Since its outbreak towards the end of 2019, COVID-19 has quickly escalated into a global health crisis. Characterised by the World Health Organisation as a pandemic in March 2020, COVID-19 has infected over 116 million people and claimed over 2.5 million lives worldwide. Governments around the world have been using unorthodox technological measures to help them fight the pandemic. Among others, public health surveillance technologies such as contact tracing or exposure notification mobile apps have been regarded globally as a crucial and novel way to help contain its spread. While public health surveillance technologies have become an integral part of many pandemic prevention and containment strategies, data protection authorities ('DPAs') around the world stress that all stakeholders should always be vigilant about the personal data privacy concerns that are raised in the process.
Contact tracing apps: trends and best practices
To address privacy challenges posed by the pandemic, the Global Privacy Assembly ('GPA') established the COVID-19 Taskforce in May 20201. Taking an active role in the COVID-19 Taskforce, my office spearheaded the compilation of the Compendium of Best Practices in Response to COVID-192 ('the Compendium'), which contained relevant experience and best practices contributed by 32 GPA members and observers from different geographic regions, through a survey conducted in August and September 2020 ('the Survey').
The use of contact tracing apps was featured as one of the main topics in the Compendium. According to the Survey's results, jurisdictions commonly deployed digital technologies for the purpose of contact tracing (84%), and the majority of them (72%) were in the form of contact tracing apps. Many of these contact tracing apps (84%) used the Bluetooth signals of mobile phones to keep records of individuals who had come into close proximity of each other, which allowed public health officials to notify or even quarantine people who had been in close contact with the infected. The use of almost all contact tracing apps reported in the Survey (except those for enforcing quarantine orders) were voluntary.
The level of privacy protection for different contact tracing apps may vary. For example, for contact tracing apps adopting a centralised approach, personal data of users is collected and stored in a central database upon registration. Often, anonymised proximity data collected by the apps will be uploaded to central servers when the users become infected, thus allowing the relevant authorities to trace their close contacts. On the other hand, in a decentralised approach, registration is usually not required. Anonymised proximity data collected by the apps would remain on the users' mobile devices. Only the pseudonym IDs of the infected users assigned by the app will be uploaded to central servers in order to notify those who may have been exposed to the virus.
The decentralised approach is more privacy-friendly because information on the infected users' close contacts is not accessible centrally by the relevant authorities. In the 'Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak'3 issued in April 2020, the European Data Protection Board took the view that the decentralised approach was the most in line with the principle of data minimisation.
On the other hand, some countries went the other direction and further incorporated real-time GPS tracking data in their contact tracing measures, which would increase data accuracy and tracing effectiveness, but which is also considered more privacy-intrusive owing to the continuous tracing of geolocation data. The results of the Survey conducted by my office showed that only one fourth (25%) of all digital contact tracing measures reported in the survey involved the use of location tracking techniques.
Apart from providing an overview on the use of contact tracing apps, the Compendium also contained the best privacy practices for contact tracing apps adopted in the 32 jurisdictions, with a view to reaping the benefits of collective experience and wisdom for the development of contact tracing apps in future. Examples of the best practices include:
Hong Kong's situation
The Government of the Hong Kong Special Administrative Region of China has also adopted advanced technological measures to combat COVID-19, including the contact tracing 'LeaveHomeSafe' app4 ('the App'). The App was launched in November 2020 to help members of the public record their visits to public places such as shopping malls and restaurants, and will notify them when they might have been exposed to the virus through having visited the same place around the same time as an infected individual.
To alleviate the public's concern about privacy, an independent third party has been engaged by the Hong Kong Government to conduct a PIA to ensure that the App is in compliance with the requirements of the local privacy law, namely, the Personal Data (Privacy) Ordinance (Cap. 486) as amended in 2012. In particular, it is noteworthy that:
The privacy design of the App is in line with the least privacy-intrusive design advocated internationally by DPAs.
The way forward
While digital technologies provide powerful tools for governments to fight COVID-19, their efficacy depends on people's trust and confidence in such applications. These measures should therefore be implemented with careful planning and transparency, upon consultation with major stakeholders in the society and with robust Privacy by Design protection. Before rolling out the digital measures, governments have to consider privacy implications, including but not limited to:
Going forward, my office will continue to take on an active role in the work of the GPA COVID-19 Working Group5 (a successor of the COVID-19 Taskforce) by leading the work on identifying the most pressing privacy issues currently arising from the COVID-19 pandemic, exploring the related best privacy practices, and compiling relevant guidance to all stakeholders, including both public and private entities, with a view to striking the appropriate balance between privacy protection and combating the pandemic.
Ada Chung Lai-ling Privacy Commissioner for Personal Data, Hong Kong, China