Data protection & digital privacy in the age of the coronavirus

SARS-CoV-2 (Covid-19) has infiltrated our lives, turning our world completely upside down. This unexpected visitor has brought new challenges that humanity has never had to imagine facing. This hit not only has an obvious medical side but also, the coronavirus pandemic has had a social an economic impact. In order to control the expansion of the pandemic, South Korea has shown us the path of how to apply technology to help to control the pandemic, using mobile apps to track the movements of citizens, and the possible risk contacts, providing detailed data of the citizens' exposure to the virus. This information can be critical for the health authorities to detect if any of us have been exposed to a contagious person and then force us to lock down in quarantine and proceed with analytics if needed, thereby controlling the expansion of the virus. This approach has been demonstrated as successful if we look at the results obtained by the South Korean authorities, where it seems that the virus expansion is under control.

However, applying this technology to control the pandemic has a dark side, by gathering personal or even sensitive data of the citizens provides companies or states with a powerful instrument of control of the population, that can be used for good (as mentioned above) but also for nefarious reasons. It is exactly here where the KRAKEN project can help, providing techniques to gather personal data while preserving the privacy of citizens. The innovative technologies KRAKEN project is using, such as Self-Sovereign Identity (SSI) and privacy-preserving cryptographic techniques, can help in some new challenges that we as a society need to face.

There are two main possible options to implement this type of application: a centralized approach or a decentralized approach. Both have advantages and disadvantages from a legal and health control point of view. However, on both of them the technologies researched by KRAKEN can be applied to minimize the invasion of privacy of the citizens. For the centralized approach the use of cryptographic techniques such as Functional Encryption and Multiparty Computation can allow to Central Health Authority to analyse the private data of the citizens but without having direct access to the information of a specific person. To the decentralized approach, it seems straight-forward blockchain technologies can be applied, especially if an SSI approach is applied taking advantage of the Zero Knowledge Proof functionalities available thanks to the Verifiable Credentials standards. For example, as we can select the information disclosed from a verifiable credential, the system could use a zero-knowledge proof of the identification of the end user disclosing the minimum information necessary in the control of the pandemic.

Some countries are exploring how to control the COVID-19 outbreak, and the immunity passport is one of the alternative options. Based on the premise that if someone is not able to become infected for a second time as they have generated themselves immunity against the SARS-CoV-2. It will allow that person to return to the daily life, moving freely without any of the associated dangers. Controversy on this measure has been arisen, the World Health Organization (WHO) and medical bodies alert on the limited reliability of the current tests for this purpose, and not enough information about the duration of the acquired immunity is known.

Additionally, this measure has an impact on the civil liberties and the citizen privacy. Other Covid-19 control measures impacting less on citizen privacy are related with the movement restrictions. In both cases (immunity passport or movement limitations), technology can help further to develop this type of the measurement proposed by the health authorities much faster. Particularly, the SSI approach developed by KRAKEN can be easily adapted to help with the implementation of this measurement. Using the Verifiable Credential standards can easily issue a credential to a citizen that later on can be used during his/her usual life, respecting the privacy of the end user at every single moment, as is the citizen who remains in control of his/her data at all times.

Therefore, in a critical situation with a pandemic and worldwide growing economic crisis, investigation, research and innovation, not only in the healthcare care domain, is more important than ever.