International Law and Digital Disease Surveillance in Pandemics: On the Margins of Regulation

Abstract

The COVID-19 pandemic elicited a surge in the use of digital tools to replace “classic” manual disease tracking and contact tracing across individuals. The main technical reason is based on the disease surveillance needs imposed by the magnitude of the spread of the SARS-CoV-2 virus since 2020, particularly how these needs overwhelmed governments around the world. Such developments led to stark variations across countries in terms of legal approaches towards the use of digital tools, including self-reporting software and mobile phone apps, for both disease tracking and contact tracing. Against this backdrop, in this article I highlight some of the normative challenges posed by the digitalization of disease surveillance, underscoring its almost non-existent regulation under international law. I look back at the historical emergence of the epidemiological principles underlying this procedure, by referring to John Snow’s trailblazing work in cholera control. I emphasize how the COVID-19 pandemic prompted both technical and normative shifts related to the digitalization of these procedures. Furthermore, I refer to some of the overarching obstacles for deploying international law to tackle future tensions between the public health rationale for digitalized disease tracking and contact tracing, on the one hand, and normative concerns directly related to their legality, on the other hand. Lastly, I put forward conclusions in light of the current juncture of international health law reforms, and how they so far display limited potential to herald structural changes concerning the legality of the use of digital tools in disease surveillance.

A. Introduction

By now, a vast literature has explored how the COVID-19 pandemic led to structural legal challenges throughout the world. Themes such as the exercise of emergency powers¹ and derogations of human rights obligations² have been rediscovered and reframed during the pandemic. One (re)discovered area in legal research is the one on individualized procedures of public health surveillance, understood as “the continuous, systematic collection, analysis and interpretation of health-related data,”³ including but not limited to disease tracking and contact tracing. Broadly speaking, through both of these procedures, public authorities trace the spread of a disease from person to person in order to identify— and possibly break—chains of transmission. Disease tracking focuses on identifying positive cases of contagion with a disease as thoroughly as possible, with the understanding that there is a medical diagnosis available through a number of methods.⁴ In turn, contact tracing refers to the identification of persons exposed to a known active case of a specific disease, making contagion likely but not yet fully established in light of a disease’s incubation period (the period of time between exposure and manifestations of symptoms or “onset”).⁵ Both of these processes belong to so-called ad hoc disease surveillance,⁶ distinct from routine surveillance where health trends are periodically monitored across entire populations.⁷

Before the COVID-19 pandemic, there was a dearth of legal literature addressing normative questions regarding disease tracking and contact tracing.⁸ Such relative obscurity is perhaps not surprising. Broadly speaking, ad hoc individualized public health surveillance is not as urgent when there is no active disease outbreak. In “ordinary” periods, public health authorities have neither the justification nor the resources to permanently monitor all individuals’ actions in order trace the spread of communicable diseases across persons. A more constant monitoring of individuals for disease tracking usually occurs when outbreaks, epidemics, or pandemics emerge. It is why this type of surveillance is known as ad hoc, as some of its parameters are contingent upon those events occurring.

The COVID-19 pandemic elicited a surge in the use of digital tools to replace “old school” manual disease tracking across individuals.⁹ In the past, these procedures were based on either active reporting by affected persons themselves, or interviews conducted by public health authorities. The disease surveillance needs imposed by the magnitude of the spread of the SARS-CoV-2 virus since 2020 overwhelmed governments all around the world. Such a development led to stark variations across countries in terms of legal approaches towards the digitalization of both disease tracking and contact tracing across individuals.

The current contribution tackles some of the normative challenges posed by the digitalization of disease surveillance through disease tracking and contact tracing, and their almost non-existent regulation under international law. For the sake of delimitation, the following analysis leaves out the use of digital tools for demonstrating proof of vaccination, generally known as “vaccine certificates”, because these lead to different legal and normative questions.¹⁰ The article proceeds as follows: The second section looks back at the historical emergence of the epidemiological principles underlying this procedure, by referring to John Snow’s trailblazing work in cholera control. The historical reference underscores how disease surveillance through disease tracking and contact tracing is, by now, a centuries-long public health tool. The third section emphasizes how the COVID-19 pandemic prompted both technical and normative shifts related to the digitalization of these procedures. The fourth section posits some of the overarching obstacles for deploying international law to tackle future tensions between the public health rationale and normative assessments in digitalized disease tracking and contact tracing. Lastly, the fifth section puts forward conclusions in light of the juncture of reforms of international health law. Reference is made to the ongoing process for amending the World Health Organization (WHO)’s International Health Regulations (IHR) of 2005. The European Union has put forward proposals to further regulate the interoperability of digital health tools, including those related to surveillance, particularly for the purposes of international travel. Despite these efforts, the conclusion argues they have a limited potential to herald substantive criteria on the legality of the use of digital tools for disease surveillance at the national level.

B. Disease Tracking and Contact Tracing: Past and Current Practice and Law

In order to frame the ensuing debate, the following subsections offer an overview of the established practice on disease tracking and contact tracing in the field of public health. By now, these are well-established procedures for facing communicable disease outbreaks and pandemics.¹¹ In addition to the technical elements involved in these procedures, a subsequent subsection tackles the relatively thin international law currently in force on the subject matter.

I. “Classic” Disease Tracking and Contract Tracing: A Primer

The surveillance procedures of disease tracking and contact tracing addressed in this contribution are those of the individualized kind, which are implemented during communicable disease outbreaks.¹² Broadly speaking, when a disease can be transmitted from person to person, halting its spread requires cutting the chain of transmission by preventing physical contact as much as possible. Classic measures for doing so are isolation¹³—for known infections—and quarantine¹⁴—for suspected infections—both part of the standard public health toolkit and consisting of the physical separation of a person or groups of persons from others.¹⁵ A key question for public law is whether these measures are adopted against the will of their addressees. In normal circumstances, before determining whether an individual must be put in isolation or quarantine, it is on the basis of a factual reconstruction of the chain of transmission.¹⁶ Yet, in extraordinary circumstances, when the level of transmission in a community is high, fully reconstructing the chain of contagion through individualized tracing may no longer be possible.¹⁷ In these scenarios, entire populations may be placed in mandatory quarantines, because presence in public spaces leads to a risk of being exposed to a disease, and authorities are no longer able to trace each and every individual instance of exposure and possible contagion.¹⁸

The practice of disease tracking and contact tracing is closely related to epidemiological practices resembling detective work. The more general epidemiological principles date back to the investigation conducted by John Snow, a pioneer of modern epidemiology, who conducted a field study on the spread of cholera in London in 1854. His methodology consisted of visiting the homes of persons known to have been infected with the disease, or having been in touch with someone who was, trying to trace the cholera transmission chain back to its origins. He eventually found the source of the outbreak to be a water pump in Broad Street, London.¹⁹ By sanitizing the water pump, cases of cholera began to recede. John Snow’s discovery contributed to validate the Germ Theory of disease transmission.²⁰ Although the procedure focused exclusively on water and not individuals as the origin of the disease, the consolidation of the Germ Theory would eventually lead to applying these tenets not only to waterborne diseases, but also to those directly transmissible between persons. Today, even though procedures have evolved and become more sophisticated, John Snow’s detective-like methodology is a core standard in the field of Epidemiology.

Disease surveillance throughout the late nineteenth and early twentieth century witnessed the entrenchment of John Snow’s work in various ways. Throughout multiple countries, the recruitment of public health authorities to conduct “manual” disease tracking and contact tracing consistently increased.²¹ The data extracted from these operations could, in turn, be used for two distinct yet closely related purposes. First, data extracted from surveillance can be employed for developing a macro view of the existing incidence and prevalence of a communicable disease. Having an accurate assessment allows authorities to gauge the epidemiological scenario at the community level and adopt measures accordingly. Second, surveillance data extracted from disease tracking and contact tracing procedures can lead to individualized medical and public health measures, including those curtailing freedom of movement. Thus, in some cases, data collected through these procedures can be used to restrict individuals’ human rights.²²

Public law doctrine on a state’s “police powers” allow for the restriction of liberties, including the right to privacy, when the protection of public health is at stake.²³ Yet, even with the multiple technological advancements since John Snow’s landmark investigation of 1854, limitations for diagnosis in the fields of medicine, and particularly immunology, remain. Such limitations do not allow for having mathematically exact tools. This explains why, unlike disease tracking where there is a diagnosis, the use of contact tracing procedures for identifying persons at risk is based on uncertainty on whether and when a person exposed to a disease will develop symptoms (known as “onset”) and, in turn, risk transmitting it to others.²⁴

The procedures described above shed light upon the normative debates in the field of “classic” disease surveillance. As explained below, the interest on the subject understandably rose with the emergence of COVID-19. Yet the tradeoff between the protection of public health, on the one hand, and privacy, on the other hand, has long been discernible.

II. Existing International Law on Disease Tracking and Contact Tracing: Thin and Malleable

At the international level, the legally binding IHR (2005) only refers to contact tracing procedures as one amongst a catalogue of health measures that may be recommended by the WHO to face communicable diseases.²⁵ These recommendations are, as defined in Article 1 IHR (2005), non-binding for States Parties. As a result, from a legal perspective it is currently up to national public health authorities to decide when and how to adopt disease tracking and contact tracing procedures – subject, of course, to human rights considerations. Beyond the WHO’s non-binding recommendations, there are no legally binding international norms dealing with how to conduct disease tracking or contact tracing procedures, let alone on how to use digital procedures therefor.²⁶ Nevertheless, there are emerging normative debates in the wake of the digitalization of health surveillance.²⁷ Arguments in the following subsections do not go as far as to identify an incipient creation of new international law rules, but rather give an overview of the potential direction of these normative concerns.

When the IHR—the core international law instrument on the cross-border spread of disease—was approved at the World Health Assembly in May 2005, digitalized contact tracing procedures did not exist. It was sensitive to devise provisions in a flexible manner, in order to accommodate future innovations. Contact tracing procedures are mentioned in Article 18(1) IHR (2005) as one amongst the multiple measures the WHO Director-General may recommend both during emergencies and in “ordinary” periods.²⁸ In general, the WHO is not endowed with any legal powers to mandate the adoption of any public health procedures, or their modality, in a particular country. Recommendations certainly do not oblige national authorities in any way. However, the WHO’s recommendations may become a normative yardstick for assessing national health responses to disease outbreaks or pandemics.²⁹ Thus, during the COVID-19 pandemic, the WHO has issued a number of non-binding guidelines on what the best practices for contact tracing are, including through the use of digital tools.³⁰ These can provide the initial basis for establishing whether measures to face a disease are suitable, by confirming prima facie that they are adequate means conducive to the end, namely to mitigate the spread of a disease across the population.³¹ As posited below in section C, some boundaries can and, depending on the jurisdiction, should be set on the use of digital technologies.

The legally non-binding nature of the WHO’s recommendations on disease tracking and contact tracing ensures that the responsibility for their adoption—or lack thereof—lies with national authorities. From a public health perspective, and in similar fashion to the principle of subsidiarity,³² it has been posited that local authorities are best located to conduct situational assessments and determining what the best measures for mitigating the spread of a disease are in a specific community.³³ Nevertheless, leeway should not be understood as carte blanche. Resorting to public health measures known to be ineffective or failing to adopt those proven to be effective without sufficient justification, can be a breach of human rights obligations.³⁴ The key challenge is how to clearly ascertain which measures are effective through an evidence-based scrutiny. So far, there is no known instance of the use of digital tools for disease tracking or contact tracing as such being deemed illegal by any national court. Nor are there any claims by the WHO or other international bodies, including those with a human rights mandate, that these procedures are not suitable. Instead, as argued below, it is not the what, but the how that makes a difference.

C. Digitalizing Disease Tracking and Contact Tracing in Times of COVID-19: Deepening Structural Developments in Global Health

The COVID-19 pandemic saw a repeat, writ large, of past tensions between the protection of public health, on the one hand, and the right to privacy, on the other hand. Owing to the state of technological development, novel digital tools for disease surveillance proliferated throughout the crisis. The main justification was based on a public health rationale: in general, “manual” disease tracking through individualized detective work was unsustainable in a pandemic of such a widespread magnitude like COVID-19.³⁵ At the same time, contact tracing has been deemed to be essential for mounting an effective public health response to the spread of the SARS-CoV-2 virus causing COVID-19.³⁶ Therefore, when the WHO Director-General declared the spread of the disease to be a public health emergency of international concern on January 30, 2020,³⁷ he issued a number of temporary recommendations³⁸ advocating the use of specific measures to face the then-novel disease.³⁹

The COVID-19 pandemic was not the first known use of digital tools for conducting disease tracking or contact tracing procedures. For example, a more rudimentary software for tracking the spread of influenza based on the active upload of disease-related data by its users had been developed across multiple countries as early as in 2006.⁴⁰ Later, during the spread of the Ebola virus in the Democratic Republic of the Congo in 2018, similar software was employed to conduct disease tracking amongst known cases.⁴¹ But none of these efforts came close to matching the scope of similar software during the COVID-19 pandemic. Furthermore, perhaps owing to the different means of disease transmission,⁴² there is so far, no universal health surveillance software capable of tracking and tracing any and all risks of communicable disease contagion and risk thereof. Nevertheless, some of these tools may be portable between diseases.⁴³

Across the national responses to COVID-19, digital tools based on the use of tracking software emerged as a feasible alternative to the “classic” manual surveillance.⁴⁴ An assortment of options came to the fore. Smartphone apps, for instance, offered the advantage of a constant identification of proximity with infected persons through the continuous monitoring of users’ location.⁴⁵ Legal considerations due to the protection of privacy are at stake, particularly as data collected through these apps may contain individually identifiable health information,⁴⁶ and transparency on the storage and use of the data by authorities may be absent.⁴⁷

The start of COVID-19 community transmission in Germany, for instance, displays the rationale behind resorting to digital disease surveillance. In January, 2020, the first imported cases of infection with the new SARS-CoV-2 virus in Europe were reported in France.⁴⁸ In Germany, a first infection cluster of the virus was detected in the district of Starnberg in the federal state of Bavaria, particularly within the premises of company after one of its employees had returned from Wuhan.⁴⁹ After local authorities were privy to the information, they managed to conduct a prompt and effective contact-tracing.⁵⁰ Persons who had been in contact with known infections were subjected to mandatory quarantines. The company´s activities were temporarily shut down. These procedures resulted in the initial containment of the disease.

The successful surveillance and response operations in Bavaria bought German authorities precious time to enhance pandemic preparedness. But ultimately, this did not prevent the disease from eventually acquiring community transmission. The key shift occurred at the end of February 2020. At a press conference, the Health Minister of the federal state of North Rhine - Westphalia informed the public of the spread of the virus.⁵¹ In his words, it was no longer possible to “reconstruct” the chain of transmission for every case through contact tracing. This prompted the then-Federal Minister of Health of Germany to declare that a national epidemic was inevitable.⁵² What followed was the countrywide spread of the virus.

The beginning of community spread of COVID-19 in Germany showcased the technical justification for the digitalization of disease surveillance through contact tracing. When a communicable disease acquires generalized community transmission, public authorities may lack the resources to effectively locate the contacts of infected persons.⁵³ “Classic” surveillance through interviews to reconstruct the chain of transmission was overrun by COVID-19. No health agency personnel in the planet can cope with conducting detective work to manually reconstruct the chains of transmission in the face of waves of infection.

Facing this scenario, two novel developments related to contact tracing during the COVID-19 pandemic can be identified. First, the mandatory use of these digital tools was entirely unprecedented.⁵⁴ Exceptionally, some countries, like South Korea, had enacted legislation following past outbreaks to set the scene of an app mandate.⁵⁵ But their society-wide deployment did not become a reality until the COVID-19 pandemic. A global divide unfolded in terms of the chosen models. The choice was directly dependent on questions of public law. Whether the use of disease tracking and contact tracing apps was mandatory or not became a decisive factor both in the uptake rates of their use—a key condition for their effectiveness⁵⁶—as well as in the degree of infringement of human rights.

So far, there is no record available of national court decisions revoking the deployment of digital COVID-19 disease tracking and/or contact tracing tools as such, by deeming their use as essentially unconstitutional or illegal. Instead, known domestic court cases have focused on the means through which digital disease surveillance has been implemented. Thus, when examining the constitutionality of a digitalized contact tracing mechanism, the Supreme Court of Israel considered that it violated the right to privacy not because of the nature of the public health measure itself, but rather due to the “chosen means.”⁵⁷ The latter consisted concretely of the collection of by the Israel Security Agency,⁵⁸ with little to no safeguards for transparency and accountability.⁵⁹ Recognizing the importance of contact tracing for facing a pandemic like COVID-19, the Supreme Court of Israel held the government should undertake efforts to find less restrictive alternatives.⁶⁰ Similarly, the High Court of Kerala at Ernakulam in India issued an injunction mandating the government of Kerala to ensure, first, that COVID-19 surveillance data collected through a software developed by the company Sprinklr was properly anonymized; and second, that there is prior consent given by persons from whom such data is extracted.⁶¹ In its order, the Court highlighted the technical necessity of the disease surveillance software used against the COVID-19 pandemic in the state of Kerala, thus refraining from extending the injunction’s effects to the use of these public health tools more generally.⁶²

Second, a salient new feature in the digitalization of disease surveillance through disease tracking and contact tracing after COVID-19 is the increasingly hybrid public-private nature of these procedures. In the past, these procedures were conducted exclusively by public authorities. The delegation of surveillance functions to private bodies is also grounded on an argument of necessity, and raises multiple normative questions of its own.⁶³ The increased degree of participation of private actors in the creation and implementation of digital disease tracking and contact tracing tools echoes debates on the participation of private for-profit actors in the performance of activities deemed to be public in nature.⁶⁴ Before the COVID-19 pandemic, the field of global health had already experienced a rising “private turn” through the proliferation of all sorts of actors with their own resources and interests.⁶⁵ While numerous healthcare systems had a mix of public-private elements previous to the pandemic,⁶⁶ the field of surveillance through disease tracking and contact tracing had been mostly limited to the public sphere. Thus, public health authorities were the only ones authorized to conduct active disease tracking and contact tracing, which could then lead to the imposition of mandatory isolations and quarantines. The shift towards an increased involvement by private actors in disease surveillance for pandemic response warrants closer examination and legal scrutiny in countries where it has occurred.

Besides the WHO’s guidelines on the matter, a number of policy studies have aimed to identify best practices in the use of digital tools for disease tracking and contact tracing.⁶⁷ Arguably, the use of these tools allows for a more efficient use of resources and yields more accurate results on contagion with a disease, and the risk thereof. The hindrances of “classic” manual disease surveillance were visible even before COVID-19. Furthermore, allocating higher numbers of contact tracing personnel in “ordinary” periods in preparation for a devastating pandemic was deemed to be economically unsustainable.⁶⁸ But ultimately, the use of digital tools for health surveillance is not technically infallible either. Disease tracking software and contact tracing apps may lead to a flawed collection of data, particularly as the algorithms used to configure them can reflect programmers’ biases.⁶⁹ Relying upon heightened accuracy as a normative argument can only go so far, especially if and when there is a legal mandate imposed on the inhabitants of a country.

It remains to be seen whether disease surveillance through digital tools will be normalized in pandemic preparedness and response.⁷⁰ There does not seem to be a full-blown displacement of traditional methods of disease tracking and contact tracing. To the contrary, several countries saw digital disease-tracking tools coexist with “classic” disease surveillance based on detective work. The latter was taken, for example, through mandatory written forms when entering certain businesses, who were then obliged to transmit the information to authorities in case an infection in a venue was reported at a particular time.⁷¹ Simultaneously, there were digital equivalents to written forms when visiting particular places. Devoted software allowed persons to log in whenever s/he is present at a determinate venue. Persons could then log off after they left the venue.⁷² This variation reduced the intensity of tracing by limiting it to instances where persons where present in particular places, although at the expense of a reduced effectiveness because it focused tracing to those spaces only.

Recent events point towards a sporadic resurgence of manual disease surveillance. In the multi-country spread of mpox (formerly known as monkeypox), active at the moment of writing, the “classic” means of disease tracking and contact tracing were deployed.⁷³ As explained previously, no devoted software for this disease was available at the onset of its multinational spread. On July 23, 2022, the WHO Director-General determined the spread of mpox to be a public health emergency of international concern.⁷⁴ Among the recommendations issued under the IHR (2005), both “case detection”—disease tracking—as well as contact tracing were fostered as part of an effective response.⁷⁵ This development confirms the viability of these public health tools even beyond COVID-19 and in the absence of digital alternatives.

D. International Health Law and the Future of Digitalized Disease Surveillance

Whereas the public health necessity of digital tools for disease surveillance has been described in the preceding section, a number of normative concerns on the use of these tools remain unsettled. In particular, the role of private actors gives way to questions of how far they should be involved in matters of public health previously within the exclusive remit of authorities. Perhaps it is understandable: Private companies do not represent any constituency and are generally not accountable to the public at large. Nevertheless, the status quo across the world is that a considerable extent of public health services, even those that are publicly funded, are directly provided by private or hybrid public-private actors.⁷⁶ This fact partly explains why leading health policy studies do not consider private actor involvement in disease surveillance as problematic per se.⁷⁷ The problem lies in the possible absence of proper safeguards to ensure that the implementation of digital disease surveillance procedures by private actors is made in conformity with transparency and accountability requirements.⁷⁸

Societal contexts make all the difference in the legality of digital disease surveillance. There are stark contrasts worldwide on how healthcare and legal systems incorporate them. Technical guidance issued by the WHO on public health measures adopted at a community level to face COVID-19⁷⁹ emphasized how, in specific aspects of pandemic response, there is simply no “one size fits all”.⁸⁰ Measures that are, first, feasible and, second, acceptable in one community may not be so in another one. By extrapolating such insights to the use of digital tools in disease tracking and contact tracing, we can classify these two considerations of feasibility and acceptability as consisting of two global divides: a digital and a normative one. In terms of the global digital divide, the digitalization of disease tracing across the population is directly dependent on the technological infrastructure of the country at hand.⁸¹ It is unreasonable to expect countries where there is a low capacity for digital technology to fully deploy these tools when facing pandemics.⁸² Furthermore, there is still no visible consensus on whether disease tracking and contact tracing through digital tools are a necessary component of pandemic responses. Unlike efforts to tackle the more general global digital divide, it remains unclear whether the international community should proactively ensure that digital tools for disease surveillance are made available in countries with a lower-income population.

As for the global normative divide regarding which public health measures are acceptable, different societal values may entail the need to tailor measures to diverging contexts. Whether contact tracing procedures are adopted in a constitutional regime based on a model of liberal democracy or in more authoritarian settings can and should also affect which measures are employed during pandemics, and how.⁸³ This is both a matter of public health rationale, as well as a recognition of the current status quo under international law. The multilateral community of states welcomes not just liberal democracies, but also regimes with varying levels of authoritarianism.⁸⁴ In the burgeoning research on the subject, no strong causal relation has been identified between how public health measures are adjusted to either more liberal or more authoritarian legal systems, on the one hand, and their effectiveness in mitigating the spread of a disease, on the other hand.⁸⁵

The growing role played by private actors in digital disease surveillance activities sheds light upon prevailing structural features of healthcare systems. It is the outcome of a decades-long trend regarding shifting sources of funding for the provision of medical and public health services and products.⁸⁶ The limited public financing of health care systems all across the world renders building a fully public digital disease surveillance system illusory in the short term.⁸⁷ Yet, beyond this justification, the shift from the public to the private sector for conducting disease tracking carries its own set of normative pitfalls.⁸⁸ Concerns abound regarding the extent to which private actors use the data collected through disease surveillance exclusively for the originally intended purposes, a matter made worse by how oversight gaps are reported in multiple jurisdictions⁸⁹—the latter also being at stake in the case of both public and private actors, as scrutinized in the judgment of the Supreme Court of Israel presented above.⁹⁰

The booming literature after COVID-19 on the digitalization of disease surveillance has underscored some of the abovementioned normative pitfalls.⁹¹ Nevertheless, a look back into “classic” modes of disease surveillance sheds light upon recurring debates which are not exclusive to the digitalization process. Several normative concerns were present already in manual disease tracking and contact tracing procedures, particularly when they were implemented through an exercise of police powers by public health authorities.⁹² Consequently, during the COVID-19 pandemic, contact tracing conducted without the use of digital tools raised similar normative questions discussed herein.

In any case, in comparison to “classic” disease surveillance, digitalization brought about a change in the degree of intrusiveness in persons’ lives. Through manual detective work, public authorities had access mostly to information strictly related to the spread of a communicable disease. Persons interviewed or questioned about their whereabouts usually reported information only to the extent they considered it relevant for detecting contacts with infected persons. By contrast, digital tools may consist of constant processes of tracing the movement of persons, while registering activities not strictly speaking related to the spread of the disease in question. Thus, the use of digital tools may lead to a deeper and unwarranted look into a person’s privacy. A problematic aspect of this development is how data may be used for purposes other than public health. When information on the location and activities of persons is used in contexts different than those for which it was collected, there may be instances of abuse of authority. These, however, have not pointed so far towards any conclusive argument on whether such digital tools ought to be used or not, let alone to any regulation at the international level.⁹³ Additionally, from a technical perspective, the degree of intrusiveness of digital tools for disease surveillance can be adjusted. According to some commentators, technologies like “blockchain” can help improve privacy considerations.⁹⁴ But these claims require further research before being accepted.

Then, there is the question of the public’s trust in how public authorities, let alone private data service providers, will use information gathered through disease surveillance. The assumptions of individuals living in liberal constitutional democracies is that their relationships with authorities will be based on the respect for human rights and fundamental freedoms, privacy being amongst them. An example from Germany, once again, underscores some of the normative pitfalls of particular concern for liberal democracies. In early 2022, police officials used information gathered through the contact registration app to try to solve a criminal case.⁹⁵ It was later clarified that the procedure was irregular and it would be halted immediately.⁹⁶ But the damage to public trust in the system on the basis of liberal-democratic principles was done. Furthermore, in the case of data being stored by private providers, the need for ensuring its proper handling becomes even more pressing as the means to foster transparency and accountability may not be as immediate. The need for private companies to guarantee proper use and storage of personal data stemming from COVID-19 surveillance was the background of the injunction issued by the High Court in Kerala, India, as explained in a preceding section.⁹⁷

The normative pitfalls explained above are not necessarily insurmountable. The problem seems to lie not in the use of digital tools to improve public health procedures, but rather in the features of their implementation.⁹⁸ There are some means to mitigate the misuse of data. Thus, for instance, legislative bodies can hold authorities from the executiveaccountable —in the particular case, whatever Ministry, Department or Secretariat is tasked with collecting data or monitoring such a process.⁹⁹ Likewise, it is an understatement to affirm that the misuse of data by public authorities is far from being a phenomenon limited to disease surveillance.¹⁰⁰ As advocated elsewhere, there is a need for enhanced public deliberation and scrutiny of the normative pitfalls in the use of digital tools for disease tracking and contact tracing.¹⁰¹ The open question is whether these matters can be tackled at all at the international level.

Last, but certainly not least, if the argument of public health necessity is explored further, a global divide is emerging between those countries that can afford digital tools for disease surveillance and those that cannot. Countries where prevailing healthcare infrastructure and individual purchasing power does not allow for society-wide usage of digital disease surveillance tools risk being left behind. Lopsided capacities make the prospects of international norms in the field wishful thinking. At most, there may be “coalitions of the willing”,¹⁰² where groupings of like-minded governments may reach agreements on common frameworks for regulating the use of digital technologies in disease tracking and contact tracing procedures, whilst leaving other countries out of the framework. Bilateral or regional agreements will remain necessary when these public health procedures involve a cross-border dimension. A notable instance is the European Union, where common rules on data protection and their balancing with individual liberties has led to an increasingly sophisticated regulatory space.¹⁰³ But, beyond these regional exceptions, there is no equivalent at the multilateral level. Instead, during the COVID-19 pandemic, it was up to every country or region to develop its own contact tracing software and the criteria that should apply to their use.

E. Conclusions: Keeping Digitalized Disease Surveillance on the Margins of International Law

The COVID-19 pandemic was by no means the first event where authorities exercised their police powers for conducting disease tracking and contact tracing. It was not the first known use of digital tools for those public health procedures either. Yet, in view of the combination of both, COVID-19 did mark a breaking point with the past. Novel normative questions on how police powers are exercised in the area of mass disease surveillance emerged. The extent of responses to these questions will define the range of policy options to come.

Digital tools for disease surveillance are only as effective as the national context allows them to be. While technological progress enables gathering data through digital means, what happens with that data afterwards remains crucial for settling questions of legality. It is unclear how such questions could be addressed internationally instead of domestically. Given the stark contrast in societal values related to restrictions on privacy,¹⁰⁴ only domestic or regional bodies have the political standing to weigh what their societies are willing to withstand.

As the COVID-19 pandemic gradually recedes, authorities across multiple countries have begun phasing out the use of digital tools for disease surveillance. Fears about a more permanent individualized disease tracking and contact tracing have, so far, proven to be exaggerated. Yet the after-effects of using digital tools may not be fully visible for the time being. This raises the question of to what extent the pervasive use of digital tools in disease surveillance will be a one-off situation. Experience gathered during the COVID-19 pandemic may be a catalyst for future normative debates on the specific subject at the international level, independently of whether new binding rules on the subject are enacted.

In the wake of COVID-19, the international community is at a legal juncture on how to set rules for facing future health threats of that kind. The possibility to devise new international norms in the field opens the possibility of holding normative debates on the use of health surveillance tools across countries. Recent developments, however, point towards the opposite direction. Thus, at the moment of writing, both a new convention on pandemic prevention, preparedness and response—a “pandemic treaty”—and amendments to the IHR (2005), are being considered at the WHO. Whether the possible norms resulting from these processes will address multiple normative considerations related to disease tracking and contact tracing remains to be seen— even if there are some indications of where things might be headed.

An Intergovernmental Negotiating Body at the WHO has produced a zero draft on the basis of input by governmental representatives, civil society and experts.¹⁰⁵ Of note is how the text of the zero draft enshrines the sovereign right of states to determine which public health measures will be adopted in response to a pandemic.¹⁰⁶ The provisions, as they currently stand, seem to confirm the aforementioned premise that there is no “one size fits all” approach towards public health measures against pandemics. If all, of even some of the wording on sovereignty in the current draft text of a pandemic treaty at the WHO is enshrined as a legally binding instrument,¹⁰⁷ states would maintain their leeway to adopt the specific measures they deem most appropriate for their contexts. This would clearly encompass the distinct modalities of digital disease surveillance described in this article.

Moreover, in the ongoing process for amending the IHR (2005), the European Union has put forward a proposal to allow the WHO—namely, its World Health Assembly—to develop binding standards on the international use of digital health documents.¹⁰⁸ These standards would determine how the interoperability of digital certificates of vaccination or prophylaxis for specific diseases could work, rendering them usable across multiple technological platforms. In theory, this could allow the World Health Assembly to, among other things, enshrine data protection requirements as a condition for accepting digital health certificates when entering a country.¹⁰⁹ Nevertheless, even if this amendment were to be approved, the international regulation of digital health certificates under the IHR (2005) would, first, be for the purposes of demonstrating vaccination and prophylaxis, and not surveillance more generally; and, second, be focused on international travel, and not on strictly-speaking domestic settings. And ultimately, the European Union’s proposal addresses neither the digital nor the normative divide, as it overlooks diverging capacities and societal viewpoints between countries on the use of digital health certificates.

In sum, the global normative divide on privacy issues related to digital disease surveillance is not envisaged to be settled within the so-far limited scope of both a future pandemic treaty and potential amendments to the IHR (2005). Instead, there might be avenues for settling that divide at the national or regional levels namely in judicial and quasi-judicial human rights bodies. It would perhaps be a more sensible development, considering the prevailing diversity of societal views on what degree of intrusion in privacy by public health authorities ought to be legally allowed. Nevertheless, that would lead to a fragmented global regulatory landscape where wildly diverging standards on the subject will prevail. Yet, for multiple reasons, a global “one size fits all” regulatory approach towards the digitalization of disease tracking and contact tracing is likely to remain a chimera in the near future.