COVID-19 makes us realize that a pandemic does not only constitute a serious risk to human health, but is also likely to have a serious impact on personal data protection too.
Decision-makers aim to stop and control the pandemic by various means, and by commissioning and launching new applications. These apps serve different purposes in the fight against the pandemic. While some of them assist in documentation (documenting the health status of the infected people or their location), others aim to model the spread of the pandemic and assisting with contact tracing.
From a privacy perspective, some of the most questioned applications are contact tracing apps. These increase the effectiveness and swiftness of interruption to the infection chain. Instead of personal interviews conducted by the relevant agencies, the app lists the locations where users have been in a given period of time and those with whom they have met. In the case of a confirmed infection, the application is able to notify potentially infected people. The app may store users’ identification data, health and location data. With this, the state is able to draw further conclusions regarding users’ lifestyles (hobbies, habits), social status (from places visited), health condition and social network, which may violate users’ right to privacy and serve as the basis of future decisions.
To protect users’ right to privacy, users must have a choice to decide whether they are prepared to allow such wide-ranging insight into their private lives through contact trancing apps in the interests of disease control. In the lack of common European regulation, the dilemma of “voluntariness” was solved by the European Commission and the European Data Protection Board by issuing guidelines in which they took a position on the voluntary use of these apps. Voluntary use does not only mean that the app shall be downloaded voluntarily, but also means that users must have the right to freely choose whether or not they share information as to their infection with others. European bodies made a number of recommendations in light of the current common data protection regulations, which set out the regulatory framework for the operation of such apps. Among these, it must be highlighted that the European bodies clearly state that contract tracing apps shall not collect users’ location data for contact tracing purposes, considering the principle of data minimization and data protection by design and default, because the proximity data may be gathered in another way, via Bluetooth technology. The proximity data shall be stored on the users’ device to notify potentially infected people, without disclosing any personal data, in the case of a confirmed contamination.
In Hungary two COVID-19 related applications are currently available, both on voluntary basis. VírusRadar is a contact tracing app which allows the user to inform the apps’ community about his or her infection by sending a notification. The notification reaches out to those who have been in contact with the infected person within the previous two weeks for at least 20 minutes within 2-meter distance. Thereby, the notified contacts are encouraged to carry out tests or to be placed in self-isolation in line with the pandemic protocols. The other application, called Házi Karantén Rendszer (“HKR”), facilitates the assessment of compliance with the home quarantine rules remotely. Home quarantined people are free to decide whether they would like to be subject to a personal official control carried out by authorities or instead they may agree to use this application. The application of HKR may substitute the personal inspection. This app tracks the motion of the user and is capable of transferring facial image and health data of the user to the respective authorities for monitoring purposes, which are stored for 60 days after the end of the home quarantine. ***
The necessity and the lawfulness of the surveillance of citizens is not a newborn concept. A survey carried out by Comparitech(1) in 2019 found that London was the most observed city, having 68.4 cameras to watch over every 1,000 Londoners; this ratio was significantly lower in Hungary, at only 3.4 cameras per 1,000 inhabitants. However, using these kinds of apps extensively increases our digital imprint and decreases our private sphere, thereby we may lose the control over our personal data.