IGF 2020 WS #340 Checks and balances of data privacy within mass surveillance

Relevance to Internet Governance: There is consensus on the need to ensure Humans Rights online, and this issue has been gaining relevance for the Internet Governance debates as our societies depend more and more on Internet-related infrastructure. Organizations around the world are highlighting particularly freedoms of speech, information, and right to privacy as principles that are fundamental to the upholding of liberal democratic values. When Edward Snowden revealed to the world the United States' government huge surveillance strategy and its worldwide reach, it pointed out for the necessity of greater efforts to protect the digital environment from Human Rights violations based on the exacerbation of the power of governments and companies that are ultimately making use of indiscriminate personal data collection. The Snowden revelations brought about a series of discussions worldwide which culminated into one of the most important Internet Governance events - the Global Multistakeholder Meeting on the Future of Internet Governance – NETmundial, held in São Paulo, in 2014, with the participation of 1480 stakeholders from 97 nations. On that occasion, the Brazilian president at the time, with the support of other government representatives, international organizations and NGOs, called for the creation of a multilateral mechanisms for the worldwide network that should be capable of ensuring principles such as: freedom of expression, privacy of the individual and respect for human rights, among others. In 2020, due to the COVID-19 outbreak privacy advocates around the world have sounded the alarm. Actions from many different fronts are being developed in order to allegedly counter the pandemic - and, once more, the slight balance between mass surveillance and personal data protection jumps on the stage raising several concerns. Since the first detection of COVID-19 in China, a handful of governments took digital action, vacuuming up citizens’ cell phone data, sometimes even including their rough location history. South Koreans are tracked through GPS location history, credit card transactions, and surveillance camera footage. Israelis learned last month that their mobile device locations have been collected for years, and now the government moves through this enormous database in broad daylight, this time to allegedly track the spread of COVID-19. Russians cannot leave home in some regions without scanning QR codes that restrict their time spent outside—three hours for grocery shopping, one hour to walk the dog, half that to take out the trash. This month, more than 100 civil and digital rights worldwide organizations urged that any government's coronavirus-targeted surveillance mechanisms ought to respect Human Rights. According to a Privacy International analysis, at least 23 countries have deployed some form of telecommunications tracking to limit the spread of coronavirus, while 14 countries are developing or have already developed their own mobile apps, including Brazil and Iceland, along with Germany and Croatia, which are both trying to make apps that are GDPR-compliant (or to their national's equivalent laws). But rapid surveillance demands rapid infrastructure. The push to allegedly digitally track the spread of coronavirus comes not only from governments, but also from companies that build potentially privacy-invasive technologies, such as a joint effort recently announced by Apple and Google. The combination of state and private surveillance means that digital technology instead of promoting equity and inclusion for all, might be encouraging a segregation within societies through a dichotomy of “watchers” - invisible, unknown and unaccountable for -, and the “watched by”. This segregation has profound consequences for democratic processes, as gathering of information tend to lead to asymmetries of knowledge, also translated into asymmetries of power. Mass surveillance has been a historically core debate, given its roots in the complex relationship between governments, companies and citizens. Almost a decade after the Snowden leaks, the world faces another challenge on the privacy boundaries online, reassuring the relevance and importance to advance this on Internet Governance once more.

Relevance to Theme: The relationship of privacy and data protection with the Internet and the advance of the digital interactions of our societies have been heavily discussed in the past years for different reasons. Recently, the most important game changer in this field has been the enforcement of the European General Data Protection Regulation – GDPR, which came into effect in May 2018. The GDPR was the main issue discussed in several Internet Governance policy arenas for a long time, by fostering debate and forming coalitions to work together on topics of interest, as well as promoting counterpart legislation around the world. But to consider the existence of the GDPR as the end of the discussion is to not acknowledge that privacy and data protection related questions are fluid and all around always changing. Surely it is an inflection point current legislation on the topic, but our connected society has been demanding more. Take for example the domain name ecosystem and the Internet Corporation for Assigned Names and Numbers – ICANN, where several professionals are engaged in a task force to build and implement rules for domain name registration data, so as to make it compliant with the new set of rules that were put in place. We need that effort for privacy and data protection, too. In the Brazil scenario, mobile telephone operators have voluntarily provided access to citizen's cellphones personal data, such as geolocation history, as allegedly anonymized aggregated information to government of some states, without even letting the owners of such personal data, aka the citizens, know, let alone ask for consent. This voluntary provision is supposedly due in order to identify crowds and assess the progression of the virus, and yet no ongoing technical study is being held as to guarantee the effectiveness of this approach. Finally, the relevance to the data track reflects upon the tech-focused tools as the ultimate go-to solutions for social issues, in this case a health issue. Is tech capable of making up for structural gaps, including shortage of personal protective equipment for medical professional, non-existent universal testing, and a potentially fatal selection of intensive care unit beds left to survive a country-wide outbreak? Or how is tech able to play a relevant part without harming human rights and invading citizen's right to data protection. As stated in a recent open letter from international privacy groups - technology can and should play an important role during this effort to save lives, such as to spread public health messages and increase access to health care. However, an increase in state digital surveillance powers, such as obtaining access to mobile phone location data, threatens privacy, freedom of expression and freedom of association, in ways that could violate rights and degrade trust in public authorities - undermining trust and the effectiveness of any public health response.