Personal information: contact tracing.

Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to require a business to delete personal information about the consumer, as specified. This bill, the Technology-Assisted Contact Tracing Public Accountability and Consent Terms (TACT-PACT) Act, would generally regulate public health entities and businesses, as defined, that provide technology-assisted contact tracing (TACT) , as defined. The bill would, among other things, require a business or public health entity offering TACT to provide a simple mechanism for a user to revoke consent for the collection, use, maintenance, or disclosure of data and permit revocation of consent at any time. The bill would require a business offering TACT that is not affiliated with a public health entity to clearly and conspicuously disclose upon solicitation and provision of that service that the service is not affiliated with a public health entity. The bill would require a public health entity participating in TACT to require that any report of exposure be verified by a health care professional or public health entity before notifying persons who have been or may have been in contact with the reporting individual or before publicly disclosing exposure data. This bill would require a business or public health entity offering TACT to individual users to issue a public report, at least once every 90 days, containing certain information, including the number of individuals whose personal information was collected, used, or disclosed pursuant to TACT, the categories of information, and the recipients of that information, as specified. This bill would prohibit a business or public entity from discriminating against a person on the basis of participation or nonparticipation in TACT, as specified. Existing law generally governs contracts entered into by a state or local agency. This bill would, among other things, require data collected and maintained in the course of fulfilling the duties of a TACT contract to be encrypted to the extent practicable and would require certain provisions to be included in a TACT contract, including a provision creating performance metrics for evaluation of the particular goods or services provided pursuant to the contract. This bill would subject a violation of its provisions to civil damages and reasonable attorney fees, as specified.