‘Information Release Guidelines on the Movement Paths of Confirmed Patients’ was provided by the Korea Centers for Disease Control and Prevention (KCDC) on March 14, 2020. According to these guidelines, the KCDC releases a daily list of confirmed patients.
Needless to say, personally identifiable information (PII) like name and phone number should not be released. As long as it is not PII, detailed information can be disclosed as much as possible for the purpose of proactive prevention and testing according to the guideline.
For example, KCDC is allowed to disclose information about specific floors or rooms, in the case of multi-use facilities (movie theaters, libraries, churches, etc. are multi-use facilities), specific store names or specific times of visit. Bus and subway routes, boarding and drop-off times can be also disclosed.
The COVID-19 patient’s movement path information can be revealed from one day prior to the onset of symptoms to the day of containment. If the symptoms are not confirmed as a result of epidemiological investigation, the information from one day before the specimen collection date to the containment date can be released.
The KCDC is allowed to disclose the location and means of transportation where close contact with a confirmed patient has occurred, both temporally and spatially.
The authorities determine the range of contacts by considering the symptoms of the confirmed patient and whether or not they are wearing a mask, the length of stay, the situation and the time of exposure.
Since COVID-19 is spreading in situations where droplets are released such as cohabitation, meals, worship, lectures, karaoke, and counseling, in these circumstances, the quarantine authorities quickly conduct contact investigations and immediately suggest self-isolation measures and, if necessary, do additional investigations.
The name of the confirmer's place of work and the detailed address of their residence cannot be disclosed. However, the name can be released if there is a risk of spreading it to the people at work.
If all the contacts in the space are identified, information may not be disclosed. Among the contacts identified through epidemiological investigations, if there are contacts whose identity is not specified, it is possible to disclose them to the public, if necessary.
On April 12, 2020, KCDC published version 2 of the guidelines. The major changes are twofold. First, movement information can be open to the public two weeks from the date the confirmer last contacted the contact. Second, movement information can be released from two days prior to the onset of symptoms. The second item follows the ‘COVID-19 Response Guideline’ Version 7-4 released on April 2, 2020, provided by the Central Disaster and Safety Countermeasures Headquarters (CDSCHQ).
Many local governments have removed the names of restaurants, cafes, hotels the patients had visited. These places are suffering stigmatization after it was known that a confirmer visited. Re-identification is afflicting patients. Too much detailed information released by the governmental authorities can be used by attackers to identify the patient's identity. Appropriate information disclosure is the homework given to us. Finding the right balance of appropriate information disclosure is still work that needs to be done.