House and Senate Democrats recently unveiled proposed legislation—tentatively titled the “Public Health Emergency Privacy Act”—that would regulate the collection and use of health and location information in connection with efforts to track and limit the spread of COVID-19.

Below we describe the proposed Public Health Emergency Privacy Act and how it differs with a separate Republican proposal, the “COVID-19 Consumer Data Protection Act,” which we previously analyzed on this blog:

• The Public Health Emergency Privacy Act would regulate any person (including government entities other than public health authorities) that collects, processes, or transfers certain covered data or develops or operates a website, web application, mobile application, mobile operating system feature, or smart device application to track, screen, monitor, contact trace, mitigate, or otherwise respond to COVID-19. The bill distinguishes between covered entities and service providers for some of these purposes.
• The bill would regulate “emergency health data,” which is defined as any data linked or reasonably linkable to an individual or device that “concerns the public COVID-19 health emergency.” Like the Republican proposal, this includes health information, geolocation information, and proximity data.  In addition, the bill identifies as examples of emergency health data certain additional categories of regulated data, including whether an individual has been tested for or “an estimate of the likelihood that a particular individual may contract” the disease or disorder; genetic data, biological samples, and biometrics; demographic data; contact information; and any other data collected from a personal device.
• Like the Republican proposal, many of the bill’s key requirements are consistent with existing federal or state privacy requirements or norms, including obligations to post a clear and conspicuous privacy policy and to maintain reasonable data security policies and practices.
• Like the Republican proposal, this bill would generally require affirmative express consent to collect, use, or disclose covered data. There also would be a requirement to provide individuals “effective mechanisms” to revoke consent and to correct any inaccurate emergency health data.  However, the proposal would also prohibit certain collection, use and disclosure of emergency health data, even with consent.  For example, the proposal would prohibit use of emergency health data for commercial advertising, e-commerce recommendations, or for use as training data for advertising or e-commerce algorithms.
• Other notable examples of prohibited uses of emergency health data include: (1) uses of emergency health data to solicit or contract for employment, insurance, housing or education opportunities; or (2) to limit the availability of any goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation, except where authorized by the government for a public health purpose. Relatedly, the bill obligates covered organizations to adopt reasonable safeguards to prevent “unlawful discrimination” on the basis of emergency health data.
• The proposal would appear to limit disclosures of emergency health data, even with consent, to government entities except where the disclosure is to a public health authority and made “solely for good faith public health purposes and in direct response to exigent circumstances.” There also is an exception for disclosures pursuant to appropriate legal process.
• The bill would require the destruction of emergency health data after the later of 60 days after termination of the public health emergency declaration by the Secretary of Health and Human Services (“HHS”) or by state officials. Otherwise, the bill requires destruction 60 days after the collection of such data.
• Like the Republican proposal, the proposed legislation would include a public reporting obligation. Under the Democratic proposal, the reporting obligation would require reporting every 90 days of the aggregated number of individuals whose emergency health data is collected, used, and processed for COVID-19 purposes.

The Democratic bill specifically exempts public health or scientific research by certain eligible researchers from its privacy requirements.  The privacy regulations in the proposal do not apply to entities regulated by HIPAA, but the Secretary of HHS is tasked with promulgating guidance on the applicability of similar requirements to covered entities and business associates.

Like the Republican proposal, the Federal Trade Commission could enforce violations under Section 5 of the FTC Act, and state attorneys general would have the right to enforce the bill’s obligations, including to obtain civil penalties.  However, there is also a private right of action, which requires proof of a concrete and particularized injury in fact.  Statutory damages are available from $100 to $1,000 per violation, and increased to between $500 to $5,000 for reckless or willful violations.  The bill would expressly invalidate pre-dispute arbitration agreements or class action waiver provisions.

This Democratic bill comes in addition to a separate proposal from House and Senate Democrats, entitled the “Emergency Limitation Periods Extension for Workers Act.”  That proposal would extend the statute of limitations period under a number of federal statutes, including the Fair Labor Standards Act and the Occupational Safety and Health Act, by 90 days after the termination of the public health emergency.