Vigilante grocers Is temperature screening of customers by retailers an ethical and valuable restriction on privacy and freedom?

Abstract

A.      Introduction

Before the COVID-19 pandemic, the protection of consumer privacy had reached a milestone with the enactment of the California Consumer Privacy Act (CCPA).[i] Stores that screen customers for elevated temperatures challenge the basic ethical underpinnings of the new law: that personal private medical data is to be controlled by oneself. The pinnacle of privacy and control over personal data, the CCPA as it applies to data being collected new ways could impede COVID-19 public health goals.[ii] Yet there is precedent to release personal medical information in other public consumer arenas. “Government has a unique role in public health”[iii] which now calls for extraordinary means to control the spread of COVID-19. In the absence of clear governmental guidance, companies must navigate public health and implement fair policies to promote safety, acting in what is traditionally government’s realm. Customers, as opposed to employees, would arguably be subject to data collection but not storage.[iv] Customers will be subject to actions that violate traditional notions of the doctor patient relationship, data privacy, and freedom. The actions can be justified as noncoercive, a public health necessity, and as less restrictive than keeping businesses closed. The justification does not necessarily imply that companies should be managing the public health task themselves. Temperature screening, important now as some stores selling essential goods are implementing it, will become more crucial as more indoor public spaces, malls, retail stores, and service industries reopen.

B.      Is temperature screening worth the sacrifice?

“In a liberal, pluralistic democracy, the justification of coercive policies, as well as other policies, must rest on moral reasons that the public in whose name the policies are carried out could reasonably be expected to accept.”[v] Temperature screening is not coercive: staying home is an option for customers (not employees). Another option is to arrive at the store, deny the screening, and be denied entrance to the normally open-to-the-public space, also negating the coercive aspect. The customer, having made the decision, would be free to leave. In certain industries, businesses have rules that more severely restrict people’s freedom and include the collection of personal medical information. In most cases, there is a legal requirement for the action. Airport scans, recently adapted to reveal less and preserve more privacy, are TSA-driven and not imposed on customers by airlines themselves. Airlines do have a lot of power to ensure that flights are safe, on balance, giving them power over personal data. Amusement parks are governed by rules and regulations by state, local, and the federal government that include height and weight requirements; they ensure safety by following laws as well as internal and industry guidelines. Even bungee jumping and zip-lining are regulated to promote safety in ways that may require demonstrating an absence of certain medical conditions. Customers must divulge personal information and medical histories. The permitting process in many industries requires proof of safety measures and agreement to hold inspections. From the customer perspective, the laws and regulations matter less than the action. Customers benefit from safe airlines and amusement parks and willingly give medical information in exchange for participation in air travel or amusement park entertainment. Temperature screening is within accepted standards of requirements to participate, justified by the public health it would promote and its non-coercive nature.

While many stores have nondiscrimination policies, the potentially contagious customer does not have any fundamental right to access that would override the public health concern. It is reasonable to accept and even embrace temperature screening knowing others inside the space will also have been screened. Temperatures often indicate the most contagious time in a viral stage and even non-COVID-19 temperatures can indicate contagious conditions. Temperature is usually protectable data: it is to be kept private if it is a product of a hospital or doctor’s appointment.

COVID-19 disproportionately affects certain populations including, most notably, the elderly. Reopening stores and businesses is an opportunity for those without special vulnerabilities wanting to go back to public space. Immunocompromised individuals may choose to protect themselves by staying home, wearing additional personal protective gear, or avoiding crowds. My own immunocompromised post-chemotherapy daughter is incredibly cautious, going to great lengths to protect herself regardless of government directives. She benefits from those directives because other members of our household are less likely to bring the virus home if public spaces are closed or engaging in temperature screening and enforcing social distancing and mask recommendations. Stay-at-home orders combined with other nonpharmaceutical interventions like closing schools and wearing masks in crowded spaces should work for flattening the curve.[vi] The strain on the economy and on personal liberty makes them unsustainable in the long term. A solution like temperature screening makes public spaces safer but may work best in conjunction with particularly vulnerable people continuing to avoid crowded public spaces.

There is an urgency to addressing the ethical basis for retail stores performing temperature screening as some stores have already begun. In Connecticut, LaBonne’s grocery stores began checking temperatures without recording data.[vii] Atlanta’s City Farmer’s Market chain is also screening its customers. Walmart has chosen to stay out of what it considers a public policy issue, refraining from testing customers’ temperatures.[viii] Greenburgh, New York, a municipality, is requiring grocery stores and pharmacies to check temperatures.[ix] Temperature screening is a valid and effective way of controlling the spread of COVID-19, and will become especially important when more businesses reopen.[x] It is reasonable to conclude that no one should be permitted entry into enclosed spaces with a fever. The efficacy of temperature checks has been debated with many public health experts in favor.[xi] Other countries that have successfully contained the virus have used temperature checks.[xii] This paper assumes enough efficacy to warrant some temperature screening policy -- some benefit or containment would derive from screening those entering public indoor spaces and barring those with a temperature of 100.4 or higher from entrance.

Temperature screening of customers has two rationales: under OSHA, such precautions protect employees by limiting exposure to customers who may carry the virus; and, the precautions serve the public health goal of transmission prevention. If reporting requirements or tracking ensued, the public health benefits would grow at the expense of control over one’s own data. Websites usually offer data restriction choices by using a pop-up. An in-person temperature screening is a new data point that companies (especially small retail companies) are not prepared to deal with. If any data is collected, customers should be notified about how the temperature would be used, who can access it, and how the customer would remain deidentified. Failing to track the febrile customer who might transmit the virus seems more ethically problematic than the privacy violation. Without government directives, stores would have trouble justifying saving or sharing the data for the sake of public health.

Public health initiatives required by law, permitted by law, and ones not addressed by law have different ethical implications. Efficacy alone would not allow stores to impede freedom and privacy more severely. Stores cannot detain those who display a symptom or refuse to wear a mask. Temperature screening must be within reason to be considered permissible. Stores like Walmart are using the absence of a governmental directive as an excuse to avoid an efficacious and sensible policy. Walmart is permitted to remain open as essential, a huge economic benefit. Customers may see Walmart’s stance as more ethical: valuing customer privacy and freedom. Stores like LaBonne’s are managing risk themselves to protect employees and the public. In Greenburgh, store employees can simply argue they are following a local government directive. Temperature screening should be accepted within a rights-driven, liberty-oriented society because it is a reasonable safety measure that creates the possibility of cautiously reopening many stores and public spaces. Some freedom is gained by a small loss of privacy and a different freedom.

C.       Privacy in public temperature screening

Privacy in the doctor patient relationship enhances value by promoting trust. Confidentiality promotes open communication with doctors and healthcare professionals. In COVID-19 customer temperature screening, the person taking the temperature is likely not trained in confidentiality and not HIPAA educated. Customers, traditionally not seen as patients, are operating outside of the traditional scope for the sake of the common good, allowing a non-invasive screening. Stores that screen customers should have a non-invasive thermometer that hovers and does not touch the customer. Evaluated by the principles of efficacy, necessity, and the least restrictive means, temperature screening may allow more freedom to move about and more businesses to open. Strict stay-at-home orders prevent the necessity for widespread screening, yet reopening stores creates a situation ripe for more pervasive temperature screening.

Companies, stores, the local government, or police have little to no experience with personal medical data collection in the sphere of retail goods and services. In some cases, people might ask for a private space for the temperature screening. Stores should provide such a space but realistically they probably will not, making the screening a public event. LaBonne’s is not storing the data but arguably an elevated temperature would be witnessed by others outside the store who may know the identity of the febrile customer as many shop among their friends and neighbors. Yelling the temperature over to a different employee would be a serious breach of privacy; the employee taking customer temperatures should be trained to be discreet.

D. An ethical lapse: the failure to record data that could improve public health and the economy  

The results (a high or normal temperature) bring up the ethical conundrum: if the customers are asked to leave, the data and the customer are still in limbo. As COVID-19 testing becomes more readily available, the customers could be referred to a COVID-19 testing site. Failure to track them could allow them to try their luck at another store, spreading the virus if in fact they do have it. For privacy, it would be best not to store any temperature data creating no metadata for the event. For public health, tracking those with an elevated temperature is worthwhile and has been helpful in other countries. The right thing for a business to do probably lies in between: for an elevated temperature, recommend an online doctor’s appointment or send the customer home to consider seeking medical advice. A government directive to report elevated temperatures for legitimate public health purposes like tracking is reasonable and would be an appropriate directive for stores to follow. Absent government use of the data, companies and stores should not be operating vigilante public health schemes that track and ban certain customers for extended periods, behavior that risks producing scarlet-letter-style stigma.

WHO goals to find, isolate, test, and treat every case would be furthered by tracking and testing those with elevated temperatures.[xiii] South Korea has in place a mechanism through apps and electronic bracelets to track those who test positive.[xiv] While their policies conflict with privacy and freedom, more businesses could reopen and more people could go more places while following social distancing and mask-wearing recommendations. The US population might be amenable to a model like South Korea’s when it is key to exercising freedom to move about in public, allowing workers to return to work, and consumers to enjoy stores and businesses. WHO seems not to envision its goals being handled by companies rather than public health authorities. The return to retail businesses and in-person services should be commensurate with a distinct protocol that fairly applies to all customers. The tradeoff for forgoing privacy is allowing stores to open, people to work, and consumers to consume.

D.      Ethical baseline: notice and informed consent

Notice of policies affecting customers is an ethical obligation. Companies should make a statement on a website and install signs announcing that temperature screening will begin on a certain date (official notice) and what the screening will entail. Businesses that require temperature taking could provide exceptions based on proof of antibodies or a current negative COVID-19 test, especially if the “immunity cards” considered by Anthony Fauci become widely circulated.[xv] Otherwise, there is no obvious expeditious way to request, accept, or deny an exception if the interaction is taking place outside on the curb instead of online.[xvi]

Kinsa, the thermometer company now well known for gathering temperature data, sells the data to pharmacies who use it for commercial purposes, specifically, to boost sales of products people with an elevated temperature might want.[xvii] Through a built-in feature, Kinsa avoids any type of consent of the unwitting customer. While no personal data accompanies the temperature data, Kinsa is profiting from the data in unexpected ways and stores’ notice to customers should include that type of data collection as well.

E.       Conclusion

Government entities should weigh in on stores and businesses imposing temperature screening as a condition of entry. The stores are ensuring employee safety and contributing to public health by conducting temperature screening. Absent government directive, companies should agree not to store or use customer medical information, despite the data’s valuable role in public health. A government order requiring reporting for the sake of tracking and isolating those with COVID-19 would be a proper use of government authority ensuring ethical data protocols. The data is essentially wasted in the absence of any reporting requirements. Hopefully, companies and customers will participate freely in screening to make shopping safer. As stay-at-home orders expire, government should oversee the uniform application of tracking and testing those with elevated temperatures. For now, the government vacuum in retail temperature screening is handing power to retailers and grocers who do not know quite what to do with it.

April 22, 2020

photo credit: Photo by Thomas Le on Unsplash

[i] AB375, Title 1.81.5, The California Consumer Privacy Act of 2018. California Civil Code, Part 4, Division 3.

[ii] Gavin Newson plans to enforce the CCPA beginning in July. “…in an email to Forbes, an “advisor” to the California Attorney General seemingly made it clear that the office intends to stick with the enforcement deadline of July 1, further issuing a stern warning to California businesses: “We’re all mindful of the new reality created by COVID-19 and the heightened value of protecting consumers’ privacy online that comes with it. We encourage businesses to be particularly mindful of data security in this time of emergency.”” Robert B. Milligan, John Tomaszewski, & Darren Dummit, “The Impact Of COVID-19 On The California Consumer Privacy Act,” Trading Secrets blog, April 6, 2020. https://www.tradesecretslaw.com/2020/04/articles/privacy-2/the-impact-of-covid-19-on-the-california-consumer-privacy-act/

[iii] Childress, James F., Faden, Ruth R., et al., “Public Health Ethics: Mapping the Terrain,” Journal of Law, Medicine, and Ethics, 30 (2002):170-178.

[iv] Employees and customers call for different treatment: employees rightly subject to some tracking and stored data. There is some government input with respect to employee temperature screening. The American with Disabilities Act (ADA) governs and the Equal Employment Opportunity Commission (EEOC), Occupational Safety and Health Administration (OSHA), some states, and the CDC have given broad guidance urging temperature screening in certain cases but not giving procedural advice. Wilmer Hale (law firm website), “COVID-19: Screening Employee Temperatures: What Employers Need to Know,” April 3, 2020. https://www.wilmerhale.com/en/insights/client-alerts/20200403-screening-employee-temperatures-what-employers-need-to-know; and see Justine Phillips, Paul Cowie, and Kelly Hensley, “Employee Privacy Forecast: Temperature Checks,” Labor and Employment Law Blog, March 25, 2020. https://www.laboremploymentlawblog.com/2020/03/articles/coronavirus/employee-privacy-forecast-temperature-checks/

[v] Childress, p. 171.

[vi] Markel, Howard, “What history revealed about cities that socially distanced during a pandemic,” PBS NewsHour online, April 20, 2020. https://www.pbs.org/newshour/health/what-history-can-teach-us-about-flattening-the-curve?fbclid=IwAR1CQzbfhiLm-1hmB586kt6RsCBPcI5Q8KwKaOmln_pyN9KKKpOSAsOJvGs

[vii] “LaBonne’s Markets to Take Customers’ Temperatures,” NBCConnecticut.com , April 8, 2020. https://www.nbcconnecticut.com/news/coronavirus/labonnes-markets-to-take-customers-temperatures/2251765/

[viii] Nathaniel Meyersohn, “Why stores could start taking customers' temperatures,” CNN Business, April 9, 2020. “Dr. Luciana Borio, former director for medical and biodefense preparedness at the National Security Council under President Donald Trump and former acting chief scientist at the FDA. "Even a modest benefit can be of value when our public health options are so limited in the absence of diagnostic tests, capacity for large scale contact tracing or a vaccine." Matthew Freeman, associate professor of environmental health and epidemiology at Emory University's Rollins School of Public Health, said it "makes sense for businesses to take the temperatures of shoppers to protect employees and patrons, but what would be the response if someone did indeed have a fever? A plan of action is critical."” https://www.cnn.com/2020/04/09/business/walmart-amazon-home-depot-whole-foods-temperatures/index.html See also https://sacramento.cbslocal.com/2020/04/09/coronavirus-grocery-stores-taking-temperature-reading/

[ix] Propper, David, “Supermarkets and pharmacies in Greenburgh could start taking temperatures of workers, customers,” Rockland/Westchester Journal News, April 9, 2020. https://www.lohud.com/story/news/coronavirus/2020/04/09/greenburgh-supervisor-wants-customers-and-workers-get-temperature-taken-before-entering-store/2974662001/ “Next week, when I extend the order I intend (unless otherwise directed by the state) to also require the non invasive taking of temperature of employees and customers. I don’t believe that people with temperature should be allowed into the stores --we all worry about the risk of being infected or infecting others.  Many people in Westchester are dying from the COVID-19 -partially because people are careless or inconsiderate of others.  Although NYS law authorizes me to issue the order - the Town Board unanimously approved a resolution endorsing the contents.”  Greenburgh Supervisor, Paul Feiner. https://greenburghny.com/CivicAlerts.aspx?AID=433

See also Kimmel, Robert, “Strict New Rules for Groceries and Pharmacies in Unincorporated Greenburgh to Combat COVID-19,” The Hudson Independent. https://thehudsonindependent.com/strict-new-rules-for-groceries-and-pharmacies-in-unincorporated-greenburgh-to-combat-covid-19/

[x] Meyersohn.

[xi] Meyersohn.

[xii] “Covid-19: Drones take Italians’ temperature and issue fines,” The Star, April 11, 2020. https://www.thestar.com.my/tech/tech-news/2020/04/11/covid-19-drones-take-italians-temperature-and-issue-fines Italy is using drones to enforce strict policies that ensure those with elevated temperatures are not out in public.

[xiii] Boseley, Sarah, “WHO urges countries to 'track and trace' every Covid-19 case,” The Guardian, March 13, 2020. https://www.theguardian.com/world/2020/mar/13/who-urges-countries-to-track-and-trace-every-covid-19-case ““You can’t fight a virus if you don’t know where it is,” the WHO’s director general, Dr. Tedros Adhanom Ghebreyesus, said at a briefing on Friday. “Find, isolate, test and treat every case to break the chains of Covid transmission. Every case we find and treat limits the expansion of the disease.””

[xiv] Josh Smith, Hyonhee Shin, and Sangmi Cha, “Ahead of the curve: South Korea's evolving strategy to prevent a coronavirus resurgence,” Reuters, April 15, 2020. https://www.reuters.com/article/us-health-coronavirus-southkorea-respons/ahead-of-the-curve-south-koreas-evolving-strategy-to-prevent-a-coronavirus-resurgence-idUSKCN21X0MO

[xv] Anthony Fauci, Director of the National Institute of Allergy and Infectious Diseases (NIAID, part of the NIH), is considering an antibody test immunity card to be carried as proof one has developed antibodies. Forgey, Quint, “Fauci: Coronavirus immunity cards for Americans are ‘being discussed,’” Politico, April 10, 2020. https://www.politico.com/news/2020/04/10/fauci-coronavirus-immunity-cards-for-americans-are-being-discussed-178784

[xvi] Milligan.

[xvii] “Taking people’s temperatures can help fight the coronavirus,” The Economist, March 26, 2020. https://www.economist.com/science-and-technology/2020/03/26/taking-peoples-temperatures-can-help-fight-the-coronavirus Users of Kinsa apps which offer medical advice based on temperature data are likely aware the company stores and sells the data. Thermometer users probably do not realize their temperatures are recorded or that the company can narrow down their location to the zip code.