Washington, D.C. – As tech companies and public health agencies deploy contact tracing apps and digital monitoring tools to fight the spread of Coronavirus Disease 2019 (COVID-19), Colorado U.S. Senator Michael Bennet announced he has co-sponsored the Public Health Emergency Privacy Act, which sets strong and enforceable privacy and data security rights for health information legislation. The bicameral legislation was introduced by U.S. Senators Richard Blumenthal (D-Conn.) and Mark R. Warner (D-Va.), along with U.S. Representatives Anna G. Eshoo (CA-18), Jan Schakowsky (IL-09), and Suzan DelBene (WA-01.).
After decades of data misuse, breaches, and privacy intrusions, Americans are reluctant to trust tech firms to protect their sensitive health information. According to a recent poll, more than half of Americans would not use a contact tracing app and similar tools from Google and Apple over privacy concerns. The bicameral Public Health Emergency Privacy Act would protect Americans who use contact tracing technology during the pandemic and safeguard civil liberties. Strengthened public trust will empower health authorities and medical experts to leverage new health data and apps to fight the COVID-19 pandemic.
“Effective public health surveillance ultimately requires the cooperation and trust of individuals and communities whose data must be collected. If people fear the government will misuse their data, they may avoid testing and withhold critical information, jeopardizing our response to the pandemic and endangering the health of our communities,” said Bennet. “As governments worldwide develop and deploy these technologies, the United States has an opportunity to lead. The Public Health Emergency Privacy Act will help us set an example to the world for how to protect not only our health, but our most cherished values.”
“This measure sets strict and straightforward privacy protections and promises: Your information will be used to stop the spread of this disease, and no more,” said Blumenthal. “Legal safeguards protecting consumer privacy failed to keep pace with technology, and that lapse is costing us in the fight against COVID-19. Americans are rightly skeptical that their sensitive health data will be kept safe and secure, and as a result, they’re reluctant to participate in contact tracing programs essential to halt the spread of this disease. The Public Health Emergency Privacy Act’s commitment to civil liberties is an investment in our public health.”
“Communications technology has obviously played an enormously important role for Americans in coping with and navigating the new reality of COVID-19 and new technology will certainly play an important role in helping to track and combat the spread of this virus. Unfortunately, our health privacy laws have not kept pace with the privacy expectations Americans have come to expect for their sensitive health data,” said Warner. “Absent a clear commitment from policymakers to improving our health privacy laws, as this important legislation seeks to accomplish, I fear that creeping privacy violations could become the new status quo in health care and public health. The credibility – and indeed efficacy – of these technologies depends on public trust.”
“I’m thankful that our country is blessed with the world’s best innovators and technologists, many of whom I represent in the House, and that they have joined the effort to combat the coronavirus by using technology to control the spread of the virus,” said Eshoo. “As we consider new technologies that collect vast amounts of sensitive personal data, we must not lose site of the civil liberties that define who we are as a nation. I’m proud to join my colleagues to introduce the Public Health Emergency Privacy Act, strong and necessary legislation that protects the privacy of every American while ensuring that innovation can aid important public health efforts.”
“As we continue to respond to the devastating suffering caused by COVID-19, our country’s first and foremost public health response must be testing, testing, testing, AND manual contact tracing. Digital contact tracing can and should complement these efforts, but it is just that – complimentary. However, if we do pursue digital contact tracing, consumers need clearly-defined privacy rights and strong enforcement to safeguard these rights. I am proud to introduce this bill with my friend and fellow Energy & Commerce Subcommittee Chairwoman Eshoo, along with Senators Blumenthal and Warner,” said Schakowsky. “It’s our shared belief that swift passage of this legislation would go a long way towards establishing the trust American consumers need – and which Big Tech has squandered, time and again – for digital contact tracing to be a worthwhile auxiliary to widespread testing and manual contact tracing.”
“We must use every tool available to us to respond to the COVID-19 pandemic. Contract tracing, along with testing, are the cornerstones of a science-based approach to addressing this historic crisis. We can protect our public health response and personal data privacy,” said DelBene. “I have been calling on the Trump administration and the private sector to adopt data privacy principles since the start of this outbreak. It is time for Congress to lead the way in assuring we have a strong national contact tracing system and that Americans’ personal data is protected. This bill will achieve this mutual goal.”
The Public Health Emergency Privacy Act would:
- Ensure that data collected for public health is strictly limited for use in public health;
- Explicitly prohibit the use of health data for discriminatory, unrelated, or intrusive purposes, including commercial advertising, e-commerce, or efforts to gate access to employment, finance, insurance, housing, or education opportunities;
- Prevent the potential misuse of health data by government agencies with no role in public health;
- Require meaningful data security and data integrity protections – including data minimization and accuracy – and mandate deletion by tech firms after the public health emergency;
- Protect voting rights by prohibiting conditioning the right to vote based on a medical condition or use of contact tracing apps;
- Require regular reports on the impact of digital collection tools on civil rights;
- Give the public control over their participation in these efforts by mandating meaningful transparency and requiring opt-in consent; and
- Provide for robust private and public enforcement, with rulemaking from an expert agency while recognizing the continuing role of states in legislation and enforcement.
The Public Health Emergency Privacy Act incorporates many of the principles Bennet outlined in a letter earlier this month urging the Trump Administration to protect civil rights and personal freedoms as it considers how to adapt technology to contact tracing efforts to combat the COVID-19 pandemic. Earlier this year, Bennet also wrote to the CEO of Zoom asking the company to detail its policies to protect user privacy and security. Last year, Bennet introduced the Data Care Act with U.S. Senator Brian Schatz (D-Hawaii) and other Senate colleagues, which requires websites, apps, and other online providers to take responsible steps to safeguard personal information and stop the misuse of users’ data.
The bill is endorsed by Lawyers’ Committee for Civil Rights Under Law, Public Knowledge, New America’s Open Technology Institute, Consumer Reports, Free Press, Electronic Privacy and Information Center (EPIC), Public Citizen, health privacy scholar Frank Pasquale, and privacy scholar Ryan Calo.
Text of the bill is available HERE. A one-page summary is available HERE. A section-by-section summary is available HERE.