Article of the Month - March 2022

Data Privacy Protection and Geographic Data Use as an Answer to Covid-19

Rosario CASANOVA, Carlos Andres CHIALE and Mathilde SARAVIA, Uruguay
 
Rosario Casanova Carlos Andrés Chiale Mathilde Saravia

 

This article in .pdf-format (27 pages)

This article aims to reflect on the relevance of geographic data use in the COVID-19 pandemic and its relationshop with the privacy rights of the people involved.

SUMMARY

Based on the importance of the concept of proximity or direct contact associated with the spread of the COVID-19 virus, this article aims to reflect on the relevance of geographic data use in this pandemic and its relationship with the privacy rights of the people involved. Thus, this article includes a study of the international and Uruguayan regulations related to geographical and, in particular, localization data.
Finally, specific considerations about proximity contact applications as a tool for combating COVID-19 are presented, making special emphasis on the Uruguayan case.

1. INTRODUCTION

The spread of the COVID-19 or SARS-CoV-2 virus and the consequent declaration of a pandemic, issued by the World Health Organization in March 2020, are now a problem that exceeds the sanitary issue. It brings deep repercussions at an economic, social, political, cultural and environmental level with impacts on the local, regional and global scale. Consequently, the measures or responses implemented by different countries involve different dimensions that affect the lives of their inhabitants.
According to recent scientific research, established transmission pathways of SARS-CoV-2 are said to be both, close contact with patients with COVID-19 and the absorption of droplets through the airways (Tan and Wang, 2020).
Therefore, the location of a virus carrier is particularly relevant as its proximity to other people is the main factor of infection (Yi, Lagniton, Ye, Li, and Xu, 2020). Thus, geographic data and geomatics tools (GeoSciencie) take a prominent role in addressing this pandemic.
One of the GIS main strengths is the ability to integrate diverse georeferenced data sets, this facilitates the aggregation of health data with contextual characteristics. There are several academic studies of descriptive models that leverage this capability to examine the geographical associations of COVID-19 with the socio-economic and environmental characteristics of the region.
Based on the importance of the concept of proximity or direct contact associated with the spread of the virus, this article proposes a reflection on the role of geographical information as a tool for combating COVID-19 and its relationship with individual and collective law.

2. USE OF GEOGRAPHIC INFORMATION

Incorporating geographic information science and technology into surveillance, modeling, and response to the COVID-19 pandemic, improves not only the understanding but also the control of the disease.
This pandemic has highlighted the usefulness of applying geosciences to visualize cases and identify the most vulnerable areas, as well as the use of location-based intelligence tools to improve data representation deficiencies. (Rosenkrantza, Schuurmana, Bellb, & Amramc, 2020).
Therefore, in this article two different uses of geographic data are presented, one related to mobile applications and the other to the use of the geographical information as response in the fight against this pandemic.

2.1 Using Location in Apps

Nowadays, there is a wide number of mobile applications that require the geolocation of the devices as an input to carry out their function. This is the case of those which allow home delivery (PedidosYa[1], Rappi[2]), request transfer in vehicles (Uber[3]) and even messaging applications in which the location can be sent in real time to other contacts (WhatsApp[4]). All applications that require this type of geolocation ask the user for permission to gather this data.

Fig. 1: Screenshot on a mobile device from the PedidosYa app when location use is requested. Source: Own elaboration.

The use of localization by applications can be diverse. There are many applications in which the user's location data is key for them to operate. On the other hand, there are other applications in which the user's location is not essential but still requested. In those cases, location data is used to promote commercial stores when proximity is detected. In all cases, the use given to this information by application providers is uncertain.
In this sense, a case that has gained a lot of popularity in Spain refers to LaLiga mobile application. This Spanish football application provides information about football competitions, fixtures, teams, and players as well as national and international results.
When using this app, access to the location and microphone of the user's mobile device is requested. With these permissions, the place where the user was watching the game could be clearly identified because the device's microphone and geolocation were activated. With microphone access granted, anytime the user was near a television broadcasting a football game was detected, registering its location. Having gathered this information, it was possible to localize bars and restaurants which broadcasted football matches without paying royalties.

Consequently, the Spanish Data Protection Agency fined LaLiga with 250.000 euros (July 2019) for the intrusion of at least 50.000 Spaniards' mobile phones, due to a violation of the principle of transparency in not reporting microphone access in the application.
This event highlights the risks brought by the misuse of the data accessed by some apps. Although prior consent to have access to location data is requested, users do not always become fully aware of the implications and consequences of this authorization. Thus, it is important to stand out the relevance of including the ethical use of geographic information on the collective agenda.

2.1  The geoinformation use in the fight against the pandemic

2.2.1 Exposure Notification

With the global health emergency as a framework and considering the fact that epidemiological monitoring is thought as a key to contain the pandemic, two leading companies in terms of technology in mobile devices, Apple and Google, joined forces to develop a system that facilitates the crisis monitoring, by sending alerts of proximity to infected users. This system, called exposure notification, is based on the premise of taking care of the security and privacy of users. The app strictly focuses on carrying out the required epidemiological monitoring and does not directly use the user's location data.
Exposure notifications can then be enabled in different apps on both iOS or Android mobile operating systems. These apps require a strict authorization from Apple and Google in order to provide the user with exposure notifications. Authorization which is only given to official institutions in each country, in the case of Uruguay, the app is called Coronavirus Uy[5].
Exposure notifications do not use location data, they work using bluetooth to share codes with other devices that are nearby and have downloaded and activated this app. Each mobile device constantly broadcasts a random number and simultaneously records those codes coming from nearby devices. (Betarte, et al, 2020). These indicators are stored in each device for 14 days. In the event that a user tests positive for COVID-19, he can inform the application, which will request permission to upload the numbers generated by its device to a central server. Every day, the indicators received by each mobile are compared with those uploaded to the central server and in case of a match, an exposure alert notification will be given. From this alert, each person can use the application to request more information or assistance but can also choose not to tell anyone that they received the alert.
From our point of view, exposure alert applications are an efficient and decentralized mechanism for people to collaborate and receive virus exposure alerts quickly, while at the same time, respecting the privacy and willingness of all involved. In the case of Uruguay, the Coronavirus UY application also allows citizens with possible symptoms of the SARS-CoV-2 virus to be connected to health care providers, in order to reduce waiting times for medical attention. Despite the possible efficiency of this application, its success depends exclusively on the population's active use (Cascón, 2020).

Although in the next section we will go into the legal aspects, it is important to clarify that all the information collected in the application is covered by the Law on Protection of Personal Data and by the privacy policy of the application itself (Figure 2).

Fig. 2: Screenshot of the notification about the exposure alert in the Coronavirus Uy application. Source: Own elaboration.

2.2.2 COVID-19 situation mapping

The global understanding of this pandemic´s impact has proportionally grown with the use of mapping apps in public and private sectors. The most popular uses of mapping tools are the daily publications of news agencies or online dashboards in near real time (Boulos and Geraghty, 2020). Although many dashboards have been made, the most widespread example has been developed by the Johns Hopkins University[6]. These maps provide a clear visual representation of the impact of COVID-19 on morbidity and mortality and represent an effective political and social tool to communicate the impact of the disease (Rosenkrantza, et al, 2020).

3. LEGAL ASPECTS

There is no doubt that the SARS-CoV-2 virus has unleashed a world full of uncertainties, not only about its origins, forms of propagation, treatment, or possible vaccine, but also about the use of individual data as a tool to combat the pandemic. The privacy of data, the ethics in the use of information, particularly geographic information at the service of decision makers, raise many concerns and questions that are not easily answered (Pérez-Colomé, 2020).

This emergency situation should not imply a suspension of the fundamental right to personal data protection.  Nor could the data protection regulations be used to hinder or limit the effectiveness of the measures adopted by the health authorities. It is possible to think that a dichotomy is being created between individual freedom and community well-being. This discussion is not new but, at this time, is becoming more visible because of globalization, the wide access to international news, the Internet, the rapid spread of the SARS-CoV-2 virus, the widespread ignorance and uncertainty about the pandemic itself.
Therefore, this article includes aspects related to the international and Uruguayan legal framework regarding the privacy of personal data, focusing on the analysis of the protection of location data and the use of geographic information as a tool to combat the pandemic in the country.

3.1 Personal and sensitive data international legal framework

The protection of personal data has been the object of regulation of several international treaties to which our country has adhered.  However, the approach of such international standards precedes the "Internet" phenomenon, and consequently, although they are an unavoidable antecedent, they do not provide sufficient legal support to modern data traffic in the ICT era. On the other hand, there is no international body that "manages" data privacy on a global scale (Elgar, 2011). Consequently, in order to analyze international law on personal data protection, we must resort to comparative law at a regional level (the case of the European Union) and at the national level of some countries, such as the United States and China.
The protection of personal data in the European Union is presented as the paradigm in the matter and has been a reference for our country. In this sense, it is positioned in the human right to data protection in the digital era by enshrining in the Charter of Fundamental Rights[7] itself that everyone has the right to the protection of personal data concerning him or her, fair processing, for specific purposes and based on the consent of the person concerned and enshrines the right of everyone to access the data collected concerning him or her and to rectify it.
Unlike the European system, the United States data protection is regulated on a sectoral basis: it focuses on consumer protection from an economic perspective and not as a personal right. In North American law, data protection is part of the consumer protection law and the supervision of its compliance is a Federal Trade Commission´ responsibility. The Patriot Act of the United States was enacted after the terrorist attacks on September 11, 2001 and enabled security authorities to have access -in suspicious cases-, to local servers’ data stored without a court order. Internet and cloud providers could also be forced to disclose personal data even without informing those affected. In 2015, the United States Freedom Act was enacted again restricting the powers of the investigating authorities.

However, the Cambridge Analytica scandal in 2016[8] prompted the state of California to draft a strict law to protect user data, liable since January 2020. The California Consumer Privacy Act aims to allow consumers to be aware of which companies collect and use their data, as well as to demand, if necessary, to be deleted. In any case, nowadays there is no national law protecting the entire country, but some steps have been taken towards European standards of regulation on data general protection (GDPR-General Data Protection Regulation) (Thielemann, 2020).
Moreover, another great power such as China does not have, to date, a general data protection law. In 2017, the personal data regulation was given through a Cybersecurity Law that aimed at the network security and strengthening of data protection. The China Cyberspace Administration (CAC), the highest internet administrative law, enacted in June 2019 the Data Protection Regulatory Directive that sets the standards for customer data collection and processing, thus it represents future orientation basis to law. (Thielemann, 2020)
From the above, it can be concluded that although data privacy issues have been placed on the public agenda, several countries -at a national level as well as the world in its global concept- do not have specific regulations which include all aspects of privacy and data security intimes of pandemic (Cascón, 2020). The following section addresses the study of the Uruguayan case and the relationship between the regulation in force and the geographic and health data use.

3.2 The protection of personal data in Uruguay

Uruguay's commitment to personal data protection arises from the ratification of different international instruments that address this issue. Since 1948 Uruguay has ratified the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights (1966), and at a regional scale, the American Convention of Human Rights Pact of San José, Costa Rica.
The Uruguayan personal data protection main rule is the Personal Data Protection Law (Law No 18,331)[9] which establishes the right to personal data protection as “inherent to the human person” and refers to the Constitution of the Republic.
According to the referred law, personal data is defined as "information of any kind referring to specific or determinable natural or legal persons"; this is "... any numerical, alphabetic, graphic, photographic, acoustic or any other information that refers to them."[10]
In short, personal data is “... any type of information that can directly identify us or makes us identifiable, as our name, address, telephone, identity card, RUT, fingerprint, member number, student number, a photograph or even DNA "
However, as sensitive data the law considers: "personal data that reveal racial and ethnic origin, political preferences, religious or moral convictions, union affiliation and information regarding health or sexual life."

In this sense, it is important to specify that as one of the forms of protection the law requires to publicize personal data, the express consent of the person involved must be given and in the case of sensitive data, an express and written consent is required. (Betarte et. Al, 2019).
Likewise, categories of specially protected data are regulated, such as health and telecommunications data, among others. Regarding health data, the law empowers public or private health institutions and health sciences professionals to “… collect and process personal data related to the physical or mental health of patients who have been under treatment…” provided that professional secrecy principles are complied with, and that the law itself establishes the need for express consent.
Within this framework, and in accordance with transcribed legal definitions, location data fits into the personal data category, while the data on the health status of a person, such as being infected by COVID-19 must also be considered as sensitive and specially protected data.
It is clear from the above that location and individual health data are protected by international and national regulations but can be limited when the community health good takes precedence, only with regard to the requirement of prior consent. Limitations that always protect the anonymity of the person so that the security and confidentiality in the treatment of the data is preserved.
Therefore, it can be assured that Uruguayan legal requirements, in terms of personal data protection, are at the level of the highest international standards, which is materialized in the imposition of legal obligations to be contemplated in the technical requirements.

4. CONCLUSIONS

Even though there are many uncertainties surrounding the pandemic, it is unquestionable that proximity between people is the main factor of contagion, thus the location of an infected person becomes particularly relevant for himself and for others. The spread of infectious diseases is mainly a spatial process; therefore, geospatial data, technologies and analytical methods play a key role in understanding and responding to the COVID-19 disease pandemic.
The opportunities to incorporate geomatic tools into monitoring, modeling and response to this pandemic, range from developing spatial data infrastructures for surveillance, incorporating mobility data into infectious disease forecasting, using geospatial technologies for digital contact tracing, integrating geographic data into COVID-19 modeling, investigating geographical health disparities and social vulnerabilities, and reporting disease status or infrastructure status in order  to return to normal operations.
Additionally, in recent times, the pandemic daily monitoring has been done through the use of geographic data in dashboards. In this sense Uruguay is not unaware of global activity by implementing its own visualizer (MIRA), in which the number of contagions is daily shown, but with a level of data disaggregation due to protect privacy data of the people involved.
Regarding normative aspects, for the Uruguayan legal system, the location data falls into the category of personal data whose protection, following the European model, has a fundamental human right status. The location of a person carrying the SARS-CoV-2.2 virus also falls into the specially protected personal data category according to the national law personal data definition. Thus, it is necessary a dual requirement for its diffusion, which is an express and written consent. For this reason, Uruguay has national regulations that strongly protect and ensure the protection of individual and health data.
The geographic data used as a spatial analysis tool to support public decision-making in the fight against the pandemic are also protected in Uruguay, since the anonymity of those affected is preserved. While this is a strength, it can also be a weakness since it limits the generation of academic specific research. This impact can be minimized by providing these data with a higher level of disaggregation, as the one used for the national population and housing censuses (in which the anonymity of the data is also protected).
According to this research and regarding other location data apps, we can state that the registration of contacts via bluetooth used in the proximity alert applications, is the most advanced technique and also the one that works best for tracking those who are infected. This tool is not only recommended in terms of its positional quality, but also and mainly, because it is more efficient in protecting individual privacy.  In particular, the Coronavirus Uy application plays a fundamental role since it provides the above-mentioned benefits and, at the touch of a button, professional healthcare assistance to the community in general and to those infected in particular. Additionally, it is a tool that solves, or at least gives a very big and invisible hand, to the weakest link in the fight against COVID-19, which is the "epidemiological monitoring".
From a legal point of view, the application complies with the requirements of express and written authorization, requested in national regulations. Since it requires the user´s consent: specifically, the willingness and action to communicate that they contracted the virus and the acceptance of generating an alert for exposure to the users of the application who were close.
In other words, from our point of view, proximity alert tools are very suitable and comply with people's privacy rules. Therefore, it is a recommended tool to be used in several countries, even if they do not have a specific national regulation that protects the privacy of personal data.
It is fair to say that while the tool has these strengths, it has a great weakness that refers to the need for massive use by all residents. A fact that can be a problem because it requires mobile phones that support this technology and users who know how to use them properly.
In any case, these limitations can be overcome, but a strong public policy is required to promote, train, facilitate and ensure that a very high percentage of the inhabitants use it. To this end, strong communication campaigns, training plans, problem-solving centers for users, and even the possibility of designing and constructing simple special devices, free of charge for the inhabitants, created solely to fulfill the functions of data exchange and proximity alerts, could be considered. The academy has a lot to contribute in this sense.


[1] Web site of Pedidos Ya: https://www.pedidosya.com.uy/
[2] Web site of Rappi: https://www.rappi.com.uy/
[3] Web site of Uber: https://www.uber.com/
[4] Web site of Whatsapp: https://www.whatsapp.com/
[5] Web site of Coronavirus Uy: https://www.gub.uy/ministerio-salud-publica/politicas-y-gestion/informacion-sobre-aplicacion-coronavirus
[6] Web site of the Dashboard of John Hopkins University: https://coronavirus.jhu.edu/map.html
[7] The Charter of Fundamental Rights is a document including a set of personal, civil, political, economic and social rights of citizens and residents of the European Union, proclaimed by the European Parliament, the Council of the European Union and the European Commission in December 2000.  https://www.europarl.europa.eu/charter/pdf/text_es.pdf
[8] Cambridge Analytica is a data analysis company that accessed data from 87 million Facebook users.
[9] Law of Personal Data, Law 18331 of August 11, 2008: https://www.impo.com.uy/bases/leyes/18331-2008
[10] Regulatory Decree (of the Law) No. 414/009 of August 31, 2009: https://www.impo.com.uy/bases/decretos/414-2009/40

REFERENCES

Adekunle, I. A., Onanuga, A., Wahab, O., Akinola, O. O. (2020). Modelling spatial variations of coronavirus disease (COVID-19) in Africa. Science of The Total Environment, 138998.
 
Betarte, G., Campo, J. D., Delgado, A., Ezzatti, P., Forteza, Á., González, L., Martin, M. Muracciole, B. y Ruggia, R. (2020) Desafíos de seguridad y privacidad en el diseño e implementación de soluciones de rastreo de proximidad.  Retrieved from: http://www.pedeciba.edu.uy/docspd/covid_CT_position_betarteetal-1.pdf
 
Boulos, M. N. K., Geraghty, E. M. (2020). Geographical tracking and mapping of coronavirus disease COVID-19/severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) epidemic and associated events around the world: how 21st century GIS technologies are supporting the global fight against outbreaks and epidemics.
 
Brito, M. (1985). “El principio de legalidad e interés público en el derecho positivo uruguayo”, La Justicia Uruguaya.

Cascón-Katchadourian, J. (2020). “Tecnologías para luchar contra la pandemia Covid-19: geolocalización, rastreo, big data, SIG, inteligencia artificial y privacidad”. Profesional de la información, v. 29, n. 4, e290429.  Retrieved from: https://doi.org/10.3145/epi.2020.jul.29
 
Economic Commission for Latin America and the Caribbean (UN-ECLAC) and United Nations Committee on Global Geospatial Information Management for the Americas (UN-GGIM: Americas) (2020) Questionnaire on geospatial response to COVID-19 in the Americas.
 
Edward (2011). Research Handbook on Governance of the internet, Edition I.
 
Kuhn, C., Beck, M., Strufe, T. (2020). Covid Notions: Towards Formal Definitions--and Documented Understanding--of Privacy Goals and Claimed Protection in Proximity-Tracing Services. arXiv preprint arXiv:2004.07723.
Pérez-Colomé, J. (2020). “Apple y Google se alían para facilitar que las apps para rastrear el coronavirus estén en todos los móviles”. El país, April 10, 2020.  Retrieved from: https://elpais.com/tecnologia/2020-04-10/apple-y-google-se-alian-para-crear-un-sistema-de-rastreo-del-coronavirusque-no-necesite-descargar-una-app.html
 
Rosenkrantz, L., Schuurman, N., Bell, N. & Amram, O. (2020). The need for GI Science in mapping COVID-19. Health & Place, 102389.
 
Santirso, J. (2020). “Corea del Sur: contra el coronavirus, tecnología”. El país, March 14, 2020.  Retrieved from: https://elpais.com/tecnologia/2020-03-13/corea-del-sur-contra-el-coronavirus-tecnologia.html
Schwartz, P. M., Peifer, K. N. (2017). Transatlantic Data Privacy Law. Geo. LJ, 106, 115.
 
Smith, C., Mennis, J. (2020). Peer Reviewed: Incorporating Geographic Information Science and Technology in Response to the COVID-19 Pandemic. Preventing Chronic Disease, 17.
Orellano, D., Toledano, B. (11 de junio de 2019). Multa a LaLiga de fútbol por usar el móvil de 50.000 españoles para espiar. El Mundo.
 
Retrieved from: https://www.elmundo.es/tecnologia/2019/06/11/5cff9a0ffdddff531a8b466e.html
Tang, L. Y., Wang, J. (2020). Anesthesia and COVID-19: What We Should Know and What We Should Do. Seminars in Cardiothoracic and Vascular Anesthesia, 24(2), 127–137.   Retrieved from: https://doi.org/10.1177/1089253220921590
 
Thielemann, S. (Novembre 27, 2020). Protección de datos fuera de la UE. HornetSecurity.  Retrieved from: https://www.hornetsecurity.com/es/seguridad-de-la-informacion/proteccion-de-datos-fuera-de-la-ue/
 
Yi, Y., Lagniton, P. N., Ye, S., Li, E., & Xu, R. H. (2020). COVID-19: what has been learned and to be learned about the novel coronavirus disease. International journal of biological sciences, 16(10), 1753.

BIOGRAPHICAL NOTES

Rosario Casanova (Uruguay) is a Land Surveyor Engineering, expert in geomatics, geo-technologies, urban planning, she has a master's degree and a doctorate in these areas.
Since 1994 she is a professor at the Institute of Land Surveying of the Faculty of Engineering of the University of the Republic, Uruguay. Being the Director of the Institute of Surveying from 2014 to March of this year.
She is the chair of the United Nations Academic Network for the Americas for Geospatial Data Management (UN-GGIM) since it was created in 2017.
She has served as professor in the Lincoln Institute of Land Policy (LILP) in the Latin America and Caribbean Program and carried out several research projects on the informal land market.
She has presented research in regional and international events.
 
Carlos Chiale (Uruguay) has graduated as Cartography Technologist (2015) in  the University of the Republic, Uruguay, and as Bachelor degree of Sytems (2020) in ORT University.
He works as consultant in information in National Emergency System of Uruguay.
He is a member of Geomatic Department at Surveying Institute, Engineering Faculty of the University of the Republic, Uruguay.
 
Matilde Saravia (Uruguay) has graduated as a lawyer (2006) and as planning and urban development magister (2017) in the University of the Republic. She has specialized herself in planning, integrated water management and environment since 2009 and she works as a consultant in these areas. She is a member of the Technical Legal Department of the Land Surveyor Institute, Engineering Faculty, University of the Republic.

CONTACTS

Rosario Casanova
Instituto de Agrimensura, Facultad de Ingeniería, Universidad de la República.Montevideo
URUGUAY
 
Carlos Andrés Chiale
Instituto de Agrimensura, Facultad de Ingeniería, Universidad de la República.
Montevideo
URUGUAY
 
Matilde Saravia
Instituto de Agrimensura, Facultad de Ingeniería, Universidad de la República.
Montevideo
URUGUAY
Email: matildes@fing.edu.uy