COVID-19: Public Access to Information – Legal and Institutional Frameworks

1 Introduction

The current global pandemic of a coronavirus (SARS-CoV-2), which began in Wuhan, China, in December 2019 (hereinafter ‘COVID-19’) has caused unprecedented damage on a global scale. As of August 4, 2020, COVID-19 has infected over 18.6 million people and claimed the lives of over 700,000 worldwide, and no cure or vaccine has been made available to the public. The pandemic has also caused unprecedented economic and social damage:^[1] a number of countries have been compelled to adopt hard measures to control the pandemic, such as lockdowns and border closures, at substantial economic and social costs.^[2] Notably, this pandemic has claimed the largest number of lives in the most advanced countries, such as the United States (4,748,806 cases of infection and 156,311 deaths as of August 4, 2020),^[3] where advanced medical technology and resources are available.

The high rate of infection and mortality in developed countries indicates that factors other than medical technology and technical capacity, such as laws and institutions designed to respond to the pandemic such as COVID-19, have a crucial impact on public health in pandemic situations. In some countries, legal and institutional reforms have enabled the governments to respond more effectively to the pandemic than others. For example, in South Korea (hereinafter ‘Korea’), the government was able to make a large number of tests available to the public in the early stages of the pandemic. The Korean government has also collected and provided timely information on the status of the pandemic to the general public and delivered speedy and effective health care to those infected with COVID-19. As a result, Korea has successfully contained the spread of COVID-19 and currently maintains a low mortality rate (five per one million) without having to resort to costly measures such as lockdowns and border closures.^[4] Relevant Korean laws, which are introduced in this chapter, have enabled and also required the government to respond rapidly and effectively to the pandemic. Laws and institutions are important in all areas relevant to the pandemic management, including public access to information, provision of timely and effective health care, and regulation of activities as necessary to control the pandemic. This chapter focuses on public access to information and introduces the best practices developed by Korea.

2 Public Access to Information

The pandemic of COVID-19 has made a significant impact on public access to information. Serious medical, economic, and social consequences of the pandemic have raised a need for public access to relevant information, such as information on the status of the pandemic (e.g., the number of infection cases and deaths across the country and in regional breakdowns), information on the government measures adopted to control the spread of COVID-19 (e.g., lockdowns, any quarantine requirements, travel bans, and border closures), and the actions recommended to protect the members of the public from the disease (e.g., social distancing, hygiene guidelines, recommended actions when infection is suspected).

The government, which is responsible for public safety and security, is expected to provide the public with relevant information in a transparent and effective manner. If the government fails to provide timely information on the outbreak of the disease and even prevents the dissemination of relevant information in fear of public unrest, it will deprive the public of the opportunity to take actions necessary to protect themselves from the disease. Thus, the first step that the government must take is to provide the public with full information on the outbreak and spread of the disease in a timely manner.

Korea has been exemplary in providing full and timely information on the status of COVID-19 within its territory. The Korea Centers for Disease Control and Prevention (KCDC), the government control tower for the control and prevention of infectious diseases, posts updated information on the pandemic, including daily changes in the number of reported infections and reported deaths caused by the pandemic across the country and in regional breakdowns.^[5] The KCDC updates this information daily and makes it available on its publicly accessible website since the first reported COVID-19 case in January 2020. Korean law also requires the government to release the information to the public. Section 6(2) of the Infectious Disease Control and Prevention Act, as amended, stipulates:

Each citizen shall have the right to know information on the situation of the outbreak of infectious diseases and the prevention and control of infectious diseases and how to cope therewith, and the State and local governments shall promptly disclose the relevant information (emphasis added).^[6]

The KCDC also provides the public with information on contact tracing of the individuals infected with COVID-19. The Infectious Disease Control and Prevention Act authorizes the government to obtain a wide range of information on the individual either infected with an infectious disease or suspected of infection.^[7] The Act also requires the government to provide the obtained information. Section 34(2) of the Infectious Disease Control and Prevention Act provides in the relevant part:

When an infectious disease harmful to citizens’ health is spreading, the Minister of Health and Welfare shall promptly disclose information with which citizens are required to be acquainted for preventing the infectious disease, such as the movement paths, transportation means, the location of medical treatment institutions, and contacts of patients of the infectious disease.” (emphasis added)^[8]

Korea has developed the world’s most advanced online platform that traces the movement of the infected individuals by simultaneously retrieving relevant information from 28 agencies. The contact tracing information is known to be secured within minutes with the advent of Korea’s advanced information technology that can trace the individual’s movement by tracking mobile phone use, credit card usage, and footages of over 260,000 CCTVs located throughout the country. The public health inspector first interviews an infected individual and obtains a statement on movement paths and the locations that the individual has visited for the past 14 days. The inspector requests further information through this tracing device when it is deemed necessary to augment or check the validity of the statement.

This tracing information is provided to the public by updated postings on a publicly accessible website and also by text messages when the receiver is in the vicinity of the reported locations. The released entry does not include the identity of the infected individual, but provides other relevant information, including the time and location in which the infected individual has been physically present (and whether the location has since then been sanitized), means of any transportation, and boarding time, in cases where the release is deemed necessary to prevent a further spread of infection (e.g., cases involving physical contract, failure to wear a face mask, presence of a crowd). The released tracing information alerts those who have recently been in the reported locations of risk of infection and the others to take precaution when traveling to or near the reported locations, thereby reducing the risk of infection. Those who have been found in contact with the infected individual are asked to take diagnostic tests (COVID-19 tests).

The public also expects the government to provide information on the measures that it has adopted to control the spread of COVID-19, such as the administration of COVID-19 tests, as well as on the actions recommended for the public as cited earlier. To control the spread of the disease, it is essential to test the individuals who may have been infected with COVID-19 as early as possible and quarantine those who test positive. The public will also need information on the hospitals and clinics equipped to treat COVID-19 and taken measures to protect patients from the virus.

Korea has also been exemplary in providing information on the available test sites and the clinics equipped to treat COVID-19. Korea has set up over 500 such clinics throughout the country, and government websites provide instructions on the steps needed to access the clinic (e.g., a prior phone consultation) and offer a search for a nearby clinic for the user.^[9] As a result, in as early as February, only a few weeks after the first reported case, Korea was able to test more than 10,000 individuals daily. The effective public access to the relevant information, coupled with the early development and mass production of the test kits by Korean pharmaceutical companies, was the key element for the success.

3 The Question of Privacy

Another impact that the pandemic has made on public access to information is the potential evasion of privacy in the course of collecting and releasing personal information to the public. The collection and release of tracing information has been essential to control the spread of COVID-19, but it raises the question of privacy. Again, in Korea, the health-care inspector requests this information only when it is deemed necessary to control further spread, and the information obtained by the government is legally protected personal information.^[10] The government is authorized to release personal information in exceptional circumstances: Section 58(1) of the Personal Information Protection Act authorizes the government to collect and release private information without consent of the individual or a court order when “it is urgently necessary to protect public safety and security, including public health.”^[11]

The privacy concern is twofold. First, the release of detailed tracing information, even without the directly identifying information (e.g., name), does not preclude a third party from tracing the identity of the individual. Second, through tracing, the government will obtain full personal information, such as travel history, visited locations, as well as the individual’s name and detailed address, regardless of which information it chooses to release to the public. The concern for privacy requires a balance between the government’s obligation to public interest in accessing information and the interest of privacy. Korea has tried to achieve this balance by limiting the extent of personal information to be released. The government initially released an extensive range of information, including gender and age, travel history, and work and residential addresses, but stopped releasing the addresses in an effort to reduce a risk of unnecessary exposure.^[12] As to the government access of personal information, the government guideline limits the personnel authorized to access the full information: only the KCDC and the health-care inspectors in the regional governments are authorized for the access.^[13]

These limiting measures neither remove concerns for privacy completely nor eliminate the risk of misuse. In the pandemic situation, however, the society has to make a decision as to whether it is ready to accept certain limitations on privacy, along with the risk, by allowing the government to obtain personal information and release it for the interest of controlling the pandemic. There seems to be growing public support for collection and release of personal information by the government, as necessary to protect the public from the pandemic.^[14] Reflecting on this consensus, other countries and autonomous regions, including Singapore, Hong Kong, Britain, and Germany, also collect and release the tracing information to the public, with details of the released information determined by their own guidelines.^[15]

4 Conclusion: A Lesson from COVID-19

The pandemic has made a significant impact on public access to information: there is a strong public interest in accessing relevant information, and Korea’s success indicates that timely provision of relevant information on the status of the pandemic, including tracing information, is essential to control the disease without costly measures such as lockdowns and border closures. A strong legal and institutional apparatus is important to secure timely collection and release of relevant information. As discussed, Korean law requires the government to collect and release relevant information to the public in a timely manner.^[16] The KCDC has been institutionally reinforced to function as the control tower, particularly in the collection, verification, and release of the information, and gained public confidence in the information it releases.

Korea’s success would justify the policy recommendations to implement laws that both empower and obligate the government to collect and release relevant information and to create an institutional focus with a single-government control tower and the legal mandate such as the KCDC. However, the recommendations entail the following caveat: the Korean laws and the institutions have effectively functioned because there has been active compliance by the population and state capacity necessary to implement the requirements of the law;^[17] it would have been difficult for the government to collect and release trace information expeditiously without its information technology linking various sources to trace individuals infected with COVID-19. Likewise, the release of information on the government measures, such as the administration of COVID-19 tests and the provision of face masks, would not have been very useful without the capacity to produce a large number of test kits and face masks in time to meet the public demand. The existence of Korea’s low-cost public health-care system, compatible with the cited government provisions, has also been essential. Thus, the effectiveness of the suggested legal and institutional arrangements will depend on the strength of public compliance, state capacity, and medical institutional apparatus already in place.

In the pandemic, governments have also found a legitimate interest to collect personal information and develop a system that expedites its collection and release to the public. However, this development raises invasion of privacy concerns. There exists a risk that a government may misuse such a newfound capacity to increase its control over populations after the pandemic. International guidelines support the protection of privacy and clarify that information collected or received by a state that refers to an identified or identifiable person shall be kept confidential and processed anonymously as required by the national law.^[18] A degree of civil control and a clear legal regulation will be necessary to ensure that an adequate balance between public access to information and protection of privacy remains through the pandemic.^[19]

Lastly, a reference should also be made to matters that impact human development and social progress. The pandemic has caused social disturbances, such as numerous incidents of derogatory comments and violent acts committed against minorities of Asian origin in public (because COVID-19 began in China) and discriminatory measures against foreign workers, asylum seekers, and refugees (in Lebanon, Malaysia, and elsewhere).^[20] There is also a concern for the abuse of police powers.^[21] Chronic social prejudice and discrimination have been exacerbated in many parts of the world in the course of the pandemic. There is an important role for governments and civil societies to contain this social derogation: it is important to adopt measures to contain COVID-19, but it must be done in a manner that is protective of essential human rights. Governments and civil societies must also raise public awareness on these issues and adopt necessary actions to contain the social damage to be inflicted by COVID-19.