The ongoing Covid-19 pandemic raises life and death questions all over the globe. Data protection concerns in this context appear trivial and insignificant. As the DPC has stated, “data protection law does not stand in the way of the provision of healthcare and the management of public health issues; nevertheless there are important considerations which should be taken into account when handling personal data in these contexts, particularly health and other sensitive data”. Nevertheless, some questions raised will remain as contentious issues long after Covid-19 has been clinically controlled. There is no need to remind anyone how the pandemic raises life and death questions. People are getting sick and many people are dying .
Identified and Identifiable
There was much debate and controversy surrounding the lack of specific geographic details provided by health officials in relation to confirmed cases of Covid-19. One view was that the GDPR was being cited as a reason not to provide more precise details as this could lead to someone’s identity being disclosed. Remember that from Art.4 (1) “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name…location data…or to one or more factors specific to the physical…cultural or social identity of that natural person;”.It is well established that non- disclosure of a person’s name, in and of itself, is not always a guarantee of anonymity.
Even when special category data processing is allowed by derogation, it does not mean there is any derogation from the applicability of data protection principles. On the contrary, these are always applicable. In fact, it is especially important to abide by all data protection principles in relation to these more ‘sensitive categories’ of data, to use the term from the old Data Protection Acts. Unquestionably, a person’s identity could quickly become public knowledge if a very precise geographical location was provided by the public health authorities. It would not be long before people would be able, by a process of elimination and observation, (hopefully, not surveillance!) to identify people in a particular area that were in isolation because they had tested positive for the virus or had been in recent contact with someone who had tested positive.
Location data
Although the health authorities are doing their best to ensure a person does not become identifiable, the possibility of this happening increases directly as the information disclosed becomes more detailed .Take the case of the un-named school that was closed because students had recently returned from a school trip to Northern Italy. Health authorities consistently refused to name the school, despite the fact it had been immediately identified on social media. Their policy of non-disclosure was rendered meaningless.
The truth is this type of information becomes public knowledge very quickly. In the midst of a pandemic people are understandably more inquisitive, and it is quite possible anyone who was on the school trip to Italy and succumbed to the virus would be identified in a timely manner. What is clear so far is that the health authorities are determined to keep information to a minimum so that precise geographical locations are not revealed. This is why we have been hearing about a case in the South or the East etc. but no towns or cities had, at least initially, been named. Some politicians prefer more specifics on locations of so-called clusters of infection.
Different views or rationales can be taken of this policy approach. One view is that naming the location precisely might, in combination with other information available to local residents, make an individual or individuals readily identifiable. This could cause panic to people in the immediate region and distress to patients and their families. Another view is that if the precise location was given, then residents in proximity to that area might be on higher alert leading to greater caution in their personal social interactions. The policy has been defended on other grounds by Dr. Tony Holohan. It is seen as designed to protect the privacy of individuals on the basis that people are less likely to come forward if they fear their identity will be made known. This would be another hurdle in the race to quantify and track the extent of the pandemic.
For the public interest/of public interest
All views have their merits but any view carries an underlying interpretation of what is ‘for the public interest’. Undoubtedly, the question is a subjective one, and in instances such as a public health emergency caused by a pandemic, what constitutes the “public interest” is properly evaluated by the health authorities and the government. Within this context, under Art.9 (2)(h), Art.9(2)(i) and S.53 DPA 2018 lie the specific exceptions to the general prohibition on processing of special categories of personal data, which includes health data. Derogations from the general prohibition are allowed, but subject to suitable safeguards having been put in place to safeguard fundamental rights and freedoms of the data subjects. Such safeguards may include limitation on access to the data, strict time limits for erasure, and other measures such as adequate staff training to protect the data protection rights of individuals.
There are many lawful bases for processing personal data. Consent is one of them but it is by no means the strongest. It can be withdrawn at any time. Indeed, the GDPR provides for the legal grounds to enable competent public health authorities (and employers) to process personal data in the context of epidemics, without the need to obtain the consent of the data subject. This applies for instance when the processing of personal data is necessary for the employers for reasons of public interest in the area of public health or to protect vital interests (Art. 6 and 9 of the GDPR) or to comply with another legal obligation.
A valid distinction needs to be made at the outset between what is “for the public interest” and what is “of interest to the public”. I am fairly certain that it was Minister Simon Harris who was recently criticised for making a distinction between the two, but he was correct in his assessment. What he was trying to explain was that because some information is ‘of interest to the public’ does not mean its disclosure is made legitimate or justifiable by a motive of public interest. Would disclosing the information do more harm than good? It has elements of the harm principle of the utilitarian philosophy espoused especially by J.S. Mills and Jeremy Bentham. In essence, the lesser harm for the greater good. The courts and many statutes frequently refer to the public interest but “ there is no single satisfactory definition of what the public interest is”.( See, Kelleher, Privacy and Data Protection Law in Ireland, 2nd ed. at p.175) It might be more incisive to simply ask what is in the best interests of the public at large.
In the context of a Freedom of Information case in an Australian Federal Court, Justice Brian Tamberlin wrote the following:
The public interest is not one homogenous undivided concept. It will often be multi-faceted and the decision-maker will have to consider and evaluate the relative weight of these facets before reaching a final conclusion as to where the public interest resides. This ultimate evaluation of the public interest will involve a determination of what are the relevant facets of the public interest that are competing and the comparative importance that ought to be given to them so that “the public interest” can be ascertained and served. In some circumstances, one or more considerations will be of such overriding significance that they will prevail over all others. In other circumstances, the competing considerations will be more finely balanced so that the outcome is not so clearly predictable. For example, in some contexts, interests such as public health, national security, anti-terrorism, defence or international obligations may be of overriding significance when compared with other considerations.( McKinnon v Secretary, Dept. of Treasury [2005]FCAFC)
The term eludes precise definition but at its core is concern with the welfare or well-being of the general public and society. Data protection law and GDPR have often to be balanced against other rights such as freedom of expression. Today we are seeing with Covid-19 government actions how the public interest motive in the area of public health far outweighs personal rights and freedoms. What is, or indeed what is not, in the public interest often depends on the context in which it is being examined.
Mr Justice Barrett in Dublin Waterworld v National Sports Campus Development Authority [2014] IEHC 518(7 Nov 204) stated, “disputes are likely to be of interest to the public but that does not make their resolution a matter of public interest”. S.53 DPA 2018 uses the terms “for public interest reasons in the area of public health including… ” The terminology of Art. 9(2)(i) is similar and refers to “processing necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health…”
Processing of special categories of personal data including health data is clearly permissible under GDPR and the DPA 2018. “Processing” under the GDPR includes, amongst others, “dissemination”, but this does not mean it is permissible to freely share the information with the general public. Dissemination, as a form of processing must itself follow the data protection principles and respect, amongst others, the principle of purpose limitation.
If the personal data is initially collected (processed) for the public interest in the area of health, is the dissemination (for example, through the coronavirus daily briefings) in line with this original purpose? It is likely that the answer is yes. The best informed view is that the dissemination just represents another type or form of processing and the purpose remains the same. Anyway, Art. 6(4) GDPR allows for a ‘compatibility (of purpose) test’, in situations where the processing is for a purpose other than that for which the data have been collected and is not based on consent or Union or Member State law. The concept of “public interest” at general law is wide –ranging and expansive. A classic dictum is that is of Lord Hailsham that “the categories of public interest are not closed” (D v National Society for the Prevention of Cruelty to Children [1978] AC 171 at 230)
There are… several different features and facets of interest which form the public interest. On the other hand, in the daily affairs of the community events occur which attract public attention. Such events of interest to the public may or may not be ones which are for the benefit of the community; it follows that such form of interest per se is not a facet of the public interest (DPP v Smith [1991) 1 VR 63 at 75).
The public interest is not the same as that which may be of interest to the public. We have seen in many previous blogs how data protection rights do not exist in isolation, nor do they trump other rights. At any time the Government can decide to be more forthcoming and more specific with information concerning Covid -19. The deciding factor will be whether it is in the public interest to do so. If that time ever comes the government will still be mindful of the obligation to protect the anonymity of any individual who may have contracted the infection.
In an upcoming blog we will share common data protection concerns in the context of the coronavirus that have been raised by many of our clients through our website.
Patrick Rowland, GDPRXpert.ie
We are GDPR and data protection consultants with bases in Carlow/Kilkenny and Mayo, offering a nationwide service.
For more details visit www.gdprxpert.ie
