Pakistan should centre its vaccination programme around informed consent of citizens

A communication campaign about vaccination that encourages informed consent of citizens will improve outcomes.

The Pakistan government deserves praise for the manner in which it has been procuring and distributing vaccines to inoculate citizens against Covid-19, including the simple text message-based registration and prompt appointment messages, leading to opening up walk-in vaccinations for all age groups this month.

This is a major breach of citizen’s privacy, as anybody with access to another’s CNIC number can access the private health data of a citizen without their express consent. If employers want to determine the vaccination status of an employee, the voluntary presentation of a vaccination certificate issued by the National Database and Registration Authority (Nadra) should be the requirement, instead of an open to abuse facility where private health data is open for access to anyone with a CNIC number.

Hence, Nadra should discontinue the policy of updating the vaccination status of a citizen through an SMS to 1166, and restrict its use for registration for the vaccine. For accessing vaccination data, Nadra should introduce additional security such as asking for additional information to confirm if it is really the citizen asking for this information.

One way to do that would be to only send this information to mobile phone numbers that are registered against the CNIC number that is being sent to 1166, as all SIM cards in Pakistan are biometrically linked to a CNIC number. This could, however, leave out those who may not have a cellphone, and this could be remedied by expanding the provision of this information to phone numbers requesting it on the basis of the unique family number on a citizen’s CNIC.

Data protection by Nadra

Further, there is little transparency on how the health data of citizens related to vaccination is being protected by Nadra. Given a history of hacking of data at the Nadra, it is all the more important that this data is protected by secure encryption protocols, with access to only authorised officials with requisite checks and balances on this access.

It is yet again time to emphasise the need for the government to move forward with the Personal Data Protection Bill 2020 which was circulated for stakeholder feedback in March 2020, but has seen little progress.

It was recommended then, too, that the Bill should contain stipulations for protection of health related data, including special sunset clauses for pandemics in case a need for additional measures arises.

It was highly concerning when the Prime Minister announced last year that the government was using the surveillance system used by intelligence agencies to track Covid-19 patients. It is pertinent to stress here that any surveillance measures — whether for health reasons or otherwise — should be transparent, legal, and subject to oversight and accountability to ensure that such powers are limited and not open to abuse.

It is undeniable that health concerns are fundamental to preserving the right to life of citizens, as guaranteed by Article 9 of the Constitution, and citizens owe the responsibility of taking precautions to ensure the safety of those around them.

Vaccinations have come to be one of the central ways immunity is developed, in addition to precautions that individuals and establishments can take. However, this necessity must be balanced with the right to privacy of citizens which is also an important aspect of the right to life of citizens, apart from being guaranteed under Article 14 of the constitution as well.

Hence, a communication campaign about vaccination that encourages informed consent of citizens, coupled with privacy protections in place around vaccination data will improve Pakistan’s admirable vaccination campaign manifold, and should be implemented by the federal and provincial governments the soonest to keep intact citizens’ dignity, right to information, health safety, and privacy.

Categories: Article