Cross-Border Epidemiological Surveillance Law.
1. Introduction
Cross-Border Epidemiological Surveillance Law is an emerging area of international health law that regulates the collection, processing, monitoring, sharing, transfer and use of epidemiological information across national boundaries to identify, prevent, investigate and control infectious diseases and other public-health threats.
It concerns the legal relationship between national governments, international health organisations, hospitals, laboratories, research institutions, pharmaceutical companies, public-health agencies and individuals when disease-related information is transmitted between countries.
Examples include:
International reporting of COVID-19, Ebola, influenza and other emerging infectious diseases.
Cross-border transmission of patient information and laboratory test results.
International genomic sequencing and pathogen surveillance.
Sharing information about disease outbreaks with the World Health Organization (WHO).
Digital contact tracing and cross-border health-data exchange.
Surveillance of international travellers, migrants and persons exposed to infectious diseases.
Sharing epidemiological information for vaccine development and public-health research.
The central legal challenge is balancing two competing interests:
Collective public-health protection: Governments must detect and control infectious diseases that may spread internationally.
Individual rights and national sovereignty: Epidemiological surveillance must respect privacy, confidentiality, human dignity, data protection, equality and constitutional safeguards.
Consequently, cross-border epidemiological surveillance is not simply a matter of medical science. It is also a question of international cooperation, state responsibility, human rights, administrative accountability and data governance.
2. Meaning and scope of epidemiological surveillance
Epidemiological surveillance refers to the systematic and continuous collection, analysis, interpretation and dissemination of health-related information for public-health action.
Cross-border epidemiological surveillance occurs when these activities involve two or more countries.
Its principal forms include:
| Form of surveillance | Legal significance |
|---|---|
| Infectious-disease surveillance | Detection and reporting of communicable diseases |
| Genomic surveillance | Sharing pathogen genetic sequences |
| Digital surveillance | Monitoring through applications and digital systems |
| Border health surveillance | Screening travellers and monitoring international movement |
| Laboratory surveillance | International exchange of test results and samples |
| Wastewater surveillance | Detection of pathogens through environmental samples |
| Contact tracing | Identifying persons potentially exposed to infection |
| One Health surveillance | Monitoring diseases across humans, animals and the environment |
The legal framework must address not only the original collection of information but also subsequent transfers, secondary use, retention, disclosure, access and deletion.
3. International legal framework
A. International Health Regulations 2005
The International Health Regulations (2005) constitute the principal international legal instrument governing the prevention, protection against, control of and response to the international spread of disease.
The Regulations were adopted under the WHO Constitution and are legally binding on States Parties, subject to applicable reservations and other provisions.
Important provisions include:
Article 5 – Surveillance
States must develop, strengthen and maintain the capacity to detect, assess, notify and report events in accordance with the IHR.
Article 6 – Notification
States must assess public-health events and notify WHO within 24 hours of assessment of information indicating a potential public-health emergency of international concern, through the designated National IHR Focal Point.
Article 7 – Information-sharing during unexpected events
States must provide relevant public-health information to WHO when an unexpected or unusual public-health event occurs within their territory, irrespective of its origin or source.
Article 9 – Other reports
WHO may consider reports from sources other than official notifications and request verification from the State concerned.
Article 10 – Verification
WHO may request verification of reports concerning events that may constitute a public-health emergency of international concern.
Article 11 – Provision of information by WHO
WHO may share information with other States Parties under specified conditions, including where necessary for an effective public-health response.
Article 12 – Determination of a public-health emergency of international concern
The WHO Director-General determines whether an event constitutes a public-health emergency of international concern, taking account of relevant information and the IHR Emergency Committee's advice.
Article 45 – Treatment of personal data
Personal data processed or disclosed under the IHR must be kept confidential and processed anonymously where required by national law, subject to specified public-health exceptions.
Article 43 – Additional health measures
States may implement additional health measures beyond WHO recommendations, but such measures must comply with the IHR's conditions, including scientific justification and applicable notification requirements.
The IHR therefore establishes an international system of surveillance cooperation while preserving important responsibilities for individual States.
B. 2024 amendments to the International Health Regulations
The 2024 amendments to the IHR entered into force on 19 September 2025 for States Parties that did not reject them.
Important developments include:
Recognition of a new global alert category called a pandemic emergency.
Establishment or designation of National IHR Authorities.
Stronger international cooperation and coordination.
Greater emphasis on equitable access to relevant health products.
Improved capacities for prevention, detection and response to international health threats.
These amendments strengthen the institutional structure for cross-border epidemiological surveillance. They do not give WHO authority to impose lockdowns or directly compel national governments to adopt particular health measures.
World Health Organization+2
C. WHO Constitution
The WHO Constitution provides the institutional foundation for international public-health cooperation.
Relevant provisions include:
Article 1: WHO's objective of attaining the highest possible level of health for all peoples.
Article 2: WHO's functions concerning international health coordination, epidemiological services and disease prevention.
Article 21: Authority of the World Health Assembly to adopt regulations concerning international disease spread, quarantine and related procedures.
Article 22: Entry into force of regulations adopted under Article 21.
The IHR derive their international legal authority from this constitutional framework.
D. International Covenant on Civil and Political Rights (ICCPR)
The ICCPR is important because epidemiological surveillance may interfere with fundamental rights.
Relevant provisions include:
Article 17: Protection against arbitrary or unlawful interference with privacy.
Article 12: Freedom of movement.
Article 19: Freedom of expression and access to information.
Article 26: Equality before the law and non-discrimination.
Restrictions imposed for public-health purposes must satisfy applicable legal requirements and cannot be arbitrary.
E. International Covenant on Economic, Social and Cultural Rights (ICESCR)
Article 12 recognises the right to the highest attainable standard of physical and mental health.
Article 12(2)(c) specifically refers to the prevention, treatment and control of epidemic, endemic, occupational and other diseases.
This provision supports international cooperation in disease surveillance, epidemic prevention and health-system development.
F. International data-protection framework
Cross-border epidemiological surveillance may involve the transfer of sensitive personal information.
Relevant instruments include:
General Data Protection Regulation (GDPR) of the European Union.
Council of Europe Convention 108 and its modernised framework.
OECD Privacy Guidelines.
Convention on the Rights of Persons with Disabilities, where surveillance affects persons with disabilities.
Domestic privacy and cybersecurity legislation.
Under GDPR, health data, genetic data and certain biometric data receive special protection under Article 9.
International transfers are governed principally by Articles 44–49, including adequacy decisions, appropriate safeguards and specified derogations.
A public-health purpose does not automatically eliminate data-protection obligations.
4. Cross-border sharing of epidemiological information
International disease surveillance depends upon the exchange of information between national authorities.
For example, when a hospital in Country A identifies a new infectious disease, the information may pass through several institutions:
Hospital / Diagnostic Laboratory
Initial detection and collection of epidemiological information
National Public-Health Authority
Verification, risk assessment and aggregation
National IHR Focal Point
International notification and communication
World Health Organization
International assessment and coordination
Other Affected Countries
Risk assessment, surveillance and protective action
This system creates several legal questions:
First, accuracy: Who is responsible if incorrect epidemiological information is transmitted internationally?
Second, confidentiality: Can identifiable patient information be transferred without consent?
Third, accountability: Which country is responsible if information is unlawfully disclosed?
Fourth, purpose limitation: Can data collected to control an epidemic subsequently be used for immigration enforcement, commercial research or criminal investigation?
Fifth, retention: How long can international health authorities retain patient-level surveillance information?
Sixth, jurisdiction: Which country's privacy law applies when information passes through multiple countries and service providers?
These questions require coordination between international health law, national constitutional law and data-protection legislation.
5. Privacy and confidentiality in international epidemiological surveillance
Privacy is one of the most significant legal issues in cross-border health surveillance.
Epidemiological records may contain:
Patient names and addresses.
HIV status and other sensitive diagnoses.
Travel histories.
Genetic sequences linked to identifiable persons.
Vaccination records.
Hospitalisation and treatment histories.
Contact-tracing records.
Biometric and location information.
The collection of this information may be necessary to prevent an epidemic. However, unrestricted collection and international disclosure can expose individuals to discrimination, stigma, employment disadvantages and social exclusion.
A lawful surveillance system should generally incorporate the following safeguards:
Clear legal authority for collecting information.
A legitimate and defined public-health purpose.
Necessity and proportionality.
Data minimisation.
Anonymisation or pseudonymisation wherever appropriate.
Encryption and access controls.
Restrictions on secondary use.
Retention and deletion policies.
Independent supervision and audit.
Effective remedies for unlawful disclosure.
Important distinction: Anonymised epidemiological information generally creates fewer privacy risks, but pseudonymised information remains personal data if an individual can still be identified using additional information.
6. Important case laws and judicial principles
There is no single comprehensive international judicial code specifically governing cross-border epidemiological surveillance. Courts have instead developed relevant principles through decisions involving medical confidentiality, infectious diseases, privacy, public-health restrictions, data processing and state accountability.
The following decisions are particularly important.
Case 1: Justice K.S. Puttaswamy v. Union of India (2017)
India – Supreme Court
Citation: (2017) 10 SCC 1.
Facts:
The Supreme Court considered whether the right to privacy was constitutionally protected under the Indian Constitution.
The proceedings involved the constitutional validity of the Aadhaar framework and broader questions concerning informational privacy and individual autonomy.
Legal issues:
Whether privacy constitutes a fundamental right.
Whether the State can collect personal information.
Whether informational privacy is protected by Article 21.
What constitutional limitations apply to governmental data collection?
Judgment:
The nine-judge Constitution Bench unanimously recognised privacy as a fundamental right protected by Article 21 and other freedoms in Part III of the Constitution.
The Court recognised informational privacy as an important aspect of individual privacy.
It also developed a constitutional framework requiring State interference with privacy to satisfy legality, legitimate State purpose and proportionality, together with appropriate safeguards.
Relevance to epidemiological surveillance:
This judgment provides an essential constitutional foundation for evaluating India's epidemiological surveillance systems.
For example, government collection of COVID-19 patient information, digital contact-tracing data, travel histories and genomic information must be examined against constitutional privacy principles.
The State cannot justify unlimited health-data collection merely by invoking public welfare.
Case 2: Balu Gopalakrishnan v. State of Kerala (2020)
India – Kerala High Court
Subject: COVID-19 data sharing and Sprinklr.
Facts:
During the COVID-19 pandemic, the Government of Kerala entered into an arrangement involving Sprinklr Inc., a private technology company, for processing information relating to individuals affected by or potentially exposed to COVID-19.
The arrangement raised concerns about personal-data protection, international processing, confidentiality and access by a foreign private service provider.
Legal issues:
Whether citizens' health information could be processed by an external technology provider.
Whether adequate safeguards existed against unauthorised disclosure.
Whether anonymisation was necessary.
Whether individuals should receive information about third-party access to their data.
Judgment and directions:
The Kerala High Court issued protective directions requiring the State to anonymise COVID-19 data before permitting further access by Sprinklr.
It also directed the State to inform citizens when their data might be accessed by Sprinklr or other third-party service providers and to obtain specific consent in the prescribed circumstances.
Relevance:
This is particularly significant for cross-border epidemiological surveillance because it demonstrates that emergency public-health data processing does not remove the State's obligation to protect citizens' information.
It is relevant to:
Foreign cloud-based health-data processing.
International epidemiological databases.
Outsourcing of disease surveillance.
Government accountability for private data processors.
Anonymisation and consent requirements.
Assettype+1
Case 3: Z v. Finland (1997)
European Court of Human Rights
Citation: Application No. 22009/93, Judgment of 25 February 1997.
Facts:
The case concerned the disclosure of a woman's HIV-positive status during criminal proceedings involving her husband.
Confidential medical information was introduced into judicial proceedings, and the applicant challenged the disclosure and limited duration of confidentiality protection.
Legal issue:
Whether disclosure of confidential HIV-related medical information violated Article 8 of the European Convention on Human Rights.
Judgment:
The European Court of Human Rights emphasised that confidentiality of health information is fundamental to privacy and public confidence in medical services.
The Court found a violation of Article 8 concerning the insufficient duration of confidentiality protection and publication of the applicant's identity and HIV status in the judgment.
Legal principle:
Medical information, particularly information concerning HIV infection, requires especially strong protection.
Relevance:
The decision is important for international disease-surveillance systems because disclosure of infectious-disease information may create stigma and discourage individuals from seeking medical testing.
It establishes that public-health objectives do not automatically justify unrestricted disclosure of identifiable medical records.
Bailii+1
Case 4: I v. Finland (2008)
European Court of Human Rights
Citation: Application No. 20511/03, Judgment of 17 July 2008.
Facts:
The applicant was an HIV-positive nurse working in a hospital. She alleged that her medical records were accessible to hospital employees without adequate protection and that the hospital had failed to ensure sufficient confidentiality.
Legal issue:
Whether the State had fulfilled its positive obligation to protect confidential medical information under Article 8 of the European Convention on Human Rights.
Judgment:
The Court found a violation of Article 8 because the domestic system had not provided sufficient practical safeguards against unauthorised access to the applicant's medical records.
Legal principle:
Protecting medical confidentiality requires more than merely adopting a formal privacy policy. Institutions must implement effective technical and organisational safeguards.
Relevance:
International epidemiological databases should implement:
Role-based access controls.
Authentication mechanisms.
Audit trails.
Monitoring of unauthorised access.
Institutional accountability for data breaches.
This judgment is particularly relevant to multinational health-data repositories and international disease-monitoring platforms.
Case 5: M.S. v. Sweden (1997)
European Court of Human Rights
Citation: Application No. 20837/92, Judgment of 27 August 1997.
Facts:
The case concerned the disclosure of medical information by a social insurance authority to another public authority without the applicant's consent.
Legal issue:
Whether the disclosure of confidential medical information between public authorities was compatible with Article 8.
Judgment:
The Court recognised that disclosure of medical information constitutes an interference with private life. It examined whether the disclosure was supported by law and justified by a legitimate public interest.
The Court found no violation in the circumstances of the case.
Legal principle:
Inter-agency sharing of sensitive medical information must have a lawful basis and must satisfy the applicable proportionality requirements.
Relevance:
The decision is relevant when one country shares epidemiological records with another country's health department, border authority or international public-health institution.
The mere fact that two agencies perform governmental functions does not remove the need for legal safeguards.
Case 6: S. and Marper v. United Kingdom (2008)
European Court of Human Rights – Grand Chamber
Citation: Applications Nos. 30562/04 and 30566/04, Judgment of 4 December 2008.
Facts:
The case involved the retention of fingerprints, cellular samples and DNA profiles of individuals who had not been convicted of criminal offences.
Legal issue:
Whether the indefinite retention of sensitive biometric and genetic information violated Article 8.
Judgment:
The Court found a violation of Article 8, emphasising the need for appropriate limits on the retention of personal data.
Legal principle:
The State must justify the retention of sensitive personal information and cannot adopt indiscriminate retention policies without adequate safeguards.
Relevance:
This judgment has considerable significance for cross-border genomic epidemiological surveillance.
Pathogen surveillance may involve genetic data obtained from human samples. Such information must not automatically become part of permanent personal databases without lawful justification.
The decision also supports restrictions on unnecessary retention and indiscriminate secondary use.
Case 7: Vavřička and Others v. the Czech Republic (2021)
European Court of Human Rights – Grand Chamber
Citation: Applications Nos. 47621/13 and others, Judgment of 8 April 2021.
Facts:
The applicants challenged the Czech Republic's childhood vaccination requirements and related consequences for non-compliance.
Legal issue:
Whether compulsory vaccination arrangements interfered with the right to respect for private life under Article 8.
Judgment:
The Grand Chamber found no violation of Article 8.
It accepted that public-health protection could justify proportionate vaccination requirements under the circumstances examined.
Legal principle:
Public-health objectives can justify certain restrictions on individual autonomy, but the measures must remain within the limits of legality, necessity and proportionality.
Relevance:
Although this was not a cross-border surveillance case, it provides an important principle for evaluating health-monitoring measures associated with international travel, vaccination verification and disease-control programmes.
It does not establish that every surveillance or data-sharing measure is automatically lawful.
Case 8: Jacobson v. Massachusetts (1905)
United States Supreme Court
Citation: 197 U.S. 11 (1905).
Facts:
During a smallpox outbreak, Massachusetts imposed a compulsory vaccination requirement. Jacobson challenged the measure.
Legal issue:
Whether a State could exercise its public-health powers to impose vaccination requirements.
Judgment:
The US Supreme Court upheld the vaccination requirement in the circumstances of the case.
Legal principle:
States possess substantial police powers to protect public health, although those powers are not unlimited and cannot be exercised arbitrarily or unreasonably.
Relevance:
The decision provides historical support for governmental authority to adopt public-health measures in response to epidemics.
In cross-border epidemiological surveillance, this principle must be read alongside modern constitutional privacy protections and international human-rights obligations.
7. Indian legal framework governing cross-border epidemiological surveillance
India's framework involves constitutional rights, public-health legislation, data protection, disease-control regulations and international obligations.
A. Constitution of India
The following constitutional provisions are particularly important:
| Provision | Relevance |
|---|---|
| Article 14 | Equality and non-arbitrary surveillance |
| Article 19 | Freedom of movement and other protected freedoms, subject to applicable restrictions |
| Article 21 | Privacy, dignity and personal liberty |
| Article 32 | Constitutional remedies before the Supreme Court |
| Article 226 | Judicial review by High Courts |
| Seventh Schedule, State List, Entry 6 | Public health and sanitation, hospitals and dispensaries |
| Seventh Schedule, Union List, Entry 28 | Ports and quarantine, including quarantine connected with ports |
| Seventh Schedule, Union List, Entry 81 | Inter-State migration and inter-State quarantine |
Public-health surveillance therefore operates within a constitutional distribution of governmental powers.
B. Epidemic Diseases Act, 1897
The Epidemic Diseases Act provides powers to take special measures and prescribe regulations for preventing the spread of dangerous epidemic diseases.
Important provisions include:
Section 2: Powers of State Governments to prescribe temporary regulations when an ordinary legal framework is insufficient to prevent an epidemic.
Section 2A: Powers of the Central Government concerning inspection and detention of ships or vessels arriving at or departing from ports and related preventive measures.
Section 3: Penalties for disobeying regulations or orders made under the Act.
Section 4: Protection for persons acting in good faith under the Act.
The legislation is relevant to border surveillance, quarantine and infectious-disease control.
However, it does not by itself create an unlimited authority to collect or transfer all forms of personal health information internationally.
C. Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 is relevant to digital processing of personal health-related information.
Important areas include:
Lawful processing of digital personal data.
Notice and consent requirements, subject to statutory exceptions.
Obligations of data fiduciaries.
Security safeguards.
Breach notification.
Rights and grievance mechanisms.
Cross-border transfer restrictions under Section 16.
Section 16 empowers the Central Government to restrict transfers of personal data to specified countries or territories, subject to the statutory framework.
A critical distinction is that the Act does not create a separate general category of sensitive personal data equivalent to GDPR's special-category health data.
Its application must also be assessed in light of the statutory exemptions, applicable rules and commencement notifications.
D. Information Technology Act, 2000
Relevant provisions include:
Section 43A: Compensation relating to failure to protect sensitive personal data or information, subject to its current statutory applicability.
Section 72: Punishment for breach of confidentiality and privacy.
Section 72A: Punishment for disclosure of information in breach of a lawful contract.
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 have historically been important for medical and health information.
Their continuing application must be considered alongside the commencement and transitional arrangements of the DPDP framework.
E. Disaster Management Act, 2005
The Disaster Management Act provides an institutional framework for disaster preparedness, coordination and response.
During a pandemic, its provisions may be relevant to:
National disease-response coordination.
Collection of information needed for disaster management.
Inter-agency cooperation.
Emergency public-health planning.
Its emergency powers must nevertheless operate within constitutional and statutory limitations.
F. International Health Regulations and India
India is a State Party to the IHR.
Consequently, it must maintain appropriate surveillance and response capacities, assess relevant public-health events and fulfil applicable international notification and cooperation obligations.
This is particularly important where outbreaks may spread through:
International airports.
Seaports.
Cross-border land routes.
International commercial transportation.
Migrant-worker movements.
Wildlife and animal-trade networks.
8. Legal regulation of cross-border genomic surveillance
Genomic epidemiological surveillance involves analysing genetic material from pathogens to identify mutations, transmission patterns, emerging variants and possible disease origins.
Covid-19: How genome sequencing process is done in labs | See pics - India Today
PulseNet: About Our Work | PulseNet | CDC
10
This form of surveillance raises several legal problems.
1. Ownership of biological samples
A country may collect biological samples from patients within its territory. Questions arise regarding authority to export those samples, ownership, permitted research uses and benefit-sharing.
2. Human genetic privacy
Where samples contain human genetic information, the transfer may implicate privacy, confidentiality and genetic-data protection laws.
3. Pathogen sequence information
Pathogen genomic sequences may be shared internationally to assist outbreak detection. However, the sharing of sequence information can raise questions about intellectual property, access to research materials and equitable distribution of resulting benefits.
4. Research consent
A sample collected for diagnostic purposes should not automatically be treated as unrestricted permission for every subsequent research or commercial purpose.
5. National sovereignty
States may regulate the collection and export of biological materials under their domestic laws and applicable international agreements.
6. Misuse of information
Sensitive pathogen information may create biosafety and biosecurity risks if improperly disclosed or used.
Accordingly, genomic surveillance requires coordination between international health law, biotechnology regulation, biodiversity law, research ethics and data-protection legislation.
9. Legal challenges in cross-border epidemiological surveillance
| Challenge | Legal concern | Required safeguard |
|---|---|---|
| Conflicting national laws | Different legal standards for data collection | Harmonisation and transfer agreements |
| Unauthorised disclosure | Violation of confidentiality | Encryption and access controls |
| Inaccurate reporting | Incorrect international risk assessment | Verification and quality controls |
| State non-cooperation | Delayed outbreak notification | IHR compliance mechanisms |
| Excessive surveillance | Interference with privacy | Necessity and proportionality |
| Digital discrimination | Unfair treatment based on health status | Equality protections |
| Commercial exploitation | Unauthorised secondary use | Purpose limitation |
| Data retention | Permanent storage of sensitive information | Retention and deletion rules |
| Cyberattacks | Exposure of international databases | Cybersecurity obligations |
| Jurisdictional conflicts | Uncertainty about applicable law | Clear jurisdiction and liability rules |
| Genomic data misuse | Privacy and biosecurity risks | Controlled access and oversight |
10. State responsibility and international accountability
Cross-border epidemiological surveillance creates obligations for States at both national and international levels.
A. Failure to notify an outbreak
If a State fails to notify WHO of a public-health event that meets the IHR notification criteria, questions of compliance with international obligations may arise.
Article 6 of the IHR establishes the notification obligation.
B. Deliberate concealment of epidemiological information
Deliberate concealment or manipulation of outbreak information can undermine international disease-control cooperation.
It may also affect other States' ability to protect their populations.
C. Unlawful transfer of health information
If a government transfers identifiable patient records to an overseas institution without sufficient legal authority or safeguards, it may face constitutional, administrative or data-protection liability under applicable law.
D. Failure to protect international databases
A State or institution responsible for a surveillance database may face legal consequences if inadequate security results in unauthorised disclosure.
E. Discriminatory surveillance
Surveillance systems should not discriminate against individuals because of nationality, ethnicity, disability, immigration status or medical condition.
The legality of differential treatment must be assessed under applicable constitutional and human-rights standards.
F. Lack of effective remedies
Individuals should have access to appropriate procedures for challenging unlawful collection, disclosure or retention of their personal information.
An important distinction is that an IHR breach does not automatically produce an international damages award. International responsibility, available remedies and enforcement mechanisms depend on the applicable legal rules and jurisdiction.
11. Relationship between epidemiological surveillance and human rights
The legality of surveillance can be evaluated through a proportionality framework.
| Legal requirement | Explanation |
|---|---|
| Legality | Surveillance must have a clear legal basis |
| Legitimate objective | It must pursue a recognised public-health purpose |
| Necessity | Collection must be genuinely required |
| Proportionality | Intrusion must not exceed what is justified |
| Non-discrimination | Measures must not arbitrarily disadvantage groups |
| Transparency | Individuals should receive appropriate information |
| Accountability | Authorities must be subject to supervision |
| Remedy | Unlawful interference must be capable of challenge |
The essential principle is that public-health protection and individual privacy should operate together rather than being treated as mutually exclusive objectives.
12. Emerging legal issues
Several new issues are transforming the regulation of cross-border epidemiological surveillance.
A. Artificial intelligence-based outbreak prediction
AI systems can analyse international travel patterns, clinical records, genomic sequences and environmental data to predict outbreaks.
Legal questions include:
Who is liable for an incorrect outbreak prediction?
Can an AI system independently classify a population as an epidemic risk?
What level of human supervision is required?
Can individuals challenge automated risk classifications?
B. Satellite and mobility-based surveillance
Satellite imagery, mobile-phone location information and transportation databases may help identify disease transmission patterns.
However, their use may interfere with privacy and freedom of movement.
C. Wastewater epidemiological surveillance
Wastewater monitoring can identify infectious-disease trends without testing every individual.
However, surveillance of small communities or particular buildings may indirectly reveal information about identifiable persons.
D. Cross-border biometric health monitoring
Digital health certificates, biometric identification and traveller-monitoring systems raise concerns about the collection and international transfer of identity-linked health information.
E. Climate-related epidemiological surveillance
Climate change can alter the geographical distribution of infectious diseases, including vector-borne illnesses.
International monitoring therefore requires cooperation between environmental, agricultural, veterinary and public-health authorities.
F. Private-sector epidemiological surveillance
Technology companies, laboratories, cloud providers and pharmaceutical businesses increasingly participate in international disease-monitoring systems.
Governments must establish clear contractual, statutory and technical safeguards to prevent misuse of public-health information.
13. Important international institutions
Data withheld from WHO team probing COVID-19 origins in China - Tedros | Nippon.com
World Health Organization
International coordination, IHR implementation, outbreak reporting and public-health guidance.
International Health Regulations
European Centre for Disease Prevention and Control
European disease surveillance, epidemiological intelligence and cross-border outbreak coordination.
Office of the UN High Commissioner for Human Rights
Human-rights protection, privacy and equality in public-health interventions.
World Organisation for Animal Health
International animal-health surveillance and cooperation under the One Health approach.
14. Critical analysis
Cross-border epidemiological surveillance operates at the intersection of state sovereignty and international cooperation.
Its effectiveness depends on States sharing accurate information promptly. Nevertheless, international cooperation cannot be used as a justification for unrestricted access to personal medical records.
Three major tensions deserve particular attention.
First: Public health versus privacy.
Excessive confidentiality restrictions may delay the sharing of information needed to contain an epidemic. Conversely, indiscriminate disclosure can discourage people from seeking diagnosis and treatment.
Second: National sovereignty versus international responsibility.
States retain authority over their domestic health systems, but infectious diseases can create international risks. The IHR therefore establishes cooperation and notification obligations without transferring general sovereign control over national health policy to WHO.
Third: Technological efficiency versus legal accountability.
AI, genomic sequencing and international cloud databases can improve disease detection. However, technological efficiency cannot replace lawful authority, transparency, human supervision and effective remedies.
A further weakness is the limited availability of direct judicial decisions dealing specifically with international epidemiological data transfers. Courts generally resolve the underlying questions through privacy, medical confidentiality, administrative law, constitutional rights and public-health jurisprudence.
15. Conclusion
Cross-Border Epidemiological Surveillance Law is an increasingly important component of international health governance.
The International Health Regulations (2005), particularly their 2024 amendments, provide the central international framework for surveillance, notification, verification and cooperation between States.
The judicial principles developed in Justice K.S. Puttaswamy v. Union of India, Balu Gopalakrishnan v. State of Kerala, Z v. Finland, I v. Finland and S. and Marper v. United Kingdom demonstrate the importance of privacy, confidentiality, proportionality and institutional accountability.
The future development of this legal field requires:
Stronger international epidemiological reporting mechanisms.
Harmonised cross-border health-data protection standards.
Effective regulation of genomic surveillance.
Transparent international data-sharing agreements.
Independent oversight of AI-based disease surveillance.
Stronger cybersecurity and confidentiality safeguards.
Clear responsibility for unlawful international data processing.
Equitable access to epidemiological information and public-health technologies.
Ultimately, the governing legal principle should be that international disease surveillance must protect populations without unnecessarily sacrificing individual privacy, dignity, equality and fundamental rights.
16. Important case-law and statutory reference list
| Case / instrument | Main legal principle |
|---|---|
| Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 | Constitutional privacy and informational autonomy |
| Balu Gopalakrishnan v. State of Kerala (2020) | COVID-19 data sharing and anonymisation |
| Z v. Finland (1997), App. No. 22009/93 | Medical confidentiality |
| I v. Finland (2008), App. No. 20511/03 | Security of electronic medical records |
| M.S. v. Sweden (1997), App. No. 20837/92 | Medical information disclosure |
| S. and Marper v. United Kingdom (2008), Apps. Nos. 30562/04 and 30566/04 | Retention of genetic and biometric information |
| Vavřička v. Czech Republic (2021), App. No. 47621/13 and others | Public-health restrictions and proportionality |
| Jacobson v. Massachusetts (1905), 197 U.S. 11 | State public-health powers |
Principal legislation and international instruments:
International Health Regulations, 2005, as amended in 2024.
WHO Constitution, 1946.
International Covenant on Civil and Political Rights, 1966.
International Covenant on Economic, Social and Cultural Rights, 1966.
General Data Protection Regulation, 2016.
Convention 108 and its modernised framework.
Constitution of India, 1950.
Epidemic Diseases Act, 1897.
Digital Personal Data Protection Act, 2023.
Information Technology Act, 2000.
Disaster Management Act, 2005.
Useful primary research sources:
WHO – International Health Regulations
WHO – 2024 IHR amendments entering into force
European Court of Human Rights – Z v. Finland
Kerala High Court – Sprinklr COVID-19 data-sharing judgment
These authorities provide a foundation for studying cross-border epidemiological surveillance as a distinct subject within international health law, constitutional law, biotechnology regulation and international data-protection law.
RELATED Blog
comments