An international rights group has raised the alarm on the Cambodian government’s “Stop COVID-19” QR Code system, saying it raises serious privacy and other human rights concerns.
On Feb. 20, Cambodia’s Ministry of Post and Telecommunications and Ministry of Health initiated a QR Code system which is meant to assist with contact tracing of new COVID-19 cases which have been rising in the country following an outbreak of the disease in late February.
But Human Rights Watch has said the system lacks privacy protections for personal data and called on the authorities to use less-rights-intrusive measures to contain and prevent the spread of the virus.
“Cambodia’s QR Code system is ripe for rights abuses because it lacks privacy protections for personal data,” said Phil Robertson, deputy Asia director for HRW.
“These concerns are heightened by the government’s stepped-up online surveillance of Cambodians since the outset of the pandemic, putting government critics and activists at greater risk,” he said.
In a statement the rights group also called on the ministries to publicly explain how the data collected through the QR Code system is used, who has access to the data and for what purpose, the measures taken to secure the data, and the period for which the data is stored.
The Post and Telecommunication Ministry’s Facebook page contains posts that state that the use of the QR Code system is “voluntary,” but “participation is strongly encouraged.” It asks users to scan the QR code when entering establishments or institutions that have previously registered their participation in the QR Code system and downloaded and printed a QR Code from the government’s website.
When a user indicates they have entered a certain establishment, their phone receives a six-digit code in a text message, which they need to enter into their phone.
On March 25, a post on the ministry’s Facebook page announced that 154,869 public and private institutions around the country had registered to use the QR Code system, with more than 11 million locations scanned by users. Several provincial authorities are using the system at provincial border crossing-points as part of mandatory screening for COVID-19 symptoms.
HRW said that the Post and Telecommunications Ministry did not respond to a March 19 letter it had sent which asked about access to personal data and its storage and protection measures under the “Stop COVID-19” QR Code system. Other ministries copied on the letter also did not respond, the rights group said.
The country’s Health Minister Mam Bunheng has stated that the aim of the QR Code system is to record the movements of customers, visitors, and staff at registered locations without violating users’ privacy.
However, HRW pointed out that on March 8, the Post and Telecommunications Ministry announced that the QR Code scan would provide the government with information about the user’s location, allowing the authorities not only to quickly identify the user, but also reveal data on whether they were violating the two-week quarantine requirement.
The rights group said that creating a log of people’s locations reveals sensitive insights about their identity, location, behavior, associations, and activities that infringe on the right to privacy, adding to the government’s existing intrusive surveillance practices.
Some business owners told HRW that they have strictly enforced the QR Code system out of fear of being deemed non-compliant with government-imposed measures. This could make them subject to sanctions such as under the recently passed Law on Measures to Prevent the Spread of COVID-19 and other Serious, Dangerous and Contagious Diseases, which introduced disproportionate criminal penalties of up to 20 years in prison and fines.
The QR Code system does not have any basis in legislation and its ostensible voluntary nature should not include sanctions, the rights group said.
Cambodia should enact a data protection law that would regulate and protect the usage, collection, and retention of data in accordance with international standards for privacy and other rights, HRW added.
According to John Hopkins University there were 2,915 COVID-19 infection cases and some 22 deaths attributed to the disease in Cambodia as of April 8.
