The discussion of internet privacy rights and data collection policies in a national context has become more intimate than one might have expected. How could data collection, location tracking and monitoring of wireless internet use become any more personal? Recently, Tulane University instated temporary data collection policies in an effort to mitigate the spread of COVID-19 and to improve the effectiveness of contact tracing. With the advent of Tulane’s data collection policy, students are implored to consider their privacy rights as well as the effectiveness of and the intentions behind the university’s COVID-19 mitigation measures. 

Tulane’s data collection policies permit the location tracking of specific students via the Tulane wireless internet network, eduroam, and Splash Card system. The Wi-Fi network and Splash Card system provide the university with specific user information each time a device connects or disconnects with the wireless server or a Splash Card is tapped. The data collection process reports the identity of the user and a timestamp of when that user connected to or disconnected from the network to the university. 

Similarly, the Splash Card system documents the user’s identification number, the date and time, the specific location and building where the Splash Card was used, and the purpose for which the Splash Card was used. These purposes include food purchases, building access and guest access.

Indeed, it is within Tulane’s rights to collect students’ personal data, their legal basis being that it is “necessary to conduct Tulane’s legitimate interests.” In this case, the legitimate interest is the mitigation of COVID-19 outbreaks. However, are Tulane’s interim data collection policies purely the necessary means by which Tulane is conducting their legitimate interests as they pertain to COVID-19? Or, perhaps, could these heightened surveillance protocols be the gateway to an invasive, authoritarian administration style that will outlive the circumstances that called for its inception? 

An awareness of internet privacy rights is essential in order for students to protect themselves from inadvertently and unknowingly contributing to a system of authoritarianism. Certainly, Tulane’s data collection policies do not constitute a totalitarian regime, but it is nonetheless critical that we consider Tulane’s intentions and the rationale of further reducing our right to keep our data private. 

In an age in which data collection has led to the reification of the most intimate components of our very being, are Tulane’s policies absolutely necessary? Does Tulane’s data collection policy call for a small sacrifice on the part of students for the benefit of the greater good or is it an ineffective solution that infringes upon our privacy rights and condones invasive practices? To determine if Tulane’s data collection policies are a necessary and justified advent, it’s important to consider two questions: To what extent are these new policies effectively mitigating COVID-19? And, will resigning our rights to privacy in this instance be at the expense of future students’ online privacy rights?

Tulane’s traditional method of contact tracing, prior to its supplementation by digital methods, is modeled largely after the contact tracing procedure of Johns Hopkins University. The procedure, designed by medical professionals at Johns Hopkins, is the familiar process in which the positive person is contacted and interviewed by contact tracers in order to identify close contacts and prevent the chain of transmission. The procedure highlights the importance of personability and the ability to help positive patients recall the interactions they have recently had with others.  

According to the Johns Hopkins model, the disclosure of personal information, as it relates to those whom one spends his or her time, should be taken seriously by contact tracers who must prove themselves to be trustworthy to positive patients. The Johns Hopkins contact tracing model privileges intentional, respectful and transparent human interactions, a seeming contradiction to the intangible cyber tracking of Tulane’s new data collection policy.

If Tulane modeled their contact tracing after credible procedures at Johns Hopkins, which are characterized by interpersonal communication, by what are Tulane’s new data collection policies informed? There are no citations from any credible sources to support the case for Tulane’s policies, nor has any data been reported by the university regarding the effectiveness of these new policies for COVID-19 mitigation. Consequently, students are forced to comply by a new set of rules which are neither preceded nor proceeded by any evidence of their success. 

Perhaps these temporary, and evidently insignificant, policies are not a substantial issue worthy of being contested. It is this seeming insignificance, however, that makes these data collection policies all the more worthy of close attention. Tulane’s temporary monitoring of students’ internet use and Splash Card activity is, for the time being, invasive and apparently useless. Of more concern is the future of data collection policies at Tulane, the residual effects of these current policies, and the administrative style condoned by such policies. 

If data collection becomes obsolete with regard to mitigation of COVID-19, will the failure of current students to defend their privacy rights bequeath to future students an administration reliant on covert, impersonal and intrusive policies to engage with and monitor student activity? This, then, is the task of current Tulane students living through these unprecedented times. In a period characterized by uncertainty, we must be hyper-vigilant, we must not be ignorant in the face of the unknown, and we must challenge the world around us as we trudge forward into new domains.