Privacy In Pandemic: Senators Announce Covid-19 Data Privacy Bill
May 11, 2020 —
Kyle Janecek & Jeffrey Dennis – Newmeyer Dillion"Data! Data! Data!. . . I can't make bricks without clay." This classic statement from Sherlock Holmes in The Adventure of the Copper Beeches takes on a new meaning in the COVID-19 pandemic. With the plans to begin contact tracing the spread of the COVID-19 pandemic slowly moving towards the forefront, a valid and important issue presents itself: how do we treat and protect the data we so desperately need to trace, track, and address the pandemic? U.S. Senators Wicker, Thune, Moran, and Blackburn introduced a possible solution to this problem with the COVID-19 Consumer Data Protection Act, as announced on April 30, 2020. So what does the Act entail? What information is protected? What action would businesses need to take towards individuals, such as consumers or even employees, in order to comply with this new legislation?
WHAT IS THE COVID-19 CONSUMER DATA PROTECTION ACT?
The Act is meant to address the concern regarding data collection and privacy due to large companies, like Google and Apple, adjusting the software within their devices to facilitate digital contact tracing. The Act can be broken up into three parts - the treatment of information; the privacy notice requirements; and the transparency requirements.
First, the Act prohibits the collection, processing, or transfer of certain categories of data without notice and the affirmative express consent of the individual, in order to:
- Track the spread of COVID-19,
- Trace the spread of COVID-19 through contact tracing, or
- Determine compliance with social distancing guidelines without the requisite notice to individuals and their express consent.
To accomplish this, the Act also restricts entities in their ability to collect excessive information, stating that an entity cannot collect information beyond what is reasonably necessary to conduct any of the three COVID-19 related purposes listed in the statute. The entity must also provide reasonable administrative, technical, and physical data security policies and practices to protect the information collected. Furthermore, in the event that the entity stops using the information for any of the three COVID-19 purposes, it must delete or de-identify the information it has collected.
Next, the Act describes the requirements for notice to individuals. In order to legally collect, process or transfer the information, the entity needs to provide the consumer with prior notice of the purpose, processing, and transfer of the data through their privacy policy within 14 days of the enactment of the law. This policy would have to:
- Disclose the consumer's rights in a clear and conspicuous manner prior to or at the point of collection,
- Be available in a clear and conspicuous manner to the public,
- Include whether the entity will transfer any of the information it collects in order to track or trace COVID-19 or determine compliance with social distancing,
- Describe its data retention policy, and
- Generally describe its data security measures.
Notably, many of these are already requirements common to many privacy policies, including the disclosure regarding the transfer of an individual's information.
In addition, an individual must give their affirmative express consent to such collection, processing and transfer. In other words, an individual must "opt-in" to having their information collected. This would be done through a checked box or electronic signature, as the law prohibits entities from inferring consent through a failure by the individual to take an action stopping the collection. Furthermore, the individual would also need the ability to expressly withdraw their consent, with the entity then having to cease collection, processing, or transfer of the information within 14 days of the revocation. In essence, due to the restriction on transferal, this may result in businesses opting to delete or de-identify data upon a revocation.
Finally, the entity would have to abide by certain reporting and transparency requirements, namely a monthly public report stating how many individuals had information collected, processed or transferred, and describing the categories of the data collected, processed or transferred by the entity and why. This is akin to the California Consumer Privacy Act's treatment of categories of information, though it would require this information to be released on an ongoing, monthly basis.
WHAT DATA IS COVERED?
Notably, the Act only affects a very limited scope of data. The Act covers geolocation data (exact real-time locations), proximity data (approximated location data), and Personal Health Information (any genetic/diagnosis information that can identify someone). This could cover information like Bluetooth communication or real-time tracking based on a cell phone's geolocation features. Notably, Personal Health Information does not include any information that may be covered under HIPAA or the broader categorization of "Biometric" data (i.e. retinal scans, finger prints, etc). Furthermore, and more generally, "publicly available information" is excluded, which includes information from telephone books or online directories, the news media, "video, internet, or audio content" as well as "websites available to the general public on an unrestricted basis." The latter of which potentially would push any and all information made available through social media (i.e. Facebook or Twitter) into the definition of "publicly available information."
HOW IS IT ENFORCED?
Generally, the law would be enforced by the FTC, under the provisions regarding unfair or deceptive acts or practices, similar to other enforcement actions arising out of privacy policies. Notwithstanding, state attorney generals may also bring actions to enforce compliance and obtain damages, civil penalties, restitution, or other compensation on behalf of the residents of the state.
WHAT SHOULD MY COMPANY DO?
If your entity plans on collecting information for tracking COVID-19, measuring social distancing compliance, or contact tracing, it is advisable to include language in your privacy policy now. This could be as simple as adding an additional provision within your privacy policy stating that the entity will retain information to conduct one of the three COVID-19 purposes as laid out in the statute. In addition, this also means that should the entity collect and use employee information for contact tracing, tracking the spread of COVID-19 or ensuring compliance with social distancing measures, it will need to disclose some of the specifics of that process to the employees and have them opt-in for the process. Finally, for contact tracing purposes, any individual that shares their diagnosis will have to opt-in for the entity to legally collect, process, and transfer that information to others.
While the time to reach compliance is unknown, it is more important than ever to form a compliance plan for privacy legislation if you do not already have a plan in place. If you decide to prepare with us, our firm has created a 90 day California Consumer Privacy Act compliance program (which can be expedited) where our team will collaborate with you to determine a scalable, practical, and reasonable way for you to meet your needs, and we will provide a free initial consultation. For further inquiries or questions related to COVID-19, you can consult with a Task Force attorney by emailing NDCovid19Response@ndlf.com or contacting our office directly at 949-854-7000.
Kyle Janecek is an associate in the firm's Privacy & Data Security practice, and supports the team in advising clients on cyber related matters, including policies and procedures that can protect their day-to-day operations. For more information on how Kyle can help, contact him at kyle.janecek@ndlf.com.
Jeff Dennis (CIPP/US) is the Head of the firm's Privacy & Data Security practice. Jeff works with the firm's clients on cyber-related issues, including contractual and insurance opportunities to lessen their risk. For more information on how Jeff can help, contact him at jeff.dennis@ndlf.com.
Read the court decisionRead the full story...Reprinted courtesy of
Insurer's Motion for Judgment on the Pleadings for Construction Defect Claim Rejected
January 22, 2024 —
Tred R. Eyerly - Insurance Law HawaiiThe magistrate judge recommended that the insurer's motion for judgment on the pleadings be denied in a case involving coverage for the insured subcontractor's alleged faulty workmanship. Evanston Ins. Co. v. Sonny Glasbrenner, Inc., 2023 U.S. Dist. LEXIS 190019 (M.D. Fla. Oct. 20, 2023).
Cone & Graham (C&G), the general contractor, subcontracted with Sonny Glasbrenner, Inc. (SGI) to work on the project. The project involved the rehabilitation of a bridge due to deterioration of the existing concrete bridge deck by adding additional cross bracing to further stiffen the steel girders and using special lightweight concrete. C&G contracted SGH to demolish the existing concrete bridge deck. SGI completed the work.
Thereafter, C&G made a demand to SGI for alleged damaged caused by SGI's work. C&G alleged that SGI was negligent in performing the demolition work, causing substantial damage to the existing bridge girders. C&G sued SGI.
Read the court decisionRead the full story...Reprinted courtesy of
Tred R. Eyerly, Damon Key Leong Kupchak HastertMr. Eyerly may be contacted at
te@hawaiilawyer.com
Insurer’s Confession Of Judgment Through Post-Lawsuit Payment
June 25, 2019 —
David Adelstein - Florida Construction Legal UpdatesThe recent opinion in the property insurance coverage dispute, Bryant v. Geovera Specialty Ins. Co., 44 Fla.L.Weekly D1232a (Fla. 4thDCA 2019), discusses the doctrine known as an insurer’s “confession of judgment.” In this case, an insured suffered water damage from a pipe leak. The insurer paid the insured $6,000 because of sublimits in the property insurance policy. There was a $5,000 sublimit for mold and a $1,000 sublimit for water leakage that occurs over a period of 14 days or more. The insured sued the insurer for covered water damage arguing that the sublimits did not apply.
After the lawsuit was filed, an agreed order was entered that stayed the case pending an appraisal. The appraisal award did not apply the $1,000 sublimit to the water damage from the pipe leak and segregated out damage for mold. (The insurer already paid the mold sublimit). The insurer ended up paying the appraisal award for the water damage caused by the pipe leak after deducting its pre-lawsuit sublimit payment. The insurer paid the award and did NOT challenge the application of the $1,000 sublimit in court, although it could have since coverage issues are decided by courts.
Read the court decisionRead the full story...Reprinted courtesy of
David Adelstein, Kirwin Norris, P.A.Mr. Adelstein may be contacted at
dma@kirwinnorris.com
Texas Windstorm Insurance Agency Under Scrutiny
April 05, 2011 —
Beverley BevenFlorez CDJ STAFFRepresentative Larry Taylor has introduced a bill in the Texas Legislature (HB 2818) that would further regulate the Texas Windstorm Insurance Agency (TWIA). According to Taylor, “In order to be adequately prepared for future hurricane seasons, it is imperative that TWIA be operating at maximum efficiency, that the Reserve Trust Fund be solvent and that the agency have adequate management measures in place to protect consumers and ensure that claims are paid in a timely manner. House Bill 2818 is an important step in the right direction toward restoring public confidence in TWIA.”
HB 2818 includes measures that would create an expert panel that would advise the commissioner on how to evaluate loss from the storm, and a greater transparency of TWIA Board meetings and actions.
In addition, the Texas Department of Insurance (TDI) has placed TWIA on Administrative Oversight. According to TDI, “While under Administrative Oversight, the Department may require its prior review and approval of executive decisions, certain expenditures, and other transactions. The insurer is required to fully cooperate with the Department and provide complete and timely disclosure of all information responsive to Department requests.”
Read the full story (Rep. Taylor’s Press Release)...
Read the full story (Texas Department of Insurance’s Press Release)...
Read the court decisionRead the full story...Reprinted courtesy of
Governor Signs Permit Extension Bill Extending Permit Deadlines to One Year
October 23, 2018 —
Garret Murai - California Construction Law BlogIt’s like that feeling you got when your teacher said you have another week to complete your group project.
On September 21, 2018, Governor Brown signed AB 2913, which, for the first time, provides a uniform 12-month period across the state for work to commence before a building permit expires. Previously, the period was six months.
In addition to doubling the expiration period, the statute includes a “justifiable cause” provision permitting local building departments to extend the time for one or more additional periods of not more than 180 days per extension upon written demonstration of “justifiable cause for the extension.”
Read the court decisionRead the full story...Reprinted courtesy of
Garret Murai, Wendel, Rosen, Black & Dean LLPMr. Murai may be contacted at
gmurai@wendel.com
Coverage Denied for Condominium Managing Agent
May 24, 2018 —
Tred R. Eyerly - Insurance Law HawaiiDetermining there were no allegations of bodily injury or property damage in the underlying lawsuit, the court found there was no duty to defend or indemnify the condominium's managing agent. State Farm Fire & Cas. Co. v. Certified Mgmt., 2018 U.S.Dist. LEXIS 71124 (D. Haw. April 27, 2018).
Frederick Caven sued Certified Management, dba Associa Hawaii ("Associa") on behalf of himself and a class. Caven alleged that he owned a condominium and was a member of the Regency homeowners' association. The suit alleged that Associa was the managing agent for the association. Caven sold his unit in April 2016. Caven asked Associa for condominium documents to provide to the purchaser. Associa charged Caven $182.29 to download 197 pages of condominium documents for Regency. Associa also charged Caven $286.46 for a one-page "fee status confirmation," a document prepared by Associa which contained financial and other information needed to complete the sale. Caven alleged that the fees charged by Associa and other unit owners were excessive and in violation of Hawaii law.
Read the court decisionRead the full story...Reprinted courtesy of
Tred R. Eyerly, Insurance Law HawaiiMr. Eyerly may be contacted at
te@hawaiilawyer.com
OSHA Issues COVID-19 Guidance for Construction Industry
July 13, 2020 —
Garret Murai - California Construction Law BlogThis past month, after remaining relatively quiet following the coronavirus outbreak, OSHA began issuing industry-specific guidance on how to deal with the coronavirus in the workplace.
Until this month, the only construction industry specific guidance issued by OSHA was an OSHA Alert entitled COVID-19 Guidance for the Construction Workforce, a one page document providing little more guidance than that workers should stay home if sick, wear masks and frequently wash hands to prevent spreading and catching the coronavirus, and to sanitize tools and work areas.
Early this month, OSHA issued more comprehensive guidance for the construction industry. The guidance, as noted in the preface by OSHA is simply guidance, “is not a standard or regulation” and “creates no legal obligations. The guidance supplements general guidance applicable to all workplaces issued earlier by OSHA.
Read the court decisionRead the full story...Reprinted courtesy of
Garret Murai, Nomos LLPMr. Murai may be contacted at
gmurai@nomosllp.com
Architect Sues School District
November 20, 2013 —
CDJ STAFFSFL+A Architects is suing the Marlboro County, South Carolina School District over $690,000 that the architect claims is owed to it by the school district. The firm did design work for the Blenheim Elementary Middle School, which opened in January.
The architectural firm contends that the school district refused to pay for anything outside of basic services and failed to pay the full amount on those either.
Read the court decisionRead the full story...Reprinted courtesy of
