Let me have a stab on location data that will be part of the 2nd edition of the Social and Privacy Impact of Contact Tracing .
In the global standard such as the Global Data Protection Regulation (GDPR) compliance applies whenever the use of location data involves processing of personal data. It means that any data processed in an electronic form or by an electronic communication service / channel indicating geographic position of the terminal (phone, car, tablet, laptops) in public using GPS or a Cell Tower triangulation. In EU there is a directive which is called EPrivacy that deals with IOT devices and it also defined that a terminal using GPS needs to be protected and can be linked on the rights of the data subjects in any Data Privacy Act. In the Philippines and in other countries there is no EPrivacy Directive, but it can be related to the eCommerce Law which is RA 8792, Data Privacy Act of 2012 / RA 10173 and the CyberCrime Law of 2012 / RA 10175.
IOT in the context of EPrivacy Directive requires an individual to give an opt-in consent to use location data to provide a value-added service.
The information requirement for the location data needs to be itemized on a privacy notice and the purpose and duration of the processing must be explicitly stated. Since, the nature of the location is always shared to a 3rd party or a joint controller the process must also be stated on the notice and in the internal policy.
The last important aspect of location data will be based on our ability to withdraw consent. As data subjects we have the right to opt-out and the controller and processor needs to show evidence that indeed the location data has been erased on an end to end manner.
Let us relate this to contact tracing and the solutions being provided by most countries in the world to address corona virus. Digital Contact Tracing as being proposed by most countries such as Singapore, South Korea, Australia among others can be classified as either a Privacy Enhancing Technology (PET) or a Privacy Impacting Technology (PIT). PET can help us solve the problem such as corona virus with Privacy in mind and has implemented Privacy by Design while PIT is impacting our privacy as data subjects on either by Territorial, Information, Bodily or Communication.
These four domains of Privacy define how we act as a person because Territorial and Bodily answers our right as a human being that goes on our bill of rights and even on the 4th amendment of the US Constitution while the Data Privacy aspects can be answered on Information and Communication. Information Privacy involves the establishment of rules governing the collection and handling of personal data such as credit information, and medical and government records. Which is commonly know right now as Data Privacy / Data Protection.
But let us put our focus on Communication Privacy which covers the security and privacy of mail, telephones, e-mail and other forms of communication including location data.
————————————————————–
Let’s look at the two sources of location data for modelling:
- Location data collected by electronic communication service providers (such as mobile telecommunication operators) during the provision of their service; and
- Location data collected by application developer or what EU calls Information society service providers’ whose functionality requires the use of such data (e.g., navigation, transportation services, etc.).
The European Data Protection Board or EDPB states that location data collected from electronic communication providers may only be processed within the remits of Articles 6 and 9 of the EPrivacy Directive. This means that these data can only be transmitted to authorities or other third parties if they have been anonymized by the provider or, for data indicating the geographic position of the terminal equipment of a user, which are not traffic data, with the prior consent of the users.
The EDPB also pointed out with emphasis that when it comes to using location data, preference should always be given to the processing of anonymized data rather than personal data.
Anonymization refers to the use of a set of techniques in order to remove the ability to link the data with a natural person against a “reasonability test”. We must consider the aspect of the objective of the problem when it was first hatched and the contextual element that may vary from country to country in the case of contact tracing applications.
In contact tracing accountability is very important so the Controller of any Digital Contact Tracing Application should be clearly defined. In other countries these contact tracing apps are sponsored and made by the government and what is unique in the Philippines is that the Private Sector donated these applications without proper vetting from proper authorities (DICT) that is why there are mistrust on contact tracing. And normally, a contact tracing application is being owned by heath authorities and in the case of the Philippines there are two – the Department of Health (DOH) is using COVID Kaya and IATF / NTF / DILG is using StaySafe and definition of being a controller and processor is vague the parties involve. And If the deployment of these apps involves different actors their roles and responsibilities must be clearly established from the onset and must be explained to the users.
In addition, on the principle of purpose limitation, the purpose must be specific enough to exclude further processing to unrelated to the management of the health crisis (e.g. commercial, surveillance or law enforcement purposes). In the context of a contact tracing application, careful consideration should be given to the principle of data minimization and privacy by design:
- Contact tracing apps do not require tracking the location of individual users. Instead, proximity data should be used.
- As contact tracing applications can function without direct identification of individuals, mitigating measures should be employed to prevent re-identification.
- The collected information should reside on the mobile / terminal of the user and only relevant information should be collected when necessary. (there must be process in place to be triggered by health or local government units)
Recommendations:
- According to the PbD and data minimization, the data processed should be reduced to the strict minimum.
- The application should not collect unrelated or not needed information, which may include civil status, communication identifiers, messages, call logs, location data, device identifiers, etc.
- Data broadcasted by applications must only include some anonymized and pseudonymous identifiers
- These identifiers must be renewed regularly with same model on RSA encrypted keys on both private and public tokens
- Implementations for contact tracing can follow a centralized or a decentralized approach.
- These approaches must provide adequate security measures.
- Consideration must be considered weighing privacy in the process that may impact rights of individuals
- Cryptographic techniques must be implemented to secure the data stored in servers and the cloud
- Authentication between the application and the server must also be performed by using multi-factor authentication
- The reporting of users as COVID-19 infected on the application must be subject to proper authorization. If confirmation cannot be obtained in a secure manner, no data processing should take place that presumes the validity of the user’s status.
In the end this kind of applications must be strictly voluntary, and it cannot be forced because contact tracing has a thin line on surveillance systems and Individuals must always have full control over their data and the public should be able to choose freely to use such an application.
