Four Republican senators plan to introduce a bill intended to protect the privacy of U.S. residents as government agencies and private companies track the spread of COVID-19. Still, some privacy advocates say the proposal doesn’t go far enough.
The proposal comes in response to privacy concerns about how companies will use smartphone and other personal data when tracking the spread of the pandemic. “As the coronavirus continues to take a heavy toll on our economy and American life, government officials and healthcare professionals have rightly turned to data to help fight this global pandemic,” said Sen. Roger Wicker, a lead sponsor of the bill. “This data has great potential to help us contain the virus and limit future outbreaks, but we need to ensure that individuals’ personal information is safe from misuse.”
The proposed COVID-19 Consumer Data Protection Act, scheduled to be released in early May, requires most companies get consent before collecting and transferring a person’s health and geolocation data to track the spread of COVID-19. The proposal would require companies to disclose to consumers how their data will be handled and how long it will be retained, and it would require companies to allow people to opt out of collection and processing of their health and geolocation data.
Among other provisions, the proposal would also require companies to delete or deidentify all personal information when it is no longer being used to track COVID-19.
But the bill only addresses COVID-19 tracking and not broader privacy, and geolocation tracking concerns said critics. The bill also appears to preempt strict Federal Communications Commission privacy rules for telecommunications carriers while making weaker Federal Trade Commission regulations its focus, said Sara Collins, policy counsel at digital rights group Public Knowledge.
The proposal gives the FTC no new enforcement or rule-making powers, and it doesn’t prohibit the sale of COVID-19 tracking information, she added.
“This bill provides little protection for Americans’ privacy during the COVID-19 epidemic,” Collins said. “Companies may still profit from selling health information or geolocation data and are allowed to infer who has been diagnosed with the novel coronavirus.”
A spokeswoman for Wicker, chairman of the Senate Commerce, Science, and Transportation Committee, said the bill would allow the sale of personal information only with consumer consent. “This preserves consumer choice and control,” she added. “The bill provides clearly articulated rights for individuals and obligations for businesses, removing the need for the FTC to create additional rules.”
Wicker has pushed for a broader privacy law addressing a wide range of personal data, but that effort appears to be stalled in Congress.
The proposal gives consumers some benefits by requiring companies to get their affirmative consent before collecting COVID-19 data, said Robert Holland, who focuses on healthcare and cybersecurity as a lawyer with the Buchanan Ingersoll & Rooney law firm.
The opt-out rights in the proposal are also “critical to give consumers a feeling of control over their data,” he said.
However, the proposal, as outlined, contains several shortcomings, he added. It does not appear to define the minimum standards for security and data minimization.
“If the security standards are too low, consumers won’t have confidence that the companies are handling data responsibly,” said Holland, based in D.C. “If minimization standards are too low, companies will be permitted to collect significantly more data than is actually necessary to achieve the contact-tracing goals.”
Also, the consumer transparency provisions in the proposal aren’t detailed and may not require that company disclosures “are meaningful and understandable by average consumers,” he said.
The proposal does not explicitly limit data collection to contact-tracing purposes, he added, and it doesn’t require companies to have safeguards against “mission creep.”
But Dr. David Samadi, a New York City urologist, praised the proposal. The senators are “on the side of U.S. citizens’ right to healthcare privacy and freedom,” he said. “If we have to live under a tyrannical nanny-state government keeping track of our every move, how will any of us ever feel comfortable venturing from our homes knowing someone is watching?”
Samadi raised concerns about the prospect of the bill passing, however, with Congress meeting irregularly during the COVID-19 pandemic. He called on Congress to “get back to work.”
