The “COVID–19 Consumer Data Protection Act of 2020” has been filed and purports to regulate the information collection which will likely increase as businesses and workplaces reopen. Provisions include:
- Prior consent for the collection of personal information for the purpose of COVID-19 tracking
- The ability to revoke this consent at any time
- Enforcement by the FTC, including over nonprofits
- Enforcement by attorneys general
Of interest is the definition of de-identified information as information which:
- Does not identify and is not reasonably linkable to an individual;
- Does not contain any information that could be used to re-identify the individual;
- Is subject to a public commitment
- To refrain from attempting to use such information to identify any individual; and
- To adopt technical and organizational measures to ensure that such information is not linked to any individual and is not disclosed unless the disclosure is subject to a contractually or other legally binding requirement that:
- The recipient not use the information to identify any individual;
- All onward disclosures of the information are subject to this limitation.