The following statement was issued today by ACLU of Rhode Island executive director Steven Brown on the Governor’s announcement and release of the “Crush Covid RI” app:
“As the Governor has acknowledged and most people recognize, potentially substantial privacy issues are raised by the government’s use of any technological location tracking program. That is certainly true in this case with the state’s efforts to control spread of Covid-19.
“We therefore greatly appreciate the fact that the Governor and her staff have understood that voluntary participation is a crucial aspect of any such program, and that steps have been taken in developing the app to help ensure that any sharing of a user’s private information is done only on an opt-in basis. At the same time, a handful of significant questions remain about the program’s operation and its true voluntariness in practice. We consider it important for those questions to be answered in order to definitively assuage concerns about the potential ‘Big Brother’ aspects of electronic contract tracing.
“On the positive side, we are very pleased that the app allows residents to access important health resources without having to opt-in to the location tracking function; requires affirmative steps to engage the location-tracking feature of the app; keeps the location-tracking information solely on the phone unless and until the user agrees to share it with health authorities; and automatically deletes the tracking information after 20 days. These are all very constructive and important privacy-protective features, and we commend the Governor for limiting the app’s potentially invasive use.
“Nonetheless, a few additional questions remain that we urge be promptly addressed. Some in particular that warrant clarification are the following:
- Since the state is encouraging employers to have their employees use the app, what protections do those employees have if an employer seeks to require its use? What prevents a supermarket or other establishments from demanding its use as a condition of entry by customer?
- What guarantees are there that DOH will not end up sharing information it collects with law enforcement officials and others, even if for purported public health purposes, just as the Department has done with addresses in its database of COVID-19-positive individuals?
- Will the state have the app subjected to an independent third-party audit to ensure that it is working as proposed and providing the privacy protections that have been assured?
- The privacy policy states that app users “may choose to share with us precise geolocation or Bluetooth information using iOS and Android location services.” Since this is not how the app has been described, what is that language for?
- How will people be informed about future updates to the app so that they can choose whether to uninstall or otherwise stop using it if the features change?
“We recognize the urgency of stemming the pandemic, and are not opposed to technological tools that may offer public health benefits. We therefore applaud the Governor for keeping privacy concerns front and center in the development of this app. However, deployed incorrectly, the app has the potential to interfere with public health efforts, undermine trust, and violate individuals’ rights. We therefore look forward to additional information so that members of the public can truly feel comfortable making use of this program and help tackle this continuing medical crisis.
“Finally, we also support the state’s recognition that use of an app like this can only be part of the public health response to the pandemic, especially since some people will not have phones that can run the app or may have legitimate concerns about installing it, and those communities cannot be left out.”
