Covid-19 (28 May 2020)
Download PDF File
Rise of the Tracking Apps
The Covid-19 pandemic introduced lockdown measures not previously experienced by society across the globe. It also gave rise to an unparalleled number of health monitoring-cum-tracking apps deployed by governments in the name of more effective and efficient contact tracing and health monitoring of the public. Such tracing and health apps were first rolled out in several Asian countries first hit by the new coronavirus, namely China, Hong Kong, Singapore and South Korea. Malaysia shortly after jumped into the bandwagon.
As the first country to introduce digital health monitoring and tracking, China witnessed a large-scale adoption of tracking apps beginning early this year ensuing from the development of health code systems by the local governments which integrated with popular mobile apps such as Alipay and Wechat.1 The health code system is intended to monitor and track people’s movement based on a QR code assigned to users. Three colours indicate each a different level of risk – green for “safe”, amber for a seven-day quarantine and red for a 14-day quarantine. The user is anointed with one of these colours after completing a self-health questionnaire which is used for verification by the authorities.2 Users must scan their QR code when entering and exiting subway stations, shopping malls, office buildings, apartments, shops and other public places.3
As the health code is the result of an automated analysis of personal information gathered by the governments, the system has been criticized for lacking transparency particularly on how it classifies users and how the information is being collected, analysed and used especially when the tracking feature is integrated into third-party apps.4 There are also complaints on inaccurate ratings and erroneous assessments resulting in users being unable to travel.5 Since each city and province have their own health code systems with differing standards for assigning health codes, the incompatibility has further caused inconvenience for inter-city and inter-province travels.6 While local governments are encouraged to mutually recognize each other’s health codes through data sharing on a centralized platform, the central government is working on a unified and standardized health code system to be rolled out nationwide.7
South Korea is one of the few countries to have successfully contained the outbreak without imposing draconian lockdown restrictions. Apart from mass testing, contact tracing and social distancing measures, South Korea employed several tracking apps including Corona 100m launched on 11 February 2020.8 Corona 100m alerts users when they approach 100 metres of a location visited by an infected person by disclosing the date when the person was diagnosed with Covid-19, places he had visited, his nationality, gender and age.9 The app uses personal information of infected persons which has been shared with the public by the government via real time emergency text alerts and related websites, ranging from their age and gender to a detailed log of their movements and travel history including the time, name and address of the places they had visited, mode of transport and whether a mask was worn.10 Such information is gathered by the authorities from various sources including use of information technology system that tracks people’s locations and movements including mobile phone location tracing, credit card transactions and CCTV footage.11
Despite the name and identity of infected persons not being released, it has raised alarming privacy concerns over the gross intrusion into the private lives of individuals. The jigsaw puzzle of information which when put together risks identifying the individuals and the resulting potential or actual doxing and online harassment against them.12 Whilst the information being shared is permitted under the South Korea’s Infectious Disease Control and Prevention Act and has proven effective in containing the spread of the virus, the National Human Rights Commission of Korea criticized the authorities on the excessive disclosure of personal information which not only violates the privacy and human rights of infected persons, but also encourages those with symptoms to hide their illness and to avoid testing due to fear of criticism and social stigma.13 Consequently, the Commission has called for privacy protection with the recommendation that only the time and name of locations visited by infected persons are shared rather than disclosing the entire travel history.14
In Singapore, the government launched the contact tracing app, TraceTogether that operates by exchanging short-distance Bluetooth signals between mobile phones to approximate the distance and duration of contact between users.15 It enables the government to track and trace close contacts of infected persons and alert users if they have been in close proximity with infected persons.16 Apart from the user’s mobile number that needs to be provided to the government, all proximity data collected via Bluetooth from nearby mobile phones running the same app are anonymized, encrypted and stored on the user’s mobile phone for 21 days and would only be accessible by the government with consent if the user is infected or is the subject of contact tracing.17
With Bluetooth technology, TraceTogether has been regarded as more privacy-friendly compared to tracking apps that use actual location data, such as GPS and Wi-Fi location data, as Bluetooth only processes anonymized and encrypted data which is incapable of identifying individuals.18 There is however still a great reluctance to use the app by Singaporeans over privacy concerns despite numerous assurances by the government.19 The low adoption rate of the app since its launch on 20 March 2020 hitting only 25 percent of the population is emasculating its utility which requires at least 75 percent for the app to be effective.20
In Hong Kong, the government deployed the tracking app, StayHomeSafe which works in collaboration with electronic tracking wristbands to monitor the movement of arrivals from overseas who are subject to a 14-day compulsory quarantine.21 Users are required to scan a unique QR code on their wristband to pair up with the app for activation and calibrate the app by walking around the perimeter of their quarantined location.22 During the quarantine period, users may at any time be requested by the app to re-scan the QR code to confirm their presence.23
The app and wristband employ the use of geofencing technology that detects and analyses environmental communication signals at a quarantined location, such as Bluetooth, Wi-Fi and geospatial signals in the neighbourhood, and their respective strengths to deduce whether a user remains in the location and to alert the authorities if he leaves the place.24 As the app does not track users’ location data nor collect their personal data25, privacy does not appear to be a concern.
The Malaysian government officially launched MySejahtera app on 20 April 2020 to aid its monitoring, managing and mitigating of the Covid-19 outbreak during and post the movement control order. It was developed through a collaboration between the National Security Council, the Ministry of Health, the Malaysian Administrative Modernisation and Management Planning Unit and the Malaysian Communications and Multimedia Commission. Essentially, MySejahtera enables users to carry out self-health assessment on themselves and their family members from time to time and allows users to share their location. The information is collected by the government to assist individuals to assess and monitor their health status and that of their dependents, determine and identify Covid-19 hotspots and track the spread of the virus for prompt and effective steps to be taken where a possible infection is identified. After the self-assessment is completed, users will be informed of their health status which is classified as low risk, casual contact, close contact, person under surveillance, person under investigation or confirmed case. Users will be guided on any further action to be taken if diagnosed with Covid-19 symptoms and will be notified if they are near to a high-risk zone. The government has assured that the personal information collected will only be used for the monitoring and prevention of the Covid-19 outbreak and will not be disclosed to any other party.
Following the reopening of sectors the economy under the conditional movement control order (“CMCO”) which currently ends on 9 June 2020, the government has urged the public to download and register MySejahtera to enhance contact tracing efforts. Although not mandatory, the importance of MySejahtera has been emphasized in the standard operating procedures as being a mitigation strategy to support the government’s economic recovery efforts. As a majority of businesses and organizations resume operations under the CMCO, employers are seeking to impose MySejahtera on employees to protect the health and safety of their workplace as required under the Occupational Safety and Health Act 1994. This is done by requiring employees to register the app and displaying their MySejahtera profiles for health screening before entering the workplace. As implementation of MySejahtera for health screening as a safety measure at workplace involves use of employees’ personal information, the main concern that inevitably creeps into the minds of employers would be data privacy in the context of the Personal Data Protection Act 2010 (“PDPA”).
The MySejahtera profile is an individual’s personal account with a digital ID in the form of a QR code, which discloses the name, user ID which may be mobile number or email address and the state in which the individual resides, which are all personal data. It also reveals the individual’s health status or classification which are known as sensitive personal data for which more stringent and additional safeguards apply. As the health screening being conducted via MySejahtera involves the collection and use of employees’ personal information, the first and foremost question would be whether employers must obtain the prior consent of their employees.
Generally, consent of employees remains the cornerstone of the PDPA for employers to process the personal data of employees. However, consent is not often the most commercially viable option for employers particularly during a pandemic. This is more so in cases of sensitive personal data which demands explicit consent. In such exceptional circumstances, exemptions under the PDPA may be resorted to in justifying processing employees’ personal data without consent, such as the necessity for employers to comply with statutory health and safety obligations and to protect the vital interests of the employees. Vital interests as the context calls for relate to matters of life, death or security.
Likewise, for sensitive personal data, the requirement of explicit consent may be dispensed with on the basis that the processing is necessary to exercise statutory health and safety obligations in connection with employment. Employers may also justify processing on the basis that they are protecting the vital interests of the employees or others where consent cannot be given by them, cannot be reasonably obtained or is unreasonably withheld.
As this “new” form of processing personal data is not expected to abate for the next several months down the long uncertain road of 2020, the next question would be whether employers must issue a fresh data protection notice despite an initial notice having been given. Generally, the PDPA only requires a fresh notice to be given if personal data is processed for a new purpose or disclosed to a new third party. Employers need to review existing data protection notices to ensure that appropriate information has been covered. Otherwise, a fresh notice must be issued.
With digital technologies emerging as effective tools for the government and businesses confronting the pandemic, the government is seeking to develop more digital apps to supplement and enhance the functionality of MySejahtera app. This includes MyTrace that was introduced on 3 May 2020. MyTrace enables the authorities to track and trace potential contacts of infected individuals. The app uses Bluetooth to detect the distance and period of contact between users. While use of tracing apps on employees is effective, businesses are legally bound by the PDPA to ensure the proper handling and management of employees’ personal information including health data. Particularly, businesses must implement appropriate technical and organizational security measures to safeguard the security and integrity of the personal information against misuse or unauthorized access or disclosure.
1 Nectar Gan and David Culver, ‘China is fighting the coronavirus with a digital QR code. Here’s how it works’ CNN Business (Hong Kong, 16 April 2020), accessible at https://edition.cnn.com/2020/04/15/asia/china-coronavirus-qr-code-intl-hnk/index.html; Cai Yineng, ‘How China’s ‘Colour Codes’ system could reopen the economy after the pandemic’ World Economic Forum (15 April 2020), accessible at https://www.weforum.org/agenda/2020/04/on-china-s-color-codes-and-life-after-covid-19/.
4 Inkstone, ‘How big data is dividing the public in China’s coronavirus fight – green, yellow, red’ South China Morning Post (22 February 2020), accessible at https://www.scmp.com/news/china/society/article/3051907/green-yellow-red-how-big-data-dividing-public-chinas-coronavirus; Minghe Hu, ‘Beijing rolls out colour-coded QR system for coronavirus tracking despite concerns over privacy, inaccurate ratings’ South China Morning Post (Beijing, 2 March 2020), accessible at https://www.scmp.com/tech/apps-social/article/3064574/beijing-rolls-out-colour-coded-qr-system-coronavirus-tracking.
6 Ibid, n 1.
7 Ibid, n 1; Audiovisualaoce, ‘The Game of Health Codes – Murderer Caught In China’ (15 May 2020), accessible at https://audiovisualaoce.com/2020/05/the-game-of-health-codes-murderer-caught-in-china/.
8 Ivan Watson and Sophie Jeong, ‘Coronavirus mobile apps are surging in popularity in South Korea’ CNN Business (28 February 2020), accessible at https://edition.cnn.com/2020/02/28/tech/korea-coronavirus-tracking-apps/index.html.
10 Derek Thompson, ‘The Technology That Could Free America From Quarantine’ The Atlantic (7 April 2020), accessible at https://www.theatlantic.com/ideas/archive/2020/04/contact-tracing-could-free-america-from-its-quarantine-nightmare/609577/; Anna Gamvros and Libby Ryan, ‘How contact tracing apps in Asia are being used to fight COVID-19 – is the reward worth the risk?’ Data Protection Report (Hong Kong, 24 April 2020), accessible at https://www.dataprotectionreport.com/2020/04/how-contact-tracing-apps-in-asia-are-being-used-to-fight-covid-19-is-the-reward-worth-the-risk/.
12 Max S. Kim, ‘Seoul’s Radical Experiment in Digital Contact Tracing’ The New Yorker (17 April 2020), accessible at https://www.newyorker.com/news/news-desk/seouls-radical-experiment-in-digital-contact-tracing; BBC News, ‘Coronavirus privacy: Are South Korea’s alerts too revealing?’ (5 March 2020), accessible at https://www.bbc.com/news/world-asia-51733145.
13 National Human Rights Commission of Korea, Press Release: NHRCK Chairperson’s Statement on Excessive Disclosure of Private Information of COVID-19 Patients (9 March 2020), accessible at https://www.humanrights.go.kr/site/program/board/basicboard/view?menuid=002002001&pagesize=10&boardtypeid=7003&boardid=7605315.
15 Janice Lim, ‘Covid-19: Govt launches mobile app which can speed up contact tracing by detecting nearby phones with app installed’ Today (Singapore, 20 March 2020), accessible at https://www.todayonline.com/singapore/covid-19-govt-launches-mobile-app-which-can-speed-contact-tracing-detecting-nearby-phones.
17 Government Technology Agency, Singapore, ‘Responding to COVID-19 with tech’, accessible at https://www.tech.gov.sg/products-and-services/responding-to-covid-19-with-tech/.
18 Aradhana Aravindan, Sankalp Phartiyal, ‘Bluetooth phone apps for tracking COVID-19 show modest early results’ Reuters (Singapore/New Delhi, 21 April 2020), accessible at https://www.reuters.com/article/us-health-coronavirus-apps/bluetooth-phone-apps-for-tracking-covid-19-show-modest-early-results-idUSKCN2232A0.
19 Dewey Sim and Kimberly Lim, ‘Coronavirus: why aren’t Singapore residents using the TraceTogether contact-tracing app?’ The Coronavirus Pandemic (18 May 2020), accessible at https://www.scmp.com/week-asia/people/article/3084903/coronavirus-why-arent-singapore-residents-using-tracetogether; Saheli Roy Choudhury, ‘Singapore says it will make its contact tracing tech freely available to developers’ CNBC (25 March 2020), accessible at https://www.cnbc.com/2020/03/25/coronavirus-singapore-to-make-contact-tracing-tech-open-source.html.
20 Mandy Lee, ‘Given low adoption rate of TraceTogether, experts suggest merging with SafeEntry or other apps’ Today (Singapore, 8 May 2020), accessible at https://www.todayonline.com/singapore/given-low-adoption-rate-tracetogether-experts-suggest-merging-safeentry-or-other-apps.
21 The Government of the Hong Kong Special Administrative Region, “StayHomeSafe” Mobile App User Guide, accessible at https://www.coronavirus.gov.hk/eng/stay-home-safe.html.
If you have any queries or require more information, please feel free to get in touch with us.
Lee Lin Li
T: +603 2050 1898
Chong Kah Yee
T: +603 2050 1831