Protection for Privacy under the United Nations Convention on the Rights of Persons with Disabilities

Abstract

Article 22 of the Convention on the Rights of Persons with Disabilities (CRPD) protects personal and family privacy and reputation. This paper examines the antecedents of the CRPD privacy article in other international instruments and selected domestic law. It traces the history of the article through the deliberations that led up to the final version of the CRPD, which has now been ratified by 173 nations. It analyzes the text of the article and discusses its limited administrative and judicial applications. Finally, it describes the article’s place in current thinking about disability human rights.

1. Introduction

Article 22 of the Convention on the Rights of Persons with Disabilities (CRPD) protects personal and family privacy and reputation. Article 22 reads:

Respect for Privacy

1. No person with disabilities, regardless of place of residence or living arrangements, shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence or other types of communication or to unlawful attacks on his or her honour and reputation. Persons with disabilities have the right to the protection of the law against such interference or attacks.

2. States Parties shall protect the privacy of personal, health and rehabilitation information of persons with disabilities on an equal basis with others1.

(UNGA 2006)

International Human Rights Law protections for privacy are generally thought to include privacy of personal information, privacy of communications, privacy of personal environment, such as one’s dwelling and other personal spaces, and freedom from attacks on personal honor or reputation (UMHRC 2012). United States Supreme Court Justice Louis Brandeis described privacy—in his words “the right to be let alone”—as the “most comprehensive of rights and the right most valued by civilized men.”2 A recent commentary on data privacy states: “The values thought to be protected by privacy…include physical security, liberty, autonomy, intimacy, dignity, identity, and equality” (Francis and Francis 20143, p. 2 of 25). Privacy is a value in itself, and its protection furthers other values that human beings cherish (Wachter 2017).

2. Relation to Other International and National Privacy Protection Regimes

The privacy article of the CRPD aligns closely with privacy protections in other international human rights instruments; those instruments served as inspiration for the CRPD provision (United Nations Ad Hoc Committee n.d.a). The International Covenant on Civil and Political Rights states: “(1). No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. (2). Everyone has the right to the protection of the law against such interference or attacks.” (UNGA 1976). The language of the Universal Declaration of Human Rights is similar (UNGA 1948).4 The Convention on the Rights of the Child states: “(1). No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation. (2). The child has the right to the protection of the law against such interference or attacks.” (UNGA 1990a). The Convention on Migrant Workers provides: “No migrant worker or member of his or her family shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home, correspondence or other.” (UNGA 1990b). Various regional and other instruments also protect a person’s private information and reputation (ICRC n.d.). The CRPD itself, in its article on statistics and data collection, requires that state parties will collect appropriate information to implement policies in accordance with the Convention, but in collecting and maintaining the information state parties must obey safeguards to ensure confidentiality and respect for the privacy of people with disabilities.5

The connection between the CRPD’s privacy article and the terms of the other human rights instruments distinguishes the CRPD’s treatment of privacy from its treatment of some other rights. The point has been made that although the United Nations’ own materials on the CRPD stress that it does not create new rights and instead applies existing rights in a way that responds to the situation of persons with disabilities (Kayess and French 20086, p. 20), in fact the treaty does contain new rights for people with disabilities, for example, rights to research and development (Article 4), raising of awareness (Article 8), poverty reduction and economic security (Article 28), and other entitlements not found or not expressed as affirmative rights in other pacts (Kayess and French 2008, pp. 32–33). The privacy article only modestly expands on the language found in other instruments. The consistency of the language, however, should not be taken to mean that the article requires mere formal equality of treatment between people with disabilities and others, as discussed at greater length in Section 6, below.

Many regional and national legal regimes afford protection for privacy rights. The European Convention on Human Rights guarantees privacy (Council of Europe 2010). A celebrated recognition of privacy in European Union law is the “right to be forgotten” case, Google Spain SL v. Agencia Española de Protección de Datos (Google v. Spain), in which the European Union Court of Justice ruled that European citizens have the right to request search engine firms that gather personal information for profit to remove links to private information if the information is no longer relevant (The Court (Grand Chamber) 2014).7 The court relied on European Union Directive 95/46, implementing Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. It ruled that Google may be forced to de-link its search engine from personal information searched for by a person’s name even when the information is true and was lawfully published. The court required a balancing of the conflicting interests of the subject of the information and the general public.8

National privacy legislation is found in many places. For example, Argentina enacted a wide-reaching Personal Data Protection Act in 2000.9 New Zealand’s Privacy Act establishes principles for the collection, use, and disclosure of individuals’ information by private and public agencies, as well as access by the individuals affected to the information held by the agencies.10 Sweden’s Personal Data Act protects people against violation of personal integrity when personal data is processed.11 Privacy protections exist in Canadian law, although the position has been advanced that existing domestic law is insufficient to protect against employer misuse of genetic information (Labman 2004). In the United States, constitutional protections exist against unreasonable searches by government actors12 and many legal sanctions exist for nongovernmental intrusions into individuals’ privacy (Dobbs 2000). In U.S. constitutional law, privacy concepts are closely linked to bodily autonomy and fundamental rights to make decisions about sexuality,13 medical treatment,14 abortion15 and other matters,16 free from government prohibitions. The idea of privacy rights being connected with rights to bodily autonomy surfaced in the comments of a number of contributors to the drafting of Article 22.

As with other aspects of the CRPD, any overlap with other international human rights instruments and national legislation does not diminish the need for particularized protections for individuals with disabilities, given the unique nature of much disability discrimination. In the words of one commentator, “the reality of persons with disabilities’ rights experience in most contexts is more complex than simply outright denial. Even when their entitlement to rights has been formally recognized and uncontentious, their disability has often effectively excluded them from rights enjoyment.” (Mégret 2011, p. 263).17 The CRPD provides a means to challenge the barriers to the realization of basic human rights for persons with disabilities.

3. The History of Article 22

During the Second Session of the Ad Hoc Committee on the Convention in 2003, the Secretary General appraised the World Programme of Action, acknowledging advances in medical research, genetics, and biotechnology, and discussing implications for the privacy rights of individuals with disabilities (United Nations Ad Hoc Committee 2003a).18 The Second Session also considered a letter from Morten Kjaerum, the Executive Director of the Danish Institute for Human Rights concerning the “concept of autonomy” (United Nations Ad Hoc Committee n.d.b). The letter pointed out that autonomy rights include: “[1.] right to personal development, to create ideas and goals for life; [2.] right to privacy; [3.] right to integrity, liberty and freedom from coercion; [4.] right to inclusion in community life; and, [5.] right to participate actively in political process” (United Nations Ad Hoc Committee n.d.b). The letter went on to state: “Issues of privacy are also highly relevant for persons with disabilities whose dependence on technical and personal aids may lead to situations of vulnerability” (United Nations Ad Hoc Committee n.d.b). The Bangkok delegation referred to respect for privacy in its initial proposals for the Convention (United Nations Ad Hoc Committee 2003b). The delegation’s discussion mentioned the link between respect for private and family life, freedom of expression, and the right to sexuality for individuals with disabilities.

Following the Second Session, the Ad Hoc Committee established a Working Group. The Working Group’s proposed text included an article establishing protection for privacy, home, and family. The portion of the text relating to privacy and reputation was close to what would become the final wording of Article 22:

1. Persons with disabilities, including those living in institutions, shall not be subjected to arbitrary or unlawful interference with their privacy, and shall have the right to the protection of the law against such interference. States Parties to this Convention shall take effective measures to protect the privacy of the home, family, correspondence and medical records of persons with disabilities and their choice to take decisions on personal matters.

(United Nations n.d.)

The Working Group suggested that the Ad Hoc Committee consider replacing the word “correspondence” in the first paragraph with the broader term “communications.” (United Nations n.d.).

Various Working Group participants submitted commentaries and proposals concerning the privacy language to be included in the Convention (Martin and Lachwitz n.d.). Great Britain suggested protecting privacy under a provision covering autonomy in general (Martin and Lachwitz n.d.). The United States highlighted the need for privacy with regard to voting and employment (United Nations 2004). The nongovernmental organization (NGO) Inclusion International noted the threat to privacy from institutional living arrangements imposed on people with mental disabilities and discussed the need to protect privacy rights of individuals with disabilities (United Nations 2003). Another NGO suggested a specialized article on the privacy of records (WNUSP 2003).

The Third Session of the Ad Hoc Committee for disability rights discussed proposals for the privacy article extensively (United Nations Ad Hoc Committee n.d.c). Costa Rica’s draft entitled “Respect for Privacy” read:

1. Persons with disabilities shall not be subjected to arbitrary or unlawful interference with their privacy, and have the right to the protection of the law against such interference in all fields. States Parties to this Convention shall take effective measures to protect the privacy of the communications, information and documents of persons with disabilities

(United Nations Ad Hoc Committee n.d.c)

The European Union’s early draft was somewhat more detailed:

1. Persons with disabilities, including those living in institutions, shall not be subjected to arbitrary or unlawful interference with their privacy, and shall have the right to the protection of the law against such interference. States Parties to this Convention shall take effective measures to protect the privacy of the home, family, correspondence and medical records of persons with disabilities and their choice to take decisions on personal matters.

(United Nations Ad Hoc Committee n.d.c)

Wording changes to this draft were discussed. Kenya suggested including the term “communication” (United Nations Ad Hoc Committee n.d.c). South Africa suggested the article should provide protection of “all forms of privacy of an individual” and “reflect the full range of human rights protection” (United Nations Ad Hoc Committee n.d.c). An Australian NGO suggested separating privacy and family into separate articles and broadening the scope of the language used in the Committee’s draft concerning medical records (United Nations Ad Hoc Committee n.d.c). The materials from the Fourth Session of the Ad Hoc Committee in 2004 continued to combine privacy and family rights, but added protection for privacy in government data collection activities (United Nations Ad Hoc Committee 2004).

During the Fifth Session of the Ad Hoc Committee, privacy was split off from family rights and became its own article, as reflected in the final version of the Convention (United Nations Ad Hoc Committee 2005a). The committee said, “There was broad support to split the substance of the text prepared by the Working Group for draft article 14 into two separate articles.” The privacy draft now read:

No persons with disabilities, regardless of place of residence or living arrangements, shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence or other types of communication, or to unlawful attacks on his or her honour and reputation. All persons with a disability have the right to the protection of the law against such interference or attacks.

(United Nations Ad Hoc Committee 2005a)

There remained an active draft concerning the privacy of medical records, and there was concern about providing for advances in communication technologies (United Nations Ad Hoc Committee 2005a). On behalf of the EU, Luxemburg favored the broad language “regardless of their place of residence or living arrangements” over language that specified institutional settings (United Nations Ad Hoc Committee 2005b). Yemen and Serbia and Montenegro expressed support for the language on arbitrary and unlawful interference and revived the proposal to replace correspondence with “communications” (United Nations Ad Hoc Committee 2005b). Serbia and Montenegro suggested covering all records pertaining to people with disabilities. The United Arab Emirates favored retaining language about persons living in institutions to make sure that privacy rights are protected while the institutions are monitored (United Nations Ad Hoc Committee 2005b). Japan favored conforming usage to that in the Covenant on Civil and Political Rights, and supported the broader language about place of residence over that specifying institutional settings (United Nations Ad Hoc Committee 2005b). Russia opposed the splitting of family rights and privacy rights into two articles, stating that the issues were closely related, but it supported some of the changes to the language while suggesting modified versions of others (United Nations Ad Hoc Committee 2005b). At the Seventh Session, Article 22 appeared in its final version (United Nations Ad Hoc Committee 2006, pp. 17–18).

4. The Text of Article 22

Several features of Article 22’s text merit comment. As indicated above, the language “regardless of place of residence or living arrangements” was the product of extensive discussions over whether to single out institutional arrangements or to embrace broader terminology that would avoid reinforcing the stereotyped idea that people with disabilities will reside in institutional settings. The broader language should not be taken as minimizing the unique threats to personal privacy that life in institutions poses for the people with disabilities who live in them. Article 22 may provide authority by which to challenge the use of large institutions that not only make privacy impossible but also breed abusive conditions (Perlin 2007, p. 344). The CRPD elsewhere addresses the opportunity of individuals to choose where they live and to have access to resources that support living an inclusive life in the community rather than a segregated or isolated institutional existence.19

The textual provision “arbitrary or unlawful interference with his or her privacy, family, home or correspondence or other types of communication” is also noteworthy. The drafters opted for breadth of coverage for privacy protections by explicitly addressing both correspondence and other forms of communication, expanding the terms of earlier human rights instruments. As illustrated by the rise of social media communication in the present era and the temptation for both public and private actors to make use of personal information on social media platforms, making rights protection keep pace with communications technology remains a continuing, even an increasing, challenge.20

The language “or to unlawful attacks on his or her honour and reputation,” which echoes that in other human rights instruments, holds promise for efforts to diminish the stigma that frequently is imposed on persons with disabilities.21 The protections in the other instruments inspired the drafters of Article 22 to include parallel provisions regarding defense against attacks on honor and reputation. State-sponsored segregation of people with disabilities and the history of eugenics and other attacks on those with disabilities make them uniquely subject to reputational harm.22

The term of Article 22 recognizing “the right to the protection of the law against such interference or attacks” imposes an affirmative duty on the state to prevent and remedy interference with privacy and attacks on reputation. Of course, nations will differ in the domestic law they create to effectuate this duty and the avenues of enforcement available. In countries influenced by the English Common Law, private suit is the default method by which victims of intrusion or damage to reputation may obtain redress.23 States with other traditions will address violations of the norms of privacy and reputation protection in other ways,24 although, as noted below, even in places that do not follow common law approaches, individual litigation has included claims under Article 22.

The language in Article 22 providing that “States Parties shall protect the privacy of personal, health and rehabilitation information of persons with disabilities on an equal basis with others” reflects special concerns about health-related information and the potential that its disclosure will lead to discrimination against persons with disabilities. The same concern inspired the Genetic Information Nondiscrimination Act25 in the United States and the present debate in the U.S. over the collection and use of medical information in employee wellness programs (Abelson 2016). Aisling De Paor and Charles O′Mahony have declared: “By implication, the right to genetic privacy is…protected under the UN CRPD and other human rights instruments…” (De Paor and O’Mahony 2016, p. 13). They note that Article 22 rights may be interpreted to require states to prohibit employers from genetically testing employees (De Paor and O’Mahony 2016, p. 19). Questions linger whether people with disabilities should be afforded special protections given their vulnerability to the misuse of personal, health, and rehabilitation information, but the language of Article 22 simply provides that the protection for people with disabilities shall be “on an equal basis with others.”

The dominant approach in affording protection of health information privacy is to ensure that no personally identifiable information is disclosed without the informed consent of the individual. Recent research has criticized that approach as incomplete, however, because individuals may be subject to discrimination based on correlations between characteristics they have and aggregate predictions of risk of disease or disability. As two prominent authorities state: “For example, employers or insurers might learn from [data analytics] that particular demographic categories of patients have especially high rates of chronic conditions (including HIV) or especially high costs of treating these conditions and alter plan design accordingly.”26

5. Article 22 Applications and Interpretations

Application and interpretation of Article 22 may be found in the reports of the Committee on the Rights of Persons with Disabilities reviewing the progress of the parties adopting the CRPD, as well as in administrative and judicial decisions in cases involving the CRPD. As an example of Committee observations, Denmark’s 2014 review led to an expression of concern that psychiatric hospitals continued to be allowed to transfer private information about patients without the patients’ consent (UNCRPD 2014). Reports by internal authorities in countries that have ratified the CRPD also describe challenges and responses with regard to implementing Article 22.27 The report from Argentina, for example, noted the nation’s law protecting the rights of persons living with HIV infections (UNCRPD 2010a). China’s report pointed to the ability of individuals whose privacy rights have been violated to seek civil liability for damage to reputation (UNCRPD 2010b). The Austrian report cautioned: “In civil society there are doubts about whether people who live or work in homes or institutions are sufficiently protected against the passing on of personal data” (UNCRPD 2010c). Peru noted that it has a national registry of persons with disabilities but that the information is confidential and subject to disclosure only by court order (UNCRPD 2010d).

Independent bodies have also issued reports on CRPD implementation that include Article 22. A draft monitoring report for India from 2013 commented on dissatisfaction with privacy protections for persons with disabilities and recommended that disability and other relevant laws explicitly provide for the right to privacy, specifically for personal, health, and rehabilitation information, and that rehabilitation and medical professionals receive training in privacy rights of persons with disabilities (Gupta et al. 2013, pp. 160–64). A report on Singapore stated that the Personal Data Protection Act governed collection, use, and disclosure of personal data, but concluded that it did not cover persons with chronic mental illness who have to report their conditions for medical insurance and was unclear with regard to protections of personal data of people with chronic mental illness (Disabled People’s Association Singapore 2015, p. 27).

The European Commission has studied the European Union’s implementation of the CRPD. The Commission’s Staff Working Document of 2014 commented on a directive and regulation that established a framework for protecting health and other personal data. Under the directive, consent is generally required except when processing the information is necessary to protect the vital interests of the person to whom the information pertains or another person, if the subject of the information is physically or legally not able to provide consent (EC 2014). Further protections were under discussion at the time of the report, and the European Data Protection Supervisor was responding to complaints alleging misuse of information pertaining to individuals with disabilities (EC 2014, pp. 26, 56).

A number of cases alleging violations of Article 22 are pending before the UN’s Committee on the Rights of Persons with Disabilities (Office of High Commissioner, UN Human Rights 2017). In an adjudicated case involving the United Kingdom, the Committee, applying Article 2 of the CRPD Optional Protocol, considered the communication of an insulin-dependent service delivery manager for Oracle Corporation who had been laid off (UNCRPD 2012). The government’s Employment Tribunal decided against the complainant on his allegation that Oracle failed to make reasonable adjustments and otherwise discriminated against him on the basis of disability. The communication to the Committee alleged that the Employment Tribunal, by finding him not to be a credible witness, attacked his honor and reputation in violation of Article 22 of the CRPD. The Committee found that the dismissal and judicial review took place before the entry into force of the Convention and Optional Protocol in the U.K., so the communication was ruled inadmissible.

6. The Relation of Article 22 to Disability Human Rights Ideas

Professor Degener has recently argued that the CRPD embodies a human rights model of disability, a model that “encompasses the values for disability policy [and] that acknowledges the human dignity of disabled persons.” (Degener 2016, p. 3). Privacy and reputation are key aspects of human dignity, so their protection fits neatly into an international treaty based on human dignity principles. The first paragraph of Article 22 is an absolute protection for privacy and reputation rights, couched in language that does not make any comparison with the rights of nondisabled persons. In this respect and using Degener’s terms, Article 22 provides for something “more than anti-discrimination.” (Degener 2016, p. 4). Professor Kanter has also stressed the departure of the CRPD from anti-discrimination measures that rely on equalizing opportunities to establish a right to substantive equality so that outcomes, not just treatment, will be equal (Kanter 2015, pp. 842–44). The rights set out in the first paragraph of Article 22 are substantive and call for different treatment when the protections society generally affords are not sufficient to guard privacy and reputational interests of those who have disabilities. Like Degener, Kanter contends that the CRPD embodies a human rights approach to disability. Unlike Degener, she sees the human rights approach as fundamentally consistent with a social model of disability, and finds both to be present in the terms of the CRPD (Kanter 2015, pp. 845–48).28

In work roughly contemporaneous with the UN General Assembly’s consideration and adoption of the CRPD, Professor Stein articulated a human rights model of disability that he found immanent in the draft Convention (Stein 2007). Like Degener, he emphasizes the Convention’s focus on the dignity and inherent worth of each person, and the importance of developing the capabilities of all (Stein 2007, pp. 83–85, 106–10). Stein is not the only authority who supports a capabilities approach in understanding and enforcing the rights of persons with disabilities under the Convention (Lang et al. 2011). Following Stein’s and others’ ideas, guarantees against intrusion and misuse of information would appear central both to dignity and to permitting individuals to achieve basic minimums needed for a meaningful life, as well as to reach toward achieving their full potential free from stereotyping assumptions and discriminatory treatment. Privacy losses are prominent among the negative consequences of disability discrimination that results from institutionalization, fear of contagion, and imposition of stigma.

The privacy provisions of the CRPD are thus consistent with disability rights thinking. Moreover, as a practical matter, quite apart from considerations of theory, privacy protections often safeguard against the most common forms of discrimination and so contribute to the overall goal of the CRPD and disability rights in general. As Professor Roberts notes, “[I]n certain circumstances, discriminators need information to discriminate…Restricting potential discriminators’ access to information about protected status can significantly reduce the chances of subsequent discrimination” (Roberts 2015, pp. 2099–2100). She cites the example of protecting the confidentiality of genetic information to prevent employment discrimination on that basis (Roberts 2015, pp. 2101, 2132). She further concludes that even at a theoretical level, privacy and anti-discrimination are symbiotic and can advance the same interests and values (Roberts 2015, p. 2121).

It is true that furthering the anti-subordination aims of laws forbidding disability discrimination may require abandoning privacy to some extent and in some situations, as when one requests an accommodation from an employer, or the modification of rules from a public accommodation or government entity (Areheart 2012, p. 714). Disclosure of personal information about disability may also promote solidarity among those with disabling conditions (Areheart 2012, p. 715). There is a loss of privacy involved in coming out as a person with a disability, a step that includes embracing an identity as disabled and joining the community of persons with disabilities. Coming out as disabled has been described as a political matter for precisely that reason (Michalko 2002, pp. 69–70, 78–79). Deciding not to invoke a shield of privacy, whether for strategic, moral, or ideological reasons, ought to be a voluntary decision, however. Legal protections need to be present to prevent unwanted, unwarranted, or abusive intrusion into a person’s private sphere.

7. Conclusions

Just what constitutes unwanted, unwarranted, or abusive intrusion into a person’s private sphere is an issue that remains to be developed, both in the context of the rights of persons with disabilities and in the context of human rights in general. Authorities have questioned whether typical privacy protection legislation, which relies on notice and consent, can be effective in an era when corporate and government information gathering is pervasive and fully informed consent is rare (Symposium 2013). Because people with disabilities are uniquely at risk of discrimination when privacy protections fail, and because institutional and other settings in which people with disabilities often live are particularly subject to private and public intrusion, people with disabling conditions are canaries in the coal mine for loss of privacy by everyone. The coming years will demonstrate how effectively governments will “protect the privacy of personal, health and rehabilitation information of persons with disabilities on an equal basis with others.” (CRPD Art. 22 Sec. 2, UNGA 2006). Article 22 of the CRPD holds promise for the protection of personal information, dignity, and reputation of individuals with disabilities, but that promise is the beginning of the story, not its end.