Covid-19: Slovenian court to rule on constitutionality of data collection

Slovenia’s Constitutional Court is set to hear a challenge to an emergency coronavirus measure that authorises mass gathering of personal data.

The provision, which came into force as part of Slovenia’s emergency coronavirus law on 11 April, allows police to collect and process personal information without cause. Slovenia’s information commissioner Mojca Prelesnik said in a letter to government ministers last week that her office “welcomes” the 21 April Constitutional Court challenge, as the provision “disproportionately restricts the rights of individuals”.

Prelesnik said the provision authorises photo-based facial recognition and the collection and processing of certain personal data by police for unclearly defined purposes. 

“In the last month, we have taken a step back in securing the right to privacy in Slovenia,” she said. “It is not clear why the government and the legislative body consider as necessary and appropriate such serious privacy intrusions, especially by expanding police authorities.”

The official added that her office is “closely monitoring the actions of the government and the legislature at reducing the volume of rights of individuals”.

Prelesnik also noted that the GDPR and ePrivacy Directive already contain provisions allowing the use of anonymous or personal data to support public authorities in their efforts to monitor and limit the spread of covid-19.

Boris Kozlevcar, a partner at JK Group in Ljubljana, said there is a “fair chance” that the court will find the measure is disproportionate, or insufficiently clear about the purpose for which the data is processed.

Mia Kalaš, a partner at Odvetniki Šelih & partnerji in Ljubljana, said she also believes the court will rule the provision unconstitutional given its recent decision in a similar matter in which it forced competent authorities to monitor and evaluate weekly whether certain covid-19 measures limiting free movement were necessary. 

“In view of [that] decision, we expect that the court will likely rule the provision unconstitutional in respect of the fragile equilibrium between the right to data privacy and the measures adopted to fight the pandemic,” Kalaš said.

Prelesnik also denounced a draft proposal that would have authorised police to access data from telecommunications providers to track individuals.

Despite the article not making it into the law, the commissioner said: “The EDPB emphasised [in its covid-19 guidelines] … that while data and technology may be important tools in limiting the spread of covid-19, they bear restrictions, and as such, can only support the effectiveness of other public health measures. Therefore, repression and privacy interference cannot and should not be their own purpose.”

Referring to the telecoms measures, Markus Bruckmueller at Wolf Theiss in Ljubljana said that in his view “certain measures were not enacted in line with the proportionality principle and other fundamental legal principles. As a result, the exercise of fundamental rights are in certain aspects limited to an extent that do not seem necessary and too wide”.