Data Privacy in the Time of Plague

Abstract

Data privacy is a life-or-death matter when it comes to public health. From late fall 2019 until summer 2021, two series of events unfolded, one that everyone was talking about, and one that hardly anyone noticed. The most reported news story of that period related to the greatest world-health crisis in at least 100 years, the COVID-19 pandemic. Meanwhile, in a story that received next to no news attention, the Personal Data Protection Act Committee of the Uniform Law Commissioners in the United States was busy working on a new model law. By July 2021, each of these stories had reached a turning point. In the developed, Western world, most people who wanted to receive the vaccine against COVID-19 could do so, and nearly 60% of people in the United States had received at least one vaccine dose. Nevertheless, the COVID pandemic surged in late summer. Meanwhile, the Uniform Law Commission adopted the Uniform Personal Data Protection Act (UPDPA) at its annual meeting, paving the way for state legislatures to consider adopting the uniform act in 2022 legislative sessions. At roughly the same time, Virginia and Colorado state legislatures also adopted comprehensive data privacy acts.These stories intersect in the public-health space. Public health researchers struggled with COVID-19 in the United States because they lacked information about individuals who were exposed and their contacts, among other matters. When the next pandemic arrives (and it is almost certain to do so), public health researchers will again have a critical need for access to personal data to monitor the progress of the disease and identify and implement population and individual interventions. In the meantime, understanding existing public health threats (e.g., obesity, opioid abuse, racism) requires leveraging and linking diverse data on the contributing social, environmental, and economic factors. The UPDPA does not clear the dense underbrush of barriers resulting from the patchwork of federal data privacy laws that interfere with public health practice and research. But it does provide an important route forward for public health, the full potential of which can be achieved only with active involvement of public health researchers and professionals. This article provides a conceptual framework for analyzing the regulation of uses of personal data and for public health and applies those frameworks to an analysis of UPDPA and other comprehensive state privacy statutes, focusing particularly on the ways that state adoption of UPDPA could promote—and hinder—public health. It concludes with recommendations for public health researchers and professionals to get involved in upcoming legislative debates on data privacy. Lives will depend on the outcomes.