Smartphones Out, Bye COVID-19! — Assessing the Possibility of Exporting China's Global Pandemic-Era QR Codes as Health Certificates
April Xiaoyi Xu
J.D. Candidate, Harvard Law School. I would like to sincerely thank Professor Martha L. Minow and Professor Cynthia Dwork for a truly enlightening course, “Fairness and Privacy: Perspectives from Law and Probability.” I am grateful to Professor Urs Gasser for sharing his expertise on digital privacy. Many thanks go to my classmate Sanjana Singh for providing her thoughts from a computer science angle throughout my research and drafting process. Additionally, I wish to express my gratitude to Anita Liu for her wonderful insights from both law and computer science, and Dr. Laura O. Karas for offering her public health and medical perspective.
Recommended Citation
April Xiaoyi Xu, Note, Smartphones Out, Bye COVID-19! — Assessing the Possibility of Exporting China's Global Pandemic-Era QR Codes as Health Certificates, Harv. J.L. & Tech. Dig. (2021), https://jolt.law.harvard.edu/d...
I. Introduction[1]
The People’s Republic of China, where the first novel coronavirus (“COVID-19”) case was identified in late-2019, has curiously become one of the few nations that have efficiently contained the spread of the virus during the ongoing global pandemic.[2] A technological strategy that has played a significant role in China’s COVID-19 success is the QR health code.[3]
Relying on a combination of “self-reporting by the user, COVID-19 databases set up by government authorities, and data held by other sources including the public transportation, telecommunication, and banking sectors,” the QR health code operates largely as “mini apps” that are embedded in the social media app WeChat and the payment app Alipay, both of which are ubiquitous in China.[4] To register, a new user needs to report his/her name, gender, cellphone number, national identity card (ID) number, home address, and travel history, indicate any contact with someone diagnosed with COVID-19, and complete a health survey.[5] These mini apps automatically generate and assign color-coded QR codes “to citizens as an indicator of their health status,” with green indicating that the individual is healthy and can move freely, yellow signaling that the user must quarantine for up to seven days, and red for fourteen-day-quarantines.[6] In a sense, each individual’s QR code serves as a health certificate.[7] Although not mandatory, virtually all public venues in China — shopping malls, office buildings, parks, and even hutongs: narrow alleyway neighborhoods — require visitors to scan the venue’s unique QR code in order to check-in; failure to comply results in denial of entry.[8] This helps expedite later contact tracing efforts.
Promptly after the QR health code debut in February 2019 in the city of Hangzhou only weeks after the Wuhan outbreak, other provinces launched similar QR health codes; along with the launch of a national health code system, various jurisdictions have worked on increasing the level of compatibility and mutual recognition.[9] Although perhaps not directly influenced by the Chinese QR system, countries including Singapore and Australia also introduced similar technologies.[10] In November 2020, President Xi Jinping openly recommended that other countries also implement this technology and pushed for mutual recognition of each other’s QR codes internationally.[11]
There are valid skepticisms regarding China’s ulterior motives in advocating for the mass export of its QR framework, such as concerns about potentially broader political monitoring by China.[12] However, given this technology’s overall effectiveness thus far, it is worth evaluating whether more countries should seriously consider incorporating similar technologies as part of their broader strategies in combating COVID-19. Political issues aside, a key concern that many experts share is individuals’ privacy, due to the amount of personal information involved in the digital process as part of the QR health code framework.[13] Having provided an overview of how the QR health code system works and how its application has expanded geographically, this paper evaluates the possibility of exporting China’s QR health code to other countries with particular attention to privacy issues. In doing so, the paper proposes and applies several interconnected criteria from prevailing concepts in law and computer science, focusing on the first three: legality, necessity, proportionality, accuracy, transparency, privacy safeguards, and transferability.
II. Dominant International Human Rights Law (IHRL) Principles: Applying Legality, Necessity, and Proportionality Principles as Preliminary Criteria
Pursuant to most international human rights laws (IHRL), measures that interfere with fundamental rights must satisfy a three-part test: legality, necessity, and proportionality.[14] “Legality” means that the measures must be “in accordance with or prescribed by[] law”; “necessity” requires measures to be “necessary to achieve a certain aim”; “proportionality” means “proportionate to the aim pursued.” Specific to the COVID-19 context, authorities around the world — such as the Israeli Supreme Court and the European Data Protection Supervisor — have reaffirmed these principles.[15]
A. Legality
The legality principle “does not necessarily require a specific law authorizing the interference in question,” although where “a bespoke legislative measure is absent,” there needs to be “some other existing legal framework that provides sufficiently clear and precise rules to govern the use of the technology” that is “adequate to ensure individuals have advanced notice of and can foresee its application.”[16] Applied to QR codes as health certificates during the COVID-19 pandemic, there generally is not a “clear and precise” rule.[17] China, for instance, has yet to adopt comprehensive legislation regulating privacy and data protection, although there are relevant civil, criminal, and cybersecurity laws, and national guidelines.[18] Specific to the QR health code context, the Chinese State Administration for Market Regulation and Standardization Administration “released a series of national guidelines for personal health information codes” specifying “requirements for the collection, processing, and use of personal health information” in response to privacy experts’ critiques.[19] Per these guidelines, “the collection, processing, and use of personal health information must comply with the Personal Data Protection Guidelines,” QR health codes “must be encrypted and stored using an algorithm,” and apps “must obtain the express consent or authorized consent of users when collecting data, and must keep the private content confidential.”[20] However, these recommended guidelines lack the force of law.[21] In other words, from an international human rights law perspective, China may not have fully satisfied the legality principle itself with its QR health codes, although one could argue that given the public health emergency, the government had done its part providing notice to citizens and promulgating the technology.
Evaluating legality involves a case-by-case analysis, as different jurisdictions have distinct privacy laws. Even within the United States itself, privacy law takes a “sectoral approach,” where there are many privacy laws at the federal and state level, with each law narrowly drawn to protect specific kinds of information in particular contexts.[22] Berkman Klein Center affiliate Elizabeth M. Renieris has assessed blockchain-enabled immunity credentials, such as China’s QR code system, which she believes would result in substantial consequences for fundamental rights and liberties because these credentials can, for example, limit one’s right to enter into a public space. Renieris observes that we currently do not know of specific or general legal frameworks that would offer individuals sufficient clarity and precision as to how any data processed would be governed or processed, or “that could provide individuals with sufficient safeguards or protections in respect of their use.”[23] This is also true in China’s QR health code context discussed above, where it would likewise be difficult to contend that the technology would be “in accordance with, or prescribed by, law.”[24] Australia, however, is arguably an example of a country that complies with the legality principle when it comes to its QR code, as Australia has taken a legislative approach to COVID-19.[25] For South Australia’s QR-based COVIDSafe app, for example, the government made specific amendments to the 1998 Privacy Act in ensuring “stronger statutory privacy protections for users and their collected data,” showing that it is possible to satisfy the legality requirement with QR technologies.[26] From a forward-looking system-design perspective, should more countries adopt QR health codes, they should pay attention to providing clear and precise rules, and advanced notice for app users-to-be.
B. Necessity
The other two key IHRL principles, necessity and proportionality, both involve much subjectivity. Is the QR health code necessary? This is a difficult question to answer. One could start by comparing countries that have used QR health codes as a form a health certificate to resume near-normal activities after COVID-19 lockdowns (China, Singapore, and Australia) and ones that have not (most countries). While the former camp does boast much fewer new COVID-19 cases than many nations in the latter group,[27] many other factors could have contributed to the former camp’s successes (e.g. China has a very strict international flight policy to minimize the number of exported cases from abroad);[28] as such, it is nearly impossible to isolate the effectiveness, or necessity, of QR health codes in coping with the pandemic. Judging by data alone, several countries (albeit almost exclusively small island nations) have documented zero COVID-19 case altogether without QR health code measures, and for countries that have reported near-zero increase in cases consistently, not many have QR health codes or similar technologies.[29] Given the amount of creativity and technological innovation, one may say that QR health codes are not necessary, but are only one of the several, if not many, ways to keep COVID-19 cases under control.
The necessity analysis is, all in all, largely theoretical given how challenging it is to conclusively prove if the technology is necessary in the IHRL sense of the word.[30] Further, the “necessity” criterion can also be applied after the end of COVID-19, when the data collected via the QR codes should be deleted (i.e. the GDPR “right to be forgotten”)[31] absent compelling justifications that such data are still “necessary.” China announced that “elements of its QR-code tracking system are likely to remain in place after the pandemic ends,”[32] which is concerning from a privacy analysis based on necessity. By contrast, South Australia has “committed to holding the data for no more than 28 days and only releasing it to SA Health for official contact tracing purposes,”[33] demonstrating that it is possible for QR health codes to comply with the necessity principle.
C. Proportionality
The next question to consider is whether the use of QR code as a form of COVID-era health certificate is proportionate to the aim pursued? One might perform an inevitably subjective balancing test typical in judicial decision-making: do the benefits — better positioning a society to rid itself of coronavirus — outweigh the costs — such as infringements on individuals’ civil liberties, especially privacy and fairness issues, in the QR context? Again, the answer depends on one’s views or a country’s culture and values. Some have voiced that while they are aware of privacy issues, to them, “for the epidemic, it makes sense” to prioritize public health over individuals’ data privacy.[34] In the U.K., where NHS QR codes are also mandatory for many public venues, experts caution against the long-term risk of conditioning citizens to routinely supply personal information, but consider the technology to show that “privacy and utility can be harmonised in [] real-world.”[35]
A counterexample might be the reaction to California’s recent bill on verified credentials of COVID-19 test results: A.B. 2004, whose stated purpose is to “authorize the use of blockchain-based technology to provide verifiable credentials for medical test results, including COVID-19 antibody tests.”[36] The Electronic Frontier Foundation (EFF), a leading American organization defending civil liberties in the digital world, strongly opposed this bill; relevant among the EFF’s reasons are the organization’s view that the bill (1) “would take us a step towards national digital identification,” (2) exacerbates social inequities in terms of access to smartphones, and (3) “endorse[s] one solution to an evolving technological problem.”[37] Supporters of these view would most likely consider the costs to outweigh the benefits of having this technology, even despite A.B. 2004’s emphasis on the technology’s attention to privacy issues.[38]
Although the idea proposed in the bill differs from the QR health code framework, the three objections would likely hold true if other countries were to adopt the QR system. Firstly, China’s QR health code heavily relies on data on national IDs in identifying and verifying app users;[39] although the U.S. federal “Real ID” law (which the EFF also objects)[40] similarly centralizes government control over individuals’ identities, mandating that the entire population share ID/SSN information would raise substantial privacy concerns. Secondly, from a fairness standpoint, many in the world, especially the elderly, children, and the rural population, do not have smartphones, and can be left out of public health benefits that the QR tracing system provides.[41] China has sought to remedy these fairness concerns by allowing family members to help out and by using facial recognition technology for verification instead of mandating QR code for those without smartphones,[42] while Australia allows paper logs for those without smartphones.[43] Thirdly, the techno-solutionism critique is valid in the QR context as well.[44]
III. Applying Additional Criteria: Accuracy, Transparency, Privacy Safeguards, Transferability
As prevailing IHRL principles are perhaps insufficient as criteria to evaluate the QR health code’s privacy issues due to the aforementioned ambiguity and subjectiveness, we now briefly evaluate Xi’s proposal using other criteria that this paper proposes: accuracy, transparency, privacy safeguards, and transferability. First, accuracy is crucial in QR health code application: while over-diagnosing based on QR health code tracing can produce both personal and public panic about (falsely) getting infected with COVID-19, under-diagnosing is very dangerous in possibly overlooking coronavirus cases—given the virus’ infectious quality, this could quickly lead to an outbreak from chains of infections.[45] While the QR health code successes so far cast little doubt on the system’s accuracy, a critical drawback is that the QR health code system partially relies on self-reported information, such as whether one has visited an area with a coronavirus outbreak in the past fourteen days or has been in close contact with an infected person.[46] Although the threat of criminal penalties for false self-reports can deter misinformation, accuracy remains an important consideration. Second, transparency—less technological and human black boxes alike,[47] e.g. clearly communicating details about QR technology to citizens, including how QR health code works, who has access to the data, and for how long—is crucial to increasing public trust and cooperation. Although China de facto mandated the use of QR health codes, Western democracies can less likely legally mandate these and will rely greatly on trust.[48] Third, privacy safeguards should be in place, especially as QR codes are vulnerable to security attacks, fraud, and malicious actors, who can either replace the entire QR code or modify individual QR code modules.[49] While the countries with existing QR health codes generally secure and encrypt the data collected[50] and public venue posters containing QR codes are not readily replaceable by malignant actors, because anonymized data can still be traced back to users via a few identifiers and linking other publicly available databases, there is always room for more caution and privacy-by-design.[51]
Ultimately, transferability determines whether China’s QR health code can be exported to other nations. Although China is singular in several respects that could have facilitated its expedient implementation of the QR health code—its position as the world’s biggest smartphone market, the ubiquity of WeChat and Alipay, the powerful one-party state,[52] and the lack of mandatory privacy laws, Australia, Singapore, and the U.K. have illustrated that the QR health code model can thrive abroad as a powerful tool to combat COVID-19.
IV. Conclusion: Synthesis and Forward-Looking Recommendations
Overall, the QR health code largely satisfies (either in China or elsewhere), or at least has the potential to satisfy, the legality, necessity, proportionality, accuracy, transparency, privacy safeguards, and transferability criteria. Although imperfect in the original form launched in China, the QR health code system is promising as health certificates that can help the world eventually return to pre-COVID-19 normalcy. Meanwhile, the seven criteria should remain essential reminders of core values, including privacy and fairness, that even a public health emergency should not compromise in current and future pandemic responses alike.
As computer science and legal experts collaborate to explore further ways to enhance existing QR health codes for potentially broader international application, one can be optimistic that a version 2.0 of the QR health code system can better incorporate the criteria we have explored.
[1]. This article was written in December 2020. Due to the fast-evolving nature of this issue, there might have been further developments during the editing process that this article does not seek to cover.
[2]. See, e.g., Coronavirus World Map: Tracking the Global Outbreak, N.Y. Times (last accessed Dec. 5, 2020), https://www.nytimes.com/interactive/2020/world/coronavirus-maps.html. While cases keep growing at alarming rates in countries such as the United States, for months now, China has consistently reported (near-)zero increase in cases.
[3]. See 健康码 (Health Code), Baidu Baike, https://baike.baidu.com/item/%... (in Chinese); Don Weinland, China’s Covid-19 QR code surveillance state, Fin. Times (May 7, 2020), https://www.ft.com/content/eee43c3e-8f7c-11ea-9b25-c36e3584cda8. “QR” stands for “quick response.” A. Sankara Narayanan, QR Codes and Security Solutions, 3 Int. J. Comp. Sci. & Telecomms 69, 69 (July 2012). QR codes are “two-dimensional (2D) matrix barcodes that can hold 7,089 numeric characters and 4,296 alphanumeric characters, and 1,817 kanji characters of information.” Id. “QR codes are, therefore, essentially pictographic hyperlinks that can be embedded in the physical environment.” Jason Coleman, QR Codes: What Are They and Why Should You Care?, Kansas Library Association College and University Libraries Section Proceedings: Vol. 1, Art. 3 (2011).
[4]. Regulating Electronic Means to Fight the Spread of COVID-19, The Library of Congress (last accessed Dec. 5, 2020), https://www.loc.gov/law/help/coronavirus-apps/china.php; Nicolás Rivero, It took a pandemic to make QR codes a global sensation, Quartz (Oct. 15, 2020), https://qz.com/1917661/qr-codes-are-finally-having-their-moment-because-of-covid-19/.
[5]. Id. From personal experience registering for the mini app, one usually also needs to upload a selfie, as part of the verification process involves facial recognition technology.
[6]. Id.
[7]. There has been much discussion on the idea of “immunity passports” for COVID-19, partly because (1) as of late-November 2020, COVID-19 vaccines were not yet available in most parts of the world and (2) antibody tests are not necessarily accurate: it appears that a COVID-19 patient can get infected again. Proving immunity to COVID-19 is challenging, if not impossible, at this point, and raises many fairness/discrimination concerns, e.g. marginalized communities have less opportunity to be tested for the virus. “Immunity passports” in the context of COVID-19: Scientific Brief, World Health Org. (Apr. 24, 2020), https://www.who.int/news-room/commentaries/detail/immunity-passports-in-the-context-of-covid-19. Historically, countries have had immunity passports based on vaccinations for diseases such as yellow fever. See, e.g., Seema Mohapatra, Why COVID-19 immunity passports may violate US law, The Conversation (May 27, 2020), https://theconversation.com/why-covid-19-immunity-passports-may-violate-us-law-138165. It is important to distinguish the QR code as health certificates idea, which I propose in this paper, from that of immunity passports: health certificates merely show that a person is healthy, and does not show immunity, and thus does not require proof of COVID-19 antibody or vaccination.
[8]. See Weinland, supra note 3; see also How China is Using QR Codes to Detect and Stop Coronavirus, QR Code Generator Blog (Jun. 2, 2020), https://www.qr-code-generator.com/blog/qr-codes-coronavirus-china/.
[9]. Regulating Electronic Means to Fight the Spread of COVID-19, supra note 4; 健康码 (Health Code), supra note 3.
[10]. See, e.g., Ariel Bogle, Will the Government’s coronavirus app COVIDSafe keep your data secure? Here's what the experts say, ABC Science (Apr. 27, 2020), https://www.abc.net.au/news/science/2020-04-27/covidsafe-contact-tracing-app-coronavirus-privacy-security/12186044; SafeEntry, GoBusiness COVID: A Singapore Government Agency Website (last accessed Dec. 5, 2020), https://covid.gobusiness.gov.sg/faq/safeentry; Alicia Wee et al., AI and Data Use: Surveillance Technology and Community Disquiet in the Age of COVID-19, https://ssrn.com/abstract=3715... (forthcoming); see also International Monitor: Public Health Identity Systems, Ada lovelace Institute (last accessed Dec. 5, 2020), https://www.adalovelaceinstitu... (noting, for example, that Estonia also applies QR technology in coping with the COVID-19 pandemic: “After logging in and authenticating via their state-issued Estonian ID, the user can get information about their test results from a database. They can then share that information via a QR code. The QR code expires after a minute and access to data from that code after an hour.”).
[11]. Ben Westcott, China’s Xi Jinping is pushing for a global Covid QR code. He may struggle to convince the world, CNN (Nov. 23, 2020), https://www.cnn.com/2020/11/23/asia/china-xi-qr-code-coronavirus-intl-hnk/index.html.
[12]. See, e.g., Covid-19: China pushes for QR code based global travel system, BBC News (Nov. 23, 2020), https://www.bbc.com/news/busin... (noting that the executive director of Human Rights Watch Kenneth Roth expressed caution over Xi’s proposal, calling China’s promotion of its QR technology a potential “Trojan Horse for broader political monitoring and exclusion.”).
[13]. See, e.g., Paul Mozur et al., In Coronavirus Fight, China Gives Citizens a Color Code, With Red Flags, N.Y. Times (Mar. 1, 2020), https://www.nytimes.com/2020/03/01/business/china-coronavirus-surveillance.html; China is fighting COVID-19 with a QR code, but is everyone on board?, CGTN (Jul. 9, 2020), https://news.cgtn.com/news/2020-07-09/China-is-fighting-COVID-19-with-a-QR-code-but-is-everyone-on-board--RYJ0O70jSM/index.html.
[14]. Elizabeth M. Renieris, When Privacy Meets a Pandemic, OneZero (Mar. 24, 2020), https://onezero.medium.com/when-privacy-meets-pandemic-fbf9154f80b3.
[15]. Elizabeth M. Renieris, The Dangers of Blockchain-Enabled “Immunity Passports” for COVID-19: A Legal, Public Health, and Technical Perspective, Medium: Berkman Klein Center (May 18, 2020), https://medium.com/berkman-kle... (referring to Haaretz, Coronavirus in Israel: Number of Recoveries Surpasses Active Cases, Haaretz (Apr. 30, 2020); EU EDPS, Online Webinar on COVID-19 Contact Tracing Applications (Apr. 24, 2020)).
[16]. Id. The “advance notice” part is tied to the transparency criterion, which seeks to avoid black box problems.
[17]. For this reason, evaluating the QR health code system using legality as a criterion can be complex and somewhat unsatisfying, which is why we use it in conjunction with several other criteria.
[18]. See Regulating Electronic Means to Fight the Spread of COVID-19, supra note 4. For instance, “[i]llegally selling or providing to others location tracking data is criminally punishable under the PRC Criminal Law. The Law itself does not specify the scope of the personal data to be protected.” Id.
[19]. National Guidelines for Personal Health Information Codes Released and Implemented, China Electronics Standardization Institute (Apr. 30, 2020), https://perma.cc/GZ2J-2974 (in Chinese).
[20]. Id.
[21]. Frequently Asked Questions on Personal National Guidelines for Personal Health Information Codes, China Electronics Standardization Institute (May 7, 2020), https://perma.cc/7SCE-CSB3 (in Chinese).
[22]. See Kobbi Nissim et al., Bridging the Gap Between Computer Science and Legal Approaches to Privacy, 31 Harv. J. Law & Tech. 687, 707 (2018). In the public health / medical context, the Health Insurance Portability and Accountability Act (HIPAA) is most relevant as America’s primary health privacy law; it punishes any covered entity that knowingly discloses another person’s “individually identifiable health information.” See Health Insurance Portability and Accountability Act Privacy Rule, 45 C.F.R. pt. 160, §§ 164.102−106, 500−534 (2017) (protecting “individually identifiable health information”); Casey Ross, After 9/11, we gave up privacy for security. Will we make the same trade-off after Covid-19?, StatNews (Apr. 8, 2020), https://www.statnews.com/2020/.... HIPAA’s privacy rule provides a safe harbor, by which “data can be shared widely once all information from a list of eighteen categories of information have been removed.” Nissim et al., supra note 22 (noting that HIPAA’s safe harbor standard creates ambiguity by requiring that the entity releasing the data “not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information). Out of these eighteen categories, quite a few are part of China’s QR health code registration survey: name, address, ID number (which is similar to social security numbers in the U.S.), and “photographic image.” See 18 HIPAA Identifiers, Loyola Univ. Chicago, https://www.luc.edu/its/abouti.... These elements have been central to China’s QR health code success because these information all contribute to the government’s ability to not only verify individuals’ identities, but also speedily go through the contact tracing process. Here, however, the HIPAA’s applicability is questionable, as the government presumably would not want to disseminate the information collected from QR health codes, should the U.S. choose to adopt a QR health code system that is similar to China’s; instead, the government would likely limit itself to using the data for specific purposes of coping with the COVID-19 pandemic.
[23]. Renieris, supra note 15.
[24]. Id.
[25]. Wee et al., supra note 10.
[26]. Id.; see also Government of South Australia, COVID SAfe Check-In, SA Gov.org (last accessed Dec. 5, 2020), https://www.covid-19.sa.gov.au....
[27]. See, e.g., Coronavirus World Map: Tracking the Global Outbreak, supra note 2.
[28]. See, e.g., Zoey Zhang, China’s Travel Restrictions due to COVID-19: An Explainer, China Briefing (Sep. 23, 2020), https://www.china-briefing.com....
[29]. Id. Granted, one can contend that the QR health code system is designed for areas that are returning to normalcy from COVID-19 infections, instead of for preventative purposes. Nevertheless, playing devil’s advocate with the word “necessity,” I do not consider it absolutely necessary to have QR health codes in place in that sense.
[30]. Still, it is debatable how necessary each piece of information China collects with the QR health code regime is to protect public health and safety. China’s mini app does seem to collect some more information than South Australia’s app, which only collects users’ name and mobile phone number. Malcolm Sutton, Data gathering capped as centralised QR check-in system launches in South Australia, ABC Radio Adelaide (Dec. 3, 2020), https://www.abc.net.au/news/20.... By contrast, Xi’an Province’s version of the QR code requires one to enter additional information such as birth city and age; these are likely not “necessary” information required for public health objectives. Tautvile Daugelaite, China’s health code system shows the cost of controlling coronavirus, Wired (Jul. 17, 2020), https://www.wired.co.uk/articl....
[31]. Everything you need to know about the “Right to be forgotten,” GDPR.EU, https://gdpr.eu/right-to-be-fo....
[32]. Natalie Kofler, Ten reasons why immunity passports are a bad idea, Nature (May 21, 2020), https://www.nature.com/article.... But see China is fighting COVID-19 with a QR code, but is everyone on board?, supra note 13 (“A Beijing official insisted that data collection via the app is solely for . . . pandemic control. ‘After 24 hours, the database will expire automatically . . . We are minimizing the data collecting process and (protecting residents’) privacy.’” ).
[33]. QR codes are being rolled out in venues across South Australia — here’s what you need to know, ABC (Dec. 2, 2020), https://www.abc.net.au/news/20....
[34]. Mozur et al., supra note 13. The article highlighted privacy issues associated with China’s QR health code system, e.g. “[w]hile Chinese internet companies often share data with the government, the process is rarely so direct. In the United States, it would be akin to the Centers for Disease Control and Prevention using apps from Amazon and Facebook to track the coronavirus, then quietly sharing user information with the local sheriff’s office.”
[35]. Chris Hicks et al., The privacy implications of venue check-in for COVID-19, (Oct. 8, 2020), >span class="Hyperlink0">https://www.turing.ac.uk/blog/....
[36]. AB-2004 Medical test results: verification credentials, California Legislative Information, https://leginfo.legislature.ca....
[37]. Adam Schwartz, No to California Bill on Verified Credentials of COVID-19 Test Results, EFF (May 20, 2020), https://www.eff.org/deeplinks/....
[38]. AB-2004 Medical test results: verification credentials, supra note 37 (e.g. “Cryptography-based verifiable credential models, such as the Verifiable Credentials Data Model . . . show great promise for providing privacy-protective, secure, and portable avenues to communicate sensitive health information.”).
[39]. See Weinland, supra note 3.
[40]. Schwartz, supra note 38.
[41]. For instance, in India, home to approximately 18% of the global population, only 24% of all adults report owning a smartphone. India Population 2020 (Live), World Population Rev., https://worldpopulationreview....; Tiantian Wang et al., The impact of health QR code system on older people in China during the COVID-19 outbreak, Age & Aging (2020), https://academic.oup.com/agein....
[42]. Shouduzhichaung, “健康宝”上线新功能 老人儿童出行添方便, NetEase (Nov. 21, 2020), https://dy.163.com/article/FRV... (in Chinese).
[43]. QR codes are being rolled out in venues across South Australia, supra note 34.
[44]. Accord Selbst et al., Fairness and Abstraction in Sociotechnical System, https://ssrn.com/abstract=3265... (critiquing the “solutionism trap").
[45]. See Mozur et al., supra note 13; 2. Understanding the Chain of Infection, ATrain Education, https://www.atrainceu.com/cont....
[46]. Regulating Electronic Means to Fight the Spread of COVID-19, supra note 4.
[47]. See, e.g., Cynthia Rudin, Algorithms and Justice: Scrapping the “Black Box,” (2018), >span class="Hyperlink2">http://www.thealiadviser.org/s....
[48]. Privacy Considerations For COVID-19 Digital Contact Tracing, National L. Rev. (Sep. 29, 2020), https://www.natlawreview.com/a.... The Singaporean government explained SafeEntry’s privacy implications clearly at https://covid.gobusiness.gov.s....
[49]. Narayanan, supra note 3; Katharina Krombholz et al., QR Code Security: A Survey of Attacks and Challenges for Usable Security, in: Tryfonas T., Askoxylakis I. (eds) Human Aspects of Information Security, Privacy, and Trust, Lecture Notes in Computer Science, vol 8533 (2014).
[50]. See, e.g., QR codes are being rolled out in venues across South Australia, supra note 34.
[51]. See, e.g., Lee A. Bygrave, Data Protection by Design and by Default: Deciphering the EU's Legislative Requirements, 4 Oslo L. Rev. 106 (2017).
[52]. In general, governance structure is a topic that is worthy of deeper exploration with regards to QR health code systems. Contrast China’s government structure with that of the U.S.; under America’s federalism principle, the question of “who decides” is much more complicated: states or the federal government, more centralization or decentralization . . . ? For further reading on this topic, see generally James D. Holt et al., Legal Considerations, CDC Epidemic Intelligence Service, https://www.cdc.gov/eis/field-... (“A state’s authority to protect public health—often included in the authorities referred to as ‘police powers’—is extensive”); Henry T. Greely, COVID-19 immunity certificates: science, ethics, policy, and law, 7 J. L. Biosciences, https://academic.oup.com/jlb/a.... Even within China, the stereotypical authoritarian state with centralized government control, the QR health code started in Hangzhou and gradually expanded nationwide, first on the provincial, rather than national/central government, level. Coordination and mutual recognition took some time to achieve. See Sina Finance, “为什么总要刷不同的健康码？这背后有一张复杂的大网” (Why the Different Health Codes? There is a complex web behind the scenes), Baidu Baijiahao (Apr. 4, 2020), https://baijiahao.baidu.com/s?... (in Chinese).