Privacy, personal data protection, and freedom of expression under quarantine? The Peruvian experience
Andrés Calderón, Susana Gonzáles, Alejandra Ruíz · International Data Privacy Law · 2021
In this article, the authors make a quantitative and qualitative study of all the Executive regulations issued during the State of Emergency in Peru, that may have impacted the fundamental rights of privacy, personal data protection, and freedom of expression. Peru represents an emblematic case study. It adopted one of the earliest, lengthiest and most severe lockdowns in the world, together with numerous regulations that restricted their citizens' civil liberties. Unlike other jurisdictions, the implemented measures in Peru did not focus solely on more controversial and technological activities such as mass surveillance, face recognition, and contact tracing mobile applications. Rather, massive collection and use of personal data, geolocation, and mandatory registration as a pre-requisite for mobilization during lockdown are among the most important hazards identified by this research. The research aims to illustrate some of the perils that similar countries may be facing during and after the fight against COVID-19. On 15 March 2020, Peru became the first South American country and one of the earliest Latin American nations to enter into a full lockdown due to the health emergency caused by COVID-19. The early response by the Government garnered compliments from several health institutions and the international media, which highlighted the prioritization of the health and protection of life of their citizens.1 Shortly after, the poster country for rapid coronavirus response became the paradoxical story of tragedy. Despite having one of the largest quarantines in the world (107 days), Peru soon became the world’s second highest per capita rate of new infections per day,2 its economy dropped more than 40 per cent year-on-year in April,3 and nearly half of the population of the capital city, Lima, lost their job.4 In spite of the unappealing health and economy numbers, Peru’s president, Martin Vizcarra, still got the support of the majority of the population.5 In all, 65 per cent of approval (up to July 2020)6 is a rare standard for Peruvian’s head of states, especially during their terms’ final year. The popularity of the Peruvian Government contrasted with the severity and length of the restrictions to civil rights endured during the State of Emergency. Under the Peruvian Constitution, the President—with the support of his Cabinet—can declare the State of Emergency for up to 60 days, but a new Executive Decree can extend it. During the State of Emergency, the Government can suspend or restrict the exercise of some civil rights, including, personal freedom and security, the inviolability of the home, and freedom of assembly and movement in the territory7 but other constitutional rights, such as privacy and freedom of expression, remain in full force and effect. However, in practical terms, those rights suffered severe limitations during the country’s lockdown. In this article, we propose a deeper look into those restrictions, most of them covered under the dazzling blanket of economic and health regulations. We study the case of the Peruvian Government’s fight against COVID-19 from a privacy (especially, personal data protection) and freedom of expression perspectives, by reviewing all of the high-level regulations enacted by the Executive Branch during the quarantine period. Privacy concerns are not limited to the fairly problematic schemes of mass surveillance, face recognition technologies and contact tracing mobile applications. For the first time, countries adopted parallel strategies of massive collection and processing of personal data. The same applies to regulations with effects on freedom of expression. Some of the exceptional measures approved by governments have had a direct or indirect impact on the continuity of the provision of telecommunications services and news media, the ability of people to communicate massively or in private, and on internet access. However, many of these regulations go unnoticed.8 The burden on people’s privacy also takes a toll on their ability to freely express themselves and engage in private conversations. We consider that some of these risks might be neglected by civil society and the academy even though their effects could be felt long after the health emergency has passed. This is the main reason we decided to take a holistic approach that included a thorough review of the regulations enacted by the Government during the State of Emergency that included privacy (including personal data) and freedom of expression. Our methodology consisted of reviewing and studying all of the regulations enacted by the Government: legislative decrees, emergency decrees and executive decrees issued between 15 March 2020 and 30 June 2020, when the nation-wide quarantine came to an end. After that, we classified the regulations into two large categories depending on the fundamental right that was more (positively or negatively) affected by them: privacy and freedom of expression. In “Executive regulations by numbers” section, we present a quantitative overview of the regulations by the Executive Branch, focusing on some high-level characteristics of the regulations and the impact on some of the above-mentioned rights. In “Privacy rights and personal data protection” section, we study the regulations related to personal data collection and some others with privacy implications, such as contact tracing and geolocation. “Freedom of expression and freedom of the press” section covers freedom of expression and the rules that may have affected private communications and press freedom. Finally, we present the conclusions. While our case study is focused on Peru because of the singularities of its early, prolonged and strict lockdown, numerous similarities will come to light for the keen reader as several countries, especially in Latin America, faced not only the same challenges posed by the pandemic but also the same institutional shortcomings. The emergency caught a number of Latin American governments unprepared, with very limited health resources, and dispersed and outdated information about their citizens, who already struggled with an informal economy. Massive collection of personal data and indirect constraints on freedom of expression became tolerable circumstances for a baffled population that understandably put their health ahead of other rights, without completely acknowledging the risks for the times to come. Within the scope of the study, it was found that 34 regulations from the Executive Branch were issued during the State of Emergency with an impact on the right to freedom of expression, the privacy of citizens and government transparency. The regulations included 13 Executive Decrees,9 14 Emergency Decrees,10 and 7 Legislative Decrees11 issued under the delegation of legislative powers. The study classified these regulations into two main thematic areas: Privacy and of The first included regulations with a direct or impact on the rights of privacy and protection of personal data. it covers executive regulations with on the and of personal data, and the and of personal are not limited to health information such as and for but some of them also information related to and economic of most of the were enacted with the of the of the health emergency and measures in of the people affected by the and the lockdown and by the Emergency Decree is an of the of regulations covered by this first While it is not a direct health this the of and to use and personal by other for the of the of with which be to The second regulations with direct or impact on freedom of expression, private communications their and freedom of the this regulations that with the continuity of the provision of telecommunications services and news media, the of telecommunications services or the ability of people to communicate massively or in private, and that impact on internet access. illustrate the of regulations under this we can Executive Decree which the nation-wide with the of for activities telecommunications and mass the of those two categories by the regulations issued by the Executive Branch In all, of them related to were with freedom of expression and with issued by the Executive Branch by thematic of by authors on Executive Emergency and Legislative on the as in issued by the Executive Branch by thematic of by authors on Executive Emergency and Legislative on the as in In we the executive regulations depending on or those fundamental rights posed risks for their or a of risks and of the regulations of the Executive Branch on the of risks and for freedom of expression and by authors on Executive Emergency and Legislative on the as in of the regulations of the Executive Branch on the of risks and for freedom of expression and by authors on Executive Emergency and Legislative on the as in We a the the exercise of a fundamental right by a to right as an or or the the of a or private that could that right to government or private to those On the other a a for those rights it or the exercise of the or when it the of a right without with international right more with the of and of the on the and in the on and In to illustrate the we propose the Emergency Decree that a to the of the of is not to telecommunications during the State of Emergency in Peru, not to the of against those This was as under our because it a to telecommunications services private or massive The same Emergency Decree telecommunications to the continuity of their by and their during the State of citizens were to use those services to in of of the telecommunications suffered a severe due to this Emergency Decree was classified as and a of the 34 regulations issued by the Executive Branch, 15 risks to the fundamental rights of privacy and freedom of and were 14 a of and and of all 34 regulations is in in has for people in of it is the of Our study identified that of the 34 executive regulations affected or to the as and only one for related to of the regulations of the Executive Branch on by authors on Executive Emergency and Legislative on the as in of the regulations of the Executive Branch on by authors on Executive Emergency and Legislative on the as in We also two other of the regulations under 13 of the 34 regulations enacted during the State of Emergency are not in spite of the exceptional circumstances under which were issued This is of because it that the effects of some of these more some of those which a to fundamental long the health and a for rights and the of an restrictions might remain in a the of of the of the regulations issued by the Executive by authors on Executive Emergency and Legislative on the as in of the regulations issued by the Executive by authors on Executive Emergency and Legislative on the as in 30 of 34 regulations not for a of or or we the of civil society or an that could the activities by the especially when a on a fundamental which be and to international rights a the of the regulations approved by the Executive by authors on Executive Emergency and Legislative on the as in of the regulations approved by the Executive by authors on Executive Emergency and Legislative on the as in in the majority of these were related to the of civil society or in the and of regulations. State have a of information in to its more which personal information of its This information is for a of services by the Government and for the to the this it is that the collection and processing of information by be with for the fundamental right to protection of personal data. Under Peruvian a government has to the and from the data to its personal data. the data put the for the data collection and the measures to the of the However, is not in some exceptional when data is or by for the of their and when it is in circumstances of for the and or of the data During the first of the the Executive Branch issued a of regulations that the collection and of an of personal data and the of of to an number of personal that were under the of and other for limited The decrees issued by the Government included the provision of personal data by citizens and the to personal data by In very and were to the protection of this information from data and similar of enacted by the Peruvian Government the and of with the of the COVID-19 and of these regulations the and of related to health protection, and to the of For the Government implemented and to the of economic to the most population as the or The of and for its in was in of those and other a of other by other as to the for of economic had to those other For some of those citizens were also to their data to use them as During the State of Emergency, the Government to of direct for of the and and and information of the citizens were such as a for of with and an for the and of activities related to the and of In most the of is the one for these and those it was very that the regulations other to to them as It was not that, in the of a health the Government to on its information to its the Government also enacted several regulations that for of in of to such or even the of large of personal However, after a review of these we found that a in the of these rules was the of in the of and of personal data and The was not in an express or decrees included a an to to or of personal for the of its and in the of this similar included such as and of to and of the decrees that the for of the population did a more for the and of those even those regulations did not the processing activities to be with the personal data. a of the for which processing and of personal data and personal it to the of the to those which could the for the or use of For the Executive Decree that from the Executive will a with to the of people affected by COVID-19 and of people from their In that will to or that surveillance, and other measures that to with the of This that Peru is by the of and to and to people affected by and to people who with It is of activities be under these the Government this information with health for up with the the be to and quarantine measures on is that the as in the of the and other are not it is not which personal data and which personal be under these regulations. For some regulations that a have to by other data the health of the the of of the of for the and processing of personal data is also of the regulations not will to the the for which were or is are the of data of the decrees for the of this study measures for the of information is a that the exceptional be restricted after The in the number of regulations that new personal data or or to personal data and the by Peru’s and its personal data be its and only for the to the for which it was the or in of processing and the personal data has the to it the has the for its processing has or the that its processing has or has However, in is that data will with this or that the information has the for the of has not the of this of especially with to government Some news have of by private to and processing of personal data are to and of in the of the health However, even in the of a are several measures neglected by the have the risks on people’s In measures to the of personal data have of the regulations included such The world has for the of about the and privacy concerns posed by contact tracing by several Peru has not in this it an of its in was the of the mobile and it was to be a for who the on their of the contact tracing of the were not between civil academy and some on the contact tracing use a or However, final has and contact tracing measures or have the Peruvian Government did a to some of the citizens that to the health emergency as The Peruvian Government issued an Executive the telecommunications to the information by citizens the two health emergency who were of COVID-19 could make a to the and to a or the of a a of those numbers, to the executive the telecommunications had the to their information the of the of the from which the was up to to the in the of or of to the the information by the be and a several the Peruvian and However, it not information about the of The for personal data protection in Peru not a standard or even for an of it only a of the of personal data processing that the of the data The is This can be problematic because of the of and of in personal data, which could to information to and other is of or of personal data by the Peruvian for when the information by the to and for the of information to health personal data, the of the and the of the to the emergency The above-mentioned restrictions on the of data For and that have to this data may only use it for the of COVID-19 and and for the and of or of COVID-19 the executive not the of such as the is It is also all other will have to all of the data. the that the data will be of the State of Emergency, it not for the of information or for that such will take of expression is a right that people or to freely and their or The exercise of this right is the of freedom of the most of it is by or other This right is an of the of and an institutional in a as it is a for the to express and make of the in the same is of the fundamental right by freedom of In to be the press has to be and of the risks that the pandemic of COVID-19 could was the to the freedom of expression and freedom of the of people’s right to or and the to the which might be to private communications in such as between a and a In the mobilization of for the telecommunications and telecommunications services is for the provision of services and as the press mobilization is for the news and a lockdown and the restrictions to the movement of people could the provision of telecommunications and services that are in a the government regulations issued during the State of Emergency the continuity of several activities related to freedom of expression, freedom of the press and private such as telecommunications services and In to the Government measures to to the of these the of the State of Emergency, an was in the country was to their with the of some such as to a health or to the from activities were from this in the security, and among were to from to their and The also included in the telecommunications and in the this and press but not for This a for the mass this we from with that, in the was to all of The had to a mobilization by the Government and to be their and their to their to the who them on the to their or from This an to their activities the mobilization to be two days, and the to make the during the State of Emergency. with this registration for the was the collection of personal data from to the mobilization of to the mobilization had to an several personal data, such as full mobile of of their the of their had to their personal information to the as This was the first that the Government (including the and the to a of all and in the and this information might be for but can be for in when it is for the especially for the and the personal by and could and to or personal the impact that this information with the Government may have on activities such as with or some this it is the of the mobilization was some of or has and it has the mobilization became the of the lockdown on 30 June The of telecommunications services became a for the Peruvian the lockdown of it to their the of In this in the first of the State Emergency, the telecommunications for its in issued a that telecommunications from or the telecommunications services to their for the Government issued an Emergency Decree that telecommunications have to to the of by during the such as the in without or services are a to freedom of expression as people to freely communicate with as as to massively and to the above-mentioned measures the provision of these were not by government measures to the for private telecommunications which a in their and a rate of of by their the of the State of Emergency, the Government the above-mentioned the to suspend the and services in the of However, this was approved when not all economic had which could have more on people economic activities were still due to be the on the of services a for telecommunications which could put their in the long other On a related due to the the of the of some such as new of and measures a economic toll on the telecommunications and a large to for of people in their and without having the and services for the new and two after this the provision of these services was though it was to use the and to suspend or telecommunications and to between telecommunications services or new and internet services was still The was adopted because the of these new services some contact between the and the to the of the the or to the the new which could the to a However, this provision was not only to the of the continuity of telecommunications services but also the for these services by the circumstances of the country’s This the of the for new telecommunications of when are to that not to personal contact or other In response to to the above-mentioned emergency during the State of the of and decided to suspend the and data services in the mobile and from which the were to 7 of it was to and these to the of the emergency were some in the of this the of and data of the to make these was by the of and and the telecommunications had to with the without the to exercise the right to themselves after a due the only for in the was the of and internet for 30 was of It was not two after the was implemented that the was and it in the from and to the of the Finally, it was the of the the of and of services such as is even more in a of and and It without that the world health emergency caused by COVID-19 caught governments in Latin American countries, economic of health and and information posed a for their Peru was one of the countries with the most severe civil rights restrictions on their citizens with in the health and This quantitative and qualitative case study to by the numerous regulations that one country enacted during a lockdown in to to the health and economic of their In spite of the of the the support of the majority of the fundamental rights such as privacy and personal data protection and freedom of expression were with of civil and the to privacy, our research that the Peruvian Government is not with the protection of their personal data and its were and for the and of massive of personal data, and for the to and of an number of personal in of regulations to the to this information from data and other of of personal data and it was that the decrees for the of the information the of the had those an was put in in the majority of the regulations. we that a large number of the regulations enacted by the Executive Branch in with privacy and personal data protection had a or impact on those rights of regulations enacted during the State of and some regulations had a of and On the other regulations with an impact on freedom of expression were In all, 7 of the regulations adopted in with freedom of expression, had a of and and were as The that the Government press and telecommunications from the was a However, the of the Government were in some of For it was that the Government the continuity of telecommunications but the same time, it from new internet and services because it personal under some outdated regulations. The on more and telecommunications services during the of was problematic was the Government that the of and to suspend the and data services from that to the emergency without them the of a or a of the regulations in this study are still in after the nation-wide lockdown and some of them will remain even after the of the health In all, 30 of the regulations included in our study did not put an of or to make that limitations to privacy and freedom of expression were and In we can that the effects on the rights of privacy and personal data protection were more and than on freedom of expression. This can be by the that and its executive are in Peru as were enacted in and are not to with these and of the risks of an and processing of personal data. On the freedom of expression not only has a long and in the country but Peruvian are of this right and freedom of the In to some of the in our study, we propose that the Government those regulations for the measures that were issued when included some of on people’s privacy rights and freedom of an that civil society in to the and of the limitations to fundamental rights approved by the for the of personal data and to the of and the of telecommunications services of and the due of in that may on the of services to freedom of expression. We that this and review of Peruvian regulations during the State of Emergency will to similar in other jurisdictions, and governments to their and make civil society and more of some restrictions on fundamental rights. data is Privacy The of the has not and the authors have of to The authors to the for on of and to of the the of for their and for the of regulations issued by the Peruvian Government during the State of Emergency. However, the authors full for the and in this