Covid-19 and cyber security: averting cybercrime, safeguarding data and protecting people

            Maria Grazia Porcedda, Trinity College Dublin

 

At the onset of the pandemic several websites purporting to provide information on Covid-19 appeared overnight; while some aimed at spreading fake news, others intended to infect users, in cybercrime parlance, with computer viruses. This was an early sign of the wave of cybercrimes to come, as demonstrated by data published by the Central Statistics Office in June. Cyber offenders impersonated WHO officials and did not spare hospitals, which led European Commission President Ursula von der Leyen to publicly denounce the attackers. Europol was among the first organizations to issue early warnings against increased exposure to cyber attacks, which spanned the full gamut of cybercriminals’ modus operandi and stressed the importance of cyber security at a time of increased reliance on digital infrastructure. This blog discusses a number of the legal questions raised by the cyber security implications of learning and working from home, contact logging and tracing.

 

Increased risks when Learning and Working from Home

The sudden move of students and the workforce to online environments en masse offered abundant opportunity for cyber offenders, which led the National Cyber Security Centre to issue dedicated advice to support teleworkers – and arguably also their children. How many, however, will know and be able to implement the advice? Moreover, new platforms to work (and socialise) took hold perhaps too quickly for the adequate performance of due diligence; for instance, it was only after the many vulnerabilities and privacy-unfriendly settings were exposed that Zoom took steps to patch its software. The human is the weakest link in security, and a grounded and pressurised workforce can easily lower its guard online, thereby becoming vulnerable to attacks. According to the latest data released by the Central Statistics Office, for instance, account takeover frauds were up by +56% in Q1 2020.

 

A unified approach to cybercrime transposing Directive 2013/40/EU into Irish law only came into effect three years ago, thanks to the Criminal Justice (Offences Relating to Information Systems) Act 2017. Convictions for cybercrime take years to be reached and are notoriously low (a case in point being the UK CMA 1990), which questions the deterrent effect of the law. Under the circumstances, the need for prevention cannot be overstated. There is no overarching legal obligation to secure computer and information systems, though there are a number of provisions to this effect deriving from the patchwork of laws with cyber security import (also available here). Could the protection of the workforce from cybercrime be part of the obligations incumbent upon the employers to provide "equipment, tools, machinery and technology commensurate with the tasks" discussed by Desmond Ryan in his blog on Working from Home?

 

Incidents with reporting obligations

Cybercriminals stop at nothing, as shown by the attack suffered by research institutions developing a Covid-19 vaccine aimed at gaining access to intellectual property and attributed to APT29. Sometimes the protection offered by IT services is not enough, but workers’ home connection and personal devices may be even more vulnerable to offenders – whether they are after trade secrets or payroll data. Some of these incidents are subject to notification and reporting obligations, and the victim may pay dearly if such incidents happened as a result of their failure to implement adequate technical and organisational measures, as is the case with the GDPR and The Measures for a High Common Level of Security of Network and Information Systems Regulations 2018. Earlier this year Ireland ranked second in Europe for data breach notifications under the GDPR; this may simply mean that Irish firms are more compliant, but it should not be forgotten that Ireland houses data-intensive services. The likelihood that designated employees of Operators of Essential Services may work from home is low, but the scenario of cyber security breaches resulting from working from home is not. This raises important liability questions to be explored in further work by the Observatory.

 

Increased risks from data and technology-driven responses to Covid-19

Increased exposure to cybercrime may also derive from the attempts to log and trace contacts to ease pandemic lockdown. The first and foremost thought goes to contact-tracing apps Ongoing research from Stephen Farrell and Doug Leigh at Trinity has revealed that Google may be able to harvest data from the Irish app through Google Play Services. Their research uncovered issues with the Bluetooth standard which, for instance, reduce the efficacy of the contact-tracing app and expose it to replay attacks. Bluetooth is not immune to flaws. In August 2019 a team of researchers unveiled the Key Negotiation of Bluetooth, a vulnerability affecting the majority of devices supporting Bluetooth. Ars Technica reported that the weakness, which is invisible to Bluetooth apps and operating systems, allows “hackers to intercept keystrokes, address books, and other sensitive data sent from billions of devices”. Quickly released software updates allowed vulnerable systems to be patched, but this reminds us of the fact that ‘mobile devices’ are at least as insecure as other machines, and that whoever has access to the machine, whether legitimately or not, can jeopardise the security of the information stored therein. This could undermine the uptake of contact-tracing apps as well as, as Andrea Pin rightly notes, eventually prevent them from passing a proportionality test.

 

Technology is not the only source of risk, however. In an earlier post I suggested we need to pay attention to manual contact logging operations, which are currently taking place under the radar. The fact that the collection of these data do not adhere to data protection standards (and follow unclearly worded advice, discussed by Oran Doyle in several posts), may raise the risk of their improper disposal. This would be a treasure trove for potential offenders and worsen the tally recorded by the Central Office of Statistics for Q1 2020, whereby phishing (email)/Vishing (voicemail)/Smishing (text messaging) frauds were up by 45%.

 

Conclusion

Moving the bulk of learning and working activities online during lockdown was tied to the necessity of the moment and people willingly made the sacrifice. However, trust is as  important an ingredient for operating in cyberspace as it is for public life. In a recent Dáil Éireann debate, Minister Eamon Ryan was asked about “the level of preparedness of Ireland to protect against cyberattack”. A comprehensive response to the question needs to embrace defence and civilian matters alike. Students, workers (and employers) cannot be left to fend off cyber attacks on their own insecure devices and connections, and with unclear distributions of liability. This question is certainly bigger than the pandemic, though it may foster legislative responses that put the protection of users at the forefront.

 

Maria Grazia Porcedda is Assistant Professor of Information Technology Law at Trinity College Dublin. 

 

Suggested citation: Maria Grazia Porcedda, ‘Covid-19 and cyber security: averting cybercrime, safeguarding data and protecting people’ COVID-19 Law and Human Rights Observatory (31 July 2020)  https://tcdlaw.blogspot.com/2020/07/covid-19-and-cyber-security-averting.html

  

Return to home page of the COVID-19 Law and Human Rights Observatory.

 

 

Pandemic Unemployment Payment (PUP) Holidays Update

Mel Cousins, Trinity College Dublin

Things have been moving rapidly on PUP since my earlier blog. The PUP scheme has been put on a statutory basis in the Social Welfare (Covid-19) (Amendment) Act 2020 (the text of the Act is not yet available at the time of writing and will be outlined in a future blog). And the Minister for Social Protection has announced that recipients of jobseekers payments and PUP will be entitled to take holidays abroad in Green List countries (for up to 2 weeks) and retain their payment. Claims which were disallowed (apparently only 85) will be contacted. This has been described as a U-turn in the media but it is arguable that this is what the law actually provided for. So how did we get here?

Two things were going on. First, given that the PUP is payable to those ‘living in Ireland’, the Department of Social Protection (DSP) were attempting to control people who left Ireland to ensure that incorrect payments were not being made. This is a perfectly legitimate aim though how it was implemented will be discussed below.

Second, sometime in June, a decision was made to change the usual rules under which jobseekers were allowed to take 2 weeks holidays abroad. This was set out in Regulations (SI 142 of 2007) in the case of jobseeker’s benefit and on an administrative basis in the case of jobseeker’s allowance. Whether this was an internal decision or linked to broader government policy to discourage travel (e.g. rules in relation to payment of public servants) is unclear. Again, while one can agree or disagree with it, this was a perfectly legitimate decision but one which required a change in the existing rules.

On 30 June, as FLAC has shown, DSP issued a circular on the issue which purported to suspend travel abroad and to say that people who returned from such travel could not be considered to be genuinely seeking work (GSW) during the period of two weeks self-isolation. There were several problems with this. First, the circular purported to ‘suspend’ the provisions of SI 142 of 2017. Of course, a circular cannot amend a Ministerial Regulation. In addition, the question of whether somebody is GSW is a question of fact. Given on-line jobsearch and applications and Zoom interviews, it is perfectly possible for a person to be GSW even if self-isolating so the circular appeared to attempt to unlawfully fetter the discretion of deciding officers. In addition, there was initially no GSW requirement for PUP though one was introduced sometime in July. At best one could describe this change as lacking transparency.

On 10 July, Minister Humphreys amended the Regulations (SI 142 of 2017). She could have ruled out all travel abroad but did not do so. Instead the Regulations provided that jobseeker’s benefit would only be payable where the claimant is on holidays in accordance with ‘the Covid-19 General Travel Advisory in operation by the Department of Foreign Affairs’. At that time, DFA was advising against all non-essential travel abroad but this, of course, changed with the introduction of the Green List allowing travel to 15 countries.

Again with some lack of transparency as to when it happened, the rules of the PUP were changed to provide that ‘Holiday entitlements rules are the same as those for Jobseeker's Payments’. So, as set out in the earlier blog, this meant that people on PUP could also go abroad to Green List countries.  However, the Department appeared to interpret its own rules (incorrectly) as meaning that no travel abroad was possible.

When the issue broke in the media, the Government and Department obfuscated for a number of days failing to explain what it was doing, why or what the legal basis was. It introduced legislation to put PUP on a statutory basis which is a welcome measure. In the course of Oireachtas debates, the Minister now claimed that PUP was a supplementary welfare allowance payment under s. 202 of the Social Welfare Acts which allows payments in urgent cases. This came as a surprise to many people including, one assumes, whoever wrote the Departmental brief for the Minister where this is never mentioned and the authors of the Revised Estimates where PUP is shown separately to ‘urgent payments’.

As noted above, the Minister has now accepted that payments may be made to people travelling to Green List countries.

The remaining issue (which affects all those leaving the country) is the basis on which DSP obtains information as to their departure. This appears to be from social welfare inspectors questioning people in Dublin airport and other ports. The basis for this is s. 250(16B) of the Social Welfare Acts but, as several commentators have noted, this requires the inspector to have 'reasonable grounds to believe that there has been a contravention of this Act'. This would seem to rule out a general ‘stop and search’ of persons travelling through Dublin airport. However, given that about 2,500 cases have been identified, the Department might argue that it has reasonable grounds to believe that particular flights will include people who are contravening the Act. Whether this would stand up in court may be more debateable. The Data Protection Commission has now expressed "serious doubts" over the lawfulness of the collection of personal data in this manner.

There have been suggestions in the media that information must have come from other sources. If this was shown to be the case, this would be likely to raise further issues including (possibly) data protection issues. It is understood that the Data Protection Commissioner has requested further information on the issue.

DSP has carried out trojan work to put in place the PUP and to ensure that up to 600,000 people got paid. Control work is an essential part of putting in place such a payment. It is, therefore, unfortunate, that its image should be tarnished by, what might appear, a relatively small issue. As Albert Reynolds said, it’s the little things that trip you up.

But in another sense, this is not a small issue and raises concerns that the Government and DSP do not adequately appreciate the importance of the rule of law and transparency in the implementation of social services.

 

Mel Cousins is a visiting research fellow at the School of Social Work and Social Policy in Trinity College Dublin and a member of the COVID-19 Law and Human Rights Observatory.

Suggested citation: Mel Cousins, ‘Pandemic Unemployment Payment (PUP) Holidays Update’ COVID-19 Law and Human Rights Observatory Blog (31 July 2020) https://tcdlaw.blogspot.com/2020/07/pandemic-unemployment-payment-pup.html

Return to home page of the COVID-19 Law and Human Rights Observatory. 

Fighting Fire with Fire? The Judicial Review of Anti-Pandemic Measures

 Andrea Pin, University of Padua

 

Many purportedly anti-Covid-19 measures have understandably raised academic eyebrows. Among such measures are emboldened executive powers, the suspension of constitutional guarantees – the states requesting the suspension of the European Convention have reached the unprecedented number of ten – or the deployment of highly sophisticated technological tools to trace contagion. Responses among constitutional law scholars have been mixed: while some have voiced their preoccupations for the survival of the rule of law, others have taken a more pragmatic approach, finding obvious theoretical leverage in Carl Schmitt’s theory of exception.

As most of today’s legal controversies end up in courts, it seems easy to predict that waves of litigation revolving around anti-Covid-19 regulations will flood many courtrooms. The measures deserving judicial scrutiny comprise both explicit limitations on fundamental freedoms or alterations of the separation of powers, and subtle regulations that exploit technological capabilities.

Cases about explicit freedoms’ limitations and the separation of powers are of utmost concern, as they touch upon the fundamentals of constitutional states. It seems safe enough to say, however, that courts are probably well equipped to address those issues: they can rely on libraries of constitutional theory, distilled constitutional texts, and ruminated judicial doctrines. Even courts embracing pragmatism should be able to distinguish between unacceptable legal solutions and acceptable deviations from the ordinary, or to put time constraints to such deviations, forcing the political branches to go back to normal mode as soon as possible. It is not guaranteed that the judiciary will be able to deter threats to the rule of law and secure the protection of fundamental rights; but courts certainly have what is necessary to pursue such goals.

Cases revolving around the deployment of technological devices are less straightforward. Until a vaccine is found and inoculated within the vast majority of world’s population, technology will help us control the pandemic. Thermal scanners, contact tracing apps, and urban data processing are only some of the means that allow people to live, work, study and socialise reasonably safely under the pandemic, and therefore are expected to stay with us for a long time, while strong, visible alterations of balances of powers and of fundamental freedoms – such as the freedom of movement – hopefully need to be only momentary. Deciding what technologies can do for us while we wait for a vaccine, and even when we can transition from physical distancing to technological distancing, cannot be easy, as courts will have to address several thorny issues that are at least partly new. What follows is a bird’s eye view of some of the most relevant theoretical problems that judges will face.

 

AI’s black box

Smart technologies increasingly embed artificial intelligence and use deep learning processes. They can process vast amounts of data through extremely complicated neural networks that imitate the human mind. Software can thus make inferences and guesses in ways that are not fully transparent even to software developers. Public policies that are based on this type of analysis therefore rely on arcane processing that is partly beyond human comprehension. Even in legal systems that accept only open access software or in which intellectual proprietary rights cannot limit judicial review, understanding how AI came to recommend a certain policy can be extremely difficult also for experts.

 

The expertise

If life in a pandemic has proved extremely complicated for individuals, developing sound public policies is exponentially more difficult. Deciding lockdowns, what they should consist of, when to lift them and under which conditions has required political branches to ask for help from a variety of experts. Physicians, data scientists, epidemiologists, psychologists, sociologists and statisticians are only some of the figures that governments around the globe have interacted with. This has happened virtually everywhere that a political decision impinging on fundamental rights has been made; but technological expertise adds a layer of complexity, as it relies upon the wisdom of largely inscrutable AI.

Exploiting such a wealth of expertise has given governments’ policies a veneer of rationality, but certainly not of transparency or democratic legitimacy. Actually, the political scenario has sensibly shifted. Political leadership has increasingly been measured with its responsiveness to the experts’ input; or, to put it in more cynical terms, political leaders have found in the experts’ support a convenient justification for their policies. It is not by chance that political polarization in several countries has taken the shape of a triangle, with politicians on one side, the people on another, and the experts on the third.

What happens when expertise goes to court? First, experts often focus on the efficacy of a certain policy. They therefore embrace a consequential approach, which considers the relationship between the goal and the success of a measure. This is a point that will be relevant later, when we consider styles of judicial scrutiny.

Second, expertise may not help AI become transparent. As technologies often embed black boxes, software experts may not be in the position of fully explaining a software’s diagnosis or prediction. Data scientists’ trial examinations do not replicate the old-fashioned experts’ explanations of the results of a polygraph. AI experts can explain how software works and the dataset that has been used; they can hardly explain exactly why a software delivered a certain output.

 

The types of scrutiny

Given the variety of technological solutions available and of their performance, judicial approaches should be able to compare their efficacy and their interference with fundamental rights. Courts will likely have to decide whether a certain digital solution outperforms the others, its benefits prevail over its downsides, and the balance it strikes among competing interests is preferable to other available options.

Such requirements seem to suggest that courts will make extensive use of proportionality analysis, especially in its four pronged-form. The four steps-proportionality test essentially analyses i) whether a measure is justified by a legitimate goal; ii) if such a measure concretely pursues its goal; iii) if it does so in the least disruptive way for the other interests involved; iv) if the measure’s benefit outweighs its damages to other interests. This multi-step process avoids justifying any means with ends, as the consequential approach would probably suggest (step i); it allows drawing from scientific expertise (steps ii and iii); and carves out room for political discretion, which can weigh benefits and damages after gathering scientific evidence (step iv).

Among the advantages of proportionality analysis is its concrete approach. When circumstances or evidence change, a new judicial assessment can replace the previous one. For example, although a tracing app can be useful to police the contagion, if the app is not sufficiently downloaded or activated and cannot work, then its deployment can be deemed unlawful as it invades individual privacy with no substantial benefit.

Conclusion

Contemporary democracies face a historical dilemma. Various types of expertise now provide public institutions with a reputation of rationality and reliability. They are, however, scarcely comprehensible to the majority of the population. Within the tech area, even experts must rely on opaque software performances. Adjudicating anti-pandemic measures that include technologically advanced policies therefore seems to mean much more than balancing competing needs. It also means being able to process multiple narratives and rely on a variety of sources coming from a variety of disciplines. It even encourages us to reconsider the role of the judge vis-à-vis other forms of expertise. Proportionality analysis can hardly overcome these difficulties, but can probably shape an ordered process to handle them.

 

Andrea Pin is Associate Professor of Comparative Law, University of Padua and Senior Fellow of the Emory Center for the Study of Law and Religion.

 

Suggested citation: Andrea Pin, ‘Fighting Fire with Fire? The Judicial Review of Anti-Pandemic Measures’ COVID-19 Law and Human Rights Observatory Blog (29 July 2020) http://tcdlaw.blogspot.com/2020/07/fighting-fire-with-fire-judicial-review.html

 

Return to home page of the COVID-19 Law and Human Rights Observatory.

Divergent Legal Responses to Covid-19 in Central and Eastern Europe

 

Beatrice Monciunskaite, Dublin City University

  

In the last decade, Hungary and Poland have continued to attract international attention for their drastic departure from the rule of law and democratic principles. Now, observers are criticising these countries for using the COVID-19 pandemic as an excuse to further entrench their political power. In Hungary, Prime Minister Viktor Orbán used legislation intended to deal with the health crisis to further centralise political power in the executive, while in Poland, the government used lockdown measures to their advantage in the Polish presidential elections, resulting in another victory for President Andrzej Duda. 

 

However, not all legal responses to COVID-19 in Central and Eastern Europe have been characterised by authoritarian power grabs. In Latvia and Lithuania, the story is very different, where bona fide attempts to preserve the economy and public health have been accompanied by considerable care to not seem overly authoritarian. As part of a joint statement, Lithuania and Latvia declared that legal measures taken in response to COVID-19 should be “limited to what is strictly necessary, should be proportionate and temporary in nature [and] subject to regular scrutiny”.

 

On March 11^th, Hungary declared a ‘state of danger’ under Article 53(1) of the Hungarian Constitution, which allows the government to adopt appropriate legal measures in the event of a natural disaster. Pursuant to this, the most controversial legal measure adopted so far, the Coronavirus Defence Act, came into effect on 1^st April.  This Act removed the time limit for emergency measures—fifteen days unless the government, with parliamentary permission, extends them—meaning that the government can rule by decree. The only remaining safeguard against abuse of power is judicial review by the Constitutional Court, but with the Court now packed with Fidesz loyalists, this safeguard lacks teeth.

 

In Poland, rather than declaring an emergency under the Constitution, the government used legislation to combat COVID-19. Article 31(3) of the Polish Constitution does allow for the limitation of human rights in the absence of an emergency as long as measures follow proportionality rules. However, this choice of means has proven controversial. Article 232 of the Constitution provides that an emergency may be declared in the event of a natural disaster, which is arguably applicable to the health crisis Poland faces now. The government insists it is avoiding an emergency declaration as they do not want to encroach on human rights, but observers have suggested that this choice is more likely the result of a political calculation.

 

An emergency declaration under the Polish Constitution would have postponed the May presidential elections until ninety days after the emergency ceased. This would have been an inconvenience for the ruling Law and Justice government, which sought to benefit from indications that their candidate, President Andrzej Duda, was an early favourite to win. Furthermore, as President Duda was still in office he was allowed to engage in televised self-promotion under the façade of performing presidential duties. The rest of the candidates were banned from campaigning due to social distancing restrictions.

 

Lithuania, similarly to Poland, chose to regulate COVID-19 through legislation rather than a constitutional state of emergency. However, rather than avoiding apt constitutional provisions for political gain, Lithuania’s choices seem to be justified.

First, Article 144 of the Lithuanian Constitution provides that a state of emergency may be called when there is a threat of a constitutional crisis or civil unrest. There is no provision to deal with a natural disaster. In late February, the Lithuanian government adopted Decree No. 152 which declared an extreme situation under the Law on Civil Protection. The government adopted the position that COVID-19 was not an immediate threat to the constitutional order or peace, so a declaration under Article 144 would have been inappropriate. The government’s decision was challenged by the parliamentary opposition and sent to the parliament’s legal department, which confirmed that the government’s response was indeed correct. In mid-March, the Lithuanian government introduced Decree No. 207 which introduced quarantine in Lithuania under the Law on the Prevention and Control of Communicable Diseases in Humans. With no mass protests, and the virus in check, the government’s decision is proving to be the correct one.

Second, the government has a sufficient constitutional mandate to limit certain constitutional rights to protect public health. Constitutional rights such as the freedom of movement under Article 32 and freedom of assembly under Article 36 were limited by Decree No. 207. However, the textual protection of these rights allows for their limitation by law in the interest of public health. Article 53 of the Constitution further confers a duty on the State to protect the health of the people.

Third, for the most part, Decree No.207 conformed to the rule of law. There were no attempts by the government to remove time limitations on emergency powers or expand government competencies. Decree No.207 was implemented on 16^th March and extended five times by the parliament until the 16^th of June. It was replaced by Decree No. 588 which ended quarantine and introduced a less stringent regime.

 

Fourth, some commentators argue that the Lithuanian government did have discretion in deciding whether to deal with COVID-19 through legislation or the constitution. However, with a general election looming in October 2020, the ruling Peasants and Greens Union seemed extremely wary of imposing a constitutional emergency due to the connotations this would have with authoritarianism. The Lithuanian polity might be unnerved by an emergency regime, as seen under the rule of Antanas Smetona in the interwar years or their recent history of Soviet occupation. It is very interesting to see that the Lithuanian government may have had an opportunity of a power-grab, but they refrained from taking it and even avoided the appearance of taking it.

The Latvian Constitution also does not provide a provision to deal with an emergency caused by a natural disaster. An emergency under Article 62 of the Latvian Constitution may be declared if there is a threat of an “external enemy” or an “internal insurrection”. Therefore, the Latvian government also dealt with COVID-19 through ordinary law. On 18^th April, the Latvian parliament introduced an amendment to the main law governing the emergency situation to allow the state of emergency to be renewed repeatedly, once parliament consents. Previously, the state of emergency could be declared for a maximum of three months, with the possibility of a further three months extension. Considering that medical experts are warning that a second wave of infection may be inevitable, this change seems necessary.

Latvia’s President, Egils Levits, has suggested resurrecting Article 81 of the Latvian Constitution, which allowed the government to enact emergency legislation between sittings of the parliament that could be later approved by parliament. This was removed in 2007 for fear of abuse. For now at least, the resurrection of this provision is unlikely as there is little enthusiasm for it.

 

While so much scholarly attention is cast on Hungary and Poland for their violations of democratic and rule of law values, nearby countries have a very different story. Although the pandemic creates opportunities for a power-grab in Lithuania and Latvia, these countries still hold on to rule of law and democratic principles.

 

Beatrice Monciunskaite is a PhD candidate at the School of Law and Government, Dublin City University.

 

Suggested citation: Beatrice Monciunskaite, 'Divergent Legal Responses to Covid-19 in Central and Eastern Europe' COVID-19 Law and Human Rights Observatory Blog (27 July 2020) https://tcdlaw.blogspot.com/2020/07/divergent-legal-responses-to-covid-19.html

Return to home page of the COVID-19 Law and Human Rights Observatory.

 

Pandemic Unemployment Payment: Holidays in the Sun?

Mel Cousins, Trinity College Dublin

Recent reports have indicated that the Department of Social Protection (DSP) has sanctioned over 100 persons in receipt of the Pandemic Unemployment Payment (PUP) who took holidays abroad. A spokesperson for DSP stated that the PUP is ‘not paid to people who go on holidays abroad or when they are going through their subsequent 14 day quarantine (sic.) period’.

The Minister for Social Protection has focussed in interviews on the rationale for this approach, i.e. that the State should not subsidise people who are in breach of public health advice. However, this blog raises the question as to the legal basis for the DSP action.

Unlike most social welfare payments, PUP is based on an (unpublished) administrative scheme. Thus the normal rules in relation to claims, payments, decisions, appeals, etc. set out in the Social Welfare Acts do not apply. However, this does not mean that the scheme can be operated on an arbitrary basis and the normal rules of administrative (and human rights) law apply.  So the question arises as to what is the legal basis for the decision not to make payments to people on holidays and on their return?

The short answer to the question is that DSP does seem to have a legal basis for non-payment of PUP to persons who travel to countries not on the Green List from 10 (or possibly 27) July 2020. There does not appear to be a clear legal basis for refusing PUP to persons during a period of self-isolation.

A number of bases for non-payment might be suggested. First, in order to qualify for the payment, a person must ‘live in the Republic of Ireland’.  This is not a term found in general social welfare law. However, social protection cases in the UK have indicated that it is possible to be temporarily absent without ceasing to live in a country. There is also a challenge to a refusal of PUP ongoing in the case of a Romanian/Moldovan national who claims to live in Ireland but who says he was temporarily absent at the time he lost his employment. It would seem unlikely that the ‘live in’ Ireland rule could constitute a basis for non-payment on holidays.

Second, it has been suggested that PUP claimants are required to be genuinely seeking work. This is indeed on normal requirement for statutory unemployment payments. However, this requirement did not feature in the description of the PUP initially on the DSP website and appears to have been added only as of July 2020. Given this condition, it may be reasonable to conclude that a person abroad on holidays will not normally be GSW. However, it is less clear that a person self-isolating who can search for work and apply for work online and, if necessary, attend an online interview would not be GSW in that period.

A third basis for non-payment is that the scheme could simply provide that it is not to be paid abroad or during a period of self-isolation in line with official public health advice. It would appear that this is, in part, the actual basis for non-payment (albeit one not clearly communicated in the media to date). The current (27 July) scheme states that ‘Holiday entitlements rules are the same as those for Jobseeker's Payments’.

The Social Welfare Acts provide that jobseekers allowance and benefit are not payable where a person is ‘absent from the State’ but, in the case of jobseekers benefit, this is relaxed by Regulation to allow limited holidays abroad. However, on 10 July, the Minister made Regulations which provide that, in the context of the grave risk to human life and public health posed by Covid-19, jobseeker’s benefit will only be payable where the claimant is on holidays in accordance with ‘the Covid-19 General Travel Advisory in operation by the Department of Foreign Affairs’.

The DFA Travel Advisory remains to ‘avoid non-essential travel’ to most countries. However, following the Government’s adoption of a Green List, DFA now advises ‘normal precautions’ in relation to the 15 countries on the Green List. So it would appear that people on JSB and, in line with the approach set out above, people on PUP would be entitled to travel to the 15 Green List countries for holidays.

This rule would allow refusal of PUP during holidays abroad in any other (non-Green List) country. However, it would not appear to provide any basis for refusing PUP to a person during the self-isolation period in Ireland. Finally, this leaves open the question as to what ‘essential’ travel involves. The Minister for Social Protection has indicated that her Department will consider cases where a person has travelled for essential reasons.

The legal change to JSB was made as of 10 July. It is not clear when exactly the change was made to the PUP conditions although it has been made as of 27 July. Principles of administrative law would not seem to allow persons to be disqualified for a benefit on the basis of a rule which had not yet been made or of which they were unaware so the rule concerning non-payment of PUP abroad would seem to apply somewhere between 10 and 27 July (whenever it was actually made and notified to claimants).

(It should be noted that the DSP website currently states that ‘At present, holiday periods permitted for Jobseeker's payments have been suspended. Jobseeker's payments will not be made to anyone who travels abroad.’ This does not appear to be an accurate statement of the legal position.)

The PUP has now been extended to April 2021. Its initial operation on an administrative basis had several advantages including speed and flexibility. However, the disadvantages of operating a large system of payments on the basis of an unpublished scheme are apparent from this issue. It would seem desirable to move more quickly to transition claimants to the general statutory schemes and/or to put PUP on a statutory basis so that the normal rules (and appeals procedures) apply.

Mel Cousins is a visiting research fellow at the  School of Social  Work and Social Policy in Trinity College Dublin and a member of the COVID-19 Law and Human Rights Observatory.

Suggested citation: Mel Cousins, 'Pandemic Unemployment Payment: Holidays in the Sun?' COVID-19 Law and Human Rights Observatory (28 July 2020) https://tcdlaw.blogspot.com/2020/07/pandemic-unemployment-payment-holidays.html

Return to home page of the COVID-19 Law and Human Rights Observatory.

Quarantine after international travel: legal obligations, public health advice, pervasive confusion

Oran Doyle,  Trinity College Dubin

Restrictions on international travel have received much public attention over the past few weeks. On Wednesday 22 July, the Government published a green list of countries in Europe with relatively low prevalence of COVID-19. Anyone arriving from those countries, the Government says, will not have to restrict their movements on their arrival in Ireland. The Opposition strongly criticised (€) this decision for undermining the Government’s advice against non-essential travel. The Sunday Times reported (€) yesterday that Ryanair has written to the Taoiseach threatening an injunction and judicial review if the government does not revise its list of lower-risk countries to include popular travel destinations such as Britain, France, Spain and Germany.

Although coming from opposite perspectives, the criticisms from both the Opposition and Ryanair highlight the same fundamental confusion surrounding the Government’s position, namely that there is no legal obligation on any international passengers to quarantine or restrict their movements after their arrival in Ireland.

SI 181/2020 Health Act 1947 (Section 31A -Temporary Requirements) (Covid-19 Passenger Locator Form) Regulations 2020 was made by the Minister for Health on 24 May 2020. The initial expiry date for the Regulations was 18 June 2020. This was extended first to 9 July 2020, then to 20 July 2020, and most recently to 10 August 2020. There has been no change to the substance of the Regulations since they were initially made in May 2020.

The core obligations in the Regulations are for international passengers (with some exceptions), on or before their arrival in the State, to complete the COVID-19 Passenger Locator form in respect of themselves or any children and give the form to an immigration officer. The form seeks information about how international passengers arrived in the State and details of their place of residence for the following 14 days. If they change their place of residence or contact details, they must make reasonable efforts to provide this updated information in writing. They must comply with any request from an immigration officer or member of the HSE COVID-19 Contact Management Programme to provide information or documentation to verify and clarify the particulars in the form or, after their arrival, to confirm where they are actually residing.

These obligations are deemed to be penal provisions, meaning that their breach can be punished by a fine of up to €2,500 and/or a term of imprisonment of up to six months. Also, a garda can direct the passenger to comply with the obligations; failure to comply is punishable in the same way.

The Government’s most recent decision is that passengers arriving from 15 European countries with a relatively low prevalence of COVID-19 do not have to restrict their movements. Passengers arriving from other countries are ‘asked to restrict their movements for 14 days’. This wording reflects the legal position, namely that there is no obligation in the Regulations on international passengers to restrict their movements; they are only requested to do so.

The HSE website is much more strongly worded, stating that if you arrive into Ireland from a location that is not on the green list ‘you will have to restrict your movements for 14 days’ or—on another page of the website—that people arriving from overseas will ‘need to restrict their movements for 14 days’. This follows the HSE’s general approach, noted several times on this blog, of escalating language so that public health advice takes on an apparently compulsory character. The HSE website explains ‘restrict your movements’ as meaning to stay at home and avoid contact with other people and social situations as possible: not using public transport, visiting others, meeting face-to-face with anyone at higher risk from COVID-19, going to the shop unless absolutely essential.

In summary, the only legal obligations on international passengers are to provide, confirm, and update information about where they will be or are residing. There is no legal obligation to restrict movements. There is public health advice to restrict movements unless arriving from one of the ‘green list’ countries. The HSE presents that public health advice in mandatory terms, but the Government is more careful not to present the advice as obligatory.

In this light, it is rather difficult to discern from yesterday’s newspaper report precisely what Ryanair intends to challenge. Solicitors for Ryanair took issue with the fact that the Government’s restrictions have been put in place on a non-statutory basis. They claimed the government’s travel restrictions had not been subject to the democratic safeguards, checks and balances inherent in ‘the constitutionally mandated process of law-making provided for under the constitution’. But the ‘constitutionally mandated process of law-making’ is only mandated for making laws. The restrictions with which Ryanair takes issue are not laws, but advice. There is no constitutional basis for any obligation on the Government to adopt legislation rather than advice.

Could Ryanair claim that it had property rights interests that were affected by the Government’s advice, triggering some sort of fair procedures obligation for the Government? This would be an ambitious argument. Clearly there is an effect on Ryanair’s business if people follow Government advice about international travel. But this seems too attenuated to generate any legal obligation on the Government formally to seek Ryanair’s views before issuing its advice. Thousands of businesses have been adversely affected by citizens following public health advice during the pandemic. Can it credibly be said that the Government was under a legal obligation to consult all of them prior to issuing the advice?

Nonetheless, there remain serious rule of law concerns with the HSE’s willingness to present public health advice in mandatory terms. It disrespects individual autonomy to blur the distinction between what is legally obligatory and what is merely advised. This presentational practice has occurred, however, across so many aspects of the state’s response to COVID-19 that it must be viewed as a deliberate strategy. It is a dangerous strategy that sows confusion and over time is likely to diminish public trust in important public health messages.

 

Oran Doyle is a professor in law in Trinity College Dublin and director of the COVID-19 Law and Human Rights Observatory.

 

Suggested citation: Oran Doyle, 'Quarantine after international travel: legal obligations, public health advice, pervasive confusion' COVID-19 Law and Human Rights Observatory Blog (27 July 2020) https://tcdlaw.blogspot.com/2020/07/quarantine-after-international-travel.html

Return to home page of the COVID-19 Law and Human Rights Observatory.

The information provided in this document is not legal advice or professional advice of any other kind, and should not be considered to be such, or relied or acted upon in that regard. If you need legal or other professional advice, you should consult a suitably qualified person.