When Is It Tortious to Report on Someone's Positive COVID Result?

A privacy controversy in a lawsuit by privacy advocate Marc Rotenberg (formerly of EPIC, the Electronic Privacy Information Center).

Marc Rotenberg is a prominent privacy advocate and founder and former long-time president of the Electronic Privacy Information Center. (He is now the Executive Director of the Center for AI and Digital Policy at the Michael Dukakis Institute.) His work on privacy, for instance, has often been mentioned in Reason, as well as in many other publications.

Last March, when Rotenberg was still heading EPIC, he apparently tested positive, but apparently didn't immediately inform his EPIC colleagues. (See the end of this post for why I interpret the Complaint as taking the view that those allegations are factually accurate.) Protocol, which is a tech news site backed by the publisher of Politico, and Politico wrote about this, and yesterday Rotenberg sued them for tortious disclosure of private facts:

[332.] The Protocol chose to make public the confidential medical diagnosis of Marc Rotenberg.

[333.] The publication of an individual's medical status was at the time, and remains to this day, contrary to medical practice, and the recommendations of the Center for Disease Control, the World Health Organization, the D.C. Health Agency, the President's Coronavirus Response Coordinator, and the workplace guidelines of the Occupational Safety and Health Administration for safe and healthy working conditions.

[334.] The Center for Disease Control has made clear the need to protect patient identity to facilitate contact tracing. Under the heading "Certain core principles of case investigation and contact tracing must always be adhered to," the CDC states "To protect patient privacy, contacts are only informed that they may have been exposed to a patient with the infection. They are not told the identity of the patient who may have exposed them." …

[337.] As the World Health Organization explained in May 2020 (echoing points Marc had made throughout his career in testimony before Congress, appellate briefs, and public lectures described above), "Member States can achieve their public health objectives while protecting fundamental rights, such as privacy, at the same time."

[338.] [A] UN statement repeatedly emphasized the need to protect privacy in the battle against COVID:

Any data collection, use and processing by UN System Organizations in the context of the COVID-19 pandemic should be rooted in human rights and implemented with due regard to applicable international law, data protection and privacy principles, including the UN Personal Data Protection and Privacy Principles.

[339.] Privacy safeguards for pandemic responses were also well known in the United States. A widely available non-profit guide to workplace safety, based on the federal Occupational Safety and Health Act of 1970 (OSHA), states:

Employers have a duty of care to their employees, and thus may be required to provide employees with information on the spread of a pandemic illness, take protective measures against the spread of the contagion, and provide warning if employees may have been exposed to someone diagnosed with the disease (but not identifying that individual)….

[341.] Privacy of contact tracing information is central to the design of the DC contract tracing app. The DC government emphasized that "persons who test positive are not identified by the system to other users …" (emphasis in original)….

[342.] Current practices for the DC government continue to protect the identity of a person who has tested positive from COVID from other employees….

[343.] Then-Presidential candidate Joe Biden, informed by the world's leading experts in infectious disease, wrote in The New York Times the very same week as The Protocol article critical of Marc Rotenberg for following the procedures for contract tracing, "there needs to be widespread, easily available and prompt testing—and a contact tracing strategy that protects privacy." (emphasis added) …

[346.] Neither The Protocol's reporter Issie Lapowsky nor The Protocol's Executive Editor Tim Grieve made any attempt to determine whether Marc's conduct was contrary to medical practices. Not a single expert was asked whether it would be consistent with medical practices for a person who received a positive test for COVID to make public that fact.

[347.] A simple Internet search for "contact tracing" and "privacy" would have quickly made clear that Marc did precisely what he was supposed to do, contrary to The Protocol's reporting.

[348.] The Protocol had constructed a 'house of cards," an 'inherently implausible story" that Marc acted without regard to medical advice, that Marc believed that "privacy trumped surveillance," and that EPIC was in "turmoil."

[349.] To characterize Marc's conduct as The Protocol did required total disregard of the relevant scientific and medical information.

[350.] The publication of a particular person's confidential medical condition with the intent to injure or cause harm to that person would be highly offensive to a reasonable person.

[351.] The Protocol's reckless disregard for the best practices for the protection of sensitive medical data is reprehensible and would discourage many from attempting to comply with public safety initiatives underway across the country to battle the pandemic.

Now D.C. law (which applies in this case) does recognize the tort of disclosure of private facts:

(1) publish[ing] private facts (2) in which the public has no legitimate concern and (3) which publication would cause suffering, shame, or humiliation to a person of ordinary sensibilities.

Publishing a person's confidential medical information—for instance, that an ordinary private citizen has cancer—would sometimes qualify, because often these are private facts that people would feel humiliated to have publicly aired, and in which the public has no legitimate concern. (I have criticized the tort on First Amendment grounds, but most American jurisdictions do recognize it despite the First Amendment concerns, though they tend to read the "legitimate public concern" exception broadly.)

But the question here is more specific: Does the public have a legitimate concern in the positive COVID test results of

1. a prominent privacy advocate,
2. who didn't disclose the results to colleagues who might have been infected, and
3. who was commenting publicly (including to members of Congress) about "the protection of medical privacy amidst efforts to combat the spread of the novel coronavirus."

This question—when can media outlets and other private speakers be legally forbidden from speaking about certain matters?—is of course separate from the question of what privacy rules control government agencies, or what is seen by medical professionals (foreign or domestic) as best practices. And we might get an answer to this disclosure-of-private-facts-tort question soon, though it's possible that we'll get in D.C. Superior Court (on an anti-SLAPP motion) and not in the federal district court (presumably on a motion to dismiss); more on that procedural twist in a later post as well.

[UPDATE: I meant to note that there was also a libel claim, which is interesting for other reasons; I will blog about that in a later post.]

[* * *]

Note that, when the Complaint claims various assertions in the news stories were false, here's what it says about the test results:

[122.] The Protocol further "reported" that in an email to staff Marc, "did not mention that his COVID-19 test had come back positive that very morning."

[123.] That statement presumes an action—namely, revealing the identity of individuals who had tested positive for coronavirus—that is directly contrary to widely established practices for public safety….

[195.] The Protocol falsely and maliciously stated that "Marc Rotenberg came to work and held meetings after his doctor directed him to take a test that later came back positive," falsely and maliciously implying that he acted contrary to medical advice.

The Complaint thus seems not to be denying that the test did come back positive, and that Rotenberg indeed didn't disclose it; and that's consistent with there being a disclosure of private facts claim, which is based on publication of true statements, and not of false ones. (Note also paragraph 332, "The Protocol chose to make public the confidential medical diagnosis of Marc Rotenberg.")