The National Coordination Body for the Suppression of Infectious Disease, founded by the Government of Montenegro, decided on Saturday evening to start digitally publishing a list of names, surnames and addresses of persons who were ordered into obligatory 14-day self-isolation due to COVID-19 risk. Thus far, the private information of 1022 people has been published by the government agency.

The Human Rights Action (HRA) announced yesterday it considers this act illegal, unconstitutional, and against the international standards of the right to privacy. It called upon the Government to end this practice.

HRA is worried about the stigmatization of people and children, whose identities and addresses had been revealed in such a way by the Government, which may ultimately lead to violence. HRA especially warns that it may be expected that people, who feel the symptoms of the virus, will not seek medical help promptly or at all, fearing that their identity may also be disclosed in the same way.

We understand the legitimate aim of protection of health and lives that the Government’s National Coordination Body had in mind, but nevertheless believe that the measure enforced in a situation where a state of emergency had not been declared by the parliament, does not have legal basis and represents a dangerous precedent. The supervision of persons in self-isolation needed to be secured in another manner, without expecting from the public to do police work.

The Law on Personal Data Protection clearly prescribes in Article 13, paragraph 3 that any data pertaining to the “detection, prevention, or diagnosis of a subject’s illness or the administration of medical treatment to them”, can only be processed “if the processing is conducted by a health worker or other professional under duty of confidentiality”. From this, it is clear that these data should have remained confidential, i.e. that the information should not have been made publicly available, as is still being done. Although the Agency for Personal Data Protection and the Free Access to Information, which approved the Government’s decision, referred to this provision of the Law in its opinion, it did not explain in any way why it interpreted the provision as an argument in favor of the measure.

The Agency also referred to the Law on Health Care, and its Article 6 which entitles citizens to be informed about the protection of their health in the event of epidemics and other major disasters and accidents. However, the Agency ignored Article 11 of the same Law, which prescribes that in exercising health care, each citizen has the right to equality in overall treatment when implementing health care, as well as the right to privacy and confidentiality of all data regarding their health (paragraph 1 line 7).

In this context, the European Data Protection Board in its Statement on the processing of personal data in the context of the COVID-19 outbreak, adopted on 19 March 2020, highlighted the following: ,,… data subjects should receive transparent information on the processing activities that are being carried out and their main features, including the retention period for collected data and the purposes of the processing. The information provided should be easily accessible and provided in clear and plain language. It is important to adopt adequate security measures and confidentiality policies ensuring that personal data are not disclosed to unauthorised parties.’’ (European Data Protection Board ,,Statement on the processing of personal data in the context of the COVID-19 outbreak’’, available at: https://edpb.europa.eu/sites/edpb/files/files/news/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf).

Also, the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data stipulates that personal data relating to health belong to a special category of data that can only be processed if their proper protection is ensured.

HRA recalls that Article 24 para. 1 of the Constitution of Montenegro stipulates that “guaranteed human rights and freedoms may be limited only by the law, within the scope permitted by the Constitution and to such an extent which is necessary to meet the purpose for which the limitation is allowed, in an open and democratic society.” We remind that in the provisions protecting the right to privacy and guaranteeing the protection of personal data (Art.  28, para. 2, Art.  40, Art.  43) do not prescribe any basis for limitation of these rights.  They may be restricted only in times of emergency, but only to the necessary extent (Article 25, paragraph 1 of the Constitution of Montenegro).

Article 8 of the European Convention on Human Rights outlines the right to protection of privacy and family life.  This right may be restricted for the protection of health, but only to the extent necessary in a democratic society.

The European Court of Human Rights held that “the right to privacy applies especially when it comes to protecting the confidentiality of data relating to viruses, since disclosure of such information can have detrimental effects on the private and family life of the individual and his or her social and professional situations, including exposure to stigma and possible exclusion from the community.” The Court emphasized, “that without providing privacy protection, those in need of medical attention, could be deterred from disclosing the personal and intimate information needed to receive appropriate treatment and even detere from seeking such assistance.  In this way, they can endanger their health and, in the case of communicable diseases, the health of the community.” (Z v. Finland, application no.  22009/93, 1997, and Mockute v. Lithuania, application no.  66490/09, 2018).