skip to Main Content


This post is also available in: Italiano Español

Sharing data to face Covid-19 comes as demand and can compromise protection.

On March 20, the decision issued by the 4th Federal Court of the Judiciary Section of the Federal District was released, in which the Union was obliged to provide, on an immediate basis, information about patients who tested positive for Covid-19 at Hospital das Forças Armed, under penalty of a daily fine of R $ 50,000.00, in addition to civil, criminal and administrative liability of the competent public agent.

According to the magistrate,  “[…] it is well known that the proper identification of cases with positive serology for Covid-19 is fundamental for the definition of public policies for the urgent and urgent confrontation of the pandemic, in order to guarantee the preservation of the health system and the care of the population, so that, under no perspective, the Union’s refusal to provide this information to the Federal District, which has the constitutional competence to coordinate and execute epidemiological surveillance actions and services in its territory, is not justified . ”  So far, however, there is no news that the hospital would have fulfilled its obligation to do.

This is just a practical effect of the privacy and data protection mitigation wave caused by the Covid-19 global pandemic. Several of the countries that already have legislation in force on data protection, aware of the seriousness and urgency of ensuring the safety of their citizens, have issued exceptional guides for the treatment of data in situations of fighting the virus.

The  Global Privacy Assembly 2  brought together the main guidelines of the world’s data protection authorities, which decided to facilitate the secure data sharing to combat Covid-19.

The  European Data Protection Board 3 , for example, defined that if data processing is necessary, considering the relevant public interest in the sphere of public health, there is no need to obtain the consent of the data subjects.

In addition, it regulated the use of device localization in order to monitor, contain or mitigate the spread of Covid-19. However, he stressed that such data must be properly anonymized, which would remove the incidence of GDPR ( General Data Protection Regulation ). If any Member State deals with location data that has not been anonymized, it will be obliged to guarantee adequate security, as well as the right of action of the data subjects.

The  Information Commissioner’s Office , the UK data protection authority, has published a guide 4  for data controllers, ensuring that data from a particular organization can be passed on to authorities, if necessary, without legislation prohibiting such sharing.

China and South Korea follow the movement, with collection and treatment policies that are quite broad, and sometimes controversial, but obtaining results that are undoubtedly effective.

But how do the countries cited in practice apply these new guidelines? Basically, appropriating the location history of people proven to be infected to identify potential patients and ” heat zones “, areas with a large number of infected people.

This technology, called  Contact Tracing , works, in short, as follows: mobile devices store location records; when a person is confirmed for Covid-19, information about their recent movements is shared with health workers; third parties whose devices have registered recent proximity to the infected person’s device are notified of the risk of infection and instructed to isolate themselves. 5

Traditionally, health workers who identified a patient who tested positive for Covid-19 would request information about their recent activities in order to locate people who may have been infected in order to quarantine them. Without a doubt, analyzing location records stored on patients’ mobile devices and matching them with data from other sources tends to be much more efficient in determining who is at risk. 6

This measure was a key factor in containing the virus in South Korea and China, countries where there is good news about fighting the virus. However, the drastic measures adopted have raised concerns.

South Korea has created a system that, upon detecting a person infected with Covid-19, the city or district in which that person resides can send an alert to people living in the same region, including sharing information about locations in the infected has been.

An alert containing the age and gender of the infected person is sent, including detailed information about the person’s movements.

This information is collected using a closed circuit that includes television and credit card information, in order to list the locations that the infected person has visited. In certain districts, the level of detail goes so far as to tell which room the person was in, as well as whether they went to the bathroom. This information is available by  clicking here .

The Korean data protection authority ( Personal Information Protection Commission  – PIPC) has not developed guidelines on the use of data in the context of the pandemic. 7

The consequences of this massive collection by the Korean authorities have been taken to the National Human Rights Commission that has classified them as a violation of human rights. 8

At the same time, South Korea stands out for being able to flatten the case curve. At the end of February, the number of cases increased exponentially, from a few dozen to thousands of cases 9  and on Sunday, March 22, it registered only 64 new cases.

This excellent result is the result of four main measures, namely: 1) rapid intervention, before it becomes a crisis; 2) massive testing; 3) use of  Contact Tracing , isolation and surveillance and; 4) enlistment of its citizens.

A report in  The New York Times 10  found that the application used by the Chinese government to contain the pandemic did more than measure in real time who offered the risk of contagion.

According to the newspaper, analysis of the application’s source code revealed the sharing of information with law enforcement authorities. Furthermore, the  app  does not seem to clarify how it classifies those infected – red, yellow or green code – nor does the government do it, which causes fear and confusion among users oriented to isolate themselves without much explanation.

The publication highlights that the use of the  app , currently used in 200 Chinese cities and booming, is creating a scenario of social control that can last well beyond the pandemic.

Despite data protection concerns, it is unquestionable that  Contact Tracing  is playing a crucial role in combating Covid-19 and has been shown to be very effective in reducing contagion among people.

Advancing a scenario in which applications based on the same technology and for the same purpose start to work in Brazil, in the light of the General Data Protection Law (law 13.709 / 18), still in  vacatio legis , some considerations can be outlined beforehand.

A treatment similar to that taking place in other countries already severely affected by Covid-19 is authorized by the LGPD in its Article 11, II, ‘e’, ​​when it says that the processing of sensitive personal data may occur without the consent of the holder when indispensable for the protection of the life or physical safety of the holder or third parties.

In this context, the treatment of the data collected and shared, even without the clear, express and unequivocal consent of its owners, must strictly observe the specific purpose for which they were collected, under penalty of serious violations of the principles that govern data protection. in Brazil.

It should be noted that the collection of health data, without the consent of the holder, does not remove from them the extra layer of protection afforded by Law 13.709 / 18, maintaining its sensitive nature and, therefore, demanding different precautions against leakage incidents, which should be detailed in the Personal Data Impact Report.

In addition, they must ensure compliance with the principle of free access by the holders to the data collected, as well as the right to information about the treatment and its duration – which should not exceed the end of the pandemic.

Restrictive privacy measures seem inevitable in the current global scenario. With each passing day we are getting closer to the harsh reality that the Covid-19 pandemic throws on the territories that it affects and that calls for not only urgent measures from the government, but also a certain degree of detachment from its citizens.
The legislation that will come into force carries principles and foundations for a correct and ethical use of  Contact Tracing  in
Brazil, which must be observed even before its validity, thus avoiding that good initiatives are distorted.


Back To Top