Privacy issues Related to Contact Tracing
Written by: K. RAJEEV REDDY
Introduction
As shown by the many lawsuits challenging the collection and use of geolocation data over the last few years, consumers have concerns about being surveilled and monitored. But today, what was once hateful may be welcomed, as India joins other countries to consider deploying contact tracing technology to track those diagnosed with COVID-19 in an effort to minimize the further spread of the virus and help reopen the economy safely.
Even so, companies developing such applications should be cautious: privacy laws do not have a “pandemic response” exception that will protect them from liability if consumers decide to question pandemic-related data collection and use. So, where do the pitfalls lie?
What Is Contact Tracing?
Contact tracing is a public health tool for containing the spread of infectious diseases. For individuals who have been exposed to a confirmed case, the “contact” is identified, evaluated for risk factors, and urged to take steps such as quarantining to prevent or minimize further spread of the disease.
The objective of Contact Tracing
The objective of contact tracing is to reduce infections in the population. Contact tracing consists of a four-step process that includes:
- Testing individuals for infection
- Isolating infected individuals
- Tracing and locating their recent contacts and testing them
- Treating all infected parties.
Contact tracing is generally employed in cases of highly infectious diseases, such as tuberculosis, measles, HIV, blood-borne infections, Ebola, and novel viruses such as SARS and H1N1 and now COVID-19.
In addition to helping to diagnose and treat individuals found to be infected, or at risk of becoming infected, the analysis and use of data gathered during the contact tracing process deliver two important benefits:
- Interrupting ongoing transmission, reducing spread, and helping prevent reinfection.
- Enabling healthcare agencies to learn more about the origin, distribution, and control of a disease in a particular population.
For these reasons, contact tracing has been a cornerstone of communicable disease control for decades in the public health arena. As just one example of its effectiveness, smallpox was eradicated by exhaustive contact tracing to locate all infected individuals. They were then isolated for treatment, and the surrounding community, as well as other at-risk contacts, were immunized against the disease.
How Does Contact Tracing Work?
Let’s assume that Rajeev has come down with COVID-19. He has been isolated and is being treated and cared for, and his chances for recovery are excellent. A trained contact tracing professional comes to Rajeev’s bedside, or telephones him, with an extensive interview questionnaire. The trace begins.
Rajeev is asked to remember each person he came in contact with during the incubation period. Where was he? Was he in a public place or a private space? How many people did he come in contact with? Did anyone exhibit symptoms? In cases where he can identify individuals, he is asked to do so, with full names, phone numbers, email addresses, and home addresses if known. Other questions may include recent contacts due to travel or work. To review examples of additional data that may be collected, there are a number of contact tracing templates available online.
If Rajeev can provide even a hint of help in identifying and locating his contacts, the contact tracer can employ various databases to further identify and locate each contact. This is similar to the detective or investigative work sometimes required in a legal case.
Clearly, contact tracing is not a perfect process. It relies on individuals knowing who might have infected them and being willing to share personal information about that contact or contacts. It may rely on database searches to locate the contacts. And, logically, all of this happens without the prior approval of the contact him/herself.
Ideally, the potentially exposed individuals are contacted before they themselves have a significant opportunity to spread the virus. Tracing has traditionally been implemented by interviewing individuals, but to the scale of the pandemic, state and federal governments are considering more modern, technology-based methods to identify potentially exposed individuals for containment outreach.
Technological Perspective:
What Should Companies Do?
While COVID-19 has uprooted many routines, reliance on long-standing privacy principles continues to be key to risk mitigation. When it comes to privacy and the collection of data about individuals including contact-tracing data—companies should undertake the following practical mechanisms:
- 1. Anonymization/pseudonymization or masking of original data that cannot be associated with any one individual.
- 2. Editing of personally identifiable information when sharing it with any other process or organization.
- 3. Apps should not need to leak information on a user’s locations or other Personally identifiable information to other users.
- 4. System should have safety by design and safety from hackers and other malicious players who can target individual data.
- 5. Automatic purging of data can be incorporated, say after a stipulated period.
- 6. Independent audit by experts and clear published policies on data use.
- 7. Any breach should be justifiable, with a clear remedy and forum for redressal.
- 8. Clear legal backing with concrete provisions about specific aspects of intended use.
- 9. Notification to individuals and strict penalties for infractions.
- 10. The technology should always create a level playing field and not target individuals based on any characteristics.
- 11. Provide consumers with a notice about who, what, and when data is collected and how it will be used;
- 12. Obtain either opt-in or opt-out consent from the consumer;
- 13. Use and disclose the data only for the public health purposes for which it was collected;
- 14. Minimize the amount of data that is collected;
- 15. Reduce the retention period of any data collected; and
- 16. Maintain the security of the data as it is stored and processed.
Legal Perspective
Protecting Civil Liberties
In the midst of a pandemic, privacy and civil liberties issues may be put aside momentarily, but the long-term impact of these measures cannot be neglected. In the battle against the virus, an overemphasis on privacy could prove fatal for a large populace but one must keep in mind that even at this time of emergency, fundamental and human rights are inalienable. They are required to be protected by the state and in order to restrict any such rights, due process and reasonability need to be applied.
The Right to privacy stands on the following general principles:
- 1. Collection, use, and/or disclosure of personal information should only be done for purposes that a reasonable person would consider appropriate in the circumstances.
- 2. The individual’s knowledge and meaningful consent must be obtained for the collection, use, or disclosure of their personal information; and
- 3. Consent is only valid where it is reasonable to expect that the individual understands the nature, purpose, and consequences of the collection, use, and/or disclosure of the personal information to which they are consenting.
Conclusion:
As India and the world enter a very critical phase in the fight against a pandemic of unprecedented proportions, various legal, policy, and emergency measures have been pressed into force. These measures are saving valuable lives and salvaging the world from disastrous economic, humanitarian, and geopolitical consequences which may change the very nature of human existence on the face of the earth. While this fog of war between man and virus continues, it is for humanity to preserve human values, ethics, and the very essence of human nature. This can be ensured by adhering to time-tested ethical and legal principles expounded in the article. It is imperative that warfare for survival against a virulent pathogen is conducted with equity, fairness, and justice for one and all.
However, recognizing that, in today’s scenario when the world is facing a pandemic, in such critical situations, obtaining consent from an individual can be particularly difficult, and therefore the state may collect, use and/or disclose personal information without an individual’s consent. In a situation like this, the possibility that consent cannot be obtained in time and state is duty-bound to protect its citizen. There exist ample legislations that provide certain powers in a pandemic, those powers must inevitably apply ethical beliefs to decide if and how to use those powers because “law cannot anticipate the specifics of each public health emergency”.
Keywords: Privacy issues Related to Contact Tracing, Privacy issues Related to Contact Tracing in India, Recent Privacy issues Related to Contact Tracing
Previous Posts
Delhi’s Air Pollution Governance
Laws For Prevention Of Animal Cruelty
Constitutional Amendments in India
The Crypto Currency and Regulation of Official Digital Currency Bill, 2021
