key: cord-0056881-91yima9z authors: Kui, Shen title: The Stumbling Balance between Public Health and Privacy amid the Pandemic in China date: 2021-02-01 journal: nan DOI: 10.1093/cjcl/cxaa035 sha: 10b95d67e4d44c46be46c64b7643fd75d18453b1 doc_id: 56881 cord_uid: 91yima9z In China, to fight against COVID-19, a variety of high- and low-tech methods have been created and applied to find and monitor people confirmed or suspected to have COVID-19 and their close contacts. Such mass monitoring may have the effect of containing and managing the pandemic, but it has brought about prevalent concerns of privacy. Undoubtedly, China is confronted with fulfilling the task of public health surveillance while, at the same time, protecting personal privacy. However, there are three factors that have caused these balancing efforts to falter. The first factor is the lack of strong and solid legal foundations to authorize and control the surveillance while giving sufficient support for personal privacy. The second factor is the huge social mobilization that entails the involvement of a large number of different entities and individuals in the mass surveillance, for whom the general principles of privacy protection proposed by public authorities and academia may not be well understood and/or may be difficult to follow in practice. The third factor is the collectivist thinking and obedience to, and in many cases reverence for, the authority that is deeply entrenched in Chinese culture and easily overwhelms the individualism-oriented modern privacy culture. To get rid of these handicaps in a short time and, hence, to strengthen privacy would be an extravagant hope. However, a landmark piece of legislation on privacy and personal information protection and other supporting regulations in the near future are what we need most. In any event, the current surveillance should not be a ‘new normal’. On 27 January 2020, only three days after the lockdown of Wuhan, the epicentre of the COVID-19 outbreak, a meeting on using big data in epidemic prevention and control was convened by the Ministry of Industry and Information * Shen Kui, Professor, Peking University Law School, 5 Yiheyuan Road, Haidian District, Beijing, China, 100871; Email: shenkui@pku.edu.cn. This article has benefited greatly from the comments of William Rosoff and Yue Hou. I am also grateful to my doctoral student Yishan Man for research assistance. Technology in Beijing. 1 Since then, a variety of high-and low-tech methods have been created and applied to find and monitor people confirmed or suspected to have COVID-19 and their close contacts. These methods are expected to continue for an uncertain amount of time until the end of the pandemic. The automated monitoring based on artificial intelligence technology is widely deployed, in particular, in a number of public places such as subways, railway stations, airports, shopping malls, grocery stores, social service centres, and so on in order to detect and control potential risks. 2 Personal information concerning identity, health, and a person's whereabouts is deemed an extremely important factor in making decisions on quarantine, isolation, or treatment. 3 In an 'age of big data', it seems both necessary and appropriate to use the big data technology to gather and process personal data that is helpful for the private/public decision-makers in this pandemic crisis. The effectiveness of such mass monitoring to contain and manage the pandemic may continue to be controversial. 4 A number of places where similar tracking technology has been adopted-for instance, Singapore, 5 South Korea, 6 Israel, 7 Taiwan, 8 the concern over personal data or privacy protection has been hovering over this deployment of new technologies. 10 Heightened fear of the pervasive and invisible intrusion into everyone's privacy by the State or public authorities, or any other data controllers, has emerged from these new tracing policies, particularly if the new watching system designed to handle the novel virus is incorporated into the already existing surveillance system. At the policy-making level, public authorities in China have also demonstrated deep concern about the issue of privacy. For example, in a notice promulgated on 4 February 2020 by the Office of the Central Cyberspace Affairs Commission, a top agency in charge of cyberspace security, principles of notice consent, data minimization, purpose limitation, security, and accountability are clearly stipulated and emphasized, notwithstanding that tech enterprises are encouraged to use big data to analyse and predict the flow of people confirmed or suspected of having COVID-19 and their close contacts, providing support for joint prevention and control. 11 However, this policy cannot totally prevent the sporadic infringements of personal privacy, no matter how strong the will of the policy-makers may appear. In social media, such as MicroBlog or WeChat, the name, identification number, itinerary, location, and other personal information of some people with the infection, suspected of having the infection, or with Wuhan contact history were, at one time, disclosed and circulated. These leaks have brought about stigmatization, discrimination, segregation, and other harsh treatment. 12 Undoubtedly, because of the allure and usefulness of these new technologies, China is confronted, on the one hand, with fulfilling the task of public health surveillance-an age-old mission in human history-while, on the other hand, with protecting personal privacy in modern society. 13 To date, China seems to have been stumbling in its efforts to find the right balance. In this unprecedented pandemic, many countries are dealing with the tension between disease control and privacy. In this article, I want to discuss three factors that may be said to have very Chinese characteristics and can help explain why, in my view, it is much harder for China to find and maintain an uncontroversial balance. 10 See notes 4À9 above; see also Liza Lin, 'China's Plan to Make Permanent Health Tracking on Smartphones Stirs Concern' Wall Street Journal (New York, 25 May 2020) accessed 5 October 2020. 11 The first factor concerns the legal basis for such sweeping surveillance and the broad collecting and processing of the personal information that it entails. The starting point for this discussion is the Law on Prevention and Treatment of Infectious Diseases (Chuanranbing Fangzhifa) (LPTID). 14 It contains no specific provisions for using and protecting personal information to control the spread of infectious diseases. Nor does China have a general law specifically protecting personal information or privacy. The National People's Congress and its Standing Committee, the central government departments, and local governments have made some laws and regulations in different sections or areas to fill in this legal vacuum. The development of personal information and privacy laws has had many positive impacts. More and more Chinese people accept the modern idea of privacy and pay much more attention to their rights to privacy and personal information. Governments at different levels, particularly the central government departments, are increasingly aware of the importance of privacy and personal information. This is why some departments have issued documents concerning the protection of privacy and personal information amid the surveillance adopted in reaction to the pandemic. But the dispersed and unsystematic regulations inevitably contain many legal holes. It has thus been a major challenge for the public authorities, lacking any clear legal basis, to encourage or require many entities and individuals to collect and process personal information while, at the same time, protecting privacy. Different proposals have been raised to deal with this problem, reflecting the serious efforts of policymakers and assisting experts and scholars to find a line consistent with the rule-oflaw principle, but no satisfactory proposal has been found. The second factor concerns the problems caused by the huge social mobilization underlying the tracking system. It is said that the success of China in slowing down the spread of COVID-19 from Wuhan to other populated parts of the country owes a lot to this social mobilization. Nevertheless, the mobilization entailed the involvement of a large number of different entities and individuals in mass surveillance-entities and individuals for whom the general principles of privacy protection proposed by public authorities and academia may not be well understood and/or may be difficult to follow in practice. The third factor concerns the role that specific Chinese culture and history may play in mass surveillance. In recent years, China has been learning a great deal about the privacy law of the European Union (EU) and the USA, and the legal developments in this area rely mostly on the importation of ideas and norms. A modern privacy culture has been growing. But, for a total population of 1.4 billion, with at least one-half living in the countryside, the individualism-oriented Western concept of privacy is still a somewhat alien concept. Managing privacy protection in China involves trying to manage a foreign standard against a specific, different, cultural background. This background can be traced back to Confucianism and Buddhism, which tend to promote collectivist thinking and obedience to, and, in many cases, reverence for, authority. Particularly in a crisis, such as a pandemic, where 14 government leadership and action is seen as essential in dealing with the emergency, a newborn culture of individual privacy may easily yield and revert to entrenched traditional cultural norms. The cultural factor is not to justify the extremely insufficient protection of privacy and personal information but, rather, to explain why there have not been strong protests or dissents against the massive surveillance that has jeopardized people's privacy. Legal construction of privacy law has been written into the legislative plan of the 13th National People's Congress (NPC) Standing Committee. 20 Two influential drafts of the law written separately by some NPC deputies and scholars have been circulated online. 21 Parallel to the hatching of a general law, some laws, regulations, and guidelines in different specific sections address the issue of personal information. The LPTID has been applied most often to tackle a good deal of issues in the pandemic, including, but not limited to, the issue of using and protecting personal information/data. However, the lawmakers obviously did not want to spend too much time on how to protect personal privacy. So the result is that it only requires that: [a]ll entities and individuals within the territory of the People's Republic of China shall accept the preventive and control measures taken by disease prevention and control institutions and medical agencies for investigation, testing, collection of samples of infectious diseases and isolated treatment of such diseases, and they shall provide truthful information about the diseases. Disease prevention and control institutions and medical agencies shall not divulge any information or materials relating to personal privacy (Article 12). Only the personal information attached to the resident identification card is addressed by this law, which provides two brief articles on the protection of personal information: 'Public security organs and people's police shall keep confidential citizen's personal information gained through making, issuing, examining or seizing resident identity cards' (Article 6), and '[e]ntities and their staff members shall keep confidential citizens' personal information recorded on their resident identity card as acquired in the course of performing duties or rendering services' (Article 13). 22 This law provides several articles on collecting, storing, and using personal information, the information subjects' right to consent, deletion and correction, the 20 accountability of confidentiality, and so on. 23 But it only applies to network operators, including the operators of the government affairs network. It does not impose these requirements on the public authorities, quasi-governmental organizations, private entities, and individuals that may engage in the collection and processing of personal information. General Provisions of the Civil Law (Minfa Zongze) (GPCL) The GPCL stipulates the basic principles and general provisions of civil activities. The principles in regard to personal information are written into Article 111: The personal information of a natural person shall be protected by law. Any organization or individual needing to obtain the personal information of other persons shall legally obtain and ensure the security of such information, and shall not illegally collect, use, process, or transmit the personal information of other persons, nor illegally buy, sell, provide, or publish the personal information of other persons. 24 This very principled stipulation is nothing more than a proclamation. Furthermore, the GPCL applies only to civil activities, not the mandatory measures taken by public institutions. This rule was made by the Ministry of Industry and Information Technology almost seven years earlier and requires only the telecommunication service operators and Internet information service providers to follow some basic rules of collection, use, and security protection. 25 Some State Council departments are increasingly aware of the importance of both using and protecting the personal information/data in an era of globalization and digitalization. They successively have published a number of nonmandatory standards and guidelines along with the above laws and regulations, which have legally binding effects. To name a few: the Information Security All of these documents together give much more detailed norms than those provided by the laws and regulations. International, regional, or foreign standards and norms are taken into consideration by the writers. 29 Given the lack of an omnibus law of personal information or privacy as mentioned above, as well as the endorsement of the public authorities, the recommended standards and guidelines have gained some authority among enterprises. 30 But they do not have a legally binding effect. Understandably, a country should pursue a dispersive and accumulative strategy to develop a complicated legal system governing the use and protection of personal information/data, gradually finding the fine balance between public good and privacy concerns in different contexts and circumstances. After all, learning something new takes time. In normal circumstances, for the most populated country in the world, the time necessary to assimilate a non-native legal system and its underlying values and concepts would likely be long. However, the pandemic has abruptly shed light on the shortcomings of this strategy, particularly against the background movement towards the rule of law in China. In light of the crisis, there has been an urgent need to gather and process a huge amount of personal information. This need was recognized not just by political officials but also by the medical community as well. For example, Dr Li Lanjuan, a nationally known epidemiologist, the academician of the Chinese Academy of Engineering, and a member of a high-level expert group of the National Health Commission (NHC), told the media that big data technology can prevent and control the spread of the epidemic by accurately locating the transmission path of the epidemic, tracking the movement trajectory, and establishing the individual relationship maps. 31 But for this surveillance of almost every person's health and movements, what is the clear and specific legal basis? The policy-makers and experts, who have played a role in the policy-making process, were not unaware of the challenge. They realized this issue should be treated carefully to legitimize the needed surveillance. Experts specializing in public administration or law have adopted at least four approaches to squarely deal with the issue of articulating a legal basis for the widespread surveillance. One is a very broad interpretation (the 'broad interpretation' approach) of the current laws and regulations. It says that, in the prevention and control of contagion, governments, public health departments, and other agencies are required to release 'early warning information' and 'emergency information', which can certainly be understood as including personal information, like the health, location, and workplace of people confirmed or suspected to have the coronavirus and their close contacts. To engage in the 'management of flowing population' and monitor 'key groups, key places and key links' inevitably involves the collection, analysis, and processing of a large amount of personal information. The bottom line is only 'not to deliberately leak' the information. 32 Another approach (the 'differentiation' approach) is to differentiate personal information and personal privacy. One law professor from the Law School of Beijing Normal University has stated the view that a mistaken conception of privacy is equating personal information with personal privacy. Privacy should be the personal information that is directly related not to social interests and public interests but, rather, to personal reputation and dignity. Using personal information to effectively track the epidemic is to protect the public interest and does not involve personal privacy. Only the subsequent abuse of personal information would harm personal privacy. 33 The third approach (the 'prevention-and-control-of-epidemic-first' approach), proposed by a famous specialist in public administration and e-government, is to prioritize the prevention and control of the epidemic over privacy concerns. It recognizes that the absence of a uniform personal information protection law and sufficiently detailed standards and norms of personal information protection 31 Li and Sicong (n 1). 32 Yu'an and Xiaomin (n 12). 33 Li and Sicong (n 1). has caused a small number of personal information abuses. Although the use of big data and privacy concerns should be balanced, the prevention and control of infectious disease is the first consideration or priority. 34 The last approach (the 'resort-to-principles' approach) agrees that China already has some laws and regulations for establishing the legal framework of personal information protection in line with international practices. But they are scattered and unsystematic and lack operability because of their abstract generality. Therefore, China needs a uniform law to put an end to the situation of 'nine dragons separately tackling the flood' (jiulong zhishui). 35 For now, however, in the abnormal time of the pandemic, personal data should be protected by taking into consideration five major principles that are implied in the current laws and regulations and learned from the EU's GDPR and the fair information practices of the USA. 36 The broad interpretation approach would obviously evoke considerable concern about the sweeping discretion exercised by the policy-makers. The differentiation approach not only evades the legal basis issue but also ignores the idea that the use of personal information/data itself, even if not abused, could constitute an invasion of privacy. For instance, though taking a picture of an individual who appears upon the public highway or in any other public place does not invade privacy, 37 it may be very hard for a person to accept that some institutions or individuals can ascertain his or her whereabouts by processing the personal data without his or her consent or awareness, even if the result is not published. The prevention-and-control-of-epidemic-first approach is the same as the differentiation approach in terms of circumventing the legal basis issue and implies a deeply rooted conception that efficiency prevails over the rule of law. The resort-to-principles approach is trying to stick to the rule of law, but, in practice, it would meet the application challenges incurred by the mobilization strategy in fighting against the pandemic, which will be discussed in the next section. Whatever problems these approaches may have, there is no doubt that they reflect the struggling efforts to uncover and explore their legal basis in an immature legal system of personal information/data/privacy and to legitimize the expanding surveillance with the concomitant high risk of privacy invasion during or even after the pandemic in China. On the one hand, it may be the evidence that the conceptions of the rule of law and privacy, as a result of more than 40 years of reform and opening and 40 years of development of scattered laws and regulations in the field of privacy, are playing some kind of constraining role on policy-makers. On the other hand, the lack of a strong general legal framework of privacy and personal information protection makes the knowledgeable elites feel overstretched to find the legitimate basis for a sweeping surveillance that risks invading individual's privacy and personal information. It also 34 Ibid. 35 It is a Chinese idiom that usually refers to a situation in which different actors deal with one problem, often causing chaos and mess. causes great tension between guarding privacy and personal information and fighting the coronavirus with an enormous social mobilization. What are the general principles? The resort-to-principles approach has not remained simply a policy proposal by legal scholars; it has been adopted by public authorities in this epidemic. Though standards and guidelines of personal information/data protection published before the epidemic outbreak provide very detailed and workable specifications, they are, after all, just advisory norms without legally binding effects. They have obtained a certain amount of respect from some Internet enterprises. But this does not mean that all of the entities and individuals involved in the surveillance will necessarily comply with them. To make mandatory requirements clear, some agencies have written a few principles of privacy protection into their administrative normative documents (xingzheng guifanxing wenjian) related to epidemic control. For example, the Urgent Notice of the Ministry of Transport on the Coordination of Epidemic Prevention and Control and Transport Security Work (Jiaotong Yunshubu Guanyu Tongchou Zuohao Yiqing Fangkong he Jiaotong Yunshu Baozhang Gongzuo de Jinji Tongzhi) 38 commands that: [w]hile collecting passengers' information according to law, no discriminatory policies shall be adopted for passengers from some regions. The privacy of individuals and the security of personal information shall be strictly protected following the law, and except for providing passenger information to health departments for the need of epidemic prevention and control, the relevant information shall not be disclosed to other organizations or individuals, and shall not be disseminated on the Internet. Among the administrative normative documents, the Notice of the Office of the Central Cyberspace Affairs Commission on the Protection of Personal Information and the Use of Big Data to Support Joint Prevention and Control (OCCAC Notice) 39 stipulates the most comprehensive principles regarding personal information protection, listed in the following sections. In addition to institutions authorized by the NHC under the Cybersecurity Law, the LPTID, and the Regulation on Responses to Public Health Emergencies 38 Issued and effective on 29 January 2020 accessed 5 October 2020. 39 See note 11 above. (RRPHE) (Tufa Gongong Weisheng Shijian Yingji Tiaoli), 40 no other entity or individual shall collect personal information in the name of epidemic prevention and control without the consent of information subjects. The collection of personal information necessary for joint prevention and control shall take into consideration the national standard Personal Information Security Specifications, adhere to the principle of minimum scope, and be limited to people confirmed or suspected of having COVID-19 and their close contacts. Generally, the collection shall not be targeted at all by the people in a specific region, to prevent de facto discrimination against the population from that specific region. Personal information collected shall not be used for other purposes. Without the consent of the information subjects, no entity or individual shall disclose personal information such as name, age, identification card number, telephone number, home address, and so on, except for joint prevention and control under the condition of desensitization of the information. Any work unit (danwei) that collects or holds personal information shall be responsible for the security and protection of personal information and shall take strict management and technical measures to prevent it from being stolen or disclosed. The cyberspace administration shall, in accordance with the Cybersecurity Law, promptly handle the illegal collection, use, and disclosure of personal information as well as incidents of mass leakage of personal information. Public security organs shall punish severely the crimes involved. In China, the OCCAC Notice is surely not a law (falu), regulation (fagui), or rule (guizhang) that has legal effects according to the Legislation Law. 41 But to enact such legislation in the unexpected epidemic outbreak is impossible' in China because of the cumbersome process of law-making. It may be controversial whether the OCCAC Notice has the power to issue these principles about the right to privacy, which is generally viewed as a basic constitutional right and should arguably be addressed by law (falu). Regardless of this, the Notice, as an administrative normative document, is a bit more authoritative than the recommended standards and guidelines. If these principles, apparently modelling international norms, could be implemented thoroughly, personal privacy might well be protected at large. However, the application of these general principles unfortunately collides with the huge social mobilization that has taken place. Unquestionably, China has called up a huge number of commercial and social actors to help control the potential risks of the epidemic spreading. 42 The reliance on this social mobilization is regarded by Dr Zhang Wenhong, another famous epidemiologist, as one of China's most successful experiences in the war against the epidemic. 43 Whether this plausible argument stands is not to be explored here. As for the issue at hand, the widespread mobilization and ubiquity of information collectors and data processors, in fact, have made far more difficult the application of the general principles of personal information/data protection. There are six types of information collectors or data processors; many of them are not clearly authorized by legislation but commanded or tacitly approved by administrative agencies. The public authorities that, in accordance with the LPTID, have the explicit or implied power to collect personal information are disease prevention and control institutions (Article 12), frontier health and quarantine offices (Article 32), and health administration departments of government at different levels (Article 34). The RRPHE authorizes the State Council or provincial governments to establish headquarters to be responsible for the overall leadership of handling the national or provincial emergency (Articles 3 and 4) , which may well be indirectly interpreted as having implied power to obtain and process personal information. The sub-district offices dispatched by the district governments and the town or township governments are also granted the power to collect and report disease information by the RRPHE (Article 40 practice, the public security offices, transport institutions (for passengers' information), education institutions (for students' information), and other public institutions have also be very involved in the collection of information. Medical institutions are empowered by the LPTID (Article 12) and the RRPHE (Article 40) to collect the personal information of people confirmed or suspected to have the infectious disease and their close contacts. Technology companies here primarily include Internet technology service providers for e-commerce sites; social networking sites; search engines; navigation software, such as Tencent, Baidu, and Alibaba; and intelligence terminal companies, such as Lenovo, Huawei, and Xiaomi. As private commercial companies, they usually collect and process users' personal information based on the users' consent to their privacy policies. Throughout the pandemic, these enterprises have been encouraged by the public authorities to reinforce the use of big data to help with the prevention and control of the coronavirus. 44 In China, grassroots autonomous organizations refer to the pervasive resident committees in cities as well as villager committees in the countryside. According to the Ministry of Civil Affairs, by 2018, there were 108,000 resident committees and 542,000 villager committees across the country. 45 The RRPHE does grant these committees the power to collect epidemic information (Article 40), which could be arguably interpreted as including the personal information of people confirmed or suspected to have the infectious disease and their close contacts. 46 (Gonggong Changsuo Xinxing Guanzhuang Bingdu Ganran de Feiyan Weisheng Fanghu Zhinan). 47 It applies to public places and workplaces that are still in operation during the epidemic where people often gather together, such as hotels, shopping malls, movie theatres, swimming pools, museums, waiting rooms for buses, trains, or flights, office buildings, and so on. The document advocates that the health monitoring and the registration of visitors be strengthened in office buildings and other places. The Joint Mechanism is an interim institution set up on 20 January 2020, led by the NHC, and joined by 32 departments. 48 Such an interdepartmental coordination platform has a very high status. This document is like an orchestra baton, and managers of public places everywhere soon initiated health monitoring. Even a supermarket or snack bar may require customers to register their name, identification number, and mobile phone number at the entrance. 49 This new vocabulary appears in the Guidance for Precise and Refined Work and Service of Community in Preventing and Controlling Pneumonia Epidemic Caused by Novel Coronavirus (Xinguan Feiyan Yiqing Shequ Fangkong yu Fuwu Gongzuo Jingzhunhua Jingxihua Zhidao Fang'an), which was issued by the MCV and the NHC. 50 The actors in this mechanism include community party organizations, community autonomous organizations (including, but not limited to, the resident committees mentioned above), community health service agencies, community realty management enterprises, and community economic and social organizations. For example, in some media reports, even realty management enterprises and owners' committees were active in monitoring and collecting personal information of community residents. 51 In the difficult period before the end of the first wave of COVID-19, China chose to slowly and cautiously reopen the economy after the Lunar New Year. To avoid the risk of a massive spread in the process, the Joint Mechanism issued a notice requiring that all public and private employers shall (i) keep track of the flow of employees and conduct health management; (ii) submit a sum report daily to the local disease control departments on the health situation of employees; and (iii) strengthen the registration of people entering and leaving the workplaces. 52 This means any person who leaves home and works at the workplace shall be under the employer's strict surveillance. Sometimes the use of technology aims not to directly monitor but, rather, to serve people's desire for information. Generally speaking, people want to know the severity of the epidemic, particularly in the areas near their residence or workplace as well as among close contacts. To develop applets to meet this demand is the domain not only of public authorities but also of private developers and those desiring to use new technology. For instance, just several days after the epidemic outbreak in Wuhan, a small program was developed by a company programmer and was used widely by people to inquire whether there are confirmed cases on the same vehicle they take. 53 Later, the public authorities also provided a similar applet, suggesting it is more authoritative, reliable, and secure. 54 Whether the developers are public or private, they are the personal information/data collectors because the users need to enter their names and identification numbers. The existence of so many personal information collectors is, indeed, alarming. Why there has not been a privacy invasion of huge and catastrophic proportions is not an easy question. What can be said for sure is that it is very hard for the general principles of privacy protection to be applied and followed strictly given the number of uncontrolled and uncoordinated information gatherers. The unparalleled surveillance based on such a huge mobilization has definitely put personal privacy in great jeopardy. Invasion of privacy by this blanket surveillance is not an imaginary or theoretical fear but, rather, a reality. There are a few typical cases reported by the media, which may be the tip of the iceberg, though the iceberg has not yet turned out to be a catastrophe. 55 There have been several cases of personal information leakage that have aroused many people's concern, worry, and fear. In one case, police found five hospital staff members using mobile devices to photograph personal information in the hospital computer system, such as coronavirus pneumonia patient names, detailed addresses, work units, the family travel path, contacts, diagnosis and treatment, and so on. They then circulated the information on social media, which, like ripples, spread very fast. It stirred a kind of panic in some communities, and the lives of the patients' families were seriously affected. 56 In another case, the leakage involved the names, addresses, contact information, identification card numbers, and other personally identifiable information of more than 6,000 people. 57 The Ministry of Public Security also released a typical case in which even a kindergarten employee could obtain and leak an account of people under key monitoring for the epidemic control. 58 The motives of getting and releasing or leaking personal information may be various. Alerting family, relatives, and friends, or even the wider public is good, and selling to illegal buyers is bad. But they share one thing-that is, the violation of people's privacy. As discussed, the principle of notice and consent is not only written into recommended standards and guidelines but also re-emphasized by an authoritative document of the Joint Mechanism. However, the phenomenon of forced consent needs to be addressed. An interviewee described her story to me. After the Lunar 55 However, since the outbreak of COVID-19, public security authorities across the country have punished 1,522 people for spreading online personal information related to the epidemic control. It may well be called an outbreak of privacy invasions. See Tang New Year vacation, everyone in her institution got a notice reminding them that, in the first three days of resuming work, the realty service centre would check the 14-day travel records of all persons entering the building. The notice also attached the quick response (QR) codes provided by three big State-owned mobile operators. Once the QR code is scanned or identified by the user's mobile, there will be an applet of inquiry of travel in the epidemic. The user needs to enter the mobile number, which, in China, is bundled with the user's name and identification card number, and tick a checkbox of consent to authorize the operator to inquire about the travel data: 'If you don't consent and authorize, you'll never get the travel records, and you can show nothing to the realty service center, and you'll never be allowed to enter the building for your work'. The interviewee seemed helpless to refuse. 59 The principle of minimization in personal data collection and processing shall not be limited to the principle of minimum scope as prescribed by the OCCAC Notice. It also entails that the personal information to be collected and used shall be necessary for the purpose of collection and use, and unnecessary personal information shall not be collected or used. However, many collectors and users are not aware of, or ignore, this principle. It was reported that some realty management companies even require the information of income, blood type, and height, which the resident believed to be irrelevant and ridiculous. 60 At a press conference on 15 March 2020, a deputy director of the Beijing Center for Disease Control reported five imported cases. In all of these cases, though the names were desensitized, the information of gender, age, and domicile was also released, which the public did not need to know. 61 Desensitization is a very important method to protect the privacy of people whose information has been collected for epidemic control. If the personal information is indeed useful for helping the public or private decision-makers to reach an appropriate decision, many people would agree to its use in the public interest as long as the personal information released does not contain identifiable information. But it has apparently been difficult for the ubiquitous collectors and users to keep this in mind. For instance, among the five imported cases reported by the Beijing Center for Disease Control, one case involved a woman with the last name Wang. She was 59 The Wechat interview was on 3 May 2020. 60 Bingren Wangnushi Jiben Heshi Qingkuang) was circulated on the Internet, which included the information of Wang, her husband, her parents, and her daughter, their home address, identification number, phone number, license plate number, and workplace. They were thereafter harassed by many insulting phone calls and texts every day. Wang and her family could not trace who released the detailed information even though they knew it was the local police station that required them to provide the full information. But the police station resolutely denied any possible leakage from its staff. 62 Besides the untraceable leakage, another piece of warning to the residents around Wang's home was issued by the local public authority on its official Wechat account. It said that the patient 'has been living with her husband Cai ** and her daughter Cai ** in area B of Lincoln Park'. 63 This seemingly inconspicuous piece of information, though not revealing the full names of Wang and her family, is quite likely to constitute a 'combination of information' that can identify individuals. The most worrisome thing in enormous networked surveillance, full of innumerable monitoring eyes, combined with automation technology, may be the invisible profiling. If the profiling begins, no one knows if he or she is being profiled until the result suddenly appears before him or her. Even then, who has done the profiling, when and where and how, and who has the result in hand, may still be mysterious. This can be quite terrifying and makes people feel naked under prying eyes everywhere. A student who returned to their home approximately 300 miles away from Wuhan was shocked when a local police officer called him, saying the student was suspected of having visited the seafood market where the virus is thought to have originated. The student was then overwhelmed by calls, visits, and doctors' checks, and finally turned off his phone after he tested negative. 64 Public sentiment towards the new tracing The task of privacy protection is confronted not only with the lack of a uniform law but also with traditional Chinese culture. With the process of industrialization, modernization, urbanization, and information technology development, traditional Chinese culture, to which the concept of privacy based on Western individualism seems an alien one, 65 has been changing. Over the past 30 years, Chinese city residents have been developing a greater consciousness of privacy issues, such as preventing parents from reading personal diaries, being free from spam, and protecting their documents and other information. 66 Chinese consumers-those using credit cards and e-commerce, in particularare increasingly standing up for their privacy, 67 and Chinese 'netizens' are now more and more concerned about the use of personal information that they have 'handed over' amid the pandemic. 68 Nevertheless, does this suggest that the majority of Chinese people have a strong sense of prioritizing personal privacy over the networked surveillance for epidemic control? Due to the continuing severity of the pandemic, it is difficult to conduct a quality survey of the Chinese public sentiment towards the fast-expanding surveillance. But, out of curiosity, I used an online survey application named Questionnaire Star (Wenjuan Xing) to make a small survey among two Wechat groups. Group A was made up entirely of my graduate students, most of them employed and some of them still studying, who are between the ages of 22 and 40. They have studied or are studying law and, in particular, majoring in constitutional and administrative law or e-commerce law at Peking University. Members of Group B have various backgrounds with a wider range of ages, which cannot be identified. 69 The only thing that can be assured is that they are middle class with quite a good income and educational background. It is regrettable that my capability does not allow a survey conducted in some Wechat groups with low-income or low-education people. 70 Table 1 Matters' (12 November 2019) accessed 5 October 2020. 68 Yongguan and others (n 49); Shu (n 55). 69 To make the respondents feel as convenient and comfortable as possible in the tough time, the questionnaire does not design such fill-in items as gender, age, occupation, and professional background. 70 Public opinion research often does not reflect the views of a larger amount of the rural peasants or the migrant workers in cities. See Farrall (n 66) 1007. 71 The survey was conducted on 4À5 May 2020. The questionnaire has eight questions. Besides the five questions in the below chart, the three other questions are: 'If you know the measure, how did you first learn about it?'; 'Has your first reaction of approval or disapproval changed since then?'; 'If changed, is it from approval to disapproval or from disapproval to approval?'. The first question is of less value for analysis here, and it can been seen from the answers to the latter two questions that their design is not good enough to let the respondents clearly understand the relationship of them to the question of 'your first reaction is approval or disapproval'. So the results of these three questions are not presented here. The questionnaire is designed simply and roughly, and the scale of the respondents is too small for more systematic analysis, but the results can still be revealing. First, the majority of the respondents, including even those studying constitutional and administrative law or e-commerce law, who are supposed to be very sensitive to the privacy issue, support the use of this tracing technology. The support rate of the respondents without legal education background is strikingly close to 100 per cent. Second, the majority of the respondents do have a deep concern for privacy protection on the tracing technology. Respondents of Group A are evidently much more privacy sensitive than Group B. Third, there is undoubtedly strained tension between supporting the use of this tracing technology and the concerns about privacy. Finally, the facts that the overwhelming majority of the respondents of Group B care about the legal basis of this tracing technology and one-third of them were willing to seek the legal basis may well be viewed as reflecting an enhanced legal consciousness. For the law students graduated from or still studying at Peking University, the fact that more than half of them attempted to uncover the legal basis by themselves is a quite significant, though not very satisfactory. Cultural handicap to privacy in the pandemic? Is this rough survey result a reflection of something deeply entrenched in Chinese culture that may handicap the Western conception of privacy, on which many international or global norms of data protection, like the GDPR, are based? 72 Given the fact that China's legal framework of personal information/ data/privacy is similar to the GDPR in many aspects, 73 could the cultural factor be an explanation for the stumbling balance between surveillance for public health and an appropriate protection of privacy? Cultural perspective in scholarly research is often puzzling and difficult to ascertain. Culture is not static but in flux, 74 not a sudden change but a slow transition, and not a simultaneous transition across the whole of society but a penetrating, permeating, and pervading one. To grasp the cultural factor is like trying to capture and keep a handful of water. Furthermore, the analysis of a cultural feature, linking it to the current events, also faces the difficulty of establishing a real-not imaginary-causal thread. Still, a lot of people, including scholars, are intent on searching for the cultural roots in understanding the salient or subtle differences among nations. The cultural tradition in China-taking root, breeding, and thriving in a history of more than two thousand years in terms of Confucianism, though undergoing dramatic prima facie changes-has not lost its grip on most Chinese people's minds or behaviour. As for the issue here, although a culture of modern privacy tending towards individualism has been cultivated in the past 40 years since the policy of reform and opening up, it has not yet shaken the inclinations of collectivism and obedience to authority, which are deeply rooted in the history of Confucianism and Buddhism 75 and were later reinforced by communism and the current political regime. 76 may often be the first response to the official demand, and collectivism may sometimes be a justification or self-consolation for that obedience. These two inclinations are usually intertwined and are both easier when authority has a mandate. The modernization that has come with industrialization and urbanization has brought a dramatic change in terms of the social structure in cities, which is vastly different from the traditional one centred on family and clan in the countryside. In particular, market reform has pushed many city residents to leave the communities that were established by work units like State-owned factories or public institutions and were mostly composed of acquainted colleagues. As of now, the majority of city residents purchasing and living in the houses and apartments constructed by real estate developers are mutual strangers. Confucianism, holding on to the family and extending family ethics to empire or State, may not have the same powerful influence over the new city communities as in the past. However, its inherent tendency of collectivism and obeying authority was woven with socialist values and even strengthened by the present epidemic control strategy of bundling the individual with the community. According to the control policy, if a person is confirmed to be infected with COVID-19, the whole building or the small community surrounded by a wall where his or her apartment or house is will be closed and quarantined. 77 Thus, in some communities, residents are watching their neighbours closely. 78 And on receiving their neighbours' reports, one community service staff member even installed a steel belt with a lock on the apartment door of a student who went back home from Wuhan to prevent his relatives from visiting. The community claimed that the student's family consented to the instalment after communication and coordination. 79 In Shanghai, to guarantee that people self-quarantine at home, some communities have posted 'little red tapes' on the door frame 80 and some have installed a sensor on the door. 81 Whether a red tape or a door sensor, it is easy for others to know someone inside is in quarantine. These measures, which may fall within the traditional category of privacy invasion and intrusion, 82 were taken in some kind of 'Bentham and Foucault's panopticon' 83 without meeting strong resistance from the targeted individuals. It seems hard to explain all of these things through any other lens than a cultural one. To sacrifice individuality for the sake of collectivity, one of the core values embraced by Confucianism, may be the best footnote to the phenomena. In ancient China, people followed and obeyed the Emperor or Tianzi (the Son of Heaven), like a son to father. It was taught by Confucius. After the collapse of the Qing dynasty, the physical emperor with flesh and blood was replaced by the abstract State. But obedience to authority, to the elders in a family of consanguinity and the Son of Heaven in the whole universe in the past, and to the State in modern times, has continued as a cultural norm. Chinese people tend to follow the official demands or guidelines as long as they seem reasonable or make sense for the sake of public or State interests, except in some cases where people believe their rights and interests are being sacrificed very unjustly for an interest that is 'public' in name only. Unlike property rights, to which people understand very well that they have at least the right to compensation even if the taking by the government is legal and in the public interest, the right to privacy is one that most Chinese people do not know from where the potential harm may be, whether they can get compensation if the harm happens, and who would be responsible. Even in the eyes of some law professors, the exposure of personal information to some unknown collectors or processors is not an infringement of privacy, and the harm to privacy only happens in the abuse of that personal information/data. 84 One interesting phenomenon may be illustrative. In the COVID-19 epidemic, at the entrances of some supermarkets or snack bars or barbershops, customers are required to register their names, identification numbers, phone numbers, and temperature testing records. The information is usually handwritten in a notebook or a form, which no designated staff member takes care of, and any person subsequently entering can see or even photograph the details. When asked about this by the correspondent, one answer from a barbershop owner was that government staff would come to check the registration from time to time and the question where to hand it in was still unclear. 85 Registration on the basis of official requirement, no security measures by the collectors, no questions from, or warnings to, the customers-this is what is happening in China. It is good, and not too late, that some media reports have increasingly focused on the issue of personal information protection, and some advice is being taken into consideration, like destroying all personal information after the pandemic. But how and when? What can and should be done to prevent further privacy invasion, particularly the leakage and abuse of information? How many people would struggle to free themselves a little from the inclination to collectivism and obedience to authority and make a louder voice to call for more government attention on the issue? If more and more people would care and pay sufficient attention to the issue, there should be a way to protect privacy concerns without inhibiting the surveillance for disease control reasons that everyone seems to agree is necessary and appropriate. The cultural background elaborated upon in this article is not to give any justification for the current practice that prioritizes the infiltrating surveillance of the whereabouts of the coronavirus absolutely over the privacy and personal information, even though several central government departments proclaim overtly the importance of the latter and the police have been punishing the illegal theft, selling, and leaking of personal information. Instead, this article has tried to explain why the emerging privacy concerns among Chinese people, particularly in cities, have not resulted in great resistance, even in public opinion, to the current pervasive usage of high-or low-tech methods to collect and process personal information, whether by the public authorities, the tech enterprises, or any other individuals involved in the surveillance. The cultural perspective would be helpful to form a more sophisticated view and understanding of what is going on in China rather than a single and simple way of attributing everything to the authoritarian regime. However, as mentioned before, culture is in flux, and as Chinese people become more and more familiar with the conceptions of the rule of law and human rights, they will also be increasingly aware of the importance of privacy and personal information and the relative legal developments. For the COVID-19 pandemic, China, despite the delayed response at the beginning in Wuhan, 86 has been taking a very aggressive approach to prevent and control the spread. No matter whether this approach is appropriate or whether it is a model, the accompanying networked surveillance has evoked privacy concerns inside and outside China. Chinese governments at national and local levels also realize the privacy problems and have tried to balance public health goals and privacy. But it seems very awkward. The lack of an omnibus personal information/data law or privacy law makes the ubiquitous collection and processing of personal information a fundamental issue with respect to its legal basis. In parallel, the new tracing and surveillance system relies a great deal on a huge social mobilization, which gets innumerable actors involved. It is impossible for these actors, whether at the provincial level or grassroots level, to even understand, let alone comply rigidly with, the general principles of personal information/data protection proposed by both the authorities and academia. Furthermore, the inherent inclinations of collectivism and obedience to authority, having very deep roots in the Chinese traditional culture, also contribute to the difficulties of privacy protection. To get rid of these handicaps in a short time and, hence, to strengthen privacy would be an extravagant hope. However, there is no doubt that a landmark piece of legislation, like the Personal Information Protection Law, and other supporting regulations in the near future are what we need most. 87 Such legislation would provide more authoritative, specific, and detailed requirements for collecting, storing, and processing personal information, which could apply to every entity and individual, public or private, and could have different rules between normal conditions and an emergency like the spread of COVID-19, most characteristic of an infection without symptoms. With such legal development on privacy issues, governments and other personal information collectors and processors would have clear knowledge and understanding of how to protect the privacy of individuals and their personal information even amid a pandemic, in which a huge social mobilization is regarded as being necessary. There would be more and more Chinese people having a clear consciousness and awareness of privacy and more and more voices raising the alarm if privacy invasions happen. For Chinese governments, there would be more and more timely and sensitive responses to the keen public concern about privacy in accordance with the legal requirements. 88 In any event, the current surveillance should not be a new normal. 87 The new Civil Code was just passed by the Third Session of the 13th National People's Congress on 28 May 2020 and will be effective on 1 January 2021. It is viewed as one of few top important events in building up the rule of law in China. In the milestone law, Part IV, ch 6, totaling 8 articles, particularly addresses the issue of privacy and personal information protection. A series of principles, such as individual's right of consent, right to review, copy, correction and deletion, information processing pursuant to legality, justification and necessity, notice of purpose, means and scope of information processing, the processors' duty of information security, and so on, are provided clearly in these articles. It is truly a huge progress and, to a large extent, fills the vacuum of a general law. However, on one hand, these stipulations are still too general. On the other hand, which may be more important, as art 2 of Civil Code stipulates, the Civil Code applies to equal private relations between natural persons, legal persons and non-legal persons. It does not regulate the collecting and processing of personal information by public institutions or authorized by public institutions, except for art 1039, which imposes duty of confidentiality on the public institutions. So China still needs a specific uniform law on personal information protection that not only governs the private actors and public actors as well but also gives more workable stipulations. 88 'It is difficult to imagine that any regime, democratically elected or not, can sustain itself for very long without taking public opinion into consideration.' See Wenfang Tang, Public Opinion and Political Change in China (Stanford University Press 2005) 198. Quanli Yingdui Xinxing Guanzhuang Bingdu Ganran de Feiyan Yiqing, 32 ge Bumen Jianli Liankong Lianfang Jizhi' ['In Response to the Novel Coronavirus Pneumonia Outbreak, 32 Departments Established a Joint Prevention and Control Mechanism Jiaochu" de Geren Xinxi Quna'er Le' ['Where Did the Personal Information "Handed Over" for Fighting Epidemic Go Zhuhu Huashen Fangyi Jixianfeng' ['Owners' Committee as Epidemic Prevention Housekeeper, Residents as Epidemic Prevention Vanguard Xiaochengxu Kecha Shifou Cengyu Xinguan Feiyan Huanzhe Tongxing Miqie Jiechuzhe Celiangyi" Gongzhongban Shangxian' ['The COVID-19 Close Contact Meter Is Now Available New Imported Case from Thailand being Investigated: Thought no Need to Register if Back from Non-epidemic Countries Nominal Control? How the Imported Case Under Investigation Returned to the Gated Community in Beijing The Entire Building Is under Emergency Quarantine Assign Special Supervision Instead Want to Sneak Out During Home Quarantine? The Town Posted Anzhuang Menci' ['How Strict Is Home Quarantine in Shanghai? Come to Inform, Sign the Letter of Commitment, and Install the Door Sensor