Status, benefits and key considerations

Since the start of the COVID-19 pandemic, employers have participated at different levels of contact seeking within the workplace. Tracking contacts involves identifying individuals who may have been in close contact with a person who tested positive for the coronavirus while that person was likely infectious. As part of employers’ pandemic response practices, many are implementing policies and procedures that attempt to determine the identities of employees who may have been in “close contact” with employees diagnosed with COVID-19, or those suspected of contracting the virus.

Traditional contact tracing is labor intensive, usually requiring interviews with individuals with positive coronaviruses to determine their movements. In some cases, such interviews may be extended to family members or others who can provide more information. Given the challenges of performing large-scale contact tracing, as well as the fallibility of human memory on which traditional contact tracing is based, technology companies are developing digital equipment to assist in the process. Some of the tools are being developed for government organizations (in fact, some countries, such as Singapore, have already urged citizens to use digital contact tracking tools as part of their COVID-19 mitigation efforts), while others They are being developed for use by employers within the private sector. Digital contact tracking tools can help both identify contacts and potentially notify potential exposure.

How does digital contact tracking work?

The technology with respect to contact tracking tools is evolving rapidly. In very general terms, digital contact tracking is based on one or both forms of underlying technology: (1) GPS or cellular location data and / or (2) Bluetooth. Digital contact tracking is usually presented in the form of an application, or “application,” which alerts the user if they have been in contact with someone who has reported having a positive coronavirus test result or COVID-19 diagnosis, with notification that occurs under certain defined parameters (for example, the duration of the contact or the proximity of the contact). Some apps are linked to smartphones, while others include portable smart devices. Similar technology can also be used to help encourage social distancing through proximity tracking and signaling between devices.

Taking Bluetooth-based contact tracking as an example, a broad description of how the technology works is as follows: An application transmits unique identifiers via Bluetooth to nearby users of the application. When two app users get close, the app can estimate the distance between them by measuring the intensity of the Bluetooth signal. If, for example, users are less than approximately six feet away for a sufficient period of time, the application records the encounter. When an application user identifies himself as positive for a current coronavirus infection or has been diagnosed with COVID-19, any other user who has had an “encounter” can be notified of the possible risk of infection.

The details of how these applications work vary widely and often depend on the developer of the technology. For example, among other details, all of the following may vary: what qualifies as an “encounter” (ie, what is considered an epidemiologically relevant distance and an epidemiologically relevant time period); details of notification of infection risks; additional information that the application may record; the hosts of the information collected about the users of the application; and the amount of information stored by the application and for how long.

Official guidance on digital contact tracking tools

At the federal level, a key component of the White House “Opening America Again” guidelines are certain “core state preparedness responsibilities” that each state should be able to meet before lifting COVID-19 restrictions. One of those responsibilities is that states must demonstrate competent ability to perform certain tests and contact-locating activities. As relevant to employers, the White House guideline states that employers should “[d]Develop and implement policies and procedures to follow up on workforce contacts after the COVID + test of employees. [results]. “States and employers following the White House guide are developing ways to effectively track contacts with infected people as part of the overall strategy to allow companies to return to normal operations and, in doing so, return workers to the workplace.

On April 23, 2020, the US Centers for Disease Control and Prevention. USA (CDC) released new guidelines and resources for contact tracing, including a “COVID-19 Contact Tracing Training Guidance and Resources” plan, a brochure on the principles of contact tracing tools, as well as a fact sheet on some of those digital contact tracking tools. These materials appear to indicate CDC’s anticipation of a pending increase in contact search efforts across the country as state and local jurisdictions begin to ease COVID-19 restrictions and stay-at-home orders. These new CDC materials are not designed to train, equip, or guide employers in locating contacts. Rather, the plan and related materials are designed for public health authorities to train. “[c]community health workers or volunteers with little or no experience searching for contacts. “However, the materials provide information on the type of contact monitoring activities likely to be carried out in the states and the types of contact monitoring tasks that employers could perform in conjunction with public health authorities in the event of future workplace exposures.

In addition, on April 16, 2020, the European Commission issued its “Guide to applications supporting the fight against the COVID 19 pandemic in relation to data protection” “to ensure a coherent approach across the EU [European Union] and provide guidance to Member States and application developers “in relation to” features and requirements that [contact tracing] applications must comply to ensure compliance with EU privacy and personal data protection legislation, in particular the General Data Protection Regulation (GDPR) and the Electronic Privacy Directive. “While the guide is not mandatory, identifies useful and guiding principles such as:

• installing the app on a device should be voluntary and there should be no negative consequences for people who choose not to use the app;

• different functionalities of the application should not be grouped so that an individual can give their consent for each functionality separately;

• If proximity data is used, that data must be stored on an individual’s device (called by the Commission “decentralized processing”). If the data is shared with a health authority, it should be shared only after confirmation that the user is infected with COVID-19, and only if the user agrees to share the data;

• the application should be automatically deactivated when the pandemic is declared under control; deactivation should not depend on uninstallation by the user;

• The Commission suggests that in determining proximity and close contacts, Bluetooth data is more recommended than GPS or cellular location data, since location information “is not necessary for the purpose of contact location functions” ;

• The Commission also recommends that storing the exact time or place of contact “does not seem necessary”, but that the date of the contact is relevant; and

• the Commission recommends that proximity data be deleted as soon as it is no longer needed to alert people, which the EU identifies as “maximum [of] one month (incubation period plus margin) “or after someone tests and the result is negative.

The Commission said that the European Data Protection Board will publish further guidance on geolocation and other tracking tools in the context of COVID-19.

Key Labor and Labor Considerations of the United States

There are many unanswered questions about how contact tracking applications will work and how effective the tools will be. Employers evaluating these tools may want to carefully review any tool and its functionality before implementing a contact tracking application in their workplaces. Among other issues, it is important that employers evaluate and understand technical issues including, but not limited to, the following:

• what data is collected;

• how the data is stored (on an individual’s device or on an external server);

• how long the data will be saved / stored;

• if the developer of the application has had continuous access to the information; and

• what data security measures exist (such as encryption and anonymity).

Employers may also want to evaluate and decide how contact location tools will be tailored for their workplaces. Factors include, for example:

• the use of the tool will be voluntary or obligatory;

• if required, employees will be fired if they refuse to use the tool or “turn it off”;

• the tool will only track contacts during business hours or after business hours; and

• who in an organization will have access to the information collected through the tool.

These are just some of the questions employers may want to answer by examining the tools they are considering deploying in a particular workforce.

As these tools continue to develop at a rapid rate, additional guidance from federal and state jurisdictions is likely. For now, as employers analyze this rapidly evolving area, it is prudent to assess the following employment and labor issues:

• Data and cybersecurity considerations. Unlike in the EU, there is no national data privacy law in the United States. However, several states, such as California, have developed data privacy and security laws that should be consulted when an employer considers contact tracking tools. For example, the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, may impose requirements regarding notification to employees and other obligations for employers. Additionally, several states (including Illinois and Texas) have adopted biometric privacy laws that, depending on what the contact tracking app collects, may be involved. Additionally, some contact tracking tools may collect personal information that is potentially subject to state data breach notification requirements.

• State law considerations. When reviewing state law privacy issues, consider and identify strategies to mitigate the risk of privacy invasion common law claims regarding contact tracking tools, particularly if the tools track employees involved in privacy-sensitive activities, such as going to the bathroom or nursing in the workplace. Also, when reviewing state laws on electronic monitoring, be aware that some states may have specific laws that are implied by these tools. For example, the Connecticut Electronic Monitoring Act prevents employers from participating in any electronic monitoring without prior written notification to all employees of the types of monitoring that may occur.

• Considerations of the National Labor Relations Law (NLRA). Employers may also want to ensure compliance with the NLRA, which has a well-developed and detailed body of jurisprudence regarding employer oversight activities. Furthermore, if a workforce is unionized, employers should consider whether the deployment of contact tracking applications implies a duty to negotiate with any relevant labor union.

• Considerations of the Law of Responsibility and Portability of Health Insurance (HIPAA). Employers who consider themselves entities covered under HIPAA may want to assess the extent to which data from contact tracking tools may contain information subject to HIPAA confidentiality requirements and usage restrictions.

• Employee Relationship Considerations. General employee relations and equal employment opportunity issues are other important issues to consider. For example, employers may consider strategies to prevent stigmatization of employees who have been diagnosed with COVID-19, or who have close contacts with employees who are positive for COVID-19. Inclusion is also critical both from an internal equity perspective and from the perspective of the effectiveness of contact tracking tools, so employers may find it helpful to have a plan to manage those employees without smart devices, as well as to those who need more assistance (such as people with disabilities) to use devices. Also, depending on what information is collected through a tool, disability discrimination issues could arise, for example, a contact tracking application might collect information about how often an employee goes to the bathroom, which could lead to leading to assumptions that an individual has a disability.

Proactively identifying these and related compliance issues, as well as developing strategies to avoid or mitigate risk, are prudent steps to take before implementing any contact tracking tool. Employers may consider developing clear policies, disseminated and recognized by all employees, that provide notice regarding the contact locating tools to be used and that explain (at a high level) how the tools work, the rationale for the tools and other critical information about how employee data will be used and protected. Transparent policies regarding any contact tracking tool implemented in a workplace can be a sensible consideration for some employers, both from legal compliance and from employee relations perspectives.