Data Privacy Concerns in Different Jurisdictions
The Covid19 pandemic has, in one way or another, affected many livelihoods, till date. In Malaysia, a recent report by the Department of Statistics (DOS) found that the unemployment rate is the highest in a decade. According to the chief statistician of DOS, Mohd Uzir, “The unemployment rate in March 2020 increased to 3.9 percent, the highest since June 2010, where the unemployment rate was at 3.6 percent.”
A pandemic like this has shown us how black swan events like this can rattle markets globally and cause an upheaval in economies. At the time of writing, Covid19 cases globally stand at over 5 million, with over 300,000 deaths and 200,000 recoveries.
As the world struggles to manage the increasing number of infections and deaths, security and privacy have become a huge concern. Due to the rapid rise of cases in the past few weeks, countries are ramping up emergency responses via surveillance systems, prompting privacy concerns. The fear that these surveillance technologies may act as a channel for individuals’ privacy to be jeopardised is the main issue.
The next part of this article explains how contact-tracing features introduced by governments globally have raised alarm bells on privacy.
Case studies from a global overview of data privacy concerns:
Picture a scenario where you are sitting in a coffee shop browsing through the internet for some things to buy. Halfway through, you come to the realization that you like an item and would like to purchase it. You switch to your mobile banking app and make the transaction online. Imagine this whole process flow is tracked. Pretty scary, right? These measures raise a whole new level of concern on privacy. Now, let’s explore how this contact-tracing app is indirectly capturing data about us while we subconsciously use them.
It started with China from the beginning since the infectious disease was first discovered in Wuhan. The government of China launched several applications that use direct geo-location or data compiled from train and airline travel or highway checkpoints. Chinese citizens have to fill in their national identity number or passport number, as well as their phone number. The app then asks them to complete a questionnaire about their travel history and current symptoms. Based on these facts, they are assigned a color.
The color on the screen determines your options, based on your current health status: green means that you’re good to go, yellow means you’ve been close to somebody who has been sick, and red means you have to stay home. How exactly the app determines if you have a yellow or red score is still unclear. However, there are concerns that the information collected from travel data to places one frequents could be used for other means.
In South Korea’s Corona 100m app, individuals are alerted if they come across infected patients within 100 metres of where they are. The government hasn’t issued people with QR health codes, but it is broadcasting detailed information about infected people’s whereabouts. When someone in South Korea tests positive for Covid19, government health authorities send text alerts, notifying residents that someone near them has the disease, linking it to a central website with more information. While the government doesn’t share people’s names, it provides details on the website, such as the person’s age range, gender, and places they recently visited, which has led people to publicly speculate about their neighbours’ marital affairs and other private matters.
In Malaysia, contact tracing is done via MyTrace. While the aim is also to help authorities detect and trace clusters of Covid19 infections, the functionality uses Bluetooth waves and geo-location data to detect the presence, distance, and period of meeting. The data collected will be kept for 21 days in the handphones of users.
In Russia, people are required to download a QR code (Cyber Gulag) to move around the city. They first register on a government website and declare their intentional route for the day in advance. The QR code then gives them the authorization to leave the house.
Singapore, on the other hand, launched an app called TraceTogether that uses Bluetooth, a wireless signal, to detect other users in proximity.
In the United States, the government is openly working with Verily, a Google sister company to offer online screening tests that require users to have a Google account. For example, users of the potential app can see the date that a coronavirus patient was infected, along with his or her nationality, gender, age, and the locations they visited.
While many of the cases above highlight the pros and cons of the contact tracing app, the next country in specific offers a different perspective.
In Japan, there has been a strong sense of anxiety that insufficient information about infections has been provided, which is currently troubling netizens. This situation has prompted authorities to look for a solution.
In a survey conducted by NHK and LINE among 2,000 respondents, 59% felt that “It is difficult to identify reliable information about Covid19,” and 38.8% felt that there were many fake news being spread. As the Japanese government and local governments ramp-up efforts in working on a solution, 50.8% felt sharing data is not a concern if it serves a means to an end in tackling the pandemic. 25.5%, on the other hand, disagreed that there could be an issue in the data usage, regardless of reasons.
There are efforts currently undertaken by the Japanese, comprising of private entities working on a solution to solve this problem. Reports suggest that an app is in the development stage, utilizing Bluetooth to record data from users. Once downloaded by a user, the app would record the other persons in close range, and if there is a Covid19 positive case found, the app will automatically notify the people who may have had close contact with this patient. This would help to contain the viral spread of the disease. As there are concerns that the app would lead to collection and monitoring of personal information by the government, it is expected that Japanese will put in place a system that records data of close contact as “anonymous,” without using phone numbers or location information, with an emphasis on privacy protection.
Tech giants, Apple and Google, have teamed up recently, coming out with a win-win situation for the contact-tracing features. The technology works by helping Apple iPhones or devices powered by Google’s Android software to communicate with one another. Signals are sent to one another over a Bluetooth radio that is stored on the phones. If someone is then confirmed as having the COVID, their phones send out a new signal alerting all the phones they’d come in contact with over the preceding 14 days.
Apple and Google have said that the technology would be an opt-in, and it won’t be turned on by default. To ensure further security, they have come out with better encryption, scrambling any identity information to ensure people will not be tracked. The companies are also switching things around, moving away from the widely used term “contact tracing,” to calling it “exposure notification,” saying it better describes the functionality of the program while emphasizing on “privacy-preserving.”
As the litmus test is carried out, there is a paradigm shift of how businesses and individuals are viewing privacy concerns moving forward. If we look at the case of Japan, citizens are beginning to have a different perception on data privacy. Apple and Google, on the other hand, as described above, are switching the focus to give users an overview that it is “privacy-preserving.”
Although many would argue that utilizing an app would not be safe as certain functionalities may allow it to compromise data on various levels, it is certainly an effective tool for contact tracing if done rightly.
In terms of data privacy, there are certain laws to govern this act (PDPA, GDPR, CCPA), but under ordinary circumstances, sensitive information, especially when it comes to personal and medical information, should be kept private. With the pace of technology at this point in time, exposing any data to anyone is a concern because these records hold significant commercial value. They could, for instance, provide advertising agencies valuable targeting data for healthcare and pharmaceutical companies.
As for companies, the need to be more sensitive to personal information of consumers is the utmost priority that would build trust for them in the long run, whereas for governments, rolling out a strategy and foul-proof plan is a good way to look at. Companies can embrace the latest innovations in Privacy-Enhancing Technology (PET). This new category of privacy technology, highlighted by the World Economic Forum, enables businesses to leverage insights derived from third-party private data without revealing confidential information that cannot and should not be shared for ethical, legal, or business reasons.
In these uncertain times, as our governments explore data-driven solutions to curb a global health pandemic, we must consider how our data will be handled in the aftermath of the coronavirus. This crisis will eventually pass, and as new data challenges arise, privacy must become the standard for enterprises and governments to ensure we are best equipped before the next crisis unfolds.
References
https://www.nst.com.my/opinion/columnists/2020/04/586413/coronavirus-surveillance-how-much-too-much
https://www.weforum.org/agenda/2020/03/restore-data-privacy-after-coronavirus-pandemic/
https://futurism.com/contact-tracing-apps-china-coronavirus
https://www3.nhk.or.jp/news/html/20200517/k10012433871000.html
https://www.cnet.com/news/apple-google-announce-new-privacy-features-for-coronavirus-tracking-tech/
https://www.wired.com/story/apple-google-contact-tracing-strengths-weaknesses/
https://medicalfuturist.com/your-data-privacy-during-a-pandemic/
