Last week, an advisory issued by the Department of Personal Data Protection (JPDP), states that businesses are only permitted to record minimal information of persons who go to their premises. Information like names and contact numbers are usually required for contact tracing efforts during an infectious disease outbreak like the COVID-19, and businesses can choose to collect these manually or digitally.
How is this translating in real life?
As we enter the last week of the movement control order (MCO) and parts of the economy reopen with conditional MCO standard operating procedures, I have to admit I have been out and about, still adhering to safe distancing guidelines, sanitising my hands a lot, and always with a mask. Once I tried a face shield, with a mask on as well.
And I haven’t travelled far from my home base, so the farthest mall I have visited is Sunway Pyramid. Suffice to say, the two shopping malls I have visited so far do practice contact tracing and enforce safety SOPs differently.
But that can be a story for another day. I am more confused about how IOI Mall is taking down my contact details and temperature.
When done the manual way, it is simple and straightforward without any confusion. My favourite food court uses the manual method of recording details in a school exercise book, with self-temperature taking. And it works.
The digital method, requires scanning a QR code, and I think the app being used is developed by the Selangor State Government. Called SELangkah It was pretty easy to use and quite seamless as well.
After scanning the QR code and a first time registration of my name and contact number, all other visits thereafter would go smoothly. A screen would be displayed, that served as notification that they have registered my presence. And that’s it.
I actually liked the SELangkah app, because there were too many other contact tracing apps floating around, and I preferred having only one app to fulfill my contact tracing requirements, even though SELangkah likely only works within the state of Selangor.
“The Selangor State Government and its authorised personnel will have the only control to manage and safeguard personal information submitted on SELangkah. Please refer to the Privacy Statement for further details.”
Also, in the case of a COVID-19 infection,
If there is a Covid-19 case the MOH officer can check the logs and identify the premises and customers at risk of Covid-19 infection. Follow-up action will be taken immediately.
I do not like the idea of being tracked and having my whereabouts logged, but since I have to comply for public health reasons, I did not mind SELangkah because of how it worked, and how it appeared to handle my data.
Foong Cheng Leong, the Bar Council Information Technology and Cyber Laws Committee deputy chairman, had told the The Star newspaper, “The data should only be maintained by a specific department with the sole purpose of aiding the Health Ministry with contact tracing.”
The SELangkah app appeared to be ticking the checkboxes in terms of privacy.
Trouble in paradise
But after a few visits, something strange happened. A different final receipt from the usual receipt appeared to indicate my presence is registered at a business premise.
Another receipt began to appear later…
The original receipt from SELangkah app
Even though the QR code appeared to be from the SELangkah app, the receipt had looked different. In fact, the receipt for SELangkah in AEON, Puchong differerd from the receipt in another outlet.
A SELangkah receipt at another location indicates temperature of visitor.
To further confuse matters, IOI Mall decided to add another contact tracing app.
At the main entrance to the mall before visitors can enter – which app to use? How do they differ from each other? Why are there two?
Something else also happened, which prompts me to think the relevant authorities must agree on a selected list of contact tracing apps to be used, and enforce it.
A certain coffee chain outlet actually uses its own app to contact trace visitors/customers to their premise. Yes, it will record the visitors’ name, contact and temperature, but also require the visitor to log in via their Facebook page, giving the business access to more information than what JPDP stipulated.
Now that the JPDP has made their advisory publicly known, the coffee chain outlet would have to change their contact tracing app for customers to use when on their premises.
IT BYTES BACK! Says: We are all in this together. Can this for once, also mean everyone gets on the same page about what apps can be used and to enforce it among the businesses? I think if this can be done, more people would be receptive and less suspicious of our national contact tracing efforts.
