My Body, My Data Act of 2022

This bill establishes protections, subject to certain limits, for personal reproductive or sexual health information. This includes information relating to past, present, or future surgeries or procedures, such as the termination of a pregnancy.

Specifically, commercial entities, including individuals, nonprofits, and common carriers, may not collect, retain, use, or disclose personal reproductive or sexual health information except (1) with the express written consent of the individual to whom such information relates, or (2) as is strictly necessary to provide a requested product or service.

Commercial entities also must provide individuals with access to, and a reasonable mechanism to delete, any of their reproductive or sexual health information upon request. Further, commercial entities must maintain and publish a privacy policy describing their practices with respect to such information.

The bill's provisions do not apply to entities that are subject to certain existing health-related privacy regulations, such as the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996. Additionally, the provisions do not apply to the disclosure of personal reproductive or sexual health information for the publication of newsworthy information of legitimate public concern.

The bill provides for enforcement by the Federal Trade Commission and by private civil actions.