Familiar issues stall US covid-19 privacy legislation

Democrats and Republicans have duelling covid-19 data bills in Congress, with the proposals differing on private rights of action and preemption – issues that have served as roadblocks to past efforts to implement comprehensive privacy legislation.

In early May, Republican senators introduced a bill that would require companies to obtain user consent before using health and location data related to the novel coronavirus. At the time, some observers were hopeful that the bill could become law by being included in a larger coronavirus relief package.

But about a week later, Democratic members of Congress released their own proposal, which was substantially different to the Republican bill. The Democratic bill would be enforced by public regulators and also by private litigation, and would not preempt state laws and regulations. The Republican bill takes the opposite position on these issues.

Two Republican members of Congress blasted the Democrats for releasing what they called “partisan proposals that have no chance at becoming law”. Republicans Greg Walden and Cathy McMorris Rogers took particular issue with the Democrats including a provision for a private right of action, which they said only serves to enrich attorneys.

“Let’s break this litigation addiction, and come together to put forth a national data privacy standard that will spur innovation, protect consumers, and bolster American leadership in today’s interconnected world,” they said. “This partisan bill jeopardises months of bipartisan negotiations by doubling down on misguided policies that kill the small businesses and life-saving innovators who are seeking to serve our constituents.”

Private rights of action and preemption have blocked efforts to pass national privacy legislation in the US.

At a US Senate Committee on Commerce, Science, & Transportation hearing in December, much of the time was spent debating these issues. No conclusion was reached, and a comprehensive bill has yet to be brought to the floor of Congress.

Jules Polonetsky, the chief executive of the Washington, DC-based think tank Future of Privacy Forum, said it is a shame that policymakers couldn’t reach a deal on these issues while they had a chance.

“Europeans have moved to advance the use of covid data far more quickly than the US, even though they have restrictive law – because they were able to look at the law and say, ‘Well, this usually wouldn’t be allowed, but we have exceptions for public emergencies … so we can and should use this,’” Polonetsky said last week during a webinar about contact tracing. 

“Talk to employers in the US: they think they can do thermal scanning, but they’re not sure," he said. “They think they could be sued if someone gets sick because they come back to the office, but it’s not clear if they can give tests. It’s chaos because we don’t have federal guidelines that say what is best practice.”

“It’s a shame we didn’t do this last year, last month. The sooner we do it, the more stability we’ll have – both for research and privacy, but also for industry,” he said.