Will Privacy Be One Of The Victims Of COVID-19? (CEPS)

As the COVID-19 outbreak rages across the world, governments have started observing the effectiveness of different approaches to ‘flatten the curve’ or contain the spread of the virus. So far, the most effective governments seem to be those that have invested in solid and even redundant healthcare infrastructure, engaged in mass testing, and identified and isolated infected people (and quarantined their contacts) to reduce the spread to healthy individuals. European countries appear to suffer from a lack of medical and testing equipment, and to be reluctant to impose restrictions on individual rights, such as privacy and the free movement of people. Against this background, a dangerous debate has emerged on whether key tenets of European democracies, including the protection of the fundamental right to privacy, should be set aside during the pandemic to enable a more effective response. This is not a new debate. Already in 52 BC, Cicero observed in his De Legibus that “ salus publica suprema lex esto” (people’s well-being shall be the supreme law). When Louis Pasteur (1822–1895) and Robert Koch (1843–1910) started the bacteriological revolution in public healthcare, providing scientific backing for already-existing practices such as quarantine, sharp resistance emerged in many countries, based on the fear that the imposition of such measures would limit the freedom of movement of people and goods. The fights against tuberculosis and smallpox, and later HIV and Ebola, created tensions between the protection of public health and other fundamental rights, including personal privacy, over the course of more than a century. A similar compression of civil liberties is also seen in other fields, such as in the fight against terrorism . In 1966, the International Covenant on Civil and Political Rights provided that, in times of a public emergency threatening the life of a nation, the need to protect public health is a permissible ground for limiting certain rights, including the liberty of movement, freedom of expression and the right to freedom of association. In Europe, this possibility must be gauged against extremely high standards when it comes to privacy and data protection, with far-reaching provisions in EU Treaties, the European Convention on Human Rights, and the General Data Protection Regulation, which firmly established privacy as a fundamental right, and data ownership as belonging to individuals, not States. The EU Charter of Fundamental Rights specifically mentions both the need to ensure protection of personal data (Articles 7-8) and “a high level of human health protection” (Article 35) in the definition and implementation of all Union policies and activities. Article 15 of the European Convention on Human Rights allows for derogations, provided that they are temporary, proportionate and strictly required by the exigencies of the situation. And the European Data Protection Supervisor has already clarified that measures that weaken the protection of the right to privacy should comply with both a necessity and a proportionality test. But what is necessary, and what is proportionate in the face of such crisis? Governments are likely to struggle to answer these questions. Restrictions of privacy that do not prove essential to save lives, or allow the continuation of essential economic activity, are unlikely to be found necessary. And the availability of feasible privacy-preserving alternatives should rule out the possibility of i…