,,ii #aafth ,,congress #b;d ,session ,s4 #chfa ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #a1 #bjbj,ms4 ,cantwell 7for herself and ,mr4 ,cassidy7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish privacy requirements for operators of infectious disease exposure notification services4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,exposure ,notification ,privacy ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,sec4 #c4 ,public trust in automated exposure notification services4,sec4 #d4 ,voluntary participation and transparency4,sec4 #e4 ,data restrictions4,sec4 #f4 ,data deletion4,sec4 #g4 ,data security4,sec4 #h4 ,freedom of movement and nondiscrimination4,sec4 #i4 ,oversight4,sec4 #aj4 ,enforcement4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative express consent 7,a7 ,in general ,the term affirmative express consent means an affirmative act by an individual that clearly communicates the individual's authorization for an act or practice1 in response to a specific request that-- 7i7 is provided to the individual in a clear and conspicuous disclosure that is separate from other options or acceptance of general terms2 and 7ii7 includes a description of each act or practice for which the individual's consent is sought and-- 7,i7 is written concisely and in easy-to-understand language2 and 7,,ii7 includes a prominent heading that would enable a reasonable individual to identify and understand the act or practice4 7,b7 ,express consent required ,affirmative express consent shall not be inferred from the inaction of an individual or the individual's continued use of a service or product4 7,c7 ,voluntary ,affirmative express consent shall be freely given and nonconditioned4 7#b7 ,aggregate data ,the term aggregate data means information that relates to a group or category of individuals that is not linked or reasonably linkable to any individual or device that is linked or reasonably linkable to an individual1 provided that a platform operator or operator of an automated exposure notification service-- 7,a7 takes reasonable measures to safeguard the data from reidentification2 7,b7 publicly commits in a conspicuous manner not to attempt to reidentify or associate the data with any individual or device linked or reasonably linkable to an individual2 7,c7 processes the data for public health purposes only2 and 7,d7 contractually requires the same commitment for all transfers of the data4 7#c7 ,authorized diagnosis ,the term authorized diagnosis means an actual1 potential1 or presumptive positive diagnosis of an infectious disease confirmed by a public health authority or a licensed health care provider4 7#d7 ,automated exposure notification service 7,a7 ,in general ,the term automated exposure notification service means a website1 online service1 online application1 mobile application1 or mobile operating system that is offered in commerce in the ,united ,states and that is designed1 in part or in full1 specifically to be used for1 or marketed for1 the purpose of digitally notifying1 in an automated manner1 an individual who may have become exposed to an infectious disease 7or the device of such individual1 or a person or entity that reviews such disclosures74 7,b7 ,limitations ,such term does not include-- 7i7 any technology that a public health authority uses as a means to facilitate traditional in-person1 email1 or telephonic contact tracing activities1 or any similar technology that is used to assist individuals to evaluate if they are experiencing symptoms related to an infectious disease to the extent the technology is not used as an automated exposure notification service2 or 7ii7 any platform operator or service provider that provides technology to facilitate an automated exposure notification service to the extent the technology acts only to facilitate such services and is not itself used as an automated exposure notification service4 7#e7 ,collect2 collection ,the terms collect and collection mean buying1 renting1 gathering1 obtaining1 receiving1 accessing1 or otherwise acquiring covered data by any means1 including by passively or actively observing the behavior of an individual4 7#f7 ,covered data ,the term covered data means any information that is-- 7,a7 linked or reasonably linkable to any individual or device linked or reasonably linkable to an individual2 7,b7 not aggregate data2 and 7,c7 collected1 processed1 or transferred in connection with an automated exposure notification service4 7#g7 ,deceptive act or practice ,the term deceptive act or practice means a deceptive act or practice in violation of section #e7;a77#a7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#a774 7#h7 ,delete ,the term delete means destroying1 permanently erasing1 or otherwise modifying covered data to make such covered data permanently unreadable or indecipherable and unrecoverable4 7#i7 ,executive agency ,the term ,executive agency has the meaning given such term in section #aje of title #e1 ,united ,states ,code4 7#aj7 ,indian tribe ,the term ,indian tribe-- 7,a7 has the meaning given such term in section #d of the ,indian ,self-,determination and ,education ,assistance ,act 7#be ,u4,s4,c4 #ecjd72 and 7,b7 includes a ,native ,hawaiian organization as defined in section #fbjg of the ,elementary and ,secondary ,education ,act of #aife 7#bj ,u4,s4,c4 #geag74 7#aa7 ,operator of an automated exposure notification service ,the term operator of an automated exposure notification service means any person or entity that operates an automated exposure notification service1 other than a public health authority1 and that is-- 7,a7 subject to the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 or 7,b7 described in section #aj7;a77#d74 7#ab7 ,platform operator ,the term platform operator means any person or entity other than a service provider who provides an operating system that includes features supportive of an automated exposure notification service and facilitates the use or distribution of such automated exposure notification service to the extent the technology is not used by the platform operator as an automated exposure notification service4 7#ac7 ,process ,the term process means any operation or set of operations performed on covered data1 including collection1 analysis1 organization1 structuring1 retaining1 using1 securing1 or otherwise handling covered data4 7#ad7 ,public health authority ,the term public health authority means an agency or authority of the ,united ,states1 a ,state1 a territory1 a political subdivision of a ,state or territory1 or an ,indian tribe that is responsible for public health matters as part of its official mandate1 or a person or entity acting under a grant of authority from or contract with such public agency4 7#ae7 ,service provider ,the term service provider means any person or entity1 other than a platform operator1 that processes or transfers covered data in the course of performing a service or function on behalf of1 and at the direction of1 a platform operator1 an operator of an automated exposure notification service1 or a public health authority1 but only to the extent that such processing or transfer relates to the performance of such service or function4 7#af7 ,state ,the term ,state means any of the several ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands1 ,guam1 ,american ,samoa1 and the ,commonwealth of the ,northern ,mariana ,islands4 7#ag7 ,transfer ,the term transfer means to disclose1 release1 share1 disseminate1 make available1 allow access to1 sell1 license1 or otherwise communicate covered data by any means to a nonaffiliated entity or person4 #c4 ,public trust in automated exposure notification services 7a7 ,collaboration with public health ,an operator of an automated exposure notification service shall collaborate with a public health authority in the operation of such service4 7b7 ,diagnosis information ,an operator of an automated exposure notification service may not collect1 process1 or transfer an actual1 potential1 or presumptive positive diagnosis of an infectious disease as part of the automated exposure notification service1 unless such diagnosis is an authorized diagnosis4 7c7 ,accuracy and reliability ,an operator of an automated exposure notification service shall publish-- 7#a7 guidance for the public on the functionality of the service and how to interpret the notifications1 including any limitation with respect to the accuracy or reliability of the exposure risk2 and 7#b7 measures of the effectiveness of the service offered1 including adoption rates4 7d7 ,prevention of deceptive acts or practices ,it shall be unlawful for a platform operator or an operator of an automated exposure notification service to engage in a deceptive act or practice concerning an automated exposure notification service4 7e7 ,service provider requirement ,when a service provider has actual knowledge that an operator of an automated exposure notification service or a public health authority has engaged in an act or practice that fails to adhere to the standards set forth in sections #c through #h of this ,act1 the service provider shall notify the automated exposure notification service or the public health authority1 as applicable1 of the potential violation or failure to adhere to such standards4 #d4 ,voluntary participation and transparency 7a7 ,voluntary participation 7#a7 ,enrollment with affirmative express consent ,an operator of an automated exposure notification service-- 7,a7 may not enroll an individual in the automated exposure notification service without the individual's prior affirmative express consent2 and 7,b7 shall provide an individual with a clear and conspicuous means to withdraw affirmative express consent to the individual's enrollment in the automated exposure notification service4 7#b7 ,right to identify a diagnosis ,an individual with an authorized diagnosis shall determine whether the individual's authorized diagnosis is processed as part of the automated exposure notification service4 7b7 ,notice of covered data practices ,an operator of an automated exposure notification service and a platform operator shall make publicly and persistently available1 in a conspicuous and readily accessible manner1 a privacy policy that provides a detailed and accurate representation of that person or entity's covered data collection1 processing1 and transfer activities in connection with such person or entity's automated exposure notification service or the facilitation of such service4 ,such privacy policy shall include1 at a minimum-- 7#a7 the identity and the contact information of the person or entity1 including the contact information for the person or entity's representative for privacy and covered data security inquiries2 7#b7 each category of covered data the person or entity collects and the limited allowable processing purposes for which such covered data is collected in accordance with section #e2 7#c7 whether the person or entity transfers covered data for the limited allowable purposes in section #e and1 if so1 a detailed description of the data transferred1 the purpose of the transfer1 and the identity of the recipient of the transfer2 7#d7 a description of the person or entity's covered data minimization and retention policies2 7#e7 how an individual can exercise the individual rights described in this title2 7#f7 a description of the person or entity's covered data security policies2 and 7#g7 the effective date of the privacy policy4 7c7 ,languages ,a person or entity shall make the privacy policy required under this section available to the public in all of the languages in which the person or entity provides1 or facilitates the provision of1 an automated exposure notification service4 #e4 ,data restrictions 7a7 ,collection and processing restrictions ,an operator of an automated exposure notification service may not collect or process any covered data-- 7#a7 beyond the minimum amount necessary to implement an automated exposure notification service for public health purposes2 or 7#b7 for any commercial purpose4 7b7 ,transfer restrictions ,an operator of an automated exposure notification service may not transfer any covered data1 except-- 7#a7 to provide notification of a potential exposure to an individual who has enrolled in the automated exposure notification service2 7#b7 to a public health authority for public health purposes related to an infectious disease2 7#c7 to its service provider1 by contract1 to-- 7,a7 perform system maintenance1 debug systems1 or repair any error to ensure the functionality of the automated exposure notification service1 provided such processing is limited to this purpose2 or 7,b7 detect or respond to a security incident1 provide a secure environment1 or maintain the safety of the automated exposure notification service1 provided such process is limited to this purpose2 or 7#d7 to comply with the establishment1 exercise1 or defense of a legal claim4 7c7 ,further restrictions 7#a7 ,in general ,it shall be unlawful for any person1 entity1 or ,executive agency to transfer covered data to any ,executive agency unless the information is transferred in connection with an investigation or enforcement proceeding under this ,act4 7#b7 ,prohibition ,an ,executive agency may not process or transfer covered data1 except-- 7,a7 for a public health purpose related to an infectious disease2 or 7,b7 in connection with an investigation or enforcement proceeding under this ,act4 7d7 ,research ,this section shall not be construed to prohibit data collection1 processing1 or transfers to carry out research-- 7#a7 conducted pursuant to the ,federal policy for the protection of human subjects under part #df of title #de1 ,code of ,federal ,regulations2 or 7#b7 for the development1 manufacture1 or distribution of a drug1 biological product1 or vaccine that relates to an infectious disease conducted pursuant to part #ej of title #ba1 ,code of ,federal ,regulations4 #f4 ,data deletion 7a7 ,deletion upon request ,upon the request of an individual1 an operator of an automated exposure notification service shall delete1 or allow the individual to delete1 all covered data of the individual that is processed by the operator4 7b7 ,recurring deletion ,an operator of an automated exposure notification service shall delete the covered data of a participating individual within #cj days of receipt of such covered data1 on a rolling basis1 or at such times as is consistent with a standard published by a public health authority within an applicable jurisdiction4 7c7 ,applicability to service providers ,an operator of an automated exposure notification service shall instruct any service provider to which the entity transfers covered data to delete such data in accordance with the requirements of this subsection4 7d7 ,research ,this section shall not be construed to prohibit data retention for public health research purposes consistent with the requirements in section #e7;d74 #g4 ,data security 7a7 ,in general ,an operator of an automated exposure notification service shall establish1 implement1 and maintain data security practices to protect the confidentiality1 integrity1 availability1 and accessibility of covered data4 ,such covered data security practices shall be consistent with standards generally accepted by experts in the information security field4 7b7 ,specific requirements ,covered data security practices required under subsection 7a7 shall include1 at a minimum1 the following3 7#a7 ,assess risks and vulnerabilities ,identifying and assessing any reasonably foreseeable risks to1 and vulnerabilities in1 each system maintained by the person or entity that processes or transfers covered data1 including unauthorized access to or risks to covered data1 human and technical vulnerabilities1 access rights1 and use of service providers4 ,such activities shall include a plan to receive and respond to unsolicited reports of risks and vulnerabilities by entities and individuals1 developing and testing systems for monitoring the security of covered data1 and resilience against denial of service attacks and malicious disinformation4 7#b7 ,preventive and corrective action ,taking preventive and corrective action to mitigate any risks or vulnerabilities to covered data identified by the person or entity1 which may include implementing administrative1 technical1 or physical safeguards or changes to covered data security practices or the architecture1 installation1 or implementation of network or operating software4 7#c7 ,breach notification ,maintaining plans for responding to security incidents involving covered data and1 in the most expedient time possible1 consistent with the legitimate needs of law enforcement1 notifying any individual whose data is subject to a security breach1 as well as the ,federal ,trade ,commission1 of the breach1 the data involved1 any reasonably foreseeable impacts of the breach for individuals whose data is subject to the breach1 the steps individuals may take to mitigate those impacts1 and the measures the operator of the automated exposure notification service is taking to prevent a future incident4 ,an operator of an automated exposure notification service shall require its service providers to provide notice to the operator of the automated exposure notification service of any breach of the security of the covered data immediately following the discovery of the breach4 7c7 ,interference prohibited ,it shall be unlawful for any person or entity to transmit signals with the intent to cause an automated exposure notification service to produce inaccurate notifications or to otherwise interfere with the intended functioning of such a service4 #h4 ,freedom of movement and nondiscrimination ,it shall be unlawful for any person or entity to segregate1 discriminate against1 or otherwise make unavailable to an individual or class of individuals the goods1 services1 facilities1 privileges1 advantages1 or accommodations of any place of public accommodation 7as such term is defined in section #cja of the ,americans ,with ,disabilities ,act of #aiij 7#db ,u4,s4,c4 #abaha771 based on covered data collected or processed through an automated exposure notification service or an individual's choice to use or not use an automated exposure notification service4 #i4 ,oversight 7a7 ,in general ,section #ajfa of the ,intelligence ,reform and ,terrorism ,prevention ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee7 is amended-- 7#a7 in subsection 7c7-- 7,a7 in paragraph 7#a71 by inserting or to respond to health-related epidemics after from terrorism2 and 7,b7 in paragraph 7#b71 by inserting or to respond to health-related epidemics after against terrorism2 and 7#b7 in subsection 7d7-- 7,a7 in paragraph 7#a71 by inserting or to respond to health-related epidemics after from terrorism each place it appears2 and 7,b7 in paragraph 7#b7-- 7i7 in subparagraph 7,b71 by striking and at the end2 7ii7 in subparagraph 7,c71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,d7 the collection1 use1 storage1 and sharing of covered data by ,federal1 ,state1 or local government in connection with responding to a ,federal declaration of a public health emergency to ensure that privacy and civil liberties are protected4 4 7b7 ,reports ,section #ajfa7;e7 of the ,intelligence ,reform and ,terrorism ,prevention ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee7e77 is amended by adding at the end the following3 7#c7 ,report on ,,covid-#ai mitigation activities ,not later than #a year after the date of enactment of this paragraph1 the ,board shall issue a report1 which shall be publicly available to the greatest extent possible1 assessing the impact on privacy and civil liberties of ,government activities in response to the public health emergency related to the ,coronavirus #bjai 7,,covid-#ai71 and making recommendations for how the ,government should mitigate the threats posed by such emergency4 7#d7 ,reports on public health emergency response ,not later than #a year after any ,federal emergency or disaster declaration related to public health1 or not later than #a year after the termination of such declaration1 the ,board shall issue a report1 which shall be publicly available to the greatest extent possible1 assessing the impact on privacy and civil liberties of ,government activities in response to such emergency or disaster1 and making recommendations for how the ,government should mitigate the threats posed by such emergency or disaster4 4 #aj4 ,enforcement 7a7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,except as provided in paragraphs 7#c7 and 7#d7 of this subsection1 the ,federal ,trade ,commission 7referred to in this ,act as the ,commission7 shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7,c7 ,effect on other laws ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7#c7 ,independent litigation authority ,notwithstanding section #af of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #ef71 the ,commission may commence1 defend1 or intervene in1 and supervise the litigation of1 any civil action under this ,act 7including an action to collect a civil penalty7 and any appeal of such action in its own name by any of its attorneys designated by it for such purpose4 ,the ,commission shall notify the ,attorney ,general of any such action and may consult with the ,attorney ,general with respect to any such action or request the ,attorney ,general on behalf of the ,commission to commence1 defend1 or intervene in any such action4 7#d7 ,nonprofit organizations and communications common carriers ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any other jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act in the same manner provided in paragraphs 7#a71 7#b71 and 7#c7 of this subsection1 with respect to-- 7,a7 any organization not organized to carry on business for the organization's own profit or that of the organization's members2 and 7,b7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto4 7b7 ,enforcement by ,state attorneys general 7#a7 ,in general ,if the chief law enforcement officer of a ,state1 or an official or agency designated by a ,state1 has reason to believe that any person has violated or is violating this ,act1 the attorney general1 official1 or agency of the ,state1 in addition to any authority it may have to bring an action in ,state court under its consumer protection law1 may bring a civil action in any appropriate ,united ,states district court or in any other court of competent jurisdiction1 including a ,state court1 to-- 7,a7 enjoin further such violation by such person2 7,b7 enforce compliance with this ,act2 7,c7 obtain civil penalties2 and 7,d7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state4 7#b7 ,notice and intervention by the ,,ftc ,the attorney general of a ,state shall provide prior written notice of any action under paragraph 7#a7 to the ,commission and provide the ,commission with a copy of the complaint in the action1 except in any case in which such prior notice is not feasible1 in which case the attorney general shall serve such notice immediately upon instituting such action4 ,the ,commission shall have the right-- 7,a7 to intervene in the action2 7,b7 upon so intervening1 to be heard on all matters arising therein2 and 7,c7 to file petitions for appeal4 7#c7 ,relationship with ,state law claims ,if the attorney general of a ,state has authority to bring an action under ,state law directed at any act or practice that also violates this ,act1 the attorney general may assert the ,state law claim and a claim under this ,act in the same civil action4 7c7 ,state law preservation ,nothing in this ,act shall be construed to preempt1 displace1 or supplant any ,state law1 rule1 regulation1 or requirement1 including-- 7#a7 any consumer protection law of general applicability such as any law regulating deceptive1 unfair1 or unconscionable practices2 7#b7 any health privacy or infectious disease law2 7#c7 any civil rights law2 7#d7 any law that governs the privacy rights or other protections of employees1 employee information1 or students or student information2 7#e7 any law that addresses notification requirements in the event of a covered data breach2 7#f7 contract or tort law2 7#g7 any criminal law governing fraud1 theft1 unauthorized access to information or unauthorized use of information1 malicious behavior1 and similar provisions1 and any law of criminal procedure2 7#h7 any law specifying a remedy or a cause of action to an individual2 or 7#i7 any public safety or sector-specific law unrelated to privacy or security4 7d7 ,preservation of common law or statutory causes of action for civil relief ,nothing in this ,act1 nor any amendment1 standard1 rule1 requirement1 assessment1 law1 or regulation promulgated under this ,act1 shall be construed to preempt1 displace1 or supplant any ,federal or ,state common law right or remedy1 or any statute creating a remedy for civil relief1 including any cause of action for personal injury1 wrongful death1 property damage1 or other financial1 physical1 reputational1 or psychological injury based in negligence1 strict liability1 products liability1 failure to warn1 an objectively offensive intrusion into the private affairs or concerns of the individual1 or any other legal theory of liability under any ,federal or ,state common law1 or any ,state statutory law4 7e7 ,severability ,if any provision of this ,act1 or the application thereof to any person or entity or circumstance1 is held invalid1 the remainder of this ,act and the application of such provision to other persons or entities not similarly situated or to other circumstances shall not be affected by the invalidation4 7f7 ,authorization of appropriations ,there are authorized to be appropriated such sums as are necessary to carry out this ,act and the amendments made by this ,act4 7g7 ,effective date ,this ,act and the amendments made by this ,act shall take effect on the date of the enactment of this ,act4