Skip Navigation

Privacy Protections Will Be Crucial For the Covid-19 App

State officials need to be transparent about what kinds of data will be collected and how it will be protected in order to overcome user distrust.

January 11, 2021

This origin­ally appeared in NJ Spot­light News.

As COVID-19 rates explode through­out the coun­try, states are finally deploy­ing smart­phone applic­a­tions to combat its spread. New Jersey is one of at least 24 states that have released an app within the past several months. The launch of COVID Alert NJ comes as Gov. Phil  Murphy reports diffi­culties persuad­ing people to cooper­ate with contact tracing. In this context, the app, which is volun­tary, stands a chance of help­ing only if it is trus­ted to keep user inform­a­tion secure.

To foster broader adop­tion and imple­ment­a­tion, state COVID-19 apps should have robust, built-in privacy protec­tions that are commu­nic­ated clearly to the public. New Jersey’s app is built on the Google/Apple Bluetooth Expos­ure Noti­fic­a­tion plat­form. This plat­form is the most privacy-protect­ive because it relies solely on Bluetooth prox­im­ity data, as opposed to loca­tion data like GPS. When an indi­vidual reports a posit­ive test result, the system can anonym­ously notify other app users who have been nearby. In addi­tion, users store prox­im­ity iden­ti­fi­ers locally on their phones. This decent­ral­ized model protects against hack­ers and limits the poten­tial for govern­ment surveil­lance by minim­iz­ing data collec­tion.

New Jersey’s model is super­ior to state apps that feature GPS loca­tion track­ing. Unlike prox­im­ity, which only meas­ures whether people are within a certain distance of one another, GPS can track someone’s every move­ment. GPS monit­or­ing poses a major risk to privacy because, in the words of U.S. Supreme Court Justice Sonia Soto­mayor, it “gener­ates a precise, compre­hens­ive record of a person’s public move­ments that reflects a wealth of detail about her familial, polit­ical, profes­sional, reli­gious, and sexual asso­ci­ations.” Unsur­pris­ingly, these less privacy-protect­ive apps have had the hard­est time attract­ing users.

Indeed, public distrust has threatened to hamper even tradi­tional contact-tracing efforts, in which public health offi­cials reach out directly to indi­vidu­als who have been diagnosed with COVID-19 to identify people they have had contact with. In partic­u­lar, communit­ies of color, espe­cially immig­rant communit­ies, have expressed concerns about the shar­ing of contact-tracing data with police or immig­ra­tion author­it­ies.

To enhance user trust and adop­tion, protec­tion of app data must go hand in hand with trans­par­ency. People will be more likely to use apps when they under­stand what data is being collec­ted from them and who has access to it.

In partic­u­lar, states must address what happens to user data once it is volun­tar­ily shared with state health author­it­ies. Will app data be disclosed to law enforce­ment, and why? If app data is used to inform deploy­ment of police to enforce social distan­cing, it could exacer­bate the poten­tial harms exper­i­enced by people of color, who have been most affected by the coronavirus and are also most impacted by systemic over­poli­cing. A contact-tracing privacy bill that would restrict shar­ing of contact-tracing data and require data dele­tion or deiden­ti­fic­a­tion passed the New Jersey Assembly in July.

States should also be forth­com­ing about their data reten­tion policies. Will app data be deleted? If so, how often? How is the data encryp­ted and stored? Strong data minim­iz­a­tion policies and limit­a­tions on data reten­tion are an import­ant check on the abil­ity of COVID-19 apps to facil­it­ate, purposely or not, govern­ment surveil­lance. They will also mitig­ate the risk that data collec­ted to combat COVID-19 is repur­posed in the future for some other object­ive.

Because the state’s app is relat­ively new, New Jersey must make efforts in the coming months to crit­ic­ally exam­ine the app’s effect­ive­ness in combat­ing the spread of the pandemic and the suffi­ciency of the safe­guards they have developed. The state should share key data points, includ­ing the app’s rate of accur­ate expos­ure noti­fic­a­tions to better inform public discus­sion. Moreover, main­tain­ing and improv­ing privacy protec­tions are continu­ing processes, requir­ing regu­lar privacy audits. New Jersey should release the results of these audits publicly and be trans­par­ent about any modi­fic­a­tions or improve­ments they produce.

It remains to be seen whether COVID-19 apps will prove an effect­ive supple­ment to tradi­tional contact tracing, but they will have a mean­ing­ful public health impact only with higher adop­tion rates. Trans­par­ency, account­ab­il­ity and user privacy are key to promot­ing usage. To this end, New Jersey should continue to be upfront with the public about how its app works and the efforts to minim­ize privacy risks.