Élise Poillot is a Full Professor of Droit Civil at the University of Luxembourg’s Faculty of Law, Economics and Finance.
Prof. Poillot is principal investigator in the COVID-19 research project funded by the Luxembourg National Research Fund (FNR), “Legally Fighting COVID-19 (LEGAFIGHT)”. The project aims, as a first step, to provide Luxembourg with a specifically socially and ethically tailored legal regime for tracking applications, leading to the drafting of a legislation, which could be proposed, in a second step, as a European and global model system in the frame of a longer-term project of epidemiological data management.
She is also a member of Research Luxembourg’s COVID-19 Task Force Work Package 05, “eHealth solutions for hospitalised and ambulatory patients”.
Could you tell us more about your background and expertise?
EP: My main fields of research and teaching have been consumer law and general contract law, in a national comparative and EU perspective. And for the last four years I have been deeply involved in setting up and directing the University of Luxembourg’s Consumer Law legal clinic, Clinique du Droit. I have also participated in establishing a network of similar legal clinics throughout Europe. And through the STARS (Skills Transfers in Academia: A Renewed Strategy Enhancing legal clinics in the European Union) programme, supported by Erasmus+, I have been working with partner universities to bring legal clinical education opportunities to Law students in Luxembourg, Italy, Romania and the Czech Republic.
How is your expertise relevant in the current COVID context?
EP: As a civil lawyer and a consumer lawyer. I am not really someone that you would expect to be doing research into COVID-19. However, there is a very strong connection here. A large part of my current research has to do with consumer profiling. Companies profile their consumers by collecting, processing, and using their data. When you have a conversation through WhatsApp or you buy something online, you are providing operators with your data. What do they do with it? One example would be changing the price of a product depending on who you are. If you are using an IPhone and you are based in Luxembourg, the price may be higher for you than for another consumer in a less wealthy country using a less expensive device.
So, when the issue of tracking applications came up because of the COVID-19 outbreak, I was very interested because it was tightly connected to the research that I have already been doing in the field of consumer law. There Is a huge interplay between consumer law and data protection; when you use a tracking application, you are somehow in the position of a consumer in the sense of “user”. Tracking applications are about collecting and processing data. It is necessary to understand to what extent companies, or institutions in the case of COVID-19, can use that data.
Before the COVID-19 outbreak, I had been working on some research projects with Italian colleagues who were specialised in data protection. Given my background and my interest for consumer profiling research, I built on this pre-existing relationship. Italy being among the first countries to be hard hit by the COVID-19 outbreak, was way ahead of us, and had already been working on these tracking applications. My idea was to collaborate with researchers that had experience in the field. As I am already in touch with Italian colleagues, Prof. Giorgio Resta and Prof. Zeno Zencovich from the University of Rome 3, who are also renowned specialists in the field and working for the Italian government, I felt that it was a good opportunity to present a trans/interdisciplinary and international project.
What is your specific role in ongoing COVID projects?
EP: The idea of these tracking, or tracing applications is to inform people if they have been in contact with an infected person and that they should, as a consequence, follow certain health measures. The application would be available to download onto your mobile phone and use on a voluntary basis. If you came into contact with an infected person, who was also using the application, a short message would be sent to you anonymously and automatically through an SMS telling you to stay at home with your family for 15 days in order prevent infecting others.
My project is about understanding to what extent the private data of citizens can be used in this context. Should Luxembourg opt for a “decentralised” process whereby citizens only receive an automatically-generated SMS, or would it possible for the local health authority, Inspection Sanitaire, to have access to the names and phone numbers of people infected and exposed in order to contact them to provide advice and psychological support, for example. The issue is whether personal information is communicated to the health authority. Is this something that can be accepted and what can be done to protect personal data?
Tracking and tracing applications are already in place in Asian countries and in some European countries, such as Austria. In Europe, people are much more concerned about data protection than in Asia. Accordingly, the legal framework in Europe takes a much more protective approach to personal data and how it is used. For example, in China, the application works with geo-tracking. If you are found to be in violation of quarantine, the authorities will have this information and can impose sanctions on citizens. In Israel, the Secret Service can have access to your personal data and where you have been. This is not something which will happen in Europe as there will be no geo-tracking function to the application. Features of the Chinese and Israeli apps would not be accepted in Europe, for cultural and legal reasons.
We, as researchers, will also be trying to understand how the application should work from the end user’s perspective. For example, determining what information needs to be provided to the consumer so that they may give explicit and informed consent for their data to be collected and processed. We have to make sure that this process will comply with the requirements of the GDPR (General Data Protection Regulation), with the European Charter of fundamental rights, the European Convention on Human Rights and with the Luxembourg Constitution. In fact, the GDPR already includes provisions for health-related data and data protection in the case of pandemics.
The idea is to draft a Luxembourg law which sets out the framework for the use of this application. A domestic law also helps citizens to trust the application, it is a positive signal to send to the population. Although the application could be put into place with only the existing EU framework, the country is choosing to strengthen data protection and regulatory oversight. Additionally, domestic framework would define a data controller, whose purpose it is to ensure compliance with the existing EU regulations. In Luxembourg, this role could go to the Inspection Sanitaire or the Commission National d’Éthique.
As lawyers, we will be able to draw up legal framework and establish the threshold that we should not cross in terms of the use of personal data. We need to be precise as to the role of the data controller and how the data will be used. We will also be able to explain in layman’s terms how everything works. It is vital that citizens are informed and educated. Our idea here, drawing on experience with Legal Clinics and other similar outreach initiatives, is to create a series of videos where Luxembourg citizens explain the application to their peers in plain and simple language. Because the use of the application would be on a voluntary basis, increasing acceptance among the population and building trust is the only way to ensure that it will become a useful tool in the fight against COVID-19.
Could you tell us more about your collaborators?
EP: On the LEGAFIGHT project specifically, I am working closely with a colleague from SnT, Dr. Gabriele Lenzini, a computing engineer who was already involved in my project on consumer profiling as a technical data protection specialist as well as with my fellow researchers in Italy whom I have already mentioned. Jean-Louis Schiltz, Honorary Professor at the University of Luxembourg, is also part of the project. He is a renowned lawyer and expert in the field of technology law,
As for the COVID-19 Task Force Work Package 05 “eHealth solutions for hospitalised and ambulatory patients”, most of the other members are medical doctors, including team leader, Damien Dietrich, Chief Medical Digital Officer at Robert Schuman hospital. Gabriele Lenzini is also a part of the team. We have had a very fruitful discussion with the medical doctors expressing their needs, the computing engineers saying whether it is technically feasible or not, and the lawyers checking the legal basis. It’s a challenge and I enjoy being part of this transdisciplinary group because it forces me to have a broader view that what I would normally have in a discussion with only other lawyers. It’s also concrete work, which is very rewarding.
