Following the lead of Asian countries, an increasing number of European countries are also accessing mobile phone data in order to overcome the coronavirus pandemic. The collection and analysis of mobile phone data is now also taking place in Switzerland.
During a press conference on the topic of the coronavirus, held on the 19th of March 2020, Daniel Koch, head of the Communicable Diseases Division at the Federal Office of Public Health (FOPH), announced the FOPH’s plan to obtain and study certain mobile phone data. Indeed, the FOPH has been looking to assess whether mobile phone data could be used to verify compliance with the enacted distance regulations of the Swiss Federal Council.
As things currently stand, the Swiss Federal Council has prohibited gatherings of more than five people in public areas and, in the case of smaller gatherings, each person is obliged to keep a distance of at least two metres (Art. 7c COVID-19 Ordinance 2). A complete quarantine could soon become a reality and therefore lead to further monitoring if the current measures are not adhered to or are insufficient to limit the spread of the coronavirus.
In the meantime, the FOPH has already summoned Swisscom to inform them as soon as there are more than twenty people located in an area of one hectare at a time. This is achieved by localizing SIM cards via mobile phone antennas. According to the FOPH, the analysed localisation data is at least twenty-four hours old, thus not permitting any real-time tracing. A transmission of location data from Swisscom to the FOPH has already been taking place over the past days. A consultation of the Federal Data Protection and Information Commissioner (FDPIC) has however not yet taken place. Seite 2 von 3
2. Legal issues
2.1. What is the legal framework for the analysis of mobile phone data in an extraordinary situation in Switzerland?
The Federal Epidemics Act (EpA, SR 818.101), which applies in the current extraordinary situation, fundamentally takes precedence over the Federal Data Protection Act (FDPA, SR 235.1) as a lex specialis and grants the authorities additional options to obtain personal data. Art. 58 para. 1 EpA provides that the FOPH and the public and private institutions entrusted with tasks under this Act may process personal data, including health data, insofar as this is necessary in view of measures to protect public health.
Telecommunications service providers such as Swisscom, Sunrise and Salt are subject to the Federal Telecommunications Act (TCA, SR 784.10). In principle, they have an obligation of confidentiality with regard to customer data (Art. 43 TCA). In particular, location data may only be processed with the data subject’s (here, the customer) consent or in anonymous form (Art. 45b TCA).
2.2. How far may the Swiss authorities go in terms of analysing mobile phone data in an extraordinary situation?
In principle, there are three conceivable scenarios in which mobile phone data can be used to contain the coronavirus pandemic:
1. analysis of location data (mass data) to check whether citizens generally adhere to measures;
2. individual tracking of location data of infected persons in order to assess with whom they have had contact during a certain period of time;
3. monitoring of infected persons and providing their location data to the public in order to warn healthy citizens.
Even in times of extraordinary situations, anyone processing personal data must adhere to the principle of proportionality: Data processing must be necessary for the protection of public health in accordance with the EpA, i.e. the purpose must not be achievable by milder means. The principle of proportionality requires taking into account current developments.
Considering the actual extraordinary situation, the use of anonymised location data seems in general appropriate from a public health perspective in order to monitor and, where
possible, hinder the spread of the coronavirus in Switzerland. However, it is doubtful whether the use of non-anonymised location data would be covered by the principle of proportionality, as individual location profiles do not seem strictly necessary to determine whether citizens are complying with imposed measures.
According to the EpA, the FOPH and the public and private institutions entrusted with tasks under this Act may in particular also process health data to the extent that is necessary to identify sick persons with regard to measures to protect public health (Art. 58 para. 1 EpA). The individual tracking of infected persons and/or the provision of their health and location data to the public would likely not comply with the generally applicable principle of proportionality at the moment, as less intrusive measures such as the enactment and the verification of compliance of minimum distances are still possible and lean towards the same result.
In order to create transparency and maintain the public's trust in the Swiss authorities, the FOPH should in any case comply with the general data processing principles and, in particular, provide information on what categories of data are actually processed, for what purpose, who is granted access to the data, how long such data are stored, etc. In particular, it is important that the mobile phone data is not combined with data from different sources because this may lead to data subject reidentification and that the analysis of mobile phone data only lasts as long as this extraordinary situation exists and does not become the norm.
Given the actual extraordinary situation, the FOPH may analyse mobile phone location data to examine whether citizens generally comply with imposed public health-related measures, as long as the data is anonymised and as long as the FOPH fulfils its information obligations and adheres to the general data processing principles.
Under the current factual and legal background, it seems doubtful that the individual tracking of location data (to assess with whom the infected person has had contact during a certain period of time) as well as the monitoring of infected persons including making location and health data publicly accessible without the consent of the data subjects concerned would comply with the principle of proportionality under the rule of law.
At this stage of the pandemic, only time will tell whether more extensive measures and interferences with the personality rights of the affected individuals will become appropriate in the near future and call for a reassessment of the measures currently in place.