Column: A corona tracking app, the end of privacy?

Rob van den Hoven van GenderenRob van den Hoven van Genderen
8.4.2020 9:55

A column by Rob van den Hoven van Genderen, Professor of Practice at Ulap/Faculty of Law .

Does the coronavirus also erode fundamental rights and civil liberties?

In China, it was expected that the already established social credit system would be used to combat the coronavirus outbreak. The citizens were followed via ‘track & trace’, the extensive camera system, temperature sensors, drones and the ‘we chat’ application on smartphones. If the body temperature was too high, action was taken, people in the vicinity of that person were warned and taken into isolation. In addition, all citizens are followed to see whether they adhere to the proclaimed rules of conduct. Violations are subject to severe penalties. This system has been adopted to a greater or lesser extent in Israel and South Korea. I do not know the situation in North Korea, but a strict regime will probably apply here, although there is probably a lesser degree of ‘smartphonization’ there. In Germany, a debate is going on in the parliament to follow smartphones by the government, whereby the choice is given to the citizen whether or not to use the app. A study by the University of Oxford developed mathematical models that can be used to map people's movements and encounters with other people. In this way, people can be warned and the government can gain a better insight into the distribution of coronavirus and can adjust its measures accordingly. Nothing new for the Chinese. Google has released the movement data of the logs of users (Google apps such as timeline, tracks or coach). I don't remember giving permission for that.

In Europe a research group called Pan-European Privacy Preserving Proximity Tracing (PEPP-PT) is working on a pan European tracking app based on blue tooth vicinity comparable with tracking apps in China, South Korea, Singapore and India, although it should take privacy requirements into account. But even pseudonymizised data can be analysed to be identifiable with the right algorithm.[1] And if all people have to have this app (and a smartphone) there also will be ample opportunity for cyber criminal to use these data if not severly secured!

In the Netherlands, the so-called ‘outbreak team’ also seems to advise that citizens be followed through the movements recorded by mobile phones. Perhaps also useful to switch on the camera and microphone remotely so that the government is informed about how the citizen experiences the measures - and whether the criticism can be suppressed!

It will not come to that. After all, the GDPR does not allow this... But if the needs be, Article 6 gives some possibilities by mentioning grounds for processing without permission of the data subject, namely in the interest of the vital interest of the subject or third parties or the public interest. And if that does not give enough ground for action there always is the last resort for a state to declare the state of emergency (Japan, Israel, USA, etc.), in the context of protecting public health, in which case the GDPR no longer applies in its entirety.

In some countries, as for instance Hungary the corona-crises is already misused to extend the powers of government, in this case president Orban, to set aside the involvement of the national parliament.

Fundamental rights can be restricted by the government on the basis of Article 23 of the GDPR. Without taking that as a fundamental restriction, still freedom of movement of persons, free trade and even freedom of expression can be limited in these circumstances. The government is also keeping a tight rein on the provision of information by the government to citizens. The government provides limited information about the course of infections, patients healed and the effects of the disease on the physical and psychological state of the citizen.

In addition, there is journalistic self-censorship. In an interview as an expert by experience with a representative of the paper media, I indicated that there are indeed physical effects on the respiratory system and heart function after direct cure of the virus. After consultation by the journalist of an undisclosed out-of-hours GP post, the journalist was advised by the out-of-hours GP post not to publish anything about this, as this type of message would increase the fear among the citizens.

So preferably no important information about the negative aspects after healing. No, instead there are positive figures about the number of IC patients and those who died, which helps to promote a positive spirit among the population. And still no figures on healings and positive effect of immunity.

And how long will it take before this (fictional) state of emergency continues in the various countries? Will camera surveillance, telephone track & trace, temperature sensors, deployment of drones, etc. be lifted with the (temporary) disappearance of the virus?