The COVID-19 global pandemic has highlighted a tension between efforts to collect sensitive personal information at scale to combat the spread of disease and potential invasions of important fundamental rights. Advancements in cryptographic techniques and other privacy enhancing technologies have allowed public health officials to move beyond manual contact tracing and consider automated contact tracing or “exposure notification” tools to help mitigate the rapid spread of illness. Yet the public continues to vigorously debate how these technologies can impact fundamental rights well beyond data protection. The panel will explore the technological, legal, and ethical dimensions of automated contact tracing and exposure notification technologies, looking for paths to reconcile tracking or data collection for public good and fundamental rights.

The discussion will be an opportunity to: i)explore the applicability of exposure notification in various use cases, and debate the merits of different cryptographic protocols and other techniques that may be used to operationalize the tool; ii) test the interplay of the fundamental right to data protection with other fundamental rights enshrined in constitutions and international charters; and iii) put in a practical context the role of technical decisions to sustain the protection of fundamental rights.

This interdisciplinary dialogue reflects the urgency to train new leadership of legality attentive data scientists and experts in data-driven technologies.

• What is exposure notification, and how does it differ from manual contact tracing?
• Do different approaches have different risks for fundamental rights and liberties?
• Use cases: Effectiveness of exposure notification for the general public versus for smaller communities or controlled environments
• Potential tradeoffs between data collection at scale and privacy harms to individuals/risk to organizations: is tracking for public health (e.g. to contain COVID-19 spreading) different from other tracking goals? Who should be setting the boundaries?
• How can technology help to create anonymous data (“personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable” GDPR refcital 26) enabling innovative technical and organisational measures to reach privacy-by-design and privacy-by-default standards? Who will be able to define and assess them? Which skills are required?