The Governor unveiled the state’s new Crush Covid contact-tracing app today. From the Boston Globe:
The governor emphasized that Rhode Islanders will be able to enable or disable the GPS tracking feature any time they want. The data will remain on their phones and be automatically deleted in 20 days. If someone gets COVID-19, health officials will ask them to share the “location diary” data, but that would be optional, she said.
Following some positive remarks, the ACLU RI explained its concerns.
- Since the state is encouraging employers to have their employees use the app, what protections do those employees have if an employer seeks to require its use? What prevents a supermarket or other establishments from demanding its use as a condition of entry by customer?
- What guarantees are there that DOH will not end up sharing information it collects with law enforcement officials and others, even if for purported public health purposes, just as the Department has done with addresses in its database of COVID-19-positive individuals?
- Will the state have the app subjected to an independent third-party audit to ensure that it is working as proposed and providing the privacy protections that have been assured?
- The privacy policy states that app users “may choose to share with us precise geolocation or Bluetooth information using iOS and Android location services.” Since this is not how the app has been described, what is that language for?
- How will people be informed about future updates to the app so that they can choose whether to uninstall or otherwise stop using it if the features change?
The app is available for both iOS (iPhones) and Android, and is available on Apple’s App Store and Google Play.