Ramiro Alvarez Ugarte
The privacy movement has always waged battle in difficult terrain, marked by the objective willingness of citizens to cede their data in exchange for benefits that they perceive as useful. The COVID-19 pandemic poses a new challenge that must be viewed as part of this long history in order to be effectively understood, and I believe that the challenge has never been so great.
Let me begin by presenting the adversary in the best possible light. A massively adopted surveillance technology already exists in society, on top of which an additional layer is being proposed for deployment in exchange for two concrete benefits: slowing the spread of the virus and lifting quarantine measures more efficiently. The promised benefits are significant and should not be quickly cast aside. Fewer deaths and less sustained economic damage appear as desirable objectives in the context of a rather frightening situation that has literally all of us locked up in our homes.
The new layer of surveillance on offer could take different forms. In China, it has manifested as a digital passport accessible via a popular e-wallet system that classifies people according to nebulous criteria. For the West, large companies are promising solutions that are more respectful of citizens’ privacy. Meanwhile, several governments have looked for some kind of technological solution to the problem. All these scenarios have their disadvantages: the ones that are specific to Latin America have already been pointed out by local organizations. In this brief space, I would like to draw attention to a structural dimension that I believe should guide us in reacting to this challenge. To do so, I’ll employ the old concept of layers, from the “internet world.”
Indeed, I believe that the best way to approach the newly proposed surveillance is to understand it as “one more layer” that would be deployed over a series of underlying layers. The image is useful because the underlying layers largely define how the top layer operates; they determine what the top one can achieve and what it asks of us in return. That is to say, the new layer of surveillance is deployed on top of an existing infrastructure, on top of specific socioeconomic situations, and, crucially, on top of the operating patterns of democratic institutions, both in terms of decision-making and mechanisms for accountability.
It is this layer of “democratic governance” that I want to focus on, seeing as I sense that the new layer of surveillance being offered to us is more or less inevitable, in part because it already exists: global users of Google Maps already allow access to their location data in return for a richer user experience. Who wouldn’t allow access to their location data in exchange for their neighbors’ survival? This focus asks us, therefore, to make a tactical pivot in order to reduce the damage or influence the decision-making process that would lead (or not lead) to a new layer involving sensitive data and the manifest intention to make it “shareable.” By doing so, we enable other people and/or health authorities to more closely monitor the population during times of quarantine.
The first step in this direction requires assuming that surveillance technologies indeed operate in one way or another in accordance with the function of the underlying layers. Thus, for example, an invasive system of mass surveillance of communications may be questionable in and of itself, but its consequences will simply be different according to whether it’s implemented by a dictatorship or by a democracy. Similarly, a CCTV system can have different consequences if the authority in charge of it is, for instance, accountable on a regular basis to a legislative oversight committee, versus if it has absolute discretion to expand, use, and enhance that system.
The second step is, then, to analyze and study the aspects of democratic governance that will determine the function of the new layer of surveillance and take direct actions specific to them.
• The personal data infrastructure. What kind of protection exists in our country? Is it effective? Is the current legislation up to date? How do the bodies responsible for protection or enforcement work? In many countries, the answers to these questions are disappointing, but there is also special protection for “sensitive” data. Another issue that needs to be examined is related to existing mechanisms for accountability. Could the judiciary branch, for example, exercise effective control over contagion tracking systems? What about the legislative branch?
• The reach of the exception. It is fundamental that we assess the extent to which our institutions are capable of creating policies of “exception” and respecting that exceptional character. In my country, for example, rules for exceptional situations have often been created and then normalized. Can we prevent that from happening? On the other hand, it is also important to pay attention to the various instruments that can be used to define the limits of the state of emergency (time limits/expirations, objective criteria such as numbers of cases, etc.). Therefore, it is essential to evaluate the current constitutional mechanisms that allow the state of emergency to be legally “produced” and the controls that regulate these mechanisms.
• Science. Another possible focus is to partner with epidemiologists, who know that an app could never be the sole tool used to manage a pandemic, a complex equation of which contact tracing is only a small part. For example, everything indicates that without a substantial increase in a society’s testing capacity, a tracking application could yield erroneous results (false positives and negatives). This is a typical tactical approach: focus on the underlying vulnerability of a proposal that is simpler and cheaper, and which surfaces as an alternative intervention when a more complex and effective proposal is too costly.
• Constitutionality. There is no reason why, upon being confronted with the deployment of technological tools, the least possible invasion of privacy cannot be demanded. In this case, the constitutional arguments that demand there should be limitations on measures that restrict rights, without sacrificing their capacity to meet their objective, should be helpful. The analysis of these limitations should take into account the amount of information collected, the guarantees established, the voluntary nature of monitoring programs, etc. Local constitutional law should be the basis of these indirect strategies, even more so, I believe, than international human rights standards.
• Transparency. All actions to be taken by governments must be transparent; they should also be designed and implemented for the benefit of citizens, with sufficient political, legal, and social controls. It is likewise essential to consider the ways in which an additional layer of control can be set up, quickly and at no additional cost, and placed on top of the new layer of surveillance, e.g. via workplaces or traffic on public roads, where public authorities or private entities oversee the right of entry. Thus, if a digital passport system is established, what prevents a supermarket from requiring the credential to be displayed before entering? This possibility should lead us to a second and vital issue: the multiple discriminatory impacts that such technologies could have.
Those who have been working on digital rights in Latin America for years will see that what has been said up to this point looks like a hasty repackaging of old challenges. But this is because these challenges are persistent: despite advocacy efforts, increased public awareness, legal changes, and occasional scandals, invasive technologies seem to be advancing at a more rapid pace. COVID-19 presents an even more difficult scenario in which existing models intrude even deeper in exchange for concrete benefits. Never was the offer of those asking us to exchange our privacy for some possible benefit so tempting. It would be unacceptable political innocence not to see the issue from the point of view of the political leaders currently in office, who face an unexpected situation with an impact that, while still uncertain, will be massive. And it would be inept of us not to adjust tactics (and strategies) to rise to the new challenge.
Ramiro Alvarez Ugarte is an associate professor of constitutional law at Universidad de Buenos Aires and a professor of law and social change at Universidad de Palermo (Buenos Aires). He is currently pursuing a JSD at Columbia Law School. Previously, he worked as a human rights lawyer at the Inter-American Commission on Human Rights (2009-2011) and at Asociación por los Derechos Civiles in Argentina (2011-2014), where he developed its privacy agenda. He holds an LLM from Columbia Law School (2009), where he was both a Harlan Fiske Stone Scholar and Fulbright Visiting Scholar.