A10583 Summary

• Requires covered entities collecting emergency health data or personal information during COVID-19 to obtain freely given, specific, informed, and unambiguous opt-in consent from individuals before processing or disclosing such data.

• Mandates covered entities provide privacy policies at a fourth-grade reading level explaining how data is collected, processed, and retained, and requires transparency reports every 90 days detailing data collection, purposes, and disclosure recipients.

• Requires emergency health data and personal information be deleted within 30 days of satisfying the initial collection purpose, or every 14 days for proximity tracing or exposure notification data.

• Prohibits use of emergency health data for commercial advertising, e-commerce, employment solicitation, financial decisions, insurance, housing, or education purposes; also prohibits making categorical decisions about care allocation based on disability.

• Establishes private right of action allowing individuals to sue for violations with damages of $10,000 or actual damages (whichever is greater), plus punitive damages and attorney's fees; authorizes attorney general to seek injunctive relief and penalties up to $25,000 per violation or 4% of annual revenue.

• Expires and is repealed January 1, 2023.