Sound Laws and Safeguards Are Essential to Prevent Gaps in Pandemic Control-JRF's Four Statements on Police Misuse of 1922 SMS Contact-Tracing Data

In view of the worsening domestic COVID-19 outbreak, the Central Epidemic Command Center (CECC) launched the "1922 SMS Contact Tracing System" on May 19 to support contact tracing and repeatedly emphasized that contact-tracing SMS data would not be used for other purposes. However, Taichung District Court Judge Chang Yuan-Sen published an op-ed in the media on June 19, pointing out that police had improperly used contact-tracing SMS data in a criminal investigation, plainly contrary to the CECC's stated restriction that the data be used "solely for contact tracing." The JRF makes the following four demands:

1. The Ministry of Justice should study legislative amendments and comprehensively review the "blanket collection" problem in the communications-surveillance legal framework

   Under the current legal framework, contact-tracing SMS data form part of the public's ordinary communications records. When investigative authorities obtain communications records under the Communication Security and Surveillance Act, they may obtain these data at the same time. Thus, even though the CECC has repeatedly promised that the data will not be used for purposes other than pandemic control, the current system does not prevent investigative authorities from obtaining the relevant records directly from telecommunications operators.

   This controversy reflects the absence, in current practice for obtaining communications records, of information-segregation safeguards that would prevent use for purposes other than those originally specified. The result is a "blanket collection" problem in the execution of communications surveillance, without adequate limits on scope or mechanisms for reviewing whether the means used satisfy the principle of proportionality. Here, when police lawfully obtained communications records, they simultaneously obtained contact-tracing SMS data that should not have been used for investigative purposes. The incident also highlights the insufficient legal safeguards and restrictions on secondary use under the Personal Data Protection Act, the Police Power Exercise Act, the Code of Criminal Procedure, and related laws.

   To address the problem at its source, the Ministry of Justice and the competent authorities under the relevant laws should promptly study legislative amendments, comprehensively review deficiencies such as blanket collection in the current communications-surveillance system, and strengthen protections for privacy and personal data, so that human-rights safeguards do not depend on differing standards adopted by individual judges or prosecutors.

2. The CECC should promptly coordinate with the Ministry of Justice and the Ministry of the Interior to issue formal directives prohibiting the retrieval of contact-tracing SMS data for criminal investigation or crime prevention

   Until legislative amendments are completed, the government should close gaps in human-rights protection and honor the CECC's commitments. The JRF therefore calls on the CECC to coordinate promptly with the relevant agencies:

   • (1) Request that the Ministry of Justice issue a formal interpretation expressly excluding information generated by the "1922 SMS Contact Tracing System" from the communications records referred to in Paragraph 1 of Article 3-1 of the Communication Security and Surveillance Act, and expressly direct investigative authorities not to obtain contact-tracing SMS data.
   • (2) Require the Ministry of Justice, the Ministry of the Interior's National Police Agency, and other agencies to issue formal directives to investigative authorities nationwide prohibiting them from proactively obtaining contact-tracing SMS data for criminal investigation or crime prevention, and prohibiting the use of any such data already obtained.

   The "1922 SMS Contact Tracing System" depends on active public cooperation to function effectively as a pandemic-control measure. The CECC repeatedly emphasized that the system was "solely for contact tracing" precisely to avoid public concern and reluctance to cooperate. If the CECC, Ministry of Justice, National Police Agency, and other agencies cannot prevent contact-tracing SMS data from being repurposed, public cooperation may decline, creating gaps in pandemic control and endangering the lives and health of the public.

3. Investigative authorities should comply with their duty of objectivity and refrain from obtaining contact-tracing SMS data

   As noted above, contact-tracing SMS data are generated by a special measure created solely for pandemic control and the protection of life and health. Before this measure existed, investigative authorities could not determine people's locations through it. Prohibiting prosecutors, police, and investigators from using contact-tracing SMS data in criminal investigations therefore does not impair preexisting law-enforcement methods.

   Conversely, allowing government agencies to obtain and repurpose contact-tracing SMS data through various means would effectively give the government a new tool for tracking individuals' specific whereabouts without a clear legal basis, seriously infringing privacy and other rights.

   According to CECC Deputy Commander Chen Tsung-Yen's remarks at the June 20 press conference, the CECC had asked the National Police Agency to direct police agencies to exclude and refrain from obtaining contact-tracing SMS data when carrying out communications surveillance during the pandemic. Until the relevant Executive Yuan ministries and agencies formally coordinate and reach a conclusion, the JRF calls on police and investigative agencies to refrain proactively from obtaining such data for criminal investigation or crime prevention, thereby reducing public concern about contact-tracing measures and avoiding subsequent legal disputes. Prosecutors, in particular, should fulfill their role as "legal gatekeepers," observe their duty of objectivity, and strictly review both applications for and the subsequent execution of communications surveillance.

4. When issuing communications surveillance warrants, courts should instruct that contact-tracing SMS data may not be obtained

   As the last line of defense for rights, the courts should play an especially important role in protecting human rights during extraordinary times. The JRF calls on courts, when issuing communications surveillance warrants, to instruct the executing personnel not to obtain contact-tracing SMS data pursuant to Paragraph 2 of Article 5 of the Communication Security and Surveillance Act. If that restriction is violated, the warrant should be revoked pursuant to Paragraph 4 of the same Article.

   The state requires the public, under coercive measures such as fines, to cooperate with pandemic control by providing contact-tracing SMS data that can reveal a person's whereabouts in considerable detail; such cooperation is therefore not entirely voluntary. The data should not be used as evidence in support of detention or to prove guilt. Only if judges expressly prohibit their retrieval and use in judicial rulings can investigative authorities be effectively deterred from using the system to intrude on privacy and the data be confined to their original contact-tracing purpose.

In summary, the "1922 SMS Contact Tracing System" has been in operation for more than a month, yet its legal authorization, supporting safeguards, and legal effects remain unclear. As a result, judicial practice has allowed evidence to be used for purposes other than those originally intended through otherwise lawful investigative means. This is unlikely to be an isolated controversy; similar cases were reported earlier this month. As a judge who independently adjudicates according to law and safeguards the constitutional order, Judge Chang Yuan-Sen deserves recognition for speaking publicly and drawing the attention of government agencies and the public to the issue, while judicial practice should apply especially strict scrutiny. At a time of a severe domestic outbreak, Taiwan emphasizes acting ahead of the curve in pandemic control; the legal framework must keep pace so that pandemic-control measures themselves do not create new gaps.

Press Contact

Lu Cheng-Yen, Staff Attorney, Judicial Reform Foundation
02-2523-1178#37
elvin@jrf.org.tw