[FALSE] Will the visit records in ‘LeaveHomeSafe’ mobile app be kept for 7 years if submitted to the government?

A screenshot of the LIHKG article.

Outline

• A post on the LIHKG (a Hong Kong local social media) forum stated that the visit data in the “LeaveHomeSafe” mobile app will be kept for 7 years if submitted to the government.
• According to the Prevention and Control of Disease (Disclosure of Information) Regulations (Cap. 599D), if someone tests positive for COVID-19 and is ascertained by the Centre for Health Protection (CHP), all visit records of the infected person, including those stored in the “LeaveHomeSafe” app, will be submitted and stored in the government system for at least 7 years.
• It is confirmed by the Office of the government Chief Information Officer (OGCIO) that the visit records of the citizens who are not diagnosed with COVID-19 will only be stored locally in their mobile phone and will not be uploaded to any other locations, including the government’s system. All local data will be deleted after 31 days.
• Due to the lack of contextual information and inaccuracy of retention period, we rate the claim FALSE.

News Brief

On Feb. 18, 2021, a post on the LIHKG forum claimed that the “LeaveHomeSafe” mobile app will not upload your data to any centralized storage system and all visit data will be kept locally for 31 days, but the data will be kept for 7 years if submitted to the government. The data will also be submitted to other authorized departments, organizations, or individuals, including the Department of Health (DH), the Hospital Authority, and authorized officers, if needed.

As of the issuance of this report, the post had received 67 replies and 207 likes or dislikes.

To curb the spread of COVID-19, the government launched a mobile application called “LeaveHomeSafe” on Nov. 16, 2020 and encourages citizens to record their visited venues and taxis with this app. Users will receive notification of exposure if they were at the same venue at about the same time with the recently confirmed COVID-19 patient, or if they (both passengers and drivers) were in the same taxi on the same day with the confirmed patient. If the user is confirmed to have COVID-19, the visit records stored in the mobile app can assist relevant epidemiological investigation and contact tracing. Starting from Feb. 18, 2021, the government mandates that anyone who dines in eateries is required to scan the QR code with “LeaveHomeSafe” app or write down their personal details for record.

Fact-Checking

The claim questions: Will the visit records submitted to the government be kept for 7 years?

On the website of Office of the Privacy Commissioner for Personal Data (PCO) in Hong Kong, a press release on Feb. 19, 2021 responded to the public’s privacy concerns relating to the use of “LeaveHomeSafe” app. It underscores, “Visit records are kept on users’ mobile phones only, not in any government systems. There is no transfer of personal data to the government’s system or operators of premises for retention. Visit records will be automatically erased after 31 days.” It also says that “Only in the unfortunate event of a confirmed infection as ascertained by the CHP will the infected person be required under the Prevention and Control of Disease (Disclosure of Information) Regulation (Cap. 599D) (henceforth, the Regulation) to upload the relevant visit records and provide his/her name and contact telephone number to assist the CHP in contact tracing.” The “disease” in the Regulations means the coronavirus disease 2019 (COVID-19).

In the “Personal Information Collection Statement” page of “LeaveHomeSafe” official website, it is elucidated that the visit records submitted to DH will be retained for at least 7 years for confirmed cases of COVID-19.

A screenshot of part of the information disclosure section in the Regulation.

Mr. Hui Siu-Kwong, Nicolas, Senior Information Officer of the Office of the Government Chief Information Officer (OGCIO) replied to our inquiries on Feb. 24, 2021. He said that irrespective of whether the confirmed patients had used the “LeaveHomeSafe” app, they were required to provide their visit records during the infectious period, along with their names and contact number, to the CHP to facilitate epidemiological investigation. Their visit records will be anonymously released to the public and downloaded by the “LeaveHomeSafe” app to compare the visit records and push the exposure notifications to the app users if their records match. It is also confirmed by him that the visit records (including the records stored in the app) of the confirmed patients will be retained for at least 7 years, while other citizens’ visit records will only be stored locally in the mobile devices and will be deleted after 31 days.

A screenshot of Mr. Hui Siu-Kwong, Nicolas’ email reply.

According to a report by RTHK, Mr. Alfred Sit Wing-hang, Secretary for Innovation and Technology, said that the number of downloads of “LeaveHomeSafe” app so far is 3.11 million, accounting for 40 percent of all Hong Kong citizens. In addition, 135 confirmed cases of COVID-19 were recorded in Hong Kong from Feb. 22 to Mar. 1, 2021, according to DH. Based on the above-mentioned data, it can be calculated that the possibility of visit records uploaded to the government in the period is only 0.0043%.