Data Protection and the use of personal data during the Covid 19 pandemic

From the archive. This article is preserved as originally published. References to laws, technology and events reflect its publication period.

The Corona Virus

I doubt it has escaped any ones' attention that we're in the middle of a health and economic emergency. Many people have succumbed to viral pneumonia since November 2019 and has become a global phenomena since earlier this year.

I'd like to draw attention to the various approaches that countries have taken with the treatment of personal data and public health. It highlights the differences in appetite for privacy intrusion.

It will be interesting to see how Germany approaches this conundrum, as they are proposing to introduce a tracking system for rapid contact tracing.

GDPR Article 23 does provide a route to curtail or suspend data protection provisions, though that has not happened yet.

Meanwhile, 164 years ago, the development of epidemiology

The use of big data, data analysis and data visualisation in health and medicine was pioneered by a very forward looking Florence Nightingale, of course she is also well known for the advancement of nursing, sanitation and promoting good hygiene to prevent deaths.

During her time at Crimean war field hospitals (1856), her use of accurate record keeping enabled her to prove that poor sanitary practices were the main culprit of high mortality in hospitals. By using applied statistical methods, she made a case for eliminating the practices that contributed to the unsafe and unhealthy environment.

I'm sure you can see the parallels between what she did 164 years ago has contributed to saving many lives in peace time, times of war and times of epidemics.

To bring this up-to-date, various countries have employed different methods of tracking and monitoring the spread of COVID19 and the virus, SARS-CoV-2.

South Korea

Has employed a rigorous testing regime, combined with a “patient information navigation” system to provide accurate information on the movement of its citizens and visitors. The app tracks users movements and whether they've tested positive for the COVID 19 virus, it works retrospectively, so that if you have been in contact with someone that test positive at a later date, the app will inform you. The South Korean government has made this data open and its updated hourly, there's even an API for this information which has spawned a myriad of independent websites showing if you're within 100m of someone who is infected.

Obviously there are privacy concerns with this, even though the information is anonymised, it has already lead to embarrassing revelations.

Names are not disclosed but details include age, and where the person lives or works.

There is enough information provided to derive people's identity as people can be tracked from their home to the coffee shop they use enroute to the office for example.

An app like this would be very unlikely to be accepted by Europeans or people in the USA. It definitely transgresses GDPR rules on special categories of personal data, location data and the level of anonymisation would not satisfy GDPR requirements.

Hong Kong and Taiwan

Hong Kong, Taiwan have taken a similar approach and strategy to the pandemic, by utilising a combination of tracking technologies and a Test, trace and track strategy which according to the data has proved very effective in minimising transmission and allows the authorities to target specific areas down to specific people.

Taiwan is tracking individuals cell phones; in metropolitan areas it is possible to get an accurate and reliable location. Visitors and returning citizens have to agree to two weeks of tracking.

Hong Kong has been issuing people arriving at immigration with armbands with a barcode which needs to be scanned at particular intervals using a smartphone with the requisite app.

Singapore

Has controlled COVID19 very well and has suppressed the level of infections seen in many countries in Europe. Singapore has developed a mobile app called TraceTogether, which is designed to facilitate contact tracing should its users contract the coronavirus. The app uses Bluetooth signals to detect other participating mobile devices in close proximity to allow them to identify those who have been in close contact when needed.

The app is able to estimate the distance between TraceTogether smartphones as well as the duration of such interactions. It also plans to make it opensource to allow other countries to benefit and minimise development time.

China

Where the first case were first reported; what are they doing ?

Provincial and central authorities have made extensive use of big data from many sources. China is one of the most well-integrated countries in terms of data sharing, this has been used in social credit systems where the way you act in your day-to-day activities and day-to-day behaviour is marked as positive or negative to society as a whole. Imagine it as a credit scoring system, but very much extended to whether you return your library books on time, to jay walking, breaking speed limits, using a cell phone whilst driving for example. Donating to charity and giving your time to deemed worthy causes will improve your score.

Electronic payment by QR code and NFC (near field communications such as waving your cellphone at ticket barriers) is very well established in China and is extensively used for paying for bus fares, coffee and other payments. This information is collected by the two major players in this area, Alipay and WeChat.

This information is being used to provide information to Alipay Health Code, give users colour-coded designations based on their health status and travel history, and a QR code that can be scanned by authorities.

The Alipay Health Code and similar indicators stipulate who can travel and who must stay in quarantine, they are tools which are being used to unwind the health lockdowns in China and to help identify further outbreaks of the virus.

There have been concerns over the transparency of these systems and the fact that financial institutions have developed and running the algorithms that these apps rely on.

As well as reporting on health, the user's ID and passport number are also collected.

Privacy Concerns raised in Europe

Ireland's Health Service Executive (HSE) is also preparing to release a contract tracing app based on Singapore's efforts.

“The HSE app might lead to two separate outcomes,” warns Elizabeth Farries, technology and human rights expert at the Irish Council for Civil Liberties.

The first (outcome) is to trace contacts in order to fight Covid-19. The second is to further normalise surveillance.

The fear for privacy advocates is the normalisation of state or pseudo-state surveillance.

Practical Aspects of Data Protection Around the world

What you can and can not ask for and share

Data Protection and Covid 19 - a useful guide from Bird & Bird (a renowned international law firm) on what you currently can and can not do with personal data with regards to C19 in across Asia, Australia and Europe.

PDF here

-------------------------------------------------------------------------------------------------------------

I'm keen to explore the privacy aspects of the above, so do join in and comment (assuming you've read this far!)

Do come back every so often, as I often update my articles with new material.

This text may be used in non-profit making organisations with full attribution.