Big Brother in Public Health? New Contact Tracing Tactic Raises Privacy Concerns

A bottle of sanitizer sits on the bar as tape marks an area to keep clear for social distancing at a Houston restaurant on April 24, 2020.

A bottle of sanitizer sits on the bar as tape marks an area to keep clear for social distancing at a Houston restaurant on April 24, 2020. AP Photo

 

Connecting state and local government leaders

Requiring businesses to keep customer logs could undermine the public trust necessary to effectively conduct contact tracing, says one public health expert.

Tech companies’ development of contact tracing apps to assist in efforts to contain the coronavirus outbreak has researchers and lawmakers alike worried about the protection of sensitive personal health information. 

But an analog contact tracing tactic that some state and local governments are deploying—requiring businesses to collect data about their customers and turn it over to health departments if there is a connection to a positive case—is also raising privacy concerns among some public health officials.

The practice of contact tracing, which requires investigators to ask infected individuals to disclose detailed information about their movements, who they came in contact with and personal health information, involves developing trust between the patient and health agency engaged in the effort, said Matt Prior, spokesman for the National Coalition of Sexually Transmitted Disease Directors. Forcing businesses to keep customer logs and turn them over to government agencies could undermine that trust, he said.

“The more data, the more tools in the toolbox of the contact tracer the better, but fundamentally contact tracing is meant to be done in a way that is respectful of people’s freedoms and privacies,” Prior said. “I don’t think this does anything to advance the trust that a marginalized population would have of these authorities.”

Contact tracing has been a key part of STD public health strategy for years and the coalition is assisting in efforts to train new contact tracers who are quickly being hired to help with the coronavirus outbreak.

As state and local governments expand their contact tracing capacity, some have moved to require businesses to keep logs of their customers or are exploring the option. The idea is that when someone tests positive for Covid-19, health officials could swiftly trace their path, obtain customer logs for any businesses they visited, and warn other customers who may have been at risk of infection. With a highly contagious respiratory illness like Covid-19, which some people have spread without even realizing they are infected, public health officials said quickly tracking a person’s movements and notifying any potential contacts is paramount. 

Washington Gov. Jay Inslee this week issued an executive order which requires restaurants to keep a daily log of customers that includes their contact information and the dates and times of their visits. But on Friday, Inslee issued a clarification noting that while restaurants would be required to keep customer logs, customers would not be mandated to provide their personal information.

“If we learn you may have been exposed to Covid-19 during your visit, we will only share this information with public health officials,” said Mike Faulk, a spokesman for the governor. “They will contact you to explain the risk, answer your questions and provide resources.”

Any information collected by restaurants will only be used for contact tracing purposes and customer lists will be destroyed within 30 days if they are not used, Faulk said.

The American Civil Liberties Union pushed back against the original order, calling mandatory logs an invasion of privacy, and wrote to the governor asking him to incorporate additional safeguards instructing businesses on how to protect the private information they collect voluntarily. 

“Business logs cannot be susceptible to disclosure beyond the tightly limited purposes of contact tracing,” the ACLU of Washington wrote. “Without appropriate safeguards, contact information can be disclosed to immigration agents, law enforcement, advertising companies, identity thieves, stalkers, and harassers.” 

Even though voluntary, the new rules “do not address how businesses must protect customers’ private information,” the ACLU said. “The rules refer to businesses keeping logs, but do not specify exactly what information must or may be requested.”

Contact tracing best practices, when used to manage other disease outbreaks, have never recommended this type of third-party disclosure, Prior said. The coalition is supportive of innovation in the field, but rather than put the onus on businesses, which may not be educated in health privacy and confidentiality laws, Prior said local governments might find it more effective to rely on the network of contact tracers trained to collect the information in a responsible manner. 

“Trust is paramount when it comes to anything involving people’s private health information,” he said. 

Washington state is trying to quickly ramp up its force of contact tracers, with Inslee last week saying the state has trained about 1,400 people. 

A federal judge is expected to weigh in soon on the legality of requiring businesses to collect customer data for contact tracing purposes. Health officials in Linn County, Kansas issued an order this month that required businesses ranging from doctor’s offices to restaurants to banks to keep customer logs. 

U.S. District Judge Holly Teeter heard arguments Friday in the case and is considering whether to grant a temporary restraining order that would ban the county’s enforcement of the ordinance.

Attorneys for the county argued the order did not violate Fourth or Fourteenth Amendment protections because the health department would first ask businesses to voluntarily comply and later seek a warrant for the information. 

“A business’ voluntary provision of its records does not offend constitutional rights,” attorneys for the county wrote in a court filing defending the order. “In the event a business elects not to voluntarily comply with a request to provide the customer logs, a judicial warrant can be sought for that information (providing the business with adequate protection of its Fourth and Fourteenth Amendment rights).”

Attorney Kevin Case said during Friday’s hearing that there “has been no effort to date to actually access the data that we have set forth should be compiled by this order.”

A newspaper publisher and restaurant owner challenged the order alleging it permits the “unreasonable, nonconsensual, suspicionless, and warrantless searches or seizures and violates the privacy rights of those required to be listed,” and violates their constitutional rights.

Samuel MacRoberts, a Kansas Justice Institute attorney representing the publisher and restaurant owner, said the county’s legal arguments appeared to be trying to rewrite the intent of the health order.

“There is nothing voluntary about it. It says it will penalize people who do not hand over this information,” MacRoberts said. 

While Case argued compliance with the order was voluntary, Teeter at times appeared skeptical of that assertion. She noted that even if the county only takes action against businesses, and not customers, to enforce the order, customers’ personal information would still be disclosed.

“At this point it’s not voluntary, is that correct?” she said.

Referring to the U.S. Supreme Court ruling in Carpenter v. United States, which established greater digital privacy rights protections, Teeter asked county attorneys to explain why plaintiffs would not have standing to challenge the third-party disclosure of their personal information.  

Case said that when customers enter a public business, their expectation of privacy is diminished.

“You cannot voluntarily enter a place where there are people around and claim it is private,” he said.

MacRoberts countered that protection against warrantless searches still exists in the public space. 

“You don’t give up your rights when you venture out into the public. You still have Fourth Amendment rights,” he said.

Andrea Noble is a staff correspondent with Route Fifty.

FEATURED CASE STUDIES
Powered By The Atlas
Corpus Christi Deploys COVID Management System to Improve Data & Eliminate Time-Consuming Tasks
Corpus Christi, TX, USA
Safer Holiday Celebrations Connect Residents and Support Local Business in Franklin, TN
Franklin, TN, USA
Mobile-first Crisis Communications in Dublin, OH
Dublin, OH, USA

NEXT STORY: The Hidden Crisis: Caring for Vulnerable Adults at Home During the Coronavirus

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.