“Covid-19(84)”. Mass surveillance, State control and civil liberties in times of pandemic

a cura di Avv. Piero De Rosa

The worldwide spread of the SARS-CoV-2 disease (commonly known as Covid-19) has highlighted the conflict between privacy and security that our democracies have been called to face over the last year. The constant threat of an uncontrolled contagion has brought to the fore the notion of security, understood as a co-essential element to the quality of life and claimed as condition for exercising other civil liberties.

Thomas Hobbes (in “Leviathan” published in 1651) already built his state doctrine on the intrinsic value of security which, according to the philosopher, represented the objective and value of State’s sovereignty: it is the need for security against mutual aggression that induces individuals to reunite and submit to the monarch.

From the Hobbesian idea of ​​security as foundation of power – and, in some ways, of legality itself – comes the concept of security understood as a right. Following the French Revolution in 1789, the Déclaration des droits de l’homme et du citoyen places, in Article 2, the “right to security” among the natural and inalienable rights of man, alongside freedom, property, resistance and oppression.

Hence the primary issue of the relationship between freedom and security.

Nowadays, the right to security enjoys a partially autonomous legal status – as a right to a protected existence – and as a complementary tool for the exercise of other rights, that is, as a claim to the quality of collective and individual life.

Therefore, security can be qualified as an asset inextricably tied to life, physical safety, as well as to the dignity of the person. Accordingly, its ownership, in addition to the State’s interest in guaranteeing a situation of social harmony, belongs to everyone as the right to a protected existence, indispensable for the exercise of other civil freedoms under secure conditions.

Security, then, is not entrusted to an absolute power, but becomes a citizen’s right – and appears in a context in which it is compared and placed side by side with other values – which define the conditions within which security can be achieved.

In this regard, security, rather than being the final objective, becomes a tool for increasing other freedoms: security is essential both as a state activity to protect citizens from social risks and dangers, and as a fundamental right in exercising civil liberties and in narrowing inequalities.

The rule of law, which guarantees legal certainty, has evolved into a preventive state which must directly protect critical legal assets.

To this end, the global health alarm raised by the Covid-19 emergency has shaken the national leaderships, unable to take responsibility for proceeding with a new (and necessary) general lockdown, once again discharging on private third parties the burden of supervising and implementing the operational tools to assert the right to security.

In this context, questions arose about the admissibility of surveillance measures based on computer tracking of movements of individuals positive to Covid-19 and the subsequent test administration for those who had close contacts with them during the virus incubation period.

In principle, there do not seem to be any constitutional obstacles to the introduction of devices that affect the privacy of the population as long as they are exclusively aimed at containing the epidemic and for the time strictly necessary to exit the emergency. In application of the proportionality principle, it is possible to assume the existence of a real obligation of the public authorities to adopt “active surveillance” measures aimed at bringing promptly the epidemic situation under control.

Moreover, in terms of the legitimacy of administrative choices, a strategy based on targeted testing determines a representation of the epidemic situation that is more faithful to reality, allowing the competent authorities to make better-informed decisions regarding the possible relaxation or reintroduction of social distancing measures considering that a contagion control situation constitutes the prerequisite for loosening the compression to fundamental freedoms resulting from the blocking of movements.

The progressive re-expansion of fundamental freedoms (and the right to health itself) largely depends on the efficiency of the controls carried out, but it cannot be denied that their accuracy also implies (limited) intrusions into the private life of citizens. In any case, the measure of a general lockdown, as far as necessary when the contagion is out of control, has shown slow and modest effects on the containment of the epidemic if not associated with a policy of identifying the subjects positive to virus (even asymptomatic)[1].

The possibility to introduce active surveillance measures is also well correlated with a precautionary principle which, in health matters, requires the public decision-maker, in specific contexts, to prefer the solution that makes possible the balance between the minimization of risks and the maximization of advantages, through the identification, based on a proportionality test, of an acceptable danger threshold[2].

For this reason, the European Centre for Disease Prevention and Control (ECDC) has specifically recommended to the health authorities of the EU Member States to resort to tracing the contacts of confirmed or even suspected positives as an essential measure to counter the spread of the epidemic, in synergy with social distancing measures as the tracing allows to isolate the chain of contagion and to reduce the potential spread of the epidemic[3].

With the EU Recommendation 2020/518, the European Commission has also announced that since the beginning of the Covid-19 crisis, various mobile applications have been developed with three main functions: i) inform citizens and facilitate the organization of medical follow-up for symptomatic people; ii) alert people who have been in the proximity of an infected person; iii) monitor the quarantine and control its compliance by the infected person[4].

That said, the European Commission – hoping for a holistic approach by the Member States in the data exchange between mobile applications developed at national level – has raised concerns regarding the protection of privacy and protection of personal data in relation to the employment of geolocation tools.

On this point, the European Data Protection Board (EDPB) stated that the rules on the protection of personal data do not prevent the adoption of measures to counter the Covid-19 pandemic (including geolocation) for the purpose of tracing the contacts of positives, as long as the data are anonymized[5].

However, with Guidelines n. 4/2020, the EDPB has clarified that computer tracking measures constitute a serious interference in private life and that they can only be legitimized on a voluntary acceptance by users based on the specific purposes that the application intends to pursue. This does not necessarily imply that the data processing must rest on consent if the public authorities provide a public interest service in line with EU-GDPR Article 6, par. 1 letter e)[6].

Anyhow, both national and European authorities’ indications seem to adopt a too broad approach, not distinguishing the position of the positive detected patients from those of the subjects who have had a mere contact with them: only the former constitutes a real threat to the collective security (justifying, also from a proportionality perspective, the derogation from data privacy right), regardless the voluntary adherence to the contact tracing system[7].

[1] Giordano, G., Blanchini, F., Bruno, R. et al. Modelling the COVID-19 epidemic and implementation of population-wide interventions in Italy. Nat Med 26, 855–860 (2020). https://www.nature.com/articles/s41591-020-0883-7

[2] Italian State Council opinion, September 26, 2017 n. 2065.

[3] European Centre for Disease Prevention and Control, Contact tracing: public health management of persons, including healthcare workers, who have had contact with COVID-19 cases in the European Union – third update. https://www.ecdc.europa.eu/en/covid-19-contact-tracing-public-health-management

[4] Commission Recommendation (EU) 2020/518 of 8 April 2020 on a common Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis, in particular concerning mobile applications and the use of anonymised mobility data, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32020H0518

[5] EDPB, Statement on the processing of personal data in the context of the COVID-19 outbreak, https://edpb.europa.eu/news/news/2020/statement-processing-personal-data-context-covid-19-outbreak_it

[6] Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak https://edpb.europa.eu/our-work-tools/our-documents/ohjeet/guidelines-042020-use-location-data-and-contact-tracing-tools_en

[7]  Tomas Pueyo, Coronavirus: How to Do Testing and Contact Tracing, available at https://tomaspueyo.medium.com/coronavirus-how-to-do-testing-and-contact-tracing-bde85b64072e