Getting on top of COVID-19 is a stress test for governments globally. One of their key strategies for containing the virus is tracking cases. On a national and global scale, that is impossible, unless you have a lot of health data.
Luckily for public health officials, there’s no shortage of health surveillance in the U.S. In the spirit of “flattening the curve”, privacy watchdogs and surveillance skeptics increasingly are debating if heightened tracking might be an appropriate approach to safeguarding public health under the exceptional circumstances the COVID-19 pandemic has created.
But even at a time when the benefits of these public health tools is clear, their privacy impact are uncertain and pose long-term risks to American citizens. For example, we simply cannot fathom how the information we collect to combat today’s emergency will be repurposed tomorrow.
Everything becomes “health data”
In order to expand government and corporate surveillance in the name of public health, we are enlarging what counts as “health data.” It was an ambiguous term before “coronavirus” became a household name, but now the Centers for Disease Control (CDC) is contact tracing travelers’ movements with the help of airline passenger manifests. Social media “check-ins” where users post their location to Facebook and other platforms, now are a tool for monitoring transmission sites. Suddenly, what movies you watch, where you travel, how you commute to work, and where you eat go from being consumer data into a metric of your COVID-19 exposure. This may, ultimately, inform whether we can work in the office, attend school, access mass transit or, indeed, see a doctor.
There are certainly cases in which this method has proved helpful. After the deadly spread of severe acute respiratory syndrome (SARS) in 2002, Taiwan implemented travel monitoring systems that proved helpful in combatting COVID-19. Using customs, immigration, and other travel records, officials were able to quickly identify individuals who had come into contact with the virus, conducting rapid testing and quarantine measures. Unlike in the U.S., this health surveillance has informed strict policies, ranging from total lock-downs to the rapid deployment of tests and other government-funded public health interventions. This type of evidence-based policy making is currently absent on American shores.
COVID-19 data can be re-used for oppression
In the U.S., COVID-19 has us rapidly developing new and invasive data collection practices that go far beyond what is needed to protect public health in the long-term. This weekend, for instance, the Wall Street Journal reported a previously undisclosed partnership by federal, state, and local agencies to monitor social distancing in over 500 cities using cellphone location data. This endangers democratic systems in the process. It should come as no surprise that the very same data that helps public health authorities to carry out contact tracing in the context of COVID-19 can easily be repurposed to monitor political movements, religious minorities, and other historically marginalized communities.
There are few restrictions on how much of the data being collected by the CDC. Private health-monitoring firms can be used by federal law enforcement, local police, or even ICE. Many of these records are subject to the third-party doctrine, the long-standing Supreme Court doctrine that holds that information provided to a commercial third party (e.g., a bank, a credit card company, etc.) often can be obtained without a warrant.
Some types of location tracking, such as the prolonged use of cellphone tower data, have recently been held to require a warrant, but nearly identical forms of tracking (such as automated license plate readers, GPS-based cell phone applications, and facial recognition), have yet to be addressed by the high court.
Bad laws stick, good laws are needed
In the U.S. there currently is nearly no legal guidance on how tracking and surveillance data should be treated in the public health context. History shows us that the American people are unlikely to get a nuanced response to that situation and face the danger of seeing a new law hastily passed that gives a free hand to the government, ignoring the risks to historically over-surveilled communities.
Notably, COVID-19 tracking sees these risks now crossing class lines: as of last week, New Yorkers who can afford to flee the city must pass traffic check points and enter mandatory quarantines. And while the outcry now is significant, it should have been from the get-go. Even though it remains to be seen how all Big Apple refugees will be monitored, we have to understand that we all face the risk that surveillance will turn state borders into 21st-century Iron Curtains, raising constitutional conundrums that would have been unthinkable just days ago.
For proof of the danger, one need only look at the aftermath of September 11th. When Congress enacted the USA PATRIOT Act, just a few weeks after the deadly attacks, the fear of terrorism blinded lawmakers to the threat of broad-based, suspicionless surveillance. Decades later, those same provisions, many of which were supposed to sunset in 2005, were still being renewed as recently as this week. If we pass hastily drafted measures to address the privacy impact of COVID-19 surveillance, there is no reason to think their impact would fade any sooner.
We need laws that protect citizens from the new privacy risks posed by COVID-19-induced data exploitation. This is even more crucial when we're including profit-motivated entities. Days ago, President Trump announced a larger private sector partnership as part of the White House’s COVID-19 response that included large-scale collaborations with Google, Walmart, CVS, Walgreens and others. New legal frameworks need to impose clear limits on how health data from the COVID-19 response can be exploited for other business lines.
To protect our democratic institutions in—and after—times of crisis and trauma, we need these frameworks fast, but we also need them to be resilient. We have all the information, tools and experts we need. We should get to work now.