Skip to content

Response to Media Enquiry or Report

Response to Media Enquiry or Report

Date: 3 March 2020

Response to media enquiry on the media statement issued by the PCPD entitled “The Use of Information on Social Media for Tracking Potential Carriers of COVID-19”


Thank you very much for your email enquiry about the media statement of the office of Privacy Commissioner for Personal Data (PCPD) titled “The Use of Information on Social Media for Tracking Potential Carriers of COVID-19”. Our response to your enquiry is as follows:
 
Answer to Q1:
The above-mentioned media statement issued on 26 February 2020 was made in response to a hypothetical question raised by a media agency, namely South China Morning Post.  There is no information suggesting that the use of information on social media for tracking potential carriers of COVID-19 is already taking place.
 
Answer to Q2:
“The third parties” refers to parties other than the data subjects concerned (e.g. suspected patients) and the original data users (e.g. port health authority).  Examples of “the third parties” may include hospitals, welfare authority, etc, from whom the data subjects can obtain the necessary public services.
 
Answer to Q3:
Please see our answer to Q1.
 
Background
  • The Personal Data (Privacy) Ordinance (PDPO) does not require any party to inform the PCPD of conducting the said monitoring and how it is conducted. As a data protection authority, the PCPD promotes, monitors and supervises organisations’ compliance with the requirements of the PDPO when collecting and using personal data. 
     
  • As you may have noted from the aforesaid media statement, the PDPO provides for certain situations where breach of the general rule on the use of data without consent may be saved by the fact that the misuse arises from the need to protect public health. Under Section 59(2) of the PDPO, in circumstances where the application of the restrictions on the use of data would be likely to cause serious harm to the physical or mental health of the data subject or any other individual, the data user can disclose the identity or location of a data subject to a third party without the consent of the data subject.
     
  • Principle-based, the PDPO does not specify under what scenarios and what parties ought to be involved for section 59(2) to be applicable.  The legislative intent of section 59(2) of the PDPO is to provide timely access to personal data such as someone’s identity and location where necessary, so that the relevant and appropriate personnel can act promptly and render necessary services to prevent the individuals concerned or the community at large from being subjected to serious harm to their physical or mental health.
     
  • At the risk of repeating the aforesaid media statement, the PCPD believes that there are sufficient legal and justifiable bases, whether under international law or local health-specific and personal data privacy legislation, on which the government may collect and use information obtainable offline or online with the aid of devices, applications, software or supercomputers with a view to tracking potential COVID-19 carriers or patients in the interests of both the individuals concerned and the public, not to mention the fact that the same approach has been adopted in many other jurisdictions as widely reported in the media.