Insights
Publications

Public Ends From Private Means: Privacy Rights and Benevolent Use of Personal Data

April 1, 2020 Blog

With the explosion of COVID-19 cases worldwide, companies and governments have expanded their interest in the use of the vast stores of consumer data. Even where such collection and use of personal data is ostensibly for the public good, the privacy rights and legal requirements applicable to such data must be considered carefully.[i]

In recent weeks, a plethora of private companies have introduced programs and applications to monitor and assess the spread of the disease, as well as to assess the effectiveness of the public health measures (e.g., social distancing) aimed at stopping it. 

Some companies or technology developers seek voluntary participation through self-reporting by members of the public. The COVID-19 Symptom Tracker from health science company ZOE Global Ltd. aims to gather data about the symptoms, spread of, exposure to, and groups most at risk from COVID-19, using an app-based study. As of last week, it was the third most downloaded app in Apple’s UK App store, and the second most in downloaded of Google Play’s new releases in the UK. Because consumers are voluntarily providing data and opting in to such data collection and to its use for the specific purpose of studying COVID-19, there are fewer legal restrictions on using their data for that purpose.[ii]

Other companies have sought to re-tool their existing products or data in order to help fight the disease. One such company is Unacast, a marketing analytics company out of Norway that tracks human movements using GPS data received from other companies’ apps (largely where such companies incorporate tracking functionality into their apps using Unacast’s software development kit, though such mobile location-related data can also be gathered through the use of Wifi connection information, IP, and other sources). Unacast has already built a business out of using and sharing its substantial set of (anonymized) consumer data to help retail, marketing, real estate, and travel companies assess consumer needs and behaviors. Now, the company is using that same data to introduce an interactive Social Distancing Scoreboard, which aims to “empower organizations to measure and understand the efficacy of social distancing initiatives at the local level.” While Unacast seems to only be sharing anonymized data, it is likely that the data as collected by the company includes personal information. According to Unacast’s website, it only collects data after providing proper disclosures and opt-in, and respects device settings. Unacast’s use and sharing of that personal data must adhere to the permissions garnered at the time of collection.

Where such aims are pursued using anonymized data collected through third party apps, and do not include any Personally Identifiable Information (and/or proper disclosures and permissions have been acquired prior to collection), such data collection and use is unlikely to create significant liability for its users. However, in a time when everyone is eager to dive in and contribute to a solution, it is important to be mindful of the risks that can arise from the collection and use of personalized information, no matter how commendable the aims for which it is collected. The California Consumer Privacy Act (CCPA) would require proper disclosures as to the types of data being collected, the purposes of the collection, and the categories of companies with whom the data is shared to be disclosed to the data subject at the time of the collection (which would likely be accomplished through a linked-to privacy policy[iii]). Europe’s General Data Protection Regulation (GDPR) would further require opt-in to such collection and use. Such laws seek to prevent unwanted use of personal information, including location tracking, and failure to comply with such privacy laws could result in significant regulator liability (as well as, for companies collecting information from European data subjects, liability pursuant to a consumer law suit[iv]).

Governments have a similar interest in tracking the development and spread of COVID-19, as well as in the effectiveness of measures to slow or stop the disease. China, Singapore South Korea, and other nations have stepped up technological surveillance to ensure compliance with quarantine orders, and to track the disease within their borders. A recent report similarly indicates that the U.S. government hopes to partner with major technology companies, to track whether Americans are adequately complying with social distancing orders, and to fight the pandemic. However, many have expressed concern about such tracking, and some Western companies have indicated a reticence, or even refusal to comply (companies in China or similar countries are less likely to have the option to take such stances).

As companies and governments attempt to track and combat COVID-19 through data collection and monitoring, we are likely to see interesting developments in privacy law in the United States, and around the world.


[i] While health information is of course a core privacy concern, this article is focused on general personally identifiable information, and does not address the separate issues for protected health information arising under HIPAA and/or other laws.

[ii] That said, whether in Europe or the U.S., the purposes for which personal data can be used and the third-parties with whom it would be shared would be limited to those disclosed at the time of collection/opt-in. On the other hand, such a company could use and share de-identified collections of the same data without limitation.

[iii] The CCPA and GDPR require parental opt-in for certain minors, so the software would have to include some kind of age-gating.

[iv] While the CCPA also includes a private right of action, such right only arises in connection with data security failures and does not apply to violations of the data collection/disclosure requirements, enforcement of which is solely the domain of the California Attorney General.

Firm Highlights

Publication

How Antitrust and Unfair Competition Laws Affect Platform Providers’ Relationships With ISVs, API Developers, and Scrapers

A wide variety of business and consumer platforms host mutually beneficial ecosystems. But these ecosystems are also fraught with antitrust risk that arises when platforms try to terminate or modify the terms of third-party...

Read More
Publication

Zoom Successfully Addresses New York’s Privacy and Security Concerns

A few weeks ago on this blog, we addressed some of the legal issues that have arisen for Zoom , as it becomes a significant part of American daily life during the COVID-19 pandemic. ...

Read More
Publication

Reopening Businesses Must Consider Employee and Consumer Privacy

While we’re far from returning to the “normal” that predated the COVID-19 pandemic, states have begun to relax lockdown requirements and some previously “nonessential” businesses are returning to operations. Along with these openings, governmental...

Read More
Publication

Three Steps Licensees Can Take to Protect Their IP Rights in Bankruptcy

During periods of widespread economic disruption such as the present, operating businesses must be able to identify and respond to threats to the financial health of their contracting counterparts in order to protect key...

Read More
Publication

Proposition 24: California’s Ever-Evolving Privacy Landscape

Next Tuesday is election day, and this year, California voters are deciding whether to support another statewide privacy initiative – the California Privacy Rights Act (CPRA) (Proposition 24).  This measure would expand on the...

Read More
News

Prop. 24 Passes: What Companies Need To Know About the New Privacy Law

Nate Garhart spoke to the San Francisco Business Times on the steps companies can take to prepare for the California Privacy Rights Act (CPRA). He noted that if the CPRA applies to your business, then...

Read More
Publication

Twists in the Plot: California AG Releases Final CCPA Regulations

With a little time to consider the  finalized California Consumer Privacy Act regulations  released by the California Attorney General on August 14, 2020, it is clear that some last-minute negotiations (or perhaps just some...

Read More
Publication

Privacy During Bankruptcy Proceedings: Why It Matters

During these particularly trying times resulting from the COVID-19 pandemic, businesses of all sizes have been concerned about the future. As a result, considering potential liquidation or restructuring through bankruptcy is inevitably starting to...

Read More
Publication

Electric Fence: Protecting Proprietary Rights in Collected Energy Data

Like companies in other industries, a growing number of modern energy-related companies are focusing their efforts on data collection and analysis. For example, Enphase – an energy technology company – regularly tracks data about how...

Read More
Publication

A Roadmap to Litigating Privacy Claims? A Look at a Recent Order From the Google Assistant Privacy Litigation

As privacy-related litigation continues to heat up, Judge Beth Freeman (ND Cal.) recently laid out in In re Google Assistant Privacy Litigation (Case No. 19-cv-04286) [1] a potential roadmap for surviving or winning a...

Read More