Beware! Corona virus - License for mass surveillance?!

In Austria, Italy and Germany, people are monitored by respective telecommunications providers, this is now being discussed in Switzerland. Is cell phone tracking a sensible solution to contain the corona virus, or will the state have a powerful mass surveillance tool at its feet?

We should be grateful to the major German telecommunications providers for their helpfulness and extreme dedication to us. Thanks to them, we can now feel safe and sleep peacefully, because they monitor our anonymized locations and send them to the authorities. They then analyze whether the home office strategy worked to better protect us from the corona virus!

You notice the irony behind these words. I would like to take a very critical look at some points in this text, including the anonymization of data and health over data protection, since some newspaper articles have recently been written on the subject of cell phone tracking. For the most part, the mass data collection and analysis was reported very positively. I would still like to represent the opposite side here, because every opportunity is being used in Germany to skip data protection as much as possible. Regardless of whether it is a question of justifying facial recognition at events and in large cities or the mass storage of car license plates on certain motorway routes, all of this, of course, in terms of data retention.

Telekom and Vodafone now passed on the data of the users out of the blue without their consent or the like. They decided to share the data with RKI and they did it. An evaluation should show the authorities whether the population adheres to the recommendation to stay at home. Now, however, this data should be transmitted "anonymously".

Unfortunately, it is questionable whether and how the data is anonymized. This was shown by an analysis by the New York Times, in which anonymized data was processed and produced terrifying results. In this way, individual data tracks could be assigned to people and analyzed, thus determining where they lived and where they work. If the location signal of one or more people is largely at one or two addresses (home and office), people can be identified.

The question that many people are currently asking is whether this action complies with the DSVGO and whether it is allowed to do so under the General Data Protection Regulation. I asked the Austrian data protection officer, lawyer and consultant Michel Sharbin:

"Profiling based on anonymized data, even if it is processed in a bundle, should be viewed critically in terms of the GDPR. Basically, it is mandatory for the user to give consent to data processing or not. Furthermore, the processing as required by the GDPR must ensure that the data is also anonymised technically correct, pseudonymization will probably not suffice to protect against identification. This technically perfect processing must be recorded accordingly in a detailed data protection impact assessment if there is an increased risk or if it results in an increased risk for the rights and freedoms of the natural person. An increased risk is defined in Art. 35 GDPR as an example Art. 35 Para. 3a GDPR „systematic and comprehensive assessment of personal aspects of natural persons, which is based on automated processing including profiling and which in turn serves as the basis for decisions that have legal effects against natural persons or impair them in a similarly significant way;“

It is critical to question whether this essential encroachment on the protected rights of the natural person has taken place without a legal basis from the current perspective. The government's currently decided measures could also have placed this measure on the agenda in order to create a legal framework for this data processing.

In this difficult time of crisis for states and their citizens, priority must be given to coping with them as best as possible. In the aftermath, it must in any case be guaranteed and ensured that, once this life-threatening crisis has been overcome, this data processing by the states also comes to an end.

For certain telecom providers, however, this will be a transition to day-to-day business, because they have been shown to be using this data before and will continue to use it even after the crisis. It is therefore advisable for every user, if he does not want this data processing, to expressly use his objection to this data processing and to transmit it to the respective provider."

There is also the question of how long the data will be processed and passed on. Until the curfew ends? Until all shopping centers have opened again? Perhaps the data will continue to be collected to be "prepared" in the event of a new virus? Or only for the "security of the people", as the Stasi did with the pretext for "reliably protecting the state-owned businesses, agricultural goods and transport from criminal elements, enemy agents, diversions, saboteurs and spies".

The "containment of the virus" purpose does not justify every means. Essential fundamental rights must not be abolished on the side, because otherwise the government may take advantage of the current or possibly coming crises to establish far-reaching surveillance powers. What will be the next step? Biometric facial recognition on every street? Social point system? No cash? If this happens, you will soon learn what total supervision and control of a society looks like. I already wrote an entry in the blog that I will link to. In my opinion, MEP Patrick Breyer describes it very well:

"Monitoring the movements of the entire population, supposedly anonymously, does not protect anyone from infection, but allows unprecedented mass surveillance."

I also do not understand to what extent the data are relevant for containment, since there are wonderful alternatives to mass surveillance. Instead of locating people, you can compare the number of calls missed by a doctor, including people in quarantines, before and after the recommendation to stay at home, and you would have very effective statistics without mass surveillance. Why is cell phone tracking considered the only solution?

Corona virus or not, what do institutes and authorities want to do with my data afterwards? Why should they be able to know whether I am at home or not? Can I then not buy toilet paper without a state permit? Either you are at home or you will be punished - Regime: where is the limit?

Since this topic is burning under my nails, I will write a sequel.