AR53

An Assembly Resolution establishing the Assembly Select Committee on COVID-19 Contact Tracing Data Privacy.

Whereas, The coronavirus disease 2019 (COVID-19), which originated in China in December 2019, has since developed into a global pandemic that, as of June 1, 2020, has resulted in more than 6.8 million infections and 375,000 deaths worldwide, with approximately 1.8 million positive cases identified and 104,000 confirmed deaths in the United States and over 160,000 cases and nearly 12,000 deaths in New Jersey; and

Whereas, Because of a lack of widespread, effective testing, many experts believe that positive cases of COVID-19 are currently underreported, and the number of cases is actually significantly higher; and

Whereas, Many people who have contracted COVID-19 are asymptomatic, which may enhance the risk that, not aware of their infection, they will interact with others and unintentionally spread the disease; and

Whereas, Because of the highly contagious nature of COVID-19 and the fact that many people with the disease may be spreading it without ever being aware that they have become infected, one of the primary tools to combat the COVID-19 pandemic is contact tracing, which is the process of identifying which individuals an infected person may have come into contact with in order to trace the potential spread of the disease and take steps to prevent future exposures; and

Whereas, Two major components of contact tracing include interviews with infected persons and the collection of digital data from Bluetooth and global positioning systems to identify individuals who may have come into contact with an infected person; and

Whereas, Particularly with regard to the use of digital data, experts and advocates have raised significant concerns about how that data will be collected, used, stored, and potentially subject to disclosure or misuse; and

Whereas, It is essential that the need for contract tracing as a means of limiting the spread of COVID-19 be balanced against the privacy rights of individuals with regard to their digital data and private health information; and

Whereas, It is therefore incumbent on this House to convene a select committee to study issues related to the use of data collected for the purposes of contact tracing, and develop recommendations for appropriate restrictions, protocols, standards, and best practices to limit the use of these data and preserve the rights of individuals without inhibiting the use of contact tracing to stop the spread of COVID-19 in the State; now, therefore,

Be It Resolved by the General Assembly of the State of New Jersey:

1. a. There is established the Assembly Select Committee on COVID-19 Contact Tracing Data Privacy, which shall be tasked with reviewing matters pertaining to how data collected from individuals for the purposes of conducting contact tracing related to the coronavirus disease 2019 (COVID-19) pandemic will be used, including, but not limited to:

(1) what types of data are collected by contract tracers;

(2) recommended requirements and best practices to ensure the privacy of personal information, as well as the confidentiality of private health data in compliance with the requirements of the federal "Health Insurance Portability and Accountability Act of 1996," Pub.L.104-191, and related regulations;

(3) mandatory protocols and best practices for collecting, storing, and restricting access to contact tracing data;

(4) the authorized uses of data collected for contact tracing and specific restrictions on how the data may be used;

(5) the length of time that contact tracing data may be retained by an entity involved in performing contact tracing;

(6) mandatory protocols and best practices regarding the destruction of data collected for contact tracing purposes;

(7) appropriate measures to prevent data mining; and

(8) any other topics or issues of relevance to the committee.

b. The committee shall comprise nine members of the General Assembly, with five members to be appointed by the Speaker of the General Assembly and four members to be appointed by the Minority Leader of the General Assembly. The Speaker of the General Assembly shall appoint a chairperson of the committee and the Minority Leader of the General Assembly shall appoint vice-chairperson. The chairperson may appoint a secretary, who need not be a member of the commission. The members of the committee shall be appointed and the committee shall organize no later than 30 days after the effective date of this resolution.

c. No later than 60 days after it first organizes, the committee shall produce and submit to the General Assembly a report of its findings and recommendations for legislation or other appropriate actions to address issues related to the security and privacy of data collected for the purposes of contact training. The committee shall dissolve upon submission of its report.

2. This resolution shall take effect immediately and shall expire 30 days after the date the committee submits its report to the General Assembly pursuant to subsection c. of section 1 of this resolution.

STATEMENT

This resolution establishes the Assembly Select Committee on COVID-19 Contact Tracing Data Privacy, which will be tasked with reviewing matters pertaining to how data collected from individuals for the purposes of conducting contact tracing in response to the coronavirus disease 2019 (COVID-19) pandemic will be used, including, but not limited to:

(1) what types of data are collected by contract tracers;

(3) mandatory protocols and best practices for collecting, storing, and restricting access to contact tracing data;

(4) the authorized uses of data collected for contact tracing and specific restrictions on how the data may be used;

(5) the length of time that contact tracing data may be retained by an entity involved in performing contact tracing;

(6) mandatory protocols and best practices regarding the destruction of data collected for contact tracing purposes;

(7) appropriate measures to prevent data mining; and

(8) any other topics or issues of relevance to the committee.

The committee will comprise nine members of the General Assembly, with five members to be appointed by the Speaker of the General Assembly and four members to be appointed by the Minority Leader of the General Assembly. The Speaker of the General Assembly will appoint a chairperson of the committee and the Minority Leader of the General Assembly will appoint vice-chairperson. The chairperson may appoint a secretary, who need not be a member of the commission. The members of the committee are to be appointed, and the committee is to organize, no later than 30 days after the effective date of this resolution.

No later than 60 days after it first organizes, the committee will be required to produce and submit to the General Assembly a report of its findings and recommendations for legislation or other appropriate actions to address issues related to the security and privacy of data collected for the purposes of contact training. The committee will dissolve upon submission of its report, and this resolution will expire 30 days after the submission of the committee’s report.