Apple, Google Must Vet Tracing Apps or Face Lawsuit Risks

Apple Inc. and Alphabet Inc.'s Google must ensure the public health apps in their digital contact-tracing system have adequate privacy protections or risk facing lawsuits, attorneys said.

The companies must make clear how they’ll decide which public health agencies can participate in the program and which data the authorities will be allowed to collect, said Ashkan Soltani, who served as the Federal Trade Commission’s chief technologist former chief technologist during the Obama administration.

The companies Friday released updated privacy protections for their plan, including encrypting Bluetooth metadata. They said the first phase of the program will start in mid-May when they provide tools for public health apps to add contact tracing.

“We would all be well served if the criteria for AppStore approval was made explicit ahead of time,” Soltani said.

Company officials told reporters Friday that they’re still developing guidelines for how public health authorities can use the tool, and they noted that the agencies will have to get user consent and follow transparency obligations. The companies also said that public health authorities won’t be able to monetize data they collect.

Apple and Google haven’t detailed the criteria they’ll use for vetting the apps. Company representatives didn’t immediately respond to requests for comment.

The companies may leave themselves open to consumer allegations if they don’t properly vet the public health apps, attorneys said. Consumers could fault the companies if they feel the agencies are collecting too much information, like geolocation data, or mishandling sensitive health data, they said.

Any lawsuits against the companies would likely allege that “they should have the set a standard higher” and known about any vulnerabilities of the apps, said Alysa Hutnik, chair of Kelley Drye & Warren LLP’s privacy practice.

The companies could avoid legal liability by being clear in their terms of service and including liability waivers, privacy attorneys said.

“Apple and Google get a lot of cover” because users are opting into the system and would likely have a clear choice to do so, said Mark McCreary, co-chair of Fox Rothschild LLP’s privacy and data security practice.