As COVID-19 continues to spread throughout the country, the Peruvian government has implemented stronger policies and strategies that are aligned with measures that have proven to be effective around the world. These strategies now include the temporary collection and treatment of the population’s personal data, specifically, the geolocation data of those infected with COVID-19 as a way to track their movements and identify possible contagion hot spots. This article takes a look at the three most recent measures the government has implemented.
Implementation of call centers
The Peruvian government established two dedicated free emergency telephone numbers (113 and 107) to provide information and guidance regarding COVID-19. When calling these numbers, users provide their names, ID numbers, addresses and health information, along with other personal data that allows the call center operator to process the consults.
On April 17, President Martín Vizcarra and six of his ministries, including the Ministry of Health and Ministry of Justice and Human Rights (to which the National Authority of Protection of Personal Data is ascribed), approved Supreme Decree No. 070-2020-PCM, which contains provisions on the treatment of a caller’s personal data.
Under the decree, the caller’s personal data is shared with the entities that administer the call centers to verify the identity (with the help of the National Registry of Identification and Civil Status). The data is then anonymized and shared with the National Platform for State Interoperability for use by the authorities to monitor the spread of the novel coronavirus.
It also establishes that all calls made to the call centers, by either landline or mobile device, will be recorded, subject to geolocation data collection. For purposes strictly limited to the identification and monitoring of suspected or confirmed COVID-19 cases, the caller will need to provide the location or the geolocation of their device for the three days before the call was made to the emergency number.
SMS/USSD messaging services
The decree also regulates the treatment of the personal data of those who complete. Telecommunication providers send text messages on a weekly basis to their customers to promote the completion of a digital triage/questionnaire created by the government to identify suspected cases of COVID-19. The decree also regulates the treatment of the personal data of those who complete the questionnaire.
Under the decree, the Ministry of Health and the Social Health Insurance can access a user's personal data for the purposes of adopting the appropriate sanitary measures. It also establishes that the Digital Government Secretariat, an entity that reports to the Presidency of the Council of Ministers, can access the anonymized data to fulfill its functions listed in the government’s framework to fight the epidemic.
On the other hand, while the concessionaires of public telecommunications services are obliged to provide the above-mentioned authorities with access to the information required, they are not permitted to share the content of outgoing and incoming calls or SMS text messages under any circumstances.
The audit of compliance with these obligations is in charge of the Agency Supervisor of the Private Investment in Telecommunications.
Launch of contact tracing app
The mobile app Perú en tus manos was launched April 3 with three functionalities: digital triage, mapping and alert. Digital triage enables citizens to carry out a self-assessment as to determine if they might have contracted COVID-19. It includes a short questionnaire, followed by guidance on the next steps to take. The map functionality shows anonymized data (yellow/orange circles) of the areas with the highest percentage of people that have reported having one or more symptoms (they do not necessarily have COVID-19). The alert functionality notifies the user of high-risk areas and if they might have been exposed to the virus.
The app collects the personal data of users at the time of registration and throughout its use, including their type and number of ID, telephone number, geolocation data and health data (symptoms, medical history, diagnosis). It also asks for access to the GPS and Bluetooth of the device to enable optimal performance.
According to the app’s privacy policy, the data collection is necessary to provide the user with COVID-19 information on symptoms and/or prevention measures. If the user suspects they have COVID-19, they will receive guidance and instructions to go to the nearest health unit. The policy also states the data collection is needed to keep a record for statistical, historical, scientific and profiling purposes, as well as to reply to any questions, comments, queries and observations.
The current version of this app indicates that the data will be used by the Ministry of Health or transferred to other authorities (not specified) and will be kept for the duration of the state of emergency.
It should be noted that the mobile app is the only one that requires the express consent of the data owners for the treatment of their personal data. The consent is given by the user when they accept the privacy policy and can be revoked at any time. Furthermore, users can exercise their rights of access, rectification, cancellation and opposition with a simple request sent to the email indicated in said policies.
In the case of the SMS messaging services and call centers, their regulation invokes the application of the limitations on the consent for the processing of personal data contained in Article 14 of the Personal Data Protection Law. It justifies the temporary treatment of personal data that enables the mapping of suspected or confirmed cases of COVID-19 nationwide, and its direct access by the entities involved with the attention of this emergency to assist in monitoring and limiting the further spread of the disease.
All collected data will be immediately deleted at the end of the State of National Emergency and will not be used for any purposes other than the ones indicated. Likewise, it is guaranteed that the organizations and entities that have access to said information have adopted the corresponding technical, organizational and legal measures to safeguard the confidentiality, integrity and availability of the data until its deletion.
Furthermore, Supreme Decree No. 070-2020-PCM guarantees that the personnel who have access to the data are obliged to maintain confidentiality and could be liable in the case of a breach. Finally, it establishes that the National Data Protection Authority accompanies, supervises and controls correct treatment of personal data, while the SGD accompanies, supervises and controls the correct use and operation of digital technologies in the deployment of data analytics, artificial intelligence, predictive use, data processing and collection, creation of digital services, and implementation of platforms and applications for digital interactions with citizens.
Last, but not least, it’s also important to mention the recent issuance of Supreme Decree No 068-2020-PCM, by which the Peruvian government created the multisectoral Working Group called "Te cuido Perú," led by the Ministry of Defense. It aims to provide monitoring and assistance to the people infected with COVID-19 who, with the approval of the health authorities, are strictly confined in their homes until their medical discharge. This group will have a digital platform for the geolocation of both the infected people and those that live with them who are in social isolation, as well as other instruments that will allow their clinical follow-up, surveillance and monitoring, among other measures. Shortly after the Working Group was created, the Ministry of Defense announced the conformation and functions of the group through Ministerial Resolution No. 281-DE/SG.
Specific regulations on the treatment of the personal data collected by the Working Group have not yet been issued.
It is undeniable that the efforts made by the Peruvian government have been expeditious and critical in helping to slow the advance of COVID-19. But these rapid developments have also exposed the fact that the full scope of how the data is being used has not yet been made clear. Further information is needed to understand the impact of these regulations on balancing public safety with personal privacy.
Photo by NESA by Makers on Unsplash
