Wuxi deletes COVID-related personal data

The city of Wuxi in Jiangsu province has deleted the first batch of 1 billion items of personal data related to COVID-19 information in order to avoid data breaches and protect people's privacy.

According to the Wuxi Big Data Administration, the city had collected personal data related to COVID-19 prevention and control, such as PCR test monitoring and tracking data of those at risk of infection.

Yan Chunshui, deputy director of the administration, said deleting the data helps prevent personal information from being misused.

"Deleting the data is one of the most effective ways to prevent data breaches," he said. "It also saves storage space and improves the storage efficiency of local government cloud services."

To guarantee that the data had been deleted and cannot be restored, the local government invited third-party audit and notary office workers to participate in the process.

In February, Guangdong province said in a notice that it would delete data relating to the local health code and protect citizens' privacy.

Such initiatives have been largely welcomed by the public.

An office clerk surnamed Fang in Beijing told China Daily the practice should be expanded nationwide to help secure privacy and curb potential abuses.

"Kongkong", an online writer, appreciated the decision of the Wuxi authorities in a post on Sina Weibo. "In case of data and information leakage, there will be huge disaster. So it's the best approach available for privacy protection."

According to National Business Daily, nearly 900 million people in China had applied for a health code during the pandemic. Digital health codes have been used more than 60 billion times. Users' data collected by the system usually include names, travel histories, health records and ID numbers.

There have been concerns over abuses related to such data, mainly accumulated via the wide use of the health code system during the battle against COVID-19.

According to Lei Zhenglong, deputy director of the Disease Prevention and Control Bureau of the National Health Commission, the State Council's joint prevention and control mechanism clearly requires that the function of health codes be strictly defined and the scope of their application should not be expanded without authorization.

The processing of personal data should be directly linked to clear and reasonable purposes, according to the Personal Information Protection Law. Those processing the data must delete it when the purpose of processing has been met, cannot be met, or the data is no longer required to achieve the purpose.

Some regions, including Beijing and Guizhou province, have said they would integrate people's health codes into mobile government platforms to help with the provision of other public services.