The COVID-19 outbreak has affected society's perception of protecting information privacy in the digital age. Countries getting COVID-19 outbreaks under control all use extensive contact-tracing measures to protect the general well-being of the public. 

In Singapore, the government published the street number of where infected persons live to warn neighbors. In South Korea, the government scanned smartphone data to find the contacts of people infected with the virus. Even the U.S. government is considering implementing a national coronavirus surveillance system. It seems that most countries have reached a consensus that digital tools for tracking health and location information are crucial parts of COVID-19 containment strategies.

When countries are in the race to build contact-tracing apps to put surveillance on its citizens without much antagonism, it risks breaching their information security laws. There are fears that contact-tracing and location-tracking apps will create privacy violation issues and raise fears in individuals about government surveillance impingement on personal liberty. However, more are calling for balancing personal privacy with the public interest, as the argument goes that although personal privacy is a foundational right in a democratic society, public health and safety support a free society, and they need to be protected.

How will the principles of information security, namely confidentiality, integration, and availability, be affected or have been affected by the COVID-19 outbreak? Can the government take care of the general well-being of the public while protecting personal privacy amid the COVID-19 pandemic and aftermath? Legal efforts should be made by countries to balance the two.

First of all, confidentiality should be protected, which means personal information should not be subject to unauthorized or accidental disclosure. People who have health problems are not just patients; they are also socially vulnerable. Their personal information should be strictly kept in safe hands, and they should not be made to suffer mentally once their information has been leaked to the public. The private sector should have strict access to information as law enforcement is, in reality, weak in terms of punishing information leaking.

Second, the integrity of personal information should be preserved. That means information is as entered and intended, not to be modified, corrupted, and destroyed without approval from the legal authority. Amid the COVID-19 pandemic, this principle should be handled carefully, mainly when the patient is fully recovered and poses no risk to the general public. Information sharing should be suspended, and the government should store information properly to prevent it from being transmitted to other parties for other purposes. 

In the end, the availability of information is the purpose of collecting them in the first place. Personal information regarding public safety should be accessed and used by an organization promptly and without delay to warn the public and keep people safe.

China provides a good case study in dealing with the dilemma. The first case of COVID-19 was reported in China, but the country has managed to control the outbreak resulting in very few new cases nationwide now. Data monitoring contributed significantly to the fight against the spread of COVID-19. 

Chinese society has been more adapted to data collection than many other countries as smartphones and fintech have been prevailing in China in the past few years. For instance, the application of digital technology as pandemic prevention tools has been widely used in China. To enforce the rules, the government uses cell phone signals to monitor at home isolation cases. 

The measures China has taken are within the legal ground. In China, the law that directly regulates information and data protection is the Cybersecurity Law (2016). Article 22 serves as a general principle in protecting personal data privacy. Articles 41-45 provide legal guidance on information providers' responsibility and legal means of using personal information. They include general rules of collecting and using personal information, integrity of personal information, and individual rights in terms of protecting their privacy from network providers. In addition, the government department that is responsible for cybersecurity supervision and management duties must keep confidential personal information for official usage, and they "must not leak, sell, or unlawfully provide it to others."

Furthermore, the law provides legal guidance on punishment for violation of personal information provisions. For instance, private sectors are subject to a fine of up to 100,000 yuan due to violation. If the circumstance is dangerous, they could face a penalty, such as suspension of operations, closing down a website, cancellation of operation permits or business licenses. In the case of selling or providing personal information illegally to a third party, a 1-million-yuan fine can be imposed, and if that offense constitutes a criminal act, the offense will be prosecuted through criminal laws. 

However, the common problem for cyber law, which is supposed to protect individual information privacy, is enforcement, which was the real obstacle even before the COVID-19 outbreak. For instance, the General Data Protection Regulation (GDPR), a 2018 EU law that serves as a model for privacy rules in many other countries, is more symbolic than instrumental as it lacks enforcement from member states. 

Given that millions of people worldwide are getting infected without a vaccine, it might be unrealistic to discuss personal information privacy. It is the reality that the legists have to deal with and make the tradeoff between individual privacy and the general well-being of the public. It is the duty for all nations to come together to make laws and regulations better adapted to information privacy and security in a post-COVID world. 

The author is a research fellow at the Collaborative Innovation Center of South China Sea Studies at Nanjing University and is a 2019-20 British Chevening Scholar. 

Opinion articles reflect the views of their authors, not necessarily those of China.org.cn.

If you would like to contribute, please contact us at opinion@china.org.cn.

Related

Go to Forum >>0 Comment(s)