Privacy newsletter - April 28, 2020

This week, we’re taking an especially close look at contact tracing. Governments around the world have come to the conclusion that some form of contact tracing is needed, but the implementation details and the associated privacy implications are still being debated.

Here are the top stories from last week you might have missed:

1. Germany and France are butting heads with Google and Apple about the right contact tracing framework. European conflict with US tech firms is nothing new. There is a long history of European governments advocating for greater privacy protections for their constituents. This headline is remarkable because France and Germany are asking smartphone makers to turn off privacy protections. Link
   
   
2. The European Data Protection Board has published guidance urging anonymization of location data among other principles for contact tracing apps. As tech companies scramble to ship life-saving apps, they are managing conflicting messages from different levels of government. Managing tradeoffs between health and privacy is hard.
   
   
3. Governments all over the world are trading off taking a centralized or decentralized approach to data collection and notification. The United Kingdom's National Health Service won't use Apple and Google's solution and will instead take a centralized approach. Germany reversed course over the weekend and announced they were going with a decentralized approach. Meanwhile, MPs in Australia are pushing back in the press about the country's plans to centralize data. 
   
   
4. Two glaring issues that stem from contact tracing are the risk of using location tracing for non-public health reasons and overlooking disease spread in areas with lower smartphone adoption. Both of these phenomena are potential hazards in many countries, but nowhere are greater numbers of people at risk than in India. Link 
   
   
5. There was a lot of unfortunate news about data breaches this week. Recently announced breaches include the US Small Business Administration, a children's game called Webkinz, and Nintendo. 
   
   In past data breach news, a judge approved a $8.9 million Banner Health settlement for a data breach in 2016. That works out to around $2.40 per patient impacted. Link