• by Wendy Davis  @wendyndavis, April 30, 2020

Four Republican senators said Thursday they will introduce privacy legislation that would require companies to obtain people's express consent before gathering data in order to trace the contacts of people diagnosed with COVID-19.

The “COVID-19 Consumer Data Protection Act” would specifically require companies to “obtain affirmative express consent from individuals to collect, process, or transfer their personal health, geolocation, or proximity information for the purposes of tracking the spread of COVID-19,” according to a statement posted on the Senate Commerce committee's website.

The measure will be introduced by GOP Senators Roger Wicker (Mississippi), John Thune (South Dakota), Jerry Moran (Kansas) and Marsha Blackburn (Tennessee).

The bill would also mandate that companies inform the public about COVID-19-related data collection, and establish data minimization and security requirements for personally identifiable information.

In addition, the bill would require companies to either delete or “de-identify” all personally identifiable information when it's no longer being used for the coronavirus outbreak.

The measure would be enforceable by state attorneys general.

The advocacy group Public Knowledge criticized the bill Thursday, warning it doesn't go far enough to protect consumers' privacy for several reasons, including that it only applies to data specifically collected for COVID-19 related purposes.

“Companies may still profit from selling health information or geolocation data, and are allowed to infer who has been diagnosed with the novel coronavirus,” Sara Collins, policy counsel at Public Knowledge, stated.

She added that the measure lacks enforcement teeth.

“This bill is truly a privacy ‘cure’ worse than the disease,” Collins stated.