A bipartisan proposed COVID-19 privacy law would prohibit operators of contact-tracing apps from collecting or processing data for any commercial purpose, including advertising.
The “Exposure Notification Privacy Act,” introduced this week by Sens. Maria Cantwell (D-Washington), Bill Cassidy (R-Louisiana), and backed by Amy Klobuchar (D-Minnesota), would also require that users affirmatively consent to participate in automated contact-tracing programs. Some public health authorities hope to use contact-tracing programs in order to track COVID-19 infections and notify people who may have been exposed to the virus.
The proposed law would allow users to delete their data, and prohibit places of public accommodation from discriminating against people who don't participate in contact-tracing programs. The Federal Trade Commission and state attorneys general would be empowered to enforce the bill.
Advocacy group Public Knowledge on Tuesday endorsed the new proposal. “We need to regulate apps that provide COVID-19 exposure notification to protect a user’s privacy, prevent data misuse, and preserve our civil rights -- and this bill offers a roadmap for doing all three,” Sara Collins, policy counsel at the organization, stated.
The bi-partisan bill comes several weeks after four Republican senators proposed a different COVID-19 privacy law. That GOP proposal, the “COVID-19 Consumer Data Protection Act,” would generally require companies to obtain people's express consent before gathering data health, device, geolocation, or proximity, in order to trace the contacts of people diagnosed with the virus.
But that earlier bill has some exceptions that, according to advocacy groups, could undermine people's privacy. For instance, that proposed law's requirements wouldn't apply to employers and visitors to businesses.