Although the debate about right to privacy and data protection has been lately expanded in Brazil, the technological solutions presented to combat the pandemic have been given little attention in the discussion about privacy. That is, in great extent, a result of the controversy and lack of coordination and control among the measures imposed in the public calamity context.

This issue is explored and highlighted in the report “Privacy and Data Protection in the Pandemic: Report on the Use of Apps and Alternative Measures in Brazil”. The study addresses the pandemic crisis management among different spheres of the public administration, the constant judicialization of the instituted determinations, the effectiveness of the technological and alternative measures employed, as well as the impact of these measures on vulnerable groups.

The research was developed within the scope of Covid App Project, an initiative of civil society organizations interested in studying national responses to Covid-19 in different countries, especially those relative to contact tracing apps. The research group is coordinated by AWO, an agency of digital rights, and it is composed of six civil society organizations: ALT Advisory (South Africa), Internet Democracy Project (India), InternetLab (Brazil), Karisma (Colombia), SMEX (Lebanon) e United for Iran (Iran).

Unravelling the analyses

The main subjects of the analysis about privacy are a contact tracing Brazilian application called Coronavirus SUS and the public-private partnerships of States and Municipalities established to monitor isolation indexes. The document presents the operating model of Coronavirus SUS – which is based on self-notification by users who have been in contact with an infected person – and highlights the issues that might emerge from it: the risks of informative self-determination to the app users due to the flaws in transparency on the privacy policy, the gaps in the characterization of consent (free, express, unambiguous, informed) to data usage permission, and the imprecision about purpose and sharing of personal data, considering the legal framework of the General Data Protection Act and the Civil Rights Framework for the Internet.

On the other hand, the national app is in conformity to the ethical and privacy parameters that are adopted internationally for the use of contact tracing. Regarding data collection, the Bluetooth option was elected, giving preference to proximity data collection over the storage of GPS location data. Regarding the app installation, voluntarism was chosen over mandatory installation, in which data collection would be compulsory.

Other issue identified by the study is related to private-public partnerships, as the one established among São Paulo State Government and telephone services companies in order to monitor the effectiveness of lockdown and social isolation policies. In this case, the study focused on the judicialization of the policies to discuss their conformity to fundamental rights related to privacy, a situation that was aggravated by the establishment of this partnership having occurred before the General Data Protection Act came into force, which evidenced the gaps in principles and criteria for the use and treatment of personal information.

The report also alerts that the difficulties to access technological solutions or adopted alternatives deepen preexistent inequalities by disproportionally exposing historically vulnerable groups, as in the case of immigrants affected by the closure of boarders or by obstacles to access the emergency income app, which provides social protection.

About Covid App Project

During the period of 7 months, through interviews with specialists and public administration authorities, as well as extensive analysis of public documents about the use of technological instruments, contact tracing apps were examined under the perspective of public health, human rights and privacy. The premise adopted in the research is that these apps must be evaluated in relation to other measures – whether technological or not – that were instituted to combat the pandemic and that interact with the use of this central tool.

Today, we publish the detailed reports of the countries – each one followed by a set of recommendations – along with a specialized technical review of seven contact tracing apps present in our focal countries.

The InternetLab team hopes this contribution may support the critical evaluation of contact tracing apps and other measures to combat the pandemic, and that it also may promote a discussion about safeguards – including appeal and supervision – that will better protect vulnerable and marginalized groups during public health crises, reinforcing human rights, democracy and the Rule of Law, and strengthening the future response to the pandemic.

Read the report here.