,,ii #aahth ,,congress #ast ,session ,s4 #fca ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #b1 #bjbc ,ms4 ,klobuchar 7for herself1 ,ms4 ,warren1 and ,ms4 ,hirono7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect the privacy of personally identifiable health and location data1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,upholding ,protections for ,health and ,online ,location ,data ,privacy ,act of #bjbc or the ,,uphold ,privacy ,act of #bjbc4 #b4 ,privacy of health data 7a7 ,prohibition on the use of health data in commercial advertising ,it shall be unlawful for any covered entity to use the health data of an individual that is collected from any source 7including data volunteered by an individual1 medical center-derived data1 data from a wearable fitness tracker1 data from web browsing history1 or any other source determined appropriate by the ,commission7 for commercial advertising4 7b7 ,minimization of collecting1 retaining1 using1 and disclosing health data ,a covered entity may not collect1 retain1 use1 or disclose health data except-- 7#a7 with the express consent of the individual to whom such data relates2 or 7#b7 as is strictly necessary to provide a product or service that the individual to whom such data relates has requested from such covered entity4 7c7 ,minimization of employee access ,a covered entity shall restrict access to health data by any employee or service provider of the covered entity to only such an employee or service provider for which access is necessary to provide a product or service that the individual to whom such data relates has requested from the covered entity4 7d7 ,privacy policy 7#a7 ,policy required ,a covered entity shall maintain a privacy policy relating to the practices of such covered entity regarding the collecting1 retaining1 using1 and disclosing of health data4 7#b7 ,publication required ,if a covered entity has a website1 such covered entity shall prominently publish the privacy policy described in paragraph 7#a7 on such website4 7#c7 ,contents ,the privacy policy described in paragraph 7#a7 shall be clear and conspicuous and contain1 at a minimum1 the following3 7,a7 ,a description of the practices of the covered entity regarding the collecting1 retaining1 using1 and disclosing of health data4 7,b7 ,a clear and concise statement of the categories of such data collected1 retained1 used1 or disclosed by the covered entity4 7,c7 ,a clear and concise statement of the covered entity's purposes for the collecting1 retaining1 using1 or disclosing of such data4 7,d7 ,a list of the specific third parties to which the covered entity discloses such data1 and a clear and concise statement of the purposes for which the covered entity discloses such data1 including how the data may be used by each such third party4 7,e7 ,a list of the specific third parties from which the covered entity has collected such data1 and a clear and concise statement of the purposes for which the covered entity collects such data4 7,f7 ,a clear and concise statement describing the extent to which an individual may exercise control over the collecting1 retaining1 using1 and disclosing of health data by the covered entity1 and the steps an individual must take to implement such controls4 7,g7 ,a clear and concise statement describing the efforts of the covered entity to protect health data from unauthorized disclosure4 #c4 ,unfair and deceptive acts and practices relating to location data 7a7 ,prohibition on sale from data brokers ,it shall be unlawful for a data broker to sell1 resell1 license1 trade1 transfer1 share1 or otherwise provide or make available location data 7including data volunteered by an individual1 medical center-derived data1 data from a wearable fitness tracker1 data from web browsing history1 or any other source determined appropriate by the ,commission74 7b7 ,prohibition on sale to data brokers ,it shall be unlawful for any person to sell1 resell1 license1 trade1 transfer1 share1 or otherwise provide or make available location data 7including data volunteered by an individual1 medical center-derived data1 data from a wearable fitness tracker1 data from web browsing history1 or any other source determined appropriate by the ,commission7 to a data broker4 #d4 ,right of access and deletion 7a7 ,right of access 7#a7 ,in general ,a covered entity shall make available a reasonable mechanism by which an individual1 upon verified request1 may access-- 7,a7 any health data or location data relating to such individual that is retained by such covered entity1 including-- 7i7 in the case of such data that the covered entity collected from any third party1 how and from which specific third party the covered entity collected such data2 and 7ii7 such data that the covered entity inferred about the individual2 and 7,b7 a list of the specific third parties to which the covered entity has disclosed any health data or location data relating to such individual4 7#b7 ,format ,a covered entity shall make the information described in paragraph 7#a7 available in both a human-readable and a structured1 interoperable1 and machine-readable format4 7b7 ,right of deletion ,a covered entity shall make available a reasonable mechanism by which an individual1 upon verified request1 may request the deletion of any health data or location data relating to such individual that is retained by the covered entity1 including any such information that the covered entity collected from a third party or inferred from other information retained by the covered entity4 7c7 ,requirements for access and deletion 7#a7 ,timeline for complying with requests ,a covered entity shall comply with a verified request received under this section without undue delay1 but not later than #ae days after the date on which the covered entity receives such verified request4 7#b7 ,fees prohibited ,a covered entity may not charge a fee to an individual for a request made under this section4 7#c7 ,rules of construction ,nothing in this section shall be construed to require a covered entity to-- 7,a7 take an action that would convert information that is not health data or location data into health data or location data2 7,b7 collect or retain health data or location data that the covered entity would not otherwise collect or retain2 or 7,c7 retain health data or location data longer than the covered entity would otherwise retain such data4 7d7 ,reasonable mechanism defined ,in this section1 the term reasonable mechanism means1 with respect to a covered entity and a right under this section1 a mechanism that-- 7#a7 is equivalent in availability and ease of use to that of other mechanisms for communicating or interacting with the covered entity2 and 7#b7 includes an online means of exercising any such right4 #e4 ,exceptions 7a7 ,publication of newsworthy information of legitimate public concern ,nothing in this ,act1 or a regulation promulgated under this ,act1 shall apply with respect to health data or location data that is collected1 retained1 used1 or disclosed by a covered entity for the publication of newsworthy information of legitimate public concern to the public1 or to the collecting1 retaining1 using1 or disclosing of such data by a covered entity for that purpose1 if such covered entity has reasonable safeguards and processes that prevent the collecting1 retaining1 using1 or disclosing of health data or location data for commercial purposes other than the publication of newsworthy information of legitimate public concern4 7b7 ,public health campaigns ,the prohibition under section #b7;a7 shall not apply to any public health campaign directed toward individuals or subpopulations of individuals4 7c7 ,disclosure pursuant to valid authorization 7#a7 ,in general ,nothing in this ,act shall be construed to prohibit a disclosure of the health data or location data of an individual for which the individual provides valid authorization4 7#b7 ,valid authorization defined ,for purposes of paragraph 7#a71 the term valid authorization has the meaning given such term in section #afd4ejh of title #de1 ,code of ,federal ,regulations 7or a successor regulation71 subject to any such adaptation the ,commission shall deem necessary to apply such term to the disclosure of both health data and location data4 7d7 ,,hipaa-,compliant actions 7#a7 ,in general ,nothing in this ,act shall be construed to prohibit any action taken with respect to the health information of an individual by a data broker that is a business associate or covered entity that is permissible under the ,federal regulations concerning standards for privacy of individually identifiable health information promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 7#b7 ,terms defined ,for purposes of paragraph 7#a71 the terms business associate1 covered entity1 and health information shall have the meanings given those terms in the ,federal regulations specified in such section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 #f4 ,effective date 7a7 ,in general ,the prohibitions under sections #b and #c shall take effect on the earlier of-- 7#a7 the date the ,commission issues the final rule under subsection 7b72 or 7#b7 #ahj days after the date of enactment of this ,act4 7b7 ,rulemaking 7#a7 ,final rule ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall promulgate regulations1 pursuant to section #eec of title #e1 ,united ,states ,code1 to carry out the provisions of this ,act4 7#b7 ,additional guidance ,the ,commission may promulgate further regulations1 pursuant to such section #eec1 to update and carry out the provisions of this ,act1 including further guidance regarding the types of data described in sections #b and #c4 #g4 ,enforcement 7a7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #b1 #c1 or #d shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,except as provided in subparagraphs 7,d7 and 7,e71 the ,commission shall enforce this ,act and any regulation promulgated thereunder in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,subject to subparagraph 7,f71 any covered entity or data broker who violates this ,act or any regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,federal ,trade ,commission under any other provision of law4 7,d7 ,scope of jurisdiction ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df71 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act and the regulations promulgated under this ,act1 in the same manner provided in subparagraph 7,a71 with respect to-- 7i7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and ,acts amendatory thereof and supplementary thereto2 and 7ii7 organizations that are not organized to carry on business for their own profit or that of their members4 7,e7 ,independent litigation authority ,in any case in which the ,commission has reason to believe that a covered entity or data broker is violating or has violated section #b1 #c1 or #d1 the ,commission may bring a civil action1 subject to subsection 7c71 to-- 7i7 enjoin any further such violation by such covered entity or data broker2 7ii7 enforce compliance with this ,act1 including through deletion of the relevant information2 7iii7 obtain a permanent1 temporary1 or preliminary injunction2 7iv7 obtain civil penalties2 7v7 obtain damages 7whether actual1 punitive1 or otherwise71 restitution1 disgorgement of unjust enrichment1 or other compensation on behalf of aggrieved persons2 or 7vi7 obtain any other appropriate equitable relief4 7,f7 ,civil penalties ,in addition to any other penalties as may be prescribed by law1 a violation of this ,act shall carry a civil penalty not to exceed #ae percent of the revenues earned during the preceding #ab-month period by the ultimate parent entity of the covered entity or data broker that committed such violation4 7b7 ,private right of action 7#a7 ,in general ,any individual alleging a violation of this ,act or a regulation promulgated thereunder may bring a civil action1 subject to subsection 7c74 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7,a7 damages in an amount equal to the greater of-- 7i7 actual damages2 or 7ii7 an amount equal to not less than #ajj and not more than #a1jjj per violation1 per day2 7,b7 punitive damages2 7,c7 restitution or other compensation2 7,d7 reasonable attorney's fees1 including litigation expenses1 and costs2 and 7,e7 any other relief determined appropriate by the court1 including equitable or declaratory relief4 7#c7 ,injury in fact ,a violation of this ,act or a regulation promulgated thereunder with respect to health data or location data constitutes a concrete and particularized injury in fact to the individual to whom such data relates4 7#d7 ,invalidity of pre-dispute arbitration agreements and pre-dispute joint-action waivers 7,a7 ,in general ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement or pre-dispute joint-action waiver shall be valid or enforceable with respect to a dispute arising under this ,act4 7,b7 ,applicability ,any determination as to whether or how this paragraph applies to any dispute shall be made by a court1 rather than an arbitrator1 without regard to whether such agreement purports to delegate such determination to an arbitrator4 7,c7 ,definitions ,for purposes of this paragraph3 7i7 ,pre-dispute arbitration agreement ,the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement4 7ii7 ,pre-dispute joint-action waiver ,the term pre-dispute joint-action waiver means an agreement that would prohibit a party from participating in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other forum1 concerning a dispute that has not yet arisen at the time of the making of the agreement4 7c7 ,exclusive jurisdiction 7#a7 ,district courts ,for any action brought under this ,act1 the following district courts shall have exclusive jurisdiction3 7,a7 ,commission ,for actions brought by the ,commission1 the ,united ,states ,district ,court for the ,district of ,columbia4 7,b7 ,private actions ,for private actions brought by individuals1 in the court of the plaintiff's choice between-- 7i7 the ,united ,states ,district ,court for the ,district of ,columbia2 or 7ii7 the district court of the ,united ,states for the judicial district in which the violation took place or in which any defendant resides or does business4 7#b7 ,court of appeals ,the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit shall have exclusive jurisdiction of appeals from any decision under paragraph 7#a74 7d7 ,statute of limitations ,an action for a violation of this ,act may be commenced not later than #f years after the date upon which the plaintiff obtains actual knowledge of the facts giving rise to such violation4 #h4 ,definitions 7a7 ,in general ,in this ,act3 7#a7 ,collect ,the term collect means1 with respect to health data or location data1 to obtain such data in any manner4 7#b7 ,commercial advertising ,the term commercial advertising means communications that promote the sale of or interest in goods or services1 including goods or services that are published digitally1 via video or audio1 or in print4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,covered entity 7,a7 ,in general ,the term covered entity means any entity that-- 7i7 is engaged in activities in or affecting commerce 7as defined in section #d of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd772 and 7ii7 is-- 7,i7 a person1 partnership1 or corporation subject to the jurisdiction of the ,commission under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 or 7,,ii7 notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,commission-- 7aa7 a common carrier subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto2 or 7bb7 an organization not organized to carry on business for its own profit or that of its members4 7,b7 ,exclusions ,the term covered entity does not include an entity that is-- 7i7 a covered entity1 as defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or a successor regulation71 to the extent such entity is acting as a covered entity under the ,,hipaa privacy regulations 7as defined in section #aahj7;b77#c7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#i7;b77#c7772 7ii7 an entity that is a business associate1 as defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or a successor regulation71 to the extent such entity is acting as a business associate under the ,,hipaa privacy regulations 7as defined in such section #aahj7;b77#c772 or 7iii7 an entity that is subject to restrictions on disclosure of records under section #edc of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bij;dd-#b71 to the extent such entity is acting in a capacity subject to such restrictions4 7#e7 ,data broker ,the term data broker means an individual or entity that-- 7,a7 collects1 buys1 licenses1 or infers data about an individual2 and 7,b7 sells1 licenses1 or trades such data4 7#f7 ,disclose ,the term disclose means1 with respect to health data or location data1 for a covered entity to release1 transfer1 sell1 provide access to1 license1 or divulge such data in any manner to a third party or government entity4 7#g7 ,express consent 7,a7 ,in general ,the term express consent means1 with respect to the collecting1 retaining1 using1 or disclosing of health data or location data1 the informed1 opted-in1 voluntary1 specific1 and unambiguous written consent of an individual 7which may include written consent provided by electronic means7 to such collecting1 retaining1 using1 or disclosing of such data4 7,b7 ,exclusions ,the term express consent does not include any of the following3 7i7 ,consent secured without first providing to the individual a clear and conspicuous disclosure1 apart from any privacy policy1 terms of service1 terms of use1 general release1 user agreement1 or other similar document1 of all information material to the provision of consent4 7ii7 ,hovering over1 muting1 pausing1 or exiting a given piece of content4 7iii7 ,agreement obtained through the use of a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy1 decision making1 or choice4 7#h7 ,health data ,the term health data means data that identifies1 relates to1 describes1 or reveals-- 7,a7 the search for1 attempt to obtain1 or receipt of any health services2 7,b7 any past1 present1 or future disability1 physical health condition1 mental health condition1 or health condition of an individual1 including efforts to research or obtain health services or supplies 7including location data that might indicate an attempt to acquire or receive such information services or supplies72 7,c7 any treatment or diagnosis of a disability or condition described in subparagraph 7,b72 or 7,d7 any information described in subparagraph 7,a7 through subparagraph 7,c7 that is derived or extrapolated from non-health information 7such as proxy1 derivative1 inferred1 emergent1 or algorithmic data74 7#i7 ,location data 7,a7 ,in general ,the term location data means data derived from a device or technology that reveals the past or present physical location of an individual or device with sufficient precision to identify street-level location information of the individual or device within #a1hej feet or less4 7,b7 ,exclusion ,the term location data does not include geolocation information identifiable or derived solely from the visual content of a legally obtained image1 including the location of the device that captured such image4 7#aj7 ,service provider 7,a7 ,in general ,the term service provider means an individual or entity that-- 7i7 collects1 retains1 uses1 or discloses health data for the sole purpose of1 and only to the extent that such individual or entity is1 conducting business activities on behalf of1 for the benefit of1 under instruction of1 or under contractual agreement with a covered entity and not any other individual or entity2 and 7ii7 does not divulge health data to any individual or entity other than such covered entity or a contractor to such service provider bound to information processing terms no less restrictive than terms to which such service provider is bound4 7,b7 ,limitation of application ,such individual or entity shall only be considered a service provider in the course of activities described in subparagraph 7,a77i74 7,c7 ,minimization by service providers ,for purposes of section #b1 a request from an individual to a covered entity for a product or service1 and an express consent from the individual to the covered entity1 shall be treated as having also been provided to the service provider of the covered entity4 7#aa7 ,state ,the term ,state means each of the several ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each ,federally recognized ,indian ,tribe4 7#ab7 ,third party ,the term third party means1 with respect to the disclosing or collecting of health data1 any individual or entity that is not-- 7,a7 the covered entity that is disclosing or collecting such information2 7,b7 the individual to whom such information relates2 or 7,c7 a service provider4 7#ac7 ,ultimate parent entity ,the term ultimate parent entity has the meaning given the term in section #hja4a of title #af1 ,code of ,federal ,regulations 7or a successor regulation74 7b7 ,rulemaking 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall conduct a rulemaking pursuant to section #eec of title #e1 ,united ,states ,code1 to define the terms public health campaign and data for purposes of implementing and enforcing this ,act4 7#b7 ,requirement ,for purposes of the rulemaking required under paragraph 7#a71 the term data shall include information that is linked1 or reasonably linkable1 to-- 7,a7 specific individuals2 or 7,b7 specific groups of individuals who share the same place of residence or internet protocol address4 #i4 ,relationship to ,federal and ,state laws 7a7 ,federal law preservation ,nothing in this ,act1 or a regulation promulgated under this ,act1 shall be construed to limit any other provision of ,federal law1 except as specifically provided in this ,act4 7b7 ,state law preservation 7#a7 ,in general ,nothing in this ,act1 or a regulation promulgated under this ,act1 shall be construed to preempt1 displace1 or supplant any ,state law1 except to the extent that a provision of ,state law conflicts with a provision of this ,act1 or a regulation promulgated under this ,act1 and then only to the extent of the conflict4 7#b7 ,greater protection under ,state law ,for purposes of this subsection1 a provision of ,state law does not conflict with a provision of this ,act1 or a regulation promulgated under this ,act1 if such provision of ,state law provides greater privacy protection than the privacy protection provided by such provision of this ,act or such regulation4 #aj4 ,severability clause ,if any provision of this ,act1 or the application thereof to any individual1 entity1 or circumstance1 is held invalid1 the remainder of this ,act1 and the application of such provision to other persons not similarly situated or to other circumstances1 shall not be affected by the invalidation4