On May 14, 2020 Democrats in both the House and Senate introduced the Public Health Emergency Privacy Act (“the Act”). In the House, the Act was sponsored by Representatives Jan Schakowsky (IL), Anna Eshoo (CA) and Suzan DelBene (WA), and in the Senate was sponsored by Senators Richard Blumenthal (CT) and Mark Warner (VA). Similar to the recently-introduced COVID-19 Consumer Data Protection Act of 2020, the Act would put temporary rules in place regarding the collection, use and disclosure of emergency health data used to combat the spread of the coronavirus. The rules imposed by the Act would only apply during the course of the Public Health Emergency as declared by the Secretary of Health and Human Services (“HHS”) and would only apply to specific uses of certain personal data.

In particular, the Act would only apply to personal data concerning the COVID-19 health emergency, including physical or behavioral health information and data such as geolocation data, proximity data and demographic data, collected for the purpose of tracking, screening, monitoring, contact tracing or otherwise responding to COVID-19. It would require that covered organizations, which include government entities, take a number of steps to secure such data and protect the privacy of individuals whose data has been collected, used or disclosed. This includes requiring covered organizations to:

• Only collect, use or disclose data that is necessary, proportionate and limited for a good-faith health purpose;
• Take measures to ensure the accuracy of data and provide a mechanism for individuals to correct inaccuracies;
• Adopt reasonable safeguards to prevent unlawful discrimination on the basis of emergency health data;
• Only disclose data to a government entity if it is to a public health authority and is solely for public health purposes;
• Establish and implement reasonable data security policies, practices and procedures;
• Obtain affirmative express consent before collecting, using or disclosing emergency health data unless one of several narrow exceptions are met, and provide individuals with the ability to revoke that consent;
• Provide notice in a privacy policy prior to collection describing the purposes for which the data will be used, the categories of recipients to whom the data will be disclosed, the purpose of that disclosure and the rights individuals may exercise;
• Issue a public report every 90 days stating the number of individuals whose data has been collected, used or disclosed, the categories of data collected, and the purpose for which it was used and disclosed if the covered organization has collected, used or disclosed data of over at least 100,000 individuals; and
• Not use or maintain emergency health data 60 days after the public health emergency has been terminated, and destroy or render not linkable such data.

The Act also would:

• Require the Federal Trade Commission (“FTC”) to promulgate regulations regarding data that was collected, used or disclosed prior to its enactment;
• Prevent government entities from using data to deny, restrict or interfere with an individual’s right to vote;
• Require the Secretary of HHS to submit reports examining the civil rights impact of the collection, use and disclosure of data covered by this Act;
• Give enforcement authority to both the FTC and state attorneys general ;
• Create a private right of action for negligent, reckless, willful and intentional violations of the Act if there was a concrete and particularized injury in fact to an individual;
• Not preempt any federal or state laws; and
• Go into effect 30 days after its enactment.