In Singapore, officials said in January that data from the country’s coronavirus contact-tracing system had been used in a criminal investigation, even though leaders had initially said it would be used only for contact tracing. In February, Singapore passed a law limiting such use only to “serious” criminal investigations.
“One of the things that we don’t want is that we normalize surveillance in an emergency and we can’t get rid of it,” said Jon Callas, the director of technology projects at the Electronic Frontier Foundation, a digital rights group.
While such incidents are not occurring in the United States, researchers said, they already see potential for overreach. Several pointed to New York City, where proof of vaccination requirements will start on Aug. 16 and be enforced starting on Sept. 13.
For proof, people can use their paper vaccination cards, the NYC Covid Safe app or another app, the Excelsior Pass. The Excelsior Pass was developed by IBM under an estimated $17 million contract with New York State.
To obtain the pass, people upload their personal information. Under the standard version of the pass, businesses and third parties see only whether the pass is valid, along with the person’s name and date of birth.
On Wednesday, the state announced the “Excelsior Pass Plus,” which displays not only whether an individual is vaccinated, but includes more information about when and where they got their shot. Businesses scanning the Pass Plus “may be able to save or store the information contained,” according to New York State.