Privacy In Pandemic: Senators Announce Covid-19 Data Privacy Bill
May 11, 2020 —
Kyle Janecek & Jeffrey Dennis – Newmeyer Dillion"Data! Data! Data!. . . I can't make bricks without clay." This classic statement from Sherlock Holmes in The Adventure of the Copper Beeches takes on a new meaning in the COVID-19 pandemic. With the plans to begin contact tracing the spread of the COVID-19 pandemic slowly moving towards the forefront, a valid and important issue presents itself: how do we treat and protect the data we so desperately need to trace, track, and address the pandemic? U.S. Senators Wicker, Thune, Moran, and Blackburn introduced a possible solution to this problem with the COVID-19 Consumer Data Protection Act, as announced on April 30, 2020. So what does the Act entail? What information is protected? What action would businesses need to take towards individuals, such as consumers or even employees, in order to comply with this new legislation?
WHAT IS THE COVID-19 CONSUMER DATA PROTECTION ACT?
The Act is meant to address the concern regarding data collection and privacy due to large companies, like Google and Apple, adjusting the software within their devices to facilitate digital contact tracing. The Act can be broken up into three parts - the treatment of information; the privacy notice requirements; and the transparency requirements.
First, the Act prohibits the collection, processing, or transfer of certain categories of data without notice and the affirmative express consent of the individual, in order to:
- Track the spread of COVID-19,
- Trace the spread of COVID-19 through contact tracing, or
- Determine compliance with social distancing guidelines without the requisite notice to individuals and their express consent.
To accomplish this, the Act also restricts entities in their ability to collect excessive information, stating that an entity cannot collect information beyond what is reasonably necessary to conduct any of the three COVID-19 related purposes listed in the statute. The entity must also provide reasonable administrative, technical, and physical data security policies and practices to protect the information collected. Furthermore, in the event that the entity stops using the information for any of the three COVID-19 purposes, it must delete or de-identify the information it has collected.
Next, the Act describes the requirements for notice to individuals. In order to legally collect, process or transfer the information, the entity needs to provide the consumer with prior notice of the purpose, processing, and transfer of the data through their privacy policy within 14 days of the enactment of the law. This policy would have to:
- Disclose the consumer's rights in a clear and conspicuous manner prior to or at the point of collection,
- Be available in a clear and conspicuous manner to the public,
- Include whether the entity will transfer any of the information it collects in order to track or trace COVID-19 or determine compliance with social distancing,
- Describe its data retention policy, and
- Generally describe its data security measures.
Notably, many of these are already requirements common to many privacy policies, including the disclosure regarding the transfer of an individual's information.
In addition, an individual must give their affirmative express consent to such collection, processing and transfer. In other words, an individual must "opt-in" to having their information collected. This would be done through a checked box or electronic signature, as the law prohibits entities from inferring consent through a failure by the individual to take an action stopping the collection. Furthermore, the individual would also need the ability to expressly withdraw their consent, with the entity then having to cease collection, processing, or transfer of the information within 14 days of the revocation. In essence, due to the restriction on transferal, this may result in businesses opting to delete or de-identify data upon a revocation.
Finally, the entity would have to abide by certain reporting and transparency requirements, namely a monthly public report stating how many individuals had information collected, processed or transferred, and describing the categories of the data collected, processed or transferred by the entity and why. This is akin to the California Consumer Privacy Act's treatment of categories of information, though it would require this information to be released on an ongoing, monthly basis.
WHAT DATA IS COVERED?
Notably, the Act only affects a very limited scope of data. The Act covers geolocation data (exact real-time locations), proximity data (approximated location data), and Personal Health Information (any genetic/diagnosis information that can identify someone). This could cover information like Bluetooth communication or real-time tracking based on a cell phone's geolocation features. Notably, Personal Health Information does not include any information that may be covered under HIPAA or the broader categorization of "Biometric" data (i.e. retinal scans, finger prints, etc). Furthermore, and more generally, "publicly available information" is excluded, which includes information from telephone books or online directories, the news media, "video, internet, or audio content" as well as "websites available to the general public on an unrestricted basis." The latter of which potentially would push any and all information made available through social media (i.e. Facebook or Twitter) into the definition of "publicly available information."
HOW IS IT ENFORCED?
Generally, the law would be enforced by the FTC, under the provisions regarding unfair or deceptive acts or practices, similar to other enforcement actions arising out of privacy policies. Notwithstanding, state attorney generals may also bring actions to enforce compliance and obtain damages, civil penalties, restitution, or other compensation on behalf of the residents of the state.
WHAT SHOULD MY COMPANY DO?
If your entity plans on collecting information for tracking COVID-19, measuring social distancing compliance, or contact tracing, it is advisable to include language in your privacy policy now. This could be as simple as adding an additional provision within your privacy policy stating that the entity will retain information to conduct one of the three COVID-19 purposes as laid out in the statute. In addition, this also means that should the entity collect and use employee information for contact tracing, tracking the spread of COVID-19 or ensuring compliance with social distancing measures, it will need to disclose some of the specifics of that process to the employees and have them opt-in for the process. Finally, for contact tracing purposes, any individual that shares their diagnosis will have to opt-in for the entity to legally collect, process, and transfer that information to others.
While the time to reach compliance is unknown, it is more important than ever to form a compliance plan for privacy legislation if you do not already have a plan in place. If you decide to prepare with us, our firm has created a 90 day California Consumer Privacy Act compliance program (which can be expedited) where our team will collaborate with you to determine a scalable, practical, and reasonable way for you to meet your needs, and we will provide a free initial consultation. For further inquiries or questions related to COVID-19, you can consult with a Task Force attorney by emailing NDCovid19Response@ndlf.com or contacting our office directly at 949-854-7000.
Kyle Janecek is an associate in the firm's Privacy & Data Security practice, and supports the team in advising clients on cyber related matters, including policies and procedures that can protect their day-to-day operations. For more information on how Kyle can help, contact him at kyle.janecek@ndlf.com.
Jeff Dennis (CIPP/US) is the Head of the firm's Privacy & Data Security practice. Jeff works with the firm's clients on cyber-related issues, including contractual and insurance opportunities to lessen their risk. For more information on how Jeff can help, contact him at jeff.dennis@ndlf.com.
Read the court decisionRead the full story...Reprinted courtesy of
Differing Site Conditions: What to Expect from the Court When You Encounter the Unexpected
September 05, 2022 —
Margarita Kutsin - Ahlers Cressman & Sleight[
1]Seattle Tunnel Partners (“STP”), a joint venture of Dragados USA and Tutor Perini, entered into a $1.4 billion contract with the Washington State Department of Transportation (“WSDOT”) to replace the Highway 99 viaduct. In December 2013, a tunnel boring machine (“TBM”) bearing the moniker “Bertha,” then the largest TBM ever built, measuring 425 feet long and 57 feet in diameter, struck an underground pipe. Shortly after the impact, Bertha overheated and eventually could no longer make forward progress. A massive repair effort ensued causing a 2.5-year delay in reaching substantial completion.
WSDOT sued STP for the delay, seeking liquidated damages of $57 million. In response, STP argued its delay was excusable because it was caused by Bertha’s impact with the pipe, and the steel well casing was a Differing Site Condition (DSC) undisclosed in the contract documents. STP asserted counterclaims against WSDOT, alleging breach of contract and seeking $300 million in damages. Ultimately, a jury found that the steel well casing on the pipe was not a DSC, foreclosing STP’s excusable delay defense and counterclaims, and resulting in a $57 million verdict, plus interest, in favor of WSDOT.
Read the court decisionRead the full story...Reprinted courtesy of
Margarita Kutsin, Ahlers Cressman & SleightMs. Kutsin may be contacted at
margarita.kutsin@acslawyers.com
Georgia State and Local Governments Receive Expanded Authority for Conservation Projects
May 31, 2021 —
David R. Cook Jr. - Autry, Hall & Cook, LLPIn the 2020-2021 session, the Georgia General Assembly amended existing laws to expand state and local governments’ authority to enter conservation projects. In connection with these projects, the contractor guarantees that cost savings or revenue increases will cover any payments for the project.
Read more about
conservation projects, including
Guaranteed Energy Savings Performance Contracts
With regard to school systems, conservation projects had previously included facility alterations designed to reduce energy or water consumption or operation costs. But the new law expands the permitted projects to include equipment purchases used in new construction or building retrofit, addition, or renovation. It also adds training programs incidental to the contract.
Read the court decisionRead the full story...Reprinted courtesy of
David R. Cook Jr., Autry, Hall & Cook, LLPMr. Cook may be contacted at
cook@ahclaw.com
Daily Reports – The Swiss Army Knife of Project Documentation
June 08, 2020 —
Christopher A. Henry - ConsensusDocsProject “Daily Reports” are some of the most important, yet overlooked aspects of a construction project. These reports serve many beneficial roles such as holding parties accountable to their obligations, providing the basis for an as-built schedule, recording manpower, documenting site conditions, and recording any other important and relevant information that happened on the job site that day. Daily reports can also provide information to help with claims or disputes that may arise in the future, such as noting weather delays, providing backup for future delay claims, and providing information to dispute claims made against your company. Finally, daily reports also serve as a useful communication tool during the project and a source of real time information for parties that want to know how the work is commencing on a day to day basis. Because daily reports are the “Swiss army knife” of project documentation, it is extremely important that a contractor puts for its best effort when creating them.
It is no secret that a construction project can become more chaotic as the schedule progresses. Unfortunately, when that is the case, the effort put into creating these reports drops off and sometimes the responsibility of creating such reports is thrown aside altogether. I can speak from experience. Prior to entering the practice of law, I was a project engineer for a general contractor in Atlanta. As an engineer in the field, one of my many responsibilities was to enter the daily reports. Based off this experience, below are some thoughts on how to prepare useful daily reports.
1. Check the contract. The contract you entered may set forth specific requirements for the daily reports, such as where to file them, the required format, and specific information that must be included. Complying with contractual requirements is necessary for a successful project. One word of caution for subcontractors, a subcontract will often incorporate the prime contract. If that is the case, be sure to check the prime contract for any specific language relating to daily reports.
Read the court decisionRead the full story...Reprinted courtesy of
Christopher A. Henry, Jones Walker LLP Mr. Henry may be contacted at
chenry@joneswalker.com
When a Request for Equitable Adjustment Should Be Treated as a Claim Under the Contract Disputes Act
August 29, 2022 —
David Adelstein - Florida Construction Legal UpdatesIn federal contracting, contractors are sometimes torn about submitting a request for equitable adjustment (known as an “REA” under 48 C.F.R. 252.243-7002) or submitting a formal claim under the Contract Disputes Act (41 U.S.C. s. 7103), the latter requiring a final decision by the contracting officer and starts the clock with respect to interest and preserving rights. It is also sometimes not easy for the contracting officer receiving an REA to determine whether the REA is actually a claim under the Contract Disputes Act requiring more immediate action. This recent take by the United States Court of Appeals for the Federal Circuit hits the nail on the head:
We recognize that contracting officers will sometimes face the difficult challenge of determining whether a request for equitable adjustment is also a claim. Contractors must choose between submitting a claim—which starts the interest clock but requires the contracting officer to issue a final decision within 60 days—and submitting a mere request for equitable adjustment—which does not start the interest clock but gives the contractor more time to negotiate a settlement and possibly avoid hefty legal fees. The overlap between these two types of documents might create room for gamesmanship. For example, a contractor could submit a document that is a claim—starting the interest clock—but appears to be a mere request for equitable adjustment—causing the contracting officer to not issue a final decision within the 60-day deadline and allowing interest to accrue for months or years. But the government has tools to address this challenge: The contracting officer can communicate to the contractor that she is going to treat the document as a claim and issue a final decision within 60 days. Or the government can explicitly require the contractor to propose settlement terms and attempt to settle disputes before submitting a claim to the contracting officer for a final decision.
Zafer Construction Company v. U.S., 2022 WL 2793596, *5 (Fed.Cir. 2022).
Read the court decisionRead the full story...Reprinted courtesy of
David Adelstein, Kirwin Norris, P.A.Mr. Adelstein may be contacted at
dma@kirwinnorris.com
Contractors: Consult Your Insurance Broker Regarding Your CGL Policy
February 15, 2018 —
David Adelstein – Florida Construction Legal UpdatesContractors: do yourself a favor and consult your insurance broker regarding your commercial general liability (CGL) policy. Do this now, especially if you subcontract out work.
CGL policies contain a “your work” exclusion. The CGL policy is written such that it excludes “‘property damage’ to ‘your work’ arising out of it or any part of it and included in the ‘products-completed operations hazard.’” This exclusion will be raised in the post-completion latent construction defect scenario. (There are other exclusions that will be raised to a defect discovered during construction.) Certain policies will contain a subcontractor exception to this “your work” exclusion. You WANT this exception- no doubt about it so that this exclusion does not apply to work performed by your subcontractors. Without this subcontractor exception, truth be told, this “your work” exclusion is a total back-breaker to contractors. It will give your insurer an immediate out for many latent defect property scenarios since excluded from coverage is property damage to your work including work performed by your subcontractors.
Read the court decisionRead the full story...Reprinted courtesy of
David Adelstein, Florida Construction Legal UpdatesMr. Adelstein may be contacted at
dadelstein@gmail.com
Antidiscrimination Clause Required in Public Works and Goods and Services Contracts –Effective January 1, 2024
January 22, 2024 —
Travis Colburn - Ahlers Cressman & SleightIn July 2023, the Washington legislature passed Senate Bill 5186, which mandates inclusion of select antidiscrimination clauses in every state contract and subcontract for public works, goods, or services executed after January 1, 2024.
[i] RCW 49.60.530(3) codifies the now-required antidiscrimination clauses, which prohibit four categories of discrimination against any person because of age, sex, marital status, sexual orientation, gender identity, race, creed, color, national origin, citizenship or immigration status, honorably discharged veteran or military status, the presence of any sensory, mental, or physical disability, or the use of a trained dog guide or service animal by a person with a disability (the “Protected Class”).
Under the new law, public contractors and subcontractors (“Public Contractor”) may not refuse to hire a person because that person is a member of the Protected Class, unless that refusal is based upon a bona fide occupational qualification or if a person with a particular disability would be prevented from properly performing the particular work involved.
[ii] Similarly, Public Contractors may not discharge or bar a person from employment or discriminate against any person – either in terms of compensation or other terms and conditions of employment – because that person is a member of the Protected Class.
[iii] Last, Public Contractors may not print or circulate (or cause to be printed or circulated) any statement, advertisement, publication, form of application for employment, or make inquiry in connection with prospective employment, which expresses any limitation, specification, or discrimination as to the Protected Class.
[iv] Read the court decisionRead the full story...Reprinted courtesy of
Travis Colburn, Ahlers Cressman & SleightMr. Colburn may be contacted at
travis.colburn@acslawyers.com
Is it the End of the Lease-Leaseback Shootouts? Maybe.
September 07, 2020 —
Garret Murai - California Construction Law BlogIt’s the case that has turned into a modern day Hatfield versus McCoy – McGee v. Torrance Unified School District, Case No. 8298122, 2nd District Court of Appeals (May 29, 2020) – a series of cases challenging the validity of certain lease-leaseback construction contracts in California.
In shootout number one, James McGee sued the Torrance Unified School District challenging the validity of lease-leaseback contracts the District had entered into with general contractor Balfour Beatty Construction, LLC. Under California’s lease-leaseback statute, a school district can lease property it owns to a developer, who in turns builds a school facility on the property and leases the facility back to the school district. The primary benefit of the lease-leaseback method of project delivery is that a school district does not need to come up with money to build the facility because the district pays for the facility over time through lease payments to the developer. In shootout number one, McGee argued that Torrance Unified School District was required to competitively bid the lease-leasebacks projects. The 2nd District Court of Appeals disagreed.
Read the court decisionRead the full story...Reprinted courtesy of
Garret Murai, Nomos LLPMr. Murai may be contacted at
gmurai@nomosllp.com
