Scope of Use
  • 120 COVID contact tracing apps are available in 71 countries, 60 digital tracking measures have been introduced in 38 countries.
  • Nevertheless, these applications differ widely in their intrusiveness, what sort of data they collect, whether they are (de-)centralized, which technology they are based on, whether they are mandatory and whether they are managed by the state.
  • 30 apps (25%) use GPS as the primary movement tracing method.
  • 43 physical surveillance measures have been adopted in 27 countries.
  • Drones have been used in 22 countries to help enforce lockdowns.
  • Europe introduced more surveillance measures than any other region.
Technological robustness and efficacy
  • Research shows that centralized movement tracking apps which monitor movement of the citizens is the most efficient anti-contagion method (e.g. Urbaczewski & Jin Lee, 2020; Ryan, 2020)
Impact on citizens and society (blue=pos, red=neg)
  • One of the common criticisms of using digital movement tracking is that it will lead to a permanent change in societal habits and behaviours, people altering (consciously or unconsciously) their behaviour as they know that they are being surveyed. This can lead to an altered level of trust in government.
  • Movement tracking apps also infringe privacy and are usually not voluntary, meaning that individual’s right to privacy is being violated.
  • Movement tracking sets a dangerous precedent for ubiquitous surveillance, infringing both individual and collective rights and the fabric of society.
Governance and Accountability
  • Many national legislation has been altered during the Corona crisis to allow for more intrusive methods of surveillance to trace the spread of the virus and monitor quarantines.
  • We have not been able to determine whether appropriate democratic processes were followed and whether the different legislations provide for a sunset clause for each and every legislative process.
  • We underline the importance of a democratic debate around AI driven surveillance and tracking measures.
Acceptable trade-offs in times of crisis

Governments must choose from multiple anti-contagion approaches that have varying levels of effectiveness and intrusiveness. While it is ideal to implement approaches that are the least intrusive and most effective, unfortunately, sometimes there has to be a trade-off between effectiveness and intrusiveness. For example, a measure may be more effective, but far more intrusive; while others maybe not only less intrusive but also less effective (Gerards, 2013). It has been proven in practice that the more privacy-intrusive movement tracking apps are more efficient at containing the spread o the virus as it is possible to monitor in a centralized manner which individual has been in contact with whom, track and instruct one immediately, and monitor one’s quarantine. Hence, the question of what an acceptable trade-off between public health and privacy is comes down to a cultural context, and how much individual rights are valued over public good, or vice versa.

South Korea Movement Tracking

South Korea has adopted the use of COVID contact tracing apps to track and monitor the spread of the virus among its citizens. Several private and public organisations assess the data such as GPS data, times and locations and travel routes. The data is given to the Korea Centers for Disease Control and Prevention (KCDC) to be published (without personal identifiers) on the government’s website.

We have assessed the use of COVID contact tracing apps against the 24 requirements of the “Framework for Responsible AI in times of Corona”, divided into 3 categories: (i) Society; (ii) Technology; and (iii) Governance.

NB. We assessed this application in its South Korean context.

Each requirement is given a score from ‘0’ to ‘3’:

0 = unknown

1 = no compliance

2 = partial compliance

3 = full compliance



  • Change in societal habits and behaviours due to constant monitoring
  • In some cases, the tracing unveiled or inferred embarrassing personal details
  • Restaurants, shops and other business premises that infected individuals had visited often experienced an abrupt loss of business (Park et al., 2020)
  • Impact on the human right to privacy
  • Mitigating the spread of the virus saves lives
  • Publication of data can lead to profiling and unveil personal data
  • Individuals affected can be subjected to public disdain
  • Public shaming infringes the rule of law and respect for privacy
  • The Infectious Diseases Control and Prevention Act (IDCPA) states that the public has a right to know if they have been in contact with infected individual
  • KCDC respects the existing Korean legislation
  • In 2015 the legislation was changed to allow for more privacy infringing practices of the government
  • The KCDC only collects essential data, they ensure that access is limited and their platform runs on a private and well-secured network (The Republic of Korea, Cheong Wa Dae, 2020).
  • The Korean Government also claims that “there has been no damage suffered by infected individuals as a result of their travel history being made public. It is very difficult to identify an individual with just that information” (SeungCheol, 2020).
  • The Korean Government stated that, despite their best efforts, privacy infringements may still occur.
  • Some individuals do not consent to their data being used
  • The behavioural ‘chilling-effect’ on people is not considered in the AI’s deployment
  • Unknown
  • Making data public has contributed to or exacerbated existing stereotypes, discrimination and stigmatisation in Korea, including “outing” patients, false identifications, “witch-hunts”, and abuse towards those who spread the virus
  • Contract tracing is mandatory for everyone. Whether everyone can comply to this mandate is unknown


  • The aim is to identify the contacts of an infected individual to reduce the transmission rate and spread of the virus.
  • The dilemma with all anti-contingency measures is a trade-off between intrusiveness and efficiency. The Korean movement tracking approach might be the most intrusive but is also the most efficient way of tracing the spread of the virus and monitoring individuals from spreading the virus. The other measures such as the decentralized Bluetooth contact-exposure apps have been proven to be less efficient at this (Ryan, 2020).
  • Compared to other countries, the use of contact-tracing allowed Korea to control and detect the early spread of the virus
  • It is worth comparing Korea’s response and outcome with a similar country, but one that took different actions (Spain). Both Spain and Korea have a similar population size, gross domestic product (GDP), infrastructure, epidemic/pandemic preparedness, high elderly populations and both witnessed strikingly similar early Covid-19 statistics early on in the outbreak. Both countries were on very similar trajectories, but the early actions by the KCDC caused strikingly different outcomes. While digital contact-tracing is not the sole outlier, it certainly contributed to Korea being able to conduct effective testing and control the early spread of the virus, which was not available in Spain. Also, Korea witnessed a comparatively low death rate because of early detection and treatment, access to healthcare, hiring extra doctors and opening hospitals for public use (Dowd et al., 2020; Hauser et al., 2020; Son et al., 2020).
  • Unknown whether an identification of adverse effects took place
  • Only essential data is collected
  • Its access is limited
  • Privacy infringements may still occur
  • Digital contact tracing has been used for approximately 35% of all cases in Korea
  • Unknown
  • It is simple to intervene in the decision that an AI
  • Usually, it is only done after a subject complains about the system


  • There is clear legal basis for collecting personal data during disease outbreaks was prepared after the 2003 SARS and 2015 MERS outbreaks, respectively, when the government learned that tracing the movement of infected and exposed individuals is crucial.
  • The Infectious Diseases Control and Prevention Act (IDCPA) states that the public has a right to know if they have been in contact with infected individual
  • Comes down to a cultural context
  • 80% of Koreans accept privacy infringements to fight the epidemic
  • Movement tacking is seen (by those being affected) proportional
  • Korea’s privacy laws (PIPA) limit the risk of function creep
  • Access to the data is limited
  • Yet, it is not set to stone whether the technology is being used for other purposes
  • Strong degree of transparency in the Infectious Diseases Control and Prevention Act (IDCPA) legislation
  • Korean government publish their findings and notify citizens about how to protect themselves
  • The approach has received 89.1% support from the public
  • The download of the contact-tracing app is mandated
  • The time-boundedness for digital contact-tracing is a little less clear. Their official announcement in April 2020 stated: “The platform operates on an interim basis, and all the personal data stored in it will be deleted once an official response to COVID-19 is complete” (The Republic of Korea, Cheong Wa Dae, 2020, p. 45).
  • Nevertheless, no clear metrics nor conditions have been given under which the contact-tracing would be dropped.
  • Decisions on the application was made solely by the government
  • Proper documentation is available on the workings and use of the AI system

Assessment prepared by Christofer Talvitie