S. Korea walks a fine line between coronavirus tracing, privacy breach

Being confirmed with COVID-19 in South Korea means giving up autonomy over your personal data.

Once you are diagnosed, local officials have the authority to look through your cellphone, credit card history and closed-circuit camera recordings of recent visits in a process known as contact tracing.

Speed is of the essence when tracking down the contacts of infected people, health officials have said. The aim is to screen and isolate those who have had potential exposure as quickly as possible, before they pass on the disease to other people.

Now the Korean government is seeking to expedite those steps even further, with the adoption of a QR code-based tracing system.

Starting Wednesday, people wishing to visit places designated as having a high contagion risk, such as bars, nightclubs and karaoke lounges, are required to scan smartphone QR codes, generated by IT giant Naver, before entering.

The information attached to the QR codes includes full names, phone numbers, when the visits were made and for how long. The Ministry of Health and Welfare says no third parties can access the data, which is anonymized and managed by the state-operated Social Security Information Service, then discarded in four weeks.


Keeping up with speed, scale of pandemic


Seongdong-gu, a district in eastern Seoul, is among the first in the country to deploy the technology. It has used QR codes at 187 venues since May 15, nearly a month before their nationwide introduction.

In fact, the district office has developed its own NFC tags and QR codes that are designed to collect even more details, such as whether you’ve recently been in a place where an active case was detected.

A Seongdong-gu official said the digital contact tracing tools are expected to cut down a huge amount of work for those on COVID-19 duty.

“A day’s work can now be done in about half an hour,” he said.

As the pandemic continues, contact tracing officers are having to deal with a mounting workload at the expense of their health. A director at the Health Ministry collapsed from a brain hemorrhage in March while on duty, and a Jeonju City official died in February following successive night shifts.

Furthermore, not everyone willingly seeks testing and gives accurate information during epidemiological surveys. The QR code visitor logs will minimize the painstaking job of verifying the accounts of patients and encouraging their contacts to come forth and get tested.

The government stresses that its handling of citizens’ information is backed by the legal framework formed after the Middle East respiratory syndrome outbreak in 2015.

Kim Il-jae, acting chairperson of the Personal Information Protection Commission under the Interior Ministry, said in an online Asia-Pacific Privacy Authorities conference held Tuesday that the legal basis for Korea’s “processing of patient information” was established during the MERS outbreak to increase transparency.

Dispelling privacy concerns, he said the legislation governing how personal data is handled by the government when a contagious disease surfaces was supported by “social consensus” and “public demand.”

Asked how secure the data was, a Naver communications officer said the company was in a tricky position and that the question would be better addressed by the government.


Troubling precedent for privacy


But efficiencies aside, the high-tech surveillance system is sparking concerns over possible violations of privacy and other rights.

The World Health Organization’s Director-General Tedros Adhanom Ghebreyesus said in a Monday briefing that while contact tracing is a critical element of the COVID-19 response, employing digital technology “can pose challenges to privacy,” stressing “more evidence is needed about the effectiveness of these tools for contact tracing.”

The legal grounds for instituting the new monitoring tools are not clear enough and are subject to dispute, according to attorney Cho Woo-sun.

She said there are no stipulations in the laws on infectious disease control that give the government the power to make entry logs at public places mandatory, or collect personal information without consent.

“The Administrative Procedures Act states all exercise of public authority should have concrete legal backing. Penalizing facilities for failing to observe the use of QR codes will likely lead to contentions about its foundation in law,” she said.

Privacy advocate Kelly Kha-yeun Kim, who is an attorney at nongovernmental organization Open Net, fighting suppression of internet freedom, said the current standard for what constitutes a “high-risk” venue was vague.

“The businesses and establishments instructed to use the QR codes are mostly recent sites of infections. If similar outbreaks occur at cafes, restaurants and in other everyday places, the scope of surveillance can widen anytime,” she said.

Some of the country’s top coronavirus experts say the QR code IDs are excessive, even from a public health point of view.

Preventive medicine specialist Dr. Choi Jae-wook, who heads the Korean Medical Association’s Scientific Review Committee, said medical professionals were not consulted or involved in the government decision.

“Safeguarding public health has to be a top priority, yes. But it’s rather worrisome how these measures are applied indiscriminately without due procedure and in the absence of apparent boundaries,” he said.

Infectious disease specialist Dr. Kim Woo-joo of Korea University Hospital in Guro, southern Seoul, said the widely cited revisions to infectious disease control laws after the MERS outbreak failed to offer a rationale before they were passed.

Kim, who orchestrated the disease control efforts at the Korea Centers for Disease Control and Prevention at the time, said he “remained unsure of enforcing panopticon-like surveillance methods in the name of public health.”


Between virus safety and liberal values


In a response to The Korea Herald’s email inquiries, Asia analyst Gordon Chang said the tracking measures the Korean government has recently implemented are “especially troubling.”

“In any societies, measures intended to prevent the spread of disease … will restrict personal freedom,” he said, but that in free countries, leaders are at least “restrained by courts and popular pressure” and there exist “a constant balancing of the personal freedom of citizens and societal need for prevention.”

Chang said the measures may not have been needed had the country responded sooner.

“Korea has been lauded for its measures to control COVID-19. Those measures would have been largely unnecessary if Moon has adopted the common-sense measure of barring arrivals from China instead of saying, as he did in early February, that Koreans should ‘share our neighbor’s suffering,’” he said.

Leif-Eric Easley, a professor of international studies at Ewha Womans University, said in an email reply that “Korea’s contact tracing and quarantine policies are at the edge of public safety-civil liberties tradeoff.”

He said success would have to entail both -- “whether the virus is contained and whether abuse of personal data is prevented.”

“Korea has been internationally recognized for dealing effectively with the pandemic. So at stake is not only the health of Korea’s democracy but also international best practices for defeating COVID-19,” he said.

While experts sound alarms, Koreans are relatively less resistant to sharing their data with the government, according to a Realmeter survey.

A survey of 500 adults conducted May 27 shows over 70 percent of the respondents saying they support the QR code-based tracking as opposed to 16 percent who said they are against it.

Sociologist Shin Jin-wook at Chung-Ang University said popular support and constitutionality did not always align together, and that approval of the majority did not mean something was democratic.

“The government has a mandate to protect the lives of its citizens. In a pandemic, decision makers face tough choices of restricting civil liberties to stem the spread of a disease,” he said. “And these restrictive actions cannot take a top-down approach, they need to be deliberated and debated out in a public sphere.”

Explaining Koreans’ seeming acquiescence, Shin said peer pressure played a role in evoking compliance from citizens.

“Officials have been posting travel histories and personal details of the patients, which led people to act as if they were in a public gaze, and exercise more caution,” he said.

Transnational historian Lim Jie-hyun at Sogang University said finding the right balance between medical laissez-faire as seen in herd immunity strategy and near-totalitarian control was key.

“Emergencies tend to give rise to authoritarian powers in favor of dealing with most pressing tasks of the moment,” he said.

“Because there is implicit public consent, such controls are imbued with false appearance of legitimacy. People acceding to relinquishing their own rights in the face of an unprecedented plight is what is truly frightening.”

By Kim Arin (arin@heraldcorp.com)