On April 30, 2020, four Republican Senators^[1],including the Chairman of the U.S. Senate Committee on Commerce, Science & Transportation, announced that they intend to introduce federal privacy legislation to regulate the collection and use of personal information in connection with the Coronavirus pandemic.  According to the Senators’ press release, the COVID-19 Consumer Data Protection Act (the “Act”) would:

• Require companies subject to the Federal Trade Commission’s jurisdiction to obtain affirmative express consent from individuals to collect, process, or transfer their personal health, geolocation, or proximity information for the purposes of tracking the spread of COVID-19.

• Direct companies to disclose to consumers at the point of collection how their data will be handled, to whom it will be transferred, and how long it will be retained.

• Establish clear definitions of “aggregate” and “de-identified” data to ensure companies adopt certain technical and legal safeguards to protect consumer data from being re-identified.

• Require companies to allow individuals to opt out of the collection, processing, or transfer of their personal health, geolocation, or proximity information.

• Direct companies to publish transparency reports describing their data collection activities related to COVID-19.

• Establish data minimization and data security requirements for any personally identifiable information collected by a covered entity.

• Require companies to delete or de-identify all personally identifiable information when it is no longer being used for the COVID-19 public health emergency.

• Authorize state attorneys general to enforce the Act.

According to the press release, the Act “would provide all Americans with more transparency, choice, and control over the collection and use of their personal health, geolocation, and proximity data.”  Nonetheless, the bill reportedly contains a provision that will pre-empt provisions of state privacy laws that are more prescriptive than the federal protections.

The Senators’ announcement seems to signal an increased interest among federal legislators in protecting individuals’ privacy rights during this pandemic.  As mentioned in our earlier article, tracking the spread of COVID-19 will likely impact individuals’ privacy rights.  Any legislation should carefully balance the collective interest in battling the pandemic with individuals’ privacy rights in order to build consumer trust in the use of sensitive health and location data and voluntary take-up of contact tracing apps.

We will provide further analysis of the substance of the Act shortly.

[1] US Sens. John Thune (R-S.D), Roger Wicker (R-Miss.), Jerry Moran (R-Kan.), and Marsha Blackburn (R-Tenn.).