Japan Cabinet secretariat reveals Japan adopt PEPP-PT style contact tracing Apps. (2)

Page3 Features of popular contact confirmation app

Types Geolocation Bluetooth
Identifying Person Anonymising(EU proposal)
Central server processing Central server processing Smartphone devhce processing
Features Health authority identify the proximity contacts by using the location data of apps user.

India(others) uses the bluetooth technology to calibrate the location data accuracy.

Health authority can identify the proximity contacts and call by registeed personal data such as telephone number. Each user’s contact data is managed by server which is managed by Authority. Each user’s contact data is managed byeach person’s terminal device..
country India,Istaeli and others Singapore,Australia England,France Germany,Switzerland,Estonia (Japan proposal)

 

Relationship with Google/Apple API Not use(originally develop,GA do not use location info) No idea

(Originally developed till now.Future is not decided.)

 

TBD

(Originally developed till now.Future is not decided.)

Based on G&A APIs.

 

Page4
Basic idea of system (plan)

Can cabinet proceed on the basic assumptions that the system are as follows:

• Apps will be built using APIs provided by Apple and Google.Because, by controlling Bluetooth on the OS, it can be used in the background while using other apps.
• The identifiers exchanged between apps change periodically and canot identify individuals or terminals.
• All contact records are managed on the terminal, and verification of positive persons is also executed on their own terminals.

• Communication between terminals to detect rich contact and management of identifiers that are not related to individuals are realized by the function provided by Google and Apple.

• The notification server manages only positive app identifiers and cannot identify individuals.

Page 5

Mechanism of contact confirmation application (under consideration / undecided draft)

<Normal time>
• An identifier (not tied to an individual) is recorded at the contact with others in the application of the terminal of the other party
• Record identifiers will be deleted sequentially after a certain period..
(Pic1)

<At the time of positive confirmation>

  • Once user is diagnosed as positive,he/she is registered in the national grasping and managing system for Novel Coronavirus infected person (tentative name) .
  •  Positive user register that he /she is Covid-19 positive after receives the notification from the public health authority.
  •  (Contact )Uses may confirm that he/she has a contact history after contact alert are notified( in the way that cannot identify the who is positive user).
  •  Contact users register that they have contacts with positive user in national grasping and managing system for Novel Coronavirus infected person (tentative name).

Page6. Operators of contacts confirmation Apps in the world.

• Apple and Google, the owners of the app store, have policy which only allow the contact confirmation app which is released by public health authorities .
• In addition, app operators in each country are being implemented or studied under the responsibility of health authorities.
(omit)

Page 7 roles and schedule for implementation of contact confirmation application (draft)

1 Roles

Tech team (Corona countermeasure room / IT office secretariat)

【role】
• Formulation of draft specifications
• Apple / Google specification evaluation
• Privacy Impact Assessment (Confirm the relationship with the APPI,Adminnistration Organisation’s APPI, etc.)
• Collaboration w/ MHLW to promote to adopt apps•

Cooperation companies*

• * (One company) Code for Japan, Rakuten, etc.
• • Cooperation in drafting specifications for apps
• • Cooperation such as publicity activities for the spread of apps

MHLW

→ Organize and publish the above at a review meeting • Proposed specifications provided by tech team
Application development / implementation / operation using
• Cooperate with  tech team for app promotion.

Page 8 Expert committee and consultation Issues

Building Expert committee and consultation Issues

An expert review group will be set up under the tech team to study the basic  specifications of the application.
The study group will proceed with the study on the following points and request the tech team to report the study results.

  1.  Evaluation of Apple / Google API from both technical and privacy perspectives
  2. . Technical verification of draft specifications for contact confirmation application based on the use of Apple / Google API
  3. Assessment of  application specifications from the perspective of privacy protection and transparency, etc. based on the Personal Information Protection Law, Administrative Personal Information Protection Law,

Committee members ( omit)

Japan Cabinet secretariat reveals Japan adopt PEPP-PT style contact tracing Apps. (1)

New Coronavirus Infectious Disease Control Tech Team “Tech team” Secretariat reveals Japan adopt PEPP-PT style contact tracing Apps.

Tech team belongs to Cabinet Secretariat.

Tech team held 3rd Anti-Covid-19 Tech Team meeting on the 8 th May.The meeting details can be reached here. (only in Japanese)

Reference No1 is “approach for introduction of contact confirmation application  (plan)”

In this plan,tech team has a plan to introduce PEPP-PT style distributer style contact tracing app and system.According to Tech team,Japan has a plan to app system will be connected with national grasping and managing system for Novel Coronavirus infected person (tentative name).So the app is only playing role to “confirmation”,so the team calls part of apps as “contact confirmation apps”.

Below is the translation of Reference No1 slides.

approach (plan) for introduction of contact confirmation application

May 8, 2nd year

New Coronavirus Infectious Disease Control Tech Team Secretariat

Page1

Purpose of contact confirmation app

  • You can use your smartphone to (1) confirm your own behavior changes , and (2) when you find yourself infected. Assuming privacy protection and consent , the rich contact will be notified and the rich contact will be expected to move to Health observation smoothly by enabling registration to the national grasping and managing system for Novel Coronavirus infections (tentative name) .
  • For accurate understanding of the situation of positive people and statistical surveys, etc., the national grasping and managing system for Novel Coronavirus infections (tentative name) .
  Contact confirmation app

 

(Reference) national grasping and managing system for Novel Coronavirus infected person (tentative name) .
Main user Residents / residents in Japan

 

Public health centers, medical institutions, etc.

 

Timing of use

 

Until virus positive testing result Positive result or After the contact with positive person

 

Purpose •         Confirmation of changes in one’s own behavior

•         Enabling Rich contact person to register national grasping and managing system for Novel Coronavirus infections (tentative name) .

 

Reducing the burden of the Public health authority

Grasping the positive infected person correctly

Grasping the contacts with positive infected person

Main features

 

Recording of contact status with others on the devices.

Notification of the contact confirmation with positive user.

Grasping the positive infected person situation

Information sharing

Producing data

Page 2

Relationship between the contact confirmation application and national grasping and managing system for Novel Coronavirus infected person (tentative name) .

Basic countermeasure policy for new coronavirus infectious disease control (excerpt)

” The government will introduce a mechanism to implement at an early stage an efficient infection control and understanding of infection status , including utilization of technologies such as contact confirmation apps and SNS ,and will lead to more effective cluster measures cooperating with the Ministry of Health, Labor and Work. ”

“To prevent the spread, we will try to let people know that it is effective to understand the infection status of the entertainment participants by utilizing technologies such as contact confirmation applications and SNS that are being considered for introduction.

amended on  May 4, 2nd year, Resolved the headquarters for new coronavirus infectious diseases

Considering the concrete implementation of a contact confirmation application in a form that properly cooperates with  national grasping and managing system for Novel Coronavirus infected person (under implementation).

  1. Contact confirmation application
  • Promote behavioral change by grasping contact history through the app.
  • Introducing contact person to register to national grasping and managing system for Novel Coronavirus infected person.
  • Preserving the individual privacy only collect minimized information
  1. National grasping and managing system for Novel Coronavirus infected person
  • efficiently collect the information about the patient and share between stake holders.
  • Reducing the burden of the Public health authority
  • Utilising for epidemiologic research preserving individuals.

Slides continues,

PPC’s view on Contact tracing application to combat new coronavirus infection

Contact tracing application to combat new coronavirus infection

The Personal Information Protection Commission’s approach to the use of personal information

May 1, 2001
Committee for the Protection of Personal Information

As a countermeasure against  the contagion of a new type of coronavirus infection ,, The introduction of contact tracing applications using ICT technology and data is progressing worldwide.  There is an international debate on the protection and utilization of personal information.

The functions and system structure of contact tracing applications vary by country and region. In general, however, it is in general to use Bluetooth and other technologies on mobile devices to make and store the contact history between app users beyond substantial level  and this is used as a cue  if a pre-user becomes infected, the user’s proximate contact will be alerted immediately.  In response to new coronavirus infections, from the view to prevent spread of  infections by warning proximate contact to promote appropriate  conduct promptly and appropriately, the effectiveness of these apps was pointed out . On the other hand, there is an argument that it is important to consider the protection of personal information and privacy.

In Japan, the Cabinet Secretariat’s New Coronavirus Countermeasure Tech Team is currently working on a  joint effort between the public and private sectors, it is trying to introduce the contact tracing application in order to promptly inform the person in proximate contact of the fact of proximate contact, and to ensure that the person in proximate contact is kept in touch with public health authority. Therefore, we, the Committee hereby provides the guidance to use such  application fully keeping in mind the balance between the public policy requirement such as combat against infection and the request to secure the rights and interests of individuals with regard to personal information.

The Committee have high expectations for the applications will be one of the most effective methods to prevent the spread of new coronavirus infections ensuring that these apps sufficiently comply with requests for the protection of personal information.

(1) The system must be appropriately designed and operated because it handles information that is may handle with information which, if mishandled, could greatly infringe on the rights and interests of the user concerned such as   PCR test results of the user or the user’s behavioral history (with others)(i.e., the contact history of the user).

For the purpose of properly protecting the rights and interests of users and the use of data by these apps, these apps should be used based on voluntary installed based on  the discretion (consent) of the individual concerned, after giving the sufficient and specific information to the individual.

In addition, these apps are of character which is expected to be effective enough to gain a large number of users. Therefore, it is necessary for the businesses involved in the application  to earn the trust of users by ensuring operational transparency and implementing appropriate safety management measures through the  collaboration with State and local governments.

(2) In light of the examples of applications that have been introduced or are being considered in other countries or regions ahead of time, and applications that are being developed ahead of time in Japan, it is likely that most of the information obtained by the business operators involved in the application does not constitute the personal information as set out in the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended)(hereinafter referred to as the “APPI “). However, even in such cases, depending on the relationship with other information held by the service provider in question, it is possible that the information may become personal information, so each application and service provider is required to specifically verify the information and appropriately operate it in accordance with the APPI and other relevant laws and regulations.

(3) If the business involved in the application is a business operator handling personal information, it is particularly important to note the following matters from the perspective of compliance with the provisions of the APPI. In addition, it is desirable to make these matters public in order to ensure transparency in the operation of the app and to gain the trust of users.

  1.  Is the purpose of use of the personal information to be obtained specified as specifically as possible and clearly stated in an easily understandable manner to the user, and is the consent of the user obtained in order to obtain personal information requiring special care or to provide the personal data to a third party? (e.g., position of the app in the overall infectious disease control system, statement that personal data will be collected for infectious disease control, purpose and method of use of each data item, third party provider of data and the reason for this, purpose and method of use of the third party provider, etc.)
  2.  Is the company acquiring data that is not necessary for the purpose of use or providing it to a third party that is not necessary?
  3.  When there is no longer a need to use the acquired data, is the data to be deleted without delay? (e.g.) Is the retention period for concentrated contact history data set at an appropriate length from an epidemiological point of view, and is it ensured that the data is erased after this period has elapsed?
  4.  Are data security management measures and supervision of employees and contractors properly implemented?
  5.  Does the company have a system for accepting inquiries and complaints from users?