After a request from the European Commission, France, through its historic operator Orange, is about to transfer anonymized telecoms data from the French to observe the evolution of the pandemic.
We have been wondering for a few days about the collection and possible exploitation of our mobile data in France, both from a technical and legal point of view, and about the model of what is done at foreign. According to the authorities, there are several advantages to this harvest: the possibility of mapping the evolution of the epidemic with population movements, or even verifying compliance with containment measures. And while France seemed not to want to copy its strategy on that of its neighbors, the more the days pass and the more the indices point to an inevitable use of these.
Discussions between the European Commission and operators
First there’s an interview with Figaro by Stéphane Richard, the boss of Orange, in which he indicated working with Inserm on the possibility of collecting data in order to “Model the spread of the epidemic” or from “Measure the effectiveness of containment measures”. Thierry Breton, European Commissioner for the Internal Market, quickly put himself on the side of the boss of Orange, supporting the use of this anonymized and aggregated data.
Also on Tuesday March 24, the Elysée Palace announced the creation of a new Research and Expert Analysis Committee (Care) supposed to reflect on “The advisability of implementing a digital strategy for identifying people who have been in contact with infected people”. Newly formed, the committee has not yet communicated on all of its objectives and their implementation.
We learned today (Thursday March 26) that the transfer of anonymized data “Planned for a few days”. The AFP also specifies that “Thierry Breton met on Monday with the bosses of several large European operators, including Orange, Telecom Italia, Telefonica, Deutsche Telekom and Vodafone, who said they were ready to share this metadata”.
Anonymous data and an emergency
In an article published on Tuesday, March 24, we raised in particular with the deputy Eric Bothorel and La Quadrature du Net doubts concerning the relevance of the use of geolocation data to follow the evolution of the epidemic, since the tests are not widespread in France. A mapping of the disease that would appear more relevant at the end of the crisis, if these tests became common to avoid the resurgence of the disease.
As for the so-called anonymized data, it leaves a certain number of personalities pensive, starting with the Dutch MEP Sophie in’t Veld, who asked Thierry Breton “clarification”, explaining that anonymizing data is not such a simple practice.
Fighting the #coronavirus with technology: sure! But always with protection of our privacy. Read my letter to @ThierryBreton 👇 about @EU_Commission’S plans to call on telecoms to hand over data from people’s mobile phones in order to track & trace how the virus is spreading. pic.twitter.com/55kZo9bMhN
– Sophie in ‘t Veld (@SophieintVeld) March 25, 2020
Joined by Digital, the Cnil recalls certain recommendations. “Several scenarios would be possible, and the impacts on the fundamental rights and freedoms of people would depend on the type of processing performed on the location data, she explains. The current legal framework, in particular the GDPR and the ePrivacy Directive (applicable to the collection of location data in the context of electronic communications), allows, under certain conditions, to process such data, in particular anonymously (sufficiently aggregated) or with the consent of the people. ”
The Commission recalls, however, that “This same legal framework allows states to go further and to derogate, by law, from this requirement of anonymization or consent, under certain conditions”. In cases where individual follow-up is necessary, the CNIL tells us that “This monitoring should be based on a voluntary approach by the person concerned”, which is the case for some applications of contact tracing existing. Also, it indicates that “If France wished to provide more detailed non-anonymous monitoring procedures, if necessary without the prior consent of all the persons concerned, legislative intervention would be necessary”. These derogating legislative measures should then be justified and proportionate, for example in terms of duration and scope.
What are the authorities planning to do?
In a speech to the National Assembly, Olivier Véran, the Minister of Health, responded to MP Danièle Obono (LFI) who questioned the monitoring of fellow citizens. According to the minister, there is no question of moving towards a Korean style, where the authorities can track each individual. “Korea has equipped all the telephones with what is necessary to warn those around them when someone is sick”, can we hear him say. “Are you ready to have this debate within the framework of this National Assembly? I’m not convinced, and neither is I personally. ”
At the moment, no one in government seems to be taking a clear stand on these issues. An amendment tabled by two LR deputies proposing “Allow managers of vital infrastructure (water, sanitation, gas, telecommunications) to access health and geolocation data for a period of six months”, was rejected as part of the state of health emergency bill.
In any case, the Cnil invites the public authorities to “Make sure to objectively and precisely define the objectives pursued by any device for locating people” and “To respect the fundamental principles laid down by the Data Protection Act and European texts”.