Coronavirus: Data Protection and Confidentiality in Ecuador

The global health emergency caused by the spread of the COVID-19 virus has led the governments of the hardest-hit countries to adopt measures to slow the virus's spread. Restrictions on movement, the closure of

The global health emergency caused by the spread of the COVID-19 virus has led the governments of the hardest-hit countries to adopt measures to slow the spread of the virus. Restrictions on movement, border closures, and the mandatory shift to remote work are just some of the measures that have been adopted in various countries around the world. Ecuador is no exception; as of the date of this post, there are 1,382 confirmed cases and 34 deaths. For this reason, on March 16, 2020, President Lenín Moreno issued Executive Decree No. 1017, declaring a state of emergency due to a public calamity. It is undeniable that precedents from other countries have shown that isolation and reducing person-to-person contact are the most effective measures to slow the spread of the virus. Even so, the Executive Decree contains a provision that must be viewed with a critical eye. Pursuant to Article 11 of said decree, “satellite and mobile phone platforms may be used to monitor the location of individuals under health quarantine and/or mandatory isolation […].” This means that anyone who tests positive for the virus, is within an epidemiological containment zone, or is required to comply with mandatory isolation after entering the country from abroad could be monitored by the government. Minister of the Interior María Paula Romo, in a virtual press conference, stated that satellite tracking of individuals within the epidemiological cordon is authorized by decree. According to Romo, the technology allows the government to determine a person’s location using their cell phone number or the GPS on their smartphones. The goal is to ensure compliance with isolation measures. Geolocation of individuals can be considered a useful tool for ensuring that people in quarantine remain at home and for identifying those who may be infected, but at the same time, it provides access to sensitive information that jeopardizes the right to privacy. Measures of this kind raise questions regarding their legality, necessity, and proportionality, as well as their impact on people’s fundamental rights. The Constitutional Court of Ecuador issued a favourable ruling on constitutionality regarding the Executive Decree. Regarding Article 11, the Court clearly stated that the use of these technologies must be limited solely to the purposes of the state of emergency and to tracking the virus and isolating individuals who may be potential sources of infection. Among the Court’s concerns are the right to privacy, the right to non-discrimination, and the protection of personal data. Above all, the Court limits the use of these technologies to those in voluntary isolation, who must be duly informed. In Ecuador, the use of satellite or GPS tracking of cell phones for the purpose of geolocating positive cases or establishing an epidemiological containment zone for COVID-19 must be subject to current constitutional regulations. Therefore, information regarding a person’s health may not be used without the authorization of the data subject or their representatives, except for the purpose of medical care (Article 66, paragraph 11). Furthermore, individuals have the right to the protection of their personal data, unless its collection, storage, and processing are authorized by the data subject or required by law (Article 66, paragraph 19); and the right to personal and family privacy (Article 66, paragraph 20). It should also be noted that individuals subject to such a measure must be duly informed, as indicated by the Constitutional Court itself. As of Sunday, March 15, the form distributed by immigration agents at airports did not include any reference to the possibility of being tracked via the cell phone numbers provided on the document. This raises the question of whether data subjects have given their consent—or at least been informed—so that they are aware of the satellite tracking of their cell phones. On March 25, President Moreno announced the development of an app that stores the name, year of birth, ID number, and geolocated address of its users. Through this app, users can report their COVID-19-related symptoms, and the app will connect the patient with the platforms created by the government for the health emergency. Authorities claim that the use of telemedicine will help identify potentially infected individuals and that the information will be kept confidential, although the terms and conditions state that users agree to provide all information to the government and its ministries. The following points raise the greatest concerns: Right to Privacy Satellite tracking and the telemedicine app place information such as names, phone numbers, addresses, and movement details in the hands of the state. This data falls within the private sphere of the individual concerned and constitutes sensitive information that could be misused by those who have access to it, whether legitimately or illegitimately. The Human Rights Committee has stated that measures must be adopted to ensure that information related to individuals’ private lives does not fall into the hands of unauthorized persons and is not used for purposes incompatible with the International Covenant on Civil and Political Rights (1). Likewise, the Inter-American Court of Human Rights has stated that States “[…] must make an even greater commitment to adapt traditional methods of protecting the right to privacy to the current times.” (2) It should be noted that measures employing surveillance technologies are typically carried out in the context of criminal proceedings or investigations. (3) While current circumstances require extraordinary measures, citizens’ right to privacy must not be jeopardized. Therefore, satellite tracking must be an exceptional measure that is not prolonged and does not compromise individuals’ private information. Processing of Personal Data The use of tracking technologies or apps to identify symptoms allows access to various types of personal data. The Inter-American Commission on Human Rights has stated that States must prohibit the processing, analysis, or disclosure of this data except when they are authorized to do so or with the consent of the affected individual. In the present case, the executive decree authorizes satellite tracking, a measure deemed constitutional by Ecuador’s Constitutional Court. Even so, this measure must comply with the recommendations of that body and be clearly communicated to the citizens concerned. In recent days, information has been leaked regarding the neighborhoods with the highest number of infections in the Metropolitan Municipality of Quito; the published the nationalities of infected patients, and photos of those who have died from the coronavirus in Guayaquil. What guarantees do we have that the data obtained through georeferencing will be protected? Given the current situation, and considering that the government is responsible for storing data from both satellite tracking and COVID-19 cases, mechanisms must be established to ensure that: 1) the data is not used for other purposes or leaked to unauthorized individuals, 2) it is carried out only for a limited period of time. This is especially important given that Ecuador does not yet have a specific law regarding the processing, storage, analysis, and protection of personal data. Non-Discrimination From the very first public cases of COVID-19 infection, xenophobic behavior against the Asian population began to emerge. Now that the virus has spread worldwide, it is reasonable to assume that all such xenophobic expressions directed at people of Asian descent could extend to anyone who tests positive for the virus. Geotagging puts at risk the data of people who pose a potential risk of transmission and, therefore, their safety. In a recent press release, the Special Rapporteurs on Freedom of Expression from the Organization of American States, the United Nations, and the Organization for Security and Cooperation in Europe have noted that, given the use of these surveillance tools, States must protect patients’ personal information. Any use of these technologies must adhere to the strictest protections and be in accordance with international human rights standards. The mishandling of sensitive data related to a person’s health, especially in a context such as the current one, exposes the affected patient. This could lead to discriminatory comments and behavior against them, particularly among the most vulnerable members of the population. 1. Human Rights Committee. General Comment No. 16. Article 17—Right to Privacy, 32nd Session, U.N. Doc. HRI/GEN/1/Rev.7 at 162 (1988). Para. 10. 2. Inter-American Court of Human Rights. Case of Escher v. Brazil. Judgment of July 6, 2009. Merits, Reparations, and Costs. Series C No. 200, para. 115. 3. IACHR. Standards for a Free, Open, and Inclusive Internet. OEA/Ser.L/V/II CIDH/RELE/INF.17/17 March 15, 2017. Para. 210 Martina Rapido Ragozzino Twitter @MartinaRapidoR