Data for evidence-based decision-making in crisis
In complex, dynamic conditions, such as the outbreak of a pandemic, policymakers need to make many swift decisions in a context of considerable uncertainty and urgency. In managing large-scale, multidisciplinary challenges to the health, economy, and sustainability of society, it is critical that appropriate evidence is available for effective decision-making. Among various kinds of evidence that policymakers can use, models play a crucial role in tackling infectious diseases. Covid-19 has illustrated the benefits as well as pitfalls of utilizing models in decision-making. For example, governments across the world have widely used susceptible, exposed, infectious, removed (SEIR) models to predict the spread of the disease.1Neil M. Ferguson et al., Report 9: Impact of Non-Pharmaceutical Interventions (NPIs) to Reduce COVID-19 Mortality and Healthcare Demand (Imperial College COVID-19 Response Team, Imperial College, London, March 16, 2020). SEIR models, however, demand rigid assumptions that would be difficult to verify during a pandemic, such as reproduction rate and mortality. Different types of models are suitable for dealing with the varying dimensions of a pandemic, producing a wide range of projections that would not necessarily be easy to reconcile. Models critically depend on assumptions, uncertainty, and sensitivity and require significant data.2Andrea Saltelli et al., “Five Ways to Ensure that Models Serve Society: A Manifesto,” Nature 582 (June 25, 2020): 482–484. A small variation in the basic reproduction number, for example, can produce significantly different predictions, ranging from eventual phase-out to an explosion of infection. A prediction that more than 400,000 people could die in Japan if no countermeasures were taken to prevent further infection was criticized for assuming an excessive value for the basic reproduction number in the model.3Hiroshi Nishiura and Hiroto Kawabata, Riron Ekigakusha Nishiura Hiroshi no Chosen: Shingata Korona kara Inochi wo Mamore [The challenge for epidemiologist Nishiura Hiroshi: Save lives from COVID-19] (Tokyo: Chuo Koron Shinsha, 2020).
Data provides essential input to modeling exercises especially in emergencies. Data on the extent of infection among the population is indispensable for understanding the current situation accurately and forming reliable predictions about the spread of the disease. The movement of people can be traced efficiently by using large amounts of data gathered from mobile phones and sensors installed across cities. This makes it possible to identify and isolate those who are infected or likely to get infected more precisely, which could help to avoid a full-scale lockdown. Data on the supplies of personal protective materials and medical devices—such as masks and ventilators, respectively—provide valuable information for developing and executing plans to distribute critical resources to the locations where there are urgent demands. Socioeconomic data are also crucial in estimating the damages on business and economic activities through economic models. To assess the state of the economy and the effects of potential policy interventions, such models require detailed data on the operating conditions of workplaces involved in the supply chains as well as the sentiments on consumer spending and corporate investment. Whether these types of data are readily available from the relevant sectors and organizations is vital in emergencies. Having the necessary data accessible when needed requires establishing a robust and reliable system of data governance that facilitates the collection, sharing, and use of data for public purposes.
Employing personal data to tackle Covid-19 in East Asia
Various types of data relevant to tackling the pandemic can be categorized into four groups. Nonpersonal data includes environmental and geographical data and data about things that do not involve humans. This kind of data is essential to identify the places where the risk of spreading the virus is exceptionally high (in buildings, for example). Aggregate data concerns people in the aggregate—not focused on a particular individual—and includes the number of people who have been infected in a specific city at a specific time. De-identified or anonymized data is about an individual who was identifiable when data was collected but has subsequently been made nonidentifiable and includes data about the location and movements of a particular person stored in mobile phones or sensors/cameras on the street. Personal data includes any information that can be used to identify an individual or that is associated with an identifiable individual and includes data about a particular person’s health.
Personal data plays a particularly important role in tackling the pandemic. Incorporating data about the location and conditions of people allows for the creation of very sophisticated models, which makes it possible to isolate those who are infected or likely to get infected and identify those with high health risks. It is also important to collect sample data to examine the extent to which the virus has already spread by analyzing antibodies in the blood, which requires volunteers who are willing to provide individual samples. There are serious concerns, however, about privacy and security among the general public. Personal data is normally subject to legal protection with limitations and restrictions on its access and use, and it is not necessarily possible or easy for policymakers to deploy personal data.“The Covid-19 pandemic has provided a rare opportunity to experiment with a variety of approaches to utilizing personal data for public health in East Asia.”
The Covid-19 pandemic has provided a rare opportunity to experiment with a variety of approaches to utilizing personal data for public health in East Asia. In China, health code mobile phone apps have been introduced that use a person’s travel history and real-time location for central algorithms to quickly decide whether an individual can freely move or needs to be quarantined by assigning different color codes. In South Korea, patients and people whom they might have contacted are traced through their locational data via mobile phones, surveillance cameras, and credit card use, as Myungji Yang discusses. The location of people in quarantine is identified through GPS data in Taiwan. In Hong Kong, those who were in home quarantine are required to wear wristbands so that their locational data can be strictly monitored. The GIS-based dashboard developed by the Hong Kong government provides detailed online information about all the infection cases, including the age and sex of each patient and their home address.4Veronica Qin Ting Li and Masaru Yarime, “Increasing Resilience toward COVID-19 via Risk Mapping: Challenges and Opportunities for Stakeholder Empowerment in Hong Kong,” (working paper, Data for Policy 2020 Conference, September 15–17, 2020). In Singapore, a mobile app, TraceTogether, is used for individuals’ contact recording via Bluetooth in the phone. Wearable devices for contact tracing have also been distributed to vulnerable seniors who might not use mobile phones. The data collected through the app and devices are centrally managed by the government. Although they are not mandatory, about 65 percent of the population were using them by the middle of December 2020.5→Daniel Moss, “Singapore’s Covid Success Isn’t Easily Replicated,” Bloomberg, January 3, 2021.
→Government of Singapore, “Moving into Phase 3 of Re-Opening on 28 Dec 2020,” gov.sg, December 14, 2020. People are also asked to check in the SafeEntry system when they visit public places, such as supermarkets and restaurants. On the other hand, criticisms were raised when the Singapore government admitted that the data collected for contact tracing could also be used by police for criminal investigation.6Tham Yuen-C, “Police Can Access TraceTogether Data Only through Person Involved in Criminal Probe: Vivian Balakrishnan,” The Straits Times, January 5, 2021. Nevertheless, these experiences have shown that personal data can be deployed effectively to combat the pandemic. While the number of confirmed cases per one million people was 66,335 for the United Kingdom and 100,495 for the United States as of May 31, 2021, it was kept at a relatively low level in East Asia—63 for China, 2,746 for South Korea, and 10,606 for Singapore.7Max Roser, Hannah Ritchie, Esteban Ortiz-Ospina, and Joe Hasell, “Coronavirus (COVID-19) Cases,” Our World Data, accessed on June 1, 2021.
In Japan, the use of personal data has been minimal in combating the Covid-19 pandemic, compared with its neighbors in the region. As discussed by Haruka Sakamoto, it is legally difficult to use GPS data or credit card histories to track infected people because of privacy considerations. Although the government has introduced a Bluetooth-based app, COCOA, designed to notify people if they have been near someone who has tested positive, the application does not record data that can be used to identify individuals, such as phone numbers or location. Data on potential contacts are stored in phones only for 14 days and are deleted afterward, giving significant consideration to the protection of people’s privacy. On the other hand, by October 2020, only 15 percent of the population had installed the application, much lower than initially expected. Furthermore, there are many patients who do not input their infection data, and the number of registered cases has been considerably lower than the actual cases, diminishing the app’s effectiveness.8Kyoto Asai, “Shingata Korona Uirusu Sesshoku Kakunin Apuri COCOA” (COVID-19 Contact Verification Application COCOA), Nikkei BP Government Technology, November 12, 2020. As of June 2021, with a state of emergency declared, Japan is still struggling to contain the spread of the virus.
Establishing robust and reliable data governance
The experiences in East Asia have exposed the significant potential as well as serious challenges in utilizing personal data for tackling the Covid-19 pandemic. The global nature of the crisis requires states to strengthen their joint efforts by coordinating the use of personal data across borders. Vaccination rates have been increasing in many industrialized countries, and there is a growing expectation that soon borders will be able to reopen. To achieve this, governments need to establish an interoperable system to recognize data that verify the result of antigen or antibody testing and the status of vaccination across jurisdictions. An immediate test for international coordination is whether we will be able to agree on a common protocol to properly manage the personal data of travelers, as various types of digital vaccine passports are currently under development. While these vaccine passports will promote freedom of movement and create economic opportunities for some people, there are legitimate concerns about privacy, equality, and discrimination. It is indispensable to properly manage the use of personal data while providing adequate protection of privacy and security.“While a range of lawful mechanisms are provided to transfer personal data in some countries, local data sovereignty measures have been imposed in others.”
Governance for cross-border data transfer is particularly a difficult challenge in East Asia, as personal data are dealt with in different ways depending on varying institutional contexts. For example, Hong Kong’s Personal Data (Privacy) Ordinance, a comprehensive data protection law applicable to both the private and the public sectors, has a section about a general prohibition of personal data transfers to places outside the city. It has not come into effect, however, as some difficulties were identified for businesses, especially small- and medium-sized enterprises. Currently, there is no clear rule in place to regulate cross-border data transfer outside Hong Kong, including to mainland China, which is creating a significant degree of ambiguities and concerns among the general public.9Masaru Yarime, “Governing Data-driven Innovation for Sustainability: Opportunities and Challenges of Regulatory Sandboxes for Smart Cities,” in Artificial Intelligence for Social Good (United Nations Economic and Social Commission for Asia and the Pacific (ESCAP), Association of Pacific Rim Universities (APRU), and Google 2020), 180–202. In the Association of Southeast Asian Nations (ASEAN), the Framework on Digital Data Governance has been introduced with an aim to enhance data management, facilitate harmonization of data regulations among the member states, and promote intraregional data flows. There still remains significant variation, however, in the requirements for how to treat personal data. While a range of lawful mechanisms are provided to transfer personal data in some countries, local data sovereignty measures have been imposed in others.
The Covid-19 pandemic has brought forward a critical challenge for utilizing personal data effectively for societal benefits, such as infection control, carbon neutrality, and natural disaster resilience, while minimizing risks to the public. As an increasing amount of data becomes widely available, a key question when considering data governance is how and to what extent government can access personal data held by the private sector.10OECD, “Government Access to Personal Data Held by the Private Sector: Statement by the OECD Committee on Digital Economy Policy,” accessed on June 1, 2021. Government agencies need to clarify what type of data is necessary for what objective, meet the conditions required for data access and sharing, and respect the restrictions imposed on the use of data. It is also necessary to consider the interest of private enterprises possessing data that would be useful for public purposes so that proper incentives could be provided to share the information with other stakeholders. Data sharing and exchange can be facilitated with various approaches, including data markets, trusts, commons, and cooperatives, each of which has its own advantages and disadvantages. Transparency and consistency in legal bases and regulatory measures will strengthen the confidence of relevant stakeholders, facilitating open data flows and exchanges across borders. Sharing good practices would help to articulate common principles and harmonized standards among different jurisdictions. It will be of utmost importance to maintain public trust in institutions when establishing robust and reliable data governance for the social good.