Coronavirus: tracking function for Hong Kong’s ‘Leave Home Safe’ app would not be illegal, privacy chief tells lawmakers

Adding a tracking function to Hong Kong’s “Leave Home Safe” Covid-19 contact-tracing app would not violate data protection laws, the city’s privacy commissioner said on Thursday, under questioning from lawmakers pressing for the inclusion of such a feature amid a surge in coronavirus cases.

Privacy Commissioner for Personal Data Ada Chung Lai-ling said the existing law did not preclude an operator from incorporating a tracking function into a mobile application, citing social media apps as an example.

The city’s Personal Data (Privacy) Ordinance also contained an explicit exemption for health-related scenarios, she added during a virtual meeting of the Legislative Council’s constitutional affairs panel.

Hong Kong’s fifth wave ‘could peak at 28,000 Covid cases a day by end of March’

The “Leave Home Safe” app was introduced by authorities in late 2020, and has since been made mandatory when entering a growing list of premises, including restaurants and government facilities.

The app requires users to scan a QR code upon entering a venue, then sends notifications if they are found to have potentially been exposed to a coronavirus patient who visited the same place. All data collected is stored on users’ phones, and widespread privacy concerns have led the government to repeatedly stress that the current version does not have a tracking function.

However, health authorities have recently said they are reviewing the need to add such a feature amid a record-smashing surge in Covid-19 cases.

Speaking at Thursday’s meeting, which came a day after Hong Kong recorded more than 1,000 new cases for the first time, Secretary for Constitutional and Mainland Affairs Erick Tsang Kwok-wai acknowledged residents’ worries, but also asked for their cooperation – without saying definitively whether a tracking feature was in the works.

“I want to stress that the pandemic is at a critical juncture,” he said, adding the government would “strike a balance and proceed on the basis that we have to prevail in this pandemic”.

Calls for the additional function were made on Thursday by lawmakers Lai Tung-kok, a former security minister, and Carmen Kan Wai-mun, a lawyer by profession, who is also a member of the advisory committee for the Office of the Privacy Commissioner for Personal Data.

In response, privacy chief Chung said some social media apps also had tracking functions, but allowed users to opt out.

She said the city’s privacy law did not bar tracking functions but required operators to tell users what information was being collected and why, as well as who had access to it. The data collection should not go beyond the stated purpose, she noted.

“If [the authorities] have informed the individuals, it should not pose a problem,” Chung said of the potential tracking feature.

She also cited Section 59 of the law, which states that protections on data pertaining to one’s identity and location would be overridden if the situation concerned “serious harm to the physical or mental health of the data subject or another individual”.

Kan, the legislator, said the public needed to know that the rights to life and health should always come first.

“People need to hear this principle out loud. This is what we have to do as governors,” she said.

Hong Kong confirms 1,161 Covid-19 cases and first deaths in roughly six months

In a statement, Secretary for Innovation and Technology Alfred Sit Wing-hang said the “Leave Home Safe” app had notified more than 430,000 people to undergo mandatory testing so far, and had turned up 62 confirmed coronavirus cases.

A recently updated version allows users to input their vaccination records so premises that require proof of inoculation for entry can easily scan them.

Sit said the scanning was encrypted to ensure business operators would not be able to access users’ details.