Our laws have not caught up with the scope and digital-age intrusiveness of COVID-19 contact tracing.
Since the plague ravaged Europe in the Middle Ages, fighting contagious and infectious disease has involved identifying those who come in close contact with infected persons, warning them of potential exposure, and advising they take precautions, such as monitoring for symptoms or self-isolation. To this day, many insist this process of “contact tracing” remains key to safely reopening America.
But COVID-19 is America’s first pandemic wholly of the digital age. When Swine flu began sweeping the globe a little over a decade ago, the iPhone was scarcely two years on the market and touch-screen Androids were unknown, the post-9/11 surveillance of Americans’ phone records was not yet revealed, and few had harnessed the tremendous power of personal data in marketing everything from consumer products to candidates.
Our thinking about the ancient practice of contact tracing needs to change with the times. Modern contact tracing presents more and different privacy and civil liberties concerns from, say, its pencil-and-paper ancestor during the 1918-19 Spanish Flu — and not only because of electronic tracking. Even data gathered the old-fashioned way by people making phone calls or knocking on doors to ask questions still present new digital-age challenges when compiled and potentially shared, manipulated, cross-referenced, and analyzed.
The scale of COVID-19 contact tracing further compounds each of these concerns. One report concluded that combating this virus may require 100,000 contact tracers to gather information about Americans’ health status, movements, and associations. Many thousands already are busily at work.
Despite this, the government’s use of contact tracing — and the personal information it gathers — remains largely unregulated. COVID-19 requires a new 21st-century mindset: How do we stop the spread of the disease and protect privacy and civil liberties?
Unfortunately, public health’s natural laser focus on stopping the virus can blind it to other legitimate concerns. For example, when I recently raised some of these privacy and civil liberties issues in our state, a senior public-health official dismissively advised the public to “relax about that” and declared to our citizens that “I hope we won’t be muzzled by those who don’t share our concern for you.”
But concern for Americans’ well-being must include both our health and our liberties. Bland government assurances akin to “trust us, we’re here to help” provide little comfort.
All this understandably troubles many Americans. A survey released last month found that 84 percent were concerned about government misuse of personal information collected through contact tracing. Addressing those concerns is not only the right thing to do but also critical to obtaining sufficient public participation to contain the disease.
The root of the problem is that our laws have not caught up with the scope and digital-age intrusiveness of COVID-19 contact tracing. Few states have statutes regulating the practice. That changed recently in Kansas.
Earlier this month, the COVID-19 Contact Tracing Privacy Act was enacted with bipartisan support, placing Kansas at the vanguard in this area. I recommended our new law, which imposes important protections for civil liberties and privacy on both state and local governments, have the following provisions:
- Participation in contact tracing must be voluntary. No person may be required to participate, or prohibited from participating.
- Information may not be collected through cellphone tracking. While perhaps promising from a public-health standpoint, this seems to us disturbingly Orwellian and at least deserves pause for further study before government may undertake it.
- Collected information must be used only for contact tracing and kept strictly confidential and not disclosed. The information must be safely and securely destroyed when the task is finished. Bureaucratic mission creep is forbidden.
- Only specified information may be collected. Through an open and transparent process, the state health department must establish what may be gathered.
- The government may not use third parties to elude these protections. Government may not require businesses, for example, to collect contact-tracing information and may obtain voluntarily gathered information only with the consent of both the third party and the person the information pertains to, or with a judicially supervised warrant.
- People working as contact tracers must receive proper training and must affirm they are familiar with the law’s privacy and civil-liberties protections.
- Contact tracers or governments are held accountable to these safeguards. Those who violate the Contact Tracing Privacy Act may face civil or criminal penalties, and any person may seek an injunction to enforce protections in the Act.
This legal framework is designed to protect privacy and civil liberties while public-health officials do their jobs. Rather than lecture and scold Kansans, our approach is to persuade, empower, and reassure. Kansans themselves bear the personal responsibility to choose our path forward by freely participating, or not, in ongoing efforts to track and contain the virus. We value both science and freedom, trusting in individuals more than government.