This article is part of an ongoing series in which experts will analyze the role of science and technology in epidemic response and control in China and around the world.

Last month, a list of over 6,000 current and former patients of a hospital in the eastern city of Jiaozhou surfaced in an online chat group. The leaked details included not just the patients’ names, but their addresses, contact information, state-issued identity card numbers, and other personal information.

This wasn’t the first high-profile security breach of private medical information following the heightened countrywide paranoia due to the COVID-19 outbreak in the central province of Hubei. At the peak of the domestic epidemic in late January, Hubei natives living around the country had their personal information published by fearful locals.

The global adoption of infectious disease control and management technologies over the past few months has inevitably led to invasions of personal privacy, whether in the form of hardware like tracking wristbands or local governments teaming up with software companies to collect user data. On the Chinese mainland, tech giants Alibaba and Tencent have both unveiled “color code” health passport systems, which harvest data from users’ cellphones and use it to evaluate their potential health risks.

Given the ongoing public health crisis, I think it’s reasonable for governments or other relevant institutions to collect and use citizens’ personal information, provided it is done in accordance with laws and is limited in scope. We all know people’s lives are at risk. The high stakes make it easier for users to acquiesce to temporary measures like disclosing some or all of our identifying and behavioral data to the government, hospitals, communities, and relevant public service providers — even if that means also giving it to cooperating private tech companies. But if we’re going to make trade-offs and concessions for the sake of public health, we also need to remember this should not be the norm.

It’s hardly a secret there’s almost no such thing as true personal privacy in today’s China. Whether for the sake of convenience or speed, almost all of the data we generate, from our shopping histories to our itineraries, is accessible to internet companies and government agencies. These info points are then compiled into dossiers — known in the industry as “user portraits” — that paint an almost complete picture of our digital lives.

Any misuse or leak of this data can have dire consequences. And even if it isn’t misued or leaked illegally, the lack of legal and commercial safeguards in our emerging digital age is leaving us vulnerable to ubiquitous monitoring. Even now, the current paradigm has essentially indentured us to tech companies who harvest, utilize, and sell our personal information for profit.

There are ways, even in a pandemic-scale crisis, to guarantee the privacy of individuals. We just need to commit to building new infrastructure capable of safeguarding our fundamental rights.

One such technology is known as privacy-preserving computation. In simple terms, it is a means of computation that prioritizes protecting user privacy during the generation, collection, preservation, analysis, utilization, and destruction of data.

Unlike on the “traditional” internet, which sends raw data back and forth, in privacy-preserving computation, data is transmitted and processed in a “secret” state. Cloud servers do not have ownership rights, only processing rights. Thus, users’ data cannot be obtained by other parties.

Privacy-preserving computation accomplishes this through modern cryptography. If it is adopted more widely, internet companies will have to ask for users’ consent for accessing their valuable social and shopping data. And that means users will have leverage in negotiating for a share of the profits or commercial value generated. For example, instead of the current model, in which companies sell user data, a privacy-centric model would allow users to “lease” their data out — the more it’s used, the more money they get.

During exceptional times like the ongoing pandemic, in which the government requires personal information to track users, privacy-preserving computing would allow the public sector access and management rights, but with cryptographic algorithms in place to protect individual privacy.

None of this is simple. It requires reshuffling and rebuilding the country’s data processing capabilities, compliance architecture, and other systems. Yet at a time when the greatest security challenge facing humankind may come not from sudden crises, but from the gradual erosion of our privacy and digital security, it’s all the more important to be vigilant.

Translator: Matt Turner; editors: Wu Haiyun and Kilian O’Donnell; portrait artist: Wang Zhenhao.

(Header image: Wang Zhenhao for Sixth Tone)