Location Tracking of COVID-19 Patients and Location Monitoring of Quarantined Must Conform To Human Rights Principles

On top of collecting past location data of COVID-19 patients, the government agencies are discussing the use of location-tracking wristbands to monitor the future movement of the quarantined. Civil societies have already raised concerns on excessive disclosure of the data thus collected. Now, Open Net is concerned with the earlier, collection stage that may contravene the principles of privacy protection.

 

Location tracking of patients and suspects

In response to COVID-19, privacy rights in Korea are being restricted at similar levels to compulsory investigatory actions such as search and seizure.

Article 76-2 (1) of the Infectious Disease Control and Prevention Act and its enforcement decree allow health officials to acquire information on the infected, the suspected-to-be-infected, the contacted, and the suspected-to-be-contacted such as names, resident registration numbers, addresses, telephone numbers, prescriptions, records of medical treatment, records of immigration control, credit card records, transit card records, and CCTV recordings from all relevant third parties – all without the consent of the data subjects and without any judicial oversight.

(2) of the same article allows health officials AND administrators of municipalities to collect location information on the infected, the suspected-to-be-infected, the contacted, and the suspected-to-be-contacted from telecommunications business operators and location information providers through the police — again all without consent of the data subjects and without any judicial oversight. Raw location information of those who freely roamed without anticipating surveillance is thus collected by the government.

The right to privacy can of course be restricted by law for reasons of strong public interest. For instance, search and seizure is justified by an essential need for a criminal investigation aimed at protecting the life and property of citizens. However, it is only possible when it meets certain requirements such as there being a ‘suspicion of a crime’, and even then it is only allowed after it has been approved in advance by a judge in the form of a warrant.

The data collection under the Infectious Disease Control and Prevention Act takes place under the discretion of health officials heavily interested in the data collection going forward, and even the discretion of elected officials of municipalities similarly interested. There are no safeguards to ensure that such discretion is not arbitrarily exercised.

Other than Singapore, it is rare to find a country with permanent legislation that allows such non-consensual non-judicial collection of past location data. Israel has temporary, wartime-like legislation that allows similar data collection. Germany’s parliament scrapped discussions of a similar provision after privacy concerns were raised, and now favors sending phone alerts to those who came near COVID-19 patients without a central collection of data. European nations are wary of closely surveilling those who have been infected and violating their human rights when they are victims after all.

Korea’s case is especially problematic for the following reasons: Firstly, extremely personal information such as credit card records, medical records, and detailed location information (not just cell site location but also the more granular GPS) is being collected.

Secondly, the collection of data is being conducted by the police, who have powers to conduct separate investigations, causing much deeper privacy concerns.

Thirdly, not only those infected but those suspected of being infected are subject to the collection of personal data, which in turn includes not only those who were in contact with the infected and even “those suspected of having been in contact”.  Such location tracking was used not only to alert people of risky areas and recommend self-quarantine or testing but also to put many without symptoms into mandatory testing or mandatory quarantine. Many argue that such location tracking is not helpful since GPS does not work indoors and both GPS and cell site location information are not accurate enough to identify the less-than-6 feet contacts but Korea compensated for the inaccuracy simply by testing or quarantining all “those suspected” to be in contact.

However, it is of relief that the relevant articles provide for the duty to inform the subjects of the fact of data collection, restrict the purpose of data collection to the prevention and blocking of the spread of the infectious disease, and require that the data be destroyed without delay at the completion of the relevant tasks.

This worldwide threat is new to us all. The validity of such compulsory data collection for purposes other than a criminal investigation, and its acceptable standards and procedures should it be valid, are unclear under international human rights standards. Hence, we are not opposing it now: such measures made it possible for Korea to identify “worthwhile” targets of testing and therefore conduct as many tests as it did with confidence, as these measures facilitated contact tracing COVID-19 all the way down to ‘those suspected to be in contact’. However, we implore that in executing such practices, Korean law remains conscious of where it stands among its international peers, and reevaluate once the threat is over and behind us.

 

Location surveillance of self-quarantined

The government is reportedly considering mandating the use of location-trackable wristbands to those who are in self-quarantine. Self-quarantine apps are currently being used can only be installed with consent and therefore has a low installation rate. It is also possible to leave the phone behind or turn off its location-tracking functions.

The answer lies within the question. Orders to self-isolate are issued under Article 42 of the Infectious Disease Control and Prevention Act and violating such orders is already punishable by law. To force the use or installation of location-tracking hardware or apps on top of these obligations require legal grounds provided by the National Assembly in the form of legislation. Even automobile seat belts could be enforced only by specific legislation. One cannot force citizens to install speed-tracking apps on their cars just on the basis of a traffic law punishing speeding.  In a liberal democracy, it requires a high level of social consensus to physically force the observance of law instead of leaving it up to each individual citizens’ moral responsibility.

In summary, it was already not possible to force the installation of home-isolation apps because of the lack of legal ground. This does not change when the method switches from software to hardware: wristbands. Also, even if wristbands were to be issued, the same problem of efficacy will arise because of the lack of legal ground to punish those who disengage or tamper with the device. Furthermore, it is especially against the principle of proportionality when such measures are being considered even to those merely suspected of being in contact with the patients.

It is impossible to create legal grounds during the current election period. As such, the government should scrap its plans to mandate the usage of wristbands. Talk of obtaining subjects’ consent before the installation of wristbands is moot, as it will result in the same low-installation-rate-problem the app came to face with.

The international human rights standard is unclear as to the validity of requiring the use of special devices to monitor compliance with infectious disease control orders. Korea is one of the few countries that did not go forward with extreme border shutdowns, and the need for stronger surveillance of those subject to self-quarantine is understandable. However, the basic principles of human rights restrictions must be followed in order to fully preserve the values of our society that we are trying to protect in this crisis.

*After this statement went to press, the government began the wrist bands but only upon consent.

April 10, 2020

Open Net

 

Inquiry: Open Net Secretariat 82-2-581-1643, master@opennet.or.kr