Coronavirus Privacy Act Proposal
Four Republican lawmakers have announced plans for a privacy bill aimed at limiting the extent of contact tracing projects. Senators John Thune (R-SD), Jerry Moran (R-KS), Roger Wicker (R-MS), and Marsha Blackburn (R-TN) declared in a press release their intent to introduce the COVID-19 Consumer Data Protection Act. According to the statement, the law would “provide all Americans with more transparency, choice, and control over the collection and use of their personal health, geolocation, and proximity data. The bill would also hold businesses accountable to consumers if they use personal data to fight the COVID-19 pandemic.” The legislation would require companies to obtain the express consent of individuals to collect their information and allow people to opt-out. It would also establish transparency safeguards, including public reports on how the data is collected, processed, and used. The proposal aims to protect users from being personally identified, calling for companies to minimize how much personally identifiable data is collected, and to safeguard whatever such data they access. “While the severity of the COVID-19 health crisis cannot be overstated, individual privacy, even during times of crisis, remains critically important,” said Thune. “This bill strikes the right balance between innovation – allowing technology companies to continue their work toward developing platforms that could trace the virus and help flatten the curve and stop the spread – and maintaining privacy protections for U.S. citizens.” However, not everyone is impressed by the senators’ efforts. Public Knowledge, a telecoms consumer watchdog, panned the proposition, claiming it doesn’t go far enough to sufficiently protect Americans’ privacy, and may even hamper other enforcement efforts. Sara Collins, policy counsel for the group, pointed out that the law would still allow tech companies to sell and profit from information gathered, as well as infer the identities of those infected by the virus. She also suggested the proposal was too narrowly focusing on private tech companies, ignoring law enforcement and federal agencies.Curbing Big Tech’s Enthusiasm
Whether or not this particular proposal moves forward, congressional lawmakers are hungry for something that deals with the digital data grab going on – though few are critical of the concept of contact tracing itself. Will these representatives and senators jump to action? “If information about who has COVID-19 gets into the wrong hands, it could lead to things that are harmful,” said Rep. Anna Eshoo (D-CA). “Without a national privacy law, this is a black hole.” “What I am afraid of is some folks in the tech community will use this huge public need as a way to be invasive with private data and create a beachfront in the health sector,” commented Sen. Mark R. Warner (D-VA). “It is not like the big platforms are coming at this with clean hands.” “Americans are right to be skeptical of this project,” said Sen. Josh Hawley (R-MO). “Too often, Americans have been burned by companies who calculated that the profits they could gain by reversing privacy pledges would outweigh any later financial penalty.”
Earlier in April, Senator Ed Markey (D-MA) lumped responsibility for the digital data grab onto the White House. While urging the Trump administration to move ahead with contact tracing as an “essential component of a sound response to the public health crisis,” he cautioned that the federal government must ensure the measures “do not infringe upon individuals’ civil liberties, including the right to privacy.”
- Transparency: Processes and data collected should be open for public scrutiny.
- Voluntary participation: Technology-assisted efforts should be “opt-in” only, and users should not be coerced into participating.
- Data Minimization and Retention Limitations: Only the minimum amount of data necessary should be collected, and it should be destroyed once no longer needed. Collection should stop once the program’s objectives have been achieved. Personal details should be kept private.
- Data Use Limitations: Information collected should be used exclusively for public health purposes.
- Data Security: Reliable security measures should be in place; information should not be kept in one centralized location.
- Equity: Programs should apply equally to all groups.
- Accountability and Recourse: Laws must be followed, or penalties must be applied.








