Contact tracing applications: ethical, cultural and educational challenges

Committee Opinion | Doc. 15660 | 30 November 2022

Committee

Committee on Legal Affairs and Human Rights

Rapporteur :

Mr Vladimir VARDANYAN, Armenia, EPP/CD

Origin

Reference to Committee: Reference 4543 of 20 November 2021, Doc. 15165. Reporting committee: Committee on Culture, Science, Education and Media. See Doc. 15648. Opinion approved by the committee on 14 November 2022. 2023 - First part-session

A Conclusions of the committee

1. The Committee on Legal Affairs and Human Rights welcomes the report prepared by Mr Duncan Baker (United Kingdom, EC/DA) for the Committee on Culture, Science, Education and Media. It is a helpful contribution focussing on the increasingly important issues and challenges posed by digital health technologies, including contact tracing applications. The Committee on Legal Affairs and Human Rights agrees with the main thrust of the draft resolution.

2. The committee would like to suggest some amendments to highlight the importance of the right to private life, as protected under Article 8 of the European Convention on Human Rights (ETS No. 5); the importance of a time-limited approach to data retention; the importance of ensuring adequate consideration is given to the rights of the child whenever children may use these digital public health technologies; and to emphasise that consent must be freely given, specific, informed and unambiguous.

3. The committee also proposes a small number of technical amendments to highlight these considerations. These considerations supplement and do not contradict the valid contribution from the Committee on Culture, Science, Education and Media, with which we agree.

B Proposed amendments

Amendment A (to the draft resolution)

In paragraph 3, delete the words “and countless other health, lifestyle and wellness applications”.

Amendment B (to the draft resolution)

In paragraph 3, replace the words “right to a private life” with the following words:

“right to respect for private life, protected under Article 8 of the European Convention on Human Rights (ETS No. 5), as well as specifically through the guarantees set out in Convention 108 and its amending Protocol (CETS No. 223), Convention 108+. Respecting the confidentiality of health data is a vital principle in the legal systems of all States Parties to the European Convention on Human Rights. In particular, in order to respect the right to private life in Article 8 of the Convention, domestic law must afford appropriate safeguards to prevent the inappropriate communication or disclosure of personal health data.”

Amendment C (to the draft resolution)

At the beginning of paragraph 4, add the following words:

“In its Resolution 2338 (2020) the Assembly noted that “a lack of public trust in such apps due to privacy-related concerns, resulting in low levels of installation or use, would seriously undermine their effectiveness”. Hence,”.

Amendment D (to the draft resolution)

In paragraph 4, before the words “the data protection standards” add the following words:

“the right to private life and with”.

Amendment E (to the draft resolution)

In paragraph 5, after the 3rd sentence, add the following sentence:

“Data should not be retained unless necessary for a legitimate purpose, and should only be retained to the extent and for the duration necessary.”

Amendment F (to the draft resolution)

In paragraph 5, after the 4th sentence, add the following sentence:

“Specific care must be taken in the design and application of these applications to ensure respect for the rights of the child, adequate safeguarding of children, and in particular the rights of children to privacy and to have their personal data protected.”

Amendment G (to the draft resolution)

At the end of paragraph 8, add the following sentence:

“As with other, particularly digital, forms of data processing, it is important that consent is freely given, specific, informed and unambiguous – this includes ensuring adequate transparency in how data is being used.”

Amendment H (to the draft resolution)

In paragraph 11, replace the last two sentences, with the following sentence:

“However, these standards must be applied in a way that allows for necessary data collection provided that the appropriate safeguards are present. The right balance between data protection standards and public health objectives must be struck not only to help fight the current pandemic but also to design future technology aimed at tackling future health crises.”

Amendment I (to the draft resolution)

In paragraph 13.2 replace the words “and are adequate and proportionate to achieving the intended goal”, with the following words:

“, are adequate and proportionate to achieving the intended goal, and that such data is only retained to the extent and for the duration necessary for those objectives;”

Amendment J (to the draft resolution)

At the end of paragraph 13.3, add the following words:

“and to ensure consent is freely given, specific, informed and unambiguous”

C Explanatory memorandum Mr Vladimir Vardanyan, rapporteur for opinion

1. I would like to welcome the report prepared by Mr Duncan Baker (United Kingdom, EC/DA) for the Committee on Culture, Science, Education and Media, which is a helpful contribution to focus on the increasingly important issues and challenges posed by digital health technologies, including contact tracing applications. The Committee on Legal Affairs and Human Rights agrees with the main thrust of the draft resolution.

2. I have proposed a minor amendment to delete the words “and countless other health, lifestyle and well-being applications” in paragraph 3 of the draft resolution as I consider that otherwise this risks broadening the issues out to applications that are beyond the scope of the topic for report (Amendment A).

3. The Committee on Legal Affairs and Human Rights shares a significant interest in the right to private life and data protection with the Committee on Culture, Science, Education and Media – and we value the different perspectives each committee brings to this topic. The current draft resolution focusses quite significantly on the role played by Convention 108 and 108+ in protecting data protection within the Council of Europe area. I would, in particular, like to suggest some amendments to highlight the importance also of the right to private life, protected under Article 8 of the European Convention on Human Rights (ETS No. 5), and benefiting from the role played by the European Court of Human Rights in ensuring respect for human rights. The right to private life is engaged by the use of digital public health technologies. Moreover, Article 8 is a right that imposes positive obligations on a State, requiring it to take positive steps to ensure that the right to private life is protected by private actors such as companies responsible for digital technologies. Respecting the confidentiality of health data is a vital principle in the legal systems of all States Parties to the Convention (see, for example, Y.G. v. Russia [(1) Y.G. v. Russia, Judgment of 30 August 2022, Application No. 8647/12.]). This requires domestic law to afford appropriate safeguards to prevent the communication or disclosure of personal health data where this is inconsistent with the guarantees in Article 8. Whilst the guarantees provided by Convention 108 and Convention 108+ are, as the Committee on Culture, Science, Education and Media rightly highlights, central to data protection consideration, I consider it is only correct for the Assembly’s report to also reflect the important role played by the right to private life protected under Article 8 of the European Convention on Human Rights (Amendments B, D and H).

4. In paragraph 4, I have suggested including a reference to Resolution 2338 (2020) to ensure consistency with earlier reports and to recall that the Assembly noted that “a lack of public trust in such apps due to privacy-related concerns, resulting in low levels of installation or use, would seriously undermine their effectiveness” (Amendment C).

5. The importance of a time-limited approach to data retention is well known from both the perspective of data retention cases in relation to Article 8 of the European Convention on Human Rights as well as the requirements of international data protection standards. This includes the fact that any justification for data retention needs to continue to remain pertinent and necessary in order for the data retention to continue to be justified (Amendments E and I).

6. Whenever digital applications either target children, or could be used by children, specific rules exist, and enhanced protection is required, in order to ensure that consideration is given to child safeguarding and to the rights of the child whenever children may use these digital public health technologies. In particular, given the explicit reference to awareness-raising in schools in paragraph 13.5 of the draft resolution, it is perhaps appropriate to acknowledge the specific care that is needed when dealing with children and data protection, and the importance of paying due regard to the rights of the child (Amendment F).

7. One of the main challenges with reliance on consent as a justification for data processing is that there are risks that it is used by companies to gain significant amounts of data without the data subject necessarily being fully aware of the implications of giving their consent, or of what other options they may have. For this reason, I consider that it is important to emphasise that if consent is relied upon, that consent must be freely given, specific, informed and unambiguous – this includes ensuring adequate transparency in how data is being used (Amendments G and J).

8. In relation to amendment H, I have suggested some minor amendments to reflect the balance that needs to be struck in order to comply with Article 8 of the European Convention on Human Rights. The requirements of Article 8 as well as those of data protection standards mean that data collection must be necessary (not just detailed) and moreover that the balance to be struck is between the right to private life and public health objectives (not health impact assessments). Whilst I understand the point being made that sometimes the requirements of public health objectives might justify the collection of detailed public health data (where it is proportionate and necessary to do so), I think it is important that we try to accurately reflect the language of the legal test that would be applied by the European Court of Human Rights so as not to inadvertently suggest any departure from the requirements of Article 8 (Amendment H).