Governments worldwide are taking unprecedented measures to track and contain the spread of the Covid-19 and use data to provide digital solutions. Of particular importance to an efficient front-line response is data about the spread of the virus, like the location and number of new confirmed cases, rates of recoveries and deaths, and the source of new cases. 

Data is also crucial to evaluate and enhance healthcare systems’ capacity and assess the efficiency of containment and mitigation policies that restrict the individuals’ movement. 

Many governments are using digital technologies and advanced analytics to collect, analyze and share data for front-line responses, in particular: geolocation data, which are user-derived from mobile call data records or collected from mobile applications; biometrics, especially facial recognition data. 

Hence, timely, secure, and reliable data access and sharing are crucial to understanding the virus and its spread, enhancing the government policies’ efficiency, and fostering global cooperation in the race to distribute vaccines. 

What challenges are arising from the sudden increase in data usage?

But the increased use of data is giving rise to novel data governance and privacy challenges. For instance, contact-tracing technologies can be helpful as they provide critical information to limit the spread of the virus. Still, if left unchecked, they can also be used for mass surveillance, collecting and sharing personal data, challenging democratic governance, and limiting individual freedoms. 

Not all countries have frameworks in place to tackle these challenges. Furthermore, the measures envisaged in some countries have already proven to be controversial in terms of their risk of violating citizens’ privacy and other fundamental rights. That’s particularly true when such measures lack transparency and public consultation. Even when the personal data is anonymized, a limited set of data points may still identify individuals. 

Is there a solution to tackle these challenges?

Policy responses are evolving fast in an environment with limited reliable evidence or chances for robust internal or multilateral consultations. But all countries urgently need data to inform regulatory and policy responses as the crisis unfolds. The following considerations should guide data collection and sharing practices worldwide.  

Governments have to promote the responsible use of personal data. 

Unfortunately, there appears to be an increasing trend towards using more invasive collection, processing, and sharing large-scale personal health and behavioral data. This data involves targeted monitoring of individuals to contain the spread of Covid-19. Some of these measures may prove efficient in helping prevent the outbreak. Still, governments should ensure these tools are implemented with complete transparency, accountability, and a commitment to swiftly cease or reverse exceptional data uses when the crisis is over. 

Consultations with PEAs (Privacy Enforcement Authorities)

Governments should discuss with PEAs before introducing measures that risk violating established privacy and data protection laws. Governments should consult PEAs in the front-line response efforts to ensure that appropriate safeguards accompany incursions into privacy rights. PEAs and governments must dedicate expert resources to enable these assessments.

PEAs must always address regulatory uncertainties. 

PEAs should adopt a pragmatic and contextual methodology in responding rapidly to requests for advice. They should clarify how data protection and privacy frameworks in each jurisdiction apply to collecting and sharing personal data in this crisis and beyond. By doing so, governments will likely foster compliance with data protection frameworks and enable adequate internal and trans-border data flows.  

Supporting national and international cooperation

Governments should support national and international cooperation in collecting, processing, and sharing personal health data for research and statistics in managing the Covid-19 crisis and beyond. 

Governments should be transparent and accountable for all their actions in response to the crisis.

Governments should ensure engagement and participation, notably through public consultation, of a wide range of stakeholders. That’s because they need to ensure that collecting, analyzing, and sharing personal data serves the public interest. Also, they must ensure that these processes are consistent with societal values and the individuals’ expectations.