Lessons from the App Store

Executive summary

The COVID-19 pandemic is the first global public health crisis of ‘the algorithmic age’.[1] In response, hundreds of new data-driven technologies have been developed to diagnose positive cases identify vulnerable populations and conduct public health surveillance of individuals known to be infected.[2] Two of the most widely deployed are digital contact tracing apps and digital vaccine passports.

For many governments, policymakers and public health experts across the world, these technologies raised hopes through their potential to assist in the fight against the COVID-19 virus. At the same time, they provoked concerns about privacy, surveillance, equity and social control because of the sensitive social and public health surveillance data they use – or are seen as using.

An analysis of the evidence on how contact tracing apps and digital vaccine passports were deployed can provide valuable insights about the uses and impacts of technologies at the crossroads of public emergency, health and surveillance.

Analysis of their role in societies can shed light on the responsibilities of the technology industry and policymakers in building new technologies, and on the opinions and experiences of members of the public who are expected to use them to protect public health.

These technologies were rolled out rapidly at a time when countries were under significant pressure from the financial and societal costs of the pandemic. Public healthcare systems struggled to cope with the high numbers of patients, and pandemic restrictions such as lockdowns resulted in severe economic crises and challenges to education, welfare and wellbeing.

Governments and policymakers needed to make decisions and respond urgently, and they turned to new technologies as a tool to help control the spread of infection and support a return to ‘normal life’. This meant that – as well as guiding the development of technologies – they had an interest in convincing the public that they were useful and safe.

Technologies such as contact tracing apps and digital vaccine passports have significant societal implications: for them to be effective, people must consent to share their health data and personal information.

Members of the public were expected to use the technologies in their everyday lives and change their behaviour because of them – for example, proving their vaccination status to access workplaces, or staying at home after receiving a COVID-19 exposure alert.

Examining these technologies therefore helps to build an understanding of the public’s attitudes to consent in sharing their health information, as well as public confidence in and compliance with health technologies more broadly.

As COVID-19 technologies emerged, the Ada Lovelace Institute was one of the first research organisations to investigate their potential legislative, technical and societal implications. We reviewed the available evidence and made a wide range of policy and practice recommendations, focusing on effectiveness, public legitimacy, governance and potential impact on inequalities.

This report builds on this work: revisiting those early recommendations; assessing the evidence available now; and drawing out lessons for policymakers, technology developers, civil society and public health organisations. Research from academia and civil society into the technologies concentrates largely on specific country contexts.[3]

There are also international studies that provide country-specific information and synthesise cross-country evidence but focus primarily on one aspect of law and governance or public attitudes. [4]^{, [5], [6]} This body of research provides valuable insights into diverse policies and practices and unearths legislative and societal implications of these technologies at different stages of the pandemic.

Yet research that investigates COVID-19 technologies in relation to public health, societal inequalities and regulations simultaneously and at an international level remains limited. In addition, efforts to track the development of global policy and practice have slowed in line with the reduced use of these technologies in many countries.

However, it remains important to understand the benefits and potential harms of these technologies by considering legislative, technical and societal aspects simultaneously. Despite the limitations, presenting the evidence and identifying gaps can provide cross-cutting lessons for governments and policymakers, to inform policy and practice both now and in the future.

These lessons concern the wide range of technical, legislative and regulatory requirements needed to build public trust and cooperation, and to mitigate harms and risks when using technologies in public crises, and in health and social care provision.

Learning from the deployment of contact tracing apps and digital vaccine passports remains highly relevant. As the infrastructure remains in place in many countries (for example, authentication services, external data storage systems, security operations built within applications, etc.), the technologies are easy to reinstate or repurpose.

Some countries have already transformed them into new health data and digital identity systems – for example, the Aarogya Setu app in India. In addition, on 27 January 2023, the World Health Organization (WHO) stated: ‘While the world is in a better position than it was during the peak of the Omicron transmission one year ago, more than 170,000 COVID-19-related deaths have been reported globally within the last eight weeks’.[7]

And on 5 May 2023, the WHO confirmed that while COVID-19 no longer constitutes a public health emergency of international concern and the number of weekly reported deaths and hospitalisations has continued to decrease, it is concerned that ‘surveillance reporting to WHO has declined significantly, that there continues to be inequitable access to life-saving interventions, and that pandemic fatigue continues to grow’. [8]

In other words, the pandemic is far from over, and we need to pay attention to the place of these technologies in our societies now and in future pandemics.

This report synthesises the available evidence on a cross-section of 34 countries, exploring technical considerations and societal implications relating to the effectiveness, public legitimacy, inequalities and governance of COVID-19 technologies.

Evidence was gathered from a wide range of sources across different disciplines, including academic and grey literature, policy papers, the media and workshops with experts.

Existing research demonstrates that governments recognised the value of health, mobility, economic or other kinds of personal data in managing the COVID-19 pandemic and deployed a wide range of technologies to collect and share data.

However, given that the technologies were developed and deployed at pace, it was difficult for governments to adequately prepare to use them – and the data collected and shared through them – in their broader COVID-19 pandemic management.[9]

It is therefore unsurprising that governments did not clearly define how to measure the effectiveness and social impacts of COVID-19 technologies. This leaves us with important evidence gaps, making it harder to fully evaluate the effectiveness of the technologies and understand their impact on health and other forms of social inequalities.

We also highlight evidence gaps that indicate where evaluation and learning mechanisms fell short when technologies were used in response to COVID-19. We call on governments to consider these gaps and retrospectively evaluate the effectiveness and impact of COVID-19 technologies.

This will enable them to improve their evaluation and monitoring mechanisms when using technologies in future pandemics, public health, and health and social care provision.

The report’s findings should guide governments, policymakers and international organisations when deploying data-driven technologies in the context of public emergency, health and surveillance. They should also support civil society organisations and those advocating for technologies that support fundamental rights and protections, public health and public benefit.

Cross-cutting findings

Despite the complex, conflicting and limited evidence available about contact tracing and digital vaccine passports, this report uses a wide range of available resources and identifies the cross-cutting findings summarised here under the four themes of effectiveness; public legitimacy; inequalities; and governance, regulation and accountability.

Effectiveness: Did COVID-19 technologies work?

• Contact tracing apps and digital vaccine passports were – necessarily – rolled out quickly, without consideration of what evidence would be needed to demonstrate their effectiveness. There was insufficient consideration and no consensus reached on how to define, monitor, evaluate or demonstrate their effectiveness and impacts.
• There are indications of the effectiveness of some technologies, for example the NHS COVID-19 app (used in England and Wales). However, the limited evidence base makes it hard to evaluate their technical efficacy or epidemiological impact overall at an international level.
• The technologies were not well integrated into broader public health systems and pandemic management strategies, and this reduced their effectiveness. However, the evidence on this is limited in most of the countries in our sample (with a few exceptions, for example Brazil and India), and we do not have clear evidence to compare COVID-19 technologies with non-digital interventions or to weigh up their relative benefits and harms.
• The evidence is inadequate on whether COVID-19 technologies resulted in positive change in people’s health behaviours (for example, whether people self-isolated after receiving an alert from a contact tracing app), either when the technologies were first deployed or over time.
• Similarly, it is not clear how the apps’ technical properties and the various policies and approaches impacted on public uptake of the apps or adherence to relevant guidelines (for example, self-isolation after receiving an alert from a contact tracing app).

Public legitimacy: Did people accept COVID-19 technologies?

• Public legitimacy was key to ensuring the success of these technologies, affecting uptake and behaviour.
• People were concerned about the use of digital vaccine passports to enforce restrictions on liberty and increased surveillance. People protested against them, and the restrictive policies they enabled, in more than half of the countries in our sample.
• Public acceptance of contact tracing apps and digital vaccine passports depended on trust in their effectiveness, as well as trust in governments and institutions to safeguard civil rights and liberties. Individuals and communities who encounter structural inequalities are less likely to trust government institutions and the public health advice they offer. Not surprisingly, these groups were less likely than the general population to use these technologies.
• The lack of targeted public communications resulted in poor understanding of the purpose and technical properties of COVID-19 technologies. This reduced public acceptance and social consensus around whether and how to use the technologies.

Inequalities: How did COVID-19 technologies affect inequalities?

• Some social groups faced barriers to accessing, using or following the guidelines for contact tracing apps and digital vaccine passports, including unvaccinated people, people structurally excluded from sufficient digital access or skills, and people who could not self-isolate at home due to financial constraints. A small number of sample countries adopted policies and practices to mitigate the risk of widening existing inequalities. For example, the EU allowed paper-based Digital COVID Certificates for those with limited digital access and skills.
• This raises the question of whether COVID-19 technologies widened health and other societal inequalities. In most of the sample countries, there is no clear evidence whether governments adopted effective interventions to help those who were less able to use or benefit from these technologies (for example, whether they provided financial support for those who could not self-isolate after receiving an exposure alert due to not being able to work from home).
• Most sample countries requested proof of vaccination from inbound travellers before allowing unconditional entry (that is, without a quarantine or self-isolation period) at some stage of the pandemic. This amplified global inequalities by discriminating against the residents of countries that could not secure adequate vaccine supply or had low vaccine uptake – specifically, many African countries.

Governance, regulation and accountability: Were COVID-19 technologies governed well and with accountability?

• Contact tracing apps and digital vaccine passports combine health information with social or surveillance data. As they limit rights (for example, by blocking access to travel or entrance to a venue for people who do not have a digital vaccine passport), their use must be proportional. This means striking a balance between limitations of rights, potential harms and the intended purpose. To achieve this, it is essential that these tools are governed by robust legislation, regulation and oversight mechanisms, and that there are clear ‘sunset mechanisms’ in place to determine when they no longer need to be used.
• Most countries in our sample governed these technologies in line with pre-existing legislative frameworks, which were not always comprehensive. Only a few countries enacted robust regulations and oversight mechanisms specifically governing contact tracing apps and digital vaccine passports, including the UK, EU member states, Taiwan and South Korea.
• The lack of robust data governance frameworks, regulation and oversight mechanisms led to lack of clarity about who was accountable for misuse or poor performance of COVID-19 technologies. Not surprisingly, there were incidents of data leaks, technical errors and data being reused for other purposes. For example, contact tracing app data was used in police investigations in Singapore and Germany, and sold to third parties for commercial purposes in the USA.[12]
• Many governments relied on private technology companies to develop and deploy these technologies, demonstrating and reinforcing the industry’s influence and the power located in digital infrastructure.

Lessons

These findings present clear lessons for governments and policymakers deciding how to use contact tracing apps and digital vaccine passports in the future. These lessons may also apply more generally to the development and deployment of any new data-driven technologies and approaches.

Effectiveness

To build evidence on the effectiveness of contact tracing apps and digital vaccine passports:

• Support research and learning efforts which review the impact of these technologies on people’s health behaviours.
• Weigh up the technologies’ benefits and harms by considering their role within the broader COVID-19 response and comparing them with non-digital interventions (for example, manual contact tracing).
• Understand the varying impacts of apps’ different technical properties, and of policies and approaches to implementation on people’s acceptance of, and experiences of, these technologies in specific socio-cultural contexts and across geographic locations.
• Use this impact evaluation to help set standards and strategies for the future use of these technologies in public crises.

To ensure the effective use of technology in future pandemics:

• Invest in research and evaluation from the start, and implement a clear evaluation framework to build evidence during deployment that supports understanding of the role that technologies play in broader pandemic health strategies.
• Define criteria for effectiveness using a human-centred approach that goes beyond technical efficacy and builds an understanding of people’s experiences.
• Establish how to measure and monitor effectiveness by working closely with public health experts and communities, and set targets accordingly.
• Carry out robust impact assessments and evaluation.

Public legitimacy

To improve public acceptance:

• Build public trust by publishing guidance and enacting clear law about permitted and restricted uses and mechanisms to support rights (for example, the right to privacy) and how to tackle legal issues and enable redress (e.g., data leakage, which could involve using collected data for reasons other than health).
• Effectively communicate the purpose of using technology in public crises, including the technical infrastructure and legislative framework for specific technologies, to address public hesitancy and build social consensus.

Inequalities

To avoid entrenching and exacerbating societal inequalities:

• Create monitoring mechanisms that specifically address the impact of technology on inequalities. Monitor the impact on public health behaviours, particularly in relation to social groups who are more likely to encounter health and other forms of social inequalities.
• Use the impact evidence to identify marginalised and disadvantaged communities and to establish strong public health services, interventions and social policies to support them.

To avoid creating or reinforcing global inequalities and tensions:

• Harmonise global, national and regional regulatory tools and mechanisms to address global inequalities and tensions.

Governance and accountability

To ensure that individual rights and freedoms are protected:

• Establish strong data governance frameworks and ensure regulatory bodies and clear sunset mechanisms are in place.
• Create specific guidelines and laws to ensure technology developers follow privacy-by-design and ethics-by-design principles, and that effective monitoring and evaluation frameworks and sunset mechanisms are in place for the deployment of technologies.
• Build clear evidence about the effectiveness of new technologies to make sure that their use is proportionate to their intended results.

To reverse the growing power imbalance between governments and the technology industry:

• Develop the public sector’s technical literacy and ability to create technical infrastructure. This does not mean that the private sector should be excluded from developing technologies related to public health, but it is crucial that technical infrastructure and governance are effectively co-designed by government, civil society and private industry.

Introduction

The COVID-19 pandemic is the first global epidemic of ‘the algorithmic age’.[13] In response, hundreds of new technologies have been developed, to diagnose patients, identify vulnerable populations and conduct surveillance of individuals known to be infected.[14] Data and artificial intelligence (AI) have therefore played a key role in how policymakers and international and national health authorities have responded to the pandemic.

Digital contact tracing apps and digital vaccine passports, which are the focus of this report, are two of the most widely deployed new technologies. Although versions of contact tracing apps had previously been deployed in some countries, such as in Sierra Leone as part of the Ebola response, for most countries across the world this was their first experience of such technologies.[15]

These technologies differ from pre-existing state surveillance tools, such as CCTV, and from other types of technologies deployed in the context of the COVID-19 pandemic, such as machine learning algorithms that profile the risk of incoming travellers or predict infected patients at high risk of developing severe symptoms.[16]

To be effective, contact tracing apps and digital vaccine passports require public acceptance and cooperation, as individuals need to consent to share their health and other types of personal information and change their behaviour, for example, by showing evidence of health status to enter a venue via a digital vaccine passport, or by staying at home on receiving an exposure notification from a contact tracing app.[17]

These technologies are therefore at the crossroads of public emergency, health and surveillance and so have significant societal implications.

The emergence of contact tracing apps and digital vaccine passports resulted in public anxiety and resistance related to their effectiveness, legitimacy and proportionality, as well as concern about the implications for informed consent, privacy, surveillance, equality, discrimination and the role of technology in broader public health management.

These technologies were therefore high stakes and were perceived as necessary, but high-risk measures in dealing with the pandemic.

As the technologies brought together a range of highly sensitive data, they were a test of the extent of the public’s willingness to share sensitive personal data and to accept limits on freedoms and rights.

The technologies were developed and deployed to save lives, but in practice they both enabled and limited people’s individual freedoms, by scoring the risk they posed to others based on their health status, location or mobility data.

Despite the risks and sensitivities, due to the challenging conditions of the pandemic, they were created and implemented quickly, and without a clear consensus on how they should be designed, governed and regulated.

Countries adopted different approaches, and – while there are some commonalities across countries and dominant infrastructures – the technical choices, policies and practices were neither unified nor consistent. Frequent changes were made even at a regional level.

It was particularly challenging for countries with weaker technological infrastructures, financial capabilities or legislative frameworks to develop and deploy COVID-19 technologies. Even in countries with relatively comprehensive regulation, these technologies caused fresh concerns for human rights and civil liberties, as they intensified ‘top-down institutional data extraction’ across the world.[18]

Many critics correctly anticipated that such technologies would normalise surveillance via state ownership of sensitive data in a way that would persist beyond the pandemic.

This creates a complex picture, made more challenging by incomplete evidence on how the technologies were developed, used and governed – and, most importantly, on their impact on people, health, healthcare provision and society. It is therefore important to monitor their development, understand their impact and consider what legacy they might have as well as the lessons we can learn for the future.

A range of studies focus on aspects of contact tracing apps and digital vaccine passports at different stages of the pandemic. The Ada Lovelace Institute has monitored the evolution of these technologies over the last three years. However, compared with more traditional health technologies or policy interventions, there is a lack of in-depth research into them or evaluation of their effectiveness.

As the infrastructure is still in place in most countries, these technologies can easily be re-used or transformed into new technologies for new purposes. Therefore, these are live questions with tangible effects on people and societies.

By synthesising evidence from a cross-section of 34 countries, this report identifies cross-cutting issues and challenges, and considers what lessons we should learn from the deployment of COVID-19 technologies as examples of new and powerful technologies that have been embedded across society.

Scope and rationale of this report

In the first two years of the pandemic, from early 2020, the Ada Lovelace Institute conducted extensive research first on contact tracing apps and then on digital vaccine passports. This research focused on the technical considerations and societal implications of these new technologies and included public attitudes research, expert deliberations, workshops, webinars and evidence reviews.

To conduct this research, we engaged multidisciplinary experts from the fields of behavioural science, bioethics, ethics, development studies, immunology, law, public health and sociology. As well as analysing the technical efficacy of the technologies, this created a holistic picture of their legal, societal and public health implications.

We published nine reports based on our research, and two international monitors, which tracked policy and practice developments related to digital vaccine passports and contact tracing apps.

In this work, we acknowledged the potential of new data-driven technologies in the fight against COVID-19. However, we also identified the risks of rapid decision-making by governments and policymakers.

In most cases, there was not sufficient time or adequate research to consider and address the wide range of societal, political, legal and ethical risks. This led to significant challenges, related to effectiveness, public legitimacy, inequalities, and governance and accountability.

Risks and challenges of COVID-19 technologies contained in the Ada Lovelace Institute’s previous publications

When contact tracing apps and digital vaccine passports first emerged, we argued that governments and policymakers should pay attention to a wide range of risks and challenges when deploying these technologies.

From early 2020, the Ada Lovelace Institute – through reports, trackers and monitors – identified and warned about the risks of these technologies.[19]

The risks we identified and highlighted can be summarised as:

Effectiveness

• Lack of resources to monitor effectiveness and impact. Impact monitoring and evaluation strategies were not developed, making it difficult to assess the effectiveness of the technologies. Digital vaccine passports and contact tracing apps were new technologies, developed and deployed at pace, so there was not enough time or resource to establish effective strategies and monitoring mechanisms to investigate their impacts on public health.
• Undermining public health by treating a collective problem (public health) as an individual one (personal safety). This placed the emphasis on individualised risks or requirements, and greater health surveillance at an individual level. For example, contact tracing apps categorise an individual as lower risk based on their vaccine or test status, rather than focusing on a more contextual risk of local infection in a specific area.
• An increase in higher-risk behaviours due to the technologies fostering a false sense of security. Experts highlighted that COVID-19 technologies could create a false sense of security and discourage people from adhering to other protection measures that reduce the risk of transmission, for example, wearing a mask.[20]

Public legitimacy

• Harming public trust in health data-driven technologies if they were not governed properly or were used for reasons other than health (for example, surveillance). Damaged public trust could make it difficult for governments to roll out new data-driven approaches and technologies to deal with public crises and in general.

Inequalities

• Creating new forms of stratification and discrimination (for example, discrimination against unvaccinated people or those unable to access accepted vaccines or tests) or amplifying existing societal inequalities (for example, digital exclusion or poor access to healthcare).
• Amplifying existing global inequalities and geopolitical tensions, particularly in the case of inequitable access to vaccines on a global level. Digital vaccine passport schemes required proof of vaccination for international travel or access to domestic activities (for example, entering a venue for a concert) across the world. This created the risk of a global race for vaccine supply, leaving many low- and middle-income countries scrambling for access.

Governance and accountability

• Facilitating restrictions on individual liberty and increased surveillance. Members of the public were expected to use these powerful and potentially invasive technologies that collected and stored their personal data. These tools could therefore be used for surveillance, invading privacy or controlling individuals’ activities and mobility in general.
• Repurposing individuals’ data for reasons other than health, for example, tracking dissidents’ activities, selling data to third parties for commercial purposes, etc.
• Uncertainty and lack of transparency about private sector involvement and the risks of concentrating power and enabling long-term digital infrastructure that is reliant on private actors.[21]

Our reports made several recommendations for policymakers about how to mitigate these risks and challenges. As well as detailed recommendations for each technology, our cross-cutting recommendations covered the lifecycle of development and implementation.

The focus of this research

The Ada Lovelace Institute’s original research in 2020 and 2021 focused on the conditions and principles required to safely deploy and monitor COVID-19 technologies.

By early 2022 many countries had deployed these technologies. Therefore, we shifted our focus and began investigating whether the risks and challenges we identified had materialised and, if so, what could be done differently in deploying technologies in the future.

As identified above, contact tracing apps and digital vaccine passports were deployed without consistent research and monitoring mechanisms. This contributed to a limited evidence base and meant that we needed to use a broad range of resources and research methods to develop this report (see Methodology).

Academic and grey literature provided valuable insights. This was supplemented by media and civil society coverage, for example of the repurposing of data collected through the contact tracing app Luca in Germany or the blocking of protests through Health Code app in China.[23]

The evidence in this report includes qualitative and quantitative data related to the uses and impacts of COVID-19 technologies drawn from policy trackers, the media, policy papers, research papers and workshops convened with experts between January 2022 and December 2022.

To accompany the report, we have created the ‘COVID-19 Data Explorer: Policies, Practices and Technology’[24] to enable civil society organisations, researchers, journalists and members of the public to access the body of data.

The COVID-19 Data Explorer supports the discovery and exploration of policies and practices relating to digital vaccine passports and contact tracing apps across the world. The data on timelines, technologies and public response demonstrates the legacy and implications of their rapid deployment.

By using a wide range of resources, reviewing the existing evidence and identifying evidence gaps, we draw important cross-cutting lessons to inform policy and practice.

We synthesise the available evidence from a sample of 34 countries, with the aim of taking a macro view and identifying cross-cutting issues at an international level. The report contributes to the growing body of research on COVID-19 technologies, improving how we understand, investigate and build data-driven technologies for public good.

The evidence sources include:

• the Ada Lovelace Institute’s previous work on contact tracing apps and digital vaccine passports in the first two years of the pandemic
• academic and grey literature on digital vaccine passports, contact tracing apps and COVID-19 pandemic management, focusing on the 34 countries in our sample
• government websites and policy papers
• a workshop delivered by the Ada Lovelace Institute with cross-country experts, focusing on the effectiveness of contact tracing apps in Europe
• papers submitted in response to The Ada Lovelace Institute’s international call for evidence on the effectiveness of digital vaccine passports and contact tracing apps
• news media coverage of digital vaccine passports, contact tracing apps and pandemic management in the 34 countries in our sample.

See Methodology for more information on methods, sampling and resources.

List of countries in our sample:

1. Argentina (ARG)
2. Australia (AUS)
3. Brazil (BRA)
4. Botswana (BWA)
5. Canada (CAN)
6. China (CHN)
7. Germany (DEU)
8. Egypt (EGY)
9. Estonia (EST)
10. Ethiopia (ETH)
11. Finland (FIN)
12. France (FRA)
13. United Kingdom (GBR)
14. Greece (GRC)
15. India (IND)
16. Israel (ISR)
17. Italy (ITA)
18. Jamaica (JAM)
19. Kyrgyzstan (KGZ)
20. South Korea (KOR)
21. Morocco (MAR)
22.  Mexico (MEX)
23.  Nigeria (NGA)
24.  New Zealand (NZL)
25.  Romania (ROU)
26.  Russia (RUS)
27.  Saudi Arabia (SAU)
28.  Singapore (SGP)
29.  Tunisia (TUN)
30.  Türkiye (TUR)
31. Taiwan (TWN)
32.  United States of America (USA)
33.  South Africa (ZAF)
34.  Zimbabwe (ZWF)

Contact tracing apps

Emergence

Contact tracing is an established disease control measure. Public health experts help patients recall everyone they have come into close contact with during the timeframe in which they may have been infectious. Contact tracing teams then inform exposed individuals that they are at risk of infection and provide them with guidance and information.[26]

In the early phase of the pandemic, the idea of building on this practice by digitising contact tracing quickly became prominent. With lockdowns contributing to social and economic hardships, the objective was to return to the pre-pandemic ‘normal’ as soon as possible, and the global consensus at the time was that vaccination would be the only long-term solution to achieve this.

While vaccines were being developed, many countries relied on contact tracing to break chains of infection so that they could ease pandemic restrictions such as lockdowns.

Research shows that contact tracing as a disease control measure reaches its full potential when carried out by trained public health experts, who are able to engage with patients and their contacts rapidly and sensitively.[27] However, many countries lacked adequate numbers of trained public health staff and resources (for example, testing capacity to detect contacts known to be infected) for this kind of manual tracking and isolation.[28] In this context, digital contact tracing offered the possibility of accelerating contact tracing.

Countries had varying approaches to contact tracing and the use of digital contact tracing technologies, depending on their existing infrastructure. South Korea, for example, established a national tower that oversaw data collection and monitoring activities. This was built on existing smart city infrastructures which contained data collected from immigration records, CCTV footage, card transaction data and medical records.[29]

Research in South Africa highlights the state’s surveillance capabilities using mobile network systems and tracking internet users’ online activities.[30] South Africa used location information from mobile network operators to help contact tracing teams who ‘tracked and traced’ people infected with COVID-19 with no prior public announcement or consultation, although it later abandoned this approach.[31]

In Asia and Africa, digital contact tracing involved extensive collection of personal data through mass surveillance. In Europe and the USA, on the other hand, the idea of digital contact tracing through a mobile app on citizens’ smartphones began to be considered. Contact tracing apps were considered a lower-risk alternative than the mass surveillance tools adopted in Asia and Africa.

The idea of building contact tracing apps eventually gained momentum not only in Europe and the USA but across the world. Governments needed to consider the technical infrastructure, efficacy and purpose of this new technology, and the related benefits, risks and harms.

As early research from the Ada Lovelace Institute showed, public legitimacy and trust were critical for these technologies to work effectively.[32] Members of the public had to use contact tracing apps in the way intended by governments and technology companies, such as by uploading their health information if diagnosed with COVID-19 or isolating after being informed they had had close contact with someone known to be infected with COVID-19. This was particularly challenging for countries and regions with low levels of digital access and skills.[33]

To support public trust, contact tracing apps needed to be built using established best-practice methods and principles, and uses of the technology and data had to be controlled through strong regulation. If the data were to be repurposed, such as for surveillance purposes, it could damage public trust in the government, limiting the effectiveness of using COVID-19 technologies to deal with public crises in the future.

Despite these challenges, many countries across the world deployed contact tracing apps at pace in 2020.[34] In this chapter, we outline the various technical approaches and infrastructure behind contact tracing apps to build understanding of the different debates and concerns around them. We then assess their effectiveness, public legitimacy, impact on inequalities and governance.

Types of contact tracing apps

Contact tracing apps can be divided into two types: centralised or decentralised. This determines where data is stored and who can access it.[35]

Table 1: Design approaches for contact tracing apps

Communication protocol	How is data generated, stored and processed?	Who can access the data?
Centralised system approach	Users’ data is generated, stored and processed on a central server operated by public authorities.	Public authorities have access to data. They score users according to their risk and decide which users to inform. For example, if person x has been in close proximity to y, who is known to be infected with COVID-19, public authorities will be able to identify x and contact them.
Decentralised system approach	Users’ data is generated, stored and processed on users’ mobile phones.	The data gathered through mobile phones can also be shared on a backend server. A backend server is responsible for storing, processing and communicating data. But decentralised contact tracing systems use arbitrary identifiers (for example, a set of numbers and letters) rather than identifiers (for example., IP address). Hence, even when public authorities access the data on a backend server, they cannot identify users or reconstruct their locations and social interactions.[36]

 

There are three main technologies that are used in both centralised and decentralised systems to detect and trace users’ contacts and estimate their risk of infection.

Table 2: Technologies of contact tracing apps

How do apps decide if a user has been in contact with a person known to be infected?
Bluetooth exposure notification system	This approach is based on proximity tracing: this means determining whether two individuals were near each other in a particular context for a specific duration.[37] Contacts are identified through Bluetooth technology on mobile phones. By giving permission for contact tracing apps to use their smartphone’s Bluetooth function, users allow the app to track real-time and historical proximity to other smartphones using the app. The app will share an infection alert if a user has been in proximity to a person who is known to be infected with COVID-19. Contact tracing apps based on Bluetooth technology are also referred to as exposure notification apps.
Location GPS data	This approach is based on location: contact tracing apps use the mobile device’s location (GPS) feature to identify contacts who have been in the same location as a person who is known to be infected with COVID-19
QR code	This approach is based on presence tracing; whether two individuals were present at the same time in a venue where infection could have taken place.[38] Users scan a QR code with their smartphone on entry to venues. If a user who is known to be infected with COVID-19 uploads this information to the app, other users who have scanned the same QR code are notified. New Zealand incorporated Near Field Communication (NFC) codes as an alternative to QR codes in the NZ COVID Tracer app. NFC is a technology that allows two devices to connect through proximity. NFC codes work by tapping mobile phones on or near NFC readers, in the same way that contactless credit cards, Google and Apple Pay work by tapping on or near card readers.[39]

When contact tracing apps were being considered for development, many countries were enthusiastic about deploying apps with a centralised system approach, which stores the data of app users on a central server.

Supporters of this centralised approach argued that access to data would give epidemiologists and health authorities valuable information for analysis. However, many privacy, data security and human rights researchers and activists highlighted the risks created by user data being accessible to third parties through a centralised server. These risks included the privacy infringements, data repurposing and increased surveillance.

In this context, proposals emerged for technical protocols that would enable decentralised contact tracing, designed to be ‘privacy preserving’ by enabling users’ data to be stored on their mobile smartphones rather than on a centralised server.

Several decentralised protocols emerged in April 2020, including the open protocol DP-3T (Decentralized Privacy-Preserving Proximity Tracing), PEPP-PT (Pan-European Privacy-Preserving Proximity Tracing) and the Apple/Google Exposure Notification protocol (GAEN API).

In our research, we collected evidence about the system approaches of contact tracing apps in 25 countries.[40] We discovered that 15 out of 25 countries used a decentralised system approach. Of the 15 countries that adopted a decentralised approach, not all of these based their decision on their privacy-preserving infrastructure.

The Apple/Google protocol quickly became the dominant decentralised protocol, because of the control exercised by the platforms over the two main smartphone operating systems (iOS and Android, respectively).

The Apple/Google protocol gained dominance in part because centralised contact tracing apps could not perform well on Google and Apple’s operating systems[41] without the platforms making technical changes to these systems, which they refused to do because of concerns about users’ privacy.[42]

The centralised contact tracing apps of Australia and France, for example, had major technical problems.[43] In June 2020, France’s junior minister for digital affairs highlighted that the poor technical efficacy of France’s centralised app had led to decreased public confidence in the app, stating: ‘There has been an upward trend in uninstalling over the last few days, to the tune of several tens of thousands per day’.

Similarly, Australia’s contact tracing app, which combined Bluetooth technology with a centralised system server approach, identified only 17 contacts not found manually in two years.

This caused tensions between technology companies and governments that wanted to use centralised systems with Bluetooth technology, which was considered less invasive of privacy than collecting geographical location data. Countries such as the UK and Germany, which initially pursued centralised apps independently of the Apple/Google protocols, eventually had to deploy the GAEN API to enable their Bluetooth notification systems to work effectively.[44]

In some cases, the distinction between centralised and decentralised systems was blurred. There are decentralised contact tracing systems that centralise information, if users voluntarily upload data.

For example, Singapore’s Bluetooth exposure notification app is decentralised in that it does not store users’ data on a central server. However, when users sign up for TraceTogether, they provide their phone number and ‘unique identification number’ (a government ID used for a range of activities).

If a user is known to be infected with COVID-19, they can grant the Ministry of Health access to their Bluetooth proximity data. This allows the ministry to identify people who have had close contact with the infected app user within the last 25 days, so it follows a more centralised model at that point.[45]

The developers emphasised that they built this ‘hybrid model of decentralised and centralised approach specifically for Singapore’.[46] Similarly, Ireland’s COVID Tracker allows users to upload their contact data, age, sex and health status to a centralised data storage server.[47] There are also apps that use both GPS data and a Bluetooth exposure system, such as India’s Aarogya Setu.

QR codes were also widely used in contact tracing apps, especially those with Bluetooth exposure notification systems, such as the UK’s NHS COVID-19 app.

Effectiveness of contact tracing apps

In April 2020, the Ada Lovelace Institute published the rapid evidence review Exit through the App Store?. [53] This report explored technical and societal implications of a variety of COVID-19 technologies, including contact tracing apps. The review acknowledged that, given the potential of data-driven technologies ‘to inform research into the disease, prevent further infections and support the restoration of system capacity and the opening up of the economy’, it was right for governments to consider their use.

However, we urged decision-makers to consider the lack of scientific evidence demonstrating the potential efficacy and impact of contact tracing apps. And we pointed out that there had not been adequate time or resources to establish effective strategies and monitoring mechanisms to investigate their impacts on public health.

We emphasised that lack of credible evidence supporting the apps’ effectiveness could undermine public trust and hinder implementation due to low uptake.

Since then, a considerable number of studies have emerged investigating the effectiveness of contact tracing apps. This body of literature offers four key findings:

• Some Bluetooth notification exposure apps with decentralised systems have been effective in identifying and notifying close contacts of people known to be infected with COVID-19, for example the UK’s NHS COVID-19 app.[54] However, the technical efficacy of this kind of system cannot be generalised at an international level. The evidence from South Africa and Canada, for example, indicates technical problems, including insufficient Bluetooth accuracy and smartphone batteries being quickly drained.[55] Such technical issues affected the apps’ ability to identify and notify close contacts of people who were known to be infected with COVID-19.
• Apps with centralised systems and Bluetooth exposure notification systems, which were not compatible with Google and Apple’s GAEN API, had significant technical problems. This reduced their ability to identify close contacts.[56] For example, France’s contact tracing app had sent only 14 notifications after 2 million downloads as of June 2020.[57]
• Low uptake of contact tracing apps reduced their effectiveness in some countries, for example in Australia.[58] This is because the proportion of potentially exposed people who actually receive an exposure notice and stay at home is, by definition, lower if fewer people are using the app overall.
• Contact tracing apps were insufficiently integrated with government services and public health systems. An investigation of the effectiveness of contact tracing apps from a public health perspective in six countries found that apps did not reach their full potential, due to inadequate testing capacity and poor data sharing across local and central government authorities.[59]

However, there are still important evidence gaps which prevent us from definitively assessing the effectiveness of contact tracing apps.

To explore these gaps, we organised a multidisciplinary workshop with experts from the USA and Europe in October 2022 to discuss the effectiveness of contact tracing apps. The findings from the workshop (listed below) demonstrate the limitations of the evidence.

It was clear that there is still no consensus on what effectiveness means beyond apps’ technical efficacy. How can we define people-centred effectiveness?

Research is also limited on how contact tracing apps affected individual behaviours that would have supported wider public health measures: for example, whether users self-isolated after a COVID-19 exposure notification. The existing evidence is limited in both sample size and scope,[60] because (to date) people’s real-life experiences of contact tracing apps have received little research attention.

A Digital Global Health and Humanitarianism Lab (DGHH Lab) investigation of contact tracing apps provides a useful framework for how further research should evaluate people’s real-life experiences of contact tracing such apps. The investigation looks at people’s opinions and experiences of contact tracing apps in five countries: Cyprus, Iceland, Ireland, Scotland and South Africa.[61] It concludes that user engagement with the apps should be seen in four stages:

1. Uptake (users download the app).
2. Use (users run the app and keeps it updated).
3. Report (users report a positive COVID-19 diagnosis via the app).
4. React ( users follow necessary next steps when they receive an exposure notification from the app).[62]

Uptake alone does not guarantee continued use and change in behaviour (for example, getting tested or staying at home when notified of an exposure). The stage-based approach should therefore guide our understanding of individuals’ actual, ongoing usage of COVID-19 technologies.

Several studies demonstrate that uptake does not guarantee continued use. In France, for example, only a minority of users of the TousAntiCovid (Everyone Against COVID, formerly StopCovid) app used the contact tracing feature.

BBC News reported that although two million people downloaded the Protect Scotland app, only 950,000 people actively used it, and that around 50,000 people stopped using it a few months after its launch.[63] Similarly, there is evidence that millions of people who downloaded the NHS COVID-19 app (used in England and Wales) never technically enabled it, so despite having an intention to engage with it, they did not use it in practice.[64]

This evidence does not suggest that contact tracing apps were completely ineffective. But it challenges us to consider why people did not use the apps as anticipated by policymakers and developers.

Exploring this will help ensure that contact tracing apps and similar health technologies reach their full potential in the future.

A research study on the UK contact tracing apps demonstrates that some people also stopped using apps after a while because they lost confidence in their effectiveness.[65] Similarly, the Government of Canada’s evaluation of the COVID Alert app notes that its perceived lack of effectiveness among the public led to fewer downloads and less continued usage, which prevented the app from reaching its full potential.[66]

These findings demonstrate that more research is needed to investigate people’s views and practices in relation to contact tracing apps in real-life contexts and over time. This will help review the apps’ effectiveness, not just technically but in terms of outcomes for people and society.

How did different technologies, policies and public communications impact public attitudes when the apps were first deployed and over time?

We need more comparative evidence to understand how different technologies, policies and public communication strategies impacted public attitudes. The existing evidence, despite its limitations, indicates the importance of comparative research.

For example, there is an important distinction between tracing apps (location GPS data) and exposure notification apps (Bluetooth technology), in terms of the risks and challenges they pose. Yet there is no adequate research into how the public perceives the respective risks and effectiveness of these two different types of contact tracing apps.

A qualitative research study with 20 users of Canada’s COVID Alert app confirms the significance of this evidence gap. It demonstrates that participants favoured the app’s decentralised approach over centralised systems because of the higher level of privacy protection and optional level of cooperation.[67] The research also finds that users’ motivation to notify the app if known to be infected with COVID-19,and to follow government guidelines, increases with their understanding of the purpose and technical functionality of the app.

A limitation of the evidence base is that existing research largely investigates contact tracing apps in the first year of the pandemic. There is a need to understand the success and effectiveness in the context of changing nature of the pandemic. This will help understand how people’s confidence in apps’ effectiveness and their usage practices have changed over time.

Public legitimacy of contact tracing apps

When they first emerged, we argued that public legitimacy was key to the success of contact tracing apps.

Members of the public were more likely to use the apps and follow the guidelines (for example, self-isolating after receiving a notification) if they trusted the technology’s effectiveness and believed that adequate regulatory mechanisms were in place to safeguard their privacy and freedoms.[70]

We also demonstrated that public support for contact tracing apps was contextual: people had varying views and experiences of the apps depending on how they were implemented locally (for example, whether uptake was mandatory or voluntary).[71]

In countries where contact tracing app use was mandatory, members of the public had to use them even if they did not think that they were legitimate technologies. For example, in China, the Health Code app was automatically integrated into users’ WeChat and Alipay, so that they could only deactivate the COVID-related functionality by deleting these applications.[72]

These applications are widely used, as smartphone-based digital payment is the main method of payment in China.[73] The app was therefore assigned mandatorily to 900 million users (out of 1.4 billion) in over 300 cities, using pre-existing legal mechanisms to justify and enforce the policy (for example, the Novel Coronavirus Pneumonia Prevention and Control Plans).[74]

The Health Code app was not the only automatically assigned technology across China. Cities and regions required their residents to use multiple technologies depending on their own local COVID-19 pandemic measures and mechanisms; however, there is not much information regarding local authorities’ administration of these technologies. Similarly, it was not always clear which government department had ultimate authority for oversight and enforcement.[75]

In the majority of the countries in our sample, contact tracing apps were voluntary. People were not obliged through legislation to use them, and only did so if they believed in their effectiveness and had the resources to adopt them and adhere to guidelines.

Seen through this lens, contact tracing apps can be taken as a test of public acceptance of powerful technologies that entail sensitive data and are embedded in everyday life.

A study that investigated voluntary contact tracing app adoption in 13 countries found that the adoption rate was 9% on average.[76] In 2020, the Ada Lovelace Institute conducted an online public deliberation project on the UK Government’s use of the NHS COVID-19 contact tracing app to transition out of lockdown.[77] This research demonstrated that the public demanded clarity on data use and potential risks as well as independent expert review of the technology’s efficacy. Since then, there has been a boom in research into public attitudes to contact tracing apps that confirms this point.

This demonstrates the reasons for low levels of public support for contact tracing apps. These include low levels of trust in government and concerns about apps’ security and effectiveness, leading to low adoption (or high rates of people discontinuing use) in some countries, for example, Australia, France and South Africa. [78]

While we do not have in-depth insights about public support for apps in the countries where uptake was mandatory, recent developments in China demonstrate people’s dissatisfaction with the Health Code app and the restrictions it enabled. When the Chinese government ended the Health Code mandate in December 2022, many people shared celebratory content on social media platforms.

Some of this content suggested that people were happy to make decisions and take precautions for themselves rather than rely on the Health Code algorithm.[79] A considerable number of privacy and human rights law experts were explicitly critical of the use of Health Code system (both about the use of the system in general and its use beyond the height of the pandemic) and urged the Chinese government to discontinue its use beyond the COVID-19 pandemic.[80]

Experts emphasise the importance of effective public communication strategies in pandemic management.[81] The existing research demonstrates that many governments across the world have not been able to communicate scientific evidence effectively, particularly to address vaccine hesitancy and misinformation.[82] This finding includes communications around digital interventions.

Research undertaken in the UK shows that the public do not have a clear understanding of the technical capabilities and uses of COVID-19 technologies.

When asked about digital contact tracing apps, participants in the research imagined these apps ‘being able to “see” or ‘visualise’ their every move’.[83]

This indicates a misunderstanding (or lack of knowledge) regarding the apps’ infrastructure. Contact tracing apps in the UK are built on the GAEN API using Bluetooth technology, so they do not collect geo-location data and are not able to track users’ location in the literal sense of knowing where a user is at a given point in time.

In Europe, Bluetooth technology has been widely used instead of geo-location data.[84] However, the perceived risk of surveillance and literal tracking has been a public concern in the majority of European countries, especially among social groups with lower levels of trust in government.[85] Similar evidence exists for South Africa, where the lack of focused and targeted communications reduced public trust, and the COVID Alert SA app was not widely used by members of the public.[86]

Perhaps an exception within our sample is Canada, which established an extensive communications campaign to increase awareness and understanding of the COVID Alert app.[87] Health Canada, the government department responsible for national health policy, spent C$21 million on this campaign to encourage Canadians to download and use the app.[88]

The official evaluation of the app published by Health Canada and the Public Health Agency of Canada concludes that these campaigns resulted in millions of downloads.[89] This evidence demonstrates the importance of effectively communicating the apps’ purpose and technical infrastructure to members of the public.

Existing political structures and socio-economic inequalities were also important in determining uptake. In many parts of the world, structural factors and inequalities mean that marginalised and disadvantaged communities are more likely to distrust the government, institutions and public health advice.[90]

It is unsurprising that these groups were less likely to use contact tracing apps. There is strong online survey research evidence from the UK that confirms this point, in an investigation of the adoption of and attitudes towards the NHS COVID-19 app:

• 42% of Black, Asian and minority ethnic respondents downloaded the app compared with 50% of white respondents
• 13% of Black, Asian and minority ethnic respondents downloaded then deleted the app compared with 7% of white respondents
• Black, Asian and minority ethnic respondents were more concerned about how their data would be used and felt more frustrated as a result of a notification from the app than white respondents
• Black, Asian and minority ethnic respondents had lower levels of trust in the National Health Service (NHS) and were less likely to download the app to help the NHS.[91]

Inequalities

The international evidence concerning the impact of COVID-19 on communities demonstrates higher infection and mortality rates among the most disadvantaged communities.

It highlights the intersections of socio-economic, ethnic, geographical, digital and health inequalities, particularly in unequal societies and regions.[93]

The introduction of contact tracing apps led to concerns that they could widen health inequalities for vulnerable and marginalised individuals in society (for example, around digital exclusion and poor access to healthcare). In this context, we called on governments to carefully consider the potential negative social impacts of contact tracing apps, especially on vulnerable and disadvantaged groups.[94]

A part of pandemic management, policymakers and technology companies developed and adopted new technologies rapidly. This left insufficient room to discuss questions about equality and impact, such as whether contact tracing apps would benefit everyone in society equally, who might not be able to benefit from them, and what the alternatives were for those individuals and communities.

There was a surge in techno-solutionism – the view that technologies can solve complex real-world problems – during the pandemic. As Marelli and others (2022) argue, ‘the rollout of COVID interventions in many countries has tended to replicate a mode of intervention based on ‘technological fixes’ and ‘silver-bullet solutions’, which tend to erase contextual factors and marginalize other rationales, values, and social functions that do not explicitly support technology-based innovation efforts’. [95]

This meant that non-digital interventions that could perhaps have benefited marginalised and disadvantaged communities – particularly manual contact tracing – were not adequately considered.

Research shows that contact tracing as a disease control measure, if effectively conducted in a timely way, can save lives, particularly for disadvantaged and marginalised communities.[96]

Manual contact tracing teams should ideally be trained to help individuals and families to access testing, identify symptoms, and secure food and medication when isolating. This type of in-depth case investigation and contact tracing requires knowing and effectively communicating with communities, which cannot be done via a mobile application.

Some contact tracing apps recognised this need and attempted to incorporate a manual function. COVID Tracker Ireland, for example, offered users the option of providing a phone number if they wanted to be contacted by public health staff.[97] This is important because it gives contact tracers the opportunity to contact people who are known to be infected with COVID-19 and address their needs.

However, it was unclear how these apps were intended to work alongside manual contact tracers, since it is a core function of majority of contact tracing apps that they inform individuals of exposure directly, with no involvement from public health staff.[98]

This raises the question of whether digital contact tracing was carried out at the expense of other health interventions (most notably, manual contact tracing) and led to the needs of particular individuals and families not being sufficiently considered.[99]

Furthermore, contact tracing apps’ success relies on the assumption that people will self-isolate if notified as a contact of someone who has tested positive for COVID-19. Yet as Landau, the author of People Count: Contact-Tracing Apps and Public Health, argues: ‘the privilege of staying at home is not evenly distributed’.[100]

While some people were able to work from home, many were not and therefore did not have the opportunity to self-isolate if notified of exposure. This shows that technologies cannot work efficiently in isolation and must be supported by strong social policies.

In some countries, governments introduced financial support for those who were ill or self-isolating. In the UK for example, the Government enabled citizens to claim a payment if notified by the NHS COVID-19 app.[101] But a report by Nuffield Foundation and the Resolution Trust found that the financial support given by the Government during the pandemic covered only a quarter of workers’ earnings.[102]

For health technologies such as contact tracing apps to result in changes in behaviour, policymakers need to address structural factors and inequalities that affect disadvantaged groups.

Similarly, people who did not have adequate digital access and skills were not able to use contact tracing apps, even if they wanted to. And these apps were particularly challenging for countries with low levels of internet access, such as South Africa and Nigeria.[103]

Governance, regulation and accountability

In deciding to introduce contact tracing apps, governments had to consider trade-offs between human rights and public health interests, because the apps used sensitive personal information and determined the freedoms and rights of individuals.

In the early stages of the pandemic, the Ada Lovelace Institute recommended that if governments wanted to build contact tracing apps, they should ensure that these new tools were governed by strong regulations and oversight mechanisms. We argued that contact tracing apps should be designed and governed in line with data protection and privacy principles.[105]

We acknowledge that these principles are not universal but are informed by political, cultural and social values. But they are underpinned by an international framework that informs the legal protection of human rights around the world.[106] It is beyond the scope of this report to evaluate country-specific laws. But the evidence we have uncovered suggests that different political cultures and pre-existing legislative frameworks of countries yielded varying governance mechanisms, which sometimes fell short of protecting civil rights and freedoms.

One of the most polarising issues concerning the launch of contact tracing apps was whether they should be mandatory or voluntary.

When contact tracing first emerged, we argued that making the use of contact tracing apps mandatory would not be proportionate given the lack of evidence for such apps’ effectiveness.

We also highlighted that contact tracing apps could facilitate surveillance and result in discrimination against certain groups (for example, those who are digitally excluded or refuse to use contact tracing apps). If these risks and challenges materialised, they could be detrimental to human rights.[107]

A comparative analysis of legislation and digital contact tracing policies in 12 countries shows that, in western countries, where privacy legislation strongly emphasises individual freedoms and rights, contact tracing app use was voluntary (for example, France, Austria and the UK).[108]

In Israel, China, Taiwan and South Korea, contact tracing app use was mandatory. Several studies demonstrate how the pre-existing laws and confidentiality requirements allowed Taiwan’s and South Korea’s governments to collect a wide range of social and surveillance data with relatively high levels of public acceptance.[109]

Both Taiwan and South Korea had had recent experiences of dealing with pandemics, and there was pre-existing legislation that permitted tracking through contact tracing apps, CCTV and credit card companies. These laws allowed the governments to carry out large-scale data collection programmes, and there were also strict confidentiality requirements in place.

Although digital contact tracing was mandatory and extensive, contact tracing app governance was transparent and civilian-run in both countries, based on pre-existing public emergency and data protection legislation.[110]

In China, on the other hand, there was no pre-existing comprehensive privacy legislation when the Health Code was deployed (as the Personal Information Protection Law came into effect in November 2021).[111] China enforced mandatory use of the Health Code app between February 2020 and December 2022.

Health Code served as both a contact tracing app and a digital vaccine passport, linked with users’ national identity numbers. It used GPS location in combination with data gathered through WeChat and Alipay, two of the most popular social commerce platforms in China.

These platforms were chosen to guarantee widescale adoption, since they provide the backbone for electronic financial transactions in China. The app categorised people into three categories to determine a risk score for users: green (low risk, free movement); yellow (medium risk, 7-day self-isolation); and red (high risk, 14-day mandatory quarantine)’.[112]

Health code systems were automatically added to citizens’ smartphones through Alipay and WeChat, and Chinese authorities were accused of misusing the systems to stop protests and conduct surveillance of activists.[113]

In Israel, where the contact tracing app was mandatory and centralised, the legislation relating to pandemics does not include digital data collection because it was established in 1940. When a state of emergency is declared, the government is empowered to enact emergency regulations that may suspend the validity of other laws that protect individual rights and freedoms.

In this context, the absence of digital data collection in the legislation relating to pandemics allowed the government to enact emergency regulations allowing the authorities to conduct extensive digital contact monitoring.[114]

The Lex-Atlas COVID-19 project also highlights that emergency powers were used to justify excessive data gathering and surveillance mechanisms in various countries.[115] Some countries unlawfully attempted to make the apps mandatory for domestic activities.

For example, in spring 2020, India made it mandatory for government and private sector employees to download the Aarogya Setu app. This decision was then questioned by experts, including a former Supreme Court judge in Kerala High Court, due to the lack of any law that backed mandatory use of the app.[116]

After the challenge was heard in early May 2020, the Ministry of Home Affairs issued a notification on 17 May 2020, clarifying that use of the Aarogya Setu app should be changed from mandatory to ‘best effort’ basis.[117] This allowed government employees to challenge the mandatory use of the app enforced by the government or a government institution.

In this case, the ‘competent authority’ to extend the scope of Aarogya Setu’s Data Access and Sharing Protocol was the Empowered Group on Technology and Data Management. However, the group was dissolved in September 2020, and the Protocol expired in May 2022. Therefore, the use of the app was anchored in a discontinued protocol and regulatory authority.[118]

Norton Rose Fulbright’s contact tracing global snapshot project demonstrates that countries with weaker legislation and enforcement mechanisms were less transparent when communicating information about their contact tracing apps. Türkiye and Russia, for example, did not clarify how long the data would be stored, whether a privacy risk assessment had been completed, or whether the data would be stored on a centralised or decentralised server.[119]

Another example demonstrating the importance of strong data protection mechanisms comes from the USA, where there are no federal privacy laws regulating companies’ data governance.[120] [121]

In 2020, we highlighted the risk of repurposing contact tracing apps being repurposed, that is, the technology and the data collected being used for reasons other than health.[122]

The company that owns the privacy and security assistant app Jumbo investigated the contact tracing app of the state of North Dakota in the USA. It reported that user location data was being shared with a third party, location data platform Foursquare.

Foursquare’s business model is based on providing advertisers with tools and data to target audiences at specific locations.[123] This exemplifies the repurposing of the data collected through a contact tracing app for commercial purposes, highlighting the importance of strong laws and mechanisms to safeguard users’ data.

Another important investigation was carried out by the Civil Liberties Union for Europe in 10 EU countries.[124] According to the EU General Data Protection Regulation (GDPR), providers should carry out a data protection and equality impact assessment before deploying contact tracing apps, as they posed risks to people’s rights and freedoms.

Yet the Civil Liberties Union for Europe investigation demonstrates that although these countries launched contact tracing apps in 2020, none had yet conducted these assessments by October 2021.

This point is also supported by Algorithm Watch’s evaluation of contact tracing apps in 12 European countries. It found that contact tracing app policies varied significantly within the EU, and that apps were deployed ‘not in an evidence-based fashion and mostly based on contradictory, faulty, and incomparable methods, and results’.[125]

Another relevant example is Singapore. The Criminal Procedure Code (2010) in Singapore allowed the police to use the data collected by contact tracing app TraceTogether data for reasons other than health.[126] In February 2021, it was reported that police had used the app in a murder investigation case.[127]

Following this, the government amended the COVID-19 (Temporary Measures) Act (2020) to restrict the use of the data. But according to this Act, personal data collected through digital contact tracing can still be used by law enforcement in investigations of ‘serious offences’.[128]

As the examples above show, unsurprisingly, countries with more comprehensive data protection and privacy legislation applied data protection principles more effectively than countries with weak legislation.

But incidents of privacy breaches and repurposing data also took place in countries with relatively strong laws and regulatory mechanisms. Germany has comprehensive personal data protection regulations under the EU GDPR and the new Federal Data Protection Act (BDSG).[129]

The Civil Liberties Union for Europe report highlights that Germany is one of the few EU countries that built and rolled out its contact tracing apps in line with the principles of transparency, public debate and impact assessments.[130] But the data gathered and stored through the Luca app, which provides QR codes to check in at restaurants, events and venues, was shared with the police and used in a murder investigation case.[131]

The role of the private sector

Our research reveals that contact tracing apps with centralised data systems were repurposed and/or used to restrict individual freedoms and privacy. This finding is also supported by Algorithm Watch’s COVID-related automated decision-making database project.

As highlighted in Algorithm Watch’s final report, there have been fewer cases of dangerous uses of data-driven technology and AI in EU countries, which largely used the decentralised GAEN API with Bluetooth technology, than in Asia and Africa.[132]

Many privacy advocates supported GAEN technology, which stored data on a decentralised server, since its use would prevent government mass surveillance and oppression.

Nonetheless, as this initiative was led by Google and Apple and not by policymakers and public health experts, it generated questions about the legitimacy of having private corporations decide the properties and uses of this kind of sensitive digital infrastructure.[133]

As digital rights academic Michael Veale argues, a GAEN-based contact tracing system may be ‘great for individual privacy, but the kind of infrastructural power it enables should give us sleepless nights’.[134] The pandemic demonstrated that big tech companies like Apple and Google hold enormous power over computing infrastructure, and therefore over significant health interventions such as digital contact tracing apps.

Apple and Google partnered to influence properties of contact tracing apps in a way that was not favourable to particular nation states (for example, France, which pursued a centralised system approach despite its incompatibility with Bluetooth technology).

This revealed the difficulty, even at state level, of engaging in advanced use of data without the cooperation of the corporations that control the software and hardware infrastructure.[135] While preventing government abuse is crucial, the growing power of technology companies, whose main interest is profit rather than public good, is equally concerning.

Some critics also – and rightly – challenge the common claim that contact tracing apps with GAEN API have been privacy preserving. The reason for the challenge is that it is very difficult to verify whether the data collected has been stored and processed as technology companies claim.[136] This indicates a wider problem: the lack of strong regulation to ensure clear and transparent insight into the workings of technology companies.

These concerns raise two important questions: how will governments rebalance power against dominant technology corporations; and how will they ensure that power is distributed to individuals and communities? As Knodel argues, governments need to move toward designing multistakeholder initiatives with increased ability ‘to respond and help check private sector motivations’.[137]

And as GOVLAB and Knight Foundation argue in their review of the use of data during the pandemic, more coordination between stakeholders would prevent fragmentation in management efforts and functions in future pandemics.[138]

In the light of evidence identified above, as we have already recommended, strong legislation and regulations should be enacted to impose strict purpose and time limitations on digital interventions in times of public crisis. Regulations and oversight mechanisms should be incorporated into emergency legal systems to curb state powers. Governments need to consider a long-term strategy that focuses on collaborating effectively with private technology companies.

Digital vaccine passports

Emergence

From the beginning of the COVID-19 pandemic, establishing some form of ‘immunity passport’ based on evidence or assumption of natural immunity and antibodies after infection with COVID-19 was seen as a possible route out of restrictions.

Governments hoped that immunity passports would allow them to lift mobility restrictions and restore individual freedoms, at least for those who had acquired immunity to the virus.

However, our understanding of infection-induced immunity from the virus was still inadequate due to lack of evidence concerning the level and longevity of antibody levels against COVID-19 after infected by the virus. In this context, these plans were slowed down to allow evidence to accumulate about the efficacy of natural immunity to protect people.[140]

In the meantime, there was considerable investment in efforts to develop vaccine against COVID-19 to protect people through vaccine-induced immunity. On 7 October 2020, Estonia and the World Health Organization (WHO) announced a collaboration to develop a digitally enhanced international certificate of vaccination to help strengthen the effectiveness of the COVAX initiative, which provides COVID-19 vaccines to poorer countries.[141]

The WHO eventually decided to discontinue this project, because the impacts and effectiveness of digital vaccine passports could not be estimated. It also pointed to several scientific, technical and societal concerns with the idea of an international digital vaccine passport system, including the fact that it could prevent citizens of countries unable to secure a vaccine supply from studying, working or travelling abroad.[142]

In November 2020, Pfizer and BioNTech announced their vaccine’s efficacy against COVID-19.[143] In December 2020, the first patient received COVID-19 vaccination in the UK.[144] In the same month, China approved its state-owned COVID vaccine for general use.[145]

Many other vaccines were quickly rolled out, including Moderna, Oxford AstraZeneca and Sputnik V. Countries aimed to roll out vaccination programmes as rapidly as possible to bring down numbers of deaths and cases, and facilitate the easing of COVID-19 restrictions.[146]

This re-energised the idea of establishing national and regional digital vaccine passport systems – among governments, but also among universities, retailers and airlines that sought an alternative to lockdowns.[147]

Despite the lack of scientific evidence on their effectiveness, the majority of countries in our sample eventually introduced digital vaccine passports, with two main purposes: to create a sense of security and to increase vaccine uptake when ending lockdowns.[148]

Unsurprisingly, technology companies raced towards building digital vaccine passports to be used domestically and internationally.[149] The digital identity industry strongly advocated for the introduction of digital vaccine passports.[150] Their argument in support of this was that, if enacted successfully, digital vaccine passports could prove the feasibility of national, regional and international schemes based on proving one’s identity and health status digitally.[151]

Private companies went on to build vaccine passports with the potential to be used in various industries as well by governments, for example, the International Air Transport Association’s Travel Pass app for international travel.[152]

Vaccine passports are not a new concept: paper vaccine passports have been around since the development of smallpox vaccines in the eighteenth century.[153] Although yellow fever is the only disease specified in the International Health Regulations (2005) for which countries may require proof of vaccination as a condition of entry, in the event of outbreaks the WHO recommends that countries ask for proof of vaccines.[154]

COVID-19 vaccine passports are the first digital health certificates that indicate someone’s vaccination against a particular disease. Due to their data-driven digital infrastructure, the health information of individuals can be easily collected, stored and shared. Digital infrastructure of COVID-19 vaccine passports caused public controversy.

When digital vaccine passports emerged, arguments offered in support of them included that they could: allow countries to lift lockdown measures more safely; enable those at lower risk of infection and transmission to help to restart local economies; and allow people to re-engage in social contact with reduced risk and anxiety.

Using a digital rather than a paper-based approach would accommodate future changes in policy, for example vaccine passes expiring or being re-enabled after subsequent infections, based on individual circumstances, countrywide policies or emerging scientific evidence.

Arguments against digital vaccine passports highlighted their potential risks and challenges. These included creating a two-tier society between unvaccinated and vaccinated people, amplifying digital exclusion, and risking privacy and personal freedoms. Experts also highlighted that vaccine passports attempt to manage risks and permit or restrict liberties at an individual level, rather than supporting collective action and contextual measures.

They categorise an individual as lower risk based on their vaccine or test status rather than taking into account a more contextual risk of local infection in a given area. They could also reduce the likelihood of individuals observing social distancing or mask wearing to protect themselves and others.[155]

Digital vaccine passport systems carry specific risks because they gather and store medical and other forms of sensitive personal information that can be compromised through hacking, leaking or selling of data to third parties. They can also be linked to other digital systems that store personal data, for example, the digital identity system Aadhaar in India and the health system Conecte SUS in Brazil.

Experts recommended that strong privacy-preserving technical designs and regulations were needed to prevent such problems, but these were challenging to establish at pace.[156]

These risks and challenges raised questions around public legitimacy and fuelled public resistance to digital vaccine passports in some countries, making it difficult for countries to gain public trust – particularly given the sharp rise in public discontent with governments and political systems due to the pressures of the pandemic.[157]

The Ada Lovelace Institute closely followed the debate regarding digital vaccine passports as they emerged. We conducted evidence reviews, convened workshops with scientists and experts, and published evidence-based research to support decision-making at pace.

Based on the evidence we gathered, we argued that although governments’ attempts to find digital solutions were understandable, rolling out these technologies without high standards of governance could lead to wider societal harms.

The expert deliberation we convened in 2021 suggested that governments should pause their digital vaccine passport plans until there was clear evidence that vaccines were effective in preventing transmission, and that they would be durable and effective against new variants of COVID-19.[158]

We also concluded that it was important to address public concerns and build public legitimacy through transparent adoption policies, secure technical designs and effective communication strategies.

Finally, we highlighted the risk of poorly governed vaccine passports being incorporated into broader systems of identification, and the wider implications of this for the UK and other countries (a risk that has been realised in various countries).[159]

Before proceeding to explaining whether the risks, aspirations and challenges outlined above have materialised, we need to identify the various digital vaccine restrictions and understand how these new technologies have been implemented across the world. In the next section, we discuss digital vaccine passport systems, and the restrictions they have enabled based on a person’s vaccination status or test results.

Types of digital vaccine passport systems and restrictions

In this section, we identify the types of digital vaccine passport systems and restrictions in 34 countries. All countries in our sample introduced digital vaccine passports between January and December 2021 – with varying adoption policies.

Digital vaccine passports were in use in two important public health contexts to either limit or enable individuals’ ability to access certain spaces and activities during the COVID-19 pandemic:

1. Domestic vaccine passport schemes: providing a valid vaccine passport to prove immunity status when participating in public activities (for example, going to a restaurant).
2. International vaccine passport schemes: providing a valid vaccine passport to show immunity status when travelling from one country to another.

The majority of the countries in our sample changed their vaccine passport schemes at multiple times throughout the pandemic.[160] For example, both Türkiye and France introduced digital vaccine passports in summer 2021, internationally for inbound travellers and domestically for residents to access particular spaces (for example, restaurant, museums, concert halls, etc.).

By spring 2022, both countries had lifted vaccine passport mandates domestically but still required inbound travellers to provide immunity proof to avoid self-isolation and testing.

By August 2022, digital vaccine passports were no longer in use or enforced in either country (although the infrastructure is still in place in both countries and can be reused at any time). At the time, China and New Zealand were still enforcing digital vaccine passports – to varying degrees – to maintain their relatively low number of deaths and cases by restricting residents’ eligibility for domestic activities and inbound travellers’ eligibility to visit.

Contrary to China and New Zealand’s severe vaccine passport schemes, many countries, especially European countries, implemented domestic vaccine passport schemes to ease COVID-19 measures and transition from lockdown measures, despite increasing number of cases and hospitalisations (for example, in summer 2022).[161]

We identified eight different vaccine passports systems that allowed or blocked freedoms for residents and inbound travellers in the 34 countries in our sample.

We have coded them according to the severity of their implementation.

There is currently no universal vaccine passport scheme that can determine how and under what circumstances digital vaccine passports can be used internationally as well as for domestic purposes.[162]

In the absence of internationally accepted criteria, countries determined when and how to use digital vaccine passports themselves, leading to a wide range of adoption policies.

• Asian and European countries were among the first to introduce digital vaccine passports in early 2021
• North and South America from mid-2021
• Oceania from late 2021.

The different approaches to using digital vaccine passports in different countries stem from their different technical capabilities, politics, public tolerance, finance and, most importantly, approaches to pandemic management.

Countries with zero-COVID policies, for example China and New Zealand, implemented stringent vaccine passport policies along with closing borders and imposing strict lockdowns on residents to suppress transmission.[163]

Many countries relied on a combination of various measures at different phases of the pandemic. In 2023, all countries in our sample currently have either no or moderate measures in place and seem to have chosen a ‘living with COVID’ policy.

Despite the varying approaches, in all the countries in our sample the technological and legislative infrastructure of vaccine passports are still in place. This is important not only because vaccine passports can still be reused, but because they can be transformed into other forms of digital systems in the future.

Effectiveness

Digital vaccine passports essentially demonstrate an individual’s transmission risk to other people.

A digital vaccine passport scheme relies on the assumption that an individual is a lower risk to others if they have been vaccinated (or if they have gained natural immunity after being infected with and recovering from the disease).

In early 2021, we argued that there was no clear evidence about whether being vaccinated reduced an individual’s risk of transmitting the disease. We suggested that governments should pause deploying vaccine passports until the evidence was clearer.[171]

We also called on governments to build evidence that considers the benefits and risks of digital vaccine passports – in particular, whether they would increase risky behaviours (for example, not observing social distance) by creating a false sense of security.

Despite this lack of evidence, many governments across the world moved forward to introduce digital vaccine passports in 2021.[172]

Policymakers saw digital vaccine passports as valuable public health tools, once the initial scientific trials of vaccines suggested that they would reduce the likelihood of severe symptoms, and hence hospitalisations and deaths.

This was critical for policymaking in many countries whose healthcare systems were under immense pressure.

At the same time, vaccine scepticism was on the rise in many countries. In this context, the idea developed that digital vaccine passport schemes would give people an incentive to get vaccinated. This represented a considerable shift in their purpose, from a digital health intervention aimed at reducing transmission to a behaviour control tool aimed at increase vaccine uptake.

Many countries considered mandatory vaccination for domestic activities as a way to increase uptake. For example, in January 2022, announcing domestic vaccine mandates, French President Macron stated ‘the unvaccinated, I really want to hassle them. And so, we will continue to do it, until the end.’[173]

Mandatory digital vaccine passport schemes raise the question of ‘whether that is ethically acceptable or instead may be an unacceptable form of coercion, detrimental to the right to free self-determination, which is guaranteed for any medical treatment, thus coming to resemble a sort of roundabout coercion’.[174]

In short, it was hoped that digital vaccine passports would positively impact public health in two main ways: (1) reducing transmission, hospitalisations and deaths, and (2) increasing vaccine uptake.

In this section, we will look at the evidence on the effectiveness of digital vaccine passports in both of these senses. We will then briefly explain several evidence gaps that prevent us from building a full understanding of digital vaccine passports’ overall impact on public health.

Impact of digital vaccine passports on reducing transmission, hospitalisations and deaths

In 2023, the scientific evidence on the efficacy of vaccines to reduce transmissions still needs to be elucidated. Although there is some evidence that being vaccinated makes it less likely that one will transmit the virus to others, experts largely agree that ‘a vaccinated person’s risk of transmitting the virus is not considerably lower than an unvaccinated person’.[175] [176] Yet there is strong evidence that vaccines are effective in protecting individuals from developing severe symptoms (although the experts say that their efficacy reduces over several months).[177]

Therefore, even if mandatory domestic vaccine passport schemes did not help to decrease rates of transmission, they might have reduced the pressure on public healthcare because fewer number of people needed medical care. This would only be the case if digital vaccine passports were indeed effective in increasing vaccine uptake (see next section below).

Vaccines have been found to be effective against new variants, but the level of effectiveness is unclear.[178] According to the WHO, there are five predominant variants of COVID-19 and more than 200 subvariants. The WHO also reports that it is becoming more difficult to monitor new variants, since many countries have stopped testing and surveillance.

The infrastructure and legislation of digital vaccine passports are still in place, meaning that they can be reused at any time.

But limited monitoring and research on (sub)variants raises concerns around vaccines’ durability and their ability to be used more widely Governments need to invest in building evidence on the vaccines’ efficacy against rapidly evolving variants if they decide to re-use digital vaccine passport.

Impact of digital vaccine passports on vaccine uptake

Digital vaccine passport systems had a mixed impact on vaccine uptake at an international level. Several countries reported a significant increase in vaccination after the introduction of digital vaccine passports. In France for example, after the digital vaccine passports were introduced, ‘the overall uptake of first doses… increased by around 15% in the last month following a lull in vaccinations.’[179]

Another study suggests that the vaccine passport requirement for domestic travelling and accessing different social settings led to higher vaccination rates in the majority of the EU countries.[180] However, levels of COVID-19 vaccine acceptance were low particularly in West Asia, North Africa, Russia, Africa and Eastern Europe despite the use of digital vaccine passports.[181]

For example, one out of four Russians continued to refuse vaccination despite the government’s plan to introduce mandatory digital vaccine passports for accessing certain spaces (for example, workplaces).[182] Similarly, in Nigeria, Bulgaria, Russia and Romania, black markets for fake passports were created by anti-vaxxers,[183] demonstrated the strength of resistance among some people to getting vaccinated or sharing their data. These examples indicate the importance of political and cultural contexts and urge us to avoid broad international conclusions.

Important evidence gaps

As well as vaccination, the scientific evidence shows that a wide range of measures can reduce the risk of COVID-19 transmission. How have vaccine passports affected individuals’ motivation to follow other COVID-19 protection measures? This question is fundamental: one of the major concerns about digital vaccine passports was that they might give people a false sense of security, leading them to stop following other important COVID-19 health measures such as wearing a face mask.

Some experts argue that digital vaccine passport schemes in the EU led to more infections because they led to increased social contact.[184] But studies that explore this were either conducted in the early phase of the pandemic or remain limited in their scope. This means that we cannot fully evaluate the impact of digital vaccine passports on public health behaviours, so we cannot weigh their benefits against the risks in a comprehensive manner.

To fill this evidence gap, we need studies that examine (and compare) unvaccinated and vaccinated people’s attitudes to other COVID-19 protection measures over time.

A systematic review of community engagement to support national and regional COVID-19 vaccination campaigns demonstrates that working with members (or representatives) of communities to co-design vaccination strategies, build trust in authorities and address misinformation is an effective way to increase vaccine uptake.

The review points to the success of several COVID-19 vaccination rollout programmes, including the United Nations High Commissioner for Refugees efforts to reach migrant workers and refugees, a female-led vaccination campaign for women in Sindh province in Pakistan and work with community leaders to reach out to the indigenous population in Malaysia.[185]

The standard and quality of countries’ healthcare systems also played a huge role in how successfully they tackled vaccine hesitancy. For example, Morocco’s pre-existing national immunisation programme, supported by a successful COVID-19 communications campaign, led to in higher vaccination rates in Morocco compared with other African countries.[186]

This raises another important question, which cannot be comprehensively answered due to limited evidence: were digital vaccine passport policies deployed at the expense of other (non-digital) interventions, such as targeted community-based vaccination programmes?

Governments’ ambition to increase vaccine uptake by using digital vaccine passport schemes (for example, by not allowing unvaccinated people to enter venues) raises the question of whether they expected digital vaccine passports to ‘fix’ the problem of vaccine hesitancy instead of working with communities and effectively communicating scientific evidence.

To comprehensively address this question, governments would need to provide detailed documentation of vaccination rollout programmes and activities and support expert evaluations of the risks and benefits of digital vaccine passport systems, compared with non-digital interventions like vaccination campaigns targeted at communities with high levels of vaccine hesitancy.

Public legitimacy

Public legitimacy was key to ensuring that digital vaccine passports were legitimate and effective health interventions. In the first two years of the pandemic, we conducted a survey and public deliberation research to investigate public attitudes to digital vaccine passports in the UK.

We found that digital vaccine passports needed to be supported by strong governance and accountability mechanisms to build public trust. Our work also highlighted public concern with regards to digital vaccine passport schemes’ potential negative impacts on marginalised and disadvantaged communities. We called on governments to build public trust and create social consensus on whether and how to use digital vaccine passports.[188]

Since then, wider evidence has emerged that complements our findings. For example, an IPSOS Mori survey from March 2021 found that minority ethnic communities in the UK were more concerned than white respondents about vaccine passports being used for surveillance.[189]

This reflects a general trend in UK society: minoritised and disadvantaged people trust public institutions less with personal data than the white majority do.[190] Unsurprisingly, there is also a link between people’s attitudes to digital vaccine passports and vaccine hesitancy.

Those who are less likely to take up the COVID-19 vaccine feel their sense of personal autonomy is threatened by mandatory vaccine passport schemes.[191]

It is difficult to draw conclusions about public acceptance of digital vaccine passports at an international level, since public legitimacy depends on existing legal and constitutional frameworks as well as moral, cultural and political factors in a society.

But we can say that more than 50% of countries in our sample experienced protests against digital vaccine passports and the restrictive measures that they enabled (for example, not being eligible to enter the workplace or travel without proof of vaccination), showing the widespread public resistance across the world.

Countries that saw such protests vary in terms of political cultures and attitudes to technology, including Italy, Russia, France, Nigeria and South Africa. In most cases, anti-digital vaccine passport protests started shortly after national or regional governments had announced mandatory schemes, demonstrating public resistance to using data-driven technology in everyday contexts.

Several studies demonstrated that people were less favourable towards domestic uses of digital vaccine passports than towards their use for international travel.

This was particularly the case for schemes that required people to use a digital vaccine passport to access work, education, and religious settings and activities.[192] Lack of trust in government and institutions, vaccine efficacy and digital vaccine passports’ effectiveness all contributed to public resistance to digital vaccine passport systems.[193]

Inequalities

Digital vaccine passports posed significant inequality risks, including discrimination based on immunity status, excess policing of citizens, and amplification of digital inequalities and other forms of societal inequalities.[196]

In this context, one of the major risks highlighted by the Ada Lovelace Institute was that mandatory vaccine passports could lead to discrimination against unvaccinated people. Mandatory vaccination policies were frequently adopted by (national or regional) governments or workplaces across the countries in our sample.[197]

For example, in November 2021, the Austrian government announced mobility restrictions for unvaccinated people.[198] The measure was ended in January 2022 due to dropping case numbers and decreasing pressure on hospitals. However, the government announced a vaccine mandate policy with penalties of up to €3,000 for anyone who refused to be vaccinated. The controversial law was never enforced due to civil unrest and international criticism.[199]

In Italy, people had to show a ‘green pass’, which included vaccination proof, recovery proof and a negative Polymerase Chain Reaction (PCR) test, to access workplaces between October and December 2021.

The policy officially ended on 1 May 2022, making it illegal for employers to ask for vaccine passports.[200] In 2021, the Moscow Department of Health declared that only vaccinated people could receive medical care.[201] The Mayor of Moscow also instituted a mandatory vaccine passport system for gaining entry to restaurants, bars and clubs after 11pm in the city.

In relation to digital exclusion, we recommended that if governments were to pursue digital vaccine passport plans, they should create non-digital (paper) alternatives for those with no or limited digital access and skills. We also recommended that plans should include different forms of immunity in vaccine passports – such as antigen test results – to prevent discrimination against unvaccinated people.[202]

In some countries, for example, Türkiye, although physical vaccine passports were available, people had to download their vaccination proof as an electronic PDF (portable document format) , which excluded those who were unable to use the internet.[203]

Some countries adopted good practices and policies to mitigate the inequality risks. In India, for example, the Supreme Court decided that vaccination could not be made compulsory for domestic activities and directed the federal government to provide publicly available information on any adverse effects of vaccination.[204]

The UK Government introduced a non-digital NHS COVID Pass letter.[205] Those who did not have access to a smartphone or internet could request this physical letter via telephone.

The European Union’s Digital COVID Certificate could be obtained after taking a biochemical test that demonstrates a form of immunity or lack of infection and hence does not discriminate against those who cannot be or refuse to be vaccinated. This made the Digital COVID Certificate available to wider population, as 25% of the EU population remained unvaccinated as of August 2022.[206]

Global inequalities

Tackling pandemics requires global cooperation. Effective collaboration is needed to fight diseases at regional and global levels.[207] Digital vaccine passports, which were used for border management in the name of public health, created vaccine nationalism, and as a result they amplified global inequalities.[208]

Digital vaccine passports did not emerge in a vacuum; state-centric perspectives that prioritise the ‘nation’s health’ by restricting or controlling certain communities and nations have existed for decades.[209] Securitising trends using the unprecedented compilation and analysis of personal data intensified following the 9/11 terrorist attack in New York.[210]

Countries compiled pandemic-related data about other countries to score risk and produce entry schemes for inbound travellers. This led to the emergence of an international digital vaccine passport scheme where individuals were linked to a verifiable test or vaccine.[211]

Low-income countries found it difficult to meet rigid standards for compliance due to low access to and uptake of vaccines.[212]

There is a positive correlation between a country’s GDP and the share of vaccinated individuals in the population.[213]

According to Our World in Data, when digital vaccine passports were introduced, the share of fully vaccinated people was 17% in Jamaica, 18% in Tunisia and 11% in Egypt.[214] At the other end of the scale, 56% of the population was fully vaccinated in Singapore, 32% in Italy and 37% in Germany.[215]

International digital vaccine passport schemes also resulted in new global tensions. The COVAX initiative led by the WHO, aimed at ensuring equitable access to COVID-19 treatments and vaccines through global collaboration.^[216]

COVISHIELD, a COVID-19 vaccine manufactured in India, was distributed largely to African countries through the COVAX initiative. Nonetheless, the EU, which donated €500 million donation to support the initiative, did not authorise COVISHIELD as part of the EU Digital COVID Certificate system.[217] This meant that the digital vaccine passports of people who had received COVISHIELD in Africa were not recognised as valid in the EU, restricting their ability to travel to EU countries.

As of December 2022, Africa still had the slowest vaccination rate of any continent, with just 33% of the population receiving at least one dose of a vaccine.[218]

In this context, many low- and middle-income countries sought vaccines approved by the European Medicine Agency (EMA). This was challenging due to lack of financial means and the limited number of vaccine manufacturing companies.

The EU Digital COVID Certificate system eventually expanded to only 49 non-EU countries, including Monaco, Türkiye, the UK and Taiwan (to give a few examples from our sample).[219] These countries’ national vaccination programmes offered vaccines authorised for use by EMA in the EU.

Governance, regulation and accountability

Like contact tracing apps, digital vaccine passports had implications for data privacy and human rights, provoking reasonable concerns about proportionality, legality and ethics.

Data protection regimes are based largely on principles that aim to protect rights and freedoms. Included within these is a set of principles and ‘best practices’ that guide data collection in disaster conditions. These include that:

• measures are transparent and accountable
• the limitations of rights are proportional to the harms they are intended to prevent or limit
• data collection is minimised and time constrained
• data is retained for research or public use purposes and unused personal data is destroyed
• data is anonymised in such a way that individuals cannot be reidentified
• third party sharing both within and outside of government is prevented.[221]

In the Checkpoints for vaccine passports report, we made a set of legislative, regulatory and technical recommendations in line with the principles outlined above.

We highlighted the importance of oversight mechanisms to ensure technical efficacy and security, as well as the enforcement of relevant regulations.[222] It is beyond the scope of this report to analyse country-specific regulations and how they were shaped by differences in legal systems and ethical and societal values. But there are several cross-cutting issues and reflections that are worth drawing attention to.

As far as we know, there were fewer incidents of repurposing data and privacy breaches in the case of digital vaccine passports than in relation to contact tracing apps. Yet in some countries, critics warned that data protection principles were not always followed despite relevant regulations being in place.[223] For example, central data systems had security flaws in some countries, for example, in Brazil and Jamaica, which resulted in people’s health records being hacked.[224]

The effectiveness of digital vaccine passports was critical when deciding whether they were proportionate to their intended purpose.[225] When they emerged, some bioethicists argued that digital vaccine passport policies were a justified restriction on civil liberties, since vaccinated people were unlikely to spread the disease and hence posed no risk to others’ right to life.[226]

However, as explained in the previous sections, the evidence does not confirm vaccines’ effectiveness at reducing transmission. And it is noteworthy that some places for example, Vietnam, successfully managed the disease without a focus on technology due to their pre-existing strong healthcare systems.[227]

Our evidence also reveals that although some countries established specific regulations for digital vaccine passports (for example, UK and Canada), this was not the case for most of the countries in our sample.

In many countries, digital vaccine passports were regulated through existing public laws, protocols and general data protection regulations.

This created concerns in those countries without data protection frameworks, for example, South Africa.[228]

In our sample of 34 countries, the EU Digital COVID Certificate regulation is the most comprehensive regulation. It clearly states when the vaccine passport scheme will end (June 2023).[229] It also provides detailed information regarding security safeguards and time limitation.

But it is important to note that the EU does not determine member states’ national policies on vaccine passport use, which means that countries can choose to keep the infrastructure and reuse digital vaccine passports domestically.

Conclusions

Contact tracing apps and digital vaccine passports have been two of the most widely deployed technologies in COVID-19 pandemic response across the world.

They raised hopes through their potential to assist countries in their fight against the COVID-19 virus. At the same time, they provoked concerns about privacy, surveillance, equity and social control, because of the sensitive social and public health surveillance data they use – or are perceived to use.

In the first two years of the pandemic, the Ada Lovelace Institute extensively investigated the societal, legislative and regulatory challenges and risks of contact tracing apps and digital vaccine passports. We published nine reports containing a wide range of recommendations for governments and policymakers about what they should do mitigate these risks and challenges when using these two technologies.

This report builds on this earlier work. It synthesises the evidence on contact tracing apps and digital vaccine passports from a cross-section of 34 countries. The findings should guide governments, policymakers and international organisations when using data-driven technologies in the context of public emergencies, health and surveillance.

They should also support civil society organisations and those advocating for technologies that support fundamental rights and protections, public health and public benefit.

We also identify important gaps in the evidence base. COVID-19 was the first global health crisis of ‘the algorithmic age’, and evaluation and monitoring efforts fell short in understanding the effectiveness and impacts of the technologies holistically.

The evidence gaps identified in this report indicate the need to continue research and evaluation efforts, to retrospectively investigate the impact of COVID-19 technologies so that we can decide on their role in our societies, now and in the future. The gaps should also guide evaluation and monitoring frameworks when using technology in future pandemics and in broader contexts of public health and social care provision.

This report synthesises the evidence by focusing on four questions:

1. Did the new technologies work?
2. Did people accept them?
3. How did they affect inequalities?
4. Were they well governed and accountable?

The limited and inconsistent evidence base and the wide-ranging, international scope present some challenges to answering these questions. Using a wide range of resources, we aim to provide some balance and context to compensate for missing information.

These resources include the media, policy papers, findings from the Ada Lovelace Institute’s workshops, evidence reviews of academic and grey literature, and material submitted to international calls for evidence.

We illustrate the findings on both contact tracing apps and digital vaccine passports with policy and practice examples from the sample countries.

Within the evidence base, the two technologies were implemented using a wide range of technical infrastructures and adoption policies. Despite these divergences and the often hard-to-uncover evidence, there are important cross-cutting findings that can support current and future decision-making around pandemic preparedness, and health and social care provision more broadly.

Cross-cutting findings

Effectiveness: did COVID-19 technologies work?

• Digital vaccine passports and contact tracing apps were – of necessity – rolled out quickly, but without consideration of what evidence would be required to demonstrate their effectiveness. There was insufficient consideration and no consensus reached on how to define, monitor, evaluate or demonstrate their effectiveness­ and impacts.
• There are indications of the effectiveness of some technologies, for example the NHS COVID-19 app (used in England and Wales). However, the limited evidence base makes it hard to evaluate their technical efficacy or epidemiological impact overall at an international level.
• The technologies were not well integrated within broader public health systems and pandemic management strategies, and this reduced their effectiveness. However, the evidence on this is limited in most of the countries in our sample (with a few exceptions, for example Brazil and India), and we do not have clear evidence to compare COVID-19 technologies with non-digital interventions and weigh up their relative benefits and harms.
• It is not clear whether COVID-19 technologies resulted in positive change in people’s health behaviours (for example, whether people self-isolated after receiving an alert from a contact tracing app).
• It is also not clear if public support was impacted by the apps’ technical properties, or the associated policies and implementations.

Public legitimacy: Did people accept COVID-19 technologies?

• Public legitimacy was key to ensuring the success of these technologies, affecting uptake and behaviour.
• The use of digital vaccine passports to enforce restrictions on liberty and increased surveillance caused concern. There were protests against them, and the restrictive policies they enabled, in more than half the countries in our sample.
• Public acceptance of contact tracing apps and digital vaccine passports depended on trust in their effectiveness, as well as trust in governments and institutions to safeguard civil rights and liberties. Individuals and communities who encounter structural inequalities are less likely to trust government institutions and the public health advice they offer. Not surprisingly, these groups were less likely than the general population to use these technologies.
• The lack of targeted public communications resulted in poor understanding of the purpose and technical properties of COVID-19 technologies. This reduced public acceptance and social consensus around whether and how to use the technologies.

Inequalities: How did COVID-19 technologies affect inequalities?

• Some social groups faced barriers to accessing, using or following the guidelines for contact tracing apps and digital vaccine passports, including unvaccinated people, people structurally excluded from sufficient digital access or skills, and people who could not self-isolate at home due to financial constraints. A small number of sample countries adopted policies and practices to mitigate the risk of widening existing inequalities. For example, the EU allowed paper-based Digital COVID Certificates for those without sufficient digital access and skills.
• This raises the question of whether these technologies widened health and other societal inequalities. In the majority of sample countries, there is no clear evidence as to whether governments adopted effective interventions to help those who were less able to use or benefit from these technologies (for example, whether financial support was provided for those who could not self-isolate after receiving an exposure alert due to not being able to work from home).
• The majority of sample countries requested proof of vaccination from inbound travellers before allowing unconditional entry (that is, without a quarantine or self-isolation period) at some stage of the pandemic. This amplified global inequalities by discriminating against the residents of countries that could not secure adequate vaccine supply or had low vaccine uptake – specifically, many African countries.

Governance, regulation and accountability: Were COVID-19 technologies well governed and accountable?

• Contact tracing apps and digital vaccine passports combine health information with social or surveillance data. As they limit rights (for example, by blocking access to travel or entrance to a venue for people who do not have a digital vaccine passport), they must be proportional. This means striking a balance between limitations of rights, potential harms and intended purpose. To achieve this, it is essential that they are governed by robust legislation, regulation and oversight mechanisms, and that there are clear sunset mechanisms in place to determine when they no longer need to be used.
• Most countries in our sample governed these technologies in line with pre-existing legislative frameworks, which were not always comprehensive. Only a few countries enacted robust regulations and oversight mechanisms specifically governing contact tracing apps and digital vaccine passports, including the UK, EU member states, Taiwan and South Korea.
• The lack of robust data governance frameworks, regulation and oversight mechanisms led to lack of clarity about who was accountable for misuse or poor performance of COVID-19 technologies. Not surprisingly, there were incidents of data leaks, technical errors and data being reused for other purposes. For example, contact tracing app data was used in police investigations in Singapore and Germany, and sold to third parties for commercial purposes in the USA.[230]
• Many governments relied on private technology companies to develop and deploy these technologies, demonstrating and reinforcing the industry’s influence and the power located in digital infrastructure.

Lessons

In light of these findings, there are clear lessons for governments and policymakers deciding how to use digital vaccine passports and contact tracing apps in the future.

These lessons may also apply more generally to the development and deployment of new data-driven technologies and approaches.

Effectiveness

To build evidence on the effectiveness of contact tracing apps and digital vaccine passports:

• Support research and learning efforts on impact of these technologies on people’s health behaviours.
• Understand the impacts of apps’ technical properties, and of policies and approaches to implementation, on people’s acceptance of, and experiences of, these technologies in specific socio-cultural contexts and across geographic locations.
• Weigh up their benefits and harms by considering their role within the broader COVID-19 response and comparing with non-digital interventions (for example, manual contact tracing).
• Use this impact evaluation to help set standards and strategies for the future use of these technologies in public crises.

To ensure the effective use of technology in future pandemics:

• Invest in research and evaluation from the start, and implement a clear evaluation framework to build evidence during deployment that supports understanding of the role that technologies play in broader pandemic health strategies.
• Define criteria for effectiveness using a human-centred approach that goes beyond technical efficacy and builds an understanding of people’s experiences.
• Establish how to measure and monitor effectiveness by working closely with public health experts and communities, and set targets accordingly.
• Carry out robust impact assessments and evaluation.

Public legitimacy

To improve public acceptance:

• Build public trust by publicly setting out guidance and enacting clear law about permitted and restricted uses and mechanisms to support rights, and redress and tackle legal issues.
• Effectively communicate the purpose of using technology in public crises, including the technical infrastructure and legislative framework of specific technologies, to address public hesitancy and create social consensus.

Inequalities

To avoid making societal inequalities worse:

• Create monitoring mechanisms that specifically address the impact of technology on inequalities. Monitor the impact on public health behaviours, particularly in relation to social groups who are more likely to encounter health and other forms of social inequalities.
• Use the impact evidence to identify marginalised and disadvantaged communities and to establish strong public health services, interventions and social policies to support them.

To avoid creating or reinforcing global inequalities and tensions:

• Harmonise global, national and regional regulatory tools and mechanisms to address global inequalities and tensions.

Governance and accountability

To ensure that individual rights and freedoms are protected:

• Establish strong data governance frameworks and make sure that regulatory bodies and clear sunset mechanisms are in place.
• Create specific guidelines and laws to make sure that technology developers follow privacy-by-design and ethics-by-design principles, and that effective monitoring and evaluation frameworks and sunset mechanisms are in place for the deployment of technologies.
• Build clear evidence about the effectiveness of new technologies to make sure that their use is proportionate to their intended results.

To reverse the growing power imbalance between governments and the technology industry:

• Develop the public sector’s technical literacy and ability to create technical infrastructure. This does not mean that the private sector should be excluded from developing technologies related to public health, but it is crucial that technical infrastructure and governance are effectively co-designed by government, civil society and private industry.

The legacy of COVID-19 technologies? Outstanding questions

This report synthesises evidence that has emerged on contact tracing apps and digital vaccine passports from 2020 to 2023. These technologies have short histories, but they have potential long-term, societal implications and bring opportunities as well as challenges.

In this research we have attempted to uncover evidence of existing practices rather than speculating about the potential long-term impacts.

In the first two years of the pandemic, the Ada Lovelace Institute raised concerns about the potential risks and negative longer-term implications of COVID-19 technologies for society, beyond the COVID-19 pandemic. The main concerns were about:

• repurposing of digital vaccine passports and contact tracing apps beyond the health context, such as for generalised surveillance
• expanding or transforming of digital vaccine passports into wider digital identity systems by allowing digital vaccine passports to ‘set precedents and norms that influence and accelerate the creation of other systems for identification and surveillance’
• damaging public trust in health and social data-sharing technologies if these technologies were mismanaged, repurposed or ineffective.[231]

In this section, we identify three outstanding research questions which would allow these three potential longer-term risks and implications. Addressing these questions will require consistent research and thinking on the evolution of COVID-19 technologies and their longer-term implications for society and technology.

Governments, civil society and the technology industry should consider the following under-researched questions, and should work together to increase understanding of contact tracing apps and digital vaccine passports and their long-term impact.

Question 1: Will contact tracing apps and digital vaccine passports continue to be used? If so, what will happen to the collected data?

Only a minority of countries, including Australia, Canada and Estonia,[232] have decommissioned their contact tracing apps and deleted the data collected. Digital vaccine passport infrastructure is still in place in many countries across the world, despite most countries having adopted a ‘living with COVID’ policy.

It is important to consider the current and future objectives of governments that are preserving these technological infrastructures, as well as how they intend to use the collected data beyond the pandemic. Given that most countries in our sample did not enact strong regulations with sunset clauses that restrict use and clarify structures or guidance to support deletion, it is crucial that we continue to monitor the future uses of these technologies and ensure that they are not repurposed beyond the health context.

Question 2: How will the infrastructure of COVID-19 technologies and related regulation persist in future health data and digital identity systems?

Digital vaccine passports have accelerated moves towards digital identity schemes in many countries and regional blocs.[233] In Saudi Arabia, the Tawakkalna contact tracing app has been transformed into a comprehensive digital identity system, which received a public service award from the United Nations for institutional resilience and innovative responses to the COVID-19 pandemic.[234]

The African Union, which built the My COVID Pass vaccine passport app in collaboration with African Centres for Disease Control and Prevention, is working towards building a digital ID framework for the African continent. The EU introduced uniform and inter-operable proofs of vaccination through the EU Digital COVID Certificate .

It is not yet clear what the societal implications of these changes of use are, or how they will affect fundamental rights and protections. Following the Digital COVID Certificate’s perceived success among policymakers, the European Commission plans to introduce an EU digital wallet that will give every EU citizen digital identity credentials that are recognised throughout the EU zone.

In some countries, healthcare systems have been transformed as a result of COVID-19 technologies. India has transformed its contact tracing app Aarogya Setu to become the nation’s health app.[235]

In the UK, data and AI have been central to the Government’s response to the pandemic. This has accelerated proposals to use health data for research and planning services. NHS England has initiated a ‘federated data platform’. This will enable NHS organisations to share their operational data through software.

It is hoped that researchers and experts from academia, industry and the charity sector will use the data gathered on the platform for research and analysis to improve the health sector in England.[236]

The federated data platform initiative has been recognised for its potential to transform the healthcare system, but it has also caused concerns about accountability and trustworthiness, as patients’ data will be accessible to many stakeholders. [237] These include private technology companies like Palantir, which has been reported as not always being transparent in how it gathers, analyses and uses people’s data.[238]

These changes in digital identity and health ecosystems can provide significant economic and societal benefits to individuals and nations.[239] But they should be well designed and governed in order to benefit everyone in society. In this context, it is necessary to continue monitoring the evolution of COVID-19 technologies into new digital platforms and to understand their legislative, technical and societal legacies.

Question 3: How have COVID-19 technologies affected public’s attitudes towards data-driven technologies in general?

There is a lot of research on public attitudes towards  COVID-19 technologies. This body of research was largely undertaken in the first years of the pandemic.[240] But, the question of whether, and how, they have affected people’s attitudes towards data-driven technologies beyond the pandemic has not had much attention.

People had to use these technologies in their everyday lives to prove their identity and share their health and other kinds of personal information. But, as demonstrated in this report, there have been incidents that might have damaged people’s confidence in the technologies’ safety and effectiveness.

In this context, we believe that it is crucial to continue to reflect on COVID-19 technologies’ persistent impacts on public attitudes towards data-driven technologies – particularly, those technologies that entail sensitive personal data.

Methodology

In 2020 and 2021, the Ada Lovelace Institute conducted extensive research on COVID-19 technologies. We organised workshops and webinars, and conducted public attitudes research, evidence reviews and desk research. We published nine reports and two monitors. This body of research highlighted the risks and challenges these  technologies posed and made policy recommendations to ensure that they would not cause or exacerbate harms and would benefit everyone in society equally.

In the first two years of the pandemic, many countries rolled out digital vaccine passports and contact tracing apps, as demonstrated in ‘International monitor: vaccine passports and COVID-19 status apps’.[241] In January 2022, as we were entering the third year of the pandemic, we adjusted the scope and objectives of the COVID-19 technologies project. In the first two years of the pandemic, we had focused on the benefits, risks and challenges; now we started focusing on the lessons learned from these technologies from January 2022 onwards. We aimed to address the following questions:

1. Did COVID-19 technologies work? Were they effective public health tools?
2. Did people accept them?
3. How did they affect inequalities?
4. Were they governed well and with accountability?
5. What lessons can we learn from the deployment and uses of these new technologies?

Sampling

We aimed for regional representation in our sample. We decided to focus on policies and practices in 34 countries in total. We based our sampling on geographical regions of North Africa, Central Africa, South Africa, South East Asia, Central Asia, East Asia, North America, South America, Eastern Europe, European Union, West Asia, North Africa and Oceania.

Relying on Our World in Data^[242] datasets on total deaths, total cases and the share of people who had completed the initial vaccine protocol in 194 countries on 5 June 2022, we created a pandemic impact score for each country, giving equal weight to each of the three variables.

In each geographical region, we then selected two countries with the highest impact score, two countries with medium impact score, and two countries with low impact score for detailed review.

Methods and evidence

This research project encompasses evidence from 34 countries (see the list of the countries in our sample).

Unsurprisingly, the amount and type of evidence on each country varies significantly. Our aim in this research project is not to compare these countries with very different technical infrastructures, political cultures and pandemic management strategies, but to have a number of shared criteria against which we can assess the policies, practices and technical infrastructure in these countries.

With this aim in mind, we established a list of data categories to collect country-specific information:

• introduction date of vaccine passports
• end date of vaccine passport regulations
• protests against vaccine passports or contact tracing apps
• implementations of vaccine passports, for example, being mandatory in workplaces, for international travel, etc.
• cumulative number of cases when digital vaccine passports were introduced
• cumulative number of deaths when digital vaccine passports were introduced
• share of the vaccinated people when digital vaccine passports were introduced
• whether there was a government-launched contact tracing app
• technical infrastructure of contact tracing apps
• reported cases of surveillance
• reported cases of repurposing data
• reported cases of rights infringements
• evidence on whether COVID-19 technologies increased societal inequalities (for example, around digital exclusion)
• evidence on whether COVID-19 technologies increased global inequalities
• evidence on the effectiveness of digital vaccine passports and contact tracing apps.

We used the following methods and resources to gather evidence on the data categories outlined above:

External datasets

We used quantitative datasets of other organisations’ data trackers and policy monitors for the following data categories:

• proportion of the vaccinated people from Our World in Data.[243]
• COVID restrictions (for example, school closures, lockdowns, etc.) from Blavatnik School of Government, Oxford University.[244]
• cumulative number of cases from Our World in Data.[245]
• cumulative number of deaths from Our World in Data.[246]

Call for evidence

In July 2022, we announced an international call for input on the effectiveness and social impact of digital vaccine passports and contact tracing apps. We incorporated the relevant evidence submitted to this call into the evidence base. For some countries, the evidence submitted was helpful as it either provided us with the missing information or confirmed that the respective country did not have an official regulation (or protocol) to govern vaccine passports or contact tracing apps.

We also worked with some of the individuals and organisations that submitted evidence as consultants to acquire further information on their respective country of expertise.

Workshop

We organised a workshop for evidence building in October 2022. The workshop aimed to discuss the effectiveness of contact tracing apps with experts from the disciplines of epidemiology, cybersecurity, public health, law and media and communications.

The aim of the workshop was to deliberate on the effectiveness of contact tracing apps in Europe. The multidisciplinary background of the workshop participants allowed a focus on the effectiveness beyond technical efficacy by considering the social, legislative and regulatory impacts of apps.

Desk research

Between August 2022 and January 2023 we conducted multiple, structured internet search queries using a set of keywords for each country in our sample. These keywords include ‘vaccine certificate’, ‘vaccine passport’, ‘immunity certificate’, ‘digital contact tracing’, ‘contact tracing app’, ‘COVID technologies’ and ‘the name of the country’.

This approach to desk research enabled collection and analysis of evidence from three different types of resources: media news, government websites, and academic and grey literature (produced by organisations who are not traditional publishers, including government documents, or third-sector organisation reports).

Limitations

There are 34 countries in this research sample. Although the sampling covers every continent, as discussed in the sampling section, we do not claim that our country-specific findings are representative of continents, regions or political blocs. Similarly, we also do not claim exhaustive evidence on developments in every country.

We also recognise that as a UK-based organisation, there might be barriers to discovering evidence emerging from various parts of the world. Our qualitative evidence on media reports in particular is largely in the English language – although there are a few exceptions. We worked with consultants from Brazil, India, Egypt, China and South Africa who provided us with non-English language media and government reports that we had not been able to capture through desk research.

The language barrier also emerged in our policy analysis. We aimed to collect data on policies and regulations from government websites and official policy papers. We used online translation software to conduct research in the official languages of the countries in our sample.

The low rate of success in discovering official policy papers of countries indicates that there are limitations to this method. Not all governments made policies and practices of contact tracing apps and digital vaccine passports publicly available. In this context, while the low amount of policy papers we gathered is partly due to the language barrier, it also relates to governments’ lack of transparency about the uses and governance of these technologies.

Acknowledgements

This report was lead-authored by Melis Mevsimler, with substantive contributions from Bárbara Prado Simão, Dr Nagla Rizk, Gabriella Razzano and Prateek Waghre, who provided evidence and analysis as consultants.

Participants in the workshop:

Professor Christophe Fraser, University of Oxford

Professor Susan Landau, Tufts University

Dr Frans Folkvord, Tilburg University

Claudia Wladdimiro Quevedo, Uppsala University

Dr Simon Williams, Swansea University

Francisco Lupianez Villanueva, Open University of Catalonia

Krzysztof Izdebski, Open Spending EU Coalition

Dr Stephen Farrell, Trinity College Dublin

Dr Laszlo Horvath, Birbeck University

Dr Mustafa Al-Haboubi, London School of Hygiene & Tropical Science

Danqi Guo, Free University of Berlin

Dr Federica Lucivero, University of Oxford

Shahrzad Seyfafheji, Bilkent University

Dr Agata Ferretti, ETH Zurich

Yasemin Gumus Agca, Bilkent University

Boudewijn van Eerd, AWO

Peer reviewers:

Eleftherios Chelioudakis, AWO

Hunter Dowart, Bird & Bird

Professor Ana Beduschi, University of Exeter

---

Footnotes

[1] Carly Kind, ‘What will the first pandemic of the algorithmic age mean for data governance?’ (Ada Lovelace Institute, 2 April 2020) www.adalovelaceinstitute.org/blog/first-pandemic-of-the-algorithmic-age-data-governance/#:~:text=Coronavirus%20is%20the%20first%20pandemic,its%20detection%2C%20treatment%20and%20prevention accessed 12 April 2023.

[2] The BMJ, ‘Artificial intelligence and Covid-19’, www.bmj.com/AICOVID19 accessed 31 March 2023.

[3] For example, G Samuel and others, ‘COVID-19 Contact Tracing Apps: UK Public Perceptions’ (2021) 32:1 Critical Public Health 31, https://doi.org/10.1080/09581596.2021.1909707; MC Mills and T Ruttanauer, ‘The Effect of Mandatory COVID-19 Certificates on Vaccine Uptakes: Synthetic-Control Modelling of Six Countries’ (2022) 7:1 The Lancet 15, https://doi.org/10.1016/S2468-2667(21)00273-5.

[4] ‘COVID-19 Law Lab’ https://covidlawlab.org accessed 31 March 2023; ‘Lex-Atlas: Covid-19’ https://lexatlas-c19.org accessed 31 March 2023; ‘Digital Global Health and Humanitarianism Lab (DGHH Lab)’ https://dghhlab.com/publications/#PUB-DRCOVID19 accessed 31 March 2023.

[5] AWO, ‘Assessment of Covid-19 response in Brazil, Colombia, India, Iran, Lebanon and South Africa’ (29 July 2021) www.awo.agency/blog/covid-19-app-project accessed 13 April 2023.

[6] MIT Technology Review, ‘Covid Tracing Tracker’ www.technologyreview.com/tag/covid-tracing-tracker accessed 31 March 2023.

[7] World Health Organization, ‘Statement on the fourteenth meeting of the International Health Regulations (2005) Emergency Committee regarding the coronavirus disease (COVID-19) pandemic’ (WHO, 30 January 2023) www.who.int/news/item/30-01-2023-statement-on-the-fourteenth-meeting-of-the-international-health-regulations-(2005)-emergency-committee-regarding-the-coronavirus-disease-(covid-19)-pandemic accessed 31 March 2023.

[8] World Health Organization, ‘Statement on the fifteenth meeting of the IHR (2005) Emergency Committee on the COVID-19 pandemic’, (WHO 5 May 2023) https://www.who.int/news/item/05-05-2023-statement-on-the-fifteenth-meeting-of-the-international-health-regulations-(2005)-emergency-committee-regarding-the-coronavirus-disease-(covid-19)-pandemic accessed 31 May 2023

[9] GOVLAB and Knight Foundation, ‘The #Data4Covid19 Review’ https://review.data4covid19.org accessed 12 April 2023.

[10] M Shahroz and others, ‘COVID-19 Digital Contact Tracing Applications and Techniques: A Review Post Initial Deployments’ (2021) 5 Transportation Engineering 100072, https://doi.org/10.1016/j.treng.2021.100072.

[11] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023.

[12] A Hussain, ‘TraceTogether data used by police in one murder case: Vivian Balakrishnan (Yahoo! News, 5 January 2021) https://uk.style.yahoo.com/trace-together-data-used-by-police-in-one-murder-case-vivian-084954246.html?guccounter=2 accessed 12 April 2023; DW, ‘German police under fire for misuse of COVID app’ DW (11 January 2022) www.dw.com/en/german-police-under-fire-for-misuse-of-covid-contact-tracing-app/a-60393597 accessed 31 March 2023.

[13] Carly Kind, ‘What will the first pandemic of the algorithmic age mean for data governance?’ (Ada Lovelace Institute, 2 April 2020) www.adalovelaceinstitute.org/blog/first-pandemic-of-the-algorithmic-age-data-governance/#:~:text=Coronavirus%20is%20the%20first%20pandemic,its%20detection%2C%20treatment%20and%20prevention accessed 26 April 2023.

[14] The BMJ, ‘Artificial intelligence and covid-19’, www.bmj.com/AICOVID19 accessed 31 March 2023.

[15] LO Danquah and others, ‘Use of a Mobile Application for Ebola Contact Tracing and Monitoring in Northern Sierra Leone: A Proof-of-Concept Study’ (2019) 19 BMC Infectious Diseases 810, https://doi.org/10.1186/s12879-019-4354-z.

[16] Fabio Chiusi and others, ‘Automating COVID Responses: The Impact of Automated Decision-Making on the COVID-19 Pandemic’ (AlgorithmWatch 2022) https://algorithmwatch.org/en/wp-content/uploads/2021/12/Tracing-The-Tracers-2021-report-AlgorithmWatch.pdf accessed 26 April 2023.

[17] F Yang, L. Heemsbergen and R Fordyce, ‘Comparative Analysis of China’s Health Code, Australia’s COVIDSafe and New Zealand’s COVID Tracer Surveillance App: A New Corona of Public Health Governmentality?’ (2020) 178:1 Media International Australia 182, 10.1177/1329878X20968277.

[18] F Yang, L Heemsbergen and R Fordyce, ‘Comparative Analysis of China’s Health Code, Australia’s COVIDSafe and New Zealand’s COVID Tracer Surveillance App: A New Corona of Public Health Governmentality?’ (2020) 178:1 Media International Australia 182, 10.1177/1329878X20968277.

[19] Ada Lovelace Institute, ‘Health data and COVID-19 technologies’ https://www.adalovelaceinstitute.org/our-work/programmes/health-data-covid-19-tech/
accessed 31 May 2023.

[20] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 30 March 2023.

[21] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 30 March 2023; Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 30 March 2023.

[22] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023; ‘Exit through the App Store? COVID-19 Rapid Evidence Review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 12 April 2023; ‘No Green Lights, No Red Lines’ (2020) www.adalovelaceinstitute.org/report/covid-19-no-green-lights-no-red-lines accessed 12 April 2023; ‘Confidence in a Crisis? Building Public Trust in a Contact Tracing App’ (2020) www.adalovelaceinstitute.org/report/confidence-in-crisis-building-public-trust-contact-tracing-app accessed 12 April 2023.

[23] DW, ‘German police under fire for misuse of COVID app’ DW (11 January 2022) www.dw.com/en/german-police-under-fire-for-misuse-of-covid-contact-tracing-app/a-60393597 accessed 31 March 2023; E Tham, ‘China Bank Protest Stopped by Health Codes Turning Red, Depositors Say’ (Reuters, 16 June 2022) www.reuters.com/world/china/china-bank-protest-stopped-by-health-codes-turning-red-depositors-say-2022-06-14 accessed 31 March 2023.

[24] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (2023) https://covid19.adalovelaceinstitute.orgaccessed 31 May 2023.

[25] Ada Lovelace Institute, ‘Health data and COVID-19 technologies’  https://www.adalovelaceinstitute.org/our-work/programmes/health-data-covid-19-tech accessed 31 May 2023.

[26] Centers for Disease Control and Prevention ‘Contact Tracing’ (2022) www.cdc.gov/coronavirus/2019-ncov/easy-to-read/contact-tracing.html accessed 31 March 2023.

[27] M Hunter, ‘Track and Trace, Trial and Error: Assessing South Africa’s Approaches to Privacy in Covid-19 Digital Contact Tracing’ (December 2020) www.researchgate.net/publication/350896038_Track_and_trace_trial_and_error_Assessing_South_Africa%27s_approaches_to_privacy_in_Covid-19_digital_contact_tracing accessed 31 March 2023.

[28] Some areas used manual contact tracing effectively, for example Vietnam and the Indian state of Kerala. See G Razzano, ‘Digital hegemonies for COVID-19’ (Global Data Justice, 5 November 2020) https://globaldatajustice.org/gdj/188 accessed 31 March 2023.

[29] C Yang, ‘Digital Contact Tracing in the Pandemic Cities: Problematizing the Regime of Traceability in South Korea’ (2022) 9:1 Big Data & Society https://doi.org/10.1177/20539517221089294.

[30] Freedom House ‘Freedom on the net 2021: South Africa’ (2021) https://freedomhouse.org/country/south-africa/freedom-net/2021 accessed 31 March 2023.

[31] M Hunter, ‘Track and Trace, Trial and Error: Assessing South Africa’s Approaches to Privacy in Covid-19 Digital Contact Tracing’ (December 2020) www.researchgate.net/publication/350896038_Track_and_trace_trial_and_error_Assessing_South_Africa%27s_approaches_to_privacy_in_Covid-19_digital_contact_tracing accessed 31 March 2023.

[32] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 9 June 2023.

[33] Ada Lovelace Institute, ‘Provisos for a contact tracing app: The route to trustworthy digital contact tracing’ (4 May 2020) www.adalovelaceinstitute.org/evidence-review/provisos-covid-19-contact-tracing-app accessed 31 March 2023.

[34] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (2023), https://covid19.adalovelaceinstitute.org  accessed 31 May 2023

[35] M Ciucci and F Gouarderes, ‘National COVID-19 Contact Tracing Apps’ (Think Tank European Parliament, 15 May 2020) www.europarl.europa.eu/thinktank/en/document/IPOL_BRI(2020)652711 accessed 31 March 2023.

[36] M Briers, C Holmes and C Fraser, ‘Demonstrating the impact of the NHS COVID-19 app: Statistical analysis from researchers supporting the development of the NHS COVID-19 app’ (The Alan Turing Institute, 2020) www.turing.ac.uk/blog/demonstrating-impact-nhs-covid-19-app accessed 31 March 2023.

[37] M Veale, ‘The English Law of QR Codes: Presence Tracing and Digital Divides’ (Lex-Atlas: Covid-19, 25 May 2021) https://lexatlas-c19.org/the-english-law-of-qr-codes accessed 31 March 2023.

[38] M Veale, ‘The English Law of QR Codes: Presence Tracing and Digital Divides’ (Lex-Atlas: Covid-19, 25 May 2021) https://lexatlas-c19.org/the-english-law-of-qr-codes accessed 31 March 2023.

[39] Ministry of Health, ‘Ministry of Health to trial Near Field Communication (NFC) tap in technology with NZ COVID Tracer’ (Ministry of Health, New Zealand, 2021) www.health.govt.nz/news-media/media-releases/ministry-health-trial-near-field-communication-nfc-tap-technology-nz-covid-tracer accessed 14 April 2023.

[40] We draw on evidence on a cross-section of 34 countries in this report. Three countries in our sample never launched a national contact tracing app, and we could not find reliable information on six countries. You can find more information on technical infrastructure of contact tracing apps on COVID-19 data explorer. Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (May 2023), https://covid19.adalovelaceinstitute.org  l accessed 31 May 2023

[41] L White and P Basshuysen, ‘Privacy versus Public Health? A Reassessment of Centralised and Decentralised Digital Contact Tracing’ (2021) 27 Science and Engineering Ethics 23 https://doi.org/10.1007/s11948-021-00301-0 accessed 31 March 2023

[42] M Ciucci and F Gouarderes, ‘National COVID-19 Contact Tracing Apps’ (Think Tank European Parliament, 15 May 2020) www.europarl.europa.eu/thinktank/en/document/IPOL_BRI(2020)652711 accessed 31 March 2023.

[43] E Braun, ‘French contact-tracing app sent just 14 notifications after 2 million downloads’ (Politico, 23 June 2020) www.politico.eu/article/french-contact-tracing-app-sent-just-14-notifications-after-2-million-downloads accessed 31 March 2023; BBC News ‘Australia Covid: Contact tracing app branded expensive “failure”’ (10 August 2022) www.bbc.co.uk/news/world-australia-62496322 accessed 31 March 2023.

[44] M Veale, ‘Opinion: Privacy is not the problem with the Apple-Google contact tracing app’ (UCL News, 1 July 2020) www.ucl.ac.uk/news/2020/jul/opinion-privacy-not-problem-apple-google-contact-tracing-app accessed 31 March 2023; N Lomas ‘Germany ditches centralized approach to app for COVID-19 contacts tracing’ (TechCrunch, 27 April 2020) https://techcrunch.com/2020/04/27/germany-ditches-centralized-approach-to-app-for-covid-19-contacts-tracing accessed 31 March 2023.

[45] G Goggin, ‘COVID-19 Apps in Singapore and Australia: Reimagining Health Nations with Digital Technology’ (2020) 177:1 Media International Australia 61, 10.1177/1329878X20949770.

[46] G Goggin, ‘COVID-19 Apps in Singapore and Australia: Reimagining Health Nations with Digital Technology’ (2020) 177:1 Media International Australia 61, 10.1177/1329878X20949770.

[47] M Ciucci and F Gouarderes, ‘National COVID-19 Contact Tracing Apps’ (Think Tank European Parliament, 15 May 2020) www.europarl.europa.eu/thinktank/en/document/IPOL_BRI(2020)652711 accessed 26 May 2023 C Gorey, ‘4 things you need to know before installing the HSE Covid-19 contact-tracing app’ (Silicon Republic, 7 July 2020) www.siliconrepublic.com/enterprise/hse-COVID-19-contact-tracing-app accessed 31 March 2023.

[48] AL Popescu, ‘România în urma pandemiei. Statul ignoră propria aplicație anti-Covid, dar și una lansată gratis’ (Europa Libera Romania, 27 November 2020) https://romania.europalibera.org/a/rom%C3%A2nia-%C3%AEn-urma-pandemiei-statul-ignor%C4%83-propria-aplica%C8%9Bie-anti-covid-dar-%C8%99i-una-lansat%C4%83-gratis/30972627.html accessed 31 March 2023; Fabio Chiusi and others, ‘Automating COVID Responses: The Impact of Automated Decision-Making on the COVID-19 Pandemic’ (AlgorithmWatch 2022) https://algorithmwatch.org/en/wp-content/uploads/2021/12/Tracing-The-Tracers-2021-report-AlgorithmWatch.pdf accessed 31 March 2023 https://romania.europalibera.org/a/românia-în-urma-pandemiei-statul-ignoră-propria-aplicație-anti-covid-dar-și-una-lansată-gratis/30972627.html

[49] Several countries in our sample, such as China and India, had a very fragmented contact tracing app ecosystem, with various states/cities/municipalities attempting to create their own apps. There are therefore notable differences across provinces, making difficult to capture the diversity of implementation and experiences.

[50] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (2023), https://covid19.adalovelaceinstitute.org l accessed 31 May 2023

[51] UK Health Security Agency, ‘NHS COVID-19 app’ (gov.uk, 2020) www.gov.uk/government/collections/nhs-covid-19-app accessed 31 March 2023.

[52] MIT Technology Review, ‘Covid Tracing Tracker’ (2021) www.technologyreview.com/tag/covid-tracing-tracker accessed 31 March 2023.

[53] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (19 April 2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 31 March 2023, 4.

[54] C Wymant, ‘The epidemiological impact of the NHS COVID-19 app’ (National Institutes of Health, 2021) https://pubmed.ncbi.nlm.nih.gov/33979832/ accessed 31 March 2023.

[55] RW Albertus and F Makoza, ‘An Analysis of the COVID-19 Contact Tracing App in South Africa: Challenges Experienced by Users’ (2022) 15:1 African Journal of Science, Technology, Innovation and Development 124,  https://doi.org/10.1080/20421338.2022.2043808; Office of Audit and Evaluation (Health Canada) and the Public Health Agency of Canada, ‘Evaluation of the National COVID-19 Exposure Notification App’ (Health Canada, 20 June 2022) www.canada.ca/en/health-canada/corporate/transparency/corporate-management-reporting/evaluation/covid-alert-national-covid-19-exposure-notification-app.html accessed 26 May 2023.

[56] F Vogt and others, ‘Effectiveness Evaluation of Digital Contact Tracing for COVID-19 in New South Wales, Australia’ (2022) 7:3 The Lancet E250, https://doi.org/10.1016/S2468-2667(22)00010-X; Ada Lovelace Institute, ‘Provisos for a contact tracing app: The route to trustworthy digital contact tracing’ (2020) www.adalovelaceinstitute.org/evidence-review/provisos-covid-19-contact-tracing-app accessed 26 May 2023.

[57] E Braun, ‘French contact-tracing app sent just 14 notifications after 2 million downloads.’ (Politico, 23 June 2020) www.politico.eu/article/french-contact-tracing-app-sent-just-14-notifications-after-2-million-downloads accessed 31 March 2023.

[58] F Vogt and others, ‘Effectiveness Evaluation of Digital Contact Tracing for COVID-19 in New South Wales, Australia’ (2022) 7:3 The Lancet E250, https://doi.org/10.1016/S2468-2667(22)00010-X; AWO, ‘Assessment of Covid-19 response in Brazil, Colombia, India, Iran, Lebanon and South Africa’ (29 July 2021) www.awo.agency/blog/covid-19-app-project accessed 13 April 2023.

[59] AWO, ‘Assessment of Covid-19 response in Brazil, Colombia, India, Iran, Lebanon and South Africa’ (29 July 2021) www.awo.agency/blog/covid-19-app-project accessed 13 April 2023.

[60] For example, see Y Huang and others, ‘Users’ Expectations, Experiences, and Concerns with COVID Alert, and Exposure-Notification App’ (2022) 6: CSCW2 ACM Journals: Proceedings of the ACM on Human–Computer Interaction 350, https://doi.org/10.1145/3555770.

[61] ‘Digital Global Health and Humanitarianism Lab (DGHH Lab)’ https://dghhlab.com/publications/#PUB-DRCOVID19 accessed 31 March 2023.

[62] ‘Digital Global Health and Humanitarianism Lab (DGHH Lab)’ https://dghhlab.com/publications/#PUB-DRCOVID19 accessed 31 March 2023.

[63] BBC News, ‘Covid in Scotland: Thousands turn off tracking app’ (24 July 2021) www.bbc.co.uk/news/uk-scotland-57941343 accessed 31 March 2023.

[64] S Trendall, ‘Data suggests millions of users have not enabled NHS contact-tracing app’ (Public Technology, 30 June 2021) www.publictechnology.net/articles/news/data-suggests-millions-users-have-not-enabled-nhs-contact-tracing-app accessed 31 March 2023.

[65] V Garousi and D Cutting, ‘What Do Users Think of the UK’s Three COVID-19 Contact Tracing Apps? A Comparative Analysis’ (2021) 28:1 BMJ Health Care Inform e100320, 10.1136/bmjhci-2021-100320.

[66] Office of Audit and Evaluation (Health Canada) and the Public Health Agency of Canada, ‘Evaluation of the National COVID-19 Exposure Notification App’ (Health Canada, 20 June 2022) www.canada.ca/en/health-canada/corporate/transparency/corporate-management-reporting/evaluation/covid-alert-national-covid-19-exposure-notification-app.html accessed 31 March 2023.

[67] Y Huang and others, ‘Users’ Expectations, Experiences, and Concerns with COVID Alert, and Exposure-Notification App’ (2022) 6: CSCW2 ACM Journals: Proceedings of the ACM on Human–Computer Interaction 350, https://doi.org/10.1145/3555770.

[68] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 31 March 2023.

[69] C Wymant, ‘The epidemiological impact of the NHS COVID-19 app’ (National Institutes of Health, 2021) https://directorsblog.nih.gov/2021/05/25/u-k-study-shows-power-of-digital-contact-tracing-in-the-pandemic accessed 26 May 2023.

[70] Ada Lovelace Institute, ‘Confidence in a crisis? Building public trust in a contact tracing app’ (2020) www.adalovelaceinstitute.org/report/confidence-in-crisis-building-public-trust-contact-tracing-app accessed 26 May 2023.

[71] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 26 May 2023.

[72] F Yang, L. Heemsbergen and R Fordyce, ‘Comparative Analysis of China’s Health Code, Australia’s COVIDSafe and New Zealand’s COVID Tracer Surveillance App: A New Corona of Public Health Governmentality?’ (2020) 178:1 Media International Australia 182, 10.1177/1329878X20968277.

[73] Planet Payment. ‘Alipay and WeChat Pay’ https://www.planetpayment.com/en/merchants/alipay-and-wechat-pay/ accessed 26 May 2023.

[74] F Liang, ‘COVID-19 and Health Code: How Digital Platforms Tackle the Pandemic in China’ (2021) 6:3 Social Media + Society, https://doi.org/10.1177/2056305120947657; National Health Commission of the People’s Republic of China, ‘Prevention and control of novel coronavirus pneumonia’ (7 March 2020) www.nhc.gov.cn/xcs/zhengcwj/202003/4856d5b0458141fa9f376853224d41d7.shtml accessed 26 May 2023.

[75] W Bin and others, ‘Depositors Are Forcibly Given Red Codes, the Latest Responses from All Parties’ (Southern Metropolis Daily, 14 June 2022) https://mp.weixin.qq.com/s/KAc8_3rCviqnVv05aQvSlw?fbclid=IwAR1xfMQtjZsRikz9vkisYxQBVAAkE9tgekKnMQ4nPaynr2BN9Ceyep3mjq8 accessed 13 April 2023.

[76] S Chan, ‘COVID-19 contact tracing apps reach 9% adoption in most populous countries’ (Sensor Tower, July 2020) https://sensortower.com/blog/contact-tracing-app-adoption accessed 26 May 2023.

[77] Ada Lovelace Institute, ‘Confidence in a crisis? Building public trust in a contact tracing app’ (2020) www.adalovelaceinstitute.org/report/confidence-in-crisis-building-public-trust-contact-tracing-app accessed 26 May 2023

[78] L Muscato, ‘Why people don’t tryst contact tracing apps, and what to do about it’ (Technology Review, 12 November 2020) www.technologyreview.com/2020/11/12/1012033/why-people-dont-trust-contact-tracing-apps-and-what-to-do-about-it accessed 31 March 2023; AWO, ‘Assessment of Covid-19 response in Brazil, Colombia, India, Iran, Lebanon and South Africa’ (29 July 2021) www.awo.agency/blog/covid-19-app-project accessed 13 April 2023; L Horvath and others, ‘Adoption and Continued Use of Mobile Contact Tracing Technology: Multilevel Explanations from a Three-Wave Panel Survey and Linked Data’ (2022) 12:1 BMJ Open e053327, 10.1136/bmjopen-2021-053327; Ada Lovelace Institute, ‘Public attitudes to COVID-19, technology and inequality: A tracker’ (2021) https://www.adalovelaceinstitute.org/resource/public-attitudes-covid-19/ accessed 26 May 2023; A Kozyreva and others, ‘Psychological Factors Shaping Public Responses to COVID-19 Digital Contact Tracing Technologies in Germany’ (2021) 11 Scientific Reports 18716, https://doi.org/10.1038/s41598-021-98249-5; G Samuel and others, ‘COVID-19 Contact Tracing Apps: UK Public Perceptions’ (2022) 1:32 Critical Public Health 31, 10.1080/09581596.2021.1909707; M Caserotti and others, ‘Associations of COVID-19 Risk Perception with Vaccine Hesitancy Over Time for Italian Residents’ (2021) 272 Social Science & Medicine 113688, 10.1016/j.socscimed.2021.113688.

[79] M Koetse ‘Goodbye, Health Code: Chinese netizens say farewell to the green horse’ (What’s on Weibo, 8 December 2022) www.whatsonweibo.com/goodbye-health-code-chinese-netizens-say-farewell-to-the-green-horse accessed 26 May 2023; L Houchen, ‘Are you ready to use the “Health Code” all the time?’ (7 April 2020) https://mp.weixin.qq.com/s/xDKKicV22IBRGnNnNStOVg accessed 26 May 2023. The National Health Commission’s notice to end the Health Code mandate did not immediately translate into municipal governments discontinuing their policies. See Health Commission, ‘Notice on printing and distributing the Prevention and Control Plan for Novel Coronavirus Pneumonia (Ninth Edition)’ (Health Commission, 28 June 2022) www.gov.cn/xinwen/2022-06/28/content_5698168.htm accessed 13 April 2023.

[80] For example, see Southern Metropolis Daily’s interview with a number of experts on the impacts of using health codes in China. W Bin and others, ‘Depositors Are Forcibly Given Red Codes, the Latest Responses from All Parties’ (Southern Metropolis Daily, 14 June 2022) https://mp.weixin.qq.com/s/KAc8_3rCviqnVv05aQvSlw?fbclid=IwAR1xfMQtjZsRikz9vkisYxQBVAAkE9tgekKnMQ4nPaynr2BN9Ceyep3mjq8 accessed 13 April 2023.

[81] M Caserotti and others, ‘Associations of COVID-19 Risk Perception with Vaccine Hesitancy Over Time for Italian Residents’ (2021) 272 Social Science & Medicine 113688, 10.1016/j.socscimed.2021.113688.

[82] M Dewatripont, ‘Policy Insight 110: Vaccination Strategies in the Midst of an Epidemic’ (Centre for Economic Policy Research, 1 October 2021) https://cepr.org/publications/policy-insight-110-vaccination-strategies-midst-epidemic accessed 13 April 2023.

[83] G Samuel and others, ‘COVID-19 Contact Tracing Apps: UK Public Perceptions’ (2022) 1:32 Critical Public Health 31, 10.1080/09581596.2021.1909707.

[84] S Landau, People Count: Contact-Tracing Apps and Public Health (The MIT Press, 2021).

[85] J Amann, J Sleigh and E Vayena, ‘Digital Contact-Tracing during the Covid-19 Pandemic: An Analysis of Newspaper Coverage in Germany, Austria, and Switzerland’ (2021) PLOS ONE, https://doi.org/10.1371/journal.pone.0246524.

[86] AWO, ‘Assessment of Covid-19 response in Brazil, Colombia, India, Iran, Lebanon and South Africa’ (29 July 2021) www.awo.agency/blog/covid-19-app-project accessed 13 April 2023.

[87] Office of Audit and Evaluation (Health Canada) and the Public Health Agency of Canada, ‘Evaluation of the National COVID-19 Exposure Notification App’ (Health Canada, 20 June 2022) www.canada.ca/en/health-canada/corporate/transparency/corporate-management-reporting/evaluation/covid-alert-national-covid-19-exposure-notification-app.html accessed13 April 2023.

[88] J Ore, ‘Where did things go wrong with Canada’s COVID Alert App?’ (CBS, 9 February 2022) www.cbc.ca/radio/costofliving/from-boycott-to-bust-we-talk-spotify-and-neil-young-and-take-a-look-at-covid-alert-app-1.6339708/where-did-things-go-wrong-with-canada-s-covid-alert-app-1.6342632 accessed 13 April 2023.

[89] Office of Audit and Evaluation (Health Canada) and the Public Health Agency of Canada, ‘Evaluation of the National COVID-19 Exposure Notification App’ (Health Canada, 20 June 2022) www.canada.ca/en/health-canada/corporate/transparency/corporate-management-reporting/evaluation/covid-alert-national-covid-19-exposure-notification-app.html accessed 13 April 2023.

[90] S Landau, People Count: Contact-Tracing Apps and Public Health (The MIT Press, 2021).

[91] L Dowthwaite and others, ‘Public Adoption of and Trust in the NHS COVID-19 Contact Tracing App in the United Kingdom: Quantitative Online Survey Study’ (2021) 23:9 JMIR Publications e29085, 10.2196/29085.

[92] Ada Lovelace Institute, ‘Confidence in a crisis? Building public trust in a contact tracing app’ (2020) www.adalovelaceinstitute.org/report/confidence-in-crisis-building-public-trust-contact-tracing-app accessed 13 April 2023; ‘Provisos for a contact tracing app: The route to trustworthy digital contact tracing’ (2020) www.adalovelaceinstitute.org/evidence-review/provisos-covid-19-contact-tracing-app accessed 13 April 2023.

[93] C Bambra and others, ‘The COVID-19 Pandemic and Health Inequalities’ (2020) 74:11 Journal of Epidemiology & Community Health 964, http://dx.doi.org/10.1136/jech-2020-214401; E Yong, ‘The Pandemic’s Legacy Is Already Clear’ (The Atlantic, 30 September 2022) www.theatlantic.com/health/archive/2022/09/covid-pandemic-exposes-americas-failing-systems-future-epidemics/671608 accessed 13 April 2023.

[94] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 Rapid Evidence Review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 26 May 2023.

[95] L Marelli, K Kieslich and S Geiger, ‘COVID-19 and Techno-Solutionism: Responsibilization without Contextualization?’ (2022) 32:1 Critical Public Health 1, https://doi.org/10.1080/09581596.2022.2029192.

[96] S Landau, People Count: Contact-Tracing Apps and Public Health (The MIT Press, 2021).

[97] Government of Ireland, ‘COVID Tracker app’ www.covidtracker.ie accessed 31 March 2023.

[98]  S Landau, People Count: Contact-Tracing Apps and Public Health (The MIT Press, 2021).

[99] S Landau, People Count: Contact-Tracing Apps and Public Health (The MIT Press, 2021).

[100] S Landau, People Count: Contact-Tracing Apps and Public Health (The MIT Press, 2021).

[101] M Veale, ‘The English Law of QR Codes: Presence Tracing and Digital Divides’ (Lex-Atlas: Covid-19, 25 May 2021) https://lexatlas-c19.org/the-english-law-of-qr-codes accessed 31 March 2023.

[102] S Reed and others, ‘Tackling Covid-19: A Case for Better Financial Support to Self-Isolate’ (Nuffield Trust, 14 May 2021) www.nuffieldtrust.org.uk/research/tackling-covid-19-a-case-for-better-financial-support-to-self-isolate accessed 26 May 2023.

[103] Statista, ‘Internet user penetration in Nigeria from 2018 to 2027’ (June 2022) www.statista.com/statistics/484918/internet-user-reach-nigeria accessed 26 May 2023.; G Razzano, ‘Privacy and the pandemic: An African response’ (Association For Progressive Communications, 21 June 2020) www.apc.org/en/pubs/privacy-and-pandemic-african-response accessed 31 March 2023.

[104] Ada Lovelace Institute, ‘Confidence in a Crisis? Building Public Trust in a Contact Tracing App’ (2020) www.adalovelaceinstitute.org/report/confidence-in-crisis-building-public-trust-contact-tracing-app accessed 26 May 2023.; ‘Provisos for a Contact Tracing App: The Route to Trustworthy Digital Contact Tracing’ (2020) www.adalovelaceinstitute.org/evidence-review/provisos-covid-19-contact-tracing-app accessed 26 May 2023.

[105] Privacy International, ‘The principles of data protection: not new and actually quite familiar’ (24 September 2018) https://privacyinternational.org/news-analysis/2284/principles-data-protection-not-new-and-actually-quite-familiar accessed 31 March 2023; Ada Lovelace Institute, ‘Provisos for a contact tracing app: The route to trustworthy digital contact tracing’ (2020) www.adalovelaceinstitute.org/evidence-review/provisos-covid-19-contact-tracing-app accessed 26 May 2023. Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 26 May 2023.

[106] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023.

[107] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 26 May 2023.

[108] TT Altshuler and RA Hershkovitz, ‘Digital Contact Tracing and the Coronavirus: Israeli and Comparative Perspectives’ (The Brookings Institution, August 2020) www.brookings.edu/wp-content/uploads/2020/08/FP_20200803_digital_contact_tracing.pdf accessed 31 March 2023.

[109] P Garrett and others, ‘High Acceptance of COVID-19 TRACING Technologies in Taiwan: A Nationally Representative Survey Analysis’ (2020) 19:5 International Journal of Environmental Research and Public Health 3323, 10.3390/ijerph19063323.

[110] TT Altshuler and RA Hershkovitz, ‘Digital Contact Tracing and the Coronavirus: Israeli and Comparative Perspectives’ (The Brookings Institution, August 2020) www.brookings.edu/wp-content/uploads/2020/08/FP_20200803_digital_contact_tracing.pdf accessed 31 March 2023.

[111] J Zhu, ‘The Personal Information Protection Law: China’s version of the GDPR?’ (Columbia Journal of Transnational Law, 14 February 2022) www.jtl.columbia.edu/bulletin-blog/the-personal-information-protection-law-chinas-version-of-the-gdpr accessed 26 May 2023.; it is noteworthy that there were pre-existing privacy rules in place embedded in several laws and regulations; however, these were not enforced with adequate oversight capacity. See A Geller, ‘How Comprehensive Is Chinese Data Protection Law? A Systematisation of Chinese Data Protection Law from a European Perspective’ (2020) 69:12 GRUR International Journal of European and International IP Law 1191, https://doi.org/10.1093/grurint/ikaa136.

[112] H Yu, ‘Living in the Era of Codes: A Reflection on China’s Health Code System’ (2022) Biosocieties, 10.1057/s41292-022-00290-8.

[113] A Li, ‘Explainer: China’s Covid-19 Health Code System’ (Hong Kong Free Press, 13 July 2022) https://hongkongfp.com/2022/07/13/explainer-chinas-COVID-19-health-code-system accessed 31 March 2023; A Clarance, ‘Aarogya Setu: Why India’s Covid-19 contact tracing app is controversial’ (BBC News, 15 May 2020) www.bbc.co.uk/news/world-asia-india-52659520 accessed 31 March 2023; W Bin and others, ‘Depositors Are Forcibly Given Red Codes, the Latest Responses from All Parties’ (Southern Metropolis Daily, 14 June 2022) https://mp.weixin.qq.com/s/KAc8_3rCviqnVv05aQvSlw?fbclid=IwAR1xfMQtjZsRikz9vkisYxQBVAAkE9tgekKnMQ4nPaynr2BN9Ceyep3mjq8 accessed 13 April 2023.

[114] TT Altshuler and RA Hershkovitz, ‘Digital Contact Tracing and the Coronavirus: Israeli and Comparative Perspectives’ (The Brookings Institution, August 2020) www.brookings.edu/wp-content/uploads/2020/08/FP_20200803_digital_contact_tracing.pdf accessed 31 March 2023.

[115] ‘Lex-Atlas: Covid-19’ https://lexatlas-c19.org accessed 31 March 2023.

[116] A Clarance, ‘Aarogya Setu: Why India’s Covid-19 contact tracing app is controversial’ (BBC News, 15 May 2020) www.bbc.co.uk/news/world-asia-india-52659520 accessed 31 March 2023.

[117] Internet Freedom Foundation, ‘Statement: Victory! Aarogya Setu changes from mandatory to, “best efforts”’ (18 May 2020) https://internetfreedom.in/aarogya-setu-victory accessed 26 May 2023.

[118] Evidence submitted to Ada Lovelace Institute by Internet Freedom Foundation, India.

[119] Norton Rose Fulbright, ‘Contact Tracing Apps: A New World for Data Privacy’ (February 2021) www.nortonrosefulbright.com/en/knowledge/publications/d7a9a296/contact-tracing-apps-a-new-world-for-data-privacy accessed 26 May 2023.

[120] T Klosowski, ‘The State of Consumer Data Privacy Laws in the US (and Why It Matters)’ (New York Times, 6 September 2021) www.nytimes.com/wirecutter/blog/state-of-privacy-laws-in-us accessed 26 May 2023.

[121] Health Insurance Portability and Accountability Act  is a federal law to protect sensitive patient health information, but contact tracing apps were not covered because they are not ‘regulated entities’ under the Act. Centers for Disease Control and Prevention ‘Health Insurance Portability and Accountability Act of 1996 (HIPAA) https://www.cdc.gov/phlp/publications/topic/hipaa.html accessed 26 May 2023.

[122] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 31 March 2023.

[123] P Valade, ‘Jumbo Privacy Review: North Dakota’s Contact Tracing App’ (Jumbo, 21 May 2020) https://blog.withjumbo.com/jumbo-privacy-review-north-dakota-s-contact-tracing-app.html accessed 31 March 2023.

[124]  Civil Liberties Union for Europe, ‘Do EU Governments Continue to Operate Contact Tracing Apps Illegitimately?’ (October 2021) https://dq4n3btxmr8c9.cloudfront.net/files/Nv4A36/DO_EU_GOVERNMENTS_CONTINUE_TO_OPERATE_CONTACT_TRACING_APPS_ILLEGITIMATELY.pdf accessed 31 March 2023.

[125] Fabio Chiusi and others, ‘Automating COVID Responses: The Impact of Automated Decision-Making on the COVID-19 Pandemic’ (AlgorithmWatch 2022) https://algorithmwatch.org/en/wp-content/uploads/2021/12/Tracing-The-Tracers-2021-report-AlgorithmWatch.pdf accessed 31 March 2023.

[126] A Hussain, ‘TraceTogether data used by police in one murder case: Vivian Balakrishnan (Yahoo! News, 5 January 2021) https://uk.style.yahoo.com/trace-together-data-used-by-police-in-one-murder-case-vivian-084954246.html?guccounter=2 accessed 31 March 2023.

[127] K Han, ‘COVID app triggers overdue debate on privacy in Singapore’ (Al Jazeera, 10 February 2021) www.aljazeera.com/news/2021/2/10/covid-app-triggers-overdue-debate-on-privacy-in-singapore accessed 31 March 2023.

[128] K Han, ‘COVID app triggers overdue debate on privacy in Singapore’ (Al Jazeera, 10 February 2021) www.aljazeera.com/news/2021/2/10/covid-app-triggers-overdue-debate-on-privacy-in-singapore accessed 31 March 2023.

[129] S Hilberg, ‘The new German Privacy Act: An overview’ (Deloitte) www2.deloitte.com/dl/en/pages/legal/articles/neues-bundesdatenschutzgesetz.html accessed 26 May 2023.

[130] Civil Liberties Union for Europe, ‘Do EU Governments Continue to Operate Contact Tracing Apps Illegitimately?’ (October 2021) https://dq4n3btxmr8c9.cloudfront.net/files/Nv4A36/DO_EU_GOVERNMENTS_CONTINUE_TO_OPERATE_CONTACT_TRACING_APPS_ILLEGITIMATELY.pdf accessed 31 March 2023.

[131] H Heine, ‘Check-In feature: Corona-Warn-App can now scan luca’s QR codes’ (Corona Warn-app Open Source Project, 9 November 2021) www.coronawarn.app/en/blog/2021-11-09-cwa-luca-qr-codes accessed 26 May 2023.

[132] Fabio Chiusi and others, ‘Automating COVID Responses: The Impact of Automated Decision-Making on the COVID-19 Pandemic’ (AlgorithmWatch 2022) https://algorithmwatch.org/en/wp-content/uploads/2021/12/Tracing-The-Tracers-2021-report-AlgorithmWatch.pdf accessed 26 May 2023.

[133] M Knodel, ‘Public Health, Big Tech, and Privacy: Multistakeholder Governance and Technology-Assisted Contact tracing’ (Global Insights, January 2021) www.ned.org/wp-content/uploads/2021/01/Public-Health-Big-Tech-Privacy-Contact-Tracing-Knodel.pdf accessed 16 April 2023.

[134] M Veale, ‘Opinion: Privacy is not the problem with the Apple-Google contact tracing app’ (UCL News, 1 July 2020) www.ucl.ac.uk/news/2020/jul/opinion-privacy-not-problem-apple-google-contact-tracing-app accessed 31 March 2023.

[135] Ada Lovelace Institute, Rethinking Data and Rebalancing Digital Power (2022) www.adalovelaceinstitute.org/report/rethinking-data accessed 16 April 2023.

[136] H Mance, ‘Shoshana Zuboff: “Privacy Has Been Extinguished. It Is Now a Zombie”’ (Financial Times, 30 January 2023) www.ft.com/content/0cca6054-6fc9-4a94-b2e2-890c50d956d5#myft:my-news:page accessed 16 April 2023.

[137] M Knodel, ‘Public Health, Big Tech, and Privacy: Multistakeholder Governance and Technology-Assisted Contact tracing’ (Global Insights, January 2021) www.ned.org/wp-content/uploads/2021/01/Public-Health-Big-Tech-Privacy-Contact-Tracing-Knodel.pdf accessed 16 April 2023.

[138] GOVLAB and Knight Foundation, ‘The #Data4Covid19 Review’ https://review.data4covid19.org accessed 16 April 2023.

[139] Ada Lovelace Institute, ‘Exit through the App Store? COVID-19 rapid evidence review’ (2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 16 April 2023.

[140] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 16 April 2023.

[141] World Health Organization, ‘Estonia and WHO to jointly develop digital vaccine certificate to strengthen COVAX’ (WHO, 7 October 2020) www.who.int/news-room/feature-stories/detail/estonia-and-who-to-jointly-develop-digital-vaccine-certificate-to-strengthen-covax accessed 16 April 2023.

[142] World Health Organization, ‘Estonia and WHO to jointly develop digital vaccine certificate to strengthen COVAX’ (WHO, 7 October 2020) www.who.int/news-room/feature-stories/detail/estonia-and-who-to-jointly-develop-digital-vaccine-certificate-to-strengthen-covax accessed 16 April 2023.

[143] Pfizer, ‘Pfizer and BioNtech announce vaccine candidate against COVID-19 achieved success in first interim analysis from Phase 3 Study’ (9 November 2020) www.pfizer.com/news/press-release/press-release-detail/pfizer-and-biontech-announce-vaccine-candidate-against accessed 16 April 2023.

[144] NHS England, ‘Landmark moment as first NHS patient receives COVID-19 vaccination’ (NHS England News, December 2020) www.england.nhs.uk/2020/12/landmark-moment-as-first-nhs-patient-receives-COVID-19-vaccination accessed 12 April 2023.

[145] H Davidson, ‘China Approves Sinopharm Covid-19 Vaccine for General Use’ (Guardian, 31 December 2020) www.theguardian.com/world/2020/dec/31/china-approves-sinopharm-covid-19-vaccine-for-general-use accessed 12 April 2023.

[146] NHS England, ‘Landmark moment as first NHS patient receives COVID-19 vaccination’ (NHS England News, * December 2020) www.england.nhs.uk/2020/12/landmark-moment-as-first-nhs-patient-receives-COVID-19-vaccination accessed 12 April 2023.

[147] Y Noguchi, ‘The history of vaccine passports in the US and what’s new’ (NPR, 8 April 2021) www.npr.org/2021/04/08/985253421/the-history-of-vaccine-passports-in-the-u-s-and-whats-new accessed 12 April 2023.

[148]  Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (2023) https://covid19.adalovelaceinstitute.org l accessed 31 May 2023.

[149] Y Noguchi, ‘The history of vaccine passports in the US and what’s new’ (NPR, 8 April 2021) www.npr.org/2021/04/08/985253421/the-history-of-vaccine-passports-in-the-u-s-and-whats-new accessed 12 April 2023.

[150] K Teyras, ‘Covid-19 health passes can open the door to a digital ID revolution’ (THALES, 30 November 2021) https://dis-blog.thalesgroup.com/identity-biometric-solutions/2021/06/23/covid-19-health-passes-can-open-the-door-to-a-digital-id-revolution accessed 12 April 2023; Privacy International, ‘Covid-19 vaccination certificates: WHO sets minimum demands, governments must do even better’ (9 August 2021) https://privacyinternational.org/advocacy/4607/covid-19-vaccination-certificates-who-sets-minimum-demands-governments-must-do-even accessed 12 April 2023.

[151] S Davidson, ‘How vaccine passports could change digital identity’ (Digicert,6 November 2021) www.digicert.com/blog/how-vaccine-passports-could-change-digital-identity accessed 12 April 2023.

[152] Ada Lovelace Institute, ‘International monitor: vaccine passports and COVID-19 status apps’ (2021) https://www.adalovelaceinstitute.org/resource/international-monitor-vaccine-passports-and-covid-19-status-apps/ accessed 12 April 2023.

[153] F Kritz, ‘The vaccine passport debate actually began in 1897 over a plague vaccine’ (NPR, 8 April 2021) www.npr.org/sections/goatsandsoda/2021/04/08/985032748/the-vaccine-passport-debate-actually-began-in-1897-over-a-plague-vaccine accessed 12 April 2023.

[154] F Kritz, ‘The vaccine passport debate actually began in 1897 over a plague vaccine’ (NPR, 8 April 2021) www.npr.org/sections/goatsandsoda/2021/04/08/985032748/the-vaccine-passport-debate-actually-began-in-1897-over-a-plague-vaccine accessed 12 April 2023.

[155] Ada Lovelace Institute, Checkpoints for Vaccine Passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023.

[156] ibid.

[157] S Subramanian, ‘Biometric tracking can ensure billions have immunity against Covid-19’ (Bloomberg, 13 August 2020) https://www.bloomberg.com/features/2020-COVID-vaccine-tracking-biometric accessed 13 April 2023

[158] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023.

[159] See the legacy of COVID-19 technologies?: Outstanding questions section, p. 118.

[160] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (2023) https://covid19.adalovelaceinstitute.org  accessed 31 May 2023

 

 

[161] World Health Organization, ‘Rapidly escalating Covid-19 cases amid reduced virus surveillance forecasts a challenging autumn and winter in the WHO European Region’ (WHO, 19 July 2022) www.who.int/europe/news/item/19-07-2022-rapidly-escalating-COVID-19-cases-amid-reduced-virus-surveillance-forecasts-a-challenging-autumn-and-winter-in-the-who-european-region accessed 12 April 2023.

[162] F Kritz, ‘The vaccine passport debate actually began in 1897 over a plague vaccine’ (NPR, 8 April 2021) www.npr.org/sections/goatsandsoda/2021/04/08/985032748/the-vaccine-passport-debate-actually-began-in-1897-over-a-plague-vaccine accessed 12 April 2023.

[163] The New Zealand government shifted its policy towards COVID-19 acceptance by opening the borders and ending lockdowns in October 2021. See J Curtin, ‘The end of New Zealand’s zero-COVID policy’ (Think Global Health, 28 October 2021) www.thinkglobalhealth.org/article/end-new-zealands-zero-COVID-policy accessed 12 April 2023.

[164] Reuters, ‘Brazil health regulator asks Bolsonaro to retract criticism over vaccines’ (9 January 2022) www.reuters.com/business/healthcare-pharmaceuticals/brazil-health-regulator-asks-bolsonaro-retract-criticism-over-vaccines-2022-01-09 accessed 12 April 2023.

[165] Al Jazeera, ‘Brazil judge mandates proof of vaccination for foreign visitors’ (12 December 2021) www.aljazeera.com/news/2021/12/12/brazil-justice-mandates-vaccine-passport-for-visitors accessed 12 April 2023.

[166]  Y Noguchi, ‘The history of vaccine passports in the US and what’s new’ (NPR, 8 April 2021) www.npr.org/2021/04/08/985253421/the-history-of-vaccine-passports-in-the-u-s-and-whats-new accessed 12 April 2023.

[167] M Bull, ‘The Italian Government Response to Covid-19 and the Making of a Prime Minister’ (2021) 13:2 Contemporary Italian Politics 149, https://doi.org/10.1080/23248823.2021.1914453.

[168] A Peacock, ‘What is the Covid ‘Super Green’ pass?’ (Tuscany Now & More) www.tuscanynowandmore.com/discover-italy/essential-advice/travelling-italy-COVID-green-pass accessed 12 April 2023.

[169] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (May 2023), https://covid19.adalovelaceinstitute.org accessed 31 May 2023

 

[170] DF Povse, ‘Examining the pros and cons of digital COVID certificates in the EU’ (Ada Lovelace Institute, 15 December 2022) www.adalovelaceinstitute.org/blog/examining-digital-covid-certificates-eu accessed 12 April 2023.

[171] Ada Lovelace Institute, ‘What place should COVID-19 vaccine passports have in society?’ (17 February 2021) www.adalovelaceinstitute.org/report/covid-19-vaccine-passports accessed 31 March 2023.

[172] Ada Lovelace Institute, ‘International Monitor: vaccine passports and COVID-19 status apps’ (15 October 2021) https://www.adalovelaceinstitute.org/resource/international-monitor-vaccine-passports-and-covid-19-status-apps/ accessed 31 March 2023

[173] S Amaro, ‘France’s Macron sparks outrage as he vows to annoy the unvaccinated’ (CNBC, 5 January 2022) www.cnbc.com/2022/01/05/macron-french-president-wants-to-annoy-the-unvaccinated-.html accessed 12 April 2023.

[174] G Vergallo and others, ‘Does the EU COVID Digital Certificate Strike a Reasonable Balance between Mobility Needs and Public Health? (2021) 57:10 Medicina (Kaunas) 1077, 10.3390/medicina57101077.

[175] C Franco-Paredes, ‘Transmissibility of SARS-CoV-2 among Fully Vaccinated Individuals’ (2022) 22:1 The Lancet P16, https://doi.org/10.1016/S1473-3099(21)00768-4.

[176] World Health Organization, ‘Information for the public: COIVID-19 vaccines’ (WHO, 18 November 2022) https://www.who.int/westernpacific/emergencies/covid-19/information-vaccines accessed 01 June 2023.

[177] World Health Organization, ‘Vaccine efficacy, effectiveness and protection’ (WHO, 14 July 2021) www.who.int/news-room/feature-stories/detail/vaccine-efficacy-effectiveness-and-protection accessed 12 April 2024; A Allen, ‘Pfizer CEO pushes yearly shots for Covid: Not so fast, experts say’ (KFF Health News, 21 March 2022) https://kffhealthnews.org/news/article/pfizer-ceo-albert-bourla-yearly-COVID-shots accessed 31 March 2023.

[178] World Health Organization, ‘Tracking SARS-CoV-2 variants’ www.who.int/activities/tracking-SARS-CoV-2-variants accessed 31 March 2023.

[179] G Warren and R Lofstedt, ‘Risk Communication and COVID-19 in Europe: Lessons for Future Public Health Crises’ (2021) 25:10 Journal of Risk Research 1161, https://doi.org/10.1080/13669877.2021.1947874.

[180] DF Povse, ‘Examining the pros and cons of digital COVID certificates in the EU’ (Ada Lovelace Institute, 15 December 2022) www.adalovelaceinstitute.org/blog/examining-digital-covid-certificates-eu accessed 31 March 2023.

[181] M Sallam, ‘COVID-19 Vaccine Hesitancy Worldwide: A Concise Systematic Review of Vaccine Acceptance Rates’ (2021) 9:2 Vaccines 160, https://doi.org/10.3390/vaccines9020160.

[182] SuperJob, ‘Most often, the introduction of QR codes is approved at mass events, least often – in non-food stores, but 4 out of 10 Russians are against any QR codes’ (16 November 2021) www.superjob.ru/research/articles/113182/chasche-vsego-vvod-qr-kodov-odobryayut-na-massovyh-meropriyatiyah accessed 31 March 2023.

[183] G Salau, ‘How vaccine cards are procured without jabs’ (The Guardian [Nigeria], 23 December 2021) https://guardian.ng/features/how-vaccine-cards-are-procured-without-jabs accessed 26 May 2023; E de Bre, ‘Fake COVID-19 vaccination cards emerge in Russia’ (Organized Crime and Corruption Reporting Project, 30 June 2021) www.occrp.org/en/daily/14733-fake-COVID-19-vaccination-cards-emerge-in-russia accessed 31 March 2023.

[184] J Ceulaer, ‘Viroloog Emmanuel Andre: “Covid Safe Ticket leidde tot meer besmettingen”’ (De Morgen, 29 November 2021) www.demorgen.be/nieuws/viroloog-emmanuel-andre-covid-safe-ticket-leidde-tot-meer-besmettingen~bae41a3e/?utm_source=link&utm_medium=social&utm_campaign=shared_earned accessed 12 April 2023.

[185] Gilmore and others, ‘Community Engagement to Support COVID-19 Vaccine Uptake: A Living Systematic Review Protocol’ (2022) 12 BMJ Open e063057, http://dx.doi.org/10.1136/bmjopen-2022-063057.

[186] AD Bourhanbour and O Ouchetto, ‘Morocco Achieves the Highest COVID-19 Vaccine Rates in Africa in the First Phase: What Are Reasons for Its Success?’ (2021) 28:4 Journal of Travel Medicine taab040, https://doi.org/10.1093/jtm/taab040.

[187] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023.

[188] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023.

[189] K Beaver, G Skinner and A Quigley, ‘Majority of Britons support vaccine passports but recognise concerns in new Ipsos UK Knowledge Panel poll’ (Ipsos, 31 March 2021) www.ipsos.com/en-uk/majority-britons-support-vaccine-passports-recognise-concerns-new-ipsos-uk-knowledgepanel-poll accessed 12 April 2023.

[190] H Kennedy, ‘The vaccine passport debate reveals fundamental views about how personal data should be used, its role in reproducing inequalities, and the kind of society we want to live in’ (LSE, 12 August 2021) https://blogs.lse.ac.uk/impactofsocialsciences/2021/08/12/the-vaccine-passport-debate-reveals-fundamental-views-about-how-personal-data-should-be-used-its-role-in-reproducing-inequalities-and-the-kind-of-society-we-want-to-live-in accessed 26 May 2023.

[191] C Brogan, ‘Vaccine passports linked to COVID-19 vaccine hesitancy in UK and Israel’ (Imperial College London, 2 September 2021) www.imperial.ac.uk/news/229153/vaccine-passports-linked-covid-19-vaccine-hesitancy accessed 12 April 2023.

[192] J Drury, ‘Behavioural Responses to Covid-19 Health Certification: A Rapid Review’ (2021) 21 BMC Public Health 1205, https://doi.org/10.1186/s12889-021-11166-0; JR de Waal, ‘One year on: Global update on public attitudes to government handling of Covid’ (YouGov, 19 November 2021) https://yougov.co.uk/topics/international/articles-reports/2021/11/19/one-year-global-update-public-attitudes-government accessed 12 April 2023.

[193] H Kennedy, ‘The vaccine passport debate reveals fundamental views about how personal data should be used, its role in reproducing inequalities, and the kind of society we want to live in’ (LSE, 12 August 2021) https://blogs.lse.ac.uk/impactofsocialsciences/2021/08/12/the-vaccine-passport-debate-reveals-fundamental-views-about-how-personal-data-should-be-used-its-role-in-reproducing-inequalities-and-the-kind-of-society-we-want-to-live-in accessed 12 April 2023.

[194] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023.

[195] H Kennedy, ‘The vaccine passport debate reveals fundamental views about how personal data should be used, its role in reproducing inequalities, and the kind of society we want to live in’ (LSE, 12 August 2021) https://blogs.lse.ac.uk/impactofsocialsciences/2021/08/12/the-vaccine-passport-debate-reveals-fundamental-views-about-how-personal-data-should-be-used-its-role-in-reproducing-inequalities-and-the-kind-of-society-we-want-to-live-in accessed 12 April 2023.

[196] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023.

[197] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (May 2023), https://covid19.adalovelaceinstitute.orgaccessed 31 May 2023

[198] B Bell, ‘Covid: Austrians heading towards lockdown for unvaccinated’ (BBC News, 12 November 2021) www.bbc.co.uk/news/world-europe-59245018 accessed 12 April 2023.

[199] B Bell, ‘Covid: Austrians heading towards lockdown for unvaccinated’ (BBC News, 12 November 2021) www.bbc.co.uk/news/world-europe-59245018 accessed 12 April 2023.

[200] Simmons + Simmons, ‘COVID-19 Italy: An easing of covid restrictions’ (1 May 2022) www.simmons-simmons.com/en/publications/ckh3mbdvv151g0a03z6mgt3dr/covid-19-decree-brings-strict-restrictions-for-italy accessed 12 April 2023.

[201] E de Bre, ‘Fake COVID-19 vaccination cards emerge in Russia’ (Organized Crime and Corruption Reporting Project, 30 June 2021) www.occrp.org/en/daily/14733-fake-COVID-19-vaccination-cards-emerge-in-russia accessed 31 March 2023.

[202] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023.

[203] Health Pass, ‘Sıkça Sorulan Sorular’ https://healthpass.saglik.gov.tr/sss.html accessed 12 April 2023.

[204] S Dwivedi, ‘“No one can be forced to get vaccinated”: Supreme Court’s big order’ (NDTV, 2 May 2022) www.ndtv.com/india-news/coronavirus-no-one-can-be-forced-to-get-vaccinated-says-supreme-court-adds-current-vaccine-policy-cant-be-said-to-be-unreasonable-2938319 accessed 12 April 2023.

[205] NHS, ‘NHS COVID Pass’ www.nhs.uk/nhs-services/covid-19-services/nhs-covid-pass accessed 12 May 2021.

[206] Our World in Data, ‘Coronavirus (COVID-19) Vaccinations’ https://ourworldindata.org/COVID-vaccinations?country=OWID_WRL accessed 12 April 2023.

[207] Harvard Global Health Institute, ‘From Ebola to COVID-19: Lessons in digital contact tracing in Sierra Leone’ (1 September 2020) https://globalhealth.harvard.edu/from-ebola-to-covid-19-lessons-in-digital-contact-tracing-in-sierra-leone accessed 26 May 2023.

[208] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023. Riaz and colleagues define vaccine nationalism as ‘an economic strategy to hoard vaccinations from manufacturers and increase supply in their own country’. See M Riaz and others, ‘Global Impact of Vaccine Nationalism during COVID-19 Pandemic’ (2010) 49 Tropical Medicine and Health 101, https://doi.org/10.1186/s41182-021-00394-0.

[209] E Racine, ‘Understanding COVID-19 certificates in the context of recent health securitisation trends’ (Ada Lovelace Institute, 9 March 2023) www.adalovelaceinstitute.org/blog/covid-certificates-health-securitisation accessed 26 May 2023.

[210] E Racine, ‘Understanding COVID-19 certificates in the context of recent health securitisation trends’ (Ada Lovelace Institute, 9 March 2023) www.adalovelaceinstitute.org/blog/covid-certificates-health-securitisation accessed 26 May 2023.

[211] J Atick, ‘Covid vaccine passports are important but could they also create more global inequality?’ (Euro News, 17 August 2021) www.euronews.com/next/2021/08/16/covid-vaccine-passports-are-important-but-could-they-also-create-more-global-inequality accessed 12 April 2023.

[212] E Racine, ‘Understanding COVID-19 certificates in the context of recent health securitisation trends’ (Ada Lovelace Institute, 9 March 2023) www.adalovelaceinstitute.org/blog/covid-certificates-health-securitisation accessed 12 April 2023.

[213] A Suarez-Alvarez and AJ Lopez-Menendez, ‘Is COVID-19 Vaccine Inequality Undermining the Recovery from the COVID-19 Pandemic?’ (2022) 12 Journal of Global Health 05020, 10.7189/jogh.12.05020. Share of vaccinated people refers to the total number of people who received all doses prescribed by the initial vaccination protocol, divided by the total population of the country.

[214]  Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (May 2023), https://covid19.adalovelaceinstitute.org accessed 31 May 2023.

[215]  ibid.

[216] World Health Organization, ‘COVAX: Working for global equitable access to COVID-19 vaccines’ www.who.int/initiatives/act-accelerator/covax, accessed 12 April 2023.

[217] European Commission, ‘Team Europe contributes €500 million to COVAX initiative to provide one billion COVID-19 vaccine doses for low and middle income countries’ (15 December 2020) https://ec.europa.eu/commission/presscorner/detail/en/ip_20_2262 accessed 12 April 2023.

 

[218] Holder, J. (2023). Tracking Coronavirus Vaccinations Around the World. The New York Times [online]. Available at: https://www.nytimes.com/interactive/2021/world/covid-vaccinations-tracker.html. (Accessed: 12 April 2023).

[219] European Council. EU digital COVID certificate: how it works. Available at: https://www.consilium.europa.eu/en/policies/coronavirus/eu-digital-covid-certificate//

[220] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023.

[221] A Gillwald and others, ‘Mobile phone data is useful in coronavirus battle: But are people protected enough?’ (The Conversation, 27 April 2020) https://theconversation.com/mobile-phone-data-is-useful-in-coronavirus-battle-but-are-people-protected-enough-136404 accessed 26 May 2023..

[222] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023..

[223] A Gillwald and others, ‘Mobile phone data is useful in coronavirus battle: But are people protected enough?’ (The Conversation, 27 April 2020) https://theconversation.com/mobile-phone-data-is-useful-in-coronavirus-battle-but-are-people-protected-enough-136404 accessed 26 May 2023.

[224] ABC News, ‘Brazil’s health ministry website hacked, vaccination information stolen and deleted’ (11 December 2021) www.abc.net.au/news/2021-12-11/brazils-national-vaccination-program-hacked-/100692952 accessed 12 April 2023; Z Whittaker, ‘Jamaica’s immigration website exposed thousands of travellers’ data’ (TechCrunch, 17 February 2021) https://techcrunch.com/2021/02/17/jamaica-immigration-travelers-data-exposed accessed 12 April 2023.

[225] Proportionality is a general principle in law which refers to striking a balance between the means used and the intended aim. See European Data Protection Supervisor, ‘Necessity and proportionality’ https://edps.europa.eu/data-protection/our-work/subjects/necessity-proportionality_en accessed 12 April 2023.

[226] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 26 May 2023..

[227] G Razzano, ‘Privacy and the pandemic: An African response’ (Association For Progressive Communications, 21 June 2020) www.apc.org/en/pubs/privacy-and-pandemic-african-response accessed 26 May 2023.

[228] A Gillwald and others, ‘Mobile phone data is useful in coronavirus battle: But are people protected enough?’ (The Conversation, 27 April 2020) https://theconversation.com/mobile-phone-data-is-useful-in-coronavirus-battle-but-are-people-protected-enough-136404 accessed 26 May 2023.

[229] European Commission ‘Coronavirus: Commission proposes to extend the EU Digital COVID Certificate by one year’ (3 February 2022) https://ec.europa.eu/commission/presscorner/detail/en/ip_22_744 accessed 26 May 2023.

[230] A Hussain, ‘TraceTogether data used by police in one murder case: Vivian Balakrishnan (Yahoo! News, 5 January 2021) https://uk.style.yahoo.com/trace-together-data-used-by-police-in-one-murder-case-vivian-084954246.html?guccounter=2 accessed 30 March 2023. DW, ‘German police under fire for misuse of COVID app’ DW (11 January 2022) www.dw.com/en/german-police-under-fire-for-misuse-of-covid-contact-tracing-app/a-60393597 accessed 31 March 2023.

[231] Ada Lovelace Institute, Checkpoints for vaccine passports (2021) www.adalovelaceinstitute.org/report/checkpoints-for-vaccine-passports accessed 12 April 2023; ‘Confidence in a Crisis? Building Public Trust in a Contact Tracing App’ (17 August 2020) www.adalovelaceinstitute.org/report/confidence-in-crisis-building-public-trust-contact-tracing-app accessed 12 April 2023; ‘Exit through the App Store? COVID-19 Rapid Evidence Review’ (19 April 2020) www.adalovelaceinstitute.org/evidence-review/covid-19-rapid-evidence-review-exit-through-the-app-store accessed 12 April 2023.

[232] Ada Lovelace Institute, ‘COVID-19 Data Explorer: Policies, Practices and Technology’ (May 2023), https://covid19.adalovelaceinstitute.orgaccessed 31 May 2023

[233] European Council, ‘European digital identity (eID): Council makes headway towards EU digital wallet, a paradigm shift for digital identity in Europe’ (6 December 2022) https://www.consilium.europa.eu/en/press/press-releases/2022/12/06/european-digital-identity-eid-council-adopts-its-position-on-a-new-regulation-for-a-digital-wallet-at-eu-level accessed 12 April 2023; Y Theodorou, ‘On the road to digital-ID success in Africa: Leveraging global trends’ (Tony Blair Institute, 13 June) www.institute.global/insights/tech-and-digitalisation/road-digital-id-success-africa-leveraging-global-trends accessed 12 April 2023.

[234] The Tawakkalna app is available at https://ta.sdaia.gov.sa/en/index; Saudi–US Trade Group, ‘United Nations recognizes Saudi Arabia’s Tawakkalna app with Public Service Award for 2022 www.sustg.com/united-nations-recognizes-saudi-arabias-tawakkalna-app-with-public-service-award-for-2022 accessed 12 April 2023.

[235] Varindia, ‘Aarogya Setu has been transformed as nation’s health app’ (26 July 2022) https://varindia.com/news/aarogya-setu-has-been-transformed-as-nations-health-app accessed 13 April 2023.

[236] NHS England, ‘Digitising, connecting and transforming health and care’ www.england.nhs.uk/digitaltechnology/digitising-connecting-and-transforming-health-and-care accessed 13 April 2023.

[237] DHI News Team, ‘The role of a successful federated data platform programme’ (Digital Health, 27 September 2022) www.digitalhealth.net/2022/09/the-role-of-a-successful-federated-data-platform-programme accessed 12 April 2023; Department of Health and Social Care, ‘Better, broader, safer: Using health data for research and analysis (gov.uk, 7 April 2022) www.gov.uk/government/publications/better-broader-safer-using-health-data-for-research-and-analysis accessed 13 April 2023.

[238] N Sherman, ‘Palantir: The controversial data firm now worth £17bn’ (BBC News, 1 October 2020) www.bbc.co.uk/news/business-54348456 accessed 13 April 2023.

[239] C Handforth, ‘How digital can close the ‘identity gap’ (UNDP, 19 May 2022) www.undp.org/blog/how-digital-can-close-identity-gap?utm_source=EN&utm_medium=GSR&utm_content=US_UNDP_PaidSearch_Brand_English&utm_campaign=CENTRAL&c_src=CENTRAL&c_src2=GSR&gclid=CjwKCAiA0J accessed 13 April 2023.

[240] L Muscato, ‘Why people don’t tryst contact tracing apps, and what to do about it’ (Technology Review, 12 November 2020) www.technologyreview.com/2020/11/12/1012033/why-people-dont-trust-contact-tracing-apps-and-what-to-do-about-it accessed 31 March 2023; AWO, ‘Assessment of Covid-19 response in Brazil, Colombia, India, Iran, Lebanon and South Africa’ (29 July 2021) www.awo.agency/blog/covid-19-app-project accessed 13 April 2023; L Horvath and others, ‘Adoption and Continued Use of Mobile Contact Tracing Technology: Multilevel Explanations from a Three-Wave Panel Survey and Linked Data’ (2022) 12:1 BMJ Open e053327, 10.1136/bmjopen-2021-053327; A Kozyreva and others, ‘Psychological Factors Shaping Public Responses to COVID-19 Digital Contact Tracing Technologies in Germany’ (2021) 11 Scientific Reports 18716, https://doi.org/10.1038/s41598-021-98249-5; G Samuel and others, ‘COVID-19 Contact Tracing Apps: UK Public Perceptions’ (2022) 1:32 Critical Public Health 31, 10.1080/09581596.2021.1909707; M Caserotti and others, ‘Associations of COVID-19 Risk Perception with Vaccine Hesitancy Over Time for Italian Residents’ (2021) 272 Social Science & Medicine 113688, 10.1016/j.socscimed.2021.113688. Ada Lovelace Institute’s ‘Public attitudes to COVID-19, technology and inequality: A tracker’ summarises a wide range of studies and projects that offer insight into people’s attitudes and perspectives. See Ada Lovelace Institute, ‘Public attitudes to COVID-19, technology and inequality: A tracker’ (2021) https://www.adalovelaceinstitute.org/resource/public-attitudes-covid-19/ accessed 12 April 2023.

[241] Ada Lovelace Institute, ‘International monitor: vaccine passports and COVID-19 status apps’ (15 October 2021) https://www.adalovelaceinstitute.org/resource/international-monitor-vaccine-passports-and-covid-19-status-apps/ accessed 30 March 2023.

[242] Our World in Data, ‘Coronavirus Pandemic (COVID-19) https://ourworldindata.org/coronavirus, accessed 31 May 2023

[243] Our World in Data ‘Coronavirus Pandemic (COVID-19)’ https://ourworldindata.org/coronavirus#explore-the-global-situation accessed 12 April 2023.

[244] University of Oxford ‘COVID-19 Government Response Tracker’ https://www.bsg.ox.ac.uk/research/covid-19-government-response-tracker  accessed 12 April 2023.

[245] Our World in Data ‘Coronavirus Pandemic (COVID-19)’ https://ourworldindata.org/coronavirus#explore-the-global-situation accessed 12 April 2023.

[246] Our World in Data ‘Coronavirus Pandemic (COVID-19)’ https://ourworldindata.org/coronavirus#explore-the-global-situation accessed 12 April 2023.