China wants to keep health codes after the pandemic but users aren’t so sure

Some officials are looking at options to tie health codes to fitness, education and pension services, but it’s fueling data privacy concerns

Coronavirus pandemic: All stories

Masha Borak

Published: 9:24pm, 3 Jun 2020

Why you can trust SCMP

This article originally appeared on ABACUS

Whenever Li Xin wants to take a stroll through a local park in Shanghai, she needs to pull out her phone and show a QR code. If it’s not the right color, she won’t be allowed in. The same goes for entering her office. Her code was even checked when she was enrolling her child in kindergarten.

Color-based health codes have become China’s most widely used method of trying to keep the spread of Covid-19 under control. With the danger having subsided in most of China, the QR codes have also started to be used less often. Local city governments, however, are hoping to turn them into a more permanent fixture for their citizens.

How the QR code conquered China

One of those plans stirred controversy last week in Hangzhou, the first Chinese city to roll out the health codes. Local officials proposed the QR codes be used for much more than contact tracing. It could, for example, score users’ general health by tracking things like sleep or smoking habits. The idea was met with immediate backlash as people contemplated its privacy implications.

Unlike the contact tracing apps proposed by Google and Apple, which rely on Bluetooth, health codes in China are less sophisticated. They rely on travel and medical records and self-reported information to generate green, yellow and red QR codes meant to indicate a person’s risk of having been in contact with the virus. Green QR codes allow people to move about freely while yellow and red QR codes require quarantine for one to two weeks.

QR health code use is dropping in China, but it’s still a requirement for gaining entrance to many offices and businesses. (Picture: Hector Retamal/AFP)

While it doesn’t currently look like health code systems will be dolling out points based on health habits anytime soon, more city officials in China are expressing interest in expanding this piece of tech that’s already being used across the country.

“We've seen in the last month or two that some governments seem to be saying: ‘Okay, well, we're sitting on this potential new goldmine, can we use this in different ways?’” said Dev Lewis, a Shanghai-based fellow at the internet research think tank Digital Asia Hub.

Lewis has relied on the health codes himself. His gym and his office require him to show it to gain entrance. He describes it as a sort of “health passport.”

But if the system does expand, one challenge for users like Lewis is that different cities operate their own health code systems.

Shanghai is one of the cities considering upgrading its system. The city’s own health code, called Suishen Hao, has been used 520 million times during the pandemic.

“Suishen Hao could kick off a wide range of applications, it’s something we didn’t expect,” Chen Jing, secretary-general of the Shanghai city government, told local media last week.

According to Chen, the health code could be tied to services like fitness, pensions and more. Shanghai’s code is offered by a local e-government platform that already provides social insurance, education and healthcare services.

Other cities, including the southern tech hub Shenzhen, are eyeing similar paths to turning health codes into a sort of digital ID card.

The initiatives have prompted Lewis and some other researchers to compare it with China’s social credit schemes. Many Chinese cities have been piloting social credit system apps based on data collected by local governments and national bodies. The goal is to incentivize good behavior like volunteering and punish bad behavior like defaulting on loans. Some of these are points-based systems that award and deduct points based on behavior.

This effort has been described by some as an interesting experiment in governance, but others see it as dystopian. In reality, though, only a small percentage of city residents are enrolled in local social credit schemes.

But while some fear heightened surveillance under such schemes, many in China are more concerned about protecting their privacy. Aggressive data collection during the pandemic has already resulted in rampant data leaks.

“I do feel it’s a controversial technology,” Li said. “It brings a lot of conveniences, on one hand, but I’m also worried about personal information leaks.”

Richard Bird, partner at the London-based law firm Freshfields Bruckhaus Deringer, said that Chinese rules about privacy are sometimes seen as patchy and weakly enforced. This, however, is no longer the case.

“It's still evolving and details are still being filled in,” Bird said. “But when you look at the whole corpus of regulation and guidance and enforceable law, it's quite rich now.”

Legally, Chinese companies and institutions have an obligation to encrypt personal data. Sensitive data, like health-related information, is also required to be de-identified. And local governments collecting data through health codes aren’t exempt. To dispel fears of privacy leaks, the National Health Commission of China issued a notice in February outlining more protection requirements for personal data during the pandemic.

Actually having these laws enforced, though, is another matter. Bird said China’s rules for enforcing data privacy protection are different from those in the US or European Union. While many Western countries often enforce these rules based on private complaints, that’s not happening in China yet.

“In China, enforcement is sort of front-loaded, if you like,” Bird said. “It's based on a self-generated investigation by the various different authorities -- often, honestly, on a campaign basis.”

But new provisions have been made in an effort to address this, he added.

The Chinese government started working on a national unified health code, and this is a proposal for how it might look. (Picture: China Electronics Standardization Institute)

Other changes are also on the way for China’s health codes. The national government is already working to standardize all the disparate systems in cities across the country. And Zhou Ping, the director of the China Electronics Standardization Institute that’s working on the project, is among the officials hoping the new standardized code could be used for more than just making travel easier.

Shenzhen-based tech giant Tencent has also expressed interest in keeping the codes around. The company’s widely used social app WeChat and the mobile payment app Alipay are the most common platforms used to access the health codes offered by third-party developers. Both companies, however, say they don’t keep the data.

(Abacus is a unit of the South China Morning Post, which is owned by Alibaba, an affiliate of Alipay owner Ant Financial.)

But for now, it’s not clear if any of the ambitious proposals to expand the use of health codes will ever become a reality. The ideas floated so far have been just that -- ideas. And in China, it’s not uncommon to see government officials boasting about their tech prowess to local media.

Some people might be more comfortable with the privacy tradeoffs than others, though. Li Xin said that she trusts the government and is willing to give up some personal information to help fight Covid-19. Given how quickly the health codes have spread throughout the country, it looks like she’s not alone.

But that trust in the government has a limit, as the mostly negative reactions to Hangzhou’s recent proposals show. For now, many remain uncomfortable with the idea of turning health codes into a wide-ranging health-tracking platform.

Post