Privacy & Information Security Law Blog

On April 9, 2020 the U.S. Senate Committee on Commerce, Science and Transportation held a “paper hearing” entitled Enlisting Big Data in the Fight Against Coronavirus. A “paper hearing” consists of the committee members submitting opening statements and witnesses submitting testimony, which were posted on the Committee’s website. Witnesses were required to submit answers to member questions last week.

The witnesses for the hearing were as follows:

• Ryan Calo, Law Professor, University of Washington
• Graham Dufault, Senior Director for Public Policy, ACT | The App Association
• Leigh Freund, Chief Executive Officer, Network Advertising Initiative
• Stacey Gray, Senior Counsel, Future of Privacy Forum
• Dave Grimaldi, Executive Vice President for Public Policy, Interactive Advertising Bureau
• Michelle Richardson, Director, Data and Privacy Project, Center for Democracy and Technology
• Inder Singh, Chief Executive Officer and Founder, Kinsa Smart Thermometers

Chairman Roger Wicker (MS) and Ranking Member Maria Cantwell (WA) both offered opening statements discussing how data can be used in a variety of ways to help combat the spread of COVID-19, and how privacy risks need to be considered and minimized. In particular, Senator Wicker mentioned the need for transparency in how data is being used, how it is being anonymized, with whom it is being shared and after it is used what will be done with the data. In addition to transparency, Senator Cantwell called for purpose limitations for the data, strong consumer rights and strict accountability measures to protect individuals’ privacy.

In general, the witnesses touched on similar themes, most notably about the various ways data is being used during the pandemic, how the COVID-19 crisis illustrates the need for a national privacy framework, and considering and minimizing the privacy risks associated with data use.

Specifically, Ryan Calo expressed skepticism over some of the methods being used to track the spread of the virus and asked that lawmakers and companies ask whether a specific intervention does enough to offset its impact on privacy and civil liberties. He also expressed concerns with secondary uses of the data being collected and used.

Graham Dufault noted the steps taken by private companies in the coronavirus fight already, and stressed the importance of anonymization of location data to protect individual privacy. He also noted that the lack of a national privacy framework has left our country ill-prepared to respond to the crisis with a coordinated, data driven effort.

Leigh Freund highlighted the Network Advertising Initiative’s Code of Conduct for digital advertising, which balances privacy and beneficial uses of data, as a set of best practices for all companies during this crisis. She also pointed to Privacy for America’s framework as a potential model for the national privacy law for which this crisis has demonstrated a need.

Stacey Gray illustrated how the collection and use of data in this crisis can be compatible with privacy and data protection principles. She noted that there needs to be consideration of whether location data being used will actually serve its intended objectives. She also recommended that companies follow the lead of public health experts, that they ensure transparency, follow the principles of data minimization, use risk assessments and follow purpose limitations principles. Finally, she addressed that a federal privacy law would provide clarity for companies, so they could respond to crises quickly and understand what data they can safely share.

Dave Grimaldi noted the importance of advertising and data to support the fight against the coronavirus as long as appropriate privacy safeguards are taken, and also advocated for Privacy for America’s framework for a federal privacy law.

Michelle Richardson advocated for how big data can help combat the coronavirus without jeopardizing privacy. She noted that the lack of a comprehensive privacy law can undermine trust in the use of data and inhibit disease response, and pointed specifically to the limitations of the scope of HIPAA. She also advocated for the use of aggregated or anonymized location data when possible, and mentioned that there are serious privacy concerns with some of the location tracking efforts in use by other countries. Ultimately, she noted that privacy should be a balancing of equities that weighs the risks to individuals against the benefits of the data use, and that companies and government alike should adhere to the principles of data minimization, purpose limitation, transparency and individual rights.

Finally, Inder Singh talked about the impact that Kinsa Smart Thermometers have already had on detecting the community spread of COVID-19 by predicting outbreaks through unusual fever levels. He noted that Kinsa aggregates all of their user data, which ensures that individuals cannot be identified, and that their users have to opt in to share their location data and can opt out of sharing at any time.