In this sense, emergency regulation may not necessarily have been required for authorities to carry out their duties. This is the view of the Council of Europe (2020). Protecting the rights of data subjects and preserving public health are goals easily reconciled in jurisdictions that are signatories to the Convention 108 and Convention 108+, as long as data are collected in line with the principles of necessity, proportionality, temporariness, effective (parliamentary and judicial) scrutiny, predictability of emergency legislation, and loyal cooperation among state institutions such as data protection authorities.<sup>25</sup> As of June 1, 2020, 20 percent of countries with data protection laws adopted emergency regulations to contain the spread of COVID-19 through the collection of personal data. None of those emergency regulations suppressed existing rights of data subjects on the pretext of fighting the pandemic. Take Mauritius as an example. In May 2020, the government adopted emergency regulations that included an amendment to the Data Protection Act 2017, which modified Section 44(1) of the act. This section regulates the “necessary and proportionate” exceptions to the application of the act,<sup>26</sup> which now includes the “issue of any license, permit or authorisation during the COVID-19 period.” This amendment sought to facilitate the issuance of documents like work permits during the pandemic, although a test of necessity for such exceptions remains in place.<sup>27</sup> Similarly, the Israeli government declared a temporary state of emergency with the Emergency Regulations (Authorization of the General Security Service to Assist the National Effort to Reduce the Spread of the Novel Coronavirus, 5780-2020), and empowered the national security agency, also known as the Shabak, to conduct contact tracing. This measure raised concerns, but the Israeli Supreme Court confirmed its compliance with the principle of data minimization, and the processing is restricted to what is necessary for the purpose of fighting the pandemic within the time frame of the state of emergency.<sup>28</sup> On the other hand, 18 percent of countries with no data protection laws promulgated emergency regulations that addressed individual rights with regard to the collection of personal data. Some of the emergency regulations embed certain good regulatory practices on personal data protection, but none provide the full range of safeguards. For instance, Brazil’s Law no. 13,979, adopted in response to the pandemic, did not include specific data protection safeguards other than a generic provision that requires personal data sharing among public authorities be limited to the purpose of preventing the spread of COVID-19.<sup>29</sup> Similarly, in Papua New Guinea’s National Pandemic Act 2020, although authorities managing the pandemic emergency are required to limit their actions to what is “necessary to achieve the purposes and objectives” of the act and to be “the least intrusive and invasive as possible,” they wield extensive powers in data collection and surveillance, such as the unspecified power to “require a person to provide information or answer questions” when needed.<sup>30</sup>

> 25 With regard to the European Union, the European Data Protection Board (2020) adopted a similar view with its _Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak_ , stating that there is no tradeoff between responding to the COVID-19 emergency and the protection of data subject rights.

> 26 The act can be accessed at: https://dataprotection.govmu.org/Documents/The%20Law/Act%20No.%2020%20- <u>%20The%20Data%20Protection%20Act%202017.pdf.</u>

> 27 See the Covid-19 (Miscellaneous Provisions) Act 2020, Section 13. Accessible at: <u>https://www.mra.mu/download/COVID19Act.pdf</u> .

> 28 The Emergency Regulations (Authorization of the General Security Service to Assist the National Effort to Reduce the Spread of the Novel Coronavirus), 5780-2020 is accessible at: https://perma.cc/96V9-HJSS – For further information see also: <u>https://www.pearlcohen.com/israeli-privacy-and-data-protection-in-the-context-of-the-coronavirus-pandemic/</u> 29 See Lei No 13.979, de 6 de Fevereiro de 2020, Art. 6. Accessible at: https://www.in.gov.br/en/web/dou/-/lei-n-13.979-de-6-de- <u>fevereiro-de-2020-242078735; At the time of our data collection, the implementation of Brazil’s Federal Law No. 13,709/2018,</u> that is the Brazilian General Data Protection Law (LGPD), had been postponed to 2021.

> 30 National Pandemic Act 2020, Sections 9 and 35. Accessible at: - <u>https://covid19.info.gov.pg/files/June2020/18062020/National%20Pandemic%20Act%202020 %28Certified%29.pdf</u>

28