Hong Kong’s harvesting of personal data in Covid-19 fight must be conducted in sunlight

Why is so much personal data required to activate the ‘one-stop personalised digital services platform’ Hongkongers are encouraged to use?
Clear rules must be drawn up, clarifying doubts about the government’s motive, and consent given before any information is collected

Peter Kammerer

Published: 6:45am, 4 May 2021

Why you can trust SCMP

My full name, Hong Kong identity card number, fingerprints and face scan – I’m protective of them all. Yet the government wants each one if I register to use its iAm Smart app, a so-called “one-stop personalised digital services platform” to enable convenient access of data and information.

I didn’t read the instructions closely enough before trying to install it, but the alarm bells rang at the facial recognition part. I bailed out when instructed to have my picture taken with mouth closed, then open.

By consenting to download the app, I would have been submitting my image to a database of records. Facial recognition software is in wide use in mainland China and increasingly by numerous other governments, police forces and at places like airports for surveillance. It identifies people by comparing images of their faces against those in a database.

There is no clear legal framework for its use; it assumes everyone is a criminal, denies us the ability to decide how our images are used and indicates authorities do not trust citizens. Its use isn’t about law and order; it’s about control.

00:59

China’s facial recognition technology identifies people wearing masks amid the Covid-19 epidemic

I had been trying to find a way to access my Covid-19 vaccination records and stumbled on a government website promoting the app. But I wasn’t anticipating that every bit of personal data I hold dear would be asked for. In simple language, this app is a violation of my privacy.

The government has been warning us for years about the need to protect our personal information. There have been hacks of the networks of some private companies and a marked increase in the number of online and phone scams. It has been telling us not to unthinkingly hand over personal information to strangers and be careful when using the internet and apps.

The government is no less a stranger to me than the person standing next to me on the subway; I would not allow that person to take pictures of my face in various poses and from different angles, nor will I accept the same from authorities.

That, in essence, is what the controversy over the government’s Leave Home Safe app has been about. Introduced on the claim that it would keep users safe by alerting them if restaurants they visited had had coronavirus cases, some people believe it was less about safety than being a tracking device for authorities. The government says the app’s information is stored on users’ phones and not sent to a database, but I’m not taking any chances.

Then there’s the government’s latest app offering, with the snappy name of QR Code Verification Scanner. This is the app that restaurants, bars, karaoke lounges and the like have to use to verify whether customers have had vaccine jabs. It requires the customer to show staff the QR code on the vaccination certificate, either digitally or on a hard copy.

01:52

‘Vaccine bubble’ allowing Hong Kong bars and party rooms to reopen leaves many confused

Mine is photocopied and taped to the back of my phone. It didn’t occur to me that anything was amiss until a work colleague pointed out that there is a miniature copy of the photo side of my ID card next to the code.

But that’s not all. If someone uses an ordinary QR code scanner rather than the government one, they can access more information. There’s the exact time of both my vaccinations and the type of vaccine I took.

Data means different things to different people; I don’t mind someone knowing this with my permission, but I have a problem about it being stored and accessed without my knowledge.

Hong Kong is striving to be a “smart city” and I have no problem with that. But the manner in which the government is going about it raises questions about its motives. There has to be transparency, better explaining, and consent. The laws that have been introduced need to ensure that our freedoms and privacy are not compromised or eroded.

Peter Kammerer is a senior writer at the Post