1) Privacy in a time of Pandemic - even the most privacy aware people have said to me that, upon reading that someone in their community has been infected, they want to know who and everywhere they've been in the prior few days. Fear often drives bad policy choices.
2) @EFF has posted on Protecting Civil Liberties During a Public Health Crisis: eff.org/deeplinks/2020…
3) And @InsidePrivacy by Covington has been posting DPA Guidance on how companies should process personal data when taking steps to contain the spread and mitigate the effects of COVID-19. Here's their post on Ireland's guidance: insideprivacy.com/covid-19/irish…
4) But here is a rhetorical #ECPA question - should those who have tested positive voluntarily disclose their location histories to the CDC or other governmental entity? If they did, could a governmental entity compel a provider of the underlying service to identify all users
5) within a geofence around location markers, or, to notify all users within a geofence of possible exposure? Under quarantine and isolation statutes and rules, there are no compulsory process authorities. See ncsl.org/research/healt…
6) So identification of potentially exposed users can't be compelled, but when faced with a request in such a case, providers likely would rely on the emergency disclosure exception to do so. It would be more privacy protective for a provider to voluntarily notify.
7) But that too has pitfalls as a governmental determination that quarantine was necessary for those users certainly would yield the (no doubt uncomfortable) disclosure.
8) The balance between privacy and pandemic policy is a delicate one. The problem here is that this is not a law school exam. Technology can save lives, but if the implementation unreasonably threatens privacy, more lives may be at risk. #notanexam
