Assessment of Contact Tracing: Balancing Privacy and Safety in the Pandemic

06.26.2020

Cities, counties, housing authorities, transit agencies, water districts, and other special districts (“public employers”) have begun to return employees to the physical workplace, despite the ongoing Coronavirus disease 2019 (“COVID-19”) pandemic.  Public employers have had to grapple with a host of workplace safety measures to address the public health risk posed by COVID-19, as the close proximity of employees in work facilities increases the risk of exposure to the virus.  Public health authorities have required or recommended several strategies to lower the level of risk, including face-coverings, social distancing, travel guidelines, and stricter cleaning and disinfecting protocols.  The Centers for Disease Control and Prevention (“CDC”) has also recommended that employers notify other employees if they may have been in contact with and/or exposed to an individual who tested positive for COVID-19. 

Given this recommendation and the unprecedented scope of the present pandemic, public employers have considered new strategies and technological solutions to help keep employees safe.  Digital contact tracing presents an innovative means of combating the risk of exposure.  However, it also poses risks to employee privacy.  This Alert shall explore the benefits and concerns raised by contact tracing, particularly those faced by public employers.

What Is Contact Tracing?

In past epidemics, public health officials relied upon earlier forms of “contact tracing.”  In its simplest form, contact tracing involves the isolation of individuals who have tested positive for an illness, the identification of others with whom the positive person has recently come into contact and/or been exposed, and the notification of those third parties about their exposure to a positive case.  By tracking the “spider web of transmission”, public health officials can seek to limit the spread of an illness through the identification and isolation of positive cases and/or exposed individuals.  The CDC has published a webpage of “Principles of Contract Tracing” which describes how it generally functions.    

Public health officials have used contact tracing for centuries, using physical records in conjunction with exhaustive one-on-one discussions with infected or exposed parties to determine how far a pathogen has spread.  However, technological advances, particularly the use of the internet and mobile computing devices (such as smartphones), provide public health officials and employers alike with more robust digital contact tracing methods.

How Does Contact Tracing Currently Work?

California’s Department of Public Health (“CDPH”) currently recommends using the traditional model of contact tracing, in which health workers notify individuals if they have been in contact with an infected individual.  The CDC and the CDPH define “close contact” during the current COVID-19 pandemic to mean anyone who was within six feet of an infected individual for at least 15 minutes.  This approach does not rely on information collected with cellular phones and/or the internet. 

Contact tracing can also be implemented using digital applications (“apps”) on an individual’s smartphone.  This app can track the user’s physical proximity to others, and alert the user if he/she has been in “close contact” with someone who later tests positive for (in this case) COVID-19.  A contact tracing app user would receive a notice on the app, if they have recently come into “close contact” with an individual who has reported a positive case of COVID-19. 

Contact tracing apps use different means for identifying when a user comes into “close contact” or proximity to an individual who has tested positive.  Some apps use Bluetooth and/or WiFi (wireless network protocols) to track whether a user has come into contact with another individual who has reported a positive case of COVID-19.  Using these networks, a user’s cell phone performs anonymized “checks” with other app users, and notifies the user if a “check” reveals that another user in close proximity has reported a positive test.  Other apps rely on geolocation, tracking a user’s geographic position and notifying the user if he/she comes into “close contact” with another user reporting a positive test result.  These apps can be set to limit the geographic location tracked to a particular site, such as an employer’s physical work facility.

Regardless of the method used, digital contact tracing apps collect various types of information, including: identifying information of the user’s cell phone or other mobile computing device; logs of contacts with other users, such as checks with other devices on WiFi or Bluetooth; the date and time of contacts; reports of the user’s positive test results; and any verification of positive test reports by a healthcare professional. 

By relying on real-time data and frequently used devices, contact tracing apps provide a swift means of notifying employees about potential exposure and beginning the self-quarantine process.  Given this speed, advocates suggest that digital contact tracing helps slow the spread of pathogens in a global pandemic, such as the coronavirus.

Balancing the Advantages and Downsides Posed by Contact Tracing.

Digital contact tracing poses several risks and challenges for public employers.  First, contact tracing methods could trigger bargaining obligations for public employers with unionized employees.  Public employers should carefully assess whether contact tracing impacts various aspects of employees’ terms and conditions of employment, such as rules of conduct, off-duty policies, or disciplinary action.  Digital and non-digital contact tracing could also constitute a form of surveillance, depending on the precise scope and nature of the digital app used by a public employer.  The Public Employment Relations Board and federal National Labor Relations Board have occasionally addressed various forms of employer surveillance.  While public employers generally have a legitimate business need to protect employees who may have been exposed to COVID-19, they will need to carefully consider the methods used by digital contact tracing apps and whether they unnecessarily monitor employees.

Second, contact tracing apps could provide public employers with confidential information.  For example, this data may include positive test results.  Public employers should remain mindful of their obligations to protect the confidentiality of employee “medical information,” which the Equal Employment Opportunity Commission (“EEOC”) has reminded employers includes the identity of employees who have tested positive for COVID-19.  Public employers should ensure that “medical information” collected by contact tracing apps remains confidential, including for users of contact tracing apps.

Third, digital contact tracing may involve the incidental collection of a host of private information.  This may include employees’ use of restrooms or lactation rooms in the workplace, as well as their travel and location during non-working hours.  Contact tracing apps typically do not distinguish between working and off-duty hours, and may provide public employers with a detailed picture of where employees travel and with whom they interact.  While public employers may not be subject to recent California statutory law governing data privacy and imposing disclosure obligations, employers may face risk under common law state privacy claims, such as invasion of privacy torts.  

Given the novel nature of contact tracing apps, and the unprecedented scope and nature of the present pandemic, there is little guidance in how courts or other authorities will assess the impact or invasion of employee privacy under existing legal claims.  Public employers should consider this level of risk when evaluating whether to implement contact tracing apps or methods.  Public employers should also ensure that they obtain the prior consent of employees before adopting any form of digital contact tracing based on geolocation and/or GPS tracking, as Section 637.7 of the Penal Code makes it illegal to monitor the movements of another person without their permission.  In addition to legal exposure, public employers should also assess the impact on employee relations and morale if expansive data collection results from digital contact tracing methods.

Fourth, public employers should also carefully consider the general collection methods, security measures, and retention protocols for a contact tracing app under consideration.  Among other concerns, public employers should consider how a contact tracing app stores the data collected (such as on users’ phones or on an external server), how long this data is stored, and whether any data security measures are in place.

Finally, public employers should be aware of the types of information that contact tracing apps do not collect.  None of the methods listed above collect information about whether users are employing other risk-mitigating measures to avoid contracting COVID-19, such as wearing face-coverings, engaging in social distancing, covering any coughs or sneezes, or washing hands.  These apps also do not account for physical barriers, partitions, or other features of an office building which could further affect the level of risk of exposure between two individuals who are generally close in geographic proximity.  Contact tracing apps may suggest the same level of exposure or risk to COVID-19 between employees walking next to one another in a narrow hallway without face-coverings, as with an employee speaking with another employee sitting behind a glass partition and wearing a face-covering.  

Public employers should carefully assess the risks and benefits posed by a particular means or form of digital contact tracing.  While the unprecedented and grave nature of the current pandemic demands sensitive and effective solutions, employers should ensure that they balance employee privacy with the safety of the workforce.  In addition to the considerations raised above, should an employer decide to use contact tracing, they should develop clear policies  which identify the specific reasonable privacy expectations of employees, whether the information is subject to collection, how the information will be maintained, when employees would be required to self-quarantine, and the consequences of failing to follow the policy. 

Finally, employers are encouraged to carefully review federal, state, and local public health guidance on contact tracing.  Public health guidance on the various aspects of the present pandemic is updated frequently and subject to change.  Please feel free to reach out to the Authors of this Alert or your regular AALRR counsel with questions relating to contact tracing.

This AALRR publication is intended for informational purposes only and should not be relied upon in reaching a conclusion in a particular area of law. Applicability of the legal principles discussed may differ substantially in individual situations. Receipt of this or any other AALRR publication does not create an attorney-client relationship. The Firm is not responsible for inadvertent errors that may occur in the publishing process. 

©2020 Atkinson, Andelson, Loya, Ruud & Romo