S.Amdt. 2044

SA 2044. Mr. MARKEY (for himself and Ms. Klobuchar) submitted an
amendment intended to be proposed by him to the bill S. 4049, to
authorize appropriations for fiscal year 2021 for military activities
of the Department of Defense, for military construction, and for
defense activities of the Department of Energy, to prescribe military
personnel strengths for such fiscal year, and for other purposes; which
was ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. OVERSIGHT RELATED TO GOVERNMENTAL RESPONSE TO
HEALTH-RELATED EPIDEMICS.

(a) In General.--Section 1061 of the Intelligence Reform
and Terrorism Prevention Act of 2004 (42 U.S.C. 2000ee) is
amended--
(1) in subsection (c)--
(A) in paragraph (1), by inserting ``or to respond to
health-related epidemics'' after ``from terrorism''; and

[[Page S3505]]

(B) in paragraph (2), by inserting ``or to respond to
health-related epidemics'' after ``against terrorism'';
(2) in subsection (d)--
(A) in paragraph (1), by inserting ``or to respond to
health-related epidemics'' after ``from terrorism'' each
place it appears; and
(B) in paragraph (2)--
(i) in subparagraph (B), by striking ``and'' at the end;
(ii) in subparagraph (C), by striking the period at the end
and inserting ``; and''; and
(iii) by adding at the end the following:
``(D) the collection, use, storage, and sharing of covered
data by Federal, State, or local government in connection
with responding to a Federal declaration of a public health
emergency to ensure that privacy and civil liberties are
protected.'';
(3) by redesignating subsection (m) as subsection (n); and
(4) by inserting after subsection (l) the following:
``(m) Definitions.--In this section:
``(1) Aggregate data.--The term `aggregate data' means
information that relates to a group or category of
individuals that is not linked or reasonably linkable to any
individual or device that is linked or reasonably linkable to
an individual, provided that a platform operator or operator
of an automated exposure notification service--
``(A) takes reasonable measures to safeguard the data from
reidentification;
``(B) publicly commits in a conspicuous manner not to
attempt to reidentify or associate the data with any
individual or device linked or reasonably linkable to an
individual;
``(C) processes the data for public health purposes only;
and
``(D) contractually requires the same commitment for all
transfers of the data.
``(2) Automated exposure notification service.--
``(A) In general.--The term `automated exposure
notification service' means a website, online service, online
application, mobile application, or mobile operating system
that is offered in commerce in the United States and that is
designed, in part or in full, specifically to be used for, or
marketed for, the purpose of digitally notifying, in an
automated manner, an individual who may have become exposed
to an infectious disease (or the device of such individual,
or a person or entity that reviews such disclosures).
``(B) Limitations.--Such term does not include--
``(i) any technology that a public health authority uses as
a means to facilitate traditional in-person, email, or
telephonic contact tracing activities, or any similar
technology that is used to assist individuals to evaluate if
they are experiencing symptoms related to an infectious
disease to the extent the technology is not used as an
automated exposure notification service; or
``(ii) any platform operator or service provider that
provides technology to facilitate an automated exposure
notification service to the extent the technology acts only
to facilitate such services and is not itself used as an
automated exposure notification service.
``(3) Collect; collection.--The terms `collect' and
`collection' mean buying, renting, gathering, obtaining,
receiving, accessing, or otherwise acquiring covered data by
any means, including by passively or actively observing the
behavior of an individual.
``(4) Covered data.--The term `covered data' means any
information that is--
``(A) linked or reasonably linkable to any individual or
device linked or reasonably linkable to an individual;
``(B) not aggregate data; and
``(C) collected, processed, or transferred in connection
with an automated exposure notification service.
``(5) Indian tribe.--The term `Indian tribe'--
``(A) has the meaning given such term in section 4 of the
Indian Self-Determination and Education Assistance Act (25
U.S.C. 5304); and
``(B) includes a Native Hawaiian organization as defined in
section 6207 of the Elementary and Secondary Education Act of
1965 (20 U.S.C. 7517).
``(6) Operator of an automated exposure notification
service.--The term `operator of an automated exposure
notification service' means any person or entity that
operates an automated exposure notification service, other
than a public health authority, and that is--
``(A) subject to the Federal Trade Commission Act (15
U.S.C. 41 et seq.); or
``(B) an organization not organized to carry on business
for the organization's own profit or that of the
organization's members.
``(7) Platform operator.--The term `platform operator'
means any person or entity other than a service provider who
provides an operating system that includes features
supportive of an automated exposure notification service and
facilitates the use or distribution of such automated
exposure notification service to the extent the technology is
not used by the platform operator as an automated exposure
notification service.
``(8) Process.--The term `process' means any operation or
set of operations performed on covered data, including
collection, analysis, organization, structuring, retaining,
using, securing, or otherwise handling covered data.
``(9) Public health authority.--The term `public health
authority' means an agency or authority of the United States,
a State, a territory, a political subdivision of a State or
territory, or an Indian tribe that is responsible for public
health matters as part of its official mandate, or a person
or entity acting under a grant of authority from or contract
with such public agency.
``(10) Service provider.--The term `service provider' means
any person or entity, other than a platform operator, that
processes or transfers covered data in the course of
performing a service or function on behalf of, and at the
direction of, a platform operator, an operator of an
automated exposure notification service, or a public health
authority, but only to the extent that such processing or
transfer relates to the performance of such service or
function.
``(11) State.--The term `State' means any of the several
States, the District of Columbia, the Commonwealth of Puerto
Rico, the Virgin Islands, Guam, American Samoa, and the
Commonwealth of the Northern Mariana Islands.
``(12) Transfer.--The term `transfer' means to disclose,
release, share, disseminate, make available, allow access to,
sell, license, or otherwise communicate covered data by any
means to a nonaffiliated entity or person.''.
(b) Reports.--Section 1061(e) of the Intelligence Reform
and Terrorism Prevention Act of 2004 (42 U.S.C. 2000ee(e)) is
amended by adding at the end the following:
``(3) Report on covid-19 mitigation activities.--Not later
than 1 year after the date of enactment of this paragraph,
the Board shall issue a report, which shall be publicly
available to the greatest extent possible, assessing the
impact on privacy and civil liberties of Government
activities in response to the public health emergency related
to the Coronavirus 2019 (COVID-19), and making
recommendations for how the Government should mitigate the
threats posed by such emergency.
``(4) Reports on public health emergency response.--Not
later than 1 year after any Federal emergency or disaster
declaration related to public health, or not later than 1
year after the termination of such declaration, the Board
shall issue a report, which shall be publicly available to
the greatest extent possible, assessing the impact on privacy
and civil liberties of Government activities in response to
such emergency or disaster, and making recommendations for
how the Government should mitigate the threats posed by such
emergency or disaster.''.
______