With the Songkran celebrations this year becoming subdued from the surging third wave of Covid-19 infections, deemed by health authorities as 10 times worse than last year's outbreak, efforts at controlling the spread of the virus are underway with contact tracing, health surveillance, compulsory quarantining, and lockdowns.
And of course, remedial efforts through vaccinations are progressing, albeit sluggishly.
Most of these measures are likely to involve the extensive collection and use of personal data -- medical and non-medical. However, little has been discussed about the need to protect personal data collected and used during the pandemic or the rights to data privacy of individual citizens, for that matter.
Despite the Personal Data Protection Act (PDPA) having been passed since May 27, 2019, the law is yet to be fully enforced. Most of the law's operational provisions, including provisions relating to the rights of a data subject, the obligations of a data controller and the penalties for non-compliance, were originally scheduled to come into effect on May 27, 2020. However, this timeline was postponed for another year due to complications from the Covid-19 pandemic.
The PDPA is now scheduled to come into full effect on June 1 this year and this will bring about significant changes to the regulation of data protection in Thailand, including the critical health scene of Covid-19 that exploits a great amount of personal data.
Notably, the new law adopts a broad definition of "personal data" (essentially, any information which directly or indirectly identifies an individual) while designating roles of relevant players as "data controller", "data processor", and "data subject".
It also implements internationally recognised data protection concepts such as consent of data subject, lawful collection, use and disclosure of personal information, privacy notice, security measures and notification of data breaches, among others. These concepts are entirely new to average Thai citizens who do not see data privacy as of inherent value.
Although Thailand has been praised for its success in handling the coronavirus epidemic by the World Health Organization (WHO), its comprehensive approach in containing the virus, even without a vaccine, is not flawless, particularly when it comes to the handling of personal data. Nevertheless, this has gone largely unnoticed because of the greater emergency of the pandemic.
Several types of data are collected and used during the spread of Covid in Thailand, manually and digitally. Contact-tracing apps have been prominent in the digital scheme while surveillance and paper-based contact tracing carried out by health practitioners and the so-called Village Health Volunteers (VHVs) have dominated the manual system.
To date, Thai Chana, has been the most pervasive national digital platform to facilitate disease-control tracking of individuals using public places and response to the spread of Covid-19. The platform, also available as a mobile app, provides users with QR codes for location self-check-in and check-out, at stores, public transportation, and restaurants nationwide.
Thai Chana was developed under the collaboration between Krung Thai Bank or KTB and the Digital Government Agency (DGA), an agency within the Ministry of Digital Economy and Society.
Thai Chana's official launch on May 28, 2020, marked the first date of lockdown lifting in Thailand when shops and shopping malls were allowed to reopen.
The platform collects the following personal data from average users -- phone number, place (visited), as well as check-in and check-out information (including the rating of the premise's hygiene). These data are retained for 60 days in compliance with the Communicable Diseases Act (2015).
Although Thai Chana clearly collects a significant amount of personal information from users, the platform/app's data protection/governance elements were slowly becoming.
The data governance working group for the platform, comprising experts in various areas, was appointed on May 22, 2020, one week after the soft launch on May 17, 2020. Similarly, the platform's privacy policy was retroactively introduced, after the working group had requested for it.
In addition, the Department of Disease Control, an evident data controller, responding to the working group's demand, later added a data protection officer to take charge of Thai Chana.
The platform's transparency and accountability were gradually improved as the working group alluded to relevant laws and regulatory frameworks such as the PDPA and the EU's Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the Covid-19 outbreak.
While national platforms like Thai Chana were monitored by the appointed data governance working group, there was little effort to ensure data protection at the provincial level where the Village Health Volunteers (VHVs) and provincial centres of Covid-19 situation administrations (provincial CCSAs) have been the main players in data collection and use.
At the same time that Thai Chana was introduced -- May 18, 2020, digital technology was also harnessed, with the aid of AIS, the country's major mobile operator, to create an online health surveillance application for VHVs nationwide.
Ordinarily, each VHV is assigned a number of households (about 15-20) to take care of. During the pandemic, the VHVs are assigned the task of screening for Covid infection cases or at-risk groups by knocking on every door under their supervision and reporting their inspection to their affiliated provincial hospital.
Previously, the VHVs would record their surveys on paper which meant that they would have to travel all the way to affiliated hospitals to submit their reports. But with the new digital platform, the data on the health condition of the surveyed households could be transmitted in real-time and accessed by designated users in the network. This data innovation was deemed to be a rapid, convenient and accurate way of dispatching reports and data sharing.
Currently, there are as many as 1.04 million VHVs in Thailand, about 300,000 of whom have adopted this online app and the number is believed to be growing. However, little has been discussed on how the personal data that are transmitted and flow freely via this app can warrant proper protection in accordance with PDPA framework, particularly in light of the ongoing panic and stigma associated with Covid.
As vaccination is slowly unfolding and taking time to prove its remedial effects, Covid could be a reality in our lives for months or years. Given this uncertainty, it is wise to start recognising privacy concerns and stepping up awareness about the protection of personal data during the pandemic control before it is too late.
This article is based on research conducted with financial support from the International Development Research Centre (IDRC).