Kansas to protect privacy and civil liberties during “contact tracing” by statute

When the new COVID-19 response legislation is signed into law, Kansas will become a leader among the states in protecting citizens’ privacy and civil liberties during the pandemic by tightly regulating “contact tracing,” said Attorney General Derek Schmidt.

The COVID-19 response bill approved this week by the Legislature contains a section enacting the COVID-19 Contact Tracing Privacy Act. The provision was recommended by the attorney general.

“Contact tracing is a long-established method used by the public health community to identify and contain contagious and infectious diseases,” Schmidt said. “But the sheer scope and unregulated nature of contact tracing during the COVID-19 pandemic have left many Kansans concerned about the procedure and about how collected information may be used. With this new statute, Kansas will put in place enforceable statutory protections specifically to protect citizens’ privacy and civil liberties during COVID-19 contact tracing.”

Contact tracing is the process of identifying people with whom an infected person has had recent contact that has potential to spread the disease. Typically, people who have been in contact with an infected person are then notified and advised they should be tested and consider self-quarantining if appropriate. Local governments and the Kansas Department of Health and Environment (KDHE) have been using contact tracing to help contain the spread of COVID-19, but until now no state law has specifically governed the practice.

One proposal from the Johns Hopkins Center for Health Security recommended 100,000 contact tracers may be needed nationwide. So far, more than 11,000 people are working as contact tracers in response to COVID-19 nationwide, according to news reports. In Kansas, KDHE announced plans to recruit 400 contact tracers, in addition to contact tracers deployed by local governments.

But until now, no statute has specifically regulated the practice of contact tracing, and legal disputes already had arisen. In early April, concerns were raised after news reports suggested KDHE might be using cellphone location data to track COVID-19, and in May residents sued Linn County over its contact tracing practices.

“This new legislation does not address every question,” said Schmidt, noting that the new law is temporary only through April 2021 to give the Legislature time for a more thorough, global review of how contact tracing should be regulated. “But at least this puts in place basic protections for civil liberties and privacy to replace the unregulated wild west that otherwise was unfolding in COVID-19 contact tracing.”

The new legislation, which applies to both the state and to local government authorities, contains the following provisions to protect citizens’ civil liberties and the privacy of information collected through contact tracing:

• Participation in contact tracing must be voluntary. No person may be required to participate, nor forbidden from participating.
• Contact tracing may not collect information through cellphone tracking and may not use any information collected through cellphone tracking.
• Information collected through contact tracing must be used only for contact tracing, kept confidential and not disclosed. The information must be safely and securely destroyed when no longer needed for contact tracing.
• Only specified information may be collected by contact tracers. The list of information that may be collected must be established by the Secretary of Health and Environment through the open and transparent process of adopting formal rules and regulations.
• The government may not require any third party to collect contact data. Information voluntarily collected by third parties may only be obtained by the government with the consent of both the third party and the person the information relates to, or with a judicially supervised warrant.
• People working as contact tracers must receive training and must affirm that they are familiar with the privacy and civil liberties protections in the legislation.

Violations of the Contact Tracing Privacy Act may result in civil or criminal penalties.

“