The “COVID–19 Consumer Data Protection Act of 2020” has been filed and purports to regulate the information collection which will likely increase as businesses and workplaces reopen. Provisions include:

• Prior consent for the collection of personal information for the purpose of COVID-19 tracking
• The ability to revoke this consent at any time
• Enforcement by the FTC, including over nonprofits
• Enforcement by attorneys general

Of interest is the definition of de-identified information as information which:

• Does not identify and is not reasonably linkable to an individual;
• Does not contain any information that could be used to re-identify the individual;
• Is subject to a public commitment
  • To refrain from attempting to use such information to identify any individual; and
  • To adopt technical and organizational measures to ensure that such information is not linked to any individual and is not disclosed unless the disclosure is subject to a contractually or other legally binding requirement that:
    • The recipient not use the information to identify any individual;
    • All onward disclosures of the information are subject to this limitation.

Read the press release announcing the measure.

[View source.]