Privacy Regimes, Crisis Strategies, and Governments’ Legitimizing of Digital Surveillance Technology: Comparing Germany, Norway, and the United Kingdom

Figures & data

Table 1. Operationalization of the dimensions of legitimacy.

Dimension of legitimacy	Indicator
Pragmatic legitimacy	General: Self-interest, within the law, technological superiority, practical consequences Specific: Internal conduct: Follow privacy laws, improve own crisis management capacity External influence: Citizens’ own (or relatives’) health most important, technical superiority compared with other crisis measures, easy to use.
Moral legitimacy	General: Duty, altruism, standards Specific: Internal conduct: Follow standards for relevant technology, consult with IT-experts External influence: Help community to stop infection from spreading, what is best for society/the common good.
Cognitive legitimacy	General: Framing inevitable and inconceivable approaches Specific: Internal conduct: Modern technology obviously must be utilized by government Old ideas of technology challenged External influence: The only way to overcome the crisis (return to “normality” and regain “freedom”) Technology provides a fundamental function in crisis management Difficult to imagine a world without this technology.

Table 2. Overview of country-specific conditions and expectations.

	Germany	Norway	United Kingdom
Institutional history of privacy regime	Strict privacy regime (privacy historically engrained in society and legal- administrative rule-following)	Moderately strict privacy regime (historically committed to protecting privacy, but also perceived leeway to implement surveillance measures when needed)	Comparatively less strict privacy regime (sometimes seen as favorable to businesses and data-driven public organizations)
Overarching crisis strategy in the early stages of the COVID-19 pandemic	Suppression approach with partial lockdown, emphasis on voluntary compliance	Suppression approach with partial lockdown, emphasis on no alternative to draconian regulations, and “dugnad”	Liberal strategy, citizens should make their own risk assessments
Expectations for legitimizing the Digital Surveillance Technology	Predominantly focus on complying with rules and adhering to IT standards. Strongly shaped by privacy legacy and regime. Also, equivalent rules and moral focus following overall crisis strategy.	Stress cognitive dimension more than the others, and moral values of “dugnad.” Mostly influence from overall crisis strategy. Some minor focus on rules and standards based on privacy regime.	Highlight self-interest more than the other countries, due to crisis strategy of making own assessments and because of the less rigorous privacy regime legacy.

Table 3. Overview of the apps and actors involved in developing the technology.

	Germany	Norway	United Kingdom
App name and organizations involved in development	Corona-Warn-App (developed by Robert Koch Institute, SAP, and Deutsche Telekom).	Smittestopp (developed by the Norwegian Institute of Public Health and the public research institute Simula).	NHS COVID-19 (developed by the National Health Service and company VMware).

Table 4. Overview of the legitimacy strategies, rhetorical content, condensed meaning, and representative quotes in Germany, Norway, and the United Kingdom.

	Germany	Norway	United Kingdom
Overall legitimacy strategy	Main strategy: Moral legitimizing Combined with: Pragmatic legitimizing	Main Strategy: Pragmatic legitimizing Combined with: Cognitive legitimizing and occasional moral legitimizing	Main strategy: Pragmatic legitimizing
Abstracted rhetorical content	Focus on moral duty and adhere to IT standards. Stress regulatory compliance.	Increase crisis management capacity. Emphasize taken-for-granted beliefs (freedom).	Accentuate citizens’ self-interests and their own benefits. Stress regulatory compliance, and non-cognitive approach.
Condensed meaning unit	Protect people that you do not know. Use of personal data will comply with data protection laws and be transparent.	Increase government’s infection tracking capacity by using the app to assess the effect of crisis measures. The app is imperative for a return to “normality.”	Protect yourself and the people you care about. Use of personal data will comply with data protection laws, but society should not rely too much on technology.
Representative quotes	“I don’t know anything about you, but I’ll protect you.” (Slogan when the app was launched). “Telekom are doing everything we can to complete this app as quickly as possible. Fast, secure in accordance with #gdprcompliance (DSGVO) and fully transparent through #opensource … ”	“Smittestopp is an app that is connected to several other things we want to do, such as … follow and study the development and impact of the [other] measures. It is absolutely crucial to be able to stop measures that harm society and that are difficult to live with over time.” “In order for us to be able to open up more in the coming weeks and months, there are several prerequisites that must be met. More automated and efficient tracking is one of these prerequisites. That is why I [Prime Minister] am asking you all to take part in another ‘Dugnad’ … ”	“Gran doesn’t need the app to benefit from it. If you download the app, you’re protected and you’re more likely to be protecting the people you care about around you.” “One of the things it has taught us is that it is the human contact that is most valued by people. There is a danger in being too technological … ”