Over the weekend, Minnesota’s Public Safety Commissioner analogized COVID-19 contact tracing with police investigation of arrested protesters. This analogy is misleading and dangerous. It also underlines the need for public health officials to practice strict data minimization—including a ban on sharing with police any personal information collected through contact tracing.

On May 30, at a press conference about the ongoing protests in Minneapolis against racism and police brutality, Commissioner John Harrington stated:

As we’ve begun making arrests, we have begun analyzing the data of who we have arrested, and begun, actually, doing what you would think as almost pretty similar to our COVID. It’s contact tracing. Who are they associated with? What platforms are they advocating for?

We strongly disagree. Contact tracing a public health technique used to protect us from a deadly pandemic. In its traditional manual form (not to be confused with automated contact tracing apps), contact tracing involves interviews of people who have been infected, to ascertain who they have been in contact with, in order to identify other infected people before they infect still more people.

On the other hand, interrogating arrested protesters about their beliefs and associations is a longstanding police practice. So is social media surveillance by police of dissident movements. These practices must be carefully restricted, lest they undermine our First Amendment rights to associate, assemble, and protest, and our Fourth Amendment rights to be free from unreasonable searches and seizures. We have similar concerns about a notorious practice that the NSA calls “contact chaining”: automated analysis of communications metadata in order to identify connections between people.

Any blurring of police work with contact tracing can undermine public health. In prior outbreaks, people who trusted public health authorities were more likely to comply with containment efforts. On the other hand, a punitive approach to containment can break that trust. For example, people may avoid testing if they fear the consequences of a test result.

Thus, we must ensure strict data minimization in COVID-19 contact tracing. At a minimum, this means that police must have no access to any personal information collected by public health officials in the course of interviewing COVID-19 patients about their movements, activities, and associations. People are less likely to cooperate with contact tracing if they fear the consequences. For this reason, EFF also opposes police access to the home addresses of COVID-19 patients.

Of course, there is much more to data minimization:

• Public health officials conducting COVID-19 contact tracing must collect as little personal information as possible for containment purposes. For example, they don’t need to know about a patient’s movements months earlier, because COVID-19 patients are only infectious for 14 days.
• Public health officials must delete the personal information they collect as soon as it is no longer helpful to contact tracing. This may be a very short retention period, given the very short infectiousness period.
• Public health officials must not disclose this information to other entities, especially if those entities are likely to use the information for anything other than contact tracing. For example, they must not disclose this information to police departments, immigration enforcement agencies, or intelligence services.
• When corporations assist with contact tracing, they must abide by data minimization rules, too. For example, they must not be allowed to use it for targeted advertising, or to monetize it in any other manner.

We need new laws to guarantee such data minimization, not just for contact tracing, but for all COVID-19 responses that gather personal information.

Finally, we must not allow police to “COVID wash” controversial police practices. Manual contact tracing is a public health measure that many people view as necessary and proportionate to the ongoing public health crisis. On the other hand, when police investigate the political beliefs and associations of protesters, whether by interrogation or social media snooping, abuse often follows. The misplaced analogy between these two very different practices can unduly blunt justified criticisms of police responses to protesters.