Can we fight against Novel Coronavirus without losing data privacy?

Can you imagine getting infected with Novel Coronavirus?

Would you like to submit your information to public institutions wherever you go whether you get infected or not?

Are you afraid of your personal information being exposed online, then may perhaps being harassed by strangers?

The right of privacy and the right to know are both essential human rights in the modern information society.

During the current times of a pandemic, the right to know all relevant facts pertaining to the virus is equally to the right to life. Thus, some people would assume that the right to privacy is negligible compared with the right to life. Really? Do we have any measures to mitigate the damage to the right to privacy? Let’s take a look what happened in China.

Around the Spring Festival, Novel Coronavirus aroused public concern in China, and one group became the centre of public opinion – those who returned from Wuhan city to their hometowns since the outbreak.

On the evening of Jan 26, according to Zhou Xianwang, the mayor of Wuhan, more than 5 million people left Wuhan because of the Spring Festival and the epidemic.

In this severe situation, information registration and activity monitoring for returnees was carried out across China.

And with the spread of the epidemic and the increased pressure on transportation after the Spring Festival, there were more and more scenarios in which people’s information was and is collected. Furthermore, it is no longer limited to those related to Wuhan.

It should be noted that, while the public submit their personal information, incidents of information leakage also occur from time to time. So many lists of returnees have been circulating on the social media site WeChat and other online platforms during the Spring festival, a large number of sensitive information also leaked, including ID card numbers, mobile phone numbers, addresses of household registrations, as well as useful data such as leaving dates, ways of transportation and train, bus and ferry numbers.

According to a college student who returned from Wuhan, a city of some 11 million people during normal periods, her personal information was exposed online. Some strangers added her on WeChat via mobile phone numbers and then directly sent harassing messages such as “Please go back to Wuhan”, “Isolate yourself at home for two weeks”, “Wuhan poisons and harms others”.

So-called “flesh searches are also not uncommon in China, where many millions of people are online. “They seek to identify people for good or bad reasons.

Also, at pop concerts, people will offer memorabilia free in return for Wechat addresses and then use them to overwhelm the innocent user with sales offers. Indeed, Wechat is a social and economic world of its own beyond the borders of the 14 billion Chinese population.

It is also widely recognised as the most monitored social media with the government gleaning more personal information than any other internet platform in a world dominated by them.

We need only consider how the US and UK elections used social information from social media in a probably highly successful way to hijack election results.

What are the adverse impacts of this, apart from the latter?

The leakage of personal information may bring personal injury and property loss.

In addition, the leakage of large-scale personal information may cause public panic and loss in government trust, which is a serious threat to public safety.

Labelled social evaluation will bring obstacles to the travel and life of returnees and increase regional and group discrimination.

Fake goods may be offered to individuals.

Prospective travellers who repeatedly visit a destination website may be subject to an algorithm that recognises their interest and raises prices each time.

Last, and by no means least, fake news can result in events ranging from personal distress to outright rioting (not unknown).

It is said by experts that the source of leaked information is directly related to each local public office of China. Currently, there are three main types:

First, the local education departments have the data of college students who studied in Wuhan from 2016-2019;

The second is big data (railway and aviation real-name information) held by the public security department;

The third is the reports completed by members of village committees, sub-district offices, and communities in house-to-house inspections since the outbreak.

There have been some cases of people refusing to cooperate with community investigations and deliberately concealing personal travel history and contact history, resulting in a serious risk of infection to many people around them. And some officers who control this personal data only updated the above mentioned lists to chat groups on social apps for the sake of saving their relatives’ or friends’ lives as a warning. Therefore, on one hand, we have the public’s right to know the infection group and, on the other, personal information protection and the right of privacy becomes non-existent.

So is there a balance?

The right to privacy and the public’s right to know are both essential human rights in the modern information society. In this special situation, these two rights seemingly conflict with each other and represent a kind of tyranny of the majority. In practice, however, the sensitive part of personal information could be deleted while meeting the needs of the public’s right to know information about an infected group.

In China, because of the long incubation period of Novel Coronavirus and the nation’s huge population, it is important and difficult to trace the close contacts of infected persons after they are diagnosed. In order to prevent and control the epidemic, an essential measure is to adopt data, such as real-name authentication, when taking buses or taxis and buying medicine.

During the real-name authentication or registration process, people should have the right to clearly see the purpose, scope, storage period etc of collecting data and other content stated in a clearly displayed notice. And if the collected data of a patient or a suspected patient is needed to be stored for a long time for scientific research purposes, the patient’s informed consent should be obtained first, and the right to delete the data should be retained, Most importantly, the data should be anonymised.

The data of healthy people cannot be stored indefinitely and it should be destroyed and deleted within the prescribed period from the date of the ending of a pandemic is  announced by the State Council or the National Public Health Emergency Response Command.

What’s government response?

Because this is a developing situation, governments are revising their responses or policy to mitigate the emerging risk to privacy issues.

On Feb 9, the Office of the Central Cyberspace Affair Commission of China released the “Notice of Personal Information Protection and Using Big Data to Support Prevention and Control of Novel Coronavirus”. It stated that personal data collected for epidemic prevention and control shall not be used for other purposes. Without the consent of the person or desensitisation of personal information, no entities or individuals may disclose personal datasuch as name, age, identity card number, phone number, home address etc, except for the offices of Defence and Control of the Novel Coronavirus.

The institution that collects or holds personal information shall be responsible for the security protection of personal information and adopt strict management and technical protection measures to prevent theft and leakage.

Any organisations or individuals who discover the collection, use or disclosure of personal information in violation of laws and regulations shall promptly report it to the Office of the Central Cyberspace Affair Commission and public security departments.

The Department of Health of Hong Kong provides a good example. On the one hand, the government has fully protected citizens’ right to know. A form lists in detail the emergency date, gender, age, report source, hospital name, test results, patient status of each suspected patient. On the other hand, the government has fully protected the personal information of each confirmed patient and suspected patient by not showing personally identifiable data such as names, ID numbers and phone numbers.

All in all, the dynamic balance between the public’s right to know and the right to personal information will be a major long-term problem in our society. How to achieve a rational balance requires specific distinction and judgment in specific scenarios. This is no easy task.