Public Health v. Personal Privacy: Is Contact Tracing Worth It?
Shelby Matsumura, Santa Clara Law JD ‘22
September 17, 2020
Contact tracing is crucial to slowing the spread of coronavirus and a return to normal. But the public is being asked to trust government agencies that want to deploy contact tracing technology to fight the current pandemic. While there may be public health benefits to downloading a contact tracing app to your mobile device, will you be risking your privacy if you do? Can the same app be used to surveil you without your consent?
These questions were the focus of an event that occurred on September 2, 2020, at the “Contact Tracing Tech — Who’s Tracking You,” panel sponsored by the High Tech Law Institute (@SCUHTLI) at Santa Clara University School of Law. Rosa Barcelo (@rosabarcelo4)(Partner at Squire Patton Boggs — Brussels), Professor David Hess (Department Chair of Biology at Santa Clara University), and Faiza Patel (@FaizaPatelBCJ )(Co-director of the Brennan Center’s Liberty & National Security Program) filled the panel, while Lauren Kitces (@LaurenKitces) (Associate at Squire Patton Boggs — Silicon Valley), a self-proclaimed “privacy geek,” served as the panel’s moderator.
As part of Professor Colleen Chien’s course on The Business, Law, Technology, and Policy of Artificial Intelligence, this event offered an in-depth view into contact tracing as the nexus between public health, privacy, and technology. Although a relatively new concept during the pandemic crisis, contact tracing appears to be an effective tool for managing the novel coronavirus and decreasing its transmission. My interest in contact tracing technology comes from personal experience with intense coronavirus prevention measures. As a person who lives in a household full of essential workers, I’ve had to follow a strict protocol of showering and changing clothes every time I leave the house. If contact tracing could help me and others move more freely, I’d be all for it! However, the privacy issues raised by contact tracing makes the law student in me hesitant to accept the mass implementation of contact tracing apps.
Contact tracing creates serious privacy concerns with regard to the collection, recording and storing of sensitive, personal information like location data or medical history. When this data is aggregated, it can reveal the personal and private details of an individual (such as if they are attending a protest or visiting an abortion center). A fundamental question then arises: contact tracing is a promising measure for Covid-19 prevention, but at what cost?
What Exactly Is Contact Tracing?
As one technological solution to addressing the pandemic, contact tracing utilizes location tracking methods to gather data on where an individual has been and who they may have interacted with in a given period of time, as explained by Faiza Patel, an expert who has testified before Congress opposing the dragnet surveillance of Muslims. Generally, these apps will use GPS to track your location, or Bluetooth to collect proximity data between your phone and other phones in your vicinity. According to Rosa Barcelo (who counsels clients on data protection and privacy, including compliance with the EU’s GDPR and the ePrivacy Directive), Bluetooth is commonly the most preferred method for contact tracing as it collects proximity data rather than keeping a detailed record of the physical locations one visits.
Once a user reports a Covid-19 positive test result, the app will notify the catalogue of those who had close contact with the individual within the past 14 days; it then encourages these people to get tested. Such critical information makes the contact tracing process more efficient, but also presents serious privacy concerns for users. Further, Faiza Patel warns, “[that] the lack of comprehensive data privacy laws at the federal level only exacerbates these concerns.” To learn more about federal privacy laws in the U.S., check out this article from Varonis.
Can AI Solve This Privacy Problem?
In posing the question of whether AI could improve contact tracing, the “Contact Tracing” panelists were unsure. Nevertheless, private companies are exploring potential AI solutions as such technology continues to grow in popularity within the tech industry. AI is adept at identifying patterns from big data. Data collected from users of contact tracing apps could help create profiles for high risk individuals, identify social distancing practices in public spaces, and help people track their social interactions in case they need to inform others about an exposure risk. One company, called Traces AI, is using CCTV cameras and face recognition technology to track individuals and their personal interactions via video footage. You can read more about Traces AI at Forbes.
Other AI companies are even trying to develop efficient contact tracing that does not sacrifice user privacy. One example, Diveplane — a corporation specializing in AI — released a contact tracing app called “Aware” that uses “Geminai” programming. Geminai collects user data and then creates a verifiable synthetic twin dataset with the same statistical properties of the original data. This twinset contains none of the real-world personal information and cannot be re-engineered to reveal an individual’s identity. Such an approach means data can be widely shared among healthcare providers, first responders, government agencies, state officials, and for broader public availability without endangering individual privacy. You can learn more about Geminai at WRALTechWire.
Although programming like Geminai could help mitigate some privacy concerns around contact tracing, several significant issues remain unresolved. In writing for the World Economic Forum, Simon Greenman (Co-founder and partner in Best Practice AI) explained how a trustworthy AI governance architecture would need to follow important principles of data protection like transparency: users should know how their data is collected and what an entity will do with that information. AI or machine learning remains unique in that many of its processes are not well understood by programmers, and if results created by AI cannot be explained, then it is difficult to achieve the desired level of transparency with contact tracing AI.
Can Contact Tracing Protect Public Health Without Sacrificing Privacy?
Currently, the answer to this question is unclear. Contact tracing rides the line between public safety and civil liberties. Lauren Kitces, a member of Squire Patton Boggs’ Data Privacy & Cybersecurity Practice, explained how some commentators assert that public health concerns justify any potential privacy violations presented by these apps. However, the “Contract Tracing” panelists caution against such a mindset and remind us to remain critical. Professor David Hess has studied microbial evolution from a public health perspective since 2009 to better understand the spread of bacterial pathogens and associated antibiotic resistance. Of all people, Professor Hess understands the value of contact tracing to Coronavirus prevention, and yet he continues to emphasize the importance of personal privacy. He believes that there is inherent risk in thinking that we are only sacrificing civil liberties temporarily as an emergency measure, when Covid-19 is a public health crisis likely to continue for the foreseeable future. Contact tracing is a fascinating tool capable of significantly improving coronavirus prevention, but we cannot fall into complacency when our right to privacy is at stake.
This event was put on by the High Tech Law Institute at Santa Clara University, which will be hosting a number of virtual events exploring the social, equity, privacy and intellectual property implications of artificial intelligence and other advanced technologies, including as part of the Artificial Intelligence for Social Impact and Equity Series curated by Professor Colleen Chien.
