Back
Image Alt

The Singapore Law Gazette

Coronavirus: Pandemics, Artificial Intelligence and Personal Data

How to Manage Pandemics Using AI and What That Means for Personal Data Protection

With COVID-19, or the Coronavirus as it is more popularly known, the world is hit with a global pandemic at a time when international travel and transactions are at its highest levels. The rapid spread of a virus that is difficult to detect and easily transmitted has presented major challenges to the its containment and eradication by governments worldwide. Due to its very nature, human contact must be minimised and tracing (and isolating) carriers through identification are key. For this and other reasons, Infocomm technology (ICT), and in particular, Artificial Intelligence (AI), can provide the best solutions that necessitates the collection, use and sharing of personal information. This article considers the benefits of AI to manage infectious diseases in the context of the COVID-19 pandemic, and how the ethical and legal considerations in relation to the data protection regime can and should respond to its use.

Artificial Intelligence in Managing and Containing the Spread of Infectious Diseases

We are living in a new reality with the COVID-19 pandemic across the globe, which provides an entirely new environment and context in which the data protection principles operate. Artificial Intelligence and other forms of data collection are highly useful, and may in fact be integral to the fight against the pandemic. AI can facilitate early detection of, and preemptive action against, the onset and spread of viruses and other infectious diseases generally and within any geographical location. AI can also lead to better and more efficient testing, the development of a vaccine and a cure as well as more effective health management on a massive scale.

First, AI can be used to track the genesis or source of infectious diseases as they may emerge and its spread in terms of speed and geography. This can trigger action by early responders and restrict its spread through containment and with a view to its eradication. AI can also provide advance notice for preparedness measures by relevant institutions, in particular, hospitals and other healthcare agencies. For example, BlueDot’s outbreak risk software is an AI platform that uses natural language and machine learning algorithms to sieve through information, including personal data, from a variety of sources with a view to early detection.1BlueDot <https://bluedot.global/>. Other examples include Metabiota, which uses health-care and news reports; and Stratifyd, which uses social media postings. See Cory Steig, How This Canadian Start-Up Spotted Corovirus Before Everyone Else Knew About It, 3 March 2020 <https://www.cnbc.com/2020/03/03/bluedot-used-artificial-intelligence-to-predict-coronavirus-spread.html>; and Aaron Pressman, How AI is Aiding the Coronavirus Fight, 16 March 2020 <https://fortune.com/2020/03/16/ai-coronavirus-health-technology-pandemic-prediction/>. BlueDot then alerts governments, hospitals and businesses thereby providing advance notice. Early predictions are done through a mapping of relevant information from sources such as news reports, social media and travel data, some of which may be proprietary and even sensitive data.

Second, AI can also be used to track human movement and traffic, which is a primary focus for containment once the virus is in the community. Of course, contact tracing is a key objective, but there are other uses for such data as well, such as in determining the effectiveness or otherwise of social distancing measures. AI can be used for contact tracing investigations by drawing patterns from a collection of personal data derived from, for example, surveillance footages and location tracking devices. Even regular IoT devices that is often with a person can be modified or enhanced to do this, including the mobile phone and wearable gadgets like smart watches and activity trackers like Fitbit, whether through the inclusion of an app or a software update. For example, Singapore’s TraceTogether was developed by Singapore’s GovTech Singapore,2GovTech Singapore < https://www.tech.gov.sg/>. a public agency, which uses Bluetooth to identify human to human contact and interaction.3TraceTogether < https://www.tracetogether.gov.sg/>. Similar types of apps can be developed to further not only contact tracing but also to encourage social distancing, such as an app that will vibrate or sound when a person is within one metre of another for more than a few seconds and that can provide a variety of settings for more efficient uses (such as to “silence” these alarms if a related person such as a family member or spouse is detected). Policing and enforcement of containment measures like social distancing regulations can also be done through AI (such as through surveillance using robotic agents) during a health crisis where human interaction and movement must be circumscribed in order to contain and control the spread of a disease within a community and to protect law enforcement officers from the risks of direct contact.

Third, AI can be in the form of a diagnostic tool or used to develop a vaccine, but this is still nascent and will take time in a race that is often won, at least in the early battles of the war, by a newly evolved virus.4See Will Douglas Heaven, AI Could Help With The Next Pandemic – But Not With This One, MIT Technology Review, 12 March 2020 <https://www.technologyreview.com/s/615351/ai-could-help-with-the-next-pandemicbut-not-with-this-one/>; and Ben Dickson, Why AI Might be the Most Effective Weapon We Have to Fight Covid-19, The Next Web, 21 March 2020 <https://thenextweb.com/neural/2020/03/21/why-ai-might-be-the-most-effective-weapon-we-have-to-fight-covid-19/>. One example of the former is Nanox, a medtech company that developed the mobile digital X-ray “Nanox System” that can diagnose viral infections early through the use of cloud-based software, which can in turn reduce the risk of an outbreak reaching a pandemic, or even an epidemic level.5Nanox < https://www.nanox.vision/>. See Simon Chandler, How AI May Prevent The Next Coronavirus Outbreak, Forbes 4 March 2020 Certainly, identifying potential carriers of the virus, and risk assessment of persons in contact with them, is an essential part of containment efforts; and as such, personal data collection and processing (as well as sharing) is necessarily involved. Early detection must include personal information as one of the mitigating measures is to identify and quarantine the infected to prevent further spread of the disease.

Hence, one of the main impediments to the effectiveness of AI in battling the spread of infectious diseases is the lack of use of personal data. Access to personal data can provide an even more detailed and accurate picture of the inception and spread of a virus. However, the private companies that require such data often do not have the justification or the authority to obtain them prior to a national emergency and without the cooperation of public and/or private institutions that may hold that information (e.g. collected through public surveillance or as part of a person’s personal health data). By the time there is a legitimate reason and legal basis for access, such as one based on public security and health justifications, that will be after early detection is done by the use of other types of information, which may arise later than would be preferred or useful to arrest the problem at its early stages. Another related problem is that as viruses can arise from anywhere in the world and does not respect borders, the source of the virus may be from a country that does not collect or cannot provide the data needed for swift early detection.6See Becky McCall, Covid-19 and Artificial Intelligence: Protecting Health-Care Workers and Curbing the Spread, The Lancet, 20 February 2020, see: https://doi.org/10.1016/S2589-7500(20)30054-6.

Personal Data Protection and Data Use Ethics During a Health Crisis

Are the ethical boundaries re-defined given the national health and security as well as economic concerns arising from the spread of infectious diseases? There are strong arguments for this to be the case since public health and security are primary concerns, bolstered by secondary interests like safeguarding the economy. The context against which ethical principles are applied is as important as the AI used and its potential for abuse or inaccuracy. The ethical principles should be aligned with the objective of safeguarding health and human lives; and as such, if the “human-centric” focus is on public health concerns, there is greater leeway for the urgent development and use of new forms of AI even as personal data and privacy concerns may be as yet untested or may be compromised to some extent. Explainability, transparency and fairness are also important but may reasonably be phased in after the implementation of AI measures given the urgency of the situation.7These categories form the high-level guiding principles toward promoting trust in, and understanding of, AI technology under the Singapore Ministry for Communications and Information’s (MCI) Model Artificial Intelligence Governance Framework, Version 2.0, January 2020 < https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/resource-for-organisation/ai/sgmodelaigovframework2.pdf>.

In other words, a main issue is the public and private use of personal data and how the personal data regime may require the above to operate, or otherwise exempt data management from the Personal Data Protection Act (PDPA).8No. 26 of 2012. In fact, many data protection laws have already put in place exemptions that can and should apply in a situation involving a pandemic of such proportions as the COVID-19 situation that we are facing today.

In Singapore, “public agencies” are excluded from the PDPA.9Section 4(1)(c) of the PDPA.. However, as an AI may be developed and operated by a private organisation, the sharing or disclosure of personal data to such organisations will have to find a legal basis under the Act; as is the independent collection and use of personal data by the organisation itself. Under its present provisions, the PDPA allows organisations to collect, use and share personal data without actively seeking consent for the purpose of contact tracing and other emergency response measures on the basis of its necessity for “national interest” (which can cover health and economic interests) and/or as a necessary response to a life, health or safety emergency of the data subject or other persons with whom that subject may have interacted with.10Section 17 read with Schedules 2(1)(d)(b), 3(1)(d)(b) and 4(1)(e)(b) of the PDPA respectively. An example is the collection of personal information like identification data including unique ID numbers, health-related symptoms, recent travel information and personal health data, for the granting of access to certain premises. Likewise, public agencies can share such data with private agencies and vice versa under an existing exemption.11Section 17 read with Schedules 2(1)(q)(r), 3(1)(j) and 4(1)(g) of the PDPA respectively. For example, where the private agency provides contact tracing services or where combined data is required for such objectives. In such a case, the other PDPA provisions and protections remain applicable, such as the institution of reasonable security arrangements for protection and reasonable notification requirements for transparency.12Sections 24 and 20 respectively.

Certainly, wider exemptions can be made if and when necessary as the Minister also has powers to enact new legislation or subsidiary regulations. An organisation or type of personal data, or classes of organisations or personal data can be prescribed for exemption in accordance with the PDPA.13Section 4(1)(d) of the PDPA. Alternatively, new emergency legislative exemptions can be passed swiftly, for example the COVID-19 (Temporary Measures) Act 2020,14Act 14 of 2020 < https://www.moh.gov.sg/docs/librariesprovider5/pressroom/press-releases/annex-for-notification-8-apr-2020.pdf>. The Act was fast-tracked through Parliament and passed on the same day as it was introduced on 7 April 2020. See Lydia Lam, Necessary for Singapore to Fast-Track COVID-19 Laws Amid Unprecedented Situation: Lawyers, 13 April 2020 < https://www.channelnewsasia.com/news/singapore/singapore-fast-tracks-covid-19-laws-unprecedented-situation-12634060>, which also provides other examples of expedited laws for national health and other emergency situations. which will take precedence over the PDPA obligations.15In accordance with Section 4(6) of the PDPA. Such a broader exemption may be necessary, for instance, if general access or notification to the public is inadvisable (that is, the other PDPA obligations should also be justifiably exempted).

In contrast, other countries may have a different policy and legislative approach. For example, the European Union’s (EU) General Data Protection Regulations (GDPR) have a different approach that can also serve the general purpose of allowing for the development and application of AI for the abovementioned objectives.16Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The ePrivacy Directive (Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector) and the exemptions provided therein (see Article 15 of the ePD) may also be applicable, such as in relation to personal location data. In fact, the GDPR also further categorises “sensitive data” which includes health information.17In relation to “sensitive data” relating to public interest in the area of public health and processing for medical diagnosis, the provision of health care or treatment and so on, see Article 9(2)(i) and (h) of the GDPR respectively. In a statement to provide a consistent approach for EU Member States to follow,18The approach has not been uniform across the EU Member States. See DPA Guidance on Covid-19, IAPP <https://iapp.org/resources/article/dpa-guidance-on-covid-19/>. the European Data Protection Board released a statement on the processing of personal data in relation to COVID-19.19Statement on the Processing of Personal Data in the Context of the Covid-19 Outbreak, EDPB, 19 March 2020 <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf>. Public and private institutions, including health authorities and services, can lawfully process personal information without relying on consent if there is substantial public interest.20Article 6 of the GDPR. See also Article 6(1)(e) and Article 9(2)(g), in relation to “sensitive data”, for the “public interest” ground. Depending on the situation, data controllers can rely on the “legitimate interest”,21Article 6(1)(f) of the GDPR. “contractual necessity”,22Article 6(1)(b) of the GDPR. or “legal obligation”23Article 6(1)(c) of the GDPR. bases to process personal data as part of the measures taken in relation to a health threat like the spread of COVID-19. It can also be justified on the basis of doing so to protect the “vital interests” of the data subject or other people.24Article 6(1)(d) of the GDPR. Article 9(2)(c) of the GDPR for “sensitive data”. Data controllers should still practice data minimisation and conduct a data protection impact assessment before collecting personal data.25See John Timmons and Tim Hickman, Covid-19 and Data Protection Compliance, White & Case, 26 March 2020 <https://www.whitecase.com/publications/alert/covid-19-and-data-protection-compliance>. Another example is the United States where restrictions on personal data, including health data, are loosened;26Henry Kenyon, Loosening of Health Data Rules in Pandemic Raises Privacy Concerns: Expert, 2020 CQINSB 0400 (Congressional Quarterly Inc.), 9 April 2020. and where laws to strengthen personal data protection are asked to be put on hold.27Natalie A. Prescott, Covid-19 Will Apparently Not Delay CCPA Enforcement, The National Law Review, 20 April 2020 < https://www.natlawreview.com/article/covid-19-will-apparently-not-delay-ccpa-enforcement>.

The Role of Academia in Aligning AI for Pandemic Response to Ethics and Regulations

The Centre for AI and Data Governance (CAIDG) in the Singapore Management University School of Law has joined a multi-disciplinary and multi-jurisdictional Global AI Ethics Consortium consisting of top academic institutions including Technical University of Munich (Institute for Ethics in AI); Aarhus University; Harvard University (Berkman Klein Center); New York University (The GovLab); Oxford University (Oxford Internet Institute); University of Tokyo and Sorbonne University to set a universal standard for data protection regulation in a health crisis and guidelines on ethical practices. Researchers in CAIDG is also developing a comparative study on the ethical issues posed by contact tracing and citizen movement with their counterparts in Edinburgh University. One of the focus of study is the different national approaches to AI ethics and the immediate, medium and long term ramifications for privacy and personal data protection. Interesting and important questions associated with crisis necessities and the future impact on surveillance societies are expected to be covered in the study.28This research/project is supported by the National Research Foundation, Singapore under its Emerging Areas Research Projects (EARP) Funding Initiative. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore.

Just as we require a concerted and calibrated response from the technologists and scientists; academics must also work together for a comprehensive and consistent global solution to meet a common global challenge on a scale and speed unlike anything since the Asian Flu in the 1980s,29Comparing it to similar viruses, the Covid-19 pandemic death toll will likely surpass the H1N1 Swine Flu in 2009-10, having already exceeded the death toll for MERS and SARS respectively). See Hilary Bruek and Shayanne Gal, How the Coronavirus Death Toll Compares to Other Pandemics, Including SARS, HIV, and the Black Death, Business Insider Singapore, 10 April 2020 <https://www.businessinsider.sg/coronavirus-deaths-how-pandemic-compares-to-other-deadly-outbreaks-2020-4?r=US&IR=T>. Given its rate of infection, that can possibly exceed all the pandemics that came before, except perhaps the Spanish Flu of a Century ago. and which is still a growing problem worldwide due to its insidious nature. The effects of this pandemic will lead to further economic hardship that is yet to be calculable. Certainly, it has impacted the way humans interact and transact in a way most have never seen before (since the World War 2) with an unprecedented lockdown of borders or heavy immigration controls, the grounding of the cruise and aviation industries, the mandatory closure of non-essential businesses and services, and quarantine or similar measures on many national levels. In contrast, it is no surprise that information and communications technology (including AI) have flourished and risen to the fore in the management and containment of this virus, given the remote access it provides to information, products and services and its many aforementioned capabilities respectively.

Endnotes   [ + ]

1.BlueDot <https://bluedot.global/>. Other examples include Metabiota, which uses health-care and news reports; and Stratifyd, which uses social media postings. See Cory Steig, How This Canadian Start-Up Spotted Corovirus Before Everyone Else Knew About It, 3 March 2020 <https://www.cnbc.com/2020/03/03/bluedot-used-artificial-intelligence-to-predict-coronavirus-spread.html>; and Aaron Pressman, How AI is Aiding the Coronavirus Fight, 16 March 2020 <https://fortune.com/2020/03/16/ai-coronavirus-health-technology-pandemic-prediction/>.
2.GovTech Singapore < https://www.tech.gov.sg/>.
3.TraceTogether < https://www.tracetogether.gov.sg/>.
4.See Will Douglas Heaven, AI Could Help With The Next Pandemic – But Not With This One, MIT Technology Review, 12 March 2020 <https://www.technologyreview.com/s/615351/ai-could-help-with-the-next-pandemicbut-not-with-this-one/>; and Ben Dickson, Why AI Might be the Most Effective Weapon We Have to Fight Covid-19, The Next Web, 21 March 2020 <https://thenextweb.com/neural/2020/03/21/why-ai-might-be-the-most-effective-weapon-we-have-to-fight-covid-19/>.
5.Nanox < https://www.nanox.vision/>. See Simon Chandler, How AI May Prevent The Next Coronavirus Outbreak, Forbes 4 March 2020
6.See Becky McCall, Covid-19 and Artificial Intelligence: Protecting Health-Care Workers and Curbing the Spread, The Lancet, 20 February 2020, see: https://doi.org/10.1016/S2589-7500(20)30054-6.
7.These categories form the high-level guiding principles toward promoting trust in, and understanding of, AI technology under the Singapore Ministry for Communications and Information’s (MCI) Model Artificial Intelligence Governance Framework, Version 2.0, January 2020 < https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/resource-for-organisation/ai/sgmodelaigovframework2.pdf>.
8.No. 26 of 2012.
9.Section 4(1)(c) of the PDPA..
10.Section 17 read with Schedules 2(1)(d)(b), 3(1)(d)(b) and 4(1)(e)(b) of the PDPA respectively.
11.Section 17 read with Schedules 2(1)(q)(r), 3(1)(j) and 4(1)(g) of the PDPA respectively.
12.Sections 24 and 20 respectively.
13.Section 4(1)(d) of the PDPA.
14.Act 14 of 2020 < https://www.moh.gov.sg/docs/librariesprovider5/pressroom/press-releases/annex-for-notification-8-apr-2020.pdf>. The Act was fast-tracked through Parliament and passed on the same day as it was introduced on 7 April 2020. See Lydia Lam, Necessary for Singapore to Fast-Track COVID-19 Laws Amid Unprecedented Situation: Lawyers, 13 April 2020 < https://www.channelnewsasia.com/news/singapore/singapore-fast-tracks-covid-19-laws-unprecedented-situation-12634060>, which also provides other examples of expedited laws for national health and other emergency situations.
15.In accordance with Section 4(6) of the PDPA.
16.Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The ePrivacy Directive (Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector) and the exemptions provided therein (see Article 15 of the ePD) may also be applicable, such as in relation to personal location data.
17.In relation to “sensitive data” relating to public interest in the area of public health and processing for medical diagnosis, the provision of health care or treatment and so on, see Article 9(2)(i) and (h) of the GDPR respectively.
18.The approach has not been uniform across the EU Member States. See DPA Guidance on Covid-19, IAPP <https://iapp.org/resources/article/dpa-guidance-on-covid-19/>.
19.Statement on the Processing of Personal Data in the Context of the Covid-19 Outbreak, EDPB, 19 March 2020 <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf>.
20.Article 6 of the GDPR. See also Article 6(1)(e) and Article 9(2)(g), in relation to “sensitive data”, for the “public interest” ground.
21.Article 6(1)(f) of the GDPR.
22.Article 6(1)(b) of the GDPR.
23.Article 6(1)(c) of the GDPR.
24.Article 6(1)(d) of the GDPR. Article 9(2)(c) of the GDPR for “sensitive data”.
25.See John Timmons and Tim Hickman, Covid-19 and Data Protection Compliance, White & Case, 26 March 2020 <https://www.whitecase.com/publications/alert/covid-19-and-data-protection-compliance>.
26.Henry Kenyon, Loosening of Health Data Rules in Pandemic Raises Privacy Concerns: Expert, 2020 CQINSB 0400 (Congressional Quarterly Inc.), 9 April 2020.
27.Natalie A. Prescott, Covid-19 Will Apparently Not Delay CCPA Enforcement, The National Law Review, 20 April 2020 < https://www.natlawreview.com/article/covid-19-will-apparently-not-delay-ccpa-enforcement>.
28.This research/project is supported by the National Research Foundation, Singapore under its Emerging Areas Research Projects (EARP) Funding Initiative. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore.
29.Comparing it to similar viruses, the Covid-19 pandemic death toll will likely surpass the H1N1 Swine Flu in 2009-10, having already exceeded the death toll for MERS and SARS respectively). See Hilary Bruek and Shayanne Gal, How the Coronavirus Death Toll Compares to Other Pandemics, Including SARS, HIV, and the Black Death, Business Insider Singapore, 10 April 2020 <https://www.businessinsider.sg/coronavirus-deaths-how-pandemic-compares-to-other-deadly-outbreaks-2020-4?r=US&IR=T>. Given its rate of infection, that can possibly exceed all the pandemics that came before, except perhaps the Spanish Flu of a Century ago.

School of Law
Singapore Management University
E-mail: [email protected]