The collection of location and other consumer data by the U.S. government and private companies can help fight the COVID-19 pandemic. Still, advocates claim this use of big data can also invade consumer privacy if not done correctly.
Government agencies and private companies have been using smartphone location data to track the spread of the coronavirus and to monitor compliance with social distancing, and the Centers for Disease Control and Prevention has been tracking the number of positive tests and moving toward digital contact tracing. While these tracking efforts can have significant benefits, they highlight the fact that the United States has no federal privacy rules to govern this data collection, privacy advocates said during a so-called paper hearing in the Senate Commerce, Science, and Transportation Committee.
The U.S. has a “patchwork of federal, state, and local laws that regulate specific sectors or data sets,” wrote Michelle Richardson, director of the Privacy and Data Project at the Center for Democracy and Technology. This patchwork covers specific sectors or data sets, such as education records, financial records, children’s information, and some health records, she added.
“This has led to the explosion of risky and exploitive data-driven behaviors in the vast, unregulated space in between,” Richardson said. “It has reduced public trust in technology companies and as a result may discourage people from using legitimate services or waste precious time and resources on untested products.
“This, in turn, may inhibit the coronavirus response,” she added.
Members of the committee and other lawmakers have introduced federal privacy legislation, but them bills appear stalled as Congress focuses on the COVID-19 pandemic and its economic consequences.
A large number of businesses, including mobile phone providers, mobile operating systems, apps, and location analytics firms, already collect mobile location information, noted Stacey Gray, senior counsel at the Future of Privacy Forum. Some of this data can be useful for public health purposes, but these collectors need to limit the use and sharing of this data, she said.
“Any personal data collection and use enlisted to fight the pandemic should be limited in time and limited to a specific, well-defined purpose,” Gray said. “History tells us that it is difficult to discontinue practices started in an emergency.”
Contact tracing apps, focused on alerting people when they come in contact with someone infected, can be done using anonymized data, said Ryan Calo, a law professor at the University of Washington.
But it’s unclear whether current contact tracing efforts are effective with the limited data they gather, and the personal information they do use raises privacy concerns, he told the committee.
“It seems fair to wonder whether these apps, developed by small teams, will be able to keep such sensitive information private and secure,” he added. “To the extent digital contact tracing — or any private, technology-driven response to the pandemic — involves the sharing of health care data with private parties, there is also the specter of inadequate transparency or consent.”
There are “nefarious” ways this contact tracing data could be used, he added. “A foreign operative who wished to sow chaos, an unscrupulous political operative who wished to dampen political participation, or a desperate business owner who sought to shut down the competition all could use self-reported instances of COVID-19 in an anonymous fashion to achieve their goals,” Calo said.
Other witnesses talked about the benefits of big data collection as the world fights the COVID-19 pandemic.
Experts are using big data to combat COVID-19 in several ways, including identifying spread patterns and trends, helping with the development of treatments and a vaccine, and forecasting needs for resources, said Graham Dufault, senior director for public policy at The App Association.
Still, “privacy concerns around the use of big data underscore both the need for governmental restraint in acting on data analytics and for governmental action to enact a national privacy framework,” he added.
