Contact tracing orders present dilemma for businesses

Restaurants already crippled by pandemic closures now face a new hurdle as governments seek to enlist them in contact tracing -- an effort that privacy attorneys said could drive away patrons and expose businesses to liability.

That threat was laid bare in a challenge to a Los Angeles County public health order filed by sushi restaurant Sasabune Beverly Hills.

"Ostensibly, these provisions are to facilitate the county's contact tracing efforts. Unfortunately they are so sweeping in nature that the result is a countywide data collection and warrantless search regime without appropriate safeguards in place," the plaintiff's attorney, Christian E. Kernkamp, wrote. "Participation is not discretionary, it is compulsory." Sasabune Beverly Hills v. Muntu Davis, 2:20-CV-05497 (C.D. Cal., filed June 20, 2020).

The order extends to non-government entities including restaurants, places of worship and workplaces. These aren't allowed to turn over patron information on a voluntary basis, Kernkamp argued; those that fail to comply could face civil and criminal sanctions.

U.S. District Judge Stephen V. Wilson of the Central District of California on June 25 denied Kernkamp's request for a temporary restraining order. Wilson sided with the county, which asserted Jacobson v. Massachusetts, 197 U.S. 11 (1905), which many public entities are using in pandemic-related litigation challenging the constitutionality of executive orders during emergencies.

Wilson did find that "the language of the county's order is relatively vague and does not clearly state the procedures for seeking disclosure of contact information in the event that the county attempts to utilize contact tracing in response to a COVID-19 outbreak."

But there's no evidence provided by Kernkamp that the county would do anything that could result in illegal searches or criminally enforce or prosecute anyone who doesn't turn over information, Wilson wrote.

Amnon Z. Siegel, a partner at Miller Barondess LLP who represents public health officer Muntu Davis, said Monday the county is willing to work with any entity that cannot collect the information.

"But this is a fight that involves everybody to prevent the spread of the virus," Siegel said. "The county is hoping to get voluntary cooperation when there is an outbreak that could be tied to a particular establishment."

The county could issue an administrative subpoena or warrant to get information quicker in case an outbreak is detected at a particular site, according to the public health order.

Siegel argued in his response papers that contact tracing is essential to suppressing spread and is proven to be effective. Siegel also responded to Kernkamp's claim there is a mandatory requirement for disclosure on demand: The public health order is silent on that issue and never says what it would do to get the records.

Resoundingly, judges across the nation have affirmed governments' broad authority to control the pandemic, especially in cases filed by churchgoers, barbers, beauticians, protesters and businesses once deemed nonessential.

The sushi restaurant case falls within the authority provided under Jacobson, Siegel argued. The vast majority of diners pre-pandemic already provided contact information when making reservations at the restaurant or through a third-party app like OpenTable, he pointed out.

"This information isn't being used for any purpose other than controlling this virus," Seigel said.

Kernkamp, of Kernkamp Law APC in Century City, said private businesses should be concerned for consequences they could face having to collect contact information that would drive away customers, especially in the wake of government shutdown orders that have already crippled the restaurant industry. As of Monday the county refused to amend its language to make it clear and consistent with the disclosure being done on a voluntary basis, Kernkamp said.

"We're not saying COVID-19 isn't a serious issue, but they should let people opt in if they want and give direction on how to collect and store the information and when to destroy it," he said.

Gerald S. Sauer, a partner at Sauer & Wagner LLP who is not involved with the case, agreed with Kernkamp that layering on the data requirement would further impact restaurants.

"What happens to the information after this is over? You're forcing a business that's on life support to do something extra. It's a burden. How do they know the list won't be compiled, sold and monetized?" he said.

Privacy concerns are why tech firms including Apple and Google backed away from partnerships with governments for contact tracing, Sauer said. Business owners are also likely worried about facing liability from patrons over data disclosure.

"The longer the pandemic goes on, the more the erosion of privacy interests," Sauer said. "There are crises you have to take steps for public welfare but you should view it like a game of chess, not checkers. Think about moves on the board down the road so you can anticipate what happens after. There shouldn't be a patchwork approach. California has come up with a comprehensive plan in theory that still has holes in it in the use of private information to battle this virus."

John Nadolenco, a partner at Mayer Brown who defends companies facing privacy suits, said he understands why a restaurant would be concerned with handing over private customer information without specific legal protections from the government.

"The restaurant might want protection from lawsuits from patrons, customers who might sue the business over disclosing their information," said Nadolenco, who is not involved in the case. "The restaurant should be able to say they were ordered to do so. I can see how a lot of businesses subject to the order find themselves in a delicate situation because they, on one hand, want to play their role in society to help contact-trace and stem the epidemic and follow the government's rules, but they also want to make sure that doing so won't get them into legal trouble."