Republican Contact-Tracing Bill Must Do More to Protect the Privacy Rights of Essential Workers and Others

On Thursday afternoon, Senate Republicans introduced privacy legislation meant to guide the ways in which companies collect and use location, Bluetooth, and other data to track contacts between people infected by coronavirus and those they've interacted with.

The COVID-19 Consumer Data Protection Act, led by Commerce Committee Chairman Roger Wicker (R-Mississippi) and Sen. Deb Fischer (R-Nebraska), is unlikely to get support from Senate Democrats, who are concerned that it doesn't adequately protect individual privacy rights.

Among other restrictions, the legislation requires that tech companies seek the express consent of some users before processing personal health information, as well as geolocation and other proximity data. It also requires that people be given the right to opt out of such data collection and processing.

The bill exempts data-collection entities from privacy-protection requirements under the Communications Act and also preempts similar state-level privacy-protection laws.

Free Press Action Senior Policy Counsel Gaurav Laroia made the following statement:

"While we're glad the bill's authors recognize that, in principle, digital contact-tracing applications carry privacy risks for their users and must be regulated, this legislation is profoundly flawed.

"Notably, the bill exempts employers from its meager protections and is another example of a collective failure to safeguard the rights of essential workers. This raises serious practical and equity concerns. Essential workers have heroically kept supply chains running and the country fed and functional. Many of these largely Black and Latinx people are laboring under dangerous conditions. They continue to get sick and die from COVID-19 at disproportionate rates.

"Digital contact-tracing tools may well make workplaces safer, but the technology must be regulated. Essential workers must be confident that these tools are safe and will actually work to protect their health. Data about their contacts, their movements and their health must not be exploited; it must not be used for non-public health purposes or shared with law enforcement agencies. It would be grossly unfair for people who work in unsafe conditions to then be tracked by unregulated technologies at home.

"The bill also exempts visitors to businesses from these protections. If grocery stores deploy this technology to digitally screen customers, then the bill covers practically no one. These exemptions absolutely swallow the rules.

"The bill's authors should start over. Any entity that is planning to deploy this technology -- whether they're state and local governments or businesses -- must do so only for valid public-health reasons, and in a way that protects individual privacy and civil rights."