Exposure Notification Privacy Act

II 116TH CONGRESS 2D SESSION S. 3861 To establish privacy requirements for operators of infectious disease exposure notification services. IN THE SENATE OF THE UNITED STATES JUNE 1, 2020 Ms. CANTWELL (for herself and Mr. CASSIDY) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To establish privacy requirements for operators of infectious disease exposure notification services. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Exposure Notification Privacy Act’’. 5 (b) TABLE OF CONTENTS.—The table of contents for 6 this Act is as follows: 7 Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Public trust in automated exposure notification services. Sec. 4. Voluntary participation and transparency. Sec. 5. Data restrictions. Sec. 6. Data deletion. VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 3861 IS Sec. 7. Data security. Sec. 8. Freedom of movement and nondiscrimination. Sec. 9. Oversight. Sec. 10. Enforcement. SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) AFFIRMATIVE EXPRESS CONSENT.— 3 (A) IN GENERAL.—The term ‘‘affirmative 4 express consent’’ means an affirmative act by 5 an individual that clearly communicates the in- 6 dividual’s authorization for an act or practice, 7 in response to a specific request that— 8 (i) is provided to the individual in a 9 clear and conspicuous disclosure that is 10 separate from other options or acceptance 11 of general terms; and 12 (ii) includes a description of each act 13 or practice for which the individual’s con- 14 sent is sought and— 15 (I) is written concisely and in 16 easy-to-understand language; and 17 (II) includes a prominent heading 18 that would enable a reasonable indi- 19 vidual to identify and understand the 20 act or practice. 21 (B) EXPRESS CONSENT REQUIRED.—Af- 22 firmative express consent shall not be inferred 23 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 3861 IS from the inaction of an individual or the indi- 1 vidual’s continued use of a service or product. 2 (C) VOLUNTARY.—Affirmative express 3 consent shall be freely given and noncondi- 4 tioned. 5 (2) AGGREGATE DATA.—The term ‘‘aggregate 6 data’’ means information that relates to a group or 7 category of individuals that is not linked or reason- 8 ably linkable to any individual or device that is 9 linked or reasonably linkable to an individual, pro- 10 vided that a platform operator or operator of an 11 automated exposure notification service— 12 (A) takes reasonable measures to safe- 13 guard the data from reidentification; 14 (B) publicly commits in a conspicuous 15 manner not to attempt to reidentify or associate 16 the data with any individual or device linked or 17 reasonably linkable to an individual; 18 (C) processes the data for public health 19 purposes only; and 20 (D) contractually requires the same com- 21 mitment for all transfers of the data. 22 (3) AUTHORIZED DIAGNOSIS.—The term ‘‘au- 23 thorized diagnosis’’ means an actual, potential, or 24 presumptive positive diagnosis of an infectious dis- 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 3861 IS ease confirmed by a public health authority or a li- 1 censed health care provider. 2 (4) AUTOMATED EXPOSURE NOTIFICATION 3 SERVICE.— 4 (A) IN GENERAL.—The term ‘‘automated 5 exposure notification service’’ means a website, 6 online service, online application, mobile appli- 7 cation, or mobile operating system that is of- 8 fered in commerce in the United States and 9 that is designed, in part or in full, specifically 10 to be used for, or marketed for, the purpose of 11 digitally notifying, in an automated manner, an 12 individual who may have become exposed to an 13 infectious disease (or the device of such indi- 14 vidual, or a person or entity that reviews such 15 disclosures). 16 (B) LIMITATIONS.—Such term does not in- 17 clude— 18 (i) any technology that a public health 19 authority uses as a means to facilitate tra- 20 ditional in-person, email, or telephonic con- 21 tact tracing activities, or any similar tech- 22 nology that is used to assist individuals to 23 evaluate if they are experiencing symptoms 24 related to an infectious disease to the ex- 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 3861 IS tent the technology is not used as an auto- 1 mated exposure notification service; or 2 (ii) any platform operator or service 3 provider that provides technology to facili- 4 tate an automated exposure notification 5 service to the extent the technology acts 6 only to facilitate such services and is not 7 itself used as an automated exposure noti- 8 fication service. 9 (5) COLLECT; COLLECTION.—The terms ‘‘col- 10 lect’’ and ‘‘collection’’ mean buying, renting, gath- 11 ering, obtaining, receiving, accessing, or otherwise 12 acquiring covered data by any means, including by 13 passively or actively observing the behavior of an in- 14 dividual. 15 (6) COVERED DATA.—The term ‘‘covered data’’ 16 means any information that is— 17 (A) linked or reasonably linkable to any in- 18 dividual or device linked or reasonably linkable 19 to an individual; 20 (B) not aggregate data; and 21 (C) collected, processed, or transferred in 22 connection with an automated exposure notifi- 23 cation service. 24 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 3861 IS (7) DECEPTIVE ACT OR PRACTICE.—The term 1 ‘‘deceptive act or practice’’ means a deceptive act or 2 practice in violation of section 5(a)(1) of the Federal 3 Trade Commission Act (15 U.S.C. 45(a)(1)). 4 (8) DELETE.—The term ‘‘delete’’ means de- 5 stroying, permanently erasing, or otherwise modi- 6 fying covered data to make such covered data per- 7 manently unreadable or indecipherable and unre- 8 coverable. 9 (9) EXECUTIVE AGENCY.—The term ‘‘Executive 10 agency’’ has the meaning given such term in section 11 105 of title 5, United States Code. 12 (10) INDIAN TRIBE.—The term ‘‘Indian 13 tribe’’— 14 (A) has the meaning given such term in 15 section 4 of the Indian Self-Determination and 16 Education Assistance Act (25 U.S.C. 5304); 17 and 18 (B) includes a Native Hawaiian organiza- 19 tion as defined in section 6207 of the Elemen- 20 tary and Secondary Education Act of 1965 (20 21 U.S.C. 7517). 22 (11) OPERATOR OF AN AUTOMATED EXPOSURE 23 NOTIFICATION SERVICE.—The term ‘‘operator of an 24 automated exposure notification service’’ means any 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 3861 IS person or entity that operates an automated expo- 1 sure notification service, other than a public health 2 authority, and that is— 3 (A) subject to the Federal Trade Commis- 4 sion Act (15 U.S.C. 41 et seq.); or 5 (B) described in section 10(a)(4). 6 (12) PLATFORM OPERATOR.—The term ‘‘plat- 7 form operator’’ means any person or entity other 8 than a service provider who provides an operating 9 system that includes features supportive of an auto- 10 mated exposure notification service and facilitates 11 the use or distribution of such automated exposure 12 notification service to the extent the technology is 13 not used by the platform operator as an automated 14 exposure notification service. 15 (13) PROCESS.—The term ‘‘process’’ means 16 any operation or set of operations performed on cov- 17 ered data, including collection, analysis, organiza- 18 tion, structuring, retaining, using, securing, or oth- 19 erwise handling covered data. 20 (14) PUBLIC HEALTH AUTHORITY.—The term 21 ‘‘public health authority’’ means an agency or au- 22 thority of the United States, a State, a territory, a 23 political subdivision of a State or territory, or an In- 24 dian tribe that is responsible for public health mat- 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 3861 IS ters as part of its official mandate, or a person or 1 entity acting under a grant of authority from or con- 2 tract with such public agency. 3 (15) SERVICE PROVIDER.—The term ‘‘service 4 provider’’ means any person or entity, other than a 5 platform operator, that processes or transfers cov- 6 ered data in the course of performing a service or 7 function on behalf of, and at the direction of, a plat- 8 form operator, an operator of an automated expo- 9 sure notification service, or a public health author- 10 ity, but only to the extent that such processing or 11 transfer relates to the performance of such service 12 or function. 13 (16) STATE.—The term ‘‘State’’ means any of 14 the several States, the District of Columbia, the 15 Commonwealth of Puerto Rico, the Virgin Islands, 16 Guam, American Samoa, and the Commonwealth of 17 the Northern Mariana Islands. 18 (17) TRANSFER.—The term ‘‘transfer’’ means 19 to disclose, release, share, disseminate, make avail- 20 able, allow access to, sell, license, or otherwise com- 21 municate covered data by any means to a non- 22 affiliated entity or person. 23 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 3861 IS SEC. 3. PUBLIC TRUST IN AUTOMATED EXPOSURE NOTIFI- 1 CATION SERVICES. 2 (a) COLLABORATION WITH PUBLIC HEALTH.—An 3 operator of an automated exposure notification service 4 shall collaborate with a public health authority in the oper- 5 ation of such service. 6 (b) DIAGNOSIS INFORMATION.—An operator of an 7 automated exposure notification service may not collect, 8 process, or transfer an actual, potential, or presumptive 9 positive diagnosis of an infectious disease as part of the 10 automated exposure notification service, unless such diag- 11 nosis is an authorized diagnosis. 12 (c) ACCURACY AND RELIABILITY.—An operator of an 13 automated exposure notification service shall publish— 14 (1) guidance for the public on the functionality 15 of the service and how to interpret the notifications, 16 including any limitation with respect to the accuracy 17 or reliability of the exposure risk; and 18 (2) measures of the effectiveness of the service 19 offered, including adoption rates. 20 (d) PREVENTION OF DECEPTIVE ACTS OR PRAC- 21 TICES.—It shall be unlawful for a platform operator or 22 an operator of an automated exposure notification service 23 to engage in a deceptive act or practice concerning an 24 automated exposure notification service. 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 3861 IS (e) SERVICE PROVIDER REQUIREMENT.—When a 1 service provider has actual knowledge that an operator of 2 an automated exposure notification service or a public 3 health authority has engaged in an act or practice that 4 fails to adhere to the standards set forth in sections 3 5 through 8 of this Act, the service provider shall notify the 6 automated exposure notification service or the public 7 health authority, as applicable, of the potential violation 8 or failure to adhere to such standards. 9 SEC. 4. VOLUNTARY PARTICIPATION AND TRANSPARENCY. 10 (a) VOLUNTARY PARTICIPATION.— 11 (1) ENROLLMENT WITH AFFIRMATIVE EXPRESS 12 CONSENT.—An operator of an automated exposure 13 notification service— 14 (A) may not enroll an individual in the 15 automated exposure notification service without 16 the individual’s prior affirmative express con- 17 sent; and 18 (B) shall provide an individual with a clear 19 and conspicuous means to withdraw affirmative 20 express consent to the individual’s enrollment in 21 the automated exposure notification service. 22 (2) RIGHT TO IDENTIFY A DIAGNOSIS.—An in- 23 dividual with an authorized diagnosis shall deter- 24 mine whether the individual’s authorized diagnosis is 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 3861 IS processed as part of the automated exposure notifi- 1 cation service. 2 (b) NOTICE OF COVERED DATA PRACTICES.—An op- 3 erator of an automated exposure notification service and 4 a platform operator shall make publicly and persistently 5 available, in a conspicuous and readily accessible manner, 6 a privacy policy that provides a detailed and accurate rep- 7 resentation of that person or entity’s covered data collec- 8 tion, processing, and transfer activities in connection with 9 such person or entity’s automated exposure notification 10 service or the facilitation of such service. Such privacy pol- 11 icy shall include, at a minimum— 12 (1) the identity and the contact information of 13 the person or entity, including the contact informa- 14 tion for the person or entity’s representative for pri- 15 vacy and covered data security inquiries; 16 (2) each category of covered data the person or 17 entity collects and the limited allowable processing 18 purposes for which such covered data is collected in 19 accordance with section 5; 20 (3) whether the person or entity transfers cov- 21 ered data for the limited allowable purposes in sec- 22 tion 5 and, if so, a detailed description of the data 23 transferred, the purpose of the transfer, and the 24 identity of the recipient of the transfer; 25 VerDate Sep 11 2014 17:40 Jun 20, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S3861.IS S3861 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 3861 IS (4) a description of the person or entity’s cov- 1 ered data minimization and retention policies; 2 (5) how an individual can exercise the indi- 3 vidual rights described in this title; 4 (6) a description of the person or entity’s cov- 5 ered data security policies; and 6 (7) the effective date of the privacy policy. 7 (c) LANGUAGES.—A person or entity shall make the 8 privacy policy required under this section available to the 9 public in all of the languages in which the person or entity 10 provides, or facilitates the provision of, an automated ex- 11 po [Text truncated for display. Full text available on Congress.gov.]