Data protection when tracing COVID-19
In their communication "Tracking and tracing COVID:Protecting privacy and data while using apps and biometrics", the OECD are stating:
- Digital technologies, in particular mobile and biometric applications, are being adopted in innovative ways to improve the effectiveness of government front-line responses to COVID-19.
- Disclosures of personal information can allow the public to better identify potential COVID-19 infections and track the spread over time. However, current digital solutions for monitoring and containment have varying implications for privacy and data protection.
- Fully transparent and accountable privacy-preserving solutions should be embedded by design to balance the benefits and the risks associated with personal data collection, process and sharing. Data should be retained only for so long as is necessary to serve the specific purpose for which it was collected.
Where do you see the line between data/privacy protection and collecting information to contain the spread of the virus?
Replies
Tracing mobile devices in the EU
The European Parliament has published a briefing on the possibilities and limitations of the tracking of mobile devices: https://www.europarl.europa.eu/RegData/etudes/BRIE/2020/649384/EPRS_BRI(2020)649384_EN.pdf
They say: About half of the EU’s Member States have taken location-tracking measures in response to the spread of the coronavirus disease, mainly by working with telecommunications companies to map population movements using anonymised and aggregate location data and by developing applications (apps) for tracking people who are at risk (p.1). According to a recent research paper, being able to identify and notify contacts immediately after a person is tested positive 'has the potential to stop the spread of the epidemic if used by a sufficiently large number of people with reasonable fidelity' (p.2).
There are both legal and technological limits with regard to using location data, in particular when this involves the systematic tracking of individual movements. That is why the use of anonymised and aggregate location data is preferable to individual monitoring. In emergency situations, such as the Covid-19 crisis, Member States may impose limitations on certain rights and freedoms in order to pursue quick and effective measures. However, such measures need to comply with fundamental rights standards and EU law (p.11).
Therefore, the European Commission has called for a common EU approach to the use of mobile apps and mobile data to assess social distancing measures, support contact-tracing efforts, and contribute to limiting the spread of the virus. I think this is an important step.