This brief analyses how countries can achieve more effective, timely and sustainable responses to the COVID-19 crisis by taking into account regulatory barriers and compliance issues. Drawing upon previous work on administrative barriers and procedures as well as regulatory enforcement and inspections, the brief identifies several key regulatory aspects of the COVID-19 crisis response. These include: 1) facilitating the supply and availability of essential goods for crisis response, 2) reconciling privacy concerns with effectiveness for tracing and/or “track-and-trace” approaches, and 3) fostering and maintaining compliance with mitigation measures through targeted, proportionate enforcement and transparent communication. This brief discusses simplification and removal of disproportionate or non-risk-based barriers, as well as the importance of ensuring effective regulation of major risks, and achieving sustained compliance with key safety measures.

Key messages
  • While the response to the pandemic is primarily an epidemiological and healthcare concern, it involves regulatory issues at nearly every stage, and specifically a number of regulatory delivery instruments – permits and approvals, inspections and enforcement, etc. These matter for combatting the pandemic, mitigating harm, and facilitating recovery.

  • The regulatory response affects daily life in an unprecedented way: rules and tools are designed and implemented to control and roll back the disease’s spread by changing citizen behaviour.

  • Administrative procedures affect the availability of tools to identify and fight the disease (tests, essential medical products, and devices).

  • Regulations and enforcement have an impact on the ability of utilities to maintain critical services, of businesses to produce and deliver food, of essential services to function – even with a partial lockdown.

  • Beyond the immediate crisis response, regulatory issues also matter to alleviate economic and social consequences, supporting quick recovery, and being better prepared for future crises.

  • While acknowledging that there is no “one size fits all” solution, this brief outlines some of the key regulatory aspects of the COVID-19 crisis response, areas of concern and attention, and/or issues where good regulatory practices seem particularly relevant.

  • A key priority is fostering and maintaining compliance with mitigation measures through targeted, proportionate enforcement and transparent communication.

  • It is crucial to facilitate the supply and availability of essential goods for crisis response (tests, disinfecting substances, protective devices, medical devices, medicines, etc.) by revising administrative procedures (approvals, etc.) based on risk-proportionality and benchmarking of most efficient practices.

  • Addressing privacy concerns (e.g. by relying on “privacy by design”) and reconciling them with effectiveness for tracing and/or “track-and-trace” approaches can help offer a viable lockdown alternative or exit.

  • “Legacy” regulations, administrative procedures, and regulatory institutions and systems, need to be reviewed and revised to improve responsiveness and resilience to future crises.


Responding to a pandemic, caused by a novel virus whose behaviour and effects are initially poorly known, is an extremely challenging task. It involves taking disease-control decisions, adopting guidelines for testing and treatment, and managing resources – all with insufficient information and extreme pressure given the potential and actual impact on human lives. In such an extremely difficult context, it is vital to avoid regulatory obstacles that can result in precious time being lost, potentially life-saving services or equipment being unavailable or seriously delayed, or effective approaches being abandoned altogether as they are impossible to implement in the existing framework (Yeager, Hurst and Menachemi, 2015[1]).

At the same time, regulatory policy approaches can help inform the pandemic response design on the best ways to safeguard individual rights, achieve desired health outcomes with the lowest possible economic and social cost, and reinforce public trust and the legitimacy of public administration decisions.1 In turn, this means that compliance with disease control measures will be higher (all other things equal), and that risk-increasing conspiracy theories will be somewhat less likely to take hold.

Throughout this document, we have sought to keep the right balance in regulatory policy and management, to emphasise not only simplification and removal of disproportionate or non-risk-based barriers, where they exist, but also the importance of ensuring effective regulation of major risks. While acknowledging the central importance of effective regulation for safety and health, e.g. helping safeguard health care workers and the public from unsafe or unreliable products, this is not the brief’s primary focus. OECD guidance already exists, (OECD, 2014[2]), (OECD, 2018[3])and this will be the object of future work.2 Rather, the perspective adopted here is to concentrate on urgent and relatively simple issues where inadequate regulatory design or practices may hinder the response. This note does not focus on post-crisis recovery, though some of the issues are relevant to it. This question will be covered in a separate note.

The preliminary suggestions below have been developed based on analyses of the COVID-19 pandemic, and of selected countries’ responses to date. They build on the extensive work on administrative barriers and procedures, as well as regulatory enforcement and inspections, developed by the OECD Regulatory Policy Committee (RPC) over the past nine years. The brief was prepared by the OECD Secretariat and submitted for comments to the RPC and the Network of Economic Regulators.

 Facilitating supply and availability of essential goods for crisis response (tests, disinfecting substances, PPE, medical devices, etc.)

 Testing: methods, services and capacity – avoiding regulatory barriers while ensuring reliability and safety, and managing priorities

Widespread testing, made available as easily and broadly as possible, has been shown to be the foundation for the most effective responses to coronavirus (COVID-19) – e.g. in Korea and in the city of Vo’ (Veneto, Italy).3 Crucially, testing widely and without “entry barriers” (e.g. with no excessive regulatory restrictions for test methods and kits approvals, testing locations, testing accessibility for patients, and laboratory analysis) was effective in bringing the spread of the virus under control even though it had already reached alarming growth rates, case numbers and transmission (e.g. in Korea).4

In a number of jurisdictions, however, the availability of testing was or still is limited not only by issues of physical availability (of reagents, laboratory equipment, staff and facilities) but by regulatory barriers affecting testing methods and/or delivery.5 While many countries have given priority to testing critical cases entering hospitals/ICUs, it is also crucial to maintain and expand the possibility of testing for asymptomatic or light cases. Indeed, this has shown to be both effective at reducing spread quickly, and a more cost-efficient (when considering financial, economic, and human costs), compared to extended, total lockdowns.6

The main barriers found to affect the availability of testing were the following:

  • Delays in approving testing methods: in certain countries (e.g. the US),7 the start of testing was delayed by the complexity and demands of validation/authorisation procedures. Such approval processes may have resulted in several weeks of delays, which has been shown to correspond potentially to tens of thousands (if not more) of additional cases.8

  • Regulatory barriers to adopting methods already established and validated in other countries: recognising methods designed and validated by international organisations (e.g. WHO) or foreign countries with a demonstrated competence in virology and infectious diseases control can save precious time. For instance, instead of developing its own testing methods, Italy simply officially endorsed the testing protocols developed by WHO, and by the Charité hospital in Berlin.9

  • Limitations on the participation of laboratories, even when these have the necessary accreditation for this type of testing, the required equipment and secure facilities, and appropriate personnel. Korea, learning from previous crises (MERS in particular), enlarged its testing network to encompass all laboratories with appropriate capacity.10 By contrast, other countries (e.g. Italy or France) have (at least initially) strongly restricted the authorisation to test for SARS-CoV-2. In such countries, only a small number of hospital or research laboratories were authorised to conduct tests, based on a list approved for each territorial unit. Though the list was gradually enlarged, it remained quite restrictive for a long time.11 Such restrictions usually appear to relate to legacy systems and regulations on epidemic controls, dating back to a very different context, and are a good example of regulations that would require regular revisions to remain “fit for purpose”.12

Relaxing barriers that limit the participation of public or private laboratories (for- or non-profit alike) in providing testing services for pandemic response can bring major benefits, as well as removing barriers that may limit the opening of “off-premises” locations.13 This can have a positive impact both on the overall testing capacity, on the ease of access to testing for citizens, and on the availability of testing across the territory.

In addition, however, two issues should be taken into consideration:

  • Costs: in countries with a single-payer health care system or other publicly funded health-care coverage, governments may have been or still be reluctant or unable to cover the increased costs of tests provided by laboratories outside of the public provider network, and/or to approve testing for patients that do not fit strict guidelines for selection. These concerns, though understandable, conflict with the public health objective to cover as large a share of the population as possible, which is critical, particularly given the high asymptomatic share and the low specificity of COVID-19 symptoms. In such cases, while it remains desirable that tests continue to be covered as widely as possible by public funds and/or the public health service to ensure allocation of scarce capacity based on need, prohibiting the private (non-reimbursed) provision of testing services may result in restricting the overall testing coverage, thus worsening overall health outcomes (as seen e.g. initially in some Italian regions, or in France). Rather than prohibiting outright the provision of testing outside of the public network and/or outside of strict case guidelines, governments could simply opt to allow for testing by private laboratories, provided that patients pay for the tests themselves, that privately funded testing does not reduce testing capacity available in the publicly funded system, and of course as long as said private or “out-of-network” laboratories have the adequate competence and safety measures (as demonstrated by relevant accreditation).14 As the actual testing costs15 for laboratories are overall low,16 the price of such tests could be left free or capped, depending on competition and market conditions. Thus, the single-payer (or other publicly funded) system would continue to cover testing in a more restricted network and in a more tightly defined set of situations, but voluntary testing (paid by patients) would be available more broadly.

  • Supply: testing, as long as a broader variety of testing methods is not available and/or validated, can be hampered by insufficient supply of key reagents. While this is not a regulatory issue per se, it can prevent relaxed testing regulations from bringing about the desired effects (and it can be worsened by regulatory issues). Early lessons indicate that, to ensure that adequate testing supplies are available, governments could17:

    • Request all laboratories with adequate capacity to also provide an inventory of their supplies, to allow an estimate of the number of tests that they can conduct at current stock level;

    • Request a similar estimate from suppliers (producers, wholesalers);

    • Consult with relevant industries (laboratories, chemical manufacturers, wholesalers and importers, etc.) on how production capacities can be ramped up to address supply gaps (existing or predicted). This may involve reducing or removing regulatory barriers to, e.g., i) changes in activities of chemical manufacturers (to allow for changes in production/process more easily), and ii) imports or relevant reagents, etc. (as applicable).

Since the end of March 2020, several “points of care” (POC) rapid tests for the virus causing COVID-19, as well as a growing number of antibody (serologic) tests, have been put on the market. Reliability (false negatives or false positives) remains a problem with many of them (particularly with antibody tests),18 meaning that though these tests are easier to administer, deliver much faster results, require far less equipment and less staff time, and are far cheaper overall, the laboratory-based Polymerase chain reaction (PCR) test remains necessary as the main testing pillar.19 The mass-availability of such tests is also an issue,20 as is the availability of reagents for PCR tests. Moreover, serologic tests serve to assess past infection but do not detect an ongoing one,21 suggesting that parallel use of all testing methods22 remains needed to ensure an optimal pandemic response. This means that, while ensuring reliability of new testing methods is an emerging challenge (and due regulatory supervision is required for this), removing barriers for laboratories with the adequate capacity and accreditation to offer COVID-19 PCR testing services remains an important priority.

The above lessons thus remain all the more valid. The rollout of these new tests (when confirmed as adequately reliable) should not be slowed down through regulatory barriers, e.g., restricting which health care providers can make use of them (as long as competence, reliability and safety requirements are met). Also, laboratory PCR tests (those hitherto used) will remain necessary when POC tests are not available (or as confirmation tests), and using both types of tests in parallel will be necessary to ensure the control of the outbreak.

Production and delivery of life-saving equipment: Personal Protective Equipment (PPE) and medical devices – avoiding excessive barriers while ensuring safety

In many countries, the health emergency created by the pandemic turned into a major crisis partly because of insufficient stock and availability of essential supplies and equipment, even simple and relatively “low tech” ones.23 The lack of personal protective equipment (PPE) for health care workers has significantly increased their risk of contagion and fatalities.24 For private citizens, there have been repeated shortages of such a basic hygiene staple as hydro-alcoholic gel/solution, and face-masks have initially been a very problematic item to procure (and such supply challenges might reoccur) even as the consensus has increasingly shifted towards their usefulness for contagion prevention.25 High infection and fatality rates for frontline medical workers have partly been due, from the start of the outbreak and through the spread of the pandemic, to a lack of personal protective equipment (PPE).26 In turn, fatalities in hospitals are linked not only to the inherent severity of the disease (and of co-morbidities) but, in some instances, to the lack of sufficient numbers of ventilators, and the impossibility to procure/obtain sufficient numbers rapidly enough – as well as to shortages of spare parts (valves, respirator masks etc.).27

These shortages largely have to do with the inherent exceptional aspects of the pandemic (leading to enormously increased demand on some items compared to a normal year), the insufficient level of preparedness of many countries, and bottlenecks in production and logistics capacity (compounded by the lockdowns imposed in various places to respond to the pandemic). Nonetheless, regulatory barriers have played a role in making matters worse in a variety of ways in many countries, by making it more difficult for new producers to enter the market, and for new devices to be developed and placed on the market.28 This was compounded, in a number of cases, by differences in technical norms and standards applied across different markets. In substance, however, technical standards for certain classes of products are quite similar up to certain details, which is why regulators in many cases have temporarily allowed the use of products certified under foreign standards to palliate the shortage of those allowed in “normal” times.29 While, in some cases, the high inherent risk of the products/devices warrants strict regulation, some relatively low-risk devices (such as PPE) are also subject to highly restrictive rules in some countries. Even for higher-risk devices, there may be a case for increased flexibility, particularly in a crisis.30

Among the examples of production or provision of life-saving equipment/supplies that were affected by regulatory barriers are hydro-alcoholic solution and face masks.

  • Hydro-alcoholic solution (HAS): in spite of production being simple and based on commonly available ingredients, local initiatives taken to increase supply and address the shortage were slowed down initially (e.g. in France) by regulatory issues. In certain countries in Europe, it appears to have resulted from the combination of application of the EU regulation on biocides (528/2012), which prohibits placing “biocides” (including disinfecting products) on the market without an authorisations, and of a gap in some countries’ pharmacopeia (no official formula for hydro-alcoholic solution). Indeed, EU Regulation 528/2012 foresees a lengthy procedure for authorisation, which is economically unviable for most SMEs, and would anyway take far too long given the crisis context. It also foresees an exemption for the scope of application of Directive 2001/83 (Community code on medicinal products), which also foresees a complex authorisation, but exempts from it restrictive rules (and/or interpretation of rules) on what can be produced in pharmacies. Since France, when the crisis situation began, had no official formula for this product, this exemption was not applicable (but it worked in other Member States), which was solved through successive decrees taken on 6, 13 and 23 March 2020 (several weeks after the start of the pandemic outbreak in the country).31 Since the basic ingredients generally used for most HAS are ethanol and glycerine, these are ingredients that can fall under other regulations if not specifically marketed as “biocides” (a claim, which entails specific rules to guarantee efficacy). Thus, some suppliers have opted to market them as “sanitiser” rather than “disinfectant” (“marketing” as in “putting on the market”, in many recent cases for free, as these manufacturers have donated them to health care facilities), and thus avoided the need for authorisation. At the EU level, a general approval for ethanol as a biocide is in preparation (under the biocide directive), but has not been completed yet, which means that the possibility to prepare “generic” (not specifically approved) HAS fell under national regulations, and (as the crisis demonstrated) these were not always “fit for purpose” in times of crisis.

    This experience shows how a system of regulatory regimes (EU and national) created to protect the public from chemical risks and to ensure users (e.g. medical providers) that the products used meet exact specifications, can become a major barrier when the needs are far more basic and urgent. Indeed, the need was suddenly different: producing rapidly and in large amount HAS through a WHO-approved formula, using commonplace ingredients. This shows the importance of having norms that are risk-based (to avoid over-regulation), more proportionate and simpler (rather than requiring to look at three different major pieces of EU legislation and all relevant national implementing regulation), and make it easier for suppliers to address urgent needs.

  • Face masks: particularly in Europe and North America, where there was no widespread habit of wearing masks, and emergency stocks had often been left to lapse after previous pandemic fears (e.g. H1N1) failed to materialise, the shortage has been particularly severe. Several types of masks exist, for various uses (protection against virus spread by the wearer, or protection from contamination for the wearer etc.) – and various procedures can apply depending on the type of mask. Overall, the following difficulties were observed:

    • Complexity around the respective roles of different regulatory agencies (e.g. the National Institute for Occupational Safety and Health – NIOSH – and the Food and Drugs Administration – FDA – in in the US, which concurrently regulate different types and aspects of face masks and respirators);

    • Complexity and length of multi-step approval process (e.g. to get an approval for a face mask by NIOSH in the US, the producer must first be registered by NIOSH);

    • Necessity, in some jurisdictions, to obtain a formal approval on top of having completed the necessary tests to assess the compliance of the product with the relevant applicable standards.

While the technical contents of the applicable regulations in the US and in the EU are quite comparable (in terms of the standards that such devices have to meet, and the testing methods), the need to obtain formal approval before marketing makes the process significantly longer and more complex. By contrast, certification by an accredited and authorised third party is sufficient in the EU (decreasing complexity, costs and length). The need for producers to be registered with NIOSH further adds to regulatory barriers. In the meantime, the FDA issued an Enforcement Policy Guidance, “allowing” (or rather: announcing that no enforcement measure would likely be taken) masks to be put on the market without prior approval under a certain number of circumstances and conditions.32 While helpful, this shows again that the rules and processes initially in place created a significant obstacle.33

In sum, it may be worth reviewing and in some cases revising regulations and procedures applicable to personal protection equipment, “massive use” medical devices such as face masks, and products such as HAS, to ensure that there is more flexibility for new producers to enter the market in case of shortage.34 This is particularly true when the regulations include both substantive norms and certification (the ones that matter most to address risks), as well as more “formal”, procedural and possibly duplicative steps (which add delays and barriers without necessarily a commensurate benefit for the public).35 This is a typical case where application of well-known good regulatory principles (risk proportionality, using the lightest possible process/procedure for the desired result, using information regulation rather than product approval when no major risk is present, etc.) can be particularly useful. Finally, even for “higher complexity, higher risk” medical devices, it is important to try streamlining approval procedures so that no additional steps are necessary beyond what is strictly needed to ensure safety.36 Examples include removing formal validation by the competent authority, which is anyway based on third-party certification, and requiring only said third-party certification to be present is also a change that can help respond to the crisis immediately, in a risk-based way.37

Some examples show that more agile and flexible regulation can enable delivery and avoid excessive barriers for producers and products to enter the market. As a result, a number of businesses have changed their production and have been able to deliver relevant supplies that would otherwise have been scarce. In Italy for instance, several businesses from the textile and paper industry have switched to manufacturing face masks and PPE, based on emergency governmental rules aimed at facilitating the production, import and the marketing of these products.38 Distilleries have now started producing sanitisers and disinfectants.39 Beyond PPE supply, regulatory flexibility can also be valuable in ensuring that there are enough health workers. In Australia, the national health professions regulator, AHPRA, has created a sub-register of professions made up of practitioners who had let their registration lapse in the last three years, and had not been subject to any complaints – allowing for the automatic re-registration of over 35 000 nurses, doctors and other health professions.40 The judgement of the relevant authorities, in all these cases, was that the benefits at this time outweighed the risks associated with this response.

 Fostering and maintaining compliance with mitigation measures through targeted, proportionate enforcement and transparent communication

 “Lockdown” and restrictions to freedom of movement – design, procedures and enforcement issues

Unfortunately, COVID-19 is both relatively easily and rapidly spread and causes severe complications in a significant number of patients. If the spread of the disease is left unchecked, the health care system can become overwhelmed. This, in turn, can result in additional virus spread (as adequate protection becomes impossible), a higher death toll from the virus (as many patients, who would otherwise survive if adequately treated, die because life-saving equipment is unavailable), and a higher death toll from other sources (as hospitals are unable to provide emergency care and life-saving treatments for other diseases because of lack of capacity). To avoid (or mitigate) such disastrous outcomes, many states have been forced to put in place partial or total “lockdowns”, whenever “track, trace, isolate” measures have proven impossible to use (e.g. because of excessive community spread already in place), or were not tried.

Such measures unavoidably encroach on individual personal freedoms, and on economic freedoms too – one aim being to manage the lowest possible encroachment compatible with the greatest possible effect. They could even be in contradiction with national constitutions, in which case they would be invalid.41 While the exact design of lockdowns is largely a matter of epidemiological management [and the many “unknowns” remaining on COVID-19 make the design difficult to optimise], some aspects of implementation and enforcement relate very directly to regulatory policy. This is the case in particular of the level of detail and prescriptiveness of rules, of the procedures and paperwork introduced, and of the way control and enforcement measures are applied, as illustrated below.

  • Detail and prescriptiveness: it may be counter-productive to impose excessively precise and rigid norms on items that do not relate directly to contagion possibility. For instance, while imposing a specific safety distance between people in waiting lines, shops etc. is justified by calculations on the distance that virus projections can reach, the relevance of certain rules is sometimes less obvious. For instance, if we consider only movement on foot within a single municipality, there seems to be little meaningful difference between imposing that people not go out further than 100m, 1km or any other prescribed distance42 outside of their home (to practice whatever essential, authorised activity, from shopping to walking the dog).43 Far more rigid quarantine measures such as those applied in Wuhan (strict isolation of virus-carriers, strict lockdown at home with food being delivered to the door) may have a meaningful additional effectiveness (while impinging major costs in terms of human and financial resources, and freedom restrictions). On the other hand, there seems to be no evidence that limitations on the precise distance one can walk from one’s residence have a meaningful impact on contagion in practice.44 This type of norm tends to focus more on the details of the prescription rather than on the goal of the legislation. The goal could be to avoid contagion by ensuring that people do not get into physical proximity and contact; as this is more difficult to avoid when there are crowds, going out is restricted. However, it cannot be said that walking or cycling, for example, is a risky activity in itself from a COVID-19 perspective.45 Explaining the intent of the rule and its logic is important, and control and enforcement should focus on ensuring that key aspects of the rule are respected.

  • Procedures and paperwork: several countries have imposed self-certification forms, or “permits” that can be obtained online (and do not strongly differ from self-certification). These create additional transaction costs for citizens.46 Nevertheless, adding vexation to a confinement situation that already creates significant stress might be counterproductive in terms of ensuring legitimacy and compliance over the longer-term. This measure may also create additional contagion risks during control (see also next section), particularly when the form has to be printed and handed over for verification. In addition, in some cases, the model is regularly changed, making things more complicated without a strongly convincing reason. Substantially, the self-certification (or permit) does not significantly change the legal situation for citizens of law enforcement: only the cases for which going out is specifically authorised by applicable regulations are allowed, and police forces can control and enforce compliance with these even in the absence of a permit or certification requirement. The paperwork (or electronic alternatives) has the downside of adding burden, risks, and possibilities for arbitrary use of discretion, or downright abuse,47 much as similar use of permitting and paperwork in other fields, that the OECD has long identified as problematic.48 The danger of this measure is that rather than focusing on managing the risks (people coming too close to each other, or congregating in numbers), police forces risk to end up enforcing the process itself, and such rules could contribute to less-effective policing methods.49 This would, in this case, be of little use but may undermine the legitimacy of authorities, and thus create risks for longer-term compliance, as well as potentially increasing contagion risks.

  • Controls and enforcement: the questions and debates around controlling compliance and applying enforcement measures mostly relate to the following issues.

    • Clarity of rules, use of discretion, and appreciation of intent: rules on “lockdown”, physical distancing etc. have not always been clear or easy to interpret. Of course, to the extent possible, clear and unambiguous rules are preferable, to avoid abuse and maximise compliance, but there is no possibility of designing “optimal” rules, and sometimes leaving a margin of flexibility in interpretation and enforcement is necessary to avoid “regulatory unreasonableness” and excessive rigidity. In such cases, governments and enforcement agencies may want to adopt guidelines/guidance clarifying the criteria to be taken into account so as to ensure that discretion is based on transparent, risk-proportional, fair criteria.50

    • Automated and mandatory control versus emphasis on voluntary compliance and targeted controls: a certain number of countries have used automated solutions linked to their “track-and-trace” systems (see next section). While this is of course technically possible, it raises issues of longer-term legitimacy and trust. Automated control and enforcement can be perceived as an unacceptable level of intrusiveness from the state, and as being “procedurally unfair” (as automated enforcement does not leave room for assessing circumstances, mitigating factors, etc.).51 Thus, in a context where many countries already face severe crises of confidence in governments (often pre-existing but exacerbated by the crisis), the “mandatory and automatic” approach may end up significantly worsening the trust situation, and make contagion prevention more difficult. The decision should rest on a careful assessment of the local situation and of the actual level and risks of non-compliance. So far, available evidence (anecdotal, or quantitative in terms of gradual decrease of epidemic growth rates) suggests that compliance levels are overall rather high, even absent extremely coercive measures, as more and more people understand the seriousness of the situation and the need for isolation measures.52

    • “Blanket” or “random” versus “targeted” controls based on risk-assessment: the easiest approach is to control “everyone that moves” (but this requires considerable resources) or to control more-or-less randomly “any movement that is detected”. Certain police forces control more frequently in areas considered as “less compliant” from a general law-enforcement perspective, but there are numerous anecdotal examples of randomness. Experience and research on controls and enforcement suggests that more targeted efforts are more efficient and effective. Having clear and better defined criteria for risk assessment and prioritisation could also allow to minimise the risk of bias, ethnic profiling, etc. This could involve, for a start, focusing on movement of people which obviously seems to create problems in terms of confinement (larger number of people, possible creation of groups or risk of disrespect of the safety distance), rather than on solitary movement in a context where the street or road is practically empty. As data becomes available, police forces could analyse it to look at what is the pattern of violations in different areas, and prioritise areas or times of the day where/when serious violations (as opposed to any violation) take place more often. It would also be possible to analyse the contamination/epidemic spread data, and/or the increase in hospitalisations and fatal cases, and focus enforcement efforts on this basis. Finally, where a software solution exists or is introduced for people to report symptoms, or there are other means to identify possible emerging “clusters” etc., this can become a key element to target controls.

    • “Zero tolerance” versus “responsive and proportionate” enforcement:53 this is a topic that has largely been covered in many other areas of law enforcement and regulatory enforcement. “Zero tolerance” has consistently not been found to be effective, or to be marginally effective but with overwhelming negative side-effects,54 and so has recent international research on the (non-) effectiveness of fines.55 In fact, it has very often been seen to result in more adverse effects while also reducing legitimacy of the system (as it is perceived by many to be unfair). Again, “formal” violations (imperfection in the self-certification form, distance from home in slight excess of the set norm, etc.) should in principle not lead to enforcement action (at most to a verbal warning). Police forces should also be cautious not to add “interpretative” obligations (on what can be considered as “legitimate shopping”, for instance) whereas formal enforcement should be reserved to actions that actually endanger the population by creating a contagion risk. Clear, proportionate and transparent guidance and criteria for formal enforcement actions, in an environment where a large number of regulatory officials are having to interpret the application of broad prohibitions to a very wide range of circumstances, can be very valuable.56

Overall, the OECD Regulatory Inspections and Enforcement Principles and the Toolkit both can serve as guidelines for enforcement of COVID-19 related rules (OECD, 2014[2]) (OECD, 2018[3]). Control should be based on risk assessment, to the extent possible. It should be responsive rather than static, i.e. react to evolutions, changes, new assessments, behaviour and results. Control measures should not add additional risks of transmission. What is controlled, and how enforcement measures are decided upon, should be strictly proportional to the actual seriousness of the (potential or actual) infraction, i.e. the risk it creates. Enforcement should aim at reaching the goal of the regulation, not focus on “process for its own sake”. This is of course challenging particularly in situations of emergency and uncertainty, and focusing on “process” (and thus, process violations) can be easier.57 Building on the experience of many countries and regulatory areas, and on established guidance in particular from the OECD,58 governments and enforcement authorities can define priorities and methods, and criteria to establish the seriousness of a violation from a risk standpoint. This can include, for example, whether a violation is mostly formal, like a form incorrectly filled, or whether there is a substantive violation of safety distances, or other sanitary and safety norms.

 Transparency and information provision – avoiding panic, and avoiding future distrust59

While this is clearly not only a regulatory topic, the issue of information/communication, and of their effectiveness (or lack thereof) is essential to the overall success of COVID-19 response, and has significant regulatory aspects and implications. Indeed, the population’s (including the business community) trust that the measures imposed are actually effective as well as that authorities are competent, trustworthy and legitimate, is essential for effectiveness – and for continued effectiveness. Unfortunately, many governments already find themselves in difficult situations from this perspective, not only because of pre-existing trust issues, but of the way they initially responded to the crisis. This, in turn, makes it far more difficult to obtain voluntary compliance from citizens, and thus to introduce “softer-touch” measures to exit full-lockdown orders, and avoid mandatory surveillance/tracking apps, but rather use approaches that safeguard privacy and rights.60

Among the areas of communication that governments may choose to be particularly cautious about:

  • Neither under- nor over-estimating the risk, or the country’s ability to cope with the epidemic: while creating panic is to be avoided, communication needs to be backed by facts, data and science, while being transparent and honest about uncertainties to foster trust. It is highly preferable to transparently convey uncertainty (“difficult to predict, we are trying to get ready”) than to risk a loss of trust by asserting misplaced certainty that later could get contradicted by facts.

  • Not over-reacting, but not under-reacting: governments may be wary of the economic costs of localised shutdowns or strong measures, but the experience (starting with China and Italy) is that the economic costs of controlling the disease once the spread has “exploded” are exponentially higher. Not only is a late reaction worse in terms of health and lives, but it does more economic harm, and destroys confidence. Better act fast and targeted, and not lift measures too early.

  • At a point when face masks were in short supply, a number of governments continued to communicate the initial guidance given e.g. by WHO that masks were only needed for health professionals.61 This did not seem to prevent speculation, shortages, theft etc., (as evidenced from countless news reports from countries where authorities had emphasised that masks were recommended only for medical professionals and not the general public62), but did harm the credibility of authorities once evidence accumulated, in later weeks, of the effectiveness of face masks, and of their absolute necessity in certain cases.63 This, in turn, may reduce the degree to which citizens heed future advice from governments that have been found to have given less-than-fully-transparent guidance.

  • Trust in official messages is the most important “currency” that governments and public bodies have in such a health crisis. Distortion of information,64 particularly if seen as deliberate, is a sure way to squander it.65 The importance of “clear and timely communication and transparency with citizens” has also been highlighted by the European Commission.66 Again, this is all the more crucial as the obligations being imposed to fight the pandemic spread will inevitably require the compliance of most citizens, i.e. go far beyond what can reasonably be achieved only through control and coercion (at least if democratic norms are to be upheld). Voluntary compliance can be secured, but to this aim, trust needs to be maintained. Clarity on how emergency rules and measures are to be interpreted, communication and discussion on why compliance is crucial to achieve the expected outcome, and use of enforcement only for those that show to be intentionally reluctant to comply while compromising the safety of their fellow citizens are examples of essential elements that can contribute to building such trust. Stakeholder engagement and co-operation between public and private sector is also crucial to maintain their trust towards government and hence also their compliance. Daily examples show how difficult it is to effectively and reliably change behaviour in the context of a health emergency, with the obvious example of even people who comply with mask-wearing requirements frequently wearing them improperly. Transparent, effective information thus is one a major priority for next phases of COVID-19 response.67

 Regulation and technologies for “track and trace” efforts– enforcement, privacy and individual freedoms

To trace the contacts of individual COVID-19 case, several sources of data from mobile phones can be used: the connections of the mobile phone to the network cells, the use of GPS68 positioning, and Bluetooth contacts between phones coming in close vicinity to each other. 69 The OECD and the World Bank have been developing a database of existing practices for data gathering and management in the context of the regulatory aspects of the COVID-19 response. The database spans OECD and non-OECD countries, and is now accessible online.70 The OECD has also published online resources and guidance on the use of technology to enhance the COVID-19 response, including in terms of science and innovation policy, open government data, and “track-and-trace” systems.71 The European Commission has recently adopted a Recommendation and a set of guidelines to support COVID-19 containment measures through mobile data and apps – while seeking to safeguard data privacy.72

This section looks more specifically at some of the regulatory management and delivery considerations that cut across different policy approaches and responses that capitalise and benefit from digital tools and data – while providing some technical details where these are necessary to make the overall issues clearer and more concrete. Beyond the technical issues involved in different solutions, what matters from a regulatory point of view are issues of proportionality, balancing of rights and effectiveness, and public trust (which, in turn, affects uptake of the system).73 For instance, using Bluetooth may present some reliability issues, but reliance on Bluetooth may become a standard thanks to the development of Bluetooth-based tracing functionalities in their systems by both Google and Apple.74 Thus, the fundamental questions from a policy point of view may concern the overall architecture of the system in terms of regulations and interaction with the public, rather than strictly technical aspects.

Public trust is essential to the success of digital tools used in the response to COVID-19. Cultural and political differences among countries (including trust in government) may mean that digital technologies are more effective in the COVID-19 context in some countries than in others. A well-designed app will not be able to effectively trace the spread of COVID-19j if citizens refuse to install it, if a critical mass of users is not reached, or if citizens refuse consent to the necessary data sharing, or stop using their phone altogether. The problem involves regulation in different ways, e.g. privacy regulations, and regulatory delivery (including controls and enforcement). Thus, touching on different policy implications for data governance in the context of digital solutions – from the quality of the data to the control of how that data is accessed, shared and used (OECD, 2019[4]).

Track and trace technologies have adopted different methods to ensure the privacy of their users. Several technologies rely on emerging data governance tools such as “trusted third parties” to collect, store and process the private data from a patient found to be infected, and then trace the contacts, while maintaining anonymity of the data. This approach presents some security issues as there can be significant risks associated with the “trusted third party” role. By contrast,75 some decentralised Bluetooth-based tracing technologies do not require a central tracking system. Rather, they rely entirely on each user’s log of contacts76. It is worth looking at some of the elements of a “track and trace” system (which, beyond contact tracing, may include location tracking, notification to/from users, enforcement functions, etc.), and of different existing or possible technological solutions, to better understand how some of the issues can be managed or reconciled better by drawing on lessons from regulatory management and delivery.

 Some elements of success in Korea

The Korean app (Corona 100m) informs the population in real time about diagnosed coronavirus COVID-19 cases. App users are alerted when they come within 100 meters of a location visited by an infected person, based on the entire travel histories of those infected.

The Korean government also provides information to the public via the “Coronamap” website, which shows the travel histories, age range and gender of confirmed cases. The privacy of individuals is protected by assigning patients a numeric ID. The travel histories are reconstructed using data from cellular phones, credit card transactions, and surveillance cameras. Another web service called “Coronaita” acts as a search engine that allows users to search for information on coronavirus-hit areas. These applications have helped citizens avoid being near infected persons and have raised self-awareness of the possibility of having been exposed to the virus, which can, in turn, help citizens decide to voluntarily self-isolate and/or visit a testing facility.77

 Applicability in other countries

Using the same approach in other OECD countries or indeed most countries worldwide with a high level of smartphone adoption and network coverage does not seem to present inescapable technical challenges - i.e. phone operators are technically able to reconstruct connections and positions going back 15 days.78 However, location data are not always sufficiently accurate to allow for effective tracing and tracking using digital tools and, most importantly, there are significant concerns linked to individual privacy and related freedoms.

Even if the initial use of data is related to pandemic response, it is difficult for governments and proponents of such system to guarantee to users that in practice the data would never be put to further use (i.e. beyond what the user has consented to, and what has been initially guaranteed). Past and current abuses, often well publicised, have made the issue of data privacy particularly salient. Irrespective of the extent to which such concern is justified,79 fostering public trust requires technological solutions to COVID-19 track and tracing that offer strong privacy guarantees.80

There is also opposition to, and justified scepticism of “automated enforcement” systems, particularly regarding the negative consequences they may have for human rights, public trust and the perceived legitimacy of authorities. These systems may involve monitoring quarantined persons 24/7 and automatically initiating law enforcement measures against them if the system indicates an unauthorised movement).81 These go considerably beyond data sharing issues, and we thus point below to the need to consider them separately and distinctly.

To offer a successful approach that can be adopted widely and remain in use to avoid resurgence of the pandemic in the future (and possibly be used for potential other epidemics in future), these justified concerns need to be addressed effectively and convincingly.

 Privacy by design

The aim is to reduce privacy loss to a minimum, both in terms of effective data protection and of citizen perceptions. To this aim, using existing instruments that can guarantee privacy by design may help avoid issues linked to determining whether an organisation or a government is “sufficiently trustworthy” (which raises unavoidable issues of subjective judgement). A technical approach that currently has strong momentum and has been increasingly adopted, in particular by virtue of being supported by both Google and Apple, is basing tracing on Bluetooth contacts, with local (i.e. “in phone”) encryption.82 Some governments, such as Italy’s, have announced that they will roll out Apps based on this approach.83 The two companies, working together, are setting a policy direction that may pre-empt the respective governments’ policy about how they would handle privacy.84 Challenges and difficulties are already visible: some governments want more control and centralisation in an attempt to ensure that public health authorities are aware of where the hot spots are and what trends are developing (e.g. France, which has decided to use Bluetooth contact detection, but with a more centralised approach that does not align with Apple/Google solutions). This raises conflicts with privacy concerns and with the protections embedded in Apple’s systems (and possibly in Google’s too).85 Critics, however, are not reassured by proclaimed assurances of privacy. In spite of many criticisms and some disappointments in terms of uptake and impact, particularly compared to some possibly excessive early expectations, some examples of successful uptake of contact tracing apps exist, and could provide useful examples.86

Another potentially effective COVID-19 digital technology combines “self-sovereign identityand a Blockchain to ensure privacy of individuals regardless of the location / contact data source, be it network cells, GPS and/or Bluetooth. “Self-sovereign identity” represents the third generation of systems of identity management, which can give users’ sovereignty (control) over their own identification data, rather than giving this control to third parties that provide such services (for “free” or not). The technology is based on the third generation of Blockchain, which, in contrast to Bitcoin (first generation) and Ethereum (second generation) allows for a more “granular” management of the anonymity of transactions (data exchanges, contacts). Combining these elements would better guarantee citizen privacy, not constraining citizens to put their faith in the reliability and effectiveness of the organisation delegated to data protection.87 Alongside the centralised and decentralised solutions, there is a third working hypothesis: keeping information on a distributed network, using for example the combination of a Self-Sovereign Identity and a Blockchain. In this hypothesis, trust does not need to be placed either in a third party (centralised model) or in the device technology provider (decentralised model).

 Possible ways forward: avoiding over-reach

One of the many challenges presented by the COVID-19 pandemic is the vast number of infected people, and the significant share of asymptomatic people88, making “traditional”, human-based tracing costly and difficult. While, when applied consistently, “traditional”, human-driven contact tracing can be very effective, the pandemic has strained the capacity of many countries to conduct it with existing resources, hence the persistent interest in digitally enabled contact tracing.89 The question of international mobility and contact tracing is also problematic, and whether and how contact-tracing applications (apps) in different jurisdictions may effectively communicate with each other remains an open question. It is important to use technology to complement and expand traditional tracing methods (not to replace it), and to provide an “early-warning” system for emerging outbreaks/clusters.90 Some of the factors that appear able to assuage, at least partly, justified concerns about excessive surveillance and loss of individual rights are the following:

  • Setting up a tracing system only without automated enforcement of quarantine measures (rather, control and enforcement measures remain done in a more compliance-promoting, trust- and risk-based approach, emphasising voluntary compliance supported by active public communication, and using targeted, “human” and non-automated enforcement actions only);91

  • Giving the information about past or current proximity to infected persons to each user, but not to a centralised system.

The information about locations could be either kept strictly in individual phones (as in the Bluetooth-based approach92), or kept in a centralised database that is totally anonymised through encryption (e.g. combining a central database of locations, and resolution of identities through decentralised use of Blockchain). The resolution of anonymity could then only be done upon the request of each individual user, and only for his/her own positions. Thus, were a person diagnosed as infected, the system would know that there was an infected user, but not that user’s identity (the Blockchain option makes this possible even when there is a central database to register locations, as only each individual user can resolve his/her own identity) – or the “match” would only happen between the users themselves, without any centralisation (e.g. using Bluetooth to detect other users and “ID” them).93 Other users are notified if the resolved “keys” showed that they were among the people in the vicinity of a person now known to be infected.

Those who have been in contact or proximity with this infected person would receive the notification from the system that this contact has taken place and that they should be tested – but no information on who this person is/was. Thus, privacy would be kept constant at all stages, and only the affected users would be notified. To ensure full effectiveness, the health system should then treat such notification as a valid reason to be tested for infection.

In addition to this key functionality (tracing of cases and notification to potentially infected people, so that they can get tested as soon as possible), a feature used in Singapore could be added which allows users to easily notify any respiratory or related symptoms that they currently feel. The aim would not be to provide an approximated and possibly misleading “diagnosis” but to crowdsource identification of possible “clusters” and spread of contagion. While individual symptoms may not necessarily be significant enough to determine infection, a large concentration of reports indicating potentially COVID-19-related symptoms in a location would denote a very high probability of spread in this area. This could then form the basis for a rapid public-health intervention (testing in the identified area). Such a functionality would be easy to add, and would be voluntary, so that no significant privacy issue is at stake.94

Beyond specific choices and solutions, data exchange and interoperability, and effective use of multiple data sources, may offer more chances of success than attempting to solve the issue of tracking contagion and spread through one single system.95

 Regulatory policy dimensions

In terms of regulatory policy, the first and most central question is often the reconciliation or balancing of privacy and effectiveness issues. While creating a centralised repository or “tracking” using a multitude of sources (including, as in Korea, surveillance cameras or banking terminals data) could increase effectiveness of localisation, it may reduce the uptake of the solution (both in terms of the number of countries adopting it, and of number of users/citizens adopting or supporting it). Bluetooth-only, for instance, does not provide location data, but raises fewer concerns and thus would be more likely to be adopted and sustained. As mass adoption and support are essential for the system to be effective, a trade-off that protects privacy and related freedoms better may in fact end up being more effective. Thus, a comprehensive view not only of technical issues, but also of enforcement and legitimacy issues, is essential to design the most adequate solution.

In addition, much can be achieved by integrating and managing better data that is less directly “private” (location, contacts) and is held by the health system, but not necessarily analysed in real time. Estonia, for instance, has successfully used its pre-existing data integration96 to make efficient use of test results in tracking epidemic spread.97

Other key considerations for such a system are whether to incorporate a mandatory element or not (e.g. make the installation and use of an app mandatory if one wishes to go out during the lockdown period), whether to apply automated enforcement (e.g. of quarantine / self-isolation orders), or whether to make the system as respectful of privacy and of individual rights98 as possible,99 and as reliant on voluntary compliance as possible. Any measures reducing privacy (because the benefits are particularly large) could be subject to sunset provisions after a specified time or when a specific trigger occurs (for example, the ending of a public health state of emergency). Such a trigger could allow the system to be reinstated if another public health state of emergency need to be initiated at a later stage, without having to introduce legislation again. Despite the obvious challenges of making people comply voluntarily (including limited ability to do so in particular for less advantaged socio-economic groups or in emerging or low-income countries), as well as technical considerations such as the effect of an app on smartphones’ batteries, avoiding the most “coercive” approach may yield real benefits in terms of legitimacy and long-term sustainability.

To promote more voluntary use and compliance, governments could mobilise trusted “voices”, explain via all media channels how the system is intended to work and protect people, and showcase how successful use of “track-and-trace” has been an important element in some countries’ ability to remain “open”,100 whereas failure to do so makes lockdowns far more difficult to avoid or exit.


[22] Alcadipani, R. et al. (2020), “Street-level bureaucrats under COVID-19: Police officers’ responses in constrained settings”, Administrative Theory & Praxis, pp. 1-10, http://dx.doi.org/10.1080/10841806.2020.1771906.

[17] Baldwin, R. (1995), Rules and Government, Clarendon Press, https://books.google.fr/books/about/Rules_and_Government.html?id=KtaPAAAAMAAJ&redir_esc=y (accessed on 6 August 2020).

[21] Blanc, F. (2018), From Chasing Violations to Managing Risks: Origins, Challenges and Evolutions in Regulatory Inspections, Edward Elgar Publishing Ltd, https://www.amazon.fr/Chasing-Violations-Managing-Risks-Inspections/dp/1788112482.

[23] Blanc, F. (2012), “Moving Away From Total Control in Former Communist Countries – the RRR in Inspections, and Lessons Learned from Reforming them”, European Journal of Risk Regulation, Vol. 3/3, pp. 327-341, http://dx.doi.org/10.1017/s1867299x00002233.

[24] Bleakley, P. and C. Bleakley (2018), “School Resource Officers, ‘Zero Tolerance’ and the Enforcement of Compliance in the American Education System”, Interchange, Vol. 49/2, pp. 247-261, http://dx.doi.org/10.1007/s10780-018-9326-5.

[16] Braga, A., B. Welsh and C. Schnell (2015), “Can Policing Disorder Reduce Crime? A Systematic Review and Meta-analysis”, Journal of Research in Crime and Delinquency, Vol. 52/4, pp. 567-588, http://dx.doi.org/10.1177/0022427815576576.

[25] Budd, J. et al. (2020), “Digital technologies in the public-health response to COVID-19”, Nature Medicine, Vol. 26/8, pp. 1183-1192, http://dx.doi.org/10.1038/s41591-020-1011-4.

[26] Burnett, J. (2018), “Review: Policing the Planet: why the policing crisis led to Black Lives Matter”, Race & Class, Vol. 59/3, pp. 108-110, http://dx.doi.org/10.1177/0306396817737239.

[27] Calvo, R., S. Deterding and R. Ryan (2020), “Health surveillance during covid-19 pandemic”, BMJ, p. m1373, http://dx.doi.org/10.1136/bmj.m1373.

[36] Cha, V. (2020), “Asia’s COVID-19 Lessons for the West: Public Goods, Privacy, and Social Tagging”, The Washington Quarterly, Vol. 43/2, pp. 1-18, http://dx.doi.org/10.1080/0163660x.2020.1770959.

[28] Chen, E. (2008), “Impacts of “Three Strikes and You’re Out” on Crime Trends in California and Throughout the United States”, Journal of Contemporary Criminal Justice, Vol. 24/4, pp. 345-370, http://dx.doi.org/10.1177/1043986208319456.

[39] Clark, B., R. Parker and T. Duy (2020), “The Roadmap to Keeping Oregon Open Part I: Establishing the COVID-19 Capacity for Testing and Contact Tracing Required to Keep the State Safe and Open”, SSRN Electronic Journal, http://dx.doi.org/10.2139/ssrn.3600638.

[29] Cullen, F., T. Pratt and J. Turanovic (2016), “It’s Hopeless”, Criminology & Public Policy, Vol. 15/4, pp. 1215-1227, http://dx.doi.org/10.1111/1745-9133.12260.

[30] Cullen, F. et al. (2018), “When Bad News Arrives: Project HOPE in a Post-Factual World”, Journal of Contemporary Criminal Justice, Vol. 34/1, pp. 13-34, http://dx.doi.org/10.1177/1043986217750424.

[11] Cullen, R. and P. Reilly (2008), “Information Privacy and Trust in Government: A Citizen-Based Perspective from New Zealand”, Journal of Information Technology & Politics, Vol. 4/3, pp. 61-80, http://dx.doi.org/10.1080/19331680801915066.

[41] Dar, A. et al. (2020), “Applicability of Mobile Contact Tracing in Fighting Pandemic (COVID-19): Issues, Challenges and Solutions”, SSRN Electronic Journal, http://dx.doi.org/10.2139/ssrn.3683404.

[8] Esposito, S. et al. (2020), “Universal use of face masks for success against COVID-19: evidence and implications for prevention policies”, European Respiratory Journal, Vol. 55/6, p. 2001260, http://dx.doi.org/10.1183/13993003.01260-2020.

[31] Halabchi, F., Z. Ahmadinejad and M. Selk-Ghaffari (2020), “COVID-19 Epidemic: Exercise or Not to Exercise; That is the Question!”, Asian Journal of Sports Medicine, Vol. 11/1, http://dx.doi.org/10.5812/asjsm.102630.

[38] He, J. et al. (2020), “Proportion of asymptomatic coronavirus disease 2019: A systematic review and meta‐analysis”, Journal of Medical Virology, http://dx.doi.org/10.1002/jmv.26326.

[19] Hodges, C. (2015), Law and Corporate Behaviour : Integrating Theories of Regulation, Enforcement, Compliance and Ethics, Hart Publishing, http://dx.doi.org/10.5040/9781474201124.

[42] Ho, H. et al. (2020), “Use of a Real-Time Locating System for Contact Tracing of Health Care Workers During the COVID-19 Pandemic at an Infectious Disease Center in Singapore: Validation Study”, Journal of Medical Internet Research, Vol. 22/5, p. e19437, http://dx.doi.org/10.2196/19437.

[40] Keeling, M., T. Hollingsworth and J. Read (2020), The Efficacy of Contact Tracing for the Containment of the 2019 Novel Coronavirus (COVID-19)., Cold Spring Harbor Laboratory, http://dx.doi.org/10.1101/2020.02.14.20023036.

[32] Kretzschmar, M. et al. (2020), “Impact of delays on effectiveness of contact tracing strategies for COVID-19: a modelling study”, The Lancet Public Health, Vol. 5/8, pp. e452-e459, http://dx.doi.org/10.1016/s2468-2667(20)30157-2.

[13] Lades, L. et al. (2020), “Daily emotional well‐being during the COVID‐19 pandemic”, British Journal of Health Psychology, http://dx.doi.org/10.1111/bjhp.12450.

[37] Lee, D. and J. Lee (2020), “Testing on the move: South Korea’s rapid response to the COVID-19 pandemic”, Transportation Research Interdisciplinary Perspectives, Vol. 5, p. 100111, http://dx.doi.org/10.1016/j.trip.2020.100111.

[14] Martinez, S. (2009), “A System Gone Berserk: How Are Zero-Tolerance Policies Really Affecting Schools?”, Preventing School Failure: Alternative Education for Children and Youth, Vol. 53/3, pp. 153-158, http://dx.doi.org/10.3200/psfl.53.3.153-158.

[33] Matasick, C., C. Alfonsi and A. Bellantoni (2020), “Governance responses to disinformation : How open government principles can inform policy options”, OECD Working Papers on Public Governance, No. 39, OECD Publishing, Paris, https://dx.doi.org/10.1787/d6237c85-en.

[12] Mattioli, A. et al. (2020), “COVID-19 pandemic: the effects of quarantine on cardiovascular risk”, European Journal of Clinical Nutrition, Vol. 74/6, pp. 852-855, http://dx.doi.org/10.1038/s41430-020-0646-z.

[4] OECD (2019), The Path to Becoming a Data-Driven Public Sector, OECD Digital Government Studies, OECD Publishing, Paris, https://dx.doi.org/10.1787/059814a7-en.

[6] OECD (2018), Good Jobs for All in a Changing World of Work: The OECD Jobs Strategy, OECD Publishing, Paris, https://dx.doi.org/10.1787/9789264308817-en.

[3] OECD (2018), OECD Regulatory Enforcement and Inspections Toolkit, OECD Publishing, Paris, https://dx.doi.org/10.1787/9789264303959-en.

[10] OECD (2017), International Regulatory Co-operation and Trade: Understanding the Trade Costs of Regulatory Divergence and the Remedies, OECD Publishing, Paris, https://dx.doi.org/10.1787/9789264275942-en.

[2] OECD (2014), Regulatory Enforcement and Inspections, OECD Best Practice Principles for Regulatory Policy, OECD Publishing, Paris, https://dx.doi.org/10.1787/9789264208117-en.

[7] OECD (2014), “The crisis and its aftermath: A stress test for societies and for social policies”, in Society at a Glance 2014: OECD Social Indicators, OECD Publishing, Paris, https://dx.doi.org/10.1787/soc_glance-2014-5-en.

[5] OECD (2010), OECD Employment Outlook 2010: Moving beyond the Jobs Crisis, OECD Publishing, Paris, https://dx.doi.org/10.1787/empl_outlook-2010-en.

[20] Ogus, A. (1994), Regulation: Legal Form and Economic Theory, Clarendon Press, https://books.google.fr/books/about/Regulation.html?id=wIQVAQAAIAAJ&redir_esc=y (accessed on 6 August 2020).

[34] Reicher, S. and C. Stott (2020), “On order and disorder during the COVID‐19 pandemic”, British Journal of Social Psychology, Vol. 59/3, pp. 694-702, http://dx.doi.org/10.1111/bjso.12398.

[18] Tyler, T. (2003), “Procedural Justice, Legitimacy, and the Effective Rule of Law”, Crime and Justice, Vol. 30, pp. 283-357, http://dx.doi.org/10.2307/1147701.

[9] Wang, J., M. Zhou and F. Liu (2020), “Reasons for healthcare workers becoming infected with novel coronavirus disease 2019 (COVID-19) in China”, Journal of Hospital Infection, Vol. 105/1, pp. 100-101, http://dx.doi.org/10.1016/j.jhin.2020.03.002.

[35] Wells, H. (2008), “The Techno-Fix Versus The Fair Cop: Procedural (In)Justice and Automated Speed Limit Enforcement”, British Journal of Criminology, Vol. 48/6, pp. 798-817, http://dx.doi.org/10.1093/bjc/azn058.

[15] Wolff, K. and J. Intravia (2019), Broken Windows/ZeroTolerance Policing, Wiley, http://dx.doi.org/10.1002/9781118568446.eurs0508.

[1] Yeager, V., D. Hurst and N. Menachemi (2015), “State Barriers to Appropriating Public Health Emergency Response Funds During the 2009 H1N1 Response”, American Journal of Public Health, Vol. 105/S2, pp. S274-S279, http://dx.doi.org/10.2105/ajph.2014.302378.


Florentin BLANC (✉ [email protected])

Céline KAUFFMANN (✉ [email protected])

Miguel AMARAL (✉ [email protected])



Countries respond well to the invitation for digitalisation. Greece, a country ranking close to last within EU, showed a rapid switch to digital age by adopting digital solutions for everything from cabinet meetings to prescriptions in a very short time, due to COVID-19, available at: https://www.businessdaily.gr/english-edition/14533_coronavirus-does-impossible-pushes-greek-state-online.


In addition to the (OECD, 2014[2]), Best Practice Principles and (OECD, 2018[3]), Toolkit for Regulatory Enforcement and Inspections, the Regulatory Policy Division will in coming months try and look specifically into inspections and enforcement issues with regard to health and safety in the crisis context.


See for instance, lessons from Italy’s Response to COVID-19: https://hbr.org/2020/03/lessons-from-italys-response-to-coronavirus.


See a recent comparison of testing campaigns across countries prepared by the Health Division of the OECD: https://read.oecd-ilibrary.org/view/?ref=129_129658-l62d7lr66u&title=Testing-for-COVID-19-A-way-to-lift-confinement-restrictions.


See e.g. articles in the New York Times and The Atlantic on delays in the US: https://www.nytimes.com/2020/03/10/us/coronavirus-testing-delays.html and https://www.theatlantic.com/health/archive/2020/03/why-coronavirus-testing-us-so-delayed/607954/Regarding the impact of testing delays, see e.g. (Kretzschmar et al., 2020[32]) in The Lancet.


On the international regulatory cooperation angle, see OECD Regulatory Policy response paper: No policymaker is an island: the international regulatory co-operation response to the COVID-19 crisis available at: http://www.oecd.org/gov/regulatory-policy/the-international-regulatory-cooperation-response-to-the-covid19-crisis.htm.


See (also on the decentralization of testing locations through “drive in” etc.): (Lee and Lee, 2020[37])


See a summary of the barriers to the use of all testing capacity in France, including a number of regulatory issues: https://www.lemonde.fr/planete/article/2020/04/24/nous-attendons-d-etre-contactes-par-l-ars-mais-il-ne-se-passe-rien-le-fiasco-des-tests-en-france_6037647_3244.html.


COVID-19, with a high share of asymptomatic, contagious cases, requires mass testing, which was not necessarily needed in the same way in the past. Overall testing capacity has increased a lot over the last decades, with much more “decentralization” between different structures, in the private sector, etc. Legacy regulations dated back to periods with less developed safety protocols and techniques, when ensuring that wrong manipulations were avoided appeared more important, etc.


Locations where citizens can get samples drawn, which are more easily accessible than hospitals, e.g. “drive-through” testing facilities in Korea.


Germany has been a prime example of using all the available testing capacity, public and private, so as to have an optimal speed and effectiveness of response. This appears to be one of the keys explaining Germany’s relative success in limiting the impact of the pandemic – see e.g. on the overall German approach: https://ourworldindata.org/covid-exemplar-germany, https://newseu.cgtn.com/news/2020-07-03/How-Germany-s-testing-regime-has-gone-from-strength-to-strength-ROj6WOUBLG/index.html, https://www.thelocal.com/20200626/how-germany-showed-the-way-when-it-came-to-coronavirus-testing – on the specific involvement of private laboratories: https://www.dw.com/en/germany-covid-19-travel-rules/a-54602605, https://www.ft.com/content/07ebae84-f0f3-424c-b704-b5aca88980d2 – on the overall testing numbers: https://www.statista.com/statistics/1109066/coronavirus-testing-in-europe-by-country/ – and official information here: https://www.rki.de/EN/Home/homepage.html and https://www.bundesgesundheitsministerium.de/coronavirus/chronik-coronavirus.html.


As distinct from the price billed to patients, which can be much higher in some cases.


Costs of doing the PCR tests for laboratories are around 15 to 20 EUR in most cases – see early reporting on this e.g. here: https://healthpolicy-watch.news/costs-of-covid-19-tests-could-limit-scale-up-in-europe-who-says-herd-immunity-approach-lacks-evidence-base/


Since the availability of PCR tests has strongly increased in most countries, and given the importance of reliability, retaining pre-existing levels of scrutiny for approval of new testing methods appears generally appropriate. Nonetheless, the seriousness of the pandemic speaks strongly for expedited recognition of tests already approved by countries with similar levels of requirements and robustness of process, rather than starting anew a full approval process.


Availability of supplies for POC tests may not be equally ensured for all markets (manufacturers giving priority to the largest markets). These tests also require the health care facility to have the necessary POC equipment, which is proprietary for each test manufacturer.


On this section, see this article on the implementation of export restrictions due to critical shortages: https://www.orfonline.org/expert-speak/covid19-export-bans-trade-rules-international-cooperation/.


This has been the subject of protracted debates, as there is no decisive clinical trial evidence, but an accumulation of country experiences suggest that face masks play a possibly important role (and their availability is definitely problematic in many countries) – here is a systematic and recent review of the evidence: https://www.health.govt.nz/system/files/documents/pages/evidence-review-for-the-use-of-facemasks-by-the-public-may6-2020.pdf. A number of articles make the case of why mask wearing, if sufficiently spread, can help reduce contagion, both in scientific journals (Esposito et al., 2020[8]) and in general publications (https://www.theatlantic.com/health/archive/2020/04/dont-wear-mask-yourself/610336/). The recent ECDC report (here summarised by the Italian Ministry of Health) ends up with a generally similar conclusion that masks can be useful in the general population: http://www.salute.gov.it/portale/nuovocoronavirus/dettaglioNotizieNuovoCoronavirus.jsp?lingua=italiano&menu=notizie&p=dalministero&id=4521.


OECD brief on this issue can be found at: http://www.oecd.org/coronavirus/policy-responses/beyond-containment-health-systems-responses-to-covid-19-in-the-oecd-6ab740c0/ – and see a detailed analysis by Italy’s ISS and ISTAT of the mass excess mortality in Lombardia and specifically in the worst-affected provinces (where a real hospital crisis was evidenced) here: https://www.istat.it/it/files/2020/05/Rapporto_Istat_ISS.pdf


On IRC approaches to mitigate regulatory barriers to trade, see (OECD, 2017[10]).


Technical standards applicable for “filtering facepiece respirators” (FFR) are, for instance, to a significant extent similar both in terms of purpose (effectiveness to be achieved) and specifics, between e.g. the US N95 (NIOSH-42CFR84), the EU FFP2 (EN 149-2001) and China KN95 (GB2626-2006) – see e.g. this technical summary by the 3M company: https://multimedia.3m.com/mws/media/1791500O/comparison-ffp2-kn95-n95-filtering-facepiece-respirator-classes-tb.pdf. There are of course also variations in how conformity to standards is actually tested and certified for, how placing FFRs on the market is regulated etc. The similarity in standards was the ground for the FDA relaxing enforcement of PPE requirements (see note xvi below).


The US FDA issued guidance relaxing enforcement of requirements on PPE: https://www.fda.gov/media/136449/download.


See e.g. the UK relaxing administrative requirements and barriers to imports of PPE and hand sanitizer, details available at https://www.gov.uk/government/news/regulations-temporarily-suspended-to-fast-track-supplies-of-ppe-to-nhs-staff-and-protect-companies-hit-by-covid-19. For hand sanitizers, see also the decrees issued in Germany (https://www.baua.de/DE/Angebote/Aktuelles/Meldungen/2020/2020-03-04-Desinfektionsmittel.html) and France (https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000041741016&dateTexte=&categorieLien=id). In Brazil, the National Health Surveillance Agency (ANVISA) published ANVISA RDC No. 348/2020, available at http://tozzinifreire.com.br/en/boletins/covid-19life-scienceshealthcare-anvisa.


And, where applicable, reliability and/or efficacy.


See recent lightening of US FDA requirements on ventilators: https://www.theregreview.org/2020/04/03/runkle-fda-relaxes-rules-ventilators-covid-19/.


See the debate in the Netherlands on this topic: https://www.theregreview.org/2020/05/18/meuwese-disjointed-dutch-policies-fight-covid-19/ and https://fra.europa.eu/sites/default/files/fra_uploads/netherlands-report-covid-19-april-2020_en.pdf.


During the lockdown in France, that distance was established at 1 km. See: https://france3-regions.francetvinfo.fr/pays-de-la-loire/coronavirus-calculez-votre-zone-sortie-autorisee-confinement-1806822.html. Specific distances / rules were imposed e.g. in Ireland or Russia etc.


On the other hand, travelling long distances from hot spots to unaffected areas during the lockdown period seems likely to help spread the disease, and also presumably makes containment/contact tracing more difficult. See for example: https://www.theguardian.com/us-news/2020/may/18/lockdown-protests-spread-coronavirus-cellphone-data.


For reference: during the lockdown, Germany did not impose specific distance or duration rule for outside exercise, France limited both distance and duration, and Russia imposed to only visit the nearest possible shop.

Another example of prescriptiveness of rules is the prohibition in some Australian States to practice golf and fishing, while others did not (and this applies to other sports: https://7news.com.au/sport/coronavirus-australia-restrictions-what-counts-as-exercise-c-951777). As a result, governments have had difficulties explaining how the more restrictive option is evidence and risk-based when there are different approaches by adjoining states.


On the issue of whether certain types of physical activities increase risk of transmission, and of settings-specific risk of transmission in general, see e.g.: i) summary of findings by the European Centre for Disease Prevention and Control (ECDC) https://www.ecdc.europa.eu/en/covid-19/latest-evidence/transmission; ii) summary guidance on outdoor activities such as: https://www.mayoclinic.org/diseases-conditions/coronavirus/in-depth/safe-activities-during-covid19/art-20489385, https://www.pacificmedicalcenters.org/physician-articles/outdoor-exercise-during-covid-19-maeda/; iii) research article on this topic (Halabchi, Ahmadinejad and Selk-Ghaffari, 2020[31]).


Although there is also a service design aspect in the way these permits and self-certifications can be obtained (for instance, in France there has been an insistence on having them on paper form, while an online service has been developed in Greece).


For comparison: Italy and France required self-certification (paper-based), France (after some weeks) added a “smartphone-based” option, Greece required a phone- or computer-based “permit” (notification-based) from the start, and Germany (for instance) did not require any “paperwork” or “online permit” (while applying restrictions to movement, activities etc.).


See http://www.oecd.org/gov/regulatory-policy/administrative-simplification.htm and the 2012 OECD Recommendation of the Council on Regulatory Policy and Governance – see in particular Principle 9, p. 16 - http://www.oecd.org/gov/regulatory-policy/49990817.pdf.


See for instance (Alcadipani et al., 2020[22]) (Reicher and Stott, 2020[34]) – as well as the report of the French Défenseur des Droits (“Human Rights Ombudsman”) on the sanitary emergency published here: https://www.defenseurdesdroits.fr/sites/default/files/atoms/files/synth-eus-num-03.06.2020.pdf – specifically p. 11.


On the impossibility of “optimal” rules see Diver, “The Optimal Precision of Administrative Rules”, 1983 and Baldwin, Rules and Government, 1995. For an example of risk-based enforcement guidance to ensure adequate exercise of enforcement discretion see: UK Health and Safety Executive, Enforcement Management Model - https://www.hse.gov.uk/enforce/enforcement-management-model.htm.


While it is too early to have consolidated research on this issue in the COVID-19 context, there is some early research showing the downside potential of automated enforcement e.g. (Calvo, Deterding and Ryan, 2020[27]) and (Budd et al., 2020[25]). In addition, research on automated enforcement in other areas (e.g. driving speed) underlines the importance of such concerns (Wells, 2008[35]).


A project for further research on this data is being developed – for now, cursory examination of e.g. Italian data on confinement controls suggests that: (a) at most a couple of % of controlled individuals were in violation, (b) between 1 and 2 per 1000 businesses only were in violation, (c) the categories of control findings are too broad to indicate whether the violations related to actual risks of contamination, or only to non-compliance with formal requirements (paperwork). See: https://www.interno.gov.it/it/coronavirus-i-dati-dei-servizi-controllo.


In addition to the proportionality of enforcement, in some countries there is an open debate on the inconsistency of enforcement (use of fines vs. warnings, also related to the lack of clarity of the measures themselves, which leads to cases of unintentional non-compliance). This is the case in The Netherlands, where the acceptance of enforcement measures is gradually decreasing, leading for instance to a sharp increase in violence against police officers. See https://nltimes.nl/2020/05/12/sharp-increase-violence-police-officers-coronavirus-crisis-report on this topic.


See e.g. , (Wolff and Intravia, 2019[15]), (Braga, Welsh and Schnell, 2015[16]).and, on zero tolerance in policing (Burnett, 2018[26]), in sentencing (‘Three Strikes laws’) (Chen, 2008[28]), in criminal supervision (Cullen et al., 2018[30]) (Cullen, Pratt and Turanovic, 2016[29]), in education (Bleakley and Bleakley, 2018[24]) (Martinez, 2009[14])


See https://theconversation.com/how-to-keep-up-social-distancing-after-lockdown-138370.


In the Australian State of New South Wales, the internal review of the first 1000 fines was done by the Police Commissioner himself - see for example https://www.smh.com.au/national/nsw/police-commissioner-personally-cancels-32-out-of-1000-coronavirus-fines-20200424-p54n1j.html. While this may seem overly senior level for such a process, it sent a clear message of the importance his force was placing on ensuring consistent and proportionate enforcement.


See a discussion of these choices e.g. in Ogus (1994), Regulation: Legal Form and Economic Theory – in particular pp. 151-171 – and Baldwin (1995), Rules and Government – specifically pp. 180-185.


See the OECD’s page on Regulatory Enforcement and Inspections here for background, recommendations etc. : https://www.oecd.org/gov/regulatory-policy/enforcement-inspections.htm – for more examples and discussions of applicable practices see e.g. Blanc (2018), From Chasing Violations to Managing Risks.


During this emergency situation, the OECD has been supporting the development of the COVID-19 Behavioural Insights Working Group as a forum for policy makers and practitioners to collaborate and exchange ideas, resources, findings and approaches in addressing COVID-19. The first event, which took place on 16 April 2020, provided lightning talks from France, Japan, South Africa and the United Kingdom on their use of behavioural insights to address the pandemic and facilitate an action-oriented discussion between policy makers. For more detail, see: https://www.oecd.org/fr/reformereg/politique-reglementaire/reg-covid-19-activities.htm.


Dr. Anthony Fauci, the Director of the US’s National Institute of Allergy and Infectious Diseases (NIAID), admitted that this had been done on purpose to try to reduce demand – https://www.thestreet.com/video/dr-fauci-masks-changing-directive-coronavirus.


There are large numbers of media reports on hoarding and panic purchase of many products in a number of countries, on shortages and price speculation on PPE, on police operations linked to such speculation and illegal sales etc., more than would be convenient to reference here. They cover i.a. a number of EU countries, the US, and others. Resulting distrust and opinion backlash can be easily observed for instance on social media in each of the relevant countries. As these are evolving, current issues, there is no consolidated literature on this as of publishing this note, but these articles offer a useful starting point: i) on PPE hoarding, and subsequent regulatory response: https://www.aha.org/news/headline/2020-03-26-ppe-other-covid-19-resources-subject-hhs-hoarding-restrictions and https://www.law.com/2020/05/04/federal-crackdown-on-hoarding-and-gouging-during-covid-19-crisis/?slreturn=20200414043818; ii) general review of Covid-related behavioural insights issues: https://www.thelancet.com/journals/lancet/article/PIIS0140-6736(20)30729-7/fulltext; iii) on the broader question of trust and social media in the COVID-19 context, see e.g. this article: https://www.thelancet.com/journals/landig/article/PIIS2589-7500(20)30084-4/fulltext.


See on both hoarding and adverse effects on trust: https://www.nytimes.com/2020/03/17/opinion/coronavirus-face-masks.html.


See more broadly on this the OECD page on “transparency, communication and trust” at https://www.oecd.org/coronavirus/policy-responses/transparency-communication-and-trust-bef7ad6e/ and (Matasick, Alfonsi and Bellantoni, 2020[33]).


See https://aisel.aisnet.org/cgi/viewcontent.cgi?article=1166&context=ecis2016_rp on communication in a crisis context and the importance of trust. See also relevant literature on the importance of trust, Hodges (2015) “Law and Corporate Behaviour” (https://www.bloomsburyprofessional.com/uk/law-and-corporate-behaviour-9781782255833/) and Tyler (2003) “Procedural Justice, Legitimacy, and the Effective Rule of Law” (https://www.jstor.org/stable/1147701).


See the European Roadmap towards lifting COVID-19 containment measures which includes, among others, raising awareness about what to do and what not do; targeted health campaigns; stressing the importance of physical distancing and hygiene rules; and coordination among bordering regions and neighbouring countries, so as not to give conflicting messages to the citizens.


For an example of balanced, carefully formulated summary of evidence on masks-wearing, see e.g.: https://www.evidence.it/articoli/pdf/e1000208.pdf.


More precisely, we mean location services, which in addition to GPS can also use in combination the network of cell phones, Wi-Fi connections, and device motion sensors.


On this section, see also the work prepared by the Science, Technology and Innovation Directorate of the OECD (both 2020): “Tracking and tracing COVID: Protecting privacy and data while using apps and biometrics” (https://read.oecd-ilibrary.org/view/?ref=129_129655-7db0lu7dto&title=Tracking-and-Tracing-COVID-Protecting-privacy-and-data-while-using) and “Ensuring data privacy as we battle COVID-19” (https://read.oecd-ilibrary.org/view/?ref=128_128758-vfx2g82fn3&title=Ensuring-data-privacy-as-we-battle-COVID-19).


The database is a “work in progress” and the intent is to keep it regularly updated and improved – it is available here: https://docs.google.com/spreadsheets/d/1nry-l4u-wjfai7o_po16qfn8f51vqehcvwq_o1ibfzo/edit#gid=505947650.


Member States in the eHealth Network, supported by the Commission, also developed a common EU toolbox for the use of technology and data for these purposes. The Commission issued guidance to secure data protection in tracing apps against COVID-19, and the eHealth Network is working on interoperability guidelines and specifications to enable seamless functioning across borders.


Low percentage of installation of the app makes it of limited effectiveness – see e.g. on limited adoption in Singapore: https://www.cnet.com/news/director-behind-singapores-contact-tracing-app-says-tech-isnt-the-solution-to-covid-19/.


See an overview of the Bluetooth approach here: https://qz.com/1838625/how-bluetooth-could-power-a-global-experiment-in-contact-tracing/.

Some may consider that these features are greatly dependent on mainly two private OS providers which are in a unique position to impose their choices to policy makers and regulators. Public trust is thus partly delegated to these actors but without relevant public counter-powers as no ex ante regulation is yet applicable to these players.


In a distributed contact tracing system, the aim is to exchange mutual proximity information between two devices, without this information being calculated from the two geographic locations sent to a central server. Bluetooth technology is therefore used both to estimate proximity, through signal strength, and to ensure communication between devices without involving a third central device. In fact, Bluetooth-based contact tracing applications can also work on devices without a SIM card and while GPS and Wi-Fi are disabled.


Specifically, contact information means a key that is not directly attributable to an identifier of the device, nor to the person, which generated it. The Apple/Google framework also requires that this key changes every 15 minutes, making it impossible to use differential analysis on data in order to associate keys with people.


See e.g. (Cha, 2020[36])


Although, from an epidemiological perspective, questions still remain regarding the usefulness/effectiveness of contact tracing apps. This is due to concerns related to the reliability of GPS (e.g. in urban densely populated areas) and Bluetooth (e.g. in crowds), to the possible existence of a non-negligible number of false positives and negatives, as well as to levels of smartphone adoption for every socioeconomic group etc.


Which can be the case when government apps are not up to standard. See on this topic https://www.guardsquare.com/en/blog/report-proliferation-covid-19-contact-tracing-apps-exposes-significant-security-risks.


See e.g. the following paper discussing a previous example of private health data being inadequately managed: https://techscience.org/a/2015081103/download.pdf – and a broad review of research and evidence on the issue (Cullen and Reilly, 2008[11]).


The challenges in getting widespread adoption are not trivial, in particular if it remains voluntary – this led Belgium, for instance, to abandon the idea – see: https://www.numerama.com/tech/620121-coronavirus-la-belgique-renonce-a-une-application-de-tracage-des-malades.html.


Equally, the technical considerations about the centralised approaches favoured by the United Kingdom (at least initially) and France are important to consider. France criticised Apple for not making a particular API available that would allow their app to work in the background (something which has long been a position of Apple for 3rd parties on the basis of privacy). Elsewhere, e.g. Australia, this prompted a shift towards the Google/Apple framework. See also on this topic : https://www.theguardian.com/commentisfree/2020/jun/16/google-apple-dictating-european-democracies-coronavirus.


See for instance Finland with considerable uptake (close to 25% of the adult population): https://yle.fi/uutiset/osasto/news/coronavirus_app_downloads_quickly_reach_1_million/11521081.


The self-sovereign identity + blockchain approach was developed thanks to the support of the OECD “Rating Audit Control” (Inspections Reform) project in Italy, funded by the European Commission DG REFORM. While specifics of the technical approach may change, the foundations of the approach are likely to be relevant for a number of countries. Because of the urgency of the problem in Italy, a detailed vision was developed, see: https://medium.com/@tizianolattisi/tracing-contamination-through-mobile-phone-locations-balancing-effectiveness-with-privacy-and-1ca4b6c9a7b6. We acknowledge the contribution of this article’s authors in this section: Tiziano Lattisi, Hyeon Kyeong (Chloe) Hwang and Enrico Talin.


See e.g. (He et al., 2020[38])


See one example (for Oregon state in the US):a (Clark, Parker and Duy, 2020[39]). For a quantitative estimation of the considerable challenges involved in COVID-19 contact tracing, see: (Keeling, Hollingsworth and Read, 2020[40])


And so is the role of technology in supporting analogue contact tracing so that public servants have good and effective access to e.g. data or testing - i.e. or whatever is needed to help them follow through with their job as public officials.


E.g. based on “human tracing” of cases, investigating when there is reason to suspect they go back to a quarantine violation, relying on intelligence (risk-based controls) combined with random controls, etc. While “automated” enforcement may of course yield “superior” results in terms of finding a larger share of violations, its costs in terms of freedoms, rights and legitimacy may simply be excessive.


Or ‘proximity data’ in this case.


See for instance the detailed technical explication of a pilot app, SM_Covid 19, developed by a “spin-off” of the University of Salerno in Italy: https://www.smcovid19.org/tech/. However, a number of countries implementing Bluetooth centralisation are not using blockchain/DLT/SSI but existing tried and tested technology.


Such a notification is by definition based on self-reporting – other tools could be developed to facilitate reporting by health care practitioners (centralization/consolidation and analysis of early reports of “abnormal” cases has been a problem in many countries, and led to delays in identifying and responding to the epidemic). Available evidence from such tools does not subject a high probability of abuse, and the idea is not to respond to every single notification, but only to identify (and react to) “clusters” of reports. The Netherlands’ “Covid Radar” app provides a good example of this, allowing users to report symptoms, but also to see where there seem to be “clusters” that they may thus want to avoid, so as to minimize further risks.


See e.g. https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/2019/07/29/Estonian+e-Ambulance+and+time-critical+health+data on the use of secure data integration (“X-Road”) for health data management pre-COVID-19 in Estonia.


In this case the right to an individual consideration of the purported offense and proposed sanction.


The Dutch data protection authority published an approach towards employers, updated several times, which has been the target of critics for limiting an employer’s options to obtain information, but also for being unclear on what measures could be taken (e.g. measuring temperature of people entering their premises, in order to protect the other employees (an obligation set by labour laws): https://www.lexology.com/library/detail.aspx?g=0dc5a2df-1c39-4ff4-8fcc-a0db674ba83c; https://globalcompliancenews.com/dutch-dpa-on-covid19-related-processing-of-employee-data-23032020/. In turn, the Labour Inspectorate offered companies to evaluate new/temporary COVID-19-related measures within ten days.


In this case the success rests in using the app in addition to more traditional contact tracers. For the specific role of digital contact tracing in successful tackling of COVID-19 spread see e.g. (Cha, 2020[36]) and (Ho et al., 2020[42]). For a discussion of challenges and potential solutions see also (Dar et al., 2020[41]). For the harmful impact of delays in contact tracing see (Kretzschmar et al., 2020[32]).