On April 30, a group of senators announced their plan to introduce the “COVID-19 Consumer Data Protection Act” (the “Act”). The Act would cover the collection and use of personal geolocation, health, and proximity data, and provide measures to hold businesses accountable to consumers if they misappropriate personal data to fight the coronavirus (“COVID-19”) pandemic.
The announcement of the Act comes on the heels of new guidance from the Centers for Disease Control and Prevention regarding digital COVID-19 contact–tracing tools, and with an eye toward Apple and Google, who are collaborating with public health officials to develop an app that can alert smartphone users if they have come near a person who has tested positive for COVID-19.
In a press release, senators said that the Act “would provide all Americans with more transparency, choice, and control over the collection and use of their personal health, geolocation, and proximity data.” Furthermore, the Act will aim to balance innovation, “allowing technology companies to continue their work toward developing platforms that could trace the virus,” with the need to protect sensitive and personal information.
For example, the Act would require companies under the jurisdiction of the FTC to obtain express consent from individuals before collecting, processing, or transferring certain personal data for the purposes of tracking the spread of COVID-19. Additionally, it would require companies to disclose how consumer data will be handled and to whom it will be transferred, and to report their data collection activities to the public.
Additionally, the Act will establish enforcement authority for both state attorneys general and the Federal Trade Commission, which recently reported it has received over 35,000 fraud complaints—amounting to over $23 million—relating to COVID-19 as of May 5. The FTC’s complete report on COVID-19 complaints is available here.
Sen. Roger Wicker (R-Miss.), chairman of the Senate Committee on Commerce, Science, and Transportation, will introduce the Act. Wicker’s co-sponsors include senators Marsha Blackburn (R-Tenn.), Jerry Moran (R-Kan.), and John Thune (R-S.D.).
Even in the absence of legislation, developers working towards creating platforms to trace the virus should be mindful of privacy considerations. To this end, developers may want to consider using the Fair Information Practice Principles, which provide the foundation for many United States state and federal privacy laws, to guide their actions. For additional information, see our article published in Law360, “Privacy Guidelines for COVID-19 Contact-Tracing App Makers.”
For regular updates about the impact that COVID-19 is having on the financial services sector, visit the Troutman Sanders/Pepper Hamilton joint COVID-19 Resource Center, or the COVID-19 feed here on the CFS Law Monitor.