On Privacy in the Age of COVID-19

As a third of the world population has been in lockdown [1], nearly half a million people have died of COVID-19 [2], and the world’s economies have nosedived, policy makers and the public clamor for good news, or even just less uncertainty. Questions such as “Might I be infected if I go to work?” or “Does wearing a mask help prevent the spread of the disease?” are being asked. Answering these questions requires data! We need data on the infectiousness of the disease, as well as the efficacy of interventions such as lockdowns, distancing, and protective measures. Because the disease is novel, we do not know whether scientifically collected data from previous pandemics are relevant. Both repurposing relevant existing data collections, and the quick and effective design of new data collections are top priorities for informed, high quality decision-making. But, potentially relevant existing and currently growing data collections were not initiated with the intent of fighting a pandemic. Some data were collected by private entities for unrelated commercial applications, or by governments. Cell phone tracking, geo-located electronic purchase transactions, and vehicle trajectories—all givens of modern life—have suddenly became (potentially) relevant for diagnostics and policy planning, if appropriately informed by research. Access to these data by parties other than those originally collecting them has therefore become important, even critical. This situation is the epitome of mission creep. Initially, the creeping seems to be in a socially positive direction. However, the (further) concentration of information, and the gathering of new information for the same good use, are vulnerable to future, unsavory, mission creep, not just for the data but also for the new mechanics of their collection. Among concerns are new operating systems for cell phones embraced in the fight against the pandemic: the helpful technology that records your prolonged proximity for notification of COVID-19 exposure gathers more about you than that. Whom you encounter also reveals information about your social and political contacts, which can be used for non-health