Contact Tracing Poses ‘Pandora’s Box’ for Reopening Businesses

Businesses looking at smartphone-based tools to track their workers’ contact with people infected with coronavirus will have to walk a delicate tightrope between reopening safely and protecting employee privacy.

Apple Inc. and Alphabet Inc.‘s Google released initial versions of new virus proximity tracking tools Wednesday so public health agencies can prepare in advance of a mid-May roll out. The applications are designed to use public health information and unique Bluetooth identifiers assigned to devices to notify people when they’ve come into proximity with someone with the virus. Digital contact tracing would supplement analog efforts, in which tracers try to connect the dots via phone calls, in-person screenings, and voluntary disclosures.

Other businesses, like PricewaterhouseCoopers and Ford Motor Co., are developing their own tracking devices as they prepare to eventually reopen offices and factories. Corporate lawyers say businesses are contemplating proximity-tracking wristbands and applications, among other tools to mitigate the spread of Covid-19, the disease caused by the coronavirus.

Employers might require workers to agree to tracking in order to be permitted to return to their workplace when stay-at-home orders are gradually lifted. That could mean trading privacy rights—even when they’re off the clock—to keep their jobs.

“Until now, this has been a big privacy no-no,” said Scott Mirsky, an attorney with Paley Rothman, of tracking employees outside of work hours. Digital contact tracing and other tracking tools “may sound like exactly what’s needed in terms of public health. At the same time, it could be a Pandora’s box regarding employees’ privacy rights.”

Some companies remain skittish because of concerns about privacy infractions and potential discrimination claims that could be grounds for lawsuits. There also could be employee revolts if digital tracking tools aren’t properly deployed.

It remains to be seen how the tools will actually be used, said Ifeoma Ajunwa, an assistant professor at Cornell University who focuses on the ethical use of workplace technology.

“We don’t have any kind of really clear, detailed sort of white paper from Google and Apple as to what laws are they concerned about when doing this contract-tracing,” Ajunwa said.

Watching Workers?

Apple and Google released an application programming interface to select public health authorities, allowing them to build their own apps based on the contact tracing technology.

The apps would access users’ anonymous Bluetooth identifiers to show when they are in close proximity to someone with the coronavirus. They would require users to opt-in for tracking and the tech giants say they won’t have access to any of the data gathered.

Illustration: Jonathan Hurtarte/Bloomberg Law

Health-care providers like PRA Health and Sentinel Healthcare are pitching tools to track users’ body temperature and heart rate for risk signs or allow them to share certain information with medical professionals.

Some companies are developing their own tracking systems.

PWC’s Automatic Contact Tracing mobile app “can collect proximity information anonymously and allows managers to effectively and precisely notify employees when they may have come into contact with an at-risk colleague,” according to the company’s website.

The accounting firm is testing the tool in its Shanghai office, Rob Mesiro, connected solutions leader at PwC said. The company has received interest from several business sectors and hopes to roll out the tracing tool broadly in the coming weeks, Mesiro said.

Ford is testing wearable technology that alerts employees when they come within six feet of each other to encourage employees to comply with social distancing recommendations. A Ford representative didn’t immediately respond to requests for comment.

Karla Grossenbacher, a business attorney for Seyfarth Shaw, said privacy concerns are reason enough for her to advise her clients to stick to “manual” contact-tracing policies, which entail an interview process of the Covid-19 positive individual, in an attempt to retrace steps in the workplace.

“I have not had anyone talk about digital tools,” she said. “It just seems easier to do the manual tracing from an employment perspective.”

Boeing recently said it will use a traditional contact-tracing policy, and workers at Smithfield Foods Inc.'s Missouri pork processing plant called on the company in a lawsuit to come up with its own contact-tracing plan. The companies didn’t immediately respond to requests for comment.

Plaintiff Lawyers on Patrol

Plaintiff firms are waiting in the wings to file class actions over tracking data breaches and hacks, said Elizabeth Hinson, privacy and cybersecurity partner at Morris, Manning & Martin LLP. “Now is not the time to incur spending” on security incidents, she said.

Jay Edelson, founder of platiniffs’ bar firm Edelson PC, said some companies are using the coronavirus pandemic as an opportunity to possibly invade consumer and employee privacy. The firm was part of the recent $550 million Facebook Inc. settlement over biometric privacy issues.

“Often they claim they are collecting information for pandemic related reasons, but their real motivation seems to be to track people more generally,” Edelson said. “These types of activities are problematic and we do think, in the right circumstances, lawsuits could be helpful in curbing this illegal behavior.”

Some state laws, like the California Consumer Privacy Act, create extra requirements for companies. Businesses have to give employees notice about what types of data they may be collecting in the tracking process, Hinson said.

“The more information you provide to employees, the less scary it’ll be to them,” said Risa Boerner, chair of Fisher Phillip’s data security and workplace privacy practice group. “In order for employees to buy-in and be comfortable, they need to understand how it works, what is being collected, and for what purpose.”

Cornell’s Ajunwa said a patchwork of individual companies deciding whether to trace contacts is problematic.

“I believe the government actually needs to set standards for how the tracing can take place, and that it basically needs to be a universal contact-tracing for everyone,” she said. “It can’t be left up to the employers. This is a public health issue.”

Discrimination Concerns

Federal disability law also imposes obligations on employers handling sensitive medical information, like a Covid-19 diagnosis.

The Equal Employment Opportunity Commission has advised companies to alert public health authorities if a worker discloses a positive Covid-19 diagnosis, but the agency also said employers can’t disclose that worker’s identity when informing other employees who may have come in contact with the ill worker. The agency declined to comment specifically on digital tracing tools.

Covid-19 information is particularly sensitive because the long-term effects of the disease are still unknown, Ajunwa said.

“There could be long-term medical issues that we don’t know about,” she said. “Insurance companies might then have an incentive to know who’s been positive, and use that as some sort of pre-existing condition in the future.”

That could lead to potential employment discrimination against workers who have had the virus and may later be subject to a host of related health issues .

Meanwhile, many employers are taking a wait-and-see approach, said Bryan Cave Leighton Paisner partner Hope Goldstein. They’re focusing now on keeping the virus out of their workplaces altogether.

“Ultimately contact tracing is generally part of their plan, should the virus enter the workplace, but it’s just generally part of the plan,” she said. “If we hear about it having more success, we might see more adoption.”