Media Statements

The Use of Information on Social Media
for Tracking Potential Carriers of COVID-19
 

In response to media enquiry about the use of information on social media for tracking potential carriers of COVID-19, the office of the Privacy Commissioner for Personal Data (PCPD) makes the following response:
 

• The general rule is that, information including personal data obtained from the social media, which is a public domain, is also regulated by the Personal Data (Privacy) Ordinance (Cap 486) (PDPO) in that the use of personal data must be consistent with or directly related to the original purpose for which the data is collected.  For example, further use of information obtained from a chat group must be for the same purpose of furthering the chat. Should the information be used for a different purpose, as in the case of tracking potential virus carriers, prior consent of the parties concerned must be obtained.  The intention of Data Protection Principle 3 (DPP 3) under the PDPO is quite clear, namely to protect one’s personal data from being abused or misused because the data belongs to the individual concerned and his personal data privacy is a fundamental human right.
   
• That said, personal data privacy right is not an absolute right. What it practically means is that it may be subject to other competing rights or interests, such as the absolute right to life and the interests of the public, including public health.
   
• The right to life refers not only to the right of life of the data subject, such as the potential carrier of the virus, but also that of others in society.  In its general comment on the “right to life” under the International Covenant on Civil and Political Rights issued in October 2018, the UN Human Rights Committee confirmed that the right to life is a supreme right and the duty to protect life implies that governments should take appropriate measures to address the general conditions in society that may give rise to direct threats to life (including the prevalence of communicable diseases).
   
• In addition, COVID-19 had been added as one of the notifiable infectious diseases under the Prevention and Control of Disease Ordinance (Cap 599).  All registered medical practitioners are required to notify the Centre for Health Protection of the Department of Health of all suspected or confirmed cases of COVID-19. The Centre for Health Protection is also tasked to conduct surveillance and control of COVID-19.  If persons are suspected of having close contacts with infected persons, it would be in the public interest to closely monitor their whereabouts, including the venues and the persons that they have visited and contacted, with the aim to control further spread of COVID-19 in the community. The intention of this legislation is also clear, namely to track the potential virus carriers.
   
• There is also an exception to the general rule under our privacy law.  Section 59 of the PDPO provides for the situations where the use of personal data may be exempted from the application of DPP 3 (use of data) if it relates to safeguarding the physical or mental health concerns of the data subject or any other individual in the interests of the public. In other words, any breach of the general rule on the use of data without consent may be saved by the fact that the misuse arises from the need to protect public health. In particular, section 59(2) of the PDPO states that in circumstances where the application of the restrictions on the use of data would be likely to cause serious harm to the physical or mental health of the data subject or any other individual, personal data relating to the identity or location of the data subject may be disclosed to a third party without the consent of the data subject.
   
• To sum up, the Privacy Commissioner Stephen Kai-yi WONG says “there are sufficient legal and justifiable bases, whether under international law or local health-specific and personal data privacy legislation, on which the government may collect and use information obtainable offline or online with the aid of devices, applications, software or supercomputers with a view to tracking potential COVID-19 carriers or patients in the interests of both the individuals concerned and the public, not to mention the fact that the same approach has been adopted in many other jurisdictions”.