Amid reports that the U.S. government is collaborating with tech companies to understand Americans' movement during the coronavirus pandemic, legal implications of the practice depend on how closely companies adhere to their stated privacy practices and on how anonymous anonymized data truly is.
In response to the ongoing outbreak, mobile advertising and tech firms are offering up their geolocation data to track the spread of the virus and the adoption of social distancing. Now, government officials at the federal, state and local level are hoping to use this data to better understand current public behavior, according to The Wall Street Journal. Companies note that the data is anonymous and thus protects user privacy, but privacy experts are divided on how the sharing of this data comports with privacy laws and consumer expectations.
Michelle Cohen, member and chair of the privacy and data security practice at the law firm Ifrah Law PLLC, said in an interview that it is "generally considered reasonable" for privacy policies to state that a company collects and shares nonpersonally identifiable information.
"In most privacy policies, when it comes to anonymized info, organizations often speak more broadly, indicating they may share with third parties for research and analytics uses," she said.
Unacast Inc., a New York City-based startup, uses anonymous device location data to assess social distancing. The company recently created a Social Distancing Scoreboard, which assigns counties and states grade letters based on whether residents have reduced their travel around town amid the outbreak.
In its privacy statement, Unacast says that in disclosing partner-provided data to third parties, it does not include any data that can directly identify a user of a mobile device, such as a name, mobile phone number or an email address.
However, some argue that certain data capturing claiming to be anonymous is not, in fact, anonymous.
"Re-identification of de-identified data is a constant infosec threat," Electronic Frontier Foundation staff attorneys Adam Schwartz and Andrew Crocker wrote in a March 23 blog post, noting that location data is particularly concerning since "location data points serve as identification of their own."
Unacast says it created its Social Distancing Scoreboard to help public health experts, policymakers, academics, community leaders and businesses gain accurate insights into current public behavior.
For instance, Ashkan Soltani, who previously was the chief technologist at the U.S. Federal Trade Commission, recently pointed to a visualization that used anonymous data to show people congregating on a beach in Florida amid the pandemic.
"Tracking the precise GPS location of a device when it goes 'home after being at the beach' is not 'anonymized' as it would reveal its home address," Soltani wrote in a March 29 tweet.
Soltani said the data for the visualization came from X-Mode Social Inc, an information technology company that monetizes location data. The company says on its website that its data is aggregated at the advertising ID level and associated to a device, but not a physical person.
But Cohen noted that the FTC has recently focused on companies that did not protect personal and identifiable information.
For example, the agency went after Facebook Inc. and the data analytics and consulting company Cambridge Analytica LLC after the latter company was found to have engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting. Specifically, the agency said users of an app associated with Cambridge Analytica were told they would not have their names or identifiable information collected. The app did, in fact, collect that personally identifiable information.
Cohen said an FTC case against anonymous data practices would be more challenging.