Washington Lawyer - July/August 2020 - 29

FEATURE

n the race to control the spread of COVID-19,
governments and tech companies gave Americans
a peek at exactly how much personal information
they can gather undetected. Governments
instituted programs using GPS location as part
of their response strategy, while intelligence agencies
and private industry revealed that they've been
collecting data on people's day-to-day activities
all along.
Jennifer Daskal, senior associate at the Center for Strategic & International
Studies' Technology Policy Program, expresses concerns about the liberties taken with private information during the crisis. "We should all be
wary of any new systems and programs that involve the collection and
accessing of large amounts of personal data," she says. "Any new collection programs should be narrowly tailored to a clearly defined public
health need and time-limited, so that they don't last past the time they
are needed."
Apprehension about how the expansion of tracking technology could be
misused in the future has its basis in the erosion of privacy rights that
occurred in the wake of the 9/11 terrorist attacks. Concerns about security
lapses and terrorism resulted in the passage of the PATRIOT Act just 45
days after the attacks. The act dramatically expanded the government's
right to monitor phone and email communications, collect bank and
credit reporting records, and track citizens' activity on the internet.
National Security Letters (NSLs), issued by the FBI, permit agents to
conduct these kinds of investigations without the involvement of a judge.
Privacy advocates have raised concerns about whether the government
will be granted additional surveillance powers in the name of fighting
future pandemics. And they're asking if the tech industry's collection and
use of personal data will receive further scrutiny. At the moment, these
are troubling questions without simple answers.

PRIVACY LAWS' CURRENT LIMITS
First, it makes sense to look at the scope of existing privacy protections.
The Health Insurance Portability and Accountability Act (HIPAA) provides
some protection for health-related information in the United States, but
it applies only to health care providers. Adam H. Greene, partner at Davis
Wright Tremaine LLP, has a long history of involvement with HIPAA. While
working for the Office of the General Counsel at the U.S. Department of
Health and Human Services, he helped draft the first HIPAA Breach
Notification Rule.
"HIPAA was only designed to govern certain 'covered entities': health
plans, health care providers that electronically transact with health plans,
and the health care clearinghouses that process transactions for them,"
Greene says.

iStock

However, information the government obtained during the coronavirus
outbreak rarely came from doctors or insurers. Instead, the government
had been utilizing health and geographic data from private technology
companies that do not fall under HIPAA protections. HIPAA does apply to
"business associates" that act on health entities' behalf, Greene says.
"But it was never intended to cover health information outside of [these]
entities and business associates, so it does not cover much of the health
information that is being collected by employers, tech companies, public
health authorities, researchers, and others involved in managing and
fighting the COVID-19 crisis," adds Greene.
Similarly, the Electronic Communications Privacy Act (ECPA) places limits
on private sector disclosure of content and non-content information to
the government by electronic communications providers, but its protections do not prevent the transfer of non-content information to other
companies.
Greg Nojeim, senior counsel and director of the Freedom, Security,
and Technology Project at the Center for Democracy & Technology, says
that "since the companies that receive non-content data - including
location information - are commonly not themselves electronic
communications providers, the information can then be provided to
the government without triggering the ECPA's protections, effectively
laundering the data."
Furthermore, Nojeim says, the ECPA includes exemptions for the disclosure of information to the government in the case of emergencies.
Where there is danger of death or serious injury requiring disclosure
without delay, companies can disclose information to the government
without liability. So far, the interpretation of this exemption has been
narrow. Although clearly there is an emergency, whether disclosure
without delay is required to meet that emergency is not clear, and
company interpretation of this requirement could change as the
COVID-19 crisis evolves.

LOOKING TO THE FOURTH AMENDMENT
Finally, the Fourth Amendment's protections are limited in their applicability to situations in which the government compels or demands information from individuals or companies. Much of the data provided to the
government is given voluntarily, and as such is not subject to the Fourth
Amendment.
An April 3 Wired article revealed that Google disclosed anonymized
location data on people in 131 countries as a guide for public health officials during the coronavirus pandemic. Government officials indicated
their need for the information to determine the efficacy of stay-at-home
and shelter-in-place orders, and the tech giant said it wasn't releasing
any data on individuals or specific location. Albert Gidari, consulting
director of privacy at the Center for Internet and Society at Stanford Law
School, is quoted as saying, "This is a good example of where aggregate
location data can be developed in a privacy sensitive way to provide
actionable information to decision makers on the effectiveness of social
distancing."

JULY/AUGUST 2020

WASHINGTON LAWYER 29

Washington Lawyer - July/August 2020

Table of Contents for the Digital Edition of Washington Lawyer - July/August 2020