Washington Lawyer - July/August 2020 - 29

FEATURE

I

n the race to control the spread of COVID-19,
governments and tech companies gave Americans
a peek at exactly how much personal information
they can gather undetected. Governments
instituted programs using GPS location as part
of their response strategy, while intelligence agencies
and private industry revealed that they've been
collecting data on people's day-to-day activities
all along.
Jennifer Daskal, senior associate at the Center for Strategic & International
Studies' Technology Policy Program, expresses concerns about the liberties taken with private information during the crisis. "We should all be
wary of any new systems and programs that involve the collection and
accessing of large amounts of personal data," she says. "Any new collection programs should be narrowly tailored to a clearly defined public
health need and time-limited, so that they don't last past the time they
are needed."
Apprehension about how the expansion of tracking technology could be
misused in the future has its basis in the erosion of privacy rights that
occurred in the wake of the 9/11 terrorist attacks. Concerns about security
lapses and terrorism resulted in the passage of the PATRIOT Act just 45
days after the attacks. The act dramatically expanded the government's
right to monitor phone and email communications, collect bank and
credit reporting records, and track citizens' activity on the internet.
National Security Letters (NSLs), issued by the FBI, permit agents to
conduct these kinds of investigations without the involvement of a judge.
Privacy advocates have raised concerns about whether the government
will be granted additional surveillance powers in the name of fighting
future pandemics. And they're asking if the tech industry's collection and
use of personal data will receive further scrutiny. At the moment, these
are troubling questions without simple answers.

PRIVACY LAWS' CURRENT LIMITS
First, it makes sense to look at the scope of existing privacy protections.
The Health Insurance Portability and Accountability Act (HIPAA) provides
some protection for health-related information in the United States, but
it applies only to health care providers. Adam H. Greene, partner at Davis
Wright Tremaine LLP, has a long history of involvement with HIPAA. While
working for the Office of the General Counsel at the U.S. Department of
Health and Human Services, he helped draft the first HIPAA Breach
Notification Rule.
"HIPAA was only designed to govern certain 'covered entities': health
plans, health care providers that electronically transact with health plans,
and the health care clearinghouses that process transactions for them,"
Greene says.

iStock

However, information the government obtained during the coronavirus
outbreak rarely came from doctors or insurers. Instead, the government
had been utilizing health and geographic data from private technology
companies that do not fall under HIPAA protections. HIPAA does apply to
"business associates" that act on health entities' behalf, Greene says.
"But it was never intended to cover health information outside of [these]
entities and business associates, so it does not cover much of the health
information that is being collected by employers, tech companies, public
health authorities, researchers, and others involved in managing and
fighting the COVID-19 crisis," adds Greene.
Similarly, the Electronic Communications Privacy Act (ECPA) places limits
on private sector disclosure of content and non-content information to
the government by electronic communications providers, but its protections do not prevent the transfer of non-content information to other
companies.
Greg Nojeim, senior counsel and director of the Freedom, Security,
and Technology Project at the Center for Democracy & Technology, says
that "since the companies that receive non-content data - including
location information - are commonly not themselves electronic
communications providers, the information can then be provided to
the government without triggering the ECPA's protections, effectively
laundering the data."
Furthermore, Nojeim says, the ECPA includes exemptions for the disclosure of information to the government in the case of emergencies.
Where there is danger of death or serious injury requiring disclosure
without delay, companies can disclose information to the government
without liability. So far, the interpretation of this exemption has been
narrow. Although clearly there is an emergency, whether disclosure
without delay is required to meet that emergency is not clear, and
company interpretation of this requirement could change as the
COVID-19 crisis evolves.

LOOKING TO THE FOURTH AMENDMENT
Finally, the Fourth Amendment's protections are limited in their applicability to situations in which the government compels or demands information from individuals or companies. Much of the data provided to the
government is given voluntarily, and as such is not subject to the Fourth
Amendment.
An April 3 Wired article revealed that Google disclosed anonymized
location data on people in 131 countries as a guide for public health officials during the coronavirus pandemic. Government officials indicated
their need for the information to determine the efficacy of stay-at-home
and shelter-in-place orders, and the tech giant said it wasn't releasing
any data on individuals or specific location. Albert Gidari, consulting
director of privacy at the Center for Internet and Society at Stanford Law
School, is quoted as saying, "This is a good example of where aggregate
location data can be developed in a privacy sensitive way to provide
actionable information to decision makers on the effectiveness of social
distancing."

JULY/AUGUST 2020

*

WASHINGTON LAWYER 29



Washington Lawyer - July/August 2020

Table of Contents for the Digital Edition of Washington Lawyer - July/August 2020

Digital Extras
Your Voice
From Our President
Election Coverage
Practice Management
Calendar of Events
When Law Firms Go Remote feature
Disaster Preparedness for Lawyers feature
Staying Afloat feature
Privacy Rights During a Pandemic Feature
Hamilton's Enduring Legacy feature
Annual Report
Taking the Stand
The Learning Curve
On Further Review
Member Spotlight -
Worth Reading
Attorney Briefs
Disciplinary Summaries
Women's Suffrage special section
Speaking of Ethics
A Slice of Wry
Washington Lawyer - July/August 2020 - Cover1
Washington Lawyer - July/August 2020 - Cover2
Washington Lawyer - July/August 2020 - 1
Washington Lawyer - July/August 2020 - 2
Washington Lawyer - July/August 2020 - 3
Washington Lawyer - July/August 2020 - Digital Extras
Washington Lawyer - July/August 2020 - Your Voice
Washington Lawyer - July/August 2020 - From Our President
Washington Lawyer - July/August 2020 - Election Coverage
Washington Lawyer - July/August 2020 - Practice Management
Washington Lawyer - July/August 2020 - Calendar of Events
Washington Lawyer - July/August 2020 - 10
Washington Lawyer - July/August 2020 - 11
Washington Lawyer - July/August 2020 - When Law Firms Go Remote feature
Washington Lawyer - July/August 2020 - 13
Washington Lawyer - July/August 2020 - 14
Washington Lawyer - July/August 2020 - 15
Washington Lawyer - July/August 2020 - 16
Washington Lawyer - July/August 2020 - 17
Washington Lawyer - July/August 2020 - Disaster Preparedness for Lawyers feature
Washington Lawyer - July/August 2020 - 19
Washington Lawyer - July/August 2020 - 20
Washington Lawyer - July/August 2020 - 21
Washington Lawyer - July/August 2020 - Staying Afloat feature
Washington Lawyer - July/August 2020 - 23
Washington Lawyer - July/August 2020 - 24
Washington Lawyer - July/August 2020 - 25
Washington Lawyer - July/August 2020 - 26
Washington Lawyer - July/August 2020 - 27
Washington Lawyer - July/August 2020 - Privacy Rights During a Pandemic Feature
Washington Lawyer - July/August 2020 - 29
Washington Lawyer - July/August 2020 - 30
Washington Lawyer - July/August 2020 - 31
Washington Lawyer - July/August 2020 - Hamilton's Enduring Legacy feature
Washington Lawyer - July/August 2020 - 33
Washington Lawyer - July/August 2020 - 34
Washington Lawyer - July/August 2020 - 35
Washington Lawyer - July/August 2020 - 36
Washington Lawyer - July/August 2020 - Annual Report
Washington Lawyer - July/August 2020 - 38
Washington Lawyer - July/August 2020 - 39
Washington Lawyer - July/August 2020 - 40
Washington Lawyer - July/August 2020 - 41
Washington Lawyer - July/August 2020 - Taking the Stand
Washington Lawyer - July/August 2020 - The Learning Curve
Washington Lawyer - July/August 2020 - On Further Review
Washington Lawyer - July/August 2020 - 45
Washington Lawyer - July/August 2020 - Member Spotlight -
Washington Lawyer - July/August 2020 - 47
Washington Lawyer - July/August 2020 - Worth Reading
Washington Lawyer - July/August 2020 - 49
Washington Lawyer - July/August 2020 - Attorney Briefs
Washington Lawyer - July/August 2020 - Disciplinary Summaries
Washington Lawyer - July/August 2020 - Women's Suffrage special section
Washington Lawyer - July/August 2020 - 53
Washington Lawyer - July/August 2020 - Speaking of Ethics
Washington Lawyer - July/August 2020 - 55
Washington Lawyer - July/August 2020 - A Slice of Wry
Washington Lawyer - July/August 2020 - Cover3
Washington Lawyer - July/August 2020 - Cover4
http://washingtonlawyer.dcbar.org/julyaugust2020
http://washingtonlawyer.dcbar.org/june2020
http://washingtonlawyer.dcbar.org/may2020
http://washingtonlawyer.dcbar.org/march2020
http://washingtonlawyer.dcbar.org/january2020
http://washingtonlawyer.dcbar.org/november2019
http://washingtonlawyer.dcbar.org/october2019
http://washingtonlawyer.dcbar.org/september2019
http://washingtonlawyer.dcbar.org/julyaugust2019
http://washingtonlawyer.dcbar.org/june2019
http://washingtonlawyer.dcbar.org/may2019
http://washingtonlawyer.dcbar.org/april2019
http://washingtonlawyer.dcbar.org/march2019
http://washingtonlawyer.dcbar.org/january2019
http://washingtonlawyer.dcbar.org/november2018
http://washingtonlawyer.dcbar.org/november2018
http://washingtonlawyer.dcbar.org/november2018
http://washingtonlawyer.dcbar.org/august2018
http://washingtonlawyer.dcbar.org/august2018
http://washingtonlawyer.dcbar.org/June/July2018
http://washingtonlawyer.dcbar.org/april2018
http://washingtonlawyer.dcbar.org/March2018
http://washingtonlawyer.dcbar.org/February2018
http://washingtonlawyer.dcbar.org/january2018
http://washingtonlawyer.dcbar.org/december2017
http://washingtonlawyer.dcbar.org/November2017
http://washingtonlawyer.dcbar.org/september 2017
http://washingtonlawyer.dcbar.org/september 2017
http://washingtonlawyer.dcbar.org/august2017
http://washingtonlawyer.dcbar.org/july2017
http://washingtonlawyer.dcbar.org/June2017
http://washingtonlawyer.dcbar.org/may2017
http://washingtonlawyer.dcbar.org/april2017
http://washingtonlawyer.dcbar.org/march2017
http://washingtonlawyer.dcbar.org/february2017
http://washingtonlawyer.dcbar.org/january2017
http://washingtonlawyer.dcbar.org/december2016
http://washingtonlawyer.dcbar.org/november2016/
http://washingtonlawyer.dcbar.org/october2016
http://washingtonlawyer.dcbar.org/september2016
https://www.nxtbookmedia.com