S.T.O.P. Contact Tracing Scorecard: NYU
Overview
Updated November 5, 2020
App: NYU Mobile
Developer: New York University
License: Unspecified
Summary: As of August 16, 2020, NYU requires all NYU faculty members, as well as any students allowed to the university premises, to complete a daily screening for COVID-19.[i] The screening is carried out either through the “Daily Screener” function in the NYU Mobile app, available both for iPhone and Android (NYU Mobile), or by responding to questions through the web version of the Daily Screener. [ii]
Tracking technologies
Anyone who plans to enter an NYU building needs to first complete the NYU Daily COVID-19 Screener (the “Daily Screener”) before leaving their home. The Daily Screener requires users to check their body temperature and respond to questions, including if they have had any symptoms of COVID-19 the last two weeks, if they have been traveling in any restricted area and whether they have been socializing with anyone known to be infected with COVID-19. Once all questions have been answered, the Daily Screener provides the user a result by sending either a green (pass) or red (fail) screening result.[iii] The result is only valid for that particular day and must be shown to a Public Safety Officer before entering an NYU building.[iv] In case of failure of the Daily Screener, the person may not access any NYU buildings, with exceptions for anyone living on campus.
In addition to the Daily Screener, NYU requires visitors to submit a COVID-19 Reporting Form if they:
Have symptoms of COVID-19;
Have been diagnosed with COVID-19;
Have been in close contact with anyone who tested positive for, or shown symptoms of, COVID-19; or
Have spent time in a state on the NYS Travel Advisory list or country on the CDC Travel Advisory list. [v]
NYU Mobile’s access to the user’s phone
Once downloaded, NYU Mobile gets access to several functions of the user’s phone, including:
Location: GPS, cell tower, and Wi-Fi tracking;
Cellular data;
Camera;
Photos/media/files;
Smart assistant;
Notifications;
Storage;
Background app refresh; and
Other functions such as receiving data from the Internet, viewing and accessing network connections, controlling vibration, and preventing the user’s device from sleeping. [i]
[i] Please note there is no information about the application’s access in NYU Mobile, but rather this information is available by checking the access in the user’s phone as well from information provided by the provider of the specific operative system.
Insufficient information provided to NYU Mobile users
NYU Mobile does not disclose what data is being processed through the application or how such data is being processed. Although NYU’s website contains a “Digital Web and Mobile Privacy Statement” (the “Privacy Statement”), the scope of the statement is vague and its content is outdated, as further discussed below.
i. The applicability of the Privacy Statement is unclear
NYU includes a “Digital Privacy Statement” on its website, but there is no link or other reference to the statement, or any other privacy policy, within NYU Mobile. In fact, the scope of the Privacy Statement is unclear and contains no specification of what platforms are subject to it.[vii] If the Daily Screener is governed by NYU’s overall Privacy Statement, such protections are manifestly insufficient; however, in the alternative, if the Daily Screener has no applicable privacy policy, the implications are far worse, leaving student and staff privacy completely in the air.
ii. The Privacy Statement is obsolete
The Digital Privacy Statement is alarmingly vague, but even more concerning is the fact it is largely out of date. The Privacy Statement was last updated on December 9, 2013, long before the Daily Screener was ever contemplated. Considering that the NYU Privacy Statement was last updated almost seven years ago, it is difficult to fully comprehend how and what data the application processes about its users. However, this scorecard highlights some of the discrepancies that clearly exist between the information collected through the Daily Screener function and the existing Privacy Statement.
iii. The Privacy Statement is coercive and does not mention health data
The Digital Privacy Statement holds that “NYU will not collect personally identifiable information about you when you visit our websites or digital properties unless you voluntarily provide us with that information.”[viii] While use of the Daily Screener is, in some senses, voluntary, it is also highly coercive. Students’ refusal to use the application results in them being barred from campus facilities, potentially endangering their coursework, enrollment, or even immigration status. The Privacy Statement further states that to the extent personal identifiable information is collected, the information is only used to fulfill the user’s requests of NYU’s information or services; provide relevant information; and conduct research surveys.[ix] There is nothing within the Privacy Statement informing the users that their data, general or health-related, is collected or processed for the sake of permitting or prohibiting access to the premises of NYU.
iv. The Privacy Statement lacks sufficient information about the usage and sharing of data
The Privacy Statement further claims that no personal identifiable information is being shared. However, in case of a failure of the Daily Screener, NYU states that the “NYU COVID-19 Prevention & Response Team—whose members are not identified—may contact you to discuss your responses”.[x] NYU confirms that the university notifies city health authorities of any positive cases on campus and the steps taken by NYU to carry out contact tracing.[xi] However, this transfer of data is not reflected in the Privacy Statement.
Equity and inclusion
NYU Mobile as well as the NYU Privacy Statement are currently available exclusively in English, creating a massive barrier to adoption by English language learners and non-native English speakers. Even those students and staff who are proficient in English as a second language may face significant difficulties with medical terminology in their non-native language. Although NYU offers the possibility to conduct the Daily Screener not only through NYU Mobile but also online through any web browser, the visitor must be able to show an email with the result from the Daily Screener to enter the premises. Thus, the actual possibility of having access to campus without a smart device is limited. As a result, older and low-income individuals may not have access to NYU premises as these groups generally have a lower access-rate to the necessary technology.
Conclusion
Although we understand and support the fact that NYU needs to take measures to ensure the safety of its staff and students, there are severe privacy and equity risks inherent in the measures taken by NYU. Due to the limited information available, it is not possible to make a complete overview of the integrity concerns raised by NYU Mobile and the Daily Screener, but it is certain that such concerns exist and we hope NYU takes further actions to not only protect the health of its staff and students but also its integrity.
_____
[i] “NYU Returns: IMPORTANT COMMUNICATION - COVID-19 Testing and Quarantining Procedures for Fall 2020-2021”, dated July 30, 2020, https://www.nyu.edu/life/safety-health-wellness/coronavirus-information/messages-to-the-community/nyu-returns-important-communication-covid-19-testing-quarantining-and-early-arrival-procedures-for-fall-2020-2021-faculty.html.
[ii] “Daily COVID-19 Screener for Campus Access”, https://nyushc.iad1.qualtrics.com/jfe/form/SV_3lVuHzaMUg2QTHL.
[iii] The result is both shown directly on the screen and sent to the user via email. We tried the application on September 17, 2020 responding that we had not taken our temperature. Notwithstanding this, the result was green, and we would have been allowed to enter the premises.
[iv] Except to pass the Daily Screener, anyone visiting campus must have prior authorization to access NYU’s premises.
[v] “COVID-19 Reporting Form”, https://nyu.qualtrics.com/jfe/form/SV_bCvIk6DpqWeFsJT.
[vi] Please note there is no information about the application’s access in NYU Mobile, but rather this information is available by checking the access in the user’s phone as well from information provided by the provider of the specific operative system.
[vii] The Privacy Statement “governs the collection and use of information collected through official NYU websites and other NYU digital properties.” Please see the Privacy Statement under the headline “Digital Web and Mobile Privacy Statement”, https://www.nyu.edu/footer/copyright-and-fair-use/digital-privacy-statement.html.
[viii] See the Privacy Statement, under the headline “Information Gathering and Use of Information - Personally Identifiable Information”.
[ix] Id.
[x] See supra note ii. There is no information of who are members in this team. We were contacted by NYU after accidently submitting positive health symptoms in the process of testing the contact tracing functionality in NYU Mobile.
[xi] Please note that NYU provides some additional information about its contact tracing process on its website, however, from a privacy perspective, this information is arguably still insufficient. Furthermore, there is no reference to the information provided neither in NYU Mobile nor the web-version of the Daily Screener. Please see the information provided by NYU here: https://www.nyu.edu/life/safety-health-wellness/coronavirus-information/safety-and-health/contact-tracing.html#contactTracing.