Warren Introduces the Health and Location Data Protection Act of 2022

On June 15, 2022, Senator Elizabeth Warren introduced the “Health and Location Data Protection Act of 2022” (“Act”), which, if passed, would “prohibit data brokers from selling and transferring” consumer location or health data.   

Pursuant to the Act:

• Data is defined as “information that is linked, or reasonably linked to specific individuals, or specific groups of individuals who share the same place of residence or internet protocol address”;

• “Location data” is defined as “data capable of determining the past or present physical location of an individual or an individual’s device”; 

• “Health data” is defined as data which reveals or describes:

  • the receipt of, or inquiry to receive, health services;

  • any disability or health condition; or

  • any treatment or diagnosis of a disability or health condition.

• Data brokers are prohibited from selling, reselling, transferring, sharing, or otherwise providing or making available a consumer’s location or health data. The only exceptions to this prohibition are:

  • where transfers may be done lawfully under the Health Insurance Portability and Accountability Act of 1996 (“HIPPA”),

  • where the information is “newsworthy information of legitimate public concern” as provided by the First Amendment or

  • where the individual consumer provides a “valid authorization” as defined by HIPPA in the health data context and as the Act requires the FTC to adapt for the location data context.

The FTC, state attorneys general, and injured persons have the right to sue for enforcement of the Act’s provisions. Additionally, the FTC will be empowered with rulemaking and enforcement authority for violations of the Act.