Measure to Require Deletion of Data No Later Than 30 Days After Receipt
As contact tracing moves to the forefront of New Jersey’s COVID-19 public health response, residents are understandably concerned about their privacy. To safeguard and restrict use of data collected for contact tracing, the Assembly Science, Innovation and Technology and Assembly Community Affairs and Development committee panels advanced legislation on Tuesday.
The bill (A-4170) is sponsored by Assembly Democrats Andrew Zwicker, Daniel Benson and Shavonda Sumter. It stipulates that any public health entity collecting data on someone for contact tracing during the COVID-19 pandemic can only use it for that specific purpose and must delete the data 30 days after receiving it.
“Contact tracing has long been an important part of controlling the spread of a contagious disease,” said Zwicker (D-Hunterdon, Mercer, Middlesex, Somerset). “To that end, people need to know what contact tracing is, how it works, and most importantly that the information requested won’t be shared or stored for reasons beyond the immediate goal: saving lives.”
The legislation would require the same level of protection for contact tracing data shared by public health entities with a third party. Misuse or unlawful disclosure of this data by a third party would result in liability for a civil penalty of up to $10,000.
“Establishing that contact tracing data goes nowhere beyond where it needs to go is about transparency and trust,” said Benson (D-Mercer, Middlesex). “If we expect people to share their every move or social interaction with us, they need to know that personal data will be protected and that their privacy is our number one priority too.”
This measure also requires the Commissioner of Health to publish guidance online regarding how collected data may be used and how its security and confidentiality must be ensured. A mechanism where the public can submit comments over a 30-day period must be provided before any guidance can be finalized.
“Building public trust to share sensitive data is essential,” said Sumter (D-Bergen, Passaic). “It works hand in hand with allowing the public to be a partner in decision making and in developing clear guidance on the use of people’s data. Information is power.”
Contact tracing is the process of identifying people who have come into contact with someone that has tested positive for COVID-19, notifying them of their risk and providing support services. It can be done manually with verbal interviews or by using digital data and smartphone technologies such as Bluetooth and GPS.
The bill now goes to the Speaker for further consideration.