Insights
Publications

Federal “COVID-19 Consumer Data Protection Act” Proposed

May 7, 2020 Blog

A group of Republican senators has proposed a new privacy law to govern the collection and use of certain personal information thought to be both important and at risk during the current coronavirus crisis.

While numerous companies and governments have developed and deployed apps and programs to track individuals and trace contacts between individuals in furtherance of the laudable goal of helping to better understand and address the pandemic, there have been concerns that such data could be collected without proper authorization and/or used for purposes outside of the scope for which the data is willingly provided.

On April 30, 2020, four Republican senators (Sens. Blackburn of Tennessee, Moran of Kansas, Thune of South Dakota, and Wicker of Mississippi) announced their intention to introduce a privacy bill to address the issue. The legislation would apply only geolocation and personal health information and would regulate how such information is collected and how it may be used during the COVID-19 Public Health Emergency. As such, the legislation would be temporary in nature. Additionally, it would apply to certain companies to the extent such companies are collecting and/or using such geolocation and personal health information. Specifically, (i) entities subject to the jurisdiction of the FTC Act, (ii) common carriers subject to the Communications Act of 1934, and (iii) nonprofits collecting such data would be subject to the requirements of the legislation.

Entities subject to the proposed law would be required to provide disclosure to and get consent from the data subject prior to the collection of her/his data regarding the data to be collected, the intended sharing of such data, and the categories of recipients with whom the data is to be shared, along with an effective opt-out mechanism enabling individuals to revoke consent. Such companies would also have to file a public report once every 30 days disclosing the aggregate number of individuals whose data has been collected and/or transferred, the categories of such data, the purposes of the collection of such categories of data, and the recipients of data shared. The FTC would be expected to provide guidelines on the appropriate use of data.

Cybersecurity is also addressed by the proposed law, requiring subject entities to “establish, implement, and maintain reasonable administrative, technical, and physical data security policies and practices to protect against risks to the confidentiality, security, and integrity” of the data covered by the law.

Enforcement would be provided for through the FTC Act’s provision of enforcement against unfair and/or deceptive practices. Additionally, the proposed law would provide state attorneys general with the power to bring civil actions for enforcement against entities who adversely affect the interests of the relevant residents of their respective states.

Whether the law will gain sufficient support to move forward remains to be seen, and will turn on the perceived propriety and effectiveness of the law to address the privacy concerns at issue, along with, of course, political considerations. If the previous attempts at federal privacy legislation are a guide, broad support is unlikely, though time will tell if the specific circumstances of the pandemic are a differentiating factor.

More information can be found in the press release announcing the planned introduction of the bill.

Firm Highlights

Publication

Top 5 Privacy Cases To Watch, From Chatbots to Geolocation

Litigation — and threats of litigation — related to privacy law violations have been on the rise recently. While some judges have pushed back on the theories set forth by plaintiffs, new privacy lawsuits...

Read More
Publication

Enforcement of CPRA Regulations Delayed

Shortly before the California Privacy Right Act (CPRA) modifications to the California Consumer Privacy Act (CCPA) were set to become enforceable on July 1, 2023, a Sacramento Superior Court judge issued a ruling on...

Read More
News

Scraping Battles: Meta Loses Legal Effort to Halt Harvesting of Personal Profiles

Alex Reese spoke to Matt Fleischer-Black of  Cybersecurity Law Report about the Meta v. Bright Data decision and its impact on U.S. scraping case law. Read the article here (paywall or trial).

Read More
Publication

Thomson Reuters v. Ross Intelligence: AI Copyright Law and Fair Use on Trial

On Sept. 25, 2023, Judge Stephanos Bibas (sitting by designation in the District of Delaware), determined that fact questions surrounding issues of fair use and tortious interference required a jury to decide media conglomerate...

Read More
Publication

It Wasn’t Me, It Was the AI: Intellectual Property and Data Privacy Concerns With Nonprofits’ Use of Artificial Intelligence Systems

In today's rapidly changing technological landscape, artificial intelligence (AI) is making headlines and being discussed constantly. To be sure, AI provides a powerful tool to nonprofits in creating content and exploiting for countless cost-effective...

Read More
Publication

Major Decision Affects Law of Scraping and Online Data Collection, Meta Platforms v. Bright Data

On January 23, 2024, the court in Meta Platforms Inc. v. Bright Data Ltd. , Case No. 3:23-cv-00077-EMC (N.D. Cal.), issued a summary judgment ruling with potentially wide-ranging ramifications for the law of scraping and...

Read More
Publication

California Appeals Court Empowers Privacy Agency to Immediately Enforce CCPA Regulations

In  California Privacy Protection Agency et al. v. The Superior Court of Sacramento County  (case number C099130), the Third Appellate District of the California Court of Appeal returned authority to the California Privacy Protection...

Read More
Publication

California Proposes New AI & Automated Decision-Making Technology Regulations

The California Privacy Protection Agency (CPPA) released its draft  regulatory framework for automated decision-making technology (ADMT) on November 27. These regulations are a preview of what new requirements may look like for companies currently...

Read More
Publication

Nonprofits’ Use of Artificial Intelligence Systems: Intellectual Property and Data Privacy Concerns

In today's rapidly changing technological landscape, artificial intelligence (AI) is making headlines and being discussed constantly. To be sure, AI provides a powerful tool to nonprofits in creating content and exploiting for countless cost-effective...

Read More
Publication

BIPA Liability: Existing CGL Coverage May Provide a Lifeline for Policyholders

Developments in the law have increased the potential liability that companies could face under the Illinois Biometric Information Privacy Act (BIPA), but fortunately for policyholders, Illinois case law has also solidified coverage for BIPA...

Read More