(Data) Privacy: What is the Corona Crisis Teaching Us?

by Fernando Luís Barroso da Silva Filho
(University of São Paulo, Brazil, School of Law),
Carolina Corrêa Giron (University of Triângulo Mineiro, Brazil, Health Department) and
Fernando Luís Barroso da Silva (University of São Paulo, Brazil School of Pharmaceutical Sciences)

Empty streets. Desolated public places. Death tolls 10.000 feet high and rising. Restrictions imposed on the population. People wearing radiation-protective-like suits. Hospitals over capacity despite working on eighth gear. Radical economic measures. Leaders denying facts and scientific evidence. New form of nationalism at its peak. Polarization of ideologies largely and quickly increasing. Countries fighting for resources. Every single location on the globe coping with the same problem. This could describe a dystopian Third World War movie but, unfortunately, it is the reality we are facing at global scale due to the COVID-19 pandemic.

Throughout history, mankind has faced uncountable outbreaks of diseases and a few pandemics that changed history (CRAWFORD 2018) – having passed the ‘mutation point’, the coronavirus is a severe one among them. Knowing for sure the world will change, it is still very hard to forecast how the post-COVID future will look like. This depends not least on the present scientific, economical and political achievements. However, a reasonable starting point is to look back in time to previous pandemics and analyse them. Some circumstances will be equal, others will be very much different, there are problems of the past that stayed in the past, others persisted. Yet there are new problems that no one has faced before, one of those is data privacy.

The most far-reaching and deadliest pandemic ever registered happened in the beginning of the 20th century – caused by the H1N1 virus, whose disease is commonly known as “Spanish flu” – and it shares some common traits (transmission mechanism, symptoms etc.) with the one the world has to face right now, among many different aspects (virus’ families, infectivity, fatality and transmission rates etc.) (TRILLA et al. 2008). The greatest aggravating factors at that time, problems that existed during the Spanish Flu and are not an issue now, excluding scientific progress, were (public) health systems absence in every country and just coming out of the First World War‘s practical consequences. On the other hand, the world still struggles with problems “of the past”, for instance, socioeconomic differences between countries and within the same town. Lastly, some circumstances were not an issue at that time but are now, for example, society’s values (specially occidental) set individual over public interests, thus considering privacy a fundamental right. Thus making a contemporary paramount issue whether we weaken privacy or praise safety.

Since immemorial times and until now the strategy to fight the pandemic is exactly the same – the ancient and rudimentary, yet fundamental and functional, the isolation – the choice is to reduce contact between people, because, after all, there is no cure or prophylactic method regarding this new coronavirus. As an expected logical conclusion, nowadays many governments (China, Europe, Iran, Israel, Singapore, South Korea, United States etc.) are taking technology-driven approaches to identify infected or possibly infected individuals and ensure proper quarantine. The digital solutions may vary from country to country, going from geolocation monitoring to measure the degree of human mobility (e.g. Brazil) to contact tracing aiming to identify exposed individuals (e.g. South Korea); from encouraging employees to come forward about eventual COVID-19 symptoms (e.g. Belgium) to generalized checks, for example, measuring their body temperature on the way in (even if its effectiveness for the transmission prevention can be questioned).

It is also important to notice that in most cases this surveillance apparatus was not built overnight. It did exist before. Governments already had it for other means or got it simply by demanding private companies to expose personal data arguing the current emergency state (that does exist) – companies that have access to our personal data and are routinely monitoring us. In this regard, the COVID-19 crisis is shedding light on society’s vulnerabilities, problems that every single individual had but most people were not concerned with, such as data privacy violations. Who knew that your country’s government could trace your location? Probably almost everybody. Who had seen it in action? Very few citizens.

For the first time populations are tasting and knowing what is it like to have their privacy compromised, their data exposed on a daily basis. These violations are usually taken for granted as the only way to contact trace in contemporary society. The greatest example is South Korea. The country is praised by the World Health Organization (WHO) for its actions against COVID-19 but, as a downside effect, it has disclosed personal data of contaminated citizens on institutional and private websites within their “path control” protocol (see ncov.mohw.go.kr and coronamap.site, respectively), which can lead to public shaming among other problems. Its effectiveness has to be weighted together with the fundamental right of privacy that engages democratic institutions to limit the arbitrary power of the State that can be restrained in specific situations, such as wars. Nonetheless, this relativization of privacy cannot be up to its most inner level of secrecy (FRIED 1984) and it has to follow criteria, namely: necessity, effectiveness, proportionality and subsidiarity.

Elsewhere, other countries have come up with less invasive strategies of contact tracing following today’s trends of “privacy by design” and, more specifically, “Privacy Enhancing Technologies” (BIONI 2019). Singapore’s “TraceTogether” app, for instance, if allowed, uses Bluetooth instead of geolocation to identify possibly infected individuals based on how close and for how long one was in touch with a confirmed case of COVID-19. Furthermore, the European Union’s app is also using Bluetooth technology, making all data storage brief and restrained to its citizens phone. The result, while not as effective, is sufficient and practically unharmful to individual’s personal space.

An atemporal – before, during and after the COVID crisis – key element in privacy by design is minimized data. In other words, only the strictly essential data is collected so, ideally, they are “born” anonymized (VOIGT et al. 2017). But it is not all roses, as a golden rule, the more useful the data, the less anonymized it is, therefore, balance is also needed. The ideal to proper contact trace and check population’s risks would be dealing with every data that matters for COVID (14-day lookback location, contacts, age, sex, comorbidities, addictions and so on) except, to ensure privacy, some data need to be cut out of the list. Complementary, the data should be kept preferentially by the data subject and certainly for the least amount of time as possible.

These less invasive strategies that ensure data privacy is a corollary of citizens’ data awareness and countries’ modern privacy regulations. Usually, awareness will come first and then the next step will be proper legislation but, sometimes, lawmakers start with the regulation to help provoke data consciousness in a downward movement. By any means, statistics from the ‘United Nations Conference on Trade and Development’ (UNCTAD) on april 25th show that 29% of nations worldwide do not have any data protection and privacy legislation yet. When the SARS-Cov-2 virus, which makes no distinction of where and when to strike upon, is no longer an issue for humanity, these “unprotected” nations ought to pass proper legislation and protect their citizens‘ privacy.

As no other has been before, our present society produces data on infinite scales and, most importantly, is driven by it due to its economic value. A whole world of discussion regarding health data will emerge. There are other issues that need to be carefully analysed and discussed, including the privacy of several medical records and clinical trials, as well as health data produced by smartthings – phones, watches, bands, and so on (AZENCOTT 2018). From the screening for COVID-19 tests to the personal genetic information that might be extracted from people fully recovered recruited to donate plasma or by host genetics initiatives (e.g. covid19hg.org), data privacy should be protected.

In the ideal post-COVID world, this crisis will have helped raise awareness to privacy and empowered citizens, privacy by design will be the rule and customers will be familiarized with several types of friendly privacy enhancing technology. In other words, by showing to the people the nefarious effects of a legislative vacuum and privacy violations, COVID-19 will speed up transformations that were already occurring in the data protection field, similar to what the ‘Spanish Flu’ did regarding universal health care and the discipline of virology (SPINNEY 2017).

REFERENCES

Azencott, Chloe Agathe “Machine Learning and Genomics: Precision Medicine versus Patient Privacy.” Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, vol. 376, no. 2128, 2018, p. 20170350., doi:10.1098/rsta.2017.0350.

Bioni, Bruno Ricardo. Proteção de Dados Pessoais – A Função e os Limites do Consentimento. Rio de Janeiro: Forense, 2019.

Crawford, Dorothy H. Deadly Companions – How Microbes Shaped Our History. Oxford: Oxford Landmark Science, 2018.

Fried, Charles. “Privacy [a moral analysis]”. Philosophical Dimensions of Privacy: An Anthology, edited by Ferdinand David Schoeman, Cambridge University Press, 1984, pp. 203

Spinney, Laura. Pale Rider – The Spanish Flu of 1918 and How it Changed The World. New York: Public Affairs, 2017.

Trilla, Antoni, et al. “The 1918 ‘Spanish Flu’ in Spain.” Clinical Infectious Diseases, vol. 47, no. 5, 2008, pp. 668–673., doi:10.1086/590567.

United Nations Conference on Trade and Development. Statistics. Data Protection and Privacy Law Worldwide. 25 April 2020.

Voigt, Paul; A. von dem Bussche. The EU General Data Protection Regulation (GDPR) – A Practical Guide. Gewerbestrasse: Springer International Publishing, 2017.

---

---