[Summary] RightOn #5: Contact tracing and challenges to privacy

The RightOn webinar earlier this week brought together experts to discuss the use of technologies to facilitate contact tracing in response to the COVID-19 pandemic, and asked whether such approaches represented a risk to the right to privacy. A diverse range of perspectives on human rights law – including those of civil society, computer science, academia and the telecommunications industry – informed the discussion.

The global COVID-19 pandemic clearly presents serious challenges to public health. The gravity of its impact across communities has encouraged swift responses in attempts to slow the progress of the disease, and to find solutions that facilitate effective responses from public authorities to stem the rise of infections. From the outset, it was evident that the challenges to public health presented by the COVID-19 pandemic have provided complex dilemmas and tough choices for governments, citizens and society in establishing how best to protect citizens while maintaining at the same time the safeguard of our fundamental rights. However, the reactions and measures put in place have at times proven disproportionate. Around the world, we have seen governments impose states of emergency and security measures that have had grave consequences for the rule of law and the protection of human rights. In Kyrgyzstan, for example, successive states of emergency severely limited access of detainees to legal counsel and due process, whilst in Vietnam provisions to quarantine those arriving from abroad were misapplied so as to infringe the rights to freedom of expression and freedom of peaceful assembly and association.

First ever widespread deployment of mass surveillance tools for public health

The pandemic represents the first situation on a global scale where the widespread deployment of mass surveillance tools, linked to monitoring citizens’ interactions with each other, and possibly movements too, are being utilised in an attempt to prevent the spread of disease. Can our institutions such as parliaments, communications regulators, data protection authorities and the courts of law effectively provide meaningful oversight to their operation? Many in advocacy and civil society spaces working to promote and protect the right to privacy in the digital sphere have highlighted a lack of transparency and accountability for those engaged in developing and implementing contact tracing applications.

As the discussion of the experts acknowledged, efforts to develop monitoring capabilities and digital contact tracing methods to stem the spread of the novel coronavirus in populations are in part a response to people’s disquiet as to the impact confinement measures have had on freedom of movement. Moreover, restrictions have also interfered with the enjoyment of basic civil liberties, and the ability of citizens to engage in work to support themselves and their families. We need also consider too in this context the very damaging effect that confinement has had for certain individuals at risk, such as women subject to domestic violence in their homes.

As such, portable device-based technologies that can facilitate our mobility in the time of the COVID-19 pandemic may also provide the vulnerable and marginalised with capacities to better safeguard and protect their human rights. That said, the same individuals and groups may also be exposed to harms where the data collected and processed by these applications can be misappropriated or misused, representing a very real threat to their safety and security. For example, in certain jurisdictions same sex relationships remain criminalized, and patterns of association between individuals could be used by authorities, including law enforcement, to investigate their interactions. Persons who have been trafficked are also at risk, where the appropriation of their personal data that identifies their patterns of movement and relationships with others could potentially be used for extortion or coercion, for example by organised crime. These cases highlight the concern that data security and effective oversight are of paramount importance.

Particularly interesting in the early part of the discussion in the webinar was the appraisal of the relative merits of co-opting and adapting technologies to the need for contact tracing. Questions were raised as to whether citizens’ concerns over surveillance and privacy would inhibit their adoption: this hesitancy could severely limit the efficacy and utility of these apps to healthcare systems if insufficient data is collected for modelling purposes. Another concern relates to the period of data retention for data collected by contact tracing apps, and whether this data might be misused for purposes including the profiling of human rights defenders, monitoring journalists, or for identifying associations between individuals within marginalised groups, who may be subject to further discrimination.

Transparency is key to winning public trust

The debate underscored the importance of transparency and trust, particularly where the technical aspects of monitoring capabilities can inhibit citizens from developing a well-informed understanding of the considerations that need to be taken into account when giving informed consent. Vital too is the need to apply the classic three-pronged test to establish the legality of any measures with respect to the implementation of the contact tracing apps: i.e. that their use is provided for by law; the use is necessary in a democratic society, and that the its functioning and operation are such that their use is a proportionate response to the effects of the COVID-19 pandemic on public health. Crucially, a domestic framework for the protection of the rights to privacy and data protection cannot necessarily be taken as a guarantee that a citizen would be adequately safeguarded. In this respect, it is critical that we consider the quality of the legislation in place, and the provision of measures for oversight and mechanisms to ensure effective enforcement of the law.

It is possible that the frameworks for the assessment of the human rights impacts stemming from the use of digital contact tracing apps might need further refinement too if they are to be applied to the novel technological innovations that are being developed at such a rapid pace. In addition, it is also apparent that many in our society are increasingly concerned as to whether the role of the larger tech companies is subject to sufficient scrutiny. A lack of accountability could further exacerbate inequality in terms of the power these businesses already yield in influencing our daily lives.

Another immediate concern was highlighted in relation to both the principle of data minimization, and also as regards the repurposing of location data. Location data can in essence act as a proxy for more sensitive categories of personal data: patterns of human mobility are highly individualised, and may disclose information relating to a person’s sexual orientation, religious affiliation or political convictions, for example. Issues regarding the sensitivity of this personal data relating to movement are, of course, complemented by the very specific considerations that need be taken into account where health data are being collected, processed and retained.

We need also consider that locational privacy constitutes a specific facet of privacy that to date has been under-theorized and subject to relatively little analysis and debate. Far more thought needs to be given to the effects the use of tracing apps might have in interfering with other interdependent rights; such as to freedom of peaceful assembly and freedom of movement. It is only by careful deliberation, and by bringing together the knowledge and insights shared of practitioners and experts in the fields of public health, epidemiology, computer science and industry, ethics and human rights law that we shall be able to effectively appraise the merit of adopting new technology-based approaches to defeating the scourge of the COVID-19 pandemic whilst also ensuring the protection of the human rights of all in our communities.

Dr Jonathan Andrew is a research fellow at the Geneva Academy of International Humanitarian Law and Human Rights