COVID-19 Consumer Data Protection Act of 2020
This bill generally prohibits covered entities from collecting, processing, or transferring an individual's personally identifiable information for the purpose of contact tracing with respect to COVID-19 (i.e., coronavirus disease 2019) without first obtaining the individual's affirmative consent to use such information. Applicable personally identifiable information includes, but is not limited to, precise geolocation data, long-lasting digital identifiers of individuals, and personal health information. However, such information does not include data that is de-identified, related to employee health screening for on-site entry, or publicly available.
Covered entities, which include businesses, common carriers, and certain nonprofit organizations, also must provide a mechanism for individuals to revoke prior affirmative consent.