On April 28th, 2020, the Laboratory of Public Policy and Internet (LAPIN), a Brazilian think tank which supports the development of public policies focused on the regulation of digital technologies, in partnership with Access Now, a global-level organization which defends and extends the digital rights of users at risk around the world, hosted a virtual Global Civil Society e-Workshop, entitled “Exploring a privacy-friendly solution to the Covid-19 pandemic“.
The meeting gathered representatives from 16 organizations around the globe to discuss surveillance measures being implemented within their regions and how to coordinate forces to guarantee that these measures respect individuals’ right to privacy. All the organizations involved understand that privacy and health can and have to work hand-to-hand, and a collaborative effort involving multiple stakeholders is needed to achieve this goal.
The e-workshop was split into two parts. In the first part, it was discussed which surveillance measures have been implemented to fight the COVID-19 pandemic. Representatives from Asia, Europe, Latin America, Middle East, and North Africa – MENA, Sub-Saharan Africa – SSA, and the U.S.A. shared facts about their specific regions.
In Asia, the starting epicenter of the pandemic, measures have been implemented since January 2020. Following is the situation in some countries/regions:
- In China, location tracking applications have been implemented to monitor quarantine compliance. These apps are linked with digital health profiles of citizens, which already existed even before the crisis;
- In Hong Kong, a more liberal state, while location tracking has been implemented, transparency and data quality safeguards have been put in place. The population trust in the government seems to be a key issue for people’s adherence to location tracing and other measures to fight COVID-19;
- In Singapore, a city-state with the size of New York City, the disease control was strongly enforced thanks to the use of contact tracing applications promoted by partnerships between the government and private companies. Privacy issues of the solution are unclear;
- In India, similarly to the Chinese case, the increase of digital surveillance resulted in the violation of individuals’ rights and freedoms. The access to public places and services has been prohibited and speech regarded as “fake news” has been criminalized. The region of Jammu and Kashmir had access to high speeds of internet curtailed, interfering with the effectiveness of information-sharing regarding the pandemic. Location tracking is done via smartphones and citizens must continuously share pictures of themselves to prove quarantine compliance. Risks of stigmatization of ethnic minorities and disinformation have severely increased. The lack of a data protection authority in the country only adds to the problem.
In Europe, technologies for movement tracking and contact tracing are rapidly being developed and implemented. The lack of proper infrastructure and the sub-notification of testing in several European countries raise concerns regarding the proportionality and effectiveness of these measures. Some tech companies such as Apple and Google have defended a decentralized architecture to address this issue. Also, while some applications are said to prioritize anonymity, the lack of transparency has raised concerns on several issues such as confidentiality on data transfers, storage limitation, and sharing of personal data. Although some government authorities have pointed concern on the protection of privacy rights, there’s a lot of uncertainty and lack of coordination between key organizations. For example, the European Commission guidelines were more privacy-friendly than the proposals from the European Parliament or the European Data Protection Board.
Following is the situation in some countries/regions:
- In Italy, Belgium, and Austria, telecom operators and healthcare authorities are exchanging location data with governmental authorities. The alleged purpose of these data transfers is individual tracing and the creation of social mobility heat maps. However, there is a lack of transparency in most of the countries about how these data are transferred and for how long it is going to be stored.
- In Slovakia, there is an app that gives the healthcare authority access to the data from telecom operators to track individuals who are in risk of infection. The technologies share information via Bluetooth.
- In Italy, Germany, and Estonia, government authorities have claimed they will prefer decentralized approaches to develop contact tracing apps so that risks of violations to the right of privacy are diminished.
- In Poland, there is a quarantine monitoring app whereby patients must demonstrate to the authorities that they are at their homes by sending selfies that are geolocated. This results in the constant monitoring of individuals.
- In Greece, five main issues can be pointed: (i) the development of non-transparent contact tracing apps; (ii) the deployment of drones with thermal cameras for quarantine monitoring, with no prior consultation to a DPA; (iii) no retention period/sunset clause to the emergency law approved to control the pandemic; (iv) the duty of citizens to inform authorities via SMS when leaving home; (v) widespread misinformation and disinformation regarding the pandemic.
In Latin America, coronavirus severely contributed to the economic crisis several countries were already having or recovering from. Some countries don’t have a health system strong enough to deal with a pandemic crisis and the lack of digital inclusion and literacy to share information is a major issue. In general, three main measures were taken to control the virus spread. First, the use of location tracking apps and surveillance drones to enforce social distancing rules. Secondly, the use of location tracking as a mechanism to detect and isolate infected citizens. Finally, the processing of data in order to update statistics and disclose information about the pandemic. In the latter, the population is obliged to share information with government officials. Concerns regarding transparency, fairness, and consistency exist in all the measures implemented, as well as the chance that some surveillance measures stay in force even after the crisis ends.
Following is the situation in some countries/regions:
- In Venezuela and Nicaragua, the economical crisis and poor health infrastructure make the issue particularly problematic. There is a big issue with misinformation to control the virus spread, even among public authorities.
- In Mexico, telecom operators provided data to the government to assist in containing the pandemic. There is no transparency on which data were shared, raising concerns on the tracking of vulnerable groups and ethnic minorities.
- In Brazil, the miscoordination between federal and state government authorities increases misinformation and lack of transparency on the measures implemented. Geolocation tracing has been developed by private companies and shared with local governments, although there’s no open-source code available to ensure that data protection safeguards have been implemented. A similar problem happens with thermal camera drones developed to monitor quarantine compliance. One initiative to track people through geolocation by the federal government was halted, as well as another to share personal data of millions of Brazilian citizens with a statistics public body, due to the concerns on privacy issues they presented. However, the lack of a Data Protection Law, which has been approved but is not yet in force, creates a deep uncertainty on the legal basis of all the proposed surveillance measures.
In MENA, the pandemic has been used as an undercover for autocratic practices of some governments. For example, in Israel, a geolocation tracking system developed by the secret service has been compulsorily installed in citizens’ mobile phones, allowing to track all communication data. Furthermore, some civilians alleged to spread misinformation on the pandemic have been arrested, raising concerns of censorship on freedom of speech related to political topics.
In SSA, due to past experiences with the Ebola pandemic, restrictions on movement have been implemented before cases of Covid-19 were confirmed. This was the case of Kenya, where surveillance reached the individual level, with civilians being encouraged to denounce those that break social isolation. People are obliged to answer questionnaires about their health condition, the places they had been, inform their phone numbers, and compulsorily turn on their GPS’s to allow location tracking. There is no transparency on how these personal data will be processed and for which purposes.
Finally, in the USA, the lack of coordination between federal and state authorities is preoccupying. Some states have followed very strict rules, such as Michigan, while others are completely loose, even allowing shops to be opened, such as Georgia. Guidelines and recommendations issued by the federal government are rarely followed and the position of the US President, who is more concerned with the open of the market than anything else, doesn’t help the situation. Regarding the use of apps for contact tracing, there are known initiatives in the states of Utah and North Dakota. Both use GPS, but the former also implements the tracking via Bluetooth. There is no transparency regarding the privacy safeguards of these technologies. The MIT and other academic institutions are working on a “safe path” solution to tackle the issue. Among other measures, there was an attempt to use drones with thermal cameras in the city of Connecticut, but it was impeded after public rejection. There are some leaks that the White House might be interested in creating a centralized national database with information about the pandemic, which would include several personal data. These reports were denied by the US government. Lastly, there is a concern about post-quarantine measures, since some employers are considering implementing different types of measures to monitor workers such as the use of thermal cameras.
The second part of the meeting aimed to figure out suggestions of better ways to deal with the issues presented. Due to the complexity of the theme, it was concluded that a single reunion would not be enough to deal with so many topics of concern. Therefore, it was decided that the group will:
- develop a mailing list to share information about relevant cases and publications during the pandemic;
- publish a more deep countries’ report via the collaboration of the several organizations involved;
- submit/sign an international statement regarding privacy safeguards on Covid-19 surveillance measures and raise awareness at a regional level.
Download this report in PDF.
Participant Organizations:
- 7amleh
- Access Now
- Birmingham Stand with Hong Kong
- Digital Rights Foundation
- EDRi
- Future of Privacy Forum
- Instituto de Pesquisa em Direito e Tecnologia do Recife – IP.rec
- Internet Freedom Foundation
- Intervozes
- KICTANet
- LAPIN – Laboratory of Public Policy and Internet
- Mozilla
- NOYB – European Center for Digital Rights
- Open Net Korea
- Open Rights Group
- R3D: Red en Defensa de Los Derechos Digitales
