Q&A

Contact tracing: Where have you been?

By CHARLES ANZALONE

Published May 18, 2020

Mark Bartholomew

As states lift their restrictions amid the COVID-19 pandemic, people eating in restaurants, traveling or taking part in other activities that were normal before social distancing can expect contact tracing, the process of locating infected persons to prevent the spread of the virus, says a School of Law expert in technology and cyberlaw.

It is possible that restaurants and other private businesses could ask customers for identification and contact information if there is a local coronavirus outbreak, according to Mark Bartholomew, professor of law, who has written extensively about cyberlaw and cybersecurity.

“People could potentially be asked to provide this information anywhere they travel,” says Bartholomew. “In fact, contact tracing is most effective when public health officials can obtain a record that is as complete as possible of an infected person’s daily movements.”

He says he knows of no states that now require restaurants to compile information on its customers if they want to re-open. But customers would be required to comply with restaurants’ individual regulations if they want to be served.

Bartholomew talked with UBNow about what to expect in a society transitioning from shelter-in-place requirements and returning to a less-restricted life.

What exactly is contact tracing?

Contract tracing is a process meant to locate infected persons and then research their social interactions to prevent further movement within the potentially infected area and to identify other possibly infected persons.

When would people be affected by contact tracing if cities and governments open up the sheltering-in-place restrictions?

Contact tracing is already starting in earnest with state and local governments looking to hire thousands of people to ascertain the movements of people infected with COVID-19. Contact tracing works best when public health officials have as comprehensive a record as possible of people’s daily movements. That is why most attention has been put on having private businesses like Google and Apple design and implement smartphone apps that can track these movements and potentially make the resulting records available to authorities. Nevertheless, it seems like analog methods of tracing that involve traditional interviews with infected persons and reaching out to their contacts will continue to be important. This is where businesses like restaurants could come in.

Can restaurants patrons expect to be asked to supply their ID/contact information?

At this point, that is really up to the restaurants, kind of like a restaurant’s decision in pre-COVID-19 times to enforce a particular dress code. So far, I have not heard of any states requiring all restaurants to engage in this kind of tracking if they want to be open for business, though in the scope of a public health emergency that is not a complete impossibility. Still, I think most restaurants and other businesses would want to avoid this kind of intrusion into their customers’ personal information for fear of driving them away. I think we are more likely to see the requirement of temperature screenings and wearing of face masks than the required disclosure of personal contact information.

Do customers have to comply, or can they opt out if they consider this some kind of breach of privacy or civil liberty?

For the most part, I don’t think customers can opt out of things like temperature readings, mask-wearing, or even being asked to present their ID and still expect to get served. It is ultimately up to the restaurant. The only wrinkle here is if the restaurant could be accused of adopting these measures in a way that disparately impacted a particular protected group of people. Then, the restaurant could be accused of discriminatory behavior.

Will restaurants be allowed to hold onto this data or be asked to hand this over to local health authorities in the event of a virus outbreak?

Again, it really depends on both restaurant owners, as well as the decisions of state and local health departments. It is conceivable that public health departments might ask for this information to be turned over to help with contact tracing efforts. The restaurants might voluntarily supply the information — after all, it is in the interest of businesses to keep the infection rate low. If a restaurant refused, we might see a court weighing in on whether such private information had to be turned over in the midst of a public health emergency.

Let’s talk about contact tracing apps. Are there examples of governments or organizations requiring these apps, and have they worked well?

Governments outside of the United States have implemented different contact tracing apps, but it is too early to determine their effectiveness. For example, Singapore’s TraceTogether app uses Bluetooth technology to reveal who an infected person has come into contact with. Someone who tests positive for the virus can log into the app, which then notifies everyone they’ve recently come into contact with but without revealing the actual identity of the infected person. Scientists agree that the use of these apps needs to be widespread to be truly effective.

We know the upside to contact tracing apps, but what’s the downside? Should we be concerned about that?

There are a few things that we should worry about when it comes to contact tracing technologies. The first concern is making sure the information collected will be used only in connection with limiting the spread of the virus. You can learn a lot about someone from their location data. As these apps are rolled out, there should be protections in place to make sure that any information collected is secure and will be deleted when the health crisis is over. Another related concern is the problem of normalization. If I had told you three months ago that millions of U.S. citizens would install an app on their phones that records all of their movements, as well as their interactions with others and then broadcasts their health status to those people and maybe the government too, you probably would have called it dystopian science fiction. Now it is very real. Once we embrace this technology, we need to be careful not to let it seem so normal that it becomes part of the background like the other tools we have gotten used to that already surveil us online. There’s long been a tradeoff between privacy and security. In this particular instance with the pandemic, the security interests may outweigh the privacy ones, but that balance needs to be kept in mind as we determine exactly how these apps are to be designed and used.