Tackling privacy & digital divide in Covid-19 tech
By Amit Roy Choudhury
GovInsider’s tech columnist reflects on governments’ top concerns in the pandemic.
The non-medical efforts to contain the disease have also centred round the use of applications, websites and monitoring devices for contact tracing, quarantine, patient supervision, and crowd control. Tech has also helped provide targeted relief to affected persons. Some examples are: Singapore’s Safe Entry, TraceTogether app and token for contact tracing; and Gov.sg for dissemination of information related to Covid-19.
While it is commendable how technology has sped up the response of governments around the world to this once in a lifetime crisis, one of the unintended consequences of the rapid rollout of these tools has been worries about data privacy and the processing of personal data. Data privacy advocates have been ringing alarm bells around the world in this regard.
Early this year, Singapore witnessed a controversy surrounding the police’s ability to use TraceTogether data during investigations. Once the story broke, several experts expressed apprehension at the apparent backtracking by the government on the use of the data and they felt this could “undermine trust”.
Fortunately, this incident did not blow up due to the adroit handling of the situation. The high degree of trust in the government among Singaporean residents, with regards to data privacy, largely remains intact. Over the past few years, the government has put in place a number of measures to ensure data privacy, including the Personal Data Privacy Act (PDPA), which is a well-regarded piece of legislation among data privacy advocates.
A point to note is that, apart from the government, many private institutions also collect personal data, in places like shopping malls, private estates, and office buildings. The pandemic has increased the scale and scope of data collection. Is there a reason to be worried?
Clear set of guidelines
The PDPA has a clear set of guidelines with regard to data collection by private entities. According to the Act, organisations may collect personal data of visitors to premises for purposes of contact tracing and other response measures in the event of an emergency, such as Covid-19.
It also notes that organisations may use visitors' national registration identity cards (NRIC), foreigner identification numbers (FIN), or passport numbers to accurately identify individuals in the event of a Covid-19 case.
However, organisations that collect such personal data must comply with the Data Protection Provisions of the PDPA. This would include ensuring “reasonable security arrangements” to protect the personal data in their possession from unauthorised access or disclosure, and also ensure that the personal data is not used for other purposes without consent or authorisation under the law.
It needs to be noted here that the contact tracing solutions implemented by the Singapore government do not fall under the data protection provisions of PDPA. That said, it is not as if there are no privacy laws applied to the data collected by the government.
Public sector agencies need to comply with the Government Instruction Manuals and the Public Sector (Governance) Act (PSGA) which allows for PDPA comparable levels of protection. These agencies could face investigations and enforcement actions in case of data security breaches.
Not alone
Singapore is not alone in the use of technology to contain the pandemic. Many other countries are using technology tools to monitor residents during this pandemic. These include contact tracing apps, CCTV footage from street cameras, mobile phone location data, and credit-card history, among others.
China, for example, set up a nationwide telecom data analysis platform after the Covid-19 outbreak. Local telecom carriers provide mobile phone location data of individuals for the previous 15 to 30 days if required.
As in Singapore, there have been concerns raised about the amount of data being collected by tracing apps. Two weeks after France launched its StopCovid app last year, experts pointed out that the app was collecting more data than it was originally understood to collect.
Following an outcry a second version of the app was launched, which also attracted criticism. Finally, the matter was settled after yet more changes were made.
There are many other such examples of civil society pushback across countries to private data collection, particularly location data, in the effort to contain the spread of the disease.
Many of the data privacy issues that have been raised across the world can be attributed to the haste in which many of these progammes have been introduced. For example, Singapore’s Safe Entry were released within weeks of the realisation of the seriousness of the pandemic. As a result, the usual due diligence that goes into developing and launching such applications, not only in Singapore but across the world, was not followed.
It was thus, in a way inevitable that data privacy did not figure very prominently in the planning and development of these technology tools. Fortunately, most governments around the world have since taken care of the misgivings voiced by common citizens with regards to privacy issues.
Singapore’s Foreign Minister Vivian Balakrishnan expressed regret at the oversight on the part of the government of not factoring in that TraceTogether data was not exempt from the Criminal Procedure Code in Singapore. Subsequently, the government passed a bill restricting the police use of personal contact tracing data only in the case of a criminal investigation into serious crimes such as murder and terrorism.
And, as mentioned previously, it took three iterations before France got its contact tracing app right.
As long as civil society remains alert and points out the problems and governments are willing to listen, there is no reason to believe that increasing the use of technology will impact data privacy.
Exacerbating the digital divide?
Closely related to data privacy is another, more long-term concern: how will the use of technology impact the already serious digital divide?
Most tracing and pandemic-related information apps, including those which provide vital information on treatment and vaccination, need smartphones for access. What happens to those who do not have access to smartphones or are not technologically savvy, like the less educated and elderly?
To be fair, this is not much of an issue in Singapore, where the government has provided physical TraceTogether tokens to those who are not comfortable using smartphone-based apps. Access to healthcare, including vaccination information, is easily available, even to the most disadvantaged sections of society.
In other countries, however, this is a major issue. A recent study in the UK showed that there was a digital divide that was causing inequalities in access, knowledge, and awareness of digital health technologies used in the pandemic.
These include symptom-tracking and contact-tracing apps and consumer-facing mental and physical health apps. According to the report, more than half of the population of the UK was concerned about the potentially discriminatory impact of vaccine passports once they start to roll out.
There are no easy solutions or answers to these issues. What is, however, certain is that while fighting the virus, the world itself is undergoing a paradigm shift. In a post-pandemic world, technology will be central to healthcare, crowd control and monitoring, and also in terms of access to resources. Data privacy will not be the only concern that will be needed to be tackled.
In this situation, it falls on governments, working in tandem with civil society leaders, to ensure that no one is left behind. There will be no easy fixes but solutions will have to be found. One can be optimistic about the future, given the fact that the response to the pandemic has shown that solutions can be found if there is a will and a clear idea of objectives. The post pandemic world will be very different from the one preceding it.
Amit Roy Choudhury, a media consultant, and senior journalist writes about technology for GovInsider.