Hostname: page-component-6898cfcb55-kwdml Total loading time: 0 Render date: 2026-11-11T07:29:13.587Z Has data issue: false hasContentIssue false
  • English
  • Français

Tracking and Nudging through Smartphone Apps: Public Health and Decisional Privacy in a European Health Union

Published online by Cambridge University Press:  16 November 2020

Josephine VAN ZEBENOpen the ORCID record for Josephine VAN ZEBEN[Opens in a new window] and
Bart A. KAMPHORST
Josephine VAN ZEBEN
Affiliation:
Professor and Chair of the Law Group, Wageningen University, Wageningen, The Netherlands; email: josephine.vanzeben@wur.nl.
Bart A. KAMPHORST
Affiliation:
Postdoctoral researcher, Department of Social Sciences, Wageningen University, Wageningen, The Netherlands.
Rights & Permissions [Opens in a new window]

Abstract

In response to the SARS-CoV-2 pandemic, European Union (EU) Member States adopted technological solutions aimed at mitigating the effects of the virus, as well as enforcing newly adopted public health measures. Examples include apps for disseminating information, performing self-diagnosis, enforcing home quarantine orders and aiding contact tracing. This extensive use of technology for tracking and promoting public health raises important questions regarding EU citizens’ privacy. Thus far, the discourse in this regard has predominantly revolved around data protection, the risk of surveillance and the right to control access over one’s personal information (informational privacy). In light of the push towards a more unified approach to mitigating the current pandemic and future health crises through a European Health Union (EHU), we consider a different dimension of privacy that may be at risk when employing technology for public health, namely the right to non-interference with one’s decisions (decisional privacy). In particular, this article focuses on whether the advances in health-related persuasive technology, together with a more general movement towards “nudging” as an individual and public health tool, will require EU legislation to further protect decisional privacy by regulating “hypernudging” technologies and to guide the EHU in coordinating public health measures that utilise these technologies in a privacy-preserving way.

Information

Type
Articles
Information
European Journal of Risk Regulation , Volume 11 , Special Issue 4: Beyond COVID-19: Towards a European Health Union , December 2020, pp. 831 - 840
Copyright
© The Author(s), 2020. Published by Cambridge University Press

I. Introduction

As the second wave of the SARS-CoV-2 pandemic is flaring up in the European Union (EU), Footnote 1 the debate regarding the EU’s role in these situations continues. The threat and consequences of COVID-19 are expected to affect the daily lives of European citizens for many years, Footnote 2 and the economic effects will be widespread, Footnote 3 permanently transforming many industries. Footnote 4 From a legal perspective, it is interesting to see that the EU’s obstacles to providing leadership in health crises such as the SARS-CoV-2 pandemic do not appear to be linked to a lack of competence; the Treaties already provide a strong basis for EU action under such circumstances. Footnote 5 Nevertheless, the response to COVID-19 was initially primarily national, with the EU having to defend its seat at the table.

The regulatory response to the pandemic also reignited discussion regarding the future role of the EU in health law and policy. As is often the case in debates on EU competence, Footnote 6 the choice appears to be a dichotomous one between a return to Member State-based health politics and policies or the creation of a clear EU mandate for EU legislation and coordination of health policy, including, but also beyond, future pandemics. Footnote 7 Those who believe that a larger health-related role for the EU is preferable consider the establishment of a European Health Union (EHU) – modelled after initiatives such as the Energy Union – to be a desirable next step. Footnote 8

This special issue engages with the emerging debate on an EHU by offering insights pertaining to Treaty changes that may or may not be necessary to facilitate it and the sectoral reforms that these may entail. Our contribution engages with this topic by highlighting how an EHU, if established, will have to play a role in the EU’s difficult balancing act between protecting individual fundamental rights and collective societal interests, in particular between the individual right to privacy and the collective interest of public health. We take as our starting point that the EU already plays a role in balancing fundamental rights with health law and policy, Footnote 9 and we consider the regulatory frameworks and privacy safeguards that an EHU will have to abide by. Footnote 10

The motivation for this focus is twofold. First, during the current pandemic, Member States have adopted different types of measures that curtail the right to privacy to various degrees. Footnote 11 For example, the Slovakian parliament passed an amendment – justified under a state of emergency – that gives the Public Health Office access to location data from mobile phones in order to track individuals who reported positive for the virus.Footnote 12 In France, a similar amendment was rejected, despite France also having declared a state of emergency.Footnote 13 As we will show in Section III, this disparity between Member States extends to the use of certain smartphone technologies that collect, store and process personal data.

Second, we expect that new public health-related technical innovations will continue to be developed to curtail the current pandemic and to prepare for future epidemiological crises. Specifically, we foresee a push towards the integration of data-driven “persuasive technologies”Footnote 14 into smartphone apps to persuade or “nudge” individuals into conforming with public health measures. The use of apps in this way may negatively affect the right to non-interference with one’s decisions (“decisional privacy”), especially when it is difficult for individuals to observe how they are being nudged. This dimension of privacy is increasingly relevant in relation to public health regulation, as public health measures that target people’s decision architectures are becoming more common.Footnote 15 Legally, there is recognition of this dimension of privacy, especially in case law, but at the same time gaps in regulation persist.

In order to understand the potential role of an EHU regarding these issues, we will first highlight the distinctions between informational and decisional privacy (Section II). We will then consider the implications of the fact that decisional privacy is not (yet) protected by the EU’s privacy legislation to the same extent as informational privacy. If part of the mission of the EHU is to assist EU citizens – and their Member States – in effectively responding to future public health emergencies, the EHU will increasingly have to consider measures that affect both informational and decisional privacy. This raises the question of whether existing EU privacy legislation is equipped to guide the EHU on the issue of decisional privacy. As part of this discussion, we will consider some of the measures that have been taken in the EU to protect the public from the spread of SARS-CoV-2 through the use of apps, and how these apps may evolve in the future (Section III).Footnote 16

II. Legal protection of informational and decisional privacy

The right to privacy has existed for centuries, long before the creation of modern-day technology. In Jewish law, privacy law is built on the doctrine of hezzek re’iyyah (injury caused by seeing), which recognises that one should be protected even from the possibility of observation.Footnote 17 Our understanding of privacy, and the ways in which it may be infringed, continues to develop with society.Footnote 18 The rise of “Big Data”Footnote 19 has been formative for our understanding of privacy as “informational privacy”, which centres on those aspects of privacy that relate to controlling access to one’s personal information.Footnote 20 As a result, the right to data protection is now often seen as an essential prerequisite to the right to privacy.Footnote 21

Since 2018, the EU has regulated informational privacy through the General Data Protection Regulation (GDPR).Footnote 22 The GDPR is widely regarded as representing the state of the art with respect to data protection.Footnote 23 It applies to any data controller or processor that offers goods or services to “data subjects” (the term used to refer to individuals whose data are processed) within the European Economic Area (EEA).Footnote 24 This includes data controllers and processors who are not located in the EEA themselves but whose data subjects are.Footnote 25 Many jurisdictions outside the EU/EEA have used the GDPR as a model for their own legislation.Footnote 26 With respect to informational privacy, the GDPR’s provisions on the rights of the data subject are of central importance; they include transparency,Footnote 27 access,Footnote 28 rectification and erasureFootnote 29 and the right to object,Footnote 30 as well as conditions that are placed on controllers and processors with regards to holding personal data, including pseudonymisation,Footnote 31 securityFootnote 32 and the assignment of a data protection officer.Footnote 33

While the right to data protection is not absolute in the EU, especially in light of the importance of data for national security, the European Data Protection Supervisor (EDPS) has an oversight role in these areas, and the European Court of Justice has found a broad scope of application for the Charter protections in this area.Footnote 34 An important issue in this context, which is especially relevant for the measures adopted during the pandemic,Footnote 35 is the question of “interoperability” between information systems. While it is important for Member States to be able to share information, especially in light of the freedom of movement of EU citizens and the borderless Schengen area, such exchange is subject to strict conditions.Footnote 36

The issue of decisional privacy, which, as mentioned, relates to non-interference in one’s decisions and actions,Footnote 37 is less pronounced in EU privacy legislation, although it is increasingly underlined in the jurisprudence of the Court of Justice of the European Union (CJEU) and especially that of the European Court of Human Rights (ECtHR).Footnote 38 Already by the 1970s, the ECtHR expanded its interpretation of Article 8 of the European Convention on Human Rights (ECHR) so as to include a positive liberty, in addition to the right to be free from arbitrary interference from authorities.Footnote 39 This Court interpreted this positive liberty as imposing a positive obligation on the state to protect individual privacy in, among others, horizontal relationships (ie between private parties), including specifically in the area of data protection.Footnote 40 Extending this to the medical sphere,Footnote 41 the concept of “decisional privacy” and its protection may be said to already be part of the ECtHR’s jurisprudence, given the centrality of personal autonomy within Article 8 ECHR.Footnote 42 However, similar safeguards have not yet been written into legislation, specifically with respect to the EU’s GDPR.Footnote 43 This means that the regulatory framework for decisional privacy, such as it is, has not (yet) benefitted from parliamentary debate as to the scope and form of regulation, or as to its relationship with other societal aims.

In public health practice, decisional privacy may be said to be under pressure due to two co-emerging developments. The first development is the interest in the use of “nudges”Footnote 44 to promote public health.Footnote 45 The idea of nudging is to alter choice situations in ways that predictably change people’s behaviour without reducing the available choice options or altering people’s economic incentives. “Good” nudges should be transparent to the person who is being nudged, easily opted out of and encourage behaviour for which there is good reason to believe it will benefit the individual.Footnote 46

The use of nudging in public and private health has been hotly debated, as it can be argued that nudging constitutes a form of manipulation, or at least presents a risk of manipulation.Footnote 47 Despite this and other criticisms, the practice of nudging is becoming mainstream and increasingly accepted by policymakers.Footnote 48 Consider, for example, the debate around obesity and healthy eating and the suggestion to feature healthy food items more prominently in supermarkets. This subtle change in the presentation of food choices is expected to nudge people to buy healthier food items without actually restricting individuals in their food choices. Similarly, placing footprints or arrows on the floor leading to a staircase instead of an elevator has been demonstrated to be an effective nudge towards taking the stairs.Footnote 49

Alongside a general move towards nudging in various areas of public policy, the second relevant development is the rise of data-driven technologies that use persuasive techniques such as personalisation and tailoring.Footnote 50 These kinds of technologies can provide powerful “hypernudges” by personalising choice architectures in real time, using behavioural, preference and contextual data from the individual as well as from groups that are deemed relevant to the individual.Footnote 51 Examples of hypernudging include personalised advertisements that Facebook presents to its users and the way in which Google varies its search results ranking depending on who is performing the search. In addition, hypernudges are increasingly implemented in self-tracking and self-improvement apps, where choice situations may be framed differently for different individuals, based partly on a person’s preferences and prior behaviour and partly on contextual information about the person’s present situation (eg time of day, weather, social environment and so on), in the hopes of steering that person towards performing a certain behaviour.Footnote 52 Thus far, these kinds of apps typically try to promote behaviours such as healthy eating, exercising and recycling, but it is easy to imagine their application extending to the promotion of personal hygiene, social distancing or home quarantining in the fight against SARS-CoV-2.

III. Futureproofing EU regulations for decisional privacy

1. Use of apps during the SARS-CoV-2 pandemic

The use of apps during the SARS-CoV-2 pandemic started during the first wave and has since become widespread. Broadly speaking, the use of apps has been aimed at three public health goals. Footnote 53 First, there are contact tracing apps aimed at quickly detecting potentially infected individuals so that infections can be controlled and contained. These apps have raised informational privacy concerns in many Member States. In the Netherlands, for example, the Dutch Data Protection Authority (DPA) heavily criticised a first initiative by the Ministry of Health, Welfare and Sport for developing such an app, questioning its necessity, the legal foundation for its use and the extent to which GDPR safeguards would be met.Footnote 54 Similarly, there were public debates in France about privacy in relation to their “StopCovid France” app, which obtains contact data through the use of low-energy Bluetooth technology and stores this data on a central server, despite the European Data Protection Board recommending a decentralised solution where the data are only stored on the devices themselves. Footnote 55

A second category of apps focuses on information dissemination with the aim of supporting self-diagnosis. The Spanish “AsistenciaCOVID-19” is an example of such an app. With the user’s consent, the app can also collect geolocation data. According to officials, these data will only be used to ensure that individuals get the right information for the region they are residing in, but these data will nevertheless be stored on a centralised server until the end of the health crisis (after which the data will be anonymised and made ready for statistical analysis). Footnote 56

The third use for apps concerns surveillance aimed at enforcing quarantine orders for those already infected or for those at risk of infection. An example of this is the “Home Quarantine” app launched by the Polish Ministry of Digital Affairs on 24 March 2020.Footnote 57 The app is meant for people required to go into home quarantine after returning from abroad or having been diagnosed with COVID-19, Footnote 58 and it monitors their compliance with the home quarantine order by frequently requesting selfies to be uploaded with geolocation data from home. Footnote 59 This app invariably also triggered informational privacy concerns as it collects personal data, including Global Positioning System (GPS) location data, and stores them in a centralised data store, where these data can be accessed, processed and analysed by third parties, potentially even for different purposes than originally intended.Footnote 60

Together, the examples above show a considerable eagerness from Member States to use data-collecting apps for various purposes during the SARS-CoV-2 pandemic, and they highlight the importance of the GDPR in protecting EU citizens’ informational privacy. As the pandemic continues and the willingness of individuals to comply with restrictive measures can be observed to dwindle, we foresee that Member States will look for new ways to increase compliance, in particular through the use of apps that utilise persuasive techniques to nudge individuals to exhibit the desired behaviours.

One way to go about this would be to extend existing apps with persuasive techniques. For example, consider how contact tracing apps could actively adapt the language they use to be more authoritative (eg about having to go into home quarantine) when an individual continues to receive messages about being exposed to infected individuals over time. Or consider how the Polish Home Quarantine app could tailor its language and framing based on the information they already have of the individual, such as age, sex and place of residence.

Another strategy could be to require commercial parties to include public health measures in their existing apps. Here, one may think of requiring Google Maps to suggest walking routes aimed at promoting social distancing rather than efficiency. Or having dining apps restrict options for the elderly to the exclusion of restaurants known to have hosted an infected individual in the recent past. Or having fitness apps recommend workouts with bodyweight instead of with free weights or machines when there is a known local outbreak of the virus in the vicinity, in the hopes of nudging people to exercise at home instead of at the gym. If we understand the right to decisional privacy as both the negative freedom to make personal decisions and the state’s positive duty to ensure that citizens can make meaningful decisions,Footnote 61 we can see how these types of hypernudges could affect people’s decisional privacy through subtle interference with their decision-making. This raises the question as to whether the existing legal framework would be sufficient to guide Member States, and potentially the EHU, in the use of these apps.Footnote 62

2. The future of decisional privacy in public health

As witnessed during the first wave of the SARS-CoV-2 pandemic, Member States may diverge in how they approach the regulation and use of apps.Footnote 63 Despite the EU’s active role in data protection, most Member States took action without consultation of, or coordination by, the EU. Footnote 64 Only in the last weeks of June 2020, once some national borders started to reopen, did the Member States, with the support of the Commission, agree on a framework that would allow for the inoperability of national contact tracing apps in line with EU data protection law. Footnote 65

Moving forward, we envisage a role for the EHU in coordinating the use of smartphone apps in order to promote a more unified approach to taking public health measures in the EU, especially with an eye on health crises such as the current SARS-CoV-2 pandemic. Insofar as these measures will involve apps that incorporate forms of hypernudging, as we have suggested they might, the EHU will need a regulatory framework governing decisional privacy that can guide its decisions and recommendations, in parallel to the way in which the GDPR would guide the EHU with regard to informational privacy.

Although a full exploration of the various safeguards that such a framework should include is beyond the scope of this contribution, we want to point to two key concerns that currently are not sufficiently dealt with through existing EU privacy legislation and should be addressed.

First, there is the question of the extent to which individuals need to be made aware of how new technologies, including smartphone apps, may change their decision-making through nudging. This is particularly pertinent in relation to health, where the protection of personal autonomy has been accepted as being fundamentally important.Footnote 66 If future realities incorporate a variety of decisional steers, legislation on the transparency of these mechanisms and their use should develop accordingly.

Second, the control of public and privately sourced apps differs insofar as the development and deployment of governmental apps, particularly mandatory ones, is often subject to parliamentary checks. Privately sourced apps do not benefit from such scrutiny, which may be explained by the fact that they more clearly include the option to “opt out”. However, once in use, the decisional privacy concerns may prove very similar. Notably, the ECtHR has interpreted the right to (decisional) privacy as imposing an obligation on the government to also protect individuals in horizontal relationships. This suggests that there is an active obligation to ensure that the use of hypernudges by corporations is scrutinised and regulated. This could be done through changes to the GDPR, which already provides such horizontal protection vis-à-vis data collection and informational privacy more generally, or through the adoption of dedicated legislation.

In summary, we envisage a role for the EHU in coordinating the use of technologies such as smartphone apps, including those involving hypernudging, in the domain of EU public health. Footnote 67 In doing so, the EHU is guided, and supported, by existing EU privacy regulation, which – increasingly explicitly – incorporates decisional privacy. However, the jurisprudential basis for decisional privacy protection means that a broader legislative debate on questions such as justifiable infringements, types of remedies and procedural protections has thus far been sidestepped. In better equipping the EHU – and Member States – for these questions, such a debate in the Council and Parliament would be welcomed.

Footnotes

We want to thank one anonymous reviewer and Jenneke Evers for valuable comments on an earlier draft of this paper. We are grateful to Lin Batten for excellent research assistance.

1 Sadly, in many other areas of the world, such as the USA, India and many African countries, the number of reported cases is still increasing, and a second wave is thought to be starting in others, such as South Korea and China.

2 For example, see B Keogh, “Coronavirus Weekly: Balancing a ‘new normal’ While Keeping COVID-19 in Check” (The Conversation, 18 May 2020) <https://theconversation.com/coronavirus-weekly-balancing-a-new-normal-while-keeping-covid-19-in-check-138577> (last accessed 3 July 2020).

3 For a general overview, see Eurostat, “Economy” <https://ec.europa.eu/eurostat/web/covid-19/economy> (last accessed 3 July 2020); on employment, see European Commission, “Jobs and Economy during the Coronavirus Pandemic” <https://ec.europa.eu/info/live-work-travel-eu/health/coronavirus-response/jobs-and-economy-during-coronavirus-pandemic_en> (last accessed 3 July 2020).

4 For example, see KPMG, “Airlines – Financial Reporting Implications of COVID-19” (April 2020) <https://assets.kpmg/content/dam/kpmg/xx/pdf/2020/04/airlines-financial-reporting-implications-of-covid-19.pdf> (last accessed 3 July 2020) (on the aviation industry); European Cultural Foundation, “Future of Culture and Creative Sectors in post COVID-19 Europe” (30 April 2020) <https://www.culturalfoundation.eu/library/future-of-culture-and-creative-sectors-in-post-covid-19-europe> (last accessed 3 July 2020) (on the cultural sector).

5 See KP Purnhagen, A de Ruijter, ML Flear, TK Hervey and A Herwig, “More Competences than You Knew? The Web of Health Competences for Union Action in Response to the COVID-19 Outbreak” (2020) 11(2) European Journal of Risk Regulation 297.

6 J van Zeben and A Bobić, Polycentricity in the European Union (Cambridge, Cambridge University Press 2019) pp 1–6.

7 European Commission, Guidelines on EU Emergency Assistance on Cross-Border Cooperation in Healthcare related to the COVID-19 crisis COM (2020) 2153 OJ C111I/1, 3 April 2020.

8 A Alemanno, “The European Response to COVID-19: From Regulatory Emulation to Regulatory Coordination?” (2020) 11(2) European Journal of Risk Regulation 307.

9 A de Ruijter, EU Health Law & Policy: The Expansion of EU Power in Public Health and Health Care (Oxford, Oxford University Press 2019) p 190.

10 We will focus primarily on privacy-related regulation. With respect to health, most national and international rights systems now recognise a “right to health”, which encompasses elements of public health protection and access to healthcare in order to ensure individual health. For example, see International Covenant on Economic, Social and Cultural Rights (adopted 16 December 1966, entered into force 3 January 1976) OHCHR Art 12; Convention on the Elimination of All Forms of Discrimination Against Women (ratified on 18 December 1979, entered into force 3 September 1981) UNGA Art 12; Convention on the Rights of the Child (adopted 20 November 1989, entered into force 2 September 1990) OHCHR Art 12. Many consider a high standard of health to be a prerequisite to attaining a good quality of life; see, for example, A Sen, “Why Health Equity” in S Anand et al (eds), Public Health, Ethics, and Equity (Oxford, Oxford University Press 2004) pp 21–33.

11 Many SARS-CoV-2-related measures also have important implications for the free movement rights of EU citizens. Although very important, these cannot all be discussed within the scope of this short contribution. For further reading, see G Di Federico, “COVID-19 and Labour Law: Free Movement of Healthcare Personnel within the EU” (2020) 13(1) ILL E-Journal <https://illej.unibo.it/article/view/10789/10725> (last accessed 3 July 2020); A Renda and R Castro, “Towards Stronger EU Governance of Health Threats after the COVID-19 Pandemic” (2020) 11(2) European Journal of Risk Regulation 273; Recommendation 2020/C 156/01 of 8 May 2020 Communication from the Commission Guidance on free movement of health professionals and minimum harmonisation of training in relation to COVID-19 emergency measures regarding Directive 2005/36/EC; J Brunsden, “Brussels tells UK it must honour EU free-movement rules” (Financial Times, 14 May 2020) <https://www.ft.com/content/c33730c8-8499-4ade-93bd-ec42411cc5f8> (last accessed 3 July 2020).

12 PWC Slovenskia, “What Does Lex Corona Bring?” (31 March 2020) <https://www.pwc.com/sk/en/tax-news/lex-corona.html> (last accessed 15 July 2020).

13 Project de Loi (Sénat commission des Lois) Fair face à l’épidémie de COVID-19 – PJL N-Com 57 Amendement Rejeté (19 March 2020) <http://www.senat.fr/amendements/commissions/2019-2020/376/Amdt_COM-57.html> (last accessed 15 July 2020).

14 BJ Fogg, Persuasive Technology: Using Computers to Change What We Think and Do (Burlington, MA, Morgan Kaufman Publishers 2003).

15 M Quigley, “Nudging for Health: on Public Policy and Designing Choice Architecture” (2013) 21(4) Medical Law Review 588.

16 Another contribution to the current volume by Simonelli and Iacob also focuses on data-driven health services and the role that the EHU may play in achieving a European Health Data ecosystem; M Iacob and F Simonelli, “Towards a European Health Data Ecosystem” (2020) European Journal of Risk Regulation 10.1017/err.2020.88.

17 P Ganley, “Access to the Individual: Digital Rights Management Systems and the Intersection of Informational and Decisional Privacy Interests” (2002) 11(3) International Journal of Law and Information Technology 241, at 264. See also Electronic Privacy Information Center, International, Privacy and Human Rights 2006: An International Survey of Privacy Laws and Developments (Washington, DC, Electronic Privacy Information Center 2006) p 5.

18 See, in detail, M Friedewald, “A New Concept for Privacy in the Light of Emerging Sciences and Technologies” (2010) 19(1) TATuP Zeitschrift für Technikfolgenabschätzung in Theorie und Praxis 71.

19 For example, see O Rene and J Polentsky, “Privacy in the Age of Big Data: A Time for Big Decisions” (2012) 64 Stanford Law Review Online 63.

20 A Westin, Privacy and Freedom (New York, Ig Publishing 1967) p 7.

21 For example, see Universal Declaration of Human Rights (proclaimed 10 December 1948) UNGA Art 12; European Convention on Human Rights (adopted 4 November 1950, entered into force 3 September 1953) CE Art 8; Charter of Fundamental Rights of the European Union (adopted 2 October 2000, ratified 7 December 2000) OJ 2012/C 326/02 Art 8. See also C Veghes et al, “European Union Consumers’ Views on the Protection of Their Personal Data: An Exploratory Assessment” (2009) 11(2) Annales Universitatis Apulensis Series Oeconomica 988.

22 Regulation (EU) 2016/679 of 4 May 2016 General Data Protection Regulation OJ L119, replacing Data Protection Directive 95/46/EC. See, in detail, Council of Europe and FRA, Handbook on European Data Protection Law (2018) <https://fra.europa.eu/en/publication/2018/handbook-european-data-protection-law-2018-edition> (last accessed 15 July 2020); PGanley, supra, note 17, at 253.

23 This is not to say that its adoption has not met considerable resistance and controversy, nor that each of the Regulation’s provisions were entirely new. See, in detail, C Hoofnagle, B van der Sloot and F Zuiderveen, “The European Union general data protection regulation: what it is and what it means” (2010) 28(1) Information & Communications Technology Law 65; Recommendation 2020/C 156/01 of 8 May 2020 Communication from the Commission Guidance on free movement of health professionals and minimum harmonisation of training in relation to COVID-19 emergency measures regarding Directive 2005/36/EC.

24 The EU has also imposed data protection rules on the EU institutions: see Regulation (EU) 2018/1725 of 23 October 2018. The European Data Protection Supervisor (EDPS) and the Member State-based Data Protection Authorities (DPAs) are important actors in ensuring a high level of data protection in the EU, and their independence is safeguarded within primary EU law: see Treaty on the Functioning of the European Union (2012) OJ C 326/1 Art 16(2) and [29] CFREU Art 8.2.

25 Regulations (EU) 2016/679 of 27 April 2016 on the Protection of Natural Persons with the Regard of Processing of Personal Data and on the Free Movement of Such Data and Repealing Directive 95/46/EC, Art 3.2.

26 For example, the California Consumer Privacy Act (adopted on 28 June, 2018) CSL.

27 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ 2016 L 119/1 (‘GDPR’), Art 12.

28 Footnote ibid, Art 15.

29 Footnote ibid, Arts 17 and 20, respectively.

30 Footnote ibid, Art 21.

31 Footnote ibid, Recital 28.

32 Footnote ibid, Arts 33 and 34.

33 Footnote ibid, Art 37

34 See Case C-399/11 and Case C-411/10.

35 See, in detail, Section III.

36 For example, see: Formal comments of the EDPS on two proposals to establish the conditions for accessing other EU information systems for ETIAS purposes <https://edps.europa.eu/sites/edp/files/publication/19_03_13_formal_comments_2_proposals_conditions_for_accessing_information_systems_for_etias_purposes_en_0.pdf> (last accessed 27 October 2020).

37 B Roessler, Value of Privacy (Cambridge, Polity Press 2005).

38 See B Roessler, “X – Privacy as a Human Right” (2017) 117(2) Proceedings of the Aristotelian Society 187; and B van der Sloot, “Decisional privacy 2.0: the procedural requirements implicit in Article 8 ECHR and its potential impact on profiling” (2017) 7(3) International Data Privacy Law 190.

39 X v Iceland App no 6825/74 (18 May 1976).

40 Köpke v Germany App no 420/08 (5 October 2010).

41 Hristozov and others v Bulgaria App nos 47039/11 and 358/12 (13 November 2012).

42 See also B van der Sloot, “Privacy as Human Flourishing: Could a Shift towards Virtue Ethics Strengthen Privacy Protection in the Age of Big Data?” (2014) 5(3) Journal of Intellectual Property, Information Technology and Electronic Commerce Law 230.

43 Van der Sloot, supra, note 38, at 201.

44 R Thaler and C Sunstein, Nudge: Improving Decisions about Health, Wealth and Happiness (New Haven, CT, Yale University Press 2008).

45 The Behavioural Insights Team, “Covid-19 – A Behavioural Perspective” <https://www.bi.team> (last accessed 15 July 2020).

46 R Thaler, “The power of nudges, for good and bad” (The New York Times, 31 October 2015) <https://www.nytimes.com/2015/11/01/upshot/the-power-of-nudges-for-good-and-bad.html?_r=0> (last accessed 6 July 2020).

47 For example, see M Wilkinson, “Nudging and manipulation” (2013) 61(2) Political Studies 341.

48 C Evers, D Marchiori, A Junghans, J Cremers and D de Ridder, “Citizen approval of nudging interventions promoting healthy eating: the role of intrusiveness and trustworthiness” (2018) 18(1) BMC Public Health 1182.

49 Notice the difference from the various arrows and lines that have been added to floors in stores and public spaces during the pandemic. These are not nudges in Thaler and Sunstein’s sense, as they typically have a signalling function in service of strict norms that people have to abide by, such as keeping to a required route or maintaining the required social distance.

50 For a taxonomy of behaviour change techniques that can be used in behaviour change interventions, see C Abraha and S Michie, “A taxonomy of behavior change techniques used in interventions” (2008) 27(3) Health Psychology 379.

51 K Yeung, “‘Hypernudge’: Big Data as a mode of regulation by design” (2017) 20(1) Information, Communication & Society 118.

52 M Lanzing, “‘Strongly Recommended’ Revisiting Decisional Privacy to Judge Hypernudging in Self-Tracking Technologies” (2019) 32 Philosophy & Technology 549.

53 An exhaustive overview of measures taken by all 27 Member States goes beyond the scope of this short piece. For a comprehensive overview of global governmental responses to the pandemic, see the Oxford COVID-19 Government Response Tracker <https://covidtracker.bsg.ox.ac.uk/> (last accessed 3 July 2020).

54 Dutch Data Protection Authority (20 April 2020), Onderzoeksrapportage bron-en contactopsporingsapps <https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/onderzoeksrapportage_bron-_en_contactopsporingsapps.pdf> (last accessed 15 October 2020). The Ministry has since continued the development of their contact tracing app in close collaboration with the Dutch DPA and external partners. The resulting “CoronaMelder” app was released to the general public on 10 October 2020, after legislation was adopted on 6 October 2020.

55 Commission Recommendation (EU) 2020/518 of 8 April 2020 on a common Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis, in particular concerning mobile applications and the use of anonymised mobility data, C/2020/3300, OJ L 114, 14.4.2020, 7–15.

56 Gobierno de España, “La aplicación oficial de autodiagnóstico, Asistencia COVID-19, disponible ya en cinco nuevas comunidades autónomas” (6 April 2020) <https://www.mineco.gob.es/portal/site/mineco/menuitem.ac30f9268750bd56a0b0240e026041a0/> (last accessed 3 July 2020); R Muñoz, “Spain’s new Coronavirus App Could Detect Violators of Lockdown Rules” (El País, 6 April 2020) <https://english.elpais.com/science_tech/2020-04-06/spains-new-coronavirus-app-could-check-whether-a-person-is-breaking-the-lockdown-rules.html> (last accessed 3 July 2020).

57 Slovakia followed Poland’s early example with its own “Smart Quarantine” app that also relies on GPS data: see Office of the Deputy Prime Minister of Slovac Republic for Investments and Informatization, “Smart-Quarantine – Self-isolation as an Alternative to Institutional Quarantine” (24 March 2020) <https://korona.gov.sk/en/smart-quarantine-self-isolation-as-an-alternative-to-institutional-quarantine/> (last accessed 15 July 2020).

58 M Scott and Z Wanat, “Poland’s Coronavirus app Offers Playbook for Other Governments” (Politico, 4 February 2020) <https://www.politico.eu/article/poland-coronavirus-app-offers-playbook-for-other-governments/> (last accessed 3 July 2020).

59 <https://www.gov.pl/web/cyfryzacja/aplikacja-kwarantanna-domowa--to-musisz-wiedziec> (last accessed 15 July 2020).

60 W Mariner, “Mission Creep: Public Health Surveillance and Medical Privacy” (2007) 87 Boston University Law Review 347.

61 Van der Sloot, supra, note 38, at 192.

62 Notice that we do not claim that infringements on decisional privacy through the use of nudging and hypernudging, particularly towards behaviours that are deemed beneficial to public health under the conditions of a pandemic, can never be justified. Preventing loss of life, protecting vulnerable populations and ensuring the continued viability of public healthcare systems are policy goals that can legitimate certain restrictions on privacy and personal freedom. Rather, the point is that this balancing act should be undertaken in a principled way, underwritten by legal remedies in case of shortcomings in process or outcome.

63 See Section III.1.

64 H van Kolfschooten and A de Ruijter, “COVID-19 and Privacy in the European Union: A Legal Perspective on Contract Tracing” (2020) 41(3) Contemporary Security Policy 478; G Fortuna, “EU Stands by its Data Privacy Rules in Response to COVID-19” (EURACTIV, 28 April 2020) <https://www.euractiv.com/section/coronavirus/news/eu-stands-by-its-data-privacy-rules-in-response-to-covid-19/> (last accessed 4 July 2020). See generally, Alemanno, supra, note 8.

65 Press Release (EC), “Coronavirus: Member States agree on an interoperability solution for mobile tracing and warning apps” (European Commission, 16 June 2020) <https://ec.europa.eu/digital-single-market/en/news/coronavirus-member-states-agree-interoperability-solution-mobile-tracing-and-warning-apps> (last accessed 3 July 2020).

66 See, generally, H Leino-Kilpi, Patient’s Autonomy, Privacy and Informed Consent (Amsterdam, IOS Press 2000) ch 3.2.2.

67 It is worth noting that there are also important questions about fundamental rights as relating to individual healthcare, most of which are discussed through patients’ rights. Consider, for example, the confinement of persons with mental disabilities or, more generally, an individual’s choice to receive, reject or be denied medical treatment. Medical ethics and bioethics provide rich debates on these questions. See, for example, S Anand et al (eds), Public Health, Ethics, and Equity (Oxford, Oxford University Press 2004); and J Mason and G Laurie, Law and Medical Ethics (Oxford, Oxford University Press 2006).

ibid
ibid
ibid
ibid
ibid
ibid