Ecuador should pass a Data Protection Law to ensure that the use of personal data to contain Covid-19 does not lead to violations of the right to privacy, Human Rights Watch said Thursday.
The Ecuadorian government is collecting and processing the personal data of users to monitor compliance with its quarantine and isolation measures, identify people who may have Covid-19 or may have come into contact with an infected person, and identify places where there are large gatherings. However, Ecuador does not have legislation to protect the personal data the government collects. A draft bill submitted by President Lenín Moreno to the National Assembly in September 2019 is pending before one of the legislative commissions.
“Carrying out Covid-19 surveillance measures without data protection legislation and an independent oversight body poses a huge threat to Ecuadoreans’ privacy rights,” said José Miguel Vivanco, Americas director at Human Rights Watch. “The National Assembly should prioritize debating President Moreno’s proposed bill and adopt a law establishing clear guidelines on the consent needed to collect personal data, as well as limits on processing, using, and retaining the data, including during times of emergency.”
One of Human Rights Watch’s concern is the fact that Ecuador operates a sophisticated system of surveillance cameras, with facial recognition capabilities, purchased from China. The government credits the system with the country’s dramatic drop in crime but critics worry that it infringes on the rights of the innocent.
As of July 2, 2020, Ecuador had 59,842 confirmed cases of the novel coronavirus and 4,687 deaths. The actual case and death toll is estimated to be much higher, the country’s health minister says, perhaps by a factor of 10.
In response to the Covid-19 outbreak, on March 16, President Moreno issued an executive decree declaring a state of emergency and allowing the government to use “satellite and mobile telephone platforms … to monitor the location of people in a state of sanitary quarantine and/or compulsory isolation.” This effectively would allow the government to monitor people who tested positive for the coronavirus, those who have been in close contact with someone who tested positive, people with symptoms, and those who are subject to 14 days of mandatory isolation after entering the country from abroad.
In a virtual news conference on March 17, Interior Minister María Paula Romo said that the decree authorized satellite tracking of people suspected of having Covid-19 to ensure they are complying with isolation requirements. She said that the government’s tracking technology can provide information about where a person is located through using the GPS on their smartphones.
On March 19, the Constitutional Court of Ecuador ruled that the decree and its surveillance measures were constitutional. It specified, however, that these technologies should only be used to address the health emergency and track the virus and should not be used to infringe on rights to privacy or nondiscrimination. The court also said the technologies should only be applied to people whom the authorities have specifically established should be in isolation or subject to similar measures and required the government to inform them about the use and scope of these technologies. The court stressed that the government was required to protect the personal data of patients or people whose health was being monitored in connection with the pandemic.
On March 25, President Moreno announced that the national government and its health ministry had developed an application, called Salud EC App, through which users can self-report Covid-19 symptoms. The application connects the patient with a healthcare worker from the 171 emergency phone number created for the Covid-19 crisis or other services provided by the public health system, depending on the severity of the reported symptoms.
To use the application, users must provide their name, year of birth, national identity document, phone number, e-mail, and geolocated address. The scope of information required appears to run counter to the principle of data minimization, under which only the data that is necessary and directly related to the stated purpose of the app should be processed and it should not be held or used for other purposes, Human Rights Watch said.
On April 12, President Moreno announced that his government was introducing the “Covid-19 platform,” a database developed by private and public entities under the supervision of the Telecommunications and Information Ministry (MINTEL). The platform analyzes data to monitor compliance with the quarantine, identify people who may have Covid-19 or have come into contact with an infected person, identify areas where there are large gatherings, and direct health authorities to carry out massive Covid-19 tests in these areas.
The information gathered through this platform is shared with national and local authorities, who could potentially share it with law enforcement agencies responsible for enforcing restrictions on gatherings and curfew compliance.
Telecommunications and Information Minister Andrés Michelena said the data the platform analyzes comes from several sources, including calls to the 171 emergency phone number, data obtained from the application Salud EC, phone number information on users provided by cellphone service providers (“big data”), satellite tracking and geolocation of smartphones carried out by MINTEL, and video surveillance by authorities charged with monitoring emergencies through a nationwide camera system.
The minister asserted that information such as addresses, names, or phone numbers would not be revealed, and that the government would use an algorithm to detect the movement of cellphones between mobile phone antennas.
Given that so much sensitive personal data is being collected, aggregated, processed, and shared without specific legal protections, there is a high risk that this initiative could lead to misuse of this data and failures in proper control and handling of sensitive information, Human Rights Watch said. Collecting and aggregating personal data can facilitate tracking a person in real time, which could lead to breaches of privacy or the use of the information for commercial or illegal purposes, such as extortion.
Because the use of surveillance and monitoring technologies inherently interferes with privacy, international human rights law requires the Ecuadorean government to adhere strictly to the criteria of necessity, proportionality, legitimate purpose, and limited duration to prevent violations of the rights to privacy, respect for physical and mental integrity, and nondiscrimination.
The Inter-American Commission on Human Rights has reminded states that during the Covid-19 emergency, data should “only be stored for the limited purpose of combatting the pandemic, and the data must not be shared for commercial or other purposes. Affected people and patients shall retain their right to delete their sensitive data.”
To protect these rights, the authorities should establish clear limitations on with whom and for what purpose the data can be shared, and ensure that data is anonymized, secured, and deleted once the original purpose for its use has expired, Human Rights Watch said. Data collection efforts should include means for free, active, and meaningful participation of relevant stakeholders, in particular experts in the public health sector and the most marginalized populations.
Credit: Human Rights Watch