CHR-6 chief cites data privacy risks in Iloilo City’s contact tracing system

By Joseph B.A. Marzan

 

The regional director of the Commission on Human Rights (CHR) -Region 6 expressed concerns on the legal implications of the collection and use of personal data by the Iloilo City government in its contact tracing application Uswag Tracer.

Uswag Tracer was launched on Nov. 16 as a uniform, web-based contact tracing facility for all national and local government apps and private establishments and offices.

This is one of the city government’s responses to the spread of the coronavirus disease 2019 (COVID-19).

It had shut down two days later after many residents, workers, and travellers applied for their respective Quick-Response (QR) codes which are required when entering establishments in the city

Several local information technology (IT) professionals have also sounded alarm over possible data privacy breaches using the application.

In an interview with Aksyon Radyo Iloilo on Tuesday, CHR-6 Regional Director Atty. Jonnie Dabuco clarified that the right to privacy, under Section 3 of Article III of the 1987 Constitution (Bill of Rights), may be subject to regulation but may not be subjected to total denial.

He added that this regulation, given the situation by the COVID-19 pandemic, is supported by Republic Act No. 11332 (Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act).

“Maybe if we base the applicable law, Republic Act 11332, it indicates that even in times of health emergency, the rights of the people should be respected, and it may include the right to privacy. We cannot say that in times of emergency, the right to privacy should be waived. Although in some instances, it may be subjected to regulation, but to totally deny [the right to privacy], it cannot be done,” Dabuco said in a radio interview.

Dabuco pointed out that one of the information being requested by the Uswag Tracer, which is the birth date of the user, may not even be necessary for the purpose of the app.

He explained that birth dates are one of the most sensitive information which people should not be sharing more than often, as it is being used as a key identifier in several personal transactions, more commonly with finances such as bank accounts and credit cards, to name a few.

Age is considered a “Sensitive Personal Information” (SPI) under Sec. 3(L) of Republic Act No. 10173 (Data Privacy Act of 2012).

“Sometimes, there is data which is not germane or necessary to the purpose of the law. For instance, what is the relevance of the birthday? Because you’re only tracing where they live. Maybe the most important part there is the address but not the birthday,” Dabuco added.

He also said that should there be a need to identify the age group, the system may ask for the age but not the exact birth date.

Several SPIs, according to Dabuco, may still be allowed, such as sex, addresses, and contact numbers, as they are “less sensitive” than birth dates, and provided that they will only be used for contact tracing purposes.

“They should just indicate whether or not they are senior citizens, a yes or no, instead of getting their birthdays, because this data is sensitive information. Gender, not so much, but birthdates are very personal data which need to be protected and cannot be taken from one person. [Mobile numbers] are for easy contacting, and maybe the address,” he explained.

He also said that the accessibility of the QR codes to persons who do not have ready access to smartphones and printers, as well as those merely traversing through the city, may also raise human rights issues.

“One of the things we need to look at is that, will it result to discrimination? If the act, or the limiting in entering establishments, will result to discrimination, there may be an issue of human rights violations there. But another thing we should look at is the accessibility of the QR code or the manner in securing QR codes for the ordinary people. We have heard that the application, if they cannot access it through the internet, they can go to their barangay officials, but what about the other people, like who were just in transit here in Iloilo City?” Dabuco said.

He also raised concerns over the lack of information as to who will be accessing the data being submitted by the users, suggesting that there may be violations of the Data Privacy Act of 2012.

Section 16 of the said act provides for the rights of “data subjects,” or the individuals whose personal information are being processed.

These include the right to be informed of whether personal information pertaining to him or her shall be, are being or have been processed, and the right to be furnished of the following information before they enter their own data:

-Description of the personal information to be entered into the system;

-Purposes for which they are being or are to be processed;

-Scope and method of the personal information processing;

-Recipients or classes of recipients to whom they are or may be disclosed;

-Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;

-Identity and contact details of the personal information controller or its representative;

-Period for which the information will be stored; and

-Existence of their rights (i.e., to access, correction, as well as the right to lodge a complaint before the National Privacy Commission).

In its landing page when it was launched, the Uswag Tracer merely stated that it will abide by provisions of the Data Privacy Act but did not include the above-mentioned information which needed to be disclosed.

Dabuco also suggested that there must a data-sharing agreement between the city government and the Department of Health (DOH), as well as other agencies that will be using the contact tracing data.

He added that complete process of how the data will be used should be shared with the public.

“Another one is, who can access this information? Because it should be explained to the people who can access. For instance, if the DOH can access this data, based on the Data Privacy Act, there has to be a data-sharing agreement. Right now, the city, or whoever takes care of the data, should inform the public and other agencies and say that the data may be shared so that the public would know where their information or data will be used,” Dabuco said.

The regional human rights chief clarified that he is not against the contact tracing system but was merely suggesting improvements that can be made before the system is fully implemented.

“Maybe these are issues which need to be ironed out before we can totally implement the program. By the way, we’re not saying that this is not a good program. It has a good intention, which is to trace and protect us from another COVID lockdown. But there are other rights which it may violate if we implement this totally. Getting the QR code should be accessible to the people,” he said.