A recent investigative report by CRHoy News raises issues of privacy in regards to the new prrof of vaccination mandate by the government of Costa Rica.
Ministry of Health confirmed to CRhoy.com that the server that would house the data of millions of Costa Ricans and foreigners living in the country (vaccinated with a complete and incomplete scheme), is located on an operating platform of the American company Amazon, called Amazon Web Services (AWS), a data storage service in the cloud.
"The Command Center servers are located on the Amazon AWS infrastructure,which is one of the most secure infrastructures in the world, with physically encrypted communications and strict security policies. The control of the database is in charge of the Ministry of Health, which is the only one that has the accreditations of administration of the database, and is the only one that can grant direct access to the information (...) We reiterate that there is no purchase of any system from SOIN, so there is no purchase contract,"they quoted via email.
This raises some interesting legal questions since there is Law 8968 that was established to prevent the transfer of private data of people to a server abroad.
Whether the government considers vaccine status public information or private medical information, as yet to be established. Considering the plan to implement the system has already been announced it is clear the government considers this personal info should be accessible to both government agencies and private business.
"According to Adalid Medrano, a lawyer specializing in computer crime and cybersecurity, the project and its implementation could cross the line of illegality in the understanding that it does not exist until now, the signature of citizens granting consent to the Ministry of Health to transfer their data to the servers of the company SOIN so that they at the same time move them to a cloud of foreign company." (translated from CRHoy.com)
It is also noted in the article that the government has been considering this app project since February when they began the process to register the database.
The company who is assisting the development of this system is an established Costa Rica Company based in San Jose, Costa Rica.
According to their website:
"We carry out the exploitation of data: self-service analysis, advanced information analytics, Data Discovery, embedded reporting in applications and integrated reporting in mobility applications. We support the operational, commercial and strategic management of our clients with projection solutions, predictive models, machine learning and targeted marketing."
And they also state a partnership with Track Group, a global leader in offender tracking:
"Track Group is the world leader in monitoring and tracking services for prisoners, helping Criminal Justice Agencies achieve better results through the strategic use of data.
In December 2019, SOIN forms an alliance with Track Group, a world leader in monitoring and tracking services for prisoners, to offer patented devices and their strategic data analysis tools to the Criminal Justice Agencies of Costa Rica, allowing to control, in real time, the restrictions imposed and the authorized movements of prisoners.
We are the laboratory authorized by Track Group for the diagnosis, conditioning and repair of your tracking devices for prisoners."
It appears that experience in tracking people might be an important component of this program. Who has access to this data should be of concern to all vaccinated persons and should be made clear to all citizens before they agree to comply with providing that data.
That is why the law exists.
