State COVID-19 tracing privacy measures are materializing in the absence of a federal law, including a new California bill that would apply requirements to employers’ use of digital COVID-19 tracking and tracing technologies, such as obtaining affirmative consent from employees and providing an opt-out mechanism.
The Technology-Assisted Contact Tracing Public Accountability and Consent Terms Act (AB-1782) would require that employers using digital COVID-19 tracking and tracing technology:
- Obtain affirmative consent from individuals for the collection, use, maintenance, or disclosure of data that pertains to the individual;
- Allow users to revoke consent for the collection, use, maintenance, or disclosure of data and permit revocation of consent at any time; and
- Provide users with an effective mechanism by which to correct or delete personal information, among several other requirements.
New York State and Minnesota are also entertaining broad COVID-19 legislation that would cover data collected in the employment context. In New York's case, a private right of action is included.
The three COVID-19 tracking privacy bills introduced in the U.S. Senate have hit familiar roadblocks: preemption and a private right of action. While overcoming these obstacles isn’t impossible, the timetable in which to act is closing quickly. Meanwhile, the conversation with many in Congress on data privacy has shifted to restricting the use of facial recognition technology by government entities such as police.
Why it matters: The state bills come amid a flurry of activity on the privacy front, and have been somewhat lost in the mix. However, if passed, they would present serious challenges to employers seeking to protect their workforces while cautiously opening facilities during the COVID-19 pandemic, and would underline the importance of a preemptive approach in any federal privacy bill.