Article, Commentary, Covid, GDPR

Location privacy and data retention in times of pandemic and the importance of harmonisation at European level

Patrícia Corrêa

In this time of pandemic, many countries are starting to actively monitor cellphone data to try to contain the spread of the new coronavirus. Governments are using location data to trace contacts or monitor and enforce quarantine of persons who have tested positive for COVID-19 or those with whom they have come into contact with.

The United States’ Government is in discussions with the tech industry about how to use Americans’ cellphone location data to track the spread of the novel coronavirus. In Iceland, authorities have launched an app that tracks users’ movements in order to help tracking coronavirus cases by collecting data about other phones in the area. In India, state authorities have also launched an application to track the movement history of persons tested positive, also providing the date and time of the visit to spots by the patients. In Brazil, at least one city is already using cellphone data to monitor gathering of people and take action to disperse them and soon federal government will follow. There are reports of similar approaches in many other countries as well.

At European level, Internal Market Commissioner Thierry Breton has held a videoconference with CEOs of European telecommunication companies and GSMA to discuss the sharing of anonymised metadata for modelling and predicting the propagation of the virus.

Does this approach necessarily put data privacy at risk? Is the trade-off between data privacy and public health necessary? Whereas it is true that in exceptional circumstances fundamental rights need to be balanced against each other, data privacy shall not be an insurmountable obstacle to the implementation of exceptional public health policies.

Some basics on data and metadata

Simply put, data consists of potential information that has to be processed to be useful. [1] Metadata, on the other hand, is “data about data”, comprising all the information about data at any given time, at any level of aggregation. It is structured information about an information resource of any media type or format. [2]

In order to safeguard privacy, personal data must be anonymised before its processing. Anonymisation refers to the process of de-identifying sensitive data while preserving its format and type [3] so it cannot be tied to specific individuals. Privacy can be also be assured by means of aggregation, which refers to the “process where raw data is gathered and expressed in a summary form for statistical analysis.”

Conditions for the use of location data

While in some countries the use of information to combat the COVID-19 outbreak seems to go beyond anonymised data (individual location and contacts tracking, for instance, requires device-level data), in Europe, so far, collaboration between telecommunication companies and governments appears to encompass only the exchange of anonymised data or databased models. On that level of data processing, the European Data Protection Board issued an approval statement based on some conditions, such as the anonymity of the processed data and the applicability of administrative controls, including security, limited access and limited retention periods.

On April 8, the European Commission issued a Recommendation on a Common Union Toolbox for the Use of Technology and Data to Combat and Exit from the COVID-19 Crisis, in particular concerning mobile applications and the use of anonymised mobility data. The Recommendation acknowledges the value of digital technologies and data in combating the COVID-19 crisis stating, however, that fragmented and uncoordinated approaches could hamper the effectiveness of measures aimed at combating the pandemic and violate fundamental rights and freedoms. It sets up a process for developing a common approach (Toolbox) to use digital means to address the crisis. The Toolbox will consist of practical measures for making effective use of technologies and data, with a focus on a pan-European approach for the use of mobile applications, coordinated at Union level and a common scheme for using anonymised and aggregated data on mobility of populations.

Regarding the use of mobility data, the Recommendation provides, inter alia, for safeguards to be put in place to prevent de-anonymisation and avoid reidentifications of individuals, including guarantees of adequate levels of data and IT security, and assessment of reidentification risks when correlating the anonymised data with other data.

The right to location privacy

According to the Article 4(1) of the GDPR, personal data comprises any information relating to an identified or identifiable natural person, including location data. Location data, as stated by the ePrivacy Directive, means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service. It can be tied to a known individual (e.g. a name linked to a cell phone subscription) or to an identifier associated with a specific device (anonymised data). In other cases, a dataset is modified to display the location of groups of people, instead of individuals (aggregated data).

Location privacy, hence, relates to the location information of an individual in a sense that prevents others to learn about one’s current or past location. [4] In other words, “This definition captures the idea that the person whose location is being measured should control who can know it.”

The right to location privacy encompasses two fundamental rights, both guaranteed by the Charter of Fundamental Rights of the EU: the respect for private and family life (Article 7) and the protection of personal data (Article 8). Notwithstanding its importance, fundamental rights are not absolute and can be restricted in exceptional situations. As stated by Article 52(1), restrictions on these rights can only be imposed when lawful, legitimate and proportionate.

Location privacy is also protected under the Article 8 of the European Convention on Human Rights and cannot be limited either, if not for derogation in time of emergency consisting of war or other public emergency threatening the life of the nation. In that case, the measures shall be taken strictly to the extent required by the situation and cannot be inconsistent with other obligations under international law (Article 15).

Data retention in EU context

In Digital Rights Ireland case, the ECJ declared the invalidity of the Directive 2006/24/EC, which required providers of publicly available electronic communication services or public communication networks to retain telecommunication data of individuals for the purposes of preventing, investigating and prosecuting serious crime. The ECJ took the view that the Directive does not “provide for sufficient safeguards … to ensure effective protection of the data retained against the risk of abuse and against any unlawful access…” According to the ECJ, although the Directive satisfies a valid objective of general interest (public security), it does not meet the principle of proportionality.

To date, there is no EU legislation regarding data retention. Filling up the void, the ECJ decided in Tele2 Sverige case on the scope and effect of its previous judgment on Digital Rights Ireland, establishing minimum safeguards that must be included in any national law regarding data retention. ECJ therefore concluded that national legislation that did not contemplate minimum safeguards would be precluded pursuant to Article 15(1) of ePrivacy Directive.

Despite the guidelines set out in the Tele2 Sverige judgement, a survey by Privacy International indicates that, as of 2017, a large number of Member States still had not yet made necessary changes to ensure national legislation compliance. This is especially important in this time of pandemic, as many States in Europe are recurring to private telecom companies to disclose retained location data in order to fight the COVID-19 outbreak.

Data retention and location privacy: the need for harmonisation

This scenario highlights the importance of harmonisation on the subject at European level, what would contribute to safeguard citizens’ privacy rights. That coordination between private companies and governments shall reveal how access to sensitive telecommunication data by public authorities will affect the retention of data for private purposes.

In the light of the COVID-19 pandemic, location data can be very useful for epidemiological analysis, medical research and measures against disease spread. This importance, however, does not preclude the respect for privacy rights. In that context, a European framework for data retention is paramount to location privacy, since it can effectively regulate what data can be retained, for how long, and what measures must be taken in order to reduce violations risks and making it is being stored and shared in legitimate and responsible ways.

Final remarks

The retention, processing and exchange of location data to handle the pandemic do not necessarily have to violate privacy. There are mechanisms that, although not infallible, minimise risks of breach in the processing of personal data, in particular aggregation and anonymization. Besides, even in exceptional cases in which personal identifiable information processing is needed, EU Regulation and case law have already set some boundaries, especially amounting to proportionality. What really matters is the approach authorities will choose to take after the outbreak subsides, so mass surveillance does not become the norm.

[1] POMERANTZ, Jeffrey. Metadata. Cambridge : The MIT Press, 2015. p. 21.
[2] BACA, Murtha (ed). Introduction to Metadata. 3. ed. Los Angeles : Getty Research Institute, 2016. p. 2.
[3] RAGHUNATHAN, Balaji. The Complete Book of Data Anonymization: From Planning to Implementation. Boca Raton, FL, USA : CRC Press, 2013. p. 4.
[4] ATAEI, Mehrnaz; KRAY, Christian. Ephemerality is the New Black: A Novel Perspective on Location Data Management and Location Privacy in LBS. In GERTNER, Georg; HUANG, Haosheng (ed. ) Progress in Location-Based Services 2016. Switzerland : Spring, 2017. p. 360.

 

The Author

Patrícia Corrêa is a Portuguese qualified lawyer currently pursuing a Master’s Degree in International and European Law at Universidade Católica do Porto, Portugal.

Article, Commentary, Covid

A Burden to Share

Jasper Doomen

 

One of the European countries that have been particularly struck by the consequences of the spread of the Coronavirus disease 2019 is Italy. The health care problems have a direct effect on the economy, as a result of which it has appealed to other EU Member states, stressing the need for solidarity between them. How should the European Union respond to such an appeal?

 

Solidarity between the Member states is an important principle of EU law enshrined in art. 122 paragraph 1 TFEU. It is easy to adhere to such a lofty principle in times when those united under a single banner have no need to invoke it. The value of that banner is put to the test in times when their interests do not harmonize. In certain respects, the European Union, and in particular the Eurozone, is more aptly characterized as a union of dissent than as an organization whose members agree upon compliance with commonly agreed upon rules. May a country such as Italy rightly call on the European Union as a whole and thus, in fact, on those countries that have followed a more austere budgetary policy than it has?

 

Italy is faced with an immediate crisis, to which a swift response is fitting. This is arguably not the time to blame Italy for fiscal policy and political choices that have resulted in its present poor economic position, which was already heading toward its third recession in a decade prior to the outbreak of the virus; such time would not even exist. On the other hand, simply providing aid does not seem appealing, either, since such a policy results in rewarding Member states’ bad behavior. With respect to Italy, it may be pointed out, in this respect, that the ratio of its government debt to its gross domestic product has exceeded 130%.

 

Short-term assistance may be realized by referring to TFEU, art. 122, par. 2, which appears to provide a sufficient basis to aid Italy, since it indicates that financial assistance may be granted to a Member state that is “seriously threatened with severe difficulties caused by natural disasters or exceptional occurrences beyond its control”. Importantly, the article stipulates that the aid shall be granted “under certain conditions.” Similarly, art. 12, paragraph 1 of the Treaty establishing the European Stability Mechanism stipulates: “If indispensable to safeguard the financial stability of the euro area as a whole and of its Member States, the ESM may provide stability support to an ESM Member subject to strict conditionality, appropriate to the financial assistance instrument chosen. Such conditionality may range from a macro-economic adjustment programme to continuous respect of pre-established eligibility conditions.”

 

Greece was aided when it was confronted with the government-debt crisis of 2009. It was forced, in return, to privatize government assets and to reform its economy. It is clear that the situations differ in several respects. Most important, perhaps, is the given that in the case of Greece there was relatively much time to consider different options, since the size of the government debt was the main issue. In this case, by contrast, external circumstances, so to speak (the virus affecting all countries), are the main factor. That does not, however, derogate from the fact the first demand could be made here, too (although, admittedly, this does run the risk of a possibly undesirable external – such as Chinese – influence). In exchange, Italy could receive the means to address the health care issues. If this seems too harsh, one may consider making funds available unconditionally, provided they are indeed allocated to combat the immediate health problems. The need for economic reforms is a separate issue, to which I will return below.

 

One may, in addition, consider aiding Italy in the long term; the aid would then not have an incidental but a structural character, being intended to support the Italian economy. In this case, it would be wise to exercise restraint. The principal argument is based on the given that the Member states that have adhered to the demands that the ratio of the government deficit to gross domestic product not exceed 3% and that the ratio of government debt to gross domestic product not exceed 60% (art. 126, paragraph  2 TFEU, read in conjunction with art. 1 of Protocol no. 12 thereof) have reaped the benefits of their budgetary policy. Member states such as Finland and the Netherlands have almost consistently met these criteria. Their economy is thriving and they are able, accordingly, to issue bonds intended to solve their problems at low interest rates. Being cautious when structural aid for a Member state which has consistently not met them is concerned is not to be interpreted as a means to berate it, so as a sort of punishment. Rather, aiding it unreservedly conflicts with the basic idea that Member states are individually responsible to effectuate sound economic policy.

 

The European Central Bank has established a temporary Pandemic Emergency Purchase Programme in the amount of EUR 750 billion (Decision (EU) 2020/440 of the European Central Bank of 24 March 2020 art. 1), notwithstanding the previously defined limit of 33% under the public sector asset purchase programme (Decision (EU) 2015/774 of the European Central Bank of 4 March 2015 art. 5). It does not thus directly support Member states, but it is, on this basis, able to do so indirectly, by purchasing bonds, thereby ensuring that Member states will be able to continue to attract sufficient financial means at an interest rate that is mitigated as a result of this measure.

 

Italy will thus be able to increase its already substantial debt at low interest rates, reducing or even – in a pessimistic scenario – removing its incentive to carry through economic reforms, especially if it is able to operate on the assumption that the European Union will come to its aid if the debt becomes too great to bear. National political considerations may be an important factor as well.

 

One may think that the problems are exaggerated; as long as Italy simply promises to realize the reforms desired by the European Union (and certain Member states in particular, namely, those who have stressed the need to observe the budgetary norms mentioned above), the issue will resolve itself, albeit in the long term, its debt gradually decreasing to manageable proportions. An important observation must be made, though, even irrespective of the issue just addressed, namely, that the incentive to realize those reforms is diminished. The demand to keep the government deficit and debt in check is not something with which Italy must now, all of sudden, comply; it exists for all Member states. So reforming one’s economy as a means to realize those goals just means that one does what one is already obligated to do, so that it should not merit a special reward. Suppose an employee has been on the payroll for several months without performing any of his tasks. It would be peculiar if his employer were to promise him a bonus, on top of his wages, if he starts doing his job.

 

I have previously used, assessing the government-debt crisis of 2009, the simile of negotiating with someone who threatens to jump down a cliff while being chained to those with whom he is negotiating: his suicide brings their deaths with it, which gives him a strong negotiation position. This characterization appears to apply here, too, the more so since Italy has the third largest economy of the Member states.

 

It is positive if the European Union disburdens Italy as far as the immediate needs are concerned, irrespective of whether the other Member states consent to the measures on the basis of humanitarian considerations or self-interest. In the latter case, a very difficult calculation, given the variables, would have to be made in order to determine whether they are – in the long run – better off without a weak Member state, which may, incidentally, arguably be better off itself if a devaluation of the new currency (a new Lira) is possible, Italy presently being unable to do so, being bound by the same rules as Member states that are both able and willing to act in accordance with them. Whereas those Member states consider them sensible directives, Italy seems to deem them a straitjacket from which it must free itself. (For completeness, I remark that this summary presentation is not accurate, states themselves not having viewpoints, the actual viewpoints rather being a representation of the majority opinion.) Given the fact that isolated devaluation is not possible, the harm of the ‘remedy’ of monetary financing cannot be ignored, an increased inflation in the Eurozone in its wake being a serious danger.

 

I readily grant that it is easy for me, exercising armchair jurisprudence from a relatively comfortable position, to judge these matters. In any event, should it, for whatever reason, be decided that certain measures in addition to those focused on addressing the immediate health care problems are necessary, a piecemeal approach would be prudent. Such an approach was not taken by the former President of the European Central Bank in his policy of quantitative easing. Italy was, as a result, able to muddle through, not being forced to save for the winter, having to request others to contribute to the purchase of a decent coat now that it has arrived. The Pandemic Emergency Purchase Programme would not necessarily be problematic if Italy’s underlying condition were sound; it is not, and the risks of such policy for the other Member States are substantial.

 

It is difficult to say what the effects of rigorous measures to provide structural support will be, but the adverse result of the attempt to bring the Member states together may be that they end up further apart than ever before.

 

The Author

Jasper Doomen is an assistant professor of Constitutional law at the Open University. His publications are focused on topics in the fields of philosophy and law.

 

Article, Brexit, Commentary

Exercises de style – Reflections on Brexit

Luigi Lonardo

The goliardic vein of our editors, blended with the tedium vitae that assails at least one of them in this season in which the year dies most sweetly, has produced a couple of reflections on Brexit presented in the form of Exercises in Style – written, that is, alla maniera di Joseph de Maistre.

Joseph de Maistre, 1753-1821, was a Savoyard diplomat and politician, a sturdy anti-rationalist reactionary voice of the counter-enlightenment, who wrote against the French revolution and in favour of the Monarchy as divinely sanctioned form of government.

The following is a translation – with worryingly minor amendments – of the initial pages of de Maistre’s Considerations sur la France (1797)

Reflections sur le Royaume Uni

A short essay on Brexit in the style of de Maistre.

A miracle is an effect produced by a divine cause that suspends an ordinary cause. If, in the middle of the winter, a man orders a tree, in front of thousands of witnesses, to cover itself immediately with leaves and fruits, and the tree obeys, everyone would consider it a miracle, and look at it in awe, and bow in front of the performer. Well Brexit is as awesome, in the realm of politics, as the instantaneous fructification of a tree in the month of January: and yet people, instead of admiring it, look elsewhere, or make foolish commentaries.

Men, led by their pride, see disorder when they do not understand the cause of something, or when the causal chain they tried to create is suspended, or when things do not go as they expected them to. The truth is that they are necessarily limited, since they are mortal creatures, and equally limited is their action, especially at revolutionary times such as the ones we are living.

Uncertainty is the key word of the times. This word is very meaningful if it is meant as a reminder of the prime cause that creates such a spectacle; but it is stupid if it only expresses a sense of despise for out times or our politicians, or a sterile disenchantment.

‘How come – we read everywhere – that a country famous for her political leadership, her stable and much-admired parliamentary system, her seriousness and conscientiousness has taken such a decision! How can politicians, who appear to be the ineptest of their generation, be put in charge of guiding such a momentous change! An opportunistic mayor, a clever and deceitful political class, they hold the country in their hands! The European Union is swallowed by both government and opposition! Everything is possible for the evil ones!’

Look, never is certainty more visible, never Providence is more present, than when superior action substitute itself to that of men, and acts by herself. What is most striking about Brexit, is its sheer force that seems to destroy all obstacles. It is a hurricane that swifts away as light hay everything that human force has been able to oppose to it: nobody was able to stop it. The purity of the motivations has perhaps shown the obstacle: but that is all; and this zealous force, proceedings irresistibly toward its goal, has rejected Miller, a second referendum, etc.

One ought to say that Brexit leads men more than men lead Brexit. This is correct, and even though we could say the same about all great revolutions, it has never been truer than in this context. The fools who appear to lead Brexit only enter into it as instruments; as soon as they have the presumption to dominate it, the fall ignobly. Those who wanted to deliver Brexit did so without really wanting it and without knowing what they were doing.

Excessively mediocre men such as Nigel Farage have exercised, on a guilty nation, a despicable form of despotism: and surely, they were the first to be shocked by their own success. But they were drawn to this success, unwittingly, by circumstances. And Providence has thrown them away, and wanted to put Theresa May in charge instead. Their faith in Brexit, they who are men without political intelligence, has led them to dare anything, without fear of a Remain campaign. They have kept marching forward, without looking back. And so far everything has succeeded for them, because they are the instrument of a force that knows better.