This articles comments on the use of governments of individuals personal data, including location data, to fight COVID-19.
Emergency estate context
In the emergency days we are living authorities must act using all the powers they have or might have due to the exceptional circumstances. The general regulations on emergency situations such as the emergency estate we are in, and the specific regulations approved to deal with all aspects of the pandemic of COVID-19 all over the world are similar.
In the efforts to control the virus all means are welcome. The use of personal data are very useful to fight the virus ocasting risk areas, to control population’s movements, to plan the use of the scarce public resources and to track the virus by identifying infected people, people at risk, etc.
Use of personal data
The use of personal is subject in the EU to specific regulations.
The general principles in the personal data treatments apply during these days more then ever. Health date are specilly sensitive data. The principles are that the treatment has to be legitimate and limited in time, scope, etc. according to the aim of the treatment, among others.
So governments can treat personal date in this situation. Health data as well of course as public health and many lives are at a stake.
We have to take into account that the regulations foresee that if personal data are aggregated and irreversible anonymised are not properly personal data as they cannot identify any specific person.
So, the personal data protection in these days applies as usual and as normal. The only difference is that the situation of the world is different and personal data treatment are also of a different kind and scope. But always according to the law. This article from a very reputable data protection expert explains it very well (available in Spanish only I am afraid). It mentions specifically the use of location data by the government. The Spanish Data Protection Agency has also published a report on the personal data treatments with regards to COVID-19 that you can read here in English if you wish.
Apps and webs asking for personal data including health data
During COVID-19 many public authorities and private companies have launched apps and webs relating to the virus (self-assessment and information sites mainly). Many of them are asking for personal date. For instance, if you use a self-assessment app you will be asked about your symptoms to give you an answer. Some of those apps and webs also ask for location data if you agree. You can see a comprehensive list of the apps and webs involved in this article (in Spanish). Also, the Spanish Data Protection Agency has made a communication on the landscape of apps and webs relating to COVID-19 that you can read here in English. This communication mentions the use of location data by the government. Also, the European Commission has made a recommendation on April the 8th on a common Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis, in particular concerning mobile applications and the use of anonymised mobility data that you can check here in English.
Use of data location by the government
Having said all the above it looks clear that our government is entitled to require and use location data aggregated and anonymised in order to fight the virus. It will help the government to control risk areas, populations movements and to make a more efficient use of public resources. Take into account that individuals’ movement restriction are in place legally during these days.
But this measure has been quite controversial. Partly, because the health data are more sensitive than other ones as this very reputable opinion explains.
Why this polemic of the use of location by the government to fight the COVID-19
As we already know the regulations state that aggregated and anonymised data are not personal data as they cannot identify any specific person. So, the protection does not apply because it is not necessary. But health date are very sensitive. Even though the Spanish government treats these data as if they were personal data and were subject to the regulations. And this is good! The government as any other person or entity treating personal data must comply with the regulations. And the government does. So, all it is legal and correct. And obviously the government is accountable for the personal data treatment. And here transparency is a must. Even more for the government. To begin with there is a regulation specifying the exact measures the government will implement and how they will do it. So, they can be controlled. Even if the regulations could be more specific and exhaustive, we have to take into account that these are emergency regulations. You can check the specific regulations here (in Spanish only again I am afraid).
So, we should trust that the government will use this data to control and fight the virus and only for this purpose, during the minimum time and using only the necessary data as it is required.
Opinion
After looking calmly at the use of PERSONAL DATA by the government during COVID-19 and specially location data which is legal and correct two questions arise to me. One is why we do not trust that governments will use our personal date only to fight the virus? It is the lack of a individual personal benefit why some people is reluctant to provide peresonal data to the governments to figth the virus?
If we compare the huge amonuts of personal data that we provide to the internet every single day (which is enough to trace our day by the minute even) with the personal data that the authorities need to fight this virus it looks to me unreasonable the lack of trust on the use of the location data the governments are asking for.
When I think about it I feel that it might be because when we provide data to the internet (to many private companies) we have an immediate and individual reward such as the use of an app, discover new places, get to the places, satisfaction on our scroll up in the social networks, prizes, information, or whatever you can think of. It is an immediate and individual reward. So it looks a fair exchange. And nowadays everybody knows that it is not free. Your personal data are the prize and the companies that received them use them to sell it to marketing companies, for their own use to sell to you, or to other uses we are not even aware of, or we do not want to know be because we do not care because we have already our individual and immediate reward which is what we what we want here and now. When we provide data to the government to fight the virus the reward is neither individual nor immediate. We understand it is good but we get very cautious and nervous and people say, hold on, why do you want my personal data for? Which personal data will you collect? What are you going to do with them? How long will you keep them? And why do you collect them? (well, it is obvious that there is pandemic now in my humble view so the reason is clear). And these really very good questions indeed. Bu it is obvious as well that we react very differently when our personal data are used by private companies than by the government. And I think this difference is based in the lack of trust in our governments. Pity. Now is when gevernments are more necessary and useful and we have to trust one another. Not only among peers but also our institutions.
What do we think that way? Are we that selfish that we do not care to give personal data to private companies for tiny rewards but we are so suspicious to do give them to public bodies when there is an urgent need as there is now? Maybe. Also, our institutions should think about why this lack of trust exists in such a way. At least, the government must be transparent and they are accountable for that. Private companies also must do the same but it can be much more difficult to make them accountable for it (we just have to remember the Cambridge Analytica scandal for instance).
I am happy now to give the necesary personal data to the government to fight the virus. I trust they will do treat them properly and I think it will be of great use.
Finally, after this crisis we have to reconsider many things about personal relationships, work, leisure, data protection, solidarity, globalization, that we are all linked in many more ways than we can think of whether we like it or not, essential things, things which are vital, priorities, etc. We will do. I am sure we all will do. Once this pass. Many lessons to learn. We were running too fast without having a clear finish or aim maybe. That is what I feel.
Meanwhile, let us the governments use our personal data including location data, as they might need. They will do it properly. This is what I think. Besides, any delay in using all the means to fight the virus it might be just translated into an increase in the figures of the daily virus’ victims all around the world. And I do not like at all the idea that that figure is bigger because of me honestly.
Thank you
Thank you for your time and attention and I hope this information is of use. You are very welcome to share if you liked it. You might be interested in this other posts on COVID-19 that you can check here, here and here.
Warning
Please, note that this is general information. This is not specific legal advice. It is advisable to seek legal advice for any specific legal issue.
And remember, take care and stay at home.