The “COVID–19 Consumer Data Protection Act of 2020” has been filed and purports to regulate the information collection which will likely increase as businesses and workplaces reopen. Provisions include:

  • Prior consent for the collection of personal information for the purpose of COVID-19 tracking
  • The ability to revoke this consent at any time
  • Enforcement by the FTC, including over nonprofits
  • Enforcement by attorneys general
Of interest is the definition of de-identified information as information which:
  • Does not identify and is not reasonably linkable to an individual;
  • Does not contain any information that could be used to re-identify the individual;
  • Is subject to a public commitment
    • To refrain from attempting to use such information to identify any individual; and
    • To adopt technical and organizational measures to ensure that such information is not linked to any individual and is not disclosed unless the disclosure is subject to a contractually or other legally binding requirement that:
      • The recipient not use the information to identify any individual;
      • All onward disclosures of the information are subject to this limitation.

Read the press release announcing the measure.