Contact Tracing Privacy Concerns

-- By SophiaHan - 08 Mar 2022

Introduction

Since its emergence in late 2019, COVID-19 has usurped many facets of our everyday living. From mask mandates to stay-at-home orders, old norms of daily living were quickly replaced by the harsh reality of living in a public health crisis. Amidst these changing norms, concerns about privacy arose as governments across the world implemented various tracking utilities to monitor and fight the spread of the virus. Even private companies, at the behest of the government, began to monitor their employees, checking their health status and travel.

Most notably, contact tracing apps have been heralded by many governments as a novel way of curbing the spread of COVID-19. However, the effectiveness of these apps is balanced by the level of privacy measures in place.

COVID-19: Contact Tracing Apps

On October 1, 2021, New York state released an app that can notify people if they have come into contact with someone who tested positive for COVID-19. Called “COVID Alert NY,” the app is one of several in the United States based on Apple and Google’s surprising joint privacy preserving contact tracing system. Apple and Google’s contact tracing system uses Bluetooth to enable exposure notification, and is opt-in and anonymous to assuage some of the privacy concerns. When a person opts in to receive exposure notifications, their phone emits a Bluetooth signal that is shared with nearby phones that have also opted in to the system. If a person tests positive for COVID-19 and enters a code from a public health authority into the system, notifications are sent to other people’s phones that picked up the infected person’s signal within the past 14 days.

Other countries worldwide have had mixed success with similar contact tracing apps. In South Korea, for example, contact tracing apps were relatively effective in curbing the spread of the virus, but at a significant cost to people’s privacy. The South Korean government used phone logs, card transaction records, and surveillance camera footage to monitor infected people’s locations and close contacts. Interestingly, public opinion in South Korea about surveillance have been positive. On the other hand, European countries, which tend to be more privacy conscious, opted for a voluntary app-based model. Compared to South Korea, European countries have had fewer success. Researchers estimate that it would take roughly 60% of a population to participate in a voluntary contact tracing program for it to be effective without any other severe measures (e.g., lockdowns). But no European country has had that high of a download rate.

In the United States, contact tracing apps have undoubtedly been a huge failure. A key reason for this failure was the lack of trust among Americans in the tech companies and the government. One survey reported that 71% of reported smartphone users would not use the app because of privacy concerns. This is unsurprising given how little information the public is told on privacy laws.

Insufficient Privacy Protections

Considering the breadth of influence technology has over our lives, it is surprising to find how few protections privacy laws afford us today. As it stands, the United States has no baseline data protection law that would protect sensitive data obtained from contact tracing apps. While there are privacy laws that protect certain data in certain market sectors, they don’t necessarily require that data acquired from COVID-19 tracing apps be securely stored and disposed, or used only for tracking the virus. It would be fairly easy for the data to be given to insurance companies, employers, creditors or the like. We see limitations in privacy protections in other areas as well. The Health Insurance Portability and Accountability Act (HIPAA), for instance, protects medical information but only for data collected and used by a “covered entity” or “business associate,” such as a hospital or insurance provider.

The Federal Trade Commission Act allows the FTC to have limited enforcement authority for privacy intrusions related to consumer protection. Specifically, it permits the FTC to challenge “unfair or deceptive acts or practices” in commerce, such as misrepresentations about data privacy or data practices that cause substantial consumer injury. While the FTCA may arguably be the broadest federal law when it comes to privacy, it is insufficient to meet the specific privacy needs that arise from COVID-19. The Act fails to regulate how data from COVID-19 tracing apps can be used, stored, or shared. It generally leaves these crucial decisions up to the companies themselves.

Some state laws attempt to narrow the gap left by federal privacy legislation. Perhaps one of the most robust privacy legislation, the California Consumer Privacy Act (“CCPA”) gives individuals more control over their personal information that businesses collect, such as the right to delete some personal information collected from them, the right to opt-out of the sale of their personal information, and the right to know about the personal information a business collects and how it is used and shared. But even this statute is limited, as it does not pertain to government agencies and would hardly cover the nationwide scale of contact tracing apps.

Conclusion

The COVID-19 pandemic revealed how sorely ill-prepared the United States is in handling a global public health crisis. Contact tracing apps have been proven to be effective, but only to the extent that the public is willing to use them. An obvious hurdle to this is getting more Americans to trust major tech companies and the government. This can be achieved if we had better privacy protections in place to regulate government control of our personal data.

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, SophiaHan
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.