Governments have a long and storied record of data abuse, from the Stasi in East Germany to LoveInt at the CIA.

The U.S. Govt used individuals' Census data to round up Japanese-Americans for FDR's World War II internment camps. They also lied about it and claimed that they were only using anonymized data.

https://exhibits.lib.berkeley.edu/spotlight/census/feature/j...

Humans have a long and storied record of using tools and information to do malicious things. But we also have a long and storied record of using tools and information to produce the incredible advances of the past few centuries, where the median life expectancy has nearly doubled from the baseline over the past 50k years.

Personally, I would really prefer a system where health information was centralized and easily transferrable to healthcare providers, as I think it would be massively better if we could learn from the bad outcomes of others rather than creating thousands of information silos that have to learn these expensive lessons in parallel, and it would also allow us to know the prices of healthcare services thereby enabling efficient markets to develop.

Are you suggesting that this location information is "health" data and is okay for them to use and store?

As a data scientist, I am oriented towards mining data for valid insights that allow us to answer important questions, such as

* "Who was in close proximity (~15m) of this known COVID superspreader event?" or * "Who has spent a large amount of time in this region where the rate of cancer is 6 standard deviations above the statewide rate?"

So yeah, I'm firmly asserting location data enables us to explore a lot of important problems that negatively impact people's health, and I think learning from the past (ie from data) is how we improve the future.

Yes. Location data is health data. It has been since 1854.

https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outb...

Just because data is used in understanding something related to health doesn't mean that it's "health data" in a legal, protected, or regulatory sense. Nor does it mean that they should have de facto access to the data without limitations. Hell, the closest thing I'm aware of that's close to it (at least under HIPAA) is the name or address of a hospital that a person's visited.

Would you be okay if the CDC purchased data from period-tracking apps to track periods? Or how many bottles of soap I purchase in a year? Or how much booze everyone buys?

Can you provide a link the statute or other ratified text that you're basing your "health data" categorization on?

By the way, HIPAA privacy rules regulate the use and disclosure of Protected Health Information (PHI) in healthcare treatment, payment and operations by covered entities.

Per this CDC FAQ [0]: """ What information is protected? All medical records and other individually identifiable health information used or disclosed by a covered entity in any form, whether electronically, on paper, or orally, are covered by the final rule.

For what disclosures and uses must consent be obtained by a provider? The Privacy Rule states that: In general, “[a] covered health care provider [with a direct treatment relationship] must obtain the individual’s consent,…prior to using or disclosing protected health information to carry out treatment, payment, or health care operations.” (See section [§] 164.506, 65 Federal Register [F.R.] p. 82810, for complete requirements.) """

Non-covered entities, like commercial data brokers, are free to sell PHI-containing data (assuming they aren't contractually prevented from doing so), and unless the data said broker sells is from a covered entity, no plausible interpretation bars the CDC from buying data available to anyone.

> Would you be okay if the CDC purchased data from period-tracking apps to track periods? Or how many bottles of soap I purchase in a year? Or how much booze everyone buys?

Legally? Yes, unambiguously. Morally? Depends on what they're do with their analysis. If it's for disease control and/or harm prevention, that seems to fall squarely within their scope.

[0] https://www.cdc.gov/nhsn/hipaa/index.html

My problem is absolutely related to data privacy and I'm not sure why you think otherwise, let alone why you think I'm interested in spreading disease (seriously, what.). At a practical level, one of my bigger concerns is that they've very likely made it possible to FOIA for the location information they bought.

The data couldnt be foiaed because it’s not the government’s. Anyway, someone could just buy it direct anyway.

This is why I don’t understand your concerns. You start off freaking out about the public health officials having widely available location data, and keep harping about the government, but never once focusing on the actual data collection by private entities. Come on. Do you really think Foursquare is HIPPA compliant?

1. That's not really how FOIA works.

2. It's spelled HIPAA.

3. Foursquare isn't bound by HIPAA because they're not a covered entity, unlike the CDC.

4. Believe me, I'm livid about the selling and collection by private entities.

5. I'm only bringing up the FOIA side of things in an attempt to highlight something that you might not have considered. Judging by your misunderstanding of HIPAA and FOIA, it seems that you could stand to consider more.

It would be cheaper to buy the data on the open market than to pay the research fees for a FOIA request. A LOT more timely too.

Yes, but those threats already exist regardless and stopping the sale of carrier data won't stop them.

Ideally you'd want to stop both, but if I had to choose I'd prefer that only the government has access rather than the highest bidder (which can be the government if they so desire, so in the end you're back at square one anyway).

Did you know there are many classes of crime that follow the pattern you spoke of "It already exists out there, and will persist even if I stop, I'm not creating it just propagating it..."

One pretty nasty example would be revenge porn.

a lesser one would be piracy of copyright material

>> Yeah. I have no problem with researchers getting anonymized data. CDC, snoop all you want. It's the business guys I don't like having it.

> Governments have a long and storied record of data abuse, from the Stasi in East Germany to LoveInt at the CIA.

"Governments" is far too coarse-grained of a category; it invites sloppy thinking.

They also have a long and storied history of helping the public avoid widespread disasters and preventing larger outbreaks of disease through using data.

Which of these is more common and useful?

That's either a straw man argument or a moral equivalence fallacy, depending on what point you believe you're making.

Note that I said "anonymized".

The first step should be to separate the identity from the data. The phone's ID is plenty for research purposes, keep the name out of it.

Of course one has to keep government( agencie)s in check, but to compare the CDC to the Stasi.... I don't know if that's really an apt or appropriate comparison

Right, because businesses have never done anything bad with data, it's all those government guys. The government of course being the one tasked with improving the health and welfare of the population, not with turning a profit.

Right, because governments have never done anything wrong in the history of the world. It's all those evil business guys.

You're right, because there's never been a leak of personal data from any researcher or government department.