.png)
In the race to control the spread of Coronavirus and reopen the U.S. economy, many private and public entities seek innovative ways to track symptomatic and Covid-19 positive patients. While likely acting in good faith, public officials and executives must ensure the legality of their actions as ignorance of a law is rarely a defense.
Certain blogs and news outlets justify surveillance activities and mass data collection absent user consent under the PATRIOT Act, which was passed following 9/11 to expand law enforcement surveillance and investigatory measures to prevent acts of terrorism. However, two facts are often lost: (1) The PATRIOT Act was intended to address terrorism, not healthcare; and (2) Portions of the PATRIOT Act expired in 2015 and were later amended (some say replaced) by the USA Freedom Act, which set new limits on domestic surveillance activities. The USA Freedom Act expressly prohibits bulk collection of “tangible things” (including business records) under 50 U.S.C. § 1861, absent specific requirements and application protocols by the FBI.
According to ABC News, Elizabeth, New Jersey and Meriden, Connecticut are set to use drones with equipment capable of detecting fever/body temperature, heart rate, respiratory rate, and social distancing. While representatives from these towns insist the intent is to promote public health, certain legal issues must be considered:
Depending where drones collect the health data from, there may be Fourth Amendment violations under the U.S. Constitution according to Kyllo v. United States, 533 U.S. 27 (2001). In Kyllo, the United States Supreme Court held that law enforcement could not use infrared devices to gauge temperature readings inside of an individual’s home. Because entering a home would require a search warrant, law enforcement could not circumvent that process with technology. Therefore, if drones are collecting similar information from individuals who are located inside an area with the same expectation of privacy, a similar Fourth Amendment violation may exist.
In Missouri v. McNeely, 569 U.S. 141 (2013), the USSC held that any compelled intrusion into the human body implicated significant, constitutionally protected privacy interests when it declined a law enforcement request to force a DWI suspect to take a blood test. The USSC was unmoved by the body’s ability to metabolize alcohol and law enforcement’s argument that absent blood test evidence it was prejudiced from meeting its burden of proof. With drone technology taking body temperature, heart and respiratory rate readings, the two cities should consider the McNeely opinion before collecting personal health information.
The difference between the two Cities’ proposed drone activities and the tracking data collected by Google and Apple and the Unacast scoreboard is consent, which usually dismisses Fourth Amendment concerns.
As discussed earlier this month on @lacyberlawblog, Google and Apple partnered to create a voluntary platform available to Android and iOS operating system users for coronavirus contact tracking. Covid-19 positive individuals who choose to participate can indicate their positive status into the application and other voluntary users are notified if they have encountered a Covid-19 positive individual. No identities are revealed to other users and participation is voluntary.
Unacast hosts a map of each county in the U.S. and assigns a grade to that county to reflect how well those citizens practice social distancing. Generally, Unacast grades social distancing based on anonymous movement from cell phone geolocation data. Unacast does not directly collect any geolocation data itself, rather receives it from “partners” (applications) with “User opt-in consent for the collection of location data from mobile devices” according to its website. In other words, the cell phone user consents to provide the application its geolocation and as part of the terms and conditions of the application, consents to allow the application to provide that geolocation data to Unacast. To terminate the process, the user can either prevent the application from receiving its geolocation data and/or uninstall the application.
However, with the drones, the issue of consent is unclear. Will being in public, off your private property and in contravention of a “stay-at-home” order constitute implicit consent? Will drones be in neighborhoods or just in common, public areas? These questions will likely surface in New Jersey and Connecticut courts.