COVID-19 has disrupted every aspect of human life. Global economies, healthcare, supply chains, and small businesses are just a few examples of industries crippled by the pandemic. As nations face mounting pressures to re-open their economies while containing the further spread of the virus, legal questions arise regarding the boundaries of compulsory digital contact tracing (DCT). There are many debates taking place over government abilities to infringe upon individual privacy rights in the name of public health safety. Privacy laws vary from country to country, and since most nations are launching some form of contact tracing, it warrants a look into what is legal and what is an invasion of privacy. The big question is where the individual right to privacy intersects with a country’s right to protect its citizens amidst a public health crisis.
South Korea was one of the first nations to launch a large-scale DCT in its response to COVID-19 with its “test, treat and trace” program. They built a network of more than 96 public and private rapid testing centers, conducted more than 200,000 tests on its citizens, and utilized a smartphone geotag application to monitor the movement of those who tested positive. Information was then shared with the general public so that the non-infected (or those who hadn’t yet tested) were alerted to areas where infected individuals had traveled via the app’s real-time updates.
Germany’s 375 health authorities were unable to administer a DCT program due to having some of the world’s strictest privacy laws. Instead, they launched large scale teams to work the phones, email, and even fax to trace and track infected individuals who volunteered information concerning where they have been and who they may have come into contact with. Despite the low-tech, privacy-preserving contract tracing method, Germany reports the program is effective, and other nations are looking to implement its model.
In the United States, the government has been cautious about getting involved from the federal level. It has pushed most, if not all, decisions over quarantine regulations and other social distancing measures to the discretion of each state, including the choice of how to initiate contact tracing programs. To date, the Trump administration has indicated no plans to launch a federal DCT mandate. To this end, state governments are in the early stages of creating a massive contact tracing mobile workforce. In Massachusetts, more than 45,000 people applied for some 1,400 jobs as contact tracers. New York’s government announced plans to hire as many as 10,000 contact tracers, and New Jersey plans to hire at least 1,000 to supplement the work of 900 local health officials. All three states have cited Germany as a model.
Like Germany, United States privacy laws and attached freedoms hinder its ability to launch a wide-scale DCT, but there are broad powers given to the states to implement localized DCT is they so desire. The 10th Amendment gives the states the ability to enact strict laws to protect the health and well-being of its citizens. However, it’s not that simple. Getting the American people to accept and comply with this level of potential privacy infringement would be a high hurdle to clear. Protests to state lock-down orders and fights erupting over mask-wearing are already a near-daily occurrence causing tension that doesn’t look like it will subside anytime soon.
American tech giants Google and Apple have launched contract tracing apps that are voluntary to the end-user and consider privacy laws. Both apps do not collect any location information from the user’s smartphone and are not active in the tracing of movement unless they opt-in. The app comes into play when an end-user voluntarily reports a positive COVID-19 test. At that point, the app uploads a set of rotating codes that their phones have transmitted to other users via Bluetooth for the previous two weeks. The notification informs the end-user if their phones shared proximity (pinged off the same cell tower) with somebody who has voluntarily tested positive. This allows the person to make the decision to self-quarantine or get tested themselves. The problem is data collection and storage. While those codes do not identify the infected user or their current location, every app maker needs to ensure a process that does not collect the IP addresses of those Covid-19 patients’ smartphones that identify and track infected individuals. If IP addresses are collected, they will need to protect that data from cyber-attacks or internal leaks.
Ultimately, the success of any contact tracing program is dependent on the will of the people. Health officials state that to have an effective program in place, a minimum of 70 percent of the population must participate. Perhaps if used only in times of crisis, and as a temporary measure – meaning all data is erased and purged – then the public trust would be easily attainable. On the other hand, even temporary DCT programs can open up a proverbial “constitutional can of worms” that could have negative, long-term implications to the overall safety of all nations – with or without corroborating legislation. So, at least for now, it looks like the legalities of contact tracing programs may not play out in a court of law, but the court of public opinion.
About the author
John Neocleous is the Founder and Managing Partner of NCI Law Group. He holds an “LLB (Hons)” from the University of East Anglia, a Master of Philosophy from the University of Sussex, and a Diploma in European Law from the European University Institute. Mr. Neocleous has lectured and published extensively in the areas of human rights, international tax and commercial law, and international criminal law. He has practiced internationally for more than 20 years, with an emphasis on solutions to complex international legal problems, including taxation, collection, contract and business law for high net worth clients. He is an active member of several professional organisations, including the International Bar Association, the Washington State, Cyprus, and American bar associations, the Bar Council and the Solicitors Regulation Authority of England and Wales, and the Ordre des Avocats Vaudois in Switzerland.
