,,ii #aaf? ,,congress #b;d ,session ,s4 #cffc ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,may #g1 #bjbj,mr4 ,wick] 7= himself1 ,mr4 ,?une1 ,mr4 ,moran1 ,mrs4 ,blackburn1 & ,mrs4 ,fis*]7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to protect ! privacy ( consum]s' p]sonal heal? in=mation1 proximity data1 device data1 & geolocation data dur+ ! coronavirus public heal? crisis4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,,covid-#ai ,consum] ,data ,protection ,act ( #bjbj4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,aggregat$ data ,! t]m aggregat$ data means in=mation t-- 7,a7 relates to a gr\p or category ( individuals2 & 7,b7 does n id5tify1 & is n l9k$ or reasonably l9kable to1 any individual4 7#b7 ,affirmative express cons5t 7,a7 ,9 g5]al ,! t]m affirmative express cons5t means an affirmative act by an individual t-- 7i7 cle>ly communicates ! individual's au?orization ( an act or practice2 & 7ii7 is tak5 aft] ! individual has be5 pres5t$ ) a cle> & conspicu\s description ( su* act or practice4 7,b7 ,no inf]5ce f inaction ,= purposes ( subp>agraph 7,a71 ! affirmative express cons5t ( an individual _c be inf]r$ f inaction4 7#c7 ,bus9ess contact in=mation ,! t]m bus9ess contact in=mation means in=mation relat$ to an individual's bus9ess position "n or title1 bus9ess telephone numb]1 bus9ess address1 bus9ess email address1 & o!r simil> bus9ess in=mation1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = purposes relat$ to su* individual's pr(essional activities4 7#d7 ,collection ,! t]m collection means buy+1 r5t+1 ga!r+1 access+1 or o!rwise acquir+ any cov]$ data ( an individual by any means4 7#e7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#f7 ,cov]$ data 7,a7 ,9 g5]al ,! t]m cov]$ data means precise geolocation data1 proximity data1 a p]si/5t id5tifi]1 & p]sonal heal? in=mation4 7,b7 ,exclusions ,su* t]m does n include ! foll[+3 7i7 ,aggregat$ data4 7ii7 ,bus9ess contact in=mation4 7iii7 ,de-id5tifi$ data4 7iv7 ,employee scre5+ data4 7v7 ,publicly available in=mation4 7#g7 ,cov]$ entity ,! t]m cov]$ entity means1 ) respect to a set ( cov]$ data1 any entity or p]son t-- 7,a7 is-- 7i7 subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 or 7ii7 a common c>ri] or nonpr(it organization describ$ 9 section #d7;a77#d72 7,b7 collects1 processes1 or transf]s su* cov]$ data1 or det]m9es ! means & purposes = ! collection1 process+1 or transf] ( cov]$ data2 & 7,c7 is n a s]vice provid] ) respect to su* data4 7#h7 ,,covid-#ai public heal? em]g5cy ,! t]m ,,covid-#ai public heal? em]g5cy means ! p]iod-- 7,a7 beg9n+ on ! date ( enactm5t ( ?is ,act2 & 7,b7 end+ on ! la/ day ( ! public heal? em]g5cy decl>$ by ! ,secret>y ( ,heal? & ,human ,s]vices pursuant to section #cai ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bdg;d7 on ,janu>y #ca1 #bjbj1 entitl$ ,det]m9ation t a ,public ,heal? ,em]g5cy ,exi/s ,nationwide z ! ,result ( ! #bjai ,novel ,coronavirus 7includ+ any r5ewal ( su* decl>ation pursuant to su* section #cai74 7#i7 ,de-id5tifi$ data ,! t]m de-id5tifi$ data means in=mation held by a cov]$ entity t-- 7,a7 does n id5tify & is n reasonably l9kable to an individual2 7,b7 does n conta9 any p]sonal id5tifi]s or o!r in=mation t c\ld be readily us$ to re-id5tify ! individual to :om ! in=mation p]ta9s2 7,c7 is subject to a public commitm5t by ! cov]$ entity-- 7i7 to refra9 f attempt+ to use su* in=mation to id5tify any individual2 & 7ii7 to adopt te*nical & organizational measures to ensure t su* in=mation is n l9k$ to any individual2 & 7,d7 is n disclos$ by ! cov]$ entity to any o!r p>ty unless ! disclosure is subject to a contractually or o!r legally b9d+ requirem5t t-- 7i7 ! recipi5t ( ! in=mation %all n use ! in=mation to id5tify any individual2 & 7ii7 all onw>d disclosures ( ! in=mation %all be subject to ! requirem5t describ$ 9 clause 7i74 7#aj7 ,employee scre5+ data ,! t]m employee scre5+ data means1 ) respect to a cov]$ entity1 cov]$ data ( an individual :o is an employee1 own]1 director1 (fic]1 /aff memb]1 tra9ee1 v5dor1 visitor1 int]n1 volunte]1 or contractor ( ! cov]$ entity1 provid$ t su* data is only collect$1 process$1 or transf]r$ by ! cov]$ entity = ! purpose ( det]m9+1 = purposes relat$ to ! ,,covid-#ai public heal? em]g5cy1 :e!r ! individual is p]mitt$ to ent] a physical site ( op]ation ( ! cov]$ entity4 7#aa7 ,delete ,! t]m delete means to remove or de/roy in=mation su* t x is n ma9ta9$ 9 human or ma*9e readable =m & _c be retriev$ or utiliz$ 9 ! normal c\rse ( bus9ess4 7#ab7 ,individual 7,a7 ,9 g5]al ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7,b7 ,exclusion ,su* t]m does n include1 ) respect to a cov]$ entity1 an individual act+ z a full-"t or "p-"t1 paid or unpaid employee1 own]1 director1 (fic]1 /aff memb]1 tra9ee1 v5dor1 visitor1 int]n1 volunte]1 or contractor ( a cov]$ entity p]mitt$ to ent] a physical site ( op]ation ( ! cov]$ entity4 7#ac7 ,p]si/5t id5tifi] ,! t]m p]si/5t id5tifi] means a te*nologically d]iv$ id5tifi] t id5tifies an individual1 or is l9k$ or reasonably l9kable to an individual ov] "t & across s]vices & plat=ms1 :i* may include a cu/om] numb] held 9 a cookie1 a /atic ,int]net ,protocol 7,,ip7 address1 a processor or device s]ial numb]1 or ano!r unique device id5tifi]4 7#ad7 ,p]sonal heal? in=mation 7,a7 ,9 g5]al ,! t]m p]sonal heal? in=mation means in=mation relat+ to an individual t-- 7i7 is-- 7,i7 g5etic in=mation ( ! individual2 or 7,,ii7 in=mation relat+ to ! diagnosis or treatm5t ( pa/1 pres5t1 or future physical1 m5tal heal?1 or disability ( ! individual2 & 7ii7 id5tifies1 or is reasonably l9kable to1 ! individual4 7,b7 ,exclusions ,su* t]m does n include ! foll[+3 7i7 ,in=mation f education records t are subject to ! requirem5ts ( section #ddd ( ! ,g5]al ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g1 commonly ref]r$ to z ! ,family ,educational ,rights & ,privacy ,act ( #aigd7 or f records describ$ 9 subsection 7a77#d77;,b77iv7 ( su* section4 7ii7 ,in=mation subject to regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 7#ae7 ,precise geolocation data ,! t]m precise geolocation data means te*nologically d]iv$ in=mation capable ( det]m9+ ) reasonable specificity ! pa/ or pres5t actual physical location ( an individual at a specific po9t 9 "t4 7#af7 ,process ,! t]m process means any op]ation or set ( op]ations p]=m$ on cov]$ data1 includ+ analyz+1 organiz+1 /ructur+1 reta9+1 us+1 or o!rwise h&l+ su* data4 7#ag7 ,proximity data ,! t]m proximity data means te*nologically d]iv$ in=mation t id5tifies ! pa/ or pres5t proximity ( "o individual to ano!r4 7#ah7 ,publicly available in=mation ,! t]m publicly available in=mation means any in=mation t-- 7,a7 has be5 lawfully made available to ! g5]al public f ,f$]al1 ,/ate1 or local gov]nm5t records2 or 7,b7 is widely available to ! g5]al public1 includ+ in=mation f-- 7i7 a telephone book or onl9e directory2 7ii7 video1 int]net1 or audio cont5t2 or 7iii7 ! news m$ia or a website t is available to ! g5]al public on an unre/rict$ basis 7= purposes ( ?is subclause a website is n re/rict$ solely because !re is a fee or log-9 requirem5t associat$ ) access+ ! website74 7#ai7 ,s]vice provid] ,! t]m s]vice provid] means1 ) respect to a set ( cov]$ data1 an entity t processes or transf]s su* cov]$ data = ! purpose ( p]=m+ "o or m s]vices or functions on behalf (1 & at ! direction (1 a cov]$ entity to :i* x is n relat$4 7#bj7 ,transf] ,! t]m transf] means to disclose1 release1 %>e1 dissem9ate1 or o!rwise make available cov]$ data by any means4 #c4 ,privacy ( cov]$ data 7a7 ,9 g5]al ,dur+ ! ,,covid-#ai public heal? em]g5cy1 x %all be unlawful = a cov]$ entity to collect1 process1 or transf] ! cov]$ data ( an individual = a purpose describ$ 9 subsection 7b7 unless-- 7#a7 ! cov]$ entity provides ! individual ) prior notice ( ! purpose = su* collection1 process+1 or transf]2 7#b7 ! individual has giv5 affirmative express cons5t to su* collection1 process+1 or transf]2 & 7#c7 ! cov]$ entity publicly commits n to collect1 process1 or transf] su* cov]$ data = a purpose o!r ?an ! purpose describ$ 9 subsection 7b7 to :i* ! individual cons5t$ unless-- 7,a7 su* collection1 process+1 or transf] is necess>y to comply ) ! provisions ( ?is ,act or o!r applicable laws2 7,b7 su* collection1 process+1 or transf] is necess>y to c>ry out op]ational or adm9i/rative tasks 9 support ( a purpose describ$ 9 subsection 7b7 to :i* ! individual has cons5t$2 or 7,c7 ! individual gives affirmative express cons5t to su* collection1 process+1 or transf]4 7b7 ,cov]$ purposes ,! purposes describ$ 9 ?is subsection are ! foll[+3 7#a7 ,collect+1 process+1 or transf]r+ ! cov]$ data ( an individual to track ! spread1 signs1 or symptoms ( ,,covid-#ai4 7#b7 ,collect+1 process+1 or transf]r+ ! cov]$ data ( an individual to measure compliance ) social di/anc+ guidel9es or o!r requirem5ts relat$ to ,,covid-#ai t are impos$ on individuals "u a ,f$]al1 ,/ate1 or local gov]nm5t ord]4 7#c7 ,collect+1 process+1 or transf]r+ ! cov]$ data ( an individual to conduct contact trac+ = ,,covid-#ai cases4 7c7 ,transp>5cy 7#a7 ,privacy policy ,a cov]$ entity t collects1 processes1 or transf]s cov]$ data = a purpose describ$ 9 subsection 7b7 %all1 n lat] ?an #ad days aft] ! enactm5t ( ?is ,act1 publi% a privacy policy t-- 7,a7 is disclos$ 9 a cle> & conspicu\s mann] to an individual prior to or at ! po9t ( ! collection ( cov]$ data = su* a purpose f ! individual2 7,b7 is made available 9 a cle> & conspicu\s mann] to ! public2 7,c7 includes :e!r1 subject to ! affirmative express cons5t requirem5t ( subsection 7a71 ! cov]$ entity transf]s cov]$ data = su* a purpose & ! categories ( recipi5ts to :om ! cov]$ entity transf]s cov]$ data = su* purpose2 7,d7 includes a g5]al description ( ! cov]$ entity's data ret5tion practices = cov]$ data us$ = a purpose describ$ 9 subsection 7b7 & ! purposes = su* ret5tion2 & 7,e7 includes a g5]al description ( ! cov]$ entity's data security practices4 7#b7 ,report+ ,dur+ ! ,,covid-#ai public heal? em]g5cy1 a cov]$ entity t collects1 processes1 or transf]s cov]$ data = a purpose describ$ 9 subsection 7b7 %all issue a public report n lat] ?an #cj days aft] ! enactm5t ( ?is ,act & n less frequ5tly ?an once e #fj days !reaft]-- 7,a7 /at+ 9 aggregate t]ms ! numb] ( individuals ^: cov]$ data ! entity has collect$1 process$1 or transf]r$ = su* a purpose2 & 7,b7 describ+ ! categories ( cov]$ data collect$1 process$1 or transf]r$ by ! entity1 ! specific purposes = :i* ea* su* category ( cov]$ data is collect$1 process$1 or transf]r$1 &1 9 ! case ( transf]r$ cov]$ data1 to :om su* data 0 transf]r$4 7d7 ,"r to opt-,out ,dur+ ! ,,covid-#ai public heal? em]g5cy1 ea* cov]$ entity t collects1 processes1 or transf]s cov]$ data = a purpose describ$ 9 subsection 7b7 %all d ! foll[+3 7#a7 ,! cov]$ entity %all provide an effective me*anism = an individual :o has cons5t$ pursuant to subsection 7a7 to ! collection1 process+1 or transf] ( ! individual's cov]$ data = su* a purpose to revoke su* cons5t4 7#b7 ,a cov]$ entity t receives a revocation ( cons5t f an individual describ$ 9 p>agraph 7#a7 %all1 z soon z practicable b 9 no case lat] ?an #ad days aft] receiv+ su* revocation1 /op collect+1 process+1 or transf]r+ ! cov]$ data ( su* individual = a purpose describ$ 9 subsection 7b71 or %all de-id5tify all su* data4 7e7 ,data deletion ,a cov]$ entity %all delete or de-id5tify all cov]$ data collect$1 process$1 or transf]r$ = a purpose describ$ 9 subsection 7b7 :5 x is no long] be+ us$ = su* purpose & is no long] necess>y to comply ) a ,f$]al1 ,/ate1 or local legal obligation1 or ! e/abli%m5t1 ex]cise1 or def5se ( a legal claim4 7f7 ,data accuracy ,a cov]$ entity %all take reasonable measures to ensure ! accuracy ( cov]$ data collect$1 process$1 or transf]r$ = a purpose describ$ 9 subsection 7b7 & %all provide an effective me*anism = an individual to report inaccuracies 9 cov]$ data4 7g7 ,data m9imization 7#a7 ,9 g5]al ,dur+ ! ,,covid-#ai public heal? em]g5cy1 a cov]$ entity t collects1 processes1 or transf]s cov]$ data = a purpose describ$ 9 subsection 7b7 %all n collect1 process1 or transf] cov]$ data beyond :at is reasonably necess>y1 proportionate1 & limit$ to c>ry out su* purpose4 7#b7 ,guidel9es ,n lat] ?an #cj days aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidel9es recomm5d+ be/ practices = cov]$ entities to m9imize ! collection1 process+1 & transf] ( cov]$ data 9 accordance ) ?is subsection4 7h7 ,protection ( cov]$ data ,dur+ ! ,,covid-#ai public heal? em]g5cy1 a cov]$ entity t collects1 processes1 or transf]s cov]$ data = a purpose describ$ 9 subsection 7b7 %all e/abli%1 implem5t1 & ma9ta9 reasonable adm9i/rative1 te*nical1 & physical data security policies & practices to protect aga9/ risks to ! confid5tiality1 security1 & integrity ( su* data4 7i7 ,exception ,not)/&+ subsection 7a71 a cov]$ entity may collect1 process1 or transf] ! cov]$ data ( an individual or gr\p ( individuals = a purpose describ$ 9 subsection 7b7 dur+ ! ,,covid-#ai public heal? em]g5cy )\t obta9+ ! affirmative express cons5t ( ! individual if su* collection1 process+1 or transf] is necess>y to all[ ! cov]$ entity to comply ) a ,f$]al1 ,/ate1 or local legal obligation4 #d4 ,en=cem5t 7a7 ,en=cem5t by f$]al trade commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act %all be treat$ z a violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7#b7 ,p[]s ( commission ,except z provid$ 9 p>agraph 7#d71 ! ,commission %all en=ce ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 ,any p]son :o violates su* section %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act4 ,except z provid$ 9 subsection 7c71 en=cem5t by ! ,commission %all be ! exclusive means ( en=c+ compliance ) ?is ,act4 7#c7 ,coop]ation ) o!r ag5cies ,:5ev] ! ,commission obta9s in=mation t any cov]$ entity may h process$ or transf]r$ cov]$ data 9 violation ( ,f$]al anti-discrim9ation laws1 ! ,commission %all transmit ! in=mation to ! appropriate ,f$]al or ,/ate ag5cy ) au?ority to initiate proce$+s relat$ to su* violation4 7#d7 ,common c>ri]s & nonpr(it organizations ,not)/&+ section #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation ( ! ,commission1 ! ,commission %all also en=ce ?is ,act 9 ! same mann] provid$ 9 p>agraphs 7#a7 & 7#b7 ( ?is subsection ) respect to-- 7,a7 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto2 & 7,b7 organizations n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s4 7b7 ,effect on o!r laws 7#a7 ,9 g5]al ,no?+ 9 ?is ,act %all be con/ru$ 9 any way to limit ! au?ority ( ! ,commission "u any o!r provision ( law4 7#b7 ,nonapplication ( fcc laws & regulations to cov]$ entities ,not)/&+ any o!r provision ( law1 nei!r any provision ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et4 seq47 & all ,acts am5datory !re( & supplem5t>y !reto nor any regulation promulgat$ by ! ,f$]al ,communications ,commission "u su* ,acts %all apply to any cov]$ entity ) respect to ! collection1 process+1 or transf]r+ ( cov]$ data = a purpose describ$ 9 section #c7;b71 except to ! ext5t t su* provision or regulation p]ta9s solely to #iaa l9es or any o!r em]g5cy l9e ( a hospital1 m$ical provid] or s]vice (fice1 heal? c>e facility1 poison control c5t]1 fire protection ag5cy1 or law en=cem5t ag5cy4 7#c7 ,/ate preemption ,no ,/ate or political subdivision ( a ,/ate may adopt1 ma9ta91 en=ce1 or cont9ue 9 effect any law1 regulation1 rule1 requirem5t1 or /&>d to ! ext5t t su* law1 regulation1 rule1 requirem5t1 or /&>d is relat$ to ! collection1 process+1 or transf] ( cov]$ data = a purpose describ$ 9 section #c7;b74 7c7 ,en=cem5t by ,/ate attorneys g5]al 7#a7 ,9 g5]al ,9 any case 9 :i* ! attorney g5]al ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( t ,/ate has be5 or is adv]sely affect$ by ! engagem5t ( any cov]$ entity 9 an act or practice t violates ?is ,act1 ! attorney g5]al ( ! ,/ate1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7,a7 enjo9 t act or practice2 7,b7 en=ce compliance ) ?is ,act or ! regulation2 7,c7 obta9 damages1 civil p5alties1 re/itution1 or o!r comp5sation on behalf ( ! resid5ts ( ! ,/ate2 or 7,d7 obta9 su* o!r relief z ! c\rt may consid] to be appropriate4 7#b7 ,rights ( ! commission 7,a7 ,9 g5]al ,except :]e n feasible1 ! attorney g5]al ( a ,/ate %all notify ! ,commission 9 writ+ prior to initiat+ a civil action "u p>agraph 7#a74 ,su* notice %all include a copy ( ! compla9t to be fil$ to initiate su* action4 ,^u receiv+ su* notice1 ! ,commission may int]v5e 9 su* action &1 ^u int]v5+-- 7i7 be he>d on all matt]s aris+ 9 su* action2 & 7ii7 file petitions = appeal ( a decision 9 su* action4 7,b7 ,notification timel9e ,:]e x is n feasible = ! attorney g5]al ( a ,/ate to provide ! notification requir$ by subp>agraph 7,a7 be=e initiat+ a civil action "u p>agraph 7#a71 ! attorney g5]al %all notify ! ,commission imm$iately aft] initiat+ ! civil action4 7#c7 ,actions by commission ,9 any case 9 :i* a civil action is in/itut$ by ! ,commission = violation ( ?is ,act1 no attorney g5]al ( a ,/ate may1 dur+ ! p5d5cy ( su* action1 in/itute a civil action aga9/ any def5dant nam$ 9 ! compla9t 9 ! action in/itut$ by ! ,commission = a violation ( ?is ,act t is alleg$ 9 su* compla9t4 7#d7 ,inve/igatory p[]s ,no?+ 9 ?is ,act %all be con/ru$ to prev5t ! attorney g5]al ( a ,/ate or ano!r au?oriz$ (ficial ( a ,/ate f ex]cis+ ! p[]s conf]r$ on ! attorney g5]al or ! ,/ate (ficial by ! laws ( ! ,/ate to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7#e7 ,consolidation ( actions br\ght by two or m ,/ate attorneys g5]al or au?oriz$ ,/ate gov]nm5tal au?orities ,:5ev] a civil action "u p>agraph 7#a7 is p5d+ & ano!r civil action or actions are comm5c$ pursuant to su* p>agraph 9 a diff]5t ,f$]al di/rict c\rt or c\rts t involve #a or m common que/ions ( fact1 su* action or actions %all be transf]r$ = ! purposes ( consolidat$ pretrial proce$+s & trial to ! ,unit$ ,/ates ,di/rict ,c\rt = ! ,di/rict ( ,columbia2 provid$ h[ev]1 t no su* action %all be transf]r$ if pretrial proce$+s 9 t action h be5 conclud$ be=e a subsequ5t action is fil$ by a ,/ate attorney g5]al or au?oriz$ ,/ate gov]nm5tal au?ority4