Will the government track me and know where I am at all times? Will they be able to find me if I leave the house? Will they geolocate me to find out if I am infected with COVID-19? These and other similar questions are becoming more widespread, spreading an enormous concern not for health but for personal protection, since on 28 March an order was published in Spain by the Ministry of Health for “the development of various actions for the management of the health crisis caused by COVID-19” (Order SND/297/2020, 27 March).
The aim of the measure is to improve the management of the health crisis and, to this end, “to have real information on people’s mobility in the days leading up to and during confinement”. For this reason, the Ministry of Economic Affairs and Digital Transformation will be responsible for the urgent development and operation of an IT application to support the management of the health crisis caused by the COVID-19.
The national application called ASISTENCIACOVID19 will allow the user to perform the self-assessment of symptoms and will provide information, practical advice and recommendations to be followed according to the assessment.
Also Read: Sensor-based logistics by FedEx: New hope to fight COVID-19
According to the Ministerial Order, the application will allow “the geolocation of the user for the sole purpose of verifying that he is in the autonomous community in which he declares to be”. Therefore, in addition to collecting data such as name, mobile phone number (for sending SMS), DNI or NIE (for later crossing with the health card), full address or date of birth, geolocation is an optional piece of information that requires the consent of the application user.
The location of the user’s mobile phone via GPS, according to the standard, only allows us to know where the user is in order to offer preventive and evaluation measures. According to the privacy policy, “geolocation will only be used when registering and performing your self-assessment (…). Your location is not tracked for purposes other than those stated”.
Likewise, the Ministry of Health informs in the legal texts of this important warning: “All information will be collected for purposes strictly in the public interest in the field of public health, and in the face of the health emergency decreed, in order to protect and safeguard an essential interest in people’s lives, in the terms described in this privacy policy”. However, it is a concern that by specifying how the data is obtained, it opens the possibility for it to be “observed when you use the Application or that we obtain from your device (e.g. your device’s operating system, or your GPS location)”. This will facilitate not only the prevention or cure of COVID19 thanks to geolocation, but also a possible “permanent surveillance” of the citizen.
Also Read: Location technology and GIS in predictive disaster mitigation, and search and rescue
It seems contradictory that this privacy policy is unclear in specifying the legal basis for the processing of personal data, including geolocation. On the one hand, it states that the data is provided directly by the user and is based on his or her express consent to use the application. But, on the other hand, it determines in too generic a manner that “they will be processed for purposes strictly in the public interest in the field of public health, in view of the current health emergency resulting from the COVID-19 pandemic and the need to control and propagate it, as well as to guarantee vital interests of yours or of third parties”.
To this indetermination is added the fact that the Ministerial Order entrusts the Secretary of State for Digitalization and Artificial Intelligence, of the Ministry of Economic Affairs and Digital Transformation, with “analyzing the mobility of people in the days prior to and during confinement”.
It is surprising that it is not specified “until how many days before” it can be geolocated, which creates legal uncertainty: since the virus appeared in China, when it arrived in Spain, when the government declared the state of alarm, or even when the government determined it at its own discretion? In addition, the Order refers to following the controversial model undertaken at the time by the National Institute of Statistics (INE) in the study of mobility and through the crossing of data from mobile operators, even if it was in an aggregate and anonymous way, as the COVID apps would identify each citizen who uses it.
Also Read: How a network-based solution could be the key to combatting GNSS outages
The Order affects a matter that compromises the fundamental right to data protection, which is protected in Europe by the General Data Protection Regulation of 2016 and in Spain by the Organic Law of 2018 on the Protection of Personal Data and the Guarantee of Digital Rights.
In this sense, the criteria of the Spanish Data Protection Agency (AEPD) on Coronavirus self-assessment apps and websites recall two key aspects: the first, regarding the current situation, is that “this emergency situation cannot imply a suspension of the fundamental right to the protection of personal data”. And the second, on public health, is that “data protection regulations cannot be used to hinder or limit the effectiveness of the measures adopted by the competent authorities, especially health authorities, in the fight against the epidemic”.
The AEPD has recalled that in order for the processing of personal health data to be lawful, those citizens who have tested positive for COVID-19 may only be geolocated through their mobile phone, provided that they have previously provided it. For greater clarity, the AEPD has established the only geolocation data that could be provided to telecommunications operators: the mobile phone number. And there is only one exception: the Ministry of Health considers that it is essential to provide some other information for the purposes of monitoring the disease.
In short, these legal measures to protect the rights of citizens are compatible with the fact that the competent health authorities, in order to prevent the spread of the virus, must monitor those who are infected, or must also know the areas with the greatest number of people affected in order to adopt the appropriate health measures.
