Two Diverging Federal COVID-19 Privacy Bills Proposed

Covered Entities:

• Private sector entities that collect, process, or transfer “covered data,” or determine the means and purposes for the collection, processing, or transfer of covered data.
• Excluded:   Service providers.

Covered Organizations:

• Defined broadly to include private and public sector entities that collect or process “emergency health data” electronically, or that develop or operate a website, mobile application, or smart device application for the purposes of tracking, monitoring, contact tracing, or otherwise responding to the COVID-19 public health emergency.
• However, the bill does not apply to as-defined public health authorities, service providers, health care providers, people acting in their individual or household capacities, or people engaged in de minimis collection or processing of emergency health data.

Covered Data:

• Precise geolocation data, proximity data, a persistent identifier, and personal health information.
• Excluded: Aggregated data, business contact information, de-identified data, employee screening data, and publicly available information.

Emergency Health Data:

• Data linked or reasonably linkable to an individual or device, including data inferred or derived about the individual or device from other collected data provided such data is still linked or reasonably linkable to the individual or device, that concerns the public COVID-19 health emergency.
• Emergency health data would include health-related data, such as test result data, genetic data, and biometric data.  This would also include contact-tracing related data, geolocation data, or any other data collected from a personal device.

Covered Entities would generally be required, among other things, to:

• Provide an individual with prior notice of the purpose for collection, processing, or transfer of covered data.
• Obtain affirmative express consent for such collection, processing, or transfer, and provide an effective mechanism for an individual to later revoke such consent.

• Publicly commit not to collect, process, or transfer covered data other than for the following Covered Purposes (subject to exception):

• To track the spread, signs, or symptoms of COVID-19;
• To measure compliance with social distancing guidelines or other requirements related to COVID-19; and
• To conduct contact tracing for COVID-19 cases.

• Provide to an individual prior to or at the point of collection a privacy policy describing the Covered Entity’s practices regarding covered data.

• Issue a public report every 60 days providing certain aggregate data points and describing its covered data practices.

• Establish, implement, and maintain reasonable administrative, technical, and physical data security policies and practices to protect against risks to the confidentiality, security, and integrity of covered data.

• Delete or de-identify all covered data when no longer being used for a covered purpose and no longer necessary to comply with legal obligations or the establishment, exercise, or defense of a legal claim.

Covered Organizations would generally be required, among other things, to:

• Only collect, use, or disclose emergency health data that is necessary, proportionate, and limited for a good faith public health purpose.
• Obtain affirmative express consent for the collection, use, or disclosure of emergency health data, as well as provide an effective mechanism for an individual to later revoke such consent.
• Not collect, use, or disclose emergency health data for certain commercial purposes, such as commercial advertising, or for purposes of discriminating in any place of public accommodations.

• Provide to an individual prior to or at the point of collection a privacy policy describing the covered organization’s practices regarding emergency health data.

• Covered organizations that collect, use, or disclose emergency health data of at least 100,000 individuals would be required to issue a public report every 90 days providing certain aggregate data points and describing its emergency health data practices.

• Establish and implement reasonable data security policies, practices, and procedures to protect the security and confidentiality of emergency health data.

• Destroy emergency health data within 60 days of the termination of HHS’ declared public health emergency, and within 30 days after an individual revokes consent.