International Health Day during a pandemic: an opportunity to reflect

This week International Health Day was marked amidst a global pandemic which has impacted every region in the world. And it gives us a chance to reflect on how tech companies, governments, and international agencies are responding to Covid-19 through the use of data and tech.

All of them have been announcing measures to help contain or respond to the spread of the virus; but too many allow for unprecedented levels of data exploitation with unclear benefits, and raising so many red flags regarding the protection of people and their data.

This is a highlight of key issues PI and our partners and global experts have been working on, giving us the opportunity to flag how Covid-19 responses are amplifying our concerns whilst creating new ones.

The Right to Health

The right to health provides for various elements which must be in place as States comply with their obligations which include availability, accessibility, acceptability and quality, and as with other social and economic rights, they must comply with them in accordance to the principle of equality and progressive realisation. Data exploitation can lead to both discrimination and receding on the providing of these rights.

The right to health provides for negative and positive obligations for the states. The freedoms include the right to control one’s health and body, including sexual and reproductive freedom, and the entitlements include the right to a system of health protection which provides equality of opportunity for people to enjoy the highest attainable level of health.

Respect for privacy are key to this, even within times of emergency. The World Health Organisation articulates this within its policy on data sharing in times of public health emergencies, as does the UN Committee on Social, Cultural and Economic Rights. Furthermore, data protection laws around the world often identify health data as sensitive personal data which must be subject to additional protections and safeguards; including legal grounds to collect, process and share data.

And in this time of crisis the Director-General of the World Health Organisations, the UN High Commissioner for Human Rights, the Council of Europe Commissioner for Human Rights have all called on countries to respect human rights principles when fighting Covid-19.

Right to health and data exploitation

PI has been monitoring how healthcare systems and benefit systems around the world are becoming reliant on the collection and processing of vast amounts of personal data.

Access to health and other social and economic rights is often tied to the provision of unique identifiers; and their decision-making models are increasingly exploiting people’s data, including profiling and automated-decision making.

And unfortunately some of the more ambitious and untested proposals by companies and governments are expanding dramatically untested expansions to this already problematic practices.

Some government measures are following expert advice when it comes to the management of pandemics, and they may require a legitimate, necessary and proportionate and temporary interference with some fundamental rights. But that’s not the case for all of them.

The need to ensure equal access to healthcare

Everyone must have access to healthcare, without any discrimination. This is even more so the case now if we are to respond comprehensively to Covid-19. This is why access is central to the right to health.

Despite this, in some countries there are already discriminatory measures emerging. For instance, requiring patients to provide a specific ID or prove their immigration status undermines both this right and public health objectives.

ID as a pre-condition for access

The inability to provide an ID card should never result in a denial of services. We are not alone on this point; this is why the UN Special Rapporteur on Extreme Poverty and Human Rights questioned existing mandatory ID requirements for accessing health care services.

ID is indeed being used to exclude people from receiving care. In countries like Chile, Uganda, India and Kenya, to name a few, providing an ID card is a pre-condition for accessing any public service. In normal circumstances we are seeing numerous cases of exclusion because many are unable to register and get an ID card. And if upheld these requirements would be counter-productive to an effective response to this public health crisis.

And yet, some governments are seeing a digital identity as a solution to faciliate the provision of emergency health care and other public services. For example, the Jamaican Government is using Covid-19 as justification to fast-track the creation of a national identification system (NIDS) to help it with its aid and benefits distribution. It will be interesting to see how it proceeds given that in April 2019, the Constitutional Court of Jamaica had struck down the country’s mandatory biometric National Identification and Registration Act and the National Identification and Registration System (NIDS) ruling that they violated constitutional privacy protections, and had to be reviewed before the government could proceed.

Exclusion based on legal status

Migrants are often most negatively affected, as migrants, asylum seekers, and refugees may be limited in accessing healthcare out of fear of coming forward and risking exposing their identities; and worries about costs too. Fortunately, the implications of such policies have led to some countries suspending such policies. For instance, the Irish government gave assurances to “treat them [migrants] with dignity and with absolute privacy and patient confidentiality, as will their social work system, during this time of emergency.”” Portugal decided to regularise the status of thousands of persons with pending cases so they could access universal health care during the pandemic.

Transparency is essential

Ensuring “accessibility” raises issues about right to information. People should be informed about how decisions are made by their governments to protect them.

In this time of crisis in particular, the public want to be ensured that the government is following the evidence from health experts and is balancing this with due regard for their welfare.

Delivering quality health care requires protecting people and respecting confidentiality

Amongst other requirements, providing quality health services requires that it be people-centred. This means that health services must provide care that responds to individual preferences, needs and values, and designed to respect confidentiality.

Rather, the deployment of digital health care systems often involves expanding data collection processes, including enhanced data access and sharing. There are multiple examples around the world including India’s Mother and Child Tracking System (MCTS), which is aimed at collecting data on maternal and child health and was set-up 2009 as part of multiple health information systems, or Colombia’s Sisbén, a unified vulnerability assessment and identificationsystem for social assistance. Also combining digital identity systems with access to public services such as health care means that vast amounts of data are being processed about people.

Collecting and recording health care data

With the pandemic requiring people to limit their movements and contact with the outside world beyond their household, many governments setting up apps to collect and record health care information with individuals self-reporting their medical conditions and some other apps to enforce quarantine measures.

These websites and applications must implement privacy and security safeguards by design and by degault, from their earliest stage of development. These are concerns that have been flagged in non-crisis situation with extensive data-sharing practices by mental health websites or menstruation apps for example.

New elements of public health: digital tracking

It’s now a standard modern response to public health crises for governments and industry to seek to grab location data from phones and applications. Since the outbreak of Covid-19, at least 24 countries including Israel, Belgium, Ecuador, and the UK, have announced measures to use people’s location data. And as with most modern responses to these initiatives, upon reflection we soon see that it is not what is most needed and helpful to health care professions.

For example, the Israel Association of Public Health Physicians have expressed their disapproval with Israel’s security service’s measure to monitor the movements of Israeli citizens to combat the spread of the coronavirus. Their reasoning is that most people are already confined to their homes, and so the location tracking is not beneficial. This echoes what the Chief Medical Officer of the UK Government said a few weeks ago during one of the daily press briefings: Sir Patrick Vallance said that the most useful period of time for location tracking had already passed and that such a measure “would have been a good idea in January”.

Telemedicine support

Remote forms of reproductive healthcare are even more important in the current crisis. For example, those seeking abortion care under lockdown will now struggle to physically travel to clinics. Accessing abortion care is already unduly complex in many countries around the world and telemedicine options give people a way to access reproductive medicine and support.

Organisations that provide care have expressed the need to allow those seeking an abortion to be able to do so at home, and for them to consult their healthcare professional by telephone or electronic means, instead of attending a healthcare facility in person.

Such services would allow the continuation of access to reproductive healthcare, and put bodily autonomy in the hands of the individual.

Antenatal and postnatal care is also an area that will benefit from remote forms of healthcare to ensure the continuation of care. Antenatal appointment continuation and postnatal support and care are areas of maternal healthcare that will rely on telemedical systems to continue to operate.

It’s essential that these telemedical procedures use systems that are secure, accessible, and privacy-protective. It is tempting to use third parties but if those third-party services are leaking metadata or allowing others, including others within the same household, to monitor these exchanges this could exposes those seeking such health services.

Tech industry and health data exploitation

Industry has identified the health sector as a fertile ground for data exploitation. They play different roles from providing tech “solutions”, i.e. infrastructure, but also some of the bigger tech giants such as Google, Microsoft and Amazon are involved at different, complementary levels from infrastructure to data management, analysis and product development, and then you have the hidden industry of data brokers mining vast amounts of personal data and making it available - at a cost of course.

Companies are keen, in this moment of crisis, to be seen to be seen as doing something to help, whether or not they have been asked by any health experts. This is particularly concerning when some of these companies, like Google or the global surveillance industry, are infamous for their involvement in the global exploitation of people’s data. As we recently highlighted, the surveillance industry won’t save us from crises.

Whilst they have the tools and resources, with many having shaped their business models around data exploitation and surveillance, we need to ensure that whatever contribution they make to the solution proposed, that they serve to protect people and they are firewalled from their commercial interests, now and in the future. Industry should not be profiterring from this crisis.

Given the potential harm of health data being abused, all of these legitimate concerns cannot be ignored in this time of crisis, but used to inform how to better protect, inform and reassure people in time of crisis.

Effective public health and fundamental rights and freedoms are complementary, not at odds

A false dichotomy between privacy and responding effectively has been constructed in the debate around Covid-19, and us and many other privacy advocates continuously have to debunk it in our work.

These extraordinary powers need extraordinary protections too.

In times of crisis, there is a tendency to enforce exceptional existing measures of control as well as institute new ones. We must ensure any such measures are based on expert health advice and done so proportionately, where necessary, and with appropriate regard to people’s safety. Also, and as we have said before, extraordinary powers require extraordinary protections.

The way we are responding locally, nationally and internationally to Covid-19 is serving as a test for us all within our societies to assess and decide how to use data and technology to empower and protect us all equally instead of exploiting our data for profit and power.