As a measure against further spread of coronavirus, the authorities in Montenegro have published on a government website lists of individuals who are in mandatory self-isolation after returning home from abroad. The lists, structured by municipalities, include individual’s name, surname, date from which the person is in isolation, and the home address.
The government may probably rely on a specific statutory basis for this form of a data processing. However, proportionality of the measure as it was enacted is questionable. In the attempt to justify the measure, the prime minister of Montenegro stated on 22 March 2020 that that “this is not the time for legal nuances but for saving human lives”.
The National Coordination Body (“NCB”), an agency established by the government to coordinate anti-contagion activities, adopted on 21 March 2020 the decision on the publication of the lists. Earlier on the same day, the NCB sought and obtained a positive opinion of the Montenegrin Data Protection Agency.
It appears from the NCB decision and the opinion of the Data Protection Agency that the aim behind the publication of the names and addresses is to discourage the persons in self-isolation from leaving their homes. As the Data Protection Agency put it, “public disclosure of the personal name and places of residence of persons in self-isolation … would significantly contribute to an increased adherence to the self-isolation measures”. Ultimately, the interaction between infected and non-infected persons should be reduced and the virus would hopefully cease to spread.
Classification of the data and the legal basis for the processing
For the NCB decision to be lawful, the processing by means of publishing the names and addresses should have a legal basis. The Montenegrin Data Protection Act (“DP Act”) does seem to offer such a basis, because it allows for the processing without the consent of the data subject “when processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority falling within the scope of work or competence of the data controller” (Art. 10(2), point 4). This provision corresponds to Art. 6(1)(e) of the GDPR.
If the name and address of the person in self-isolation were health data, the Ministry of Health (or the Government) as the data controller would have to find an additional legal basis for the processing of the special category of personal data. However, the data published by the NCB are probably not health data and therefore the reliance on the general legal basis from Art. 10(2) is sufficient to ensure that a basis exists.
An argument that data at issue are health data would be based on the reasoning that a segment of the public considers the persons in the self-isolation as particularly likely to be infected by coronavirus. However, that perception is not sufficient to convert the data about self-isolation into “health data”. As the data protection authorities in Sweden and in Norway have explicitly stated in relation to coronavirus, information on whether an individual has been quarantined and information on whether an individual has returned from a “risk area” do not qualify as health data.
Proportionality issues
The NCB measure is vulnerable on the proportionality grounds, mainly because the measure includes publication of home addresses. It is difficult to find justification for making home addresses of the thousands of individuals known to the general public. The NCB probably reasoned that knowledge of the home address allows a third person to distinguish between two or more different individuals whom he knows to live in the same municipality and to share the name and surname. However, in such hypothetical cases confusion could be avoided by including in the publishable list, for example, the age and the middle initial, of the persons in mandatory self-isolation rather than the security-sensitive information about their home addresses.
If the lists did not include home addresses, the jury would still be out on whether the publication of the names of persons in isolation would be “necessary to achieve the purpose of processing” (Art. 2(2) of the DP Act). The purpose of the measure is hardly controversial: to contain the spread of coronavirus. However, this goal has to be weighed against the fact that the measure affects personal data of a high number of individuals, has uncertain benefits, and has potential negative effects.
Thousands of individuals might end up appearing on the lists, because the Institute of Public Health considers that 5.565 individuals have returned in the past two weeks from the countries with high transmission rate.
It is not clear to what extent publishing the names of the persons in self-isolation contributes to the containment of the Covid-19 contagion. It is not clear whether the practice of abandoning the place of self-isolation is widespread. The prime minister blamed “a certain number of citizens” for breaching self-isolation regime, and the NCB referred to “individual persons”. Also, it remains to be seen whether the publication will contribute to the reduction of contacts between the persons in mandatory self-isolation and the others. The decision of the NCB does not invite the citizens who spot a person from the list to report that person to the authorities. It seems, therefore, that the NCB expects that the anticipated social opprobrium will have a dissuasive effect on the persons in self-isolation.
The main unknown would probably be, in the hypothetical situation in which the persons’ addresses would not be published, whether there is a significant negative impact of the publication of the names on the lives of law-abiding individuals in self-isolation. One argument would be that in the context of the unprecedented health (and likely economic) crisis a part of the public would consider all individuals from the list as a threat. To this one could retort that such concern is speculative, and the public is reasonable enough to distinguish between the law-abiding persons in isolation and the non-law-abiding ones. In this instance, the NCB has tried to pre-empt negative reactions by inviting the public to avoid “doing any wrong to the great majority of the responsible fellow citizens diligently respect the self-isolation” and to provide every assistance and support to them.
The NCB and the Data Protection Agency have not made any reference to the availability of other potential measures to achieve the desired purpose. For example, it might be possible to use surveillance cameras or track bank card and mobile phone usage in order to verify whether a person in self-isolation respects his or her obligation to stay home. Those alternatives, of course, raise data protection issues of their own.
