Democrats introduce coronavirus-focused privacy legislation

Democrats introduce coronavirus-focused privacy legislation
© Greg Nash

Democrats in both chambers introduced legislation Thursday aimed at protecting the privacy and security of health data during the coronavirus pandemic.

The Public Health Emergency Privacy Act would place strict limits on what and by whom data collected for public health purposes can be used, implement data minimization procedures for that info, and require opt-in consent for any efforts.

The legislation comes as health agencies and tech companies are developing contact tracing and monitoring tools to contain the pandemic.


It would bar conditioning the right to vote based on use of such services or a medical condition.

The bill would also formally mandate data collected to fight the pandemic be deleted after the public health emergency.

Sens. Richard Blumenthal (D-Conn.) and Mark WarnerMark Robert WarnerSenate infrastructure talks spill over into rare Sunday session Senate holds sleepy Saturday session as negotiators finalize infrastructure deal Democrats warn shrinking Biden's spending plan could backfire MORE (D-Va.) introduced the legislation in the Senate.

“Legal safeguards protecting consumer privacy failed to keep pace with technology, and that lapse is costing us in the fight against COVID-19," Blumenthal said in a statement, referring to the disease caused by the coronavirus.

"Americans are rightly skeptical that their sensitive health data will be kept safe and secure, and as a result, they’re reluctant to participate in contact tracing programs essential to halt the spread of this disease," he added.

Reps. Anna EshooAnna Georges EshooHouse committee approves slate of bills to improve telecom security Hillicon Valley: House advances six bills targeting Big Tech after overnight slugfest | Google to delay cookie phase out until 2023 | Appeals court rules against Baltimore Police Department aerial surveillance program House lawmakers introduce bill to increase American awareness of cyber threats MORE (D-Calif), Jan SchakowskyJanice (Jan) Danoff SchakowskyDemocrats repeal prohibition on funding abortions abroad Nearly 140 Democrats urge EPA to 'promptly' allow California to set its own vehicle pollution standards Omar reflects on personal experiences with hate in making case for new envoy MORE (D-Ill.) and Suzan DelBeneSuzan Kay DelBeneBiden's keeping the Canada-US border closed makes no sense Biden administration stokes frustration over Canada Reducing compliance burdens for the beauty industry MORE (D-Wash.) introduced the House version.


"As we consider new technologies that collect vast amounts of sensitive personal data, we must not lose site of the civil liberties that define who we are as a nation," Eshoo, who represents a portion of Silicon Valley, said in a statement.

Reps. Yvette ClarkeYvette Diane ClarkeHouse passes host of bills to strengthen cybersecurity in wake of attacks Haiti Caucus: Forging path out of crisis will not be quick, but necessary to avoid false 'democracy' US lawmakers express shock at Haitian president's assassination MORE (D-N.Y.), G.K. ButterfieldGeorge (G.K.) Kenneth ButterfieldBlack Caucus presses Democratic leaders to expedite action on voting rights Democratic clamor grows for select committee on Jan. 6 attack Lobbying world MORE (D-N.Y.) and Tony Cárdenas (D-Calif.) are also co-sponsors.

The legislation from Democrats comes two weeks after Senate Republicans introduced another bill focused on data privacy in the context of the pandemic. It did not receive any Democratic support.

That bill would also create an opt-in requirement, but is more limited to data collected for the “purposes of tracking the spread of COVID-19."

It also does not include the civil rights protections in the Democratic version.

Another key difference between the bills is a private right to action, which would let individual consumers sue companies over violations.

Democrats have pushed for that right in previous efforts at data privacy legislation, while Republicans have declined to include it.

The bill introduced by Democrats also explicitly allows states and federal regulators to craft additional rules protecting user data during outbreaks, making the legislation a floor rather than a ceiling.

Republicans have long insisted that federal data privacy legislation should preempt state laws, a position that has gained importance since the passage of California's landmark privacy law, which Republicans have said is too stringent.

These two issues - a private right of action and state preemption - have derailed several prior efforts at creating bipartisan consensus on a federal data privacy law.