anu-act-health-covid19-support / soap-evaluation Goto Github PK

Describe the problem, gap or error in the framework
The authorisation criteria state that "the regulator for....where they involve personal information has been identified". This risks focussing information toward data protection regulators when the data involved may not be personal (for example data could be anonymised to a legal definition which excludes it from data protection) and/or another regulator, such as one for medical devices may be more appropriate.

Describe alternatives you've considered
Suggest altering the text to include the possibility of multiple regulators and indicate the need for health/medical expertise.

Additional context
In the UK the MHRA and ICO would be two of the regulators involved.

Describe the problem, gap or error in the framework
In the operational section for the framework a criteria is "vulnerable communities, who may not be able to engage with a technology solution, have been offered alternatives". This focuses on a particular type of vulnerability and problem, which might cause others to be missed.

Describe alternatives you've considered
An alternative approach would be to:

• expand on the user needs/profiles section to encourage identification of different communities & vulnerabilities, and how to get information about potential contact to them
• alter this criteria to encourage people to look at the breadth of tech/non-tech solutions being offered, how those match against the different user needs, and to consider whether the range of solutions provides adequate coverage to meet both public health goals and to avoid discrimination & unequitable (inequitable? sp?) outcomes

Additional context
The earlier discussion section of the paper could usefully highlight how people from different communities and with different vulnerabilities intermingle as friends, as workers, or on the same public transport and therefore, if they are infected, expose each other to risk of transmission.

Describe the problem, gap or error in the framework
The paper would be improved by first examining the suitability of existing standards and methodologies for assessing, or assuring, privacy of systems. I suspect there is no need to make up a new methodology just for contact tracing systems. But even if there is the existing ones need to be looked at first.

Describe alternatives you've considered
Professor Troncoso's team at EPFL seem to have a reasonable approach with "Decentralized Privacy-Preserving Proximity Tracing"

Additional context
The work of organizations, such as the Sahana Foundation for Disaster Management Systems, might have something useful to contribute.