Since the start of the corona crisis, there has been a lot of discussion about how to trace and follow up the contacts that infected people maintained during the incubation period in order to limit the further spread of the epidemic. Initially, this was thought to be via so-called contact tracing want to monitor apps. Due to numerous serious privacy objections, people changed their shoulder last week and full use was made of "corona investigators" to detect infections. So get rid of the technology. But also get rid of the privacy problems? Not so.
In connection with the contact tracing apps, the Data Protection Authority, the supervisor for the protection of personal data in Belgium, withdrew emergency advice of 28 and April 29 sounding the legal alarm bell. In the first place, she denounced the hasty and unclear way in which such measures were attempted. She was also deeply concerned about how the (delicate) information collected by the apps would be obtained, managed, shared with third parties and crossed with other databases.
Our governments now seem to want to address these very justified concerns by giving the data collection a new look and swapping the apps for human interviewers. This change of course, however, is very similar to the emperor's new clothes from the fairy tale of the same name. We all want to believe so badly in a privacy-resistant way of mapping possible corona infections that we threaten to close our eyes to a manifest truth: the way in which the functioning of the corona investigators has been given shape in recent days contains at least as much difficulties as the decried apps. As long as there is no clear framework, there is no guarantee for an acceptable level of protection of our privacy.
In addition, additional problems arise.
Firstly, Wouter Arrazola de Oñate, the pulmonologist involved in preparing the questionnaires, indicated that such surveys can take up to an hour and that it is important that they are done by “people with experience in professional secrecy and privacy” given the drastic nature of the questions (article De Morgen, 5 May 2020). Nevertheless, people closely involved in the file only talk about training for the investigators of a few hours (article RTBF, April 21, 2020), while no training or even knowledge of privacy is required in the vacancies for corona sleuth published by VDAB (see website VDAB). A high school diploma is sufficient. The first conclusion is therefore clear: we understand that everything has to go fast, but also after the start-up sufficient time must be taken to train everyone thoroughly – in particular regarding privacy protection.
Secondly, the surveys will be organized by a consortium of different call centers, the consultancy firm KPMG and five health insurance funds. However, barely six months ago, in October 2019, these health insurance funds themselves were discredited because they manifestly violated the privacy rules (article VRT NWS, 10 October 2019). In a follow-up survey, two months later, in December 2019, the VRT again conducted a random sample which showed that these health insurance funds were still unable to meet their privacy obligations (article VRT NWS, 30 December 2019). The second conclusion is equally clear: the choice to work with external partners is understandable, but is once again a reason to establish clear rules that protect privacy. Especially when working with commercial partners.
This consideration also has a direct importance for the efficiency of the exercise that must now be done: if people are not sure that their privacy is protected, they will never give the necessary information, especially on the phone. This far-reaching operation can only be a success with strong privacy protection. Corona tracing may be necessary and may be urgent, but, as has already been achieved in other European countries such as Austria and Switzerland (website care vision), in Belgium too, a clear framework must first be provided that regulates such matters.
The government now has every opportunity to do so, by means of the extensive powers of attorney. Once this framework is in place, however, it is recommended that it be thoroughly evaluated after a few weeks, together with the Data Protection Authority, and that Parliament should ultimately be allowed to draw up a final legal framework.
Otherwise we will end up in a kind of panic football that is reminiscent of the way in which in 2016, just after the terrorist attacks in Brussels, all kinds of flawed regulations were pushed through parliament at lightning speed. Years later, those rules continue to cause major problems and the realization that in the heat of battle we may have jeopardized important human rights principles too quickly. Today, too, we threaten to make unconsidered sacrifices on the altar of the fight against the pandemic. Let this then be the gently raised child's finger that asks why the Emperor, despite all undoubtedly good intentions, has no clothes on.
This opinion piece was published on Thursday, May 7, 2020 in The standard.
