The second half of the health code, from epidemic prevention and control to abuse crisis
arts/
At present, the incident of inexplicably assigned red codes to Henan Bank depositors is still fermenting, and behind the red codes assigned to bank depositors, the risk of abuse of health codes has been further highlighted.
People used to believe that the health code was only a temporary plan. Now, two years later, not only has the health code not withdrawn, but it has ushered in the second half of the more closely connected with people's lives, and has gone further on the basis of normalization. In many cities, the health code has been technically connected with the QR code for rides. If a person's health code turns red, yellow, or has a pop-up window, he will be unable to ride the car, buy food, visit public places, and be unable to Returning to the situation where it was impossible to go back to where you lived.
When the health code is highly related to people's lives, it means that the health code has more power to manipulate people's lives. Just as the Henan depositors were given a red code this time - this kind of epidemic prevention code that accurately records personal information such as personal itinerary, as an expedient measure during the epidemic period, there is a great risk of being abused. How to understand the privacy protection of health codes in the context of epidemic prevention and control, and how to ensure the validity and legitimacy of health codes have become new problems that need to be solved urgently in the post-epidemic prevention and control era.
The benefits and costs of health codes
Let’s look back at this inexplicable red code incident.
First, after the thunderstorm at Henan Rural Bank, the depositors who were victims wanted to go to Henan to recover their deposits or seek help from the local regulatory authorities. During this process, many depositors found themselves without access to high-risk areas of the epidemic. , the health code turns red. Even some depositors did not step into Henan, and inexplicably "liked the red code" in other places.
When the whole incident is reviewed, it can be said that it is both clear and confusing. The clear part is that the people who have been given red codes by Henan are basically the depositors of this village bank thunderstorm incident, which seems to have nothing to do with everyone's action trajectory; and what makes people feel confusing is that no one knows this red code. Who added the code to the depositors, and how was it added to the depositors - Henan Health and Health Commission pushed it to the city-level Big Data Administration, and the Big Data Administration pushed it to Zhengzhou Epidemic Prevention and Control The control headquarters and the epidemic prevention and control headquarters are also unclear.
And all the disputes have to start from the health code . The birth of the health code was originally a stopgap measure in the context of the COVID-19 pandemic. During the rapid spread of the epidemic, for the purpose of public epidemic prevention, in order to save the cumbersome procedures of declaration and verification of personal whereabouts and other information, the health code came into being.
On the one hand, the health code will record personal travel, such as whether you have been to other places and whether you have passed through the epidemic area; on the other hand, the health code will record whether the individual has had interpersonal contact with other confirmed or suspected persons. From the perspective of its operation principle, the so-called health code is actually an epidemic prevention code that can accurately record the whereabouts of a person, which reflects a person's infection risk and has nothing to do with health.
In fact, in addition to health codes, during this global public health crisis, countries have begun to adopt digital means to monitor the transmission chain of the COVID-19 virus .
For example, in the early days of the outbreak, the South Korean government, also in East Asia, tracked everyone’s cell phone location information and created a public map that allowed anyone to check if they had coincidental paths with any coronavirus patients. Tracking data in maps is not limited to cell phone data and credit card records, and even face-to-face interviews with patients can be used to map activity tracks. The South Korean government has also used the data collected to proactively push regional text messages warning recipients that they may have come into contact with someone with the virus.
The European Union announced that mobile operators in the region will share customer location data with the European Commission to monitor the spread of the coronavirus. In addition, the US media also disclosed that the relevant US government agencies have obtained the location data of millions of smartphones and mobile devices across the country. Unlike in Europe, however, U.S. agencies obtain location data through mobile ad trackers, rather than relying on mobile operator cell tower locations.
It is undeniable that the development of digital technology will bring greater well-being to mankind. The health code stores data in the cloud, so that all residents' health information, travel information and personal identity information are bound, stored and shared in the cloud, saving the trouble of setting up checkpoints by local authorities and repeatedly filling out health forms. As a digital passport, the health code can realize one-code access in the whole city or even the whole country, bringing convenience to epidemic prevention and control .
It can be said that during the epidemic, it is necessary and timely to choose digital technology to carry out stricter prevention and control of the epidemic. The emergence and application of health codes depend on the upgrade of ubiquitous big data technology, which is more than ten years old. The anti-epidemic weapon that we did not have during the SARS period a few years ago. But you know, all this is not without a price.
The second half of the health code
As mentioned earlier, health codes are data-driven products. From the collection of personal data to data access, from the sharing of various data to data analysis, from government data decision-making to the supervision and implementation of various places, the health code is built on the data, and then carefully designed and embedded into the epidemic prevention and control. in the process.
According to the State Council's "Notice on Scientific and Accurate Prevention and Control of the COVID-19 Pneumonia Epidemic" issued by the State Council on February 25, 2020, the health code has become a statutory certificate for administrative agencies to comprehensively judge the level of personal health risk and obtain travel and resumption qualifications. From this aspect, the health code confirms the insight of American jurist Lessig - "code is law".
But you must know that the health code is based on the premise that the people have surrendered their personal privacy rights for the overall situation of epidemic prevention. This is the basis for the establishment of the health code , which also makes the health code a relatively special "superposition of data power and administrative power." ", which is why people have been very vigilant about the application of health codes.
At present, with the continuous integration of health codes and people's lives, the challenges brought by health codes are becoming more and more prominent. This scene in Henan now proves that people's worries are not unfounded .
On the one hand, data is the soul of the health code. Without credible data, there is no credible health code. The so-called "garbage in, garbage out". How to prevent a few people from uploading false information institutionally and technically is the top priority of the health code. Although the reason why the current Henan savers are inexplicably assigned the bomb code is still unknown, the potential risk of exposing health code data errors should not be underestimated - and if the health code has been abused for purposes other than epidemic prevention, this will not only make The local government's anti-epidemic policy seems to be unbelievable, and it also violates the Personal Information Protection Law. To some extent, it is an abuse of administrative power.
On the other hand, with regard to the confidentiality, integrity, and availability of data, both government departments and third parties that open health codes have the obligation to secure data, and must take relevant security measures such as encrypted storage, encrypted transmission, and access control. After all, although big data ensures the smooth flow of information during the epidemic, realizes information exchange, and achieves transparency of personal information, it also brings the risk of private information exposure.
It is predicted that by 2025, 87% of data will be data in need of protection. However, the reality is that more than half of the data is not properly protected. In recent years , there have been frequent incidents of privacy leakage. We cannot be sure that when the health code has a broader meaning, the information covered by the health code is protected . What's more, under the circumstance that the big data personal privacy protection law is seriously lagging behind, who will be responsible for the various troubles and risks brought to individuals in the later stage due to the multi-platform, non-standard storage and circulation of such personal privacy data?
As the initiator and user of the health code, the government department determines the type, content, use method, and purpose of data collection in the "health code" application, and should undertake a series of obligations of data collectors and data controllers. At the same time, technology companies are data processors that are entrusted by the government to store, process, and analyze data. They should use data in strict accordance with relevant agreements and legal regulations, follow government instructions, and must not violate the entrustment requirements. Backup, secondary use, or provide to third parties .
Concerns about the abuse of health codes
Facts have proved that the health code is by no means a simple "management measure". During the epidemic, the health code has been gradually upgraded from the initial epidemic prevention function to the combination with the electronic health card and the electronic social security card. It is even foreseeable that the health code will not disappear with the disappearance of the epidemic, and the health code will survive and gain wider application through the epidemic.
To a certain extent, once the health code is activated, it is difficult to completely close it, because the migration of human society to the digital world is constantly progressing and deepening. It is almost impossible to go back to the previous state. Based on this, what we need to do may be to get used to coexisting with it, and let it accept the necessary constraints and controls, so as to dispel the public's concerns about the possibility of its abuse .
Therefore, government departments should disclose the data and calculation logic used by health codes to the public as much as possible, and more importantly, should give the public the right to object and obtain reasonable explanations .
For example, in March 2020, the European Union Data Privacy Commission issued a statement giving a clear explanation of the General Data Protection Regulation’s protection of personal data during the epidemic: only in the case of anonymity or with the consent of the individual, the operating agency (such as telecommunications operators or Internet companies) to use the user's location data. Public authorities should first target anonymized processing of location data (processing aggregated data in a way that cannot be converted into personal data).
Especially the data used in the health code involves name, gender, date of birth, nationality, ID number, phone number, place of residence, home address, travel mode, track, license plate number, precise positioning information, health status, personal occupation In the case of a large amount of personal information such as data, communication records, medical treatment information, etc., personal data protection rules are even more important.
As the EU Data Protection Commission stated in its Official Statement on the Processing of Personal Data During the COVID-19 Outbreak: “ Personal data protection rules do not prevent measures taken against the pandemic. The fight against infectious diseases is a common and should therefore be supported in the best possible way .” The choice between personal data protection and saving lives is not an either-or choice, but a trade-off.
In addition, the health code rule is an "extraordinary rule" for regulating emergencies. It has the inherent authorizing, preventive, necessary, and temporary characteristics of emergency laws. Once the epidemic prevention and control changes from acute and extraordinary to normal, the relevant governance rules Even the survival and disuse of the health code needs to be re-evaluated .
Furthermore, "when the state looks at social images through the eyes of technology, it may see its own reflection". Just like the inexplicable red code for savers in Henan this time, the fragmentation of different places, the closed system that prioritizes control, and the symbiosis of government and enterprise interests may all enter the health code under the shell of technology. To this end, more diverse values such as "public safety, individual rights, and market competition" should be consciously injected into the design of health codes, and the government and enterprises should be urged to use this technology responsibly to safeguard citizens' personal dignity and personal freedom. .
Technology is not neutral, it is always shaped by the social, economic and political environment in which it lives, and reflects the power exercise and value goals of designers and users. The health code is no exception. Its electronic, data-based and intelligent features do not obscure the original administrative behavior attributes.
After all, although the update of technology means the further expansion of many industry boundaries, scene boundaries and industry boundaries, we cannot but ignore the accompanying crises while embracing technology. Will the risk of personal privacy exposure be further aggravated? How does social regulation define the management boundary of data? Although the health code is small, it contains infinite potential for change. How to realize the potential of the health code requires more thinking.