Roger Wicker

• Many states have introduced bills which would govern collection, use, and sharing of COVID-19 data by a range of entities, including government actors and commercial entities.
• Unless appropriate guardrails are put in place, data collected by governments through contact tracing could be used in unexpected, inappropriate, or even harmful ways.
• Below, we discuss FPFs participation in a July 28th COVID-19 Public Work Session hosted by the Washington State Senate Committee on Environment, Energy & Technology, and the wide range of active COVID-19 legislation in state legislatures, including New York, New Jersey, and California.

Washington Public Work Session (July 28) 

• These recommendations align with FPF’s recent report to promote responsible data use; and FPF’s April 2020 testimony on the topic of “Enlisting Big Data in the Fight Against Coronavirus,” convened by the U.S. Senate Committee on Commerce, Science, and Transportation.
  • Download a copy of FPF’s presentation HERE. 
  • Watch the full video HERE.
  • Read FPF & BrightHive Report: “Digital Contact Tracing: A Playbook for Responsible Data Use”
  • See FPF Infographic: “Understanding the “World of Geolocation Data”
  • On July 28, 2020, the Washington State Senate Committee on Environment, Energy & Technology held a Public Work Session to discuss government uses of data and contact tracing technologies.
  • The Committee invited guest experts to give presentations, including FPFs Senior Counsel Kelsey Finch, Consumer Reports Justin Brookman, and the Washington State Department of Health.
  • In FPFs presentation, we recommended for policymakers and technology providers to follow the lead of public health experts, and outlined key considerations when deciding how to design and implement digital contact tracing tools.
  • Recognizing widespread consensus that apps ought to be voluntary, Ms. Finch also emphasized the need to find ways to promote and maintain public trust.

Legislative Trends in the States 

• As a result, in some states, COVID-19 privacy bills have already been signed into law, including a few notable new state laws:
  • Kansas’s H.B. 2016(signed into law June 8, 2020 following a special session) requires participation in state contact tracing to be voluntary and mandates confidentiality and data retention requirements for contact tracing information, and prohibits the use of cellphone location data to “identify or track, directly or indirectly, the movement of persons” for contact tracing purposes; 
  • New York’s S 8362 (signed into law June 17, 2020) requires that all contact tracers hired by the state health departments be representative of the cultural and linguistic diversity of the communities in which they serve.
  • South Carolina’s HJR5202(signed into law June 25, 2020) prohibits the local health department from using mobile apps created for contact tracing. 
  • Over 20 states are considering, developing, or implementing decentralized Bluetooth-based apps based on the Apple Google Exposure Notification API, an effort supported nationally by the Association of Public Health Laboratories for individuals to receive exposure alerts even when they travel across state borders.
  • Meanwhile, most state legislatures have suspended their sessions for the year, with only some states remaining in regular session, and others convening special sessions to address the pandemic.
  • In other states, COVID-19 privacy legislation has been introduced and remains active with some bills appearing likely to pass in upcoming weeks.

New York

• In New York, which will remain in session through the end of 2020, several COVID-19 privacy bills have gained traction in recent months, including:
  • NY A10500, which passed the New York Senate on July 23, would mandate the confidentiality of COVID-19 contact tracing information and prohibit access to such data by law enforcement or for immigration purposes. The ACLU and other community organizations support the bill.
  • NY S8448, which passed the Senate on July 23, would regulate the collection and use of emergency health data and the use of COVID-19 technology. The bill contains transparency requirements, data minimization obligations, retention limitations, and data security obligations for government entities and “third party recipients” of emergency health data. The scope of the bill resembles two federal billsintroduced by Senator Blumenthal and Senator Wicker earlier this year to regulate emergency health data.

New Jersey

• In New Jersey, the legislative session runs through the end of 2020. In January, a number of geolocation data bills were introduced that remain technically under consideration (e.g., A 193 and A 5259), in addition to general comprehensive privacy bills (e.g., S269 and A2188). However, New Jersey legislators have since prioritized urgent pandemic response bills, including:
  • A4170, passed the Assembly and received in the Senate on August 3, would require public health authorities to abide by purpose and retention limitations (30 days) for contact tracing data, and if data is shared with any third parties, to publish the names of those entities online. Third parties would also be required to abide by the same obligations, with a civil penalty available of up to $10,000 collected by the Commissioner of Health. S 2539 is a companion bill.

California 

• Active COVID-19 privacy bills in California include:
  • AB 685, which would require employers to notify its employees and state health departments of known or reasonably known exposures to COVID-19 within 24-hours. 
  • AB 2004, which would establish a pilot program to expand the use of verifiable health  credentials for communication of COVID-19 or other medical test results; and prohibit law enforcement agencies from requiring a patient to show such a credential. 
• On August 20, 2020, two additional noteworthy bills narrowly failed to progress out of the Senate Appropriations Committee, which would have regulated data related to established methods of contact tracing (AB 660) and digital contact tracing tools (AB 1782).
  • AB 660 would have required that data collected for the purpose of contact tracing could only be used, maintained, or disclosed to facilitate contact tracing efforts, and would have prohibited law enforcement from participating in contact tracing. AB 660 was opposed by local law enforcement, due to lack of clarity regarding how it intended to apply to law enforcement in the context of an employer-employee relationship. Concern was also raised about possible unintended consequences within prisons, which have experienced outbreaks. At a recent hearing, some legislators argued that California already has adequate legislation to protect individuals from law enforcement, such as the California Values Act of 2017 (SB54), which prevents state and local law enforcement agencies from using their resources on behalf of federal immigration enforcement agencies. However, numerous community organizations supported the bill, arguing that it would increase participation in contact tracing, thereby contributing towards more complete datasets and overall effectiveness. 
  • AB 1782 would have comprehensively regulated digital contact tracing tools (“technology-assisted contact tracing”) offered by public health entities and businesses. AB 1782 would also have prohibited discrimination on the basis of participation in technology-assisted contact tracing. The scope of the bill resembles a bipartisan federal bill introduced by Senator Cantwell and Senator Cassidy to regulate exposure notification services. 
  • In California, the legislature has generally prioritized pandemic related bills over other pieces of legislation such as amendments to the California Consumer Privacy Act (e.g., AB 3119 and AB 3212).
  • However, some related privacy bills remain under consideration, such as other CCPA amendments (AB 1281 and AB 713), and a consumer genetics privacy bill (SB 980).In California, the final day for bills to be passed by the House or the Senate is August 31, 2020.

Overall Trends 

• For example, all states have unfair and deceptive practices (UDAP) laws and laws governing healthcare entities (supplementing HIPAA).
• Many states also have strong laws governing the confidentiality of state-held records, such as the California Confidentiality of Medical Information Act (Cal.
• Civil Code 5656.37 [1992]), and the Uniform Health Care Information Act (National Conference, 988).