The Public Health Emergency Privacy Act Puts in Place Safeguards for Digital Contact Tracing

WASHINGTON — On Thursday, Reps. Anna Eshoo (D–California), Jan Schakowsky (D–Illinois) and Suzan DelBene (D–Washington) joined Sens. Richard Blumenthal (D–Connecticut) and Mark Warner (D–Virginia) to introduce a privacy bill addressing the use of technology to track the spread of COVID-19 during the pandemic.

The Public Health Emergency Privacy Act (PHEPA) provides needed regulations on exposure-notification and contact-tracing applications whether built and deployed by state and local governments or by tech companies and other private-sector employers. These protections mandate that the use of these digital tools be voluntary; that information collected — such as medical diagnoses and exam data, and location or proximity information — be limited to what’s necessary and proportionate to addressing the public-health crisis.

The bill bans commercial use of that information, and protects the civil rights of people who use these applications by preventing discrimination in access to public-facing businesses like stores, and other commercial establishments and public spaces, based on whether a person uses such an application or not.

Free Press Action Senior Policy Counsel Gaurav Laroia made the following statement:

“There’s an understandable desire to use state-of-the-art technology to combat the spread of COVID-19. Some of these technologies may prove effective in addressing this public-health emergency, but efforts to contain coronavirus shouldn’t open the door to a more abusive and discriminatory surveillance system.

“Governments and businesses across the world have begun deploying digital technology to trace people’s movements and contacts to help stop the spread of the disease. Almost all of that information collection and tracking is unregulated here in the United States, opening the door to potential abuses. This bill would put many necessary protections in place to make sure the technology is used responsibly.

“This bill makes it clear that we don’t need to completely sacrifice privacy, data protection and civil rights to make these tools effective. And for them to work, a large majority of cellphone users would need to use them. Without PHEPA’s protections to secure this information, people will be reluctant to use contact-tracing applications in the numbers needed to make the technology useful.

“Unlike the proposal put forth by Senator Wicker and other Senate Republicans, PHEPA also protects workers from undue and unnecessary surveillance. Black and Latinx essential workers are bearing the brunt of this crisis while dying in disproportionate numbers. Digital tools may help keep them safe, but employers’ use of these tools must be regulated. This crisis cannot turn already difficult working conditions into a pretext to deploy long-lasting and unnecessary worker surveillance.

“If we’ve learned anything from experience with widespread data collection it’s that stringent safeguards and oversight are necessary to prevent personal data from falling into the hands of those who seek to misuse it. The bill rightfully tightly ties this data collection to solving the public-health crisis and prevents using that information for commercial purposes. The bill also prohibits the unnecessary sharing of that data with law-enforcement agencies —  which would undermine the goal of widespread adoption, especially among the most vulnerable.

“We’ve seen big tech companies mishandle data they collect from their users, exploiting it for purposes other than those they officially claim. Their promises to protect our essential information aren’t enough. We need policies to limit data collection at its source, with clear restrictions and rules on what’s being gathered, by whom, how it’s being stored, how it gets used and for how long. PHEPA puts many of these vital safeguards in place.”