REPRODUCTIVE HEALTH DATA PROTECTION ACT S.B. 1082 (S-1):

SUMMARY OF BILL

REPORTED FROM COMMITTEE

Senate Bill 1082 (Substitute S-1 as reported)

Sponsor: Senator Mallory McMorrow

Committee: Housing and Human Services

CONTENT

The bill would enact the "Reproductive Health Data Privacy Act" to do the following:

-- Prohibit a regulated entity, service provider, or affiliate (entity) from collecting or processing an individual's reproductive health data unless that entity provided the individual with privacy information, obtained consent, and used the data only for specified purposes.

-- Create an exemption for aggregated and de-identified data.

-- Specify the purposes for which an entity could collect or process reproductive health data and prohibit an entity from using or providing to a third-party more data than was necessary or for longer than was necessary.

-- Prohibit an entity from disclosing an individual's reproductive health data to a government agency or official unless presented with a warrant, mandated under law, or as requested by the individual to whom the data pertained.

-- Beginning June 30, 2027, prohibit an entity from selling or offering for sale an individual's reproductive health data without specific consent.

-- Prescribe requirements for consent to be considered valid in the sale of an individual's reproductive health data.

-- Require an entity to provide a clear and conspicuous link on its website that would allow an individual to revoke consent of sale or processing of the individual's reproductive health data.

-- Require an entity to respond to a request access to and deletion of the individual's data within 45 days.

-- Require the seller and purchaser of reproductive health data to enter into a written agreement for the terms and conditions of the data s use and processing.

-- Prohibit an entity from implementing geofencing that tracked or collected information from an induvial seeking reproductive health service, among other things.

-- Allow the Attorney General (AG) to bring an action to enjoin a person from violating the Act's provisions.

-- Allow the AG or individual who suffered a loss due to a violation of the Act to collect up to $750 per incident or actual damages, whichever was greater, or other relief.

The bill would take effect two years after its enactment.

BRIEF RATIONALE

Smart watches, fitness trackers, and apps can track a user's health data, including stress levels, heart rates, and menstruation cycles. According to testimony before the Senate Committee on Housing and Human Services, it is not uncommon for apps designed for female health tracking to claim not to share a user's personal and sensitive data with third parties but allow levels of third party sharing in the app's privacy policy. Accordingly, it has been suggested to prohibit the processing and sharing of reproductive health data without informed consent.

Legislative Analyst: Eleni Lionas

FISCAL IMPACT

The bill could have a minor negative fiscal impact on State and local government. To the extent that under the definitions in the bill the State Medicaid program or local health departments would be considered a "covered entity" or a "service provider", there would likely be minor costs to ensure compliance with the requirements.

The bill would have a minor negative fiscal impact on the AG and local courts. The AG would have minor administrative costs associated with the promulgation of rules to implement the language of the bill. Local courts are likely to have an increase in hearings associated with requests from the AG for injunctive relief permitted by the language of the bill. For requests from the AG for injunctive relief in which the AG prevailed, the AG could recover reasonable attorney fees.

Date Completed: 12-5-24 Fiscal Analyst: John P. Maxwell

Michael Siracuse

This analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent.