News

Start of main content

Digital tools and pandemics

| News | Litigation

Vicente Moret analyses the Ministerial Order published on March 28th in the BOE, which promotes the development of various actions in digital matters for the management of the health crisis

On March 28th, the Ministerial Order promoting the development of various actions in digital matters for the management of the health crisis caused by the COVID-19 was published in the BOE. This regulation has awakened a broad debate, not exempt from some controversy, about the use of Big Data tools as mechanisms for obtaining and processing the information needed to fight the pandemic. Many countries in the Far East have successfully used these technological formulas, although in the case of China these measures are not at all extraordinary, since in this country mass surveillance by the State is part of the daily life of citizens.

The central question, however, is whether in an environment as highly guaranteed in terms of data protection as the European Union, these highly invasive control systems can be used. The General Data Protection Regulation already provided that in situations of exceptionality such as the one we are experiencing, it is legitimately permitted to lift the ban on processing the special category of data in Article 9, that is to say, data affecting health among others. Without the situation of exceptionality, this possibility would not be in accordance with the regulations.

However, the rule, and this is the key, also states that it is necessary to introduce ad hoc safeguards, since the principles governing data protection remain in force despite the exceptionality, as was recently stated in a report by the EDPA. Data lawfulness, fairness, transparency, accuracy, and minimisation remain fully applicable principles. Therefore, this extraordinary processing by means of Big Data methods must be subject to appropriate and specific measures in order to protect the rights and freedoms of natural persons.

In this sense, among the measures included in this Ministerial Order, the one that stands out is that of enabling a development that allows the analysis of the mobility of persons in the days prior to and during the confinement. It is added that this development will be done following the model undertaken by the National Institute of Statistics in its study of mobility and through the crossing of data from mobile operators in an aggregate and anonymous way. Last year, the NIS developed a model for studying the mobility of Spaniards for statistical purposes based on data provided by mobile phone operators.

In this respect, it should be noted that if the guarantee of anonymity is total, there would be no objection from the point of view of the protection of personal data. However, some experts claim that anonymity, even if companies do not disclose identities, depends on the amount and type of data used and the granularity of the data provided.

In view of the above and understanding the importance of these technological measures being incorporated into the means available to the State to combat this pandemic, certain guarantees are lacking that would help to dispel uncertainties.

These additional measures have to do with control in their use. The Ministerial Order briefly refers to the responsible authorities, all of them ministerial. It would perhaps have been appropriate to reinforce these guarantees by means of some form of direct participation in the management of the Spanish Data Protection Agency as a supervisory body. Given its nature as an independent public authority, responsible for ensuring the privacy and protection of citizens' data, its effective incorporation as a specific supervisor in this specific case and not only as a general supervisory body would have been positive.

Another essential issue is to ensure that these data are collected for the duration of the exceptional situation, and that they cannot, of course, be used for any purpose other than health. In this regard, it would have been appropriate to envisage the involvement of the Public Prosecutor's Office to ensure a comprehensive and independent protection of fundamental rights and public freedoms during the time of use of this tool. It would exercise a function like that already exercised by the Public Prosecutor's Office within the Commissions for the Guarantee of Video Surveillance.

In short, it is necessary to use the enormous possibilities offered by digital disruption to achieve greater efficiency in the management of the pandemic. But at the same time we cannot forget that the essence of our legal-political model is based on the protection of rights, even in situations of exceptionality such as this one in which the extension of the powers of the States is the widest since the Second World War. The two obligations of the public authorities are compatible.

You can read the article in El Independiente.

End of main content