A Legal Minefield

COVID-19 preventive measures are being enforced nationally, provincially, locally and sometimes down to the block or even to specific buildings. Indoor spaces pose a higher likelihood of people getting infected, while some FMs are classified as essential workers who must keep security and operations going during these challenging times. While some regions have started reopening from wider lockdowns, owners and FMs are tasked with responsibly reopening their facilities and ensuring their tenants and visitors are and feel safe to return. In addition to providing hand-sanitizing gel, facemasks and temperature readings, public health authorities have started imposing contact and facility tracing. All of these factors combined create a treacherous legal minefield for owners and FMs to navigate.

The minefield creating legal & financial risk

Owners and FMs must operate and maintain health and safety standards, and in this COVID-19 world, special scrutiny will be applied to those facilities that host large groups of gatherings. But what does healthy and safe mean now and what types of legal regimes could apply? The answer will depend on the jurisdiction, but some general legal areas include building code, public health and safety, employment, real estate, disability, human rights, and any COVID-19-specific laws and regulations. In the U.S., a class-action lawsuit is filed against McDonald’s for allegedly failing, in part, to have notified employees of their potential exposure to COVID-19-positive individuals, or in other words, for failing to have a contact tracing plan. Property and casualty insurers have taken notice of the need for contact tracing.

As companies and facilities prepare for a phased re-entry of buildings, a number of national and local laws and regulations have developed and will continue to develop, requiring owners and FMs to implement protocols and safety procedures to mitigate potential liability. In New York state, health authorities require owners and FMs to track and trace their tenants and visitors.

To the extent possible, responsible parties should make best efforts to maintain a log of every person, including their own employees and visitors, who may have close contact with other individuals at the building; excluding deliveries that are performed with appropriate PPE or through contactless means. Logs should contain contact information, such that all contacts may be identified, traced and notified in the event an employee or visitor is diagnosed with COVID-19. Responsible Parties must cooperate with state and local health department contact tracing efforts.

In New York state, the owner and FM also must notify all entities occupying space in the building immediately with information on where someone who has shown symptoms has been near their section of the building and the respective cleaning and disinfection procedures taken. Presumably the owner and FM will need to keep a record of such notices having been delivered and received, as a simple email may not suffice for liability purposes.

To make matters more challenging, owners and FMs must meet all of these legal obligations while respecting the privacy rights of tenants and visitors. For example, consumer data privacy regimes, such as the California Consumer Privacy Act (CCPA) and the European Union General Data Protection Regulation (GDPR), could apply to facilities outside of those jurisdictions if their citizens visit those facilities.

What is contact tracing

A historically effective epidemiological tool to fight pandemics such as COVID-19 is contact tracing, or the process of identifying people who may have come into contact with a COVID-19-positive person. The purpose is to notify those contacts, so they can take appropriate action and notify their contacts.

The table below lays out the four general ways to conduct contact tracing along with each method’s benefits and challenges.

Method	Process	Challenges
Manual/contact relationship management/database	Based on people’s notes and memories of where they have been for the previous 14 days and with whom they may have come into contact. A person working with the public health authority records those contacts (manually, or a CRM database) and tries to reach out to all the individuals. Most respective of privacy.	People’s memories and notes are not perfect. They may choose not to cooperate. They may lack the contact details of people potentially exposed. Anecdotal reports of fraudsters pretending to be contact tracers calling people to obtain their private information.
Camera surveillance	Install cameras throughout the entire facility. Using facial recognition and computer vision, digitally capture every person’s movements to create a digital record of every person’s actions and people’s interactions with each other. No friction to engage, capture everyone as soon as they get near/on premises.	How is consent obtained? Will it stand up in litigation? Capturing biometrics could create more liability problems for the owner and FM. A database of tenant and visitor biometrics becomes a more desirable target for hackers. Biases for people with non-Caucasian facial features. How would compliance with personal data removal work? May be illegal in some jurisdictions.
Location tracking via beacons or GPS	Track people by matching their time-stamped location data using GPS or beacons, not actual proximity to each other. Allows authorities to track geographic areas where infections may be spreading.	Users must download an app. Accuracy issues due to lack of vertical awareness (which floor of a building). High data usage and drains battery life on devices. May be illegal in some jurisdictions.
Actual proximity based on smartphones/mobile apps	Automatically record interactions when people are physically near each other with Bluetooth Low Energy. Light battery usage, no human error. Faster to gather information and to swing into action. Speed is critical and can be very effective.	Users must download an app and keep Bluetooth on. Most smartphone solutions are for public health authorities and not for private sector use such as facilities.

Does contact tracing really work?

A jurisdiction such as Taiwan that has powerful pandemic fighting tools due in part to its robust contact tracing program has done a better job fighting COVID-19.

Compare:

As of 7/7/20	Population	Confirmed COVID-19 cases	Confirmed COVID-19 deaths
Taiwan	23.78M	449	7
Australia	24.99M	8,886	106
United Kingdom	66.65M	287,880	44,476

A number of nations have built or are building smartphone apps as a tool for its citizens and residents to opt-in to a national contact tracing program. This would theoretically produce higher quality results with less human labor. These national contact tracing apps thus far, however, are not meeting expectations for various reasons, including a lack of sufficient percentage of population downloading and using the mobile app.

Moreover, in many jurisdictions, including some parts of the U.S., owners and FMs may be required to have their own contact and facility tracing solutions regardless of any state or national contact tracing app. If a nation’s public contact tracing effort falters, the more the private sector will be expected to pick up the slack.

Facility tracing

In New York (and possibly other jurisdictions), in addition to providing contact tracing, a facility may be required to apply special cleaning procedures to any areas where someone tested positive has spent time on site. That means FMs need not just a way to trace contacts but map the path and duration that person took inside the facility.

The need for facility tracing is still being hashed out in the public health domain as scientists work to understand how COVID-19 is transmitted. But there has already been an alarming case in China where "[o]ne asymptomatic carrier rode an elevator alone, then 70 people got COVID-19.” No facility owner or FM would want a headline like that. A contact tracing only solution and a temperature check at the entrance would not have prevented that.

While FMs will keep the entire facility clean, facility tracing just offers that extra bit of insight and assurance that they provide a deeper clean to those sensitive areas such as bathrooms and elevators, where an infected person has been. Without this insight, the environment the user is moving through could be helping spread the virus to more people at the facility even without coming into contact with them.

Notifications (& records retention)

In some jurisdictions, FMs also may have the responsibility to notify tenants of certain COVID-19-related events, such as someone on site having tested positive. Owners and FMs in litigious areas may want to consider keeping a record of delivery and potentially receipt by the tenant of such notices.

Some suggestions

Owners and FMs should get proactive and start planning their own contact and facility tracing and tenant notification programs.

Choosing an app-based solution means real user consent (they downloaded and registered to use the app) and could potentially provide contact tracing, facility tracing and messaging/notification capabilities in one. In addition, the FM can outsource consumer data privacy compliance needs to the app-based solution provider, who would be better equipped to handle such matters.

While there may already be a sea of products available, most offer only a piece of the puzzle. Owners and FMs should look for vendors who can provide all three services as that would help them navigate this minefield of legal issues.