Ericson Scorsim. Advogado e Consultor em Direito da Comunicação. Doutor em Direito pela USP.

A União Europeia aprovou a regulamentação para a utilização da tecnologia para a coleta de dados para o combate ao coronavírus, especialmente para a utilização de dados de modo sem a identificação dos usuários dos dispositivos.  O texto é denominado Comission Recomemendation of 8.4.2020 on a common Union toolbox for the use of technology and data to combate and exit from the COVID-19 crisis, in particular concerning mobile applications and the use of anonymised mobility data. E, também, há o Statement on the processing of personal data in the context of the COVID-19 outbreak, adopted on 19 march 2020, do European Data Protection Board (EDPB) Segundo a declaração oficial da União Européia, é necessária uma estratégia comum para os países europeus para enfrentar o tema.  As funções dos aplicativos de coleta de dados servem: i) informação e aconselhamento dos cidadãos e facilitação das organizações médicas em relação ao monitoramento de pessoas com sintomas de coronavírus, frequentemente, a partir de um auto questionário; ii) advertência às pessoas  que estiveram próximas de uma pessoa infectada para o fim de interromper a cadeia de fluxo de infecções e prevenir o ressurgimento das infecções em fase de reabertura dos estabelecimentos; iii) monitoramento e cumprimento da quarente das pessoas infectadas, possivelmente combinando-se com medidas de assessoramento em suas condições de saúde durante o período de quarentena. Segundo a recomendação: “Certain companies including telecommunications providers and major technology platforms have publhished or made available to public authorities anomysed and aggregated location data. Such data is necessary for research to combate the virus, modeling to understand how the virus will spread and modelling of the economic effects of the crisis. In particular, the data will help to understand and model the spatial dynamics of the epidemic and to assess the impact of social distancing measures (travel limitations, non-essential activities closures, total lock-down etc) on mobility. This is essential firstly to contain the effects of the virus and assess the needs notably in termos of Persona Protective Equipment and Intensive Care Units and, second, to support the exit strategy with data-driven models that indicate the potential effects of the relaxation of the social distancing measure”. A recomendação sugere ainda o respeito das políticas públicas no setor de saúde conforme o princípio da minimização na coleta de dados. Segundo o texto: “In accordance with the principle of data minimization, public health authorities and research institutions should process personal data only where adequate, relevant and limited to what is necessary, and shoul apply appropriate safeguardars such as pseudonymisation, aggregation, encryption and decentralization”. Além disto, as medidas de captura de dados de mobilidade devem respeitar regras de segurança cibernética e a segurança dos dados: “effective cybersecurity and data security measures are essential to protect the availability, authenticity integrity and confidentiality of data”.  Na definição das estratégias de saída da crise no setor da saúde pública é necessário: “the appropriate use of anonymous and aggregated mobility data for modelling to understand how the virus will spread and modelling of the economic effects of the crise”. Este é um dos pontos-chave da estratégia de saída da crise, isto é, a utilização dos dados anônimos sobre mobilidade na definição da modelagem do mecanismo para a compreensão do fluxo de disseminação do vírus nas cidades e a modelagem dos efeitos econômicos da crise. Ademais, a recomendação dispõe sobre as salvaguardas para proteger a anonimização dos dados: “safeguardas to be put in place to prevent de-anonymisation and avoid re-identifications of individuals, includinng guarantees of adequate levels of data and IT security, and assessment of re-identification risks when correlating the anonymise data with other data”. E, ainda, em relacão aos dados de geolocalização, a declaração do European Data Protection Board dispõe: “whith regard the processing of telecom data, such as location data, national laws implementing the ePrivacy Directive must also be respected. In principle, location data can only be used by the operator when made anonymous or with the consent of individuals. However, Art.15 of the ePrivacy Directive enables Member States to introduce legislative measures to safeguard public security. Such exceptional legislation is only possible if it constitutes a necessary, appropriate and proportionate measure within a democratic society. These measures must be in accordance with the Charter of Fundamental Rights and the European Convention for the Protection of Human Rights and Fundamental Freedoms. Moreover, it is subject to the judicial controle of the European Court of Justice and the European Court of Human Rights. In case of an emergency situation, it should also be strictyly limited to the duration of the emergency at hand”. Como se nota do texto, declaração do European Data Protection Board as medidas legislativas de proteção à saúde pública, em relação à coleta de dados por aplicativos, devem respeitar o princípio da proporcionalidade, devem ser necessárias, apropriadas e proporcionais ao regime de direitos humanos. Além disto, sobre a questão se os governos podem utilizar dados de telefones celulares para monitorar, conter ou mitigar a disseminação do coronavírus. Segue o texto do European Data Protection Board: “In some member States, governments envisage using mobile location data as a possible way monitor, contain or mitigate the spread of COVID-19. This would imply, for instance, the possibility to geolocate individuals or to send public health messages to individuals in a specific area by phone or text message. Public authorities should first seek to process location data in an anomymous way (i.e. processing data aggreated in a way that individuals cannot be re-identified), which could enable generating reports on the concentration of mobile devices at a certain location (‘cartography’). Por fim, a declaração oficial do European Data Protection Board  menciona sobre a necessidade de soluções não invasivas à privacidade dos usuários dos serviços de telecomunicações: “The proportionality principle also applies. The least intrusive soluctions should always be preferred, taking into account the specific purpose to be achieved. Invasive measures, such as the ‘tracking’ of individuals (i.e. processing of historical non-anonymised location data), could be considered proportional under exceptional circumstances and depending on the concret modalities of the processing. However, it should be subject to enhanced scrutiny and safeguards to ensure the respect of data protection principles (proportionality of the measure in terms of duration and scope, limited data retention and purpose limitation”. E sobre as medidas em proteção à saúde em relação aos trabalhadores, a declaração oficial do European Data Protection Board  dispõe o seguinte: “Can na employer require visitors or employees to provide specific health information in the context of COVID-19? The application of the principle of proportionality and data minimisation is particularly relevant here. The employer should only requerie health information to the extent that national law allows it. Outra questão:  “Is an employer allowed to perform medical check-ups on employees? The answer relies on national laws relating to employment or health and safety. Employers should only acess and process health data if their own legal obligations requires it”. Há, também, a questão do risco de infecção de trabalhadores em relação a colega ou terceiros: “Can an employer disclose that na employeed is infected with COVID-19 to his colleagues or to externals? Employers should inform staff about COVID-19 cases and take protective measures, but should not communicate more information than necessary. In cases where it is necessary to reveal the name of the employee (s) who contracted the virus (e.g. in a preventive context) and the national law allow it, the concerned employees shall be informed in advance and their dignity and integrity shal be protected”. Por fim, a última questão: “What information processed in the context of COVID-19 can be obtained by the employers? Employers may obtain personal information to fulfil their duties and to organise the work in line with national legislation”.

Crédito de imagem: Wikipedia