[Congressional Bills 105th Congress]
[From the U.S. Government Publishing Office]
[H.R. 4470 Introduced in House (IH)]







105th CONGRESS
  2d Session
                                H. R. 4470

  To prohibit Federal, State, and local agencies and private entities 
from transferring, selling, or disclosing personal data with respect to 
an individual to other agencies or entities without the express consent 
of the individual except in limited circumstances, and to require such 
    agencies and entities to provide individuals with personal data 
              maintained with respect to such individuals.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             August 6, 1998

 Mr. Hinchey introduced the following bill; which was referred to the 
              Committee on Government Reform and Oversight

_______________________________________________________________________

                                 A BILL


 
  To prohibit Federal, State, and local agencies and private entities 
from transferring, selling, or disclosing personal data with respect to 
an individual to other agencies or entities without the express consent 
of the individual except in limited circumstances, and to require such 
    agencies and entities to provide individuals with personal data 
              maintained with respect to such individuals.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Personal Data Privacy Act of 1998''.

SEC. 2. LIMITATIONS ON TRANSFER, SALE, OR DISCLOSURE OF PERSONAL DATA.

    (a) Limitation on Transfer, Sale, or Disclosure of Personal Data.--
Except as provided in subsection (b), no Government agency or private 
entity may transfer, sell, or disclose any personal data with respect 
to an individual to another Government agency or private entity without 
the express consent of such individual. The preceding sentence shall 
apply with respect to each transfer, sale, or disclosure of personal 
data by a Government agency or private entity.
    (b) Exceptions.--Subsection (a) shall not apply with respect to the 
transfer, sale, or disclosure of data by a Government agency for a 
national security purpose, law enforcement purpose, or purpose relating 
to the Federal or State regulation of an industry.

SEC. 3. REQUIREMENT TO PROVIDE ACCESS TO PERSONAL DATA UPON REQUEST OF 
              INDIVIDUAL; REPORTS ON DATA COLLECTED.

    (a) Access to Personal Data Required.--A Government agency or 
private entity, shall, upon the request of an individual with respect 
to whom the agency or entity maintains personal data, provide such 
individual with access to such personal data not later than five 
business days after the individual makes the request.
    (b) Reports.--Each year a Government agency or private entity shall 
provide, to each individual regarding whom the agency or entity has 
collected or maintained personal data during the preceding 12-month 
period, a report including the personal data collected with respect to 
the individual during such period. A Government agency or private 
entity shall provide such report to an individual regardless of whether 
the agency or entity has provided the data to the individual pursuant 
to the requirement in subsection (a).

SEC. 4. DEFINITIONS.

    For purposes of this Act:
            (1) The term ``personal data'' means any data that contains 
        individually identifiable information with respect to an 
        individual, including (but not limited to) the following:
                    (A) The name of the individual.
                    (B) The address of the individual.
                    (C) The Social Security number of the individual.
                    (D) Any information relating to the medical records 
                of the individual.
                    (E) The passport number or driver's-license number 
                of the individual.
                    (F) Any student identification or taxpayer 
                identification numbers with respect to the individual.
                    (G) Any school records of the individual.
                    (H) The Internet address of the individual.
                    (I) Any information relating to a credit card 
                account of the individual.
                    (J) Any other information regarding an account with 
                information that is individually identifiable with 
                respect to the individual.
            (2) The term ``Government agency'' means any Federal, 
        State, or local agency.
            (3) The term ``private entity'' means any business, 
        corporation, joint venture, affiliate, or subsidiary thereof.

SEC. 5. PRIVATE RIGHT OF ACTION FOR VIOLATIONS.

    Whenever a Government agency or private entity fails to comply with 
the provisions of this Act, the individual with respect to whom the 
personal data relates may bring a civil action against such agency or 
entity, and the district courts of the United States shall have 
jurisdiction in the matters under the provisions in this Act.

SEC. 6. EFFECTIVE DATE.

    This Act shall take effect on November 1, 1998.
                                 <all>