Private Policy, Public Health and the Balance of Power during COVID-19

 

Róisín Costello, Trinity College Dublin

Much has been made, rightly, of the privacy impacts of contact tracing and the threat to civil liberties posed by the tracking technologies employed for public health purposes during the COVID-19 pandemic. In the United States, a period of protest and pandemic have overlapped leading to concern over the identification and targeting of protesters under the guise of public health concerns. Globally, the response to COVID-19 has raised concerns about the differential impacts of tracking technologies, questions about how States should define necessity in assessing compliance with data protection law in the context of a public health emergency, and uncertainty over whether tracking technologies can be considered as effective as traditional public health and epidemiological modelling. What is perhaps more concerning, however, is what the pandemic has highlighted about the interaction of government’s public policy capacities and private, digital platforms.

 

In responding to COVID-19 States formulated a public health response premised on activating the capacities of digital technologies to track outbreaks of the virus, on the understanding that the collection and analysis of such information could maximise the efficacy of prevention mechanisms and resource allocation in national public health system. In general, States adopted a model which would see an app downloaded to an individual’s phone or other personal device and which would monitor their proximity to, and contacts with, other individuals to track possible transmission and exposure. Within those policies adopting tracing apps two broad approaches were identifiable - decentralised’ models of contact tracing and centralised ones.

 

In ‘centralised’ models individual devices collect and provide data to a centralised database on a remote server which would be used to conduct contact tracing, risk analysis and to distribute alerts. In contrast, in decentralised models individuals are afforded more control over their data by keeping it on their device. For various reasons, ranging from a desire for greater information about transmission and exposure patterns, to a desire for greater privacy different States adopted policies favouring one of the two models. So far, so normal.

Enter Google and Apple who effectively operate a monopoly on the app market through their software on which a majority of personal devices worldwide rely. Leveraging this position the companies effectively monopolised the model of contact tracing which could be adopted by States by stating, in April, that they would develop a system to support the operation of Bluetooth contact-tracing apps but that only decentralised apps would be supported. This position, the companies argued, was necessary to protect user privacy, by granting individuals maximum control over their data and preventing it data from entering a large, centralised database where it could be analysed to impute broader patterns, relationships or characteristics.

This privacy friendly position is not without irony given the record of both companies, but Google in particular, in monetising the maximisation data collection, centralisation and analysis as a core aspect of their business model. All well and good for private industry to compile detailed profiles on individuals based on data harvested from a personal device – quite dangerous for State actors to do the same, so the logic appears to go. However, this doublethink is not the real issue. The outcome of the adoption of a decentralised model for individual privacy is, after all, positive.

The real concern, which this development highlights, and which Apple and Google’s posturing about the importance of individual privacy distracts from, is the power of private actors to subvert State actors by displacing the objectives and strategies developed as part of the public policy process (however one may disagree with the content of that public policy itself). Public policy refers to a course of government action (or inaction) in response to conflicts or matters affecting the public or public goods, and operates as a mechanism of asserting State power - one which operates not only through formally approved legal standards (such as legislation, statutory regulation or procedural rules) but also with the less formal practices and implementing behaviour of the State and State actors.

Harold Lasswell, who is generally recognised as having developed the field of public policy from the early 1950s specifically articulated public policy in this manner as seeking to advance democratic governance, and secure the public good through integrating key social values into the decision making structures, conduct, standards, rules and regulatory and legal principles which govern the activity of State actors.

I have written, elsewhere, about the power which private actors in the digital environment have come to exercise over those values traditionally advanced and protected through the public policy process. Ultimately, in the European Union, this influence has been enabled by complex and systemic factors but it is, on occasion, facilitated by the sheer market power which dominant companies like Google and Apply enjoy.

The ability of both companies to determine how State actors responded to, and interacted with, citizens during a global public health crisis – and to ordain those values which should win out in the policy response to COIVID-19  is perhaps the most striking example of what I articulate as the rise of private policy – that is the growing capacity of private actors, specifically those located in the digital space, to control which and in what manner values and objectives can be achieved by State actors. While, to date, private policy has succeeded largely in those spaces where the protection of fundamental rights, or the understanding of State actors of digital technologies has faltered, the control exercised by Google and Apple over the response to COVID-19 may indicate a more brash exercise of the same capacity.

Of course, private actors have long sought to influence the agendas and priorities of States. However, what distinguishes private policy from its public counterpart is its fundamental orientation to the pursuit of those ends most advantageous to the private actors – rather than democratic outcomes and the public good. While we might be able to agree that a decentralised contact tracing model is good for individual privacy we can, equally, acknowledge that the process that achieved that end is one which fundamentally challenges the health of the public policy process and the location of power within that process – both State power to direct its own policy, as well as the power of citizens to effectively control policy (to an admittedly flawed extent) through the election of State actors.

The Digital Services Act package may offer a mechanism to redress the dominance of private actors like Google and Apple, and their attendant capacity to dictate policy positions as in the case of the COVID-19 tracing apps. However, there has been little attention to the more fundamental trend of private policy, and market mechanisms such as those proposed in the DSA package fail to answer how the more systemic dominance can be addressed.

Róisín Costello is a PhD candidate at Trinity College Dublin where her research focuses on the intersection between private actors and public norms in digital spaces. From September 2020, she will be an Assistant Professor at the School of Law and Government, Dublin City University.

Suggested citation: Roisin Costello, 'Private Policy, Public Health and the Balance of Power during COVID-19' COVID-19 Law and Human Rights Observatory Blog (17 July 2020)

http://tcdlaw.blogspot.com/2020/07/private-policy-public-health-and.html

Return to home page of the COVID-19 Law and Human Rights Observatory.