The COVID-19 global pandemic has raised many issues at the intersection of law and psychology. One that is becoming a focus of debate is the tension between privacy and public health. Already, companies are using aggregate smartphone location data to assess whether residents are following stay-at-home orders. In some countries, like South Korea, smartphone apps alert authorities when quarantined residents leave their homes. Other countries, including Australia and several European nations, are developing apps that use location data to facilitate contact tracing. Singapore has already deployed such an app, called TraceTogether. Commercial products that could enable employers to track workers’ health or locations are also available. Employers and schools are considering using facial recognition software to implement new timekeeping practices, security protocols and exam-proctoring methods.
Issues related to digital privacy have been brewing for some time, and these COVID-19-related developments will only accelerate that trend. In Carpenter v. United States (2018), the U.S. Supreme Court held that, given the privacy interest individuals have in information about their physical location, authorities needed to obtain a warrant before seeking a week’s worth of location data from a cellular service provider as part of a criminal investigation. The court noted that cellphones have become “almost a ‘feature of human anatomy’” and that location data “provides an intimate window into a person’s life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations.’” But how these concerns will play out in the public health and surveillance context remains to be seen.
State privacy laws will play a role as well. The Illinois Biometric Information Privacy Act (BIPA), for example, restricts the ability of private entities to collect biometric information without notice and consent. In January, Facebook agreed to a $550 million class action settlement for using facial recognition technology without users’ consent. In April, parents sued Google under BIPA and the federal Children’s Online Privacy Protection Act, alleging that Google collected, stored and used children’s biometrics without parental consent by providing access to laptop computers with preinstalled apps that required voiceprints and faceprints.
Claims like these are likely to proliferate in the wake of the pandemic, and the decisions made are likely to outlast it. Psychologists have much to contribute by helping policymakers understand whether people appreciate how much digital and biometric information they are transmitting and how (and by whom) it will be used. Psychologists can add to discussions of what informed consent might look like in these contexts, the differences between opt-in and opt-out participation and the role of (often fine-print) privacy policies. Research might explore how the use of digital data might affect trust between individuals and public health workers responsible for contact tracing interviews, or how digital contact tracing might interact with poverty and the technology divide. Psychologists can contribute to solutions for helping people protect themselves against counterfeit contact-tracing apps and other forms of cybercrime. More broadly, psychologists can continue to study people’s expectations of privacy, an important concept under the Fourth Amendment to the U.S. Constitution.
