New Normal: Contact Trace COVID-19 Means Privacy

BigID / Courtesy Vice President of Privacy and Policy for Photography, Heather Federman

Back in January, when technology giants ask consumers if they want to share location data and health with strangers, or if employers ask workers to measure daily temperatures. , Many people probably told them to wipe out. However, with more than 80,000 US deaths from a coronavirus pandemic, more Americans could put public health first, putting aside distrust of Big Tech and everyday privacy breaches.

Heather Federman, BigID’s Vice President of Privacy and Policy, uses machine learning to help businesses protect customer and employee data, but how far are these pandemic privacy breaches? It is unclear if it will continue.

“I stopped using the word” return to normal “because I don’t think I can go back to what I was before,” she said.

Federman, a lawyer with training that started his career at the Future of Privacy Forum as a legal and privacy fellow and led the privacy teams of Macy’s and American Express, is about the legal and privacy implications of contact tracking apps and other data. She shared her thoughts on flattening the curve using a central initiative.

Answers have been edited for length and clarity.

What do you think of Apple’s and Google’s contact tracking app suggestions?

I have mixed feelings about it. On the other hand, these companies feel they have to do something. On the other hand, there are still many questions about how this works. One of the interesting things is that this is the first time two major competitors have come together to create an interoperable system. This is what pops up in various data protection laws. The ability to import data into another system. This is an interesting example of what is happening. It seems that they are trying their best to protect their privacy as much as possible. We use Bluetooth technology and are trying to collect as much information as possible. Because it’s decentralized, it’s on the device, not on the central server. So some governments are facing problems, but that’s a step in the right direction.

I think the other questions are yes. You can agree with this, but how likely is it that you really want enough users to adopt it? And, as far as I can tell, at least 60% of the population is needed to adopt it.

Sign up to learn more about the future of law What’s next..

From a privacy perspective, what are your biggest concerns about these contact tracking apps?

I think my biggest concern is that I have made many comparisons with the Patriot Act since September 11. We were all baffled and, of course, limited clauses. But [for] Something that was supposed to be retired in 2005 is still ready for update. That is my concern about this. Apple and Google say they want to destroy the data, but at what point will it actually happen? After all of us have been vaccinated?

One of the challenges faced by these contact tracking apps is how to reuse data responsibly from a privacy perspective. What are the main hurdles for this?

In the world of privacy, I think data reuse is always a problem. This pandemic exacerbates this problem by being directly in front of processing location and health data. And unfortunately the answer is not clear. So, let’s get back to the issue of trust. If we are not required to do this, what makes me trust you not to use this for a secondary purpose? If you want to participate in 60% to opt in, you know that you are using this for a limited purpose and only for a limited time. There is no guarantee yet. And that’s the part that scares me, and I think it scares a lot of people.

Can you anticipate a lawsuit resulting from these apps?

Perhaps. We are a country that is happy with the lawsuit. Due to certain limitations of Bluetooth, it can have a hypothetical impact when dealing with false positives. For example, let’s say you’re notified that you may have COVID-19 and get the wrong result that you need to be at home. You had to stay home so you could appeal to lose your salary for that period. I’m not sure how to prevent liability issues. Since they are working with public health authorities, it is possible to tell them. “It’s up to you to face this, and if anyone sues you, you’re not suing Apple or Google as a third-party provider. They are suing you, public health authorities.”

What are you listening to for tracking contacts at work and other ways you can get employees back to work, but that could violate privacy?

I am in a group chain with different privacy practitioners. They all ask, “How can I do this so that people can return safely to the office without being completely overloaded?” I think that is also very unclear at this point. Temperature checking seems to be popular right now, but I think it’s a problem because the problem can be asymptomatic. How much concern is there? Temperature check is one thing. However, “Do you have a COVID?” I’m not sure if we’re in the space, but during onboarding most employers say we can monitor your work device. I am. We are already looking at employee surveillance.

We also look at daily surveys that employees must complete before joining the company. It’s not just about employees, but about people who are closely related. It involves not only you, but your family. One way to process that data is to separate that information into a separate database rather than just regular HR data and touch that data only when needed.