Exposure Notification Privacy Act

To establish privacy requirements for operators of infectious disease exposure notification services. 1. Short title; table of contents (a) Short title This Act may be cited as the Exposure Notification Privacy Act (b) Table of contents The table of contents for this Act is as follows: Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Public trust in automated exposure notification services. Sec. 4. Voluntary participation and transparency. Sec. 5. Data restrictions. Sec. 6. Data deletion. Sec. 7. Data security. Sec. 8. Freedom of movement and nondiscrimination. Sec. 9. Oversight. Sec. 10. Enforcement. 2. Definitions In this Act: (1) Affirmative express consent (A) In general The term affirmative express consent (i) is provided to the individual in a clear and conspicuous disclosure that is separate from other options or acceptance of general terms; and (ii) includes a description of each act or practice for which the individual’s consent is sought and— (I) is written concisely and in easy-to-understand language; and (II) includes a prominent heading that would enable a reasonable individual to identify and understand the act or practice. (B) Express consent required Affirmative express consent shall not be inferred from the inaction of an individual or the individual’s continued use of a service or product. (C) Voluntary Affirmative express consent shall be freely given and nonconditioned. (2) Aggregate data The term aggregate data (A) takes reasonable measures to safeguard the data from reidentification; (B) publicly commits in a conspicuous manner not to attempt to reidentify or associate the data with any individual or device linked or reasonably linkable to an individual; (C) processes the data for public health purposes only; and (D) contractually requires the same commitment for all transfers of the data. (3) Authorized diagnosis The term authorized diagnosis (4) Automated exposure notification service (A) In general The term automated exposure notification service (B) Limitations Such term does not include— (i) any technology that a public health authority uses as a means to facilitate traditional in-person, email, or telephonic contact tracing activities, or any similar technology that is used to assist individuals to evaluate if they are experiencing symptoms related to an infectious disease to the extent the technology is not used as an automated exposure notification service; or (ii) any platform operator or service provider that provides technology to facilitate an automated exposure notification service to the extent the technology acts only to facilitate such services and is not itself used as an automated exposure notification service. (5) Collect; collection The terms collect collection (6) Covered data The term covered data (A) linked or reasonably linkable to any individual or device linked or reasonably linkable to an individual; (B) not aggregate data; and (C) collected, processed, or transferred in connection with an automated exposure notification service. (7) Deceptive act or practice The term deceptive act or practice 15 U.S.C. 45(a)(1) (8) Delete The term delete (9) Executive agency The term Executive agency (10) Indian tribe The term Indian tribe (A) has the meaning given such term in section 4 of the Indian Self-Determination and Education Assistance Act ( 25 U.S.C. 5304 (B) includes a Native Hawaiian organization as defined in section 6207 of the Elementary and Secondary Education Act of 1965 ( 20 U.S.C. 7517 (11) Operator of an automated exposure notification service The term operator of an automated exposure notification service (A) subject to the Federal Trade Commission Act ( 15 U.S.C. 41 (B) described in section 10(a)(4). (12) Platform operator The term platform operator (13) Process The term process (14) Public health authority The term public health authority (15) Service provider The term service provider (16) State The term State (17) Transfer The term transfer 3. Public trust in automated exposure notification services (a) Collaboration with public health An operator of an automated exposure notification service shall collaborate with a public health authority in the operation of such service. (b) Diagnosis information An operator of an automated exposure notification service may not collect, process, or transfer an actual, potential, or presumptive positive diagnosis of an infectious disease as part of the automated exposure notification service, unless such diagnosis is an authorized diagnosis. (c) Accuracy and reliability An operator of an automated exposure notification service shall publish— (1) guidance for the public on the functionality of the service and how to interpret the notifications, including any limitation with respect to the accuracy or reliability of the exposure risk; and (2) measures of the effectiveness of the service offered, including adoption rates. (d) Prevention of deceptive acts or practices It shall be unlawful for a platform operator or an operator of an automated exposure notification service to engage in a deceptive act or practice concerning an automated exposure notification service. (e) Service provider requirement When a service provider has actual knowledge that an operator of an automated exposure notification service or a public health authority has engaged in an act or practice that fails to adhere to the standards set forth in sections 3 through 8 of this Act, the service provider shall notify the automated exposure notification service or the public health authority, as applicable, of the potential violation or failure to adhere to such standards. 4. Voluntary participation and transparency (a) Voluntary participation (1) Enrollment with affirmative express consent An operator of an automated exposure notification service— (A) may not enroll an individual in the automated exposure notification service without the individual’s prior affirmative express consent; and (B) shall provide an individual with a clear and conspicuous means to withdraw affirmative express consent to the individual’s enrollment in the automated exposure notification service. (2) Right to identify a diagnosis An individual with an authorized diagnosis shall determine whether the individual's authorized diagnosis is processed as part of the automated exposure notification service. (b) Notice of covered data practices An operator of an automated exposure notification service and a platform operator shall make publicly and persistently available, in a conspicuous and readily accessible manner, a privacy policy that provides a detailed and accurate representation of that person or entity’s covered data collection, processing, and transfer activities in connection with such person or entity’s automated exposure notification service or the facilitation of such service. Such privacy policy shall include, at a minimum— (1) the identity and the contact information of the person or entity, including the contact information for the person or entity’s representative for privacy and covered data security inquiries; (2) each category of covered data the person or entity collects and the limited allowable processing purposes for which such covered data is collected in accordance with section 5; (3) whether the person or entity transfers covered data for the limited allowable purposes in section 5 and, if so, a detailed description of the data transferred, the purpose of the transfer, and the identity of the recipient of the transfer; (4) a description of the person or entity’s covered data minimization and retention policies; (5) how an individual can exercise the individual rights described in this title; (6) a description of the person or entity’s covered data security policies; and (7) the effective date of the privacy policy. (c) Languages A person or entity shall make the privacy policy required under this section available to the public in all of the languages in which the person or entity provides, or facilitates the provision of, an automated exposure notification service. 5. Data restrictions (a) Collection and processing restrictions An operator of an automated exposure notification service may not collect or process any covered data— (1) beyond the minimum amount necessary to implement an automated exposure notification service for public health purposes; or (2) for any commercial purpose. (b) Transfer restrictions An operator of an automated exposure notification service may not transfer any covered data, except— (1) to provide notification of a potential exposure to an individual who has enrolled in the automated exposure notification service; (2) to a public health authority for public health purposes related to an infectious disease; (3) to its service provider, by contract, to— (A) perform system maintenance, debug systems, or repair any error to ensure the functionality of the automated exposure notification service, provided such processing is limited to this purpose; or (B) detect or respond to a security incident, provide a secure environment, or maintain the safety of the automated exposure notification service, provided such process is limited to this purpose; or (4) to comply with the establishment, exercise, or defense of a legal claim. (c) Further restrictions (1) In general It shall be unlawful for any person, entity, or Executive agency to transfer covered data to any Executive agency unless the information is transferred in connection with an investigation or enforcement proceeding under this Act. (2) Prohibition An Executive agency may not process or transfer covered data, except— (A) for a public health purpose related to an infectious disease; or (B) in connection with an investigation or enforcement proceeding under this Act. (d) Research This section shall not be construed to prohibit data collection, processing, or transfers to carry out research— (1) conducted pursuant to the Federal policy for the protection of human subjects under part 46 of title 45, Code of Federal Regulations; or (2) for the development, manufacture, or distribution of a drug, biological product, or vaccine that relates to an infectious disease conducted pursuant to part 50 of title 21, Code of Federal Regulations. 6. Data deletion (a) Deletion upon request Upon the request of an individual, an operator of an automated exposure notification service shall delete, or allow the individual to delete, all covered data of the individual that is processed by the operator. (b) Recurring deletion An operator of an automated exposure notification service shall delete the covered data of a participating individual within 30 days of receipt of such covered data, on a rolling basis, or at such times as is consistent with a standard published by a public health authority within an applicable jurisdiction. (c) Applicability to service providers An operator of an automated exposure notification service shall instruct any service provider to which the entity transfers covered data to delete such data in accordance with the requirements of this subsection. (d) Research This section shall not be construed to prohibit data retention for public health research purposes consistent with the requirements in section 5(d). 7. Data security (a) In general An operator of an automated exposure notification service shall establish, implement, and maintain data security practices to protect the confidentiality, integrity, availability, and accessibility of covered data. Such covered data security practices shall be consistent with standards generally accepted by experts in the information security field. (b) Specific requirements Covered data security practices required under subsection (a) shall include, at a minimum, the following: (1) Assess risks and vulnerabilities Identifying and assessing any reasonably foreseeable risks to, and vulnerabilities in, each system maintained by the person or entity that processes or transfers covered data, including unauthorized access to or risks to covered data, human and technical vulnerabilities, access rights, and use of service providers. Such activities shall include a plan to receive and respond to unsolicited reports of risks and vulnerabilities by entities and individuals, developing and testing systems for monitoring the security of covered data, and resilience against denial of service attacks and malicious disinformation. (2) Preventive and corrective action Taking preventive and corrective action to mitigate any risks or vulnerabilities to covered data identified by the person or entity, which may include implementing administrative, technical, or physical safeguards or changes to covered data security practices or the architecture, installation, or implementation of network or operating software. (3) Breach notification Maintaining plans for responding to security incidents involving covered data and, in the most expedient time possible, consistent with the legitimate needs of law enforcement, notifying any individual whose data is subject to a security breach, as well as the Federal Trade Commission, of the breach, the data involved, any reasonably foreseeable impacts of the breach for individuals whose data is subject to the breach, the steps individuals may take to mitigate those impacts, and the measures the operator of the automated exposure notification service is taking to prevent a future incident. An operator of an automated exposure notification service shall require its service providers to provide notice to the operator of the automated exposure notification service of any breach of the security of the covered data immediately following the discovery of the breach. (c) Interference prohibited It shall be unlawful for any person or entity to transmit signals with the intent to cause an automated exposure notification service to produce inaccurate notifications or to otherwise interfere with the intended functioning of such a service. 8. Freedom of movement and nondiscrimination It shall be unlawful for any person or entity to segregate, discriminate against, or otherwise make unavailable to an individual or class of individuals the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation (as such term is defined in section 301 of the Americans With Disabilities Act of 1990 ( 42 U.S.C. 12181 9. Oversight (a) In general Section 1061 of the Intelligence Reform and Terrorism Prevention Act of 2004 ( 42 U.S.C. 2000ee (1) in subsection (c)— (A) in paragraph (1), by inserting or to respond to health-related epidemics from terrorism (B) in paragraph (2), by inserting or to respond to health-related epidemics against terrorism (2) in subsection (d)— (A) in paragraph (1), by inserting or to respond to health-related epidemics from terrorism (B) in paragraph (2)— (i) in subparagraph (B), by striking and (ii) in subparagraph (C), by striking the period at the end and inserting ; and (iii) by adding at the end the following: (D) the collection, use, storage, and sharing of covered data by Federal, State, or local government in connection with responding to a Federal declaration of a public health emergency to ensure that privacy and civil liberties are protected. . (b) Reports Section 1061(e) of the Intelligence Reform and Terrorism Prevention Act of 2004 ( 42 U.S.C. 2000ee(e) (3) Report on COVID–19 mitigation activities Not later than 1 year after the date of enactment of this paragraph, the Board shall issue a report, which shall be publicly available to the greatest extent possible, assessing the impact on privacy and civil liberties of Government activities in response to the public health emergency related to the Coronavirus 2019 (COVID–19), and making recommendations for how the Government should mitigate the threats posed by such emergency. (4) Reports on public health emergency response Not later than 1 year after any Federal emergency or disaster declaration related to public health, or not later than 1 year after the termination of such declaration, the Board shall issue a report, which shall be publicly available to the greatest extent possible, assessing the impact on privacy and civil liberties of Government activities in response to such emergency or disaster, and making recommendations for how the Government should mitigate the threats posed by such emergency or disaster. . 10. Enforcement (a) Enforcement by the Federal Trade Commission (1) Unfair or deceptive acts or practices A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (2) Powers of the Commission (A) In general Except as provided in paragraphs (3) and (4) of this subsection, the Federal Trade Commission (referred to in this Act as the Commission 15 U.S.C. 41 (B) Privileges and immunities Any person who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. (C) Effect on other laws Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law. (3) Independent litigation authority Notwithstanding section 16 of the Federal Trade Commission Act ( 15 U.S.C. 56 (4) Nonprofit organizations and communications common carriers Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act ( 15 U.S.C. 44 (A) any organization not organized to carry on business for the organization's own profit or that of the organization's members; and (B) common carriers subject to the Communications Act of 1934 ( 47 U.S.C. 151 (b) Enforcement by State attorneys general (1) In general If the chief law enforcement officer of a State, or an official or agency designated by a State, has reason to believe that any person has violated or is violating this Act, the attorney general, official, or agency of the State, in addition to any authority it may have to bring an action in State court under its consumer protection law, may bring a civil action in any appropriate United States district court or in any other court of competent jurisdiction, including a State court, to— (A) enjoin further such violation by such person; (B) enforce compliance with this Act; (C) obtain civil penalties; and (D) obtain damages, restitution, or other compensation on behalf of residents of the State. (2) Notice and intervention by the FTC The attorney general of a State shall provide prior written notice of any action under paragraph (1) to the Commission and provide the Commission with a copy of the complaint in the action, except in any case in which such prior notice is not feasible, in which case the attorney general shall serve such notice immediately upon instituting such action. The Commission shall have the right— (A) to intervene in the action; (B) upon so intervening, to be heard on all matters arising therein; and (C) to file petitions for appeal. (3) Relationship with State law claims If the attorney general of a State has authority to bring an action under State law directed at any act or practice that also violates this Act, the attorney general may assert the State law claim and a claim under this Act in the same civil action. (c) State law preservation Nothing in this Act shall be construed to preempt, displace, or supplant any State law, rule, regulation, or requirement, including— (1) any consumer protection law of general applicability such as any law regulating deceptive, unfair, or unconscionable practices; (2) any health privacy or infectious disease law; (3) any civil rights law; (4) any law that governs the privacy rights or other protections of employees, employee information, or students or student information; (5) any law that addresses notification requirements in the event of a covered data breach; (6) contract or tort law; (7) any criminal law governing fraud, theft, unauthorized access to information or unauthorized use of information, malicious behavior, and similar provisions, and any law of criminal procedure; (8) any law specifying a remedy or a cause of action to an individual; or (9) any public safety or sector-specific law unrelated to privacy or security. (d) Preservation of common law or statutory causes of action for civil relief Nothing in this Act, nor any amendment, standard, rule, requirement, assessment, law, or regulation promulgated under this Act, shall be construed to preempt, displace, or supplant any Federal or State common law right or remedy, or any statute creating a remedy for civil relief, including any cause of action for personal injury, wrongful death, property damage, or other financial, physical, reputational, or psychological injury based in negligence, strict liability, products liability, failure to warn, an objectively offensive intrusion into the private affairs or concerns of the individual, or any other legal theory of liability under any Federal or State common law, or any State statutory law. (e) Severability If any provision of this Act, or the application thereof to any person or entity or circumstance, is held invalid, the remainder of this Act and the application of such provision to other persons or entities not similarly situated or to other circumstances shall not be affected by the invalidation. (f) Authorization of appropriations There are authorized to be appropriated such sums as are necessary to carry out this Act and the amendments made by this Act. (g) Effective date This Act and the amendments made by this Act shall take effect on the date of the enactment of this Act.

Summary: Exposure Notification Privacy Act This bill establishes requirements for operators of services providing automatic notification of exposure to infectious diseases such as COVID-19 (i.e., coronavirus disease 2019). These include voluntary consent for enrollment in such services and procedures related to data privacy.