How have the governments of the 55 countries party to "Convention 108" on data protection been able to urgently address this unprecedented Covid-19 crisis? What shortcomings in the protection of privacy and personal data have been identified in some of the legal and technical measures taken to prevent the spread of the pandemic?
2020 has been a turning point on many grounds, including in respect of data protection.
Challenges faced worldwide by societies, governments and health care systems provided a unique opportunity to reaffirm our founding values of democracy, rule of law and human rights. When confronted with the Covid-19 health crisis, governments have been seeking to protect their populations and responding effectively to urgent and vital needs. Emergency measures were adopted that have affected the enjoyment of the rights to privacy and data protection. At the same time, the use of technologies providing distance communication in lieu of human contacts, and algorithms replacing human intervention simply exploded. Digital technologies used in public places to monitor population, at home, while teleworking or self-diagnosing, or when learning remotely, became the new ‘normal’ of our lives.
The manner in which the health crisis has been addressed prompts a reaffirmation of the resilience of the data protection principles as a key component of the effective functioning of our democracies.Greater awareness and compliance with those requirements contribute to increase the individuals’ trust in actions taken by their governments and a greater acceptance of the measures adopted in the general interest. The future lies in our capacity to react promptly to new challenges without undermining our core values and putting our societies at greater risk on the longer term than do the present threats we have to address.
This report takes stock of the digital solutions adopted or planned in the context of the Covid-19 in over 50 countries from Africa, Europe and Latin America. It gives insights on the legal and technical measures that were adopted, and of their impact on data protection.
EXECUTIVE SUMMARY INTRODUCTION I. LEGAL ANALYSIS OF THE LEGISLATIVE DEVELOPMENTS
A. Emergency measures
B. Analysis of the impact on specific provisions of Convention 108 and Convention 108+
1. Legal basis
2. Purpose limitation, storage and sharing of data
3. Proportionality
4. Security measures
5. Transparency
6. Rights of the data subjects
7. Automated decision making and use of AI
8. Accountability, privacy impact assessment, privacy by design and by default
9. Transborder data flows
10. Enforcement and sanctions
C. Specific legislation and processing of personal data
1. Mobile applications
2. Use of traffic and location data from mobile phones and apps
3. Other digital solutions
4. Increase of teleworking and distance learning
II. A CASE-STUDY: THE USE OF DIGITAL SOLUTIONS
A. Digital contact tracing apps
1. Centralised tracing apps
2. Decentralised tracing apps
B. Other purposes
C. Public engagement and private sector involvement
D. Transparency and Open source
E. Users’ expectations
