The rapid spread of the Coronavirus prompted almost as rapid a response by those countries affected. To respond to the public health emergency, and in an effort to eradicate the virus, several States have implemented a number of cyber surveillance mechanisms, some of which allow for contact tracing and the identification of the geographical location of potentially infected individuals. Although these electronic surveillance measures serve a reasonable purpose with regards to public health, they also present a slippery slope in terms of potential human rights violations, including the right to private life.
Predating the COVID-19 pandemic, in 2013, the UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression warned that technological advances could represent an opportunity for States to take part in anti-privacy surveillance activities.
Today, tracing and geolocalization technologies allow governments to collect data on how people behave and move around. This data can, for example, inform individuals if they have been exposed to the virus, and therefore allows them to seek healthcare as soon as possible. Given the urgent nature of the current situation, the use of such mechanisms can only be justified if their true purpose is to fight the pandemic. In addition, these measures must satisfy any applicable legality, necessity, and proportionality tests.
Technology does have a role to play in preventing the spread of the virus, but it must be seen to that these mechanisms are not used for purposes other than those for which they were originally intended to serve, namely slowing the spread of COVID-19, and not for any purpose beyond the context of the crisis.
Article 17 of the International Covenant on Civil and Political Rights (ICCPR) states that:
This article also protects the right to privacy in the digital realm.
The United Nations High Commissioner for Human Rights took a closer look at the topic of secret electronic State surveillance, in a report on the right to privacy in the digital age.
Such measures should only be taken to prevent violations, fight the most serious threats, or investigate such violations or threats. The duration of the implementation of any given measure to achieve a specific goal must be limited to the strict minimum. Using and storing collected data must comply with strict rules, and the circumstances in which said data is deleted must be clearly defined and in line with any relevant necessity and proportionality requirements.
In the context of the pandemic, the Inter-American Commission on Human Rights has recalled that States have a duty to disclose the surveillance mechanisms they use, and the purpose that these mechanisms serve, and that States must implement an independent system to control their use.
Data security posed a major problem even before the crisis. Between 2018 and 2019, at least 28 million Canadians were affected by personal data leaks, a figure that vastly speaks to the importance of protecting online data.
Some States that collect data on their population are taking the necessary measures to ensure the protection of this data. Others are not. Failure to take any form of precautionary action could result in sensitive and confidential information leaking, including information a person’s location, and could put some individuals in significant danger—among these, human rights defenders.
The Alerta Guate case is a good illustration of the risks associated with collecting personal data. Alerta Guate is an application that aims to keep Guatemalans up to date on governmental measures regarding COVID-19. Since the application’s release, however, an analysis conducted by Global Witness has shown that the Android version of the application was sending precise user locations to the app developer on a regular basis, even when the application was closed.
In a country like Guatemala where, according to independent newspaper Nómada, the government has previously conducted a mass cyber surveillance operation, there is a risk that the data collected by Alerta Guate is being misused. And given the regular persecution human rights defenders face in Guatemala, using an application like Alerta Guate could significantly hinder their actions.
The dangers associated with the application were raised by Human Rights Ombudsperson Jordan Rodas once the government failed to limit its use once the country ended its lockdown. Rodas described the situation as posing an “extremely high risk to democracy and civil liberties” [free translation].
As States start to ease lockdown measures, it is essential that governments respond to concerns that have been expressed with regard to the protection of data collected that has served as part of the response to the public health emergency. The pandemic must not diminish respect for human rights, neither during the crisis, nor once it passes.
The World Health Organization has published a series of documents that specifically address the use of technology as a means to protect public health.