Facing Surge in Virus, European Countries Try to Fix Their Covid Apps

“Data protection is not what comes to mind firstly when someone starts developing an app,” Victor Klos, a senior specialist at the Dutch data protection regulator, said at a conference organized by a European data protection regulator last week. The Dutch CoronaMelder app became available nationwide this month, and uses technology built by Alphabet Inc.’s Google and by Apple Inc.

Many European countries now use Google and Apple’s technology, as do 10 U.S. states, including New York and Pennsylvania. Government authorities in different European countries argued the technology could help protect users’ privacy because it operates with random codes that don’t reveal an individual’s identity. These apps also store most data directly on users’ cellphones, only sending some information to a central server.

Yet Mr. Klos sees problems. For example, the technology could still endanger users’ privacy because it might be possible to see who receives a lot of random codes indicating they were close to other users with a positive Covid-19 diagnosis.

“We should refrain from calling this anonymous,” Mr. Klos said.

Other countries that introduced apps months ago have added features to help them assess how well the apps work. That can be difficult because the privacy safeguards built into the Google and Apple system also prevent authorities from seeing details that would help make such evaluations.

For instance, users of the Danish app Smittestopp can voluntarily report through the app if they test positive for coronavirus. As infection rates climb in Denmark, authorities are now observing that more people submit that information, said Birgitte Drewes, a manager at the Danish Patient Safety Authority, speaking at a different conference organized by the European cybersecurity agency last week.

#g-COVIDAPPS-Europe-box.ai2html_export { max-width: 700px; width:100%; margin: 0 auto; } .g-aiImg { margin-top: -1.2px; } .g-_valign { margin-top: -2px; } div[class^=”g-_textoutline-white”] { text-shadow: -1px -1px 0 #fff, 1px -1px 0 #fff, -1px 1px 0 #fff, 1px 1px 0 #fff; } div[class^=”g-_textshadow-white”] { text-shadow: 1px 1px 2px #fff; } div[class^=”g-_textoutline-black”] { text-shadow: -1px -1px 0 #000, 1px -1px 0 #000, -1px 1px 0 #000, 1px 1px 0 #000; } div[class^=”g-_textshadow-black”] { text-shadow: 1px 1px 2px #000; } div[class^=”g-_textoutline-grey”] { text-shadow: -1px -1px 0 #dddddd, 1px -1px 0 #dddddd, -1px 1px 0 #dddddd, 1px 1px 0 #dddddd; } div[class^=”g-_textshadow-grey”] { text-shadow: 1px 1px 2px #dddddd; } @media all and (max-width: 585px) { .at4units .ai2html_export { max-width: 355px !important; } } @media all and (min-width: 586px) and (max-width: 665px){ .at4units #g-COVIDAPPS-Europe-box.ai2html_export { max-width: 540px !important; } } .at8units #wsj-article-wrap .inline .ai2html_export, .at8units #wsj-article-wrap .offset .ai2html_export, .at8units #wsj-article-wrap .bleed .ai2html_export { margin: 0 auto; max-width: 620px; } #g-COVIDAPPS-Europe-box .g-artboard { margin:0 auto; } #g-COVIDAPPS-Europe-box p { margin:0; } .g-aiAbs { position:absolute; } .g-aiImg { display:block; width:100% !important; } .g-aiSymbol { position: absolute; box-sizing: border-box; } .g-aiPointText p { white-space: nowrap; } #g-COVIDAPPS-Europe-box tspan { position:relative; overflow:hidden; } #g-COVIDAPPS-Europe-box tspan p { font-family:Retina,Helvetica,Arial,sans-serif; font-weight:300; font-size:13px; line-height:17px; height:auto; filter:alpha(opacity=100); -ms-filter:progid:DXImageTransform.Microsoft.Alpha(Opacity=100); opacity:1; letter-spacing:0em; text-align:left; color:rgb(51,51,51); text-transform:none; padding-bottom:0; padding-top:0; mix-blend-mode:normal; font-style:normal; position:static; } #g-COVIDAPPS-Europe-box tspan .g-pstyle0 { font-weight:500; font-size:18px; line-height:20px; } #g-COVIDAPPS-Europe-box tspan .g-pstyle1 { font-size:15px; line-height:20px; } #g-COVIDAPPS-Europe-box tspan .g-pstyle2 { font-size:15px; line-height:18px; height:18px; } #g-COVIDAPPS-Europe-box tspan .g-pstyle3 { height:17px; } #g-COVIDAPPS-Europe-box tspan .g-pstyle4 { color:rgb(114,114,114); } #g-COVIDAPPS-Europe-_300px { position:relative; overflow:hidden; } #g-COVIDAPPS-Europe-_300px p { font-family:Retina,Helvetica,Arial,sans-serif; font-weight:300; font-size:13px; line-height:17px; height:auto; filter:alpha(opacity=100); -ms-filter:progid:DXImageTransform.Microsoft.Alpha(Opacity=100); opacity:1; letter-spacing:0em; text-align:left; color:rgb(51,51,51); text-transform:none; padding-bottom:0; padding-top:0; mix-blend-mode:normal; font-style:normal; position:static; } #g-COVIDAPPS-Europe-_300px .g-pstyle0 { font-size:15px; line-height:18px; height:18px; } #g-COVIDAPPS-Europe-_300px .g-pstyle1 { height:17px; } #g-COVIDAPPS-Europe-_540px { position:relative; overflow:hidden; } #g-COVIDAPPS-Europe-_620px { position:relative; overflow:hidden; } #g-COVIDAPPS-Europe-_700px { position:relative; overflow:hidden; }

Seeking Unity

European countries take different approaches to Covid-19 tracking apps

Not on Google-Apple framework

Launched on Google-Apple framework

People who sign up for virus tests on a government website can voluntarily inform authorities if they previously received an app notification of exposure to an infected person. A higher percentage of people who received a notification later test positive compared with those who test positive but didn’t receive an alert from the app and got tested for a different reason, Ms. Drewes said. That indicates the app technology is working, informing at-risk people, she said.

“We’ve had to establish a different reporting structure because we can’t get the data from the app,” she said.

One way authorities measure the success of the apps is by the number of people who download them. But in some countries that hasn’t been easy. In April, the umbrella group of European data protection regulators published guidelines stating that contact-tracing apps should be voluntary and users should always have control of their data.

France relaunched its StopCovid app with the new name of TousAntiCovid last week after less than three million people downloaded it in a country of close to 70 million. At least 20% of the population needs to use the app for it to be effective, according to the government.

This month, Portugal’s government proposed making its Stayaway Covid app mandatory, but dropped the idea after less than a week in the face of broad criticism. Around 2.4 million people have downloaded the app since its launch in September.

The widely used technology from Google and Apple frustrates some European privacy authorities and government officials. France doesn’t use it, but other European countries with apps do.

“We still don’t really know what’s under the hood,” said Vitor Bernardo, who was an official at the Portuguese data protection regulator’s office until last month and now works at the umbrella group of European regulators.

Users of the Latvian app received confusing notifications that made them think they could be at risk, said Ieva Ilves, an adviser on digital policy to the Latvian president. The messages referred to users’ possible “exposure” in a way that made them panic, she said, though the alerts were only standard updates on how the Google and Apple technology worked.

Still, frightened users overwhelmed health authorities with phone calls asking for advice, she said. The companies changed the notifications after lengthy correspondence, according to Ms. Ilves.

“You have this confusing situation where you understand you have no legal and technical ways to influence it,” she said. “All you can do is write emails saying this doesn’t make sense.”

Write to Catherine Stupp at [email protected]