This paper is part of the e-conference on « Data protection Issues and Covid-19: Comparative Perspectives » which consist in a daily publication at 12 p.m. (GMT+1) except on Sundays until the Summer break. A new session will start again at the beginning of the academic year 2020-21. Please subscribe to blogdroiteuropeen, so you don’t miss a publication. This e-conference was organised by Dr. Yseult Marique, Senior Lecturer at the University of Essex and FÖV Speyer and Dr. Olivia Tambou, Associate Professor at the University of Paris-Dauphine, External Scientific Fellow at the Max Planck Institute of Luxembourg, and Founder- Editor of Blogdroiteuropeen. If you are interested to contribute for our September session feel free to contact us at firstname.lastname@example.org.
In Slovenia the Covid-19 pandemic officially started on 13 March 2020. On this day the government ordered to close all kindergartens, schools, universities, student dormitories etc. All public transport was suspended, excluding taxis. All appointments with a medical specialist and surgical procedures, rehabilitation procedures and other non-urgent forms of treatment, except those marked with the degree of urgency, oncological services and appointments by gynaecologists and obstetricians, were cancelled. Restaurants, hotels, wellness services, fitness centres, hairdressers, beauticians, cinemas, museums, galleries etc. were closed. The border crossing points with other countries were mostly closed. The courts held hearings only in urgent cases (i.e. criminal cases in which the accused is deprived of or restricted in liberty of movement, enforcement matters relating to the custody of children, cases concerning the detention of persons in psychiatric health organizations…). The courts did not serve any documents and the procedural deadlines were suspended until 1 June 2020.
This article is going to focus on new police powers the government wanted to enforce in connection with Covid-19 and special application which would allow citizens (and maybe government as well) to follow the situation regarding the possible contacts with infected people.
The Slovene national assembly adopted in this respect the Act Determining the Intervention Measures to Contain the Covid -19 Epidemic and Mitigate its Consequences for Citizens and the Economy (hereinafter the Act) on 2 April 2020, which entered into force on 11 April 2020.
Before the above mentioned Act entered into force a very vivid public debate took place, since the government’s initial draft proposal of the Act gave new powers to the police and even stipulated that the police can enter dwellings and other premises and can restrict the movement of persons without prior judicial authorization. The draft proposal additionally provided that the police can obtain information on the location of an individual’s means of communication if it is not otherwise possible to ensure compliance with the measures stemming from the decision or other act for the containment and control of the epidemic, without any court injunction whatsoever.
The discussion was incited as one could not determine on the basis of the proposed draft provisions, for instance, when the situation, where the police can obtain the information on the location, occurred. Furthermore, the draft did not specify how and especially in what order the police should exercise their new powers.
In the given situation, probably no one would have opposed the measures if these measure had been presented convincingly as being necessary and proportionate. But this justification was seriously lacking in the proposed provisions of the draft. When interfering with fundamental human rights, the legislator is expected to be fully transparent and, above all, to clarify the provisions that restrict these rights.
The controversial proposal, which allowed for the tracking of citizens in quarantine through the locations of their mobile devices and entering the dwellings without a court order, was not accepted. The draft of the Act was modified after very negative reactions from the public in this respect and following the opinion of the Information Commissioner and of the Ombudsman. Therefore, these provisions cannot be found in the Act currently in force.
Nevertheless, Article 103 of the Act in force still conferred (some) new powers to the police. The aforementioned provision stipulates that police officers may, for the purpose of containment and control of the epidemic and for the purpose of ensuring compliance with special measures under the Communicable Diseases Act and orders or decrees adopted to contain and control the epidemic, use the powers already attributed under Police Tasks and Powers Act as well as access to the following personal data, including special categories of personal data, which the National Institute of Public Health (hereinafter National Institute) collects: name; identity number; address of permanent or temporary residence; information about one’s personal physician; information on the decision by which the sick person was ordered to be isolated, completely isolated or quarantined (who and when ordered the isolation); information on the type and duration of isolation or quarantine (whether the isolation takes place at the patient’s home, in a health care institution (hospitalization) or in a specially designated area) and information on the restrictions imposed on the person subjected to isolation or quarantine (protective equipment, mode of transport). The protocol for the exchange of data between the Ministry of the Interior, the Ministry of Health and the National Institute shall be determined with a resolution by the government. Article 103 further provides that in case a police officer finds that a person violates the measure ordered, he/she shall bring that person to the place specified in the decision on the isolation/quarantine and shall propose that a stricter measure be adopted.
Since the Ministry of Health has no legal basis for transmitting the data to the National Institute, consequently the National Institute does not have the data it should provide the police with, this part of Article 103 cannot even be implemented. The decision of the government on the exchange of data is thus unenforceable for the purposes the legislator had in mind.
Furthermore, according to Article 103 the obtained data shall be kept for at least the duration of the measures prescribed under the Communicable Diseases Act or according to orders and decrees adopted to contain and control the epidemic, but not longer than 30 days after the official declaration of the epidemic’s end. After the expiry of this period, the obtained data shall be deleted or destroyed. There is no information available at this point whether the police had access to the data and in that instance, if the data collected was actually deleted or destroyed, even though the period of 30 days after the end of the epidemic in Slovenia was over on 16 June 2020.
Understanding the complexity of the Covid-19 situation, the fear that the new powers of the police are too general and can be understood and applied in a way counter to our democratic values cannot be ignored. In particular, it is not clear from the Article 103 which special measures are supposed to be protected by the new powers of the police. However, according to the data available no questions regarding this issue were raised so far in court.
At the end of June 2020, a public debate about a special application that allows tracking individuals infected with the Covid -19 virus was reopened again. Namely, the government has rewritten the provisions of the law (Act on Intervention Measures to Prepare for the Second Wave Covid -19). The act was adopted on July 9, 2020 and it hence became the legal basis for the use of the application, which should be voluntary for all the interested and mandatory for infected individuals ordered to be in isolation and for individuals who are ordered to be in quarantine.
However, the government again did not ask the Information Commissioner for an opinion before drafting the legal provisions. This follows from the press release issued by the Commissioner on 29 June 2020, immediately after the government presented plans for the introduction of a mobile application for tracking contacts.
It needs to be mentioned that the Information Commissioner is constantly warning the government about the privacy issues and General Data Protection Regulation (GDPR) rules. It also needs to be stressed that Slovenia is the only EU member state which has not enacted the post GDPR national data protection act yet, hence at the moment GDPR is the only data protection pillar to follow.
The legal basis for obligatory use of the application is now provided and on 12 July 2020 the government has announced the public procurement procedure for upgrading and adapting a German version of the app to Slovenian language (estimated cost 20,000 EUR). The responding time for developers was 3 days. The basis for an upgrade is the application Corona Warn App.
After the public criticized the law again Minister for Public Administration has explained that for now the app is going to be on a voluntary basis only and that obligatory part provided by the above-mentioned law is not going to be executed.
Nonetheless, we should never forget that denying human rights, such as freedom of movement, the inviolability of dwellings and the protection of privacy, to every resident to a large extent, without presenting them with concrete arguments justifying such action, which must always be proportionate, is inadmissible in the modern democratic society. Slovenia obviously, even though the Act could be better written, never did satisfy the strict criteria regarding limitation of human rights.
Nataša Pirc Musar, PhD, Attorney at Law, ex Information Commissioner, Slovenia
For more information on the context of this e-conference
and the other papers see here
Don’t miss the next paper tomorrow at 12 p.m. (GMT+1), Contact tracing and data protection during Covid-19 pandemic in South Africa, by Melody Muson