Over the last several days, companies around the world have announced plans to develop a contact tracing mechanisms to help combat the spread of COVID-19. To understand how it works, imagine you’re in the midst of an earlier pandemic: the 1918 flu. As you go through your day, you ask for and write down the names of everyone you encounter in a notepad. At first, you don’t give the list to anyone, and in fact, your notepad never leaves your jacket pocket. Meanwhile, if anyone comes down with COVID-19, that person can voluntarily notify the local newspapers, who then publish a daily list of everyone who’s self-reported. Each morning you sit down with the newspaper in one hand and your list in the other, and cross-check to see if you’ve come into contact with anyone who’s tested positive. If you find a match, then you can take steps to self-quarantine or otherwise manage your exposure. At its core, the tracing mechanisms works exactly the same way—except instead of asking for and writing down names, people’s phones are constantly broadcasting Bluetooth signals to everyone around them, and instead of exchanging names, everyone exchanges anonymous identifiers that can’t easily be traced back to anyone. The result is a respectably privacy-minded system to help people figure out whether they’ve been exposed.
According to some companies who are developing tracing mechanisms in the United States, they aren’t going to force anyone to participate in the system. You’ll have to opt-in to broadcasting your signals, and obviously you don’t have to share your diagnosis if you don’t want to. But can other people force you to participate—and to disclose results?
Here’s why that possibility is, well, a possibility. If you’re a grocery store, you generally have a duty to inspect your store for dangers and fix them. That means you should check the aisles periodically for an olive oil spill that might lead to a slip and fall—it’s in your interest to avoid the liability. The same principle arguably applies to COVID-19. Plenty of people are taking the position that businesses have an obligation to take reasonable steps to protect visitors and employees from COVID. In some cases, that means trying to exclude visitors and employees who pose a risk of infecting others. That’s why some companies have been asking visitors about their travel history or taking employee temperatures before letting them enter a building.
The mobile phone-based mechanisms potentially gives businesses an even stronger tool for filtering out risky visitors and employees. A front desk could, for example, demand to see visitor or employee phones, confirm that individuals have been using the mechanism for 14 days, and check if the person has found a “match” with an infected person.
This raises legal questions that businesses will need to address. For example, can you demand to see people’s phones? Can you exclude people who don’t have mobile phones with tracing? Can you demand that employees enable the system on their own devices? If your business issues phones to employees, can you simply enable the mechanism on the backend? What notices, if any, must you provide? And—perhaps most important—if businesses adopt any of these requirements on a widespread basis, will these procedures quickly become the prevailing standard of care? In other words, at what point are you legally required to go with the flow?
Companies are going to have to contend with this data collection mechanism -- either as employers deciding whether or not to monitor their employee data, or as a companies welcoming customers, who they may want to screen. It is too early to tell exactly how to wrestle with these decisions, but companies should start thinking through these issues now. To be sure, the public will want to re-open American life as soon as possible, and all experts say that contact tracing must be part of any solution. If companies are not part of the solution, will they be part of the problem?
For some of the company explanations, please click here, here, and here.
If you want to know more about what companies need to know about contact tracing apps, our experts across the globe will explain explore the topic in a blog series over the next weeks.
