Data privacy and COVID-19: What will stay and what will go?

By Michael Moran and Tim Panagos

Data privacy seems vulnerable to episodic spasms driven by unforeseen events. With each new sensation, governments, corporations and average people react in ways that change the game, and the debate, over what is and what is not acceptable. The role and responsibilities of government regulators, technology firms, legislators, corporate security and IT departments, and individual people continue to evolve with each new blow – and not always in a direction that data privacy advocates deem helpful.

Remember the impact of early WikiLeaks releases, revelations of widespread eavesdropping by the US National Security Agency (NSA) on American citizens and the furor created by reports that NSA had recorded the personal cell phone calls of world leaders, including US allies like German Chancellor Angela Merkel and then Brazilian President Dilma Rousseff? These incidents sparked outrage and activism, including Edward Snowden’s subsequent release of vast tranches of classified US intelligence, and changed the way data is regulated and classified in many ways.

Julian Assange wound up under house arrest in the UK; Brazil, Germany and others instituted new laws that required personal data to be stored within national borders. Apple and other tech companies improved their encryption and have pushed back against government demands to turn over their customers’ personal data. Subsequent hacks of US government agencies and the 2016 Hillary Clinton presidential campaign, along with manipulation of Facebook’s algorithms by everyone from Cambridge Analytica to Russian military intelligence operatives brought the debate to a fever pitch.

The world is in the midst of another such transition. COVID-19 has changed the context of the debate over data privacy, if not its core propositions, and has opened new questions about the tradeoffs between personal privacy and the public good. Six months ago, an anonymous mall worker who pointed a gun-like device at your head to take your temperature most likely would have had that hand slapped away. Today, with COVID context, this is commonplace, and except among the deliriously libertarian, by and large it is accepted. Similarly, questions about who you may have associated with recently – in the context of symptoms of the virus – are today understood quite differently than they would have been six months ago. Some may still answer “none of your business,” but few serious people question the motives for such inquiries these days.

An indication that the privacy debate was changing came early, on March 17, when the US federal government loosened restrictions on data sharing in the interest of collecting information on the virus. At issue was a 1996 US law known as HIPAA, the Health Insurance Portability and Accountability Act, which sharply restricts the sharing of personal medical data. The government’s Health and Human Services (HHS) department announced it would exercise “enforcement discretion when it came to such data sharing given the need to stem the spread of the virus and to contact trace those exposed.

How much of this new tolerance for intrusion survives the pandemic is up for question. Crises bring both short-term fixes and permanent shifts. It is often noted, for instance, that following heightened security procedures and far more intrusive requirements with regard to personal identification that were introduced in the immediate aftermath of the 9/11 attacks have never gone away. Neither have the much more stringent financial requirements that banks demand of borrowers seeking a mortgage, requirements instituted after the crash of the US housing market in 2008-2009 spawned the Great Recession.

And while the privacy debate may be hottest where questions of individual liberties are concerned, there is a rising interest in seeing the value generated by personal data distributed more equitably between subject and collector. If data is the new oil, as is oft repeated, then we have permitted tech companies to drill in our own backyards without much in the way of explicit compensation. Consumers are paid in free software and services, the argument goes, and get value where they would otherwise need to shell-out cash. Yet, as the services on offer themselves tend to become data collectors and the value disparity between the digerati and the hoi polloi continues to widen, it is increasingly difficult to feel adequately compensated. And so, any conversation about data privacy must include provisions for broader economic participation in the value-streams that are created from it.

It’s a debate as old as human society itself: Aristotle’s assertion that an ideal government would favor the interests of the many over those of the few is a foundational expression of democracy. Brought forward 2,400 years or so, its digital manifestation can be seen in laws like the EU’s General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), both of which seek to protect the privacy of the individual many against the privations of a corporate “few.” How will democratic societies balance these “goods” in the post-COVID world. Like the virus itself, the answers are still evolving.

For a deeper conversation on these issues, join authors Tim Panagos, Microshare CTO, and Michael Moran, the company’s Chief Risk & Sustainability Officer, as well as Black Hills IP CTO Thomas Marlow as they assess the privacy debate in the context of COVID-19.

1500 UK / 10 AM ET

Thursday August 8, 2020

THIS EVENT HAS PASSED. IF YOU’D LIKE TO VIEW A RECORDING OF THE WEBINAR PLEASE CONTACT MARKETING@MICROSHARE.IO