COVID-19 tracing app in Serbia

Governments across the globe are increasingly using digital tools to accelerate the tracking of people infected with COVID-19 and their contacts as a key measure to prevent the pandemic’s spread. Among potential solutions, contact tracing mobile applications have emerged as the most used and discussed, and it is likely that many governments, including Serbia’s, will include them in national public health efforts. Nevertheless, issues of privacy and data protection, and low public trust and user acceptance can prevent these apps from being used, which is why Serbia’s government needs to ensure a good understanding and respect of citizens’ concerns before proceeding with the implementation of one. Given the comprehensive EU-level discussions towards finding the best possible common solution aligned with the Union’s robust personal data protection policies, little can go wrong if Serbia follows European approaches. This can also help reaffirm the country’s pro-European orientation.

Context: Mobile apps as the leading solution for tracing COVID-19 infections

Tracking infected people and their contacts is increasingly being recognised as a key measure to prevent future outbreaks of the COVID-19 illness. Most recently, the German chancellor calmly explained to her nation why it is necessary for the state to track every single infection as well as all of the people with whom infected individuals recently interacted. The eHealth Network of the EU considers tracing contacts to have a crucial role in “all phases of the outbreak, especially as part of containment measures during de-escalation scenarios”.

Mobile phone apps, considering the widespread penetration of mobile technology among the world’s population, have surfaced as the most viable means to achieve this purpose. Moreover, a part of the international scientific community has affirmed that mobile apps can make the work of public health authorities faster, more efficient, and effective at the proper scale, as manual contact tracing is too slow to contain the virus. The main purpose of such apps is to notify users if they potentially had contact with COVID-19-positive individuals, even if at the moment of contact the person carrying the virus was not aware of it. Several countries have already swiftly implemented such solutions, among which Asian countries (such as Singapore, China, Taiwan, and South Korea) have emerged as the most prepared, partly due to their previous experience with the outbreak of SARS from 2002 to 2004 and partly due to the continent’s generally advanced technological know-how.

The discussion about introducing contact tracing technology has also quickly taken root in the developed Western world. At least 14 EU member states have already initiated or considered developing contact tracing apps. News about Google and Apple joining forces to come up with software compatible with both Android-based devices and iPhones emphasised the importance of private sector partnerships, but also public-private partnerships, leaving governments little option but to support the two giants responsible for the technology behind practically all smartphones used today. Yet, in the Western world, the concept of developing tracking apps immediately raised numerous concerns related to the protection of privacy and personal data, as well as to whether the data collected through the apps would be stored in a centralised or decentralised manner. Europe has been the leading actor promulgating these concerns, a role which can easily be traced back to its recent achievements in raising the standards of data protection through common EU legislation.

Although in Serbia a larger-scale public discussion on contact tracing technology has not yet been opened, the digital orientation of the incumbent government makes it likely that the country will soon follow wider trends towards implementing a contract tracing app. Additionally, practices in Serbia’s neighbouring countries (such as in North Macedonia, where the government launched the “StopKorona!” app that is open source for reuse) are likely to induce positive pressure on Serbian authorities. As a country aiming to join the EU, Serbia is expected to gradually adopt the Union’s principles and legislation, which opens the question of with which models and how transparently Serbia should approach this issue going forward.

Problem: The dilemmas and unanswered questions of contact tracing apps

As mentioned above, issues of protecting personal data and privacy are core to the discussion on the introduction of contact tracing apps. Questions of what personal data is to be collected by whom, stored where, and managed in what manner, have dominated debates. The least privacy-threatening model proposed so far is a solution based on Bluetooth communication between mobile phones rather than on tracking individuals by GPS location. This Bluetooth model is already being applied in some countries, including, for example, Singapore and North Macedonia.

This preferred model is nevertheless not without flaws, particularly in relation to the efficacy and accuracy of Bluetooth technology, as well as the limits of user acceptance and public trust in government measures. Some sources, for instance, point to the risk that Bluetooth could show false contacts due to issues with measuring proximity. This could happen, for example, if the phones of neighbours communicate through walls or different floors of the same building, or in the open air if people cycle close to each other. Consequently, people who do not interact with an infected person can still potentially receive a notification which could cause unnecessary worry.

Another important issue to consider is the threshold of the number of users needed for such an app to achieve its purpose. For any user, a benefit-cost ratio informs their decision whether or not to download the app. Apart from a very small percentage of highly vigilant and ethically motivated citizens, most citizens would find downloading such an app to be a nuisance with little perceived benefit. The continuous use of Bluetooth uses up a phone’s battery power, for instance, which reduces the willingness of users to keep such an app switched on. Another concern relates to those parts of the population that do not use, or consistently carry, smartphones. Therefore, the problem of “free riders” naturally emerges in this discussion, as this contact tracing system is essentially voluntary, relying on people’s consciences to use the app. Experts have warned that at least 60% of the population is needed to participate for the app to work to its desired effect, which could present a difficult hurdle to overcome.

The question of user acceptance further leads to what is probably the greatest factor of all: trust. It is highly probable that in countries and societies with high levels of social trust and, particularly, trust towards public authorities and institutions, the uptake of such apps will be higher. Surveys done in countries with higher levels of trust have shown people to be surprisingly in favour of downloading an app of this type or keeping it on their phone if it was to be automatically installed by their mobile operator. Yet, even in these countries, privacy and security-related concerns still represent a major hindrance to installing such apps, as respondents tend to be concerned that such an app might have the potential to be used by government to increase surveillance after the epidemic or that their phones “might get hacked”. This discussion reveals that understanding and addressing people’s fears is essential in formulating a method of tracking people’s contacts through their most personal devices.

In the need to address the aforementioned problems, the EU’s Data Protection Supervisor has called upon member states to work towards a joint solution in providing a single, EU-wide COVID-19 tracing app, ideally with coordination from the WHO, and perhaps motivated by the need to restore freedom of movement in the single European market. Additionally, the EU’s eHealth Network recently issued a toolbox for member states, proposing a set of recommendations for a common approach and expressing key requirements for any app being built: that it is to be “voluntary, approved by the national health authority, privacy-preserving, and dismantled as soon as no longer needed”. These recent EU developments present a framework in which Serbia – an EU aspirant – should search for its solutions.

Prospects: A way forward for Serbian policymakers

In developing a new, or adopting an existing, mobile app in Serbia, decision-makers should carefully consider the dilemmas and concerns discussed above. Future solutions should be based on a sound understanding of people’s worries and implemented so as to minimise them. The recommendations suggested below may offer some guidance to experts and decision-makers charged with this task.

Although most recently the media has referenced citizens’ high levels of trust in the Serbian leadership’s actions in fighting the pandemic, outside of a heated crisis, Serbian citizens generally tend to have low levels of trust in the key institutions of the state. Therefore, an important question to consider is how to generate and retain the trust needed for citizens to download and use such an app. Before proceeding with a solution and promoting it as the latest token of the government’s digital orientation, policymakers should implement a survey of a representative sample of citizens to learn about their willingness, concerns, and priorities in relation to this policy. Based on a sound understanding of those issues revealed in the survey, there are at least two sets of measures that the government needs to take.

1. The development and implementation of the mobile app need to be done in full transparency, preferably including partners engaged in topics of government accountability, open data and personal data protection from within Serbia’s vibrant civil society and tech community. Only with stakeholder involvement and scrutiny can such efforts yield positive results and, more importantly, ensure public trust.
2. The government needs to implement a short, but wide-reaching communication campaign, addressing concerns and providing key information and clear, simple and reassuring messages. This communication strategy needs to be prepared and delivered by professionals, not politicians, and must be inclusive rather than divisive. Messages which intimidate or shame citizens, include inconclusive and vague information, potentially leaving people with more questions than answers (as happened at the start of the COVID-19 crisis’ management) should be entirely absent from this new phase of fighting the pandemic.

The Serbian Government has a good chance of confirming its pro-European orientation by allying with its EU partners in the search for a solution. Since the Serbian personal data protection law is already relatively closely aligned with the EU’s GDPR, the government simply needs to comply with its own legislation in implementing this technological solution. Moreover, considering the high frequency of interaction between Serbia’s population and that of other European countries (much more so than with the rest of the world), as well as the country’s overall interest in establishing normal travel arrangements with its main economic partner, adopting European solutions in this matter simply makes sense.

In sum, although a plethora of options for digital contact tracing is available to the Serbian Government in the fight against COVID-19, the government must assess the crucial dilemmas accompanying them and build an understanding of the population’s concerns before implementing one. Bluetooth-based apps have stood out as the least worrisome solution for data privacy so far and represent the logical choice for the Serbian government. It is essential that the process of introducing such an app is as transparent as possible and ensures the inclusion of civil society and the tech community. Emulating best EU practice can help to avoid mistakes in the sphere of personal data protection for example, and can help to support the country’s pro-European orientation.

This text is published as a CEP policy brief. The brief is available for download here. (English)