APPA Technology Working Group

Checklist of good data protection practices for COVID-19 management

This checklist is a consolidation of the common baseline data protection best practices relating to technologies used to manage the COVID-19 situation. It seeks to enable app developers in the Asia Pacific region to develop apps that comply with the majority of the data protection best practices in the region. The document is a collation of advisories issued by the Asia Pacific Privacy Authorities (APPA) Technology Working Group (TWG) members in relation to:

  1. Safe Management (e.g. contact tracing, monitoring of social distancing, enforcement of stay-home quarantines, or any other form of technology developed for the purposes of safe management); and
  2. Remote Working/Living (e.g. video conferencing, e-commerce, and other digital transactions).

App developers wishing to develop apps for use in the Asia Pacific region may refer to the following checklist as a common baseline of best practices. However, should they be developing apps for a specific jurisdiction, they should consult the rules or advisories published by the relevant jurisdiction.

Contact tracing (including apps)

Office of the Australian Information Commissioner (for all OAIC COVID-19 related advice and guidance, click here)

The COVIDSafe app and my privacy rights
(Guidance in 10 other community languages)

Privacy obligations regarding COVIDSafe and COVID app data

Guidance for businesses collecting personal information for contact tracing

National Privacy Commission (Philippines)

On COVID-19-related apps, digital tools and solutions in this time of pandemic  

Education/Online learning

Office of the Information and Privacy Commissioner for British Columbia
FIPPA and online learning during the COVID-19 pandemic

National Privacy Commission (Philippines)
Privacy Dos and Don’ts for Online Learning in Public K-12 Classes  

Employment/Remote work

Office of the Australian Information Commissioner 
Coronavirus (COVID-19): Understanding your privacy obligations to your staff

Assessing privacy risks in changed working environments: Privacy Impact Assessments

Office of the Information and Privacy Commissioner for British Columbia
Tips for public bodies and organizations setting up remote workspaces

National Privacy Commission (Philippines)
Protecting Personal Data in a Work From Home Arrangement

Health/patient privacy

National Privacy Commission (Philippines)
Statement of the National Privacy Commission on Calls for Patients to Waive Privacy Rights’, Publicly Disclose Health Status 

Protecting Patient Data from Unauthoritzed Disclosure 

Joint Statement of the Department of Health (DOH) and National Privacy Commission (NPC) on Processing and Disclosure of COVID-19 Related Data (30 April 2020) 

Press Statement of Privacy Commissioner Raymund Enriquez Liboro on the collection of personal data to aid in contact tracing relevant to the COVID-19 response 

Online security

National Privacy Commission (Philippines)

Statement by Privacy Commissioner Raymund Enriquez Liboro on “Social Vigilantism” in the time of COVID-19

Personal information collection

National Privacy Commission (Philippines)

Frequently Asked Questions (FAQs) on the Collection and Processing of Personal Data during the COVID-19 Pandemic

Collect the minimum necessary information in providing financial aid and other relief packages to those affected by the enhanced community quarantine 

National Institute for Transparency, Access to Information and Personal Data Protection (Mexico)

Sector-specific infographics on processing personal data

Reporting improper processing of personal data

INAI’s COVID-19 microsite

Restaurants, Entertainment, Retail

Office of the Information and Privacy Commissioner for British Columbia

Collecting personal information at food and drink establishments, gatherings and events during COVID-19
Related infographic

National Privacy Commission (Philippines)

Guidelines for Establishments on the Proper Handling of Customer and Visitor Information for Contact Tracing

Statements

National Institute for Transparency, Access to Information and Personal Data Protection (Mexico)

INAI’s outputs, as recommendations issued addressed to both public and private sectors: .

National Privacy Commission (Philippines)

Statement of Privacy Commissioner Raymund Enriquez Liboro on the Declaration of Public Health Emergency in Relation to COVID-19  

NPC supports DILG’s bid vs discrimination of COVID-19 frontliners 

Travel/Tourism

National Privacy Commission (Philippines)

Statement of Privacy Commissioner on release of passenger manifest of airlines to government agencies