Introduction

Digital technologies are supporting the public-health response to COVID-19 worldwide, including through population surveillance, case identification, and contact tracing [1]. Control of the COVID-19 pandemic relies on testing for infection, isolation of infected individuals and tracing and quarantining of their contacts [2, 3]. Disease models suggest that the effectiveness of contact tracing as a control strategy declines rapidly if health authorities cannot complete contact investigations within 2 days of case identification [4, 5]. The variable disease expression and high transmissibility of SARS-CoV-2 means that asymptomatically infected people can unknowingly spread infection. Manual contact tracing processes for community cases are labour intensive such that a sufficiently large and rapidly spreading outbreak can quickly overwhelm system capacity. Part or all of contact tracing processes can be automated using people’s smart phones to capture and record encounters between users [6]. In this way contact tracing technologies can provide public health officials, affected individuals, or both, with rapid access to relevant information. They are readily scalable to larger populations and could reduce further transmission and escalation of a COVID-19 outbreak [4, 5].

The Australian Commonwealth (Federal) Government released the COVIDSafe contact tracing application (app) on 26 April 2020. Unlike the Google/Apple Exposure Notification System, the COVIDSafe app is integrated into established manual contact tracing systems. Based on Singapore’s TraceTogether app that utilises the BlueTrace protocol (https://bluetrace.io/), the COVIDSafe app deploys the Bluetooth function on smart phones to log encounters between users. When two people using the app are less than 1.5 m apart for 15 min or more, the app records the date, time, distance and duration of the contact and the other app users’ reference code [6, 7]. The information collected by the COVIDSafe app is encrypted and stored securely on the user’s phone and deleted on a 21-day cycle. The app does not capture or store the user’s location. If the user is diagnosed with COVID-19 they can give permission for this contact tracing data to be uploaded from their phone to a centralised store, which is subsequently made available to their local health authorities [8]. Data generated by the app can only be decoded by designated state or territory health authorities that manage contact tracing. In the case of New South Wale—where this research was conducted—these are located across 15 geographically defined Local Health Districts (LHD) as part of the state-run decentralised health service. See Supplementary Materials for further information on the operation of the COVIDSafe contact tracing system.

The effectiveness of the COVIDSafe contact tracing system depends on how many people download it and have it operating on their phone [6]. Current estimates are that 18 million Australians own a COVIDSafe compatible smart phone. The Commonwealth Government had an initial target of 40% of Australians to download the app, equating to about 10 million people. By late September 2020 estimates were that more than 7 million Australians had registered their details via the app—just over a third of potential users or about 20% of the entire population. Adoption is limited by smartphone ownership, user trust, usability and handset compatibility [1]. Because of concerns about the potential for coercion and discrimination, use of COVIDSafe is completely voluntary. COVIDSafe can be installed or deleted by the phone user at any time. To maximise data security and system integrity the Commonwealth Government has drafted legislation that restricts data transfer, storage, use and disposal. The COVIDSafe Bill 2020 protects people from being required to download COVIDSafe for any reason, including: employment; accessing services; and, receiving or providing goods or services [9]. Breaches can attract penalties of up to 5 years in prison or an equivalent fine.

In Australia, immediately prior to the release of the COVIDSafe app, a range of academic and media commentators raised concerns about data security, system effectiveness, and the normalisation of privacy-invasive surveillance technologies [10,11,12]. Others emphasised the need for mandates and the possibility of future scenarios where people could be required to have COVIDSafe on their phone in order to access certain ‘higher risk’ services or venues [13,14,15]. Concomitantly, bioethicists and social scientists focused on the political and ethical importance of the voluntariness; proportionality; fairness; and system trustworthiness [16,17,18,19]. In the absence of mandates, overall uptake depends on the public acceptability and perceived legitimacy of using mobile-phone-based personal tracing technologies to enhance contact tracing. In other words, system effectiveness will be determined by decisions made by individuals about the balance between the perceived potential risks, harms and benefits of having the COVIDSafe app operating on their phone. In this paper we report on six online deliberative workshops convened with New South Wales (NSW) residents in May and June 2020 to provide their recommendations on the appropriateness of using the COVIDSafe app to enhance contact tracing capacity in Australia. In particular, we focused on an empirical examination of the public acceptability, or otherwise, of the privacy and personal protections entailed by the interaction between app design, digital contact tracing system deployment, and the supporting legislation.

Methods

A deliberative workshop is a process in which a broadly representative group of members of the public is brought together to be informed about and deliberate on a specific issue. Due to COVID-19 restrictions, the deliberative workshops in this study were held online. What distinguishes deliberative methods from focus groups and other research methodologies for eliciting public views, is the structured and constructive process of information exchange, and the opportunities for developing knowledge between experts and members of the public to inform policy [20]. The method assumes that people can think in a reasoned way and change their views when warranted by evidence [21]. The general characteristics of deliberative workshops are:

  1. 1.

    A group of members of a public is provided with pre-reading materials containing factual information and covering a range of perspectives on the issue to be discussed

  2. 2.

    The group is convened for up to 3 h

  3. 3.

    They are asked to consider a specific issue

  4. 4.

    They hear (sometimes opposing) evidence from experts, and are given opportunities to ask these experts questions

The group are given time for deliberation, and to come to a set of reasoned conclusions, which is documented. The group size is small (n = 6–8), which is considered necessary for facilitating open discussions and high-quality deliberation—especially in an online format. Deliberative methods have been used in Australia and elsewhere to consider issues surrounding health data management and infectious disease control and prevention [22, 23].

The Questions Put to the Six Deliberative Groups

First, we asked each deliberative group to consider the legitimacy and appropriateness of the legislated privacy and personal protections regarding using the COVIDSafe app to enhance contact tracing capacity (Fig. 1). To validate each group’s decisions—and to provide further insights—the groups also deliberated on, and responded to, questions about different contexts in which the use of COVIDSafe app could potentially be mandated, and whether they would change their position if greater restrictions were being considered, such as stay at home orders, due to a sustained deterioration in epidemiological conditions.

Fig. 1
figure 1

The questions for the deliberative workshops

Full size image

Participants and Recruitment

Forty-three people were recruited across the six deliberative workshops (Supplementary Table 1). Because we were interested in exploring whether prior knowledge of public health approaches to infectious diseases risks had some influence on the verdict, the first three groups were recruited from a pool of participants of a previous study examining the preferences of NSW residents for technologically enhanced communicable disease surveillance [23]. An independent professional research service (Taverner Research) was contracted to recruit participants for the final three groups (comprised of individuals who had not taken part in previous research on the acceptability of communicable disease surveillance systems). This was done: (a) by telephone calls, using randomly generated list-based samples of people who live in NSW and had previously volunteered to take part in research, and b) by topic-blinded social media advertising on Facebook. Deliberative workshop participants were selected from this pool, based on representative socio-demographic characteristics (including gender and age); the final composition of each group was determined by individual availability and eligibility. All workshops included participants from a range of ages and varied educational levels; Group 2 was older on average than the other groups and Group 3 was skewed toward females. Workshop participants received a modest honorarium of $100 AUD per session in recognition of their time commitment.

Deliberative Workshop Processes

Participant consent was obtained via email. Participants were also sent a booklet containing fact-based information and a range of perspectives on the COVIDSafe app as a primer for discussions (See supplementary materials). The booklet was developed by two members of the research team in consultation with the expert witnesses, following an extensive review of publicly available materials on the new COVIDSafe app, and location and proximity tracing technologies in scholarly sources, grey literature and news media. The online workshops ran for an average of 150 min; facilitation throughout focused on promoting constructive dialogue and fair interaction amongst participants. Each workshop commenced with a short orientation session. Participants were then asked to complete a polling exercise (Fig. 1 PART A), prior to taking part in a 20-min facilitated discussion about their responses to the questions posed in the polling exercise.

Next, the groups were presented with further evidence in three pre-recorded presentations focused on understanding: SARS-COV-2 infections and the importance of contact tracing to public health responses to COVID-19; the COVIDSafe app and supporting legislation; and the socio-technical implications of deploying a contact tracing technology for health, and, potentially, society-wide surveillance. Experts were selected on the basis of their institutional roles, experience and expertise. Each presentation ran for approximately 5 min. After each presentation the experts were available through videoconferencing for participants to ask questions and clarify the evidence and opinions presented. After the final question and answer session a second poll was taken (Fig. 1 PART B). Participants then discussed their positions regarding the COVIDSafe app being deployed as a precondition of service use and socio-economic participation, and the reasons for holding their views. For the final hour of each workshop, participants reflected on, discussed and debated the questions posed, aided by a researcher acting as facilitator. A final poll was taken in which participants were asked to respond again to the questions in PART A. Participants’ underpinning reasoning and dissenting views, were then recorded in a final facilitated feedback session.

Data Collection and Analysis

The verdict provided by each group and the reasons for their decision are the key outcomes of workshop processes [24]. Because these outcomes are the product of discussions and the trading of reasons between participants the six deliberative groups (workshops) are the units of analysis in this study. To allow for verification and secondary analysis, all group deliberations and expert question and answer sessions were audio-recorded and transcribed. Local epidemiological conditions changed substantially during the course of collecting the data. The first three workshops were conducted in the middle of June 2020—when NSW was under stage 2 restrictions (schools closed, non-essential workers working from home) and COVID-19 case numbers were relatively low. The last three workshops were held in the middle of July, after restrictions had been eased; case rates in NSW were still low but concerns were growing because of a rapid increase in infection rates in the neighbouring state of Victoria.

Transcripts were independently reviewed, coded, and then analysed thematically by the first two authors, and cross-compared to track the emergence and course of different positions and arguments in group discussions, and to identify and clarify reasons why participants supported or rejected the presented options at the final poll [25]. Drawing on emerging literature on the social and ethical dimensions of using mobile technologies to support contact tracing, our analytic strategy paid attention to the ways in which workshop participants reasoned through and made claims about the need to balance the risks to privacy and equity of access against the potential benefits. As analysts, we appreciate that workshop deliberations are discussions within groups of strangers. We did not approach analysis assuming we could access the actual opinions or beliefs of participants. Instead we were interested in the different positions taken during deliberations and the underlying reasons and rationales presented by participants for why a position was seen to be important and how it was justified.

Results

PART A: Table 1 shows the outcomes of the final poll for the deliberative workshops. All six groups took the position (by majority) that the privacy and personal protections enacted in the COVIDSafe app design and supporting legislation were appropriate. The overarching rationale was that the legislation was respectful of individual choice and the protections put in place were appropriate to the current risks. Noting that groups 3 and 5 voted for this position only by a slim margin, and none of the groups came to a consensus, a significant minority of participants held opposing views. The nine participants who maintained that the legislation did not go far enough to protect privacy and personal rights held this view because they did not trust the government’s ability to keep data secure and were concerned about the overall competence of the COVID-19 response. In contrast, the three participants who took the position that the legislation went too far argued that the threat to lives was significant and public adherence to physical distancing guidelines was inadequate. Therefore, any measure that potentially improved preparedness through a minor loss of privacy was much better than increasing the risks that further lockdowns would be needed to slow community transmission in the future. Greater prior knowledge of public health approaches to infectious disease risks did not appear to influence group discussions and responses to the questions posed.

Table 1 PART A poll results
Full size table

Participant responses also varied to questions about whether a sustained increase in the incidence of COVID-19 would change their position (Table 1). Overall support for the legislated protections remained high but was more polarised. The main reasons participants gave for not changing their position were: that Australia seemed well prepared for a second wave; and that privacy and voluntariness were key concerns that should not be further compromised under any conditions. In other words, these participants were not convinced that greater intrusiveness could be justified. Allied to this, fears about the Commonwealth Government introducing mandates underpinned the view of some participants (n = 10) who argued for stronger legal protections against reactive and potentially arbitrary changes to current policies and practices.

PART B: In response to the second set of questions all but one of the groups voted that the use of the COVIDSafe app should not be a precondition of using services provided by governments or private businesses—even if epidemiological conditions were deteriorating and health authorities needed to increase contact tracing capacity to manage higher rates of community transmission (Supplementary Table 2). Although the majority of participants were against mandating app use, most believed that it was important for people who did not use the app to be required to supply service providers with personal details through other means to better support future contact tracing if a positive case emerged.

Deliberations Focused on Balancing the Voluntariness, Proportionality, Fairness, and Trustworthiness of the COVIDSafe App

Analysis of the transcripts revealed the following patterned similarities and differences in how participants reasoned about key issues surrounding the acceptability and legitimacy of using the app to aid contact tracing.

Voluntariness

The extent to which governments rely on mandates and different forms of coercion to increase the level of public participation in a public health measure can be understood as the voluntariness of the intervention. The unrestricted voluntariness of the COVIDSafe app was seen by almost all groups as being central to its acceptability. For most, if not all participants, the protections against coercion in the COVIDSafe Bill made clear the Commonwealth Government’s commitment not to make app use mandatory. Practical details, such as the requirement for users to actively ‘opt in’ four times between downloading the app and giving permission for any information collected to be uploaded to the central data-store, reassured participants. The fact that de-installing the COVIDSafe app from a user’s phone immediately wiped all collected data was seen as a further safeguard. Despite the rapid increase in COVID-19 cases in Victoria during the data collection period, participants in the later groups remained strongly committed to the app remaining voluntary. Key to this was a recognition that access to the app is inequitable. Making it mandatory would result in exclusion and sanctions on vulnerable groups and those who did not have a suitable smartphone; whereas, making use of the app voluntary ensured a fairer and less discriminatory distribution of the benefits of system participation.

Proportionality

A key trade-off considered during deliberations was whether the intrusiveness of the new technology was proportional to the risk to public health. Most participants believed the COVIDSafe app achieved an acceptable balance between privacy concerns and the need to enhance the public health response in NSW. The collection of proximity data was not perceived as being overly invasive but sufficient to contribute to improved COVID-19 contact tracing processes. However, the overall effectiveness of the COVIDSafe app was a significant concern in all groups—and a topic that was continually revisited during discussions. Extensive media reporting around early technical issues with the app and the subsequent extended public debate around the small number of cases it had detected, was central to much of the uncertainty expressed by participants. Technical issues in digital contacting tracing systems were seen as significant for acceptability—but participants struggled to make sense of some design decisions—especially the 1.5 m/15 min proximity parameter. Lack of clear public communication and ambiguity about the number of downloads sufficient to enhance contact tracing capacity, led some participants to question whether it was worth compromising their privacy to support a poorly subscribed and ineffective system. The potential for app users to be forced into social isolation unnecessarily because of a false alert was a key reason not to use the app, particularly if they had to cease work in order to comply with public health directives. A substantial minority of participants also expressed concerns that the app had introduced a privacy invasion benchmark that would be normalised and easily increased in future risk scenarios. Key to this was the view that the risks entailed by COVID-19 were overstated; noting also these participants told us they would willingly compromise privacy if the evidence was clear that COVID-19 or subsequent pandemics represented a more serious threat to public health.

Fairness

The fairness of a public health measure can be understood as the extent to which the burdens and benefits of the intervention are distributed equitably. Resistance to mandating the COVIDSafe app was primarily driven by recognition that some people, including the most vulnerable in society, may not be able to use it. Almost all participants held the view that mandating app usage would only be reasonable if an alternative platform to operate a COVIDSafe contact tracing device, such as a dongle, could be provided at no cost to people who needed it. In response to PART B, little distinction was drawn between government and private service providers in the discussion of contact detail collection options. Some participants explicitly noted that private service providers should not be treated differently because they and their staff need to be protected to the same degree as staff and users of government services such as public transport. At the conclusion of the process, most groups sought a compromise—such that asking service users to provide contact details in some other way (rather than insisting that they use the app) was the preferred option. This was seen as being least likely to lead to people being excluded and therefore addressed concerns about equity of access. For some, deeper consideration of fairness required that use of the app be clearly identified as a secondary and supplementary strategy within the suite of available COVID-19 preventative measures. Promoting physical distancing and the uptake and use of hand sanitiser and face masks were seen as of greater importance to controlling COVID-19. The overarching rationale being that basic public health measures were easily accessible to most, if not all people, lessening the potential for digital discrimination and inequities.

Trustworthiness

Trust in this context revolves around faith in the reliability of government, with concerns about the risk to privacy posed by use of the COVIDSafe app almost entirely discussed in terms of trust and whether the systems put in place to aggregate, secure and manage the collected data were reliable. Although most participants believed that Australian governments (Commonwealth and State) were doing as well as could be expected in the circumstances, several had misgivings about the Commonwealth Government’s role as the source of information about the COVIDSafe app and custodian of the centralised database. Cyber security competency was a particular concern. During discussions in most groups, it was observed that government communication about the app had been besieged by misinformation and sensational reporting by mainstream media sources. Bluetooth security was cited as an instance where there had been enough reference in the media to elicit concern, but not to fully evaluate the risks, given the complexity of the issue. Several participants who regarded themselves as being technically competent and well-informed stated that prior to the workshop they held misconceptions about the app, for example that it collects location data, or that its use was already mandated in certain situations in Australia. Clearer, publicly available factual information about how the app functions and the associated privacy protections, was needed; the dominance of politicians in delivering information about the app created scepticism and mistrust. Yet despite all of these concerns, at the conclusion of the workshops most participants described themselves as being willing to use the COVIDSafe app because of the limited data it collected—but lacked confidence that all private information will be securely managed.

Discussion

Bioethicists and social scientists have focused on how governments and potential end users need to navigate the trade-offs inherent to the design of digital contact tracing systems between population benefits, risks to individual privacy, and the potential for exacerbating existing disadvantage [15,16,17,18,19]. After having the opportunity to consider evidence, engage with experts, and deliberate with others, more than two thirds of participants supported the balance between privacy protection and potential public health benefit enacted through the COVIDSafe app and supporting legislation. This support was eroded, but not substantially, when participants were asked to consider a scenario where cases of COVID-19 are increasing. Participants who changed their position did so because they wanted either greater or less protection of individual privacy. Greater privacy protections would add reassurance about the commitment of the Commonwealth Government to the security of people’s data; whereas less privacy protection would lead to more effective contact tracing and better public health outcomes. Recent surveys suggest that the way the pandemic in Australia is being managed is heightening a perception among the public that more needs to be done to protect their personal information [26, 27]. Despite their support for the COVID-19 control measures being implemented in NSW, participants in our study were highly resistant to government agencies using technologies to track people’s locations. Previous research indicates that most Australians are uncomfortable with sharing their location data to enhance communicable disease surveillance, believe that it is a significant risk, and do not trust the current protections [23, 27].Footnote 1

These results are consistent with research in Australia [26, 27] and elsewhere [30,31,32] that indicates that privacy concerns are a key factor affecting individuals’ willingness to download contact tracing apps. This does not mean that privacy concerns trump all other considerations—but that the importance of privacy is dependent on a range of other social, political, and technical factors. As the emphasis placed by the groups during their deliberations on voluntariness and fairness of access to the technology indicates, privacy becomes something that people are willing to trade in the expectation that participating individuals, and the broader community will receive some level of benefits [33]. For many participants in the current study, their decision whether or not to participate in a digital contact tracing system was also dependant on how much they trust that the promised benefits are proportionate to the potential risks. And, perhaps more importantly, how much potential users believe that the benefits associated with the uptake of the technology can and will be delivered and distributed in a manner that does not create barriers for or discriminate against disadvantaged groups in the community. Individual privacy and data security are important considerations, but so is the potential for digitised public health systems to give private corporations greater control of the public sphere and exacerbate social disadvantage [15].

Against this background, it was notable, during each group’s deliberations, that concerns about the effectiveness of app were the launching pad and return point for most discussions and evaluations. Our impression was that participants were responding to sustained public scepticism about the usefulness of the technology. In the months following the release of the COVIDSafe app, political and media discussion focused on the lack of evidence available to the public as to its effectiveness. Initially, the relatively low numbers of new COVID-19 cases led to the technology being described at best, as being redundant, and more critically as an expensive flop [12, 34]. As outbreaks in Victoria and New South Wales took off and then were slowly brought under control, reports in the media about the number of people who have been in contact with a COVID-19 case uniquely identified by the app varied widely [35, 36]. In August 2020 the Commonwealth Government’s Digital Transformation Agency confirmed that, in NSW, the app had identified 560 close contacts missed through manual tracing processes—two of whom were later diagnosed with the virus [37]. Other Commonwealth agencies and State health departments—including the Victorian Department of Health and Human Services which managed a much larger COVID-19 outbreak—have consistently declined to provide more detailed information on COVIDSafe app usage because of the privacy components of the supporting legislation, and broader concerns that any disclosure may prejudice lawful methods of protecting public safety [38]. On these terms, the COVIDSafe app, supporting legislation and low case numbers were working counter to each other, with privacy protections and public health actions inhibiting the capacity of governments to demonstrate the app’s utility to drive uptake. Most participants indicated that they were reassured by the robust protections that were embedded in the design of the COVIDSafe app and the absence of direct coercion to drive system uptake. But, somewhat paradoxically, the absence of detailed factual information about the app’s performance created room for scepticism as to its effectiveness, and consequently, the proportionality of the privacy intrusiveness of the system.

Looking to the future, there is alarm that governments and corporate entities may use the COVID-19 crisis to increase surveillance infrastructures [39, 40]. Concerns about the involvement of private companies in digital contact tracing eroding public expertise and creating new dependencies are also being expressed by legal academics and technical experts [41, 42]. Despite entreaties by IT experts for Australia to follow health authorities in the UK and swap to the Google/Apple platform, governments remain committed to the COVIDSafe app and organising the public health response around manual contact tracing systems, it has been claimed, partly for reasons of data sovereignty [43,44,45]. In the Australian context, trust in existing systems and actors appears to be important to accepting a loss in individual privacy in order to enhance public health capacity [31, 46]. For most if not all participants of the current study, the central role of health service providers in operationalising data collected by the COVIDSafe app to trace contacts mitigated most concerns about protecting privacy. Public refusal of commercial involvement in the curation or analysis of data for public health purposes has been found elsewhere [47, 48]. Once again highlighting the importance of citizen trust to effective policy implementation [8], there may be a greater willingness to cooperate in the co-production of public health services such as contact tracing in jurisdictions with government-run universal healthcare systems when they are delivered by public organisations, rather than private corporations [31].

Strengths and Limitations

A limitation to this study is that deliberative workshops are comprised of small groups of ‘engaged citizens’ from NSW whose views may not represent those of the broader Australian general public. The use of a videoconferencing platform may have acted as a barrier to some potential participants or changed the nature of participant engagement in the process. The events were conducted in English; the involvement of non-English speaking participants may have yielded different results. A strength is that deliberative workshops involve a process of iterative two-way exchange of information between members of the public and experts. By providing extensive information from a range of experts from diverse but relevant academic disciplines, health service providers and governments, and ensuring conditions for reasonable debate, this method elicits more considered judgements than other social research methods such as surveys or focus groups. The sample size is small, but this is necessary for high-quality deliberation.

Conclusion

The complex interaction of risks, benefits, and burdens, and the redistribution of power enacted through the deployment of digital contact tracing points to the need for implicated stakeholders, including citizens, to be involved in technology design at the earliest opportunity. Value-based decisions are not restricted to the technical characteristics of the app but include the design of the supporting legal protections and organisational systems [19]. Even as the technical effectiveness of the COVIDSafe app remains an open question and source of controversy, the outcomes of the deliberative workshops indicate that the decisions to encode voluntariness in legislation and use of the app, and to augment and strengthen rather than replicate existing government-run systems, are appropriate to the values that many Australians see as being central to communicable disease control and prevention. The COVIDSafe app may yet prove to be a valuable tool in Australia’s response to COVID-19, should governments attempt to sustain social and economic activities even as epidemiological conditions significantly deteriorate. Success under these conditions depends, in part, on the proportion of Australians who are willing to trust public health authorities, and are able to download and operate the app on their mobile phones.

Our results suggest that Australian citizens are willing to trade their privacy for the common good during an emergency, and are more likely to do so when the governing institutions can demonstrate that the benefits justify the costs to individuals. As the current study shows, in principle acceptance of a new technology and a willingness to trust governing institutions is relatively easy to obtain. However, this underlying willingness does not necessarily translate into high levels of technology uptake unless other conditions and criteria are met in practice. Rather than relying on soft coercion—and existing but inherently fragile public trust—participatory and consultative design processes are needed to assess what risks citizens are willing to take, and what they expect in return [49]. Alternative means of engaging with the public and communicating the implementation of technological solutions do not necessarily need to be posed in trade-off terms. A positive-sum approach could be explored, particularly in cases where privacy by design is the chosen design methodology. Given the level of confusion and concern about how the app works, an accompanying educational component is also crucial to successful implementation, whereby the public is informed as to the purpose of the technological solutions, their realistic benefits and evident limitations. Finally, as governments around the world find themselves increasingly relying on private companies to provide public health functions, care needs to be taken to ensure that immediate solutions do not disenfranchise or increase risks to citizens in the longer term [15].