A Controversy be- tween The Protection vs. Violation of Person- al Information and Obligation vs. ChoiceSeveral Countries worldwide have strived in various ways to face the Coronavi- rus (Covid-19) Pandemic. Precautionary procedures and measures are various and all methods, recommendations and technology are used to control the virus outbreak. Qatar however has been among the leading countries to preserve its citizens and residents by taking all the precautions and procedures to combat this pandemic including AI, among several precautionary measures taken the latest to date was decided by the Council of Ministers which is mandatory for all citizens and residents to install EHTERAZ Application on their smart phones when leaving their residence for any reason whatsoever. The Council also point- ed out that in case of non-compliance with these decisions, penalties stipulated in the decree that promulgated Law No. (7) of 1990 on the prevention of infec- tious diseases shall be applied.
This decision, however, has sparked widespread controversy for a couple of issues:Firstly: Concerns about the privacy of personal information of the users of the application; in terms of the violation of privacy by the application in addition to its vulnerability to hack the users smart phone.
Secondly: The extent to which the Council of Ministers is entitled to issue a decision with a criminal penalty for those who violate this decision. In this article we will go through a legal opinion on the above aforementioned issues after that presenting necessary legal recommendations for a crisis man- agement; taking into account the public interest without predjudice to the private one.
Artificial Intellegence (AI) has become indispensable for all aspects of life. It has become and important partner in the development and growth of communities; and several countries have involved it more and more in the measures taken in countering the Coronavirus Pandemic. Hence, EHTERAZ App, which uses loca- tion and Bluetooth features, was developed to provide various services to pro- mote prevention procedures and to control the outbreak of the Coronavirus Pan- demic; as well as presenting latest updates and statistics and receive aware- ness-raising tips.
The First thing to spark controversy is the application’s permission to access users' photo and video galleries; in addition to the ability of performing phone calls which conflict with their privacy and the protection of their personal data. Some have even considered it a way to spy on individuals to trace and track them, and to access their personal data.
Whereas the State of Qatar is among the leading countries in protection of per- sonal data; it has issued Law No. (13) of 2016 which stipulates that all individu- als are entitled to the protection of their personal data. Further, such data may only be processed within the framework of transparency, honesty, respect for human dignity, and accepted practices after obtaining the individual's consent. Such law is an extension to its former approach for protection of personal data since Article (7) of law no. (2) of 2011 states that all data related to the names and identities of establishments and individuals are confidential".
Hence, the general principle is the confidentiality of the individuals' personal data and respect of their privacy. In regards to legal investigation of the decision of the Council of Ministers to oblige the installation of EHTERAZ Application on smart phones by all citizens and residents for the purpose indicated which is tracing and tracking the move- ment of individuals and following those in social contact; which will allow the officials to control the outbreak of Covid-19 and alerting people at risk of infec- tion when there are close to people that are infected.
We see that this decision is issued in exceptional circumstances to address an accidental matter in which the public interest must prevail over the private inter that may befall community. Hence, in order for this decision to be consistent with the law; and not to violate individual's privacy; we recommend to process the permissions when installing the App so that access to individuals' photos and videos; as well as making phone calls, shall not be allowed since such permis- sions are not necessary for the fulfilling the purpose of the application. Further, only the minimum personal information and data allowing the control of the pandemic outbreak, tracing and tracking the movements of persons, tracing those in contact, and alerting them when at risk, shall be obtained. Also, it should be taken into consideration that in the light of electronic development, all applications are vulnerable to cyber hacking and theft. Therefore, a law must be issued to increase the penalty for anyone who tries to hack, or actually hacks this application to access personal data of individuals since this matter prejudic- es national security.
Therefore, in the event of installing the application as stated in the decision of the Council of Ministers dated 18/05/2020 obliging citizens and residents to install it without processing the unnecessary permissions, without minimizing the amount of personal information, and without protection authentication of per- sonal information through secure storage in the light of hacking and penetra- tion, then such decision shall be deemed in conflict with the constitution which stipulated sanctity of human privacy. As for the legal opinion on the extent to which the Council of Ministers is entitled to issue a decision with a criminal penalty for those who violate this decision.
The Shura Council has the legislation power; and no other authority or entity may issue a law without following the procedures which are stated by the Qatari constitution. That raises the question about how the Council of Ministers issued a law which imposes a criminal penalty on those who violates its decision to install EHTERAZ APP. Addressing the text the decision which states the following: " In case of non-com- pliance with these decisions, then the penalties, which are imprisonment for no more than three years and a fine of no more than (200,000 QAR) Two Hundred Thousand Qatari Riyal; or either one of the penalties, stipulated in the decree which promulgated law no. (7) of 1990 on prevention of infectious diseases, shall be applied to the violator.
Therefore, we find that the decision is not a special legislation, law, or an amendment to a law by adding a new article, but rather a reference to a penal- ty that already exists since the decision is considered one of the precautionary measures authorized by law to the Prime Minister in accordance with Article (10) of the decree of law no. (17) of 1990 on prevention of infectious diseases which was amended by law no. (9) of 2020. So, the Council of Ministers, upon a proposal of the Minister, and for the pur- pose of limiting the spread of infectious disease, may take appropriate public procedures and measures to maintain public health. That includes imposing restrictions on the people's freedom to gather, move, reside and pass in certain places or times."
Therefore, the decision which was issued by the Minister’s Council is deemed accurate and complies to the law. Finally, the state is facing urgent circumstances that have befallen it, in which all authorities must join forces to obtain safety for all and reduce damage by all means. In this regard, we cannot overlook the implementation of the decision to oblige all citizens and residents to install the application, which only nega- tively impacts a few but benefits the most. Sharia Law states that necessities allow prohibitions, that preventing mischiefs is better than bringing benefits, and that public interest prevails over individual interest. Thus, the state's deci- sion to oblige citizens and residents to install EHTERAZ in pursuit of controlling the outbreak of Coronavirus Pandemic, tracing, tracking and categorizing per- sons in terms of infected, in contact, and recovered, in order to limit its out- break and then eliminate it. However, the permissions of this App which unnec- essarily request personal information, and in the light of technological develop- ments that have made it easier to hack applications, make this information vulnerable to piracy and hacking. Thus, this makes this application more harm- ful rather than beneficial from one point of view, and from the other point of view it will not be of any use if it is not installed by the public and only some of them install it while others don't.
Protecting personal data is just as important as preventing and limiting the spead of the Coronavirus Covid-19. Hence, the aforementioned recommenda- tions to minimize the amount of the required personal information, to increase the deterrent penalties in case the application was hacked, and to cancel the unnecessary permissions that violate personal data; must be implemented.