,,ii #aafth ,,congress #ast ,session ,s4 #bhhe ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,november #ah1 #bjai,mr4 ,cassidy 7for himself and ,ms4 ,rosen7 introduced the following bill2 which was read twice and referred to the ,committee on ,health1 ,education1 ,labor1 and ,pensions ,a ,,bill ,to prohibit the transfer or sale of certain consumer health information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,stop ,marketing ,and ,revealing ,the ,wearables ,and ,trackers ,consumer ,health ,data ,act or the ,,smartwatch ,data ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,aggregated ,the term aggregated1 with respect to consumer health information-- 7,a7 means the removal of individual consumer identities1 so that the information is not linked or reasonably linkable to any consumer1 including a personal consumer device2 and 7,b7 does not include one or more individual consumer records that have not been deidentified4 7#b7 ,biometric information ,the term biometric information-- 7,a7 means the physiological1 biological1 or behavioral characteristics of an individual1 and the recorded1 copied1 captured1 converted1 stored derivatives of any such characteristics1 that can be used1 singly or in combination with each other or with other identifying data1 to establish the identity of an individual2 and 7,b7 includes deoxyribonucleic acid1 imagery of the iris1 retina1 fingerprint1 face1 hand1 palm1 vein patterns1 and voice recordings1 from which an identifier template1 such as a faceprint1 a minutiae template1 or a voiceprint1 can be extracted4 7#c7 ,business associate2 covered entity2 protected health information ,the terms business associate1 covered entity1 and protected health information have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7#d7 ,commercial purposes ,the term commercial purposes-- 7,a7 means an action intended-- 7i7 to advance the commercial or economic interests of a person1 such as by inducing another person to buy1 rent1 lease1 join1 subscribe to1 provide1 or exchange products1 goods1 property1 information1 or services2 or 7ii7 to enable or affect1 directly or indirectly1 a commercial transaction2 and 7,b7 does not include engaging in speech that ,state or ,federal courts have recognized as noncommercial speech1 including political speech and journalism4 7#e7 ,consumer device ,the term consumer device-- 7,a7 means a commercially produced piece of equipment1 application software1 or mechanism that has the primary function or capability to collect1 store1 or transmit consumer health information2 and 7,b7 may include a device1 as defined in section #bja7;h7 of the ,federal ,food1 ,drug1 and ,cosmetic ,act 7#ba ,u4,s4,c4 #cba7;h774 7#f7 ,consumer health information ,the term consumer health information means any information about the health status1 personal biometric information1 or personal kinesthetic information about a specific individual that is created or collected by a personal consumer device1 whether detected from sensors or input manually4 7#g7 ,deidentified ,the term deidentified means information that cannot reasonably identify1 relate to1 describe1 be capable of being associated with1 or be linked1 directly or indirectly1 to a particular consumer1 computer1 or other device4 7#h7 ,information broker ,the term information broker means any entity that collects consumers' personal information and resells or shares that information with another person4 7#i7 ,kinesthetic information ,the term kinesthetic information means keystroke patterns or rhythms1 gait patterns or rhythms1 sleep information1 and other data that relates to the personal health of an individual4 #c4 ,prohibitions 7a7 ,in general ,subject to subsection 7b71 no entity that collects consumer health information may-- 7#a7 transfer1 sell1 share1 or allow access to any consumer health information 7unless aggregated or anonymized7 or any other individually identifiable consumer health information collected1 recorded1 or derived from personal consumer devices to any domestic information broker or other domestic entity if-- 7,a7 the primary business function of such domestic information broker or other domestic entity is collecting or analyzing consumer information for profit2 or 7,b7 the purpose for transferring1 selling1 sharing1 or allowing access to such information is to otherwise add value to the entity that collects consumer health information1 for commercial purposes2 or 7#b7 transfer1 sell1 or allow access to any consumer health information collected1 stored1 recorded1 or derived from personal consumer devices to any information broker or any entity outside of the jurisdiction of the ,united ,states4 7b7 ,exceptions 7#a7 ,in general ,subject to paragraph 7#c71 the prohibition under subsection 7a77#a7 shall not apply if-- 7,a7 the entity obtains the informed consent of the consumer2 7,b7 the information is provided to a covered entity1 as defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 7,c7 such information is provided to a government organization or agency1 including law enforcement or regulators1 to comply with applicable laws1 regulations1 or rules1 or requests of law enforcement1 regulatory1 or other governmental agencies or in response to a legal process in connection with a subpoena1 warrant1 discovery order1 or other request or order from a law enforcement agency2 7,d7 such information is provided to the entity's affiliates or other trusted businesses or persons to process the information as part of the entity's external processing procedures1 based on the entity's instructions and in compliance with privacy protections and any other appropriate confidentiality and security measures2 7,e7 such information is provided in connection with a substantial corporate transaction of the entity1 such as the transfer of ownership1 a merger1 consolidation1 asset sale1 or bankruptcy or insolvency2 or 7,f7 such information is provided to academic1 medical1 research institutions1 or other nonprofit organizations acting in the public interest for the purpose of detecting or responding to security incidents2 preventing fraud2 conducting scientific1 historical1 or statistical research2 or preserving the security and safety of people or property4 7#b7 ,transfers to foreign entities ,subject to paragraph 7#c71 the prohibition under subsection 7a77#b7 shall not apply if-- 7,a7 the transfer is made only for limited and specific purposes consistent with the consent provided by the individual and with assurances that the recipient will notify the entity providing the data if such recipient makes a determination that it can no longer use the data consistent with such consent2 7,b7 the entity transferring the information determines that the recipient of the information will provide the same level of privacy protection as is required by the entity transferring the information2 7,c7 the entity transferring the information takes reasonable and appropriate steps to ensure that the third party effectively processes the personal information transferred in a manner consistent with the third party's obligations under the second party's privacy principles2 and 7,d7 the entity transferring the information agrees to take reasonable steps to stop and remediate unauthorized processing of information by the entity to whom such information is transferred4 7#c7 ,limitation ,none of the exceptions under paragraphs 7#a7 and 7#b7 shall supersede any contrary rule promulgated by the ,federal ,trade ,commission that is in effect on the date of enactment of this ,act4 7c7 ,treatment of consumer health information as protected health information ,if a covered entity or business associate1 acting in its capacity as a business associate1 receives consumer health information generated by a personal consumer device at any time for any reason1 such consumer health information is considered protected health information and is subject to the same protections and restrictions under parts #afb and #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 as any other protected health information4 #d4 ,enforcement ,the ,secretary of ,health and ,human ,services shall enforce the requirements of section #c against an entity that collects or receives consumer health information in the same manner and to the same extent1 as such secretary enforces the privacy regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia2 #aaj ,stat4 #bjcc7 against a covered entity4