Court upholds first complaint over release of lists of self-isolating citizens: Government breached the right to privacy on a massive scale

Hundreds of cases are pending before courts across Montenegro, waiting for practice to be established and the grounds for one final judgement to be transposed to other cases. The state could face millions of euros in damages and legal costs for breaches of human rights.

By Ana Komatina

In March last year, the Montenegrin government violated the right to privacy of 76-year old Žarko Bošković from Bijelo Polje by publishing his personal data – including his name, surname and address – while he was self-isolating.

This is the first instance judgment rendered by the Basic Court in Bijelo Polje, which partially upheld Mr Bošković’s complaint – the first out of several hundred complaints that have been filed with Montenegrin courts over the past ten months for the very same reason.

The Bijelo Polje-based man sued the state, seeking a symbolic compensation of 200 euros. The first instance court ordered the Government to pay him half that amount by way of compensation for non-pecuniary damages due to the breach of the right to privacy and family life. His defence counsel announced plans to appeal against the decision.

The state could lose millions of euros in damages and legal fees as a result of publishing the lists of persons ordered to self-isolate. In July 2020, the Constitutional Court found that the Government had violated the right to privacy. Individual compensation claims, as Vijesti has learned, amount up to €3,000.

There is no precise information on how many people were on the lists released between 21 March, when the Government published the first names, and 7 May last year, when it removed the names from the official website. According to the Administration for Inspection Affairs, more than 10,000 people received a decision on mandatory self-isolation or quarantine between mid-March and 24 April. Human Rights Action (HRA), a Podgorica-based NGO, says the first list contained more than 1,000 names, adding that the identities of at least 2,000 people were published.

“Some sources claim that the list contained even more than 6,000 names,” HRA said, citing a text published by the ZDNet news website on 27 March last year entitled “This tiny country is posting the names and locations of quarantined citizens.”

The unlawful publication of personal data was also met with condemnation in the European Commission’s 2020 report on Montenegro. This, however, was not the only case of infringement of the right to privacy of citizens during the COVID-19 pandemic. In early April last year, a list with the details of 62 people from Podgorica infected with coronavirus, including their personal identification numbers, made its way into the public. So far only one employee of the Podgorica Health Centre has been charged on these grounds, only to be released in the first instance procedure in the meantime. Although the Basic Court noted in its judgment of acquittal delivered towards the end of last month that the Institute of Public Health had not processed the data in a lawful manner, none of those responsible from that institution and the Health Centre have been prosecuted for that.

Delays as courts are waiting for a model

As a result of the publication of the lists of names of people required to self-isolate, as confirmed to Vijesti, a total of 206 complaints have been filed with the Podgorica Basic Court to seek compensatory damages for past and future mental anguish, the violation of personal rights, the right to privacy, data protection rights and the right to respect for private and family life. The Bijelo Polje Basic Court has received 59 complaints, whereas the Basic Court in Bar is currently handling eight cases involving a total of 10 plaintiffs.

Having confirmed that one case (apparently the complaint filed by Žarko Bošković) has been concluded at first instance on 18 May with partial admission of the claim, the Bijelo Polje court president Radula Piper told Vijesti that there was a delay in the remaining 58 proceedings until a final and non-appealable decision has been rendered in the first case.

The Podgorica Basic Court told Vijesti that “most proceedings have been put on hold until the final conclusion of case No. 3757/20 before this court.”

This means that this court is also making use of the legal possibility to wait for case law to be established in order to obtain guidance on how to rule in other proceedings involving this matter, following the final conclusion of one case.

“If a large number of complaints have been filed with a court with claims based on the same or similar facts and involving the same legal basis, the court may, upon receipt of responses to the claims, conduct proceedings on the basis of one complaint and suspend other proceedings until a final and non-appealable judgment has been rendered in respect of the said complaint. After a judgment becomes final and non-appealable, the court shall apply the law in the same manner to suspended cases,” the Law on Civil Procedure says.

Attorney Maja Živković told Vijesti that the cases assigned to her are in their early stages, confirming that case law on this issue has not been established yet.

“There are three ongoing cases seeking compensatory damages for mental anguish resulting from a violation of personal rights, or more precisely from a violation of the right to privacy by publishing the name and address of a person who was in self-isolation, which took place in March 2020. I’m not aware of any case that has been finalized so far,” Živković said.

She specified that compensation claims range between €2,000 and €3,000.

“We still don’t know what position the court will take when it comes to amounts to be reimbursed if it finds the claims to be well-founded,” Živković explained.

Pješčić: I was treated worse than a criminal

“The decision of the Government to publish my name and address just before the end of my self-isolation period was a great burden to me. They made me feel like a walking contagion and a criminal, but also guilty because I came back to Montenegro to stay with my parents.”

This is how Milica Pješčić, a mathematics student at Belgrade University, recounts to Vijesti her experience of 13 months ago, when her details together with personal data of another several thousand people were posted to the Government’s website.

“This is to enable each citizen to know who of their neighbours and fellow citizens is putting them at risk due to their poor discipline,” the Government's wrote on Twitter.

Pješčić was among the first to decide to bring action against the state for violating the right to privacy, claiming that she suffered mental anguish as well due to the actions of the former government.

“I told people to gather up the courage and sue the state. Someone decided to play with human rights in the middle of a pandemic. Even if it is out of ignorance, there’s no excuse. A global problem was turned into a show, with many omissions. Our rights must not be infringed, even during a pandemic,” she said.

The outbreak of the coronavirus pandemic caught Ms Pješčić in Belgrade. As she was unemployed and given that a lockdown was introduced, she decided to return home to Nikšić for a while.

"For days, I inquired about the flight that was supposed to get us home. I went to the Montenegrin embassy several times only to be told that no transport options were available, even though people knew there would be a flight and made bookings a few days earlier. Two hours before the take-off, I got a call from the embassy saying that, all of a sudden, there was a flight. I didn’t even pack up – I left all my things in Belgrade and continued to pay the rent for another six months, as I didn’t have time to cancel it. I don’t understand how it was possible that they had no information. I only brought a sweatshirt and my books. I didn’t want to stay alone in Belgrade and spend my parents’ money, which is not easy to earn at all. I already suffered harm when I was leaving for Montenegro,” Pješčić told Vijesti.

She added that at Podgorica airport no one could make sense of the criteria that were used to decide who should be sent to quarantine and who should self-isolate.

“A man in a protective suit greeted us, asking if I had a fever or cough and if I was feeling well. I wanted to go home, as I didn’t have my clothes and other necessary stuff with me. An inspector handed me a decision on mandatory self-isolation. I took it, but I didn’t know who signed the document, because the signature was illegible. I spent the next few days alone in my room, without any contact. I followed all the prescribed measures,” said Pješčić.

On day 13, just before the expiry of the self-isolation period, her name, surname and address were published on the Government’s website.

"It really hurt me that someone was pointing a finger at me. I felt like a criminal and asked why the names of paedophiles, rapists and murderers were not made public. Why me, who came to stay with my parents?,” Pješčić recalls.

She felt, she says, guilty and unwelcome, claiming that the Government influenced her decision not to return to Montenegro after her studies.

“They did an injustice to us. They gave criminals a warmer welcome than they did to us, students from Montenegro,” she said.

Pješčić said that she had spent 28 days in self-isolation, as she was handed a new decision on two-week self-isolation just before the expiry of initial period.

"After 14 days, I wanted to get tested for coronavirus, even to pay if necessary. I called and begged, but they wouldn’t let me. It was neither possible for me to get tested, nor anyone could visit me and examine me. I wanted to stop self-isolating as soon as possible and begin treatment of a condition that had worsened due to anxiety and confinement. I didn’t want to sign the second decision, only to be told in the end that it would be regarded as having been handed to me, "she said.

She claims that her religious rights were also breached. In particular, on Easter day, which was the 28^th day of her self-isolation period, she felt the need to be, if not in the church, then at least with her family.

List of infected people emailed unlawfully

Following the leak of a list of names of 62 people infected with coronavirus, it is not known whether any of those citizens decided to take legal action against the state in addition to the criminal proceedings that have been brought against one person.

Last month, the Basic Court acquitted Rade Milović, an employee of Podgorica Health Centre, of unauthorized collection and use of personal data. He is suspected of sending information about coronavirus patients to third parties via Viber in the capacity of an official in charge of providing such data to chosen GPs.

In the judgment seen by Vijesti, the Podgorica Basic Court finds that it is not possible to tell how the list of infected persons reached the public, while also claiming that these data were previously shared with numerous people.

“The e-mail does not indicate that it contains personal data. Milović, who works in the IT department, was not obliged to know that the email contained personal data. Instead, he only carried out the order of his superior, which he – as stated by himself – would not have performed if he had known that such action would lead to criminal proceedings against him,” the judgment says.

The court found that a list of persons in self-isolation had previously been published on the Government’s website, as part of the “Let everyone know” campaign, which is why even those responsible for the processing of personal data would have been confused as to whether the list really represented personal data at the time or not.

“As stated in the letter from the Health Insurance Fund, under Article 4 of the Law on Data Collections in the Area of Health, the Institute of Public Health as the data collector had the possibility to send this list directly through the Health Centre’s system, instead of it being passed between, as was clearly the case, an indefinite number of persons, which is certainly not a lawful way of processing personal data,” the judgment says.

Mladen Tomović, Rade Milović’s defence counsel, told Vijesti that it had been proven beyond doubt that special categories of personal data were sent via e-mail outside the health information system, without any cybersecurity mechanisms and contrary to regulations.

He believes that the Law on Data Collections in the Area of Health, Law on Personal Data Protection, Rulebook on the method of marking and protecting special categories of personal data, Law on Information Security, Decree on information security measures and Rulebook on information security have been breached. He said that the Institute of Public Health and the Health Centre had done that even before such data were delivered to Milović.

Tomović believes that the said data, in case there was no current or permanent technical possibility for data exchange directly through the information system, had to be marked as “a special category of personal data” in all processing stages and be submitted solely to persons authorized to process such data, after which the data would be manually entered into patients’ health records in specially designated premises.

Tomović said that one of the most dangerous types of injustice is selective justice. None of the persons who ordered the publication of personal data on the Government’s website, or those responsible in the Personal Data Protection Agency who gave their authorisation, have been prosecuted for unlawful data processing, despite the fact that the Constitutional Court found the decision unlawful and ordered the lists to be removed from the website.

“On the other hand, this is an event that occurred due to a set of negligent circumstances caused by a lack of procedures and protocols, whereby one person is incriminated and prosecuted, which indisputably represents discrimination and selective interpretation of personal data protection regulations,” he concluded.

Only Montenegro and South Korea

In its 2020 report, the European Commission notes that the crisis caused by the COVID-19 pandemic further exposed the challenges relating to personal data protection, adding that a list of all persons subject to self-isolation was published upon a decision of the National Coordination Body (NKT – dissolved towards the end of last year) and positive opinion of the Agency for Personal Data Protection. The report also states that the list was subsequently used by private individuals to create a mobile application allowing users to locate those in self-isolation.

Such an example was unprecedented in European countries, which, just like Montenegro, are parties to the International Covenant on Civil and Political Rights and the European Convention on Human Rights.

In Belgium, Germany, Italy, Spain and France, GSM data (on mobile phone numbers) were used in order to know whether people who had been ordered into self-isolation or those infected stayed at home.

The Belgian weekly Le Vif compared Montenegro to South Korea, where the Corona 100m app was developed to alert people if they come within 100 metres of the location of a person infected with the virus.

“Koreans did not go that far as to publish the name, surname and address of infected people. A country much closer to us dared to do so: Montenegro,” Le Vif wrote in early April last year.

Ombudsman reacted at a later stage, breaches of journalists’ code of ethics 

Following the publication of the list of persons in self-isolation, the Ombudsman said that “there is no possibility for him to react” and that “he cannot interfere in the work of other independent and autonomous bodies”, referring to the Personal Data Protection Agency (AZLP).

Two months later, the Ombudsman requested Ministry of Public Administration to undertake a detailed inquiry into the case of the crnagorakorona.com website, so as to prevent unjustified interference with the personal data of individuals. It was then recommended that AZLP “in all future analogous situations should act proactively with its opinions and other types of action in order to prevent abuses of personal data, as well as to control the creation and use of similar websites."

By visiting the crnagorakorona.com web portal, it was possible to locate all people in Montenegro who were ordered to self-isolate, based on the list published by the Government.

Lists of persons in self-isolation were also published by certain print and electronic media. The news website of the national broadcaster RTCG still contains press releases from March last year stating that the NKT published an updated list of people in self-isolation, as well as links to the Government’s website. The same is true of the news websites of Pobjeda, CDM, Analitika, Antena M, Radio Jadran, Radio Skala, etc. Regulatory and self-regulatory bodies failed to react to these violations of the right to privacy.

Stigma costs €100?

Attorney Miloš Kojović, defence counsel of Žarko Bošković, whose complaint was the first to be considered by the Bijelo Polje Basic Court, told Vijesti that it was established in a proper and lawful manner that the Government had violated the fundamental human rights and freedoms of his client by publishing his details on its website.

“This includes both the right to privacy and the right to respect for private and family life. In this regard, the court ordered the Government to pay him €100 as fair compensation. We lodged an appeal in respect of such a decision, as we believe that €100 is not proportional to the stigmatization and intrusion by the general public which the plaintiff suffered. His mental state was impaired, given that this was the period when the epidemic reached its peak, with citizens fearing transmission,” said attorney Miloš Kojović.

The judgment, which was seen by Vijesti, states that the Government violated Bošković’s right to private life by publishing his name, surname, address and date of the decision on self-isolation. They did not accept the claim for damages that is higher than the one awarded, because Bošković said that he did not suffer any inconveniences arising from the list. Judge Almir Muratović claims in the judgment that the fact that the National Coordination Body for Infectious Diseases (NKT) decided to publish the list with the consent of AZLP did not affect the decision, nor did the Government’s claim that the goal was to protect public health.