The purpose of this analysis is to focus on the multi-level challenges that, regardless of its form, what is in effect a post-Covid system of mass surveillance poses on well-established principles of law, rights, trust and citizenship
Author: Valsamis Mitsilegas, Professor of European Criminal Law and Global Security at Queen Mary University of London
Surveillance has been at the heart of the development of state responses to Covid-19. Responses have focused on the surveillance of movement and mobility, including cross-border mobility in the context of re-opening the closed Covid-19 borders in Europe and beyond; and on the surveillance of citizens and populations deemed to have developed Covid-19 symptoms, and those they may have come in contact with, under systems of tracking and tracing. Technology plays a key role in the development of these responses. In the context of population tracing, a variety of responses based on the introduction of tracking apps have been put forward, ranging from centralised systems such as the one proposed in the UK whereby data are gathered in c central state database, to decentralised approaches developed by the private sector whereby data are retained in the actual devices and not forwarded to centralised state databases. The purpose of this analysis is to focus on the multi-level challenges that, regardless of its form, what is in effect a post-Covid system of mass surveillance poses on well-established principles of law, rights, trust and citizenship. The analysis will evaluate critically these challenges, drawing attention to the perils of watering down fundamental principles underpinning democratic societies in normalising what can be currently seen as a securitised state of emergency.
The collection of everyday and sensitive personal data of large numbers of populations under tracing systems poses fundamental challenges to privacy and data protection. Concerns arise in particular regarding the collection of a wide range of personal data not necessarily related to the purposes for which this data has been collected, lengthy retention and storage periods and the erosion of the purpose limitation principle including allowing access to these data to a wide range of state authorities. It has been documented that these challenges are acute in centralised tracing systems and databases but these challenges arise also in the operation of decentralised systems based on private sector designed apps. Respect of the principle of proportionality is key in this context: mass surveillance and generalised tracing and tracking systems should only be introduced if they are proportionate to the objective sought and designed to comply with fundamental rights and the principle of proportionality. Privacy invasive measures constituting interference with fundamental rights may deem to be proportionate to avert an imminent health threat, but less so if they are justified on the grounds of generating scientific knowledge for future use- in any case, detailed, evidence-based justification of the introduction of mass surveillance is essential in this context.
The introduction of mass surveillance systems on the basis of tracing apps is fully dependent on citizen uptake and participation, which in turn is an issue of trust. There has been a debate on whether participation to these systems should be voluntary or mandatory. Even if participation remains voluntary, it is important to note that any consent given by citizens to take part in mass tracing systems- centralised or decentralised- must be meaningful: the European Court of Justice has noted that such consent would be undermined if citizens did not have a real choice of objecting to the processing of their persona data (C-291/12 Michael Schwarz v Stadt Bochum: for further analysis see this European Law Blog). In this context, it is paramount that governmental pressure to participate in the system does not lead to discrimination, stigmatisation and dangerous distinctions between ‘good’ and ‘bad’ citizens in the eyes of the state- with current discourse on ‘civic duties’ of ‘saving lives’ exacerbating the potential of stigmatisation. A push towards uncritical mass surveillance may lead to a two-way erosion of trust between citizens and the state. On the one hand, the generation of mistrust from the state to citizens who do not participate in tracing systems either by choice or by lack of access to technology may lead to the exclusion of and discrimination against these citizens in key areas of everyday life, including commerce, work and travel. On the other hand, the potential of the trust of citizens towards the state being eroded is significant. Citizens will not participate in a system which they do not trust in terms of both its effectiveness and its handling by state –and private- authorities. Moreover, the introduction of systems of generalised, ongoing population tracing may lead to citizens having the feeling of constantly being watched and being under suspicion- concerns which have been raised already in the context of the introduction of mass surveillance via duties of mobile phone and telecommunications companies to retain the data of their customers in a generalised manner.
Surveillance-led responses to Covid-19 have been largely based on the extraction of personal data stemming from public-private partnerships. The privatisation of surveillance, whereby the private sector is requested to collect and retain personal data and allow access of this data to state authorities, is not new- it has been a key component to emergency responses to terrorism since 9/11. In the digital era, the role and powers of the private sector, and in particular of the tech giants, in this privatised surveillance paradigm becomes even more prominent. This is clearly the case in managing Covid-19, where tech giants have essentially become gatekeepers of fundamental rights protection and of the reconfiguration of the relationship between the citizen and the state. Reliance on the private sector in the development of public-private partnerships in this context raises a number of challenges of transparency, accountability and the rule of law. These challenges are compounded by the related reliance on technology (developed largely by the private sector) in providing credible solutions to very complex problems. The uncritical belief in the infallibility of technology may have profound fundamental rights and rule of law implications. Surveillance systems based on automatic algorithmic assessments and decision-making leave little – if any- room for challenging their results and for providing an effective remedy to affected individuals. In addition to the erosion of the rule of law this situation would entail, over-reliance on technology may also lead to the depoliticisation of the debate on the multiple challenges surveillance responses to Covid-10 pose to democratic societies. These concerns become more acute in the current push to interconnect national Covid-19 surveillance systems irrespective of their nature under the banner of ‘interoperability.’ Interoperability has appeared in the realm of EU law as a mechanism of interconnecting primarily a number of EU immigration databases- presented as a technical solution, it presents a number of profound fundamental rights and rule of law challenges (http://www.migrationpolicycentre.eu/interoperability-as-a-rule-of-law-challenge/ )In responses to Covid-19, these fundamental rights and rule of law challenges extend to the surveillance of mobility, including the cross-border movement and mobility, of citizens within the EU and beyond. With ongoing surveillance of mobility based on technology and interoperability, one wonders whether movement within Europe’s Area of Freedom, Security and Justice is really free.
Surveillance-led responses to Covid-19 have been based on the securitsation of health, treating Covid-19 as an emergency threat justifying emergency measures. Here, a number of lessons can be learned from global responses to other phenomena deemed to be existential threats, and in particular terrorism after 9/11. Counter-terrorism responses have led to the introduction of a series of measures challenging fundamental legal and constitutional principles and justified on the basis of the state of emergency. It has taken years for courts to push back against some of these measures, but with every new terrorist attacks emergency legislation has returned and proliferated- leading in many instances in the normalisation of the state of emergency in democratic societies. A similar danger arises regarding the responses to Covid-19. As Harari observes, temporary measures have a nasty habit of outlasting emergencies, especially as there is always a new emergency lurking on the horizon. Vigilance is required so that any current measures justified by governments as emergency measures remain temporary and time-limited, and are accompanied by robust independent judicial oversight. Moreover, the framing of Covid-19 surveillance responses as emergency measures must be critically scrutinised on a case-by-case basis, in order to avoid mission creep and to ensure that any new measures comply fully with legality and proportionality.