COVID-19 Consumer Data Protection Act of 2020

To protect the privacy of consumers' personal health information, proximity data, device data, and geolocation data during the coronavirus public health crisis. 1. Short title This Act may be cited as the COVID–19 Consumer Data Protection Act of 2020 2. Definitions In this Act: (1) Aggregated data The term aggregated data (A) relates to a group or category of individuals; and (B) does not identify, and is not linked or reasonably linkable to, any individual. (2) Affirmative express consent (A) In general The term affirmative express consent (i) clearly communicates the individual's authorization of an act or practice; and (ii) is taken after the individual has been presented with a clear and conspicuous description of such act or practice. (B) No inference from inaction For purposes of subparagraph (A), the affirmative express consent of an individual cannot be inferred from inaction. (3) Business contact information The term business contact information (4) Collection The term collection (5) Commission The term Commission (6) Covered data (A) In general The term covered data (B) Exclusions Such term does not include the following: (i) Aggregated data. (ii) Business contact information. (iii) De-identified data. (iv) Employee screening data. (v) Publicly available information. (7) Covered entity The term covered entity (A) is— (i) subject to the Federal Trade Commission Act ( 15 U.S.C. 41 (ii) a common carrier or nonprofit organization described in section 4(a)(4); (B) collects, processes, or transfers such covered data, or determines the means and purposes for the collection, processing, or transfer of covered data; and (C) is not a service provider with respect to such data. (8) COVID–19 public health emergency The term COVID–19 public health emergency (A) beginning on the date of enactment of this Act; and (B) ending on the last day of the public health emergency declared by the Secretary of Health and Human Services pursuant to section 319 of the Public Health Service Act ( 42 U.S.C. 247d Determination that a Public Health Emergency Exists Nationwide as the Result of the 2019 Novel Coronavirus (9) De-identified data The term de-identified data (A) does not identify and is not reasonably linkable to an individual; (B) does not contain any personal identifiers or other information that could be readily used to re-identify the individual to whom the information pertains; (C) is subject to a public commitment by the covered entity— (i) to refrain from attempting to use such information to identify any individual; and (ii) to adopt technical and organizational measures to ensure that such information is not linked to any individual; and (D) is not disclosed by the covered entity to any other party unless the disclosure is subject to a contractually or other legally binding requirement that— (i) the recipient of the information shall not use the information to identify any individual; and (ii) all onward disclosures of the information shall be subject to the requirement described in clause (i). (10) Employee screening data The term employee screening data (11) Delete The term delete (12) Individual (A) In general The term individual (B) Exclusion Such term does not include, with respect to a covered entity, an individual acting as a full-time or part-time, paid or unpaid employee, owner, director, officer, staff member, trainee, vendor, visitor, intern, volunteer, or contractor of a covered entity permitted to enter a physical site of operation of the covered entity. (13) Persistent identifier The term persistent identifier (14) Personal health information (A) In general The term personal health information (i) is— (I) genetic information of the individual; or (II) information relating to the diagnosis or treatment of past, present, or future physical, mental health, or disability of the individual; and (ii) identifies, or is reasonably linkable to, the individual. (B) Exclusions Such term does not include the following: (i) Information from education records that are subject to the requirements of section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g Family Educational Rights and Privacy Act of 1974 (ii) Information subject to regulations promulgated pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 (15) Precise geolocation data The term precise geolocation data (16) Process The term process (17) Proximity data The term proximity data (18) Publicly available information The term publicly available information (A) has been lawfully made available to the general public from Federal, State, or local government records; or (B) is widely available to the general public, including information from— (i) a telephone book or online directory; (ii) video, internet, or audio content; or (iii) the news media or a website that is available to the general public on an unrestricted basis (for purposes of this subclause a website is not restricted solely because there is a fee or log-in requirement associated with accessing the website). (19) Service provider The term service provider (20) Transfer The term transfer 3. Privacy of covered data (a) In general During the COVID–19 public health emergency, it shall be unlawful for a covered entity to collect, process, or transfer the covered data of an individual for a purpose described in subsection (b) unless— (1) the covered entity provides the individual with prior notice of the purpose for such collection, processing, or transfer; (2) the individual has given affirmative express consent to such collection, processing, or transfer; and (3) the covered entity publicly commits not to collect, process, or transfer such covered data for a purpose other than the purpose described in subsection (b) to which the individual consented unless— (A) such collection, processing, or transfer is necessary to comply with the provisions of this Act or other applicable laws; (B) such collection, processing, or transfer is necessary to carry out operational or administrative tasks in support of a purpose described in subsection (b) to which the individual has consented; or (C) the individual gives affirmative express consent to such collection, processing, or transfer. (b) Covered purposes The purposes described in this subsection are the following: (1) Collecting, processing, or transferring the covered data of an individual to track the spread, signs, or symptoms of COVID–19. (2) Collecting, processing, or transferring the covered data of an individual to measure compliance with social distancing guidelines or other requirements related to COVID–19 that are imposed on individuals under a Federal, State, or local government order. (3) Collecting, processing, or transferring the covered data of an individual to conduct contact tracing for COVID–19 cases. (c) Transparency (1) Privacy policy A covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall, not later than 14 days after the enactment of this Act, publish a privacy policy that— (A) is disclosed in a clear and conspicuous manner to an individual prior to or at the point of the collection of covered data for such a purpose from the individual; (B) is made available in a clear and conspicuous manner to the public; (C) includes whether, subject to the affirmative express consent requirement of subsection (a), the covered entity transfers covered data for such a purpose and the categories of recipients to whom the covered entity transfers covered data for such purpose; (D) includes a general description of the covered entity’s data retention practices for covered data used for a purpose described in subsection (b) and the purposes for such retention; and (E) includes a general description of the covered entity’s data security practices. (2) Reporting During the COVID–19 public health emergency, a covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall issue a public report not later than 30 days after the enactment of this Act and not less frequently than once every 60 days thereafter— (A) stating in aggregate terms the number of individuals whose covered data the entity has collected, processed, or transferred for such a purpose; and (B) describing the categories of covered data collected, processed, or transferred by the entity, the specific purposes for which each such category of covered data is collected, processed, or transferred, and, in the case of transferred covered data, to whom such data was transferred. (d) Right to opt-Out During the COVID–19 public health emergency, each covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall do the following: (1) The covered entity shall provide an effective mechanism for an individual who has consented pursuant to subsection (a) to the collection, processing, or transfer of the individual's covered data for such a purpose to revoke such consent. (2) A covered entity that receives a revocation of consent from an individual described in paragraph (1) shall, as soon as practicable but in no case later than 14 days after receiving such revocation, stop collecting, processing, or transferring the covered data of such individual for a purpose described in subsection (b), or shall de-identify all such data. (e) Data deletion A covered entity shall delete or de-identify all covered data collected, processed, or transferred for a purpose described in subsection (b) when it is no longer being used for such purpose and is no longer necessary to comply with a Federal, State, or local legal obligation, or the establishment, exercise, or defense of a legal claim. (f) Data accuracy A covered entity shall take reasonable measures to ensure the accuracy of covered data collected, processed, or transferred for a purpose described in subsection (b) and shall provide an effective mechanism for an individual to report inaccuracies in covered data. (g) Data minimization (1) In general During the COVID–19 public health emergency, a covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall not collect, process, or transfer covered data beyond what is reasonably necessary, proportionate, and limited to carry out such purpose. (2) Guidelines Not later than 30 days after the date of enactment of this Act, the Commission shall issue guidelines recommending best practices for covered entities to minimize the collection, processing, and transfer of covered data in accordance with this subsection. (h) Protection of covered data During the COVID–19 public health emergency, a covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall establish, implement, and maintain reasonable administrative, technical, and physical data security policies and practices to protect against risks to the confidentiality, security, and integrity of such data. (i) Exception Notwithstanding subsection (a), a covered entity may collect, process, or transfer the covered data of an individual or group of individuals for a purpose described in subsection (b) during the COVID–19 public health emergency without obtaining the affirmative express consent of the individual if such collection, processing, or transfer is necessary to allow the covered entity to comply with a Federal, State, or local legal obligation. 4. Enforcement (a) Enforcement by federal trade commission (1) Unfair or deceptive acts or practices A violation of this Act shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (2) Powers of commission Except as provided in paragraph (4), the Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 (3) Cooperation with other agencies Whenever the Commission obtains information that any covered entity may have processed or transferred covered data in violation of Federal anti-discrimination laws, the Commission shall transmit the information to the appropriate Federal or State agency with authority to initiate proceedings related to such violation. (4) Common carriers and nonprofit organizations Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act ( 15 U.S.C. 44 (A) common carriers subject to the Communications Act of 1934 ( 47 U.S.C. 151 (B) organizations not organized to carry on business for their own profit or that of their members. (b) Effect on other laws (1) In general Nothing in this Act shall be construed in any way to limit the authority of the Commission under any other provision of law. (2) Nonapplication of fcc laws and regulations to covered entities Notwithstanding any other provision of law, neither any provision of the Communications Act of 1934 ( 47 U.S.C. 151 911 (3) State preemption No State or political subdivision of a State may adopt, maintain, enforce, or continue in effect any law, regulation, rule, requirement, or standard to the extent that such law, regulation, rule, requirement, or standard is related to the collection, processing, or transfer of covered data for a purpose described in section 3(b). (c) Enforcement by State attorneys general (1) In general In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is adversely affected by the engagement of any covered entity in an act or practice that violates this Act, the attorney general of the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to— (A) enjoin that act or practice; (B) enforce compliance with this Act or the regulation; (C) obtain damages, civil penalties, restitution, or other compensation on behalf of the residents of the State; or (D) obtain such other relief as the court may consider to be appropriate. (2) Rights of the commission (A) In general Except where not feasible, the attorney general of a State shall notify the Commission in writing prior to initiating a civil action under paragraph (1). Such notice shall include a copy of the complaint to be filed to initiate such action. Upon receiving such notice, the Commission may intervene in such action and, upon intervening— (i) be heard on all matters arising in such action; and (ii) file petitions for appeal of a decision in such action. (B) Notification timeline Where it is not feasible for the attorney general of a State to provide the notification required by subparagraph (A) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately after initiating the civil action. (3) Actions by commission In any case in which a civil action is instituted by the Commission for violation of this Act, no attorney general of a State may, during the pendency of such action, institute a civil action against any defendant named in the complaint in the action instituted by the Commission for a violation of this Act that is alleged in such complaint. (4) Investigatory powers Nothing in this Act shall be construed to prevent the attorney general of a State or another authorized official of a State from exercising the powers conferred on the attorney general or the State official by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence. (5) Consolidation of actions brought by two or more State attorneys general or authorized State governmental authorities Whenever a civil action under paragraph (1) is pending and another civil action or actions are commenced pursuant to such paragraph in a different Federal district court or courts that involve 1 or more common questions of fact, such action or actions shall be transferred for the purposes of consolidated pretrial proceedings and trial to the United States District Court for the District of Columbia; provided however, that no such action shall be transferred if pretrial proceedings in that action have been concluded before a subsequent action is filed by a State attorney general or authorized State governmental authority.

Summary: COVID-19 Consumer Data Protection Act of 2020This bill generally prohibits covered entities from collecting, processing, or transferring an individual's personally identifiable information for the purpose of contact tracing with respect to COVID-19 (i.e., coronavirus disease 2019) without first obtaining the individual's affirmative consent to use such information. Applicable personally identifiable information includes, but is not limited to, precise geolocation data, long-lasting digital identifiers of individuals, and personal health information. However, such information does not include data that is de-identified, related to employee health screening for on-site entry, or publicly available. Covered entities, which include businesses, common carriers, and certain nonprofit organizations, also must provide a mechanism for individuals to revoke prior affirmative consent.