Removing administrative barriers, improving regulatory delivery

 Testing: methods, services and capacity – avoiding regulatory barriers while ensuring reliability and safety, and managing priorities

Widespread testing, made available as easily and broadly as possible, has been shown to be the foundation for the most effective responses to coronavirus (COVID-19) – e.g. in Korea and in the city of Vo’ (Veneto, Italy).3 Crucially, testing widely and without “entry barriers” (e.g. with no excessive regulatory restrictions for test methods and kits approvals, testing locations, testing accessibility for patients, and laboratory analysis) was effective in bringing the spread of the virus under control even though it had already reached alarming growth rates, case numbers and transmission (e.g. in Korea).4

In a number of jurisdictions, however, the availability of testing was or still is limited not only by issues of physical availability (of reagents, laboratory equipment, staff and facilities) but by regulatory barriers affecting testing methods and/or delivery.5 While many countries have given priority to testing critical cases entering hospitals/ICUs, it is also crucial to maintain and expand the possibility of testing for asymptomatic or light cases. Indeed, this has shown to be both effective at reducing spread quickly, and a more cost-efficient (when considering financial, economic, and human costs), compared to extended, total lockdowns.6

The main barriers found to affect the availability of testing were the following:

• Delays in approving testing methods: in certain countries (e.g. the US),7 the start of testing was delayed by the complexity and demands of validation/authorisation procedures. Such approval processes may have resulted in several weeks of delays, which has been shown to correspond potentially to tens of thousands (if not more) of additional cases.8

• Regulatory barriers to adopting methods already established and validated in other countries: recognising methods designed and validated by international organisations (e.g. WHO) or foreign countries with a demonstrated competence in virology and infectious diseases control can save precious time. For instance, instead of developing its own testing methods, Italy simply officially endorsed the testing protocols developed by WHO, and by the Charité hospital in Berlin.9

• Limitations on the participation of laboratories, even when these have the necessary accreditation for this type of testing, the required equipment and secure facilities, and appropriate personnel. Korea, learning from previous crises (MERS in particular), enlarged its testing network to encompass all laboratories with appropriate capacity.10 By contrast, other countries (e.g. Italy or France) have (at least initially) strongly restricted the authorisation to test for SARS-CoV-2. In such countries, only a small number of hospital or research laboratories were authorised to conduct tests, based on a list approved for each territorial unit. Though the list was gradually enlarged, it remained quite restrictive for a long time.11 Such restrictions usually appear to relate to legacy systems and regulations on epidemic controls, dating back to a very different context, and are a good example of regulations that would require regular revisions to remain “fit for purpose”.12

Relaxing barriers that limit the participation of public or private laboratories (for- or non-profit alike) in providing testing services for pandemic response can bring major benefits, as well as removing barriers that may limit the opening of “off-premises” locations.13 This can have a positive impact both on the overall testing capacity, on the ease of access to testing for citizens, and on the availability of testing across the territory.

In addition, however, two issues should be taken into consideration:

• Costs: in countries with a single-payer health care system or other publicly funded health-care coverage, governments may have been or still be reluctant or unable to cover the increased costs of tests provided by laboratories outside of the public provider network, and/or to approve testing for patients that do not fit strict guidelines for selection. These concerns, though understandable, conflict with the public health objective to cover as large a share of the population as possible, which is critical, particularly given the high asymptomatic share and the low specificity of COVID-19 symptoms. In such cases, while it remains desirable that tests continue to be covered as widely as possible by public funds and/or the public health service to ensure allocation of scarce capacity based on need, prohibiting the private (non-reimbursed) provision of testing services may result in restricting the overall testing coverage, thus worsening overall health outcomes (as seen e.g. initially in some Italian regions, or in France). Rather than prohibiting outright the provision of testing outside of the public network and/or outside of strict case guidelines, governments could simply opt to allow for testing by private laboratories, provided that patients pay for the tests themselves, that privately funded testing does not reduce testing capacity available in the publicly funded system, and of course as long as said private or “out-of-network” laboratories have the adequate competence and safety measures (as demonstrated by relevant accreditation).14 As the actual testing costs15 for laboratories are overall low,16 the price of such tests could be left free or capped, depending on competition and market conditions. Thus, the single-payer (or other publicly funded) system would continue to cover testing in a more restricted network and in a more tightly defined set of situations, but voluntary testing (paid by patients) would be available more broadly.

• Supply: testing, as long as a broader variety of testing methods is not available and/or validated, can be hampered by insufficient supply of key reagents. While this is not a regulatory issue per se, it can prevent relaxed testing regulations from bringing about the desired effects (and it can be worsened by regulatory issues). Early lessons indicate that, to ensure that adequate testing supplies are available, governments could17:

  • Request all laboratories with adequate capacity to also provide an inventory of their supplies, to allow an estimate of the number of tests that they can conduct at current stock level;

  • Request a similar estimate from suppliers (producers, wholesalers);

  • Consult with relevant industries (laboratories, chemical manufacturers, wholesalers and importers, etc.) on how production capacities can be ramped up to address supply gaps (existing or predicted). This may involve reducing or removing regulatory barriers to, e.g., i) changes in activities of chemical manufacturers (to allow for changes in production/process more easily), and ii) imports or relevant reagents, etc. (as applicable).

Since the end of March 2020, several “points of care” (POC) rapid tests for the virus causing COVID-19, as well as a growing number of antibody (serologic) tests, have been put on the market. Reliability (false negatives or false positives) remains a problem with many of them (particularly with antibody tests),18 meaning that though these tests are easier to administer, deliver much faster results, require far less equipment and less staff time, and are far cheaper overall, the laboratory-based Polymerase chain reaction (PCR) test remains necessary as the main testing pillar.19 The mass-availability of such tests is also an issue,20 as is the availability of reagents for PCR tests. Moreover, serologic tests serve to assess past infection but do not detect an ongoing one,21 suggesting that parallel use of all testing methods22 remains needed to ensure an optimal pandemic response. This means that, while ensuring reliability of new testing methods is an emerging challenge (and due regulatory supervision is required for this), removing barriers for laboratories with the adequate capacity and accreditation to offer COVID-19 PCR testing services remains an important priority.

The above lessons thus remain all the more valid. The rollout of these new tests (when confirmed as adequately reliable) should not be slowed down through regulatory barriers, e.g., restricting which health care providers can make use of them (as long as competence, reliability and safety requirements are met). Also, laboratory PCR tests (those hitherto used) will remain necessary when POC tests are not available (or as confirmation tests), and using both types of tests in parallel will be necessary to ensure the control of the outbreak.

Production and delivery of life-saving equipment: Personal Protective Equipment (PPE) and medical devices – avoiding excessive barriers while ensuring safety

In many countries, the health emergency created by the pandemic turned into a major crisis partly because of insufficient stock and availability of essential supplies and equipment, even simple and relatively “low tech” ones.23 The lack of personal protective equipment (PPE) for health care workers has significantly increased their risk of contagion and fatalities.24 For private citizens, there have been repeated shortages of such a basic hygiene staple as hydro-alcoholic gel/solution, and face-masks have initially been a very problematic item to procure (and such supply challenges might reoccur) even as the consensus has increasingly shifted towards their usefulness for contagion prevention.25 High infection and fatality rates for frontline medical workers have partly been due, from the start of the outbreak and through the spread of the pandemic, to a lack of personal protective equipment (PPE).26 In turn, fatalities in hospitals are linked not only to the inherent severity of the disease (and of co-morbidities) but, in some instances, to the lack of sufficient numbers of ventilators, and the impossibility to procure/obtain sufficient numbers rapidly enough – as well as to shortages of spare parts (valves, respirator masks etc.).27

These shortages largely have to do with the inherent exceptional aspects of the pandemic (leading to enormously increased demand on some items compared to a normal year), the insufficient level of preparedness of many countries, and bottlenecks in production and logistics capacity (compounded by the lockdowns imposed in various places to respond to the pandemic). Nonetheless, regulatory barriers have played a role in making matters worse in a variety of ways in many countries, by making it more difficult for new producers to enter the market, and for new devices to be developed and placed on the market.28 This was compounded, in a number of cases, by differences in technical norms and standards applied across different markets. In substance, however, technical standards for certain classes of products are quite similar up to certain details, which is why regulators in many cases have temporarily allowed the use of products certified under foreign standards to palliate the shortage of those allowed in “normal” times.29 While, in some cases, the high inherent risk of the products/devices warrants strict regulation, some relatively low-risk devices (such as PPE) are also subject to highly restrictive rules in some countries. Even for higher-risk devices, there may be a case for increased flexibility, particularly in a crisis.30

Among the examples of production or provision of life-saving equipment/supplies that were affected by regulatory barriers are hydro-alcoholic solution and face masks.

• Hydro-alcoholic solution (HAS): in spite of production being simple and based on commonly available ingredients, local initiatives taken to increase supply and address the shortage were slowed down initially (e.g. in France) by regulatory issues. In certain countries in Europe, it appears to have resulted from the combination of application of the EU regulation on biocides (528/2012), which prohibits placing “biocides” (including disinfecting products) on the market without an authorisations, and of a gap in some countries’ pharmacopeia (no official formula for hydro-alcoholic solution). Indeed, EU Regulation 528/2012 foresees a lengthy procedure for authorisation, which is economically unviable for most SMEs, and would anyway take far too long given the crisis context. It also foresees an exemption for the scope of application of Directive 2001/83 (Community code on medicinal products), which also foresees a complex authorisation, but exempts from it restrictive rules (and/or interpretation of rules) on what can be produced in pharmacies. Since France, when the crisis situation began, had no official formula for this product, this exemption was not applicable (but it worked in other Member States), which was solved through successive decrees taken on 6, 13 and 23 March 2020 (several weeks after the start of the pandemic outbreak in the country).31 Since the basic ingredients generally used for most HAS are ethanol and glycerine, these are ingredients that can fall under other regulations if not specifically marketed as “biocides” (a claim, which entails specific rules to guarantee efficacy). Thus, some suppliers have opted to market them as “sanitiser” rather than “disinfectant” (“marketing” as in “putting on the market”, in many recent cases for free, as these manufacturers have donated them to health care facilities), and thus avoided the need for authorisation. At the EU level, a general approval for ethanol as a biocide is in preparation (under the biocide directive), but has not been completed yet, which means that the possibility to prepare “generic” (not specifically approved) HAS fell under national regulations, and (as the crisis demonstrated) these were not always “fit for purpose” in times of crisis.

  This experience shows how a system of regulatory regimes (EU and national) created to protect the public from chemical risks and to ensure users (e.g. medical providers) that the products used meet exact specifications, can become a major barrier when the needs are far more basic and urgent. Indeed, the need was suddenly different: producing rapidly and in large amount HAS through a WHO-approved formula, using commonplace ingredients. This shows the importance of having norms that are risk-based (to avoid over-regulation), more proportionate and simpler (rather than requiring to look at three different major pieces of EU legislation and all relevant national implementing regulation), and make it easier for suppliers to address urgent needs.

• Face masks: particularly in Europe and North America, where there was no widespread habit of wearing masks, and emergency stocks had often been left to lapse after previous pandemic fears (e.g. H1N1) failed to materialise, the shortage has been particularly severe. Several types of masks exist, for various uses (protection against virus spread by the wearer, or protection from contamination for the wearer etc.) – and various procedures can apply depending on the type of mask. Overall, the following difficulties were observed:

  • Complexity around the respective roles of different regulatory agencies (e.g. the National Institute for Occupational Safety and Health – NIOSH – and the Food and Drugs Administration – FDA – in in the US, which concurrently regulate different types and aspects of face masks and respirators);

  • Complexity and length of multi-step approval process (e.g. to get an approval for a face mask by NIOSH in the US, the producer must first be registered by NIOSH);

  • Necessity, in some jurisdictions, to obtain a formal approval on top of having completed the necessary tests to assess the compliance of the product with the relevant applicable standards.

While the technical contents of the applicable regulations in the US and in the EU are quite comparable (in terms of the standards that such devices have to meet, and the testing methods), the need to obtain formal approval before marketing makes the process significantly longer and more complex. By contrast, certification by an accredited and authorised third party is sufficient in the EU (decreasing complexity, costs and length). The need for producers to be registered with NIOSH further adds to regulatory barriers. In the meantime, the FDA issued an Enforcement Policy Guidance, “allowing” (or rather: announcing that no enforcement measure would likely be taken) masks to be put on the market without prior approval under a certain number of circumstances and conditions.32 While helpful, this shows again that the rules and processes initially in place created a significant obstacle.33

In sum, it may be worth reviewing and in some cases revising regulations and procedures applicable to personal protection equipment, “massive use” medical devices such as face masks, and products such as HAS, to ensure that there is more flexibility for new producers to enter the market in case of shortage.34 This is particularly true when the regulations include both substantive norms and certification (the ones that matter most to address risks), as well as more “formal”, procedural and possibly duplicative steps (which add delays and barriers without necessarily a commensurate benefit for the public).35 This is a typical case where application of well-known good regulatory principles (risk proportionality, using the lightest possible process/procedure for the desired result, using information regulation rather than product approval when no major risk is present, etc.) can be particularly useful. Finally, even for “higher complexity, higher risk” medical devices, it is important to try streamlining approval procedures so that no additional steps are necessary beyond what is strictly needed to ensure safety.36 Examples include removing formal validation by the competent authority, which is anyway based on third-party certification, and requiring only said third-party certification to be present is also a change that can help respond to the crisis immediately, in a risk-based way.37

Some examples show that more agile and flexible regulation can enable delivery and avoid excessive barriers for producers and products to enter the market. As a result, a number of businesses have changed their production and have been able to deliver relevant supplies that would otherwise have been scarce. In Italy for instance, several businesses from the textile and paper industry have switched to manufacturing face masks and PPE, based on emergency governmental rules aimed at facilitating the production, import and the marketing of these products.38 Distilleries have now started producing sanitisers and disinfectants.39 Beyond PPE supply, regulatory flexibility can also be valuable in ensuring that there are enough health workers. In Australia, the national health professions regulator, AHPRA, has created a sub-register of professions made up of practitioners who had let their registration lapse in the last three years, and had not been subject to any complaints – allowing for the automatic re-registration of over 35 000 nurses, doctors and other health professions.40 The judgement of the relevant authorities, in all these cases, was that the benefits at this time outweighed the risks associated with this response.

 “Lockdown” and restrictions to freedom of movement – design, procedures and enforcement issues

Unfortunately, COVID-19 is both relatively easily and rapidly spread and causes severe complications in a significant number of patients. If the spread of the disease is left unchecked, the health care system can become overwhelmed. This, in turn, can result in additional virus spread (as adequate protection becomes impossible), a higher death toll from the virus (as many patients, who would otherwise survive if adequately treated, die because life-saving equipment is unavailable), and a higher death toll from other sources (as hospitals are unable to provide emergency care and life-saving treatments for other diseases because of lack of capacity). To avoid (or mitigate) such disastrous outcomes, many states have been forced to put in place partial or total “lockdowns”, whenever “track, trace, isolate” measures have proven impossible to use (e.g. because of excessive community spread already in place), or were not tried.

Such measures unavoidably encroach on individual personal freedoms, and on economic freedoms too – one aim being to manage the lowest possible encroachment compatible with the greatest possible effect. They could even be in contradiction with national constitutions, in which case they would be invalid.41 While the exact design of lockdowns is largely a matter of epidemiological management [and the many “unknowns” remaining on COVID-19 make the design difficult to optimise], some aspects of implementation and enforcement relate very directly to regulatory policy. This is the case in particular of the level of detail and prescriptiveness of rules, of the procedures and paperwork introduced, and of the way control and enforcement measures are applied, as illustrated below.

• Detail and prescriptiveness: it may be counter-productive to impose excessively precise and rigid norms on items that do not relate directly to contagion possibility. For instance, while imposing a specific safety distance between people in waiting lines, shops etc. is justified by calculations on the distance that virus projections can reach, the relevance of certain rules is sometimes less obvious. For instance, if we consider only movement on foot within a single municipality, there seems to be little meaningful difference between imposing that people not go out further than 100m, 1km or any other prescribed distance42 outside of their home (to practice whatever essential, authorised activity, from shopping to walking the dog).43 Far more rigid quarantine measures such as those applied in Wuhan (strict isolation of virus-carriers, strict lockdown at home with food being delivered to the door) may have a meaningful additional effectiveness (while impinging major costs in terms of human and financial resources, and freedom restrictions). On the other hand, there seems to be no evidence that limitations on the precise distance one can walk from one’s residence have a meaningful impact on contagion in practice.44 This type of norm tends to focus more on the details of the prescription rather than on the goal of the legislation. The goal could be to avoid contagion by ensuring that people do not get into physical proximity and contact; as this is more difficult to avoid when there are crowds, going out is restricted. However, it cannot be said that walking or cycling, for example, is a risky activity in itself from a COVID-19 perspective.45 Explaining the intent of the rule and its logic is important, and control and enforcement should focus on ensuring that key aspects of the rule are respected.

• Procedures and paperwork: several countries have imposed self-certification forms, or “permits” that can be obtained online (and do not strongly differ from self-certification). These create additional transaction costs for citizens.46 Nevertheless, adding vexation to a confinement situation that already creates significant stress might be counterproductive in terms of ensuring legitimacy and compliance over the longer-term. This measure may also create additional contagion risks during control (see also next section), particularly when the form has to be printed and handed over for verification. In addition, in some cases, the model is regularly changed, making things more complicated without a strongly convincing reason. Substantially, the self-certification (or permit) does not significantly change the legal situation for citizens of law enforcement: only the cases for which going out is specifically authorised by applicable regulations are allowed, and police forces can control and enforce compliance with these even in the absence of a permit or certification requirement. The paperwork (or electronic alternatives) has the downside of adding burden, risks, and possibilities for arbitrary use of discretion, or downright abuse,47 much as similar use of permitting and paperwork in other fields, that the OECD has long identified as problematic.48 The danger of this measure is that rather than focusing on managing the risks (people coming too close to each other, or congregating in numbers), police forces risk to end up enforcing the process itself, and such rules could contribute to less-effective policing methods.49 This would, in this case, be of little use but may undermine the legitimacy of authorities, and thus create risks for longer-term compliance, as well as potentially increasing contagion risks.

• Controls and enforcement: the questions and debates around controlling compliance and applying enforcement measures mostly relate to the following issues.

  • Clarity of rules, use of discretion, and appreciation of intent: rules on “lockdown”, physical distancing etc. have not always been clear or easy to interpret. Of course, to the extent possible, clear and unambiguous rules are preferable, to avoid abuse and maximise compliance, but there is no possibility of designing “optimal” rules, and sometimes leaving a margin of flexibility in interpretation and enforcement is necessary to avoid “regulatory unreasonableness” and excessive rigidity. In such cases, governments and enforcement agencies may want to adopt guidelines/guidance clarifying the criteria to be taken into account so as to ensure that discretion is based on transparent, risk-proportional, fair criteria.50

  • Automated and mandatory control versus emphasis on voluntary compliance and targeted controls: a certain number of countries have used automated solutions linked to their “track-and-trace” systems (see next section). While this is of course technically possible, it raises issues of longer-term legitimacy and trust. Automated control and enforcement can be perceived as an unacceptable level of intrusiveness from the state, and as being “procedurally unfair” (as automated enforcement does not leave room for assessing circumstances, mitigating factors, etc.).51 Thus, in a context where many countries already face severe crises of confidence in governments (often pre-existing but exacerbated by the crisis), the “mandatory and automatic” approach may end up significantly worsening the trust situation, and make contagion prevention more difficult. The decision should rest on a careful assessment of the local situation and of the actual level and risks of non-compliance. So far, available evidence (anecdotal, or quantitative in terms of gradual decrease of epidemic growth rates) suggests that compliance levels are overall rather high, even absent extremely coercive measures, as more and more people understand the seriousness of the situation and the need for isolation measures.52

  • “Blanket” or “random” versus “targeted” controls based on risk-assessment: the easiest approach is to control “everyone that moves” (but this requires considerable resources) or to control more-or-less randomly “any movement that is detected”. Certain police forces control more frequently in areas considered as “less compliant” from a general law-enforcement perspective, but there are numerous anecdotal examples of randomness. Experience and research on controls and enforcement suggests that more targeted efforts are more efficient and effective. Having clear and better defined criteria for risk assessment and prioritisation could also allow to minimise the risk of bias, ethnic profiling, etc. This could involve, for a start, focusing on movement of people which obviously seems to create problems in terms of confinement (larger number of people, possible creation of groups or risk of disrespect of the safety distance), rather than on solitary movement in a context where the street or road is practically empty. As data becomes available, police forces could analyse it to look at what is the pattern of violations in different areas, and prioritise areas or times of the day where/when serious violations (as opposed to any violation) take place more often. It would also be possible to analyse the contamination/epidemic spread data, and/or the increase in hospitalisations and fatal cases, and focus enforcement efforts on this basis. Finally, where a software solution exists or is introduced for people to report symptoms, or there are other means to identify possible emerging “clusters” etc., this can become a key element to target controls.

  • “Zero tolerance” versus “responsive and proportionate” enforcement:53 this is a topic that has largely been covered in many other areas of law enforcement and regulatory enforcement. “Zero tolerance” has consistently not been found to be effective, or to be marginally effective but with overwhelming negative side-effects,54 and so has recent international research on the (non-) effectiveness of fines.55 In fact, it has very often been seen to result in more adverse effects while also reducing legitimacy of the system (as it is perceived by many to be unfair). Again, “formal” violations (imperfection in the self-certification form, distance from home in slight excess of the set norm, etc.) should in principle not lead to enforcement action (at most to a verbal warning). Police forces should also be cautious not to add “interpretative” obligations (on what can be considered as “legitimate shopping”, for instance) whereas formal enforcement should be reserved to actions that actually endanger the population by creating a contagion risk. Clear, proportionate and transparent guidance and criteria for formal enforcement actions, in an environment where a large number of regulatory officials are having to interpret the application of broad prohibitions to a very wide range of circumstances, can be very valuable.56

Overall, the OECD Regulatory Inspections and Enforcement Principles and the Toolkit both can serve as guidelines for enforcement of COVID-19 related rules (OECD, 2014[2]) (OECD, 2018[3]). Control should be based on risk assessment, to the extent possible. It should be responsive rather than static, i.e. react to evolutions, changes, new assessments, behaviour and results. Control measures should not add additional risks of transmission. What is controlled, and how enforcement measures are decided upon, should be strictly proportional to the actual seriousness of the (potential or actual) infraction, i.e. the risk it creates. Enforcement should aim at reaching the goal of the regulation, not focus on “process for its own sake”. This is of course challenging particularly in situations of emergency and uncertainty, and focusing on “process” (and thus, process violations) can be easier.57 Building on the experience of many countries and regulatory areas, and on established guidance in particular from the OECD,58 governments and enforcement authorities can define priorities and methods, and criteria to establish the seriousness of a violation from a risk standpoint. This can include, for example, whether a violation is mostly formal, like a form incorrectly filled, or whether there is a substantive violation of safety distances, or other sanitary and safety norms.

 Transparency and information provision – avoiding panic, and avoiding future distrust59

While this is clearly not only a regulatory topic, the issue of information/communication, and of their effectiveness (or lack thereof) is essential to the overall success of COVID-19 response, and has significant regulatory aspects and implications. Indeed, the population’s (including the business community) trust that the measures imposed are actually effective as well as that authorities are competent, trustworthy and legitimate, is essential for effectiveness – and for continued effectiveness. Unfortunately, many governments already find themselves in difficult situations from this perspective, not only because of pre-existing trust issues, but of the way they initially responded to the crisis. This, in turn, makes it far more difficult to obtain voluntary compliance from citizens, and thus to introduce “softer-touch” measures to exit full-lockdown orders, and avoid mandatory surveillance/tracking apps, but rather use approaches that safeguard privacy and rights.60

Among the areas of communication that governments may choose to be particularly cautious about:

• Neither under- nor over-estimating the risk, or the country’s ability to cope with the epidemic: while creating panic is to be avoided, communication needs to be backed by facts, data and science, while being transparent and honest about uncertainties to foster trust. It is highly preferable to transparently convey uncertainty (“difficult to predict, we are trying to get ready”) than to risk a loss of trust by asserting misplaced certainty that later could get contradicted by facts.

• Not over-reacting, but not under-reacting: governments may be wary of the economic costs of localised shutdowns or strong measures, but the experience (starting with China and Italy) is that the economic costs of controlling the disease once the spread has “exploded” are exponentially higher. Not only is a late reaction worse in terms of health and lives, but it does more economic harm, and destroys confidence. Better act fast and targeted, and not lift measures too early.

• At a point when face masks were in short supply, a number of governments continued to communicate the initial guidance given e.g. by WHO that masks were only needed for health professionals.61 This did not seem to prevent speculation, shortages, theft etc., (as evidenced from countless news reports from countries where authorities had emphasised that masks were recommended only for medical professionals and not the general public62), but did harm the credibility of authorities once evidence accumulated, in later weeks, of the effectiveness of face masks, and of their absolute necessity in certain cases.63 This, in turn, may reduce the degree to which citizens heed future advice from governments that have been found to have given less-than-fully-transparent guidance.

• Trust in official messages is the most important “currency” that governments and public bodies have in such a health crisis. Distortion of information,64 particularly if seen as deliberate, is a sure way to squander it.65 The importance of “clear and timely communication and transparency with citizens” has also been highlighted by the European Commission.66 Again, this is all the more crucial as the obligations being imposed to fight the pandemic spread will inevitably require the compliance of most citizens, i.e. go far beyond what can reasonably be achieved only through control and coercion (at least if democratic norms are to be upheld). Voluntary compliance can be secured, but to this aim, trust needs to be maintained. Clarity on how emergency rules and measures are to be interpreted, communication and discussion on why compliance is crucial to achieve the expected outcome, and use of enforcement only for those that show to be intentionally reluctant to comply while compromising the safety of their fellow citizens are examples of essential elements that can contribute to building such trust. Stakeholder engagement and co-operation between public and private sector is also crucial to maintain their trust towards government and hence also their compliance. Daily examples show how difficult it is to effectively and reliably change behaviour in the context of a health emergency, with the obvious example of even people who comply with mask-wearing requirements frequently wearing them improperly. Transparent, effective information thus is one a major priority for next phases of COVID-19 response.67

 Some elements of success in Korea

The Korean app (Corona 100m) informs the population in real time about diagnosed coronavirus COVID-19 cases. App users are alerted when they come within 100 meters of a location visited by an infected person, based on the entire travel histories of those infected.

The Korean government also provides information to the public via the “Coronamap” website, which shows the travel histories, age range and gender of confirmed cases. The privacy of individuals is protected by assigning patients a numeric ID. The travel histories are reconstructed using data from cellular phones, credit card transactions, and surveillance cameras. Another web service called “Coronaita” acts as a search engine that allows users to search for information on coronavirus-hit areas. These applications have helped citizens avoid being near infected persons and have raised self-awareness of the possibility of having been exposed to the virus, which can, in turn, help citizens decide to voluntarily self-isolate and/or visit a testing facility.77

 Applicability in other countries

Using the same approach in other OECD countries or indeed most countries worldwide with a high level of smartphone adoption and network coverage does not seem to present inescapable technical challenges - i.e. phone operators are technically able to reconstruct connections and positions going back 15 days.78 However, location data are not always sufficiently accurate to allow for effective tracing and tracking using digital tools and, most importantly, there are significant concerns linked to individual privacy and related freedoms.

Even if the initial use of data is related to pandemic response, it is difficult for governments and proponents of such system to guarantee to users that in practice the data would never be put to further use (i.e. beyond what the user has consented to, and what has been initially guaranteed). Past and current abuses, often well publicised, have made the issue of data privacy particularly salient. Irrespective of the extent to which such concern is justified,79 fostering public trust requires technological solutions to COVID-19 track and tracing that offer strong privacy guarantees.80

There is also opposition to, and justified scepticism of “automated enforcement” systems, particularly regarding the negative consequences they may have for human rights, public trust and the perceived legitimacy of authorities. These systems may involve monitoring quarantined persons 24/7 and automatically initiating law enforcement measures against them if the system indicates an unauthorised movement).81 These go considerably beyond data sharing issues, and we thus point below to the need to consider them separately and distinctly.

To offer a successful approach that can be adopted widely and remain in use to avoid resurgence of the pandemic in the future (and possibly be used for potential other epidemics in future), these justified concerns need to be addressed effectively and convincingly.

 Privacy by design

The aim is to reduce privacy loss to a minimum, both in terms of effective data protection and of citizen perceptions. To this aim, using existing instruments that can guarantee privacy by design may help avoid issues linked to determining whether an organisation or a government is “sufficiently trustworthy” (which raises unavoidable issues of subjective judgement). A technical approach that currently has strong momentum and has been increasingly adopted, in particular by virtue of being supported by both Google and Apple, is basing tracing on Bluetooth contacts, with local (i.e. “in phone”) encryption.82 Some governments, such as Italy’s, have announced that they will roll out Apps based on this approach.83 The two companies, working together, are setting a policy direction that may pre-empt the respective governments’ policy about how they would handle privacy.84 Challenges and difficulties are already visible: some governments want more control and centralisation in an attempt to ensure that public health authorities are aware of where the hot spots are and what trends are developing (e.g. France, which has decided to use Bluetooth contact detection, but with a more centralised approach that does not align with Apple/Google solutions). This raises conflicts with privacy concerns and with the protections embedded in Apple’s systems (and possibly in Google’s too).85 Critics, however, are not reassured by proclaimed assurances of privacy. In spite of many criticisms and some disappointments in terms of uptake and impact, particularly compared to some possibly excessive early expectations, some examples of successful uptake of contact tracing apps exist, and could provide useful examples.86

Another potentially effective COVID-19 digital technology combines “self-sovereign identity” and a Blockchain to ensure privacy of individuals regardless of the location / contact data source, be it network cells, GPS and/or Bluetooth. “Self-sovereign identity” represents the third generation of systems of identity management, which can give users’ sovereignty (control) over their own identification data, rather than giving this control to third parties that provide such services (for “free” or not). The technology is based on the third generation of Blockchain, which, in contrast to Bitcoin (first generation) and Ethereum (second generation) allows for a more “granular” management of the anonymity of transactions (data exchanges, contacts). Combining these elements would better guarantee citizen privacy, not constraining citizens to put their faith in the reliability and effectiveness of the organisation delegated to data protection.87 Alongside the centralised and decentralised solutions, there is a third working hypothesis: keeping information on a distributed network, using for example the combination of a Self-Sovereign Identity and a Blockchain. In this hypothesis, trust does not need to be placed either in a third party (centralised model) or in the device technology provider (decentralised model).

 Possible ways forward: avoiding over-reach

One of the many challenges presented by the COVID-19 pandemic is the vast number of infected people, and the significant share of asymptomatic people88, making “traditional”, human-based tracing costly and difficult. While, when applied consistently, “traditional”, human-driven contact tracing can be very effective, the pandemic has strained the capacity of many countries to conduct it with existing resources, hence the persistent interest in digitally enabled contact tracing.89 The question of international mobility and contact tracing is also problematic, and whether and how contact-tracing applications (apps) in different jurisdictions may effectively communicate with each other remains an open question. It is important to use technology to complement and expand traditional tracing methods (not to replace it), and to provide an “early-warning” system for emerging outbreaks/clusters.90 Some of the factors that appear able to assuage, at least partly, justified concerns about excessive surveillance and loss of individual rights are the following:

• Setting up a tracing system only without automated enforcement of quarantine measures (rather, control and enforcement measures remain done in a more compliance-promoting, trust- and risk-based approach, emphasising voluntary compliance supported by active public communication, and using targeted, “human” and non-automated enforcement actions only);91

• Giving the information about past or current proximity to infected persons to each user, but not to a centralised system.

The information about locations could be either kept strictly in individual phones (as in the Bluetooth-based approach92), or kept in a centralised database that is totally anonymised through encryption (e.g. combining a central database of locations, and resolution of identities through decentralised use of Blockchain). The resolution of anonymity could then only be done upon the request of each individual user, and only for his/her own positions. Thus, were a person diagnosed as infected, the system would know that there was an infected user, but not that user’s identity (the Blockchain option makes this possible even when there is a central database to register locations, as only each individual user can resolve his/her own identity) – or the “match” would only happen between the users themselves, without any centralisation (e.g. using Bluetooth to detect other users and “ID” them).93 Other users are notified if the resolved “keys” showed that they were among the people in the vicinity of a person now known to be infected.

Those who have been in contact or proximity with this infected person would receive the notification from the system that this contact has taken place and that they should be tested – but no information on who this person is/was. Thus, privacy would be kept constant at all stages, and only the affected users would be notified. To ensure full effectiveness, the health system should then treat such notification as a valid reason to be tested for infection.

In addition to this key functionality (tracing of cases and notification to potentially infected people, so that they can get tested as soon as possible), a feature used in Singapore could be added which allows users to easily notify any respiratory or related symptoms that they currently feel. The aim would not be to provide an approximated and possibly misleading “diagnosis” but to crowdsource identification of possible “clusters” and spread of contagion. While individual symptoms may not necessarily be significant enough to determine infection, a large concentration of reports indicating potentially COVID-19-related symptoms in a location would denote a very high probability of spread in this area. This could then form the basis for a rapid public-health intervention (testing in the identified area). Such a functionality would be easy to add, and would be voluntary, so that no significant privacy issue is at stake.94

Beyond specific choices and solutions, data exchange and interoperability, and effective use of multiple data sources, may offer more chances of success than attempting to solve the issue of tracking contagion and spread through one single system.95

 Regulatory policy dimensions

In terms of regulatory policy, the first and most central question is often the reconciliation or balancing of privacy and effectiveness issues. While creating a centralised repository or “tracking” using a multitude of sources (including, as in Korea, surveillance cameras or banking terminals data) could increase effectiveness of localisation, it may reduce the uptake of the solution (both in terms of the number of countries adopting it, and of number of users/citizens adopting or supporting it). Bluetooth-only, for instance, does not provide location data, but raises fewer concerns and thus would be more likely to be adopted and sustained. As mass adoption and support are essential for the system to be effective, a trade-off that protects privacy and related freedoms better may in fact end up being more effective. Thus, a comprehensive view not only of technical issues, but also of enforcement and legitimacy issues, is essential to design the most adequate solution.

In addition, much can be achieved by integrating and managing better data that is less directly “private” (location, contacts) and is held by the health system, but not necessarily analysed in real time. Estonia, for instance, has successfully used its pre-existing data integration96 to make efficient use of test results in tracking epidemic spread.97

Other key considerations for such a system are whether to incorporate a mandatory element or not (e.g. make the installation and use of an app mandatory if one wishes to go out during the lockdown period), whether to apply automated enforcement (e.g. of quarantine / self-isolation orders), or whether to make the system as respectful of privacy and of individual rights98 as possible,99 and as reliant on voluntary compliance as possible. Any measures reducing privacy (because the benefits are particularly large) could be subject to sunset provisions after a specified time or when a specific trigger occurs (for example, the ending of a public health state of emergency). Such a trigger could allow the system to be reinstated if another public health state of emergency need to be initiated at a later stage, without having to introduce legislation again. Despite the obvious challenges of making people comply voluntarily (including limited ability to do so in particular for less advantaged socio-economic groups or in emerging or low-income countries), as well as technical considerations such as the effect of an app on smartphones’ batteries, avoiding the most “coercive” approach may yield real benefits in terms of legitimacy and long-term sustainability.

To promote more voluntary use and compliance, governments could mobilise trusted “voices”, explain via all media channels how the system is intended to work and protect people, and showcase how successful use of “track-and-trace” has been an important element in some countries’ ability to remain “open”,100 whereas failure to do so makes lockdowns far more difficult to avoid or exit.