This blog is a part of our series on the privacy considerations around geolocation. You can find part one, which focuses on geolocation and privacy regulations, here and part two, a FAQ on geolocation and privacy, here.

It's been over a year since the World Health Organization (WHO) declared the Covid-19 outbreak a pandemic, presenting new challenges and disruptions for governments, businesses, health agencies, and individuals worldwide. Aside from releasing social distancing and isolation guidelines, the WHO also urged countries to track and trace anyone who has tested positive for Covid-19 and those who might have come in contact with an infected individual. As a result, many countries have turned to digital location tracking in combination with Covid-19 testing to help understand, monitor, and contain the spread of the virus.

Geolocation is a highly valuable tool for understanding people's movements as its technology can identify an individual's location from their internet-connected device. By detecting which devices have been in close proximity of each other, geolocation information can be analyzed to help gauge the effectiveness of social distancing, enforce quarantine restrictions, locate population hot spots, and serve as a useful tool in contact tracing.

However, the same geolocation data used to fight the spread of Covid-19 can also contain sensitive and revealing insights about a person's identity, location, behavior, and health. In this blog, we'll take a closer look at how geolocation data is being used to help slow the spread of the Covid-19 pandemic, the potential privacy risks, and a few tips on how to properly collect Covid-19 geolocation information.

Geolocation and the Fight Against Covid-19

The Covid-19 pandemic has caused dramatic personal and business disruptions, from physical lockdowns to mask mandates to social distancing guidelines. While various cities, states, and countries have returned to some level of normalcy, these decisions cannot be made without tracking the movements of the virus. Geolocation information is a key component in measuring and containing the spread.

Below are a few examples of how geolocation technology is being used to respond to the Covid-19 crisis:

Enforce quarantine and social distancing orders.

At the start of the pandemic, state governments imposed mandatory quarantines and social distancing rules, which included the closure of nonessential businesses and public spaces and orders for a 14-day self-isolation of infected individuals. Many governments committed to using mobile geolocation data to monitor compliance with these restrictions, requesting that individuals install an app that uses either Bluetooth or GPS to track their movements; while other state governments approved of the mandatory tracking of individuals who refused to quarantine.

Even prior to the pandemic, Google Maps allowed users to see a live feed of how busy a popular destination was. While this technology cannot detect who is wearing a mask or which groups are from the same household, it is useful in determining which locations have a high concentration of people (e.g., bars, theaters, parks, etc.) and if new restrictions should be put in place as a result.

Map potential Covid-19 hot spots.

A hotspot can be described as an area that has a higher concentration of “events” (in this case, positive Covid-19 cases) than the average number for the area. Using geolocation data, analysts can determine the location of statistically significant clusters. Policymakers can then use this data to identify neighborhoods and communities that are at a high risk for becoming hot spots, better equip hospitals and healthcare facilities with the resources necessary to battle virus surges, and make informed decisions regarding the safety of the individuals in the area.

Various U.S. states have utilized geolocation data to gauge school closures, define the reopening criteria for nonessential businesses, and establish travel restrictions. Using the data generated from the mapping, public health warnings can also be released about certain locations that have proven to be a breeding ground for the virus. Although this data can only provide a limited perspective, it is still helpful in trying to manage and limit the spread of the virus.

New contact tracing technology.

Contact tracing is the process of identifying individuals that have come into contact with an infected person and is key in attempting to slow the spread of infectious diseases like Covid-19. There are three main steps to contact tracing according to the WHO:

Contact Identification: Identifying the individuals who have had contact with an infected individual.
Contact Listing: Informing all persons who might have made contact with the infected individual of this fact and encouraging them to seek care if they develop symptoms.
Follow-up: The symptoms of these contacted individuals are monitored and tested for signs of infection.

Unfortunately, the spread of Covid-19 is too fast to be contained by manual contact tracing, which traditionally involves interviews and data gathering. Instead, new contact tracing apps and technologies are leveraging mobile phones, Bluetooth signals, and other devices to expand the tracing capabilities of the Covid-19 virus.

The Privacy Risks of Covid-19 Location Data

Since Covid-19 has become a household name, governments, public organizations, and private businesses have taken several measures to try and curtail the spread of this pandemic. Geolocation tracking methods and apps are becoming key tools in identifying and isolating infected patients, monitoring high density areas, and informing reopening decisions. However, these data collection practices are riddled with data privacy landmines, forcing individuals to have to choose between the right to privacy and the health and safety of others.

Let's take a closer look at three of the major privacy concerns associated with Covid-19 geolocation measures.

Collection of Sensitive Personal Information

With contact tracing apps and geolocation data tracking methods, a significant amount of information is being collected about an individual, sometimes with consent and other times involuntarily. Not only can mobile location information reveal a person's name, behavior, association, and activities, but combined with tracing apps, can also collect personal health information including age, recent travel, health symptoms, and underlying medical conditions.

Governments and public health officials consider the collection of this location information to aid in limiting the spread of Covid-19. However, significant privacy concerns are continually being raised over geolocation data collection practices, regardless of the reason for it.

Risk of Non-Compliance with Relevant Privacy Laws and Regulations

To fight Covid-19, governments are collecting health information and tracking individuals using mobile location data and public health officials are analyzing this information. But, even in these efforts to ensure public health and safety, there are privacy regulations that govern the collection of geolocation data and personal health information. There are a host of various industry, national, and worldwide privacy laws to remain current on, ranging from the Federal Trade Commission (FTC) and HIPAA (which is currently being updated due to Covid-19) to California's CCPA and the EU's GDPR. Navigating compliance with all applicable geolocation and privacy laws is a challenging but mandatory practice, even amidst a pandemic.

Employee Privacy Concerning Covid-19 Exposure

At the start of the Covid-19 pandemic, organizations were forced to navigate significant business disruptions and changes to daily operations. They were also tasked with ensuring the health and safety of their employees. However, these challenges left many companies questioning what information relevant to Covid-19 they could collect from their employees and what liability they would have for disclosing (or not disclosing) this information.

In addition, many companies often provide their employees with cell phones, laptops, and even a car, which are all beacons for geolocation data. Should an employee reveal a positive Covid-19 test result, these devices could be used to generate a trail of their prior locations to warn employees or customers of possible exposure. In addition, various regulations like the CCPA govern employee personal information, so organizations must ensure they are handling it properly.

Tips for the Responsible Collection of Covid-19 Geolocation Information

Gain explicit consent: While most contact tracing apps are voluntary and require consent to use, most mobile devices are already constantly collecting geolocation data. Ensure each user is aware of your data collection practices and has provided express consent beforehand.
Ensure compliance with applicable laws: Many privacy laws have requirements covering geolocation data but adding the collection of personal health information increases your potential scope. Properly mapping your data can help you make strategic decisions around regulatory compliance and avoid the risk of penalties.
Set data storage restrictions: Storage of Covid-19 geolocation information should be guided by decisions from public health authorities and only stored for the time necessary for addressing the pandemic, such as for generating contact tracing location trails.
Properly secure collected data: Reasonable security protocols and secure transmissions of data (i.e., encryption) should be employed to protect a users location information from unauthorized access, alteration, destruction, use, or disclosure.
Update your privacy policies: Regardless of the type of geolocation data collected, your organization and/or application's privacy policy should contain disclosures for how the information is collected, used, and shared with.
Inform employees of their rights: Although group health plans are subject to HIPAA guidelines, employers cannot simply demand information about an employee's health. Regardless, ensure each employee is completely aware of their rights and has provided an authorization for the disclosures necessary for protecting the health of those within the company.
Always be transparent: Your organization should be as transparent as possible regarding the collection and use of personal geolocation and health information in order to build trust among consumers.

The world is facing unprecedented times at the hands of a global pandemic, and new, modern approaches are being used fight against the spread. Although the pandemic is still at large, geolocation technology has helped organizations find new ways to stop the spread and save lives. While the end of the Covid-19 pandemic is uncertain, advances in geolocation capabilities will have long-term use cases that may be able to help in future crises.

Want more insights into the latest privacy news?

Subscribe to Focal Point's Privacy Pulse below - a once-a-month newsletter with guides, webinars, interesting white papers, and news all focused on data privacy. Thousands of your colleagues and competitors have signed up! You can unsubscribe at any time.