By: Yasmin Hayre
Until a vaccine becomes available, primary ways of preventing the transmission of COVID-19 include interventions such as contact tracing. The scale and speed needed for such tracing are unprecedented, and technology companies have worked quickly to collaborate with various public health experts to develop tools, such as smartphone apps, that aid in COVID-19 response efforts. Many of these technologies present numerous risks and concerns, such as how data is gathered and used, as well as how to integrate these tools into the public health infrastructure. The success of these technologies and their associated risks heavily depend on public support and trust in these companies and the government that privacy rights and protections under the Fourth Amendment will be preserved.
The COVID-19 pandemic, also known as the Coronavirus pandemic, is an ongoing serious global health threat that has consequently resulted in the nation’s top concern being the preservation of its citizens’ health. Researchers have suggested that one way to mitigate the spread of the virus is to utilize artificial intelligence technology to track infectious diseases by tapping into peoples’ cellphone location data. Digital contact tracing, however, has sparked numerous controversies because of the privacy implications involved in adopting AI technology. The concerns revolve around significant data privacy risks, including “who has access to any data including public authorities and for what purposes, whether the use of the solution is voluntarily or mandatory, whether the data is encrypted, whether users are anonymous, what is revealed by infected users to individuals they come into contact with, whether the system can be exploited by external parties, and how reliable and secure the system is.” Thus, at issue is how the government can utilize AI technology to track and monitor individuals to slow and combat the pandemic, while also preserving peoples’ privacy rights and protections.
The technologies employed by governments around the world are aimed at preventing the further spread of COVID-19 by identifying and monitoring individuals who may have been exposed to the virus. The hope is that digital contact tracing will avoid the challenges presented by traditional contact tracing, which is “a labor- and time-intensive process demanding both technical training and interpersonal skill.” Authorities in Asia have experimented with the most intrusive forms of digital contract tracing, surveying user’s movements and locations. For instance, in Hong Kong, the government imposed mandatory electronic wristbands that alert the authorities when people under quarantine leave their houses. In South Korea, China, and Taiwan, the approach would “run afoul of privacy laws in many other countries” because they did not seek permission from individuals before tracking their cellphones. These methods of digital contract tracing would be implausible in Europe and the United States, where privacy laws and individual’s expectations of privacy are more stringent, and thus governments have taken a different approach from Asian authorities, still utilizing phone-tracking strategies to slow the spread of the virus, but simultaneously working to ensure that peoples identities and locations are protected.
Apple and Google collaborated – and were dubbed “Gapple” – to create a “Bluetooth-based framework to keep track of the spread of infections without compromising location privacy.” For these apps to work, the individual will need to have both Bluetooth and location tracking features turned on – even though the actual physical location is not being tracked. There are instructions on how to utilize the apps for both iPhone and Androids; for example, if using iOS, “open Settings and select Privacy, Health, and COVID-19 Exposure Logging.” The phone logs onto other phones it comes into contact with, assuming the devices are running a COVID-19 tracking app and uses random numerical ID codes that change frequently and get trashed after fourteen days (the incubation period for COVID-19). The apps log the “length of time you’ve been in contact with each person (or rather each individual phone), and how far away you were, judging from the strength of the Bluetooth signals” and are completely an opt-in system, as one can control exposure notification in their settings.
When Apple and Google released their technology, they “planned to be hands-off”, providing the technology to the states, but leaving it up to them to “sort out how to integrate them into their local health systems”, which was designed to give states flexibility, but instead “turned digital contact tracing into a political football and a headache for public health officials.” Utah, for example, decided to ignore the Gapple framework and instead put together its own tracking app. Rhode Island, Massachusetts, California, Louisiana, and New York City all paired with software company Salesforce to launch a new contract-database system. “Only six states—Alabama, Arizona, Nevada, North Dakota, Virginia, and Wyoming—signed on to [the Gapple] vision. Forty-four did not.”
Regardless of what app is being used, “digital technology has so far failed to stem the worst pandemic in a century.” In European countries, the pandemic response is coordinated nationally and thus releasing an app and integrating it into the existing public health system was relatively straightforward. In the United States, however, “policies, attitudes, and even software systems differ between and within states” and there is no unified, national strategy. As a result, efforts at contract tracing have become mired due to a number of reasons, the chief complaint being privacy law issues which leads to a lack of public support. As the United Nations’ special rapporteur on privacy rights commented, “Things are going too fast, and not enough scrutiny is being applied.” In Utah, for instance, few people downloaded the app and the public health departments declined to use it. Generally, other apps have proven to be insufficiently accurate or sent location data to third parties, violating peoples’ reasonable expectations of privacy. As a result of distrust in the apps, and moreover in the government with regards to preserving privacy rights, many states have just resorted to “plain old vanilla contract tracing.” As a consequence, lawmakers have realized that “voluntary contact-tracing apps that claim to preserve users’ privacy, such as the one proposed by Apple and Google, aren’t effective without high levels of participation.” People are also fearful that after the health emergency has passed, any curtailments of privacy and democratic rights create risks that measures may become permanent or be hard to reverse.
Additional, crucial issues with the apps include the fact that COVID-19 contract tracing is on a gigantic scale and the outbreak of cases often surges beyond public health officials’ ability to trace cases. Managing these efforts has proven to be tremendously difficult, as researchers at George Washington University estimated that many states have fewer contact tracers than they need. Finally, contract tracers have reported numerous difficulties in getting people to follow advice to quarantine and seek testing, especially when they cannot officer resources such as childcare to help.
Despite the myriad of issues involved in using the apps for contract tracing, one thing has been made evident: the United States needs a more national response. Obviously, the biggest concern for citizens is preserving Fourth Amendment protections, but in the face of a public health crisis, “the reasonable expectations of privacy must be substantially reduced.” This is true for the chief reason that the government has a clear interest in protecting the public from the virus, “which would warrant an exception to the Fourth Amendment.” Until a vaccine is publicly available certain security measures can be taken to help ease the public’s concern, such as storing personal data in secure servers that are automatically erased after a certain number of days. The information should not be collected or maintained for longer than necessary to “accomplish the purpose for which it is being collected.” Furthermore, people should have the right to get tested the old-fashioned way, rather than through their smartphones. Additionally, local health officials who oversee traditional contact tracing should be involved in the process of designing new apps or modifying old ones to recognize and combat challenges. Despite the potential backlash, individual tracing is necessary, and policymakers should not impede the use of technologies that can help ameliorate this global pandemic. There are numerous issues with the technologies that stretch beyond the scope of privacy intrusions that must be first resolved. This must be done while maintaining an appropriate balance of privacy interests with government overreach because privacy, “as a moral or legal principle, does not trump all other laws or interests.”
Student Bio: Yasmin Hayre is currently a second-year law student at Suffolk University Law School and a Staff Member on the Journal of High Technology Law. Prior to law school, Yasmin received a Bachelor of Arts Degree in Biology and Education from Bowdoin College.
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHTL or Suffolk University Law School.
