The KSLR Forum

Latest Post 15/3/2021




Hetal Doshi, student at National University of Study and Research in Law (NUSRL), Ranchi, India.


The COVID-19 pandemic has brought the world to a relative standstill. With more than 2 million fatalities and 103 million positive cases,[1] governments across the globe have implemented unprecedented lockdowns in an attempt to contain this novel virus. Currently, limiting close human contact is the only known method of controlling the pandemic.[2] To ensure compliance, military forces, armed guards, and high-tech surveillance are used by the government.[4] This system represents a trade-off, which permits the violation of personal freedoms[5] and human rights infringements, to ensure the containment of a fast-spreading virus. However, this trade-off might prove to be costly. As warned by the UN Special Rapporteur, dictatorships and authoritarian states often start from similar infringements in the face of a threat.[6]

Some governments are teetering toward authoritarianism by resorting to authoritarian technologies to enforce restrictions on movements. This includes technologies such as facial recognition and phone tracking.[7] While it is generally accepted that such measures are needed to protect citizens in such exceptional circumstances, there is growing concern that they may outlast this global crisis. Will citizens have the right to ask their governments to delete their data once the pandemic is under control? Will this trade-off prove to be the death knell to basic human rights or democracy?

The dangers of such data being at the disposal of the State seems obvious. This article seeks to discuss the right to privacy and its limitations under the international human rights framework amidst a public health crisis. The types of measures which have raised concerns are explored here using examples from China, India, and South Korea.

  1. Right to Privacy amidst COVID-19

Article 17 of the International Covenant on Civil and Political Rights (ICCPR) protects the right to privacy of individuals against both unlawful and arbitrary interference.[8] Certain surveillance measures are necessary to ensure public health[9] amidst a pandemic, such as comprehensive contact tracing and facial recognition. However, blanket surveillance on all the individuals even though lawful or necessary should not reverse the relation between right and restriction.[11] In times of such an emergency, the Siracusa Principles provide authoritative guidance on the restriction of the right to privacy for reasons of national emergency (that includes public health), to limit government’s abuses, and to protect the rule of law.[12] In consonance with Article 17 and various Human Rights Committee (Committee) reports,[13] these principles state that any limitation on privacy must be consistent with the principles of legality, necessity, and proportionality. These principles and the surveillance measures adopted by China, India, and South Korea amidst a public health emergency are explored below to see whether these measures constitute a lawful and non-arbitrary interference to privacy.

1.1 Determining the Legality of the Interferences

The legality principle mandates that every interference must have a clear legal basis. However, surveillance measures adopted by governments to ensure lockdown amidst COVID-19 do not inherently make it a lawful interference under Article 17.[14]

Various Committee reports and judgments[15] have held that any interference with the right to privacy must be first, pursuant to, and in accordance with domestic laws (legal basis). Secondly, such domestic law must be publicly accessible and must ensure that the interference is reasonably foreseeable by the people concerned (foreseeable).[16] Thirdly, the law allowing such interference must specify in detail the circumstances in which such interference may be allowed (specific).[17] Fourthly, adequate protection from abuse of such laws must be established by the State (safeguard from abuse).[18] However, the majority of surveillance measures adopted by China and India to control the pandemic fails to qualify this four-part lawfulness test.

  1. a) China

The Chinese government has attracted criticism from human rights groups such as Amnesty International for its invasive use of technology for surveillance. This has indeed continued during the COVID-19 pandemic.[19] On 20 January 2020, China classified the COVID-19 pandemic as a Class A infectious disease under the Prevention and Treatment of Infectious Diseases Act (Prevention of Diseases Act).[20] This empowers both the State and local authorities to take necessary actions to control the spread of this virus. Further, Articles 17, 18, and 20 of the Prevention of Diseases Act states that it is the responsibility of local authorities to monitor infectious diseases.

The measures adopted by the Chinese authorities include drones to ensure people are wearing masks,[21] facial recognition cameras to track people breaking quarantine, and apps or software to track the location of citizens.[22] Citizens have been instructed to use smartphone apps such as ‘AliPay’ and ‘WeChat’ (the Apps) which instruct whether they can move around and meet people. These apps designate those rated yellow or red banned from public places for 14 days.[23] The principles determining algorithms of such apps and the criteria used by them to categorise people remains unclear.[24] Such lack of transparency may lead to unbridled power with the authorities.

While the January 2020 notice and the Prevention of Diseases Act comply with the requirement that any such interference has a clear legal basis, it remains silent on the procedure and the extent of such monitoring by the authorities. Lack of clarity and undefined discretion to the public authorities to determine the extent of the interference fails to meet the requirement of the interference to be specific.[25] The requirement for specificity and precision is necessary to safeguard people against abuse of power.[26] Further, as the procedure of such monitoring is not publicly accessible, the Prevention of Diseases Act fails the requirement of the interference to be reasonably foreseeable to be lawful.[27]

To elaborate on the requirement of safeguard from abuse, Article 2 of the ICCPR requires States to ensure effective remedy against any abuse of rights recognised by the Covenant.[28] The UN Special Rapporteur on Counter-Terrorism has stated that States must develop an oversight system of surveillance activities to ensure that any interference must be consistent with international human rights law.[29] This could be provided through a strong and independent oversight system or a combined judicial, legislative, and executive approach that ensures that affected persons have access to effective remedies in cases of abuse.[30] No such oversight system of the surveillance measures has been developed by China despite the broad ambit of their surveillance. Moreover, Article 38, Article 39, and Article 40 of the Constitution of China[31], which give legal protection to the freedom and privacy of correspondence of citizens, remain largely ineffective in protecting the privacy of citizens in the absence of other supporting legislation as no safeguards are available. Accordingly, this practice is not in conformity with the safeguard from abuse requirement of the legality test.

  1. b) India

In India, strict surveillance measures have been adopted to ensure the containment of the virus. These include smartphone apps with geotagging features,[32] camera footage,[33] and disclosing travel and other personal information of those who have contracted the virus in the public forum.[34] The legal basis on which the central and state government implemented these measures are the National Disaster Management Act and the Epidemic Diseases Act (EDA), respectively. While neither of these Acts explicitly empowers the government to disclose the personal information of people, they do include provisions which grant broad and non-specific power to the government to take any measures they deem necessary to control the virus.[35] This contradicts the requirement for the interference to be specific and reasonably foreseeable as the law allowing interference with privacy is vague and therefore not foreseeable.

Lastly, instead of providing safeguards from abuse, the EDA protects the authorities from legal proceedings for anything done in good faith under this Act.[36] Accordingly, the law allowing interference with the fundamental right to privacy of citizens[37] does not appear to fulfil the lawfulness test.

1.2 Necessity

Article 17 of ICCPR requires interference to be lawful and non-arbitrary. An interference is said to be ‘non-arbitrary’ if it is consistent with the principles of necessity and proportionality. For interference to qualify as a necessity it must pursue a legitimate aim[38] and there must be a rational connection between the interference and that aim.[39]

The legitimate aims are clarified by the ICCPR which States’ adopted measures must pursue are the protection of national security, public health, and public order.[40] In the current circumstances, all measures adopted by China and India can be said to pursue the aim of protecting public health. Contact tracing apps[41] may meet the necessity test, as research by various organisations has concluded that such measures might prove to be more effective to control the virus than ordinary measures such as manual contact tracing.[42]

Despite this utility, mass surveillance measures by China raises many concerns regarding the protection of privacy. The pre-emptive tracking of people’s movements and mass storage of personal data on a private server does not appear to be necessary or related to safeguarding public health.[43] As discussed above, lack of safeguards against abuse from surveillance measures and lack of clarity on the working of the Apps invites further speculation on the aim behind such interferences with the privacy of individuals. Interference can only be classified as non-arbitrary if it is clearly directed at achieving the legitimate aim, which in the present context is public health. It can be contended in the author’s opinion that surveillance technologies adopted by the Chinese government to intrude into an individual’s private life threaten to blur the divide between the private and the public spheres due to its vague ambit and lack of safeguards against abuse.[44]

1.3 The Proportionality Test

This test forms the other limb of a non-arbitrary interference.[45] It states that apart from necessity, the measures adopted must also the least intrusive amongst those which achieve the desired result.[46] A fair balance must be struck between the legitimate aim and the right to privacy.[47] The proportionality measures adopted by countries around the globe amidst COVID-19 can be assessed by its people and the Committee based on the safeguards adopted to limit the duration, geographical, and material scope of these restrictions.[48]

While determining proportionality in mass surveillance programmes, the UN Special Rapporteur on Right to Privacy held that what is done with the bulk data collection and who may have access to them once collected is very important.[49] The European Court of Human Rights (ECtHR) in S and Marper v the United Kingdom held that domestic law which permits mass surveillance should precisely mention the purpose behind collecting and storing such data, and must state who will have access to it.[50] Such laws must also ensure that data is stored for no longer than is required.[51] This constitutes a part of Information privacy which has been recognised by the Committee as part of the right to privacy under Article 17.[52]

  1. a) China and India

As discussed above, the measures implemented by the Chinese government to contain the virus lack transparency. There is a lack of clarity regarding the working of the contact tracing apps, on the duration of the storage of the personal data collected through these apps and other measures on a private server, and on who will have access to it. This appears to violate the principle of proportionality. As reported by the Human Rights Watch, the App’s colour determination has a wide-ranging impact on the lives of its 700 million users.[53] For example, local authorities throughout China require people to show their app when they move around, buy groceries, and obtain medicines.[54] Therefore, the measures adopted by the Chinese government do not appear to be the least restrictive option to protect public health. Accordingly, they fail to provide safeguards as required in mass surveillance under Article 17.

In India, disclosing the personal information of the people who have contracted the virus does not appear to be the least intrusive measure available to maintain public health.[55] This coupled with the unbridled power given to authorities to ensure compliance by the public as mentioned above is thus not consistent with the principle of proportionality.

  1. b) South Korea

South Korea has been widely praised for its efforts to slow the outbreak’s spread. In response to COVID-19, they employed web developers to build detailed maps of citizens’ movements using CCTV, phone-tracking, and tracing bank transactions.

Health authorities and district offices in the country also send messages which are accompanied by personal details of infected patients, including hyperlinks to detailed data about their movements.[57] This has raised alarm bells as it breaches medical confidentiality, and potentially fuels stigma against people with the virus.[58]  The legal basis for the sharing of such information is Article 34-2 of the Infectious Disease Control and Prevention Act 2016 (Diseases Control Act). Further, Article 76-2 of the Diseases Control Act empowers the government to collect or access the personal data of the people to contain the virus. Thus, while the measures adopted by South Korea have a legal basis, it

The Constitution of Korea protects the right to privacy of citizens under Articles 17 and 18. To comply with the principle of proportionality, the scope of the personal data collected by the government through the measures mentioned above is kept to a minimum, and access to such data has also been granted to limited authorities.[59] However, there lies no provision which states that citizens have the right to ask the Korean government to delete such information after the crisis is over. Thus, it can be contented that South Korea stands out in terms of protecting the privacy of its people among the jurisdictions discussed in this article but it still requires adopting certain additional measures to adhere completely to the proportionality test.

  1. Duration of emergency powers

There are concerns that these strict surveillance methods may outlast the pandemic itself. A report by Amnesty International has highlighted a fear which suggests that the surveillance methods could remain in place even after the COVID-19 threat weakens.[60]

The United Nations Commission on Human Rights has stated that limitations applied to human rights during emergencies should terminate at the end of the emergency.[61] Thus, the continuance of the surveillance measures by governments post-pandemic might make those measures unlawful and arbitrary under Article 17. Governments have in the past taken such opportunities to continue measures when they are no longer justified.

For example, the 2008 Beijing Olympics and Shanghai Expo provided opportunities for the Chinese government to implement surveillance measures that were not subsequently discontinued.   China treats ‘stability maintenance’ as a legitimate State aim. They have used such major events as an opportunity to implement more intrusive security measures and allocate more funding for surveillance and social control. Some of these measures later became permanent features of Chinese policing.[62] The behaviour is also seen in Western democracies. The USA PATRIOT Act, 2001 and Homeland Security Act, 2002 were promulgated post 9/11 by the USA to focus on Muslim Americans. However, these laws have now been radically expanded to look at asylum seekers of all origins and faiths.[63]

Thus, while governments around the globe have justified the strict surveillance measures by stating that they are necessary to contain the virus, they should not outlast the crises they claim to address. The surveillance measures must not outlast the pandemic to qualify as lawful and non-arbitrary interference under Article 17.


While many measures adopted by the governments to control COVID-19 appear necessary, it does not justify a permanent erosion of privacy rights. In response to this threat, the United Nations has recommended that governments should favour voluntary tools such as phone-tracking apps that require users’ consent for ensuring compliance and to set up independent bodies to oversee such measures.[64] The latter measure seeks to ensure that governments are not left unchecked with such surveillance measures.[65]

            One such voluntary app was developed by the Norwegian Institute of Public Health to control the state’s spread of COVID-19. It does not collect the health data of the individuals and stores the data collected through the app for a maximum period of 30 days.[66] In order to comply with existing human rights obligations, Governments around the globe should work towards developing surveillance programmes that safeguard the privacy rights of individuals only legitimately, proportionately, and with the minimum interference necessary for the achievement of purpose. Such programmes must include clarity regarding the purpose and duration of the measures implemented. The UN Human Rights Office has also reiterated that measures adopted to control COVID-19 must be temporary and the least intrusive.[67] Finally, it is critical while implementing strict surveillance measures that the government uses the data collected through it only to control COVID-19 and nothing more.

With COVID-19 proving to be the deadliest viral outbreak in recent memory and a serious threat to global health, it is now more important than ever to prevent the erosion of democracy and human rights.

*The author is a student at the National University of Study and Research in Law (NUSRL), Ranchi, India with an interest in international human rights law. She can be reached at


[1] The numbers are updated as of 3 February 2021. For updated information, see Center for Systems Science and Engineering, ‘COVID-19 Dashboard’ (Johns Hopkins University & Medicine, 2020) <> accessed 3 February 2021.

[2] Samantha Sault, ‘Why lockdowns can halt the spread of COVID-19’ (World Economic Forum, 21 March 2020) <> accessed 20 August 2020

[3] Michelle Bachelet, ‘COVID-19: Exceptional measures should not be cover for human rights abuses and violations’ (UNHRC, 27 April 2020) < COVID-19: Exceptional measures should not be cover for human rights abuses and violations> accessed 20 August 2020.

[4] Lawrence Gostin & Sarah Wetter, ‘Why There’s No National Lockdown’ (The Atlantic, 31 March 2020) <> accessed 20 August 2020.

[5] Such as privacy, movement, and expression.

[6] Umberto Bacchi, ‘Coronavirus surveillance poses long-term privacy threat, UN expert warns’ (Thomson Reuters Foundation, 31 March 2020) <> accessed 11 August 2020.

[7] Amnesty International, ‘COVID-19, surveillance, and the threat to your rights’ (Amnesty International, 3 April 2020) <> accessed 15 August 2020 (Amnesty International report on Surveillance).

[8] International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171 (ICCPR), Art 17.

[9] UNCHR ‘Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism’ (2009) UN Doc A/HRC/13/37 [12].

[10] The WHO defines contact tracing as the identification and follow-up of persons who may have come into contact with a person infected with a contagious disease, to help the contact to get relevant care and treatment. World Health Organization, ‘Contact tracing’, available at: < > last accessed 3 February 2021.

[11] UNCHR ‘General Comment No. 27’ in ‘Freedom of movement (article 12)’ (1999) UN Doc CCPR/C/21/Rev.1/Add.9 [11] – [16]; Handyside v the United Kingdom App no 5493/72 (ECtHR, 7 December 1976) [48]; Klass v Germany App no 5029/71 (ECtHR, 6 September 1978) [42].

[12] UNCHR ‘The Siracusa Principles on the Limitation and Derogation Provisions in the International Covenant on Civil and Political Rights’ (1984) UN Doc E/CN.4/1985/4 [10].

[13] ibid; UNCHR ‘CCPR General Comment No 29: Article 4: Derogations during a State of Emergency’ (2001) UN Doc CCPR/C/21/Rev.1/Add.11.

[14] Giosue Canepa v Canada (1997) Communication no 558/1993, UN Doc CCPR/C/59/D/558/1993, (1993) 5 IHRR 69, IHRL 1697 [11.4].

[15] UNCHR ‘Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism’ (2010) UN Doc A/HRC/14/46, annex; Weber & Saravia v Germany no 54934/00 (ECtHR, 29 June 2006) [152].

[16] ibid.

[17] UNCHR ‘Concluding observations on the fourth periodic report of the United States of America’ (2014) UN Doc CCPR/C/USA/CO/4 [22] (Fourth periodic report); UNCHR ‘Consideration of Reports Submitted by States Parties under Article 40 of the Covenant, Concluding Observations, Jamaica’ (1997) UN Doc CCPR/C/79/Add.83 [20]

[18] Weber & Saravia v Germany (n 15).

[19] June Ko, ‘How China used technology to combat COVID-19 – and tighten its grip on citizens’ (Amnesty International, 17 April 2020) <> accessed 16 August 2020.

[20] ‘Announcement of the National Health Commission of the People’s Republic of China [2020] No 1’, The State Council of the People’s Republic of China, 21 January 2020 <> accessed 16 August 2020.

[21] Kari Soo Lindberg & Colum Murphy, ‘Drones Take to China’s Skies to Fight Coronavirus Outbreak’ (Bloomberg, 4 February 2020) <> accessed 18 August 2020.

[22] Wold Health Organisation, ‘Report of the WHO-China Joint Mission on Coronavirus Disease 2019 (COVID-19)’ (16-24 February 2020) p14-15

[23] Maya Wang, ‘China: Fighting COVID-19 With Automated Tyranny’ (Human Rights Watch, 1 April 2020) <> accessed 15 August 2020.

[24] ibid.

[25] Malone v the United Kingdom App no 8691/79 (ECtHR, 2 August 1984) [67- 68]

[26] UNCHR ‘General Comment No 16’ in ‘Article 17 (The right to respect of privacy, family, home and correspondence, and protection of honour and reputation)’ (1988) UN Doc HRI/GEN/1/Rev.9 (Vol I) [8].

[27] Ivashchenko v Russia, no 61064/10 (ECtHR, 13 February 2018) [72].

[28] ICCPR art 2 Paragraph 3(a).

[29] UNCHR ‘Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism’ (2014) UN Doc A/69/397 [35].

[30] Fourth periodic report (n 17) [22].

[31] The Constitution law of People’s Republic of China, Arts 38, 39 & 40.

[32] S Garg, N Bhatnagar & N Gangadharan, ‘A Case for Participatory Disease Surveillance of the COVID-19 Pandemic in India’ (JMIR Public Health and Surveillance, 2020) <> accessed 15 August 2020.

[33] Venkat Ananth ‘Covid-19 cases rise in India, “Covtech” based surveillance intensifies’ (The Economic Times, 30 March 2020) <> accessed 12 August 2020.

[34] Karnataka makes addresses of quarantined residents public, raises privacy concerns (The News Minute, 25 March 2020) <> accessed 17 August 2020

[35] National Disaster Management Act 2005 s 6(i); Epidemic Diseases Act 1897 s 2

[36] Epidemic Diseases Act 1897 s 4.

[37] K.S. Puttaswamay v Union of India (2017) 10 SCC 1 [644].

[38] Manfred Nowak, UN Covenant On Civil and Political Rights: CCPR Commentary (2nd ed, 2005) 383.

[39] Malone (n 25).

[40] UN Special Rapporteur on Countering Terrorism (n 9) [16] – [17].

[41] Contact tracing apps are usually based on Bluetooth proximity technology. People who test positive enter their diagnosis into an app. This is used by Bluetooth technology to identify people who had been in close contact with them during their infectious period. The app then proceeds to notify those close contacts of possible exposure.

[42] In manual contact tracing, the person infected with a contagious disease gives details to the contact tracer regarding who they have been physically close to. The contact tracer then proceeds to trace those people and isolate them subject to their symptoms; Luca Ferretti, ‘Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing’ (Science, 8 May 2020) <> accessed 15 August 2020.

[43] Paul Mozur and others, ‘In Coronavirus Fight China gives Citizens a Color Code, with Red Flags’ (New York Times, 1 March 2020) <> accessed 16 August 2020.

[44] Page 3 of the article.

[45] MG v Germany (2008) Communication no 1482/2006, UN Doc CCPR/C/93/D/1482/2006 [10.1] – [10.2].

[46] UN Special Rapporteur on Countering Terrorism (n 9) [17].

[47] Antonius Cornelis Van Hulst v Netherlands (2004) Communication no 903/1999, UN Doc CCPR/C/82/D/903/1999 [7.3]

[48] The Siracusa Principles (n 12) [51].

[49] UNCHR ‘Report of the Office of the United Nations High Commissioner for Human Rights’ in ‘The Right to privacy in the digital age’ (2014) UN Doc A/HRC/27/37 [27].

[50] S and Marper v the United Kingdom [GC] App no 30542/04 and 30566/04 (ECtHR, 4 December 2008) [103].

[51] Breyer v Germany no 50001/12 (ECtH.R, 30 January 2020) [97].

[52] General Comment No 16 (n 26) [10].

[53] Wang (n 23)

[54] Kai Kupferschmidt & Jon Cohen, ‘China’s aggressive measures have slowed the coronavirus. They may not work in other countries’ (American Association for the Advancement of Science, 2 March 2020) <> accessed 18 August 2020.

[55] The News Minute (n 34).

[56]  The Korean government is tracing credit card and bank transaction of infected people to track where these people went. This makes it easier for the authorities to quarantine and sterilize those locations. Korea Center for Disease Control and Prevention, ‘Frequently Asked Questions for KCDC on COVID-19’ <> accessed 19 August 2020.

[57] Amnesty International report on Surveillance (n 7).

[58] ibid.

[59] M.P. Sacco, ‘Digital contact tracing for the Covid-19 epidemic: a business and human rights perspective’ (International Bar Association, 19 June 2020), p 8-9. <> accessed 18 August 2020.

[60] Amnesty International report on Surveillance (n 7).

[61] UNCHR, Human Rights in the Administration of Justice: A Manual on Human Rights for Judges, Prosecutors and Lawyers 825 <>.

[62] Lily Kuo, ‘The new normal: China’s excessive coronavirus public monitoring could be here to stay’ (The Guardian, 9 March 2020) <> accessed 17 August 2020.

[63] Karen C. Tumlin, ‘Suspect First: How Terrorism Policy Is Reshaping Immigration Policy’ (2004) California Law Review, Vol 92, No 4 at 1228.

[64] Bacchi (n 6).

[65] UNCHR ‘Report of the Special Rapporteur to the Human Rights Council on the implications of States’ surveillance of communications on the exercise of the human rights to privacy and to freedom of opinion and expression’ (2013) UN Doc A/HRC/23/40EN [31].

[66] Simula is working with the Norwegian Institute of Public Health’ (Simula, 27 March 2020) <> accessed 18 August 2020.

[67] UNCHR ‘Emergency Measures and Covid-19: Guidance’ (27 April 2020) <>.