Politiscope implemented the project „Privacy in the time of Corona“ from October 2020 till February 2021. Monitoring of public bodies in charge of developing pandemic practices of data gathering and processing was supported by Active Citizens Fund of Iceland, Liechtenstein and Norway.
The key project activity was producing short policy briefs in order to conduct evidence-based advocacy and awareness-raising activities among the public and citizens on data practices and their rights. We analysed the work of the Croatian Data Protection Agency, pandemic practices of data gathering and processing, applications used for online schooling and the Stop Covid-19 contact tracing application.
Analysis of the work of the Agency for Data Protection focuses on the appointment of Zdravko Vukić as the director of the agency, since the appointment is unlawful, it destroys public trust in the institution and it is an example of political capture of independent oversight institutions. Vukić is in a permanent conflict of interest as a former member of the ruling party and due to his close connections to the Government and thus only further undermines the independence of the institution towards the executive branch. The analysis points to the conclusion that the Croatian Supervisory Authority does not have capacities to monitor modern technological practices of data processing and is inactive when it comes to the oversight of public bodies. A sense of impunity is nurtured among the political elite holding the most important political functions, since public bodies are exempt from financial sanction in the Croatian Law on the Implementation of the General Directive on Data Protection. Public bodies are currently responsible for some of the most serious GDPR breaches in Croatia.
Analysis of applications for distance learning from the perspective of safeguarding privacy of pupils detected privacy is not present in policy documents on distance learning nor was it taken as an important factor when choosing and recommending apps to public schools. Politiscope analysed applications that were used most often and issued a clear set of recommendations on the use of analysed apps.
Analysis on data gathering and processing practices during the Covid pandemic – case of Croatia puts forth a series of short case studies indicating that the Government lacks the capacity to develop a suitable legal framework for data processing during the pandemic. Instead, it developed illegal and illegitimate data gathering and processing pandemic practices. Croatia failed to create a separate legal framework as obligated by recitals 45. and 53. of the GDPR. Selected cases reveal dependency of the data protection authority in relation to the Government and at the same time exposed a sense of impunity on data malpractices among members of the political elite holding most relevant functions in the executive branch of power.
The analysis of the Stop Covid-19 application deals with the legal and technical framework for the protection of personal data of users of the mobile application, which serves to warn citizens about exposure to epidemiologically risky contacts. Although there are some visible shifts in the considerations of user privacy, the Stop COVID-19 application has not been fully developed according to the "privacy by design" principle. Thus, the Croatian version of the Android application contains third-party software components that are known privacy violators, such as Google Analytics. The data protection authority did not recognize the shortcomings of the application or give clear recommendations for their corrections, showcasing yet again its lack of technical capacities and subjugation by the Government.
Another important goal of the project was to present Politiscope to the wider public, media, activist and professional community as a privacy watchdog organization recognized by safeguarding citizens' privacy and their data protection rights. Politiscope participated in national and European consultations on rule of law and state of human rights, while all produced analyses were delivered to the Ombudsman, Deputy President of the Government for Social and Human Rights Affairs, committees and MP clubs of the Croatian Parliament. Media outreach activities resulted in two media features: appearance on "Točka na tjedan" political weekly show on N1 Television, interview for srednja.hr on distance learning apps. Project supported finalization of organization's website and creation of the English site version. Building up on contacts with IT sector in the Dalmatia region established during project implementation, Politiscope submitted two project proposals with partners from IT industry.
‘Privacy in the time of Corona’ project is funded by Iceland, Liechtenstein and Norway through the EEA Grants and Norway Grants in the amount of 4.973 €.