Personal Data Privacy During an Unprecedented Pandemic

Personal data is a complicated asset. The use of personal information for the provision of a service, research purposes, identity verification, and a countless array of other objectives that range from benign and boring, to potentially predatory and malicious, has become ubiquitous in modern society. Personal data is an extremely valuable tool; it is capable of being leveraged to inform decisions and policies, and reach such specific and targeted conclusions to complicated questions, that it borders on clairvoyance. As is often the case, there are two sides to this coin. Personal data also presents substantial risk, to the individuals to which that data pertains, and to the organizations using it, which now needs to operate under ever-increasing regulation. Governments and companies alike are rushing to leverage personal data to its utmost capacity and bring this pandemic to a speedy end, while still maintaining the privacy of the sick and vulnerable.  

For a law aimed to increase the protection of personal information, it is perhaps surprising that there are provisions within the European Union’s General Data Protection Regulation (GDPR) that allows for the suspension of the rights and requirements of the legislation. Responding to the COVID-19 outbreak is the first instance in which these provisions have been exercised. To better equip itself to fight the spread of COVID-19, the EU is suspending GDPR and loosening restrictions on the processing of what the law calls “special categories” of personal information. These special categories were created to place firmer limitations on types of personal data that presented increased risk, such as race/ethnicity information, political affiliations, and sexual orientation. However, also within this group of special categories is health data. Privacy protections were put in place to benefit the public, but under current circumstances curtailing the access to, and use of valuable health data, it would work against that interest. As a result, France now allows the transfer of personal health data to “any partner involved in the control, prevention and evaluation of the epidemic, in particular the General Directorate of Health.” Italy has issued an ordinance permitting the processing of any personal health data “necessary for the performance of the civil protection function.” Even the U.S. Department of Health and Human Services has announced that there are multiple scenarios under which covered entities may share personal health information without an individual’s consent in order to combat the virus.

This loosening of reins, however, is not absolute. While it is completely reasonable to determine that such a public crisis requires more flexibility, the risks of processing personal data are still very much present and in need of mitigating. Even the ways in which suspensions are being made to the GDPR requirements seem to reflect this fact. Italy’s new ordinance is effective only until July, and France limits its new data sharing policies to “only the data strictly necessary for the accomplishment of the mission.” While some sharing of HIPAA protected health data within the United States may now be permissible under the cover of serving public health interests, it is still important to protect an individual’s privacy and only share such information to those with a legitimate need to know basis.

As individual enterprises look to their own practices to make decisions regarding COVID-19 and their employee’s personal data, risks will need to be evaluated; in terms of the potential harm to the individual, and the potential benefits to the enterprise and individual, arising from the release of information. As a result, there are items that should be on an enterprise’s checklist to help them weigh the balance:

  • Do not reveal the identities of individuals to the public or provide information that could accurately identify people who are under investigation for exposure to COVID-19.
  • Be prudent with your employees in sharing the latest CDC information regarding prevention and efforts by government and businesses in limiting exposure of people to COVID-19.
  • Use continued due diligence in collecting, using, and storing health information of employees. Publicizing of employees who have contracted the disease is counterproductive.
  • Assess your organization’s third-party relationships, including business and strategic partners, which might involve the transfer, sharing or release of employee data.
  • Ensure that proper authentication and authorization controls are in place to access sensitive information. How does the organization verify the identity of calls wishing to either access their health information or inquire about the status of its employees?
  • Assure your employees of the continued control posture that their data is maintained in the enterprise. Continue to educate employees regarding your organization’s privacy policy.
  • Continue with security efforts to monitor networks and access for anomalies, since others may think your attention is diverted to pandemic issues.

Data privacy regulations are still attempting to nail down the balance between extracting value from personal data and protecting the individuals that are the sources of such data. The managing of the COVID-19 outbreak by governments worldwide will represent the equivalent of case law, further fine-tuning our understanding of where and when to protect personal data, and where and when to leverage it.

Sources:

In Response to COVID-19 SBA Disaster Assistance Offering Low Interest Loans

In response to the novel coronavirus (COVID-19) pandemic affecting the small business community across the country, the U.S. Small Business Administration (SBA) is offering low-interest federal disaster loans for working capital to small businesses suffering substantial economic injury. Substantial economic injury means the business is unable to meet its obligations and to pay its ordinary and necessary operating expenses. $50 billion in funding has been set aside for the program.

SBA’s Economic Injury Disaster Loans offer up to $2 million in assistance per small business and can provide vital economic support to small businesses to help overcome the temporary loss of revenue they are experiencing.  The loans can be used to fixed debts, payroll, accounts payable and other bills that can’t be paid because of the disaster’s impact.

Loans will be underwritten by the federal SBA program. The interest rate is 3.75% for small businesses without credit available elsewhere, and 2.75% for non-profit organizations.  Businesses with credit available elsewhere are not eligible. The loans offer long-term repayment terms in order to keep payments affordable, up to 30 years, and will be determined on a case-by-case basis based upon each borrower’s ability to repay.

While the loans are offered through a federal program, they are administered through the application by governors of states and territories to be included and considered a designated state or territory. Once a declaration is made by SBA for designated areas within a state, the information on the application process for Economic Injury Disaster Loan assistance will be made available to the affected communities and updated online at SBA.gov/disaster.

Most states and territories are still in the process of applying to be a designated area for Economic Injury Disaster Loan assistance. As part of this process, many states are asking businesses to fill out and submit surveys on the state of their business to better understand the need in their area. As of this publication, the following states and contiguous counties have been declared designated areas:

  • District of Columbia (Contiguous Counties: Montgomery and Prince George, Maryland; Alexandria City, Arlington and Fairfax, Virginia)
  • Maine (Contiguous Counties: Carroll, Rockingham and Strafford, New Hampshire)
  • Montana (Contiguous Counties: Clearwater, Fremont and Idaho, Idaho; Divide and Williams, North Dakota; Park and Teton, Wyoming)
  • Nevada (Contiguous Counties: Mohave, Arizona; Cassia, Owyhee and Twin Falls, Idaho; Harney and Lake, Oregon)
  • New Mexico (Contiguous Counties: Apache and Greenlee, Arizona; Archuleta, Costilla, La Plata, Las Animas and Montezuma, Colorado; Andrews, Cochran, Deaf Smith, El Paso, Gaines, Hartley, Loving, Oldham, Winkler and Yoakum, Texas)
  • Rhode Island (Contiguous Counties: New London and Windham, Connecticut; Bristol, Norfolk and Worcester, Massachusetts)
  • Utah (Contiguous Counties: Apache, Coconino, Mohave and Navajo, Arizona; Dolores, Mesa, Montezuma, Montrose and San Miguel, Colorado; Sweetwater and Uinta, Wyoming)
  • Washington (Contiguous Counties: Benewah, Latah and Nez Perce Idaho; Gilliam, Hood River, Morrow, Sherman, Umatilla and Wasco, Oregon)

The list of designated areas will continue to be updated as states and territories apply and are approved.  You can check this list at sba.gov/disaster-assistance/coronavirus-covid-19.  Our team will be continuously monitoring the program as it expands and details on how businesses can apply within each state are released.

How Manufacturers Can Navigate the Novel COVID-19 Impact on Supply Chains

The novel coronavirus (otherwise known as COVID-19) crisis has struck a serious blow to the manufacturing industry, which was already battling trade policy turbulence, a slowdown in global manufacturing growth and broader economic uncertainty. The virus’ disruptive impacts are rippling throughout global manufacturing supply chains, particularly in the auto sector. Automakers rely heavily on China for auto parts, and some major automakers have temporarily closed plants in South Korea and Japan due to supply shortages, while others are racing to find alternative sources of supply in Europe or elsewhere. Not all parts can be easily sourced elsewhere, however, and some automakers may not have any other option but to wait out the crisis.

COVID-19 isn’t the only issue plaguing supply chains. Even before the virus became a global crisis, manufacturers had to contend with the disruptive impacts of U.S. trade policy. According to BDO’s Manufacturing CFO Outlook Survey, 21% of manufacturers say they’ve experienced a disruption to their supply chain as a result of government restrictions in the last 12 months.

We’ve summarized some of the crisis’ specific impacts to manufacturers below:

Supply shortages and increased prices: Until affected factories can resume production, manufacturers will need to rely on inventory stockpiles. However, these resources are limited and will run out eventually. When existing inventory runs dry, we can expect to see shortages and / or price increases throughout supply chains if alternate sources aren’t secured.

Fulfilment delays: Quarantines, travel restrictions, and workforce shortages can make it difficult or impossible for impacted manufacturers to fulfill their contractual obligations to their customers. A shortage or delay of products can seriously impact a company’s reputation and may result in lost customers or even legal consequences.

Increased transportation prices: Once factories can resume production, companies will likely rush to get their operations back online and make up for lost time, which could cause a sharp increase in transportation prices.

Economic impacts: The COVID-19 crisis does not end when the outbreak is finally contained. How fast the economy—and the Chinese economy in particular—will be able to rebound from the crisis is yet to be seen, and any slowdown in global demand may exacerbate existing headwinds for U.S. manufacturing, which was already nearing a slump at the end of 2019. The Phase 1 U.S.-China deal provided some relief to manufacturers, but the coronavirus crisis could impede China’s ability to fulfil its end of the trade agreement and delay any Phase 2 deal negotiations.

Reputational impacts: A brand is a promise, and a company needs to consistently deliver on that promise to keep the brand strong. When a company fails to deliver on that promise—even if that failure is due to forces beyond the company’s control—reputation can take a serious hit. The way manufacturers respond to COVID-19 delays or shortages will be an important dimension of longer-term brand preservation. Viewed with the right lens, manufacturers’ response to the novel coronavirus is an opportunity for competitive differentiation. During times of crisis, demonstrated leadership, transparency and communication are highly valued and can earn customer loyalty.

The virus and last two years of trade turbulence have uncovered a prevalent problem in the manufacturing industry: a lack of geographic diversification in supply chains. The combined disruptive impacts of U.S.-China geopolitical tension and the coronavirus crisis have made it clear that manufacturers cannot be so dependent on one location for supply—namely, China.

To help get you started on protecting your supply chains against future unexpected crises, we’ve outlined six key considerations for supply chain planning that manufacturers should factor into their sourcing strategies.

Geographic diversification: The coronavirus crisis is the latest proof that manufacturers need to revisit their sourcing strategies and consider reducing dependence on China or any one major location. Many manufacturers were already having these conversations as a result of the last two years of trade policy disruptions—according to BDO’s Manufacturing CFO Outlook Survey, 36 percent of manufacturers have considered countries other than China for sourcing. By shifting supply sources to a variety of countries, companies can reduce the impact of natural disasters or government regulations on their businesses. When evaluating changes to supply chain operations, manufacturers will need to assess potential exit charges, permanent establishment status and the preservation of tax attributes on the movement of functions, assets and risks.

Increase visibility: Technologies such as cargo-tracking, automated warehousing, cloud-based GPS and RFID introduce increased visibility into nearly every part of the supply chain. Surprise disruptions, which used to occur in supply chain blind spots—meaning areas where companies didn’t even realize supplies traveled—are less common as a result. By capitalizing on these technologies and increasing their real-time visibility into every part of the supply chain, companies can more proactively identify areas of potential risk prior to an issue, or more quickly notice and respond to a disruption that does occur.

Sales and operations planning: This crisis has changed demand in one way or another for nearly every manufacturer. Some have seen significant increases in demand for basic consumer goods, others have seen demand shift from various products or customer types, while others have seen demand fall with the uncertain economic environment. This is an important time for manufacturers to be agile in reacting to these changes and plan production, distribution, and inventory investments to optimize their reaction to these fast-moving challenges and opportunities. 

Conduct a business continuity risk assessment: Although companies cannot predict when a public health crisis or other natural disaster might occur, they can help mitigate the effects of unexpected disruptions by carrying out risk assessments. They may identify potential internal operational, financial and market risks, determine direct and indirect impacts, and generate contingency plans in case of unexpected disruptions.

Review your insurance coverage: Manufacturers should familiarize themselves with their insurance policies so they are aware of the extent of their coverage. In the case of a public health crisis such as the coronavirus, companies should pay close attention to whether their insurance coverage contains a Communicable Disease Exclusion or not.

Engineer resilience and introduce agility for the future: The best opportunity for lasting change is crisis. Once manufacturers have immediate mitigation measures in place, they should consider how they might reengineer their supply chain to be resilient by design, factoring in increased complexity and uncertainty as the new normal. In the months and years ahead, effective supply chain risk management will be all about agility and systems thinking. The supply chain itself must be viewed as an interconnected, interdependent network. Truly agile supply chains require end-to-end visibility across the entire supplier ecosystem, relying on real-time data to identify shifts in demand or disruptions faster and adapt to sudden changes faster. The agile supply network will eventually replace traditional lean approaches.



This article was written by Jeff Pratt and Sean Murphy and originally appeared in BDO USA, LLP’s “Insights” newsletter (Winter 2020). Copyright © 2020 BDO USA, LLP. All rights reserved. www.bdo.com