2020 is proving to be a challenging year for the world. Right from the start, news of horrific bush fires in Australia were followed by warnings that World War III was imminent. And now we have the coronavirus. The scale and severity of the disease is not unprecedented but the level of panic around it seems to be. As a consequence, extreme measures to handle the situation appear to have become the norm in a very short period of time. Some of those measures have a direct impact on people's privacy. In some places, the whole population is being subject to intense surveillance while the medical data of those infected with the virus is widely shared across organisations and countries. It may well be in the name of saving the planet from a deadly epidemic, but is it truly necessary and is it the right thing to do?
The privacy implications of the attempts to control the spread of coronavirus have become particularly visible in Asia. Once this global crisis is finally under control, China will likely be commended for the clinical efficiency with which it eventually managed to suppress an outbreak that could have affected billions of people. But that will certainly come at a cost. There are reports of 'epidemic maps' showing the precise location of confirmed and suspected cases in real time so people can avoid going to the same places. There is even an app that lets users check if they have been on a train or plane with someone who contracted the virus. These are indeed effective measures, but they require the collection and dissemination of detailed medical data at a massive scale. Similarly, innovative approaches to tackling the problem have been adopted in Korea and Singapore, and on the whole, they appear to have had success despite the wide and obvious privacy intrusions.
The nature of this dilemma suggests that the right approach must lie in finding the right balance. The right to privacy is not an absolute right, even in Europe. Regulators and courts know that, and their decisions reflect the reality that some interferences with the right to privacy are compatible with the law. The jurisprudence around cases that involve the ability of public authorities to interfere with the fundamental right to privacy in the interests of national security or public safety has consistently demonstrated that it is possible to find a reasonable balance. The numerous and complex rulings of the Court of Justice of the European Union on these types of cases tend to focus on two concepts: necessity and proportionality. So these parameters will also be applicable to the sharing and dissemination of coronavirus-related personal data.
Where does this leave us in practice? In an employment context, for example, how far can employers go in terms of monitoring their employees' health, finding out about their exposure to the disease and making business-wide decisions on that basis? In Italy, the biggest coronavirus hotspot outside Asia so far, the data protection authority is adamant that employers must refrain from demanding that their employees disclose personal data related to the coronavirus and their health. European data protection law may allow the collection and use of this data - either by relying on the necessity to comply with a legal obligation or even substantial public interest - but long-standing obligations regarding transparency, fairness, purpose limitation and data minimisation will continue to apply. Carrying out an objective assessment of the justification for requesting and processing this data therefore remains essential.
Data gathering and data sharing in the context of the fight against the coronavirus presents a global test for privacy frameworks around the world. Privacy and data protection laws cannot and should not get in the way of a common-sense approach to saving lives. For that reason, all such frameworks allow the use and sharing of data when necessary for that purpose. At the same time, the parameters set out in the law cannot be ignored - even at times of crisis. Disproportionate decisions and measures are often the result of knee-jerk reactions, and when that happens at a global scale, everyone is at risk - no matter how often you wash your hands.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
