On the compatibility of pandemic data-driven measures with data protection: a review of Ireland's "under the radar" Covid-19 measures

Abstract

This article reviews the compatibility of ‘under the radar’ data-driven measures adopted in Ireland to contain the Covid-19 pandemic with data protection law, understood as both a source of regulatory compliance, and as the substantiation of a right. The article elaborates a test for permissible limitations on the right to data protection that incorporates requirements from the applicable law, followed by an analysis of how select data-driven measures comply with the various stages of the test. The measures reviewed - thermal scanner guns, health self-check forms, statutory instruments for contact logging and the Vaccine Information System - appear well-meaning but partly incompatible with the right to data protection. The analysis points to the difficulty of reconciling public health and data protection without a systematic data processing strategy and concludes with recommendations for right-proofing data-driven measures in the guise of a blueprint strategy for processing for pandemic purposes.