In late February 2020, South Korea teetered on the verge of catastrophe due to a massive outbreak of COVID-19 among the members of a pseudo-Christian sect known as the Shincheonji (New World) church.1 The country found itself in second place behind China in confirmed cases of infection, reaching a peak of 909 on February 29. Since then, South Korea has implemented a number of innovative measures that successfully flattened the curve on COVID-19.
Extensive testing and effective contact tracing were crucial. The country learned from the 2015 MERS (Middle East Epidemic Syndrome) outbreak the importance of proper personal protective equipment for medical staff. Once health personnel were properly equipped, the government launched a massive testing program for the virus. As of April 27, 2020, over 600,000 people had been tested and those confirmed positive quarantined for treatment in special-care units. Thanks to aggressive testing and early treatment, the case fatality rate has remained relatively low.
South Korea has treated the COVID-19 pandemic without lockdowns, roadblocks, or immigration controls. This is only possible given a rapid and effective tracing system. Contact tracing is routinely employed by South Korean health department personnel.2 If communities fail to isolate patients effectively, rapid transmission of the disease is likely to force health departments to adopt much stricter mitigation strategies.
At an earlier stage of the COVID-19 outbreak, South Korea began manually collecting information about infections and contact. Thousands of government employees and volunteers analyzed the reports from police departments and local governments, and interviewed the patients and proxies either face-to-face or by telephone. This conventional investigative method takes time and often tends to be outstripped by events as the disease runs rampant. It is also prone to factual error and data omission. On March 16, the Ministry of Science and ICT (Information and Communication Technologies), the Ministry of Land, Infrastructure, and Transport, and the Korea Centers for Disease Control and Prevention (KCDC) announced their plans to develop an innovative digital contact tracing system. They successfully launched the COVID-19 Smart Management System (SMS) on March 26. This new system could be developed quickly because the South Korean scientific community was already in the process of constructing a smart city data hub platform. This cloud-based open data hub can combine idiosyncratic data from varied fields. For instance, new services can be generated when combining weather information and traffic data. The COVID-19 SMS enabled quarantine officials to reduce the time for tracing and testing from over 24 hours to 10 minutes.
The KCDC has access to or receives data from 28 government organizations including the National Police Agency, three major telecommunications companies, the Credit Finance Association, and 22 credit card companies. Epidemiological investigation and management usually consist of identifying the contact locality, evaluating the infection risk, classifying the contact type, and deciding how the case will be managed.3 To determine the location of the contact, authorities gather records from phone-based GPS, credit card transactions, and closed-circuit television. Visitation records of medical institutions and pharmacies are also inspected to determine the need to quarantine the medical facilities visited by the infected. The COVID-19 SMS enables epidemiological surveyors to identify transmission routes quickly and conduct real-time spatiotemporal analysis of the places visited by the infected. The platform helps health personnel reconcile interview results and systems data. Since it provides multiple data points, the system can detect incidents of cluster infection and pinpoint the origin of transmission.4
Once a person is tracked and tested positive, the KCDC informs the local health center near the patient’s residence; the local center then uploads the information to its official website and sends it out to every resident’s smartphone. A typical alert message contains the patient’s age and gender, and a detailed movement log down to the minute. Sometimes it includes the time and the names of the public facilities and businesses visited by the patient, using data collected from credit card transactions and closed-circuit television. Some local districts send out information that includes which rooms of a building the patient entered, if and when he used a toilet, and whether or not he wore a mask.5
Like most other advanced countries, South Korea has a stringent data privacy law.6 The Personal Information Protection Act enacted in 2011 prohibits collecting and disclosing personal information without prior informed consent. The 2015 MERS epidemic, however, demanded that lawmakers pass the Contagious Disease Prevention and Control Act, which authorizes officials to override certain provisions of the Personal Information Protection Act. Upon the outbreak of infectious disease, public agencies such as the Ministry of Health and Welfare and the KCDC are empowered under the auspices of Contagious Disease Prevention and Control Act to collect, analyze, and share the following data: location history, transit pass records, immigration records, closed-circuit television footage, prescription and medical records, personal identification information, and credit, debit, and prepaid card transactions.7
The COVID-19 SMS respects existing privacy regulations. Epidemiological investigators collect a minimum of data and require approval from relevant authorities to access additional data. Only the KCDC and local government officials in charge of contact investigation are granted security clearance. The platform operates on a private network to protect the system from hacking and on an interim basis, meaning that all the personal information stored in the system is deleted once the official process is complete. Operating personnel are under tight surveillance, and the entire operation is constantly monitored by computer security experts. The information disclosed to the Ministry of Health and Welfare includes the following: age, gender, nationality, and movement routes of the infected, means of transportation used by the infected, medical institutions that treated the infected, and the health status of people in contact with the infected.
Some local governments did release potentially sensitive information in the form of the names of restaurants, shops, and hotels visited. This led the National Human Rights Commission on March 9 to issue a brief that the disclosure of excessively detailed information was unwarranted in accordance with public concerns over privacy. The KCDC accepted the Commission’s recommendation and on March 14 announced a guideline to further limit the scope and detail of the information to be released. It advised that local governments disclose such detailed information only when ongoing epidemiological investigations are unable to identify all the people in contact with the infected. This amendment was made swiftly to protect not only the privacy of the infected but also the local economy.
Outside of South Korea, many other countries have opted to use contact tracing apps. Expectations have risen as Google and Apple collaborate to make the technology work more effectively. Compared to the more centralized digital contact tracing system in use in South Korea, however, the contact tracing app strategy has several drawbacks. A simulation study at Oxford University found that nearly 80% of smartphone users in a city of 1 million people would need to install an app in order for it to be effective in controlling viral spread.8 Even if a large number of people voluntarily installed an app, there would still be an issue of technical reliability with respect to Bluetooth, whose approximate location sensing range is much greater than the 1.5 meters recommended for social distancing. Privacy remains no less an issue than in the government-run system of South Korea. Apple and Google are developing systems that are exhaustively privacy-centric, and the two companies have committed to shutting down the system once the pandemic is over. Concerns linger, though, because it is technically possible that personal identities could be retrieved from the randomly generated Bluetooth keys to anonymize users. Paradoxically, at a cost to privacy, the South Korean model—rapid and massive testing and government-run digital contact tracing—helped avoid an authoritarian policy of shutting down entire cities and states and restricting personal freedom.
