,,ii #aafth ,,congress #b;d ,session ,s4 #cffc ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,may #g1 #bjbj,mr4 ,wicker 7for himself1 ,mr4 ,thune1 ,mr4 ,moran1 ,mrs4 ,blackburn1 and ,mrs4 ,fischer7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect the privacy of consumers' personal health information1 proximity data1 device data1 and geolocation data during the coronavirus public health crisis4 #a4 ,short title ,this ,act may be cited as the ,,covid-#ai ,consumer ,data ,protection ,act of #bjbj4 #b4 ,definitions ,in this ,act3 7#a7 ,aggregated data ,the term aggregated data means information that-- 7,a7 relates to a group or category of individuals2 and 7,b7 does not identify1 and is not linked or reasonably linkable to1 any individual4 7#b7 ,affirmative express consent 7,a7 ,in general ,the term affirmative express consent means an affirmative act by an individual that-- 7i7 clearly communicates the individual's authorization of an act or practice2 and 7ii7 is taken after the individual has been presented with a clear and conspicuous description of such act or practice4 7,b7 ,no inference from inaction ,for purposes of subparagraph 7,a71 the affirmative express consent of an individual cannot be inferred from inaction4 7#c7 ,business contact information ,the term business contact information means information related to an individual's business position name or title1 business telephone number1 business address1 business email address1 and other similar business information1 provided that such information is collected1 processed1 or transferred solely for purposes related to such individual's professional activities4 7#d7 ,collection ,the term collection means buying1 renting1 gathering1 accessing1 or otherwise acquiring any covered data of an individual by any means4 7#e7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#f7 ,covered data 7,a7 ,in general ,the term covered data means precise geolocation data1 proximity data1 a persistent identifier1 and personal health information4 7,b7 ,exclusions ,such term does not include the following3 7i7 ,aggregated data4 7ii7 ,business contact information4 7iii7 ,de-identified data4 7iv7 ,employee screening data4 7v7 ,publicly available information4 7#g7 ,covered entity ,the term covered entity means1 with respect to a set of covered data1 any entity or person that-- 7,a7 is-- 7i7 subject to the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 or 7ii7 a common carrier or nonprofit organization described in section #d7;a77#d72 7,b7 collects1 processes1 or transfers such covered data1 or determines the means and purposes for the collection1 processing1 or transfer of covered data2 and 7,c7 is not a service provider with respect to such data4 7#h7 ,,covid-#ai public health emergency ,the term ,,covid-#ai public health emergency means the period-- 7,a7 beginning on the date of enactment of this ,act2 and 7,b7 ending on the last day of the public health emergency declared by the ,secretary of ,health and ,human ,services pursuant to section #cai of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bdg;d7 on ,january #ca1 #bjbj1 entitled ,determination that a ,public ,health ,emergency ,exists ,nationwide as the ,result of the #bjai ,novel ,coronavirus 7including any renewal of such declaration pursuant to such section #cai74 7#i7 ,de-identified data ,the term de-identified data means information held by a covered entity that-- 7,a7 does not identify and is not reasonably linkable to an individual2 7,b7 does not contain any personal identifiers or other information that could be readily used to re-identify the individual to whom the information pertains2 7,c7 is subject to a public commitment by the covered entity-- 7i7 to refrain from attempting to use such information to identify any individual2 and 7ii7 to adopt technical and organizational measures to ensure that such information is not linked to any individual2 and 7,d7 is not disclosed by the covered entity to any other party unless the disclosure is subject to a contractually or other legally binding requirement that-- 7i7 the recipient of the information shall not use the information to identify any individual2 and 7ii7 all onward disclosures of the information shall be subject to the requirement described in clause 7i74 7#aj7 ,employee screening data ,the term employee screening data means1 with respect to a covered entity1 covered data of an individual who is an employee1 owner1 director1 officer1 staff member1 trainee1 vendor1 visitor1 intern1 volunteer1 or contractor of the covered entity1 provided that such data is only collected1 processed1 or transferred by the covered entity for the purpose of determining1 for purposes related to the ,,covid-#ai public health emergency1 whether the individual is permitted to enter a physical site of operation of the covered entity4 7#aa7 ,delete ,the term delete means to remove or destroy information such that it is not maintained in human or machine readable form and cannot be retrieved or utilized in the normal course of business4 7#ab7 ,individual 7,a7 ,in general ,the term individual means a natural person residing in the ,united ,states4 7,b7 ,exclusion ,such term does not include1 with respect to a covered entity1 an individual acting as a full-time or part-time1 paid or unpaid employee1 owner1 director1 officer1 staff member1 trainee1 vendor1 visitor1 intern1 volunteer1 or contractor of a covered entity permitted to enter a physical site of operation of the covered entity4 7#ac7 ,persistent identifier ,the term persistent identifier means a technologically derived identifier that identifies an individual1 or is linked or reasonably linkable to an individual over time and across services and platforms1 which may include a customer number held in a cookie1 a static ,internet ,protocol 7,,ip7 address1 a processor or device serial number1 or another unique device identifier4 7#ad7 ,personal health information 7,a7 ,in general ,the term personal health information means information relating to an individual that-- 7i7 is-- 7,i7 genetic information of the individual2 or 7,,ii7 information relating to the diagnosis or treatment of past1 present1 or future physical1 mental health1 or disability of the individual2 and 7ii7 identifies1 or is reasonably linkable to1 the individual4 7,b7 ,exclusions ,such term does not include the following3 7i7 ,information from education records that are subject to the requirements of section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g1 commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd7 or from records described in subsection 7a77#d77;,b77iv7 of such section4 7ii7 ,information subject to regulations promulgated pursuant to section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 7#ae7 ,precise geolocation data ,the term precise geolocation data means technologically derived information capable of determining with reasonable specificity the past or present actual physical location of an individual at a specific point in time4 7#af7 ,process ,the term process means any operation or set of operations performed on covered data1 including analyzing1 organizing1 structuring1 retaining1 using1 or otherwise handling such data4 7#ag7 ,proximity data ,the term proximity data means technologically derived information that identifies the past or present proximity of one individual to another4 7#ah7 ,publicly available information ,the term publicly available information means any information that-- 7,a7 has been lawfully made available to the general public from ,federal1 ,state1 or local government records2 or 7,b7 is widely available to the general public1 including information from-- 7i7 a telephone book or online directory2 7ii7 video1 internet1 or audio content2 or 7iii7 the news media or a website that is available to the general public on an unrestricted basis 7for purposes of this subclause a website is not restricted solely because there is a fee or log-in requirement associated with accessing the website74 7#ai7 ,service provider ,the term service provider means1 with respect to a set of covered data1 an entity that processes or transfers such covered data for the purpose of performing one or more services or functions on behalf of1 and at the direction of1 a covered entity to which it is not related4 7#bj7 ,transfer ,the term transfer means to disclose1 release1 share1 disseminate1 or otherwise make available covered data by any means4 #c4 ,privacy of covered data 7a7 ,in general ,during the ,,covid-#ai public health emergency1 it shall be unlawful for a covered entity to collect1 process1 or transfer the covered data of an individual for a purpose described in subsection 7b7 unless-- 7#a7 the covered entity provides the individual with prior notice of the purpose for such collection1 processing1 or transfer2 7#b7 the individual has given affirmative express consent to such collection1 processing1 or transfer2 and 7#c7 the covered entity publicly commits not to collect1 process1 or transfer such covered data for a purpose other than the purpose described in subsection 7b7 to which the individual consented unless-- 7,a7 such collection1 processing1 or transfer is necessary to comply with the provisions of this ,act or other applicable laws2 7,b7 such collection1 processing1 or transfer is necessary to carry out operational or administrative tasks in support of a purpose described in subsection 7b7 to which the individual has consented2 or 7,c7 the individual gives affirmative express consent to such collection1 processing1 or transfer4 7b7 ,covered purposes ,the purposes described in this subsection are the following3 7#a7 ,collecting1 processing1 or transferring the covered data of an individual to track the spread1 signs1 or symptoms of ,,covid-#ai4 7#b7 ,collecting1 processing1 or transferring the covered data of an individual to measure compliance with social distancing guidelines or other requirements related to ,,covid-#ai that are imposed on individuals under a ,federal1 ,state1 or local government order4 7#c7 ,collecting1 processing1 or transferring the covered data of an individual to conduct contact tracing for ,,covid-#ai cases4 7c7 ,transparency 7#a7 ,privacy policy ,a covered entity that collects1 processes1 or transfers covered data for a purpose described in subsection 7b7 shall1 not later than #ad days after the enactment of this ,act1 publish a privacy policy that-- 7,a7 is disclosed in a clear and conspicuous manner to an individual prior to or at the point of the collection of covered data for such a purpose from the individual2 7,b7 is made available in a clear and conspicuous manner to the public2 7,c7 includes whether1 subject to the affirmative express consent requirement of subsection 7a71 the covered entity transfers covered data for such a purpose and the categories of recipients to whom the covered entity transfers covered data for such purpose2 7,d7 includes a general description of the covered entity's data retention practices for covered data used for a purpose described in subsection 7b7 and the purposes for such retention2 and 7,e7 includes a general description of the covered entity's data security practices4 7#b7 ,reporting ,during the ,,covid-#ai public health emergency1 a covered entity that collects1 processes1 or transfers covered data for a purpose described in subsection 7b7 shall issue a public report not later than #cj days after the enactment of this ,act and not less frequently than once every #fj days thereafter-- 7,a7 stating in aggregate terms the number of individuals whose covered data the entity has collected1 processed1 or transferred for such a purpose2 and 7,b7 describing the categories of covered data collected1 processed1 or transferred by the entity1 the specific purposes for which each such category of covered data is collected1 processed1 or transferred1 and1 in the case of transferred covered data1 to whom such data was transferred4 7d7 ,right to opt-,out ,during the ,,covid-#ai public health emergency1 each covered entity that collects1 processes1 or transfers covered data for a purpose described in subsection 7b7 shall do the following3 7#a7 ,the covered entity shall provide an effective mechanism for an individual who has consented pursuant to subsection 7a7 to the collection1 processing1 or transfer of the individual's covered data for such a purpose to revoke such consent4 7#b7 ,a covered entity that receives a revocation of consent from an individual described in paragraph 7#a7 shall1 as soon as practicable but in no case later than #ad days after receiving such revocation1 stop collecting1 processing1 or transferring the covered data of such individual for a purpose described in subsection 7b71 or shall de-identify all such data4 7e7 ,data deletion ,a covered entity shall delete or de-identify all covered data collected1 processed1 or transferred for a purpose described in subsection 7b7 when it is no longer being used for such purpose and is no longer necessary to comply with a ,federal1 ,state1 or local legal obligation1 or the establishment1 exercise1 or defense of a legal claim4 7f7 ,data accuracy ,a covered entity shall take reasonable measures to ensure the accuracy of covered data collected1 processed1 or transferred for a purpose described in subsection 7b7 and shall provide an effective mechanism for an individual to report inaccuracies in covered data4 7g7 ,data minimization 7#a7 ,in general ,during the ,,covid-#ai public health emergency1 a covered entity that collects1 processes1 or transfers covered data for a purpose described in subsection 7b7 shall not collect1 process1 or transfer covered data beyond what is reasonably necessary1 proportionate1 and limited to carry out such purpose4 7#b7 ,guidelines ,not later than #cj days after the date of enactment of this ,act1 the ,commission shall issue guidelines recommending best practices for covered entities to minimize the collection1 processing1 and transfer of covered data in accordance with this subsection4 7h7 ,protection of covered data ,during the ,,covid-#ai public health emergency1 a covered entity that collects1 processes1 or transfers covered data for a purpose described in subsection 7b7 shall establish1 implement1 and maintain reasonable administrative1 technical1 and physical data security policies and practices to protect against risks to the confidentiality1 security1 and integrity of such data4 7i7 ,exception ,notwithstanding subsection 7a71 a covered entity may collect1 process1 or transfer the covered data of an individual or group of individuals for a purpose described in subsection 7b7 during the ,,covid-#ai public health emergency without obtaining the affirmative express consent of the individual if such collection1 processing1 or transfer is necessary to allow the covered entity to comply with a ,federal1 ,state1 or local legal obligation4 #d4 ,enforcement 7a7 ,enforcement by federal trade commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act shall be treated as a violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of commission ,except as provided in paragraph 7#d71 the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates such section shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 ,except as provided in subsection 7c71 enforcement by the ,commission shall be the exclusive means of enforcing compliance with this ,act4 7#c7 ,cooperation with other agencies ,whenever the ,commission obtains information that any covered entity may have processed or transferred covered data in violation of ,federal anti-discrimination laws1 the ,commission shall transmit the information to the appropriate ,federal or ,state agency with authority to initiate proceedings related to such violation4 7#d7 ,common carriers and nonprofit organizations ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act in the same manner provided in paragraphs 7#a7 and 7#b7 of this subsection with respect to-- 7,a7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto2 and 7,b7 organizations not organized to carry on business for their own profit or that of their members4 7b7 ,effect on other laws 7#a7 ,in general ,nothing in this ,act shall be construed in any way to limit the authority of the ,commission under any other provision of law4 7#b7 ,nonapplication of fcc laws and regulations to covered entities ,notwithstanding any other provision of law1 neither any provision of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et4 seq47 and all ,acts amendatory thereof and supplementary thereto nor any regulation promulgated by the ,federal ,communications ,commission under such ,acts shall apply to any covered entity with respect to the collection1 processing1 or transferring of covered data for a purpose described in section #c7;b71 except to the extent that such provision or regulation pertains solely to #iaa lines or any other emergency line of a hospital1 medical provider or service office1 health care facility1 poison control center1 fire protection agency1 or law enforcement agency4 7#c7 ,state preemption ,no ,state or political subdivision of a ,state may adopt1 maintain1 enforce1 or continue in effect any law1 regulation1 rule1 requirement1 or standard to the extent that such law1 regulation1 rule1 requirement1 or standard is related to the collection1 processing1 or transfer of covered data for a purpose described in section #c7;b74 7c7 ,enforcement by ,state attorneys general 7#a7 ,in general ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is adversely affected by the engagement of any covered entity in an act or practice that violates this ,act1 the attorney general of the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to-- 7,a7 enjoin that act or practice2 7,b7 enforce compliance with this ,act or the regulation2 7,c7 obtain damages1 civil penalties1 restitution1 or other compensation on behalf of the residents of the ,state2 or 7,d7 obtain such other relief as the court may consider to be appropriate4 7#b7 ,rights of the commission 7,a7 ,in general ,except where not feasible1 the attorney general of a ,state shall notify the ,commission in writing prior to initiating a civil action under paragraph 7#a74 ,such notice shall include a copy of the complaint to be filed to initiate such action4 ,upon receiving such notice1 the ,commission may intervene in such action and1 upon intervening-- 7i7 be heard on all matters arising in such action2 and 7ii7 file petitions for appeal of a decision in such action4 7,b7 ,notification timeline ,where it is not feasible for the attorney general of a ,state to provide the notification required by subparagraph 7,a7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately after initiating the civil action4 7#c7 ,actions by commission ,in any case in which a civil action is instituted by the ,commission for violation of this ,act1 no attorney general of a ,state may1 during the pendency of such action1 institute a civil action against any defendant named in the complaint in the action instituted by the ,commission for a violation of this ,act that is alleged in such complaint4 7#d7 ,investigatory powers ,nothing in this ,act shall be construed to prevent the attorney general of a ,state or another authorized official of a ,state from exercising the powers conferred on the attorney general or the ,state official by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#e7 ,consolidation of actions brought by two or more ,state attorneys general or authorized ,state governmental authorities ,whenever a civil action under paragraph 7#a7 is pending and another civil action or actions are commenced pursuant to such paragraph in a different ,federal district court or courts that involve #a or more common questions of fact1 such action or actions shall be transferred for the purposes of consolidated pretrial proceedings and trial to the ,united ,states ,district ,court for the ,district of ,columbia2 provided however1 that no such action shall be transferred if pretrial proceedings in that action have been concluded before a subsequent action is filed by a ,state attorney general or authorized ,state governmental authority4