By: Chukwuyere Ebere Izuogu


The coronavirus diseases otherwise referred to as COVID-19 is now an epidemiological nightmare hopping from one country to another since when it was first detected in Hubei province of China on 17 November 2019. COVID-19 was declared by the world health organisation as a public health emergency on 30 January 2020 and recognised as a pandemic on 11 March 2020. Unfortunately, COVID-19 has found its way into Nigeria since 27 February 2020, when patient zero, a 44-year Italian national was the first confirmed case to be diagnosed of this infectious disease in Lagos state. As at the time of this writing, Nigeria has 318 confirmed cases of COVID-19 spread across 19 states of the federation and the federal capital territory. The federal and some state governments, and health authorities have instituted several regulatory measures and medical protocols to contain the spread of COVID-19, prominent among them are the so called lockdown measure, a form of social distancing that restricts the movement of persons within a pre-defined geographic area and contact tracing of persons suspected to have come into contact with confirmed COVID-19 cases.

In this article, I explain how location data of communications users acquired from a network operator can be used by health authorities in their strategy for curbing the community spread of COVID-19 in Nigeria, and how the data processing risk arising from this strategy may be overcome.  

What is location data?

Location data is information acquired by a network operator which indicates the precise geographical position of the terminal or mobile device of the user of the network operator’s communications service. Location data would in most cases indicate the latitude, longitude and altitude of a user’s device. In mobile communications networks, location data indicating the geographic position of a user’s device is used for enabling the transmission of communications in an area of coverage of a network operator.

Potential uses of location data in curbing the spread of COVID-19

Contact tracing for the purpose of quarantine

Contact tracing as a strategy used by health authorities during an epidemic significantly contains the spread of an infectious agent. The traditional method of contact tracing employed is to reconstruct the network of face-to-face interactions with confirmed cases, however this method is severely limited because it relies heavily on a comprehensive knowledge of the pattern of movement of confirmed cases, and such information will in most cases involve only the travel history, commercial facilities visited and public transportation used in which health officials may be unable to trace all possible contacts. Moreover, confirmed cases required to self-report such information may in certain circumstances be unwilling to make a full disclosure especially if such information is of a private nature. Because of this challenge, the health authority is not able to alert potential contacts of confirmed cases about the risk of an infection, and the need to go into self-isolation or quarantine.

Several researches have concluded that location data obtained from a network operator is an invaluable tool for observing the digital footprint of a communications user and can indeed be a good proxy for a network of face-t0-face interactions as an effective and efficient method of contact tracing. It should be borne in mind that this is not a novel method of contact tracing as it is presently being contemplated (or used) in several jurisdictions. For instance, Israel seeks to access the geolocation data of confirmed COVID-19 cases to find and identify people who came in close contact with them and send them SMS directing them to isolate themselves immediately. Towards the end of last month (March), it was reported that the mobile phone industry is contemplating the creation of a global data-sharing portal able to track an individual across the globe in order to be able undertake contact tracing for the purpose of identifying a person whom confirmed cases of COVID-19 may have come into contact with.

To better understand the pattern of spread of COVID-19

Location data is also an invaluable tool in molecular epidemiological studies, as it helps health authorities to better understand the pattern of spread of an infectious disease. Presently in the US, health authorities at the federal and state level, including the Centers for Disease Control and Prevention (CDC) are tracking the movement of users of communications service to better understand how COVID-19 is transmitted from one person to another. This use case scenario presents health authorities with information of instances of mass movements, for instance whether people are still going about their daily work schedule and/or where large numbers of persons are congregating. In this way, epidemiologists and public health officials are able to identify potential hotspots for infection and to accordingly advice governments on the appropriate prevention strategy required to mitigate the risk of an infection. In addition, such information concerning the pattern of spread of COVID-19 will assist health authorities in forecasting the logistical resources and increment in hospitals required for managing potential and confirmed cases within a designated geographic area.


To observe whether individuals are complying with the lockdown measures

Location data also provide an insight into whether individuals are complying with lockdown measures put in place to contain the spread of an infectious disease. An example of a use case is Google’s COVID-19 Community Mobility Report which uses anonymised location data obtained from individuals that have agreed to share their location to observe how busy certain types of places are, thus informing health authorities whether people are complying with the lockdown measures. This Report for Nigeria shows that as at 29 March 2020, there was a +15% increase in movements to residential places, thus indicating that more people are staying at home. Social distancing strategies such lockdown measures will significantly contain the spread of COVID-19.

Overcoming the data protection risk

The use of location data as explained above raises significant privacy and data protection risks. In Nigeria, the applicable legal regime governing the processing of personal data is the Nigerian Data Protection Regulations 2019 (NDPR) issued by the National Information Technology Development Agency (NITDA). Location data and the disclosure of location data by network operators to health authorities and/or use of location data by health authorities in this circumstance respectively constitute “personal data” and “processing” within the meaning of the NDPR, thus the provision of the NDPR will apply in this case. In this use case scenario, it should be noted that location data have been expressly stated to be an example of personal data in the NDPR, and that two forms of (data) processing takes place. At the first level is the disclosure of location data by network operators to health authorities and at the second level is the use of location data obtained from network operators by health authorities as part of their strategy for curbing the community spread of COVID-19.

Under the NDPR, the processing of personal data is lawful and hence will be permissible, if at least one of the legal grounds specified by the NDPR applies. Thus, for the processing of location data to be lawful in this circumstance, network operators (and/or health authorities) simply need to identify at least one lawful basis prior to the data processing transaction. One of the legal basis that can be relied upon in this circumstance is “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official public mandate vested in the controller” set out in Art. 2.2 (e) of the NDPR. It is interesting to note that the General Data Protection Regulations (GDPR) applicable in the EU has a similar provision in Art. 6 (1) e which according to Recital 46 can serve as a lawful basis for processing personal data for the purpose of “monitoring epidemics and their spread” among many other purposes. Recently on 19 March 2020, the European Data Protection Board adopted a statement reaffirming that personal data may be used by competent public health authorities in the context of an epidemic such as one relating to COVID-19 (However unlike Nigeria, EU has a special rule concerning the processing of location data).

In the light of this, it is arguable that Art. 2.2 (e) can safely be relied upon in this circumstance as a lawful basis for processing location data considering the epidemiological concerns of COVID-19 and the health risks it poses to the general population.


Data protection concerns in matters of public health continues to be an ongoing debate, especially during the outbreak of an infectious disease. Although several data protection authorities have come to realise that data protection rules should not be used to impede measures taken by public health authorities in curbing the spread of an infectious agent, especially if this can be justified on a public interest basis. Even the Constitution which is the Grundnorm of the Nigerian society recognises that the right to privacy is not absolute but may be derogated from in deserving circumstances. In any case, the use of personal data in this circumstance must be narrowed by the data protection principle of purpose specification which requires that the use of location data is confined to only the monitoring and containment of COVID-19, and governed by a duty of care owed to individuals whose location data is processed, otherwise the government and health authorities would be acting outside the boundaries set by the NDPR and ultimately overreaching themselves.

Infectious diseases are a scourge to humanity, where modern technologies are used to mitigate their effects, it must be done in accordance with laid down rules in order to legitimise the use of such modern technology.


Chukwuyere, formerly a Tech Policy Fellow at Mozilla Foundation and presently a Research Fellow at the African Academy Network on Internet Policy and Senior Associate at Streamsowers & Köhn.




Related Posts