When Privacy Meets a Pandemic

Applying core international human rights principles to coronavirus-related privacy interferences

Photo: Paul Faith/Getty Images

InIn the face of the devastating coronavirus pandemic, governments around the world are deploying an array of public- and private-sector technologies, causing great concern and alarm among privacy advocates worldwide. Many privacy experts are calling on the need to favor more privacy-preserving technologies, take measures to mitigate the risks to individual privacy posed by specific technologies, and impose purpose and storage limitations (among other restrictions) on the use of any personal data collected by the technologies that are ultimately deployed.

One example of a specific measure causing alarm is known as contact tracing, or the process of identifying individuals who may have come into contact with an infected person (in this case, someone who has tested positive for Covid-19). While many public health experts agree that contact tracing and identifying a “patient zero” as the source of an outbreak, where possible, can be important measures to control the spread of a virus, there is also countervailing research and reports that question the efficacy of this tactic.

The World Health Organization explains that “watching these contacts after exposure to an infected person will help the contacts to get care and treatment, and will prevent further transmission of the virus.” But what if there is no care or treatment available to those identified? What if we still have the same number of hospital beds, personal protective equipment (such as face masks and gloves), and ventilators available, as is likely to be the case in the United States?

The measure is self-evidently invasive. Even while there may be specific techniques to enhance or preserve individual privacy in employing contact tracing, we have to ask: to what end? What happens if we trace people with no ability to help them? What if it just doesn’t work in some contexts? We especially have to ask these questions as some experimental methods of contact tracing are being entrusted to large for-profit tech companies.

There are few privacy absolutists in a crisis. While no one seriously questions the need for interventions that can protect public health and safety, the framing of many privacy-related concerns skips a fundamental step in the analysis — namely, asking when an interference with fundamental rights is justified. This analysis is grounded in core principles of international human rights law — something that is not particularly within Facebook or Google’s expertise. If the privacy community skips this critical step, we have already lost the battle to protect our fundamental rights.

As early as 1948, the international community agreed upon and articulated a set of “human rights and fundamental freedoms” in the Universal Declaration of Human Rights (UDHR). Though not binding, the UDHR served as the foundation of subsequent legally binding instruments that form the body of international and regional human rights law, including the International Covenant on Civil and Political Rights (ICCPR), the International Covenant on Economic, Social, and Cultural Rights (ICESCR), and the European Convention on Human Rights (ECHR), among others.

Even while there may be specific techniques to enhance or preserve individual privacy in employing contact tracing, we have to ask: to what end?

Human rights law aims to strike a fair balance between the general interests of the community at large and the protection of the fundamental rights of the individual.¹ Some fundamental rights and freedoms are absolute, meaning they are not subject to “derogations” or exceptions, even in times of war or emergency. Examples include the right to life,² the prohibition on torture,³ and the prohibition on slavery,⁴ among others.

Other rights are non-absolute and subject to derogations in times of war⁵ or a “public emergency.”⁶ For example, the ICCPR allows states to temporarily suspend or adjust their obligations “in time of public emergency which threatens the life of the nation.”⁷ In addition to such blanket emergency situations, some rights are also subject to limitations when necessary for certain legitimate objectives of the state.

Most relevant in the case of Covid-19 are derogations necessary for “the protection of public health or morals.” Rights subject to such derogations include the freedom of thought, conscience, and religion;⁸ the freedom of expression;⁹ the freedom of assembly and association;¹⁰ and the freedom of movement.¹¹ We see many of these rights, including the freedom of assembly and association and the freedom of movement, implicated and restricted in the context of the present coronavirus pandemic through prohibitions on group gatherings and orders to observe social distancing and shelter in place.

Privacy is a fundamental right recognized under international human rights law.¹² Although it is fundamental, it is not absolute. Rather, it is subject to certain derogations. Nevertheless, interferences may be justified only when prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.¹³ In some national contexts, this means the interference must not be “arbitrary.” These principles — legality, necessity, and proportionality — are among the core principles rooted in international human rights law and jurisprudence. They are always relevant, including, and perhaps especially, in emergencies.¹⁴

So, where does this leave us as a privacy community, and what is our role in the time of the novel coronavirus? It means that before we debate the particulars of a specific technology or application, before we tweak certain features or functionality to better protect individual privacy, and before we impose certain transparency or accountability measures, we take a step back.

Before we concede that a measure is necessary and begin to assess its proportionality, we question that underlying assumption — especially when it’s coming from private companies that stand to gain from it or from governments that fear being perceived as lacking control over the situation. We apply the age-old tests of legality, necessity, and proportionality — in that order. We require concrete evidence that a measure will further specific aims or achieve certain measurable outcomes.

If privacy advocates don’t step up and do this, who will?

¹ See, e.g., Soering v. United Kingdom (1989) 11 EHRR 439, https://opil.ouplaw.com/view/10.1093/law:ihrl/90echr89.case.1/law-ihrl-90echr89.
² See Art. 6, ICCPR, and Art. 2, ECHR.
³ See Art. 7, ICCPR, and Art. 3, ECHR.
See Art. 8, ICCPR, and Art. 4, ECHR.
See, e.g., ECHR Art. 15(1): “In time of war or other public emergency threatening the life of the nation any High Contracting Party may take measures derogating from its obligations under this Convention to the extent strictly required by the exigencies of the situation, provided that such measures are not inconsistent with its other obligations under international law.”
See Art. 4(1), ICCPR, and Art. 15(1), ECHR.
See Art. 4(1), ICCPR: “In time of public emergency which threatens the life of the nation and the existence of which is officially proclaimed, the States Parties to the present Covenant may take measures derogating from their obligations under the present Covenant to the extent strictly required by the exigencies of the situation, provided that such measures are not inconsistent with their other obligations under international law and do not involve discrimination solely on the ground of race, colour, sex, language, religion or social origin.”
See Art. 18, ICCPR, and Art. 9, ECHR.
See Art. 19, ICCPR, and Art. 10, ECHR.
¹⁰ See Art. 21–22, ICCPR, and Art. 11, ECHR.
¹¹ See Art. 2, ECHR.
¹² See Art. 17, ICCPR, and Art. 8, ECHR.
¹³ See, e.g., Frank La Rue, “Report of the Special Rapporteur to the Human Rights Council on the implications of States’ surveillance of communications on the exercise of the human rights to privacy and to freedom of opinion and expression,” 2013, A.HRC.23.40 EN.
¹⁴ Where fundamental rights are concerned, the test for proportionality is beyond “reasonableness,” or whether a measure is within a reasonable range of options. Rather, where fundamental rights are concerned, proportionality is closely tied to necessity.

Founder @ hackylawyer | Fellow @ Berkman Klein Center for Internet & Society | Fellow @ Carr Center at Harvard |CIPP/E, CIPP/US | Privacy, Identity, Blockchain

Sign up for Pattern Matching

By OneZero

A newsletter that puts the week's most compelling tech stories in context, by OneZero senior writer Will Oremus. Take a look.

By signing up, you will create a Medium account if you don’t already have one. Review our Privacy Policy for more information about our privacy practices.

Check your inbox
Medium sent you an email at to complete your subscription.

The undercurrents of the future. A publication from Medium about technology and people.