Professor Buzz Scherr discusses the legal implications of low and high tech contact tracing of COVID-19, including aspects of digital privacy and health information privacy. Produced and Hosted by A. J. Kierstead
Get an email when the latest episode releases!
Previous episode with Professor Scherr discussing his authoring of New Hampshire's privacy amendment: https://www.podbean.com/ew/pb-jvavx-9eb8de
UNH Franklin Pierce School of Law is now accepting applications for JD, Graduate Programs, and Online Professional Certificates at https://law.unh.edu
Legal topics include privacy, technology, US constitution, criminal law
Read the Transcript
A. J. Kierstead (host):
Professor Buzz Sherr talks to the legal implications of low and high-tech contact-tracing due to COVID-19. This is The Legal Impact presented by the University of New Hampshire Franklin Pierce School of Law, now accepting applications for JD, praduate programs and online professionals certificates. Learn more and apply at law.unh.edu. The opinions discussed is solely the opinions of the faculty or host and do not constitute legal advice, or necessarily represent the official views of the University of New Hampshire.
A. J. Kierstead (host):
Suppose contact tracing always gets brought up when epidemics arise. An obvious pre-COVID-19 example was the Ebola outbreak a few years back. There must be some pretty obvious legal concerns when it comes to government implemented contact-tracing.
Buzz Scherr:
Yeah, I mean contact-tracing is basically, you want to figure out who has had contact with ... Alert people who have had contact with someone who is infected, in this case with the COVID-19 virus. And it's a really important public health practice in order to really manage the outbreak in a way that that is effective, particularly when you're trying to reopen the economy,
Buzz Scherr:
for lack of a better way of putting it. The two things that are really important are testing, as comprehensive a plan of testing as you can engage in. And then contact-tracing, knowing when somebody has the virus, who they have had contact with. So it's an important public health measure. That said, there are ways to do it and there's ways to do it, to use the formal illegal expression.
Buzz Scherr:
A low-tech way to do it, it's already going on in New Hampshire. The Public Health Department is alerting police departments, fire departments and emergency response people, EMTs, about the names of those people in their communities who've tested positive. So that when the police go or the fire department or an EMT goes to a address where somebody is known to have tested positive and is there, they're aware of that and can take particularly significant precautions, which makes a lot of sense.
Buzz Scherr:
The concern is that they're releasing medical information about somebody. Now HIPAA, the privacy legislation of many years ago that deals with medical records, has an exception for this kind of circumstance so there's not a HIPAA problem. But the concern is, if a police officer tells his spouse and his spouse tells a bunch friends, then you're spreading the medical condition of an individual beyond those who are in public health need of knowing it. And that is a privacy concern.
Buzz Scherr:
In New Hampshire in particular, that would be evaluated under the new Part One, Article 2-b information privacy constitutional amendment. Where personal and private information, the government is not supposed to intrude on personal and private information.
A. J. Kierstead (host):
Who would make the determination whether an outbreak or something of the like, reaches that critical mass where it should be bypassing the HIPAA privacy?
Buzz Scherr:
That's public health officials in the state make that determination. And they're the right people to make that determination. I mean, there's some outbreaks like the flu outbreak, they may take action in the context of a nursing home, but if the nursing home itself hasn't dealt of spreading that information amongst appropriate people within the nursing home, but more broadly with a pandemic like this, it's the public health officials in the state.
Buzz Scherr:
And what they've done with this information is they have everybody to whom they release it, sign a document saying those individuals who get the information promised not to reveal it to anyone outside the department, or even within the department who doesn't need to know that information. So in cooperation with the Attorney General's office and Public Health Department and the local police and fire departments, et cetera, it's done a good job in that regard.
Buzz Scherr:
The constitutional privacy concern, that [inaudible 00:05:05] on the long run, if a circumstance develops, will be evaluated by a judge when somebody files a lawsuit against the police for revealing that information in the wrong kind of context. And then a judge will begin to interpret what does Part One, Article 2-b mean. Basically what it likely means is a judge as a public agency, would have to engage in strict scrutiny of whether there are other less intrusive alternatives to revealing the information in the way it was revealed. And did they take sufficient precautionary measures to make sure it wasn't revealed. It appears in the circumstance of what the Public Health Department in New Hampshire is doing, they seem to be doing it the right way, but that's my opinion.
Buzz Scherr:
So, that aspect of contact-tracing is being managed reasonably well. It's a relatively low-tech approach to contact-tracing. Then there's a second kind of contact-tracing that for example, is being used in Israel and South Korea. Where people who have been diagnosed as positive, they're being tracked. Where they go is being tracked via their cellphone data, and the government has got access to that data.
Buzz Scherr:
It's unclear from what I've read, whether the person has opted in to give the government access to that data. It's unclear whether that access to that data is via a private company, a commercial company like a cellphone provider, whether the government is obtaining that information from cellphone providers. Where is the cellphone going that AJ Kierstead has? Hypothetically only, who we know has diagnosed positive, where's that cell phone going and tracking that.
Buzz Scherr:
So there's a host of issues there. One, does the person know they're being tracked? Have they chosen to do that? Can the government do that without getting their consent? Do they need a search warrant to do that? What happens to the data in the possession of the government? Can the government use it for any other purpose, even assuming they get consent to do it for contact-tracing, once they've used it for contact-tracing and that process has run its course over the next several months or years. Can they hold on to that data? What can they do with that data? How about what can commercial entities who are providing that data, do with that?
Buzz Scherr:
There's a host of really thorny contractual problems between a commercial entity and it the provider of the cellphone to the individual, their relationship, and what is the scope of the contract they signed and what can the commercial entity do. Does the government need a search warrant to get that information from the commercial entity? Or can the commercial entity give it to the government without a search warrant justified by probable cause?
Buzz Scherr:
It's a really messy area and the challenge is going to be, as this continues and people challenge it, decisions are going to be made amidst the fear of the pandemic. And historically we've always seen privacy rights fall by the wayside when fear is the dominant cultural ethos at the moment. That happened with 9/11 for example, we took a lot of liberties with our privacy rights in light of the fear of terrorist attacks.
A. J. Kierstead (host):
And government agencies have a real hard time with relinquishing that control after years. I mean how it took Edward Snowden to speak out about the NSA, they were said, "Oh, we're not going to do that anymore," with it came to metadata and that wasn't the case.
Buzz Scherr:
"Well, use it for this purpose and that work was really helpful, so we'll just stretch it a little bit and use it for this other purpose." It's kind of the same thing and it's what more formally is called mission creep. The original, not the original, but one of the early examples of mission creep was the social security number.
Buzz Scherr:
Social security number had a very, very, very limited purpose when it first came into being. It had to do with your payments you make to the social security administration and the benefits you could get depending on your physical or mental status or your age. But I mean, we could talk for hours and not describe the many different ways that social security numbers are now used by private entities and by the government. It's as close to an identification number as we all have, and that's far beyond the scope of what is originally intended.
Buzz Scherr:
And way back in the forties when the social security number first came into being, everybody had these privacy concerns. And they said, "Oh, no, no. It's just for this limited purpose." And then this concept of mission creep over the next 75 years took over, really 60, 75 years.
A. J. Kierstead (host):
Now going off of the digital privacy bit, they were just talking about with regards to say someone did sign up for government tracking, with regards to contact-tracing. I mean, we've talked about this briefly when it came to Clearview AIs, facial recognition, is you're not the only person that's necessarily near this mobile device that's receiving the tracking.
A. J. Kierstead (host):
I have a family, say I sign up for it to be tracked, but my wife is likely with me for a majority of the time because we're, especially during social isolation, stay-at-home orders and things like that, you're more likely to be with your family. In theory, I'm not the only person being tracked, my family is also getting tracked.
Buzz Scherr:
Yep, it can be a shared phenomenon. It can be a shared phenomenon. It's like when you send in your DNA to ancestry.com or 23andMe. You're not only sending in your DNA, you're sending in everyone who's a somewhat close relative to you's DNA. Since those we're related to were ... I mean, we as human beings are 99.9 similar to each other anyway, genetically you and I are. But if it's somebody who's related to you, it's 99.99999 per ... You know what I mean, but it's a very close relation.
Buzz Scherr:
So if I send in my DNA and my wife's sending in my brothers' and sisters' and children's DNA too. So it's the same thing with contact-tracing, in a different way. It's not exactly the same thing, but it's a rough analogy. And it's the way of the future, as all of this is. The broadest concern with high-tech contact-tracing is not that necessarily the use it's being put to in the moment, particularly when there's consent. It's what are the companies and the government going to do with all that data. Are they going to mine it for all sorts of other purposes and build a profile of you, and your profile of how you move around?
Buzz Scherr:
There's a famous US Supreme court case, it was seven or eight years ago that said, if the government puts a tracking GPS on the bottom of your car when it's in public, doesn't enter the car, and follows you around technologically for 10 days, that's a violation of the Fourth Amendment. Unless they have a search warrant supported by probable cause. Contact-tracing is another version of that if you think about it.
Buzz Scherr:
So that's going to be the challenge. It's all going to happen in this atmosphere of the fear of the pandemic, the fear of COVID-19, which skews people's judgment, understandably, but nonetheless excuse it.
A. J. Kierstead (host):
Thanks for listening to The Legal Impact presented by UNH Franklin Pierce School of Law. [Inaudible 00:14:21] spread word about the show, please be sure to subscribe and comment on your favorite podcast platform, including Apple Podcasts, Google Play, and Spotify
