Tracking methodologies and data privacy implications

Covid, in its wake, brought a new way of doing things. Companies, shops, hotels developed new ways to monitor temperatures to consider whether an individual is worth further investigation or is worth entering into a building. Yet, these organisations fail to consider the data privacy implications of these tracking methodologies.

We are in a new era of close monitoring or tracking. It seems to me that organisations, out of what some have called “legal obligation”, continue to carry out excessive monitoring of employees and customers. What remains is this, most companies can’t necessarily justify why they are tracking employees or customers.

For example, you walk into a shop and the security guard stops you, points a thermometer digital gun on your forehead before, checks your temperature and ushers you into the business premises. Your special category data is in that device and usually, individuals don’t know for how long. You walk into a hotel and there is an automatic scanning machine in the lobby that takes the temperature of every guest, and the hotel saves it for prevention against the spread of the virus.

In China, for example, there is an all-out mission to track individuals who have the virus, actions to take on these individuals and how to monitor their every movement. Is this intrusive? Yes. Is it legal? Only to a certain extent. The big question is what are countries and organisations trying to achieve?

In the beginning, countries were trying to contain the spread of the virus, to reduce deaths and more importantly, to ensure that individuals are vaccinated. However, these measures do leave room for perpetual monitoring. There is no set time when this monitoring will end and there seems to be no permanent solution to the expanding virus.

What then can countries or organisations do to ensure that they are carrying out this “public task” with serious considerations for privacy implications? Why companies are now telling employees to do covid tests and companies are saying non-vaccinated staff would not be allowed in work? Well, that is the new norm it seems but we have to also consider the rights and freedoms of individuals even during these dire times.

The principles of fairness and lawfulness should still play in the handling and processing of these requests. Organisations should stipulate why they want staff to be vaccinated, why they are asking for covid results and more importantly, what the retention and deletion schemes of these results?

Businesses or organisations collecting personal information from individuals who walk into their building should do so with consideration of how this information will be stored. More importantly, ensure that there is the technical and organisational measure in place for the protection of these information assets. These means companies should avoid using logbooks or lists as this spring risks.

Companies should also ensure that they do not misuse personal information. As such, organisations and their staff members should be trained on what to do with the information. For example, staffs within a particular company should not use the contact details for further marketing or sell it other companies for the reasons of targeting. These information assets should be strictly used for the intended purpose.

Organisations collecting information for contact tracing should be transparent that they are only collecting the information for the purposes of contact tracing. If they want to collect information for other reasons, they must inform individuals about this new purpose.

Tracking raises a whole lot of privacy issues but companies who adhere to the principles of data protection can apply the right methodologies in tracking and monitoring of employees and customers in the right way and manner that is not detrimental to their human rights.