COVID–19 Consumer Data Protection Act of 2020

II 116TH CONGRESS 2D SESSION S. 3663 To protect the privacy of consumers’ personal health information, proximity data, device data, and geolocation data during the coronavirus public health crisis. IN THE SENATE OF THE UNITED STATES MAY 7, 2020 Mr. WICKER (for himself, Mr. THUNE, Mr. MORAN, Mrs. BLACKBURN, and Mrs. FISCHER) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To protect the privacy of consumers’ personal health infor- mation, proximity data, device data, and geolocation data during the coronavirus public health crisis. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘COVID–19 Consumer 4 Data Protection Act of 2020’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) AGGREGATED DATA.—The term ‘‘aggre- 8 gated data’’ means information that— 9 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 2 •S 3663 IS (A) relates to a group or category of indi- 1 viduals; and 2 (B) does not identify, and is not linked or 3 reasonably linkable to, any individual. 4 (2) AFFIRMATIVE EXPRESS CONSENT.— 5 (A) IN GENERAL.—The term ‘‘affirmative 6 express consent’’ means an affirmative act by 7 an individual that— 8 (i) clearly communicates the individ- 9 ual’s authorization of an act or practice; 10 and 11 (ii) is taken after the individual has 12 been presented with a clear and con- 13 spicuous description of such act or prac- 14 tice. 15 (B) NO INFERENCE FROM INACTION.—For 16 purposes of subparagraph (A), the affirmative 17 express consent of an individual cannot be in- 18 ferred from inaction. 19 (3) BUSINESS CONTACT INFORMATION.—The 20 term ‘‘business contact information’’ means informa- 21 tion related to an individual’s business position 22 name or title, business telephone number, business 23 address, business email address, and other similar 24 business information, provided that such information 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 3 •S 3663 IS is collected, processed, or transferred solely for pur- 1 poses related to such individual’s professional activi- 2 ties. 3 (4) COLLECTION.—The term ‘‘collection’’ 4 means buying, renting, gathering, accessing, or oth- 5 erwise acquiring any covered data of an individual 6 by any means. 7 (5) COMMISSION.—The term ‘‘Commission’’ 8 means the Federal Trade Commission. 9 (6) COVERED DATA.— 10 (A) IN GENERAL.—The term ‘‘covered 11 data’’ means precise geolocation data, proximity 12 data, a persistent identifier, and personal health 13 information. 14 (B) EXCLUSIONS.—Such term does not in- 15 clude the following: 16 (i) Aggregated data. 17 (ii) Business contact information. 18 (iii) De-identified data. 19 (iv) Employee screening data. 20 (v) Publicly available information. 21 (7) COVERED ENTITY.—The term ‘‘covered en- 22 tity’’ means, with respect to a set of covered data, 23 any entity or person that— 24 (A) is— 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 4 •S 3663 IS (i) subject to the Federal Trade Com- 1 mission Act (15 U.S.C. 41 et seq.); or 2 (ii) a common carrier or nonprofit or- 3 ganization described in section 4(a)(4); 4 (B) collects, processes, or transfers such 5 covered data, or determines the means and pur- 6 poses for the collection, processing, or transfer 7 of covered data; and 8 (C) is not a service provider with respect 9 to such data. 10 (8) COVID–19 PUBLIC HEALTH EMERGENCY.— 11 The term ‘‘COVID–19 public health emergency’’ 12 means the period— 13 (A) beginning on the date of enactment of 14 this Act; and 15 (B) ending on the last day of the public 16 health emergency declared by the Secretary of 17 Health and Human Services pursuant to sec- 18 tion 319 of the Public Health Service Act (42 19 U.S.C. 247d) on January 31, 2020, entitled 20 ‘‘Determination that a Public Health Emer- 21 gency Exists Nationwide as the Result of the 22 2019 Novel Coronavirus’’ (including any re- 23 newal of such declaration pursuant to such sec- 24 tion 319). 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 5 •S 3663 IS (9) DE-IDENTIFIED DATA.—The term ‘‘de-iden- 1 tified data’’ means information held by a covered en- 2 tity that— 3 (A) does not identify and is not reasonably 4 linkable to an individual; 5 (B) does not contain any personal identi- 6 fiers or other information that could be readily 7 used to re-identify the individual to whom the 8 information pertains; 9 (C) is subject to a public commitment by 10 the covered entity— 11 (i) to refrain from attempting to use 12 such information to identify any individual; 13 and 14 (ii) to adopt technical and organiza- 15 tional measures to ensure that such infor- 16 mation is not linked to any individual; and 17 (D) is not disclosed by the covered entity 18 to any other party unless the disclosure is sub- 19 ject to a contractually or other legally binding 20 requirement that— 21 (i) the recipient of the information 22 shall not use the information to identify 23 any individual; and 24 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 6 •S 3663 IS (ii) all onward disclosures of the infor- 1 mation shall be subject to the requirement 2 described in clause (i). 3 (10) EMPLOYEE SCREENING DATA.—The term 4 ‘‘employee screening data’’ means, with respect to a 5 covered entity, covered data of an individual who is 6 an employee, owner, director, officer, staff member, 7 trainee, vendor, visitor, intern, volunteer, or con- 8 tractor of the covered entity, provided that such data 9 is only collected, processed, or transferred by the 10 covered entity for the purpose of determining, for 11 purposes related to the COVID–19 public health 12 emergency, whether the individual is permitted to 13 enter a physical site of operation of the covered enti- 14 ty. 15 (11) DELETE.—The term ‘‘delete’’ means to re- 16 move or destroy information such that it is not 17 maintained in human or machine readable form and 18 cannot be retrieved or utilized in the normal course 19 of business. 20 (12) INDIVIDUAL.— 21 (A) IN GENERAL.—The term ‘‘individual’’ 22 means a natural person residing in the United 23 States. 24 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 7 •S 3663 IS (B) EXCLUSION.—Such term does not in- 1 clude, with respect to a covered entity, an indi- 2 vidual acting as a full-time or part-time, paid or 3 unpaid employee, owner, director, officer, staff 4 member, trainee, vendor, visitor, intern, volun- 5 teer, or contractor of a covered entity permitted 6 to enter a physical site of operation of the cov- 7 ered entity. 8 (13) PERSISTENT IDENTIFIER.—The term 9 ‘‘persistent identifier’’ means a technologically de- 10 rived identifier that identifies an individual, or is 11 linked or reasonably linkable to an individual over 12 time and across services and platforms, which may 13 include a customer number held in a cookie, a static 14 Internet Protocol (IP) address, a processor or device 15 serial number, or another unique device identifier. 16 (14) PERSONAL HEALTH INFORMATION.— 17 (A) IN GENERAL.—The term ‘‘personal 18 health information’’ means information relating 19 to an individual that— 20 (i) is— 21 (I) genetic information of the in- 22 dividual; or 23 (II) information relating to the 24 diagnosis or treatment of past, 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 8 •S 3663 IS present, or future physical, mental 1 health, or disability of the individual; 2 and 3 (ii) identifies, or is reasonably linkable 4 to, the individual. 5 (B) EXCLUSIONS.—Such term does not in- 6 clude the following: 7 (i) Information from education 8 records that are subject to the require- 9 ments of section 444 of the General Edu- 10 cation Provisions Act (20 U.S.C. 1232g, 11 commonly referred to as the ‘‘Family Edu- 12 cational Rights and Privacy Act of 1974’’) 13 or from records described in subsection 14 (a)(4)(B)(iv) of such section. 15 (ii) Information subject to regulations 16 promulgated pursuant to section 264(c) of 17 the Health Insurance Portability and Ac- 18 countability Act of 1996 (42 U.S.C. 19 1320d–2 note). 20 (15) PRECISE GEOLOCATION DATA.—The term 21 ‘‘precise geolocation data’’ means technologically de- 22 rived information capable of determining with rea- 23 sonable specificity the past or present actual phys- 24 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 9 •S 3663 IS ical location of an individual at a specific point in 1 time. 2 (16) PROCESS.—The term ‘‘process’’ means 3 any operation or set of operations performed on cov- 4 ered data, including analyzing, organizing, struc- 5 turing, retaining, using, or otherwise handling such 6 data. 7 (17) PROXIMITY DATA.—The term ‘‘proximity 8 data’’ means technologically derived information that 9 identifies the past or present proximity of one indi- 10 vidual to another. 11 (18) PUBLICLY AVAILABLE INFORMATION.— 12 The term ‘‘publicly available information’’ means 13 any information that— 14 (A) has been lawfully made available to the 15 general public from Federal, State, or local gov- 16 ernment records; or 17 (B) is widely available to the general pub- 18 lic, including information from— 19 (i) a telephone book or online direc- 20 tory; 21 (ii) video, internet, or audio content; 22 or 23 (iii) the news media or a website that 24 is available to the general public on an un- 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 10 •S 3663 IS restricted basis (for purposes of this sub- 1 clause a website is not restricted solely be- 2 cause there is a fee or log-in requirement 3 associated with accessing the website). 4 (19) SERVICE PROVIDER.—The term ‘‘service 5 provider’’ means, with respect to a set of covered 6 data, an entity that processes or transfers such cov- 7 ered data for the purpose of performing one or more 8 services or functions on behalf of, and at the direc- 9 tion of, a covered entity to which it is not related. 10 (20) TRANSFER.—The term ‘‘transfer’’ means 11 to disclose, release, share, disseminate, or otherwise 12 make available covered data by any means. 13 SEC. 3. PRIVACY OF COVERED DATA. 14 (a) IN GENERAL.—During the COVID–19 public 15 health emergency, it shall be unlawful for a covered entity 16 to collect, process, or transfer the covered data of an indi- 17 vidual for a purpose described in subsection (b) unless— 18 (1) the covered entity provides the individual 19 with prior notice of the purpose for such collection, 20 processing, or transfer; 21 (2) the individual has given affirmative express 22 consent to such collection, processing, or transfer; 23 and 24 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 11 •S 3663 IS (3) the covered entity publicly commits not to 1 collect, process, or transfer such covered data for a 2 purpose other than the purpose described in sub- 3 section (b) to which the individual consented un- 4 less— 5 (A) such collection, processing, or transfer 6 is necessary to comply with the provisions of 7 this Act or other applicable laws; 8 (B) such collection, processing, or transfer 9 is necessary to carry out operational or admin- 10 istrative tasks in support of a purpose described 11 in subsection (b) to which the individual has 12 consented; or 13 (C) the individual gives affirmative express 14 consent to such collection, processing, or trans- 15 fer. 16 (b) COVERED PURPOSES.—The purposes described in 17 this subsection are the following: 18 (1) Collecting, processing, or transferring the 19 covered data of an individual to track the spread, 20 signs, or symptoms of COVID–19. 21 (2) Collecting, processing, or transferring the 22 covered data of an individual to measure compliance 23 with social distancing guidelines or other require- 24 ments related to COVID–19 that are imposed on in- 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 12 •S 3663 IS dividuals under a Federal, State, or local govern- 1 ment order. 2 (3) Collecting, processing, or transferring the 3 covered data of an individual to conduct contact 4 tracing for COVID–19 cases. 5 (c) TRANSPARENCY.— 6 (1) PRIVACY POLICY.—A covered entity that 7 collects, processes, or transfers covered data for a 8 purpose described in subsection (b) shall, not later 9 than 14 days after the enactment of this Act, pub- 10 lish a privacy policy that— 11 (A) is disclosed in a clear and conspicuous 12 manner to an individual prior to or at the point 13 of the collection of covered data for such a pur- 14 pose from the individual; 15 (B) is made available in a clear and con- 16 spicuous manner to the public; 17 (C) includes whether, subject to the affirm- 18 ative express consent requirement of subsection 19 (a), the covered entity transfers covered data 20 for such a purpose and the categories of recipi- 21 ents to whom the covered entity transfers cov- 22 ered data for such purpose; 23 (D) includes a general description of the 24 covered entity’s data retention practices for cov- 25 VerDate Sep 11 2014 22:33 May 13, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S3663.IS S3663 kjohnson on DSK79L0C42PROD with BILLS 13 •S 3663 IS ered data used for a purpose described in sub- 1 section (b) and the purposes for such retention; 2 and 3 (E) includes a general description of the 4 covered entity’s data security practices. 5 (2) REPORTING.—During the COVID–19 public 6 health emergency, a covered entity that collects, 7 processes, or transfers covered data for a purpose 8 described in subsection (b) shall issue a public report 9 not later than 30 days after the enactment of this 10 Act and not less frequently t [Text truncated for display. Full text available on Congress.gov.]