Individual Privacy and Data Protection Rights. The Legal and Economic Consequences of the Violation During the Covid-19 Pandemic

More than two years have passed since the first recorded case of infection caused by the Covid-19 virus. The first laboratory-confirmed case of infection in Montenegro was recorded on 17th of March, 2020. The domestic and general public, as well as public policy makers, were faced with numerous challenges, the most important of which was how to introduce appropriate restrictions in order to keep the epidemic under control, while ensuring respect for human rights and fundamental freedoms.

Due the fact that health crisis was unprecedented so far, it has negatively affected the enjoyment of fundamental rights (Madera, 2021). Dealing with the new situation in the wake of the pandemic, and due to the uncertainty of what was coming, resulted in numerous restrictions on human rights and freedoms, primarily freedom of movement, privacy rights, all in order to protect the public interest and public health (Shany, in Dialog between judges, 2022, 9.).

Governments around the world were encouraged to take urgent and drastic measures, in an attempt to halt the spread of the infection, by striking the necessary balance between their positive obligations to protect the health of citizens and the negative obligations of disproportionate restrictions on human freedoms. In order to help the member states cope with the pandemic, the General Secretariat of the Council of Europe issued guidelines (EC A toolkit for member states, SG/inf (2020)11)) to the member governments on how to limit human rights in accordance with the European Convention, while the Parliamentary Assembly of the Council of Europe issued a set of recommendations and resolutions (EC Resolution 2338, 2020) on the impact of the Covid 19 pandemic on human rights and the rule of law as well as the challenges that democracies face in the pandemic era (EC Resolution 2337, 2020).

One of the human rights that, in addition to freedom of movement, suffered the most, in the period behind us, is the right to privacy, i.e., the right to respect for private life, which, as we will see below, will have its legal and economic implications for individuals so for the state. The right to respect for private life must be viewed on a wider scale, given the fact that these are concepts of a different scope. Privacy is not just personal, but interdependent. (Kamleitner and Mitchell, 2019, 433.) In this sense, private life is a broader concept than the concept of privacy, meaning those areas in which each individual can freely express, develop and fulfil his own personality, both to himself and to the outside world (Roagna, 2012, 14.)

The European Convention for the Protection of Human Rights and Fundamental Freedoms does not contain the notion of private life in the form of a definition, but looking at the case law of the European Court of Human Rights, we can unequivocally conclude that this notion has evolved over time. This notion has developed over time, in accordance with the views of European society, and that the aforementioned "evolution" of this right was accompanied by Montenegrin law (Vukčević and Ćupić, 2013.)

The scope of the term has expanded over the time, so today its scope includes name-bearing, protection of human character and reputation, knowledge of family origin, physical and moral integrity, gender and social identity. Some aspects of this term, in light of Montenegrin coping practice with the pandemic, will be specifically considered through the analysis of the Decision of the National Coordination Body for Infectious Diseases on publishing the names of people in self-isolation.

The paper predominantly uses normative methodology and case study approach in the interpretation of positive legal regulations, together with sociological and axiological method, necessary for understanding the broader context of individual privacy and data protection rights. For that purpose, authors also chose a comparative law method, with special emphasis on extremely valuable practice of the European Court of Human Rights and Constitutional Court of Montenegro.

The actions of public authorities during the pandemic with special reference to Montenegro

The outbreak of the pandemic has forced governments, public and private organizations across Europe and the world to take various measures to alleviate the COVID-19 crisis. Those actions have posed many questions in terms especially of privacy and data protection (Malgieri, 2020). In certain cases, as it was the case with Montenegro, the measures taken included the processing of various types of personal data, which raised two information concerns: privacy and security (Kumar and Kumar, 2021, 172). Aware of the fact that the fight against infectious diseases is an important goal shared by all nations, it was to be expected that the measures taken would be supported by the widest possible number of citizens. However, in many cases, no balance was struck between the obligation to protect the health of citizens and the degree of restriction of human rights and fundamental freedoms, which led to certain regulations being assessed as unconstitutional and illegal, with all legal and economic consequences.

The National Coordination Body for Infectious Diseases was formed after the outbreak of the coronavirus in Montenegro, with the task of thoroughly and daily monitoring the development of the situation and adopting measures to alleviate the human crisis. Due to the great epidemiological risk, with the firm conviction of all members that the protection of life and health of citizens was the primary duty, obligation and highest priority of the state, this body made a decision to publish the names of people in self-isolation (Decision of the National Coordination Body for Infectious Diseases on publishing the names of persons in self-isolation, number 8-501-/20-129, from 21st of March, 2020.) Shortly after publication, the list with names and private data appeared on social networks whose goal is mutual communication (Boyd and Ellison, 2008). Namely, after several appeals from the competent authorities, it was affirmed that certain persons, who were imposed a measure of self-isolation after entering Montenegro from abroad, left their homes, thus exposing everyone they came into contact with and, ultimately, the whole of Montenegro. This body stated that it was impossible to monitor every citizen in self-isolation at all times, and that every person who left self-isolation posed a danger to his family and the whole community. Consequently, it was considered that the names of self-isolated people be published with an aim to raise the awareness of citizens about the need to respect measures in the fight to preserve the health and lives of citizens. According to the members of the National Coordination Body, the only alternative to this solution was to declare a ban on movement for all citizens, but the experiences of many European countries influenced the introduction of such a measure, despite the fact that massive information collection may threaten data privacy (Shen and Wang, 2021).

Due to the sensitivity of the data that needed to be handled, the opinion of the Agency for Personal Data Protection and Free Access to Information was requested, after whose consent the National Coordination Body for Infectious Diseases unanimously decided to start publishing the names of persons who were issued decisions on mandatory self-isolation for a period of 14 days (The names of persons were published on two occasions, 986 names in the first and 1,734 names in the second occasion, a total of 2,720 names of natural persons).

At its session on 23^rd of July, 2020, the Constitutional Court of Montenegro passed a Decision repealing the Decision of the National Coordination Body for Infectious Diseases on publishing the names of persons in self- isolation. (Decision of the Constitutional Court of Montenegro, U-II no. 22/20, from 23 July 2020.) Namely, after considering the content of the disputed Decision, the Constitutional Court determined that it was not in accordance with the Constitution and the law and that the conditions for its repeal had been met.

In the process of assessing constitutionality and legality, the normative framework was analysed, which, in addition to the Constitution, the European Convention on Human Rights and Fundamental Freedoms and the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Official Gazette of the FRY - International Agreements, No. 1/92; Official Gazette of Serbia and Montenegro - International Agreements No. 11/05 and Official Gazette of Montenegro - International Agreements, No. 6/09), consists of laws that regulate the area of personal data handling, protection of the population from infectious diseases, health care, etc. (Law on Personal Data Protection, Law on Data Collections in the Field of Health, Law on Protection of the Population from Infectious Diseases, Law on Protection and Rescue, Law on Health Care).

Also, in the context of resolving disputed legal issues in this case, the Constitutional Court took into consideration the acts of the Council of Europe related to data protection and the statement on personal data processing in the context of the COVID-19 epidemic, adopted by the European Data Protection Board, and to Recommendation CM/Rec (2019) 2 of the Committee of Ministers to member states on the protection of health data (EC Recommendation from 27^th of March, 2019.) and the Joint Declaration on the right to data protection in the context of the COVID-19 pandemic Alessandra Pierucci, Chair of the Convention Committee 108+ (Convention 108, as amended by the Protocol, is also called Convention 108+) and Jean-Philippe Valter, Commissioner for Protection data at the Council of Europe (The statement was given on 30th of March, 2020). These international acts emphasize the obligation of states to ensure high standards for the protection of personal data that are compatible and not in conflict with other fundamental rights and relevant public interests. Throughout all these documents, there is a common view that data protection can in no way be an obstacle to saving lives and that the current principles always enable the balance of interests in question. It is crucial that, even in particularly difficult situations, the principles of data protection are respected in accordance with Convention 108+, and it is therefore ensured that the individuals are familiar with the processing of personal data relating to them; the processing of personal data is performed only if it is necessary and in proportion to the explicit, determined and legitimate goal to which it is pursued; the impact assessment is performed before the start of processing; special privacy is ensured and appropriate data protection measures are adopted, especially in relation to certain categories of data such as medical data. As further stated in the Joint Declaration, one of the main principles of data protection provided by Convention 108+ is the principle of legality, according to which data may be processed either with the consent of the data subject or with reference to the grounds contained in law. It should be noted that such a legitimate basis in particular includes the necessary data processing for the vital interests of individuals and data processing carried out on the basis of public interest, such as the monitoring of a life-threatening epidemic. On the other side, all organizations that collect and manage personal data must provide high level protection against misuse (Baltazarevic and Baltazarevic, 2017, 247).

After assessing that the situation caused by the COVID-19 virus had the characteristics of a pandemic (Statement of the Director-General of the World Health Organization, March 11, 2020), the World Health Organization called on all states to activate and improve their emergency response mechanisms, to inform the population about risks and how to protect themselves, to find, isolate, test and treat every case and monitor every contact. The special emphasis was on the fact that the proper alignment of competing interests and practices is the main condition for good functioning establishment of human rights and freedoms online (Tikk, 2017, 490.). One of the activities of the Government of Montenegro, undertaken in that direction, was to publish the list of persons who were imposed self-isolation measures in a way that it was made publicly available on the website of the Government of Montenegro.

The initiative for assessing the constitutionality and legality of the Decision on publishing the names of persons in self-isolation was based on the allegations of violation of the right to privacy and protection of personal data, from the provisions of Articles 40 and 43 of the Constitution (Constitution of Montenegro, "Official Gazette of Montenegro" no. 1/2007 and 38/2013 Amendments I-XVI.) and Article 8 of the European Convention, because personal data was made available to the public, without the consent of the person to whom they relate, without disputing the public interest reflected in the protection of health. In the proceedings before the Constitutional Court, the following constitutional issues were raised as disputable:

• To what extent can personal data collected in connection with the COVID-19 virus (name, surname, address and date of commencement of self-isolation) be considered medical data?

• Can measures of public disclosure of personal data of people living in self-isolation (name, surname, address and date of commencement of self-isolation) be considered legal and proportionate restriction, i.e., permissible interference of the state in the right to privacy from the provisions of Articles 24, 40 and 43 of the Constitution and Article 8 of the European Convention, having in mind the legitimate goal - health protection?

The Constitutional Court based their response to the constitutional and legal questions starting from the World Health Organization's knowledge of the COVID-19 virus, which pointed out to the states the importance of testing, treating, isolating and monitoring contacts, in order to avoid clusters that would lead to transmission throughout society. The introduction of measures to test and monitor contacts, especially in the initial phase of the fight against the spread of infection, with measures of physical distance and community mobilization, according to the World Health Organization could prevent infections and save lives, and many countries showed that the spread of the virus could be successfully controlled by taking the same or similar measures.

The Constitutional Court, in the specified decision, determined that, according to the WHO (https://www.who.int/docs/default-source/coronaviruse/situation-reports/20200402-sitrep-73-covid-19.pdf) findings "virus transmission is possible from symptomatic, pre-symptomatic and asymptomatic patients", the collection of personal data on persons residing in self-isolation, as well as mandatory self-isolation measures of persons coming from abroad, monitoring of their health condition, as well as all members of the household, who happen to be in that family accommodation, by the competent hygienic-epidemiological service, clearly indicates that it is personal data of persons at risk of illness or was exposed to the COVID-19 virus and without disclosing their health status, i.e. that, in this particular case, they can be considered medical data which, as such, are subject to stricter processing rules.

It follows from the provisions of the European Convention that each Contracting State may, by its internal regulations, restrict the rights contained in the European Convention, under the conditions established by the Convention. Permitted restrictions on rights are conditioned by legality, legitimacy and justification. The restriction of any right is permissible only if the competitive principle in relation to the principle in which the right is contained has greater significance in the circumstances of the specific case. This means finding the right balance between different conflicting interests. Restrictions must be implemented in a consistent manner, so that the essence of the law in question and the basic principles on which a state is based (Vukoslavčević, 2012.), which aspires to be marked as a state governed by the rule of law and a state governed by the rule of law, are not endangered. As fundamental rights have a constitutional status, they can be limited only by constitutional or provisions adopted on the basis of the constitution according to the European Court. Constitutional restrictions can be constitutionally immediate and constitutionally mediate, prescribed by law, on the basis of an explicit constitutional provision under strictly prescribed preconditions and only for certain purposes. This principle allows freedoms and rights to be restricted only in accordance with the law and sets limits on the restriction of rights. Restriction is not necessary if there are milder but suitable measures that can serve the same purpose. Restrictions on fundamental rights and freedoms in this process, however, must be in accordance with the Constitution and the European Convention for the Protection of Human Rights and Fundamental Freedoms and, in general, must be in the general interest and respecting the principle of proportionality.

Any restriction necessarily affects the enjoyment of the rights and freedoms guaranteed by the Constitution and the European Convention, whether or not their imposition was accompanied by the notification to the Secretary General of the Council of Europe, a notification of derogations from European Convention obligations, in accordance with the provisions of Article 15 of the Convention, as done by the nine member states of the Council of Europe (Albania, Armenia, Estonia, Georgia, Latvia, Northern Macedonia, Serbia, Moldova and Romania). Montenegro has not exercised its right to derogate from the provisions of the European Convention in accordance with the provisions of Article 15 of the European Convention. Although the right to health care is recognized in numerous international instruments, as such, it is not prescribed by European Convention (ECoHR, Lopes de Sousa Fernandes v. Portugal, judgment no. 56080/13, of 19^th of December 2017, §165; Vasileva v. Bulgaria, judgment no. 23796/10, of 17^th of March, 2016, §63). Nevertheless, the danger posed by the COVID-19 virus pandemic to life and physical integrity undoubtedly raises the question of the material and procedural positive obligations of a member state with regard to respect for rights under the provisions of the Convention. In fulfilling their positive obligations under the European Convention, the states, according to the case law of the European Court, enjoy a certain margin of appreciation (Lopes de Sousa Fernandes, §175; Vasileva, §67), which is recognized by states and without derogation from the provisions of Article 15 of European Convention-in the case of measures adopted by the state in response to "the existence of an extremely severe unprecedented crisis". (ECoHR, Koufaki i Adedy v. Greece, judgment no. 57665/12, of 7^th of May, 2013, §37).

The protection of personal data, in terms of protection of individual privacy, is one of the basic human rights and is necessary for the proper functioning of any democratic society. The provisions of Article 43 of the Constitution guarantee the protection of personal data, prohibit the use of personal data outside the purpose for which they were collected and it is determined that everyone has the right to be informed of data collected on his personality and the right to judicial protection in case of abuse. The basic standards of privacy protection are defined in the United Nations Universal Declaration of Human Rights and the European Convention. This right, in accordance with the provision of Article 8 paragraph 2 of the European Convention, may be limited only by law, to the extent necessary in a democratic society, in the interests of national security, public security, economic progress in the country, in the event of riots and crime prevention, as well as the protection of health and morals or the protection of the rights and freedoms of others.

The protection of the individual privacy from unlawful interference with has been proclaimed in international law as a fundamental human right that enjoys legal protection. The basic idea of protection of rights to which Article 8 of the European Convention applies is that there are spheres of life of each individual in which the state must not interfere, except in those situations when the conditions from paragraph 2 of that article are cumulatively met. The provision of Article 8 of the European Convention guarantees everyone the right to respect for private and family life, home and correspondence (paragraph 1), and public authorities will not interfere in the exercise (enjoyment) of the right to privacy "unless in accordance with law and necessary in a democratic society, in the interests of national security, public security or the economic well-being of the country, to prevent disorder or crime, to protect health or morals, or to protect the rights and freedoms of others ”(paragraph 2). The right to privacy, guaranteed by the provisions of Article 8 of the European Convention, allows a person not only to be protected from interference by the authorities, but also from interference by other persons and institutions, including the media. The term "respect" implies the protection of persons from arbitrary interference by public authorities with their privacy, but also obliges the state to actively participate in ensuring this right.

According to the provision of Article 6 of Convention 108 (CE Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data) health-related data fall into the category of special data and can be processed automatically only if domestic legislation provides for appropriate guarantees. The derogations from the provisions of Article 6 of this Convention shall be possible only where such derogations, provided for by the law of the Contracting State concerned, constitute a necessary measure in a democratic society for the protection of the security of a state, public security, monetary interests or the suppression of criminal offenses, protection of data subjects and the rights and freedoms of others (Article 9 of the Convention). In order to clarify the disputed issues in this case, the Constitutional Court also had in mind the relevant practice of the European Court of Human Rights, which in numerous cases expressed the view that the protection of personal data, including medical data, is fundamental to the protection of the right to respect for private and family life, from the provisions of Article 8 of the European Convention.

In this regard, in Amann v. Switzerland case (ECoHR, Amann v. Switzerland, judgment no. 27798/95, of 16 February 2000, § 65), the European Court expressed the view that the protection of the right to privacy, from Article 8 of the European Convention, was applicable to the protection of personal data and that a broad interpretation of this term was in line with Convention 108:

• ‘65. The Court reiterates that the retention of data relating to an individual's "private life" falls within the scope of Article 8 paragraph 1 ...

In this regard, it points out that the term private life must not be interpreted restrictively. Respect for private life includes the special right to establish and develop relationships with other human beings; (…). This broad interpretation corresponds to the Council of Europe Convention of 28 January 1981 about the protection of individuals with regard to automatic processing of personal data, which entered into force on 1 October 1985 and aims to "ensure in the territory of the Contracting States for every individual ... the respect to his rights and fundamental freedoms, and in particular his right to privacy, with regard to the automatic processing of personal data relating to him "(Article 1), where such personal data are defined as" all information relating to a recognized or recognizable individual (Article 2).’ In Gardel v. France (ECoHR, Gardel v. France, judgment no. 16428/05, of 17 December 2009, § 62) the European Court pointed out that the laws of a Contracting State should ensure that such information was relevant and effectively protected against incorrect processing and misuse:

• ‘62. The protection of personal data plays an essential role in the enjoyment of the right to respect for private and family life guaranteed by Article 8 of the Convention. National legislation must therefore provide adequate safeguards to prevent any use of personal data which would not be in accordance with the guarantees provided for in that article. (…). In particular, national legislation must ensure that this information is relevant and does not contain more than is necessary to achieve the purposes for which it was registered, and that it is kept in a form that allows the persons concerned to be identified for a period not longer than is necessary in view of the purpose for which they were registered… Internal law should also include safeguards that effectively protect personal data from unauthorized and illegal users.’

In Z. v. Finland, (ECoHR, Z. v. Finland, judgment no. 22009/93, of 25 February 1997, § 95-97) the European Court recalled that the right to privacy, under Article 8 of the European Convention, also applied to the protection of health data:

• ‘95. In this regard, the Court notes that the protection of personal data, including medical data, is fundamental to the enjoyment of the right to respect for a person's private and family life, as guaranteed by Article 8 of the Convention. Respect for the confidentiality of health data is a vital principle of the legal systems of all states parties to the Convention. It is crucial, not only in terms of respecting the patient's privacy, but also in maintaining his / her confidence in the medical profession and medical institutions in general.

• ‘96. Without such protection, those in need of medical care might be reluctant to disclose information of a private and intimate nature, which may be necessary to obtain appropriate treatment, or even seek help in general, thereby endangering both their own health and the health of the community in the case of infectious diseases…

• ‘97. Accordingly, domestic law must provide appropriate safeguards to prevent any exchange or disclosure of personal health data, which may be contrary to what is guaranteed by Article 8 of the Convention…’

Analysing the case law of the European Court, the Constitutional Court of Montenegro concluded that the protection of personal data, including medical, is fundamental to enjoying the right to respect for private and family life, guaranteed by Article 8 of the European Convention, in the legal systems of all parties. According to the European Court, it is crucial not only to respect the patient's privacy but also his trust in the medical profession and health services in general, and the lack of such protection could deter people in need of medical care from disclosing personal and intimate data needed for appropriate treatment even from seeking such help, because in that way they can endanger their health and, in the case of communicable diseases, the health of the community. The interest in protecting the confidentiality of such information will therefore, according to the European Court, significantly outweigh the balance in determining whether the interference was proportionate to the legitimate aim pursued. Such interference, according to the European Court, cannot be in accordance with the provisions of Article 8 of the European Convention, unless justified by an overriding requirement in the public interest, in the applicant's own interest or in the interest of the safety of hospital staff (Z. v. Finland, §77-78). The European Court considers that the laws of the contracting states must provide for appropriate safeguards to prevent any use of personal data which is not in accordance with the guarantees of this article (ECoHR, Mockutė v. Lithuania, judgment no. 66490/09, 27^th of February, 2018, §93-94).

The Constitutional Court concluded that it was indisputable that the measure of public disclosure of the identity of a person (name, surname, address and date of commencement of self-isolation) living in self-isolation in connection with COVID-19 virus constituted a violation or restriction of the right to personal data protection from the provisioned of the Articles 40 and 43 of the Constitution and the right to respect for private and family life, guaranteed by the provision of Article 8 paragraph 1 of the Convention. Therefore, in the procedure, it was assessed whether this measure met the conditions from the provisions of Article 24 of the Constitution, Article 8 paragraph 2 of the European Convention and Articles 6 and 9 of Convention 108.

The disputed decision on publishing the names of persons in self-isolation, which imposed a restriction on the right to privacy and the right to protection of personal data, from the provisions of Articles 40 and 43 of the Constitution and the right to respect for private and family life, guaranteed by the provision of Article 8 paragraph 1 of the European Convention, is part of general measures, orders and decisions in the fight against COVID-19 virus, which sought to achieve the same goal - "Preserving the health and lives of citizens." Namely, according to the order of the Constitutional Court, there were no constitutional and legal obstacles to limit the stated rights of persons in order to prevail public interest in the field of health care, which is primarily reflected in the protection of human life and health, especially bearing in mind that the "interest of health protection" was stated as the basis for the restriction of rights from the provision of Article 8, paragraph 2 of the European Convention, i.e. there was undoubtedly a legitimate aim.

In determining whether the disputed measure was "necessary in a democratic society", the Constitutional Court assessed whether there was a pressing social need (ECoHR, Voght v. Germany, judgment no. 17851/91, from 26 September 1995.) for the imposed restriction, whether the reasons given for justifying these measures were relevant and sufficient and whether those measures were proportionate to the legitimate aim pursued.

Given the seriousness of the emergency regarding the COVID-19 virus and the great danger posed by the virus to the health of all citizens in Montenegro, as well as the authorities assessment that there was a danger of a large number of people getting infected and in need of medical assistance, the Constitutional Court, based on the position of the European Court, according to which the assessment of the need to restrict a constitutional or convention right, and even the restriction of the right to privacy, falls within the margin of appreciation of a Contracting State, found that there was an urgent social need for the restriction.

However, the publication of personal data on people in self-isolation, as ordered by the Constitutional Court, made these data available to an unlimited number of people, which is difficult to determine when it comes to the publication on a website, as was the case here. The publication of personal data on people who respect the issued orders on self-isolation, according to the order of the Constitutional Court, can lead to their stigmatization by the wider social community. In addition, the lack of protection of personal medical data, as ordered by the Constitutional Court, could deter persons in need of medical assistance from seeking such assistance, which would endanger their health, which, in the case of communicable diseases, could result in the spread of the disease to other people, i.e., to significantly endanger the public interest - preventing the spread of diseases caused by the COVID-19 virus. Although the current location of these persons could not be traced on the basis of published data (name, address and date of commencement of self-isolation), as was the case in the recent Breyer v. Germany case (ECoHR, Breyer v. Germany, judgment no. 50001/12, 30^th of January, 2020.), the Constitutional Court found that these data were sufficient for the so-called creation of a "profile" on the website (https://www.crnagorakorona.com/home) by an unknown person, who provided the user with information about the distance of the address, with the name and surname of the person who was in self- isolation.

The principle of proportionality in the narrow sense (the principle of balancing) means that appropriate and necessary measures must not upset the fair balance and/or destroy the essence of the law. In that sense, the Constitutional Court, as well as the European Court, controls whether there is a proportion between measure taken by the state and the legitimate goal it seeks to achieve. The proportionality of the measure implies that the measure is suitable to achieve the desired goal, but also that the state finds a fair balance between the measure taken and the overall goal set. Proportionality will not exist when the weighing of private and public interest has not been carried out in a reasonable way or when an individual has been burdened too much in relation to the public goal to be achieved.

Considering the disputed restriction in the light of the specific case as a whole and in the context of the circumstances caused by the COVID-19 virus, the Constitutional Court found that the disputed decision did not strike a fair balance between the need to protect the health and lives of citizens on the one hand and the right to privacy and protection of personal data, from the provisions of Articles 40 and 43 of the Constitution and the right to respect for private and family life, guaranteed by Article 8 paragraph 1 of the European Convention, of persons related to COVID -19 who are in self-isolation, on the other hand, that is, that the restriction of the rights of these persons represents a disproportionate burden for them in relation to the goal pursued.

Also, the issuer of the disputed act did not process the personal data of people in self-isolation as ordered by the Constitutional Court and in the manner prescribed by lawn or with the express consent of the person, with special marking of data and protection for unauthorized access to such data, nor did it consider the possibility of applying a less restrictive measure than that applied in the present case. The Constitutional Court, therefore, found that the disputed decision was not in accordance with the provisions of the Articles 24, 40 and 43 of the Constitution,

Article 8 of the European Convention and Articles 6 and 9 of the Council of Europe Convention 108 and that the conditions for its abolition have been met.

Economic Consequences of the Established Violation or How Much Will the Unconstitutional Decision Cost Montenegro?

The decision of the Constitutional Court on the unconstitutionality or illegality of any regulation in principle has legal effect for the future, i.e., from the day of its publication in the "Official Gazette of Montenegro". Pursuant to the provisions of the Law on the Constitutional Court, the Constitutional Court may, by a decision determining that a law or other regulation and general act is not in accordance with the Constitution or the law, determine the manner of compensation for all persons whose rights have been violated by a final or final individual act passed on the basis of that law or other regulation.

In this particular case, after the Decision of the Constitutional Court of Montenegro on revoking the Decision of the National Coordination Body for Infectious Diseases on publishing the names of persons in self- isolation was published in the Official Gazette of Montenegro, the conditions were met that all people whose right to privacy and the right to protection of personal data have been violated by the said Decision, may request compensation in regular court proceedings, by a lawsuit for compensation of non-pecuniary damage, in accordance with the provisions of the Law on Obligations.

After stating that citizens whose rights were violated began to file lawsuits for compensation and that the courts decided that the amount of € 300.00 was an adequate satisfaction for the damage suffered, the Protector of property and legal interests of Montenegro addressed the Government of Montenegro, with a proposal for the conclusion of court settlements, in order to avoid the costs of enforcement proceedings.

Namely, the analysis of the overall factual and legal situation concluded that in court proceedings a total of 2,720 persons could claim compensation which would represent a financial burden of € 816,000.00 for the State of Montenegro. Also, in the case of enforcement, according to case law, the costs for each case individually would amount to about € 200.00, which implies additional costs of about € 544,000.00. Therefore, the costs of compensation for non-pecuniary damage increased by the costs of enforcement would amount to about € 1,360,000.00, which would be the price of the unconstitutionality of the Decision of the National Coordination Body for Infectious Diseases on publishing the names of persons in self-isolation.

Aware of the fact that the costs of non-pecuniary damage cannot be avoided, but that the total costs for the State of Montenegro can be reduced by concluding court settlements and indirectly avoiding the costs of enforcement, thus, the Protector of property interests proposed to the Government of Montenegro to conclude settlements with all persons i.e., their proxies. Also, the proposal contained a recommendation to act within certain short deadlines. Specifically, the Protector's proposal is to pay the amount for damages within 15 days from the day of concluding the settlement, in order to prevent forced execution and thus reduce the amount of total costs that the State is obliged to pay.

After a detailed and comprehensive analysis of the overall situation and appreciating the proposal of the Protector of property and legal interests, the Government of Montenegro (https://www.gov.me/clanak/52-sjednica-vlade-crne-gore-23122021), at its session on 23rd of December 2021, gave its consent to conclude the settlement in proceedings for non-pecuniary damage to persons whose names were published on the website of the Government of Montenegro, based on the Decision of the National Coordination Body for Infectious Diseases. For that purpose, the Protector of property and legal interests of Montenegro is in charge of concluding a settlement with 2720 persons in the form of compensation / satisfaction of €300 for non-pecuniary damage due to violation of personal rights by publishing personal data.

The states are faced with a number of major challenges in tackling the Covid-19 pandemic today. As these challenges continue today, due to the fact that the virus is taking on various mutations and that the pandemic is not yet over, states and governments are obliged to rethink policies on a daily basis and adopt measures aimed at protecting the health and lives of citizens. The adoption of these measures, as we had the opportunity to see in this case, is not an easy task, because it is necessary to strike a balance between the measure taken and the goal it seeks to achieve.

The restrictions on the rights and freedoms of citizens must be extremely restrictive, proportionate to the goal pursued and must be necessary in a democratic society. The absence of any of these requirements, as was the case in the example described, has the effect that the measures adopted ultimately have some new implications, both legal and economic. The legal implication was the repeal of the unconstitutional decision and its removal from the Montenegrin legal system on the day of the publication of the Decision of the Constitutional Court of Montenegro in the Official Gazette, while the economic consequence is in the amount of the total compensation claims that Montenegro will have to pay as compensation for non-pecuniary damage for each person whose name was made public on the basis of an unconstitutional regulation. The total amount to be paid is still unknown, but estimates made on the basis of known facts about the number of persons and the individual amount determined by the courts as the amount of satisfaction, say that it is a considerable amount and which will ultimately be paid by Montenegrin citizens.