This thesis research comes from combining a theoretical problem with an empirical problem.
The theoretical problem of this thesis roots from scholars of securitization theory debating the
context in which securitization can occur. The original founders of the theory, Copenhagen
School, understood securitization can occur in a nation-state environment. This statement was
a departure point for the scholars to argue that securitization can and is carried out by
international organizations in the role of securitization actors. This brings out the empirical
problem of this thesis, which puts the European Union in the role of the securitization actor in
the current Covid-19 pandemic. This puts the Member States in the role of the securitization
audience. The measure suggested by the European Union for the Member States is processing
personal health data to curb the spread of the virus. Furthermore, this thesis aims to look at
the securitization implications of the interactions of States and IOs regarding health data. The
research question of this thesis is: To what extent is securitization theory applicable in case of
the EU’s framing of use of personal health data to curb the spread of Covid-19?”
This thesis carries out a comparative case study and frame analysis of the relevant documents
published by the European Union and chosen Member States. These states are Denmark,
Finland, Hungary, Ireland, Lithuania, Luxembourg. Frame analysis of this thesis investigated
the role of the European Union as a securitization actor and the role of the Member States as
an audience.
This frame analysis showcased that the European Union frames Covid-19 as a threat due to
its challenges to functioning society. The argument is that a health crisis ultimately leads to
unemployment, economic losses, discrimination, disinformation etc. Therefore, the European
Union as a securitization actor strives for more coherent and unified responses. The aim is for
the States to follow the GDPR when processing subject’s health data and that the States
ensure maximum level of safety alongside with following the fundamental human rights.
However, within the responses of the States there can be seen levels of fragmentation. This
means that although the States all comply to following GDPR when processing subject’s data
in a state of crisis, all of them do so accordingly to their own judgement. Different states
define health data differently, assign the role of data processor to a different entity, and
assigns different responsibilities to different stakeholders, such as the state or the employers.
This fragmentation comes from not specific definitions by the European Union. These
lacking definitions are found within health data, emergency, and data collector/ data
processor. This is because of the character of GDPR as a Regulation, which aims to appeal to
each State, as all States must comply to it. Furthermore, GDPR has been created and
implemented before the pandemic. This interpretation leads to the States having certain
amounts of power, as they can adjust the rules set out from the European Union to their
specific conditions. Therefore, the Member States act as an empowering audience, with the
power to adjust the measures to their national judgements and they get to influence the
decisions made by the European Union.
The answer to the research question is that securitization is largely possible in the context of
the EU, however it leads to different reactions within the Member States. There is considered
fragmentation found within how the States approach the processing of personal health data as
a securitization response. The EU as a securitization actor owns certain amounts of power
and authority and influences behaviors of the Member States. The Member States also
influence the way that the EU produces guidelines in the state of emergency.