II 

117TH CONGRESS 

1ST SESSION S. 500 

To prohibit the transfer or sale of certain consumer health information, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 1, 2021 

Mr. CASSIDY (for himself and Ms. ROSEN) introduced the following bill; which 

was read twice and referred to the Committee on Health, Education, 

Labor, and Pensions 

A BILL 

To prohibit the transfer or sale of certain consumer health 

information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Stop Marketing And 

5 Revealing The Wearables And Trackers Consumer Health 

6 Data Act’’ or the ‘‘SMARTWATCH Data Act’’. 

7 SEC. 2. DEFINITIONS. 

8 In this Act: 

9 (1) AGGREGATED.—The term ‘‘aggregated’’, 

10 with respect to consumer health information— 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•S 500 IS

1 (A) means the removal of individual con2 sumer identities, so that the information is not 

3 linked or reasonably linkable to any consumer, 

4 including a personal consumer device; and 

5 (B) does not include one or more indi6 vidual consumer records that have not been 

7 deidentified. 

8 (2) BIOMETRIC INFORMATION.—The term ‘‘bio9 metric information’’— 

10 (A) means the physiological, biological, or 

11 behavioral characteristics of an individual, and 

12 the recorded, copied, captured, converted, 

13 stored derivatives of any such characteristics, 

14 that can be used, singly or in combination with 

15 each other or with other identifying data, to es16 tablish the identity of an individual; and 

17 (B) includes deoxyribonucleic acid, imagery 

18 of the iris, retina, fingerprint, face, hand, palm, 

19 vein patterns, and voice recordings, from which 

20 an identifier template, such as a faceprint, a 

21 minutiae template, or a voiceprint, can be ex22 tracted. 

23 (3) BUSINESS ASSOCIATE; COVERED ENTITY; 

24 PROTECTED HEALTH INFORMATION.—The terms 

25 ‘‘business associate’’, ‘‘covered entity’’, and ‘‘proVerDate Sep 11 2014 00:16 Mar 31, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S500.IS S500

pbinns on DSKJLVW7X2PROD with BILLS
3 

•S 500 IS

1 tected health information’’ have the meanings given 

2 such terms in section 160.103 of title 45, Code of 

3 Federal Regulations (or any successor regulations). 

4 (4) COMMERCIAL PURPOSES.—The term ‘‘com5 mercial purposes’’— 

6 (A) means an action intended— 

7 (i) to advance the commercial or eco8 nomic interests of a person, such as by in9 ducing another person to buy, rent, lease, 

10 join, subscribe to, provide, or exchange 

11 products, goods, property, information, or 

12 services; or 

13 (ii) to enable or affect, directly or in14 directly, a commercial transaction; and 

15 (B) does not include engaging in speech 

16 that State or Federal courts have recognized as 

17 noncommercial speech, including political 

18 speech and journalism. 

19 (5) CONSUMER DEVICE.—The term ‘‘consumer 

20 device’’— 

21 (A) means a commercially produced piece 

22 of equipment, application software, or mecha23 nism that has the primary function or capa24 bility to collect, store, or transmit consumer 

25 health information; and 


pbinns on DSKJLVW7X2PROD with BILLS
4 

•S 500 IS

1 (B) may include a device, as defined in 

2 section 201(h) of the Federal Food, Drug, and 

3 Cosmetic Act (21 U.S.C. 321(h)). 

4 (6) CONSUMER HEALTH INFORMATION.—The 

5 term ‘‘consumer health information’’ means any in6 formation about the health status, personal biomet7 ric information, or personal kinesthetic information 

8 about a specific individual that is created or col9 lected by a personal consumer device, whether de10 tected from sensors or input manually. 

11 (7) DEIDENTIFIED.—The term ‘‘deidentified’’ 

12 means information that cannot reasonably identify, 

13 relate to, describe, be capable of being associated 

14 with, or be linked, directly or indirectly, to a par15 ticular consumer, computer, or other device. 

16 (8) INFORMATION BROKER.—The term ‘‘infor17 mation broker’’ means any entity that collects con18 sumers’ personal information and resells or shares 

19 that information with another person. 

20 (9) KINESTHETIC INFORMATION.—The term 

21 ‘‘kinesthetic information’’ means keystroke patterns 

22 or rhythms, gait patterns or rhythms, sleep informa23 tion, and other data that relates to the personal 

24 health of an individual. 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•S 500 IS

1 SEC. 3. PROHIBITIONS. 

2 (a) IN GENERAL.—Subject to subsection (b), no enti3 ty that collects consumer health information may— 

4 (1) transfer, sell, share, or allow access to any 

5 consumer health information (unless aggregated or 

6 anonymized) or any other individually identifiable 

7 consumer health information collected, recorded, or 

8 derived from personal consumer devices to any do9 mestic information broker or other domestic entity 

10 if— 

11 (A) the primary business function of such 

12 domestic information broker or other domestic 

13 entity is collecting or analyzing consumer infor14 mation for profit; or 

15 (B) the purpose for transferring, selling, 

16 sharing, or allowing access to such information 

17 is to otherwise add value to the entity that col18 lects consumer health information, for commer19 cial purposes; or 

20 (2) transfer, sell, or allow access to any con21 sumer health information collected, stored, recorded, 

22 or derived from personal consumer devices to any in23 formation broker or any entity outside of the juris24 diction of the United States. 

25 (b) EXCEPTIONS.— 


pbinns on DSKJLVW7X2PROD with BILLS
6 

•S 500 IS

1 (1) IN GENERAL.—Subject to paragraph (3), 

2 the prohibition under subsection (a)(1) shall not 

3 apply if— 

4 (A) the entity obtains the informed consent 

5 of the consumer; 

6 (B) the information is provided to a cov7 ered entity, as defined in section 160.103 of 

8 title 45, Code of Federal Regulations (or any 

9 successor regulations); 

10 (C) such information is provided to a gov11 ernment organization or agency, including law 

12 enforcement or regulators, to comply with appli13 cable laws, regulations, or rules, or requests of 

14 law enforcement, regulatory, or other govern15 mental agencies or in response to a legal proc16 ess in connection with a subpoena, warrant, dis17 covery order, or other request or order from a 

18 law enforcement agency; 

19 (D) such information is provided to the en20 tity’s affiliates or other trusted businesses or 

21 persons to process the information as part of 

22 the entity’s external processing procedures, 

23 based on the entity’s instructions and in compli24 ance with privacy protections and any other ap25 propriate confidentiality and security measures; 


pbinns on DSKJLVW7X2PROD with BILLS
7 

•S 500 IS

1 (E) such information is provided in con2 nection with a substantial corporate transaction 

3 of the entity, such as the transfer of ownership, 

4 a merger, consolidation, asset sale, or bank5 ruptcy or insolvency; or 

6 (F) such information is provided to aca7 demic, medical, research institutions, or other 

8 nonprofit organizations acting in the public in9 terest for the purpose of detecting or respond10 ing to security incidents; preventing fraud; con11 ducting scientific, historical, or statistical re12 search; or preserving the security and safety of 

13 people or property. 

14 (2) TRANSFERS TO FOREIGN ENTITIES.—Sub15 ject to paragraph (3), the prohibition under sub16 section (a)(2) shall not apply if— 

17 (A) the transfer is made only for limited 

18 and specific purposes consistent with the con19 sent provided by the individual and with assur20 ances that the recipient will notify the entity 

21 providing the data if such recipient makes a de22 termination that it can no longer use the data 

23 consistent with such consent; 

24 (B) the entity transferring the information 

25 determines that the recipient of the information 


pbinns on DSKJLVW7X2PROD with BILLS
8 

•S 500 IS

1 will provide the same level of privacy protection 

2 as is required by the entity transferring the in3 formation; 

4 (C) the entity transferring the information 

5 takes reasonable and appropriate steps to en6 sure that the third party effectively processes 

7 the personal information transferred in a man8 ner consistent with the third party’s obligations 

9 under the second party’s privacy principles; and 

10 (D) the entity transferring the information 

11 agrees to take reasonable steps to stop and re12 mediate unauthorized processing of information 

13 by the entity to whom such information is 

14 transferred. 

15 (3) LIMITATION.—None of the exceptions under 

16 paragraphs (1) and (2) shall supersede any contrary 

17 rule promulgated by the Federal Trade Commission 

18 that is in effect on the date of enactment of this 

19 Act. 

20 (c) TREATMENT OF CONSUMER HEALTH INFORMA21 TION AS PROTECTED HEALTH INFORMATION.—If a cov22 ered entity or business associate, acting in its capacity as 

23 a business associate, receives consumer health information 

24 generated by a personal consumer device at any time for 

25 any reason, such consumer health information is considVerDate Sep 11 2014 00:16 Mar 31, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S500.IS S500

pbinns on DSKJLVW7X2PROD with BILLS
9 

•S 500 IS

1 ered protected health information and is subject to the 

2 same protections and restrictions under parts 162 and 164 

3 of title 45, Code of Federal Regulations (or any successor 

4 regulations), as any other protected health information. 

5 SEC. 4. ENFORCEMENT. 

6 The Secretary of Health and Human Services shall 

7 enforce the requirements of section 3 against an entity 

8 that collects or receives consumer health information in 

9 the same manner and to the same extent, as such sec10 retary enforces the privacy regulations promulgated under 

11 section 264(c) of the Health Insurance Portability and Ac12 countability Act of 1996 (Public Law 104–191; 110 Stat. 

13 2033) against a covered entity. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS