Digital Contact Tracing and Data Protection Law. Congressional Research Service. Jonathan M. Gaffney, Eric N. Holmes, Chris D. Linebaugh. September 24, 2020
Digital Contact Tracing and Data Protection Law Coronavirus Disease 2019 (COVID-19) has infected millions of Americans since the ongoing pandemic began, and the disease has caused many thousands of deaths across the country. Government officials attempting to slow the spread of COVID-19 have implemented a number of responses, including widespread stay-at-home orders, travel advisories, and an increase in testing. State and local public health authorities are also making use of public health investigation techniques to ascertain how the disease has spread. One such technique is contact tracing, a process by which public health investigators identify individuals who have come into contact with infected persons.
Officials and technology companies have suggested that contact tracing may be accomplished more quickly and easily with the assistance of digital tools. For example, digital technology might assist with tracking individual movements and encounters using information collected from mobile devices. However, public health authorities’ use of digital tools capable of collecting individual information also raises concerns about how to preserve the privacy and security of that data.
This report will discuss how data privacy and security (together, data protection) law applies to a public health authority’s use of digital contact tracing tools. The report begins with a discussion of contact tracing, the role of technology in assisting with contact tracing, and potential privacy concerns. The second section of the report details key federal privacy laws—the Health Insurance Portability and Accountability Act, the Communications Act, the Family Educational Rights and Privacy Act, the Children’s Online Privacy Protection Act, the Privacy Act, the Electronic Communications Privacy Act, and the Federal Trade Commission Act—and discusses what rights and obligations these laws may create for users and providers of digital contact tracing tools. Next, the report reviews selected state and foreign data protection laws and their application to digital contact tracing. The report concludes by providing an overview of data protection bills introduced in the 116th Congress in response to the COVID-19 pandemic and discussing some considerations for Congress as it weighs such legislation.
[PDF format, 47 pages].