Leveraging Data to Combat the COVID-19 Pandemic: The U.S. Response
The ongoing COVID-19 public health crisis has confronted society with a series of medical, social, political, and economic challenges. As policymakers consider appropriate responses to the outbreak, there is increasing recognition that leveraging “big data” sources can help track the spread of the virus and inform public health officials of the efficacy of containment efforts. The opportunities presented by such data-driven tools and information sharing are significant; however, the use of inherently sensitive personal information such as location and health data raises serious privacy issues. In recent weeks, both the American government and industry have launched promising new data-driven efforts to combat the pandemic while also respecting American consumer protection laws and values.
1. Federal Responses
To date, the centerpiece of the Federal Government’s response to the COVID-19 emergency has been the CARES Act, a stimulus bill of over $2 trillion in funding for individuals, businesses, and local governments. This legislation also clearly recognized the value of data to prevention efforts by allocating over $500 million to the Centers for Disease Control and Prevention (CDC) for “public health data surveillance and analytics infrastructure modernization” with a requirement to report to Congress on the development of these programs within 30 days. The CDC has shared that to create an ongoing picture of the disease’s spread and effects, its surveillance efforts draw from “existing influenza and viral respiratory disease surveillance systems, syndromic surveillance systems, case reporting systems, commercial lab reporting, ongoing research platforms employed for the coronavirus response, and new systems designed to answer specific questions.”
On Tuesday April 14, the Senate Commerce Committee completed a novel “paper hearing” on “Enlisting Big Data in the Fight Against Coronavirus.” Through public postings of statements, questions, and answers, Senators and witnesses from across industry, academia and civil society explored issues concerning the use of consumer data to measure and treat Coronavirus cases. Within this back and forth, several recurring themes and principles emerged that could serve as a framework for evaluating data-driven programs to combat the pandemic.
• Outcome Oriented: A common refrain of the hearing was that any decisions to harness data should be done with specific use cases in mind. Furthermore, in order to ensure that such programs provide meaningful and actionable insight, developers should recognize and account for circumstances where data may be inaccurate or not fully representative of a population. Ranking Member Cantwell encapsulated this sentiment in her opening statement, arguing that policymakers must “always focus on exactly how we expect technology to help, and how to use data strategically to these ends.”
• Transparency: Witnesses agreed that organizations leveraging data for public health purposes should be clear and open about how data is collected, used, and protected. As certain proposals to control the pandemic may require voluntary user participation, such transparency is an important way to build public trust in these initiatives. Stacey Gray of the Future of Privacy Forum noted that in this context, “governments and companies seeking to share data should take extra steps to be transparent about the personal data used, how it is processed, who has access, and for what specific purposes.”
• Data Minimization: The principle of data minimization was also frequently cited to support the proposition that pandemic response programs should use the least amount of identifying data necessary to accomplish their purposes. Michelle Richardson of the Center for Democracy & Technology added specific guidance for this principle that “individually identifiable information should not be used when less intrusive measures will suffice. If aggregated data will not do, industry best practices in anonymization and de-identification must be applied.”
• Prevent Repurposing: A repeated concern was that data collected for containing the viral outbreak could subsequently be used for inappropriate secondary purposes. Witnesses advocated for strict controls and accountability mechanisms that would prevent the repurposing of data for unexpected uses. Professor Ryan Calo, University of Washington, raised an example of an inappropriate secondary use, arguing that “[n]o consumer would or should expect that the absence of certain antibodies in their blood, gathered for the purpose of tracing a lethal disease, could lead to higher health insurance premiums down the line.”
• Government Restraint: Participants recognized that context matters in utilizing data to respond to the pandemic and that different considerations apply to industry-led efforts versus government collection of data implicating civil liberties. It was further posited that any expansion of government surveillance authority must be weighed against other vital interests and should be limited to the duration of the crisis. Graham Dufault of ACT | The App Association noted while a tempting data source, “the ready availability of an extraordinarily complete picture about individuals’ movements to a government authority is not generally a feature of American policy, which tends to avoid such invasive surveillance and enforcement without due process.”
Finally, witnesses uniformly stressed that the lack of a national consumer privacy framework and the current fragmented patchwork state rules has created unnecessary uncertainty for the development of data-driven tools to help health officials respond to the COVID-19 pandemic. The U.S. regulatory patchwork was contrasted with the European Union’s standardized General Data Protection Regulation (GDPR), which allowed officials to rapidly issue guidance on processing personal data in the context of the COVID-19 outbreak in accordance with data protection rules. Senators appeared receptive to this message, with Chairman Wicker framing the hearing by recognizing that the pandemic “further underscores the need for uniform, national privacy legislation.”
2. Industry Responses
The magnitude and urgency of the threat posed by the COVID-19 virus has prompted swift and significant responses from lawmakers and partners in industry. While some of the technological systems that will guide and inform the public response to the pandemic are still under development, U.S. industry has taken a leading role in developing tools to help contain the pandemic including: (1) methods for evaluating social distancing efforts and (2) contact tracing mechanisms. Furthermore, these tools have been developed with individuals’ privacy and security in mind from the outset.
A. Evaluating Social Distancing Efforts
In an effort to relieve pressure on the public health system, officials have issued stay-at-home orders and undertaken other efforts to limit the transmission rate of the COVID-19 virus. Understanding the movement trends of a population can help health officials both evaluate the effectiveness of these measures and anticipate areas of increased risk for new viral outbreaks. One company leveraging this information to help inform public policy is Facebook, which has produced three new Disease Prevention Maps through its “Data for Good” program.
Facebook’s Disease Prevention Maps provide health researchers with near real-time mobility trends to better understand how population dynamics are influencing the spread of the COVID-19 virus. These maps include: (1) co-location maps that show the likelihood of people in different areas coming into contact with one another; (2) movement range trends which show the rates at which people in a specific region are staying at home relative to pre-pandemic baselines; and (3) a social connectedness index depicting friendships across states and countries, which can help forecast the likelihood of disease spread. Critically, these maps present data in an aggregated form at regional levels, so as to provide useful insights to researchers and health experts without compromising individual privacy.
B. Enabling Contact Tracing
Another strategy governments are exploring to limit the spread of the disease is “contact tracing,” which entails notifying individuals who have recently been in contact with a diagnosed patient so that they can take early measures to test and self-quarantine. While contact tracing has long been recognized as a valuable method to help prevent the spread of infectious diseases, identifying and notifying recent contacts while protecting the privacy of infected individuals can be challenging.
In an effort to enable more effective contact tracing, Google and Apple have announced a joint initiative to develop interoperable APIs and operating system-level technology harnessing wireless Bluetooth signals. Under this system, diagnosed individuals may choose to send an alert to phones that have recently been in their vicinity, providing notice of possible exposure to someone who has tested positive for COVID-19 and relevant public health information. While the full details of this program are under development with key stakeholders and will be announced through a series of white papers, these companies have made important privacy and security commitments up front. First, Bluetooth-enabled contract tracing and notifications will be activated only for users who explicitly opt-in to the program. Second, the program is not based on location data, but instead relies on proximity detection through Bluetooth signals to exchange anonymous identifiers. Finally, the program follows a decentralized model, meaning that anonymized contact lists will be processed solely on a participant’s phone and that those who test positive will not be identified to other users, Google, or Apple.
The response to and recovery from the COVID-19 pandemic will require far-reaching creativity, collaboration, and determination. While data alone should not be regarded as a panacea, it can serve as an important tool to assess risk, measure public health responses, and enact policy. The values of privacy and public safety have often been framed as in tension; however, despite areas of regulatory uncertainty, the American response to the ongoing crisis presents the basis for a balanced approach to leveraging data for social good while respecting individual rights and interests.