Issues of privacy should be as transparent as possible so that people who decide to use the application understand what they are getting themselves into, writes POTLAKO BOGATSU
In an effort to combat the new Coronavirus, the Government of Botswana has rolled out a new application for use to track people’s movement and fast track contact tracing of individuals. But like with all applications, people will always question how safe their information is.
Issues of privacy are embedded in almost all platforms where users have to include their information online. With confirmation of the Indonesian database of COVID-19 contact tracing app being hacked, it is pivotal to understand and fully grasp issues of privacy when it comes to any electronic application, and in this case our very own Bsafe app.
Senwelo Modise, a certified information privacy professional who is a practicing attorney, says there is no guarantee that a user’s private information will not be sold to a third party. Selling of data collected is repurposing it in the same was as using it for research is.
So far, the COVID-19 Task Force has just said the application complies with the legal framework that protects a user’s right to privacy. Section 28 of the Data Protection Act states that the data controller or processor shall, where personal data is obtained directly from the data subject, provide the following information to the data subject, except where the data subject already has the information-
The identity and habitual residence or principal place of business of the data collector or data processor.
The purpose of the processing for which the personal data is intended.
The existence of the right to object to the intended processing, if the processing of the personal data is obtained for purposes of direct marketing.
Taking into account the specific circumstances in which the data is processed, any other additional information, if the information is necessary to ensure fair processing to ensure fair processing for the data subject, which information may include-
The recipient or category of the recipients of data.
Whether the reply to any question made to any subject is obligatory or voluntary, as well as the possible consequences of failure to reply, and
The existence of the right to access, rectify and where applicable, the right to delete the data concerning him or her; or
Any other information necessary for the specific nature of the processing, to guarantee fair processing in respect of the data subject.
In layman terms, law act wants the application, in this case the BSafe app, to let it users know where its offices are, what they will do with their data and gives users the opportunity to object to the selling of their own personal data. The application rolled out by the COVID-19 task force does not do that.
The World Health Organisation has Guidelines on Information Technology for contact tracing under Data Protection. Some of them are that safeguards must be in place to guarantee privacy and data protection in accordance with the legal frameworks of the countries where systems are implemented.
Everyone involved in contact tracing must adhere to the ethical principles of handling personal information to ensure responsible data management and respect for privacy throughout the process. But how data will be handled, stored and used needs to be communicated to those concerned in a clear and transparent manner. This is important for buy-in and engagement, as well as to avoid misperceptions that could jeopardise the effectiveness of a contact tracing programme.
However, these guidelines seem to have not been applied by the BSafe app, leaving questions of uncertainty on the application’s intention beyond contact tracing. Modise says the COVID-19 Task Force has not let the public know what security safeguards there are. In this way their approach was different from the world over where contact tracing apps were assessed by anyone who cared to before they launched and the technologies used on them are open to the public.
It should be understood that it is very important for contact tracing to be done in the fight against this virus. But issues of privacy should be as transparent as possible so that people who decide to use the application can understand what they are getting themselves into.