Privacy and Free Speech During COVID-19

As the country begins to reopen, federal, state, and local governments are considering a number of different techniques to control the continued spread of COVID-19. And as some states stay in extended lockdowns, questions have arisen about citizens’ right to gather to protest.

Similar to the immediate aftermath of 9/11 — which saw the passage of the Patriot Act due to legitimate public fears over the potential for a second and even worse terrorist attack — government attempts to mitigate the effects of the pandemic and public fears stemming from COVID-19 have the potential to impact privacy rights.

David Grogan, director of the American Booksellers for Free Expression (ABFE), said ABFE will be actively monitoring current and post-pandemic federal and state plans to ensure that legislation, regulations, or rules regarding to the virus do not inadvertently chill people’s access to books and their right to read. Any techniques involving privacy and constitutional rights that are mandated or authorized by governments to slow/stop the spread of COVID-19 must include a strict sunset to ensure that these potentially privacy-infringing techniques do not outlive the pandemic.

At present, governments are considering the following techniques: contact tracing, digital contact tracing, temperature checks and testing, and immunity passports. Here, we delve into how these techniques will work, with a preliminary look into the possible privacy and free expression concerns they may spur.

Contact Tracing

What is contact tracing?

According to the Centers for Disease Control and Prevention (CDC), contact tracing involves public health staff (“contact tracers”) working with a patient to help them recall everyone with whom they have had close contact during the timeframe they may have been infectious. The CDC defines close contact as “someone who was within 6 feet of an infected person for at least 15 minutes starting from 48 hours before illness onset until the time the patient is isolated.” Contact tracers then warn the exposed contacts as quickly as possible.

To protect patient privacy, the exposed contacts are not told the identity of the patient who potentially exposed them. Exposed contacts are only told that they may have been exposed.

The CDC recommends that someone within close contact of an infected person should stay home, maintain social distancing (at least six feet), and self-monitor until 14 days from the last date of exposure. Contact tracers provide exposed contacts with education and information, including the possibility that they could spread the infection to others even if they never develop symptoms. The CDC instructs contact tracers to regularly check in with exposed contacts to make sure they are self-monitoring for symptoms; if contacts develop symptoms, contact tracers will link them to testing and care.

The CDC includes contact tracing as a key element in slowing/stopping the spread of COVID-19. According to the CDC, “If communities are unable to effectively isolate patients and ensure contacts can separate themselves from others, rapid community spread of COVID-19 is likely to increase to the point that strict mitigation strategies will again be needed to contain the virus.”

States have already begun contact tracing efforts. For example, New York, in coordination with New Jersey and Connecticut, announced a contract tracing pilot program. Former New York City Mayor Michael Bloomberg and his Bloomberg Philanthropies will work with New York’s Department of Health to identify and recruit contact tracers. The Bloomberg School of Public Health at John Hopkins University is building an online curriculum and training program for contact tracers. The baseline number of contact tracers is 30 tracers for every 100,000 people. Depending on the projected number of cases, additional tracers may be used. The program is expected to have between 6,400 and 17,000 tracers.

How may contact tracing infringe privacy rights?

While most experts say contact tracing has the ability to slow/stop the spread of COVID-19, the question remains: What will be required, if anything, of booksellers to help with contact tracing? And, of course, will these requirements infringe on the privacy of employees and/or a customers’ right to read? Right now, without any laws regarding tracking under consideration, that is an unknown.

The CDC says exposed contacts should be asked to voluntarily stay home, monitor themselves, and maintain social distancing from others. However, the CDC leaves open the possibility of forced quarantine, noting “health departments have the authority to issue legal orders of quarantine, should the situation warrant that measure.”

Further, effective contact tracing relies on a patient’s ability (and willingness) to remember everywhere they went during the infectious timeframe. The inherent problem with this is that a patient’s physical location is not relevant. The only relevant fact is that the patient came into close contact with others, regardless of where this contact occurred.

Digital Contact Tracing

What is digital contact tracing?

A challenging aspect of contact tracing is that it relies heavily on a patient’s ability to recall everyone they have been in contact with during the infectious timeframe. In order to reduce human error, some experts are turning to digital contact tracing.

For instance, the Massachusetts Institute of Technology (MIT) has introduced Private Automated Contact Tracing (PACT). This approach uses inter-phone Bluetooth communication as a proxy for inter-person distance measurement. This crypted system can be used to collect and maintain weeks of contact information to later be used to send infection notifications to all cell phone owners who have had medically significant contact (within 6 feet for 15 minutes as defined by the CDC) with an infected person within the past two weeks. According to the project leaders, “all of this can be done without revealing any private information to anyone (not to the government, the health care providers, the cellular service providers, etc.).”

Apple and Google have teamed up to work on a COVID-19 contact tracing software to use on public health apps. The companies laid out requirements for apps using their software. The requirements define how the system plans to protect user privacy. For instance, each user will have to make an explicit choice to turn on the technology (which can also be turned off at any time). Apple and Google say the system will not collect location data. The software will only be used by public health apps and will not be monetized. The user will control all of the data they want to share. People who test positive are not identified to other users, or to Apple or Google.

Other technology and security companies are also creating tools to help employers digitally track their employees’ exposure to COVID-19. For example, Salesforce, a software company, announced a new tool Work.com. This tool in part creates employee health surveys and maps workplace locations visited by employees with COVID-19 infections.

How may digital contact tracing infringe privacy rights?

Digital contact tracing may infringe privacy rights if location data is collected on a central server and can be used to trace the information back to a particular individual. As noted by the Electronic Frontier Foundation (EFF), technologies that use aggregate location data to combat COVID-19 “need strict safeguards.” While digital contact tracing using Bluetooth proximity is more promising than using location data, the EFF recommends this technology undergo careful security testing and be paired with other techniques to be effective.

Importantly, location data is not useful for tracing. It does not matter where a person was exposed to an infected patient; the only data that matters is the proximity to an infected patient. If data on who tested positive for COVID-19 is linked with a particular location and traced back to a specific person using digital contact tracing apps, this technique has the potential to turn into active surveillance by both the government and big tech companies.

Tracing apps have been used in other countries, including the United Kingdom and China. In the U.K., the National Health Service (NHS) built a centralized app that sends data about interactions back to the health service to help model the spread of the virus. Due to the decision to use a centralized app, the U.K. cannot use the tools being built by Apple and Google (which require decentralization). China’s app classifies people as green, amber, or red depending upon their level of exposure to the virus. This classification dictates where people can go and what they can do.

Further, any voluntary app to report your symptoms will be open to trolling. To be effective, the app requires people to honestly report their symptoms and test results. Unfortunately, some people are likely to falsely report they have symptoms and have tested positive to cause panic. As a result of these false positives, law-abiding citizens may be sent into mandatory quarantine for no reason. Additionally, experts say contact tracing apps will need to be downloaded and used by at least 60 percent of the population in order to be effective in controlling the virus. Most apps take years to reach this level of uptake.

Free speech and civil liberty groups are encouraging the public to approach digital techniques with caution. Alexandra Givens, the new CEO of the Center for Democracy & Technology, noted, “As leaders explore deploying contact tracing apps, we must examine not only whether the apps can be effective, but the privacy and security measures embedded within them and the rules governing their use. If these apps are useful enough to be implemented — a question still being debated — their adoption must have strict limitations on how employers and other decision-makers may use them, and firm sunsets on their use."

Temperature Checks and Testing

What are temperature checks and testing?

The CDC defines employee temperature checks as an optional strategy employers may use to screen employees for COVID-19 symptoms. Ideally, the CDC recommends employees administer their own temperature checks either before entering the workplace or upon arrival in the workplace. In any case, temperature checks should rely on social distancing, barrier/partition controls, and personal protective equipment (PPE).

In a frequently asked questions sheet, the Equal Employment Opportunity Commission (EEOC) says it is okay for employers to take employees’ temperatures. However, it is important to note that some people with COVID-19 never develop a fever and that some people with a fever do not have COVID-19. The FAQ from the EEOC also says that an employer can administer a COVID-19 test before allowing an employee to enter the workplace.

Just as there are new tools to help employers contact trace their employees, there are also tools to help employers gauge employees’ temperatures and COVID-19 test results. One such company is Clear, a security company that uses technology to identify people at airports. Clear is creating a health-screening service to take employees’ temperatures using a thermal camera. Additionally, the service will confirm COVID-19 test results and share the results with employers using a color-coded system.

Importantly, employers should ensure that the tests are accurate and reliable. As instructed by the EEOC, employers should “review guidance from the U.S. Food and Drug Administration about what may or may not be considered safe and accurate testing, as well as guidance from CDC or other public health authorities, and check for updates.” There is a possibility of false-positives and false-negatives for certain tests. Maintaining social distancing and proper hygiene is still of high importance.

How may temperature checks and testing infringe on privacy rights?

In normal circumstances, temperature checks and testing are medical examinations not conducted by an employer. The Americans with Disabilities Act (ADA) prohibits medical examinations unless they are job-related and consistent with business necessity. According to the EEOC, temperature checks and testing for COVID-19 fall under the category of job-related and a business necessity since a person with the virus poses a direct threat to the health of others.

If an employer decides to require these medical examinations, the log of the results of the temperature check and test results must be kept confidential. The ADA requires that all medical information be stored separately from an employee’s personnel file in order to limit access to the confidential information. Medical information includes an employee’s statement that they have or suspects they have the disease, or the employer’s notes or other documentation from questioning an employee about symptoms.

Even if an employer is required to keep this information confidential, the employer is still collecting troves of information. Further, an employer can disclose the name of an employee who has COVID-19 to a public health agency.

Immunity Passports

What are immunity passports?

Governments and employers alike are considering the use of immunity passports to stop/slow the spread of COVID-19 and return to “normal.” Under this technique, a person would receive an immunity passport if an antibody test detected COVID-19 antibodies in the person’s system. Once cleared with an immunity passport, the person can return to work and travel under the assumption that they are protected from a second infection.

However, there is one main problem with this technique: There is not yet consensus in the scientific community that having antibodies protects you from re-infection. According to the World Health Organization, “There is currently no evidence that people who have recovered from COVID-19 and have antibodies are protected from a second infection.” In fact, data from South Korea and China show that some patients who recovered from COVID-19 are experiencing a relapse.

Since the disease is still so new, scientists remain unsure as to why this is happening. It is unclear if this shows evidence of re-infection, reactivation of the virus, or inaccurate antibody tests. There are several antibody tests on the market, some of which are more reliable and accurate than others.

How may immunity passports infringe privacy rights?

According to some bioethicists and law professors, the widespread use of immunity passports runs the risk of creating a class system around employment. In this new class system, people who have never contracted COVID-19 may be prevented from returning to work. Immunity passports may usher in a new era of surveillance and social control (similar to China’s digital contact tracing app that classifies people as green, amber, or red depending upon their level of exposure to the virus and limits where you can go accordingly).

The inaccuracy of some antibody tests and the unclear consensus around COVID-19 immunity in general have not prevented governments from considering the use of immunity passports. For instance, Chile previously called for an immunity card that would allow travelers to clear airport security. The United Kingdom and France have also considered similar “passports.”

In the U.S., Los Angeles Mayor Eric Garcetti was among those floating the idea as part of a reopening strategy. In early April, Garcetti said, “There are approaches that might allow us to have ‘immunity passports’ or some evidence through antibody tests that we are good to go to work and stay at work, though we’d want to be sure that folks can’t spread it even if they’ve had it.”

Free Speech

In addition to privacy implications, the COVID-19 outbreak has negatively affected free speech and the First Amendment right to protest. Last month, ABFE condemned an April 14 tweet posted by the Raleigh, North Carolina, police department that declared: “Protesting is a non-essential activity.”

David Grogan, director of ABFE, said in response that it’s imperative to be vigilant about free expression during times when people are fearful for their health and safety. “While our health and safety are critical during and after the current pandemic, we must not allow our concerns to justify federal or state government actions that strip us of our constitutional rights,” said Grogan.

Further, in response to officers breaking up a protest in early May, New York City police commissioner Dermot F. Shea said, “While we greatly, greatly respect the right of people to protest, there should not be protests taking place in the middle of a pandemic by gathering outside and putting people at risk.” According to some at the protest, protesters wore face coverings and stood several feet apart. Some civil rights lawyers fear that social distancing rules could also be used as an excuse to curtail free speech.

It is important to remember that Americans do not relinquish their First Amendment rights in a pandemic. Specifically, citizens can engage in protest in accordance with social distancing guidelines.