A first-of-its-kind judicial decision sets out the rules for lawful tracking in an epidemic outbreak situation. The Israeli Supreme Court strikes a balance between COVID-19-related contact tracing technology and the right to privacy in a landmark decision about the government’s limits of power and the rights to privacy and dignity.

The Israeli government enforces the isolation of confirmed patients and people who came in close contact with them in an effort to contain the spread of the COVID-19 pandemic. Among the measures used is an anti-terror technological system, operated by the General Security Service, to trace the movement path of a confirmed patient during the 14 days preceding the patient’s diagnosis and to track individuals who were close to the patient for more than 15 minutes.

On April 26, the Supreme Court ruled in four petitions filed against the Israeli government’s Resolution 4950 from March 30 that authorizes the use of the GCC’s measure. According to the court’s decision, the government will need to amend the law through a parliamentary legislative process to continue using this measure.

How does it work?

The Ministry of Health provides the GCC with a confirmed patient’s name, ID number, mobile number and the date of the diagnosis and also notifies the patient through a text message that their personal details were provided to the GCC.

The GCC tracks and provides the MOH with the patient’s movement during the 14 days preceding the diagnosis and also provides identifying details of the individuals who were in potentially infectious close contact with the patient. These details include ID numbers, phone numbers, birthdate, and the time and place of contact with the patient. Next, the MOH sends a text message to the identified individuals requiring them to enter home quarantine and to report it on the MOH website.

To provide the MOH with the contact tracing data, the GCC uses a covert system containing communications data, regularly transmitted from telecoms to the GCC, under a general authority pursuant to the General Security Service Law, 2002.

The petitions and state’s response

Four petitions were filed against the use of the GCC technology and included the following arguments:

• The authorization of the GCC to act in a public health-related issue, under the government’s Resolution 4950, exceeds the authority vested in the GCC under the GCC Law.
• The GCC, as Israel’s secret service, is only authorized to perform pure national security functions. Even if a broader interpretation of the GCC Law is accepted, the GCC’s authority to act in matters not directly related to national security should be used only in extreme circumstances.
• Resolution 4950 violates the rights to privacy and dignity. Though the resolution advances a worthy purpose, there are less restrictive means to achieve the same purpose and accordingly, the resolution fails the proportionality test. Additionally, the mechanism set out in Resolution 4950 falls short of acceptable privacy protection principles, particularly given its coercive nature and lack of transparency.

The state claimed against the petitions that the GCC Law empowers the GCC to operate in other domains, not in the core national security activities of the GCC, as required to protect national vital interests and subject to the approval of a parliament’s designated committee.

Immediate and severe threat

Chief Justice Esther Hayut stated that the use of the GCC’s abilities toward law-abiding civilians entails a grave danger to a democratic society. However, the state can endure restrictions on human rights, such as the right to privacy, where the state’s existence is threatened.

The Supreme Court agreed that the GCC Law should be interpreted to allow the government to empower the GCC in domains that are not directly related to national security but only in light of the existence of an “immediate and severe threat” to the public or to the state’s order and institutional structure.

The burden to demonstrate an immediate and severe threat lies with the government. The more a justification to authorize the GCC to act moves away from the core national security domains, the higher the burden is. The “immediate and severe danger” test further requires that there be no practical option to develop alternative means better suited to deal with the situation. It also means that such powers should be deployed only for as long as the immediate need remains.

The Supreme Court agreed that the current health crisis is one of the extreme and unusual situations that the legislator had in mind when the term “national security” was included in the GCC Law and also agreed that Resolution 4950 followed a grave danger of an epidemic outbreak. Therefore, the resolution did not contradict the principle of establishing fundamental issues through parliamentary acts.

However, the circumstances have changed and the urgency that supported the government’s resolution decreased. Accordingly, to continue using the GCC measures for contact tracing after April 30 (the expiration date of Resolution 4950), the government will need to enact an interim explicit authority into the GCC Law, through a parliamentary legislative process. To support the legislative process, the Supreme Court allowed a limited extension of the resolution of up to a few weeks.

The future of privacy in the COVID-19 era

The Supreme Court noted that the violation of the right to privacy is severe because the GCC tracks the location and other personal information related to law-abiding citizens and residents by using a covert, coercive and non-transparent technology.

The Supreme Court further noted that the measures taken by the Israeli government to confront the COVID-19 virus are extreme and unusual and warned from a slippery slope effect, which may lead to the use of the GCC’s capabilities without proper justification for additional purposes. The court encouraged the government to find and deploy effective alternatives to the GCC’s means, such as the “Magen” (Shield, in Hebrew) application, which is offered by the MOH, and is a highly secured, decentralized, voluntary solution.

It seems that the government is heading in a different direction.

On April 28, two days after the Supreme Court delivered their ruling, the government reached a new resolution that extended the GCC powers under Resolution 4950 in seven days, to allow a government discussion over drafting a bill to amend the GCC Law and exploring additional options. At the time of this article’s publication, the government has not introduced a bill yet.

On April 30, the special parliamentary committee for secret services approved an extension of five days only. The chairman of the committee noted that amending the GCC Law to create explicit non-national security-related powers to the GCC would be a difficult process and recommended the enhancement of epidemiological investigations and tests.

At the same time, the government is exploring the deployment of additional non-consensual contact tracing solutions, including requiring employees to install the Magen application as a condition to returning to work from the offices; requiring owners of malls to develop CTT applications and condition entrance to the malls with installing the apps; and using additional solutions offered by private companies, such as NSO.

Saving lives and preserving rights

The Supreme Court concluded, "We are presented with novel issues, that the entire world, as well as the medical profession and legal practice, have not yet addressed. We have tried, with the aid of the authorities who handle the current situation and pursuant to acceptable principles under the law, to address the situation and provide solutions that both save lives and, at the same time, preserve the established constitutional rights, with appropriate and proportionate balances. May we soon not need them, and better times will come."

Considering the government’s current plans, the public discourse over the government’s tracking powers and the right to privacy has only begun.

The Supreme Court’s decision is available in Hebrew.

Photo by Cole Keister on Unsplash