Privacy & Information Security Law Blog

On June 2 and June 5, 2023, the Connecticut and Nevada state legislatures, respectively, voted in favor of sending legislation to their governors for signature that would impose restrictions, among others, on the processing of consumer health data, including geofencing provisions.  Nevada S.B. 370 was signed by Nevada Governor Joe Lombardo on June 16, 2023. These bills contain provisions similar to Washington’s My Health My Data Act and expand on protections in the Health Insurance Portability and Accountability Act of 1996 and other privacy laws.

Connecticut’s S.B. 3

S.B. 3, pending signature by Connecticut Governor Ned Lamont, would amend certain portions of the Connecticut Data Privacy Act (“CTDPA”) to provide additional protections for health data. In particular, S.B. 3 would apply to “consumer health data,” which means any personal data that a controller uses to identify a consumer’s physical or mental health condition or diagnosis, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data. S.B. 3 would add “consumer health data” to the CTDPA’s definition of “sensitive data.”

S.B. 3 would require opt-in consent before any person can sell or offer to sell consumer health data. “Consent” may include a written statement or any other unambiguous affirmative action. S.B. 3 also would prohibit any person from using of a geofence to establish a virtual boundary that is within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, collecting data from or sending any notification to a consumer regarding the consumer’s consumer health data.

S.B. 3 also would impose new restrictions regarding processing of children’s online data. In particular, any controller that offers any online service, product or feature to consumers whom such controller has actual knowledge, or willfully disregards, are minors would, subject to exceptions (e.g., consent), be prohibited from:

• processing any minor’s personal data for the purposes of (1) targeted advertising, (2) any sale of personal data, or (3) certain types of profiling;
• collecting a minor’s precise geolocation; or
• using any system design feature to significantly increase, sustain or extend any minor’s use of such online service, product or feature.

Each controller that offers any online service, product or feature to consumers whom such controller has actual knowledge, or willfully disregards, are minors would be required to conduct a data protection assessment for such online service, product or feature.

S.B. 3 also would:

• impose requirements on online dating operators, including to maintain an online safety center and adopt a policy for the online dating platform’s handling of harassment reports by or between users; and
• establish a “Connecticut Internet Crimes Against Children Task Force.”

S.B. 3 does not contain a private right of action. Most of the provisions relating to protection of minors would not apply until October 1, 2024, but other provisions would be effective July 1, 2023, when the CTDPA takes effect.

Nevada’s S.B. 370

S.B. 370 was signed by Nevada Governor Joe Lombardo on June 16, 2023. Most of its substantive provisions apply to a “regulated entity” who conducts business in Nevada or produces or provides products or services that are targeted to consumers in Nevada, and, alone or with other persons, determines the purpose and means of processing, sharing or selling consumer health data. “Consumer health data” means personally identifiable information that is linked or reasonably capable of being linked to a consumer and “that a regulated entity uses to identify the past, present or future health status of the consumer.”

Among its key provisions, S.B. 370 would prohibit a regulated entity from:

• collecting consumer health data except (1) with the consumer’s prior opt-in consent, or (2) to the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity; or
• sharing consumer health data except (1) with the consumer’s prior opt-in consent that is “separate and distinct from” the consent provided for collecting consumer health data; (2) to the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity; or (3) where required or authorized by another provision of law.

S.B. 370 also would require a regulated entity to maintain a detailed consumer health data privacy policy, and prohibit a regulated entity from:

• collecting, using or sharing categories of consumer health data, other than those included in the regulated entity’s consumer health data privacy policy, without disclosing those additional categories to each consumer whose data will be collected, used or shared and obtaining the consumer’s opt-in consent;
• sharing consumer health data with a third party or affiliate, other than those included in the regulated entity’s consumer health data privacy policy, without disclosing those additional third parties or affiliates to each consumer whose data will be shared and obtaining the consumer’s opt-in consent;
• collecting, using or sharing consumer health data for purposes other than those included in the regulated entity’s consumer health data privacy policy without disclosing those additional purposes to each consumer whose data will be collected, used or shared and obtaining the consumer’s opt-in consent; or
• entering into a contract with a processer to process consumer health data that is inconsistent with the regulated entity’s consumer health data privacy policy.

S.B. 370 would provide consumers with access, opt-out and deletion rights with respect to their consumer health data.

Other provisions of S.B. 370 apply to any “person” (i.e., not just regulated entities). In particular, S.B. 370 would prohibit any person from:

• selling or offering to sell consumer health data (a) without the written authorization of the consumer to whom the data pertains; or (b) if the consumer provides such written authorization, in a manner that is outside the scope of or inconsistent with the written authorization; or
• implementing a geofence within 1,750 feet of any medical facility, facility for the dependent or any other person or entity that provides in-person health care services or products for the purpose of: (1) identifying or tracking consumers seeking in-person health care services or products; (2) collecting consumer health data; or (3) sending notifications, messages or advertisements to consumers related to their consumer health data or health care services or products.

“Health care services or products” means any service or product provided to a person to assess, measure, improve or learn about the health of a person.

S.B. 370 does not contain a private right of action and would be effective on March 31, 2024.