The Covid-19 pandemic was the worst public health crisis the world has experienced in living memory – and it was also a crisis for rights and privacy. Used well, personal data and health surveillance could inform public policy decisions, empower people and benefit public health. Used badly, personal data was exploited to boost the surveillance industry at the cost of our privacy rights and safety.
Individuals as biohazards
The pandemic led to the emergence of biosurveillance – where various organisations from government agencies, private businesses and employers sought to monitor our bodies, test results, vaccine status and more, to infer a health status or a risk status. In many cases, the thresholds of necessity and proportionality were far surpassed, and organisational safety responsibilities were deprioritised in favour of personalising risk, making individuals risk vectors and ‘biohazards’ measured by intrusive personal data processing – not necessarily because there was evidence that it would benefit public health, but to defer responsibility or justify the public returning to shops, restaurants, and workplaces. In order to do that, our body data became a resource to be mined and quantified.
One major biosurveillance product was thermal scanning – infrared scanners that estimate skin temperature. These were falsely marketed as offering “fever detection” despite being unable to measure core body temperature. Thermal scans became a condition of entry to many workplaces, from Amazon warehouses to the BBC, as well as to shops, theatres and schools.
Stackable surveillance
In May 2020, we identified that Heathrow Airport, Bournemouth Airport and Amazon UK were using thermal biosurveillance cameras in attempt to boost confidence in international travel and workplace settings (where, arguably, safety standards were otherwise low). We wrote letters to each of them outlining the evidentiary and privacy issues, and making the case for them to desist, copying the ICO, Surveillance Camera Commissioner, and Transport Committee.
These cases signaled not only a serious expansion of body surveillance, but a worrying trend of “stackable” surveillance, whereby new and increasingly intrusive monitoring software was added to existing security infrastructure. For example, Heathrow Airport adopted thermal surveillance alongside automated behavioural and demographic analysis – estimating gender, age, movement speed, clothing and masks, any items carried, among other data -and even planned to add automated facial recognition, in a major expansion of intrusive surveillance in our immigration halls. It was clear that the pandemic had opened the gateway to intrusive surveillance despite its inefficacy for identifying illness.
Our advocacy was successful – all airports stopped using thermal biosurveillance following our campaign.
However, we realised it was important not only to put public pressure on organisations with regards to thermal surveillance but to establish legal standards that protected everyone’s privacy rights and clarified the legal duties of any potential operators, whether during this public health crisis or future ones.
We secured a grant from the Digital Freedom Fund to research and do legal work to protect data rights in the context of biosurveillance, with expert data rights legal firm, AWO.
Our campaign
Our goals were:
- To ensure a more evidence-led, rights-respecting and data protection respecting approach to surveillance during a pandemic, particularly related to thermal scanning
- To increase public awareness about the potential issues related to thermal scanning
- To set precedents confirming that other rights were being indirectly violated by the imposition of thermal scanning in certain contexts (e.g. education, airports, employment)
Recognising an emerging trend, we became concerned that access to schools and other important public buildings could become contingent on thermal scans, and that such scans were not being operated in a privacy-respecting way that protected people’s data rights. We started by undertaking further scoping work.
We raised attention about the issue, invited members of the public to tell us about their experiences of thermal surveillance so we could write to operators and ask them to desist, and we launched a specific campaign site in July 2021, BiosurveillanceWatch.co.uk.
In our scoping work, we identified and contacted numerous operators of thermal surveillance to urge them to desist, or evidence their legal compliance. This included:
- 10+ schools and universities
- 7+ restaurants (mostly large chains)
- 6 airports
- 6 workplaces
- A theatre group (responsible for 6 theatres in London), and another London theatre
- 5 medical and care settings
- 2 retail chains
- An international port
- A major coach company
- A national gym chain
- A homeless shelter
- A borough council
- A theme park
A city-wide freedom pass
We also identified one concerning case where a city-wide rollout of thermal surveillance was proposed. Users of an app would have a time-limited “freedom pass” after passing a thermal scan, allowing them to freely access premises involved in the scheme, whilst non-users or those who failed the thermal scan would be denied entry. We identified and engaged the company behind the scheme, as well as some of their users.
In all of the cases, we were unable to identify a single Data Protection Impact Assessment (DPIA). In fact, confirming our initial fears, every operator that responded denied that they were processing sensitive category data or indeed personal data at all, thus avoiding their responsibilities to assess and protect individuals’ privacy and data rights.
Since our very first letters raising concerns about thermal surveillance to airports and the Department for Transport, some positive health advice reflecting our early concerns was published by the MHRA and the European Centre for Disease Prevention and Control. Eventually, (then) Government Health Minister Lord Bethell explicitly advised against the use of thermal scanners for temperature screening, stating: “it’s important businesses do not rely on temperature screening tools and other products which do not work.”
In addition to the airports, many other operators of thermal biosurveillance desisted their use following our intervention.
This was an excellent outcome. However, many operators had – in our view, wrongly – denied that thermal readings were personal data at all, thus minimising the legal rights and protections available to individuals and their data.
Next, we resolved to bring the best legal data experts together to advise on the legal standards that should apply to thermal biosurveillance and its operators, to clarify people’s rights and any potential operators’ legal duties, should organisations seek to use it again.
Legal standards for the future
We instructed a team of leading data rights experts including solicitor Ravi Naik at AWO and barrister Schona Jolly KC from Cloisters to advise on the data protection principles that apply to thermal scanning.
The expert legal opinion, which you can read here, clarified that:
- Temperature readings do constitute personal data, and indeed special category data, incurring a set of legal safeguards under GDPR
- In the absence of an evidence base that thermal surveillance protects health, mandatory scans are likely to be unlawful
- Further, organisations operating thermal screening face potential legal risk under the Equality Act 2010
- Even if a lawful basis were identified
- any ongoing screening would need to be demonstrably necessary and proportionate in relation to the lawful purpose relied on to justify its use, with no less intrusive method possible
- an Article 6 lawful basis and Article 9 condition for processing the special category data would need to be identified
- the use of thermal scanning would need to be kept under review, accompanied by relevant privacy policies, and other steps accounted for (detailed in Annex B to the legal opinion) to ensure the processing is done lawfully
This legal advice is a valuable contribution to the data rights field, and we hope is a useful resource to organisations considering biosurveillance options now or in the future.
Never before has society faced such a rapid rate of major change. The decisions we make now will affect the freedoms of future generations to come.
The fight for the future is now. Don’t stand by – join us today.