Does Covid-19 justify the suspension of privacy?

The current global pandemic involving coronavirus may be unprecedented with ramifications for every aspect of society. One of these is personal privacy. It is certainly unarguable that control of affected populations with the disease has been more effective where it has been possible to track individuals who have been either infected themselves or in contact with those who are. Especially useful is the ability to monitor individuals’ movements, locations and social contacts. Smart phones are the instrument of choice for such surveillance.

In China, QR (Quick Response) codes have been used to assign every individual a coding based on their risk profile: thus, infected persons may be designated with red whilst their immediate family might be orange, for instance. Those with whom they might have been in contact could be yellow whereas others from isolated areas might be classified as green. Similarly, cities with larger concentrations of individuals with the disease maybe designated red or orange with completely unaffected regions being green. Crucially, such codes also control movement with access to public transport and even the ability to go outside denied to some.

Might such pervasive surveillance techniques ever be tolerated in New Zealand, however? Crises of this nature often generate calls to suspend civil liberties, including privacy, due to the paramount need to ensure the public’s health and safety. Companies peddling apps and surveillance technologies have certainly been at the Government's door. There have also been calls to relax the normal safeguards relating to how personal information is processed.

It is important to recognise, however, that existing legislation amply caters even for extraordinary circumstances such as those that exist at present. Thus, the Health Act which has been invoked to restrict movement and gatherings is already designed to override the Privacy Act. The Privacy Act’s principles likewise allow disclosures of personal information that are necessary to prevent or lessen serious threats to public health or safety as well as the life or health of individuals. It is therefore permissible, to report one's neighbours if it is believed they have recently returned from overseas and are not self-isolating.

The just-declared state of national emergency also brings into effect the Civil Defence National Emergencies (Information Sharing) Code 2013. This was adopted after the Christchurch earthquake to relax the normal rules for sharing information contained in the Privacy Act, for example to ascertain where someone’s relatives were. Obviously, the Code will, once again, be useful.

Could individuals, however, be required to download an app that tracks their every move as well as social contact? The European privacy authorities have sanctioned the use of location data in an anonymous manner by aggregating it in such a way that an individual can't be re-identified. This may, for instance, allow high-infection areas to be mapped without necessarily tracking specific individuals. Where such generalised monitoring is not possible the authorities warn that privacy-intrusive measures must be proportionate and necessary (there may well be less intrusive methods such as simply phoning to see if the individual is at home). There must also be adequate privacy safeguards.

The Europeans have every reason for caution. Any app can also be a Trojan horse that gathers vast amounts of data contained from use of smartphones. The Cambridge Analytica scandal, it will be recalled, involved an app named “This is Your Digital Life” innocuously characterised to be a survey taken by individuals. Instead, in addition to those taking the survey, the app accessed all their friend’s data including private messages with them. The data gathered was used for purposes including political advertising and influencing voter behavior. We also know that such apps are difficult to remove or de-activate once they are installed. The data collected may also never be deleted - New Zealand’s privacy law does not currently allow a rite of erasure as does Europe's.  

Extraordinary times may call for extraordinary measures but, as the authorities deal with the present threat, it will be important to ensure that any surveillance technologies that are deployed are limited to their immediate purpose and de-activated as soon as the threat abates.