On Monday evening, Philadelphia Health Department spokesperson James Garrow said the city had decided to end the partnership partly because Philly Fighting COVID recently updated the online agreement in a way that could let the group sell pre-registration data.
“The city has not been notified of any of these data having been sold,” Garrow wrote in an email. “But for PFC to have made these changes without discussion with the city is extremely troubling. As a result of these concerns, along with PFC’s unexpected stoppage of testing operations, the Health Department has decided to stop providing vaccine to PFC.”
People worried about use of data they entered into the site can contact the Pa. Attorney General to complain and suggest an investigation, said DC privacy attorney Kirk Nahra.
The city presumes anyone collecting registration data shares the city’s goal of getting as many people vaccinated as possible, said Health Department spokesperson Garrow, and that it would be “counterproductive” if Philly Fighting COVID were to refuse to hand over their data.
Kirk Nahra, who specializes in cybersecurity and privacy and is a partner at DC’s WilmerHale law firm, said the Philly Fighting COVID policy is so broad, there are items that don’t seem to refer to anything PFC does. For example, the agreement refers to “the performance of a contract”, which he said he does not understand in this context.
“That’s language that they probably borrowed from a website that the Gap had or … where you buy stuff,” Nahra said. “My guess is … the next 10 websites you went to … that weren’t like major media websites, if you looked at their privacy policies, they would look a lot like this.”
It’s line four: “You, the USER, agrees to allow the storage within any person for which you are legally entitled to for such purposes as may be necessary to provide you with services and information through COVIDReadi.”
“The sentence is confusing not because it is dense with legalese but because there is a grammatical error,” Schwartz said. “Terms of service need to be more clear than this.”
Lack of posted policy: Early warning sign
It’s unclear what people can do if they registered with Philly Fighting COVID and are worried about how their data may be used.
Kirk Nahra said that to bring a lawsuit, someone has to prove a site did something bad with their data, like if a site was collecting information about people’s sexually transmitted diseases and posting it publicly. But he said that people can certainly contact the Pa. Attorney General to complain and suggest an investigation.
Some had been worried about the Philly Fighting COVID site weeks ago. For years, Sarah Wipperman, a scholarly communications librarian at Villanova University, has been reading terms and conditions and privacy policies on websites, and was disappointed to find that the Philly Fighting COVID site did not have one.
“This one to me screamed: I need a second look, because some of those basic things weren’t in place.”
She added that though she has been reading these policies for years, she does not enjoy it, but does it because she wants to know how websites are going to use her data.
“It’s mentally taxing, something that should be simple like signing up for a quick website or signing up for an account for something takes like half an hour, an hour,” she said. “I definitely don’t like it, I wish I didn’t have to do it.”
She has given up on products and services because she disagreed with the terms and conditions. For instance, when she was moving apartments last year, she found one that she liked and got an offer for, but the contract included mandatory arbitration, which means disputes have to be resolved out of court behind closed doors, and a line saying she was not allowed to have kitchen knives. She asked about the lines she objected to, and the landlord took back the offer.
Deciding whether or not to sign up for the Philly Fighting COVID vaccine registry was a harder decision, because there are alternatives for apartments, but earlier in the month, Philly Fighting COVID was the only site registering people for vaccines in Philadelphia.
“I (was) terribly divided as to whether or not I kind of want to put aside all of these issues I have with terms of service, privacy policies and just do it because I feel like it’s a good civic thing for me to do,” she said. “This is something that’s definitely beyond me, it’s something that impacts our entire city.”
She ultimately did not register with Philly Fighting COVID.
Get daily updates from WHYY News!