It is crisis. And with crisis come measures. Super measures, intelligent measures like 'we' do in the Netherlands. We, the Dutch, who do not let what other countries do drive us crazy, but simply remain pragmatic and choose the intelligent lockdown. And stick to it. As good and bad as it goes.
They are also looking at how to make this intelligent lockdown even more intelligent. And do 'our' Mark and Hugo want to contain the virus by monitoring and directing behavior through mobile applications. It involves two applications: the first tells you if you have been near a person infected with Corona, and through the second you pass on possible symptoms to a nearby doctor.
The introduction of these applications could have huge implications for citizens' privacy. But is a breach of personal data protection necessarily going on here? Not necessarily.
Ministers indicate that the protection of personal data is an important aspect of introducing these applications. Privacy will be taken into account. The Personal Data Authority (AP) is also involved in the possible implementation of the proposed plans. The AP states that an emergency law may be required to put such applications into operation.
But is it? Looking at the past, an emergency law is not repealed once the emergency is over. So the question is whether an emergency law is proportional to the purpose to be served. The General Data Protection Regulation (AVG) is being passed over very quickly: does this law by itself not provide sufficient safeguards for the protection of personal data? In addition to the proper basis for processing, the AVG requires that a mobile application be built with the user's privacy in mind and that technical and organizational measures have been taken that protect personal data from unjustifiable intrusions.
It also cites consent as the ground for processing data. That's where the shoe wrings for the second time. Can the citizen see that privacy versus health is a false contradiction? Is she capable of making this assessment herself, or should she be protected in this by both the government and the AP?
Again, I argue for the legitimate interest as the ground for processing: that way, the responsibility for setting up privacy-friendly apps is placed on the government, with the AP as the controlling body.
Processing on the basis of legitimate interest means that the government is required to make a balancing of interests between the invasion of the user's privacy and the government's interest in introducing the apps to Dutch citizens. This balancing must be transparent. This means that it will have to demonstrate that general health is served by the introduction of these apps. That use of these apps means such a rapid or major containment of the virus that infringement of privacy is justified. It will have to be able to argue that the use of this technology will contain the spread of the virus faster than less far-reaching measures such as the intelligent lockdown as we use it now. That the intelligent lockdown is not enough and the danger to public health justifies invasion of the privacy of (almost all) citizens. The AP will have to test this balancing of interests.
The European Data Protection Board (EDPB) argues for a common European approach, stating that the AVG does provide sufficient safeguards to deploy technologies that prevent further proliferation. The European Data Protection Supervisor (EDPS) also endorses that view.
Along with this, the call to not let the AVG get in the way of a solution above all: "The GDPR clearly states that the processing of personal data should be designed to serve mankind."
The EDPS also recalls that privacy law is not an absolute right and always requires a balancing of interests:
"The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality."
By April 15, the EDPB will release a toolbox of guidelines to combat the crisis and ensure privacy rights. I look forward to seeing which basis it opts for.
This article can also be found in the files AVG and Coronavirus
