Coronavirus: Are we trading privacy for security?

Since the beginning of the coronavirus crisis, digital rights defenders warned that collecting massive volumes of citizens' data can lead to an increase in state digital surveillance powers - which might pose a risk to citizens' fundamental rights.

"We can have privacy and security. It is not a zero-sum game," the spokesperson of the EU's Fundamental Rights Agency, Nicole Romain, told this website.

"Given the unprecedented situation, restrictions or limitations to many fundamental rights are legitimate, as long as they are consistent with our legal safeguards and are in place only as long as necessary," she added.

Last week, more than 100 NGOs and consumer groups from all over the world called on member states not to use the coronavirus pandemic "as a cover to usher in a new era of greatly expanded systems of invasive digital surveillance".

However, the concerns over the abuse of surveillance power of some countries has even been highlighted by the World Health Organization (WHO) itself.

"When we talk about surveillance in the case of public health, the gathering of information about individuals, their movements must be done with the consent of the community and in many cases of the individual themselves," said WHO key advisor, Michael Ryan, earlier this year.

Tracking people like never before?

As long as measures in place use aggregated and anonymised data there should be, in principle, no impact on privacy rights since they would be in line with EU data protection rules.

"However, new local apps are appearing by the minute and it is not clear if all of them are in line with GDPR [EU's data protection rules] and ePrivacy," said the head of policy at European Digital Rights, Diego Naranjo.

Likewise, Naranjo believes that the coronavirus crisis reaffirms the need to update the EU's ePrivacy rules - which have been blocked by member states for more than three years.

According to Lucie Krahulcova, a policy analyst at NGO AccessNow, "the most worrying are tracking applications which use a combination of mobile network data together with bluetooth and wifi pings to track location".

More and more member states are launching apps to monitor quarantined patients or trace contact, which prompted that the European Commission recently announced guidelines for the use of technology and data to fight and exit the pandemic.

However, the European Data Protection Supervisor (EDPS) called, instead, for a pan-European Covid-19 app amid the proliferation of country-specific apps.

Poland was the first EU country to launch a mobile application amid the pandemic - the 'Home Quarantine' app requires people to take selfies to prove they are quarantining properly, but personal data will be retained for six years.

However, Germany, Ireland, the UK, France, Italy and Spain have also announced their plans for their own apps.

Germany and Spain the exception

Meanwhile, telecom operators agreed to share aggregated mobile phone location data with the commission to track the spread of the coronavirus.

The EU's data watchdog backed the commission's plan, but stressed that "it would also be preferable to limit access to the data to authorised experts in spatial epidemiology, data protection and data science".

Although data protection rules still apply, some countries have slightly changed their data protection rules.

Germany, for instance, has amended its GDPR-enabling legislation to allow for processing personal data in the event of an epidemic.

One can assume that temporary measures taken during a state of emergency will disappear once the emergency is over, but experts warned about the negative possible outcome of this 'experiment'.

"We must ensure that the measures governments are taking right now do not transform this health crisis into a global human rights crisis," said Estelle Massé, a senior policy analyst at NGO Access Now.