Giving out patient details: Serving public good or invasion of privacy?


Headlines published in the last 30 days are listed on SLW.

Giving out patient details: Serving public good or invasion of privacy?

Giving out patient details: Serving public good or invasion of privacy?

Source: Straits Times
Article Date: 15 Mar 2020
Author: Chang May Choon

Transparency is crucial in a health crisis, but revealing too much could lead to stigmatisation.

In highly connected South Korea, people know immediately when a new coronavirus case emerges in their neighbourhood.

A government alert, accompanied by a shrill emergency alarm, will pop up on their mobile phones, giving details such as the new patient's age, gender and travel history.

Such public revelations have led to online witch-hunts that disclose patient identities, triggering groundless speculations and cyber bullying when travel records unwittingly reveal some awkward truths, such as involvement in dubious religious groups.

As the coronavirus continues to wreak havoc around the world, causing more than 140,000 infections - with Italy, Iran, South Korea and France among the worst hit outside China, where Covid-19 is said to have originated - concerns have been raised about the infringement of privacy, stigmatisation and doxxing as patient data is scrutinised and dissected.

South Korea, which has reported more than 8,000 cases of the coronavirus, insists that transparency is crucial in fighting a public health crisis and invokes the Infectious Diseases Act to do contact tracing using cellphone records, the Global Positioning System, credit card use and closed-circuit television camera footage.

But some critics have questioned the need to reveal so much personal information, and if public good comes at the expense of privacy.

A 46-year-old woman from the western city of Cheonan, who tested positive on Feb 27, drew so much flak after her travel history exposed that she is a member of controversial religious group Jesus Morning Star that her husband filed a petition with the presidential Blue House calling for an end to the "indirect murder" of his wife.

"After my wife was diagnosed, I was ashamed and remained silent," he wrote. "However... I cannot stand the harassment any longer... The numerous comments and falsehoods disguised as real news are causing the total destruction of one's character." In another case, two infected members of the same church in Busan were accused of having an extramarital affair after their travel history revealed that they spent a night in the same condominium resort on Feb 21.

Patient No. 31, a 61-year-old woman from Daegu, was widely condemned for travelling extensively and attending church twice despite being ill. Testing positive on Feb 18, the so-called "crazy ajumma" ("auntie" in Korean) was the first of thousands of members of the secretive Shincheonji Church of Jesus who were infected in the country's largest community outbreak of the coronavirus disease.

Politician Lee Jun-seok warned that revealing too much about a patient's travel history could lead to stigmatisation, thus deterring people from seeking help, he told The Korea Herald newspaper.

But the South Korean government swears by what it calls a "dynamic response system for open democratic societies".

Vice-Health Minister Kim Gang-lip last Monday underscored the importance of disclosing information and detailed explanations to help citizens stay safe.

"The more transparently and quickly accurate information is provided, the more the people will trust the government. They will also act rationally for the good of the community at large," he said at a foreign media briefing.

Identity leaks, however, come at a heavy price.

Four civil servants working at the Seongbuk District Office in central Seoul were arrested last Monday for violating privacy laws after they leaked a confirmed patient's information in a phone group chat unrelated to work. Details included the patient's personal information and people whom the patient met over the Chinese New Year holiday.

The police said they will conduct a thorough investigation into "document leaks that can cause social chaos".


Outside South Korea, some other countries are also struggling with overzealous journalists and online vigilantes bent on uncovering the identities of patients under the guise of public service.

Indonesia's first two coronavirus patients, a 31-year-old woman and her 64-year-old mother, were isolated in hospital when an army of reporters swarmed their home in West Java two weeks ago after their test results were announced by President Joko Widodo.

Within hours, their photographs and personal details, from their initials to their home address, were shared on WhatsApp groups and social media. The viral message detailed their symptoms, where and how they might have contracted the virus, and when they were admitted to hospital.

The younger woman also had to refute reports which said she caught the virus while dancing in a Jakarta club on Feb 14 with a close Japanese friend, who later tested positive in Malaysia. She clarified in a WhatsApp message that she did not have a Japanese friend, and the dance event was held in a restaurant on Feb 15.

"You have no idea how stressed I am right now... Please respect my privacy and help me get through this instead of putting more stress in my head," she said, adding that the leaks have left her and her mother "mentally drained".

Indonesia has no specific laws on privacy or data protection. But President Joko has since called on the public to respect the privacy of the patients and ordered his ministers and the hospitals treating the patients to stop disclosing their private information.

The Alliance of Independent Journalists group has also urged members to be more considerate in their reportage and refrain from sensationalising the cases.

Vietnam's 17th patient, a 26-year-old woman from a wealthy family, was abused online after it was revealed that she travelled through Britain, France and Italy before returning to Hanoi on March 2. She was admitted to hospital only three days later.

Several local media outlets published her full name. A document with her home address and workplace was also leaked online. People abused her on social media and spread rumours about her purported movements.

The authorities had until then been cautious about giving too many details about new patients.

Vietnam's state-owned media also refrained from using patients' full names, although it has run pictures of those who have recovered from the disease.

In the Philippines, health officials disclose only the age, gender, nationality and travel history of new patients.

But social media has been muddying the waters with misinformation and hearsay, forcing some hospitals and companies to clear the air. Accounting firm Deloitte, for one, had to issue a statement to clarify that only one of its staff - a lawyer - tested positive for the virus, not 11 as rumoured on Facebook.


Given the prevalence of social media today, it seems inevitable that the coronavirus outbreak will challenge the principles of privacy, freedom and human rights, as Bloomberg noted in a March 2 commentary.

"We will have to walk a fine line between letting transparency and reason prevail, and taking sensible precautions to save lives," it added.

Even in Europe, where human rights are highly valued and the General Data Protection Regulation keeps personal information private, exceptions are being made in times of crisis.

Italy, the country outside China which is the worst hit, with more than 17,000 cases and over 1,200 deaths, adopted the Civil Protection Ordinance No. 630 on Feb 3 to give the authorities "extensive powers" to process personal data related to the outbreak, according to global law firm Morgan Lewis.

This includes potentially sensitive information such as racial or ethnic origin, political opinions, religious beliefs, health and genetic data and criminal records.

Germany's Federal Data Protection Act allows for a special category of personal data processing "for reasons of public interest in the field of public health, such as protection against serious cross-border health risks".

State agency Robert Koch Institute is now discussing with tech companies how to best use digital data for contact tracing instead of relying on traditional methods such as asking travellers to fill out exit cards. But this new approach will work only if users voluntarily hand over their data.

Collecting personal information is a tall order in Germany as people are generally wary of sharing data, but reservations may diminish as the number of infections rises. Germany now has more than 3,600 cases.

Data collection could also prove challenging in the United States, which now has more than 2,000 infections, prompting President Donald Trump to declare a national emergency.

The Centres for Disease Control and Prevention (CDC) used to be the only one authorised to test for the virus and provide centralised data, mostly centred on the number of confirmed cases.

But as restrictions are loosened, testing is also being done at the state level, and local health departments have started releasing their own data, often giving the county, city or town the confirmed patient is from. The details are not enough to give away any identities.

As a result, there is no complete picture of how many people have been tested in the US, obscuring the extent of the disease's spread and its fatality rate.


At the other end of the spectrum is Singapore's tightly controlled data collection and contact tracing for a small population of 5.6 million. The Republic has reported 212 cases so far, half of whom have recovered.

Disease investigators work tirelessly with the police to map out a patient's travel history, using all kinds of resources, from surveillance footage to mobile phone data and ATM records. Information such as patients' age, gender, nationality, the street where they live, and the places they visited, are then released by the Health Ministry in a bid to curb the spread and keep the public safe.

The same level of intrusive data collection is also seen in China, where there are more than 80,000 cases of the coronavirus and over 3,000 deaths from it.

QR codes must be scanned before people can enter residential compounds, mobile phone apps record your daily temperature, while other apps show if there are cases nearby or if patients have been in close proximity.

Employees are also positioned at mall and subway entrances to ensure that shoppers and commuters register their personal details before entering, and cellphone users can ask for a list of their locations from telcos to help with contact tracing.

The authorities have said that these measures are in place because of the extraordinary situation. Still, some have expressed concern that the epidemic is an excuse to accelerate the collection of citizens' data in a country with lax data protection laws.

Over in Japan, the demand for coronavirus-related legislation has grown amid public unease over how adequate the government's actions have been to stem the outbreak.

Japan's lack of a "command centre" akin to America's CDC has been fingered as one of its shortfalls, and the Health Ministry has drawn flak for the alleged mishandling of the Diamond Princess cruise ship, which had nearly 700 infections on board as it docked off Yokohama.

Economy Minister Yasutoshi Nishimura has been appointed to take charge of laws related to the outbreak, and one of his key tasks is to strengthen public relations as the domestic infection tally crossed 700 cases, with 21 deaths.

The Hong Kong government, on the other hand, is trying to strengthen measures against a growing trend of cyber bullying and doxxing, where personal information is circulated for purposes of harassment. For instance, the online release of personal data of some medical staff and locations of almost 6,000 buildings set aside for home quarantine for returning Chinese residents triggered debate.

To tackle doxxing, the territory's government has proposed measures such as the setting up of an independent criminal investigation team and new rules to compel social media platforms to remove doxxed content.


Not all countries are on the same path though. At least India, Malaysia and Thailand appear to be holding up well and keeping patient information private.

Thai authorities are even reluctant to give non-identifiable basic details unless pressed by the media, while Malaysia keeps small cluster outbreak locations vague, mentioning only the states and cities.

No identities were leaked in India either, as the government revealed only where patients are from and their travel history.

Australia also keeps personal data of patients to a minimum, offering only the person's state of residence, where they had travelled to and if they had contact with a virus-hit country.

More details, such as age, gender and place of work or study, may surface during press conferences, but it has not led to privacy concerns and appears to have been viewed as necessary public health precautions.

Contrary to its reputation for being reserved, South Korea learnt the hard way during the Middle East respiratory syndrome outbreak in 2015 that withholding information, such as the patients' travel history, could incur public wrath. Laws were later amended to allow public sharing of such data.

But now, too much patient information is being shared and too quickly, law professor Lee Jae-min of Seoul National University told The Sunday Times.

"Right now, the government is simply trying to do as much as it can to find the sources of infection and the persons involved, so as to segregate them," he said. "That policy purpose is now suppressing any other legitimate concerns that would otherwise have been raised, such as privacy issues."

• Additional reporting by Arlina Arshad, Charissa Yong, Claire Huang, Hathai Techakitteranun, Jonathan Pearlman, Markus Ziener, Nadirah H. Rodzi, Nirmala Ganapathy, Raul Dancel, Tan Hui Yee and Walter Sim.

Source: Straits Times © Singapore Press Holdings Ltd. Permission required for reproduction.


Theme picker

Latest Headlines

Business Times / 08 Apr 2020

Bill passed to give temporary relief from contractual obligations

To claim relief, a contracting party must give notice to the other party, who is then prohibited from certain actions including commencing or continuing legal action, eviction due to non-payment of rent, or repossession of goods used for business.

No content

A problem occurred while loading content.

Previous Next

Terms Of UsePrivacy StatementCopyright 2020 by Singapore Academy of Law
Back To Top