Public-Private Partnerships on Technology in Peru: A Government without horizon

The Peruvian government has a history of collaboration with the private sector in developing technology with the alleged purpose of providing greater security to citizens. The most recent example, the smartphone application "Peru En Tus Manos" launched in the context of the Covid-19 crisis, has been developed in a similar fashion and currently collects geolocation data on more than a million users. Although Peru has a proper legal framework for public private partnerships, developments are usually done outside of this system with little transparency, public scrutiny, and accountability.

Peru has a legal framework for public-private partnerships, but does not use it for technology

In Peru, for several years now, we have a legal framework for public-private partnerships. The most important is the Act that regulates the Promotion of Private Investment through Public-Private Partnerships and Active Projects (Legislative Decree No. 1362). Although this legal framework was initially thought for the development of large infrastructure projects, the possibility of applying it for the development of apps or other technological solutions is not excluded.

The Law itself establishes that Public-Private Partnerships projects can be centered on ”technological innovation". This regulatory environment, inspired by public procurement mechanisms, guarantees transparency, results-focused projects, planning, and competition among providers (through public tenders). However, the Peruvian government hasn’t used this legal framework in recent high-profile technology projects. As a consequence, those efforts were riddled with secrecy, subpar development and, ultimately, forgetfulness and disinterest in the long run.

If this legal framework exists, why is it not being used by the Peruvian government? We do not have the answer, but it may revolve around the little importance and the absence of a strategic and comprehensive plan that addresses the development of apps to face issues or situations of public interest. A road is assumed to be a major project, with stakeholders and planning, but an application that collects data on millions is still treated as a government freebie to the citizens that you should take without asking questions.

We focus here on three recent cases where the Government relied on intermediaries for projects that exploited large amounts of personally identifiable information but lacked control of it or didn’t set proper rules to prevent misuse.

Public security when hailing a ride: Wachitaxi

In May 2017, the Peruvian government held a press conference for an app that was meant to bring security to taxi passengers in the country. As context, in Peru taxi services run largely unsupervised: even though permits exist, almost anyone with a car can pick up passengers. Even before the arrival of ride-hailing apps, this was already a concern in terms of passenger safety: a passenger doesn't know the driver’s name, if the taxi plate is real, or even if the driver owns a license. Taking a taxi on the streets of Peru is a lottery: you don’t know if the driver is going to assault you or not. As some of the most famous technology platforms began their operations in Peru, the cases where a taxi passenger was robbed or injured got more visible.

In this scenario, the Ministry of Interior presented “Wachitaxi,” a smartphone application that allowed users to “track” their trips through surveillance. Users of this app could save pictures of the driver and the license plate of the vehicle, as well as manually entering their route, and everything through the application to a trusted contact. The trip would be also monitored in real time via GPS and, if the users sent an alert or didn’t reach their destination, all this information would be shared with the police.

Something that the government toned down in their press releases, but was evident in the Terms of Service of the application, was its provenance. Wachitaxi was totally developed and hosted by a private company called For Innovation Technology Big Data S.A. (FIT), whose other project is a “financial score” monitor. Although this was not stated in the agreement signed between the Ministry and the company, according to its Privacy Policy the application collected a large amount of personal data from users and produced statistical reports that the company could later sell to third parties. Thus, the data generated from the use of Wachitaxi remained the company's property and there are no guarantees that the same data will not be used in different projects.

However, due to the poor quality of the app, the lack of dissemination and, mainly, due to the absence of a comprehensive plan that addresses the problem of citizen security in the use of street taxis, the project was canceled silently a few months later.

Non-profit private development against novel coronavirus

In April, the Peruvian government presented "Peru En Tus Manos," a smartphone application to collaborate in the fight against the novel coronavirus through different methods of contact tracing. Despite such an important mission, it wasn’t the result of a government plan but the donation of a wide array of third parties like universities and private companies.

However, what Hiperderecho was able to discover about its development was the complete nonexistence of a framework of collaboration in this regard. Following several requests for access to public information, we discovered was no agreement, covenant or public contract covering the development of this app with any vendor. On the contrary, the only thing that formally existed were the proposals made by the companies. This lack of leadership and presence of the Peruvian government in the development of Peru En Tus Manos, as a public-private alliance, is extremely worrying giving the amount of data it collects.

As a consequence of this lack of strategy, the application’s purpose and efficacy is still hard to measure after three months. The app was presented on April 3, but it was only on May 23 that a favorable report regarding the development of ”Peru En Tus Manos” was issued by the corresponding body of the Peruvian government. In other words, the Peruvian government was encouraging the use of an app that did not have its own internal approval or a plan of continuity.

A similar situation happened with the release of the automated chatbot called BotPe. This tool, which was a public-private alliance with one of the largest insurance companies in the country, provided information about the novel coronavirus through a chat that any citizen could use on the official website of the Government. Once again, when requesting more information about this collaboration, the Peruvian government informed us that there were no agreements or contracts regarding its development. After local journalists started to question the involvement of an insurance company, the lack of transparency regarding whether it collects personal data and what it does with it, the tool was removed from the page of the Peruvian government.

In all of these cases the Government seems to end up having access to the data being generated. In some of these cases, such as the Wachitaxi case, the data still belongs to the company, and in the others, the data belongs to the Government but with some unspecified degree of access from the private companies. This extremely unclear level of unregulated data sharing is deeply concerning. The Government having access to, for example, information about your taxi trips gives them a back door to access your movements. The government needs to be absolutely clear about what data goes where and who has access.

Collaborations between the government and private companies can be powerful mechanisms to tackle complex public challenges. However, appropriate and transparent agreements are necessary to prevent putting citizens’ privacy at risk and foster trust in the projects.

Article written by Miguel Morachimo and Dilmar Villena from Hiperderecho, a non-profit Peruvian civil association dedicated to investigating, facilitating public understanding, and promoting respect for rights and freedoms in digital environment.