key: cord-0893195-48krwfia authors: Molldrem, Stephen; Hussain, Mustafa I.; McClelland, Alexander title: Alternatives to sharing COVID-19 data with law enforcement: recommendations for stakeholders date: 2020-11-07 journal: Health Policy DOI: 10.1016/j.healthpol.2020.10.015 sha: 53a3047d1e4da41e7bb7059d677ec3697c991d47 doc_id: 893195 cord_uid: 48krwfia During the COVID-19 pandemic, in some jurisdictions, police have become involved in enforcing coronavirus-related measures. Relatedly, several North American jurisdictions have established COVID-19 data sharing protocols with law enforcement. Research across a range of fields has demonstrated that involving police in matters of public health disproportionately impacts the most vulnerable and does more harm than good. This is reflected in the consensus against COVID-19 criminalization that has emerged among civil society organizations focused on HIV, human rights, and harm reduction. The European Data Protection Board has also released guidelines against re-uses of COVID-19 data for law enforcement purposes. This article offers an overview of the harms of criminalizing illnesses and strategies for health stakeholders to seek alternatives to sharing COVID-19 data with police agencies while facilitating interoperability with healthcare first responders. It also presents case studies from two North American jurisdictions – Ontario and Minnesota – that have established routine COVID-19 data sharing with police. We recommended seven alternatives, including designating COVID-19 data as sensitive and implementing segmented interoperability with first responder agencies. These guidelines can help ensure that health information technology platforms do not become vehicles for the criminalization of COVID-19, and that health data stay within the health system. Keywords: COVID-19; SARS-CoV-2; interoperability; public health; criminal justice Alternatives to sharing COVID-19 data with law enforcement: recommendations for stakeholders It is against best practice and the public interest to share private health data with police, even during pandemic emergencies. However, during the COVID-19 pandemic, in some jurisdictions, police have become involved in enforcing emergency orders and public health measures. 1 As part of this, several jurisdictions in the U.S. and Canada have established COVID-19 data sharing protocols with law enforcement agencies. 2, 3, 4, 5 Historical scholarship, 6 legal analysis, 7, 8, 9 public health best practice, 10 social science, 11, 12 and criminology research 13, 14 have consistently demonstrated that using criminalization and law enforcement approaches in disease control overwhelmingly does more harm than good and disproportionately impacts the most vulnerable. 15, 16 This is reflected in the civil society consensus against using criminalization to manage COVID-19. Groups such as The United Nations Joint Programme on HIV/AIDS, 17 HIV Justice Worldwide, 18 The American Civil Liberties Union, 19 Canadian Civil Liberties Association, 20 and black and indigenous legal advocacy organizations, 21 have engaged in stakeholder education aimed at communicating the harmful effects of using police to enforce public health measures. The European Data Protection Board (EDPB), the entity charged with ensuring consistent enforcement of the E.U. General Data Protection Regulation (GDPR), has also issued guidelines against the re-disclosure of COVID-19 contract tracing data to law enforcement. 22 The EDPB notes that re-uses of COVID-19 data during declared states of emergency should be accompanied by "adequate safeguards, such as granting individuals the right to judicial remedy," 23 and that sharing data for "law enforcement purposes" is "unrelated to the management of the COVID-19 health crisis." 24(p7) The consensus against the criminalization of COVID-19 and against disclosures of COVID-19 data to law enforcement follows decades of research and best J o u r n a l P r e -p r o o f practices that demonstrate the importance of keeping the work of public health and the police separate, and of ensuring that health information stays within the health system. We are social scientists who study HIV criminalization, public health surveillance, opioid control, and health information technology (IT) in the U.S. and Canada. Herein, we provide information on the harms of using police and punitive measures to manage illnesses, and particularly on the harms of sharing health data with law enforcement. We draw lessons from academic research, the HIV decriminalization and harm reduction movements, regulatory actions by EDPB related to COVID-19, and from critiques of law enforcement-driven pandemic preparedness strategies. 25 Our findings and recommendations have broad relevance for health policy stakeholders, particularly in countries with highly interoperable health IT ecosystems that facilitate various forms of health data exchange. Below, we review the literature and offer two case studies of North American jurisdictions -Minnesota and Ontariowhose public health authorities have established data sharing protocols with law enforcement. We then present seven alternatives to sharing COVID-19 data with police, while facilitating interoperability with healthcare first responders. These strategies can help ensure that health IT platforms do not become vehicles for the criminalization of COVID-19. This can, in turn, help to ensure that public health principles such as balancing individual rights against the public good are observed during the COVID-19 state of emergency. There is abundant evidence that using criminal statutes and punitive measures against people living with chronic illnesses such as HIV harms them and their communities, who are often among the most marginalized. 26 The same is true for opioid control, in which criminalization perpetuates the misconception of substance use as an individual moral failing and crime, rather than a biopsychosocial phenomenon and public health issue. 27, 28 Similarly, the over-use of police powers in pandemic preparedness for respiratory illnesses has been flagged as an area of J o u r n a l P r e -p r o o f concern by civil liberties advocates. 29 Additionally, associating illnesses with marginalized groups is a longstanding and harmful effect of pandemics, and this has occurred in the case of COVID- 19 for Asian people as the result of xenophobic discourse surrounding the virus's origin in Wuhan, China. 30 Using law enforcement to manage public health problems creates environments of fear and cycles of punishment that harm affected people and do not support positive behavioral changes. 31 For example, multiple cases of HIV-related criminal punishment stemming from alleged nondisclosure to sexual partners have resulted in the release of individuals' names and HIV status to the public by law enforcement, often working with public health agencies. 32 In addition to being inhumane, this further stigmatizes HIV, erodes public trust in public health, and has led criminalized people to experience physical and psychological violence. The history of HIV criminalization demonstrates why police have no business knowing individuals' health status. 33 However, globally, police have enforced COVID-19 control measures. Citations and arrests have been reported in the U.S., Canada, the E.U., Latin America, and other regions. 34, 35 The U.S. Department of Justice has issued guidance for prosecuting individuals for COVID-19 violations that includes terrorism provisions, 36 and some jurisdictions have enforced COVID-19 measures with criminal charges involving fines, periods in jail, or both. 37 While activities that violate COVID-19 measures such as shelter-in-place, social distancing, and self-isolation should be discouraged, non-compliance is not an adequate justification to criminalize an individual for having COVID-19 or to share a person's health data with police. COVID-19 policing also disproportionately affects communities of color, which have higher rates of COVID-19 as the result of systemic forms of racism. 38 At the beginning of June, the London Metropolitan Police released data indicating that Black and Asian people were more likely to be targeted and fined with COVID-19 emergency laws than white people. 39 A month earlier, the New York City Police Department (NYPD) released data on COVID-related enforcement, revealing that 81 percent of the NYPD's summonses related to physical distancing have gone to Black and Latinx people. 40 It was further J o u r n a l P r e -p r o o f revealed that 35 of 40 people arrested by the NYPD for alleged physical distancing failures were Black. 41 In the U.S., Canada, E.U., and internationally, there are few legal and ethical justifications for giving individuals' health information to law enforcement without consent or a court order. 42,43(p14),44(p4) Without consent, identifiable COVID-19 data should only be shared with law enforcement in the most extraordinary circumstances, requiring a court order. Otherwise, sharing COVID-19 patient data with criminal justice entities should be limited to those involved in the provision of healthcare, housing/detention, medical transport, or other services. We agree with other researchers and legal scholars that states of pandemic emergency do not justify implementing protocols to criminalize illnesses or to share individuals' health data with police. 45, 46 Minnesota and Ontario, April 2020: sharing identifiable COVID-19 data with police show how sharing COVID-19 data with police has become routine in two large regions covering urban, rural, and indigenous territories. On April 1 st , 2020 three Minnesota law enforcement associations requested that Governor Tim Walz direct the state government to share COVID-19 data with first responder agencies. 47 On April 10 th , Governor Walz signed an executive order that directed the state Department of Public Health (DPH) to work with the state Department of Public Safety (DPS) to make a plan to share the addresses of positive cases of COVID-19 with 911 emergency dispatchers. 48 The order emphasized limited data sharing, and that individuals' names would not be included. On April 20 th , Minnesota DPH and DPS released a protocol (excerpt shown in Figure 1 ) describing how the addresses of "each 'positive COVID-19 case,'" would be shared with 911 dispatchers around the state every day. 49 On April 21 st , Minnesota DPH and DPS held webinars to instruct personnel about how to implement the protocol. 50 The protocol allows for the sharing of COVID-19 data with J o u r n a l P r e -p r o o f all first responder agencies through the 911 infrastructure, utilizing Computer Aided Dispatch (CAD) systems. The protocol defines "'first responders and other public safety personnel'" as "emergency medical services personnel, ambulance transport staff, law enforcement personnel, fire responders, fire inspectors, and probation officers and parole agents." 51 The protocol also trains dispatchers on how to screen people for COVID-19 symptoms. The protocol is narrowly written, only directing dispatchers to share COVID-19 data "after exhausting other sources of information (e.g., the screening protocol above) and when a first responder has an emergent need to know the shared data." 52 The protocol also requires that Minnesota DPH remove "addresses that are no longer 'positive COVID-19 cases'" and to remove cases as part of daily list updates sent to dispatch centers. 53 The protocol also states "[a]ll data must be destroyed…within 15 days of [the Governor's executive order] being rescinded or the expiration of the peacetime emergency, whichever occurs first." 54 Under Minnesota law, individuals must also be given a warning that their data could be re-disclosed, and be provided an initial opportunity to refuse. 55,56 Even with these limitations, the Minnesota protocol's procedure for sharing COVID-19 data with law enforcement without consent crosses the line into unacceptable terrain. 57(p14) In the absence of a court order, individuals should have a say over when their sensitive health data are J o u r n a l P r e -p r o o f disclosed to law enforcement. 58(p14) The initial warning is not sufficient. Providing someone a single opportunity to refuse re-disclosures upon diagnosis is not equivalent to affirmative consent for specific re-disclosures. 59(p412) The Minnesota protocol's COVID-19 screening procedure is an example of providing people with an opportunity to disclose at a specific moment in time, when asked by a 911 operator. Ontario: police permitted to check COVID-19 status, April-August 2020 On April 3 rd , 2020, in Ontario -Canada's most populous provincean order under the Emergency Management and Civil Protection Act was added to enable the sharing of individual COVID-19 positive data with police and fire authorities. 60 The order allows for the sharing of an individual's name, address, date of birth, and whether they had a positive test for SARS-CoV-2 (the coronavirus that causes COVID-19). "Specified custodians"such as laboratory and public health personnelare permitted to share the data with entities including (but not limited to) police officers and staff, firefighters and staff, paramedics, and communicable disease communications officers. 61 In addition to the Ontario Provincial Police (OPP), there are fifty municipal police services and nine First Nations police services in Ontario that must implement the policy. 62 Waterloo Regional Police, in central Ontario, was one of the entities to adopt the protocol. In a policy, the agency notes: The disclosure of personal health information related to the COVID-19 (positive) status of an individual, must only be used to prevent, respond to or alleviate the effects of the COVID-19 emergency. This includes, ensuring appropriate measures are taken to protect police personnel when responding to a call. This information cannot be used for any other purpose. 63(p42) Furthermore, the policy states the data will be held in a separate database from the Canadian Police Information Centre, the country's centralized policing database. 64(p42) Additionally, on April 16 th , police in Kingston, Ontario noted in the media that "[a]s an additional safety measure for front-line officers, Kingston police, along with other law enforcement in the province, now have a listing of all COVID-19 patients in the region, which will be available J o u r n a l P r e -p r o o f to a select number of Kingston dispatchers." 65 Neither the regulation nor the protocols discuss informing COVID-19 patients that their health data could be shared with police. Further, the data collected did not include date of diagnosis, potentially allowing data to be accessed after a person recovered from COVID-19. 66 Across the U.S. and Canada, comprehensive testing is not being rolled out. 67, 68 At the same time, COVID-19 police enforcement has increased. 69 The path toward positive behavioral change lies not in policing the pandemic, but in a strong collective response rooted in ethics of care and public health best practices. Sharing individuals' health data with police works at crosspurposes with these goals. 70 Here, we present seven alternatives to sharing COVID-19 data with law enforcement that personnel can pursue if a jurisdiction opts to implement a protocol to share coronavirus data with police. These recommendations are summarized in Table 1 . We reiterate that existing evidence strongly favors not implementing any such protocols. They are far more likely to do more harm than good, potentially leading to fines, criminal charges, physical and psychological violence, discrimination, stigmatization, and improper disclosures of COVID-19 status. We also note that most police are not trained to handle sensitive health information, and that police have been known to improperly disclose information about individuals' health status. 71(p139-44) , 72(p99-208) However, if a jurisdiction does implement a COVID-19 police data sharing protocol, the following strategies and policy recommendations provide potential remedies to ameliorate harms. (1) Treat COVID-19 data as sensitive health information or public health surveillance data, and thus subject to similar restrictions on disclosures to law enforcement. A "sensitive" designation akin to data about HIV, mental health, substance use, domestic violence, abuse, and other categories of sensitive health information often comes with additional safeguards governing use, disclosure, and exchange. 73(p25) This often includes the requirement J o u r n a l P r e -p r o o f for police and prosecutors to secure a court order or the individual's consent. 74 Without a court order or consent, disclosures of identifiable COVID-19 data should not be made outside of the healthcare, research, public health, or social service sectors. 75(p14) (2) Implement segmented COVID-19 data interoperability with first responder agencies. Public health agencies can build interoperability loops with public safety agencies that facilitate data sharing with healthcare first responders, while preventing data sharing with police. (6) Advocate for policies to limit COVID-19 data sharing with police. By "policies," we mean both health organization policies and government policies that limit how COVID-19 data J o u r n a l P r e -p r o o f can be shared with police. Health system policies include establishing protocols within organizations to ensure that COVID-19 data are not improperly disclosed. Government policies include solutions sought, for example, by lobbying policymakers. Jurisdictions could adopt laws requiring consent or a court order for COVID-19 disclosure to law enforcement. 81 (7) Report improper data sharing. Individuals who believe that agencies are engaging in improper COVID-19 data sharing can report this activity. Most health organizations have internal grievance processes. [ Table 1 appears on the following page] J o u r n a l P r e -p r o o f Table 1 (1) Treat COVID-19 data as sensitive health information or public health surveillance data, and thus subject to similar restrictions on disclosures to law enforcement. Health systems have many ways of designating data as sensitive or subject to extra restrictions. COVID-19 data are an emergent data class that has arisen at a time when many health data exchange restrictions have been relaxed under emergency powers. Health systems can adopt policies that limit COVID-19 data sharing with police by adopting frameworks used to regulate other sensitive data, such as HIV data or mental health data. (2) Implement segmented COVID-19 data interoperability with first responder agencies. Personnel who build systems for the transmission of COVID-19 data to first responders can construct interfaces that give access to medical first responders and not to law enforcement. (3) Designate a panel to review applications from police for COVID-19 data. Most health departments and systems have ethics review panels. These can be used to review applications from police for COVID-19 patient data. Ideally, these panels will include community voices, such as people from disparity groups and/or who have had COVID-19. (4) Decline to share COVID-19 data with police. Personnel can refuse to share COVID-19 data with police. This work can be shifted to other personnel, who might themselves join in refusal. Personnel should not act without being fully informed about potential ramifications. Discussing these issues with co-workers and seeking guidance from professional associations and advocates can be good starting points. (5) Decline to build COVID-19 data infrastructures that are interoperable with law enforcement. Personnel can decline to build infrastructures intended to share COVID-19 data with police. Other personnel can take on this work, or can join in refusal. Personnel should not act without being fully informed about potential ramifications. Discussing these issues with co-workers and seeking guidance from professional associations and advocates are good starting points. (6) Advocate for policies to limit COVID-19 data sharing with police. Advocating for internal policies at a health organization that limit COVID-19 data sharing with police is one way to advance reform. Personnel can also advocate within their professional associations for public resolutions against COVID-19 data sharing with police. At the jurisdictional level, engaging in policy advocacy to limit COVID-19 data sharing with law enforcement is another way to advance change. Public health agencies often advise policymakers. Independent advocacy by personnel is also possible. This can involve public exposure, and some personnel may not be able to speak publicly, either for legal reasons or by choice. Working with experienced advocatesincluding fellow health workers, lawyers, and professional advocatesis key to ensuring legal compliance and effective strategy. (7) Report improper data sharing. Many organizations have internal mechanisms to report abuses, such as an Inspector General or Ombudsman. These offices can be leveraged in a variety of ways to report abuses. If a health professional uses their professional and ethical judgement to determine that a COVID-19 data-related abuse is so egregious that it must be brought to light publicly, most news outlets have anonymous tip lines. Personnel can also contact advocates who work with whistleblowers. Personnel should not act without considering the potential ramifications. Stakeholders can also use their professional and ethical judgement to seek other means to stop COVID-19 data abuses. This occurred in Toronto. In April 2020, 82 August 2020, a court put a hold on police access to the COVID-19 police databasebut not before it had been accessed over 95,000 times. 84,85(p22-4) The juxtaposition of forms of organized advocacy with the bus driver's act shows that everyday actions, organized resistance, and thoughtful dialogue are all critical to resisting the integration of COVID-19 data with police data. The risks of sharing COVID-19 data with law enforcement are manifold, and the benefits range from indiscernible to negative. Data stewards have a vital role to play in keeping police and health data separate. Pandemic states of emergency do not permit the suspension of basic rights of control over the disclosure of one's health data outside the health system. This is evident from the history of research on the harms of criminalizing illness, civil society consensus against the use of criminal powers in the COVID-19 response, and COVID-19 data regulations by the EDPB. Regulations related to sharing COVID-19 data with police have been implemented partly in the name of protecting officers. However, the benefits of disclosing health information to police do not outweigh the risks, and there are measures that police agencies can take to protect their employees, and which officers can take to protect themselves. Police can wear masks, regularly wash their hands, carry hand sanitizer, engage in social distancing, and self-isolate if they display symptoms of COVID-19 or test positive. J o u r n a l P r e -p r o o f Policing the Pandemic: Tracking the Policing of Covid-19 across Canada ON: Policing the Pandemic Mapping Project Emergency Executive Order 20-34: Protecting Minnesota's First Responders by Directing the Commissioner of Health to Share Information with the Department of Public Safety Order Under Subsection 7.0.2 (4) of the Act -Access to COVID-19 status information by specified persons Telling Police Where People With COVID-19 Live Erodes Public Health United States: Electronic Frontier Foundation COVID-19 data sharing with law enforcement sparks concern Contagious divides: epidemics and race in San Francisco's Chinatown Again and Again We Suffer: The Poor and the Endurance of the War on Drugs Rethinking Criminalization of HIV Exposure -Lessons from California's New Legislation American Civil Liberties Union. Pandemic Preparedness: The Need for a Public Health -Not a Law Enforcement/National Security -Approach Project Inform Staff. Using Surveillance and Other Data to Improve HIV Care Linkage and Retention Project Inform 16 Defining Addiction and Identifying the Public Interest in Liberal Democracies Punishing disease: HIV and the criminalization of sickness Power, ideology, and the war on drugs: Nothing succeeds like failure What can we learn from the Portuguese decriminalization of illicit drugs? The harms of HIV criminalization: responding to the 'association of HIV diagnosis rates and laws criminalizing HIV exposure in the United States Oslo Declaration on HIV Criminalization Rights in the Time of COVID-19 HIV Justice Worldwide Steering Committee Statement on COVID-19 Police are Enforcing Public Health Orders, but that Doesn't Make them Public Health Experts American Civil Liberties Union Canadian Civil Liberties Association calls for safeguards in data-based COVID-19 contact tracing. The Logic Magazine Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak European Data Protection Board. Statement by the EDPB Chair on the processing of personal data in the context of the COVID-19 outbreak Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak American Civil Liberties Union. Pandemic Preparedness: The Need for a Public Health -Not a Law Enforcement/National Security -Approach Tiger Mandingo," a Tardily Regretful Prosecutor, and the "Viral Underclass Addiction and Moralization: the Role of the Underlying Model of Addiction The Biopsychosocial Model of Addiction American Civil Liberties Union. Pandemic Preparedness: The Need for a Public Health -Not a Law Enforcement/National Security -Approach Xenophobia in the time of pandemic: othering, anti-Asian attitudes, and COVID-19. Politics, Groups, and Identities Lock This Whore Up": Legal Violence and Flows of Information Precipitating Personal Violence against People Criminalised for HIV-Related Crimes in Canada Impacts of Criminalization on the Everyday Lives of People Living with HIV in Canada. Sexuality Research and Social Policy Over 350 more people booked for violating movement ban. Cyprus Mail Coronavirus en Perú: más de 16.000 detenidos por violar el aislamiento obligatorio Those who intentionally spread coronavirus could be charged as terrorists: The Justice Department offers guidance on how to deal with "purposeful exposure and infection of others Enforcing the shutdown: Law enforcement grapples with policing stay-athome orders, social distancing, quarantines. USA Today Disparities in Incidence of COVID-19 Among Underrepresented Racial/Ethnic Groups in Counties Identified as Hotspots During Black people more likely to be fined under coronavirus laws than whites in London, new figures show. Yahoo News UK 81 Percent of NYPD's Social Distancing Summonses Were Issued to Blacks and Latinos Guidance Note -Ending overly broad criminalization of HIV non-disclosure, exposure and transmission: Critical scientific, medical and legal considerations Public Goods, Private Data: HIV and the History, Ethics, and Uses of Identifiable Public Health Information. Public Health Reports Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak How Do We Balance Tensions Between COVID-19 Public Health Responses and Stigma Mitigation? Learning from HIV Research American Civil Liberties Union. Pandemic Preparedness: The Need for a Public Health -Not a Law Enforcement/National Security -Approach Minnesota police groups want locations of those infected with COVID-19 to protect first responders Emergency Executive Order 20-34: Protecting Minnesota's First Responders by Directing the Commissioner of Health to Share Information with the Department of Public Safety Minnesota Department of Public Health, Minnesota Department of Public Safety. MDH/DPS Protocol Related to Executive Order League of Minnesota Cities. Executive Order Requires Addresses of COVID-19 Patients to Be Shared With 911 Operators MN: League of Minnesota Cities Minnesota Department of Public Health, Minnesota Department of Public Safety. MDH/DPS Protocol Related to Executive Order Ethical Justification for Conducting Public Health Surveillance Without Patient Consent Public Goods, Private Data: HIV and the History, Ethics, and Uses of Identifiable Public Health Information. Public Health Reports Keeping confidence: HIV and the criminal law from HIV service providers' perspectives. Critical Public Health Order Under Subsection 7.0.2 (4) of the Act -Access to COVID-19 status information by specified persons Ontario Minister of the Solicitor General Waterloo Regional Police Services Board Kingston police adjusting to new reality during coronavirus pandemic. Global News Canada Why COVID-19 testing varies so much across Canada Without More Tests, America Can't Reopen. The Atlantic Policing the Pandemic Enforcement Report Policing the Pandemic Mapping Project Resisting the Digital Medicine Panopticon: Toward a Bioethics of the Oppressed Lock This Whore Up": Legal Violence and Flows of Information Precipitating Personal Violence against People Criminalised for HIV-Related Crimes in Canada Punishing disease: HIV and the criminalization of sickness Office of the National Coordinator for Health Information Technology (ONC). Federal Health IT Strategic Plan Office of the Secretary, United States Department of Health and Human Services Considerations for Modernized Criminal HIV Laws and Assessment of Legal Protections Against Release of Identified HIV Surveillance Data for Law Enforcement Public Goods, Private Data: HIV and the History, Ethics, and Uses of Identifiable Public Health Information. Public Health Reports Interoperability Standards Advisory: Data Segmentation of Sensitive Information Office of the National Coordinator for Health Information Technology Department of Health and Human Services (HHS) Office of Civil Rights (OCR) Conscience Protections for Health Care Providers Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak Clashes Over Ethics At Major Tech Companies Are Causing Problems For Recruiters Considerations for Modernized Criminal HIV Laws and Assessment of Legal Protections Against Release of Identified HIV Surveillance Data for Law Enforcement We have chosen to redact the date due to ensure confidentiality and protect against reidentification This public correspondence has been removed from Twitter Ontario ends police access to COVID-19 database after legal challenge. Canadian Broadcasting Corporation (CBC) We Can't Police Our Way Out of the Pandemic -Lessons for Abolition The authors thank the two anonymous reviewers, the editorial staff of Health Policy, Tom Boellstorff, Olivia Guest, and Luke Stark.