 |
| © Bloomberg A traveler wearing protective masks and protective suit pushes a luggage cart through the arrivals hall of Hong Kong International Airport on March 18. |
By Jamie Tarabay, Bloomberg
Layla Keith had just gotten off a flight from Singapore when she and her fellow passengers were met at the gate by Hong Kong government officials and ushered onto buses that shuttled them to a nearby convention center.
There, they were handed forms to fill out and given small containers to spit into.
“They just put all the samples in a tray and told us to go,” said Keith, a junior at an international high school in the semi-autonomous Chinese territory. “I mean, we just didn’t really have a choice.”
Those who tested positive for the coronavirus were sent to a hospital for treatment; others were allowed to go. But the data from their saliva stayed behind in a government database.
In the global battle to curb Covid-19, governments have collected troves of data from testing and contact-tracing apps to try to find the disease and stop its spread. Even as many are willing to surrender personal information amid the crisis, privacy experts worry about who controls the data and what will happen to it after the crisis ends.
Hong Kong began imposing stricter measures on travelers after a rebound in coronavirus cases was brought on by residents returning from more severely stricken areas. Non-residents were banned from entry, and a mandatory quarantine was required for those returning home.
In addition, on April 8, incoming travelers were required to submit “deep throat saliva” tests, after being shuttled to a nearby center. Starting April 22, asymptomatic passengers had to wait for their test results before being allowed to leave.
Even as contact tracing apps have raised concerns about state surveillance, the involuntary surrender of DNA or other biodata takes it a step further, providing governments with sensitive and unchangeable fragments of personal identity. Saliva samples are used by DNA testing companies, for instance, to glean insights on ancestry, certain traits and predisposition to certain health ailments.
In Hong Kong, where pro-Democracy protests continue, some worry that the pandemic may give government officials the opportunity to make restrictions on privacy permanent. How Hong Kong uses the biodata it collects from travelers could provide some detail on whether or how that might happen.
“The problem of collection of biodata in the age of artificial intelligence and big data is a concern globally, especially in the administration of cross-border travel, where governments around the world are increasingly collecting and storing travelers’ data, from fingerprints to facial recognition to saliva,” said Maya Wang, a senior researcher at Human Rights Watch.
“Travelers, and in particular foreigners, don’t have rights to challenge this collection or this use or storage, and have very little ability to seek redress,” she said.
Biodata can be particularly revealing and therefore valuable to hackers or repressive governments. It could expose medical histories or contribute to selective surveillance of political activists. It could also compromise a person’s ability to get insurance or open a bank account, experts warn. In China, authorities are already using DNA data to keep track of the Uighur population.
Hong Kong’s health ministry told Bloomberg News it would dispose of the saliva samples according to laboratory protocols, but it didn’t say what those were. In forms travelers fill out on arrival at the airport, they are told the government “will take all practicable steps to ensure that personal data is not kept longer than necessary.”
The ministry also said the data would be accessible to government departments where deemed necessary. However it wasn’t clear whether this referred to the passengers’ travel and personal history, or the data yielded from the saliva samples. The ministry didn’t respond to repeated requests for clarification.
Authorities should be using saliva to determine if someone is infected with Covid-19 and then disposing of the sample, said David Murdoch, dean of the University of Otago in Christchurch, New Zealand, and a specialist in infectious diseases. Governments shouldn’t try to pull additional information from such a sample without a person’s consent, he said.
Some governments, like Singapore’s, have vowed to delete any private data or anonymize as much as they can.
In Hong Kong, authorities have recently stepped up efforts to rein in the pro-democracy camp with arrests of prominent activists and lawmakers, while Beijing has asserted the right to comment on the city’s politics. That has spurred worries among some lawmakers that departments outside of health authorities wouldn’t use that data, and further, that Beijing’s representatives in the territory might also lay claim to that information.
“I have to say that not a lot of people have really thought about it yet, the potential implications for collecting this data,” said Charles Mok, a member of Hong Kong’s Legislative Council who represents the information technology constituency.
“We should get clarification from the government, at the very least it should tell us how they’re going to dispose of the data and tell us this is the only test they’re carrying out with the samples,” he said.
One major problem with Hong Kong’s data privacy law is that a section that bans the cross-border transfer of private data has never come into effect. The law, enacted in 1996, hasn’t been updated and the section regarding cross-border data transfer hasn’t been enforced, mainly, experts say, because so many foreign companies have back offices overseas and those regulations would hinder their ability to operate.
Additionally, the personal data and privacy law that currently exists makes no accommodation for facial images or biodata, said Wang, of Human Rights Watch.
“That’s why the privacy data ordinance needs to be updated,” Wang said. On the cross-border transfer of private data, she said, “The government hasn’t given us any satisfactory information on why it hasn’t been enacted all these years.”
James Hazel, a research fellow at Vanderbilt University Medical Center, who studies privacy policies concerning the collection, use and sharing of genetic data, said the European Union tends to have stronger regulations on how biodata such as DNA can be used. In the U.S., he said, the secondary use of such data depends on the context -- rules governing physicians or researchers are generally more strict than those for a DNA company receiving voluntarily samples from customers.
Hong Kong isn’t the only place where personal data and politics are interwoven. At least one other country, Vietnam, currently greets travelers with swab tests on arrival. Vietnamese officials said that the records of every test result are retained but that it is against the law to reveal anyone’s name.
But as other countries move to loosen restriction on travelers, Hong Kong -- where cases have nearly trickled to a halt -- offers one model for how to track the infection in people entering the country.
Some travelers into Hong Kong didn’t seem too concerned, based on recent comments on Facebook support groups discussing Hong Kong’s arrival process. People swapped tips on keeping children entertained and suggested bringing food and additional water for obligatory hotel stays managed by the government for afternoon arrivals.
But what happened to their saliva, or the forms they’ve signed agreeing to submit the samples, weren’t a topic of conversation.
And while arriving at a European airport that is protected by stringent privacy laws might be less intrusive on travelers, anyone wanting to do business in Hong Kong -- 71 million people traveled through the international airport last year -- will have to spit in a cup, at least for now.
“If nothing else, it is important for Hong Kong to be transparent about the details of the program so travelers can use that information in determining whether they want to travel to Hong Kong or not,” said I. Glenn Cohen, a Harvard University law professor and expert on the intersection of bioethics and the law.
Layla Keith had just gotten off a flight from Singapore when she and her fellow passengers were met at the gate by Hong Kong government officials and ushered onto buses that shuttled them to a nearby convention center.
There, they were handed forms to fill out and given small containers to spit into.
“They just put all the samples in a tray and told us to go,” said Keith, a junior at an international high school in the semi-autonomous Chinese territory. “I mean, we just didn’t really have a choice.”
Those who tested positive for the coronavirus were sent to a hospital for treatment; others were allowed to go. But the data from their saliva stayed behind in a government database.
In the global battle to curb Covid-19, governments have collected troves of data from testing and contact-tracing apps to try to find the disease and stop its spread. Even as many are willing to surrender personal information amid the crisis, privacy experts worry about who controls the data and what will happen to it after the crisis ends.
Hong Kong began imposing stricter measures on travelers after a rebound in coronavirus cases was brought on by residents returning from more severely stricken areas. Non-residents were banned from entry, and a mandatory quarantine was required for those returning home.
In addition, on April 8, incoming travelers were required to submit “deep throat saliva” tests, after being shuttled to a nearby center. Starting April 22, asymptomatic passengers had to wait for their test results before being allowed to leave.
Even as contact tracing apps have raised concerns about state surveillance, the involuntary surrender of DNA or other biodata takes it a step further, providing governments with sensitive and unchangeable fragments of personal identity. Saliva samples are used by DNA testing companies, for instance, to glean insights on ancestry, certain traits and predisposition to certain health ailments.
In Hong Kong, where pro-Democracy protests continue, some worry that the pandemic may give government officials the opportunity to make restrictions on privacy permanent. How Hong Kong uses the biodata it collects from travelers could provide some detail on whether or how that might happen.
“The problem of collection of biodata in the age of artificial intelligence and big data is a concern globally, especially in the administration of cross-border travel, where governments around the world are increasingly collecting and storing travelers’ data, from fingerprints to facial recognition to saliva,” said Maya Wang, a senior researcher at Human Rights Watch.
“Travelers, and in particular foreigners, don’t have rights to challenge this collection or this use or storage, and have very little ability to seek redress,” she said.
Biodata can be particularly revealing and therefore valuable to hackers or repressive governments. It could expose medical histories or contribute to selective surveillance of political activists. It could also compromise a person’s ability to get insurance or open a bank account, experts warn. In China, authorities are already using DNA data to keep track of the Uighur population.
Hong Kong’s health ministry told Bloomberg News it would dispose of the saliva samples according to laboratory protocols, but it didn’t say what those were. In forms travelers fill out on arrival at the airport, they are told the government “will take all practicable steps to ensure that personal data is not kept longer than necessary.”
The ministry also said the data would be accessible to government departments where deemed necessary. However it wasn’t clear whether this referred to the passengers’ travel and personal history, or the data yielded from the saliva samples. The ministry didn’t respond to repeated requests for clarification.
Authorities should be using saliva to determine if someone is infected with Covid-19 and then disposing of the sample, said David Murdoch, dean of the University of Otago in Christchurch, New Zealand, and a specialist in infectious diseases. Governments shouldn’t try to pull additional information from such a sample without a person’s consent, he said.
Some governments, like Singapore’s, have vowed to delete any private data or anonymize as much as they can.
In Hong Kong, authorities have recently stepped up efforts to rein in the pro-democracy camp with arrests of prominent activists and lawmakers, while Beijing has asserted the right to comment on the city’s politics. That has spurred worries among some lawmakers that departments outside of health authorities wouldn’t use that data, and further, that Beijing’s representatives in the territory might also lay claim to that information.
“I have to say that not a lot of people have really thought about it yet, the potential implications for collecting this data,” said Charles Mok, a member of Hong Kong’s Legislative Council who represents the information technology constituency.
“We should get clarification from the government, at the very least it should tell us how they’re going to dispose of the data and tell us this is the only test they’re carrying out with the samples,” he said.
One major problem with Hong Kong’s data privacy law is that a section that bans the cross-border transfer of private data has never come into effect. The law, enacted in 1996, hasn’t been updated and the section regarding cross-border data transfer hasn’t been enforced, mainly, experts say, because so many foreign companies have back offices overseas and those regulations would hinder their ability to operate.
Additionally, the personal data and privacy law that currently exists makes no accommodation for facial images or biodata, said Wang, of Human Rights Watch.
“That’s why the privacy data ordinance needs to be updated,” Wang said. On the cross-border transfer of private data, she said, “The government hasn’t given us any satisfactory information on why it hasn’t been enacted all these years.”
James Hazel, a research fellow at Vanderbilt University Medical Center, who studies privacy policies concerning the collection, use and sharing of genetic data, said the European Union tends to have stronger regulations on how biodata such as DNA can be used. In the U.S., he said, the secondary use of such data depends on the context -- rules governing physicians or researchers are generally more strict than those for a DNA company receiving voluntarily samples from customers.
Hong Kong isn’t the only place where personal data and politics are interwoven. At least one other country, Vietnam, currently greets travelers with swab tests on arrival. Vietnamese officials said that the records of every test result are retained but that it is against the law to reveal anyone’s name.
But as other countries move to loosen restriction on travelers, Hong Kong -- where cases have nearly trickled to a halt -- offers one model for how to track the infection in people entering the country.
Some travelers into Hong Kong didn’t seem too concerned, based on recent comments on Facebook support groups discussing Hong Kong’s arrival process. People swapped tips on keeping children entertained and suggested bringing food and additional water for obligatory hotel stays managed by the government for afternoon arrivals.
But what happened to their saliva, or the forms they’ve signed agreeing to submit the samples, weren’t a topic of conversation.
And while arriving at a European airport that is protected by stringent privacy laws might be less intrusive on travelers, anyone wanting to do business in Hong Kong -- 71 million people traveled through the international airport last year -- will have to spit in a cup, at least for now.
“If nothing else, it is important for Hong Kong to be transparent about the details of the program so travelers can use that information in determining whether they want to travel to Hong Kong or not,” said I. Glenn Cohen, a Harvard University law professor and expert on the intersection of bioethics and the law.
