Although it’s become common to think of our world in terms of “Before Corona” and “After Corona,” the vast majority of the planet is still years from leaving the pandemic in the rearview mirror. In the nearly two years since the first cases were identified, the number of recorded infections worldwide has passed 200 million, and over 4 million have died. Even in countries with high vaccination rates like Singapore, a return to “normal” has proven elusive.

In China, which has recorded only sporadic outbreaks over the past 18 months and where life has largely resumed, the emergence of just a handful of new cases in a region will typically trigger a host of strict preventative measures, including traffic controls, mass screenings, and lockdowns. Even in areas without active outbreaks, mask-wearing, temperature checks, and health passports remain widespread, and with the Winter Olympics looming early next year, there are few signs that this will change anytime soon.

Still, just because there’s no end in sight doesn’t mean it’s not important to plan for what “After Corona” might look like. Over the past two years, countries around the world, including China, have responded to the current public emergency by rolling out vast new surveillance and data collection apparatuses in the name of disease control and prevention. What happens to that information — and the bureaucracies that have sprung up around it — once COVID-19 ceases to be a major threat?

COVID-19 isn’t the first time a major outbreak has forced China to reevaluate its regulatory and legal approach to public health and safety. It was the 2003 SARS epidemic that finally pushed lawmakers to establish the legal framework for a more robust and elaborate emergency response system. That April, the central government drafted new regulations outlining state responses to public health emergencies. Less than a month later, the regulations were passed and implemented in one of the fastest legislative processes in modern Chinese history. The next year, lawmakers reworded the section of China’s constitution on martial law, replacing the term with “state of emergency” to give themselves greater latitude in such situations.

Over the ensuing decade and a half, China continued to enact and revise legislation in response to a series of crises, including a chemical spill in the Songhua River in 2005 and the devastating Wenchuan earthquake in 2008. These disasters repeatedly forced different levels of government to produce contingency plans which — together with the aforementioned laws and the Ministry of Emergency Management established in 2018 — became the foundation of China’s current emergency response system.

The COVID-19 pandemic has likewise ushered in changes and tweaks to this system. In particular, technology and private firms are playing an increasingly significant role in emergency response work. As early as February 2020, the Hangzhou-based tech company Alibaba began working with that city’s government to launch a “health code” system: a kind of digital passport that records and tracks users’ identity card numbers, phone numbers, addresses, travel itineraries, and other information to produce a dynamic, colored code specifying their transmission risk. A green “low risk” assessment grants access to public spaces like train stations, airports, or hospitals, while yellow or red indicate a potential public health risk. Soon, other local governments across China launched their own health code services, often in cooperation with Alibaba or another tech firm, Tencent.

Compared to traditional epidemiological survey work, digital tracking systems like health codes have numerous advantages. They collect personal information and update risk assessments in real-time, increasing efficiency and reducing the risk of transmission. The swift rollout of the health code system helped China’s businesses to reopen relatively early in the pandemic. Countries like Korea, Singapore, and Israel have all implemented their own digital trackers, each tailored to local needs.

Yet the question remains: What happens to all this data — and the invasive methods being used to collect it — after the pandemic? Indeed, despite almost no recorded instances of local transmission in much of the country over the past 18 months, some cities have floated preserving and even expanding the health code system moving forward. For instance, Hangzhou has contemplated using big data assessments to assign “health indicators” to residents, neighborhoods, and companies in the future, while the nearby city of Suzhou tested a “civility code” system monitoring citizens’ traffic violations and volunteer service records. The fact that much of this data is collected in cooperation with some of the country’s biggest tech companies also raises questions.

The bulk of local health code expansion plans went too far for residents and ended up fizzling away in the face of vocal opposition. Yet for all the detailed emergency response legislation enacted in China over the past two decades, the decision to return to normal and suspend the emergency measures that laid the groundwork for them remains at the discretion of officials. This is not a new problem, or even a technology-specific one: Traditional emergency management systems like requiring visitors to sign in before entering residential neighborhoods have also persisted long after the danger of COVID-19 receded.

Still, digital tracking systems could prove particularly hard to quit. Governments and companies alike are often reluctant to part with the new powers they gain under a state of emergency, and they may see the personal data and user profiles collected and produced by these systems as a potential asset. Even now, after the central government established its own unified national health code system to alleviate public concerns about the patchwork, ad hoc, and potentially insecure nature of the first, locally developed generation of passports, many regions continue to require residents show their local codes.

For those looking to minimize the risk that the privacy violations currently being undertaken in the name of public health outlast the present emergency, there are at least two worthwhile options. The first and most immediate is to set higher privacy standards for the collection, revelation, and use of personal data. Since the start of the pandemic, there have been multiple instances in which an infected person’s information has been leaked or otherwise exposed. Technologies such as anonymous Bluetooth-based contact tracing and other privacy-first tracking tools can help protect citizens’ privacy while still enabling effective disease control and prevention work.

The second and more long-term solution is to legally require that all data collected is erased once it is no longer needed after the pandemic. China has actually taken steps in this direction. Borrowing from the European Union GDPR’s “right to be forgotten” mechanism, lawmakers included a clause in this year’s Personal Information Protection Law stating that personal data should be deleted once “its processing purpose has been achieved, can no longer be achieved, or (the data) becomes unnecessary for achieving its processing purpose.” Set to take effect on Nov. 1, this law applies to both public platforms and private internet companies alike. While not explicitly related to the health code system, there’s no reason to carve out an exception for these platforms after the pandemic has passed.

Technology has played an important role in China’s efforts to combat the current pandemic. Spurred by public demand, officials have moved to increase the accessibility of online public service platforms and health services. At the same time, however, we should also acknowledge that the current emergency response measures are conditional, and the authority given to officials under the state of emergency doesn’t automatically legitimize them after the state of emergency has passed. If any of the extraordinary measures adopted over the past two years are to be incorporated into everyday governance, it must be done with the informed consent of the people.

Translator: Katherine Tse; editors: Cai Yineng and Kilian O’Donnell. 

(Header image: A woman shows her health code to a policeman before entering a railway station in Nanjing, Jiangsu province, Aug. 18, 2021. People Visual)