While many wondered how their personal contact information ended up on social media for reporting violations of the governor’s ‘Stay-Home-Stay-Safe’ order, an attorney is wondering why the information was released, at all.
“I am, to be honest, a little surprised that these names were disclosed,” John Davisson, Counsel at the Electronic Privacy Information Center (EPIC), said. “Washington, like most states, as an exemption in the public record’s law that allows for the government to redact information, if the disclosure of that information would violate the privacy rights of those individuals. And this seems like a pretty paradigm example of that. So, the government has the power and the responsibility to make sure when it is disclosing records and data that is personally identifiable, it’s taking the appropriate precautions.”
While Davisson argues contact information could have been redacted by the state in fulfilling a public records request for the online complaint form, multiple complainants argue they never knew their contact information could be publicized.
“I would have not given my name and contact information had I known it was not going to be kept private. I wouldn’t have done it,” a Spokane woman, who wished to remain anonymous out of safety concerns, said.
Another person, who received harassing texts and emails after her contact information circulated online, told the Seattle Times, “I’m disappointed the state did not do a better job of protecting our privacy and for not making it clear that our private information will become public if we submit a report.”
According to Davisson, it’s on the government to make sure it’s clear on what is considered public, and what isn’t, including options to remain anonymous. Multiple complainants claim they never knew entering their contact information was optional.
The governor’s office claims it was always optional, telling KHQ in a statement, “At no point did the form require names/emails/phone numbers to be submitted.”
A KHQ analysis shows the only wording indicating it was optional to enter contact info was added a month after WA’s complaint form went online. It now reads, “If you want this to be an anonymous complaint, do not include your name or contact information.” That sentence was not on the form on May 1.
“It is certainly the government’s responsibility, when they are collecting personal data, to look before they leap, to take privacy obligations seriously, and not to rely on a ‘bait and switch’, where a reasonable citizen using this form is going to expect their information is protected because, in one sense, they’re acting as a whistleblower,” Davisson said. “They’re identifying alleged threats to public health that they’re hoping the government will follow up on… whatever the technical configuration of this form was, then or now, it’s important for the government in Washington and elsewhere to take those privacy obligations seriously.”
Davisson said this “does pose a trust issue,” if members of the public do not feel their personal information is safe in the government’s hands. The lack of trust lowers the effectiveness of online complaint form or other state-supported systems to require providing personal information, like contract tracing apps.
“You can be sure that it won’t be effective, if the public doesn’t trust those systems and is not willing to participate in those systems because they think their privacy is going to be at risk if they turn over that personal data,” Davisson said. “It’s essential that those contact tracing systems also include robust privacy and civil liberties protections, but again – within the contexts of those apps and in other contexts, like this reporting form, if the government is seen as not protecting the privacy of its citizens, you’re never going to get the type of buy-in to that contact tracing app.”
