Is tracking adherence to stay-at-home mandates a privacy concern?

The goal of providing the data is to see how well people in certain areas of the United States are heeding stay-at-home orders by tracking the movements of people’s cell phones as they carry them to the grocery store, pharmacy, or park. Such would allow health officials to assess how well the government’s orders are being followed and, along with monitoring infection rates, help determine whether the orders should be strengthened or loosened.

Like General Motors retrofitting an auto plant to manufacture ventilators or New Balance switching from making running shoes to face masks, Google’s offer should be viewed as a good-faith attempt to help the country during an unprecedented time of national distress.

And yet, releasing data sets that track people’s movements “does raise significant privacy concerns,” said Hilary Wandall, senior vice president, privacy intelligence and general counsel at TrustArc, a compliance and risk management consulting company.

Should someone figure out how to reidentify individuals, she said, they could use the data to track the movements of a particular individual. Other data sets, once reidentified, might allow others to know who has been quarantined as sick with coronavirus and where they live.

Privacy is always a bit of a balancing act, said Brian Kint, a certified information privacy professional and member of the firm Cozen O’Connor. Law enforcement and privacy advocates rightly disagree over whether using information from third parties like cell phone providers to track customers is an invasion of privacy.

In this case, where Google is anonymizing and aggregating the data it provides to the government, “this kind of use falls on the right side of privacy law,” he said.

“The problem right now is we are in the center of a huge public health concern that we are trying to solve as fast as possible, but we still have to be mindful of privacy and risk obligations.”

Hilary Wandall, SVP, Privacy Intelligence and General Counsel, TrustArc

Another aspect of the Google data is that cell phone users are providing it voluntarily. Most phones have set geolocation functions to off when they are sold; it is up to users to turn them on, so that their friends can announce which restaurant they are currently dining in or so parents can track the location of their teenager’s phone.

Kint points out that during pandemics, exceptions to the Health Insurance Portability and Accountability Act (HIPAA) allow for government agencies to release an individual’s health information to protect public health. On the flipside, it’s not OK for governments (in democracies anyway) to track individuals with positive coronavirus tests to ensure they don’t stray from home during a mandatory quarantine, for example.

“That’s where the slippery slope comes in,” Kint said. Releasing individual data could also become the foundation for an unfair trade practice, if a cell phone provider promised a customer that certain kinds of data would not be released to law enforcement but then did it anyway without receiving the individual’s consent. Law enforcement must obtain a search warrant or subpoena to get access to data on an individual. It is a founding principal of American democracy.

The compliance conundrum of coronavirus

Companies large and small are wrestling with how to handle information gathered on employees who test positive for coronavirus. When workplaces were open, a positive test meant sending an employee home and thoroughly cleaning the workspace. Health officials might contact all of the people that infected person came in contact with, including coworkers, as a means to trace the infection.

But now many people are working from home. Those work-from-home employees are not obligated to inform their employer that they are sick with coronavirus—only that they are too sick to work, Wandall said. Those employees can safely self-quarantine without exposing their fellow coworkers to the virus.

If the employee chooses to inform his or her employer, the employer should have privacy practices in place for handling this information, she said. It is vital for employers to collect only the information they need, share it only with those within the organization who need to know, and be careful both where the information is stored and for how long. Be transparent about the processes while not unnecessarily revealing an employee’s positive test for coronavirus, Wandall said.

“The problem right now is we are in the center of a huge public health concern that we are trying to solve as fast as possible,” Wandall said, “but we still have to be mindful of privacy and risk obligations.”

Ethics concerns as well

Even if a government can track an individual in quarantine, should they?

“The question is, how do you do good with these huge data sets in a way that does not create ethical issues?” Wandall asked.

For example, a government can order someone who has tested positive for coronavirus to quarantine in their home for two weeks. In western democracies, these quarantines have largely been voluntary, but these same governments could choose to make quarantines mandatory and enforce them as they see fit.

“But is that the society we want to live in?” Wandall asked. “We are not prisoners, and we want to congregate together in public places. It’s a liberty we hold dear.” At the same time, it is also part of the social contract not to knowingly spread coronavirus to others.

China, led by an autocratic regime, is not bothered by civil liberties or the rights of the individual. For years, China has been developing a nationwide, technology-driven strategy to monitor individual citizens on a massive scale. During the coronavirus, this poorly kept secret strategy has become much more visible, as it has used this digital monitoring apparatus to enforce home quarantines.

“Chinese have long been aware that they are tracked by the world’s most sophisticated system of electronic surveillance. The coronavirus emergency has brought some of that technology out of the shadows, providing the authorities with a justification for sweeping methods of high tech social control,” according to a recent Reuters story.

And because surveillance technology—not just cameras on street corners and at subway stations, but artificial intelligence programs that can recognize faces the cameras pick up—is readily available, other countries are following China’s lead, according to a December 2019 story in Time magazine.

“Last year, London police made their first arrest based on facial recognition by cross–referencing photos of pedestrians in tourist hot spots with a database of known felons. A few months earlier, a trial of facial-recognition software by police in New Delhi reportedly recognized 3,000 missing children in just four days,” the Time story said. “In August, a wanted drug trafficker was captured in Brazil after facial-recognition software spotted him at a subway station. The technology is widespread in the U.S. too. It has aided in the arrest of alleged credit card swindlers in Colorado and a suspected rapist in Pennsylvania.”

As technology used to monitor people becomes more accessible and available, the push and pull between the right of government to enforce public safety and public health, and the rights of the individual, will only become more pronounced.