QR Code Craze Powers China’s Coronavirus Fight While Raising Concerns Over Privacy

As China encourages people to return to work despite potential fears associated with the coronavirus outbreak, a QR code craze has once again taken over the country. However, this time, the codes are used not for online payments, but to prevent the virus from spreading.

In Beijing, scanning a QR code through WeChat or Alipay at a checkpoint of an apartment complex, a shopping mall or an office building has become a normal part of daily life. Before entering a building, citizens are asked by security personnel to take a temperature check and scan a QR code hanging at the entrance. The code will lead them to an online registration page, requesting an ID number and a phone number to issue a color-based personal health code. Users are asked to answer a series of questions including where they have been in the last two weeks, if they have any symptoms that suggest an illness or infection and whether they have traveled to virus-hit areas or have come into contact with infected people. 

The system is supposed to allow low-risk people to return to their normal lives and go back to work. The code shows their movements in the past 14 days with their status getting updated every time people open it. Users with a green QR code are allowed to travel relatively freely within the city, while users with a yellow code are instructed to stay home and report their temperature daily to their local neighborhood committees. People with a red code are confirmed coronavirus cases and should be quarantined. Different versions of the app adopt a slightly different color code system.

Chinese internet giant Tencent’s WeChat was first to launch the health code tracking system in Shenzhen via mini program “iShenzhen” on February 9. WeChat then partnered with China’s national government service platform affiliated with the State Council to build a QR code system in earlier March, which now can be widely used across the country. 

As of March 26, a total of 900 million people use the system on WeChat, according to Tencent’s Vice President Cheng Wu. 

Meanwhile, Tencent rolled out a “school resumption code” or “fuxuema” embedding it in WeChat as a mini program on March 23, allowing students to track their daily temperatures and report it to teachers when preparing to go back to school. 

Alipay, the payment App operated by Alibaba’s sister company Ant Financial, released a similar QR code tracking feature in Hangzhou, the headquarter city of Alibaba in Zhejiang Province. It has already been adopted nationwide. 

Although WeChat and Alipay have launched their versions of the health code, local governments are not required to adopt it. Actually, each province and city is developing its local version of the system such as the “Suishenban” of Shanghai, “Jinxinban” of Tianjin and “Health Pass” of Guangzhou. Local neighborhood committees have their preferences as well, some use WeChat or Alipay, some use local apps and some use platforms supported by the “big three” telecom operators—China Mobile, China Telecom and China Unicom. 

National Health Committee warned local governments not to “overdo” it as people may need to scan multiple QR codes from different developers while some cities accept their local codes only. 

In reality, users have been questioning the necessity to scan different QR codes in different places and criticizing the QR system for being ineffective because some local codes only identify users’ status based on self-reported questionnaires without tracing people’s movements. Users of Weibo, the Chinese microblogging website, said that if questionnaires only record self-reported information, how can the records they provide be verified? People can easily lie about their movements and health conditions in order to travel freely.

The enforcement of health code tracking systems is inconsistent and spotty. Among the four residential compounds Pandaily visited in Beijing during the Tomb-Sweeping long weekend, there was only one requiring visitors and residents to show their health codes before entering. The remaining three were very much relying on paper records to write down the entrant’s name, temperature, citizen ID number and phone number.

The technology has also raised wide concerns over privacy and data security.

“I saw my ID card photo show on my phone after I scanned the QR code,” one user on Weibo said. “I am uncomfortable, and I don’t feel safe.”

“Can I ask how much access the health code developers grant the government to check our personal information?” Another user said. “This technology can certainly keep local officials informed at this hard time, but it can’t be used after the epidemic because it is an invasion of my privacy.” 

The operator of Alipay, Ant Financial, said in a statement to media that it simply provides a health code platform and has no access to the data entered into it. Chen Leiming, the General Counsel of Ant, said that Ant requires all third-party developers, including those offering health code services, to follow the data security and privacy requirements, which include obtaining user consent before providing services, according to The New York Times.

Pandaily found that some of the third-party health code developers on WeChat such as “Jingxinxiangzhu” in Beijing do not obtain user protocol and display privacy policy warnings to users before asking them to sign in. As a result, users have to choose between protecting their privacy and being able to move freely within a city.

The Office of the Central Cyberspace Affairs Commission affiliated with The Cyberspace Administration of China, said in an announcement on February 4 that the data collected at this time should be used for coronavirus prevention and control only. They also ruled that any organization collecting and operating users’ personal information should be responsible for its safety, and should take strict management and technical protection measures to prevent misinformation and illegal manipulation of data. 

While this not-yet mandatory system has the potential to put the coronavirus outbreak under control and provide some reassurance to the public as the country is gradually recovering from the epidemic, a system managing 1.4 billion people’s personal data could not exist without controversies.