New privacy bill makes your location, sexual orientation "sensitive info"

The privacy legislation proposed by reps Rick Boucher (D-VA) and Cliff Stearns (R-FL) isn't particularly long, and compared to laws in other countries, it's not particularly strict. But it does provide a decent privacy baseline in the US, providing limited protection for "covered information" and much tougher protection for "sensitive information." The bill makes a key distinction between the two kinds of data: covered information collection is "opt-out," while sensitive information collection would become "opt-in" only.

According to the bill, covered information includes:

• The first name or initial and last name
• A postal address
• A telephone or fax number
• An e-mail address
• Unique biometric data, including a fingerprint or retina scan
• A Social Security number, tax identification number, passport number, driver's license number, or any other government-issued identification number
• A financial account number, or credit or debit card number, and any required security code, access code, or password that is necessary to permit access to an individual's financial account
• Any unique persistent identifier, such as a customer number, unique pseudonym or user alias, Internet Protocol address, or other unique identifier, where such identifier is used to collect, store, or identify information about a specific individual or a computer

Companies and websites that disclose their data collection practices can harvest this data on the assumption that, by using the site, one has agreed to such collection. But they are required to provide an opt-out option that would stop all such data collection and prevent the company from using even previously acquired data.

Sensitive information can't even be collected and stored in the first place without an explicit opt-in assent. The bill defines sensitive information as:

• Medical records, including medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional
• Race or ethnicity
• Religious beliefs
• Sexual orientation
• Financial records and other financial information associated with a financial account, including balances and other financial information
• Precise geolocation information

When it comes to that last one, the bill states that "a user's express opt-in consent to an application provider that relies on a platform offered by a commercial mobile service provider shall satisfy the requirements of this subsection."

Aggregate and anonymous information can be collected without any privacy policy at all.