Never before has data protection been put to the test in a global crisis of such magnitude as the COVID-19 pandemic, as personal rights and freedoms take a back seat to protecting public health. Different countries have taken different routes in fighting the pandemic within their borders. Those hit the hardest require tighter measures to prevent grave consequences for their population and health systems, and tighter measures mean a higher level of intrusion into personal rights and the right to protection of personal data among others.
Croatia currently has a moderate epidemiologic situation and as restrictive measures and limits on mobility were introduced early on, the number of infected persons and persons requiring hospital care is among the lowest in the world.
Despite this fact, the government has initiated amendments to the Electronic Communications Act (Official Gazette 73/2008, 90/2011, 133/2012, 80/2013, 71/2014 and 72/2017) enabling the legal use of mobile data as an additional tool in its strategy to combat the spread of COVID-19. However, the process has been deterred by the opposition finding the amendments potentially unconstitutional and unjustified.
The existing Electronic Communications Act implements the EU ePrivacy Directive (2009/136/EC), which provides for the principle that location data can be used only when is anonymized or with the data subject's consent. When it is impossible to process data anonymously, Article 15 of the EU ePrivacy Directive enables EU member states to introduce legislative measures pursuing national security and public security.
In an official statement on the processing of personal information in the context of the COVID-19 outbreak, the European Data Protection Board stated that this emergency legislation is possible under the condition that it constitutes a necessary, appropriate and proportionate measure within a democratic society. Further, the European Data Protection Board added that if such measures are introduced, EU member states must put in place adequate safeguards, such as granting individuals the right to judicial remedy.
Croatia decided to exercise its right under Article 15 of the EU ePrivacy Directive to introduce additional legislative measures to use non-anonymous mobile data without the data subject's consent in situations of national emergency. The government passed a bill amending the Electronic Communications Act and sent it to Parliament in an urgent procedure; however, due to the opposition's disagreement, the process is still underway and its result still uncertain.
Article 104 of the Electronic Communications Act stipulates that:
Location data other than traffic data, relating to subscribers or users of public communications networks or publicly available electronic communications services may only be processed when they are made anonymous, or with the consent of the users or subscribers in the manner and for the duration necessary for the provision of a value-added service.
As Article 104 does not account for situations when processing location data other than traffic data could help to protect people's health and lives, an additional Article 104a was proposed, which would exceptionally permit the processing of such location data with the aim of protecting public safety, if people's lives and health cannot be efficiently protected otherwise. The additional exception to a general prohibition on location data processing is limited to emergency situations.
The new Article 104.a(1) would read as follows:
As an exception to Article 104 of this Act, processing location data without traffic data is allowed in the interest of protection of national and/or public safety in such cases when the Government of Republic of Croatia has declared a natural disturbance or disaster or when the minister in charge of health has declared an infectious disease epidemic or danger of an infectious disease epidemic, in line with special regulations, if the health and lives of citizens could not be efficiently protected without processing that data.
Further, the amendments oblige operators of public communication networks to provide the competent body with the relevant location data if requested to do so by the minister in charge of health or the natural disturbance or disaster declared. The competent body in this case is the state administration body in charge of civil protection affairs.
To give an example of the practical application of these provisions, the new amendments would allow the actual location of those instructed to self-isolate to be checked. A total of 1,053 violations of self-isolation measures were recorded by the police in Croatia by the end of March 2020 and there are approximately 20,000 people prescribed the same measure. Not respecting the civil protection recommendations was a significant problem in Italy at the beginning of their struggles with the COVID-19 pandemic, where anonymous mobile data discovered that 40% of people in Lombardy, the hardest-hit region, were still moving about when instructed to stay in their homes.
The protection of personal data is a constitutional right in accordance with Article 37.1 of the Constitution (Official Gazette 56/90, 135/97, 8/98, 113/00, 124/00, 28/01, 41/01, 55/01, 76/10, 85/10 and 05/14), which guarantees the security and confidentiality of personal data to every individual. Any limitation of this right must be carefully considered, proportionate and necessary, which is why the proposed amendments, which are broad and general in nature, have been criticised in public.
The main concerns and objections to the bill, raised by the opposition, can be summarised as follows:
- The group of people whose location can be tracked must be limited and clearly defined (eg, only people in prescribed self-isolation).
- Individuals must be informed about any tracking.
- The precise duration of such tracking needs to be determined.
- Further procedures for handling collected data must be prescribed.
- Supervision over conducting such actions is required.
While the bill awaits its second reading in Parliament, a Constitutional Court judge has publicly criticised some other actions taken by the authorities during the COVID-19 outbreak, drawing attention to essential constitutional issues raised by the pandemic. In an article, the judge stated that "in the long run, the damage to democracy is greater than the damage caused by any virus".(1) However, so far there have been no interventions by the Constitutional Court regarding the state authorities' procedures and actions undertaken during the health crisis. In an official statement following the article's publication, the Constitutional Court confirmed that it is carefully monitoring the situation and at present there is no need to intervene.
Endnotes
(1) "Constitutionality in the Age of Virus" available here in Croatian.
