Privacy In Pandemic: Senators Announce Covid-19 Data Privacy Bill
May 11, 2020 —
Kyle Janecek & Jeffrey Dennis – Newmeyer Dillion"Data! Data! Data!. . . I can't make bricks without clay." This classic statement from Sherlock Holmes in The Adventure of the Copper Beeches takes on a new meaning in the COVID-19 pandemic. With the plans to begin contact tracing the spread of the COVID-19 pandemic slowly moving towards the forefront, a valid and important issue presents itself: how do we treat and protect the data we so desperately need to trace, track, and address the pandemic? U.S. Senators Wicker, Thune, Moran, and Blackburn introduced a possible solution to this problem with the COVID-19 Consumer Data Protection Act, as announced on April 30, 2020. So what does the Act entail? What information is protected? What action would businesses need to take towards individuals, such as consumers or even employees, in order to comply with this new legislation?
WHAT IS THE COVID-19 CONSUMER DATA PROTECTION ACT?
The Act is meant to address the concern regarding data collection and privacy due to large companies, like Google and Apple, adjusting the software within their devices to facilitate digital contact tracing. The Act can be broken up into three parts - the treatment of information; the privacy notice requirements; and the transparency requirements.
First, the Act prohibits the collection, processing, or transfer of certain categories of data without notice and the affirmative express consent of the individual, in order to:
- Track the spread of COVID-19,
- Trace the spread of COVID-19 through contact tracing, or
- Determine compliance with social distancing guidelines without the requisite notice to individuals and their express consent.
To accomplish this, the Act also restricts entities in their ability to collect excessive information, stating that an entity cannot collect information beyond what is reasonably necessary to conduct any of the three COVID-19 related purposes listed in the statute. The entity must also provide reasonable administrative, technical, and physical data security policies and practices to protect the information collected. Furthermore, in the event that the entity stops using the information for any of the three COVID-19 purposes, it must delete or de-identify the information it has collected.
Next, the Act describes the requirements for notice to individuals. In order to legally collect, process or transfer the information, the entity needs to provide the consumer with prior notice of the purpose, processing, and transfer of the data through their privacy policy within 14 days of the enactment of the law. This policy would have to:
- Disclose the consumer's rights in a clear and conspicuous manner prior to or at the point of collection,
- Be available in a clear and conspicuous manner to the public,
- Include whether the entity will transfer any of the information it collects in order to track or trace COVID-19 or determine compliance with social distancing,
- Describe its data retention policy, and
- Generally describe its data security measures.
Notably, many of these are already requirements common to many privacy policies, including the disclosure regarding the transfer of an individual's information.
In addition, an individual must give their affirmative express consent to such collection, processing and transfer. In other words, an individual must "opt-in" to having their information collected. This would be done through a checked box or electronic signature, as the law prohibits entities from inferring consent through a failure by the individual to take an action stopping the collection. Furthermore, the individual would also need the ability to expressly withdraw their consent, with the entity then having to cease collection, processing, or transfer of the information within 14 days of the revocation. In essence, due to the restriction on transferal, this may result in businesses opting to delete or de-identify data upon a revocation.
Finally, the entity would have to abide by certain reporting and transparency requirements, namely a monthly public report stating how many individuals had information collected, processed or transferred, and describing the categories of the data collected, processed or transferred by the entity and why. This is akin to the California Consumer Privacy Act's treatment of categories of information, though it would require this information to be released on an ongoing, monthly basis.
WHAT DATA IS COVERED?
Notably, the Act only affects a very limited scope of data. The Act covers geolocation data (exact real-time locations), proximity data (approximated location data), and Personal Health Information (any genetic/diagnosis information that can identify someone). This could cover information like Bluetooth communication or real-time tracking based on a cell phone's geolocation features. Notably, Personal Health Information does not include any information that may be covered under HIPAA or the broader categorization of "Biometric" data (i.e. retinal scans, finger prints, etc). Furthermore, and more generally, "publicly available information" is excluded, which includes information from telephone books or online directories, the news media, "video, internet, or audio content" as well as "websites available to the general public on an unrestricted basis." The latter of which potentially would push any and all information made available through social media (i.e. Facebook or Twitter) into the definition of "publicly available information."
HOW IS IT ENFORCED?
Generally, the law would be enforced by the FTC, under the provisions regarding unfair or deceptive acts or practices, similar to other enforcement actions arising out of privacy policies. Notwithstanding, state attorney generals may also bring actions to enforce compliance and obtain damages, civil penalties, restitution, or other compensation on behalf of the residents of the state.
WHAT SHOULD MY COMPANY DO?
If your entity plans on collecting information for tracking COVID-19, measuring social distancing compliance, or contact tracing, it is advisable to include language in your privacy policy now. This could be as simple as adding an additional provision within your privacy policy stating that the entity will retain information to conduct one of the three COVID-19 purposes as laid out in the statute. In addition, this also means that should the entity collect and use employee information for contact tracing, tracking the spread of COVID-19 or ensuring compliance with social distancing measures, it will need to disclose some of the specifics of that process to the employees and have them opt-in for the process. Finally, for contact tracing purposes, any individual that shares their diagnosis will have to opt-in for the entity to legally collect, process, and transfer that information to others.
While the time to reach compliance is unknown, it is more important than ever to form a compliance plan for privacy legislation if you do not already have a plan in place. If you decide to prepare with us, our firm has created a 90 day California Consumer Privacy Act compliance program (which can be expedited) where our team will collaborate with you to determine a scalable, practical, and reasonable way for you to meet your needs, and we will provide a free initial consultation. For further inquiries or questions related to COVID-19, you can consult with a Task Force attorney by emailing NDCovid19Response@ndlf.com or contacting our office directly at 949-854-7000.
Kyle Janecek is an associate in the firm's Privacy & Data Security practice, and supports the team in advising clients on cyber related matters, including policies and procedures that can protect their day-to-day operations. For more information on how Kyle can help, contact him at kyle.janecek@ndlf.com.
Jeff Dennis (CIPP/US) is the Head of the firm's Privacy & Data Security practice. Jeff works with the firm's clients on cyber-related issues, including contractual and insurance opportunities to lessen their risk. For more information on how Jeff can help, contact him at jeff.dennis@ndlf.com.
Read the court decisionRead the full story...Reprinted courtesy of
Reasonableness of Denial of Requests for Admission Based Upon Expert’s Opinions Depends On Factors Within Party’s Understanding
February 27, 2019 —
Stephen M. Tye & Lawrence S. Zucker II - Haight Brown & Bonesteel LLPIn Orange County Water District v. The Arnold Engineering Company (D070763), the Fourth Appellate District examined the criteria for evaluating the reasonableness of a parties’ denial of requests for admission (RFA’s) based upon their expert’s opinions and the proof required to recover costs for unreasonable denials.
In Orange County Water District, the Orange County Water District (the District) sued several current and former owners and operators of industrial sites, including The Arnold Engineering Company (Arnold), to recover expenses associated with groundwater cleanup efforts intended to address groundwater contamination caused by volatile organic compounds (VOC’s) and other chemicals. Over six years, the parties conducted extensive discovery, including document productions, depositions, and soil sampling and monitoring.
Reprinted courtesy of
Stephen M. Tye, Haight Brown & Bonesteel LLP and
Lawrence S. Zucker II, Haight Brown & Bonesteel LLP
Mr. Tye may be contacted at stye@hbblaw.com
Mr. Zucker may be contacted at lzucker@hbblaw.com
Read the court decisionRead the full story...Reprinted courtesy of
Florida Continues Enacting Tort Reforms, This Time Shortening the Statute of Repose
May 01, 2023 —
William L. Doerler - The Subrogation StrategistOn April 13, 2023, Florida’s governor, Ron DeSantis, signed into law
SB 360 which, among other things, shortens the statute of repose period for improvements to real property. The law also revises the date on which the statute of limitations period runs for these types of damage claims. Florida’s revision of this law provides further evidence of the state’s tort reform efforts.
The new law went into effect upon signing and includes the following changes:
- Shortens the statute of repose period set forth in Fla. Stat. § 95.11(3)(c) for actions founded on the design, planning or construction of improvements to real estate from ten (10) to seven (7) years. The statute of repose period runs from the earliest (rather than the latest) of the date: a) the authority having jurisdiction issues a temporary certificate of occupancy; b) a certificate of occupancy; c) a certificate of completion; or d) of abandonment of construction if not completed. Of note, the revised repose period eliminates that date of actual possession by the owner as one of the accrual dates.
Read the court decisionRead the full story...Reprinted courtesy of
William L. Doerler, White and Williams LLPMr. Doerler may be contacted at
doerlerw@whiteandwilliams.com
Temecula Office Secures Approval for Development of 972-Acre Community on Behalf of Pulte Homes
December 27, 2021 —
Lewis BrisboisTemecula, Calif. (December 7, 2021) – Temecula Partners Kelly Black and Samuel Alhadeff, along with Associate Mark Mercer, recently represented Pulte Homes in securing unanimous approval from the Murrieta City Council and the Murrieta Planning Commission for a large-scale 972-acre development known as the Murrieta Hills development.
As described by local media including
The Press-Enterprise,
Menifee 24/7, and the
Murrieta Patch, the Murrieta Hills development will be located just south of Menifee and east of Wildomar. It will include 750 homes – 522 single-family units and 228 multi-family dwellings. The project will also include an 18-acre commercial center with plans for shopping, dining, lodging, and office space.
In addition, 619 of the 972 acres will be dedicated as natural open space and will be overseen by the Western Riverside County Regional Conservation Authority. The project will be built in three phases, with the first phase scheduled to be completed by 2023 and the final phase to be completed in 2031.
Read the court decisionRead the full story...Reprinted courtesy of
Lewis Brisbois
Commercial Construction in the Golden State is Looking Pretty Golden
August 26, 2015 —
Garret Murai – California Construction Law BlogIf the $2.1 trillion erased from the U.S. stock market over the last week has you white knuckled, you might consider commercial construction in the Golden State, where things are looking . . . well . . . pretty golden.
According to the Summer/Fall 2015 Commercial Real Estate Survey jointly published by Allen Matkins and the UCLA Anderson School of Management, commercial construction in California has risen to its highest level since 2001.
The survey, conducted of commercial real estate developers and financiers and their outlook for seven metropolitan regions in California including the East Bay, the Inland Empire, Los Angeles, Orange County, San Diego, San Francisco and Silicon Valley, found that all respondents expressed optimism (characterized as an optimism sentiment above 50) that office, multifamily, industrial and retail construction would grow over the next three-years although it varied depending on the region and sentiment was at times lower than when the survey was last taken last year.
Read the court decisionRead the full story...Reprinted courtesy of
Garret Murai, Wendel Rosen Black & Dean LLPMr. Murai may be contacted at
gmurai@wendel.com
The International Codes Development Process is Changing to Continue Building Code Modernization
March 06, 2023 —
The International Code CouncilWashington D.C., March 02, 2023 (GLOBE NEWSWIRE) -- The International Code Council is revising its rigorous code development process. The changes will take effect in 2024-2026 for the development of the 2027 International Codes (I-Codes) and will move the development process to an integrated and continuous three-year cycle.
In the new timeline, year one will include two Committee Action Hearings for Group A Codes; year two will include two Committee Action Hearings for Group B Codes; and year three will be the joint Public Comment Hearings and Online Governmental Consensus Vote for both Group A and B Codes.
The addition of the second Committee Actions Hearings in year one and two will foster a more in-depth vetting of code change proposals, allowing an opportunity for the committee members to review and evaluate the original proposals and consider the submitted responses. This also provides more opportunity for proponents to build consensus for their code change proposal and ensure the best version of their intended improvement to the existing codes.
Additionally, with combined Public Comment Hearings in the third year, voting members are able to vote on all suggested changes to the next edition of the I-Codes at one time. The updated process also provides more opportunity for proposed new referenced standards to be developed and finalized on a consistent timeline regardless of the group (Group A or B) with which they are associated.
About the International Code Council
The International Code Council is the leading global source of model codes and standards and building safety solutions. Code Council codes, standards and solutions are used to ensure safe, affordable and sustainable communities and buildings worldwide.
Read the court decisionRead the full story...Reprinted courtesy of
Construction Contract Basics: Venue and Choice of Law
February 19, 2024 —
Christopher G. Hill - Construction Law MusingsPreviously in this on-again-off-again series of posts on construction contract basics, I discussed attorney fees provisions and indemnification. In this installment, the topic at hand is venue and choice of law.
As construction professionals (outside of us construction attorneys), you are likely to be focused on things like the scope of work in a construction contract, the price terms, payment, delays, change orders, and the like. However, the venue (where any lawsuit or arbitration will have to happen) and the choice of law (what state’s law applies) can be equally important. You need to know where you will have to enforce your rights under the contract and also what law will apply. Will you need to go to another state to enforce your rights? Even if not, will your local attorney have to learn the law of another jurisdiction? These are important questions when reading and negotiating your prime contract (if with the owner) or subcontract (if with the general contractor).
Read the court decisionRead the full story...Reprinted courtesy of
The Law Office of Christopher G. HillMr. Hill may be contacted at
chrisghill@constructionlawva.com
NLRB Broadens the Joint Employer Standard
September 17, 2015 —
Craig Martin – Construction Contractor AdvisorPerhaps in anticipation of Labor Day, the National Labor Relations Board issued its ruling in Browning-Ferris Indus. of Cal. d/b/a BFI Newby Island Recyclery, establishing an easier standard for unions to prove that a joint employer relationship exists. This will make it easier for unions to make the upstream company, like a parent company, liable for unfair labor practices, even if the upstream company had no direct involvement.
Some Background
BFI runs a recycling plant and contracts with Leadpoint to provide workers to sort garbage in the recycling plant. The staffing agreement specifically stated that Leadpoint was the sole employer of the personnel it supplied and Leadpoint handled supervision of the employees, not BFI.
Leadpoint’s employees sought to unionize and an election was held. The union filed a petition seeking a determination that Leadpoint and BFI were a joint employers.
Read the court decisionRead the full story...Reprinted courtesy of
Craig Martin, Lamson, Dugan and Murray, LLPMr. Martin may be contacted at
cmartin@ldmlaw.com
