Tracking mobile phones in Slovakia during the pandemics

A new Slovak Act on certain emergency measures in relation to the spread of COVID-19 will authorize the Public Health Authority to collect, process and store data from mobile phones of residents of the Slovak Republic, even without their consent. This measure means an unprecedented interference with the privacy of people by the state, but responds to an unprecedented situation.

In order to ensure that the processing of the data fulfills its purpose and at the same time cannot be misused by the authorities at a later stage, strict rules should apply to the processing of personal data. The Act itself specifies that the Public Health Authority will only be able to process basic identification data such as the user's first name, surname, address and telephone number, as well as information about where the user is located - so-called location data.

The purpose of personal data processing is:

(i)

preventing and modeling the development of life and health threats;

(ii)

the identification of the Recipients of notification messages about the special measures of the Public Health Authority for the purpose of life and health protection; and

(iii)

the identification of Users for the purpose of life and health protection. 

In addition, according to the wording of the Act, personal data will only be processed by the end of the year. Consequently, all personal data collected in this way should be deleted, provided, of course, that we will be able to handle the coronavirus pandemic by then.

 Although the state wants to have access to the data of each mobile phone user, it does not mean that the Public Health Authority will necessarily have to process the personal data of all Slovak citizens. It is also possible to monitor the movement of people according to location data from phones based on anonymized data (i.e. data aggregated in a way that individuals cannot be re-identified).

Personal data protection regulations emphasize minimizing data processing, and therefore, if a specific purpose (in this case, tracking people for statistical purposes to prevent and model life and health threats) can be achieved without the processing of personal data, the provider is obliged to refrain from processing personal data.

In this context, however, it should be added that the European Data Protection Board (EDPB) said in its Statement on the processing of personal data in the context of the COVID-19 outbreak that when it is not possible to only process anonymous mobile location data, the Member States should seek to introduce legislative measures to process non-anonymized location data to safeguard public security.

In the case of monitoring specific people whether they comply with the quarantine or sending SMS messages to persons infected with the virus, the personal (identification and localization) data of these persons will be processed. And exactly for such data processing the rules of the new Act on certain emergency measures in relation to the spread of COVID-19 (mentioned above) and the general principles and rules for the protection of personal data will apply. According to these, the Public Health Authority should, in particular, ensure that the processing of personal data takes place transparently and only for the specific necessary purpose and within the necessary material and time scope. 

The EDPB conveyed in its statement the message that European data protection rules do not hinder measures taken in the fight against the coronavirus pandemic because it is in the interest of humanity to curb the spread of diseases including the use of available technologies. The EDPB underlined that, even in these exceptional times, the data controller and processor must ensure the protection of the personal data and any action taken by the Member States in this context, it must respect general legal principles and must not be irreversible. 

If the state adheres to privacy and personal data protection rules, people will not have to worry that their personal data will be misused for purposes other than protecting public health in relation to the COVID-19 outbreak.