Inbound Travellers, COVID Quarantines, and Data Access in Hong Kong
Stuart Hargreaves – The Chinese University of Hong Kong
-- COVID19 was gazetted in Hong Kong as a statutorily notifiable disease under the Prevention & Control of Diseases Ordinance in January. This granted the Secretary for Food & Health broad powers to regulate the admission of persons to Hong Kong, including isolation and quarantine, in order to prevent the spread of COVID19. For the last several months I have been running a research project aimed at discovering the kind of personal information retained by the Hong Kong Government as a result of the quarantine measures it applies to incoming travellers at the airport.
Virtually all arriving passengers must now undergo a COVID19 deep throat saliva test. If the results are positive, they are taken to hospital. If the results are negative, they must complete a 14-day quarantine period before being allowed to move about Hong Kong freely. Most can complete this period at a private residence, but some arrivals from high-risk countries must complete it in a hotel. In either case, enforcement of the quarantine is achieved through the use of a smartphone app connected to an electronic bracelet. The system is ‘home grown’ and uses changes in the electronic signal environment (including Bluetooth, wifi, and GPS signals) to determine whether an individual has left their mandated place of quarantine.
My research project uses the data access provisions of Hong Kong’s Personal Data (Privacy) Ordinance (PDPO) to determine exactly what kind of information is gathered through this process. Hong Kong Data Protection Principle 6 allows individuals to make formal data access requests to data controllers; I sought volunteers who had undergone the quarantine process and assisted them in making these requests. The project is ongoing, but the results are intriguing So far, the project has revealed that there are two different organizations responsible for holding the relevant data. The Department of Health controls information regarding the health test at the airport, while the Office of the Government Chief Information Officer (OGCIO) controls data related to the wristband.
From a privacy standpoint, the results are mixed. Most importantly, neither organization appears to retain significant amounts of data, and the OGCIO in particular appears to have adopted a number of best practices regarding data protection including deletion after a defined period of time. Both departments indicate they have not transferred any information gathered to any third parties. The Department of Health has a more formalized procedure for responding to access requests, but tend to provide the minimum response possible. Neither office charge fees for processing of the applications, which is positive.
However, the project has also revealed some potential problems. The fact that there are two separate points of contact (and that this is not made clear to arriving passengers) and that neither allows an initial contact to be made via email adds substantial friction to the process, making it more difficult for Hong Kongers to exercise their rights under the PDPO. The Department of Health also uses a “Personal Information Collection Statement” that is barely adequate, and ought to be revised given the sensitivity of the information gathered. While both departments ultimately responded to the requests from the volunteers, the time to do so is inconsistent and in a few cases volunteers waited nearly two months just to receive an initial acknowledgement from the Government that their request had been received.
Hong Kong’s relative success in containing COVID19 suggests that the quarantine approach has been successful from a health perspective (though this is no doubt aided in Hong Kong by the relatively small number of ports of entry as well as near-universal masking). It suggests that more intrusive measures such as mandatory ongoing contact tracing for the entire population may not always be necessary. At the same time, the rapidity with which the quarantine measures and accompanying enforcement mechanisms were developed mean that there is certainly room for improvement in how sensitive personal information of arriving passengers is handled. Once all the data has collected and analyzed, this project will seek to define a set of ‘best practices’ related to informational privacy rights in the context of health quarantines.