What’s New?

Personal data privacy has been the subject of intense debate in recent years, with important progress made on the development of ethical guidelines for data collection and use. Now, COVID-19 will put these to the test. The use of individual data to diagnose illness, undertake contact tracing, and notify people of potential COVID-19 exposures may play an important role in the epidemiological response to the pandemic, as even staunch privacy advocates concede.

At the same time, there are worrisome signs that an individual’s personal COVID-19 status could be used to exclude them from fully participating in certain activities. Personal health data related to COVID-19 are already being used in some places to grant or deny access to workplaces, airports, hotels, and other venues, for example.

The use of personal health data by governments and businesses raises major questions regarding data privacy and ownership and may severely test the current spectrum of data privacy laws. The incentives to protect privacy are undermined when the countries with the largest volumes of accessible data are better positioned to contain the pandemic. Data privacy is in particular jeopardy where tracking is either mandatory or is required to fully participate in economic and social life. The longer these measures stay in place, the more likely they are to be normalized and the less likely they are to be rolled back once the public health emergency is over.

Signals of Change

Air travel security business Clear has launched a new service called HealthPass, which will deploy COVID-19 screening to manage people’s access to crowded public spaces, including airports, restaurants, hotels, retail stores, museums, and sports arenas. The screening is currently based on temperature checks and questionnaires, but Clear has indicated that it hopes to integrate individual health data into the process.

In China, the COVID-19 tracing app is mandatory and tied to one’s national ID. It is used to determine individual risk level and to determine access to do things such as travel or enter a market or shopping mall.

South Korea has deployed one of the most aggressive and successful contact tracing programs among democratic countries, using a combination of phone location data, CCTV footage, and electronic financial data to track confirmed coronavirus cases. This data is publicly available and has raised major concerns over privacy. The country also deployed a quarantine app that exposed private user information through a security flaw.

What Might This Mean for Business in the Coming Years?

Regulations on data privacy and protection in different jurisdictions are likely to change abruptly and become more divergent in the coming months and years. These will impact employees, consumers, and other stakeholders. Global businesses will need to become adept at anticipating, interpreting, and responding to these changes. At a minimum, business will likely have to contend with increasingly different data privacy and protection paradigms in China, Europe, and the U.S.

To navigate these challenges, businesses will need a comprehensive data privacy and protection policy that complies with the most stringent data privacy laws across operating countries and is consistent with international human rights norms and standards.

Growing anti-trust sentiment and the simmering “techlash” pose particular reputational risks for the technology and data-driven businesses that are creating the infrastructure and services used to enable greater health and security. These companies have not only a higher “duty of care” when it comes to protecting data and privacy, but they also have a significant opportunity to gain competitive advantage by proactively building human rights and social impacts considerations into the design and development of their products and services. "Human rights by design" is likely to become a key requirement for sustained leadership and success.

What Is the Role of Sustainability?

Sustainability, particularly the intersection of technology and human rights, will be core to managing these changes. The UN Guiding Principles on Business and Human Rights provide a framework by which to realize the promise of data—for evidence-based decision-making, epidemiological research, and other advances—while preventing and mitigating harms such as the suppression of political participation and freedom of expression or the inequitable distribution of economic and educational opportunities.

The sustainability agenda will need to support rights-based dialogues on evolving technologies that include new stakeholders, such as data brokers and vulnerable end users. New industry standards and regulations will be required, not only in the technology sector, but for all sectors that may provide or use data in new ways. International human rights standards will need to be integrated from the early stages of design of all new data and tracking products through to how the product is being used. The application of new technologies as well as their processes, including algorithms, will need to be audited and have enhanced transparency.

The sustainability agenda will also have to consider the impact of new technologies on existing inequalities and marginalized communities. In India, for example, the required usage of a contract tracing app has restricted movements for marginalized groups such as women whose husbands do not allow them to own a mobile phone. Lastly, adopting a futures approach when applying sustainability to data and technology applications can help foresee and prepare for developments—and their impacts on sustainability and human rights—that are likely to happen rapidly given the pace of technological change.