Authored Articles & Publications Jan 08, 2021

Best in Law: Protecting Privacy on COVID-19 Contact Tracing Apps

Glen Price Discusses Privacy Issues Around COVID-19 CA Notify App and Others

By Glen Price

From the beginning of the COVID-19 pandemic, public health officials around the world have looked to use the benefits of big data and the ubiquity of smartphones to help track and stop the spread of the virus. The ability to track smartphone users with location data and Bluetooth to better understand community interaction and the geographic spread of the virus appeared to be a practical and societal good.

But the promise of digital tracking hit two roadblocks: First, compliance with the legal requirements of data privacy regulations, such as the California Consumer Privacy Act, the European Union General Data Protection Regulation and federal and state protections of personal health care information, such as HIPPA and, secondly, general concerns that sensitive personal information could be subject to government misuse or unauthorized disclosure by hackers.

With the recent revelations concerning a massive breach of government computer systems, including sensitive systems related to national security, the concern that personal data is at risk — regardless of legal compliance and ordinary security protocols — is a valid one.

One of the common features of privacy regulation is the ability to collect data if users consent to the collection and use of that data through a voluntary opt-in process. Most contact tracing apps released so far by governments are voluntary. This also extends to the contact tracing system set up by the California Department of Public Health, called California Connected.

The Department of Public Health requests information from individuals on a voluntary basis to conduct contact tracing of potentially infected individuals and provide them with counseling and advice on how to stay safe and quarantine. Health information collected by California Connected is confidential under federal and California law but can be accessed through a court order and the question of data security from a potential unauthorized breach remains.

Another common feature of privacy regulation is to allow the use of data if it is aggregated or anonymized so that any personally identifying information is stripped out. This is done routinely by government agencies and businesses as a way to legally mine information about groups of individuals, including patterns and preferences.

As a practical matter, aggregated or anonymous data has remained a concern because the prevalence of digital tracking of individuals across multiple databases can allow individuals to be identified if the right characteristics are chosen. Furthermore, aggregate and anonymous data, while potentially useful by public health officials to track trends and statistical variations in COVID-19 infections, is also not particularly useful for the work of stopping the spread of the virus in our communities. That effort requires the ability to trace individuals who may have been exposed.

The new CA Notify app attempts to avoid these pitfalls by making the process of exposure notification and contact tracing as voluntary and anonymous as possible. It does this by using the express model of the Google/Apple Exposure Notification System, which uses Bluetooth on phones to exchange random identifiers between phones that have been in proximity with each other and where virus transmission could have occurred.

These random identifiers are stored on the phone and no identifying information concerning the location or identity of the user is collected or stored by the government. When an individual finds out that he or she has tested positive, it is the user’s choice to enter a code into the app that will then send an anonymous notification to everyone whose phone exchanged the random identifier. This lets people know that they are potentially at risk and should look for symptoms, get tested and consider quarantine.

At no time is the identity of the person who tested positive, or where they were when the contact occurred, stored or revealed. Unlike some other states that use the Google/Apple system, California does not ask for supplemental information from users that could create privacy concerns.

In a shopping season where it is clear how much individuals are tracked online, as a click in a browser on a computer shows up almost immediately as an ad on mobile social media streams, people have good reason to be concerned about an app that could track their location and interactions at all times. But the CA Notify app goes about as far as possible legally and practically to protect privacy while attempting to save lives.

This article first appeared in The Press-Enterprise and other Southern California Newspaper Group publications online on Dec. 24, 2020. Republished with permission.

COVID-19 Legal Updates

COVID-19 Legal Updates

All BB&K communications on the rapidly changing laws and requirements related to COVID-19 for businesses and public agencies can be found here.

Stay Connected

Questions? Contact the author(s) of this article listed above.

    


Sign up to receive Legal Alerts, BB&K Webinar invitations and other eCommunications >

Continue Reading

Cookie Consent

By clicking “Agree,” you agree to the storing of cookies on your device to enhance website navigation, analyze website usage and assist in our marketing efforts. View our Cookie Notice here.