Exposure Notification Privacy Act Introduced

A third COVID-19 privacy bill is unveiled in the Senate that may be more about messaging and positioning on broader privacy legislation. In any event, the odds on such legislation being enacted in the near term is not high.

First things first, if you would like to receive my Technology Policy Update, email me. You can find some of these Updates from 2019 and 2020 here.

This week, a third COVID-19 privacy bill was released that occupies a middle ground between the other two bills. However, despite being bipartisan and between the two other bills, it is still not likely Congress will enact either targeted privacy legislation or broader, national privacy legislation this year. And yet, a number of the bill’s requirements track more closely with the Democratic bill released last month, suggesting some of the ground may be shifting under some of the outstanding issues. For example, the bill would not preempt state laws and while it would not create a new federal means a person could sue a company for violations, it expressly preserves all existing state and federal avenues a person could use to litigate.

On 3 June, Senate Commerce, Science and Transportation Committee Ranking Member Maria Cantwell (D-WA) and Bill Cassidy (R-LA) introduced the “Exposure Notification Privacy Act” (S.3861) with Senator Amy Klobuchar (D-MN) cosponsoring. The Senators released a section-by-section and a summary of the bill, too. This bill follows the “Public Health Emergency Privacy Act” (S.3749) and the “COVID-19 Consumer Data Protection Act” (S.3663), bills that take approaches aligned with the Democratic and Republican thinking on privacy respectively. (See here for more analysis).

The key term in the Exposure Notification Privacy Act is “automated exposure notification service,” (AENS) for it informs what is “covered data,” and hence covered by the bill’s protections, and it seems fairly targeted to address only those apps or services created to track contacts for purposes of reducing the spread of COVID-19. This term is defined as:

• a website, online service, online application, mobile application, or mobile operating system
• offered in interstate commerce in the United States
• designed, in part or in full, specifically to be used for, or marketed for, the purpose of digitally notifying, in an automated manner, an individual who may have become exposed to an infectious disease

And yet, because what is covered data is limited to information “collected, processed, or transferred in connection with an AENS,” it is a reasonable reading of this language that an entity obtaining information from a data broker in order to track COVID-19 would be outside the definition of covered data. The same would seem to be true of social media platforms that collect and process data from their users incidentally to their main business of monetizing these data. This seems like a fairly large loophole that would mean the “Exposure Notification Privacy Act” would really focus tightly on technology programs, apps, and platforms mostly used to track and prevent infectious diseases with the voluntary, knowingly consent of users.

AENS would need to obtain express, affirmative consent a person provides after being provided with conspicuous, easy-to-understand notice about data collection, usage, processing, and transfer. There must also be a conspicuous means of withdrawing such consent. In any event, a person with an “authorized diagnosis” would control whether this information is processed by the AENS.

AENS and platform operators must publish “a privacy policy that provides a detailed and accurate representation of that person or entity’s covered data collection, processing, and transfer activities in connection with such person or entity’s AENS or the facilitation of such service.” These privacy policies must divulge “each category of covered data the person or entity collects and the limited allowable processing purposes for which such covered data is collected” and

• “a description of the person or entity’s covered data minimization and retention policies;
• how an individual can exercise the individual rights described in this title;
• a description of the person or entity’s covered data security policies.”

As an aside, platform operators are entities “other than a service provider who provides an operating system that includes features supportive of an AENS and facilitates the use or distribution of such AENS to the extent the technology is not used by the platform operator as an AENS.” And so, platform operators might be Google, Apple, Microsoft, or a handful of others to the extent their operations systems are supporting the AENS in its purpose to track infectious diseases. Hence, some of the bill’s requirements will be imposed on such entities.

Of course, the bill text does not limit this measure just to COVID-19 and extends it to all infectious diseases, which is perhaps a nod to a new normal in which many Americans have apps on their phone or wearables on their bodies designed to counter contracting the flu or other, less dangerous viruses (See below in further reading for an article on FitBit and other apps and platforms that may be poised to do just this and a wearable Singapore may debut shortly.)

There are restrictions on whom may receive covered data from AENS. These entities may only alert individuals of possible exposure if they opted in or a public health authority, transfer these data to service providers to maintain, fix, or improve the system or for security purposes, or to comply in a legal action. The bill also seeks to assuage fears that the sensitive information of people collected for the purposes of combatting infectious diseases could be transferred to and used by law enforcement and surveillance agencies. The legislation explains “[i]t shall be unlawful for any person, entity, or Executive agency to transfer covered data to any Executive agency unless the information is transferred in connection with an investigation or enforcement proceeding under this Act.” Consequently, it would appear the Centers for Disease Control and Prevention (CDC) would be able to transfer covered data to the FTC for an investigation, it could not do the same with the Federal Bureau of Investigation (FBI). In this vein, Executive agencies can only process or transfer for a health purpose related to infectious diseases or in connection with an FTC or state investigation or enforcement action. However, this limitation does not seem to bar a state public health authority from conducting such a transfer to a state law enforcement agency.

There are data minimization responsibilities AENS would need to meet. AENS may not “collect or process any covered data…beyond the minimum amount necessary to implement an AENS for public health purposes; or…for any commercial purpose.” This would seem to limit AENS to collecting, processing and sharing personal information strictly necessary for the purpose of tracking infectious diseases. Likewise, AENS must delete a person’s covered data upon request and on a rolling basis per public health authority guidance. Service providers working with AENS must comply with the latter’s direction to delete covered data.

AENS must “establish, implement, and maintain data security practices to protect the confidentiality, integrity, availability, and accessibility of covered data…[that] be consistent with standards generally accepted by experts in the information security field.” The bill further specifies that such practices must include identifying and assessing risks, corrective and preventive actions for risks, and notification if an AENS is breached. The bill would also ban discrimination on the basis of covered data collected or processed by an AENS or on the basis of a person’s decision not to use an AENS.

As a means of providing oversight, the Privacy and Civil Liberties Oversight Board (PCLOB) would have its mandate enlarged to include “health-related epidemics,” meaning the Board could investigate and issue reports on how well or poorly the act is being implemented with respect to privacy and civil liberties.  To this end, within one year of enactment, PCLOB “shall issue a report, which shall be publicly available to the greatest extent possible, assessing the impact on privacy and civil liberties of Government activities in response to the public health emergency related to the Coronavirus 2019 (COVID–19), and making recommendations for how the Government should mitigate the threats posed by such emergency.”

AENS must also collaborate with public health authorities, which are federal and state agencies charged with protecting and ensuring public health. AENS could only collect, process, and transfer actual diagnoses of an infectious disease and could not do so with potential or presumptive diagnoses. AENS would be charged with issuing public guidance to help people understand the notifications of the system and any limitations with respect to accuracy and reliability. Moreover, AENS must also publish metrics (i.e. “measures of the effectiveness of the service”), including adoption rates. Presumably these latter two requirements would allow for greater transparency and also greater insight into how widely an app or platform is being adopted.

There are a few unexpected wrinkles, however. For example, the act only bars deceptive acts, and not unfair ones, which is a deviation from Section 5 of the Federal Trade Commission (FTC) Act, necessitating language in the bill to this effect rather than the usual reference to 15 USC 45. The bill also places a positive duty on service providers to report violations of the act by either AENS or public health authorities to these entities. It is possible that if such a report accurately depicted a violation the AENS or public health authority then neglected to remedy, the enforcers of the act would have an easier case to make that a violation occurred.

As mentioned, the FTC would police and enforce the act with an enlarged jurisdiction to include common carriers and non-profits. The agency would treat violations as if they were violations of an FTC regulation barring unfair or deceptive practices, which allows the agency to seek civil fines for first offenses. The FTC would not, however, receive rulemaking authority, and should regulations be needed, the agency would be forced to use the cumbersome Moss-Magnuson process.

However, and like the “Public Health Emergency Privacy Act,” the FTC would receive explicit authority to go to court itself instead of having to work through the Department of Justice (DOJ), which is currently the case. That this new wrinkle has appeared in two recent bills largely sponsored by Democrats suggests this may be a new demand for targeted and national privacy legislation and also may reflect diminished faith in the DOJ to vigorously enforce privacy legislation.

State attorneys general could enforce the act in the same ways as the FTC, meaning civil penalties in the first instance being possible. State attorneys general may also bring concurrent state claims, alleging violations under state laws. And so, the bill does not preempt state laws, as a section of the bill goes to some length to stress.

Interestingly, while the bill does not create a private right of action, it suggests a possible way of resolving that sticking point in negotiations between Republicans and Democrats. The bill stresses that it does not foreclose any existing common law federal and state rights of action and would therefore allow people to use any existing law to sue covered entities. This would allow tort suits and other suits to move forward. That Cassidy has cosponsored legislation with this language does not necessarily indicate this is now the will of the Senate Republican Conference.

© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2020. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.