Democrats introduce coronavirus-focused privacy legislation

Democrats in both chambers introduced legislation Thursday aimed at protecting the privacy and security of health data during the coronavirus pandemic.

The Public Health Emergency Privacy Act would place strict limits on what and by whom data collected for public health purposes can be used, implement data minimization procedures for that info, and require opt-in consent for any efforts.

The legislation comes as health agencies and tech companies are developing contact tracing and monitoring tools to contain the pandemic.

It would bar conditioning the right to vote based on use of such services or a medical condition.

The bill would also formally mandate data collected to fight the pandemic be deleted after the public health emergency.

Sens. Richard Blumenthal (D-Conn.) and Mark Warner (D-Va.) introduced the legislation in the Senate.

“Legal safeguards protecting consumer privacy failed to keep pace with technology, and that lapse is costing us in the fight against COVID-19,” Blumenthal said in a statement, referring to the disease caused by the coronavirus.

“Americans are rightly skeptical that their sensitive health data will be kept safe and secure, and as a result, they’re reluctant to participate in contact tracing programs essential to halt the spread of this disease,” he added.

Reps. Anna Eshoo (D-Calif), Jan Schakowsky (D-Ill.) and Suzan DelBene (D-Wash.) introduced the House version.

“As we consider new technologies that collect vast amounts of sensitive personal data, we must not lose site of the civil liberties that define who we are as a nation,” Eshoo, who represents a portion of Silicon Valley, said in a statement.

Reps. Yvette Clarke (D-N.Y.), G.K. Butterfield (D-N.Y.) and Tony Cárdenas (D-Calif.) are also co-sponsors.

The legislation from Democrats comes two weeks after Senate Republicans introduced another bill focused on data privacy in the context of the pandemic. It did not receive any Democratic support.

That bill would also create an opt-in requirement, but is more limited to data collected for the “purposes of tracking the spread of COVID-19.”

It also does not include the civil rights protections in the Democratic version.

Another key difference between the bills is a private right to action, which would let individual consumers sue companies over violations.

Democrats have pushed for that right in previous efforts at data privacy legislation, while Republicans have declined to include it.

The bill introduced by Democrats also explicitly allows states and federal regulators to craft additional rules protecting user data during outbreaks, making the legislation a floor rather than a ceiling.

Republicans have long insisted that federal data privacy legislation should preempt state laws, a position that has gained importance since the passage of California’s landmark privacy law, which Republicans have said is too stringent.

These two issues – a private right of action and state preemption – have derailed several prior efforts at creating bipartisan consensus on a federal data privacy law.