DECEMBER 6 — I refer to the article published in the Malay Mail on December 5, 2020 entitled “Amid privacy concerns, cybersecurity expert says social media apps more intrusive than MySejahtera.”
There is widespread concern about how the data is being managed in the MySejahtera application. The government has come out many times to explain. Yet, many are still concerned about privacy, personal data harvesting and even the perception that the government is using this application to track its citizens.
I believe these concerns are valid and the government need to respond to them clearly and transparently. The explanation is given in this article, unfortunately, does not ally these concerns. Here is why.
MySejahtera is not a social application
The responses given by Fong Choong Fook in the said article does not fully address the issues. Firstly, I do not agree that we should even compare MySejahtera application with social media applications such as Facebook, Telegram WhatsApp Snapchat or even Instagram. This is because MySejahtera is NOT a social media application.
According to the FAQ section on mysejahtera.gov.my, this is the definition of the MySejahtera:
MySejahtera is an application developed by the Government of Malaysia to assist in managing the Covid-19 outbreaks in the country. It allows users to perform health self-assessment on themselves and their families.
The users can also monitor their health progress throughout the Covid-19 outbreak. In addition, MySejahtera enables Ministry of Health (MOH) to monitor users' health condition and take immediate actions in providing the treatments required.
MySejahtera application is developed to:
- Assists the Government in managing and mitigating the Covid-19 outbreak
- Helps users in monitoring their health throughout the Covid-19 outbreak
- Assists users in getting treatment if they are infected with Covid-19
- Locates nearest hospitals and clinics for Covid-19 screening and treatment
Next, we cannot compare how intrusive the application is based on permissions alone. Fong may be right that Facebook or WhatsApp required far more permission to access specific data from our devices. There are very fundamental differences.
We need to note that the data provided to the application. The big difference is that MySejahtera makes it compulsory to enter our IDENTITY information. Identity information includes personal data such as Full Name, Gender, Date of Birth, mobile phone number, address most pertinently, MyKad number (or passport number).
If we have completed the Penjana claim and link our MySejahtera with an eWallet, the data is complete.
I cannot remember any occasion that Facebook, WhatsApp or telegram asked for any personal identity information such as ID card number, passport number or even my address.
Having provided your identity data and being able to link that to the places you have and the ability the permission to access precise location make it possible to locate and track individuals. I not saying the government is tracking individuals. The perception of tracking is there. This is what we want to address.
In this situation where the Covid-19 outbreak needs to be contained through contract tracing, a careful balance between the privacy and outbreak management needs to present. This may not an easy task for the government to manage.
Addressing the issue of (the lack of) trust
This lack of trust has many dimensions and the main reason why this is happening is the lack of information, lack of transparency and proper communications. Here, I agree with Fong that there is a need for the government to be more transparent about how the government utilise the data collected through MySejahtera.
Here are some ideas the government could consider doing to address this trust deficit.
1. Develop and execute a comprehensive and impactful communication plan
Communication is everything. We need to be able to effectively share, strong positive and accurate information to the public. The communication plan needs to regard the public as a stakeholder in this effort to battle Covid19. It impacts us economically, socially, and emotionally.
Next, the government needs to systematically explain what is being done.
2. Tell us that our data is secure
Start by telling us our data is secure. Share that our data is stored in a location /locations that has the necessary certification and compliance with security and cybersecurity. The exact location may not be revealed. I think it is fine.
3. Show us that our data us safe and used for the appropriate reasons
The prevailing that law today is the Personal Data Protection Act (PDPA) 2010. It would be good to express compliance. While it may not be necessary, this will be a good step. At least another contact tracing app in Malaysia has already expressed compliance with the PDPA.
4. Share with us how our data is being used
Many of us read with concern when the Minister of Health on November 12 replied in Parliament that MySejahtera, has only directly detected 4 per cent of total reported Covid-19 cases in Malaysia.
It would be good for the Ministry would explain how the data is being used and the steps taken to prevent the spread of Covid-19. As they remain in the 4-digit daily new cases, the perception is that MySejahtera is not working. Helping the people understand will us to help in the fight against Covid-19.
5. Demonstrate is how you are managing the above
One of the best ways to address is to have independent/oversight committees comprising of credible and notable individuals to have oversight, access to the workings of MySejahtera. Allow them the opportunity to speak on behalf of the governments that there is compliance and data governance is intact. If there are shortcoming, address them accordingly.
This is not an exhaustive list of suggestions which I hope the government will seriously consider.
This is the “new normal” in privacy versus healthcare and citizen wellbeing which needs to be addressed seriously. At it is time the citizen be more informed and involved in collaborative engagement with the government.
* KV Soon has worked in leadership positions in Asia, Africa and the Pacific to lead and guide digital government initiatives.
** This is the personal opinion of the writer(s) or organisation(s) and does not necessarily represent the views of Malay Mail.
