COVID-19 has been a grim reminder of how unfair the world is.  People of color and people who are economically challenged have had more than their fair share of the disease and its consequences.  One way to limit the damage to human life has been the use of data associated with people for isolating COVID-19 hot spots.  Data protection authorities globally have issued guidance that declare that tracking applications must be proportionate, considering the rights to privacy and data protection.  However, it is not clear they have asked the same question in reverse: Is the right to privacy proportional to the right to life? Or the right to health? Or the right to conduct a business? Or in other contexts the rights to liberty and security?

The IAF has been thinking about proportionality as a process that is specific to balancing the full range of fundamental rights.  This viewpoint seems to be consistent with many parts of the GDPR (e.g., the balancing tests required in Legitimate Interests or Data Protection Impact Assessments).  This approach also is consistent with the view that while it is a fundamental right, data protection is not an absolute right.  Today, proportionality most often seems to be referenced within a fundamental right (e.g. “protection of personal data”) and less often as a construct that should be applied to a fuller range of fundamental rights. In short, if the GDPR requires an assessment of the full range of fundamental rights, then the proportional balance should be against this full set of rights. Picking and choosing applicable rights is inconsistent with both the GDPR and the EU Charter of Fundamental Rights. While other parts of world may not have the explicit connection as in Europe (EU Charter of Fundamental Rights and the GDPR), the implicit connection exists between privacy and other rights and by extension should be balanced in a proportional way.

This disconnect is shown when law professors Hannah van Kolfschooten and Annick de Ruijter explore when public interest might abridge individual rights in a proportional manner in their paper, “COVID-19 and Privacy in the European Union:  A Legal Perspective on Contact Tracing.”  Since the court cases related to health screening are limited, the paper looks to the case law related to government interest in national security.  The paper speaks about the issue as public interest, national security and public health versus individual rights to privacy and data protection.  In reality, COVID-19 impacts individuals’ rights to life and health and ability to be freely employed.  Those are individual rights, not just collective societal rights. The recitals to the GDPR frame the right to data protection as one of the rights that exist among the full range of rights and freedoms impacted by the decision to process or not process data; therefore, they all should be considered.

Prior to this view of proportional balancing, the IAF put on the table in the “Unified Ethical Frame for Big Data Analysis” the view that the applied ethic of legal, fair and just requires an analysis of the full range of fundamental rights and interests and consideration of society as a group of individuals.  The IAF then further argued that the impact of not processing data also should be weighed with the impacts of processing data.

This vision of proportionality among fundamental rights is reflected in IAF’s work in Europe, Hong Kong, and Canada on ethical assessments.  Those assessments proposed questions that thoughtful organizations should ask.

This concept of looking at a fuller range of fundamental rights was reflected in the European Court of Justice’s decision in the Google Spain case. There the court recognized that the fundamental rights to information and conducting a business are both rights that should be considered.  Yet, neither the European Data Protection Board nor its constituent authorities have issued guidance or opinions that reflect the view that personal data involves a risk benefit or detriment analysis that is proportional among all rights and not singularly focused on the rights to privacy and data protection.

This narrow focus on data protection and privacy is an issue that is much broader than the COVID-19 pandemic.  Yet the virus has been a useful mirror on assessment and balancing processes that might be conducted in a more complete manner.  In the end, excellent data protection needs to be in context and proportional to its impact on the full range of rights and interests. 

Proportionality across fundamental rights will be fully explored in future IAF work.