Answering key data governance questions raised by COVID-19

As countries around the world struggle to contain the spread of the SARS-CoV-2 virus, the issue of government intervention into the private lives of citizens has come into sharpened focus. How aggressively should states seek to control the activities of individuals and businesses in order to combat this deadly health threat? To what degree should privacy and other rights be curtailed for the sake of public safety?

How countries handle data, it turns out, is a crucial part of their pandemic response. Information about people’s health, movements and interactions with others can be as important as physical quarantines and lockdowns in combating disease. This data is also highly sensitive, and in most countries it is subject to stringent privacy controls.

Those controls are coming under a microscope as never before, especially as countries with highly interventionist governments have shown success in bending the coronavirus infection curve downward. Many are asking, can liberal democracies do the same? And at what cost?

Our belief is that even liberal societies can make better use of personal data for the greater good while still protecting individual rights like privacy. They key is a systematic approach that emphasizes creating and sharing value, using clear rules created though broad agreement.

Under many countries’ data-governance regimes, privacy protections can be relaxed during pandemics and other crises, giving governments more power than usual to access private information. But the rules defining exactly how, when and to whom exceptions apply are often vague, and differ from jurisdiction to jurisdiction. In practice, policy makers confronting the current crisis have been forced to answer many emergency-related data-privacy questions in real-time, on an ad hoc basis when the stakes could not be higher.

Thorough, accurate data is vital for many disease-fighting tasks: predicting where and how fast an illness will spread; allocating inevitably scarce resources; identifying so-called infection clusters; and tracking and tracing the contacts of those who have been found to be carriers. Quarantines are more effective when people’s movements can be monitored. And since viruses don’t respect borders, countries must share information for containment efforts to work — and they need to be able to trust that the information they receive from elsewhere is reliable.

Complicating matters is the fact that the scope of health-related data is expanding rapidly — both in terms of what constitutes medical information and the range of organizations that collect it. Mundane lifestyle data can be as useful as hospital records in tracing a virus’ spread, and the technology contained in the phones in our pockets can be as powerful in fighting disease as that in a laboratory — but that means more stakeholders need to be brought into the discussion.

So far, some of the most aggressive data-based interventions to fight coronavirus are happening in Asia, where authorities have used information to do everything from provide real-time infection updates to the public to tracking people’s movements in order to enforce quarantine measures. China has used its surveillance infrastructure to track infected people, and residents of some Chinese cities must present a smartphone QR code certifying that they are healthy in order to enter shops and restaurants. Singapore has required coronavirus carriers to make a wide range of personal information available to the government. South Korea has conducted extensive tracking though smartphone apps and text messages. Several countries have issued tracking devices such as GPS bracelets to infected people.

Not all of these measures would be accepted everywhere, and some rights watchdogs have voiced concerns about overreach. Yet not all of Asia’s interventions have been coercive. Creativity and voluntary cooperation have also been in evidence, too. Early in the outbreak, for instance, the health ministry in Taiwan, China began providing information about shops where surgical masks were available, updating information about supplies every 30 seconds — an example of voluntary public-private data cooperation that worked to reassure the public and curb panic buying.

In Japan, the Tokyo Metropolitan government has moved to make coronavirus data open-sourced, while local governments and the national health ministry have partnered with LINE, the country’s most popular messaging app, to circulate a voluntary coronavirus health questionnaire to users, with answers collected by the company and shared with health authorities. So far more than 25 million of LINE’s 83 million users have participated.

Attitudes and legal systems vary widely when it comes to data management and privacy, even within Asia. At the global scale, the differences are even greater. In Europe, where laws guaranteeing individuals’ right to data privacy are perhaps most strict, the coronavirus outbreak has prompted calls for greater openness — as well as concerns that the crisis could lead to abuses and rollbacks of essential protections.

We believe that a systematic, cross-national approach to handling sensitive data is vital, not only to deal with the current crisis but to prepare for the next one. At the Centre for the Fourth Industrial Revolution, we have been working on an approach to data governance that seeks to balance human rights such as privacy with the interests of a data-collecting organizations and the public interest — that is, the needs of whole societies.

We call this approach Authorized Public Purpose Access (APPA). At its core is the question of value: when normally private data holds potential value for everyone, there is an argument for broadening access to it. In a white paper published in January, we examined existing data-governance models and found that most are biased toward the interests of one of three major stakeholder groups—individual data subjects, technology companies and other data holders, or governments (whose interests may or may not align with those of their citizens). We proposed a more balanced governance model designed to maximize the socially beneficial potential of data while protecting individual rights such as privacy and the legitimate interests of data holders.

The key is creating widely accepted mechanisms and limits on that access, based on the kind of data involved, who is doing the accessing, and why. How valuable or sensitive is the data? Is the proposed user a legitimate, trusted entity? And is the purpose both important and broadly beneficial — that is, will the data be used for the benefit of everyone in society, rather than a select few?

APPA not a one-size-fits-all set of rules — every society will inevitably have its own priorities. We offer it instead as a reference tool in the debate over health-data management. As the world seeks a new normal in the wake of the coronavirus pandemic, it is a debate that grow more intense and important for all of us.

Contributing to this article include: Chizuru Suga, Head of the World Economic Forum Centre for the Fourth Industrial Revolution Japan; Jonathan Soble, Editorial and Communication Lead; Yusuke Inoue, Healthcare Data Policy Project Fellow; Masako Okamoto, Healthcare Data Policy Project Fellow; Reiko Onodera, Healthcare Data Policy Project Fellow; Yasunori Suzue Healthcare Data Policy Project Fellow.