Public Health Has a Critical Role in the Development of Data Privacy Legislation
November 30, 2022
Overview
As public health is increasingly moving toward cross-sector data sharing to better tailor public health interventions and address health inequities, comprehensive privacy laws are receiving more legislative attention. The American Data Privacy and Protection Act (ADPPA), introduced in June 2022 and amended in July, is an example of a pending federal bill that may have implications for public health data collection and sharing.
Protecting the privacy of individuals’ information is of utmost importance, and comprehensive privacy laws are increasingly receiving legislative attention. Health departments and public health organizations should be monitoring this trend, particularly pending privacy legislation for any impacts on public health’s data needs. This is especially important as public health is increasingly moving toward cross-sector data sharing to better tailor public health interventions and address health inequities.
Individuals’ data is currently protected by a patchwork of federal and state privacy laws that are often sector-specific – health, education, financial, and so on. Five states – California, Colorado, Connecticut, Virginia, and Utah – have passed comprehensive consumer data privacy laws. Other states are considering such legislation. At the federal level, there have been more than 50 privacy bills introduced in the first year of the 117th Congress (2021-2022) alone.
The American Data Privacy and Protection Act (ADPPA), introduced in June 2022 and amended in July, is an example of a pending federal bill that may have implications for public health data collection and sharing. The ADPPA is the latest attempt by Congress to pass comprehensive national privacy legislation. Such attempts date back to the 1970s. As amended, the ADPPA would apply to companies, including nonprofits and common carriers, and not to federal, state, Tribal, territorial, or local governments. The Act would require covered entities to limit the collection, processing, and transfer of personal data to that which is reasonably necessary to provide a requested product or service (Sec 2(9)). The ADPPA would also generally prohibit companies from transferring an individual’s personal data without their affirmative express consent. Individuals would have rights to access, correct, and delete their personal data. The ADPPA would also preempt state laws that are covered by its provisions, except for certain categories of state laws and specified laws in Illinois and California (see bill summary).
Commentators have noted that the current version of the ADPPA does not expressly provide for public health data collection or transfer of data for public health purposes. Indeed, the ADPPA may actually impose new legal challenges or restrictions for public health, for example restrictions on secondary uses of demographic data to promote population health. Importantly, the ADPPA would not preempt state laws relating to health information, medical information or records, HIV status or testing, or public health activities, reporting, data, or services (Sec 404(b)(2)(O),(P)).
Whether the ADPPA or other privacy legislation will pass in this session of Congress remains to be seen. What is clear from the scope of the ADPPA, and the concerns expressed about it, is that health departments and public health organizations need to be aware of pending privacy legislation at the federal and state level and the potential impact of such legislation on their data needs. Public health should take part in the development of privacy legislation to ensure it has access to the data it needs to adequately promote population health and address health inequities.
This post written by Carrie Waggoner, JD, Deputy Director, Network for Public Health Law – Mid-States Region Office.
The Network for Public Health Law provides information and technical assistance on issues related to public health. The legal information and assistance provided in this document do not constitute legal advice or legal representation. For legal advice, readers should consult a lawyer in their state.
Support for the Network is provided by the Robert Wood Johnson Foundation (RWJF). The views expressed in this post do not represent the views of (and should not be attributed to) RWJF.