OTI Calls on Senators to Enhance Privacy Protections in COVID-19 Data Protection Bill

On Thursday, Senators Roger Wicker (R-Miss.), John Thune (R-S.D.), Deb Fischer (R-Neb.), Jerry Moran (R-Kan.), and Marsha Blackburn (R-Tenn.) introduced the COVID-19 Consumer Data Protection Act, which would regulate companies’ collection and use of personal health information and location data to support efforts in the fight against a global public health pandemic.

The bill is a positive first effort in addressing what protections should be in place for such a major data collection regime, and contains important limits such as defining a time-limited period of “public health emergency” during which the collection permissions apply and including “persistent identifiers” like IP addresses as personal data to be protected. However, the legislation fails to provide robust consumer privacy protections. In particular, it lacks precise definitions for key terms around geolocation and proximity data, creating the risk that cell site location information (CSLI) and GPS location information will not be subject to the bill’s limits. In addition, the bill is missing critical safeguards that would restrict any government use of information to public health authorities, and prohibit secondary uses by other government entities including law enforcement.

The following quote can be attributed to Koustubh “K.J.” Bagchi, senior policy counsel at New America’s Open Technology Institute:

“During a time when so many vulnerable communities are unsure of how to contend with a global pandemic, Congress should be working to ensure that any efforts to combat the virus do not cause more harm by creating uncertainty around personal privacy protections. This bill falls short of that goal. The lack of protections to limit use of data to public health authorities and prohibit any use by law enforcement or other government entities will only make vulnerable communities more suspicious about using technology as a contact tracing tool. In addition, without more specificity in the bill around crucial terms related to location data, this bill fails to protect consumers. Major enhancements in the bill must be made.”