113 HR 4711 IH: Commercial Privacy Bill of Rights Act of 2014
U.S. House of Representatives
2014-05-21
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.The table of contents for this Act is as follows:
Sec. 1. Table of contents.
TITLE I—Commercial privacy
Sec. 101. Short title.
Sec. 102. Findings.
Sec. 103. Definitions.
Subtitle A—Right to security and accountability
Sec. 111. Security.
Sec. 112. Accountability.
Sec. 113. Privacy by design.
Subtitle B—Right to notice and individual participation
Sec. 121. Transparent notice of practices and purposes.
Sec. 122. Individual participation.
Subtitle C—Rights relating to data minimization, constraints on distribution, and data integrity
Sec. 131. Data minimization.
Sec. 132. Constraints on distribution of information.
Sec. 133. Data integrity.
Subtitle D—Right to notice of breaches of security
Sec. 141. Definitions.
Sec. 142. Notice to individuals.
Sec. 143. Notice to law enforcement.
Subtitle E—Enforcement
Sec. 151. General application.
Sec. 152. Enforcement by the Federal Trade Commission.
Sec. 153. Enforcement by Attorney General.
Sec. 154. Enforcement by States.
Sec. 155. Civil penalties.
Sec. 156. Effect on other laws.
Sec. 157. No private right of action.
Subtitle F—Co-Regulatory safe harbor programs
Sec. 161. Establishment of safe harbor programs.
Sec. 162. Participation in safe harbor program.
Subtitle G—Application with other Federal laws
Sec. 171. Application with other Federal laws.
Subtitle H—Development of commercial data privacy policy in the Department of Commerce
Sec. 181. Direction to develop commercial data privacy policy.
TITLE II—Online privacy of children
Sec. 201. Short title.
Sec. 202. Findings.
Sec. 203. Definitions.
Sec. 204. Online collection, use, and disclosure of personal information of children.
Sec. 205. Targeted marketing to children or minors.
Sec. 206. Digital Marketing Bill of Rights for Teens and Fair Information Practices Principles.
Sec. 207. Online collection of geolocation information of children and minors.
Sec. 208. Removal of content.
Sec. 209. Enforcement and applicability.
Sec. 210. Rule for treatment of users of websites, services, and applications directed to children
or minors.
Sec. 211. Effective dates.
<enum>I</enum><header>Commercial privacy</header>
<section id="HB96BBB94E4ED475F8A3035A3AC4A7C0A"><enum>101.</enum><header>Short title</header><text display-inline="no-display-inline">This title may be cited as the <quote><short-title>Commercial Privacy Bill of Rights Act of 2014</short-title></quote>.</text>
</section><section id="H48A7CAD1C642438CABE90954C0378BA8"><enum>102.</enum><header>Findings</header><text display-inline="no-display-inline">The Congress finds the following:</text>
<paragraph id="HF768791432AA414D99F50572E7D147FD"><enum>(1)</enum><text>Personal privacy is worthy of protection through appropriate legislation.</text>
</paragraph><paragraph id="H900753FD80424DB295128968F32B8BDC"><enum>(2)</enum><text>Trust in the treatment of personally identifiable information collected on and off the Internet is
essential for businesses to succeed.</text>
</paragraph><paragraph id="H0EF13A746FFB4BE7952B60AA99600057"><enum>(3)</enum><text>Persons interacting with others engaged in interstate commerce have a significant interest in their
personal information, as well as a right to control how that information
is collected, used, stored, or transferred.</text>
</paragraph><paragraph id="H8EEE78A0760B4598A024145BF01CD19E"><enum>(4)</enum><text>Persons engaged in interstate commerce and collecting personally identifiable information on
individuals have a responsibility to treat that information with respect
and in accordance with common standards.</text>
</paragraph><paragraph id="HE66BD5E64E9F4FD192A02D4FF640636A"><enum>(5)</enum><text>On the day before the date of the enactment of this Act, the laws of the Federal Government and
State and local governments provided inadequate privacy protection for
individuals engaging in and interacting with persons engaged in interstate
commerce.</text>
</paragraph><paragraph id="H831202552BA94AD7A2676C8E278980F9"><enum>(6)</enum><text>As of the day before the date of the enactment of this Act, with the exception of Federal Trade
Commission enforcement of laws against unfair and deceptive practices, the
Federal Government has eschewed general commercial privacy laws in favor
of industry self-regulation, which has led to several self-policing
schemes, some of which are enforceable, and some of which provide
insufficient privacy protection to individuals.</text>
</paragraph><paragraph id="HDC0639FD86F44684B9A360D6F5B61AA7"><enum>(7)</enum><text>As of the day before the date of the enactment of this Act, many collectors of personally
identifiable information have yet to provide baseline fair information
practice protections for individuals.</text>
</paragraph><paragraph id="HEE402E0E87514B14A216E725156037D7"><enum>(8)</enum><text>The ease of gathering and compiling personal information on the Internet and off, both overtly and
surreptitiously, is becoming increasingly efficient and effortless due to
advances in technology which have provided information gatherers the
ability to compile seamlessly highly detailed personal histories of
individuals.</text>
</paragraph><paragraph id="HD0D1A3AA7AF34C93A419777B4D0C07B5"><enum>(9)</enum><text>Personal information requires greater privacy protection than is available on the day before the
date of the enactment of this Act. Vast amounts of personal information,
including sensitive information, about individuals are collected on and
off the Internet, often combined and sold or otherwise transferred to
third parties, for purposes unknown to an individual to whom the
personally identifiable information pertains.</text>
</paragraph><paragraph id="H5149B483E5AC4E9D9249AFD355BD00ED"><enum>(10)</enum><text>Toward the close of the 20th century, as individuals' personal information was increasingly
collected, profiled, and shared for commercial purposes, and as technology
advanced to facilitate these practices, Congress enacted numerous statutes
to protect privacy.</text>
</paragraph><paragraph id="HEABA7675DD9A4606A0903A8546DDC711"><enum>(11)</enum><text>Those statutes apply to the government, telephones, cable television, e-mail, video tape rentals,
and the Internet (but only with respect to children and law enforcement
requests).</text>
</paragraph><paragraph id="H4B3687431A484F93B35DA29754E0A955"><enum>(12)</enum><text>As in those instances, the Federal Government has a substantial interest in creating a level
playing field of protection across all collectors of personally
identifiable information, both in the United States and abroad.</text>
</paragraph><paragraph id="HD679DDA5884541658C4E325DB9EAAAC4"><enum>(13)</enum><text>Enhancing individual privacy protection in a balanced way that establishes clear, consistent rules,
both domestically and internationally, will stimulate commerce by
instilling greater consumer confidence at home and greater confidence
abroad as more and more entities digitize personally identifiable
information, whether collected, stored, or used online or offline.</text>
</paragraph></section><section id="H43EB06026C34400781AF1143F7A07F8A"><enum>103.</enum><header>Definitions</header>
<subsection id="H6E6B684095974582BB731D3A36DF0CF2"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">Subject to subsection (b), in this title:</text>
<paragraph id="H5EC96635817E49FD939B6D48A9B03321"><enum>(1)</enum><header>Commission</header><text>The term <term>Commission</term> means the Federal Trade Commission.</text>
</paragraph><paragraph id="H4E35FE265FAE42DFB8AD135588C0F4CE"><enum>(2)</enum><header>Covered entity</header><text>The term <term>covered entity</term> means any person to whom this title applies under section 151.</text>
</paragraph><paragraph id="H484A55D9D7D743B2885DB84A1E7FF81D"><enum>(3)</enum><header>Covered information</header>
<subparagraph id="H1D591034C4D4483FA3511D0BC21FB33B"><enum>(A)</enum><header>In general</header><text>Except as provided in subparagraph (B), the term <term>covered information</term> means only the following:</text>
<clause id="HBD987122321C427BBAFFB3CD74971650"><enum>(i)</enum><text>Personally identifiable information.</text>
</clause><clause id="H478A8D1526984034B57BDDD7CCD4C46B"><enum>(ii)</enum><text>Unique identifier information.</text>
</clause><clause id="HC529D53618634F9ABCC3F045A85FBBF5"><enum>(iii)</enum><text>Any information that is collected, used, or stored in connection with personally identifiable
information or unique identifier information in a manner that may
reasonably be used by the party collecting the information to identify a
specific individual.</text>
</clause></subparagraph><subparagraph id="HBEA55F111D704CA094585EBFF65FA5E1"><enum>(B)</enum><header>Exception</header><text>The term <term>covered information</term> does not include the following:</text>
<clause id="H2C3CA090287F4E8B972EE81C86D0EBCD"><enum>(i)</enum><text>Personally identifiable information obtained from public records that is not merged with covered
information gathered elsewhere.</text>
</clause><clause id="H027EE672BE5841A291103B7058AB4439"><enum>(ii)</enum><text>Personally identifiable information that is obtained from a forum—</text>
<subclause id="H3B346BEF02D8456C81D619F8445908FF"><enum>(I)</enum><text>where the individual voluntarily shared the information or authorized the information to be shared;
and</text>
</subclause><subclause id="HD8F85F4D428547D9B7FAE086C4C90A5D"><enum>(II)</enum><text>that—</text>
<item id="H3C1516E73B384B9A9382BE91920B4FCF"><enum>(aa)</enum><text>is widely and publicly available and was not made publicly available in bad faith; and</text>
</item><item id="H17BCF9D592404FDA8CEAD5D88A192E9E"><enum>(bb)</enum><text>contains no restrictions on who can access and view such information.</text>
</item></subclause></clause><clause id="H0BDBB89910F84ED080E14EE9DB636C39"><enum>(iii)</enum><text>Personally identifiable information reported in public media.</text>
</clause><clause id="HB9546E2654A340C891B83125997DD402"><enum>(iv)</enum><text>Personally identifiable information dedicated to contacting an individual at the individual's place
of work.</text>
</clause></subparagraph></paragraph><paragraph id="H98972C235FBB4A8ABFFA28A336FB6CA2"><enum>(4)</enum><header>Established business relationship</header><text>The term <term>established business relationship</term> means, with respect to a covered entity and a person, a relationship formed with or without the
exchange of consideration, involving the establishment of an account by
the person with the covered entity for the receipt of products or services
offered by the covered entity.</text>
</paragraph><paragraph id="HDEFCAC23D39D4F47867452CC62804074"><enum>(5)</enum><header>Personally identifiable information</header><text>The term <term>personally identifiable information</term> means only the following:</text>
<subparagraph id="H9BF567ACC5784A9F9FC60C1D4A378357"><enum>(A)</enum><text>Any of the following information about an individual:</text>
<clause id="HE363A8823C7B4618ABED14EC1282BED9"><enum>(i)</enum><text>The first name (or initial) and last name of an individual, whether given at birth or time of
adoption, or resulting from a lawful change of name.</text>
</clause><clause id="H0D0F63D5519E4DE5A8FB1D4BD98EB89C"><enum>(ii)</enum><text>The postal address of a physical place of residence of such individual.</text>
</clause><clause id="HB0E08F162A954B0FAD447D159BAF3579"><enum>(iii)</enum><text>An e-mail address.</text>
</clause><clause id="HD4C9FEE00D9C4C679C20F6F9547C5F52"><enum>(iv)</enum><text>A telephone number or mobile device number.</text>
</clause><clause id="H24280BEDD0D3416DAC3E44BE25BA4C81"><enum>(v)</enum><text>A social security number or other government issued identification number issued to such
individual.</text>
</clause><clause id="H6C6B54C73D634EF68EADF5C1680EE28F"><enum>(vi)</enum><text>The account number of a credit card issued to such individual.</text>
</clause><clause id="H257EAFE61DCA450AAA8BD4A5390F4D2C"><enum>(vii)</enum><text>Unique identifier information that alone can be used to identify a specific individual.</text>
</clause><clause id="H271BBC2A388D40A6A18F718BE753A0F3"><enum>(viii)</enum><text>Biometric data about such individual, including fingerprints and retina scans.</text>
</clause></subparagraph><subparagraph id="H88885AF4A70F4A228396D40578028927"><enum>(B)</enum><text>If used, transferred, or stored in connection with 1 or more of the items of information described
in subparagraph (A), any of the following:</text>
<clause id="H48BC685B2F1D46918DE286F49FE07CD0"><enum>(i)</enum><text>A date of birth.</text>
</clause><clause id="H543A2D3FAA3A4EB1926C1FF2544826A8"><enum>(ii)</enum><text>The number of a certificate of birth or adoption.</text>
</clause><clause id="H6AB341072AE349E68C8A988705898195"><enum>(iii)</enum><text>A place of birth.</text>
</clause><clause id="H09B7BF6903994CFFB2BB45AAE7C900EC"><enum>(iv)</enum><text>Unique identifier information that alone cannot be used to identify a specific individual.</text>
</clause><clause id="HEC9999C0681E4CECB64331E4A126C3B5"><enum>(v)</enum><text>Precise geographic location, at the same degree of specificity as a global positioning system or
equivalent system, and not including any general geographic information
that may be derived from an Internet Protocol address.</text>
</clause><clause id="HF38328B5D4384DEABCBC426215BB2C45"><enum>(vi)</enum><text>Information about an individual's quantity, technical configuration, type, destination, location,
and amount of uses of voice services, regardless of technology used.</text>
</clause><clause id="HAD15A11E9B9C4351A57956AD7FFDC543"><enum>(vii)</enum><text>Any other information concerning an individual that may reasonably be used by the party using,
collecting, or storing that information to identify that individual.</text>
</clause></subparagraph></paragraph><paragraph id="HD617A9571BAC4286A762A0E512E89420"><enum>(6)</enum><header>Sensitive personally identifiable information</header><text>The term <term>sensitive personally identifiable information</term> means—</text>
<subparagraph id="HBAFF980AF50645378742B4CEBF77DABE"><enum>(A)</enum><text>personally identifiable information which, if lost, compromised, or disclosed without authorization
either alone or with other information, carries a significant risk of
economic or physical harm; or</text>
</subparagraph><subparagraph id="HA8551F71856F4243BF1B70F7B9BF4E24"><enum>(B)</enum><text>information related to—</text>
<clause id="H3CA4628934E94BDCA583174F24603401"><enum>(i)</enum><text>a particular medical condition or a health record; or</text>
</clause><clause id="H18215F03C95C4B32AD3B185B460F6502"><enum>(ii)</enum><text>the religious affiliation of an individual.</text>
</clause></subparagraph></paragraph><paragraph id="HB67521F8E5C5489E94079129C3073FD2"><enum>(7)</enum><header>Third party</header>
<subparagraph id="H27692722CD7E44AEB9FCAE5331D84A66"><enum>(A)</enum><header>In general</header><text>The term <term>third party</term> means, with respect to a covered entity, a person that—</text>
<clause id="H2A707A14E0394C7DBA6C2F3AD9B5D23D"><enum>(i)</enum><text>is—</text>
<subclause id="HD8F89EA85CDE4582A01B52D3A4FE6065"><enum>(I)</enum><text>not related to the covered entity by common ownership or corporate control; or</text>
</subclause><subclause id="H2B15816F752643FFA562807EA2487C7C"><enum>(II)</enum><text>related to the covered entity by common ownership or corporate control and an ordinary consumer
would not understand that the covered entity and the person were related
by common ownership or corporate control;</text>
</subclause></clause><clause id="HD5EB98D3A98644B09A10A641C7518C4C"><enum>(ii)</enum><text>is not a service provider used by the covered entity to receive personally identifiable information
or sensitive personally identifiable information in performing services or
functions on behalf of and under the instruction of the covered entity;
and</text>
</clause><clause id="H8ED4F188A2F94D04B72EE467AFEDFF66"><enum>(iii)</enum><text>with respect to the collection of covered information of an individual, does not have an
established business relationship with the individual and does not
identify itself to the individual at the time of such collection in a
clear and conspicuous manner that is visible to the individual.</text>
</clause></subparagraph><subparagraph id="HA368F09D0249410DB3D152918D3B0100"><enum>(B)</enum><header>Common brands</header><text>The term <term>third party</term> may include, with respect to a covered entity, a person who operates under a common brand with the
covered entity.</text>
</subparagraph></paragraph><paragraph id="H9918444341214C38A84B46AC992FFEB4"><enum>(8)</enum><header>Unauthorized use</header>
<subparagraph id="H41F906AFF71C49808DB2183A53267419"><enum>(A)</enum><header>In general</header><text>The term <term>unauthorized use</term> means the use of covered information by a covered entity or its service provider for any purpose
not authorized by the individual to whom such information relates.</text>
</subparagraph><subparagraph id="H602CBB04FB054A26A5F857C00E8B1C87"><enum>(B)</enum><header>Exceptions</header><text>Except as provided in subparagraph (C), the term <term>unauthorized use</term> does not include use of covered information relating to an individual by a covered entity or its
service provider as follows:</text>
<clause id="HA244D050A33F4226B2D95D749F959E67"><enum>(i)</enum><text>To process and enforce a transaction or deliver a service requested by that individual.</text>
</clause><clause id="H37BAFBB178A849D695B2D217322B8332"><enum>(ii)</enum><text>To operate the covered entity that is providing a transaction or delivering a service requested by
that individual, such as inventory management, financial reporting and
accounting, planning, and product or service improvement or forecasting.</text>
</clause><clause id="H1A38B6ED52214362A601CD34D83A9B80"><enum>(iii)</enum><text>To prevent or detect fraud or to provide for a physically or virtually secure environment.</text>
</clause><clause id="H3A9337A4491F4E108BC8FD257A492AEC"><enum>(iv)</enum><text>To investigate a possible crime.</text>
</clause><clause id="HED8398D52C2A4DAD9BCC15C3117C895E"><enum>(v)</enum><text>That is required by a provision of law or legal process.</text>
</clause><clause id="HD206F590056D4556A30423EBD7C97DBE"><enum>(vi)</enum><text>To market or advertise to an individual from a covered entity within the context of a covered
entity's own Internet website, services, or products if the covered
information used for such marketing or advertising was—</text>
<subclause id="HCB77C70DFDB047A59F13141F719E9011"><enum>(I)</enum><text>collected directly by the covered entity; or</text>
</subclause><subclause id="HE2B1ECD9D2E144F0AD9C38BAB37573B6"><enum>(II)</enum><text>shared with the covered entity—</text>
<item id="HCE45CBA065584B2BB754297A146704B1"><enum>(aa)</enum><text>at the affirmative request of the individual; or</text>
</item><item id="HB395ABD35A884545A95626DFF74EA424"><enum>(bb)</enum><text>by an entity with which the individual has an established business relationship.</text>
</item></subclause></clause><clause id="H60989B90B4DD493D952AA506C20DFB2F"><enum>(vii)</enum><text>Use that is necessary for the improvement of transaction or service delivery through research,
testing, analysis, and development.</text>
</clause><clause id="HE83F987A3C2D4D2AA72FFF7F13259A55"><enum>(viii)</enum><text>Use that is necessary for internal operations, including the following:</text>
<subclause id="H00731AE81E4C45F7BCA67C7D9EB1A7EE"><enum>(I)</enum><text>Collecting customer satisfaction surveys and conducting customer research to improve customer
service information.</text>
</subclause><subclause id="HF55290EAB942427091C0E24A556705B1"><enum>(II)</enum><text>Information collected by an Internet website about the visits to such website and the click-through
rates at such website—</text>
<item id="H557A9CD391354779BD8A208927B59032"><enum>(aa)</enum><text>to improve website navigation and performance; or</text>
</item><item id="HABB420A8375F4C78AC5BE58A38372DA9"><enum>(bb)</enum><text>to understand and improve the interaction of an individual with the advertising of a covered
entity.</text>
</item></subclause></clause><clause id="H3157559FBAC04F73A4B47C3B914BDEB4"><enum>(ix)</enum><text>Use—</text>
<subclause id="HEF2E418004F94E1CB195806E5FA9BCA2"><enum>(I)</enum><text>by a covered entity with which an individual has an established business relationship;</text>
</subclause><subclause id="H60138C64A6B54FC8AD4A2A8B4DD206EE"><enum>(II)</enum><text>which the individual could have reasonably expected, at the time such relationship was established,
was related to a service provided pursuant to such relationship; and</text>
</subclause><subclause id="H5186F7B8DD344A608E9AE017D1C2BE8B"><enum>(III)</enum><text>which does not constitute a material change in use or practice from what could have reasonably been
expected.</text>
</subclause></clause></subparagraph><subparagraph id="H8016F042E9BE418BBD49F13A0C0A37AF"><enum>(C)</enum><header>Savings</header><text>A use of covered information regarding an individual by a covered entity or its service provider
may only be excluded under subparagraph (B) from the definition of <quote>unauthorized use</quote> under subparagraph (A) if the use is reasonable and consistent with the practices and purposes
described in the notice given the individual in accordance with section
121(a)(1).</text>
</subparagraph></paragraph><paragraph id="HE5F9EC8B219142819F2CD2710B32E74C"><enum>(9)</enum><header>Unique identifier information</header><text>The term <term>unique identifier information</term> means a unique persistent identifier associated with an individual or a networked device,
including a customer number held in a cookie, a user ID, a processor
serial number, or a device serial number.</text>
</paragraph></subsection><subsection id="H7A752CE5489E47C8B049A147D58BCFC9"><enum>(b)</enum><header>Modified definition by rulemaking</header><text>If the Commission determines that a term defined in any of paragraphs (3) through (8) is not
reasonably sufficient to protect an individual from unfair or deceptive
acts or practices, the Commission may by rule modify such definition as
the Commission considers appropriate to protect such individual from an
unfair or deceptive act or practice to the extent that the Commission
determines will not unreasonably impede interstate commerce.</text>
</subsection></section><subtitle id="H623B24A96C194E3A9B4ED979CFF1302D"><enum>A</enum><header>Right to security and accountability</header>
<section id="H6006D8E315EE47FCA17A0D8A00A41DCD"><enum>111.</enum><header>Security</header>
<subsection id="H2D1C5E1CB2A046C799775F90AC66EA54"><enum>(a)</enum><header>Rulemaking required</header><text display-inline="yes-display-inline">Not later than 180 days after the date of the enactment of this Act, the Commission shall initiate
a rulemaking proceeding to require each covered entity to carry out
security measures to protect the covered information it collects and
maintains.</text>
</subsection><subsection id="HB394481C506D4E7D8BBBBB17238BD084"><enum>(b)</enum><header>Proportion</header><text display-inline="yes-display-inline">The requirements prescribed under subsection (a) shall provide for security measures that are
proportional to the size, type, nature, and sensitivity of the covered
information a covered entity collects.</text>
</subsection><subsection id="H02408741EE4146DAB5E8A56F4A614856"><enum>(c)</enum><header>Consistency</header><text>The requirements prescribed under subsection (a) shall be consistent with guidance provided by the
Commission and recognized industry practices for safety and security on
the day before the date of the enactment of this Act.</text>
</subsection><subsection id="H047D3DDE1EF046D09BE8EEE2CC844689"><enum>(d)</enum><header>Technological means</header><text display-inline="yes-display-inline">In a rule prescribed under subsection (a), the Commission may not require a specific technological
means of meeting a requirement.</text>
</subsection></section><section id="HD420441EBBA34A55BB2946B55B8BA79F"><enum>112.</enum><header>Accountability</header><text display-inline="no-display-inline">Each covered entity shall, in a manner proportional to the size, type, and nature of the covered
information it collects—</text>
<paragraph id="HDCA62656B5804D6DB7F706548CD5AAAD"><enum>(1)</enum><text>have managerial accountability, proportional to the size and structure of the covered entity, for
the adoption and implementation of policies consistent with this title;</text>
</paragraph><paragraph id="HA523F5B13F4A4A348B88B0ECEC6BD768"><enum>(2)</enum><text>have a process to respond to non-frivolous inquiries from individuals regarding the collection,
use, transfer, or storage of covered information relating to such
individuals; and</text>
</paragraph><paragraph id="HC5DC875522F44F4882400F3A1223F9CE"><enum>(3)</enum><text>describe the means of compliance of the covered entity with the requirements of this Act upon
request from—</text>
<subparagraph id="HFA577090AE424DC3913E2827BF4D6B12"><enum>(A)</enum><text>the Commission; or</text>
</subparagraph><subparagraph id="H1A404D54D9874EE6840A575CE3033266"><enum>(B)</enum><text>an appropriate safe harbor program established under section 151.</text>
</subparagraph></paragraph></section><section id="H961AA71F3725435F8A27D777C39F992F"><enum>113.</enum><header>Privacy by design</header><text display-inline="no-display-inline">Each covered entity shall, in a manner proportional to the size, type, and nature of the covered
information that it collects, implement a comprehensive information
privacy program by—</text>
<paragraph id="HFDC481671832406BBD62E96898CDBC0C"><enum>(1)</enum><text>incorporating necessary development processes and practices throughout the product life cycle that
are designed to safeguard the personally identifiable information that is
covered information of individuals based on—</text>
<subparagraph id="HB95783A811D341D8990BA52837312A29"><enum>(A)</enum><text>the reasonable expectations of such individuals regarding privacy; and</text>
</subparagraph><subparagraph id="HF5BEB17C64EC4A3B8DCD892049A89550"><enum>(B)</enum><text>the relevant threats that need to be guarded against in meeting those expectations; and</text>
</subparagraph></paragraph><paragraph id="H0B33BA6C68954CA19E8D7D495C6CCED4"><enum>(2)</enum><text>maintaining appropriate management processes and practices throughout the data life cycle that are
designed to ensure that information systems comply with—</text>
<subparagraph id="H1D4ECA3B90BD4695BCD0C556A630E96E"><enum>(A)</enum><text>the provisions of this title;</text>
</subparagraph><subparagraph id="HD58CA29722304D66864A318B48E49EA0"><enum>(B)</enum><text>the privacy policies of a covered entity; and</text>
</subparagraph><subparagraph id="HFD64153B9A714A6E9FB8E89BDB151877"><enum>(C)</enum><text>the privacy preferences of individuals that are consistent with the consent choices and related
mechanisms of individual participation as described in section 122.</text>
</subparagraph></paragraph></section></subtitle><subtitle id="H92B96676AD7E46B88EDD75F30FB0C34E"><enum>B</enum><header>Right to notice and individual participation</header>
<section id="H72A839B546774CDAB01E8C34E2F17671"><enum>121.</enum><header>Transparent notice of practices and purposes</header>
<subsection id="H59D847891EEC48C582A8D039477CECDF"><enum>(a)</enum><header>In general</header><text>Not later than 60 days after the date of the enactment of this Act, the Commission shall initiate a
rulemaking proceeding to require each covered entity—</text>
<paragraph id="H91B538D99383493C90484FA6E7B40153"><enum>(1)</enum><text>to provide accurate, clear, concise, and timely notice to individuals of—</text>
<subparagraph id="H7E38660342054B3B8260E9CC8C757A61"><enum>(A)</enum><text>the practices of the covered entity regarding the collection, use, transfer, and storage of covered
information; and</text>
</subparagraph><subparagraph id="HFEA0A21273564D6DA3675D0BF18C1B65"><enum>(B)</enum><text>the specific purposes of those practices;</text>
</subparagraph></paragraph><paragraph id="HECFC4A541A144A129ADBEF6079AAFECD"><enum>(2)</enum><text>to provide accurate, clear, concise, and timely notice to individuals before implementing a
material change in such practices; and</text>
</paragraph><paragraph id="H88AFBCC5F34B44AF9077AF93D9612454"><enum>(3)</enum><text>to maintain the notice required by paragraph (1) in a form that individuals can readily access.</text>
</paragraph></subsection><subsection id="H7FB40518348D4F72A5CEDAA16BED507D"><enum>(b)</enum><header>Compliance and other considerations</header><text>In the rulemaking required by subsection (a), the Commission—</text>
<paragraph id="HD5322F94775646F183942E68646DCAD5"><enum>(1)</enum><text>shall consider the types of devices and methods individuals will use to access the required notice;</text>
</paragraph><paragraph id="H63493DB00AAE4B85B024AB3EB8AFF37E"><enum>(2)</enum><text>may provide that a covered entity unable to provide the required notice when information is
collected may comply with the requirement of subsection (a)(1) by
providing an alternative time and means for an individual to receive the
required notice promptly;</text>
</paragraph><paragraph id="H0795E06F6C89424591241B29B35637A3"><enum>(3)</enum><text>may draft guidance for covered entities to use in designing their own notice and may include a
draft model template for covered entities to use in designing their own
notice; and</text>
</paragraph><paragraph id="H860066C5E8D848F6AD3BA2BB199451C2"><enum>(4)</enum><text>may provide guidance on how to construct computer-readable notices or how to use other technology
to deliver the required notice.</text>
</paragraph></subsection></section><section id="H8BDA0619D0254E5EBC56C1DFD0079C5A"><enum>122.</enum><header>Individual participation</header>
<subsection id="H8AB0B74EF6304E209315CB2AE0FCB2E8"><enum>(a)</enum><header>In general</header><text>Not later than 180 days after the date of the enactment of this Act, the Commission shall initiate
a rulemaking proceeding to require each covered entity—</text>
<paragraph id="H58BD1B5BC950432E971C05A810056046"><enum>(1)</enum><text>to offer individuals a clear and conspicuous mechanism for opt-in consent for any use of their
covered information that would otherwise be unauthorized use;</text>
</paragraph><paragraph id="H892D28DB57B54CCB89BA32F4213593EA"><enum>(2)</enum><text>to offer individuals a robust, clear, and conspicuous mechanism for opt-in consent for the use by
third parties of the individuals' covered information for behavioral
advertising or marketing;</text>
</paragraph><paragraph id="HA93F149E8A8E483FB026ACBD696BD73C"><enum>(3)</enum><text>to provide any individual to whom the personally identifiable information that is covered
information pertains, and which the covered entity or its service provider
stores, appropriate and reasonable—</text>
<subparagraph id="HC5CC62F82B9643C080BEECAB2F1443CB"><enum>(A)</enum><text>access to such information; and</text>
</subparagraph><subparagraph id="H650E4C04028B4A2A9C0A31DFECD0C66A"><enum>(B)</enum><text>mechanisms to correct such information to improve the accuracy of such information; and</text>
</subparagraph></paragraph><paragraph id="H00B0B20ECB364D148602683664F206D9"><enum>(4)</enum><text>in the case that a covered entity enters bankruptcy or an individual requests the termination of a
service provided by the covered entity to the individual or termination of
some other relationship with the covered entity, to permit the individual
to easily request that—</text>
<subparagraph id="H3495D8CB89AE43F0AD130B9EACDBD53A"><enum>(A)</enum><text>all of the personally identifiable information that is covered information that the covered entity
maintains relating to the individual, except for information the
individual authorized the sharing of or which the individual shared with
the covered entity in a forum that is widely and publicly available, be
rendered not personally identifiable; or</text>
</subparagraph><subparagraph id="HB94BC0AD5F52481CA5C72AE7D984AB6F"><enum>(B)</enum><text>if rendering such information not personally identifiable is not possible, to cease the
unauthorized use or transfer to a third party for an unauthorized use of
such information or to cease use of such information for marketing, unless
such unauthorized use or transfer is otherwise required by a provision of
law.</text>
</subparagraph></paragraph></subsection><subsection id="HA4DAA478787E4A4BA6E7C06F3E691098"><enum>(b)</enum><header>Unauthorized use transfers</header><text>In the rulemaking required by subsection (a), the Commission shall provide that with respect to
transfers of covered information to a third party for which an individual
provides opt-in consent, the third party to which the information is
transferred may not use such information for any unauthorized use other
than a use—</text>
<paragraph id="H72F2C7EB08D943C9AFD092604254B826"><enum>(1)</enum><text>specified pursuant to the purposes stated in the required notice under section 121(a); and</text>
</paragraph><paragraph id="H89CAC2B2381544AD884E6ED82882CB12"><enum>(2)</enum><text>authorized by the individual when the individual granted consent for the transfer of the
information to the third party.</text>
</paragraph></subsection><subsection id="HEB0648891E954575A7102F435F30DB41"><enum>(c)</enum><header>Alternative means To terminate use of covered information</header><text>In the rulemaking required by subsection (a), the Commission shall allow a covered entity to
provide individuals an alternative means, in lieu of the access, consent,
and correction requirements, of prohibiting a covered entity from use or
transfer of that individual's covered information.</text>
</subsection><subsection id="HC12495F915FB4673A8E63484824E450C"><enum>(d)</enum><header>Service providers</header>
<paragraph id="H2A01BDB5894C4DB8BD198510B83E7B21"><enum>(1)</enum><header>In general</header><text>The use of a service provider by a covered entity to receive covered information in performing
services or functions on behalf of and under the instruction of the
covered entity does not constitute an unauthorized use of such information
by the covered entity if the covered entity and the service provider
execute a contract that requires the service provider to collect, use, and
store the information on behalf of the covered entity in a manner
consistent with—</text>
<subparagraph id="H59F18830BBB947B1AD069E531EF64DDE"><enum>(A)</enum><text>the requirements of this title; and</text>
</subparagraph><subparagraph id="HA17AF0BDFFA447E08576805E23691C7C"><enum>(B)</enum><text>the policies and practices related to such information of the covered entity.</text>
</subparagraph></paragraph><paragraph id="H7EBB68930627445EABFAABEE10E403EB"><enum>(2)</enum><header>Transfers between service providers for a covered entity</header><text>The disclosure by a service provider of covered information pursuant to a contract with a covered
entity to another service provider in order to perform the same service or
functions for that covered entity does not constitute an unauthorized use.</text>
</paragraph><paragraph id="HC21B063127B240C2BCAECF9A2AC8C575"><enum>(3)</enum><header>Liability remains with covered entity</header><text>A covered entity remains responsible and liable for the protection of covered information that has
been transferred to a service provider for processing, notwithstanding any
agreement to the contrary between a covered entity and the service
provider.</text>
</paragraph></subsection></section></subtitle><subtitle id="H8CBE7EA21E05422EAE7D99A0884F51B0"><enum>C</enum><header>Rights relating to data minimization, constraints on distribution, and data integrity</header>
<section id="H9B112DE2A587472B966DB5E2F39A2928"><enum>131.</enum><header>Data minimization</header><text display-inline="no-display-inline">Each covered entity shall—</text>
<paragraph id="H44114CAB379340BCA601C8336DC18065"><enum>(1)</enum><text>collect only as much covered information relating to an individual as is reasonably necessary—</text>
<subparagraph id="HDE2DA68569F048628396687ECC4F9595"><enum>(A)</enum><text>to process or enforce a transaction or deliver a service requested by such individual;</text>
</subparagraph><subparagraph id="HA57B0399A31A4AC487B51A71E1B6EA74"><enum>(B)</enum><text>for the covered entity to provide a transaction or delivering a service requested by such
individual, such as inventory management, financial reporting and
accounting, planning, product or service improvement or forecasting, and
customer support and service;</text>
</subparagraph><subparagraph id="H07B99DDEB87F4E8B9A0E6555450A5960"><enum>(C)</enum><text>to prevent or detect fraud or to provide for a secure environment;</text>
</subparagraph><subparagraph id="H0CB16910F84F4981813E4CD1636E24A1"><enum>(D)</enum><text>to investigate a possible crime;</text>
</subparagraph><subparagraph id="H92A74F56B61F40419304E032796912C5"><enum>(E)</enum><text>to comply with a provision of law;</text>
</subparagraph><subparagraph id="HF416D3BCBA47484B8AC41898E8E20228"><enum>(F)</enum><text>for the covered entity to market or advertise to such individual if the covered information used
for such marketing or advertising was collected directly by the covered
entity; or</text>
</subparagraph><subparagraph id="H34359E4F78FD42D39FE95B6B52559754"><enum>(G)</enum><text>for internal operations, including—</text>
<clause id="H4850365206DE4EB7897E7C6B4537D6A4"><enum>(i)</enum><text>collecting customer satisfaction surveys and conducting customer research to improve customer
service; and</text>
</clause><clause id="HF9258BAF1FB647B5AD7B1C6B30A40ED3"><enum>(ii)</enum><text>collection from an Internet website of information about visits and click-through rates relating to
such website to improve—</text>
<subclause id="H3BEA3074A6694288BC133333D2EB97CC"><enum>(I)</enum><text>website navigation and performance; and</text>
</subclause><subclause id="H16E10116A7A24F72840C267F53073073"><enum>(II)</enum><text>the customer’s experience;</text>
</subclause></clause></subparagraph></paragraph><paragraph id="HA59510919D8B4C4F84B5F7E0AD2FE750"><enum>(2)</enum><text>retain covered information for only such duration as—</text>
<subparagraph id="HBDD8817070E24978A310A6A486C1E301"><enum>(A)</enum><text>with respect to the provision of a transaction or delivery of a service to an individual—</text>
<clause id="H6796DD831E5949E2A01BC3274344EEE5"><enum>(i)</enum><text>is necessary to provide such transaction or deliver such service to such individual; or</text>
</clause><clause id="HCEB06A4FA1294150AB17A5FB26ECDFEE"><enum>(ii)</enum><text>if such service is ongoing, is reasonable for the ongoing nature of the service; or</text>
</clause></subparagraph><subparagraph id="HA92689A0B3FC4A7E91D75D0BDBBBE9A6"><enum>(B)</enum><text>is required by a provision of law;</text>
</subparagraph></paragraph><paragraph id="H9B72D571B9F64D67832A0313DC58136D"><enum>(3)</enum><text>retain covered information only for the purpose it was collected, or reasonably related purposes;
and</text>
</paragraph><paragraph id="H8F59C81CE40F4EA49E8157FFA981092A"><enum>(4)</enum><text>exercise reasonable data retention procedures with respect to both the initial collection and
subsequent retention.</text>
</paragraph></section><section id="H189E60D8C6D8402BBDFAE104F2508EB2"><enum>132.</enum><header>Constraints on distribution of information</header>
<subsection id="H796EEF9765F14CB2B4C48F77642B5CBF"><enum>(a)</enum><header>In general</header><text>Each covered entity shall—</text>
<paragraph id="H778B268EC6E049D6B3F2B8FE8FBA7CE3"><enum>(1)</enum><text>require by contract that any third party to which it transfers covered information use the
information only for purposes that are consistent with—</text>
<subparagraph id="HC1F022EF2A964A8D9EC2617CC9D52F10"><enum>(A)</enum><text>the provisions of this title; and</text>
</subparagraph><subparagraph id="H6F558D4C29474F89B0B94593D5184BF4"><enum>(B)</enum><text>as specified in the contract;</text>
</subparagraph></paragraph><paragraph id="H4749FD96818C49DC865D8965A06FBEFD"><enum>(2)</enum><text>require by contract that such third party may not combine information that the covered entity has
transferred to it, that relates to an individual, and that is not
personally identifiable information with other information in order to
identify such individual, unless the covered entity has obtained the
opt-in consent of such individual for such combination and identification;
and</text>
</paragraph><paragraph id="H4E0984CC987A4F49B431B366CFB8E55E"><enum>(3)</enum><text>before executing a contract with a third party—</text>
<subparagraph id="H17206024723B4538B6E731DA1A966702"><enum>(A)</enum><text>assure through due diligence that the third party is a legitimate organization; and</text>
</subparagraph><subparagraph id="HE4EA42CD3EB943079E4792FA493EFF05"><enum>(B)</enum><text>in the case of a material violation of the contract, at a minimum notify the Commission of such
violation.</text>
</subparagraph></paragraph></subsection><subsection id="H992F6536625A4F5EB7EDA592B044BFBC"><enum>(b)</enum><header>Transfers to unreliable third parties prohibited</header><text>A covered entity may not transfer covered information to a third party that the covered entity
knows—</text>
<paragraph id="H99F6753AF7014A0386B8780FBFE0D407"><enum>(1)</enum><text>has intentionally or willfully violated a contract required by subsection (a); and</text>
</paragraph><paragraph id="H1B9B7DF7CDEB4624AEF0B3BA1E8E2D61"><enum>(2)</enum><text>is reasonably likely to violate such contract.</text>
</paragraph></subsection><subsection id="H7F0E26F1400D4DF98E158BC019F5AE84"><enum>(c)</enum><header>Application of rules to third parties</header>
<paragraph id="H6A8C38903EF349A382C7E061F16C1503"><enum>(1)</enum><header>In general</header><text>Except as provided in paragraph (2), a third party that receives covered information from a covered
entity shall be subject to the provisions of this Act as if it were a
covered entity.</text>
</paragraph><paragraph id="HF823403C671940BC80865C43E4A43D89"><enum>(2)</enum><header>Exemption</header><text>The Commission may, as it determines appropriate, exempt classes of third parties from liability
under any provision of subtitle B if the Commission finds that—</text>
<subparagraph id="H48F34D22C11E4DCFA279CA631717303A"><enum>(A)</enum><text>such class of third parties cannot reasonably comply with such provision; or</text>
</subparagraph><subparagraph id="H7ECB42E4EFE44B1BB54D9CDDDA03C695"><enum>(B)</enum><text>with respect to covered information relating to individuals that is transferred to such class,
compliance by such class with such provision would not sufficiently
benefit such individuals.</text>
</subparagraph></paragraph></subsection></section><section id="H3092D4EF83A24106A39D62D780E74189"><enum>133.</enum><header>Data integrity</header>
<subsection id="H5AE7ECD0B01144A2A019546C12A31452"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">Each covered entity shall attempt to establish and maintain reasonable procedures to ensure that
personally identifiable information that is covered information and
maintained by the covered entity is accurate in those instances where the
covered information could be used to deny consumers benefits or cause
significant harm.</text>
</subsection><subsection id="HA98762DFBACC4C239391858887101F7E"><enum>(b)</enum><header>Exception</header><text display-inline="yes-display-inline">Subsection (a) shall not apply to covered information of an individual maintained by a covered
entity that is provided—</text>
<paragraph id="HCDDF91395C684EE79A3C2CA37D3382D1"><enum>(1)</enum><text display-inline="yes-display-inline">directly to the covered entity by the individual;</text>
</paragraph><paragraph id="HBD3EF062C37B4DF1BDECFE136D49A6C5"><enum>(2)</enum><text display-inline="yes-display-inline">to the covered entity by another entity at the request of the individual;</text>
</paragraph><paragraph id="H7062E5B8F61F4BF98936E53DC5617D57"><enum>(3)</enum><text>to prevent or detect fraud; or</text>
</paragraph><paragraph id="H7AE9C4CF609D46EC83CF176C6FC64B83"><enum>(4)</enum><text>to provide for a secure environment.</text>
</paragraph></subsection></section></subtitle><subtitle id="H935170F677A548BBBFFDADF31619E9E1"><enum>D</enum><header>Right to notice of breaches of security</header>
<section id="H7AF4E0ABF83C45B8AEB7358028B6DF75"><enum>141.</enum><header>Definitions</header><text display-inline="no-display-inline">In this subtitle:</text>
<paragraph id="HC1DBD2416D8C4D95AF10B9B8CF13DD62"><enum>(1)</enum><header>Breach of security</header>
<subparagraph id="H1D9A700905FD4109BC9801E1D13E30F1"><enum>(A)</enum><header>In general</header><text>The term <term>breach of security</term> means compromise of the security, confidentiality, or integrity of, or loss of, data in electronic
form that results in, or there is a reasonable basis to conclude has
resulted in, unauthorized access to or acquisition of personally
identifiable information from a covered entity.</text>
</subparagraph><subparagraph id="HE1426E30CAAE40D08454137F33E6A0E2"><enum>(B)</enum><header>Exclusions</header><text>The term <term>breach of security</term> does not include—</text>
<clause id="H82127403A02147E8AAF0084FA45AEEFA"><enum>(i)</enum><text>a good faith acquisition of personally identifiable information by a covered entity, or an employee
or agent of a covered entity, if the personally identifiable information
is not subject to further use or unauthorized disclosure;</text>
</clause><clause id="H7E1BA7B574804465909D12238669F0DF"><enum>(ii)</enum><text>any lawfully authorized investigative, protective, or intelligence activity of a law enforcement or
an intelligence agency of the United States, a State, or a political
subdivision of a State; or</text>
</clause><clause id="H01AB72C6412749CFA40D7A1388C4D6EA"><enum>(iii)</enum><text>the release of a public record not otherwise subject to confidentiality or nondisclosure
requirements.</text>
</clause></subparagraph></paragraph><paragraph id="H2A2362A325204F8389467377281AD035"><enum>(2)</enum><header>Data in electronic form</header><text>The term <term>data in electronic form</term> means any data stored electronically or digitally on any computer system or other database,
including recordable tapes and other mass storage devices.</text>
</paragraph><paragraph id="H17ABE0D539524C4182EB1FF7A9665339"><enum>(3)</enum><header>Designated entity</header><text>The term <term>designated entity</term> means the Federal Government entity designated by the Secretary of Homeland Security under section
143(a).</text>
</paragraph><paragraph id="HC7BF3ECF22994A9AB4127F2EB23735B4"><enum>(4)</enum><header>Identity theft</header><text>The term <term>identity theft</term> means the unauthorized use of another person's personally identifiable information for the purpose
of engaging in commercial transactions under the identity of such other
person, including any contact that violates <external-xref legal-doc="usc" parsable-cite="usc/18/1028A">section 1028A</external-xref> of title 18,
United States Code.</text>
</paragraph><paragraph id="H47E5A114173644879A895D88046B7B80"><enum>(5)</enum><header>Major credit reporting agency</header><text>The term <term>major credit reporting agency</term> means a consumer reporting agency that compiles and maintains files on consumers on a nationwide
basis within the meaning of section 603(p) of the Fair Credit Reporting
Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1681a">15 U.S.C. 1681a(p)</external-xref>).</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="HDC47F8EFE6424DF2B42F474E40D564DC"><enum>(6)</enum><header>Service provider</header><text>The term <term>service provider</term> means a person that provides electronic data transmission, routing, intermediate and transient
storage, or connections to its system or network, where the person
providing such services does not select or modify the content of the
electronic data, is not the sender or the intended recipient of the data,
and does not differentiate personally identifiable information from other
information that such person transmits, routes, or stores, or for which
such person provides connections. Any such person shall be treated as a
service provider under this subtitle only to the extent that it is engaged
in the provision of such transmission, routing, intermediate and transient
storage, or connections.</text>
</paragraph></section><section id="H67A2DDD4EF9248DB8B081467EC1C90DA"><enum>142.</enum><header>Notice to individuals</header>
<subsection id="H0D4C93F6D85D4B1B94E737B7D469BFA6"><enum>(a)</enum><header>In general</header><text>A covered entity that owns or possesses data in electronic form containing personally identifiable
information, following the discovery of a breach of security of the system
maintained by the covered entity that contains such information, shall
notify—</text>
<paragraph id="HEF5E9D6C26134238AB1544E506692B27"><enum>(1)</enum><text>each individual who is a citizen or resident of the United States and whose personally identifiable
information has been, or is reasonably believed to have been, acquired or
accessed from the covered entity as a result of the breach of security;
and</text>
</paragraph><paragraph id="HFFFCA64CB5AC4552898ABA93636F0425"><enum>(2)</enum><text>the Commission, unless the covered entity has notified the designated entity under section 143.</text>
</paragraph></subsection><subsection id="H33B0EC4BED4149899C5CF447A650D22F"><enum>(b)</enum><header>Special notification requirements</header>
<paragraph id="HB2C5A8F18B2A4F299097F4594801E5BE"><enum>(1)</enum><header>Third parties</header><text>In the event of a breach of security of a system maintained by a third party that has been
contracted to maintain or process data in electronic form containing
personally identifiable information on behalf of a covered entity who owns
or possesses such data, the third party shall notify the covered entity of
the breach of security.</text>
</paragraph><paragraph id="H88C5F1EFCCC841648C413D72CB7A652A"><enum>(2)</enum><header>Service providers</header><text>If a service provider becomes aware of a breach of security of data in electronic form containing
personally identifiable information that is owned or possessed by another
covered entity that connects to or uses a system or network provided by
the service provider for the purpose of transmitting, routing, or
providing intermediate or transient storage of such data, the service
provider shall notify of the breach of security only the covered entity
who initiated such connection, transmission, routing, or storage if such
covered entity can be reasonably identified.</text>
</paragraph><paragraph id="H15ABC44B129E4A2F9208958A7ACE5A98"><enum>(3)</enum><header>Coordination of notification with credit reporting agencies</header>
<subparagraph id="H8E0AF93799A049E4A6721E48B9819E7D"><enum>(A)</enum><header>In general</header><text>If a covered entity is required to provide notification to more than 5,000 individuals under
subsection (a)(1), the covered entity also shall notify each major credit
reporting agency of the timing and distribution of the notices, except
when the only personally identifiable information that is the subject of
the breach of security is the individual's first name or initial and last
name, or address, or phone number, in combination with a credit or debit
card number, and any required security code.</text>
</subparagraph><subparagraph id="H11A5F7E281624089A3FC4140FE50A452"><enum>(B)</enum><header>Notice to credit reporting agencies before individuals</header><text>Such notice shall be given to each credit reporting agency without unreasonable delay and, if it
will not delay notice to the affected individuals, prior to the
distribution of notices to the affected individuals.</text>
</subparagraph></paragraph></subsection><subsection id="HF6F0748C40F240F884F2FF0CD727E829"><enum>(c)</enum><header>Timeliness of notification</header>
<paragraph id="H6731EB7775CD4E02901F24FFE13AAEF1"><enum>(1)</enum><header>In general</header><text>All notifications required under this section shall be made without unreasonable delay following
the discovery by the covered entity of a security breach.</text>
</paragraph><paragraph id="HE29A8509218B4EA295C699D14930714C"><enum>(2)</enum><header>Reasonable delay</header>
<subparagraph id="H7AB451D36F0C4909B8FBE7995DB7ACDF"><enum>(A)</enum><header>In general</header><text>Reasonable delay under this subsection may include any time necessary to determine the scope of the
security breach, prevent further disclosures, restore the reasonable
integrity of the data system, and provide notice to law enforcement when
required.</text>
</subparagraph><subparagraph id="H7F2BD7F2A1004D0EB2C2415F44568CC2"><enum>(B)</enum><header>Extension</header>
<clause id="H36B58279BFC543DDAA7FC974149DF646"><enum>(i)</enum><header>In general</header><text>Except as provided in subsection (d), delay of notification shall not exceed 60 days following the
discovery of the security breach, unless the covered entity requests an
extension of time and the Commission determines in writing that additional
time is reasonably necessary to determine the scope of the security
breach, prevent further disclosures, restore the reasonable integrity of
the data system, or to provide notice to the designated entity.</text>
</clause><clause id="HEEB5EE355FB14B2BBF528FD540FCE81F"><enum>(ii)</enum><header>Approval of request</header><text>If the Commission approves the request for delay, the covered entity may delay the period for
notification for additional periods of up to 30 days.</text>
</clause></subparagraph></paragraph><paragraph id="H83B3B9CB2C2342778B21225D254B111C"><enum>(3)</enum><header>Burden of production</header><text>The covered entity, third party, or service provider required to provide notice under this title
shall, upon the request of the Commission provide records or other
evidence of the notifications required under this subtitle, including to
the extent applicable, the reasons for any delay of notification.</text>
</paragraph></subsection><subsection id="H414A022C4656421BA760F61D93194557"><enum>(d)</enum><header>Method and content of notification</header>
<paragraph id="HFFE7E2FE8B804D638882FD6F313F47A7"><enum>(1)</enum><header>Direct notification</header>
<subparagraph id="HC975E9489D6940CD8458260D10AFC2AB"><enum>(A)</enum><header>Method of direct notification</header><text>Except as provided in paragraph (2), a covered entity shall be in compliance with the notification
requirement under subsection (a)(1) if—</text>
<clause id="HC580AC2C403C453FA131F467C3C1A6AF"><enum>(i)</enum><text>the covered entity provides conspicuous and clearly identified notification—</text>
<subclause id="HB5796199E0154D318806231C90C925D8"><enum>(I)</enum><text>in writing; or</text>
</subclause><subclause id="HA382BAFC2171480589F404EDC0E69DBA"><enum>(II)</enum><text>by e-mail or other electronic means if—</text>
<item id="H2F4C7F64CB2845D38D9234814779CE93"><enum>(aa)</enum><text>the covered entity's primary method of communication with the individual is by e-mail or such other
electronic means; or</text>
</item><item id="HB5776973AE7A406F88B8B2F50175C067"><enum>(bb)</enum><text>the individual has consented to receive notification by e-mail or such other electronic means and
such notification is provided in a manner that is consistent with the
provisions permitting electronic transmission of notices under section 101
of the Electronic Signatures in Global and National Commerce Act (15
U.S.C. 7001); and</text>
</item></subclause></clause><clause id="H2369FE39DC3E4BB1A53C5245DD0E6A7D"><enum>(ii)</enum><text>the method of notification selected under clause (i) can reasonably be expected to reach the
intended individual.</text>
</clause></subparagraph><subparagraph id="HC5261347F133434C935C952830159F29"><enum>(B)</enum><header>Content of direct notification</header><text>Each method of notification under subparagraph (A) shall include the following:</text>
<clause id="HE035689175DA4131935220C63A5FDFF9"><enum>(i)</enum><text>The date, estimated date, or estimated date range of the breach of security.</text>
</clause><clause id="H986E5055F9EA40F0A6CBCE6CE347F037"><enum>(ii)</enum><text>A description of the personally identifiable information that was or is reasonably believed to have
been acquired or accessed as a result of the breach of security.</text>
</clause><clause id="H57D5D6DCB124431AA975290288B2FE00"><enum>(iii)</enum><text>A telephone number that an individual can use at no cost to the individual to contact the covered
entity to inquire about the breach of security or the information the
covered entity maintained about that individual.</text>
</clause><clause id="H008E5A1FCBB34B29A02B541A87C09B6D"><enum>(iv)</enum><text>Notice that the individual may be entitled to consumer credit reports under subsection (e)(1).</text>
</clause><clause id="H73A34183810D431BAC9DD7E53DDCD0F0"><enum>(v)</enum><text>Instructions how an individual can request consumer credit reports under subsection (e)(1).</text>
</clause><clause id="H8AC28BC8BA20439CBF125C3089598F6D"><enum>(vi)</enum><text>A telephone number, that an individual can use at no cost to the individual, and an address to
contact each major credit reporting agency.</text>
</clause><clause id="H62E778D4769747CBBAEA053451A94589"><enum>(vii)</enum><text>A telephone number, that an individual can use at no cost to the individual, and an Internet
website address to obtain information regarding identity theft from the
Commission.</text>
</clause></subparagraph></paragraph><paragraph id="H054DF2039B204BDE970736A71D83C5F8"><enum>(2)</enum><header>Substitute notification</header>
<subparagraph id="HEAC6A9961E5C4515B14DA038927486E5"><enum>(A)</enum><header>Circumstances giving rise to substitute notification</header><text>A covered entity required to provide notification to individuals under subsection (a)(1) may
provide notification under this paragraph instead of paragraph (1) of this
subsection if—</text>
<clause id="H4CFC8AA9E3A64B3CAA7824D53F07EAB0"><enum>(i)</enum><text>notification under paragraph (1) is not feasible due to lack of sufficient contact information for
the individual required to be notified; or</text>
</clause><clause id="H6A08242D018C4C5DA14E8F08659AF09A"><enum>(ii)</enum><text>the covered entity owns or possesses data in electronic form containing personally identifiable
information of fewer than 10,000 individuals and direct notification is
not feasible due to excessive cost to the covered entity required to
provide such notification relative to the resources of such covered
entity, as determined in accordance with the regulations issued by the
Commission under paragraph (3)(A).</text>
</clause></subparagraph><subparagraph id="H0939C36F43C746058A44700C775760F5"><enum>(B)</enum><header>Method of substitute notification</header><text>Notification under this paragraph shall include the following:</text>
<clause id="H5D87DE1D54DD4EE2958FF9F1EB7709B2"><enum>(i)</enum><text>Conspicuous and clearly identified notification by e-mail to the extent the covered entity has an
e-mail address for an individual who is entitled to notification under
subsection (a)(1).</text>
</clause><clause id="HC6658875101B491C968DF7D715E21391"><enum>(ii)</enum><text>Conspicuous and clearly identified notification on the Internet website of the covered entity if
the covered entity maintains an Internet website.</text>
</clause><clause id="HA76BD8E66A824C4E8C130F8A07BCAB32"><enum>(iii)</enum><text>Notification to print and to broadcast media, including major media in metropolitan and rural areas
where the individuals whose personally identifiable information was
acquired or accessed reside.</text>
</clause></subparagraph><subparagraph id="HA9294C13C42E435289E25C4D5D16D74A"><enum>(C)</enum><header>Content of substitute notification</header><text>Each method of notification under this paragraph shall include the following:</text>
<clause id="HE58B594AD1B34797897EDB1090838A5D"><enum>(i)</enum><text>The date, estimated date, or estimated date range of the breach of security.</text>
</clause><clause id="HF466E60D484142BE98404BD2549060E3"><enum>(ii)</enum><text>A description of the types of personally identifiable information that were or are reasonably
believed to have been acquired or accessed as a result of the breach of
security.</text>
</clause><clause id="H81132B00549245A490DC020BD863B076"><enum>(iii)</enum><text>Notice that an individual may be entitled to consumer credit reports under subsection (e)(1).</text>
</clause><clause id="HEDA1C5DB29904C0A8F79475F8D7AA5C3"><enum>(iv)</enum><text>Instructions how an individual can request consumer credit reports under subsection (e)(1).</text>
</clause><clause id="H8F125FE7902A41E7A1C1B7F88F67727B"><enum>(v)</enum><text>A telephone number that an individual can use at no cost to the individual to learn whether the
individual's personally identifiable information is included in the breach
of security.</text>
</clause><clause id="H1B20361BA62E48798A86EAA19AA9B29A"><enum>(vi)</enum><text>A telephone number, that an individual can use at no cost to the individual, and an address to
contact each major credit reporting agency.</text>
</clause><clause id="H2B16438946844FB68139BA6CF0658A22"><enum>(vii)</enum><text>A telephone number, that an individual can use at no cost to the individual, and an Internet
website address to obtain information from the Commission regarding
identity theft.</text>
</clause></subparagraph></paragraph><paragraph id="H4377F01ED2C345CB9A9F53A2C267B27A"><enum>(3)</enum><header>Regulations and guidance</header>
<subparagraph id="H986B95E2AFBE4508BAFD080B4A041466"><enum>(A)</enum><header>Regulations concerning substitute notification</header>
<clause id="H330F8F6771F14D42B1673DE79F18DF36"><enum>(i)</enum><header>In general</header><text>Not later than 1 year after the date of the enactment of this Act, the Commission shall prescribe
criteria for determining circumstances under which notification may be
provided under paragraph (2), including criteria for determining whether
providing notification under paragraph (1) is not feasible due to
excessive costs to the covered entity required to provide such
notification relative to the resources of such covered entity.</text>
</clause><clause id="HD2527DBDFA3044999CC9CD2078F9E895"><enum>(ii)</enum><header>Other circumstances</header><text>The regulations required by clause (i) may also identify other circumstances in which notification
under paragraph (2) would be appropriate, including circumstances under
which the cost of providing direct notification exceeds the benefits to
individuals.</text>
</clause></subparagraph><subparagraph id="H8B5111F601944C68A1B029543A9AA5A0"><enum>(B)</enum><header>Guidance</header>
<clause id="H8B4352AAE5AD44E3905619D1F4B5643F"><enum>(i)</enum><header>In general</header><text>The Commission, in consultation with the Administrator of the Small Business Administration, shall
publish and otherwise make available general guidance with respect to
compliance with this subsection.</text>
</clause><clause id="H42ED4FBAF7DA46C1859463CCD5E9A701"><enum>(ii)</enum><header>Contents</header><text>The guidance required by clause (i) shall include the following:</text>
<subclause id="H9976CD34F36C4F9BBABCC530F849EAF1"><enum>(I)</enum><text>A description of written or e-mail notification that complies with paragraph (1).</text>
</subclause><subclause id="H798A1B6DB32F4E788ADE539E00102A2C"><enum>(II)</enum><text>Guidance on the content of notification under paragraph (2), including the extent of notification
to print and broadcast media that complies with subparagraph (B)(iii) of
such paragraph.</text>
</subclause></clause></subparagraph></paragraph></subsection><subsection id="HD341BEDEFF0644EE9413D5559DBC266B"><enum>(e)</enum><header>Other obligations following breach</header>
<paragraph id="H8380D59B12134787A313B54BF49DD11D"><enum>(1)</enum><header>In general</header><text>Subject to the provisions of this subsection, not later than 60 days after the date of a request by
an individual who received notification under subsection (a)(1) and
quarterly thereafter for 2 years, a covered entity required to provide
notification under such subsection to such individual shall provide, or
arrange for the provision of, to such individual at no cost to such
individual, consumer credit reports from at least 1 major credit reporting
agency.</text>
</paragraph><paragraph id="H39E089398570460893E0DDA4A834C8AE"><enum>(2)</enum><header>Limitation</header><text>Paragraph (1) shall not apply if the only personally identifiable information that is the subject
of the breach of security is the individual's first name or initial and
last name, or address, or phone number, in combination with a credit or
debit card number, and any required security code.</text>
</paragraph><paragraph id="H07BF06B12963418C82677443139A28D1"><enum>(3)</enum><header>Rulemaking</header><text>Not later than 1 year after the date of the enactment of this Act, the Commission shall prescribe
the following:</text>
<subparagraph id="HA16AD1A697704126B17A1F4E284581B9"><enum>(A)</enum><text>Criteria for determining the circumstances under which a covered entity required to provide
notification under subsection (a)(1) must provide or arrange for the
provision of free consumer credit reports under this subsection.</text>
</subparagraph><subparagraph id="HBDEB156FC7314A6499258A69F710E53D"><enum>(B)</enum><text>A simple process under which a covered entity that is a small business concern or small nonprofit
organization may request a full or a partial waiver or a modified or an
alternative means of complying with this subsection if providing free
consumer credit reports is not feasible due to excessive costs relative to
the resources of such covered entity and relative to the level of harm, to
affected individuals, caused by the breach of security.</text>
</subparagraph></paragraph><paragraph id="H7F07CA45D0C54D689D60E8B6348C73EB"><enum>(4)</enum><header>Definitions</header><text>In this subsection:</text>
<subparagraph id="H549156ECB5B54EE3B3A5BF7016CF4077"><enum>(A)</enum><header>Small business concern</header><text>The term <term>small business concern</term> has the meaning given such term under section 3 of the Small Business Act (<external-xref legal-doc="usc" parsable-cite="usc/15/632">15 U.S.C. 632</external-xref>).</text>
</subparagraph><subparagraph id="H42A00391B5534FC880E3985D21808AAD"><enum>(B)</enum><header>Small nonprofit organization</header><text>The term <term>small nonprofit organization</term> has the meaning the Commission shall give such term for purposes of this subsection.</text>
</subparagraph></paragraph></subsection><subsection id="H59256459A5D042C682857C5582036119"><enum>(f)</enum><header>Delay of notification authorized for national security and law enforcement purposes</header>
<paragraph id="H255F6771B8684689AC4C6EF0202C8A5F"><enum>(1)</enum><header>In general</header><text>If the United States Secret Service or the Federal Bureau of Investigation determines that
notification under this section would impede a criminal investigation or a
national security activity, such notification shall be delayed upon
written notice from the United States Secret Service or the Federal Bureau
of Investigation to the covered entity that experienced the breach of
security. The notification from the United States Secret Service or the
Federal Bureau of Investigation shall specify the period of delay
requested for national security or law enforcement purposes.</text>
</paragraph><paragraph id="H552B914D9CDA4A89B3091CB1D105F89C"><enum>(2)</enum><header>Subsequent delay of notification</header>
<subparagraph id="H959532797E7B4B3A9679A84307C01DCC"><enum>(A)</enum><header>In general</header><text>If the notification required under subsection (a)(1) is delayed pursuant to paragraph (1), a
covered entity shall give notice not more than 30 days after the day such
law enforcement or national security delay was invoked unless a Federal
law enforcement or intelligence agency provides written notification that
further delay is necessary.</text>
</subparagraph><subparagraph id="HA130BB94B111408F99320CB9217C96F2"><enum>(B)</enum><header>Written justification requirements</header>
<clause id="H7F526E4B8DC846AAA69199E8B598B063"><enum>(i)</enum><header>United States Secret Service</header><text>If the United States Secret Service instructs a covered entity to delay notification under this
section beyond the 30-day period set forth in subparagraph (A) (referred
to in this clause as <quote>subsequent delay</quote>), the United States Secret Service shall submit written justification for the subsequent delay to
the Secretary of Homeland Security before the subsequent delay begins.</text>
</clause><clause id="HA2A84A58010C4541982A1369868DE253"><enum>(ii)</enum><header>Federal Bureau of Investigation</header><text>If the Federal Bureau of Investigation instructs a covered entity to delay notification under this
section beyond the 30-day period set forth in subparagraph (A) (referred
to in this clause as <quote>subsequent delay</quote>), the Federal Bureau of Investigation shall submit written justification for the subsequent delay
to the Attorney General before the subsequent delay begins.</text>
</clause></subparagraph></paragraph><paragraph id="HD84E4787D1034304B8899238421834CF"><enum>(3)</enum><header>Law enforcement immunity</header><text>No cause of action shall lie in any court against any Federal agency for acts relating to the delay
of notification for national security or law enforcement purposes under
this subtitle.</text>
</paragraph></subsection><subsection id="HFF157229008D4790871B8556B9FB8435"><enum>(g)</enum><header>General exemption</header>
<paragraph id="HA8342ADA028B4CECBD17FD7662E11A0E"><enum>(1)</enum><header>In general</header><text>A covered entity shall be exempt from the requirements under this section if, following a breach of
security, the covered entity reasonably concludes that there is no
reasonable risk of identity theft, fraud, or other unlawful conduct.</text>
</paragraph><paragraph id="H8CCCC3BAA05F438ABB6068840D1EF084"><enum>(2)</enum><header>FTC guidance</header><text>Not later than 1 year after the date of the enactment of this Act, the Commission, after
consultation with the Director of the National Institute of Standards and
Technology, shall issue guidance regarding the application of the
exemption under paragraph (1).</text>
</paragraph></subsection><subsection id="H478E96AC51DA4A57BF0F37A6A236DC03"><enum>(h)</enum><header>Exemptions for national security and law enforcement purposes</header>
<paragraph id="HE6E05B9832B742AF920118FF8350594F"><enum>(1)</enum><header>In general</header><text>A covered entity shall be exempt from the notice requirements under this section if—</text>
<subparagraph id="H055BFC34ACBC44D6B009AB7C04E71FEA"><enum>(A)</enum><text>a determination is made—</text>
<clause id="H773680785F5C4F37BBDD04D9C9F16C0F"><enum>(i)</enum><text>by the United States Secret Service or the Federal Bureau of Investigation that notification of the
breach of security could be reasonably expected to reveal sensitive
sources and methods or similarly impede the ability of the Government to
conduct law enforcement or intelligence investigations; or</text>
</clause><clause id="H501C283CB4444B948F457030BD801D1A"><enum>(ii)</enum><text>by the Federal Bureau of Investigation that notification of the breach of security could be
reasonably expected to cause damage to the national security; and</text>
</clause></subparagraph><subparagraph id="H8758E2AA45F04CBEB08FD6806906BC68"><enum>(B)</enum><text>the United States Secret Service or the Federal Bureau of Investigation, as the case may be,
provides written notice of its determination under subparagraph (A) to the
covered entity.</text>
</subparagraph></paragraph><paragraph id="HD30739710BD34484BB2D846EBDEFAAFC"><enum>(2)</enum><header>United States Secret Service</header><text>If the United States Secret Service invokes an exemption under paragraph (1), the United States
Secret Service shall submit written justification for invoking the
exemption to the Secretary of Homeland Security before the exemption is
invoked.</text>
</paragraph><paragraph id="H484B10EF0A404BA4911ADB3A9B1CE476"><enum>(3)</enum><header>Federal Bureau of Investigation</header><text>If the Federal Bureau of Investigation invokes an exemption under paragraph (1), the Federal Bureau
of Investigation shall submit written justification for invoking the
exemption to the Attorney General before the exemption is invoked.</text>
</paragraph><paragraph id="HCF1A541FA08E4B0B924DA3EA54ACFDB8"><enum>(4)</enum><header>Immunity</header><text>No cause of action shall lie in any court against any Federal agency for acts relating to the
exemption from notification for national security or law enforcement
purposes under this subtitle.</text>
</paragraph><paragraph id="H32E019AC1313477AA005FB33D6BEDC06"><enum>(5)</enum><header>Reports</header><text>Not later than 540 days after the date of the enactment of this Act, and upon request by Congress
thereafter, the United States Secret Service and the Federal Bureau of
Investigation shall submit to Congress a report on the number and nature
of breaches of security subject to the exemptions for national security
and law enforcement purposes under this subsection.</text>
</paragraph></subsection><subsection id="H2EB237521A2947FF80F60D198518C4F5"><enum>(i)</enum><header>Financial fraud prevention exemption</header>
<paragraph id="H846B9BB9BAD648DA980F27DE87966034"><enum>(1)</enum><header>In general</header><text>A covered entity shall be exempt from the notice requirements under this section if the covered
entity utilizes or participates in a security program that—</text>
<subparagraph id="HE8AF89EB02964705A8D4D7493AEB0BBA"><enum>(A)</enum><text>effectively blocks the use of the personally identifiable information to initiate an unauthorized
financial transaction before it is charged to the account of the
individual; and</text>
</subparagraph><subparagraph id="H7D24184EB35A4C5C988BD27A6E95C34D"><enum>(B)</enum><text>provides notice to each affected individual after a breach of security that resulted in attempted
fraud or an attempted unauthorized transaction.</text>
</subparagraph></paragraph><paragraph id="H4335AC59755C4E0E85B545DE621BC1AD"><enum>(2)</enum><header>Limitations</header><text>An exemption under paragraph (1) shall not apply if—</text>
<subparagraph id="H6418A21095064973BB6C7C9B53E39464"><enum>(A)</enum><text>the breach of security includes personally identifiable information, other than a credit card
number or credit card security code, of any type; or</text>
</subparagraph><subparagraph id="HE111130259A2454FAD593C784955DBD9"><enum>(B)</enum><text>the breach of security includes both the individual's credit card number and the individual's first
and last name.</text>
</subparagraph></paragraph></subsection><subsection id="HCD6CF2E5D170428DAD2C7A8A48E7F89D"><enum>(j)</enum><header>Financial institutions regulated by Federal functional regulators</header>
<paragraph id="H2B5E279CE0F04B01BB6343368B5826C9"><enum>(1)</enum><header>In general</header><text>A covered financial institution shall be deemed in compliance with this section if—</text>
<subparagraph id="HB25F7B02265B437E8BE1F5B076B87681"><enum>(A)</enum><text>the Federal functional regulator with jurisdiction over the covered financial institution has
issued a standard by regulation or guideline under title V of the
Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6801">15 U.S.C. 6801 et seq.</external-xref>) that—</text>
<clause id="HAFB2F2198228465D9C9FFB7BAE29247C"><enum>(i)</enum><text>requires financial institutions within its jurisdiction to provide notification to individuals
following a breach of security; and</text>
</clause><clause id="H00CA155CE5444D1590CC186FDBFA0622"><enum>(ii)</enum><text>provides protections substantially similar to, or greater than, those required under this Act; and</text>
</clause></subparagraph><subparagraph id="H6CB5EFF56AC942E396D53BFC0D9F7CD7"><enum>(B)</enum><text>the covered financial institution is in compliance with the standard under subparagraph (A).</text>
</subparagraph></paragraph><paragraph id="H4BF4336A4A0C45BA8CA5C9B2EB620433"><enum>(2)</enum><header>Definitions</header><text>In this subsection:</text>
<subparagraph id="H98928D8183A2475CAD122EC24EB35807"><enum>(A)</enum><header>Covered financial institution</header><text>The term <term>covered financial institution</term> means a financial institution that is subject to—</text>
<clause id="H0B5DF71475E2404CB63053A87E446F8E"><enum>(i)</enum><text>the data security requirements of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6801">15 U.S.C. 6801 et seq.</external-xref>);</text>
</clause><clause id="H74347233F62844F19B15978CEEE22DFA"><enum>(ii)</enum><text>any implementing standard issued by regulation or guideline issued under that Act; and</text>
</clause><clause id="H895500EB1DFD47A9A1054132DF7920E2"><enum>(iii)</enum><text>the jurisdiction of a Federal functional regulator under that Act.</text>
</clause></subparagraph><subparagraph id="HA1B3F0C00124461EAFC7FFD39C5710BA"><enum>(B)</enum><header>Federal functional regulator</header><text>The term <term>Federal functional regulator</term> has the meaning given the term in section 509 of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6809">15 U.S.C. 6809</external-xref>).</text>
</subparagraph><subparagraph id="H02253FC5DA4D4DC4845D10C2746816ED"><enum>(C)</enum><header>Financial institution</header><text>The term <term>financial institution</term> has the meaning given the term in section 509 of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6809">15 U.S.C. 6809</external-xref>).</text>
</subparagraph></paragraph></subsection><subsection id="H8E8C3DFBF6FD465C86E4F688DBE663BF"><enum>(k)</enum><header>Exemption; health privacy</header>
<paragraph id="H930A99DA881941C3AAFA580506EE2D03"><enum>(1)</enum><header>Covered entity or business associate under HITECH Act</header><text>To the extent that a covered entity under this section acts as a covered entity or a business
associate under section 13402 of the Health Information Technology for
Economic and Clinical Health Act (<external-xref legal-doc="usc" parsable-cite="usc/42/17932">42 U.S.C. 17932</external-xref>), has the obligation to
provide notification to individuals following a breach of security under
that Act or its implementing regulations, and is in compliance with that
obligation, the covered entity shall be deemed in compliance with this
section.</text>
</paragraph><paragraph id="HB63CE0B78DA540C0A6768A994185EC9A"><enum>(2)</enum><header>Entity subject to HITECH Act</header><text>To the extent that a covered entity under this section acts as a vendor of personal health records,
a third party service provider, or other entity subject to section 13407
of the Health Information Technology for Economical and Clinical Health
Act (<external-xref legal-doc="usc" parsable-cite="usc/42/17937">42 U.S.C. 17937</external-xref>), has the obligation to provide notification to
individuals following a breach of security under that Act or its
implementing regulations, and is in compliance with that obligation, the
covered entity shall be deemed in compliance with this section.</text>
</paragraph><paragraph id="HB48C59786F9E44BDBD722FF7E16B9FF0"><enum>(3)</enum><header>Limitation of statutory construction</header><text>Nothing in this subtitle may be construed in any way to give effect to the sunset provision under
section 13407(g)(2) of the Health Information Technology for Economic and
Clinical Health Act (<external-xref legal-doc="usc" parsable-cite="usc/42/17937">42 U.S.C. 17937(g)(2)</external-xref>) or to otherwise limit or
affect the applicability, under section 13407 of that Act, of the
requirement to provide notification to individuals following a breach of
security for vendors of personal health records and each entity described
in clause (ii), (iii), or (iv) of section 13424(b)(1)(A) of that Act (42
U.S.C. 17953(b)(1)(A)).</text>
</paragraph></subsection><subsection id="H3DF46603AA9F460B8D53BC148B5DEDB3"><enum>(l)</enum><header>Internet website notice of Federal Trade Commission</header><text>If the Commission, upon receiving notification of any breach of security that is reported to the
Commission, finds that notification of the breach of security via the
Commission's Internet website would be in the public interest or for the
protection of consumers, the Commission shall place such a notice in a
clear and conspicuous location on its Internet website.</text>
</subsection><subsection id="HCFB06D78088A48FCACD1C4DFF59F41A7"><enum>(m)</enum><header>FTC study on notification in languages in addition to English</header><text>Not later than 1 year after the date of the enactment of this Act, the Commission shall conduct a
study on the feasibility and advisability of requiring notification
provided pursuant to subsection (d)(1) to be provided in a language in
addition to English to individuals known to speak only such other
language.</text>
</subsection></section><section id="H074458F557B449CABD8AD9E6B1BFE80C"><enum>143.</enum><header>Notice to law enforcement</header>
<subsection id="H1FF6D7143A7040E9B9C7CC5089314FF9"><enum>(a)</enum><header>Designation of Government entity To receive notice</header><text>Not later than 60 days after the date of the enactment of this Act, the Secretary of Homeland
Security shall designate a Federal Government entity to receive notice
under this section.</text>
</subsection><subsection id="HC8FCF1C3F0194BD0B9D332B63E1D9A7E"><enum>(b)</enum><header>Notice to designated entity</header><text>A covered entity shall notify the designated entity of a breach of security if—</text>
<paragraph id="H0AA886B8995E455C9732D1739110B23D"><enum>(1)</enum><text>the number of individuals whose personally identifiable information was, or is reasonably believed
to have been, acquired or accessed as a result of the breach of security
exceeds 10,000;</text>
</paragraph><paragraph id="HCCCEE6ED469247F8B320877973DF59AE"><enum>(2)</enum><text>the breach of security involves a database, networked or integrated databases, or other data system
containing the personally identifiable information of more than 1,000,000
individuals;</text>
</paragraph><paragraph id="HA67441F47D90412281DE7B8CE55D50BF"><enum>(3)</enum><text>the breach of security involves databases owned by the Federal Government; or</text>
</paragraph><paragraph id="H1C978D3376FE4F3B819636322F38FA1F"><enum>(4)</enum><text>the breach of security involves primarily personally identifiable information of individuals known
to the covered entity to be employees or contractors of the Federal
Government involved in national security or law enforcement.</text>
</paragraph></subsection><subsection id="HE9DF7BB0CF964AE0AE9EBB37846C31E1"><enum>(c)</enum><header>Content of notices</header>
<paragraph id="H4EBDDA22911246EFBD21D29F6C9E4A27"><enum>(1)</enum><header>In general</header><text>Each notice under subsection (b) shall contain the following:</text>
<subparagraph id="H7372FEC3AEE74426B6B6C2D21F9CAF70"><enum>(A)</enum><text>The date, estimated date, or estimated date range of the breach of security.</text>
</subparagraph><subparagraph id="HD711491465D448DFBE5BBD2E34F20FCC"><enum>(B)</enum><text>A description of the nature of the breach of security.</text>
</subparagraph><subparagraph id="H76EAE7FDE3F74538832A06075470545E"><enum>(C)</enum><text>A description of each type of personally identifiable information that was or is reasonably
believed to have been acquired or accessed as a result of the breach of
security.</text>
</subparagraph><subparagraph id="H4AE28B0A829045FB9949CF05568CDDD8"><enum>(D)</enum><text>A statement of each paragraph under subsection (b) that applies to the breach of security.</text>
</subparagraph></paragraph><paragraph id="HA3AB002BA189447AAAA059551BAFF9AB"><enum>(2)</enum><header>Construction</header><text>Nothing in this section shall be construed to require a covered entity to reveal specific or
identifying information about an individual as part of the notice under
paragraph (1).</text>
</paragraph></subsection><subsection id="H559AE593E8C446598D4085E7503EF75F"><enum>(d)</enum><header>Notice by designated entity</header><text>The designated entity shall promptly provide each notice it receives under subsection (b) to the
following:</text>
<paragraph id="H218CE03BD70841D1B02C5B8611532686"><enum>(1)</enum><text>The United States Secret Service.</text>
</paragraph><paragraph id="HB64423BFEBB946F180459C452333F443"><enum>(2)</enum><text>The Federal Bureau of Investigation.</text>
</paragraph><paragraph id="HCCBAD8832982441EB449FDE512394169"><enum>(3)</enum><text>The Commission.</text>
</paragraph><paragraph id="HD220FD542796498AB1AEA93E7813D42C"><enum>(4)</enum><text>The United States Postal Inspection Service, if the breach of security involves mail fraud.</text>
</paragraph><paragraph id="H904F0104E3324CAEB3E0F43A8428580E"><enum>(5)</enum><text>The attorney general of each State affected by the breach of security.</text>
</paragraph><paragraph id="HB2142113C8A04732A16F49A97E6CC0B5"><enum>(6)</enum><text>Such other Federal agencies as the designated entity considers appropriate for law enforcement,
national security, or data security purposes.</text>
</paragraph></subsection><subsection id="H51C8952A05734BD7AE3A9C6FE204A8C5"><enum>(e)</enum><header>Timing of notices</header><text>Notice under this section shall be delivered as follows:</text>
<paragraph id="H5ED1F67DEC634F0BB9668B06E97F3BB1"><enum>(1)</enum><text>Notice under subsection (b) shall be delivered as promptly as possible, but—</text>
<subparagraph id="HD77E804AC6A54C98AACABDBAD5589192"><enum>(A)</enum><text>not less than 3 business days before notification to an individual under section 142(a)(1); and</text>
</subparagraph><subparagraph id="H90BAE0E2A5A74638BF9C3DBF6320304D"><enum>(B)</enum><text>not later than 10 days after the date of discovery of the events requiring notice.</text>
</subparagraph></paragraph><paragraph id="H4313E9778E664C2EA215B18E60881CE8"><enum>(2)</enum><text>Notice under subsection (d) shall be delivered as promptly as possible, but not later than 1
business day after the date that the designated entity receives notice of
a breach of security from a covered entity.</text>
</paragraph></subsection></section></subtitle><subtitle id="H6CDAB2403CC84E849AC992670407672E"><enum>E</enum><header>Enforcement</header>
<section id="H2B1798D4F02D48EB90612D869E9F8AF1"><enum>151.</enum><header>General application</header><text display-inline="no-display-inline">The requirements of this title shall apply to any person who—</text>
<paragraph id="H4A1505B5C1434C7CA17E68F3886DF529"><enum>(1)</enum><text>collects, uses, transfers, or stores covered information concerning more than 5,000 individuals
during any consecutive 12-month period; and</text>
</paragraph><paragraph id="HFDD3D72569594CC69FDCBC0B66146F73"><enum>(2)</enum><text>is—</text>
<subparagraph id="H33C1A5C10574478387E3AFD2A7CCB090"><enum>(A)</enum><text>a person over which the Commission has authority pursuant to section 5(a)(2) of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(2)</external-xref>);</text>
</subparagraph><subparagraph id="H11F650A8862A43DFAE47BDE52CD255D8"><enum>(B)</enum><text>a common carrier subject to the <act-name parsable-cite="CA34">Communications Act of 1934</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/47/151">47 U.S.C. 151 et seq.</external-xref>), notwithstanding the definition of the term <quote>Acts to regulate commerce</quote> in section 4 of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/44">15 U.S.C. 44</external-xref>) and the exception provided by section 5(a)(2) of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(2)</external-xref>) for such carriers; or</text>
</subparagraph><subparagraph id="H896084C62D4B473BBC80856F5CA69EA4"><enum>(C)</enum><text>a nonprofit organization, including any organization described in section 501(c) of the Internal
Revenue Code of 1986 that is exempt from taxation under section 501(a) of
such Code, notwithstanding the definition of the term <quote>Acts to regulate commerce</quote> in section 4 of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/44">15 U.S.C. 44</external-xref>) and the exception provided by section 5(a)(2) of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(2)</external-xref>) for such organizations.</text>
</subparagraph></paragraph></section><section id="H2D187674877C4B5C8306B960F3E42151"><enum>152.</enum><header>Enforcement by the Federal Trade Commission</header>
<subsection id="HF6F6E8FAA0D6400AAF296794E0C103D8"><enum>(a)</enum><header>Unfair or deceptive acts or practices</header><text>A reckless or repetitive violation of a provision of this title, except section 143, shall be
treated as an unfair or deceptive act or practice in violation of a
regulation under section 18(a)(1)(B) of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/57a">15 U.S.C. 57a(a)(1)(B)</external-xref>) regarding unfair or deceptive acts or practices.</text>
</subsection><subsection id="HE7591ADC9C9D47668163C8989E2A2DE3"><enum>(b)</enum><header>Powers of commission</header>
<paragraph id="HCA5F1284CD2D46CCAA35C61995EB377C"><enum>(1)</enum><header>In general</header><text>Except as provided in paragraph (3), the Commission shall enforce this title, except section 143,
in the same manner, by the same means, and with the same jurisdiction,
powers, and duties as though all applicable terms and provisions of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/41">15 U.S.C. 41 et seq.</external-xref>) were incorporated into and made a part of this title.</text>
</paragraph><paragraph id="H2F46283AC730409BAF236B3D8ECFD955"><enum>(2)</enum><header>Privileges and immunities</header><text>Except as provided in paragraph (3), any person who violates a provision of this title, except
section 143, shall be subject to the penalties and entitled to the
privileges and immunities provided in the Federal Trade Commission Act (15
U.S.C. 41 et seq.).</text>
</paragraph><paragraph id="H45DBC0C490B3450E8EB2B083387B3833"><enum>(3)</enum><header>Common carriers and nonprofit organizations</header><text>The Commission shall enforce this title, except section 143, with respect to common carriers and
nonprofit organizations described in section 151 to the extent necessary
to effectuate the purposes of this title as if such carriers and nonprofit
organizations were persons over which the Commission has authority
pursuant to section 5(a)(2) of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(2)</external-xref>).</text>
</paragraph></subsection><subsection id="HE4753571BB3A4F9D946DF761CD841EF4"><enum>(c)</enum><header>Rulemaking authority</header>
<paragraph id="HF68BBF04F1924F5F81E600233637D801"><enum>(1)</enum><header>Limitation</header><text>In promulgating rules under this title, the Commission may not require the deployment or use of any
specific products or technologies, including any specific computer
software or hardware.</text>
</paragraph><paragraph id="H0F9CA8A4CFAC42878D9FE1A165CCC1E4"><enum>(2)</enum><header>Administrative procedure</header><text>The Commission shall promulgate regulations under this title in accordance with section 553 of
title 5, United States Code.</text>
</paragraph></subsection><subsection id="H1B547D6329E24BBDB3094EA0CC5F9D20"><enum>(d)</enum><header>Rule of construction</header><text>Nothing in this title shall be construed to limit the authority of the Commission under any other
provision of law.</text>
</subsection></section><section id="H56D96DE4A5B84624A5675BDA0B17DF79"><enum>153.</enum><header>Enforcement by Attorney General</header>
<subsection id="HE56D134C4EEE4F3698BD07B3EC808B29"><enum>(a)</enum><header>In general</header><text>The Attorney General may bring a civil action in the appropriate United States district court
against any covered entity that engages in conduct constituting a
violation of section 143.</text>
</subsection><subsection id="H16874EAEFF374FD58F90B6323006230C"><enum>(b)</enum><header>Penalties</header>
<paragraph id="H63D722D3572C40818428117DECAA5303"><enum>(1)</enum><header>In general</header><text>Upon proof of such conduct by a preponderance of the evidence, a covered entity shall be subject to
a civil penalty of not more than $1,000 per individual whose personally
identifiable information was or is reasonably believed to have been
accessed or acquired as a result of the breach of security that is the
basis of the violation, up to a maximum of $100,000 per day while such
violation persists.</text>
</paragraph><paragraph id="HB740D370FA294B7991AA9C82829DDC62"><enum>(2)</enum><header>Limitations</header><text>The total amount of the civil penalty assessed under this subsection against a covered entity for
acts or omissions relating to a single breach of security shall not exceed
$3,000,000, unless the conduct constituting a violation of subtitle D was
reckless or repeated, in which case an additional civil penalty of up to
$3,000,000 may be imposed.</text>
</paragraph><paragraph id="H4DCB4A45314F4AAA9E942BBC69597308"><enum>(3)</enum><header>Adjustment for inflation</header><text>Beginning on the date that the Consumer Price Index is first published by the Bureau of Labor
Statistics that is after 1 year after the date of the enactment of this
Act, and each year thereafter, the amounts specified in paragraphs (1) and
(2) shall be increased by the percentage increase in the Consumer Price
Index published on that date from the Consumer Price Index published the
previous year.</text>
</paragraph></subsection><subsection id="HE3AEA150ABA140939A412F36FB67D8E6"><enum>(c)</enum><header>Injunctive actions</header><text>If it appears that a covered entity has engaged, or is engaged, in any act or practice that
constitutes a violation of subtitle D, the Attorney General may petition
an appropriate United States district court for an order enjoining such
practice or enforcing compliance with such subtitle.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="H363752A516C6428C88F542B1B605FC35"><enum>(d)</enum><header>Issuance of order</header><text>A court may issue such an order under paragraph (c) if it finds that the conduct in question
constitutes a violation of subtitle D.</text>
</subsection></section><section id="H06DECD058AA44178BB60E1B57F11F355"><enum>154.</enum><header>Enforcement by States</header>
<subsection id="H4A4CC984980C4197AA5E0B921CDD7301"><enum>(a)</enum><header>Civil action</header><text>In any case in which the attorney general of a State has reason to believe that an interest of the
residents of that State has been or is adversely affected by a covered
entity who violates any part of this title in a manner that results in
economic or physical harm to an individual or engages in a pattern or
practice that violates any part of this title other than section 143, the
attorney general may, as parens patriae, bring a civil action on behalf of
the residents of the State in an appropriate district court of the United
States—</text>
<paragraph id="HEACAD09077C840588C23F68E7B28A026"><enum>(1)</enum><text>to enjoin further violation of this title or a regulation promulgated under this title by the
defendant;</text>
</paragraph><paragraph id="H9B4E8B5E59E4476CA002F963FC3A03EB"><enum>(2)</enum><text>to compel compliance with this title or a regulation promulgated under this title; or</text>
</paragraph><paragraph id="H70437FC6D97C42D5BDC3478A12FC20FA"><enum>(3)</enum><text>for violations of this title or a regulation promulgated under this title to obtain civil penalties
in the amount determined under section title.</text>
</paragraph></subsection><subsection id="H453B5F7E0CAD404AAAD989EA00FEBB5D"><enum>(b)</enum><header>Rights of Federal Trade Commission</header>
<paragraph id="H6DA398184E824F60A9862260B332C3AD"><enum>(1)</enum><header>Notice to Federal Trade Commission</header>
<subparagraph id="H198D580D264F489A9FFD0AAD25D1FFA4"><enum>(A)</enum><header>In general</header><text>Except as provided in subparagraph (C), the attorney general of a State shall notify the Commission
in writing of any civil action under subsection (b), prior to initiating
such civil action.</text>
</subparagraph><subparagraph id="H89B629E419384B5898EBB99C5F60D74F"><enum>(B)</enum><header>Contents</header><text>The notice required by subparagraph (A) shall include a copy of the complaint to be filed to
initiate such civil action.</text>
</subparagraph><subparagraph id="H95AF34DEF7604704A0D777BA8E49E6F0"><enum>(C)</enum><header>Exception</header><text>If it is not feasible for the attorney general of a State to provide the notice required by
subparagraph (A), the State shall provide notice immediately upon
instituting a civil action under subsection (b).</text>
</subparagraph></paragraph><paragraph id="HFA8E56D81C344FA582492EC6A4B0032F"><enum>(2)</enum><header>Intervention by Federal Trade Commission</header><text>Upon receiving notice required by paragraph (1) with respect to a civil action, the Commission may—</text>
<subparagraph id="HAC95BDA0D7C94337B1C73EFEC1EF3219"><enum>(A)</enum><text>intervene in such action; and</text>
</subparagraph><subparagraph id="H7B1FB3DC9D514BD88E85632A2C9B45D5"><enum>(B)</enum><text>upon intervening—</text>
<clause id="HE53033E53F8B44E0A41EB207C8C6D78E"><enum>(i)</enum><text>be heard on all matters arising in such civil action; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="HAEFAB611F7EE4E02A0CA088AA8A25993"><enum>(ii)</enum><text>file petitions for appeal of a decision in such action.</text>
</clause></subparagraph></paragraph></subsection><subsection id="H7029A1F7E4BC4FE0984AAC8843656ACC"><enum>(c)</enum><header>Preemptive action by Federal Trade Commission</header><text>If the Commission institutes a civil action for violation of this title or a regulation promulgated
under this title, no attorney general of a State may bring a civil action
under subsection (a) against any defendant named in the complaint of the
Commission for violation of this title or a regulation promulgated under
this title that is alleged in such complaint.</text>
</subsection><subsection id="HD72B3227A98744189316D59DFAD9CA74"><enum>(d)</enum><header>Investigatory powers</header><text>Nothing in this section may be construed to prevent the attorney general of a State from exercising
the powers conferred on such attorney general by the laws of such State to
conduct investigations or to administer oaths or affirmations or to compel
the attendance of witnesses or the production of documentary and other
evidence.</text>
</subsection><subsection commented="no" id="HFE80824AB78E4743ADB1057EFBCCC197"><enum>(e)</enum><header>Venue; service of process</header>
<paragraph commented="no" id="H0D313031B09B401AB17B4C6D69F9B1AE"><enum>(1)</enum><header>Venue</header><text>Any action brought under subsection (a) may be brought in—</text>
<subparagraph commented="no" id="H99744CF4D659475ABDA9BF79EAA4A035"><enum>(A)</enum><text>the district court of the United States that meets applicable requirements relating to venue under
<external-xref legal-doc="usc" parsable-cite="usc/28/1391">section 1391</external-xref> of title 28, United States Code; or</text>
</subparagraph><subparagraph commented="no" id="H0ED1CF406517400FBA8B3CB4B37CDAE5"><enum>(B)</enum><text>another court of competent jurisdiction.</text>
</subparagraph></paragraph><paragraph commented="no" id="HB5EB80EE09DA446C93DF3716C1CDB570"><enum>(2)</enum><header>Service of process</header><text>In an action brought under subsection (a), process may be served in any district in which the
defendant—</text>
<subparagraph commented="no" id="HB9EC6EDB0C6E415C973BC63CE0B00EDE"><enum>(A)</enum><text>is an inhabitant; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H364B81E40C3B45C2A1F6D08D70715FC2"><enum>(B)</enum><text>may be found.</text>
</subparagraph></paragraph></subsection><subsection commented="no" id="HF0CC5893FDF74AF48009FDD253D94505"><enum>(f)</enum><header>Actions by other State officials</header>
<paragraph commented="no" id="H2A5A6146B3844F7588C21D00553B358C"><enum>(1)</enum><header>In general</header><text>In addition to civil actions brought by attorneys general under subsection (a), any other officer
of a State who is authorized by the State to do so may bring a civil
action under subsection (a), subject to the same requirements and
limitations that apply under this section to civil actions brought by
attorneys general.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="H3A8E2393A50D4426BFCA6F0DC6F13033"><enum>(2)</enum><header>Savings provision</header><text>Nothing in this section may be construed to prohibit an authorized official of a State from
initiating or continuing any proceeding in a court of the State for a
violation of any civil or criminal law of the State.</text>
</paragraph></subsection></section><section id="H64FC9406DDD34C5F86059D283A6F371B"><enum>155.</enum><header>Civil penalties</header>
<subsection id="HB0D8CEB1114A4901A4EE8437980FE38C"><enum>(a)</enum><header>In general</header><text>In an action brought under section 154, in addition to any other penalty otherwise applicable to a
violation of this title or any regulation promulgated under this title,
the following civil penalties shall apply:</text>
<paragraph id="HDBB12C6C70BC480883AF72EE103D9D46"><enum>(1)</enum><header>Subtitle A violations</header><text>A covered entity that recklessly or repeatedly violates subtitle A is liable for a civil penalty
equal to the amount calculated by multiplying the number of days that the
entity is not in compliance with such subtitle by an amount not to exceed
$33,000.</text>
</paragraph><paragraph id="H385D99C94F0B4696A3BE2EE93FFF6C64"><enum>(2)</enum><header>Subtitle B violations</header><text>A covered entity that recklessly or repeatedly violates subtitle B is liable for a civil penalty
equal to the amount calculated by multiplying the number of days that such
an entity is not in compliance with such subtitle, or the number of
individuals for whom the entity failed to obtain consent as required by
such subtitle, whichever is greater, by an amount not to exceed $33,000.</text>
</paragraph><paragraph id="HF902929E51AC45E8821D22750E2FD120"><enum>(3)</enum><header>Subtitle D violations</header><text>A covered entity that recklessly or repeatedly violates section 142 is liable for a civil penalty
equal to the amount calculated by multiplying the number of violations of
such section by an amount not to exceed $33,000. Each failure to send
notification as required under such section to a resident of the State
shall be treated as a separate violation.</text>
</paragraph></subsection><subsection id="H7D018C82B6294065865E128CE415631E"><enum>(b)</enum><header>Adjustment for inflation</header><text>Beginning on the date that the Consumer Price Index for All Urban Consumers is first published by
the Bureau of Labor Statistics that is after 1 year after the date of the
enactment of this Act, and each year thereafter, each of the amounts
specified in subsection (a) shall be increased by the percentage increase
in the Consumer Price Index published on that date from the Consumer Price
Index published the previous year.</text>
</subsection><subsection id="H1007DA5DA1EE4FA5AD587A94DB35EA2F"><enum>(c)</enum><header>Maximum total liability</header><text>Notwithstanding the number of actions which may be brought against a covered entity under section
154, the maximum civil penalty for which any covered entity may be liable
under this section in such actions shall not exceed—</text>
<paragraph id="H3F0452824A304A6CAE86F1F4A17B9FD4"><enum>(1)</enum><text>$6,000,000 for any related series of violations of any rule promulgated under subtitle A;</text>
</paragraph><paragraph id="H18C6D2930F84406CA28CDA8E5ACAB431"><enum>(2)</enum><text>$6,000,000 for any related series of violations of subtitle B; and</text>
</paragraph><paragraph id="HE925E2B7E216447EB88674472B8F4057"><enum>(3)</enum><text>$6,000,000 for any related series of violations of section 142.</text>
</paragraph></subsection></section><section id="HA6968A7A8E164D478A21834EC6D2D281"><enum>156.</enum><header>Effect on other laws</header>
<subsection id="HD2C07FC0AAF949948826F744068A10FC"><enum>(a)</enum><header>Preemption of State laws</header><text>The provisions of this title shall supersede any provisions of the law of any State relating to
those entities covered by the regulations issued pursuant to this title,
to the extent that such provisions relate to the collection, use, or
disclosure of—</text>
<paragraph id="HAA33A3638D57408E907C7805DE71471A"><enum>(1)</enum><text>covered information addressed in this title; or</text>
</paragraph><paragraph id="H87ED3A63C40F44B1B433B020E76FC0F5"><enum>(2)</enum><text>personally identifiable information or personal identification information addressed in provisions
of the law of a State.</text>
</paragraph></subsection><subsection id="HBC0244792AD14B84BC8EBA8287FF5E7E"><enum>(b)</enum><header>Unauthorized civil actions; certain State laws</header>
<paragraph id="H5692AF8B863C4C2A844233413920A245"><enum>(1)</enum><header>Unauthorized actions</header><text>No person other than a person specified in section 154 may bring a civil action under the laws of
any State if such action is premised in whole or in part upon the
defendant violating this title or a regulation promulgated under this
title.</text>
</paragraph><paragraph id="HED3991D03277487083B635F0CD99ACC7"><enum>(2)</enum><header>Protection of certain state laws</header><text>This title shall not be construed to preempt the applicability of—</text>
<subparagraph id="HDADDE6C4BCF943149A893B4455ADB69E"><enum>(A)</enum><text>State laws that address the collection, use, or disclosure of health information or financial
information; or</text>
</subparagraph><subparagraph id="H5DECE659FCA845E7B5B0550F1ECF7A70"><enum>(B)</enum><text>other State laws to the extent that those laws relate to acts of fraud.</text>
</subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="HEF4CDE8AB2C04AC09CF5BB65537CD66C"><enum>(c)</enum><header>Rule of construction relating to required disclosures to government entities</header><text>This title shall not be construed to expand or limit the duty or authority of a covered entity or
third party to disclose personally identifiable information to a
government entity under any provision of law.</text>
</subsection></section><section id="H35E537FB3A6A4A0CA2B91F914E23D41F"><enum>157.</enum><header>No private right of action</header><text display-inline="no-display-inline">This title may not be construed to provide any private right of action.</text>
</section></subtitle><subtitle id="H1540315D2F7048D89C191B075128D671"><enum>F</enum><header>Co-Regulatory safe harbor programs</header>
<section id="HAD25C821C05A4C7DBD1A33C389EC173E"><enum>161.</enum><header>Establishment of safe harbor programs</header>
<subsection id="H240D40F734094962B2FF81CD423ACDBF"><enum>(a)</enum><header>In general</header><text>Not later than 1 year after the date of the enactment of this Act, the Commission shall initiate a
rulemaking proceeding to establish requirements for the establishment and
administration of safe harbor programs under which a nongovernmental
organization will administer a program that—</text>
<paragraph id="H9F1EA04A0CD24F5286ACE47247CC5F63"><enum>(1)</enum><text>establishes a mechanism for participants to implement the requirements of this title with regards
to—</text>
<subparagraph id="HFC41CEE9FB0741A2B88DBFD8531738CD"><enum>(A)</enum><text>certain types of unauthorized uses of covered information as described in paragraph (2); or</text>
</subparagraph><subparagraph id="H2ED7B990742A4E8AAC6C8D4E899DBAAD"><enum>(B)</enum><text>any unauthorized use of covered information; and</text>
</subparagraph></paragraph><paragraph id="H5C5A001C8FD743FD8F445B3DF076A3B5"><enum>(2)</enum><text>offers consumers a clear, conspicuous, persistent, and effective means of opting out of the
transfer of covered information by a covered entity participating in the
safe harbor program to a third party for—</text>
<subparagraph id="H7A6CA3EBC16F4BA884F3E9AF99F58EB3"><enum>(A)</enum><text>behavioral advertising purposes;</text>
</subparagraph><subparagraph id="H8946A2C390764FA38C228D8E920C558F"><enum>(B)</enum><text>location-based advertising purposes;</text>
</subparagraph><subparagraph id="HE7D4BD73167E49F4A959668C7127625E"><enum>(C)</enum><text>other specific types of unauthorized use; or</text>
</subparagraph><subparagraph id="H0E268D20DAA24E62B6E9D63E8F2FD695"><enum>(D)</enum><text>any unauthorized use.</text>
</subparagraph></paragraph></subsection><subsection id="H5605E9844D5840DEAE4016CE6E0CB567"><enum>(b)</enum><header>Selection of nongovernmental organizations To administer program</header>
<paragraph id="HAAAE9923566F42C79224D2D6E5543E78"><enum>(1)</enum><header>Submittal of applications</header><text>An applicant seeking to administer a program under the requirements established pursuant to
subsection (a) shall submit to the Commission an application therefor at
such time, in such manner, and containing such information as the
Commission may require.</text>
</paragraph><paragraph id="HA474AD5BBACC48C9B2AC2DE237814DC0"><enum>(2)</enum><header>Notice and receipt of applications</header><text>Upon completion of the rulemaking proceedings required by subsection (a), the Commission shall—</text>
<subparagraph id="HA88C3CA685B545B981A2B31D93795B07"><enum>(A)</enum><text>publish a notice in the Federal Register that it will receive applications for approval of safe
harbor programs under this subtitle; and</text>
</subparagraph><subparagraph id="H3D5909250C2044A1903B76B48079ECA7"><enum>(B)</enum><text>begin receiving applications under paragraph (1).</text>
</subparagraph></paragraph><paragraph id="H14618C111914434E80C55C6EB9165DAB"><enum>(3)</enum><header>Selection</header><text>Not later than 270 days after the date on which the Commission receives a completed application
under this subsection, the Commission shall grant or deny the application
on the basis of the Commission's evaluation of the applicant’s capacity to
provide protection of individuals’ covered information with regard to
specific types of unauthorized uses of covered information as described in
subsection (a)(2) that is substantially equivalent to or superior to the
protection otherwise provided under this title.</text>
</paragraph><paragraph id="H7E34A1193BC141D893E52522CE9D33D5"><enum>(4)</enum><header>Written findings</header><text>Any decision reached by the Commission under this subsection shall be accompanied by written
findings setting forth the basis for and reasons supporting such decision.</text>
</paragraph></subsection><subsection id="H56A6B3031E2642C9AF572E244B4F519A"><enum>(c)</enum><header>Scope of safe harbor protection</header><text>The scope of protection offered by safe harbor programs approved by the Commission that establish
mechanisms for participants to implement the requirements of the title
only for certain uses of covered information as described in subsection
(a)(2) shall be limited to participating entities’ use of those particular
types of covered information.</text>
</subsection><subsection id="H38D4EAD988BE4C7687F153EE361CCA3F"><enum>(d)</enum><header>Supervision by Federal Trade Commission</header>
<paragraph id="H27053AB82360432A99D48FA80437FF99"><enum>(1)</enum><header>In general</header><text>The Commission shall exercise oversight and supervisory authority of a safe harbor program approved
under this section through—</text>
<subparagraph id="H8284EF5BD666418EBF784B2E654DA50F"><enum>(A)</enum><text>ongoing review of the practices of the nongovernmental organization administering the program;</text>
</subparagraph><subparagraph id="H8D74CFFA23D84A87BBB234F371F11953"><enum>(B)</enum><text>the imposition of civil penalties on the nongovernmental organization if it is not compliant with
the requirements established under subsection (a); and</text>
</subparagraph><subparagraph id="HDC66DCBD627F4538B5D80F607262AC57"><enum>(C)</enum><text>withdrawal of authorization to administer the safe harbor program under this subtitle.</text>
</subparagraph></paragraph><paragraph id="H21BD168CAB9A4448BC71933EF383E4BB"><enum>(2)</enum><header>Annual reports by nongovernmental organizations</header><text>Each year, each nongovernmental organization administering a safe harbor program under this section
shall submit to the Commission a report on its activities under this
subtitle during the preceding year.</text>
</paragraph></subsection></section><section id="HF296579948BC46B5922B7AFBE30A31AD"><enum>162.</enum><header>Participation in safe harbor program</header>
<subsection id="H6E0FC242EE8B41239EC3FDD42A47A226"><enum>(a)</enum><header>Exemption</header><text>Any covered entity that participates in, and demonstrates compliance with, a safe harbor program
administered under section 161 shall be exempt from any provision of
subtitle B or subtitle C if the Commission finds that the requirements of
the safe harbor program are substantially the same as or more protective
of privacy of individuals than the requirements of the provision from
which the exemption is granted.</text>
</subsection><subsection id="H298A39972D8F4A349A1AC5B2BC18E1A6"><enum>(b)</enum><header>Limitation</header><text>Nothing in this subtitle shall be construed to exempt any covered entity participating in a safe
harbor program from compliance with any other requirement of the
regulations promulgated under this title for which the safe harbor does
not provide an exception.</text>
</subsection></section></subtitle><subtitle id="H3398279C743A41ABAA03B0A7B97B7C48"><enum>G</enum><header>Application with other Federal laws</header>
<section id="H3FC25929DC4F4DAFBD92C23436B5E593"><enum>171.</enum><header>Application with other Federal laws</header>
<subsection id="H82B23116A949408F9A7F4B9F71DF65BE"><enum>(a)</enum><header>Qualified exemption for persons subject to other Federal privacy laws</header><text>If a person is subject to a provision of this title and a provision of a Federal privacy law
described in subsection (d), such provision of this title shall not apply
to such person to the extent that such provision of Federal privacy law
applies to such person.</text>
</subsection><subsection id="HD0A47E1DF7DC438BA5940E9EC3F6B22B"><enum>(b)</enum><header>Protection of other Federal privacy laws</header><text>Nothing in this title may be construed to modify, limit, or supersede the operation of the Federal
privacy laws described in subsection (d) or the provision of information
permitted or required, expressly or by implication, by such laws, with
respect to Federal rights and practices.</text>
</subsection><subsection id="H980E299D8F3741B39D2D65EA49BA2CCB"><enum>(c)</enum><header>Communications infrastructure and privacy</header><text>If a person is subject to a provision of section 222 or 631 of the Communications Act of 1934 (47
U.S.C. 222 and 551) and a provision of this title, such provision of such
section 222 or 631 shall not apply to such person to the extent that such
provision of this title applies to such person.</text>
</subsection><subsection id="H7A0E770640FD45F089B00F90D1410B32"><enum>(d)</enum><header>Other Federal privacy laws described</header><text>The Federal privacy laws described in this subsection are as follows:</text>
<paragraph id="H99B02F006C65488A9BA3C0A0B73C838E"><enum>(1)</enum><text><external-xref legal-doc="usc" parsable-cite="usc/5/552a">Section 552a</external-xref> of title 5, United States Code (commonly known as the Privacy Act of 1974).</text>
</paragraph><paragraph id="H9B2B777B8BFF4A398E510E412B30A1C3"><enum>(2)</enum><text>The Right to Financial Privacy Act of 1978 (<external-xref legal-doc="usc" parsable-cite="usc/12/3401">12 U.S.C. 3401 et seq.</external-xref>).</text>
</paragraph><paragraph id="HDA4F3B1E64034E9092C3EA0E47323B4A"><enum>(3)</enum><text>The Fair Credit Reporting Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1681">15 U.S.C. 1681 et seq.</external-xref>).</text>
</paragraph><paragraph id="H96D4E1CBBFB34ABF8C50C5B254A59845"><enum>(4)</enum><text>The Fair Debt Collection Practices Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1692">15 U.S.C. 1692 et seq.</external-xref>).</text>
</paragraph><paragraph id="H980B350394724EC6A5DA03FAB51B032C"><enum>(5)</enum><text>The Children’s Online Privacy Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6501">15 U.S.C. 6501 et seq.</external-xref>).</text>
</paragraph><paragraph id="H83B4B1D6F1EA4B40952071A766F7044F"><enum>(6)</enum><text>Title V of the Gramm-Leach-Bliley Act of 1999 (<external-xref legal-doc="usc" parsable-cite="usc/15/6801">15 U.S.C. 6801 et seq.</external-xref>).</text>
</paragraph><paragraph id="HDCAF428404414E37A7056D08AB6486DD"><enum>(7)</enum><text>Chapters 119, 123, and 206 of title 18, United States Code.</text>
</paragraph><paragraph id="H548BEE4FA3A44B47B08AFB87B50C0055"><enum>(8)</enum><text><external-xref legal-doc="usc" parsable-cite="usc/18/2710">Section 2710</external-xref> of title 18, United States Code.</text>
</paragraph><paragraph id="H9B9FD239F5FA40C2A55AE3F1C448C799"><enum>(9)</enum><text>Section 444 of the General Education Provisions Act (<external-xref legal-doc="usc" parsable-cite="usc/20/1232g">20 U.S.C. 1232g</external-xref>) (commonly referred to as the <quote>Family Educational Rights and Privacy Act of 1974</quote>).</text>
</paragraph><paragraph id="HD4020877C5784368AE7926580D68238C"><enum>(10)</enum><text>Section 445 of the General Education Provisions Act (<external-xref legal-doc="usc" parsable-cite="usc/20/1232h">20 U.S.C. 1232h</external-xref>).</text>
</paragraph><paragraph id="HC8040ECBEB514515B2BAB6C47B8ACDE1"><enum>(11)</enum><text>The Privacy Protection Act of 1980 (<external-xref legal-doc="usc" parsable-cite="usc/42/2000aa">42 U.S.C. 2000aa et seq.</external-xref>).</text>
</paragraph><paragraph id="H94A070003D0C4E42AD20686C15DB2F9E"><enum>(12)</enum><text>The regulations promulgated under section 264(c) of the Health Insurance Portability and
Accountability Act of 1996 (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-2">42 U.S.C. 1320d–2</external-xref> note), as such regulations
relate to a person described in section 1172(a) of the Social Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-1">42 U.S.C. 1320d–1(a)</external-xref>) or to transactions referred to in section
1173(a)(1) of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-2">42 U.S.C. 1320d–2(a)(1)</external-xref>).</text>
</paragraph><paragraph id="HB6D71B249E5C4760B7E7286AC4784328"><enum>(13)</enum><text>The Communications Assistance for Law Enforcement Act (<external-xref legal-doc="usc" parsable-cite="usc/47/1001">47 U.S.C. 1001 et seq.</external-xref>).</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="H36E9E06F18FF45299708CE4C1962603B"><enum>(14)</enum><text>Section 227 of the Communications Act of 1934 (<external-xref legal-doc="usc" parsable-cite="usc/47/227">47 U.S.C. 227</external-xref>).</text>
</paragraph></subsection></section></subtitle><subtitle id="H5A83A45BABF34551A508378FCA805532"><enum>H</enum><header>Development of commercial data privacy policy in the Department of Commerce</header>
<section id="H95F424747435444FA2F9F41651594690"><enum>181.</enum><header>Direction to develop commercial data privacy policy</header><text display-inline="no-display-inline">The Secretary of Commerce shall contribute to the development of commercial data privacy policy by—</text>
<paragraph id="HEC6F7B2A5D194D998C67193AC55E9859"><enum>(1)</enum><text>convening private sector stakeholders, including members of industry, civil society groups,
academia, in open forums, to develop codes of conduct in support of
applications for safe harbor programs under subtitle F;</text>
</paragraph><paragraph id="H07BD229365D04E1AB837326463B32882"><enum>(2)</enum><text>expanding interoperability between the United States commercial data privacy framework and other
national and regional privacy frameworks;</text>
</paragraph><paragraph id="HFBC3462218F5488AA99D11D5340A38D3"><enum>(3)</enum><text>conducting research related to improving privacy protection under this title; and</text>
</paragraph><paragraph id="H6AF34D82EA3C4481B02D983E0370237E"><enum>(4)</enum><text>conducting research related to improving data sharing practices, including the use of anonymised
data, and growing the information economy.</text>
</paragraph></section></subtitle><enum>II</enum><header>Online privacy of children</header>
<section id="H1608C0DF2A834DE8A11DD45A571478A6"><enum>201.</enum><header>Short title</header><text display-inline="no-display-inline">This title may be cited as the <quote><short-title>Do Not Track Kids Act of 2014</short-title></quote>.</text>
</section><section commented="no" id="H6F5DF466951B4AC1A167019A48204662"><enum>202.</enum><header>Findings</header><text display-inline="no-display-inline">Congress finds the following:</text>
<paragraph id="H327CB6BDB95E4CDF982F9800813BB1E7"><enum>(1)</enum><text display-inline="yes-display-inline">Since the enactment of the Children’s Online Privacy Protection Act of 1998, the World Wide Web has
changed dramatically, with the creation of tens of millions of websites,
the proliferation of entirely new media platforms, and the emergence of a
diverse ecosystem of services, devices, and applications that enable users
to connect wirelessly within an online environment without being tethered
to a desktop computer.</text>
</paragraph><paragraph id="H067C3EF33B674F659C83CCFF1A7DB416"><enum>(2)</enum><text display-inline="yes-display-inline">The explosive growth of the Internet ecosystem has unleashed a wide array of opportunities to
learn, communicate, participate in civic life, access entertainment, and
engage in commerce.</text>
</paragraph><paragraph id="H16EDBE46CBA84F40A092C00C553976D7"><enum>(3)</enum><text display-inline="yes-display-inline">In addition to these significant benefits, the Internet also presents challenges, particularly with
respect to the efforts of entities to track the online activities of
children and minors and to collect, use, and disclose personal information
about them, including their geolocation, for commercial purposes.</text>
</paragraph><paragraph id="HB2C898C63B7F4096A7F4431CBD6AEA2C"><enum>(4)</enum><text display-inline="yes-display-inline">Children and teens are visiting numerous companies’ websites, and marketers are using multimedia
games, online quizzes, and mobile phone and tablet applications to create
ties to children and teens.</text>
</paragraph><paragraph id="H54873CEA37C04000ADE944294C2D4065"><enum>(5)</enum><text display-inline="yes-display-inline">According to a study by the Wall Street Journal in 2010, websites directed to children and teens
were more likely to use cookies and other tracking tools than sites
directed to a general audience.</text>
</paragraph><paragraph id="H6B098E5F43B341279BF6D3E43B10B418"><enum>(6)</enum><text display-inline="yes-display-inline">This study examined 50 popular websites for children and teens in the United States and found that
these 50 sites placed 4,123 cookies, beacons, and other tracking tools on
the test computer used for the study.</text>
</paragraph><paragraph id="HF642674D985E402A837C4458B34A1355"><enum>(7)</enum><text display-inline="yes-display-inline">This is 30 percent greater than the number of such tracking tools that were placed on the test
computer in a similar study of the 50 overall most popular websites in the
United States, which are generally directed to adults.</text>
</paragraph><paragraph id="H3F06C24AB3014F598703E122955A1BE8"><enum>(8)</enum><text>Children and teens lack the cognitive ability to distinguish advertising from program content and
to understand that the purpose of advertising is to persuade them, making
them unable to activate the defenses on which adults rely.</text>
</paragraph><paragraph id="H2EDCD40051F447D68362E2D5789F6169"><enum>(9)</enum><text>Children and teens are less able than adults to understand the potential long-term consequences of
having their information available to third parties, including
advertisers, and other individuals.</text>
</paragraph><paragraph id="H41A22A4B233C494AB3C0E37CA83C95A2"><enum>(10)</enum><text>According to Common Sense Media and the Center for Digital Democracy, 90 percent of teens have used
some form of social media, 75 percent have a social networking site, and
51 percent check their social networking site at least once a day.</text>
</paragraph><paragraph commented="no" id="H3F5535446BC5403CA90A2CBC7F4D29B4"><enum>(11)</enum><text>Ninety-one percent of parents and 91 percent of adults believe it is not okay for advertisers to
collect information about a child’s location from that child’s mobile
phone.</text>
</paragraph><paragraph commented="no" id="H53E5590E26C54144922C0B7BB1F8C8E9"><enum>(12)</enum><text>Ninety-four percent of parents and 91 percent of adults agree that advertisers should receive the
parent’s permission before putting tracking software on a child’s
computer.</text>
</paragraph><paragraph id="H8F63D7C275574807929C201D9943E798"><enum>(13)</enum><text>Ninety-six percent of parents and 94 percent of adults expressed disapproval when asked if it is <quote>okay for a website to ask children for personal information about their friends</quote>.</text>
</paragraph><paragraph id="H7C0455BEABD241CAB9C54BEC89625E80"><enum>(14)</enum><text display-inline="yes-display-inline">Eighty-eight percent of parents would support a law that requires search engines and social
networking sites to get users’ permission before using their personal
information.</text>
</paragraph><paragraph id="H18B5B416BD094005BA9888C6881E87AF"><enum>(15)</enum><text display-inline="yes-display-inline">A Commonsense Media/Zogby poll found that 94 percent of parents and 94 percent of adults believe
individuals should have the ability to request the deletion, after a
specific period of time, of all of their personal information held by an
online search engine, social networking site, or marketing company.</text>
</paragraph><paragraph id="H736AF7807D034CA0BD9242B204821998"><enum>(16)</enum><text display-inline="yes-display-inline">According to a Pew/Berkman Center poll, 69 percent of parents of teens who engage in online
activity are concerned about how that activity might affect their
children’s future academic or employment opportunities.</text>
</paragraph><paragraph id="HBBC352F683F646F4A6883FDC9C8EECCF"><enum>(17)</enum><text display-inline="yes-display-inline">Eighty-one percent of parents of teens who engage in online activity say they are concerned about
how much information advertisers can learn about their children’s online
activity.</text>
</paragraph></section><section id="HABB051D5B18246D6A6D7B05CCC1AABBE"><enum>203.</enum><header>Definitions</header>
<subsection id="HFBB501533F50448DB9C19CC88AA31DC7"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">In this title:</text>
<paragraph id="HB0E02BDE6D75419CB33B3DE24B75E182"><enum>(1)</enum><header>Minor</header><text>The term <term>minor</term> means an individual over the age of 12 and under the age of 16.</text>
</paragraph><paragraph commented="no" id="H93DED440669E430C9124B5EE054FAB94"><enum>(2)</enum><header>Targeted marketing</header><text>The term <term>targeted marketing</term> means advertising or other efforts to market a product or service that are directed to a specific
individual or device—</text>
<subparagraph id="H46779166567E417F949999092EB0B289"><enum>(A)</enum><text>based on the personal information of the individual or a unique identifier of the device; and</text>
</subparagraph><subparagraph id="H5EF84F0E5EAC40B0ACAD0A836A1378EE"><enum>(B)</enum><text display-inline="yes-display-inline">as a result of use by the individual, or access by the device, of a website, online service, online
application, or mobile application.</text>
</subparagraph></paragraph></subsection><subsection id="H6C71C1105C8342D4853C9816D0026BB4"><enum>(b)</enum><header>Terms defined by Commission</header><text display-inline="yes-display-inline">In this title, the terms <term>directed to minors</term> and <term>geolocation information</term> shall have the meanings given such terms by the Commission by regulation. Not later than 1 year
after the date of the enactment of this Act, the Commission shall
promulgate, under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations
that define such terms broadly enough so that they are not limited to
current technology, consistent with the principles articulated by the
Commission regarding the definition of the term <term>Internet</term> in its statement of basis and purpose on the final rule under the Children’s Online Privacy
Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6501">15 U.S.C. 6501 et seq.</external-xref>) promulgated on November 3,
1999 (64 Fed. Reg. 59891).</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="H9F0404474F5447F690CFCB7BCA917502"><enum>(c)</enum><header>Other definitions</header><text display-inline="yes-display-inline">The definitions set forth in section 1302 of the Children’s Online Privacy Protection Act of 1998
(<external-xref legal-doc="usc" parsable-cite="usc/15/6501">15 U.S.C. 6501</external-xref>), as amended by section 3(a), shall apply in this title,
except to the extent the Commission provides otherwise by regulations
issued under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code.</text>
</subsection></section><section id="H20105A59C49E4280A21BB6756A146216"><enum>204.</enum><header>Online collection, use, and disclosure of personal information of children</header>
<subsection id="H4D29182FB3C740C18A13591B5B5FBB21"><enum>(a)</enum><header>Definitions</header><text display-inline="yes-display-inline">Section 1302 of the Children’s Online Privacy Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6501">15 U.S.C. 6501</external-xref>) is amended—</text>
<paragraph id="H9DDF75EEE7964630A2CB8BBBA60595E5"><enum>(1)</enum><text>by amending paragraph (2) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="H5DABBD0A30EC43718AD24FA861BB3292" style="OLC">
<paragraph id="HB9BCDA6A2B80401398593C85C817868D"><enum>(2)</enum><header>Operator</header><text display-inline="yes-display-inline">The term <term>operator</term>—</text>
<subparagraph id="HFB120B5C82D84226957218DD32D841BF"><enum>(A)</enum><text display-inline="yes-display-inline">means any person who, for commercial purposes, in interstate or foreign commerce, operates or
provides a website on the Internet, online service, online application, or
mobile application, and who—</text>
<clause id="H10AAE7BFAFD04585B1C1F8F26B8DCE31"><enum>(i)</enum><text display-inline="yes-display-inline">collects or maintains, either directly or through a service provider, personal information from or
about the users of such website, service, or application;</text>
</clause><clause id="H9471EECDC6634744B12A77661A959063"><enum>(ii)</enum><text display-inline="yes-display-inline">allows another person to collect personal information directly from users of such website, service,
or application (in which case the operator is deemed to have collected the
information); or</text>
</clause><clause id="HFC5F1836F7604BF09B3B22406D09599C"><enum>(iii)</enum><text display-inline="yes-display-inline">allows users of such website, service, or application to publicly disclose personal information (in
which case the operator is deemed to have collected the information); and</text>
</clause></subparagraph><subparagraph commented="no" id="H41B9B22D73BD414999EE727932A3C204"><enum>(B)</enum><text>does not include any nonprofit entity that would otherwise be exempt from coverage under section 5
of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45</external-xref>).</text></subparagraph></paragraph><after-quoted-block>;</after-quoted-block></quoted-block>
</paragraph><paragraph id="HF8A739CADEDD4E669D563728EE2E5EAD"><enum>(2)</enum><text>in paragraph (4)—</text>
<subparagraph id="HAAAD99E0F21448029D74A7D44F349EEF"><enum>(A)</enum><text>by amending subparagraph (A) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="H32CF929CD7AA433AA00B4ADF7E67BBCC" style="OLC">
<subparagraph id="H3862C0129F094E7BAA2514FF327B1731"><enum>(A)</enum><text display-inline="yes-display-inline">the release of personal information for any purpose, except where such information is provided to a
person other than an operator who provides support for the internal
operations of the website, online service, online application, or mobile
application of the operator and does not disclose or use that information
for any other purpose; and</text></subparagraph><after-quoted-block>; and</after-quoted-block></quoted-block>
</subparagraph><subparagraph id="HC79B5B7051AF4F66A237D8F930F67BB2"><enum>(B)</enum><text>in subparagraph (B), by striking <quote>website or online service</quote> and inserting <quote>website, online service, online application, or mobile application</quote>;</text>
</subparagraph></paragraph><paragraph id="H752A9BA89FD049EDBDB4523905844C9B"><enum>(3)</enum><text>in paragraph (8)—</text>
<subparagraph id="HC21E9D04D7DC4BE88202951C17246437"><enum>(A)</enum><text>by amending subparagraph (G) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="H23195762A1D048768495C4BF4F25CCFA" style="OLC">
<subparagraph id="HC1C7BB2AD1AE4D2B966EB24B2DA2E4E8"><enum>(G)</enum><text display-inline="yes-display-inline">information concerning a child or the parents of that child (including any unique or substantially
unique identifier, such as a customer number) that an operator collects
online from the child and combines with an identifier described in
subparagraphs (A) through (G).</text></subparagraph><after-quoted-block>;</after-quoted-block></quoted-block>
</subparagraph><subparagraph id="HDFD982DD2C5246D589EC2A2EB85DDDE7"><enum>(B)</enum><text>by redesignating subparagraphs (F) and (G) as subparagraphs (G) and (H), respectively; and</text>
</subparagraph><subparagraph id="H2805634F30BA4F12A3BBB217595477B2"><enum>(C)</enum><text>by inserting after subparagraph (E) the following new subparagraph:</text>
<quoted-block display-inline="no-display-inline" id="HBB2100E9074F454598E139F0E9CB8D23" style="OLC">
<subparagraph commented="no" id="H387D4C877F004AE5BD3349270EC99C2C"><enum>(F)</enum><text display-inline="yes-display-inline">information (including an Internet protocol address) that permits the identification of an
individual, the computer of an individual, or any other device used by an
individual to access the Internet or an online service, online
application, or mobile application;</text></subparagraph><after-quoted-block>;</after-quoted-block></quoted-block>
</subparagraph></paragraph><paragraph id="H770DE7918B0748F2A598882A76548A71"><enum>(4)</enum><text>by striking paragraph (10) and redesignating paragraphs (11) and (12) as paragraphs (10) and (11),
respectively; and</text>
</paragraph><paragraph id="H75D7C7ACF2C6406F8A4CFE6295242AEA"><enum>(5)</enum><text>by adding at the end the following new paragraph:</text>
<quoted-block display-inline="no-display-inline" id="HDBD2664A27FD49419383D838C7BEC959" style="OLC">
<paragraph id="H9768327F42614F3B9200540D8ACA8972"><enum>(12)</enum><header>Online, online service, online application, mobile application, directed to children</header><text display-inline="yes-display-inline">The terms <term>online</term>, <term>online service</term>, <term>online application</term>, <term>mobile application</term>, and <term>directed to children</term> shall have the meanings given such terms by the Commission by regulation. Not later than 1 year
after the date of the enactment of the <short-title>Commercial Privacy Bill of Rights Act of 2014</short-title>, the Commission shall promulgate, under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations
that define such terms broadly enough so that they are not limited to
current technology, consistent with the principles articulated by the
Commission regarding the definition of the term <term>Internet</term> in its statement of basis and purpose on the final rule under this title promulgated on November
3, 1999 (64 Fed. Reg. 59891). The definition of the term <term>online service</term> in such regulations shall include broadband Internet access service (as defined in the Report and
Order of the Federal Communications Commission relating to the matter of
preserving the open Internet and broadband industry practices (FCC 10–201,
adopted by the Commission on December 21, 2010)).</text></paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="H59FB888F52364AE5A7569F72F17BF77C"><enum>(b)</enum><header>Online collection, use, and disclosure of personal information of children</header><text display-inline="yes-display-inline">Section 1303 of the Children’s Online Privacy Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6502">15 U.S.C. 6502</external-xref>) is amended—</text>
<paragraph id="H3E6123EED9D54EA6992EFA4967FA80EF"><enum>(1)</enum><text>by striking the heading and inserting the following: <quote><header-in-text level="section" style="OLC">Online collection, use, and disclosure of personal information of children.</header-in-text></quote>;</text>
</paragraph><paragraph id="HF00EC6D1925E46908DC13821FD9F19AD"><enum>(2)</enum><text>in subsection (a)—</text>
<subparagraph id="HB13E63817AAF41699C9AF28179F3633E"><enum>(A)</enum><text>by amending paragraph (1) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="H321B607429504BB3AD3392659CB89839" style="OLC">
<paragraph id="HC6D3F243C6D7483BABF2DD2820F18630"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">It is unlawful for an operator of a website, online service, online application, or mobile
application directed to children, or an operator having actual knowledge
that personal information being collected is from a child, to collect
personal information from a child in a manner that violates the
regulations prescribed under subsection (b).</text></paragraph><after-quoted-block>; and</after-quoted-block></quoted-block>
</subparagraph><subparagraph id="H3D1BC7DC26EF4B7AADB8B87A4DA01289"><enum>(B)</enum><text>in paragraph (2)—</text>
<clause id="H6666ACB80B8A44C784C97679BEB61D2B"><enum>(i)</enum><text>by striking <quote>of such a website or online service</quote>; and</text>
</clause><clause id="H94A920C53EB64500B5DC79CAAF465BEE"><enum>(ii)</enum><text>by striking <quote>subsection (b)(1)(B)(iii)</quote> and inserting <quote>subsection (b)(1)(C)(iii)</quote>; and</text>
</clause></subparagraph></paragraph><paragraph id="H547DB4D12B3F4800B216910112B69D6F"><enum>(3)</enum><text display-inline="yes-display-inline">in subsection (b)—</text>
<subparagraph id="HB3E44C8232DF454BAF84CB1668FC47A5"><enum>(A)</enum><text>by amending paragraph (1) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="HA12D092F32B44A96BDF119CB1218458B" style="OLC">
<paragraph id="H60801195DEC948B7B5BA0F7CF4120275"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">Not later than 1 year after the date of the enactment of the <short-title>Commercial Privacy Bill of Rights Act of 2014</short-title>, the Commission shall promulgate, under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations to
require an operator of a website, online service, online application, or
mobile application directed to children, or an operator having actual
knowledge that personal information being collected is from a child—</text>
<subparagraph id="H80D99025A8FC4DD4882E87407EDB662C"><enum>(A)</enum><text>to provide clear and conspicuous notice in clear and plain language of the types of personal
information the operator collects, how the operator uses such information,
whether the operator discloses such information, and the procedures or
mechanisms the operator uses to ensure that personal information is not
collected from children except in accordance with the regulations
promulgated under this paragraph;</text>
</subparagraph><subparagraph id="H7F9221D20FB64316B03A1EBAD11BC868"><enum>(B)</enum><text display-inline="yes-display-inline">to obtain verifiable parental consent for the collection, use, or disclosure of personal
information of a child;</text>
</subparagraph><subparagraph id="H19DDA4D7EC13472EA2FDE77D24A5A4F6"><enum>(C)</enum><text>to provide to a parent whose child has provided personal information to the operator, upon request
by and proper identification of the parent—</text>
<clause id="H40E58B75FB0944D2AC55F42254E45E02"><enum>(i)</enum><text>a description of the specific types of personal information collected from the child by the
operator;</text>
</clause><clause id="H100C37F77EE6456F91EE45E522A26B22"><enum>(ii)</enum><text>the opportunity at any time to refuse to permit the further use or maintenance in retrievable form,
or future collection, by the operator of personal information collected
from the child; and</text>
</clause><clause id="H8B9A99B008F048788B87C128E2B7D358"><enum>(iii)</enum><text>a means that is reasonable under the circumstances for the parent to obtain any personal
information collected from the child, if such information is available to
the operator at the time the parent makes the request;</text>
</clause></subparagraph><subparagraph id="HC606F6391CD046C7BC97238F4204092B"><enum>(D)</enum><text>not to condition participation in a game, or use of a website, service, or application, by a child
on the provision by the child of more personal information than is
reasonably required to participate in the game or use the website,
service, or application; and</text>
</subparagraph><subparagraph id="H9FF5AD40E5D44EDAA91ACB1B2B637CD8"><enum>(E)</enum><text>to establish and maintain reasonable procedures to protect the confidentiality, security, and
integrity of personal information collected from children.</text></subparagraph></paragraph><after-quoted-block>;</after-quoted-block></quoted-block>
</subparagraph><subparagraph id="HD03C0FDBAEEF4CC6937861B4D59C7CD3"><enum>(B)</enum><text display-inline="yes-display-inline">in paragraph (2)—</text>
<clause id="H45585FC7871C4BA5B579D88CABCC2DAC"><enum>(i)</enum><text>in the matter preceding subparagraph (A), by striking <quote>paragraph (1)(A)(ii)</quote> and inserting <quote>paragraph (1)(B)</quote>; and</text>
</clause><clause id="H01711D5F28294A5CA77B9156A641956E"><enum>(ii)</enum><text>in subparagraph (A), by inserting <quote>or to contact a different child</quote> after <quote>to recontact the child</quote>;</text>
</clause></subparagraph><subparagraph id="HD2E8ED6F87094C9DA9800DC0FE0E799E"><enum>(C)</enum><text display-inline="yes-display-inline">by amending paragraph (3) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="H43AB34AF126B4FBE9A700D8AB801463B" style="OLC">
<paragraph id="H8AFC548751F44C0A8A8886727F4C549A"><enum>(3)</enum><header>Continuation of service</header><text display-inline="yes-display-inline">The regulations shall prohibit an operator from discontinuing service provided to a child on the
basis of refusal by the parent of the child, under the regulations
prescribed under paragraph (1)(C)(ii), to permit the further use or
maintenance in retrievable form, or future collection, by the operator of
personal information collected from the child, to the extent that the
operator is capable of providing such service without such information.</text></paragraph><after-quoted-block>; and</after-quoted-block></quoted-block>
</subparagraph><subparagraph id="H809D907ED8984C699DB78CDFF762B663"><enum>(D)</enum><text>by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="HA277E7529D8A49AB818CAEB6BB77883D" style="OLC">
<paragraph id="H496970D034454F64B6CE50351522A399"><enum>(4)</enum><header>Rule for treatment of users of websites, services, and applications directed to children</header><text display-inline="yes-display-inline">An operator of a website, online service, online application, or mobile application that is
directed to children shall treat all users of such website, service, or
application as children for purposes of this title, except as permitted by
the Commission by a regulation promulgated under this title.</text></paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subparagraph></paragraph></subsection><subsection id="HC297E146EC854710B6B2DDF6F120FBA9"><enum>(c)</enum><header>Administration and applicability of Act</header><text display-inline="yes-display-inline">Section 1306 of the Children's Online Privacy Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6505">15 U.S.C. 6505</external-xref>) is amended—</text>
<paragraph commented="no" id="H5E772E6C856D492DB3C608F1AAEFD101"><enum>(1)</enum><text>in subsection (b)—</text>
<subparagraph commented="no" id="HEA00FA55D8FD477882D5E2C1BE1868D0"><enum>(A)</enum><text>in paragraph (1), by striking <quote>, in the case of</quote> and all that follows and inserting the following: <quote>by the appropriate Federal banking agency with respect to any insured depository institution (as
such terms are defined in section 3 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/12/1813">12 U.S.C. 1813</external-xref>));</quote>; and</text>
</subparagraph><subparagraph commented="no" id="H89BE0B712F1D4CA19EC1A90CB67F5B57"><enum>(B)</enum><text>by striking paragraph (2) and redesignating paragraphs (3) through (6) as paragraphs (2) through
(5), respectively; and</text>
</subparagraph></paragraph><paragraph id="H77997A9B48EE4E86B7918B1A233DF241"><enum>(2)</enum><text>by adding at the end the following new subsection:</text>
<quoted-block display-inline="no-display-inline" id="H2F5A640960EA48518B15C4608FC2FA73" style="OLC">
<subsection display-inline="no-display-inline" id="H8CC064856BAA4136905F4CC9D7D40702"><enum>(f)</enum><header>Telecommunications carriers and cable operators</header>
<paragraph id="HFC54361D58F84546B0A8F4267F8C4BDE"><enum>(1)</enum><header>Enforcement by FTC</header><text display-inline="yes-display-inline">Notwithstanding section 5(a)(2) of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(2)</external-xref>),
compliance with the requirements imposed under this title shall be
enforced by the Commission with respect to any telecommunications carrier
(as defined in section 3 of the Communications Act of 1934 (47 U.S.C.
153)).</text>
</paragraph><paragraph id="H81295D9301D04350A196DDDE7AD6FE60"><enum>(2)</enum><header>Relationship to other law</header><text display-inline="yes-display-inline">To the extent that sections 222, 338(i), and 631 of the Communications Act of 1934 (<external-xref legal-doc="usc" parsable-cite="usc/47/222">47 U.S.C. 222</external-xref>;
338(i); 551) are inconsistent with this title, this title controls.</text></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection></section><section id="HF872B829B7EE41B986173F955967DADD"><enum>205.</enum><header>Targeted marketing to children or minors</header>
<subsection id="H040253A9EDAD4DE583C4B0DDE8AF0950"><enum>(a)</enum><header>Acts prohibited</header><text display-inline="yes-display-inline">It is unlawful for—</text>
<paragraph id="HC77F35432A2141BE842D1676E03D4341"><enum>(1)</enum><text display-inline="yes-display-inline">an operator of a website, online service, online application, or mobile application directed to
children, or an operator having actual knowledge that personal information
being collected is from a child, to use, disclose to third parties, or
compile personal information for targeted marketing purposes without
verifiable parental consent; or</text>
</paragraph><paragraph id="H52E368081B3B4C558E775B49443D2A34"><enum>(2)</enum><text display-inline="yes-display-inline">an operator of a website, online service, online application, or mobile application directed to
minors, or an operator having actual knowledge that personal information
being collected is from a minor, to use, disclose to third parties, or
compile personal information for targeted marketing purposes without the
consent of the minor.</text>
</paragraph></subsection><subsection id="H555FC0B9CBE64C0E9DD3B0FDE6BB6CDF"><enum>(b)</enum><header>Regulations</header><text display-inline="yes-display-inline">Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate,
under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations to implement
this section.</text>
</subsection></section><section id="H6076F137969940CF8D41172F464728C0"><enum>206.</enum><header>Digital Marketing Bill of Rights for Teens and Fair Information Practices Principles</header>
<subsection id="H693F42F3129D4E02B023A5214B27A52E"><enum>(a)</enum><header>Acts prohibited</header><text display-inline="yes-display-inline">It is unlawful for an operator of a website, online service, online application, or mobile
application directed to minors, or an operator having actual knowledge
that personal information being collected is from a minor, to collect
personal information from a minor unless such operator has adopted and
complies with a Digital Marketing Bill of Rights for Teens that is
consistent with the Fair Information Practices Principles described in
subsection (b).</text>
</subsection><subsection id="H8BC5A15B646A4282A84DD7AE40B86721"><enum>(b)</enum><header>Fair Information Practices Principles</header><text display-inline="yes-display-inline">The Fair Information Practices Principles described in this subsection are the following:</text>
<paragraph id="H575B1D1A3EA746F28B79489B1C4A34BB"><enum>(1)</enum><header>Collection limitation principle</header><text display-inline="yes-display-inline">Except as provided in paragraph (3), personal information should be collected from a minor only
when collection of the personal information is—</text>
<subparagraph id="HFAC43FB60AC248029B0258940BC3AAE9"><enum>(A)</enum><text display-inline="yes-display-inline">consistent with the context of a particular transaction or service or the relationship of the minor
with the operator, including collection necessary to fulfill a transaction
or provide a service requested by the minor; or</text>
</subparagraph><subparagraph id="HCCEAD3C177D741EE98FAF83F69AC6358"><enum>(B)</enum><text>required or specifically authorized by law.</text>
</subparagraph></paragraph><paragraph id="H8A3AA30C18E64747BC9FF602A37E4F35"><enum>(2)</enum><header>Data quality principle</header><text display-inline="yes-display-inline">The personal information of a minor should be accurate, complete, and kept up-to-date to the extent
necessary to fulfill the purposes described in subparagraphs (A) through
(D) of paragraph (3).</text>
</paragraph><paragraph id="HC6710C06B02D4E3C98F3B5F0CFF1A201"><enum>(3)</enum><header>Purpose specification principle</header><text display-inline="yes-display-inline">The purposes for which personal information is collected should be specified to the minor not later
than at the time of the collection of the information. The subsequent use
or disclosure of the information should be limited to—</text>
<subparagraph id="HDFAF5FAB4DC54BEC8B23E390583FEB2E"><enum>(A)</enum><text>fulfillment of the transaction or service requested by the minor;</text>
</subparagraph><subparagraph id="H556C973C6B8244E0814067928891C0F2"><enum>(B)</enum><text>support for the internal operations of the website, service, or application, as described in
<external-xref legal-doc="regulation" parsable-cite="cfr/16/312.2">section 312.2</external-xref> of title 16, Code of Federal Regulations;</text>
</subparagraph><subparagraph id="H2AD8FFD2BD354F50ABF45BE516C33DED"><enum>(C)</enum><text>compliance with legal process or other purposes expressly authorized under specific legal
authority; or</text>
</subparagraph><subparagraph id="H6F3460F823564D6D9D2C0BA55F440D8A"><enum>(D)</enum><text>other purposes—</text>
<clause id="H9939DEA8FF6F42CF8AF404C0A9880EA0"><enum>(i)</enum><text>that are specified in a notice to the minor; and</text>
</clause><clause id="HDF744A18503545AD87527D8235C4842A"><enum>(ii)</enum><text>to which the minor has consented under paragraph (7) before the information is used or disclosed
for such other purposes.</text>
</clause></subparagraph></paragraph><paragraph id="H6279B570C5ED43B7A6BC68B7DF1549D7"><enum>(4)</enum><header>Retention limitation principle</header><text display-inline="yes-display-inline">The personal information of a minor should not be retained for longer than is necessary to fulfill
a transaction or provide a service requested by the minor or such other
purposes specified in subparagraphs (A) through (D) of paragraph (3). The
operator should implement a reasonable and appropriate data disposal
policy based on the nature and sensitivity of such personal information.</text>
</paragraph><paragraph id="HEF088D3C379F4B3DAF5E6D1D8253C52C"><enum>(5)</enum><header>Security safeguards principle</header><text display-inline="yes-display-inline">The personal information of a minor should be protected by reasonable and appropriate security
safeguards against risks such as loss or unauthorized access, destruction,
use, modification, or disclosure.</text>
</paragraph><paragraph id="H7E70EC7790B343E19BA94D79C736C458"><enum>(6)</enum><header>Openness principle</header>
<subparagraph id="HCB6DA9B4BD9C46B8A14260AEE9F9C8AE"><enum>(A)</enum><header>In general</header><text>The operator should maintain a general policy of openness about developments, practices, and
policies with respect to the personal information of a minor. The operator
should provide each minor using the website, online service, online
application, or mobile application of the operator with a clear and
prominent means—</text>
<clause id="H781455381EB1406E8DA39E25928047CC"><enum>(i)</enum><text>to identify and contact the operator, by, at a minimum, disclosing, clearly and prominently, the
identity of the operator and—</text>
<subclause id="H8A31EA10FB7F441D89320676153E9588"><enum>(I)</enum><text>in the case of an operator who is an individual, the address of the principal residence of the
operator and an e-mail address and telephone number for the operator; or</text>
</subclause><subclause id="HCDC324CE287043A3B834C4B1016CAF66"><enum>(II)</enum><text>in the case of any other operator, the address of the principal place of business of the operator
and an e-mail address and telephone number for the operator;</text>
</subclause></clause><clause id="HC3932A6CAC834A9A99D31E3F2D00B0B4"><enum>(ii)</enum><text>to determine whether the operator possesses any personal information of the minor, the nature of
any such information, and the purposes for which the information was
collected and is being retained;</text>
</clause><clause id="H4E09FA79D4F847A7BBF5F2D164085375"><enum>(iii)</enum><text>to obtain any personal information of the minor that is in the possession of the operator from the
operator, or from a person specified by the operator, within a reasonable
time after making a request, at a charge (if any) that is not excessive,
in a reasonable manner, and in a form that is readily intelligible to the
minor;</text>
</clause><clause id="H99122D81048A47559CC79AC0C481C038"><enum>(iv)</enum><text>to challenge the accuracy of personal information of the minor that is in the possession of the
operator; and</text>
</clause><clause id="HD3363720A69C4AB0ABD5CCA128D048BC"><enum>(v)</enum><text>if the minor establishes the inaccuracy of personal information in a challenge under clause (iv),
to have such information erased, corrected, completed, or otherwise
amended.</text>
</clause></subparagraph><subparagraph id="HE9CCF6BA67F447ACA8DCB8F6B8621333"><enum>(B)</enum><header>Limitation</header><text>Nothing in this paragraph shall be construed to permit an operator to erase or otherwise modify
personal information requested by a law enforcement agency pursuant to
legal authority.</text>
</subparagraph></paragraph><paragraph id="H9F545E140ABD4C63BA5BCF27915A4000"><enum>(7)</enum><header>Individual participation principle</header><text display-inline="yes-display-inline">The operator should—</text>
<subparagraph id="H97A8E3044F7547998AAB52779E5307C9"><enum>(A)</enum><text>obtain consent from a minor before using or disclosing the personal information of the minor for
any purpose other than the purposes described in subparagraphs (A) through
(C) of paragraph (3); and</text>
</subparagraph><subparagraph id="H96304F37E12A45048626845FEC006A12"><enum>(B)</enum><text>obtain affirmative express consent from a minor before using or disclosing previously collected
personal information of the minor for purposes that constitute a material
change in practice from the original purposes specified to the minor under
paragraph (3).</text>
</subparagraph></paragraph></subsection><subsection id="HD742836040EC45C2963B7A53F408564A"><enum>(c)</enum><header>Regulations</header><text display-inline="yes-display-inline">Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate,
under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations to implement
this section, including regulations further defining the Fair Information
Practices Principles described in subsection (b).</text>
</subsection></section><section id="HE7B52F5219D5478981CE9C2FCAC43DB5"><enum>207.</enum><header>Online collection of geolocation information of children and minors</header>
<subsection id="HA6710DA38CFA4B01A8404AE4E7C1B1B1"><enum>(a)</enum><header>Acts prohibited</header>
<paragraph id="H47583EE30922445F8D759CEA4ECDC3D1"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">It is unlawful for an operator of a website, online service, online application, or mobile
application directed to children or minors, or an operator having actual
knowledge that geolocation information being collected is from a child or
minor, to collect geolocation information from a child or minor in a
manner that violates the regulations prescribed under subsection (b).</text>
</paragraph><paragraph id="H1E531CAF42524D90B5BBF475B36B8029"><enum>(2)</enum><header>Disclosure to parent or minor protected</header><text>Notwithstanding paragraph (1), neither an operator nor the operator’s agent shall be held to be
liable under any Federal or State law for any disclosure made in good
faith and following reasonable procedures in responding to a request for
disclosure of geolocation information under subparagraph (C)(ii)(III) or
(D)(ii)(III) of subsection (b)(1).</text>
</paragraph></subsection><subsection id="HBAA35BE5A45746D8B563DB742426F273"><enum>(b)</enum><header>Regulations</header>
<paragraph id="HB77E5022BD674E27B131299A69310E66"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate,
under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations that require
an operator of a website, online service, online application, or mobile
application directed to children or minors, or an operator having actual
knowledge that geolocation information being collected is from a child or
minor—</text>
<subparagraph id="H6A6387DAA3B6475E8E6843EFA33D328A"><enum>(A)</enum><text display-inline="yes-display-inline">to provide clear and conspicuous notice in clear and plain language of any geolocation information
the operator collects, how the operator uses such information, and whether
the operator discloses such information;</text>
</subparagraph><subparagraph id="HD49CAB6E7D244E8A85B0A46944A58829"><enum>(B)</enum><text>to establish procedures or mechanisms to ensure that geolocation information is not collected from
children or minors except in accordance with regulations promulgated under
this paragraph;</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="H60A38D2F776449F592E8C7760C88C33A"><enum>(C)</enum><text display-inline="yes-display-inline">in the case of collection of geolocation information from a child—</text>
<clause id="HA5D7BA2D035A44DB83E6AE52E260D1C7"><enum>(i)</enum><text>prior to collecting such information, to obtain verifiable parental consent; and</text>
</clause><clause id="H3EC72830AC804EC7A754FDFCA17EB1EF"><enum>(ii)</enum><text>after collecting such information, to provide to the parent of the child, upon request by and
proper identification of the parent—</text>
<subclause id="H329ADDAE9F7C4520A40CC18D165A3989"><enum>(I)</enum><text>a description of the geolocation information collected from the child by the operator;</text>
</subclause><subclause id="HAF602C9543E848E08EDD9E42DED78A2B"><enum>(II)</enum><text>the opportunity at any time to refuse to permit the further use or maintenance in retrievable form,
or future collection, by the operator of geolocation information from the
child; and</text>
</subclause><subclause id="H197B33DA91484B6FAFD44A47BF8D9FFD"><enum>(III)</enum><text display-inline="yes-display-inline">a means that is reasonable under the circumstances for the parent to obtain any geolocation
information collected from the child, if such information is available to
the operator at the time the parent makes the request; and</text>
</subclause></clause></subparagraph><subparagraph id="H6B8206EC91AD44FAA42C45E3C7800AC5"><enum>(D)</enum><text display-inline="yes-display-inline">in the case of collection of geolocation information from a minor—</text>
<clause id="H6C24902131C84D2B87FF76A6FE4A7D2A"><enum>(i)</enum><text display-inline="yes-display-inline">prior to collecting such information, to obtain affirmative express consent from such minor; and</text>
</clause><clause id="HA4CBD8FF4F5F45ED99FA7D651A63B964"><enum>(ii)</enum><text>after collecting such information, to provide to the minor, upon request—</text>
<subclause id="HC8DA8696714249D8A1424BCE89E6166D"><enum>(I)</enum><text>a description of the geolocation information collected from the minor by the operator;</text>
</subclause><subclause id="H7EF8347C15C74065AAB09FB967081906"><enum>(II)</enum><text>the opportunity at any time to refuse to permit the further use or maintenance in retrievable form,
or future collection, by the operator of geolocation information from the
minor; and</text>
</subclause><subclause id="HC595104333A544F495272A1DC65C0DA2"><enum>(III)</enum><text display-inline="yes-display-inline">a means that is reasonable under the circumstances for the minor to obtain any geolocation
information collected from the minor, if such information is available to
the operator at the time the minor makes the request.</text>
</subclause></clause></subparagraph></paragraph><paragraph id="H67B9F64C107E49F0848E698618C508EC"><enum>(2)</enum><header>When consent not required</header><text display-inline="yes-display-inline">The regulations promulgated under paragraph (1) shall provide that verifiable parental consent
under subparagraph (C)(i) of such paragraph or affirmative express consent
under subparagraph (D)(i) of such paragraph is not required when the
collection of the geolocation information of a child or minor is
necessary, to the extent permitted under other provisions of law, to
provide information to law enforcement agencies or for an investigation on
a matter related to public safety.</text>
</paragraph><paragraph id="HF34BB8EB95B64B0481DB7C83268F6212"><enum>(3)</enum><header>Continuation of service</header><text display-inline="yes-display-inline">The regulations promulgated under paragraph (1) shall prohibit an operator from discontinuing
service provided to—</text>
<subparagraph id="H4A179293CB9A48DEBA13C02C660D6C44"><enum>(A)</enum><text display-inline="yes-display-inline">a child on the basis of refusal by the parent of the child, under subparagraph (C)(ii)(II) of such
paragraph, to permit the further use or maintenance in retrievable form,
or future online collection, of geolocation information from the child by
the operator, to the extent that the operator is capable of providing such
service without such information; or</text>
</subparagraph><subparagraph commented="no" id="H53D089138396483C85B1CFEC8EF472EA"><enum>(B)</enum><text display-inline="yes-display-inline">a minor on the basis of refusal by the minor, under subparagraph (D)(ii)(II) of such paragraph, to
permit the further use or maintenance in retrievable form, or future
online collection, of geolocation information from the minor by the
operator, to the extent that the operator is capable of providing such
service without such information.</text>
</subparagraph></paragraph></subsection><subsection id="HBB7E188C5B614197B732C7B025DAF01B"><enum>(c)</enum><header>Inconsistent State law</header><text display-inline="yes-display-inline">No State or local government may impose any liability for commercial activities or actions by
operators in interstate or foreign commerce in connection with an activity
or action described in this section that is inconsistent with the
treatment of those activities or actions under this section.</text>
</subsection></section><section id="H1F0945A69ED04D61AA19252631939672"><enum>208.</enum><header>Removal of content</header>
<subsection id="H5256A6475A194D3090C53A94EC40D47F"><enum>(a)</enum><header>Acts prohibited</header><text display-inline="yes-display-inline">It is unlawful for an operator of a website, online service, online application, or mobile
application to make publicly available through the website, service, or
application content or information that contains or displays personal
information of children or minors in a manner that violates the
regulations prescribed under subsection (b).</text>
</subsection><subsection id="HF4AFCDBE833149DF807B2420C9427C71"><enum>(b)</enum><header>Regulations</header>
<paragraph id="HCD96E0C6AA384C18A2836D9CFC1443CC"><enum>(1)</enum><header>In general</header><text>Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate,
under <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, regulations that require
an operator—</text>
<subparagraph id="H8981374854CE44CC82C5227325544AEA"><enum>(A)</enum><text display-inline="yes-display-inline">to the extent technologically feasible, to implement mechanisms that permit a user of the website,
service, or application of the operator to erase or otherwise eliminate
content or information submitted to the website, service, or application
by such user that is publicly available through the website, service, or
application and contains or displays personal information of children or
minors; and</text>
</subparagraph><subparagraph id="H1B597DFEED54434498C92479F2A855AF"><enum>(B)</enum><text display-inline="yes-display-inline">to take appropriate steps to make users aware of such mechanisms and to provide notice to users
that such mechanisms do not necessarily provide comprehensive removal of
the content or information submitted by such users.</text>
</subparagraph></paragraph><paragraph id="HE04250378C554EF69670499D7BAA1B0B"><enum>(2)</enum><header>Exception</header><text>The regulations promulgated under paragraph (1) may not require an operator or third party to erase
or otherwise eliminate content or information that—</text>
<subparagraph id="HE959537673214A84B273EE62C7A58898"><enum>(A)</enum><text display-inline="yes-display-inline">any other provision of Federal or State law requires the operator or third party to maintain; or</text>
</subparagraph><subparagraph id="HA5609D1EE17D43FEAA913991C2E34515"><enum>(B)</enum><text display-inline="yes-display-inline">was submitted to the website, service, or application of the operator by any person other than the
user who is attempting to erase or otherwise eliminate such content or
information, including content or information submitted by such user that
was republished or resubmitted by another person.</text>
</subparagraph></paragraph><paragraph id="H4D3D984E7CAE44A3B9CA9CB4D71ECB84"><enum>(3)</enum><header>Limitation</header><text>Nothing in this section shall be construed to limit the authority of a law enforcement agency to
obtain any content or information from an operator as authorized by law or
pursuant to an order of a court of competent jurisdiction.</text>
</paragraph></subsection></section><section id="H8CA3D40075FC4E96BBA4E800624FD559"><enum>209.</enum><header>Enforcement and applicability</header>
<subsection id="H3884CBE0E04149079E9399FFFC6361AF"><enum>(a)</enum><header>Enforcement by the Commission</header>
<paragraph id="H98BFB464411B4494A62BFB0663F77FA5"><enum>(1)</enum><header>In general</header><text>Except as otherwise provided, this title and the regulations prescribed under this title shall be
enforced by the Commission under the Federal Trade Commission Act (15
U.S.C. 41 et seq.).</text>
</paragraph><paragraph id="H312260EBEC5E4D8A807766C951D5ED2F"><enum>(2)</enum><header>Unfair or deceptive acts or practices</header><text display-inline="yes-display-inline">Subject to subsection (b), a violation of this title or a regulation prescribed under this title
shall be treated as a violation of a rule defining an unfair or deceptive
act or practice prescribed under section 18(a)(1)(B) of the Federal Trade
Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/57a">15 U.S.C. 57a(a)(1)(B)</external-xref>).</text>
</paragraph><paragraph id="H2B271BCBC0104071A2D9AAC39AD747E6"><enum>(3)</enum><header>Actions by the Commission</header>
<subparagraph id="H79994DFBA10B45D38777B71FFD173FBC"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">Subject to subsection (b), and except as provided in subsection (d)(1), the Commission shall
prevent any person from violating this title or a regulation prescribed
under this title in the same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all applicable terms and
provisions of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/41">15 U.S.C. 41 et seq.</external-xref>) were
incorporated into and made a part of this title.</text>
</subparagraph><subparagraph id="HC9A66765148A479CADBE457489BBFF0D"><enum>(B)</enum><header>Privileges and immunities</header><text display-inline="yes-display-inline">Any person who violates this title or a regulation prescribed under this title shall be subject to
the penalties and entitled to the privileges and immunities provided in
the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/41">15 U.S.C. 41 et seq.</external-xref>).</text>
</subparagraph></paragraph></subsection><subsection commented="no" id="HCC4912E3CEB346478DD46DB8F032295B"><enum>(b)</enum><header>Enforcement by certain other agencies</header><text>Notwithstanding subsection (a), compliance with the requirements imposed under this title shall be
enforced as follows:</text>
<paragraph commented="no" id="H02179486185F4051AFA06A7BE220A3BA"><enum>(1)</enum><text display-inline="yes-display-inline">Under section 8 of the Federal Deposit Insurance Act (<external-xref legal-doc="usc" parsable-cite="usc/12/1818">12 U.S.C. 1818</external-xref>) by the appropriate Federal
banking agency, with respect to an insured depository institution (as such
terms are defined in section 3 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/12/1813">12 U.S.C. 1813</external-xref>)).</text>
</paragraph><paragraph commented="no" id="HC563883225D14EBAB2E32A3F567654DC"><enum>(2)</enum><text>Under the Federal Credit Union Act (<external-xref legal-doc="usc" parsable-cite="usc/12/1751">12 U.S.C. 1751 et seq.</external-xref>) by the National Credit Union
Administration Board, with respect to any Federal credit union.</text>
</paragraph><paragraph commented="no" id="H9CD61CFD8BC844D69B2DC6201818ECDB"><enum>(3)</enum><text>Under part A of subtitle VII of title 49, United States Code, by the Secretary of Transportation,
with respect to any air carrier or foreign air carrier subject to such
part.</text>
</paragraph><paragraph commented="no" id="HD7C06566276640288AF8D4A4CB857CD2"><enum>(4)</enum><text>Under the Packers and Stockyards Act, 1921 (<external-xref legal-doc="usc" parsable-cite="usc/7/181">7 U.S.C. 181 et seq.</external-xref>) (except as provided in section
406 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/7/226">7 U.S.C. 226</external-xref>; 227)) by the Secretary of Agriculture, with
respect to any activities subject to such Act.</text>
</paragraph><paragraph commented="no" id="H74C1998F4F8E4319B074E9A1B221D42B"><enum>(5)</enum><text>Under the Farm Credit Act of 1971 (<external-xref legal-doc="usc" parsable-cite="usc/12/2001">12 U.S.C. 2001 et seq.</external-xref>) by the Farm Credit Administration, with
respect to any Federal land bank, Federal land bank association, Federal
intermediate credit bank, or production credit association.</text>
</paragraph></subsection><subsection id="H61DD1B8CEA464143BDD62E1459E76BE1"><enum>(c)</enum><header>Enforcement by States</header>
<paragraph id="H79E86CF33AC14384AB240983D4351870"><enum>(1)</enum><header>Civil actions</header><text display-inline="yes-display-inline">In any case in which the attorney general of a State has reason to believe that an interest of the
residents of that State has been or is threatened or adversely affected by
the engagement of any person in a practice that violates this title or a
regulation prescribed under this title, the State, as parens patriae, may
bring a civil action on behalf of the residents of the State in a district
court of the United States of appropriate jurisdiction to—</text>
<subparagraph id="H031110768A5346D2AA21DA40F0B1713B"><enum>(A)</enum><text>enjoin that practice;</text>
</subparagraph><subparagraph id="H0FD51E364BDD4062B1C24CC26D0C8721"><enum>(B)</enum><text>enforce compliance with this title or such regulation;</text>
</subparagraph><subparagraph id="HCACA03D93ED14193A5704E81E73A5734"><enum>(C)</enum><text>obtain damages, restitution, or other compensation on behalf of residents of the State; or</text>
</subparagraph><subparagraph id="H953F48CAADED42B8AB4D9D5DB591C214"><enum>(D)</enum><text>obtain such other relief as the court may consider to be appropriate.</text>
</subparagraph></paragraph><paragraph id="H2CCD0753A78B4A08BEAD1686E0AABF93"><enum>(2)</enum><header>Rights of Federal Trade Commission</header>
<subparagraph id="H65DAC633DABE40D586C24370530FAFBE"><enum>(A)</enum><header>Notice to Federal Trade Commission</header>
<clause id="H109B41B425AE4EEF958C17CA9ACCFB1F"><enum>(i)</enum><header>In general</header><text>Except as provided in clause (iii), the attorney general of a State shall notify the Federal Trade
Commission in writing that the attorney general intends to bring a civil
action under paragraph (1) before initiating the civil action.</text>
</clause><clause id="H387086D062FF46EEA059BDE14C25B162"><enum>(ii)</enum><header>Contents</header><text>The notification required by clause (i) with respect to a civil action shall include a copy of the
complaint to be filed to initiate the civil action.</text>
</clause><clause id="H041E233936D64448ADD0F611604346E0"><enum>(iii)</enum><header>Exception</header><text>If it is not feasible for the attorney general of a State to provide the notification required by
clause (i) before initiating a civil action under paragraph (1), the
attorney general shall notify the Federal Trade Commission immediately
upon instituting the civil action.</text>
</clause></subparagraph><subparagraph id="H5FF89D0F550244269A0320015E33F487"><enum>(B)</enum><header>Intervention by Federal Trade Commission</header><text>The Federal Trade Commission may—</text>
<clause id="HCCB709CCC62F4FB18814A909BB5A0B1F"><enum>(i)</enum><text>intervene in any civil action brought by the attorney general of a State under paragraph (1); and</text>
</clause><clause id="H53970C19F49F4514AAEB6161A15872FC"><enum>(ii)</enum><text>upon intervening—</text>
<subclause id="HF5974494412F457BBA257E973438D5A7"><enum>(I)</enum><text>be heard on all matters arising in the civil action; and</text>
</subclause><subclause commented="no" display-inline="no-display-inline" id="H678CDE097C334665B8004402D5381DDF"><enum>(II)</enum><text>file petitions for appeal of a decision in the civil action.</text>
</subclause></clause></subparagraph></paragraph><paragraph id="HFB1074EAC1C94AC992C23F028016F68C"><enum>(3)</enum><header>Investigatory powers</header><text>For purposes of bringing any civil action under paragraph (1), nothing in this title shall be
construed to prevent an attorney general of a State from exercising the
powers conferred on the attorney general by the laws of that State to—</text>
<subparagraph id="H6F7BEC5F1DA64145855F549D7838A42E"><enum>(A)</enum><text>conduct investigations;</text>
</subparagraph><subparagraph id="H47E28B6DE36345B6A2608CE7AA96D1A8"><enum>(B)</enum><text>administer oaths or affirmations; or</text>
</subparagraph><subparagraph id="HCBE7129693EE48E6B1722BD583A5E9A5"><enum>(C)</enum><text>compel the attendance of witnesses or the production of documentary and other evidence.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H57A3122D46ED4012A2C45708E67E3B98"><enum>(4)</enum><header display-inline="yes-display-inline">Preemptive action by Federal Trade Commission</header><text display-inline="yes-display-inline">If the Federal Trade Commission institutes a civil action or an administrative action with respect
to a violation of this title, the attorney general of a State may not,
during the pendency of such action, bring a civil action under paragraph
(1) against any defendant named in the complaint of the Commission for the
violation with respect to which the Commission instituted such action.</text>
</paragraph><paragraph id="H7F80AA83EF13413A8AB1F4EA8E6D3650"><enum>(5)</enum><header>Venue; service of process</header>
<subparagraph id="H985722A1BF0C47169A157C785FD4E1EF"><enum>(A)</enum><header>Venue</header><text>Any action brought under paragraph (1) may be brought in the district court of the United States
that meets applicable requirements relating to venue under section 1391 of
title 28, United States Code.</text>
</subparagraph><subparagraph id="H57695E2C0211483CA17D8C75937F3894"><enum>(B)</enum><header>Service of process</header><text>In an action brought under paragraph (1), process may be served in any district in which the
defendant—</text>
<clause id="H26723E9CFDA54664B7C8C2C56F90DE7D"><enum>(i)</enum><text>is an inhabitant; or</text>
</clause><clause id="H7C17E950AA0F402CB1F14B45BD996DF5"><enum>(ii)</enum><text>may be found.</text>
</clause></subparagraph></paragraph><paragraph commented="no" id="H338F2CD6EE164C378773B44B72B7586D"><enum>(6)</enum><header>Actions by other State officials</header>
<subparagraph commented="no" id="H78791838A9F14C63B44BBEC452F125CF"><enum>(A)</enum><header>In general</header><text>In addition to civil actions brought by attorneys general under paragraph (1), any other officer of
a State who is authorized by the State to do so may bring a civil action
under paragraph (1), subject to the same requirements and limitations that
apply under this subsection to civil actions brought by attorneys general.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HB01D9BCDA04D46A29DD44E5FD223E0CF"><enum>(B)</enum><header>Savings provision</header><text>Nothing in this subsection may be construed to prohibit an authorized official of a State from
initiating or continuing any proceeding in a court of the State for a
violation of any civil or criminal law of the State.</text>
</subparagraph></paragraph></subsection><subsection id="HFAE6E753393E4A478D343736984F7FD9"><enum>(d)</enum><header>Telecommunications carriers and cable operators</header>
<paragraph id="H14CEE71C659140BE9D2478A4DD946D8C"><enum>(1)</enum><header>Enforcement by FTC</header><text display-inline="yes-display-inline">Notwithstanding section 5(a)(2) of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(2)</external-xref>),
compliance with the requirements imposed under this title shall be
enforced by the Commission with respect to any telecommunications carrier
(as defined in section 3 of the Communications Act of 1934 (47 U.S.C.
153)).</text>
</paragraph><paragraph id="H0BA9C6C68D4B4C4D9034A6BAC77C307E"><enum>(2)</enum><header>Relationship to other law</header><text display-inline="yes-display-inline">To the extent that sections 222, 338(i), and 631 of the Communications Act of 1934 (<external-xref legal-doc="usc" parsable-cite="usc/47/222">47 U.S.C. 222</external-xref>;
338(i); 551) are inconsistent with this title, this title controls.</text>
</paragraph></subsection></section><section commented="no" id="HBEBF447C517D440DA5D42421D2F4AABE"><enum>210.</enum><header>Rule for treatment of users of websites, services, and applications directed to children or minors</header><text display-inline="no-display-inline">An operator of a website, online service, online application, or mobile application that is
directed to children or minors shall treat all users of such website,
service, or application as children or minors (as the case may be) for
purposes of this title, except as permitted by the Commission by a
regulation promulgated under this title.</text>
</section><section commented="no" id="HE0045A04F4AA44A2860A3E508B4A514A"><enum>211.</enum><header>Effective dates</header>
<subsection commented="no" id="H57CD59031E454D998A57300D55E479F6"><enum>(a)</enum><header>In general</header><text>Except as provided in subsections (b) and (c), this title and the amendments made by this title
shall take effect on the date that is 1 year after the date of the
enactment of this Act.</text>
</subsection><subsection commented="no" id="HE54A77FD7DF44266A132269F9B51FF6B"><enum>(b)</enum><header>Authority To promulgate regulations</header><text>The following shall take effect on the date of the enactment of this Act:</text>
<paragraph commented="no" id="HE2B1030949094EF2A5E2288EBE776CE5"><enum>(1)</enum><text display-inline="yes-display-inline">The amendments made by subsections (a)(5) and (b)(3)(A) of section 204.</text>
</paragraph><paragraph commented="no" id="HAFE6169DE32F41AF8CB671335797C5C4"><enum>(2)</enum><text>Sections 205(b), 206(c), 207(b), and 208(b).</text>
</paragraph><paragraph id="H3080BB0D81B942CE9C574AE74176ADE5"><enum>(3)</enum><text>Subsections (b) and (c) of section 203.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="H6B395A5D7AB04830A37E0F39AEBEC0C1"><enum>(c)</enum><header>Digital Marketing Bill of Rights for Teens</header><text>Section 206, except for subsection (c) of such section, shall take effect on the date that is 180
days after the promulgation of regulations under such subsection.</text>
</subsection></section>