COVID-19 Privacy Update

Privacy in the Time of Corona

As almost the entire world is under a lockdown caused by the COVID-19 pandemic, countries are racing to use any means available to combat the disease and hinder its rapid spreading. Many of them are starting to use innovative technology for this purpose, including digital surveillance tools for monitoring citizens’ whereabouts, which are proving to be extremely effective.

Imagine receiving an SMS addressing you by name and saying: “Dear [John], according to an epidemiological investigation you were near someone sick with the coronavirus. You must immediately isolate at home until [March 24, 2020] to protect your relatives and the public”.

Hundreds of Israeli citizens had the pleasure of meeting the “Big Brother” this way a couple of days ago, after their Government authorised its security services to use mobile phone location data to retrace the movements of confirmed coronavirus carriers, and order quarantine to anyone who may have come near them within the preceding two weeks. Special software and techniques, used so far only for Israel’s counterterrorism and defence activities, have now been deployed for tracking and messaging people who may or may not have the novel coronavirus (since mobile GPS location has a 5-20 meters margin of error), blatantly bypassing the mandatory approval of the Israeli Parliament and oversight in the process.

Israel is not the first, and surely will not be the last country to go this road. China, where the virus originated, is likely the global leader in hi-tech mass surveillance, with millions of face-recognition cameras in place, monitoring of mobile communications, credit card usage, payment apps and social media, and even requiring people to check and report their body temperature and medical condition. Chinese companies are also quickly developing new intrusive technologies capable of precisely detecting elevated temperatures in a crowd, highlighting individuals not wearing a face mask, or assigning citizens a colour code showing personalized virus risk assessment based on their travel history and exposure to virus carriers.

Other Asian countries are not far behind, either. South Korea publishes a “travel log” of coronavirus carriers, based on GPS location history, credit card, and surveillance video records. Singapore has a website platform showing age, gender and occupation of all its coronavirus patients and details of their travels prior to being diagnosed. Due to the differences in culture and type of governance, the measures implemented in both countries, although mandatory, are more balanced and transparent when compared to China. Neither of them are publishing the affected patients’ names, while both are placing special emphasis on extensive testing and cooperation with well-informed citizens.

There are numerous reports that the EU countries and the USA are also considering using similar technologies, but with the implementation of stronger checks and balances, and with a public debate ongoing about the appropriate balance to be made between the public health concerns and privacy risks.

The arrival of the coronavirus to the Balkans prompted governments to use whatever defence tools they had at disposal. Montenegrin authorities quickly found a simple solution for tackling the frequent failure of individuals to comply with mandatory 14 days self-isolation after entering Montenegro, by publishing online a complete and up-to-date list of all individuals subject to self-isolation, with their names and addresses for everyone to see. The explanation was that there were way too many breaches of this prohibition and that no government can monitor so many people effectively, which is why the public should be made aware of the risk and the identities of individuals potentially in breach. Apparently, a prior approval of the Montenegrin Data Protection Authority has also been obtained for such a drastic invasion of constitutional right to privacy that was introduced despite no state of emergency being declared in the country.

The Serbian authorities acted a bit more subtle, publicly declaring that visitors from Italy are being tracked by monitoring their phone location to see if they are complying with the mandatory 14-days self-isolation after entering Serbia. The same techniques seem to be used to determine if the general corona-related curfew is being breached by others as well. Since no additional details have been provided at this stage, it is unclear how exactly the tracking works in practice and what information is being collected, whether on individual or aggregate level, and most importantly – if the appropriate procedures have been followed.

Specifically, in the absence of an individual’s consent, access to his mobile location data in Serbia is permitted only based on a relevant court’s decision, if necessary for conducting a criminal procedure or protecting national security. It is possible to derogate this requirement during the state of emergency, which was declared in Serbia; however no such derogation has yet been enacted. Adding to the growing pile of questions is whether the conditions for introducing the state of emergency actually existed in the first place and if it was lawful to introduce it by a joint decision of the Serbian President, Prime Minister and Head of Parliament, instead of by the Parliament itself (allegedly due to its inability to convene during the outbreak). The authorities’ handling is not exactly projecting confidence.

Convenient as all these measures may be for monitoring the existing quarantine orders and imposing new ones, and therefore for better containing the public health threats, they are endangering the delicate balance between public safety and individual’s right to privacy. Desperate times call for desperate measures, they say, and it is true that some of these techniques could prove extremely valuable for bringing the pandemic to an end faster, with less devastating results. However, this simply cannot justify any derogation from hard-won constitutional rights, at least not without proper procedures being followed in a transparent and proportionate manner. Otherwise we are all risking a systematic, Orwellian-style privacy invasion and usurpation of power, that would be extremely hard to unravel once the crisis is over, especially in countries without effective Rule of Law in place.

So under pretext of fighting corona, he has closed the… parliament, ordered people to stay in their homes, and is issuing whatever emergency decrees he wishes. This is called a dictatorship”, said Yuval Noah Harari, a history professor at the Hebrew University of Jerusalem, in a tweet about Israel’s Prime Minister Benjamin Netanyahu.

A day after Israel’s authorities started sending SMS messages to its citizens, its democratic capacity’s bounced back, as Israel’s Supreme Court issued an injunction ruling that the cellular surveillance of actual and suspected patients would have to stop if parliamentary oversight is not introduced within five days. The Court also gave the government a short deadline to form a Parliamentary Committee that would oversee the surveillance operation, or otherwise, the entire program would be shut down. The injunction was issued upon the motions of civil liberty groups and political opposition leaders, while a couple of hundred Israelis organised a protest convoy on the same day, despite coronavirus concerns, condemning the government’s measures as invasion of democracy under the anti-virus battle pretext.

All of this happened in a country where a state of emergency had been introduced in 1948, during its War of Independence, and has been continuously in effect to this day, despite strong democratic tradition. Obviously, we cannot expect anything similar happening in China, but what about Serbia and Montenegro?

In Serbia the state of emergency has been declared a week ago, unlike Montenegro where this is still not the case. The days ahead will surely show what measures will their governments use to combat the pandemic and how this may limit civil liberties, and, perhaps more importantly, whether these countries actually have engaged civil liberty groups, independent courts and people interested in defending their constitutional rights.