LCQ10: Privacy issues related to virus testing

     Following is a question by the Hon Charles Mok and a written reply by the Secretary for Food and Health, Professor Sophia Chan, in the Legislative Council today (May 27):
     To tackle the coronavirus disease 2019 epidemic, the Department of Health (DH) has collected hundreds of thousands of deep throat saliva samples for virus testing since January this year. Some members of the public are worried that the authorities and relevant organisations may obtain from the saliva samples the DNA sequence information of Hong Kong residents and even establish a database using such information, thereby intruding on the privacy of members of the public. In this connection, will the Government inform this Council:
(1) of the number of samples collected by DH since January this year for testing, with a breakdown by (i) the locations where such samples were collected (e.g. the airport and private clinics) and (ii) whether or not the persons from whom the samples were taken were Hong Kong residents;
(2) of the testing items included in DH's testing service, and in respect of the personal data obtained from such testing service, their (i) categories, (ii) retention period, (iii) storage methods (including whether the data have been anonymised when being processed and stored, as well as the information security measures taken), and (iv) whether such data have been used for purposes other than the purpose of preventing the occurrence or spread of an infectious disease or contamination (e.g. establishing a DNA database and preventing or detecting crimes); if so, of the details;
(3) whether DH has disclosed since January this year, in accordance with the Personal Information Collection Statement issued by it to data subjects, the personal data (including biometric data) collected from the virus testing to any bureaux, other government departments or relevant organisations; if so, of the number of occasions of such disclosure and the number of data subjects involved; and
(4) whether it will amend the Personal Data (Privacy) Ordinance (Cap. 486) to classify certain categories of personal data (including biometric data such as DNA sequences) as "sensitive personal data", and make more stringent provisions for protecting sensitive personal data, so as to prevent the authorities from using the biometric data collected on a large scale for monitoring and control purposes?  
     In consultation with the Constitutional and Mainland Affairs Bureau, my consolidated reply to the various parts of the question raised by the Hon Charles Mok is as follows:
     Enhancing testing for the coronavirus disease 2019 (COVID-19) is a crucial element of the Government's work in prevention and control of the outbreak and can help achieve "early identification, early isolation and early treatment". Following a risk-based approach, the Government has continuously expanded the Enhanced Laboratory Surveillance Programme with a view to identifying COVID-19 infection cases as early as possible. To further prevent imported cases, the Government has mandated all asymptomatic inbound travellers arriving at Hong Kong from overseas and those who have been to Hubei Province in the past 14 days prior to arriving at Hong Kong via land boundary control points (i.e. Shenzhen Bay Port and the Hong Kong-Zhuhai-Macao Bridge Hong Kong Port) to undergo virus testing, with an aim to identifying infected but asymptomatic people as early as possible.
     The Department of Health (DH) has set up a Temporary Specimen Collection Centre (TSCC) at the AsiaWorld-Expo to speed up the collection of specimen from asymptomatic inbound travellers arriving at Hong Kong for conducting testing for COVID-19. All asymptomatic inbound travellers arriving at the Hong Kong International Airport are mandated to wait for the test results for COVID-19 at a designated location after collecting their deep throat saliva samples at the TSCC. Depending on the arrival time of flights and taking into consideration factors such as infection control, crowd control and testing time, etc., DH will arrange those asymptomatic people who need to wait for test results overnight to be temporarily accommodated at the Holding Centre for Test Result set up in a hotel.  Furthermore, DH has also started to provide relevant persons with an extra specimen collection container and request for their collection of deep throat saliva samples during the home quarantine period for another round of virus testing. After receiving the extra specimen collection container, the relevant persons have to collect their deep throat saliva sample on a designated date before the completion of the 14-day compulsory quarantine at home or at a designated place, and then arrange to deliver the specimen to a collection point on the same morning the specimen was collected by a family member, friend or door-to-door specimen collection service. Specimen collection containers are also provided to asymptomatic inbound travellers who have been to Hubei Province in the past 14 days prior to arriving at Hong Kong via land boundary control points for collection of their deep throat saliva samples at their dwelling places. They need to deliver their deep throat saliva samples via the aforementioned methods for undergoing testing as soon as possible.
     From January 1 to May 19, 2020, the Public Health Laboratory Services Branch (PHLSB) under DH's Centre for Health Protection (CHP) and the Hospital Authority had performed over 202 900 COVID-19 tests, or over 27 000 tests per million population. The statistics on COVID-19 tests have been uploaded to the CHP website at and are updated on a weekly basis.
     All samples obtained for conducting tests for COVID-19 are solely used for preventing and controlling the occurrence or spread of infectious disease. Personal information related to virus testing is stored in PHLSB's laboratory information system and can only be accessed by personnel authorised by PHLSB. The relevant information is appropriately stored, processed and protected in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) and DH's established guidelines. So far, DH has not disclosed any sample or personal information obtained for conducting tests for COVID-19 to other bureaux, departments or related organisations.
     According to the PDPO, all kinds of personal data are currently protected under the Data Protection Principles (DPPs) of Schedule 1 to and relevant provisions of the PDPO, under which no distinction is made between sensitive personal data and other kinds of personal data. According to DPP 4, data users should take all practicable steps to ensure the personal data they hold are protected against unauthorised or accidental access, processing, erasure, loss or use, having particular regard to "the kind of the data and the harm that could result if any of those events take place". Therefore, data users should adopt stricter data security measures for sensitive personal data.
     In the light of advancements in information technology, the Office of the Privacy Commissioner for Personal Data recognises that the collection and use of personal data of a more sensitive nature, such as biometric data and genetic data, will become more common. In this connection, it has published the Guidance on Collection and Use of Biometric Data to put forward a number of measures and recommendations for data users handling sensitive biometric data on minimising the risk with regard to collection of the relevant data. In the course of reviewing the PDPO, the Government will consider whether it is necessary to strengthen the regulation of sensitive personal data.

Ends/Wednesday, May 27, 2020
Issued at HKT 12:15