BY
As the coronavirus pandemic gets worse, privacy commissioners are lifting data restrictions for health officials to keep track of the outbreak.
As the coronavirus pandemic gets worse, privacy commissioners are lifting data restrictions for health officials to keep track of the outbreak. A review of policy changes around the world shows that data protection agencies are prioritizing lives over privacy, and it could be a sign of what’s to come for the US.
In Hong Kong, the city’s privacy commissioner said in February that authorities would track quarantined people with their permission via smartphone tracking. In the UK, the Information Commissioner’s Office gave an advisory on enforcement as recently as March 12. The Global Privacy Assembly, a group of more than 130 data protection authorities, noted changes surrounding data privacy brought on by the pandemic in at least 27 countries.
The organization said it’s committed to making sure people’s data is not abused.
“We are confident that data protection requirements will not stop the critical sharing of information to support efforts to tackle this global pandemic,” the GPA’s executive committee said in a statement on Tuesday. “The universal data protection principles in all our laws will enable the use of data in the public interest and still provide the protections the public expects.”
The changes to guidelines have varied across countries, but a clear trend has emerged. In regions where conditions are worst, officials are focusing on public health over privacy. That’s led some governments to use phone location data to track the coronavirus’ spread and decide on how to quarantine communities affected by COVID-19, the respiratory illness caused by the virus.
The method, used in China and South Korea, has been lauded as successful. The World Health Organization has discussed how public health surveillance can provide an early warning for outbreaks and allow for effective policies.
At a media briefing on March 16, the WHO’s director-general, Tedros Adhanom Ghebreyesus, said there needed to be more technological measures for tracking the coronavirus outbreak.
“We haven’t seen an urgent enough escalation in testing, isolation and contact tracing, which is the backbone of the COVID-19 response,” he said. “You cannot fight a fire blindfolded. And we cannot stop this pandemic if we don’t know who is infected.”
But the tracking carries privacy risks because location data can reveal a lot of sensitive information about our lives. The US is considering similar measures and could rely on data collected by Facebook, Google and other companies. That’s raised concerns among some legislators, including Sen. Ed Markey, a Democrat from Massachusetts.
Unlike many countries, the US doesn’t have a sole office tasked with data privacy issues. Still, government agencies are altering privacy standards to deal with the coronavirus outbreak. On Tuesday, the Department of Health and Human Services said it was waiving penalties for violations related to health data privacy standards so more doctors could video chat with patients.
If changes enacted in other countries are an indication, further loosening of US privacy protections could be on the way. The government has already consulted with the tech industry about ways to use aggregated data to determine population density, according to a person familiar with the discussions. Requests for data, however, could get more specific if the pandemic worsens in the US.
The Trump administration didn’t respond to a request for comment.
“With the pandemic, government, companies and research institutions are scrambling to respond in a way that makes optimal use of information about individuals’ whereabouts and health conditions, while maintaining our democratic values and civil liberties,” Omer Tene, vice president of the International Association of Privacy Professionals, said in a statement. “In contrast, in its response, China could weigh heavily on the side of public safety, throwing individual rights under the bus. For us, this isn’t a plausible approach.”
The TraceTogether app from Singapore’s government uses Bluetooth on people’s phones to track who they’ve been in contact with.
Screenshot by Alfred Ng / CNET
Asia
The epicenter of the coronavirus outbreak is Wuhan, China, a city about 570 miles north of Hong Kong.
Hong Kong, which experts say has contained the virus’ spread, has fewer than 170 cases and four deaths, thanks to its drastic measures to track and quarantine those with the disease. Those measures include using location data to track people’s movement during its quarantine, and checking in to make sure people are staying place if quarantined.
Authorities obtained consent from people under quarantine before tracking them, according to Hong Kong’s privacy commissioner. It’s unclear how that consent was obtained.
On Feb. 12, the agency said health crises were exempt from its privacy laws. Protecting lives during an outbreak like the coronavirus is more important than privacy, it said.
“The right to life refers not only to the right of life of the data subject, but also to the right to life of others in society,” the Hong Kong data commissioner’s office said. “This right is particularly important in epidemics.”
Singapore has taken similar measures, on Friday launching an app called TraceTogether that’s designed to build a record of people exposed to a potentially infected person. The app tracks, identifies and keeps a log of those who’ve been within two meters of each other for at least 30 minutes by using a phone’s Bluetooth technology to connect with other devices that have the app installed and Bluetooth enabled.
The app is voluntary to download, but the country’s government has been encouraging citizens to use it as part of a public health effort. Officials said that the data is encrypted locally and the government will only get data from people who give consent. But if you don’t give consent, you could be prosecuted under Singapore’s Infectious Disease Act.
The government said that it would end the app once the coronavirus outbreak is over, and people will be instructed on how to delete the data stored on their phones.
“The engineering that our GovTech team has spent thousands of man-hours on is fairly elegant in the sense that it preserves a fair degree of privacy,” Puthucheary said.
On Thursday, the death toll in Italy rose to 3,405, overtaking China. Ten days earlier, the Italian government changed broad policies, including data policies, to help deal with the coronavirus outbreak. Most of the changes addressed resources for its National Health Service.
Tucked away under “Other Provisions” in the changes, the government noted alterations to how it handles personal data in a national emergency, which Italy declared on Jan. 31. Because of the national emergency, the notice read, restrictions on processing personal data would be lifted until at least July 30.
Lifting restrictions make it easier to share data, including biometrics and health information, with the government and health workers. Stil, the new provisions aren’t open-ended. They are specifically restricted to data that will help manage the COVID-19 health crisis, according to a translation of the notice.
Vodafone, a major phone provider in Europe, said it is producing an aggregated and anonymized heat map for Italy’s Lombardy region, which it said would help health officials understand how the population is moving around.
“It may become increasingly important for governments to understand people’s movements to contain the spread of the virus, especially inside and to/from areas under quarantine,” the company said in a statement. “Wherever technically possible, and legally permissible, Vodafone will be willing to assist governments in developing insights based on large anonymised data sets.”
A Wired Italy article stated that Facebook has been providing an anonymized data set of people’s movement to the University of Pavia. The data shows the flow of movement from the northern to southern regions in the country on March 7, according to the report. Facebook didn’t respond to a request for comment.
Italy is a part of the European Union, which has its own view on how data privacy should be handled during the pandemic. The EU’s General Data Protection Regulation typically requires consent for processing personal data, but it also allows for public health officials to gather that information without permission during epidemics.
Comments