Cambodia’s “Stop COVID-19” QR code-based contact tracing app has prompted privacy and human rights concerns, but local officials have refuted the claims, saying that the app only collects users’ phone numbers and no other personal information, the Phnom Penh Post reported on Sunday.
“Stop COVID-19” was launched by the Cambodian government on February 20. It is designed to track the whereabouts of citizens to contain the spread of the pandemic. Users have to scan QR codes posted by establishments they wish to visit, and then enter their phone number to receive a six-digit code via text message, which they need to type into the app to gain permission for entry.
As of early April, nearly 170,000 public and private locations were registered with the system and their QR codes were scanned close to 15 million times, according to an update posted on Facebook by the Ministry of Post and Telecommunications.
Despite the rising adoption, Cambodia’s Ministry of Post and Telecommunications does not publish any details on data collection and protection, how the data will be used, and how long it will be stored, according to a report published by Human Rights Watch in April. “Cambodia’s QR Code system is ripe for rights abuses because it lacks privacy protections for personal data,” said Phil Robertson, deputy Asia director of the NGO.
Although health minister Mam Bunheng claims that the app doesn’t violate user privacy, the Ministry of Post and Telecommunications said that the government can track the visited locations and monitor if quarantine requirements are followed or not, the report added. Human Rights Watch considers the “Stop COVID-19” app to be problematic, as it may reveal sensitive information about users, including their identity, associations, and activities, and hence violate their privacy rights.
“These concerns are heightened by the government’s stepped-up online surveillance of Cambodians since the outset of the pandemic, putting government critics and activists at greater risk,” Robertson added.
On June 10, Hong Kong-based digital media outlet Asia Times alleged that the Chinese ambassador to Phnom Penh, Wang Wentian, met with Cambodia officials and requested access to the personal information collected through the application, citing sources familiar with the request. The report was quickly debunked by the Cambodian government. “The Ministry of Posts and Telecommunications and the Ministry of Health completely dismiss the fabrications and exaggerations of this false information that is only intended to pollute society and public opinion as well as incite people to refuse to participate in the implementation of government measures to prevent the spread of COVID-19 in Cambodia,” the official said in a statement two days later, as reported by the Phnom Penh Post.
While there is no evidence to support the accusations, public scrutiny of the contact tracing app typifies the fragmented and poor personal data protection in Southeast Asia. In mid-February, Cambodia published a decree on building a China-style internet gateway that enables the government to control and monitor internet traffic, per a Reutersreport.
“The Cambodian government should urgently develop a law on data protection and specific guidelines on protecting the right to privacy and security of data collected to apply to the QR Code system,” said Robertson.