news

Washington, DC – Congresswomen Debbie Dingell (MI-12) Jackie Speier (CA-14), and Diana DeGette (CO-01) introduced legislation today to ensure Americans can confidently use technology for contact tracing of COVID-19 knowing their data are secure and privacy is respected. The Secure Data and Privacy for Contact Tracing Act would provide grants to states that choose to use technology as part of contact tracing efforts for COVID-19 if they agree to adopt strong privacy protections for users. Senators Brian Schatz (D-HI) and Tammy Baldwin (D-WI) introduced companion legislation in the U.S. Senate today as well.

“Contact tracing technology will undoubtedly help us contain the spread of this pandemic as new variants emerge, but we cannot compromise consumer privacy protections. By enhancing data security and privacy protections in this emerging technology, our legislation will increase trust in contact tracing and make it more effective,” Rep. Dingell said. “We can end this pandemic by taking action to strengthen measures that have already proven successful.”

“It’s more important than ever that we employ every proven scientific method at our disposal to stem the spread of the pandemic, and that means contact tracing,” Rep. Speier said. “Several states are already using this technology, but it will only succeed if users can trust their information is safe. Our bill ensures that users can feel confident if they do their part and download a contact tracing app because their private data will be protected and secure.”

“We need to stop the spread of this virus, but no one should have to choose between protecting their health or protecting their privacy,” Rep. DeGette said. “New digital contact-tracing tools have the potential to play a vital role in helping us combat this pandemic and this legislation will ensure they’re developed in a way that will continue to protect people’s privacy as well.”

The Secure Data and Privacy for Contact Tracing Act provides grant funding for states to responsibly develop digital contact tracing technologies consistent with the following key privacy protections:

• Digital contact tracing tech must be strictly voluntary and provide clear information on intended use.
• Data requested must be minimized and proportionate to what is required to achieve contact tracing objectives.
• Data must be deleted after contact tracing processing is complete, or at the end of the declaration of emergency.
• States must develop a plan for how their digital contact tracing technology compliments more traditional contact tracing efforts and describe efforts to ensure their technology will be interoperable with other states. 
• States must establish procedures for independent security assessments of digital contact tracing infrastructure and remediate vulnerabilities. 
• Information gathered must be used strictly for public health functions authorized by the state and cannot be used for punitive measures, such as criminal prosecution or immigration enforcement.
• Digital contact tracing tech must have robust detection capabilities consistent with CDC guidance on exposure. 
• Digital contact tracing technology must ensure anonymity, allowing only authorized public health authorities or other authorized parties to have access to personally identifiable information. 

The Secure Data and Privacy for Contact Tracing Act is co-sponsored by Representatives André Carson (IN-07), Mondaire Jones (NY-17), Stephen Lynch (MA-08), Jamie Raskin (MD-08), and Mark Takano (CA-41).

The bill is endorsed by Ashkan Soltani, Distinguished Fellow at Georgetown University and former Chief Technologist of the Federal Trade Commission; AIDS United; Project on Government Oversight; Treatment Advocacy Group

“This bill creates the necessary incentives for states to ensure that the plethora of digital tools being developed in response to this and future pandemics are safe, effective, and interoperable. The lack of oversight and coordination has been one of the biggest barriers thus far,” said Ashkan Soltani, Distinguished Fellow at Georgetown University and former Chief Technologist of the Federal Trade Commission.

"The Secure Data and Privacy for Contact Tracing Act creates strong and sensible safeguards for individuals' private activities and interactions, a measure that's vital to both individual rights as well as encouraging participation in programs to fight the pandemic. With other nations now co-opting contact tracing data for policing, it's more critical than ever that the United States build these types of protections into contact tracing,” said Jake Laperruque, Senior Counsel, The Project on Government Oversight.

###