1 EWRS and Article 9 alert notification of threats: actors, scope, and operation

The Early Warning and Response System (“EWRS”) for serious, cross-border health threats, which replaced the preceding mechanism that had been established under the Old Surveillance Decision applicable to infectious diseases only, is now based on Article 8 of the Health Threats Decision. EWRS constitutes a constant communication channel between the Commission and competent authorities of Member States, which is administered and coordinated by the European Centre for Disease Prevention and Control in Stockholm.Footnote ¹⁹

The key obligation of the EWRS competent authorities is to “notify an alert in the EWRS where the emergence or development of a serious cross-border threat to health” fulfils the normative criteria cumulatively (the statutory conditions).Footnote ²⁰ It has to be done within 24 hours of the authority becoming aware of a threat.Footnote ²¹ They are obliged to warn the EWRS partners in case of risk to health when: (1) “more than one Member State” is concerned (geographical criterion); (2) there is a high probability of risk based on either of four alternative indicators: an unusual character of event; a level of morbidity/mortality; pace of spreading; or an overall extent (risk factor); (3) “it requires or may require” a coordinated response at the EU level (the subsidiarity principle).Footnote ²² The understanding of a “cross-border” and “serious” character of a threat is defined broadly as “a life-threatening or otherwise serious hazard to health” which spreads or entails a significant risk of spreading across the Member States, and thus requires an EU level response.

The scope of information which authorities are obliged to provide in an Article 9 alert is the widest possible to include “any available relevant information in their possession that may be useful for coordinating the response.”Footnote ²³ The Health Threats Decision contains the exemplary enumeration of information which must be provided for the full characterisation of a health threat event and the organisation of an appropriate response. For example: type and origin of the (pathogenic) agent, date and place of the incident or outbreak, means of transmission, methods of detection, toxicological data, risks, implemented/planned public health measures, and – what is the most interesting for the purposes of this text – “personal data necessary for the purpose of contact tracing”, which can also mean personal health data.Footnote ²⁴

From the perspective of data protection, it needs to be explained that the transmission of information within EWRS is carried out via two channels. The first one, the general information channel, enables competent authorities concerned to send an alert message on health threats under obligatory notification to all the national public health contact points in the EU, the Commission, ECDC and WHO. The actors empowered to participate in EWRS include: the Unit responsible for crisis management and preparedness in health within the Commission’s Directorate General for Health (SANTE), the national public health authorities designated to EWRS by the Member State governments (“EWRS competent authorities”), and delegated ECDC and WHO representatives.Footnote ²⁵

The second communication channel of EWRS is the so-called selective-messaging channel. It is used in case of exchange of personal information or personal health data when a contact tracing procedure is applied. The selective-messaging functionality allows communication between the national competent authorities concerned only, and it was created especially as a specific measure to guarantee and implement personal data protection.Footnote ²⁶ The horizontal design of EWRS and its electronic tools warrant that all the responsible actors receive the information immediately and simultaneously, and if the protection of personal data so require, that those data are exchanged only between the interested states.Footnote ²⁷ So, technically, EWRS is an electronic platform with an access limited to international/EU/national competent institutions because of the possible processing of either personal data or other sensitive information about public health security. The process of sending alerts and exchange of any information is always undertaken via designated electronic means. The details of the EWRS functioning, and its operational procedures, are regulated, or awaiting regulation, in the implementing acts of the Commission.Footnote ²⁸

Finally, Article 9 alert notification is a sui generis EU administrative act which can cause several legal effects both at the EU and national level. For example, it can trigger a risk assessment by ECDC (or other EU agency), an obligation to assess risks, co-ordinate actions and manage risks by national competent authorities, and moreover, the ad hoc monitoring and individual contact tracing means, which can also entail the exchange of personal data.Footnote ²⁹

2 Ad hoc monitoring

The Health Threats Decision introduced a new tool, named “ad hoc monitoring”, but until now little has been known about its application and practical operation. The regulation in the Decision is rather laconic (Article 7). The Decision says that it applies to health threats other than infectious diseases, that is, in case of bio-toxic, chemical, environmental or unknown danger. It is activated following the Article 9 alert notification concerning one of those health threats. Member States and the Commission are then required to inform each other about the development of those threats at the national level and on the basis of information from national, internal monitoring systems.Footnote ³⁰ Pursuant to Article 7, para 2, the mandatory information “shall include, in particular”: change in geographical distribution, spread and severity of the threat concerned and of the means of detection, if available.

This tool is supposed to function as a kind of ad hoc surveillance for the above health threats, and for this reason, it requires the mutual co-operation of Member States and the Commission via the channel of EWRS or the Health Security Committee. But it is not clear what will be the exact scope of the shared data, what the relation is between the ad hoc monitoring and the EWRS, and, above all, whether ad hoc monitoring can involve exchange of personal data. That is why it was concluded by the European Data Protection Supervisor that those problems raise questions regarding the protection of personal data.Footnote ³¹ The required implementing legislation, which could perhaps provide answers to some of the questions, has not yet been adopted by the Commission (see further section IV below).

3 Individual contact-tracing: scope and operation

The procedure of exchanging information between the responsible authorities in order to find and identify infected or potentially infected persons who were put in danger because of contact with, eg a pathogen or a chemical substance, is the next tool of public health control here examined.Footnote ³² Pursuant to the legal definition in Article 3(c), Health Threats Decision, contact tracing means:

A decision to trace contacts can follow the notification of Article 9 alert, but it can also be initiated earlier, at the national level, and then continued at the EU level through a co-ordinated action of Member States. The ECDC usually issues non-binding opinions on whether contact tracing should be applied for any specific disease and/or event in the course of its risk assessment, but the co-ordination of measures is decided by the Health Security Committee composed of national representatives.Footnote ³³ Finally, it is always national competent authorities who, following the EDCD guidelines, ultimately decide, each according to its own procedures and national laws, whether contact tracing should be initiated in its jurisdiction with respect to a particular threat and carried out at national level in a given state. Formally, it is a national, administrative decision(s), although co-ordinated via EU level action.

As explained above, the exchange of data is to take place solely between the Member States affected by a health threat and via the EWRS selective module.Footnote ³⁴ The type of data which are usually shared via EWRS under the contact tracing procedure include both personal data (eg contact details of the person, start of travel, means of transport, and other data related to the person’s travel itinerary and places of stay, including, information on visited persons and destinations, and details of other persons potentially exposed to contamination), and also, very often, sensitive health data, mainly information on alleged infection of sought individual(s) or on the possibility of developing an infection.Footnote ³⁵

The best way to explain the functioning of EU contact tracing is to cite some statistical examples from the Commission reports.Footnote ³⁶ In 2006 there were 138 warnings and 223 comments of national competent authorities notified in EWRS, while in 2007, there were 105 warnings and 157 comments of national competent authorities respectively, nine of which triggered a need to co-ordinate response at EU level and to those the comments related mostly (126/157). In the years 2013–2015, Member States authorities notified 168 warnings and posted 354 comments.

In a number of cases, the contact tracing procedure was initiated including the exchange of personal data across borders. For example, the 2007 Report describes a story of a rabies-infected dog, brought illegally into the EU, which had contacts with many people, including children, in the south of France. The application of contact tracing within EWRS allowed for sending rapid information and the vaccination of affected individuals. Another reported case concerned tracing back passengers of a flight from Thailand who have/might have encountered a co-passenger smuggling into Europe in his hand-luggage two birds of prey, infected with the highly pathogenic avian influenza virus type A/H5N1, and intercepted at the Zaventem airport in Brussels. The next example of contact tracing occurred after several guests who stayed at a hotel in Phuket (Thailand) were diagnosed with Legionnaires’ disease, a serious lung infection. As a result, 284 tourists were identified and contacted with information about the possible exposure and advised to seek medical care should they develop symptoms suggestive of Legionellosis.Footnote ³⁷

The above examples show explicitly that the applied measures realised the goals of ensuring public and individual health. However, they also show that the application of contact tracing measures will always concern the exchange of personal data, and almost always, the sharing of some kind of personal health data, usually without the preceding consent of individuals (because people are sought in the context of a health threat without being aware of it). In those cases, the EU system allows – in the aim of protecting public health and within a prescribed legal framework – for the exchange of personal data, including sensitive, medical data, without the preceding consent of data subjects. This lawful limitation of the right to data protection is based on the legal basis in the general EU data protection laws and on the safeguards included in the Health Threats Decision. Acting in obedience to those laws when personal data are exchanged in the EWRS is essential for the adequate protection of personal information under the EU regime of health threats. Before moving to the analysis of specific data protection safeguards in the Health Threats Decision, it is appropriate to investigate the legal basis for the exchange of personal (health) data in view of the general EU laws for safe data processing.

4 Legal basis for an exchange of personal (health) data in the EWRS pursuant to the EU data protection laws

The general EU Data Protection Directive 95/46/EC applies to the processing of personal data by national authorities (eg within EWRS); and the general Regulation on Data Protection 2001/45 applies to the processing of personal data by the EU institutions (eg the Commission, ECDC).Footnote ³⁸ The Directive will be repealed by the EU General Data Protection Regulation 2016/679 as of 25 May 2018.Footnote ³⁹ These acts establish an EU-wide, horizontal system of data protection which is applicable to all policy fields, and provide legality conditions, general principles, obligations of data controllers, rights of data subjects, etc, which must always be obeyed by Member States (harmonisation of national laws) and the EU institutions respectively.Footnote ⁴⁰ The laws give a specific enforcement framework to the right to personal data protection as provided for by Article 8(1) of the EU Charter of Fundamental Rights and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU).Footnote ⁴¹

In light of the EU Data Protection Laws, the processing of personal data (contact tracing data) within the EWRS must always be justified on the basis of specific legal grounds. In this regard, Article 7 of Data Protection Directive (Article 6, GDPR), and the corresponding provisions of Article 5 of Regulation on Data Protection by the EU, set out the criteria for making data processing lawful and legitimate. Accordingly, an exchange of personal data in a contact tracing procedure can happen only if: (i) responsible authorities act to comply with their obligations to prevent and combat serious cross-border health threats pursuant to the Health Threats Decisions (“processing is necessary for compliance with a legal obligation to which the controller is subject”); and (ii) the exchange is necessary to provide endangered persons with the appropriate care or treatment, with the aim of protecting the health of the individuals concerned and, ultimately, that of EU citizens at large (“processing is necessary in order to protect the vital interests of the data subject”); and (iii) the exchange is done to co-ordinate the response against health threats in the public interest (“processing is necessary for the performance of a task carried out in the public interest”).Footnote ⁴² In other words, apart from a clear legal basis for an exchange (lawfulness), personal data may be processed in the EWRS only for specified, explicit and legitimate purposes and should not be further processed in a way incompatible with those purposes (the purpose limitation principle).Footnote ⁴³

Moreover, when processing of data within EWRS involves sensitive health data as well (and as explained above, this will mostly, or almost always, be the case), processing must be additionally justified because a higher level of protection is accorded in the EU to the so-called sensitive data, including data regarding person’s health.Footnote ⁴⁴ That is why EU law contains in principle a prohibition to process any health data which belong to the “special category of data” (Article 8(1), Data Protection Directive; Article 9(1), GDPR; and Article 10(1), Regulation on Data Protection respectively).Footnote ⁴⁵ The exception to this general prohibition is possible in few situations, ie when a data subject has given an explicit consent; when it is a vital interest of a data subject who is incapable of giving consent; and finally, when processing is required for “preventive medicine, medical diagnosis or healthcare and carried out by healthcare professional obliged to professional secrecy”.Footnote ⁴⁶

Neither of those statutory exceptions from the Data Protection Directive refers explicitly to the situation of cross-border health threats, simply because when Directive was adopted in 1995 the Health Threats Decision did not exist. The new GDPR (repealing the Data Protection Directive as of May 2018) introduces a specific exception in case of health threats (public interest). The exception applies when:

This development is very important, as it makes the health threats regime more coherent with EU data protection laws, and reinforces the obligation both for the EU and Member States to provide for safeguards of rights of data subjects, especially when it can be very difficult to obtain the explicit consents of data subjects. It is because of both objective conditions (eg data subjects are sought and they do not know they have contacted a source of a threat) and subjective circumstances (eg data subjects are incapable of expressing their consent). The very idea of EWRS functioning relies on the necessity of rapid reaction in situations of exceptional, cross-border health threats which may per se exclude any chance of seeking consent of data subjects. In any case, if it is feasible, authorities should seek to ensure that data subjects have given unambiguous consent for the processing of their personal health details.Footnote ⁴⁸

Finally, the interpretation of Article 8 of the Charter by the EU Court of Justice (“CJEU”) provides for an additional standard of control for the lawful limitation of the right to data protection in the context of health threats.Footnote ⁴⁹ The case law on processing of personal health data is scarce. However, the CJEU maintains, making reference to the case law of the European Court for Human Rights, that any transfer of health information by a public authority, may only be justified if: (i) it is “in accordance with the law”; (ii) it pursues an objective which is exhaustively listed; and (iii) it is “necessary” (proportional) to achieve that objective.Footnote ⁵⁰ CJEU emphasises that “In view of the extremely intimate and sensitive nature of medical data, the possibility of being able to transfer or communicate such information to a third party, even where that party is another European Union institution or body, without the consent of the person concerned, calls for particularly rigorous examination”.Footnote ⁵¹ Accordingly, a particular weight will be accorded by the Court to the proportionality assessment of a given action.Footnote ⁵² Any evaluation, however, will need to be contextualised in relation to a prescribed regime for health threats.

Consequently, in the present context, when a contact tracing measures is scrutinised, the exchange of personal data, especially of sensitive medical data, will be lawful if it is based on specific legal provisions and safeguards (here the Health Threats Decision and its implementing acts), it is undertaken by empowered authorities for the sole purpose of identification of individuals who have been exposed to a threat and to protect them (and others), and finally indispensable (necessary) for the co-ordination of a response against a health threat. The respect for the right to data protection will further depend on the guarantees embodied in the Health Threats Decision. Their analysis follows in the next section.

1 Data protection in the old EWRS for infectious diseases – an overview of initial guarantees

The initial regulation establishing the EU control system of infectious diseases and EWRS based on the Old Surveillance Decision and the Old EWRS Decision did not entail any specific provisions regarding protection of personal data. These matters were solely regulated by the provisions of the horizontal EU data protection laws (of the Data Protection Directive with obligations for national actors and the Regulation on Data Protection for the EU institutions), but there was no reference to those laws in the health threats regime.Footnote ⁵⁸

Soon, as mentioned in the introduction to this section, an appealing need to adopt more context-specific legal guarantees for the protection of personal and health data shared via EWRS emerged. The first important changes were introduced in 2004–2005.Footnote ⁵⁹ In May 2005 a special communication channel was activated within EWRS to transmit messages related to data shared under the contact tracing. An SMS messaging function was also activated in order to transmit to the Commission users a real-time notification by SMS that an urgent message was posted on EWRS.

Second, the Old EWRS Decision was amended in 2009, to raise the standards applicable to data protection when contact tracing was applied.Footnote ⁶⁰ A new Article 2a, which was inserted into the Decision, provided for a first legal definition of contact tracing, at that time, and for additional requirements of responsible authorities. That is, national competent authorities became statutorily obliged to use only “selective messaging functionality” when communicating personal data for contact tracing purposes. Second, sharing of data became permissible between the Member States affected by a disease only. Further, all the EU/national actors became explicitly bound to comply with the general EU data protection laws while communicating and circulating personal data through EWRS.Footnote ⁶¹ Finally, Annex III was added to the Old EWRS Decision containing for the first time the EU-level, indicative list of personal data which can be exchanges via EWRS under contact tracing. The list stipulated five categories of data which could be exchanged when seeking persons exposed to an infectious disease: personal information; travel specifications; contact information, including the names of visited places and persons; information on accompanying persons; and emergency contact details.Footnote ⁶²

Third, the Commission notified the EWRS to the European Data Protection Supervisor (“EDPS”) for an “ex-post” check, in order to ensure that the tool respects an adequate level of data protection.Footnote ⁶³ In his opinion, EDPS indicated several deficiencies in the analysed system, but eventually, he concluded that the EWRS was compatible with the general EU data protection framework provided that his recommendations were implemented.Footnote ⁶⁴

To remedy the enlisted defects, the Commission issued broad Data Protection Guidelines for EWRS users (2012).Footnote ⁶⁵ The recommendation contained the explanation of principles for data protection in a given context, the clarification of duties assigned to EU/national actors (“data controllers”), their specific obligations, and the explanation of data subjects’ rights with the necessary references to the EU data protection laws. The Commission recommended that data controllers exchanging personal information in the contact tracing procedure should always assess its need on a case-by-case basis, following a scientific cost-benefit analysis in relation to the nature of the disease and the advantages of its being combatted, and with a due respect to the proportionality of measures, considering whether data-sharing is “strictly necessary” for the purpose of applied measures.Footnote ⁶⁶ The Old Guidelines also recommended that national competent authorities ensured a technical design of data friendly environment, appropriate information to all data subjects, and an effective protection of their rights at the national level. Regarding the material scope of personal data which could be exchanged, the Commission advised a narrow interpretation of the indicative list from the Annex III to the Old EWRS Decision, stating that it “… should not be seen as granting a blanket and unconditional authorisation to process these categories of data”. Moreover, in order to respect the proportionality principle, the Commission urged national competent authorities to apply an extreme precaution “as regards processing of personal data other than those listed in that Annex, as disclosure is likely to be excessive and unreasonable.”Footnote ⁶⁷

To sum up, as of 2012, the initial system of safeguards for personal data protection within the EWRS for infectious diseases was based on specific provisions of the Old Surveillance Decision, the Old EWRS Decision (as amended by the Decision 2009/257) and on the Old Commission Data Protection Guidelines. The acts were referenced to and consistent with the EU data protection laws for national and EU authorities (Data Protection Directive and Regulation on Data Protection for the EU institutions). That system was fairly complete and legally consistent to offer an adequate level of data protection on the condition that all the obligations and laws were respected by the relevant actors.

Now, the legal framework has changed. As a consequence of the reform of the EU regime on health threats, starting in 2013, the safeguards for data protection, in the context of their exchange within EWRS, are based on the new Health Threats Decision and its implementing legislation (so far incomplete), and as before, on the general EU data protection laws.Footnote ⁶⁸ The Decision absorbed in part previous guarantees resulting from the Old EWRS Decision, especially, regarding obligations for competent authorities and the guarantees built in technical structure of the EWRS platform. The only act of the initial system of data safeguards within the health policy which has remained in force is the Old Commission Data Protection Guidelines. Notwithstanding its soft law character, it contains plenty of important explanations for national competent authorities and EU institutions as well as suggestions for best practice in the implementation of personal data protection within EWRS. Yet, it was issued in the context of contagious diseases control, so it still ought to be updated and linked to the new Health Threats Decision.

Let us now turn to the new provisions.

2 Article 16 of the Health Threats Decision and the current personal data protection system

The new Health Threats Decision contains a specific Personal Data Protection Clause (Article 16 “Protection of personal data”). It was included in the Decision to provide for a set of specific safeguards ensuring the safe and lawful exchange of personal data in the application of the Decision, as implemented by Member States at national level and co-ordinated via EU actions.Footnote ⁶⁹ The legal meaning of Article 16 can be explained as follows.

The clause is a lex specialis to the general EU Data Protection Directive (soon: GDPR) and the Regulation on Data Protection by the EU institutions. The purpose of this provision is to implement the EU general data protection principles in the field of public health (relating to purpose limitation, data quality and retention, confidentiality and security).Footnote ⁷⁰ That is why Article 16 imposes some stricter requirements both on national and EU authorities when they apply the Health Threats Decision, especially when they share personal data in the EWRS under contact tracing procedure. Article 16 contains several context-specific (public health), particular obligations for national competent authorities (eg to use solely the selective messaging functionality of EWRS to communicate personal data) and implementing powers for the Commission (eg to issue guidelines ensuring that the day-by-day operation of the EWRS complies with the general EU Data Protection Laws – to be – “the New Commission Data Protection Guidelines”).Footnote ⁷¹ Moreover, it designates the particular responsibilities of data controllers under the Health Threats Decision to ensure their proper enforcement, ie national competent authorities are regarded as data controllers in relation to responsibilities to notify and rectify personal data through the EWRS (information and rectification rights of data subjects); and the Commission acts as data controller concerning storage of personal data.Footnote ⁷² It is a consequence of the fact that EWRS is an example of joint controllership, where the responsibility for ensuring safe processing of data is allocated, at different levels, between the Commission and the Member States.Footnote ⁷³ Finally, Article 16 also mandates several operative and technical functions of EWRS required for data protection, for example: accessibility to personal data exchanged in the system is restricted to affected Member States only; selective messaging function is mandatory for personal data sharing, and duration of processing is limited. Further, EWRS competent authorities receive login and password from the Commission together with an authorisation for a full access to both channels and the two functions of the EWRS: reading and commenting messages. Since August 2015, the access to EWRS has been granted through the special authentication system of the Commission (ECAS) and through personalised email addresses and passwords, although some Member States expressed preference for access through “generic mailboxes”.Footnote ⁷⁴ The system of safeguards for lawful personal data sharing within EWRS (as of 2017) is presented and described in detail in Table 1.

Table 1

Safeguards for lawful exchange of personal data in EWRS (source: own analysis)

It should further be emphasised that, in order to warrant lawful and legitimate data processing, the Health Threats Decision refers in its content more explicitly to the purpose of data exchange and the proportionality of applicable measures. In light of its provisions, national competent authorities are allowed to communicate solely those personal data which are “necessary for the purpose of contact tracing”. In other words, the clear purpose of personal data exchange is established in the Decision in order to provide a yardstick for the assessment of respective measures. This sole aim is the identification of persons who were exposed to a serious health threat and risk developing of a disease or have already developed the disease. Moreover, communication of personal data via EWRS must be “useful” for co-ordination of a response to a serious cross-border health threat. Accordingly, the proportionality of measures will be assessed against this condition, that is, whether sharing of personal data was suitable and necessary to respond to a given threat. It would also often require a reference to scientific evidence based on a specific risk assessment (performed by the ECDC and/or national competent authorities). Further, in case of finding that exchange of personal information was unnecessary for contract-tracing measures, the competent authority concerned must immediately inform other involved authorities.Footnote ⁷⁵

Further, for matters not regulated in Article 16, responsible actors are obviously obliged to apply the provisions of the general EU data protection laws to ensure safe data processing. Article 16 provides for an explicit reference to that framework.Footnote ⁷⁶ As already explained above, national competent authorities must respect the Data Protection Directive (and, as from 18 May 2018, GDPR) and EU institutions, the respective Regulation on Data Protection.Footnote ⁷⁷ The provisions of those acts will apply to the issues not tackled in Article 16, for example, legal definitions relevant for data protection (eg “data controller”, “processing”), provisions establishing information and access rights of data subjects, and obligations to notify and rectify incorrect data in the EWRS.Footnote ⁷⁸

In sum, and as can be seen in the Table 1 above, the system of data protection safeguards established under the Health Threats Decision provides a broad set of important guarantees to ensure safe processing of personal data.

It also appears that they function well in practice. The Commission Report of 2015 on the implementation of the new Decision contains the optimistic information. First, the system has been technically adjusted to the new material scope of the Decision – “the existing IT tool of the EWRS was expanded to include threats of biological, chemical, environmental and unknown origin”. The new version of this IT tool was put in place in February 2015.Footnote ⁷⁹ Second, during the 2014 Ebola epidemics in Africa, the selective messaging functionality of EWRS proved to be crucial for the transmission of personal data to support the medical evacuation of patients from the affected countries into the EU.Footnote ⁸⁰

So far so good. Operationally, the EWRS is said to be adjusted to the provisions of the Health Threats Decision. However, from a normative point of view, including the law enforcement, there are still many issues which raise doubts. The next section proceeds to their critical appraisal.

1 The incompleteness of the regime

It has been repeated several times throughout this article that as a result of the regulatory reform, the new Health Threats Decision has a broader material scope. Today’s regime covers biological (diseases), environmental, chemical, and other health threats, when the 1990s’ regime regarded communicable diseases only.Footnote ⁸¹ It is a consequence of the EU “integrated approach” to health and security. Accordingly, the new Decision requires new implementing acts (old implementing legislation is now repealed), but as of September 2017, the Commission has not yet issued relevant implementing provisions (the Health Threats Decision entered into force in 2013).Footnote ⁸²

First, neither Health Threats Decision nor Implementing Decision on Alerts (which repealed the old EWRS Decision) specify an indicative list of personal data that could be lawfully shared for contact tracing purposes. The Old EWRS Decision contained an Annex III, where an indicative list was provided as an important yardstick for the application of the principles of lawful data processing: the purpose limitation and the proportionality evaluation. The relevant guidelines should be adopted by the Commission (Article 16, para 9(b), Health Threats Decision). Second, the Commission should also issue new guidelines ensuring that the operation of EWRS is compatible with the general EU Data Protection Laws (as required by Article 16, para 9(a)). Since 2013, when the new Decision entered into force, the system has been relying on the Old Commission Data Protection Guidelines of 2012 which were issued for the EWRS for infectious diseases. Third, there are no updated or adjusted implementing or delegated measures to Article 6, para 5 of the Health Threats Decision (the list and case definitions for communicable diseases and related health issues); Article 7 para 3 (case definitions to be used for ad hoc monitoring); Article 8 para 2 (procedures for the information exchange and operation of EWRS), and Article 11 para 5 (procedures for uniform implementation of competent authorities’ co-ordination).

The existing gaps in the regulatory system which result from the lack of implementing legislation can easily affect the clarity of data protection safeguards and their accurate enforcement. To give several examples: the current EU legislation does not provide for an indicative list of personal data to be exchanged for contact tracing purposes. The differences between national systems in that respect can affect the system of data protection because it is possible that divergent data are collected or required by different national competent authorities. In effect, it is possible that in various Member States different data are collected in the context of different catastrophic situations, involved diseases and/or other health threats. Some Member States may collect and exchange personal data which, in light of other national systems, will be illegitimate and/or unnecessary. To put it simply, it is contestable whether it is a name, address, and phone number which are necessary for identification of a person, or just a name and date of birth. What about the information on sex and nationality?Footnote ⁸³

Without a harmonised, indicative list stating which personal data can be lawfully exchanged, it can be difficult to agree what data constitute “a minimum threshold” for individuals’ identification under contact tracing measures (NB: only those data of an individual can be communicated which are necessary for the identification of persons who have been exposed to a threat). Previously an indicative list of data which could be exchanged provided a useful framework of reference. The current lack of an EU-wide standard on which personal data can be exchanged for the purpose of contact tracing creates a deficiency in the regime regarding the lawfulness and the legitimate purpose of data processing.

Further, the current legal definition of contact tracing is relatively general. As early as 2010 and 2012, the EDPS recommended that a more structured format for the exchange of contact tracing information should be provided, as well as a clearer definition of contact tracing, indicating its purposes and scope, methods for determination of the persons to be sought, and sources that can be used to obtain contact details, which might be all different for communicable diseases and other health threats.Footnote ⁸⁴

Moreover, some provisions of the old regime have disappeared. Before the adoption of the Health Threats Decision, the Annex to Old EWRS Decision regulated the criteria obliging to notify an alert within EWRS (for infectious diseases). They guided competent authorities on when to institute an alert and provided for the three-degree diversification of alerts. It remains unclear whether those issues would be regulated in implementing acts or not at all.

Next, at present, the relationship between ad hoc monitoring and the EWRS is not clear, especially, with regard to the specification of types of data which can be processed through the former. The provisions of the Health Threats Decision are not equivocal on this issue and it is not known what measures will be applied to minimise/exclude the chance of processing of personal data (eg through appropriate anonymisation techniques and/or restriction of the processing to aggregate data).Footnote ⁸⁵ Again, it would be helpful to address all the above matters, at least, in the legislation based on the Health Threats Decision (which foresees appropriate powers to adopt implementing acts).

Finally, the criteria guiding the assessment of proportionality of contact tracing measures should be included in the implementing legislation.Footnote ⁸⁶ They could address the significance of risk assessment and scientific expert evidence mandating contact tracing, the relationship between national and ECDC/WHO scientific evaluation, if diverse, and case-by-case evaluation of health threats.

To sum up, the first, considerable effect of the lack of adoption of implementing acts to the Health Threats Decision (ie an incomplete regulatory framework) results in the ambiguity of the scope of powers and obligations of EU/national competent authorities (“data controllers”). The second, resulting consequence can be an inaccurate application of data protection safeguards. This, in turn, can lead to a contestation of lawfulness, legitimacy and proportionality of an exchange of personal data in the ERWS and the contact tracing procedure.

2 Insufficient coherence of the regime

The next shortcoming of the health threats regime which can affect the level of personal data protection is its insufficient normative coherence with other EU policies. This will be illustrated through the following examples.

The overall aim of EWRS operating under the Health Threats Decision is to complement the existing information security systems at EU level in order to avoid duplication of information-sharing procedures.Footnote ⁸⁷ Accordingly, the Decision foresees a progressive linking of all the EU internet-based alert tools with EWRS, with the aim of streamlined communication of various health threats. The new Article 3 of the Implementing Decision on Alerts obliges the Commission to indicate through EWRS the lead system for the information exchange when a serious cross-border threat to health is communicated through more than one Union alert system. Yet, other systems (eg Rapid Alert System for Food and Feed, RASFF; Rapid Alert System for Dangerous Non-Food Products, RAPEX) do not have specific safeguards for the exchange of personal data. Will the lawfulness and legitimacy of processing of personal data be safeguarded in this context? The problematic character of those provisions is in part a consequence of an integrated approach to health and security in the EU (because before, the EWRS applied to infectious diseases only and there was no interest of linking it to other electronic systems).Footnote ⁸⁸ It is also not clear how the guarantees for adequate personal data protection (which are integral to the electronic platform of EWRS) will be implemented if competent authorities decide that they will communicate within the Health Security Committee in writing.Footnote ⁸⁹

It is also feared here that the transition between the system of the EU Data Protection Directive and its successor, the system of GDPR, could lead to incoherence between the Health Threats Decision and the respective national laws – which will need to be adjusted to the new GDPR. Until 2017, the Data Protection Directive established total harmonisation in the field of data protection,Footnote ⁹⁰ but nevertheless, Member States were entitled to some exceptions, including those relating to stricter requirements in national laws for data protection in the EWRS.Footnote ⁹¹ The Regulation will substitute those national laws which had been earlier implementing the Data Protection Directive, but also requires new, revised national laws. The final shape and content of national laws is impossible to predict, but there may well be gaps regarding the consistency between national laws allowing for the practical operation of GDPR and the provisions of the Health Threats Decision applicable to exchange of personal data.

3 Insufficient transparency for an individual citizen

Finally, the EU regime for combating health threats suffers from an insufficient degree of transparency for individual citizens. This concerns both ordinary citizens and persons affected by data processing.

To begin with, there is no satisfactory (or simply no) information on the Commission’s website regarding the current EU regime for health threats, conditions for exchange of personal data in the context of EWRS and contact tracing measures. The DG SANTE webpage is divided into two folders: security and health threats; and control of communicable diseases, but the information provided is incoherent and outdated.Footnote ⁹² Various pages of the Commission’s website list regulatory acts which are no longer in force.Footnote ⁹³ The webpage of ECDC does not provide information on the respective issues either. All the sites are available in English mainly and it is not quite clear how data subjects are informed of the processing of their personal data. For example, there is no information regarding the exercise of access rights of data subjects (including rectification, erasure and blocking), the enforcement of rights against national competent authorities and their different jurisdictions, or at least, name(s) of a contact person in case of need.

Insufficient transparency is problematic because personal data processing in the contact tracing procedure happens between two or more Member States where different competent authorities collect and exchange personal data. It might even not be the country of origin of a given person. Supposedly, each person receives the information about contact-tracing measures and their consequences from national authorities, but what happens if the information is incomplete and/or a person does not understand it (language problem) and/or there is a mistake in the data content? Will it be clear to a person to whom his/her concerns should be addressed? Will it be clear which of his/her personal data have been exchanged, and where they can be accessed/corrected, etc? And what happens if links provided in e-messages do not function properly?

It is difficult to provide definite answers to those questions. The lack of answers contradicts the Old Commission Data Protection Guidelines stating that a clear and comprehensive privacy statement will be available on the webpage dedicated to the EWRS.Footnote ⁹⁴ It further ignores the recommendation of EDPS.Footnote ⁹⁵ It also contrasts heavily with the Commission’s original declarations that the reforming process of the previous regulatory framework (for infectious diseases) would lead to the simplification of existing legislation and the improvement of transparency.Footnote ⁹⁶

To conclude the overall appraisal, it can be said that the revision of the EU-wide regime for health threats to follow the “integrated approach” has not (yet?) introduced a comprehensive system to warrant personal data protection completely. The problems of an adequate personal data protection in the process of data exchange within EWRS are summarised in Table 2.

Table 2

Problems of adequate personal data protection within EWRS (source: own analysis)

It is true that the Health Threat Decision and its implementing act establish the framework to ensure that processes of data exchange within EWRS are lawful, but a number of actions are clearly needed to address the above-described incompleteness, insufficient coherence and lack of transparency of the EU regime for prevention of health threats. A basis step to begin with would be to adopt necessary legislative solutions. However, it may not be that easy because of the complexity of the new regime based on the “all-hazards approach”. This is another reason why the health threats regime suffers from the above shortcomings: because it simply takes a very long time to adopt measures (of all kinds) which concern those intricate “all-hazards security” issues.