COVID-19 and Privacy

-- By ElaineHuang - 20 Nov 2020

Introduction

South Korea has had, in general, an effective response to the pandemic. With the recent spike in cases, the total number of confirmed cases is a little over 30,000. Especially when compared to the United States, even accounting for the U.S.’s larger population, South Korea is one of the countries that has handled the pandemic particularly well.

For a case in point, in May of this year, there was a small outbreak of Coronavirus in the Itaewon district of Seoul, tied to a string of nightclubs in the area. The Seoul Metropolitan Government quickly traced anyone who had visited one of the major nightclubs and also used data from cell phones, credit card records, lists of nightclub visitors, public transportation records, and surveillance cameras to eventually identify 5,517 people. They also used cell phone location data to identify close to another 60,000 people who had spent at least half an hour around the area. With this data, the South Korean government was able to monitor these people, have them get tested anonymously, and slow the spread of the virus.

While stopping the spread of the virus is not something to criticize, I was alarmed by the extent to which the government was able to use data to identify these individuals. And this led me to wonder about the role of privacy during a pandemic. Should people have a lower expectation of privacy?

Anonymity and Privacy Problems During a Pandemic

Tracking the spread of a pandemic is extremely important in curbing the rate of infection. Indeed, when I visited different offices during the course of my summer internship, all of the places asked me to write down my name and contact information, which I gladly complied to because had that office later discovered a positive COVID case, I would have liked to know about my potential exposure and get tested. Tracking allows for people to isolate sooner, thereby reducing the risk of exposure to those around them.

In this Korean nightclub case, however, the tracking was much more invasive than simply asking for a name and contact information. As stated by Professor Moglen previously, anonymity is more than just hiding away one particular thing we do–it’s also about what we read, what we see, what our preferences are. These nightclubs were frequented by the LGBTQ+ community, which is still quite stigmatized in South Korean society, and while the government offered anonymous testing to encourage this community to get tested–only requesting a phone number for contact purposes–the data from cell phones, credit cards, public transportation records, and cameras still outed the people who visited Itaewon and exposed their preferences (e.g. their preference for nightclubs, choice of drink, post-clubbing snacks, or even for other people). Even if this data didn’t include names per se, the aggregate of all of the information may still have allowed the government to personally identify individuals.

The collection of such data is much more invasive than simply writing down a name and contact information, but perhaps it was more effective than the latter. In the face of a pandemic, and judging from the positive response to the government’s swift action, it doesn’t seem like people even minded that their anonymity and privacy were being stripped away.

What Can Be Done?

One thing that should be done is to allow people to request to have their data permanently deleted once the pandemic is over. Even better is to require these agencies and companies to delete this data without customer requests.

And, if there is no better way to track the spread of a pandemic, people should at the very least be aware of their consent to credit card companies or cell phone providers to provide this information to the Government in times of a viral outbreak.

Another option is to simply have the proper infrastructure in place for people to get tested frequently and anonymously without personally identifiable information. South Korea had the right idea when it promised anonymous testing to encourage the LGBTQ+ community to get tested.

This is a good start in clarifying the issues, I think. We need to know what actually works, however. Recent South Korean experience has shown how rapidly the virus can jump past the point at which tracing single clusters is feasible. Much of the argument depends on whether there is any actual ability to prevent cases and to save lives by conducting mass surveillance or repurposing surveillance-capable data sources in this fashion. The discussion has not occurred in the US because the scale of the outbreak dwarfs any such efforts, It would much improve the draft to put the Korean efforts in context. What have we actually learned in the world about the value or absence of value of such efforts? If they are pointless, then discussing whether they are necessary is a category error.

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, ElaineHuang
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.