Stop Marketing And Revealing The Wearables And Trackers Consumer Health Data Act

To prohibit the transfer or sale of certain consumer health information, and for other purposes. 1. Short title This Act may be cited as the Stop Marketing And Revealing The Wearables And Trackers Consumer Health Data Act SMARTWATCH Data Act 2. Definitions In this Act: (1) Aggregated The term aggregated (A) means the removal of individual consumer identities, so that the information is not linked or reasonably linkable to any consumer, including a personal consumer device; and (B) does not include one or more individual consumer records that have not been de­i­den­ti­fied. (2) Biometric information The term biometric information (A) means the physiological, biological, or behavioral characteristics of an individual, and the recorded, copied, captured, converted, stored derivatives of any such characteristics, that can be used, singly or in combination with each other or with other identifying data, to establish the identity of an individual; and (B) includes deoxyribonucleic acid, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted. (3) Business associate; covered entity; protected health information The terms business associate covered entity protected health information (4) Commercial purposes The term commercial purposes (A) means an action intended— (i) to advance the commercial or economic interests of a person, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services; or (ii) to enable or affect, directly or indirectly, a commercial transaction; and (B) does not include engaging in speech that State or Federal courts have recognized as noncommercial speech, including political speech and journalism. (5) Consumer device The term consumer device (A) means a commercially produced piece of equipment, application software, or mechanism that has the primary function or capability to collect, store, or transmit consumer health information; and (B) may include a device, as defined in section 201(h) of the Federal Food, Drug, and Cosmetic Act ( 21 U.S.C. 321(h) (6) Consumer health information The term consumer health information (7) Deidentified The term deidentified (8) Information broker The term information broker (9) Kinesthetic information The term kinesthetic information 3. Prohibitions (a) In general Subject to subsection (b), no entity that collects consumer health information may— (1) transfer, sell, share, or allow access to any consumer health information (unless aggregated or anonymized) or any other individually identifiable consumer health information collected, recorded, or derived from personal consumer devices to any domestic information broker or other domestic entity if— (A) the primary business function of such domestic information broker or other domestic entity is collecting or analyzing consumer information for profit; or (B) the purpose for transferring, selling, sharing, or allowing access to such information is to otherwise add value to the entity that collects consumer health information, for commercial purposes; or (2) transfer, sell, or allow access to any consumer health information collected, stored, recorded, or derived from personal consumer devices to any information broker or any entity outside of the jurisdiction of the United States. (b) Exceptions (1) In general Subject to paragraph (3), the prohibition under subsection (a)(1) shall not apply if— (A) the entity obtains the informed consent of the consumer; (B) the information is provided to a covered entity, as defined in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations); (C) such information is provided to a government organization or agency, including law enforcement or regulators, to comply with applicable laws, regulations, or rules, or requests of law enforcement, regulatory, or other governmental agencies or in response to a legal process in connection with a subpoena, warrant, discovery order, or other request or order from a law enforcement agency; (D) such information is provided to the entity's affiliates or other trusted businesses or persons to process the information as part of the entity's external processing procedures, based on the entity's instructions and in compliance with privacy protections and any other appropriate confidentiality and security measures; (E) such information is provided in connection with a substantial corporate transaction of the entity, such as the transfer of ownership, a merger, consolidation, asset sale, or bankruptcy or insolvency; or (F) such information is provided to academic, medical, research institutions, or other nonprofit organizations acting in the public interest for the purpose of detecting or responding to security incidents; preventing fraud; conducting scientific, historical, or statistical research; or preserving the security and safety of people or property. (2) Transfers to foreign entities Subject to paragraph (3), the prohibition under subsection (a)(2) shall not apply if— (A) the transfer is made only for limited and specific purposes consistent with the consent provided by the individual and with assurances that the recipient will notify the entity providing the data if such recipient makes a determination that it can no longer use the data consistent with such consent; (B) the entity transferring the information determines that the recipient of the information will provide the same level of privacy protection as is required by the entity transferring the information; (C) the entity transferring the information takes reasonable and appropriate steps to ensure that the third party effectively processes the personal information transferred in a manner consistent with the third party’s obligations under the second party’s privacy principles; and (D) the entity transferring the information agrees to take reasonable steps to stop and remediate unauthorized processing of information by the entity to whom such information is transferred. (3) Limitation None of the exceptions under paragraphs (1) and (2) shall supersede any contrary rule promulgated by the Federal Trade Commission that is in effect on the date of enactment of this Act. (c) Treatment of consumer health information as protected health information If a covered entity or business associate, acting in its capacity as a business associate, receives consumer health information generated by a personal consumer device at any time for any reason, such consumer health information is considered protected health information and is subject to the same protections and restrictions under parts 162 and 164 of title 45, Code of Federal Regulations (or any successor regulations), as any other protected health information. 4. Enforcement The Secretary of Health and Human Services shall enforce the requirements of section 3 against an entity that collects or receives consumer health information in the same manner and to the same extent, as such secretary enforces the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( Public Law 104–191

Summary: Stop Marketing And Revealing The Wearables And Trackers Consumer Health Data Act or the SMARTWATCH Data Act This bill restricts the commercial use of identifiable personal health information derived from a smartwatch or similar consumer device. The Department of Health and Human Services must enforce these restrictions. Specifically, an entity that collects personal health information from consumer devices may not transfer, sell, or otherwise allow domestic entities to access such information if the purpose is to increase profits or generate commercial value. However, the bill sets out certain exceptions to this prohibition, including where the consumer provided informed consent or where the information is necessary for specified business transactions. Furthermore, an entity that collects personal health information derived from consumer devices may not allow foreign entities to access such information unless there are certain privacy and security protections in place. In addition, any personal health information derived from a consumer device and received by health care providers, health plans, or their business associates is considered protected health information and thus subject to applicable federal privacy standards governing its use and disclosure.