An intensive care nurse treat a patient at intensive care unit at the Klinikum Bad Hersfeld hospital on March 20, 2020 in Bad Hersfeld, Germany. (Photo: Thomas Lohnes/Getty Images)
No to Expanded HHS Surveillance of COVID-19 Patients
The new program called HHS Protect poses a grave threat to the data privacy of all Americans.
The federal government plans to process more of our personal data, in the name of containing COVID-19, but without showing that this serious privacy intrusion would actually do anything to protect public health. EFF filed comments in opposition to these new plans from the U.S. Department of Health and Human Services (HHS).
The U.S. Centers for Disease Control (CDC) leads our nation's efforts to contain infectious diseases. Thus, CDC for decades has managed the federal government's processing of personal data about infection. It did so during the early months of the COVID-19 outbreak. But in July 2020, HHS stripped this tracking authority from the CDC, and transferred it to a new program called "HHS Protect."
HHS issued two new Systems of Records Notices (SORNs) about this new HHS program. The federal Privacy Act requires federal agencies to issue SORNs to advise people about personally identifiable information that the government maintains about them.
Unfortunately, HHS Protect poses a grave threat to the data privacy of all Americans. As set forth in the SORNs, it would greatly expand how the federal government collects, uses, maintains, and shares all manner of personal information. We highlighted the following ways that HHS Protect would substantially burden privacy without a necessary or proportionate benefit to protecting public health.
New data collection. The SORNs would allow collection of personal information about physical and psychological health history, drug and alcohol use, diet, employment, and more. Data collected would also include "geospatial records," which countless research has shown is difficult to de-identify. Data would be collected not just about people who test positive, but also about their family members, as well as people who test negative, and perhaps people who have not tested at all. Data would be collected from countless different sources, including federal, state, and local governments, their contractors, the healthcare industry, and patients' family members.
New data sharing. The SORNs would allow sharing of these vast sets of data with additional federal agencies, unspecified outside contractors, and even "student volunteers." These additional federal agencies would be allowed, in turn, to share the data with their contractors. Patient consent would not be required for this sharing.
New data use. The SORNs would allow use of this data in litigation and "other proceedings" whenever the federal government has "an interest" in them (such use now is allowed only when HHS is a defendant in litigation).
New data storing. The SORNs would allow permanent retention of data with "significant historical and/or research value" (retention now is limited to four years).
No doubt, the ongoing COVID-19 crisis requires a coordinated governmental response, which in turn requires robust data concerning the spread of the disease. But HHS has made no showing that CDC's existing epidemiological data systems are not up to the task.
Thus, EFF filed comments with HHS, asking the agency to withdraw these two SORNs. They violate the Privacy Act and create new threats to privacy without any showing of public health benefit.
We are at a crossroads
This country and this world are at a monumental crossroads. In a few short weeks, US voters will have an opportunity to beat back the forces of fascism and confront the billionaires who are rigging the economy, our media system, and our democracy, making it increasingly impossible for ordinary people to get by. We’re not just talking about the election. We’re talking about what must be done once these fascist elements are vanquished from power. We need a bolder set of solutions than what either major party has so far been willing to offer and a working-class movement ready to fight like hell for it. Trump didn't emerge from nowhere. The conditions that fueled MAGA authoritarianism were created by decades of radical neoliberal economic policies and a corrupt political system dominated by corporate interests. They slashed taxes on the super-rich, promising that the benefits would trickle down. They said giveaways to the corporate titans would make life more affordable for the rest of us. It was all bullshit. And when a bitter, betrayed populace searches for someone to blame, right-wing demagogues have little trouble finding scapegoats. People know when they're being lied to, but you won't hear any of this from the corporate media. Only independent journalism—powered and funded by people who believe in building a better world—can deliver truly trustworthy daily news. Our Fall Campaign is underway, and we need your help. To power our newsroom through the rest of the year, we need to raise $125,000 by midnight on October 31. So if you share our vision, please contribute whatever you can to sustain our work. |
The federal government plans to process more of our personal data, in the name of containing COVID-19, but without showing that this serious privacy intrusion would actually do anything to protect public health. EFF filed comments in opposition to these new plans from the U.S. Department of Health and Human Services (HHS).
The U.S. Centers for Disease Control (CDC) leads our nation's efforts to contain infectious diseases. Thus, CDC for decades has managed the federal government's processing of personal data about infection. It did so during the early months of the COVID-19 outbreak. But in July 2020, HHS stripped this tracking authority from the CDC, and transferred it to a new program called "HHS Protect."
HHS issued two new Systems of Records Notices (SORNs) about this new HHS program. The federal Privacy Act requires federal agencies to issue SORNs to advise people about personally identifiable information that the government maintains about them.
Unfortunately, HHS Protect poses a grave threat to the data privacy of all Americans. As set forth in the SORNs, it would greatly expand how the federal government collects, uses, maintains, and shares all manner of personal information. We highlighted the following ways that HHS Protect would substantially burden privacy without a necessary or proportionate benefit to protecting public health.
New data collection. The SORNs would allow collection of personal information about physical and psychological health history, drug and alcohol use, diet, employment, and more. Data collected would also include "geospatial records," which countless research has shown is difficult to de-identify. Data would be collected not just about people who test positive, but also about their family members, as well as people who test negative, and perhaps people who have not tested at all. Data would be collected from countless different sources, including federal, state, and local governments, their contractors, the healthcare industry, and patients' family members.
New data sharing. The SORNs would allow sharing of these vast sets of data with additional federal agencies, unspecified outside contractors, and even "student volunteers." These additional federal agencies would be allowed, in turn, to share the data with their contractors. Patient consent would not be required for this sharing.
New data use. The SORNs would allow use of this data in litigation and "other proceedings" whenever the federal government has "an interest" in them (such use now is allowed only when HHS is a defendant in litigation).
New data storing. The SORNs would allow permanent retention of data with "significant historical and/or research value" (retention now is limited to four years).
No doubt, the ongoing COVID-19 crisis requires a coordinated governmental response, which in turn requires robust data concerning the spread of the disease. But HHS has made no showing that CDC's existing epidemiological data systems are not up to the task.
Thus, EFF filed comments with HHS, asking the agency to withdraw these two SORNs. They violate the Privacy Act and create new threats to privacy without any showing of public health benefit.
The federal government plans to process more of our personal data, in the name of containing COVID-19, but without showing that this serious privacy intrusion would actually do anything to protect public health. EFF filed comments in opposition to these new plans from the U.S. Department of Health and Human Services (HHS).
The U.S. Centers for Disease Control (CDC) leads our nation's efforts to contain infectious diseases. Thus, CDC for decades has managed the federal government's processing of personal data about infection. It did so during the early months of the COVID-19 outbreak. But in July 2020, HHS stripped this tracking authority from the CDC, and transferred it to a new program called "HHS Protect."
HHS issued two new Systems of Records Notices (SORNs) about this new HHS program. The federal Privacy Act requires federal agencies to issue SORNs to advise people about personally identifiable information that the government maintains about them.
Unfortunately, HHS Protect poses a grave threat to the data privacy of all Americans. As set forth in the SORNs, it would greatly expand how the federal government collects, uses, maintains, and shares all manner of personal information. We highlighted the following ways that HHS Protect would substantially burden privacy without a necessary or proportionate benefit to protecting public health.
New data collection. The SORNs would allow collection of personal information about physical and psychological health history, drug and alcohol use, diet, employment, and more. Data collected would also include "geospatial records," which countless research has shown is difficult to de-identify. Data would be collected not just about people who test positive, but also about their family members, as well as people who test negative, and perhaps people who have not tested at all. Data would be collected from countless different sources, including federal, state, and local governments, their contractors, the healthcare industry, and patients' family members.
New data sharing. The SORNs would allow sharing of these vast sets of data with additional federal agencies, unspecified outside contractors, and even "student volunteers." These additional federal agencies would be allowed, in turn, to share the data with their contractors. Patient consent would not be required for this sharing.
New data use. The SORNs would allow use of this data in litigation and "other proceedings" whenever the federal government has "an interest" in them (such use now is allowed only when HHS is a defendant in litigation).
New data storing. The SORNs would allow permanent retention of data with "significant historical and/or research value" (retention now is limited to four years).
No doubt, the ongoing COVID-19 crisis requires a coordinated governmental response, which in turn requires robust data concerning the spread of the disease. But HHS has made no showing that CDC's existing epidemiological data systems are not up to the task.
Thus, EFF filed comments with HHS, asking the agency to withdraw these two SORNs. They violate the Privacy Act and create new threats to privacy without any showing of public health benefit.