COVID-19: A Compilation of Resources on Data Protection Advisories and Guidelines

It appears that the COVID-19 pandemic is not going away soon even as countries scramble to vaccinate their citizens. Many countries are seeing waves of infections with India now having the second-highest number of cases (more than 20 million), and hitting a record of 379,257 cases daily (as of 5 May).  In Singapore, we are seeing clusters of infection happening again, demonstrating that the guidelines, measures and contact tracing are crucial in containing any infection cluster, especially in today's interconnected world. 

Here is a compilation of resources of advisories from the Asia Pacific Privacy Authorities, the forum for privacy and data protection authorities in the region.

Checklist of good data protection practices for COVID-19 management

This checklist is a consolidation of the common baseline data protection best practices relating to technologies used to manage the COVID-19 situation. It seeks to enable app developers in the Asia Pacific region to develop apps that comply with the majority of the data protection best practices in the region for the purpose of:

• Safe Management (e.g., contact tracing, monitoring of social distancing, enforcement of stay-home quarantines, or any other form of technology developed for the purposes of safe management)
  
  
• Remote Working/Living (e.g., video conferencing, e-commerce, and other digital transactions).

However, app developers developing apps for the region or jurisdictions should still consult the rules or advisories published by the relevant jurisdiction they are developing apps for.

Contact tracing Advisories (including apps)

Contact tracing involves systematically identifying and tracing individuals who have come into contact recently with confirmed or suspected COVID-19 cases. Once these individuals are tracked down, they will be advised or ordered to be isolated/quarantined in their own homes or at specified quarantine facilities for the period specified by the medical guidelines of that country. For contact tracing to be effective in taking individuals out of the chain of transmission, it must be carried out rapidly and expeditiously, lest these individuals who may be carriers of the virus begin to infect others in the community. Hence the importance of collecting personal data/contact information.

• Office of the Australian Information Commissioner
  a. For all OAIC COVID-19 related advice and guidance
  b. For COVIDSafe app and privacy rights
  c. For COVIDSafe app and privacy rights in 10 other community languages
  d. For Privacy obligations regarding COVIDSafe and COVID app data
  e. For businesses collecting personal information for contact tracing
  
  
• National Privacy Commission (Philippines)
  On COVID-19-related apps, digital tools and solutions in this time of pandemic
  
  
• Singapore PDPC
  Advisory on collection of personal data for contact tracing and use of SafeEntry

Education/Online learning

One of the disruptions will be regarding the education of students. To avoid a “lost generation” of education, schooling has to continue even by using online means. With regard to this, organisations have to take note of the advisories from the respective jurisdictions.

• Office of the Information and Privacy Commissioner for British Columbia
  FIPPA and online learning during the COVID-19 pandemic
  
  
• National Privacy Commission (Philippines)
  Privacy Dos and Don’ts for Online Learning in Public K-12 Classes

Employment/Remote work

Even under lockdown conditions businesses have to continue to function. Some of the business continuity measures have included working from home, telecommuting and "split teams".

In the midst of all these additional measures, employers still need to be mindful about their personal data protection obligations under their local data protection laws. The following are some of the guidelines:

• Office of the Australian Information Commissioner
  a. Coronavirus (COVID-19): Understanding your privacy obligations to your staff
  b. Assessing privacy risks in changed working environments: Privacy Impact Assessments
  
  
• Office of the Information and Privacy Commissioner for British Columbia
  Tips for public bodies and organizations setting up remote workspaces
  
  
• National Privacy Commission (Philippines)
  Protecting Personal Data in a Work From Home Arrangement
  
  
• PDPC (Singapore)
  Advisories on Collection of Personal Data for COVID-19 Contact Tracing and Use of SafeEntry - Advisory for Employers

Health/patient privacy

In the event of a COVID-19 case, the health laws and guidelines take precedence over the data protection laws in the interest of public health and safety. Relevant personal data can be collected, used and disclosed without consent during this period to carry out contact tracing and other response measures, as this is necessary to respond to an emergency that threatens the life, health or safety of other individuals.

• National Privacy Commission (Philippines)
  a. Statement of the National Privacy Commission on Calls for Patients to Waive Privacy Rights’, Publicly Disclose Health Status
  b. Protecting Patient Data from Unauthorised Disclosure
  c. Joint Statement of the Department of Health (DOH) and National Privacy Commission (NPC) on Processing and Disclosure of COVID-19 Related Data (30 April 2020)
  d. Press Statement of Privacy Commissioner Raymund Enriquez Liboro on the collection of personal data to aid in contact tracing relevant to the COVID-19 response

Online security

As businesses pivot to online transactions, the use of personal data for e-commerce, work from home (WFH), online meetings and online education platforms see some 20-fold increase in usage, it is important too that organisations and individuals be mindful of the measures required in such online transactions/ engagements.

• National Privacy Commission (Philippines)
  Statement by Privacy Commissioner Raymund Enriquez Liboro on “Social Vigilantism” in the time of COVID-19

Personal information collection

• National Privacy Commission (Philippines)
  a. Frequently Asked Questions (FAQs) on the Collection and Processing of Personal Data during the COVID-19 Pandemic
  b. Collect the minimum necessary information in providing financial aid and other relief packages to those affected by the enhanced community quarantine
  
  
• National Institute for Transparency, Access to Information and Personal Data Protection (Mexico)
  a. Sector-specific infographics on processing personal data
  b. Reporting improper processing of personal data
  c. INAI’s COVID-19 microsite

Restaurants, Entertainment, Retail

• Office of the Information and Privacy Commissioner for British Columbia
  a. Collecting personal information at food and drink establishments, gatherings and events during COVID-19
  b. Related infographic
  
  
• National Privacy Commission (Philippines)
  Guidelines for Establishments on the Proper Handling of Customer and Visitor Information for Contact Tracing

Statements

• National Institute for Transparency, Access to Information and Personal Data Protection (Mexico)
  INAI’s outputs, as recommendations issued addressed to both public and private sectors
  
  
• National Privacy Commission (Philippines)
  a. Statement of Privacy Commissioner Raymund Enriquez Liboro on the Declaration of Public Health Emergency in Relation to COVID-19
  b. NPC supports DILG’s bid vs discrimination of COVID-19 frontliners

Travel/Tourism

• National Privacy Commission (Philippines)
  Statement of Privacy Commissioner on release of passenger manifest of airlines to government agencies

These are useful guidelines and advisories drawn up to mitigate the risks of pandemic worsening. It serves organisations, stakeholders, and individuals well to heed them in a world that has seen a rising COVID-19 mortality.

Adapted from APAC with input by: Leong Wai Chong, CIPM, GRCP

The views and opinions expressed in this article are those of the author and do not necessarily reflect the official view or position of DPEXNetwork. Information and links are correct as at the point of posting.