Written Evidence Submitted by Professor Raphael Cohen-Almagor

(CLL0032)

COVID-19 and the Right to privacy

This short report explains in bullet points the medical aspects of tracking COVID and then the technological aspects of the challenge. Some general Premises are outlined to guide the reasoning. Then, arguments for Track and Trace and arguments against are presented. I will be making some useful distinctions between the types of collected information, and between different interest groups that are important for the analysis of the legal aspects in balancing between conflicting interests. The Report concludes with a practical Proposal: Reasonable Requirements for Track and Trace.

Medical Aspects

• From the moment of infection, 2 to 14 days will pass until the onset of the disease.
• The symptomatic period of the disease is probably the most contagious.
• The contagious period is currently estimated to be 7-14 days after infection.
• To interrupt the chain of infection, we need to know who is ill, and who are the people who came in contact with a patient during about ten days prior to the onset of symptoms.
• Contact means someone who is within two feet of a verified patient, for at least 15 minutes.
• Older people and people who suffer from background conditions are the most vulnerable.
• Fast and accurate action is required.

Technological Aspects

• The UK is a leading startup nation
• ‘Emergency’ Cyber Measures to Track Coronavirus
• Contact Tracing Technologies can assist in identifying contacts in order to curtail the spread of the disease.
• Track the cellphones of those who may have the coronavirus.
• When a person is diagnosed with the virus, she is required to help in constructing a map of her movements in the relevant period.

• The application compares the places in which the user was with routes of verified patients, in order to locate possible overlap/meeting points.
• Considers how much time they were together in the same place.
• If less than 15 minutes, nothing is done.
• 15 minutes or more, letters from Health Ministry, ordering self-isolation for 14 days
• Police/civilian inspections (by phone, physical inspection).

Premises

• Health considerations do not prescribe the right to do unjustifiable harm to others.
• Privacy is commonly understood as insulation from observability, a value asserted by individuals against the demands of a curious and intrusive society.
• Its violation is demeaning to our individuality, an affront to our dignity.
• Institutions of a decent society should not encroach unnecessarily into the private lives of individuals.
• We all should enjoy a certain “halo”.
• Private v public sphere.
• Private matter should preferably remain private.
• Health is a private matter.
• Trust in government is important.
• Accentuate social solidarity.

Arguments for Track-and-Trace

• Extreme circumstances call for extreme measures
• Need for prompt action
• Saving life: Patients have an interest to receive prompt treatment
• Patients have an interest not to infect others, especially their loved ones
• Quick fix
• Helps to enforce the law.

Arguments against Track-and-Trace

• Sick and infected people, as well as contacts, have privacy interests and rights regarding the data
• When an individual receives a text message from the Ministry of Health they are legally obliged to isolate themselves. But what happens if the system is wrong?
• No possibility for appeal
• Restraining people needlessly
• Harming the job market and economy
• There is no quick fix
• People leave their phones at home and go anywhere they wish
• Make citizens feel like criminals
• Slippery slope.

Types of collected information

• A distinction should be made between the types of collected information:

      medical information,

      location and movement data,

      information on relationships between people.

Medical information

• Prima facie personal.
• Obligation to report if infected.
• Report ONLY to health authorities.

Location and movement data

• Person's location and movement data are personal information and protected by privacy protection norms and laws.
• The location and movement reveal lifestyle, economic status, religious beliefs and practices, social behavior and sexual preferences.

Interpersonal relationships

• Information on interpersonal relationships is also protected by privacy protection norms and laws.
• Such information reveals sensitive information about the person, her beliefs, economic status, sexual preferences etc. 

Balancing interests

• Of patients;
• Of patient’s family and loved ones;
• Of the medical professionals;
• Of others;
• Of society at large.

They all have an interest to know about infection asap.

Legal aspects

• Privacy is not an absolute right.
• The state is allowed to infringe on privacy, but only if:
• there is appropriate certification in law,
• if the harm is for a proper purpose, and
• only to the extent that it does not exceed what is required.

Balancing

• Social responsibility: protecting lives and human rights
• Balancing act that requires sensitivity and accountability
• Need to develop a transparent organizational and governance infrastructure around these

apps

• Communication and transparency are paramount.

Proposal: Requirements for Track and Trace

• Promote and encourage the use of civilian technology to locate those who have been in close contact with patients
• Run by the Ministry of Health
• Voluntary use, with citizens’ informed consent and free will
• Develop a detailed, ethical policy
• Respect for people’s privacy
• Using technology only for the purpose of saving life
• Protect people’s data
• Do not retain personal data beyond necessary
• Limiting surveillance to the minimum necessary to overcome the crisis
• Prevent abuse: Do not let data stream to others interested parties, e.g. commercial firms
• Prohibition on the collection of excess information
• Obligation of purposefulness (according to which the information collected will not be used for any purpose other than locating the contacts)
• Duty of information security
• Clear legal sanctions against those who violate the above guidelines.

Bear in mind that:

• technology alone is not the solution.
• Voluntary track-and-trace are limited.
• Not everyone will use them.
• Technology should be part of a comprehensive plan that addresses social, economic and health concerns.
• If applied correctly with communication and transparency, it may make lockdown unnecessary.
• If applied too late and the pandemic is rampant, track-and-trace is ineffective. You cannot monitor the movements of millions of people.

(November 2020)