What's happening
This bill regulates the collection, use, and disclosure of emergency health and personal data during COVID-19, establishing strict privacy protections and oversight.
Why it matters
Empowers individuals with strong consent rights. The bill requires clear, opt-in consent before any emergency health or personal data is collected, processed, or disclosed, and mandates that people can withdraw consent at any time. This ensures individuals have real control over their data during health emergencies.
Strict limits on data use and retention. Covered entities can only collect the minimum necessary information for COVID-19 response, must delete most data within 30 days (or 14 days for proximity/exposure data), and are forbidden from using data for commercial purposes or discriminatory decisions—helping prevent future misuse or "mission creep."
Transparency and accountability requirements. Entities covered by the law must provide privacy policies at a fourth-grade reading level, publish detailed transparency reports every 90 days, and undergo annual independent audits that assess not just privacy and security but also potential for bias or discrimination. This creates ongoing public oversight and pressure to maintain high standards.
Enforceable protections with real penalties. The Attorney General is empowered to take enforcement action, with penalties of up to $25,000 per violation or 4% of annual revenue, and courts can order restitution or other relief. This means organizations face serious consequences for violating privacy and security rules, making the protections more than just symbolic.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Protect COVID Health Data
Plain English, a few words. Used as the page title.
Sponsors
History
- Referred to health
- Delivered to assembly
- Passed senateVote 55–5
- Ordered to third reading cal.907
- Reported and committed to rules
- Print number 8448d
- Amend and recommit to health
- Committee discharged and committed to health
- Print number 8448c
- Amend (t) and recommit to internet and technology
- Print number 8448b
- Amend and recommit to internet and technology
Show 3 earlier actions
- Print number 8448a
- Amend (t) and recommit to internet and technology
- Referred to internet and technology
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect COVID Health Data
In Assembly Committee · Health · Sponsor Linda Rosenthal
Full text
6 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
8448--D
IN SENATE
June 3, 2020
Introduced by Sens. THOMAS, BAILEY, CARLUCCI, GOUNARDES, HOYLMAN, MAY, RAMOS, STAVISKY -- read twice and ordered printed, and when printed to be committed to the Committee on Internet and Technology -- committee discharged, bill amended, ordered reprinted as… Show allHide
Introduced by Sens. THOMAS, BAILEY, CARLUCCI, GOUNARDES, HOYLMAN, MAY, RAMOS, STAVISKY -- read twice and ordered printed, and when printed to be committed to the Committee on Internet and Technology -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee -- committee discharged and said bill committed to the Committee on Health -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee
AN ACT in relation to the collection of emergency health data and personal information and the use of technology to aid during COVID-19; and providing for the repeal of such provision upon the expiration thereof
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. For the purposes of this act:
1. "Collect" means to buy, rent, gather, obtain, receive, or access any personal information pertaining to an individual by any means, online or offline, including but not limited to, receiving information from the individual or from a third party, actively or passively, or obtaining information by observing an individual's behavior.
2. "Covered entity" means any person, including a government entity:
(a) that collects, processes, or discloses emergency health data, as defined in this act, electronically or through communication by wire or radio; or
(b) that develops or operates a website, web application, mobile application, mobile operating system feature, or smart device application for the purpose of tracking, screening, monitoring, contact tracing, or mitigation, or otherwise responding to the COVID-19 public health emergency.
3. "De-identified information" means information that cannot reasonably identify, relate to, describe, be capable of being associated with,
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD16478-14-0
S. 8448--D 2
or be linked, directly or indirectly, to a particular individual, household, or device. A covered entity that uses de-identified information:
(a) has implemented technical safeguards that prohibit re-identification of the individual to whom the information may pertain;
(b) has implemented business processes that specifically prohibit re-identification of the information;
(c) has implemented business processes that prevent inadvertent release of de-identified information; and
(d) makes no attempt to re-identify the information.
4. "Disclose" means any action, set of actions, or omission in which a covered entity makes personal information available to another person, intentionally or unintentionally, including but not limited to, sharing, publishing, releasing, transferring, disseminating, making available, selling, leasing, providing access to, failing to restrict access to, or otherwise communicating orally, in writing, electronically, or by any other means.
5. "Emergency health data" means data linked or reasonably linkable to an individual, household, or device, including data inferred or derived about the individual, household, or device from other collected data provided such data is still linked or reasonably linkable to the individual, household, or device, that concerns the public COVID-19 health emergency. Such data includes:
(a) Information that reveals the past, present, or future physical or behavioral health or condition of, or provision of healthcare to, an individual including:
(i) data derived from the testing or examination;
(ii) whether or not an individual has contracted or been tested for, or an estimate of the likelihood that a particular individual may contract, such disease or disorder; and
(iii) genetic data, biological samples and biometrics; and
(b) Other data collected in conjunction with other emergency health data that can be used to infer health status, health history, location or associations, including:
(i) geolocation data, when such term means data capable of determining the past or present precise physical location of an individual at a specific point in time, taking account of population densities, including cell-site location information, triangulation data derived from nearby wireless or radio frequency networks and global positioning system data;
(ii) proximity data, when such term means information that identifies or estimates the past or present physical proximity of one individual or device to another, including information derived from Bluetooth, audio signatures, nearby wireless networks, and near field communications;
(iii) demographic data;
(iv) contact information for identifiable individuals or a history of the individual's contacts over a period of time, such as an address book or call log; and
(v) any other data collected from a personal device.
6. "Individual" means a natural person whom the covered entity knows or has reason to know is located in New York state.
7. "Personal information" means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, or device.
8. "Process" means any operation or set of operations that are performed on personal data by either automated or not automated means.
S. 8448--D 3
9. "Public health authority" means the New York state department of health, a county health department or the New York city department of health and mental hygiene, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons to entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.
§ 2. Individual rights.
1. The individual's right to opt-in. (a) A covered entity shall obtain freely given, specific, informed, and unambiguous opt-in consent from an individual to:
(i) process the individual's personal information or emergency health data; and
(ii) make any changes in the processing of the individual's personal information or emergency health data.
(b) It shall be unlawful for a covered entity to collect, process, or disclose emergency health data or personal information unless:
(i) the individual to whom the data pertains has freely given, specific, informed, and unambiguous consent to such collection, processing, or disclosure; or
(ii) such collection, processing, or disclosure is necessary and for the sole purpose of:
(A) protecting against malicious, deceptive, fraudulent, or illegal activity; or
(B) detecting, responding to, or preventing security incidents or threats.
(c) To the extent that a covered entity must process internet protocol addresses, system configuration information, URLs of referring pages, locale and language preferences, keystrokes, and other personal information in order to obtain individuals' freely given, specific, informed, and unambiguous opt-in consent, the entity:
(i) shall only process the personal information necessary to request freely given, specific, informed, and unambiguous opt-in consent;
(ii) shall process the personal information solely to request freely given, specific, informed, and unambiguous opt-in consent; and
(iii) shall immediately delete the personal information if consent is withheld or withdrawn.
2. The individual's right to privacy. (a) All emergency health data and personal information shall be collected at a minimum level of identifiability reasonably needed for the completion of the transaction disclosed to, affirmatively consented to, and requested by the individual. For a covered entity using proximity tracing or exposure notification this includes changing temporary anonymous identifiers at least once in a 20 minute period.
(b) A covered entity shall not process personal information or emergency health data beyond what is adequate, relevant, and necessary for the completion of the transaction disclosed to, affirmatively consented to, and requested by the individual.
(c) A covered entity shall not process emergency health data or personal information for any purpose not authorized under this act, including:
(i) commercial advertising, recommendation for e-commerce, or the training of machine learning algorithms related to, or subsequently for use in, commercial advertising and e-commerce;
S. 8448--D 4
(ii) soliciting, offering, selling, leasing, licensing, renting, advertising, marketing, or otherwise commercially contracting for employment, finance, credit, insurance, housing, or education; or
(iii) segregating, discriminating in, or otherwise making unavailable the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation (as such term is defined in section 301 of the Americans with Disabilities Act of 1990), except as authorized by a state or federal government entity for a public health purpose; provided that a covered entity shall not process emergency health data or personal information to make categorical decisions about the allocation of care based on disability.
3. Covered entity privacy policy. (a) A covered entity shall provide to the individual a privacy policy, at a fourth grade reading level or below and in the language the entity regularly uses to communicate with the individual, prior to or at the point of collection of emergency health data or personal information:
(i) detailing how and for what purpose the covered entity collects, processes, and discloses emergency health data and personal information;
(ii) describing the covered entity's data retention and data security policies and practices for emergency health data and personal information; and
(iii) describing how an individual may exercise rights under this section.
(b) A covered entity shall create transparency reports, at least once every 90 days, that include:
(i) the number of individuals whose emergency health data or personal information the covered entity collected or processed;
(ii) the categories of emergency health data and personal information collected, processed, or disclosed;
(iii) the purposes for which each category of emergency health data or personal information was collected, processed, or disclosed;
(iv) the number of requests for individuals' emergency health data or personal information, including information on who the emergency health data or personal information was disclosed to; and
(v) the number of instances where emergency health data or personal information was produced, in whole or in part, without prior, explicit consents by the individuals specified in the request.
(c) The covered entity shall make each transparency report persistently available and readily accessible on such entity's website.
4. Time limitation on retention. (a) Emergency health data and personal information shall be deleted when the initial purpose for collecting or obtaining such data has been satisfied or within 30 days, whichever occurs first, except that proximity tracing or exposure notification data which shall be automatically deleted every 14 days.
(b) This subdivision shall not apply to de-identified information.
5. Access rights. (a) Emergency health data and personal information shall be disclosed only as necessary to provide the service requested by an individual.
(b) A covered entity may share aggregate, de-identified data with public health authorities.
(c) A covered entity shall not disclose emergency health data or personal information to a third party unless that third party is contractually bound to the covered entity to meet the same privacy and security obligations as the covered entity.
(d) No covered entity in possession of emergency health data or personal information may disclose, redisclose, or otherwise disseminate
S. 8448--D 5
an individual's emergency health data or personal information unless the subject of the emergency health data or personal information or the subject's legally authorized representative consents in writing to the disclosure or redisclosure.
(e) Without consent under subdivision one of this section, emergency health data, personal information, and any evidence derived therefrom shall not be subject to or provided in response to any legal process or be admissible for any purpose in any judicial or administrative action or proceeding.
(f) Individuals shall have the right to access the emergency health data and personal information collected on them and correct any inaccuracies.
(i) A covered entity must comply with an individual's request to correct emergency health data or personal information not later than 30 days after receiving a verifiable request from the individual or, in the case of a minor, the individual's parent or guardian.
(ii) Where the covered entity has reasonable doubts or cannot verify the identity of the individual making a request under this paragraph, the covered entity may request additional information necessary for the specific purpose of confirming the identity of the individual. In such cases, the additional information shall not be processed for any purpose other than verifying the identity of the individual and must be deleted immediately upon verification or failure to verify the individual.
§ 3. 1. A covered entity shall implement reasonable measures to ensure confidentiality, integrity, and availability of emergency health data and personal information.
2. A covered entity that collects an individual's emergency health data or personal information shall implement and maintain reasonable security procedures and practices, including administrative, physical, and technical safeguards, appropriate to the nature of the information and the purposes for which that information will be processed, to protect that information from unauthorized processing, disclosure, access, destruction, or modification.
3. A covered entity shall limit access to emergency health data and personal information to authorized essential personnel whose use of the data is reasonably necessary to operate the program and record who has accessed emergency health data or personal information, the date of access, and for what purposes.
§ 4. 1. All covered entities shall be subject to annual data protection audits, conducted by a neutral third party auditor, evaluating the technology utilized and the development processes for statistical impacts on classes protected under section 296 of article 15 of the executive law, as well as for impacts on privacy and security, that includes at a minimum:
(a) a detailed description of the technology, its design, and its purpose;
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act in relation to the collection of emergency health data and personal information and the use of technology to aid during COVID-19; and providing for the repeal of such provision upon the expiration ther- eof
Purpose
The purpose of this bill is to create ethical guidelines for entities using technology to track, screen, monitor, contact trace, mitigate or respond to the C071D-19 health emergency.
Summary of specific provision
Section one of the bill defines covered entities as any person that electronically collects, processes or discloses emergency health data or that develops or operates a website, application, or operating system feature for tracking, screening, monitoring, contact tracing, miti- gation, or otherwise responding to the COVID-19 public health emergency.
Read the full memo (947 words)
Emergency health data is information that reveals the past, present, or future physical or behavioral health or condition of, or provision of healthcare to, an individual and other data collected in conjunction with emergency health data that can be used to infer health status, health history, location or associations.
Section two of the bill establishes individual rights of users who enter into transactions with a covered entities.
* An individual has the right to opt in the collection, processing, and disclosure of personal information or emergency health information.
* An individual has the right to have emergency health data and personal information collected at the minimum level of identifiability reasonably needed for the completion of the transaction consented to and requested by the individual.
* An individual has the right to know, through a privacy policy, what emergency health data or personal information is being collected, proc- essed, and disclosed about them and for what reasons. An individual has the right to be given that information in a way that is understandable and at a 4th grade reading level or below. A covered entity must publish on its website transparency reports every 90 days with the following information: the number of individuals the covered entity has collected and processed information on; the categories of information collected, processed, and disclosed; the purpose for collection, processing, and disclosure; the number of requests for information and who information was disclosed to; and the number of instances where information was produced without explicit consent from individuals.
* An individual has the right to know, through a privacy policy, what emergency health data deleted when the initial purpose for the trans- action is satisfied or within 30 days, whichever occurs first. Except exposure notification information should automatically delete every 14 days. Deletion does not apply to de-identified information. * An individual has the right to have emergency health data and personal information disclosed only as necessary to complete the requested trans- action or if consented to in writing. Emergency health data and personal information can never be disclosed in response to a legal process or admissible in any judicial or administrative proceeding. De-identified information may be shared with public health authorities. An individual has the right to correct any inaccuracies in the information collected about them.
Section three of the bill requires covered entities to implement securi- ty procedures and practices that ensure confidentiality, integrity, and availability of emergency health data and personal information. A covered entity must limit access to emergency health data and personal information to personnel whose use of the data is necessary to operate the program. A covered entity must record who accessed the date, the date of access, and for what purpose.
Section four of the bill requires covered entities to hire a neutral third party audit to conduct annual data protection audits. The purpose of an audit is to provide transparency about the technology used, to assess the covered entity's level of compliance with its own data protection policies and to identify gaps and weaknesses in the covered entity's data protection policies and implementation. A covered entity must make transparency reports readily and persistently available on its website.
Section five of the bill allows for a private right of action and enforcement by the attorney general.
Section six of the bill contains a severability clause. Section seven of the bill is the effective date.
Justification
Many states have implement orders to limit the spread of COVID-19. The Center for Disease Control and Prevention (CDC) has advocated that public health authorities implement contact tracing procedures to prevent the reoccurrence of widespread infection after these orders are relaxed or lifted it. The federal government may advise on procedure but state and local public health authorities will be responsible for contact tracing operations.
Contract tracing is a technique used by health departments to identify and support individuals with suspected or confirmed infections and to prevent further spread of the infection. Traditional contact tracing techniques are labor intensive and slow compared to a fast moving virus like COVID-19. As states move to reopen their economies, governments are looking at technology to simplify the process of contact tracing.
The new methods of contact tracing being proposed would rely on location or proximity detection by mobile phones to selectively deliver alerts about potential exposures. These systems have the ability to aid in the collection of crucial data to halt fight the pandemic but they also pose significant risks to privacy, civil rights, and civil liberties.
Any technology that involves the collection, processing, and disclosure of sensitive information can put consumers at increased risk or exploi- tation. Efforts to combat the coronavirus should not undermine New Yorker's privacy rights. The legislature has a responsibility to protect the privacy of consumers' personal information during the COVID-19 public health crisis.
Prior legislative history
New bill.
Fiscal impact on the state
None.
Effective date
This act shall take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.