data privacy

The aftermath of COVID-19 may change the way attorneys and other legal professionals think about or execute their work, but the privacy landscape could remain largely untouched. While obligations under the Health Insurance Portability and Accountability Act have been temporarily relaxed to facilitate the public's access to telemedicine, the enforcement of other privacy laws seems likely to remain in full force.

For example, Xavier Becerra, the attorney general of California, sent out a press release in April reminding consumers that they could still take advantage of California Consumer Privacy Act  tenants—such as the right to be forgotten—during the pandemic. Other regulators may continue to be just as vigilant.

"I'm not seeing large sweeping changes or [regulators] willing to make large sweeping changes just yet. … If anything I'm seeing more enforcement actually," said Christopher Ballod, a partner with Lewis Brisbois Bisgaard & Smith.

Why the increased activity? Ballod has noticed an uptick in the number of incident response cases his firm has walking through the door, the result of bad actors who are successfully leveraging COVID-19-themed phishing emails to get more people to click on contaminated links. He posited that regulators may be aware that the present environment calls for them to be more vigilant—or remote working could just be doing wonders for their productivity.

"It could be that the office environments are less productive for them, which is true for some businesses," Ballod said.

Law firms aren't the only ones tracking how COVID-19 is impacting privacy enforcement. Hilary Wandall, senior vice president of privacy intelligence and general counsel at privacy compliance tech company TrustArc, said corporate clients have been looking for guidance around how to align various elements of their COVID-19 response—notifying employees that someone from the office has tested positive for the virus, for instance—with existing privacy laws.

Some regulators appear eager to comply. In March, for example, the European Data Protection Board published guidance clarifying that the General Data Protection Regulation permits employers or public health authorities to process personal data without subject consent if "necessary for the employers for reasons of public interest in the area of public health or to protect vital interests."

"We're seeing regulators continue to be focused on privacy from both a guidance perspective and also from an enforcement perspective. … And then with respect to [new] legislation, we've seen a dramatic slowdown," Wandall said.

What that could mean for the prospects of a federal privacy law in the U.S. is unclear as politicians and lawmakers continue to grapple with the more direct fallout of COVID-19. However, projects developed to help mitigate the spread of the virus could inadvertently wind up adding fuel to the fire.

Google and Apple, for example, are exploring mobile applications that would alert a user when they have come into contact with someone who tested positive for COVID-19. Jarno Vanto, a partner at Crowell & Morning, believes such technology could galvanize a strong response from both Democrats and Republicans, although for different reasons.

He theorized that Democrats might see such a gambit as an attempt by large tech companies to collect more data, while Republicans could balk at anything that gives the government the power to track citizens. "That will very likely, at least from a political perspective, make it easier to advocate for a federal privacy law. And calls for a federal privacy law especially have increased over the last few weeks," Vanto said.

Still, Ballod at Lewis Brisbois posited that absent a data breach or exposure at a large company that puts other entities at risk, it may be difficult to garner sufficient momentum behind a federal privacy law given the attention being driven toward COVID-19.

"The COVID-19 pandemic in my mind is definitely taking a privacy law off the table for the foreseeable future. I do think there are other issues, especially in a election year, with a pandemic that will keep that from being at the forefront," Ballod said.