The Pakistan government deserves praise for the manner in which it has been procuring and distributing vaccines to inoculate citizens against Covid-19, including the simple text message-based registration and prompt appointment messages, leading to opening up walk-in vaccinations for all age groups this month.

However, there are two areas the federal and provincial governments need to improve their performance to achieve the stated target of herd immunity against Covid-19 by Eid-ul-Azha: the communication campaign to encourage vaccinations, and the privacy protocols related to vaccination data.

The state should take an approach of encouraging informed consent for Covid-19 vaccination amongst the people instead of forcing people to get vaccinated against their will by imposing penalties and other measures.

For instance, the Sindh government announced that it will block the salaries of those Sindh government officials who refuse to get vaccinated by July 2021. The Punjab government has announced that it is going to start blocking SIM cards of citizens who refuse the Covid-19 vaccine.

Informed consent vs forceful vaccination

In a society where vaccine hesitancy is rife owing to multiple propaganda campaigns, and stemming from foreign interventions such as the CIA’s fake hepatitis B vaccination campaign to intercept Osama bin Laden in Abbottabad, the focus of the government’s efforts should be informational campaigns to encourage vaccinations using mass media.

Read more:All you need to know about Covid vaccines in Pakistan

In addition, there has also been viral global proliferation of misinformation regarding the Covid-19 vaccines. The state’s information apparatus should counter these with mass campaigns to educate people, instead of leaving it at an approach that begins and ends with “get vaccinated or there will be consequences”.

Such forceful propositions undermine the consent of individuals, and also contravene medical ethics. The government must ask itself the question: is there sufficient information regarding the Covid-19 vaccines available and accessible to citizens to offer or withdraw informed consent for vaccination?

The answer will be a hard “no”, and energy must be diverted in that direction. It is a myth that such refusals are only in “remote” and “conservative” areas because large cities are filled with educated individuals who do not feel comfortable getting vaccinated as yet, and hence the target must be a wide-scale across the board campaign.

Key concerns that such a campaign should address include:

• Simplified information regarding how the vaccine works
• Information regarding its efficacy
• The fact that vaccines hugely diminish the chances of a patient’s health deteriorating to a critical state rather than cutting the total chance of infection
• There is absolutely no chip that is injected
• Data regarding the drop in infection rates after vaccination campaigns picked up
• The time period vaccines take to build anti-bodies in an individual after inoculation
• Possible side-effects and the minimal chances of these
• The advantage to one’s quality of life, the economy, and ease of movement and travel once vaccinated

Radio, television, print, and social media should all be used to send out these key messages, including from the prime minister’s office for the highest impact. Once people have sufficient information to make a decision, should governments move to implement disincentives to not getting vaccinated, they must not violate other fundamental rights such as the right to access information and communicate through SIM cards, or the right to compensation for work done by employees.

Privacy concerns regarding vaccine data

The second area of concern regarding the government’s vaccination campaign is the privacy protocols related to vaccination data of citizens. The web portal for vaccine registration has sufficient protections in terms of ensuring that nobody other than a citizen themselves can access their personal data related to vaccination through a two-step verification code that is sent to one’s mobile phone number without which one cannot access personal data on the web portal.

However, a major cause of concern is the SMS verification on a citizen’s vaccination status: any person who has another’s Computerised National Identity Card (CNIC) number can find out about their vaccination status, by sending an SMS with a CNIC number to 1166.

This is a major breach of citizen’s privacy, as anybody with access to another’s CNIC number can access the private health data of a citizen without their express consent. If employers want to determine the vaccination status of an employee, the voluntary presentation of a vaccination certificate issued by the National Database and Registration Authority (Nadra) should be the requirement, instead of an open to abuse facility where private health data is open for access to anyone with a CNIC number.

Hence, Nadra should discontinue the policy of updating the vaccination status of a citizen through an SMS to 1166, and restrict its use for registration for the vaccine. For accessing vaccination data, Nadra should introduce additional security such as asking for additional information to confirm if it is really the citizen asking for this information.

One way to do that would be to only send this information to mobile phone numbers that are registered against the CNIC number that is being sent to 1166, as all SIM cards in Pakistan are biometrically linked to a CNIC number. This could, however, leave out those who may not have a cellphone, and this could be remedied by expanding the provision of this information to phone numbers requesting it on the basis of the unique family number on a citizen’s CNIC.

Data protection by Nadra

Further, there is little transparency on how the health data of citizens related to vaccination is being protected by Nadra. Given a history of hacking of data at the Nadra, it is all the more important that this data is protected by secure encryption protocols, with access to only authorised officials with requisite checks and balances on this access.

It is yet again time to emphasise the need for the government to move forward with the Personal Data Protection Bill 2020 which was circulated for stakeholder feedback in March 2020, but has seen little progress.

It was recommended then, too, that the Bill should contain stipulations for protection of health related data, including special sunset clauses for pandemics in case a need for additional measures arises.

It was highly concerning when the Prime Minister announced last year that the government was using the surveillance system used by intelligence agencies to track Covid-19 patients. It is pertinent to stress here that any surveillance measures — whether for health reasons or otherwise — should be transparent, legal, and subject to oversight and accountability to ensure that such powers are limited and not open to abuse.

It is undeniable that health concerns are fundamental to preserving the right to life of citizens, as guaranteed by Article 9 of the Constitution, and citizens owe the responsibility of taking precautions to ensure the safety of those around them.

Vaccinations have come to be one of the central ways immunity is developed, in addition to precautions that individuals and establishments can take. However, this necessity must be balanced with the right to privacy of citizens which is also an important aspect of the right to life of citizens, apart from being guaranteed under Article 14 of the constitution as well.

Hence, a communication campaign about vaccination that encourages informed consent of citizens, coupled with privacy protections in place around vaccination data will improve Pakistan’s admirable vaccination campaign manifold, and should be implemented by the federal and provincial governments the soonest to keep intact citizens’ dignity, right to information, health safety, and privacy.