Notes

Two models to be compared «In the vocabulary of the Chinese», says the philosopher Byung chul Han, «the term "private sphere" does not appear, which has facilitated the construction of a whole infrastructure for surveillance that is highly effective in containing an epidemic». «Digitalization is a collective thrill beyond individualism. In Europe the systemic use of big data would be, as it happens in Asia, much efficient than to rise again borders and walls. But such systemic use is not possible for the legal regime of protection of fundamental rights in Europe».

Is there a real trade-off between using new technologies to contain the spread of Covid-19 and protecting human rights?

• Which remedies are we considering? i.e., what do we mean by 'contact tracing'?
  • Enforcement measures?
  • Tracking measures?
• How to design such technological solutions?

China: Massive Surveillance

• Before people can do things like ride the subway or enter a crowded shopping mall, they have to prove they are at low risk of having Covid-19, by scanning a government-mandated QR "health code" on their cellphone that's either green (likely Covid-19 free), yellow (at risk of Covid-19), or red (likely Covid-19 positive); the code is based on information like a user's location and their medical and travel history, which is informed in part by a government questionnaire.
• Individuals generate these codes through a governmental tool named 'Health Code' in Alipay and WeChat, that nearly every citizen has installed on their phones and that they use to do everything from chatting to buying basic goods to hailing rides.
• Large resort to facial recognition techniques to control the activity of citizens. (Not only to preventing the outbreak of the virus, but also to improve a gradually lifting of the lockdown).
• In mid-February, local governments began lifting strict lockdown orders and private companies began rolling out app add-ons that help the government determine who can start safely leaving their house again without infecting others.
• General monitoring is made possible because of the use of app such as Alipay and WeChat in conjunction with other techniques (surveillance in public places, smart cities data..).

(China imposed the more restrictive measures, which proved to be among the more effective).

South Korea: COVID-19 Smart Management System (SMS)

(South Korea was almost ready and had an already organized system to deal with the pandemic, in addition to the fact, that Korea, is the "most connected" country in the world, which allowed the government to strictly control the citizens.)

South Korea: Corona 100

• South Korea's Centers for Disease Control and Prevention (KCDC) runs the contact tracing system that collects data from 28 organizations (the Police Agency, the Credit Finance Association, three smartphone companies, and 22 credit card companies)
• This system takes 10 minutes to analyze the movement of the infected individuals:
  • For people who come in contact with an infected person, the KCDC informs the local public health center near the infected citizen's residence and the health center sends the notification to them.
  • If they test positive, they are hospitalized at the COVID-19 special facilities. Those without symptoms are asked to remain self-quarantined for 14 days.
• Only epidemic investigators at KCDC can access the location information and once the COVID-19 outbreak is over, the personal information used for the contact tracing will be canceled.

Singapore

• Enforcement Measures
• TraceTogether

  "Instead of attempting to tackle the issue of contact tracing by answering the question of 'where,' we address contact tracing by answering the question of 'who', [...] the virus doesn't care where transmission happens; it's only interested in whether there is a hospitable host in close contact" (Jason Bay, Senior Director of Government Digital Services at GovTech).

• On a voluntary basis
• Using Bluetooth
• Data regarding interactions are stored locally, subject to encryption and then sent to the Ministry of Health in case the user is infected.

Israel: HaMagen (The Shield)

• Downloaded on a voluntary basis (by 1.5. milion Israelis) it alerts users who have crossed paths with a coronavirus patient.
• Users' personal and location data remain on their phones and are not available to others
• Possibility for users to cancel data.
• It allows users to decide whether to report their exposure to the coronavirus to the Ministry of Health.
• Open source.
• Limited duration (April 30).
• Problem: which legal basis for the tracking tool?
• First, emergency legislation (no legal scrutiny).
• Then, order of the Government based on emergency legislation and review by Knesset: order with limited duration, expired on April 30.
• Supreme Court: emergency legislation does not constitute the proper legal ground, as contrast to Covid-19 does not stand as a matter of national security.
• Parallely, Knesset had already suspended police use of cellphone data to enforce coronavirus quarantines adopted on the same legal basis.

Europe, EU law:

• Art. 6 GDPR

Processing shall be lawful only if and to the extent that at least one of the following applies:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes [...].
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Art. 9 GDPR

Regulates the processing of particular categories of personal data (e.g., data concerning health): «personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited». Paragraph 1 shall not apply if one of the following applies: [...] processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject.

The Debate on Contact Tracing in Europe What do we mean by contact tracing? A variety of options:

• Use of statistical data generated on anonymous basis to measure the degree of crowdedness of public places (e.g. Municipality of Milan / Lombardy region): use of mobile phone towers.
• Use of traffic and location data to monitor compliance with stay-at-home orders/obligations (e.g. for those tested positive to Covid-19).
• Tracing and alerting contacts which crossed the path of patients tested positive within a given timeframe (e.g. 14 days) with a significant risk exposure (via BT or GPS signals). (In Italy only the Bluetooth will be used).

The Italian way (modeled on the Singaporean and Israeli paradigms):

• Alerting contacts which crossed the path of patients tested positive within a given timeframe with a significant risk exposure (via Bluetooth signals).
• Tracing may therefore sound inaccurate, as no monitoring activity is implied.

EDPB (European Data Protection Board) guidelines

• Voluntary Adoption. The systematic and large-scale monitoring of location and/or contacts between natural persons is a grave intrusion into their privacy. It can only be legitimized by relying on a voluntary adoption by the users for each of the respective purposes. This would imply, in particular, that individuals who decide not to or cannot use such applications should not suffer from any disadvantage at all.

• Public Nature To ensure accountability, the controller of any contact tracing application should be clearly defined. The EDPB considers that the national health authorities could be the controllers for such application; other controllers may also be envisaged. In any cases, if the deployment of contact tracing apps involves different actors their roles and responsibilities must be clearly established from the outset and be explained to the users.

• Purpose Limitation In addition, with regard to the principle of purpose limitation, the purposes must be specific enough to exclude further processing for of the COVID- 19 health crisis (e.g., commercial or law enforcement purposes). Once the objective has been clearly defined, it will be necessary to ensure that the use of personal data is adequate, necessary and proportionate.

• Principles In the context of a contact tracing application, careful consideration should be given to the principle of data minimisation and data protection by design and by default:

• Contact tracing apps do not require tracking the location of individual users. Instead, proximity data should be used;

• As contact tracing applications can function without direct identification of individuals, appropriate measures should be put in place to prevent re-identification;

• The collected information should reside on the terminal equipment of the user and only the relevant information should be collected when absolutely necessary.

• Legal Basis Furthermore [...] the mere fact that the use of contact-tracing applications takes place on a voluntary basis does not mean that the processing of personal data will necessarily be based on consent. When public authorities provide a service based on a mandate assigned by and in line with requirements laid down by law, it appears that the most relevant legal basis for the processing is the necessity for the performance of a task in the public interest, i.e. Art. 6(1)(e) GDPR. The basis for the processing referred to in article 6(1)(e) shall be laid down by Union or Members State law to which the controller is subject. The purpose of the processing shall be determined in that legal basis or shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

• Safeguards The legal basis or legislative measure that provides the lawful basis for the use of contact tracing applications should, however, incorporate meaningful safeguards including a reference to the voluntary nature of the application. A clear specification of purpose and explicit limitations concerning the further use of personal data should be included, as well as a clear identification of the controller(s) involved. The categories of data as well as the entities to (and purposes for) which, the personal data may be disclosed should also be identified. Depending on the level of interference, additional safeguards should be incorporated, taking into account the nature, scope and purposes of the processing. Finally, the EDPB also recommends including, as soon as practicable, the criteria to determine when the application shall be dismantled, and which entity shall be responsible and accountable for making that determination.

The Italian Way: Immuni

• Voluntary Basis
• No prejudice affecting those who do not download the app
• Anonymous / Pseudonymous ID
• Alerting rather than tracking
• Controller: Ministry of Health
• Predominantly decentralized model
• Open-source app: "verifiable" code/functioning
• Adequate information notice prior to the download
• Data minimization: personal data collected are only those necessary for alerting users
• Anonymization, if possible; in any case, pseudonymization
• No user geolocalization (LE BT only)
• Automatic deletion of data at the end of the emergency.