Will Quarantine pass the test of privacy? A Lithuanian perspective

COVID-19 has impacted every sphere of our lives. First and most importantly of all, it has brought unmeasurable threats and damages to people’s lives and health. It also has had a huge impact on almost every business – “revenue growth” is usually replaced with “staying alive” in the list of priorities of many businesses. Moreover, this extreme situation penetrates very strongly and deeply into the area of human rights and freedoms, with a major impact on their implementation. Europe has not seen such strict closing of borders and movement restrictions for decades. Even though democracy and the rule of law dictates that human rights and freedoms shall not be put under quarantine in any circumstances and shall be respected even on the darkest days, some countries might fail this exam. One of the heavily affected rights, challenging almost every democracy, is the right to privacy.

Home-teaching a four-year-old daughter for almost two months, I unwillingly started applying certain “grades” mechanisms to some situations in everyday life (too early for a four-year-old, you say?). Could we put privacy in times of quarantine to test? Would our democracies fail or pass such a test? There is only one way to find out – set the rules of the game (the second thing I mastered during this quarantine!) and give it a go.

Let’s assign letters A through F as grades. A (excellent) to E (poor) means passing the test, F – failing. Let’s list the measures applied in most of the European countries having an impact on individuals’ privacy, and then, at the second part of this op-ed, assign a report card to Lithuania. Every item listed below reduces the overall grade by at least one point (depending on the extent of violation the grade could be reduced by two or more points):

• Implementation of route maps of infected individuals and their public announcement – minus one point. Two or more points shall be reduced in case of highly detailed maps (for example, provision of gender data; maps with possibility to locate exact or very proximate home address, etc.);

• Collection of GPS location data via specialised apps without person’s consent – minus one point. The downgrading could be adjusted depending on security and technical configuration of the app (for example, the app has serious security gaps or provides information to third parties);

• Collection of location data of individuals from mobile operators – minus one point. Collection of aggregated or anonymised data shall not result in downgrade. Two or more points could be taken away in case mobile operators are requested to provide location data of all individuals, without considering if he or she falls in the greater risk zone (is infected; has been in contact with infected individuals; has been travelling, etc.), or not; also, if the individuals are not informed about such collection, etc.;

• Introduction of GPS ankle monitors for infected / quarantined individuals – minus one point. Even if all the measures are taken in terms of privacy and legitimacy (for example, the individual is well informed about the device and its operating principles, the GPS ankle monitor is introduced after the individual already breached the quarantine conditions and only upon appointment of the court, etc.), my subjective downgrade goes to this method solely for the inhumane nature of it. More points could be taken away in case the said conditions are not ensured. 

The list could go on. These measures may be topped up with imperative orders on collection of health data (requirement for businesses to document each flu-like symptom of employees and/or clients), heavy interrogations of individuals on certain subtle aspects of their private lives and many others. This list once again proves that democracies are taking a huge privacy test by facing all of these challenges at once. 

Would Lithuania pass this test? With goodwill, let's start the test with the grade of A. Further goes the privacy assessment items described above: 

• Minus one point for implementing route maps of infected individuals and their public announcement;

• One more point can be taken away for quite detailed entries of the mentioned map – some of them include exact flight number, destination and origin countries, exact seat or other precise information;

• The Lithuanian government together with the municipality of Vilnius has set up an app called Karantinas (in English – quarantine), which enables daily coronavirus symptom tracking, encourages healthy actions that curb the spread of the virus and helps to care for people in self-isolation. The Privacy Policy claims that GPS location data is available only in case location data is activated. However, operation of this specific app is not available in case location data is off. Therefore, it seems that provision of location data is based on legitimate interest or other ground, but not freely given consent according to General Data Protection Regulation – minus one point for that -- Lithuania slips to a grade of D, but the story is not over;

• Failure to ensure other privacy aspects in the mentioned app costs the Lithuanian government another point at this test: data retention periods, in my opinion, are too long (almost all the collected data, including location data is saved for 18 months); profiling might have significant impact on person’s rights and legitimate interests (the wording says “the data controller expects that profiling will not have significant impact, but <…> the results of the analysis could make the person identifiable”; some reviews of the app claim they received unsolicited marketing e-mails after installing the app, etc. Also, a technical audit may be conducted to ensure the app has no serious security gaps;

• Lithuania has a chance to lose some more points on its debated collection of location data of individuals from mobile operators. The draft amendment to the Law on Electronic Communications which aims to grant governmental authorities with access to mobile location data is under consideration at the Parliament. After serious criticism, the draft is amended and contains certain privacy safeguards, however they are more nominal than real, giving a ground for many commentators to voice their fears over mass surveillance. The repeated hearing was scheduled on 28 April, however, was postponed once again (the date of the next hearing is not set yet);

• Luckily, Lithuania did not introduce the GPS ankle monitors for infected / quarantined individuals so far. 

Following the rules of the game, Lithuania gets minus 4 points and ends with “E” (poor) as the test result, leaving the last question unanswered – will the Lithuanian Parliament adopt the mentioned draft Law on Electronic Communications without privacy protecting amendments? If the answer is positive, sadly, the privacy report card will change into “F - fail”. 

Understanding that situations such as the current coronavirus pandemic mean that certain human rights and freedoms may be restricted, I strongly believe such restrictions shall be proportionate, legitimate, well-weighed, justified, in line with the rule of law and only be sign-off on when other less restrictive measures cannot achieve that objective. Even considering the test criteria set forth above, one can clearly see that there are many means and options of collection of data, and the governments shall choose wisely.

Every country is currently under exam not only in terms of mitigating the virus, but also in terms of protecting basic human rights and freedoms. Most likely the actions taken, and lines drawn will be analysed and pushed forward and backward for many years to come. Would your country pass the test?