This data that will be transferring

between phones will now be encrypted.

What more do we know about how

this is actually going to work?

The clamor to improve contact tracing

has seen nations like Israel, Singapore,

South Korea, and of course, China using a combination

of location data, video camera footage,

and credit card information to track

and contain COVID-19 in their countries.

We're prepared, and we're doing a great job with it.

It will go away, just stay calm, it will go away.

The U.S. has lagged behind,

but Google and Apple are feverishly building

a contact tracing platform,

scheduled for release in mid-May.

It will enable the use of Bluetooth technology

to help governments and health agencies

reduce the spread of the virus by tracing people

who have come into close contact with COVID-19.

But how exactly this information will be used in the future

and with whom is an open question.

Well, we're kind of at this fascinating moment, right,

where we don't know exactly what the response

is gonna look like.

We know that robust contact tracing

is gonna be a huge part of re-opening the economy,

and we know that we have to balance that

with privacy concerns, somehow, but we don't know

exactly what the balance is gonna look like.

And I leave it up to the epidemiologists to say

whether you need to be as repressive as China

or if there are ways to protect privacy.

We might not have a ton of time to debate it.

And that's kind of the problem.

There are currently few legal protections

from data misuse or abuse, and while some states

do have some laws in place,

progress on this front has been halted.

There was some privacy momentum in Congress

before the pandemic hit,

and that's been destroyed for obvious reasons.

California passed a privacy law a couple of years ago,

and there's been a lot of work

to try to improve it as it goes into effect this year.

A bunch of other states have been considering

privacy legislation as well,

like Washington State and New York,

and then covid comes and a lot of the states legislatures

have just pretty much shut down.

Now before you envision a Black Mirror episode

for your personal future, you should know

that as of now, involvement will be voluntary.

The data it collects is to be anonymized,

and there will be no central server

where the data is stored, so governments or corporations

can't directly grab all this private data

for its own purposes, but that could easily change.

There's nothing really to stop them

from having a centralized database.

It's only the restraint of our expectations.

If our expectations were to become overturned

and again shift tremendously over to safety,

it could become a lot more Orwellian a lot quicker.

There's many scenarios

that could be quite troubling.

For example...

Your information could be given to insurance companies,

and it could be used as a pre-existing condition

that prevents you from getting insurance

or as a reason to charge you much higher prices.

The information could be sold to data brokers,

who could then package it to anyone that they want.

The information could end up with your employer,

who could use it to make decisions about

whether to promote you because of your health.

Now, that may sound a little paranoid,

but we have good reason to be suspicious.

These are entities that already collect

enormous amounts of our data in a commercial context,

and whose mishandling of data

has come under fire in the past.

Exhibit A.

Cambridge Analytica.

Cambridge Analytica.

Cambridge Analytica.

We just traded away everything there is

to know about ourselves for Farmville,

and I think that people are starting to realize

that wasn't a good trade.

In 2016, the big data company Cambridge Analytica

took the personal data of millions

of Americans from Facebook.

They packaged it and sold it so that political groups

could then target parts of the population

with narrow casted messages.

People were sharing information with friends,

and they weren't necessarily expecting that data

to be shared by a company like Cambridge Analytica

that was making use of it to build political profiles,

and then serve specific advertisements or propaganda.

Cambridge Analytica really captures

the dilemma of privacy, which is how data collected

for one reason, with certain expectations,

is used for another reason.

We have been giving away all of our

most private information to companies

that have then sold it on and created

what is now a multi-trillion dollar a year industry.

This was business as usual

as far as Facebook developers went.

This scandal resulted

in the Federal Trade Commission's fining

of Facebook for five billion dollars,

as well as a general push for broader privacy laws.

We didn't take a broad enough view of our responsibility,

and that was a big mistake,

and it was my mistake, and I'm sorry.

What you're seeing is a greater bipartisan concern

about the power of these data-opolies

and how do we rein them in.

So how do we know this

isn't gonna happen this time?

The answer comes back to those privacy protection laws

that have been put on hold because of the pandemic.

If there had been a national privacy law enacted

before the pandemic hit us, we probably would've been

in a better position to respond to it with data.

But even if there was a national

privacy law in place, contact tracing is actually pointless

if we don't have widespread testing

to go along with it, which we don't.

So what is this about?

Is this a smokescreen for collecting a lot of data?

Is the data truly gonna stay anonymized or aggregated?

The pandemic is showing why a general privacy law

is so important, because there's so much confusion

around data collection,

concern that there will be overreach,

and lack of rules about how the information

could be reused for other purposes.

Laws are going to be needed

to stem a lot of this corporate data collection,

and I think you're only going to see those efforts continue.

Short-term, I think they may be delayed because of covid,

but I think the fundamental concerns around

overly broad corporate collection aren't going away.

I don't see some centralized bureaucracy

that will then be shared with the police and the IRS

and your future employer

and your future insurer, at least not right now.

I think it is worth noting that

some of those things aren't forbidden.