伊丽莎白·斯坦纳:欧洲人权公约与新冠疫情:任意的位置跟踪具有正当性吗? - 第一单元:人权价值观与抗击新冠疫情 - 中国人权网

首页 > 专题2020 > “疫情防控中的中西方人权观比较”国际视频研讨会 > 第一单元:人权价值观与抗击新冠疫情 >

伊丽莎白·斯坦纳:欧洲人权公约与新冠疫情:任意的位置跟踪具有正当性吗?

2020-06-01 14:47:44来源:中国人权网

\
REEEP机构法律顾问艾格尼丝·斯坦伯格女士代替伊丽莎白·斯坦纳博士发言(网络会议视频截图)

  2020年5月30日下午,由中国人权研究会指导、华中科技大学人权法律研究院主办的“疫情防控中的中西方人权观比较”国际视频研讨会召开。会议采取现场和网络相结合的形式,来自联合国人权高专办、联合国人权高专办驻几内亚办事处、奥地利、荷兰、英国、巴基斯坦、尼泊尔和中国等国家和地区的40余名人权专家、官员参加了线上研讨。 奥地利克莱姆斯多瑙大学教授、前欧洲人权法院法官伊丽莎白·施泰纳女士由REEEP机构法律顾问艾格尼丝·斯坦伯格女士代其在”第一单元:人权价值观与抗击新冠疫情“上作题为《欧洲人权公约与新冠疫情:任意的位置跟踪具有正当性吗?》的发言。

欧洲人权公约和新冠肺炎:不加选择的位置跟踪举措是否合理?

伊丽莎白·斯坦纳博士(Dr. Elisabeth Steiner)

  接下来,请允许我用十分钟的时间,来探讨一下这个问题:政府为了应对新冠肺炎疫情而采取的技术措施,是否真的是保护人民生命健康的必要举措?特别是不加区分地跟踪人们行踪这一做法,是否符合《欧洲人权公约》的相关规定?

  为了应对新冠肺炎疫情,各国政府、以及非公有部门采取了许多措施,其中之一就是使用数据驱动的解决方案;只是,这一方案引起了人们对于隐私方面的担忧。原因是这一方案被政府滥用的可能性很大。因为,当前在疫情暴发的紧急情况下显得合理的这一做法,一旦疫情结束后,却有可能成为政府手中一个常态化的举措。可以明确的是一点是,如果没有足够的保障措施,这些强大的技术手段,可能会带来歧视、侵扰问题,以及对隐私的侵犯;或者,政府可能会针对个人或者群体使用这些技术手段,而且其使用目的也不再是为了应对疫情大流行。

  位置跟踪

  当前采取的位置跟踪措施主要可分为两大类。因为,用于模拟病毒传播、以及封闭措施总体有效性的位置数据,主要也有以下两类:

  • 一类是由电子通讯服务供应商(例如流动电讯营办商)在提供服务过程中所收集到的位置数据;

  • 另一类,是信息社会服务提供者通过应用程序收集到的位置数据,因为这些应用程序需要使用这些数据(例如,导航、交通服务等数据)才能发挥功能。

  这两大类数据的共同之处在于,它们都是通信数据或者元数据;也就是说,它们并不是通信的实际内容,而是以通信为基础而产生的数据。

  此外,相关部门所采取的这些措施,最终将会成为一种地毯式的办法。也就是说,这些举措将不加区别地收集所有人的数据。政府部门还会声称,这些举措不能只限于在绝对必要的范围里使用,理由是它们无法预先确定哪些人员需要安装这些应用程序、也无法预知哪些人会感染新冠肺炎。

  第八条

When determining whether an interference with Article 8 of the European Convention on Human Rights - the right to privacy - was justified in a democratic society, the European Court of Human Rights will examine whether the interference was necessary and proportionate to the aims pursued. This involves a balancing exercise between competing interests (Z v. Finland). In that regard, “national authorities enjoy a margin of appreciation, the scope of which will depend not only on the nature of the legitimate aim pursued but also on the particular nature of the interference involved” (Leander v. Sweden).

  如果一项举措违背了《欧洲人权公约》第8条关于隐私权之规定的相关精神,则在确定该举措是否应当在一个民主社会中付诸实行时,欧洲人权法院将审查这一举措是否出于必要、是否符合其所要达到的目标。这就需要在相互冲突的利益或者目标之间进行权衡(如:Z诉芬兰案)。在这方面,“政府当局享有一定的斟酌权限,其权限之大小不仅取决于其所欲实现的合法目标的性质,而且还取决于其所采取的具体举措的性质。”(如:利安得诉瑞典案)。

  在乌赞诉德国案中,欧洲人权法院已经指出,政府部门有系统地收集、储存、一般性地处理申诉人的全球定位系统数据时,会对申诉人的私人生活构成干涉。在元数据方面,比如在“老大哥观察”和其他组织诉英国案中,斯特拉斯堡法院的裁定是:“获取相关通信数据不一定比获取通信内容更不具有侵犯性”。此外,在数据被大量获取的情况下,该法案强调指出:

  “这样一来,入侵的程度就会更加严重;因为,即将出现的跟踪模式可以通过社交网络的映射、位置跟踪、互联网浏览跟踪、交流模式的映射等手段,以及对该人员与他人互动的观察,呈现出该人员的亲密画面。”

  因此,这些位置跟踪举措对隐私权构成了严重的侵犯。在一个民主社会中,是否有充足的理由证明这些位置跟踪举措确实是必要的?这个问题一直存在。

  在审查大规模采取跟踪措施是否必要时,法院对一般性或者不加区分的跟踪举措施一直以来都是持反对的态度,因为这些举措无法达到法院的相关要求,也就是没有充足的理由证明其为“民主社会之必要举措”。值得强调指出的是,在早期的关于监视措施的案例法中,最高法院曾提出,应该提高对此类监视举措的审查标准,即此类举措必须是出于绝对的必要性、而不仅仅只是具备了必要性而已。在克拉斯诉和其他人诉德国一案中,法院强调指出,秘密监视权“只有在出于保卫民主制度的绝对必要性的情况下,才能够被《公约》所接受。”

  在Szabo和Vissy 诉匈牙利案中,法院指出,考虑到“尖端监视技术有可能被政府用来侵犯公民的隐私”,因此,只有在出于一种整体性考虑、对于保卫民主制度是绝对必要的情况下,秘密监视措施才可以被认为是符合《公约》的精神。另外,如果该举措只是出于一种特殊的考虑,牵涉到在一个单独的行动中去获得重要的情报,那么,则该举措更是要在绝对必要的情况下能被《公约》所允许。法院认为,任何不符合这些标准的秘密监视措施,都很可能被当局滥用,因为当局手中掌握着强大的技术。

  不加区分的位置跟踪是否绝对必要、完全正当?

  根据这一法理,各国政府应当说明,为什么这些举措对应对疫情大流行来说是绝对必要的。

  现在,几乎没有科学证据表明,不加选择地跟踪位置是应对疫情大流行的有效手段。不过,大家都一致同意的一点是,要想让位置跟踪这一举措发挥作用,就必须对绝大多数人(如果不是全部人的话)的位置都进行跟踪。然而,考虑到现实条件,这是不可能办到的。虽然手机的数量在增加,但并不是每个人都拥有手机;而且,即使每个人都拥有手机,也没有办法确保他们不管去哪里都会带上手机。这意味着,如果挑出某些区域的人群或者某一特定人群、不对其位置进行跟踪,那么,位置跟踪这一举措就会成为无效的手段。

  不过,就算我们假定这一举措是有效的,各国政府也必须证明,如果他们采取了比位置跟踪侵犯性更小的举措,将无法实现同样的目标。就距离识别而言,蓝牙可以说是一种更为精确的技术——这里所说的距离识别,是指使用指定的应用程序来识别某手机与其他手机之间的距离。可以说,蓝牙也是一种侵犯性最小的跟踪形式,因为蓝牙是使用应用程序来识别一部手机相对于另一部手机的距离、而不是手机主人的实际位置(比如GPS或者发射塔数据)。在这种情况下,蓝牙其实也就是一种交互式跟踪工具。

  不过,这并不意味着这些举措不会像位置跟踪一样不加区别地跟踪人们的位置(因为只有跟踪人们的位置才能确保其实效)。但是,这些举措对个人隐私所带来的侵犯,至少程度会较小一些。比如,在乌赞诉德国案中,法院公平地处理了这样一个问题:“其他调查手段,如果它们的侵犯性比当局通过全球定位系统对申诉人进行监视的侵犯性更小,是实效是否会更低一些。”

  因此,任何对手机进行的地毯式的位置跟踪措施,都可能无法达到《公约》中规定的绝对必要这一标准。如前所述,法院对不加区分的监视措施持相当反对的态度,特别是在这些措施没有附加一系列强有力的保障条款的情况下,更是反对。而且,即便当局出台了这些保障措施,也并不意味着持续而系统的位置跟踪,对个人隐私所造成的严重侵犯可以被抵消。在S和Marper案中,大分庭认为,收集和保存守法公民的DNA和指纹,违反了《公约》第8条的精神。大会庭“对英格兰和威尔士保留权的笼统性和不加区分的性质,尤其感到震惊”。最后,大分庭的结论是,英格兰和威尔士不认为有必要“考虑申诉人对某些特定保障措施不够充分的批评”。

  结论

  欧洲理事会最近指出,获取和处理个人数据的新技术,有可能遏制新冠肺炎疫情的大面积传播。

  与此同时,欧洲理事会还指出,必须正视当局利用现代技术侵犯公民隐私的可能性,同时要确保尊重私人生活的原则不被政府当局所违背。根据数据保护原则,我们始终应当在保护个人隐私的高标准和维护公共利益(包括公共卫生)之间取得平衡。

  《公约》允许在有限的时间内、在适当的保障措施(例如匿名)、以及有效的监督框架下,在一般的数据保护规则之外特事特办,目的是确保当局以合法而负责任的方式收集、分析、储存和分享这些数据。另外,只有以下这种情况下,才能对个人数据进行大规模的处理:有足够的科学证据令人信服地表明,采用人工智能手段对个人数据进行大规模的处理,比起采用其他侵入性较低的解决方案,能够带来更大的公共健康的好处。
总之,所有此类措施都必须附加上可行的数据保护保障措施;必须是出于绝对的必要性;必须是适当的、有时限的;必须是服务于正当的公共卫生目标。

  考虑到这些技术手段所带来的风险,各国政府必须证明为什么使用这些技术手段能够有效遏制新冠肺炎疫情的传播;证明采用这些手段是有充分理由的。而且,一旦疫情结束,还要向公众说明:在疫情期间,除了采用这些手段,别无其他具备更小侵犯性的解决方案可供使用。除非各国能证明这一点,否则,它们就不应当采用这些技术手段。而且,那些已经在采用这些手段的地方,也应当立即停止使用这些手段。

  “事实上,所有这些问题的根源,是当局要人们在隐私和健康之间做出二选一的选择。不过,这实际上是一个伪选择题,因为我们可以、而且也应该同时享有隐私和健康。”(Harari, Y. N.,《新冠肺炎疫情期间的世界》,金融时报,2020年3月22日)

  来源:

  联合国:新冠肺炎疫情和人权——我们同舟共济(United Nations, COVID-19 and Human Rights We are all in this together), https://www.un.org/victimsofterrorism/sites/www.un.org.victimsofterrorism/files/un_-_human_rights_and_covid_april_2020.pdf

  欧洲理事会:在2019冠状病毒病卫生危机框架下尊重民主、法治和人权(Council of Europe, Respecting democracy, rule of law and human rights  in the framework of the COVID-19 sanitary crisis)
(https://www.coe.int/en/web/portal/-/coronavirus-guidance-to-governments-on-respecting-human-rights-democracy-and-the-rule-of-law)

Siatisa/Kouvakas:新冠肺炎疫情期间不加选择的位置跟踪(第一部分):在民主社会中有必要吗?(Siatisa/Kouvakas, Indiscriminate Covid-19 location tracking (Part I): Necessary in a democratic society?), https://strasbourgobservers.com/2020/05/04/indiscriminate-covid-19-location-tracking-part-i-necessary-in-a-democratic-society/

  欧洲数据保护委员会(European Data Protection Board), https://edpb.europa.eu/our-work-tools/our-documents/usmernenia/guidelines-042020-use-location-data-and-contact-tracing_de

  麦格雷戈:联系人追踪应用和人权(McGregor, Contact-tracing Apps and Human Rights),
https://www.ejiltalk.org/contact-tracing-apps-and-human-rights/


The European Convention on Human Rights and COVID-19:Could indiscriminate location tracking be justified?

Dr. Dr. Elisabeth Steiner

Please allow me to explore within the next ten minutes whether the technological measures implemented by authorities in light of the global pandemic are necessary to safeguard people and whether especially indiscriminate location tracking could be justified under the European Convention on Human Rights.

Governments and private actors are turning toward the use of data driven solutions as part of the response to the COVID-19 pandemic, raising numerous privacy concerns. The potential for abuse is high as what is justified during an emergency now could become normalized once the crisis has passed. What is clear is that without adequate safeguards, these powerful technologies may cause discrimination, be intrusive and infringe on privacy, or may be deployed against people or groups for purposes going far beyond the pandemic response.

Location Tracking

Current location tracking measures fall within two broad categories. There are two principal sources of location data available for modelling the spread of the virus and the overall effectiveness of confinement measures:

• location data collected by electronic communication service providers (such as mobile telecommunication operators) in the course of the provision of their service ; and

• location data collected by information society service providers’ applications whose functionality requires the use of such data (e.g., navigation, transportation services, etc.).

What all these types of data have in common is that they constitute communications data or metadata, namely not actual content of communications, but data often surrounding a communication.

Moreover, such measures taken will ultimately be of a blanket nature – meaning that they will have to collect the data of everyone indiscriminately. Governments will claim they cannot be limited to what is strictly necessary because the authorities are not in a position to pre-emptively identify the individuals that need to install the app or the individuals that will consequently get infected.

Article 8

When determining whether an interference with Article 8 of the European Convention on Human Rights - the right to privacy - was justified in a democratic society, the European Court of Human Rights will examine whether the interference was necessary and proportionate to the aims pursued. This involves a balancing exercise between competing interests (Z v. Finland). In that regard, “national authorities enjoy a margin of appreciation, the scope of which will depend not only on the nature of the legitimate aim pursued but also on the particular nature of the interference involved” (Leander v. Sweden).

In Uzun v. Germany, the Court had already noted that the systematic collection, storing and, in general processing, of the applicant’s GPS data amounted to an interference with his private life. More widely on metadata, in Big Brother Watch and Others v. UK, which has been referred to the Grand Chamber, the Strasbourg Court was not persuaded that “the acquisition of related communications data is necessarily less intrusive than the acquisition of content”. Additionally, with reference to their bulk acquisition, it underlined that:

the degree of intrusion is magnified, since the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.

The location tracking measures as such constitute a serious interference with the right to privacy. The question remains whether they could be justified as necessary in a democratic society.

When examining the necessity of bulk surveillance measures, the Court has been quite critical of measures that are of a blanket or indiscriminate nature, due to their inability to adhere to the Court’s “necessary in a democratic society” requirements. It is worth highlighting that already in its early case-law on surveillance measures, the Court has favoured a higher standard of review of surveillance legislation, namely strict necessity and not just necessity.

In Klass and Others v. Germany, it underlined that secret surveillance powers “are tolerable under the Convention only in so far as strictly necessary for safeguarding the democratic institutions”

In Szabó and Vissy v. Hungary, the Court indicated that, given “the potential of cutting-edge surveillance technologies to invade citizens’ privacy,”:

A measure of secret surveillance can be found as being in compliance with the Convention only if it is strictly necessary, as a general consideration, for the safeguarding [of] democratic institutions and, moreover, if it is strictly necessary, as a particular consideration, for the obtaining of vital intelligence in an individual operation. In the Court’s view, any measure of secret surveillance which does not correspond to these criteria will be prone to abuse by the authorities with formidable technologies at their disposal.

Could indiscriminate location tracking be strictly necessary and justified?

Based on this jurisprudence governments will have to justify why these measures are strictly necessary and relevant to deal with the pandemic.

There is little scientific evidence to suggest that indiscriminate location tracking will be an effective means to deal with the pandemic. One aspect everyone agrees though is that in order to stand even a chance to be effective, it will have to be applied to the vast majority of, if not the whole, population. However, this is materially not possible. While the number of mobile phones is increasing, not everyone owns a mobile phone and even if they do there is no way to ensure that they will carry it around everywhere they go. This means that if certain regions or groups of the population were to be excluded, location tracking would accordingly prove to be practically ineffective.

However, even if we assume that it is effective, states will have to prove that they cannot achieve the same goal by less intrusive measures available. Bluetooth is arguably one of the more accurate technologies in terms of proximity identification, in this instance, proximity to other phones using a specified app. Arguably, it is also the least intrusive form of tracking given that it is based on proximity to other phones using the app rather than actual location e.g. GPS or cell tower data. In this context, it can be understood more so as an interaction tracking tool.

This does not mean that these measures will not equally have to be of an indiscriminate nature in order to be effective but will at least amount to a smaller degree of intrusion with individuals’ privacy. In Uzun v. Germany, for example, the Court equally dealt with the question whether “other methods of investigation, which were less intrusive than the applicant’s surveillance by GPS, had proved to be less effective”.

It is therefore likely that any blanket mobile phone location tracking measures will fail to adhere to the Convention’s standards of strict necessity. As mentioned above, the Court has been quite critical against indiscriminate surveillance measures, especially when the latter fail to incorporate a series of robust safeguards. Provided that these safeguards existed, it would still not ultimately mean that the severity of the interference posed by constant and systematic location tracking could ever be counterbalanced. In S and Marper, the Grand Chamber held that the collection and retention of DNA and fingerprints of innocent people was contrary to Article 8. In particular, the Grand Chamber was “struck by the blanket and indiscriminate nature of the power of retention in England and Wales” It concluded that there was no need “to consider the applicants’ criticism regarding the adequacy of certain particular safeguards”.

Conclusion

The Council of Europe recently noted that the new technologies of access to – and the processing of – personal data have the potential to contain and remedy the pandemic.

At the same time the CoE noted that, the intrusive potential of modern technologies must not be left unchecked and unbalanced against the need for respect for private life. Data protection principles have always allowed a balancing of high protective standards and public interests, including public health. The Convention allows for exceptions to ordinary data-protection rules, for a limited period of time and with appropriate safeguards (eg anonymisation) and an effective oversight framework to make sure that these data are collected, analysed, stored and shared in legitimate and responsible ways. Large-scale processing of personal data by means of artificial intelligence should only be performed when the scientific evidence convincingly shows that the potential public health benefits override the benefits of alternative, less intrusive solutions.

In summary, all measures must incorporate meaningful data protection safeguards, be strictly necessary, and proportionate, time-bound and justified by legitimate public health objectives.

Given the risks that these technologies impose, states must demonstrate why using these technologies is relevant and justied in meeting the goal of preventing the spread of Covid-19, particularly once the lockdown is lifted, using scientic evidence and show that no less rights-invasive solutions are available. Unless they can make this case, these technologies should not be introduced and where they have already been rolled out, they should be withdrawn.

“Asking people to choose between privacy and health is, in fact, the very root of the problem. Because this is a false choice. We can and should enjoy both privacy and health.” (Harari, Y. N., The world after coronavirus, Financial Times, 22 March 2020)

Sources:

United Nations, COVID-19 and Human Rights We are all in this together, https://www.un.org/victimsofterrorism/sites/www.un.org.victimsofterrorism/files/un_-_human_rights_and_covid_april_2020.pdf

Council of Europe, Respecting democracy, rule of law and human rights  in the framework of the COVID-19 sanitary crisis (https://www.coe.int/en/web/portal/-/coronavirus-guidance-to-governments-on-respecting-human-rights-democracy-and-the-rule-of-law)

Siatisa/Kouvakas, Indiscriminate Covid-19 location tracking (Part I): Necessary in a democratic society?, https://strasbourgobservers.com/2020/05/04/indiscriminate-covid-19-location-tracking-part-i-necessary-in-a-democratic-society/

European Data Protection Board, https://edpb.europa.eu/our-work-tools/our-documents/usmernenia/guidelines-042020-use-location-data-and-contact-tracing_de
McGregor, Contact-tracing Apps and Human Rights, https://www.ejiltalk.org/contact-tracing-apps-and-human-rights/


分享:
收藏 复制 打印