Short title

This Act may be cited as the Personal Data Offshoring Protection Act of 2004.

Definitions

As used in this Act, the following definitions apply: (1)

Business enterprise

The term business enterprise means any organization, association, or venture established to make a profit, or any private, nonprofit organization that collects or retains personally identifiable information. (2)

Country with adequate privacy protection

The term country with adequate privacy protection means a country that has been certified by the Federal Trade Commission as having a legal system that provides adequate privacy protection for personally identifiable information. (3)

Personally identifiable information

The term personally identifiable information includes information such as— (A)name; (B)postal address; (C)financial information; (D)medical records; (E)date of birth; (F)phone number; (G)e-mail address; (H)social security number; (I)mother’s maiden name; (J)password; (K)state identification information; (L)driver’s license number; (M)personal tax information; and (N)any consumer transactional or experiential information relating to the person. (4)

Transmit

The term transmit or transmission means the use of any instrumentality of interstate commerce, including the mails or any electronic means, to transfer information or to provide access to such information via the Internet or any comparable telecommunications system.

Protection of Personally Identifiable Information From Unauthorized transmission

(a)

In general

A business enterprise may transmit personally identifiable information regarding a citizen of the United States to any foreign affiliate or subcontractor located in a country that is a country with adequate privacy protection, provided that the citizen has been provided prior notice that such information may be transmitted to such a foreign affiliate or subcontractor and has not objected to such transmission. (b)

Opt-in Consent required for Countries without adequate privacy protection

A business enterprise may not transmit personally identifiable information regarding a citizen of the United States to any foreign affiliate or subcontractor located in a country that is a country without adequate privacy protection unless— (1)the business enterprise discloses to the citizen that the country to which the information will be transmitted does not have adequate privacy protection; (2)the business enterprise obtains consent from the citizen, before a consumer relationship is established or before the effective date of this Act, to transmit such information to such foreign affiliate or subcontractor; and (3)the consent referred to in paragraph (2) is renewed by the citizen within 1 year before such information is transmitted. (c)

Prohibition on refusal to provide services

A business enterprise shall not deny the provision of any good or service to, nor change the terms of or refuse to enter into a business relationship with any person based upon that person’s exercise of the consent rights provided for in this Act or in any other applicable law.

Enforcement by the Federal Trade Commission

(a)

Unfair and deceptive act or practice

A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (b)

Enforcement authority

The Federal Trade Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

Civil remedies

(a)

Private right of action

A person or entity may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State— (1)an action based on a violation of this Act or the regulations prescribed pursuant to this Act to enjoin such violation; (2)an action to recover for actual monetary loss from such a violation, or to receive $10,000 in damages for each such violation, whichever is greater, or (3)both such actions.

If the court finds that the defendant willfully or knowingly violated this subsection or the regulations prescribed under this subsection, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under paragraph (2).

(b)

Actions by States

(1)

Authority of States

Whenever the attorney general of a State, or an official or agency designated by a State, has reason to believe that any person has engaged or is engaging in a violation of this Act or the regulations prescribed pursuant to this Act, the State may bring a civil action on behalf of its residents to enjoin such violation, an action to recover for actual monetary loss or receive $10,000 in damages for each violation, or both such actions. If the court finds the defendant willfully or knowingly violated this Act or regulations prescribed pursuant to this Act, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under the preceding sentence. (2)

Exclusive jurisdiction of Federal courts

The district courts of the United States, the United States courts of any territory, and the District Court of the United States for the District of Columbia shall have exclusive jurisdiction over all civil actions brought under this subsection. Upon proper application, such courts shall also have jurisdiction to issue writs of mandamus, or orders affording like relief, commanding the defendant to comply with the provisions of this Act or regulations prescribed pursuant to this Act, including the requirement that the defendant take such action as is necessary to remove the danger of such violation. Upon a proper showing, a permanent or temporary injunction or restraining order shall be granted without bond. (3)

Notice to an intervention of federal Trade Commission

The State bringing a civil action under this section shall serve prior written notice of any such civil action upon the Federal Trade Commission and provide the Commission with a copy of its complaint, except in any case where such prior notice is not feasible, in which case the State shall serve such notice immediately upon instituting such action. The Commission shall have the right— (A)to intervene in the action; (B)upon so intervening, to be heard on all matters arising therein; and (C)to file petitions for appeal. (4)

Venue; service of process

Any civil action brought under this subsection in a district court of the United States may be brought in the district wherein the defendant is found or is an inhabitant or transacts business or wherein the violation occurred or is occurring, and process in such cases may be served in any district in which the defendant is an inhabitant or where the defendant may be found. (5)

Investigatory powers

For purposes of bringing any civil action under this subsection, nothing in this Act shall prevent the attorney general of a State, or an official or agency designated by a State, from exercising the powers conferred on the attorney general or such official by the laws of such State to conduct investigations or to administer oaths or affirmations or to compel the attendance of witnesses or the production of documentary and other evidence. (6)

Effect on state court proceedings

Nothing contained in this section shall be construed to prohibit an authorized State official from proceeding in State court on the basis of an alleged violation of any general civil or criminal statute of such State. (7)

Limitation

Whenever the Federal Trade Commission has instituted a civil action for violation of this Act or the regulations prescribed pursuant to this Act, no State may, during the pendency of such action instituted by the Commission, subsequently institute a civil action against any defendant named in the Commission’s complaint for any violation as alleged in the Commission’s complaint.

Certification of countries with adequate privacy protection

(a)

In general

Not later than 6 months after the date of enactment of this Act, the Federal Trade Commission, after providing notice and opportunity for public comment, shall— (1)certify those countries that have legal systems that provide adequate privacy protection for personally identifiable information; and (2)make the list of countries certified under paragraph (1) available to the general public. (b)

Certification criteria

(1)

In general

In determining whether a country should be certified under this section, the Federal Trade Commission shall consider the adequacy of the country’s infrastructure for detecting, evaluating, and responding to privacy violations. (2)

Presumption

The Commission shall presume that a country’s privacy protections are inadequate if they are any less protective of personally identifiable information than those afforded under Federal law or under the laws of any State, or if the Commission determines that such country’s laws are not adequately enforced. (c)

European Union Date Protection Directive

A country that has comprehensive privacy laws that meet the requirements of the European Union Data Protection Directive shall be certified under this section unless the Federal Trade Commission determines that such laws are not commonly enforced within such country.

Effective Date

Section 6 of this Act shall take effect on the date of enactment of this Act. Sections 2 through 5 of this Act shall take effect 60 days after the the completion of the certification required by section 6.