Cassidy proposes bipartisan Exposure Notification Privacy Act

U.S. Sen. Bill Cassidy (R-LA) on June 1 introduced the bipartisan Exposure Notification Privacy Act to establish privacy requirements for operators of infectious disease exposure notification services.

“This bill defends privacy when someone voluntarily joins with others to stop the spread of COVID-19,” Sen. Cassidy said.

The lawmaker signed on as the original cosponsor of S. 3861 with bill sponsor U.S. Sen. Maria Cantwell (D-WA). The proposal aims to protect consumer privacy and promote public health in the development of the privacy requirements.

In the coming weeks, automated exposure notification services will be released to track the spread of COVID-19 and notify individuals who may be exposed, according to a one-page summary of the bill provided by Sen. Cassidy’s office.

“However, this method will only be effective if adoption reaches a critical mass. Safeguarding data privacy and civil rights in any exposure notification system is needed to help ensure the widespread participation necessary for the program’s efficacy,” according to the summary document. “The Exposure Notification Privacy Act creates those strong privacy safeguards for commercial automated exposure notification services.”

“Public health needs to be in charge of any notification system so we protect people’s privacy and help them know when there is a warning that they might have been exposed to COVID-19,” said Sen. Cantwell.

If enacted, the legislation would require that public health officials be involved with the deployment of any exposure notification systems, according to the bill summary. The measure also would allow only medically authorized diagnoses to be submitted to exposure notification systems and require that participation be voluntary and based on consumer consent.

Additionally, S. 3861 would limit the collection and use of data to what is necessary for the purpose of the system and prohibit any commercial use of data, and permit participants to delete their data from an exposure notification system at any time, according to the summary.

The bill also would prohibit discrimination against an individual based on information provided to an exposure notification system and would create both strong data security safeguards and strict enforcement measures.

The measure has garnered support from numerous health, privacy and tech experts, as well as advocacy groups, including the Council of State and Territorial Epidemiologists, the National Coalition of STD Directors, New America’s Open Technology Institute, the Electronic Privacy Information Center, the Future of Privacy Forum, the Center for American Progress, and the National Urban League, among others.