Contact tracing form variants trigger data privacy probe

MANILA, Philippines — Privacy officials are setting their sights on varying contact tracing forms establishments use to track down possible infections, but are now considered high risk for personal data misuse.

Reports have flooded the National Privacy Commission over the “mishandling” of contact tracing forms which people are required to fill up and sign whenever visiting a commercial establishment. A probe has been launched and hefty penalties of up to P5 million and imprisonment of up to 6 years await violators.

“The chief concerns were the improper use of logbooks and the lack of appropriate data-protection measures that left in the open filled-out contact-tracing forms that contain customers’ data, such as names, addresses and contact details, which other people could see,” the NPC said in a statement.

“Other concerns included using personal data for purposes besides contact tracing, absence of a privacy notice, and baseless retention period,” it added.

The government has prescribed a contact tracing form template for businesses, but fell short of requiring a uniform format and contents of the form. As a result, some establishments are requiring more personal information than others including birthdays which appear to be unnecessary to locate people if a coronavirus infection is recorded.

How these personal information are handled is important for NPC especially since they are typically used in other transactions such as accessing bank accounts. While providing no detail how to proceed with the investigation, NPC is examining complaints against “a mall, fast-food and drugstore chains and supermarkets” as well as a “European fast-fashion retailer and North American coffee shop franchisee.”

“Building trust is especially crucial now as we begin to open the economy gradually,” Privacy Commissioner Raymund Liboro was quoted as saying in a statement.

Last week, the national action task force, which coordinates and enforces policies concerning pandemic control, said the Philippines is moving to the third phase of its pandemic response plan, which essentially includes allowing more people to go out— a sign government is further loosening movement restrictions to revive an economy in recession.

With more people expected to flock retailers, which means more tracing forms getting filled out, Trade Secretary Ramon Lopez encouraged businesses to go paperless in contact tracing. 

His key suggestion, however, is for establishments to use StaySafe, the government’s official contact-tracing app heavily criticized for its supposedly weak data privacy features. Told about apprehensions against StaySafe, Lopez replied in a Viber message recently: “We will continue to promote StaySafe.”

Without a uniform fix for now, the privacy body advised business establishments to “devise a reasonable way” to gather data, including restricting information collection to the minimum necessary, imposing a limited period of storage for forms, ensuring their proper disposal thereafter and training employees about data privacy protocols.

“As you are in the best position to anticipate and manage risks based on your store setup, you should be able to identify points of possible risks for you to develop the security measures appropriate for your operations,” Olivia Khane Raza, privacy director, said.