EFF Urges Universities to Commit to Transparency and Privacy Protections For COVID-19 Tracing Apps

San Francisco—The Electronic Frontier Foundation (EFF) called on universities that have launched or plan to launch COVID-19 tracking technologies—which sometimes collect sensitive data from users’ devices and lack adequate transparency or privacy protections—to make them entirely voluntary for students and disclose details about data collection practices.

Monitoring public health during the pandemic is important to keep communities safe and reduce the risk of transmission. But requiring students, faculty, and staff returning to campus to commit to using unspecified tracking apps that record their every movement, and failing to inform them about what personal data is being collected, how it’s being used, and with whom it’s being shared, is the wrong way to go about it.

EFF is urging university officials to commit to its University App Mandate Pledge, a set of seven transparency-and privacy-enhancing policies that will help ensure a higher standard of protection for the health and personal information of students, faculty, and staff.

In committing to EFF’s pledge, university officials are agreeing to make COVID-19 apps opt-in, disclose app vendor contracts, disclose data collection and security practices, reveal the entities inside and outside the school that have access to the data, tell users if the university or app vendors are giving law enforcement access to data, and stay on top of any vulnerabilities found in the technologies.

“The success of public health efforts depends on community participation, and if students are being forced to download COVID-19 apps they don’t trust to their phones, and are being kept in the dark about who’s collecting their personal information and whether it’s being shared with law enforcement, they’re not going to want to participate,” said EFF Grassroots Advocacy Organizer Rory Mir. “University leaders should support the app mandate pledge and show that they are committed to respecting the privacy, security, and consent of everyone that is returning to campus.”

Universities have rushed to adopt apps and devices to monitor public health, with some mandating that students download apps that track their locations in real time or face suspension. Location data using GPS, for example, can reveal highly personal information about people, such as when they attend a protest or go to a bar, where their friends live, and what groups they associate with. It should be up to users to decide whether to download and use a COVID-19-related app, and up to universities and public health authorities to communicate the technology’s benefits, protections, and risks.

For the pledge:
https://www.eff.org/app-mandate/pledge

For more about COVID-19 and digital rights:
https://www.eff.org/issues/covid-19