Country analysis: Finland

By Tuukka Lehtiniemi and Minna Ruckenstein

The Finnish ADM-related efforts to mitigate hams from the COVID-19 pandemic include a corona symptom checker, maintained by a state-owned company, and two projects involving public-private partnerships.

Corona symptom checker 

Once the pandemic started to spread in Finland, a corona symptom checker was added to the Omaolo (”MyFeel” in English) health service, maintained by a state-owned company SoteDigi. As a CE-marked service, the Omaolo is guaranteed to meet the requirements for medical devices, stated in three different European Union directives.

The COVID-19 symptom checker was compiled in collaboration with The Finnish Medical Society Duodecim and the Finnish Institute for Health and Welfare. After the publication of the checker, it has been updated 15 times, according to the state of the pandemic and changes in regulatory guidance.

The main purpose of the corona symptom checker is to assess the possibility and severity of a COVID-19-infection. In practice, the symptom checker asks yes-or-no, or multiple-choice questions, in order to evaluate the possibility of contagion and whether the condition needs medical care, or if self-care is sufficient.

The service is available for approximately 3,3 million Finns (the overall population in Finland is 5,5 million), with the possibility to send the symptom report to a health professional. According to SoteDigi, since March the corona symptom checker has been used over 600 000 times. In comparison, the amount of confirmed covid-19 infections in Finland is 7,362, with the number of tested samples being a little over 320 000 (23.7.2020).

The citizen using the Omaolo service is asked for informed consent and contact information, so that the medical personnel can communicate with the patient, if needed. One can also make a health appointment after using the corona symptom checker.

The Omaolo service has been used and tested extensively prior to the pandemic and it is a very good example of how existing digital infrastructures, which have already gained the trust of the citizens, can be mobilized for health care needs in exceptional times.

Crowd insights

As part of the pandemic-related efforts, the telecommunications operator Telia launched a service called Crowd Insights, tailored to the Government, at the beginning of April 2020 for three months.

Information gathered by Telia can be used to monitor the connections of mobile devices to the base stations of the mobile network. The aggregated data can aid in monitoring the presence of mobile devices in geographical areas and the mobility of devices e.g. between municipalities and provinces, so that the Government can use that information to survey people’s whereabouts, movements and gatherings.

The collected data is anonymized and aggregated, and cannot be used to trace individual actions. While Telia’s data covers only their own customers, it is computationally generalized to provide an estimate of the entire population.

Later in April, another telecommunications operator, Elisa, announced that they are providing a similar service to HUS Helsinki University Hospital. The service can, at least in principle, be used to monitor how pandemic-related restrictions are followed and how effective they are.

Exposure notification app

As part of the “exit strategy” from restrictions imposed due to the pandemic, the Finnish government is, much like the governments of many other countries, planning and preparing a smartphone app for coronavirus exposure notifications.

According to media reports, the app development got started as a public-private partnership effort in late March, when the IT consultancies Reaktor and Futurice teamed up, aided by the government’s funding agency Business Finland, to examine whether the app used in Singapore, or the app concepts developed elsewhere in Europe could be employed in Finland. In early April, a government minister confirmed that the Finnish government supports the effort.

In late April, details of the app were outlined in a plan prepared by the Ministry of Social Affairs and Health. The app is based on using the smartphone’s Bluetooth radio to determine the proximity of other smartphones running the app. Healthcare authorities determine criteria for exposure to the virus, such as Bluetooth-based estimation of contact distance and duration.

The app is of the decentralised variety: pseudonymous identifiers about proximate app users are stored on each device instead of a central database. Contact data is to be deleted after a period of a few weeks, and the app itself is to be discontinued after the epidemic ends.

A pilot version of the app was called Ketju (in English, Chain) and it was developed by the above-mentioned IT consultancies, Reaktor and Futurice, and the information security company Fraktal. The pilot was funded by the government-backed innovation fund Sitra. Pilot studies took place during May and early June, when the pilot app was used by healthcare workers in the city of Vaasa. The focus was on technical feasibility of Bluetooth-based exposure tracing. After the pilot, the app’ source code was published in GitHub.

In early June, concurrently with the pilot phase, it was announced that Solita, an IT firm that had not been involved in the pilot, won the competitive tender for the final app. A number of public-sector organizations, including the Finnish Institute of Health and Welfare (THL) and the Social Insurance Institution of Finland (Kela), are now involved in the project. Temporary legislative amendments necessary for launching an app for public use, related to, among other things. the necessary personal data collection, were passed in late June.

The launch of the app for public use is expected to take place at the end of August. The goal of the Finnish Institute of Health and Welfare, the public authority responsible for the app, is that the app would have one million users during the first month after the launch. Around three million users, corresponding to 60 % app penetration in the Finnish population, has been cited as a longer-term target.The expected benefits of the app are reliant on considerable voluntary action on part of citizens. First, installing the app itself is voluntary. The hurdle of convincing citizens to install the app is thought to be diminished by the decentralized and therefore ostensibly more privacy-preserving design.

Second, if an app user is diagnosed with COVID-19, they receive a code from healthcare authorities. If the user chooses to input the code in the app, the app sends the pseudonymous identifiers of past potential contacts to the backend system. The backend system then notifies the potentially exposed users via the app.

Third, when the app notifies someone about potential exposure to the virus, they only receive information about next actions, such as taking a test or remaining self-quarantined. Nevertheless, in addition to providing information to app users, the app is expected to supplement manual contact tracing by healthcare authorities.

At least some health authorities have expressed hopes that the app will significantly help with this task. According to the Ministry’s plan, however, any use of exposure information in manual contact tracing relies on app users voluntarily notifying authorities about potential exposure – that is, healthcare authorities will not have access to any information without explicit voluntary action from part of the app user. It is for this reason that we have referred to the app as “exposure notification” rather than “contact tracing” app.

In the Finnish public debate, the development of a national coronavirus exposure app has from the start been mainly taken as a given. The notion that an app should be built to help with a complex societal phenomenon has led to the typical debates around technological solutions: worries about privacy infringements and surveillance, technology choices to mitigate these worries, and complains about the public sector’s decision processes being so slow that they prevent quick technological solutions to emerging problems.

Questions that need to be asked

There are, however, fundamental questions about the app that would merit asking, but have largely been absent from the public debate.

First, before delving into the technical minutiae of the app and its privacy-preserving features, we should carefully consider whether privacy-preserving, end-user-focused app-based exposure notifications are a feasible idea to begin with. Even if Bluetooth is the best available technological proxy for coronavirus exposure, this does not mean that it provides us with reliable information about exposure. Similarly, even if a decentralised design offers high guarantees for user anonymity, this likely makes the app less useful for supplementing manual contact tracing by healthcare authorities.

Second, we should consider the legitimacy of public health interventions when they are delegated to apps. Some of the challenges faced by the authorities are related to convincing enough citizens to install the app. A 60 % population coverage for a voluntary app is a very high target. Achieving it requires not only a high sense of responsibility on part of the citizens, but also a smooth use experience of the app. Even if a high number of people installed the app, under which conditions would they take the app and its suggestions seriously and continue its use? If, for example, using Bluetooth as a proxy for virus exposure leads to many false positives, would citizens voluntarily continue to use the app and follow its suggestions?

Third, and most fundamentally, even if we assume that large-scale app penetration is achieved and maintained, and exposure notifications become part of our everyday lives, we should ask what it is like to live in a society where public health is ensured and controlled by apps. How might our everyday lives change as a result? What are the consequences in terms of equality and justice in public health? Are there some groups whose lives will be affected negatively more than others?

Even if questions like these seem irrelevant, or hypothetical, amid the urgency to combat the pandemic, we should carefully consider technological solutions, instead of remaining fixated on the ones that are technologically most feasible.

Download the full report as PDF (1 MB).