What This Bill Does
**
This bill creates new rules to protect people's personal health and location information from being collected, sold, and used for advertising without their permission. Companies that collect or sell this type of data must get clear written permission from individuals and give them the ability to see what data is kept about them and delete it.
**
Who It Affects
**
- Any company, organization, or person that collects or uses health or location data from people
- Data brokers (companies that buy and sell personal information)
- Internet service providers and phone companies
- Non-profit organizations
- Individuals whose health or location data is collected
- The Federal Trade Commission (enforces the rules)
**
Key Provisions
**
- Companies cannot use health data for commercial advertising without the person's clear written permission, and they can only collect and keep health data if someone asks for a specific product or service (Sec. 2(a) and 2(b))
- Data brokers are banned from buying, selling, or sharing location data with anyone (Sec. 3(a) and 3(b))
- Companies must give people an easy way to see all their health and location data and request that it be deleted within 15 days, at no cost (Sec. 4)
- Companies must publish a clear privacy policy explaining what data they collect, why they collect it, who they share it with, and how people can control their information (Sec. 2(d))
- Employees and contractors can only access health data if they need it to provide the service the person requested (Sec. 2(c))
**
What Changes
**
If this bill becomes law, companies would be prohibited from selling or sharing people's health information for advertising purposes without getting specific written permission first. People would gain the legal right to see what health and location data companies hold about them and demand deletion of that data. Companies would have to maintain public privacy policies and limit who inside their company can see this sensitive information. Data brokers would be completely banned from trading in location data.
**
Important Definitions
**
- **Health data**: Information that identifies or reveals someone's search for health services, any past or present physical or mental health condition, medical treatment, or any information derived from non-health information that reveals health details (like inferring someone's disability from their browsing history)
- **Location data**: Information showing where a person or device was at a specific time with precision to within 1,850 feet or less
- **Express consent**: Clear, written, opt-in permission from a person that must be obtained before collecting or using their data (and cannot be assumed from just hovering over content, muting something, or using a confusing website design)
- **Data broker**: A person or company that collects, buys, or infers data about people and then sells or trades that data
- **Covered entity**: Any company or organization doing business in the United States that collects or uses health or location data (except certain healthcare providers already regulated under federal health privacy law)
- **Commercial advertising**: Messages that promote the sale of or interest in goods or services, including digital, video, audio, or print ads
**
Effective Date
**
The rules become effective on whichever comes first: either the date the Federal Trade Commission issues final regulations to carry out the law, or 180 days after the bill becomes law (Sec. 6).
II
118TH CONGRESS
1ST SESSION
S. 631
To protect the privacy of personally identifiable health and location data,
and for other purposes.
IN THE SENATE OF THE UNITED STATES
MARCH 2, 2023
Ms. KLOBUCHAR (for herself, Ms. WARREN, and Ms. HIRONO) introduced the
following bill; which was read twice and referred to the Committee on
Commerce, Science, and Transportation
A BILL
To protect the privacy of personally identifiable health and
location data, and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Upholding Protections
4
for Health and Online Location Data Privacy Act of
5
2023’’ or the ‘‘UPHOLD Privacy Act of 2023’’.
6
SEC. 2. PRIVACY OF HEALTH DATA.
7
(a) PROHIBITION ON THE USE OF HEALTH DATA IN
8
COMMERCIAL ADVERTISING.—It shall be unlawful for any
9
covered entity to use the health data of an individual that
10
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
2
•S 631 IS
is collected from any source (including data volunteered
1
by an individual, medical center-derived data, data from
2
a wearable fitness tracker, data from web browsing his-
3
tory, or any other source determined appropriate by the
4
Commission) for commercial advertising.
5
(b) MINIMIZATION
OF COLLECTING, RETAINING,
6
USING, AND DISCLOSING HEALTH DATA.—A covered en-
7
tity may not collect, retain, use, or disclose health data
8
except—
9
(1) with the express consent of the individual to
10
whom such data relates; or
11
(2) as is strictly necessary to provide a product
12
or service that the individual to whom such data re-
13
lates has requested from such covered entity.
14
(c) MINIMIZATION OF EMPLOYEE ACCESS.—A cov-
15
ered entity shall restrict access to health data by any em-
16
ployee or service provider of the covered entity to only such
17
an employee or service provider for which access is nec-
18
essary to provide a product or service that the individual
19
to whom such data relates has requested from the covered
20
entity.
21
(d) PRIVACY POLICY.—
22
(1) POLICY REQUIRED.—A covered entity shall
23
maintain a privacy policy relating to the practices of
24
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
3
•S 631 IS
such covered entity regarding the collecting, retain-
1
ing, using, and disclosing of health data.
2
(2) PUBLICATION REQUIRED.—If a covered en-
3
tity has a website, such covered entity shall promi-
4
nently publish the privacy policy described in para-
5
graph (1) on such website.
6
(3) CONTENTS.—The privacy policy described
7
in paragraph (1) shall be clear and conspicuous and
8
contain, at a minimum, the following:
9
(A) A description of the practices of the
10
covered entity regarding the collecting, retain-
11
ing, using, and disclosing of health data.
12
(B) A clear and concise statement of the
13
categories of such data collected, retained, used,
14
or disclosed by the covered entity.
15
(C) A clear and concise statement of the
16
covered entity’s purposes for the collecting, re-
17
taining, using, or disclosing of such data.
18
(D) A list of the specific third parties to
19
which the covered entity discloses such data,
20
and a clear and concise statement of the pur-
21
poses for which the covered entity discloses
22
such data, including how the data may be used
23
by each such third party.
24
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
4
•S 631 IS
(E) A list of the specific third parties from
1
which the covered entity has collected such
2
data, and a clear and concise statement of the
3
purposes for which the covered entity collects
4
such data.
5
(F) A clear and concise statement describ-
6
ing the extent to which an individual may exer-
7
cise control over the collecting, retaining, using,
8
and disclosing of health data by the covered en-
9
tity, and the steps an individual must take to
10
implement such controls.
11
(G) A clear and concise statement describ-
12
ing the efforts of the covered entity to protect
13
health data from unauthorized disclosure.
14
SEC. 3. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RE-
15
LATING TO LOCATION DATA.
16
(a) PROHIBITION ON SALE FROM DATA BROKERS.—
17
It shall be unlawful for a data broker to sell, resell, license,
18
trade, transfer, share, or otherwise provide or make avail-
19
able location data (including data volunteered by an indi-
20
vidual, medical center-derived data, data from a wearable
21
fitness tracker, data from web browsing history, or any
22
other source determined appropriate by the Commission).
23
(b) PROHIBITION ON SALE TO DATA BROKERS.—It
24
shall be unlawful for any person to sell, resell, license,
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
5
•S 631 IS
trade, transfer, share, or otherwise provide or make avail-
1
able location data (including data volunteered by an indi-
2
vidual, medical center-derived data, data from a wearable
3
fitness tracker, data from web browsing history, or any
4
other source determined appropriate by the Commission)
5
to a data broker.
6
SEC. 4. RIGHT OF ACCESS AND DELETION.
7
(a) RIGHT OF ACCESS.—
8
(1) IN GENERAL.—A covered entity shall make
9
available a reasonable mechanism by which an indi-
10
vidual, upon verified request, may access—
11
(A) any health data or location data relat-
12
ing to such individual that is retained by such
13
covered entity, including—
14
(i) in the case of such data that the
15
covered entity collected from any third
16
party, how and from which specific third
17
party the covered entity collected such
18
data; and
19
(ii) such data that the covered entity
20
inferred about the individual; and
21
(B) a list of the specific third parties to
22
which the covered entity has disclosed any
23
health data or location data relating to such in-
24
dividual.
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
6
•S 631 IS
(2) FORMAT.—A covered entity shall make the
1
information described in paragraph (1) available in
2
both a human-readable and a structured, interoper-
3
able, and machine-readable format.
4
(b) RIGHT OF DELETION.—A covered entity shall
5
make available a reasonable mechanism by which an indi-
6
vidual, upon verified request, may request the deletion of
7
any health data or location data relating to such individual
8
that is retained by the covered entity, including any such
9
information that the covered entity collected from a third
10
party or inferred from other information retained by the
11
covered entity.
12
(c) REQUIREMENTS FOR ACCESS AND DELETION.—
13
(1) TIMELINE
FOR
COMPLYING
WITH
RE-
14
QUESTS.—A covered entity shall comply with a
15
verified request received under this section without
16
undue delay, but not later than 15 days after the
17
date on which the covered entity receives such
18
verified request.
19
(2) FEES PROHIBITED.—A covered entity may
20
not charge a fee to an individual for a request made
21
under this section.
22
(3) RULES
OF
CONSTRUCTION.—Nothing in
23
this section shall be construed to require a covered
24
entity to—
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
7
•S 631 IS
(A) take an action that would convert in-
1
formation that is not health data or location
2
data into health data or location data;
3
(B) collect or retain health data or location
4
data that the covered entity would not other-
5
wise collect or retain; or
6
(C) retain health data or location data
7
longer than the covered entity would otherwise
8
retain such data.
9
(d) REASONABLE MECHANISM DEFINED.—In this
10
section, the term ‘‘reasonable mechanism’’ means, with re-
11
spect to a covered entity and a right under this section,
12
a mechanism that—
13
(1) is equivalent in availability and ease of use
14
to that of other mechanisms for communicating or
15
interacting with the covered entity; and
16
(2) includes an online means of exercising any
17
such right.
18
SEC. 5. EXCEPTIONS.
19
(a) PUBLICATION OF NEWSWORTHY INFORMATION
20
OF LEGITIMATE PUBLIC CONCERN.—Nothing in this Act,
21
or a regulation promulgated under this Act, shall apply
22
with respect to health data or location data that is col-
23
lected, retained, used, or disclosed by a covered entity for
24
the publication of newsworthy information of legitimate
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
8
•S 631 IS
public concern to the public, or to the collecting, retaining,
1
using, or disclosing of such data by a covered entity for
2
that purpose, if such covered entity has reasonable safe-
3
guards and processes that prevent the collecting, retain-
4
ing, using, or disclosing of health data or location data
5
for commercial purposes other than the publication of
6
newsworthy information of legitimate public concern.
7
(b) PUBLIC HEALTH CAMPAIGNS.—The prohibition
8
under section 2(a) shall not apply to any public health
9
campaign directed toward individuals or subpopulations of
10
individuals.
11
(c) DISCLOSURE PURSUANT TO VALID AUTHORIZA-
12
TION.—
13
(1) IN GENERAL.—Nothing in this Act shall be
14
construed to prohibit a disclosure of the health data
15
or location data of an individual for which the indi-
16
vidual provides valid authorization.
17
(2) VALID
AUTHORIZATION
DEFINED.—For
18
purposes of paragraph (1), the term ‘‘valid author-
19
ization’’ has the meaning given such term in section
20
164.508 of title 45, Code of Federal Regulations (or
21
a successor regulation), subject to any such adapta-
22
tion the Commission shall deem necessary to apply
23
such term to the disclosure of both health data and
24
location data.
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
9
•S 631 IS
(d) HIPAA-COMPLIANT ACTIONS.—
1
(1) IN GENERAL.—Nothing in this Act shall be
2
construed to prohibit any action taken with respect
3
to the health information of an individual by a data
4
broker that is a business associate or covered entity
5
that is permissible under the Federal regulations
6
concerning standards for privacy of individually
7
identifiable health information promulgated under
8
section 264(c) of the Health Insurance Portability
9
and Accountability Act of 1996 (42 U.S.C. 1320d–
10
2 note).
11
(2) TERMS DEFINED.—For purposes of para-
12
graph (1), the terms ‘‘business associate’’, ‘‘covered
13
entity’’, and ‘‘health information’’ shall have the
14
meanings given those terms in the Federal regula-
15
tions specified in such section 264(c) of the Health
16
Insurance Portability and Accountability Act of
17
1996 (42 U.S.C. 1320d–2 note).
18
SEC. 6. EFFECTIVE DATE.
19
(a) IN GENERAL.—The prohibitions under sections 2
20
and 3 shall take effect on the earlier of—
21
(1) the date the Commission issues the final
22
rule under subsection (b); or
23
(2) 180 days after the date of enactment of this
24
Act.
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
10
•S 631 IS
(b) RULEMAKING.—
1
(1) FINAL
RULE.—Not later than 180 days
2
after the date of enactment of this Act, the Commis-
3
sion shall promulgate regulations, pursuant to sec-
4
tion 553 of title 5, United States Code, to carry out
5
the provisions of this Act.
6
(2) ADDITIONAL GUIDANCE.—The Commission
7
may promulgate further regulations, pursuant to
8
such section 553, to update and carry out the provi-
9
sions of this Act, including further guidance regard-
10
ing the types of data described in sections 2 and 3.
11
SEC. 7. ENFORCEMENT.
12
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
13
MISSION.—
14
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
15
TICES.—A violation of section 2, 3, or 4 shall be
16
treated as a violation of a rule defining an unfair or
17
a deceptive act or practice under section 18(a)(1)(B)
18
of the Federal Trade Commission Act (15 U.S.C.
19
57a(a)(1)(B)).
20
(2) POWERS OF THE COMMISSION.—
21
(A) IN GENERAL.—Except as provided in
22
subparagraphs (D) and (E), the Commission
23
shall enforce this Act and any regulation pro-
24
mulgated thereunder in the same manner, by
25
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
11
•S 631 IS
the same means, and with the same jurisdic-
1
tion, powers, and duties as though all applicable
2
terms and provisions of the Federal Trade
3
Commission Act (15 U.S.C. 41 et seq.) were in-
4
corporated into and made a part of this Act.
5
(B) PRIVILEGES AND IMMUNITIES.—Sub-
6
ject to subparagraph (F), any covered entity or
7
data broker who violates this Act or any regula-
8
tion promulgated thereunder shall be subject to
9
the penalties and entitled to the privileges and
10
immunities provided in the Federal Trade Com-
11
mission Act (15 U.S.C. 41 et seq.).
12
(C) AUTHORITY PRESERVED.—Nothing in
13
this Act shall be construed to limit the author-
14
ity of the Federal Trade Commission under any
15
other provision of law.
16
(D) SCOPE
OF
JURISDICTION.—Notwith-
17
standing section 4, 5(a)(2), or 6 of the Federal
18
Trade Commission Act (15 U.S.C. 44, 45(a)(2),
19
46), or any jurisdictional limitation of the Com-
20
mission, the Commission shall also enforce this
21
Act and the regulations promulgated under this
22
Act, in the same manner provided in subpara-
23
graph (A), with respect to—
24
VerDate Sep 11 2014
21:31 Mar 15, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\S631.IS
S631
pbinns on DSKJLVW7X2PROD with $$_JOB
12
•S 631 IS
(i) common carriers subject to the
1
Communications Act of 1934 (47 U.S.C.
2
151 et seq.) and Acts amendatory thereof
3
and supplementary thereto; and
4
(ii) organizations that are not orga-
5
nized to carry on business for their own
6
profit or that of their members.
7
(E) INDEPENDENT
LITIGATION
AUTHOR-
8
ITY.—In any case in which the Commission has
9
reason to believe that a covered entity or data
10
broker is violating or has violated section 2, 3,
11
or 4, the Commission may bring a civil action,
12
subject to subsectio
[Text truncated for display. Full text available on Congress.gov.]