Gecić Law office has already written about how “COVID-19 couldn’t care less about GDPR”. The recent measures adopted in Montenegro once again confirmed what we have written before.
On March 21, the National Coordination Body for Infectious Diseases of Montenegro adopted the Decision on the publication of names and addresses of individuals who were assigned measures of self-isolation, because due to the previous failure to respect the obligation of self-isolation by some of them. The Agency for Personal Data Protection and Free Access to Information of Montenegro approved the Decision, stating that it is not contrary to the Personal Data Protection Act.
Today, because of this, anyone with internet access can visit the website of the Government of Montenegro and easily find out the addresses of citizens who were assigned measures of self’-isolation – diligently classified by municipalities for easier and quicker access.
The Agency’s Opinion, by which it consented to the Decision of the National Infectious Diseases Coordination Body, referred to provisions of the Personal Data Protection Act, which stipulate that the processing of personal data, inter alia, implies their publication and processing may be conducted without consent if it is necessary for the performance of tasks in public interest or for exercise of public authority. However, the question that can be asked before the Montenegrin courts, and ultimately before the European Court of Human Rights, after the state of emergency ends, is if such an imprecise a norm is enough to allow publication of addresses of Montenegrin citizens.
Furthermore, for some reason, the Personal Data Protection Agency refers to a provision that states that processing (and therefore disclosure) of personal data is permitted without consent of the data subject when it is in the interest of protection of life and other vital interests of the person whose personal data it is when they are unable to consent. This provision is absolutely inapplicable as the legal basis of the Decision to publish personal data of persons in self-isolation. Firstly, this disclosure of personal data was not made in the interest of these persons but in the interest of other citizens of Montenegro. Secondly, the condition for publishing, in this case, is that the data subjects were unable to consent. Citizens whose addresses and names are published on the Montenegrin Government’s website were, however, able to give their consent in this case.
Personal Data Protection Agency refers to a provision (among others) of the Personal Data Protection Act, which states that personal data can be processed when that is necessary for detection, prevention and diagnosis of diseases and treatment of persons, as well as for management of health services if the information is processed by a health-care professional or another person who has a duty of confidentiality. The stated provision in the Agency’s Opinion, by which it gave consent to the Decision, was quoted correctly, but it is unclear why it was quoted at all. It needs to be stressed that this provision is not applicable to these specific circumstances. In relation to the published personal data, not only is there the confidentiality obligation missing, but the purpose of their processing was precisely to make it available to the widest possible public.
The Constitution of Montenegro prescribes the possibility of temporary restriction of rights and freedoms during a state of emergency to a necessary extent. Such restrictive measures, however, can last just as long as the state of emergency. The measures adopted by the Montenegrin institutions in this case, by their nature, cannot be temporary. A piece of information once published and found out by third parties remains forever in their possession and is liable to abuse.
Thus, according to the national regulation, it cannot be concluded that the restriction of the right to protection of personal data is justified in this case.
European Convention on Human Rights and the European Court of the Human Rights Caselaw – The Right to Respect for Private and Family Life
As is typical for a stipulation of provisions of the European Convention, it, by itself, allows the possibility of restriction of the right to respect for one’s private and family life by public authorities when that restriction is in accordance with the law and is necessary for the protection of health (inter alia) in a democratic society.
Legality requirement
As explained above, it is questionable whether the national legal provisions invoked by the Montenegrin Agency, in this case, are at all sufficient and applicable. However, even if they are, the principle of legality, in the sense of the caselaw of the European Court of Human Rights is not satisfied by mere reference to national laws. The Court has repeatedly affirmed that any interference with an individual’s right to respect for private and family life and correspondence, by a public authority, must be in accordance with the law. This expression does not only necessitate compliance with domestic laws but also relates to the quality of that law, requiring it to be compatible with the rule of law (caselaw Halford v. the United Kingdom, paragraph 49).
In order to meet the legality requirements for a restriction of the right to respect for private and family life, the national act which serves as a base for such a restriction must be clear and precise. Domestic law must indicate, with reasonable clarity, the scope and manner of exercise of the relevant discretion conferred on public authorities so as to ensure a minimum degree of individual’s protection to which they are entitled under the rule of law in a democratic society. (caselaw Piechowicz v. Poland, paragraph 212)
Therefore, the key question is whether the provision of the Montenegrin Law on Personal Data Protection, which implies that disclosure of personal data without consent is permitted when necessary for the purpose of performing activities of public interest or in the exercise of public authority, is sufficiently clear. Does that provision indicate the scope and manner of exercising discretionary power to ensure a minimum degree of protection in accordance with the rule of law?
The proportionality principle
Public authorities have the sovereign right to assess when limiting the right to respect for private and family life is necessary in a democratic society. Such a necessity, according to the Court in Strasbourg, actually implies that there is a “pressing social need”. However, the decisions made by public authorities, regardless of the urgent social need, are a valid subject of examination for the European Court of Human Rights. As the Court states, measures of restriction on this particular right cannot be considered necessary in a democratic society unless they are proportionate to the legitimate aim which is pursued (caselaw Dudgeon v. The United Kingdom, paragraph 51-53 and Z v. Finland, paragraph 94).
Thus, for this right to be restricted, mere legitimacy of the aim is not enough: restrictive measures need to be proportionate to that legitimate aim. Disclosure of an address, as a piece of personal information, is not only a violation of the right to privacy but can potentially seriously endanger security and personal integrity of the person whose address is published. At the same time, given the large number of citizens whose information was published in this case, the possibility for abuse is much larger. Information published in this manner can be permanently preserved by third parties and the possibility that it will be misused will remain in place after the state of emergency is abolished.
What does this practically imply for the citizens of Montenegro?
Montenegro is a member of the Council of Europe and a signatory to the European Convention on Human Rights (as one of the successors to the State Union of Serbia and Montenegro). Thereby, the caselaw of the Strasbourg Court (as precedents) is a source of law for Montenegro as well. Citizens whose addresses and personal names are publicly disclosed after the state of emergency is abolished may invoke these precedents even before Montenegro’s national institutions because they are the source of their rights. Ultimately, the Strasbourg precedents may also be cited by Montenegrin citizens before the European Court itself.
The open questions are: Is this specific situation adequate to be covered at all under the provisions used as justification by the Montenegrin institutions? Are these provisions clear enough? Even if they are applicable in this situation, are they in accordance with the principles of the rule of law? Most importantly, is such a measure by the Montenegrin institutions proportionate to a legitimate interest, especially given that the address is a piece of personal data, publication of which could seriously jeopardize citizens’ personal and property rights? How can such a measure be considered temporary, and can the memory of those who found out the addresses of their fellow citizens be erased?
For more information, please contact us via covid19@geciclaw.com
