LA TECNOLOGÍA DE LOCALIZACIÓN APLICADA A LA INVESTIGACIÓN CIENTÍFICA: EL CUMPLIMIENTO NORMATIVO EN TORNO A LA PROTECCIÓN DE DATOS PERSONALES

Abstract

At the beginning of the pandemic, multiple scalable mobile applications with tracking technology emerged, promoted by public administrations and governments with the aim of managing and controlling the pandemic, generating personal and individual data as aggregates. Telecommunications operators put them in the hands of epidemiological authorities and agencies, and although no personal information was shared, it became clear that through metadata and the combination of metadata it was possible to obtain personal information and violate people's fundamental rights and even their own safety. Ninety-five percent of people can be easily identified from only four different locations). Moreover, with alliances between technology companies and pharmaceutical organisations comes a certain risk of 'commoditisation' of data for more spurious purposes that would not necessarily coincide with the overriding public interest of public health, and this places us in the research community at the right moment to reflect on the lawfullness of the processing of these data, the risks and the level of «anonymisation» (and the most feared and warned against) «re-identification», which cannot be completely avoided. When talking about consent as a legitimate basis, it does not always have to be «alone» but accompanied by others, so it would be important to establish normatively, which could make up the «double legitimate basis», opting for the public interest and the legitimate interest. In case only the public interest legal basis is chosen, for dominant companies to disclose data to researchers, it should be formulated together with the strict proportionality test and safeguards against misuse and illegal Access. In short, privacy should be perceived as an institutional value (in line with public policy) from the outset, identifying the level of invasiveness by collecting the least amount of data, avoiding any kind of 'data opacity' and implementing technical measures such as anonymisation and pseudonymisation without harming the purpose of the research itself.