<enum>I</enum><header>Protection of individual privacy in interstate commerce</header> <section id="HA00DCC2E0CF943598D377B11C73069D8"><enum>101.</enum><header>Privacy notices to consumers</header> <subsection id="H5239DA0EEBE24CCDB7BFCAE5EEFD78AE"><enum>(a)</enum><header>Notice required</header><text>A data collection organization shall provide to a consumer a notice containing the information required under subsection (b) as follows:</text> <paragraph id="H464CBFD70DA94201BAC3B56195B7C3A9"><enum>(1)</enum><text>Upon the first instance of collection from the consumer of personally identifiable information, that may be used for a purpose unrelated to the transaction, by a data collection organization, the organization shall provide the notice at the time personally identifiable information is collected.</text></paragraph> <paragraph id="H5E84D777866C40229FCF5355BB195FD9"><enum>(2)</enum><text>Upon a material change in the organization’s privacy policy under section 102(a), the organization shall provide the notice, not later than the first time after such change in policy that the organization seeks to collect, sell, disclose for consideration, or use personally identifiable information to the extent practicable, to each consumer from whom the organization has collected such information.</text></paragraph></subsection> <subsection id="H6A78953BA737451193D200BAEC8E5120"><enum>(b)</enum><header>Form and contents of notice</header><text>A notice required under subsection (a) shall be provided in a clear and conspicuous manner, be prominently displayed or explicitly stated to the consumer, and contain the following information:</text> <paragraph id="H98981CA9B89D4C0F81B45FC78BDBBCB8"><enum>(1)</enum><text>A statement that the personal information collected by the data collection organization may be used or disclosed for purposes or transactions unrelated to that for which it was collected, as described in the organization’s privacy statement.</text></paragraph> <paragraph id="HCBE34815ABAD4F6692036BCAB4890507"><enum>(2)</enum><text>A description of the manner in which the consumer may obtain a privacy policy statement that meets the requirements of section 102, which may include providing the consumer with an Internet website, a hyperlink to such a website, or a toll-free telephone number from which such a statement may be obtained. If the notice required under subsection (a) is provided to the consumer by means of an Internet website, one manner in which the consumer may obtain the privacy policy statement must be by means of an Internet website.</text></paragraph> <paragraph id="H7331856BFB724C66BDC9D3B6DF10249E"><enum>(3)</enum><text>If the notice is required under subsection (a)(2), a statement that there has been a material change in the organization’s privacy policy.</text></paragraph></subsection></section> <section id="H804484EAFFBF461D9406AC986EC3F7A0"><enum>102.</enum><header>Privacy policy statements</header> <subsection id="H7F9FDA6391724E8F8366B63C259BD5A6"><enum>(a)</enum><header>Privacy policy</header><text>A data collection organization shall establish a privacy policy with respect to the collection, sale, disclosure for consideration, dissemination, use, and security of the personally identifiable information of consumers, the principal elements of which shall be embodied in a privacy policy statement (or statements) that meets the requirements of subsection (b).</text></subsection> <subsection id="H4ABBF444E0874D3C9D8C7017FE0840ED"><enum>(b)</enum><header>Statement</header><text>The statement (or statements) required under subsection (a) shall meet the following requirements:</text> <paragraph id="H7C6B0ECC6C984A75B0A7F4227E1C342F"><enum>(1)</enum><text>The statement must be brief, concise, clear, and conspicuous and written in plain language.</text></paragraph> <paragraph id="H9569A6CFA23542EF00E02071C6BB7899"><enum>(2)</enum><text>The statement must be accessible to all consumers of the data collection organization (regardless of the means by which a consumer conducts a transaction with the organization)—</text> <subparagraph id="H669F18256BB14DBDBF263E55ACF56806"><enum>(A)</enum><text>at no charge to the consumer; and</text></subparagraph> <subparagraph id="H99A326F2E19E4F8B859C002C332880AF"><enum>(B)</enum><text>at the time the data collection organization first collects personally identifiable information about the consumer that may be used for a purpose unrelated to a transaction with the consumer and subsequently.</text></subparagraph></paragraph> <paragraph id="H24333796B3D740B388C0EC05359F2F81"><enum>(3)</enum><text>The statement must disclose only the following:</text> <subparagraph id="H9BA374A89C28488D93113DDE004D08B"><enum>(A)</enum><text>The identity of each data collection organization, or a description of each class or type of data collection organization, that may collect or use the information.</text></subparagraph> <subparagraph id="H18BA8C3F9AC04793A4DDEEAE310D7B2"><enum>(B)</enum><text>The types of information that may be collected or used.</text></subparagraph> <subparagraph id="H401B22E74CE84D7BA569CD53E96527EE"><enum>(C)</enum><text>How the information may be used.</text></subparagraph> <subparagraph id="H85D7101E9CF4465E846D1F815C6F7515"><enum>(D)</enum><text>Whether the consumer is required to provide the information in order to do business with the data collection organization.</text></subparagraph> <subparagraph id="H7CBF19C495B44307A5D00C56D8DA32D"><enum>(E)</enum><text>The extent to which the information is subject to sale or disclosure for consideration to a data collection organization that is not an information-sharing affiliate of the data collection organization providing the statement, including—</text> <clause id="HF684D1FCD9B04E2A8E65F2BA0617B673"><enum>(i)</enum><text>a clear and prominent statement of the fact that the information is subject to such sale or disclosure for consideration;</text></clause> <clause id="HA06B17D20A2047C1B54BF3C9E50705CA"><enum>(ii)</enum><text>a description of each class or type of data collection organization to which the information may be sold or disclosed for consideration;</text></clause> <clause id="HAE95EDCBBDB342C2AA7F9E1137008770"><enum>(iii)</enum><text>to the extent practicable, the purpose for which the information may be used; and</text></clause> <clause id="HE41DE331AD0046B8933C79FBEB1E8C8E"><enum>(iv)</enum><text>the types of information that may be sold or disclosed for consideration.</text></clause></subparagraph> <subparagraph id="HFEBC29B7371C404CA3C2864FC29F06B3"><enum>(F)</enum><text>Whether the information security practices of the data collection organization meet the security requirements of section 105 in order to prevent unauthorized disclosure or release of personally identifiable information.</text></subparagraph></paragraph></subsection> <subsection id="HAB66977DFEDE486CBE5304F424947CD8"><enum>(c)</enum><header>Commission facilitation</header><text>The Commission shall take actions (including conducting industry-wide workshops) to facilitate the development of harmonized, universal wording or logo-based graphics in order to convey the contents of privacy policy statements required under this section.</text></subsection></section> <section id="H0E59C29A01E44B2AB8B689E1F3A821D"><enum>103.</enum><header>Consumer opportunity to limit sale or disclosure of information</header> <subsection id="HA9D2114A100C4A29A8949396D5D7C6EE"><enum>(a)</enum><header>Preclusion of sale or disclosure</header> <paragraph id="H4D283D56C3C14A7887C6B292BBCD67E"><enum>(1)</enum><header>Requirement</header><text>A data collection organization shall provide to the consumer, without charge, the opportunity to preclude any sale or disclosure for consideration of the consumer’s personally identifiable information, provided in a particular data collection, that may be used for a purpose other than a transaction with the consumer, to any data collection organization that is not an information-sharing affiliate of the data collection organization providing such opportunity.</text></paragraph> <paragraph id="H295DC540D8D34856A04CFE1B59C49998"><enum>(2)</enum><header>Duration</header><text>A preclusion on sale or disclosure for consideration of information established by a consumer under this subsection shall remain in effect for 5 years or until the consumer indicates otherwise, whichever occurs sooner. A data collection organization may not seek reconsideration of a consumer’s preclusion of such sale or disclosure until at least 1 year after such preclusion has been imposed by the consumer.</text></paragraph></subsection> <subsection id="HC1ECCD8DB9EA4155B297E442D162E48F"><enum>(b)</enum><header>Permission for sale or disclosure</header><text>A data collection organization may provide the consumer an opportunity to permit the sale or disclosure described in subsection (a)(1) in exchange for a benefit to the consumer.</text></subsection> <subsection id="HAC2412C7936C4808A2DAD4DA2B069D2B"><enum>(c)</enum><header>Accessibility</header><text>The opportunity to preclude (or if offered, to permit) the sale or disclosure for consideration of information under this section must be both easy to access and use, and the notice of the opportunity to preclude must be clear and conspicuous.</text></subsection></section> <section id="HC69E61C449D74A4785D2A21C005567E8"><enum>104.</enum><header>Consumer opportunity to limit other information practices</header><text display-inline="no-display-inline">If a data collection organization provides to a consumer the opportunity to limit other practices of the data collection organization with respect to a particular collection or use of personally identifiable information regarding the consumer, other than that required by section 103—</text> <paragraph id="HA8F20788DB504F0A97F5A6BB5D17002E"><enum>(1)</enum><text>a notice and description of such opportunity must appear in the privacy statement;</text></paragraph> <paragraph id="H1CD3935181304714A398F12770867935"><enum>(2)</enum><text>such opportunity must be easy to access and to use; and</text></paragraph> <paragraph id="H07959AA4FA5149B1BC7F3BE651B698CD"><enum>(3)</enum><text>any limitation exercised by the consumer pursuant to such opportunity shall remain in effect, unless—</text> <subparagraph id="HB82DC117B4EC45469E2D5DC268305FA7"><enum>(A)</enum><text>the limitation is withdrawn by the consumer; or</text></subparagraph> <subparagraph id="HC81880A5F9EF4E84BF17ED4D52E272ED"><enum>(B)</enum><text>the data collection organization provides the consumer at least 30 days notice before materially changing the limitation or terminating its compliance with the limitation.</text></subparagraph></paragraph></section> <section id="H2B032017F08C43E8B16781AA07C72CB8"><enum>105.</enum><header>Information security obligations</header> <subsection id="H3A081B7FEBE84036B5DA218566E76F24"><enum>(a)</enum><header>Information security policy</header> <paragraph id="HAB07396562D54610AC448060A5852851"><enum>(1)</enum><header>Implementation</header><text>A data collection organization shall prepare, revise as necessary, and implement an information security policy that is applicable to the information security practices and treatment of personally identifiable information maintained by the data collection organization, that is designed to prevent the unauthorized disclosure or release of such information.</text></paragraph> <paragraph id="H4B84804E66AD41DB9D54315B25620015"><enum>(2)</enum><header>Management approval</header><text>An information security policy created pursuant to paragraph (1) shall be considered and approved by the senior management officials of the data collection organization.</text></paragraph> <paragraph id="H5C16A2642757468887318E8B53D6CA"><enum>(3)</enum><header>Contents</header><text>An information security policy required under paragraph (1) shall include—</text> <subparagraph id="H67C171A8714649D0A69C268EECAB73C5"><enum>(A)</enum><text>a process for taking corrective action pursuant to subsection (b); and</text></subparagraph> <subparagraph id="HAE96E4E899E14A1B87C9BC33B727FC2C"><enum>(B)</enum><text>identifying an officer of the data collection organization as the point of contact with responsibility for information security issues for the organization.</text></subparagraph></paragraph></subsection> <subsection id="HCB04D29983EC4C808F0360D441E2C443"><enum>(b)</enum><header>Corrective actions</header> <paragraph id="H241380BF3D544499ADF5E81E3D13AAD"><enum>(1)</enum><header>Information security advisories and action</header><text>Except as provided in paragraph (2), upon the issuance of an information security advisory (as such term is defined in subsection (d)), a data collection organization shall, within a reasonable period of time after the issuance of such advisory and pursuant to its information security policy, take appropriate action reasonably necessary to mitigate against any vulnerability identified in such advisory, including implementing any changes to its security practices and the architecture, installation, or implementation of its network or operating software (including corrective patches) in response to such advisory.</text></paragraph> <paragraph id="H1479892CA14B448E894F9D5CA6E62EE7"><enum>(2)</enum><header>Exceptions</header><text>A data collection organization shall not be required to take the action specified in an information security advisory under paragraph (1) if such organization can, in good faith, show that—</text> <subparagraph id="H4E10E149710D4DF2AE163DBBDB1401C0"><enum>(A)</enum><text>the corrective action required would cause harm to, or weaken, the organization’s existing information security for personally identifiable information or the procedures or systems of the organization;</text></subparagraph> <subparagraph id="H81B8611536194109A75140A9AE847F31"><enum>(B)</enum><text>the organization takes, or has taken, other appropriate steps or corrective action to mitigate the vulnerabilities and exposure risks identified in the information security advisory; or</text></subparagraph> <subparagraph id="H1E1F773C7ADC40F6B1D2246BD9D4434D"><enum>(C)</enum><text>the specified corrective action is not necessary.</text></subparagraph></paragraph></subsection> <subsection id="HC9A5DBD4A44A4B1F8C907CF642603807"><enum>(c)</enum><header>Effect of release of personally identifiable information</header><text>If the security of a data collection organization has been compromised, resulting in the unauthorized release of a consumer’s personally identifiable information, the data collection organization shall be presumed to be in violation of this section if such organization has failed to respond to an information security advisory in accordance with subsection (b)(1).</text></subsection> <subsection id="H6C0A0C36D4984C749DC8696944DFD850"><enum>(d)</enum><header>Definition</header><text>As used in this section, the term <term>information security advisory</term> means an information security advisory issued by the Federal Computer Incident Response Center of the Department of Homeland Security, or its successor agency.</text></subsection></section> <section id="HC1D4052BA0F747EABF158EB457E186BD"><enum>106.</enum><header>Self-regulatory programs</header> <subsection id="H7C79799CC48844819922134DB9D8EA94"><enum>(a)</enum><header>Self-regulatory program</header> <paragraph id="H2409FAEDB07845EE9DF0C2BBC6489707"><enum>(1)</enum><header>Presumption of compliance</header><text>The Commission shall presume that a data collection organization is in compliance with the provisions of sections 101 through 105 if that organization—</text> <subparagraph id="H1C65D7709488494DAFD315266CD8DEDE"><enum>(A)</enum><text>participates in a self-regulatory program approved under subsection (b); and</text></subparagraph> <subparagraph id="H92B5C4749B28420FBC1D340588335814"><enum>(B)</enum><text>has been determined by a self-regulatory program to be in compliance with the guidelines, procedures, requirements, and restrictions of the program (including a remedial process under subsection (c)(7)).</text></subparagraph></paragraph> <paragraph id="H1BD848BD6EF04A5182D982AA03D32D1E"><enum>(2)</enum><header>Effect of willful noncompliance</header><text>A data collection organization that participates in a self-regulatory program under this section shall not be liable for a civil penalty arising out of a violation of any provision of sections 101 through 105 unless such violation results from willful noncompliance with the guidelines, procedures, requirements, or restrictions of the program.</text></paragraph></subsection> <subsection id="H13A553DC8E28451C9281A32C9056C0B5"><enum>(b)</enum><header>Approval by Commission</header> <paragraph id="H70ECA12EBD414245B1A2064EEC4A261"><enum>(1)</enum><header>Approval</header><text>The Commission shall, within 90 days after submission of an application for approval of a self-regulatory program under this section (or of a material change in a program previously approved by the Commission), approve such program (or change) if the Commission finds that the program (or change) complies with the requirements of subsection (c).</text></paragraph> <paragraph id="H0E6132B5373F4C25806D2FA027E7D969"><enum>(2)</enum><header>Form of application</header><text>The Commission shall accept an application for approval under paragraph (1) in any reasonable form the applicant may submit.</text></paragraph> <paragraph id="H5F142DD8C13B414FB35540E9B24F2DE2"><enum>(3)</enum><header>Duration until renewal</header><text>A self-regulatory program approved by the Commission under paragraph (1) shall be approved for a period of 5 years.</text></paragraph> <paragraph id="H60F889177B484EC6BF2CF69103694EF"><enum>(4)</enum><header>Revocation of approval</header><text>The Commission may, after notice and opportunity for a hearing, revoke approval granted under paragraph (1), if the Commission finds that a self-regulatory program fails to meet the requirements of subsection (c).</text></paragraph> <paragraph id="H04B4198EE97541D791DE28D9C1E4C23"><enum>(5)</enum><header>Judicial review</header><text>Any order by the Commission denying approval of a self-regulatory program shall be subject to judicial review, as provided in <external-xref legal-doc="usc" parsable-cite="usc/5/706">section 706</external-xref> of title 5, United States Code.</text></paragraph></subsection> <subsection id="HB3659312F568450BA500921776DB6FAE"><enum>(c)</enum><header>Requirements of self-regulatory program</header><text>A self-regulatory program complies with the requirements of this subsection if the program provides each of the following:</text> <paragraph id="HB4D66881B161432CB567CF73264BEAA7"><enum>(1)</enum><text>Guidelines and procedures requiring a program participant to provide substantially equivalent or greater protections for consumers and their personally identifiable information as are provided under sections 101 through 105.</text></paragraph> <paragraph id="H2B1789761A5B4D45865059B2C49CE6B"><enum>(2)</enum><text>Procedures and requirements to provide for—</text> <subparagraph id="H7F3BCD9F3F734C3F86196912E420BB2B"><enum>(A)</enum><text>an initial review of a participant’s privacy statement and privacy policy, and subsequent review whenever such statement or policy is substantively changed, to determine whether the participant complies with the self-regulatory program’s guidelines;</text></subparagraph> <subparagraph id="H0193ACB64F894AFA859EA900BE257F11"><enum>(B)</enum><text>an initial self-review and self-certification of a participant’s privacy policy and practices to ensure compliance with the guidelines, procedures, requirements, and restrictions of the program established under this subsection;</text></subparagraph> <subparagraph id="HCCA25CF695EE45AEA025B9DBC18063F4"><enum>(C)</enum><text>subsequent periodic self-reviews and self-certifications, which shall occur at least annually, of the participant’s privacy policy and practices to ensure continued compliance with such guidelines, procedures, requirements, and restrictions;</text></subparagraph> <subparagraph id="HEE6C1E6DFDE24051B122C6C3D9B700CC"><enum>(D)</enum><text>submission of self-reviews and self-certifications under this paragraph to any administrator of the program; and</text></subparagraph> <subparagraph id="H0F86B3327B65473FA66F0042AB828CCC"><enum>(E)</enum><text>random compliance testing of participants, which may concentrate on selected compliance issues, if the self-regulatory program conducts—</text> <clause id="H1A47D5E8AB2D40CB8E3CDE18F198DEEA"><enum>(i)</enum><text>a random compliance test with respect to each participant not less frequently than every 3 years;</text></clause> <clause id="HB5DA83E4CC6E408F9C4B0072CAF0DDBA"><enum>(ii)</enum><text>a full compliance test in any case where non-compliance with any of the selected compliance issues is identified; and</text></clause> <clause id="HD75AFB2C120042CFA8F511A0FB3F85D7"><enum>(iii)</enum><text>full compliance tests of participants with a high number of complaints against them.</text></clause></subparagraph></paragraph> <paragraph id="HA75FA8462EF64A1C80CB895927601104"><enum>(3)</enum><text>Procedures and requirements that ensure that a program participant provides a process for resolving disputes with consumers relating to the privacy policy and practices of the participant. Such dispute resolution process—</text> <subparagraph id="HA8B68FD7156E47F0BF19038BD6655BCD"><enum>(A)</enum><text>must be available without charge to a consumer;</text></subparagraph> <subparagraph id="HB7D801BBFD1C4526819C8E26A4E5C1D0"><enum>(B)</enum><text>must be available at a cost to the participant that is reasonable and does not discourage participation by the participant in such process;</text></subparagraph> <subparagraph id="H5FBAC0945C2D402384F7A762AB8CB32B"><enum>(C)</enum><text>must ensure that consumers are informed of how to utilize the process;</text></subparagraph> <subparagraph id="H55C74A714AD44363B22C4769C8946951"><enum>(D)</enum><text>may include, as one choice among others, binding arbitration; and</text></subparagraph> <subparagraph id="HA41DC2A0712947329DE27F543CCB397E"><enum>(E)</enum> <clause display-inline="yes-display-inline" id="H99CBC2387AD4471DBD6575540106DDF"><enum>(i)</enum><text>must be completed within 60 days after submission of the dispute by the consumer; or</text></clause> <clause indent="up1" id="H407FDF0AFB7D45A2A8144827C2411524"><enum>(ii)</enum><text>must be completed within 90 days after submission of the dispute by the consumer, if the participant—</text> <subclause id="H3C0D29E956B74C4C85E2BC3C8B4E60FF"><enum>(I)</enum><text>determines that additional time is required to obtain information to make an informed decision with respect to the dispute; and</text></subclause> <subclause id="HFC7E248652954BAA8BEA1B79208F5098"><enum>(II)</enum><text>notifies the consumer and the self-regulatory program that such additional time is required.</text></subclause></clause></subparagraph></paragraph> <paragraph id="H77D9B76B16E442F4B30005E801305206"><enum>(4)</enum><text>Provisions for the use by participants in the program of a means (including the use of a seal) to represent the participant’s participation in the program.</text></paragraph> <paragraph id="H8D1E507ACC3443C68007CC1893E08E46"><enum>(5)</enum><text>With respect to any nonvoluntary suspension or termination of participation in the program because of the participant’s failure to comply with the program, procedures or requirements to provide for the following:</text> <subparagraph id="H48B21426EFFE47D88DC9EC85D471FB2"><enum>(A)</enum><text>Publication of notice and the reasons for any such suspension or termination, except that no personally identifiable information related to such suspension or termination may be published.</text></subparagraph> <subparagraph id="H075754C17C7244C3A9886E00C8F358B2"><enum>(B)</enum><text>Notice to the Commission of any such termination.</text></subparagraph></paragraph> <paragraph id="HCB5C43D487AE4BC3BE816E2CAB22EFBA"><enum>(6)</enum><text>Requirements and restrictions that assure independence with respect to program eligibility, compliance, and dispute resolution mechanisms and decisions from improper interference by management or ownership of the self-regulatory program participant.</text></paragraph> <paragraph id="HB32FFED46BAB445ABDD1FC36C4945FF5"><enum>(7)</enum><text>A process for a noncompliant participant to take timely remedial action in order to come back into compliance with the program before suspension or termination of participation in the program.</text></paragraph></subsection> <subsection id="HB2A7A65BCBAC465CA258F3A9AE7DBA03"><enum>(d)</enum><header>Consumer dispute resolution</header> <paragraph id="HE77AB8E186D04EABA3B3083EFDCB3EBC"><enum>(1)</enum><header>Self-regulatory dispute process</header><text>If a consumer has a dispute with a participant in a self-regulatory program under this section or under section 5 of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45</external-xref>) to the extent that such dispute pertains to the entity’s privacy policy or practices required for participation in the self-regulatory program, the consumer shall initially seek resolution through the participant’s dispute resolution process (established in accordance with subsection (c)(3)). The Commission shall promptly refer to the participant involved any dispute submitted to the Commission for which resolution has not been initially sought through such process.</text></paragraph> <paragraph id="H05F7862175384654A57FB79559C29606"><enum>(2)</enum><header>Resolution by Commission</header><text>A consumer may submit to the Commission for resolution a dispute with a participant in a self-regulatory program under this section, if the following requirements are met:</text> <subparagraph id="H653DBE178C324178A981ED0073AB5DDB"><enum>(A)</enum><text>The dispute was initially submitted under paragraph (1) for resolution through the participant’s dispute resolution process.</text></subparagraph> <subparagraph id="H63D9B719453E4462B8869E5E19E4D6FD"><enum>(B)</enum><text>The dispute submitted under paragraph (1) is not resolved—</text> <clause id="H9B80C0C602684118B2996F68784533BB"><enum>(i)</enum><text>within 60 days after submission of the dispute by the consumer; or</text></clause> <clause id="HA08A6077E5B54DC792CAA8D36CDBCF5"><enum>(ii)</enum><text>to the satisfaction of the consumer.</text></clause></subparagraph> <subparagraph id="HC2430D96EB2240D9868DF1B418E3E48"><enum>(C)</enum><text>Notice of the facts of the dispute is submitted to the Commission not later than 30 days after the date on which the consumer is notified of the resolution through the participant’s dispute resolution process.</text></subparagraph> <subparagraph id="H10101FA02480497CBBD381D41270699D"><enum>(D)</enum><text>The consumer has not voluntarily accepted a resolution of the dispute under paragraph (1).</text></subparagraph> <subparagraph id="H57ED7CE413C749ED90B21640EA000710"><enum>(E)</enum><text>The dispute was not resolved through binding arbitration.</text></subparagraph></paragraph> <paragraph id="H03FA57EFCA8B4AA4ADC507E015EBBFD2"><enum>(3)</enum><header>Limitation</header><text>Nothing in this Act shall prevent the Commission from investigating compliance with this Act by a participant in a self-regulatory organization based upon a complaint from an individual or organization other than a consumer with a dispute with such participant, or on its own initiative, except that prior to instituting any such investigation the Commission shall afford the self-regulatory organization a reasonable opportunity to invoke its own remedial procedures and assure compliance by the participant.</text></paragraph> <paragraph id="H5F2AA44E2E6E4A4FA81253E890868DB1"><enum>(4)</enum><header>Clear and convincing evidence</header><text>The presumption established by paragraph (1) of subsection (a) may be overcome by clear and convincing evidence of non-compliance.</text></paragraph></subsection> <subsection id="H261F92A7F5244638BBC49F4C85FB815"><enum>(e)</enum><header>Nonrelease of certain information</header><text>The Commission may not compel a participant in a self-regulatory program approved under subsection (b) (or an administrator of such a program) to provide proprietary information or personally identifiable information of consumers to the Commission unless the Commission provides assurances that such information will not be released to the public.</text></subsection> <subsection id="HFB65BA0FBFAE4A85B7F48F8CE6943861"><enum>(f)</enum><header>Misrepresentation of self-regulatory program participation</header><text>It is unlawful for a data collection organization to misrepresent that it is a participant in a self-regulatory program (including through any mechanism provided under subsection (c)(4)) when such organization is not, in fact, such a participant.</text></subsection> <subsection id="H435DAAF8BAFB432B93B5F1887306995"><enum>(g)</enum><header>Exempted entity participation</header><text>An entity that is not a data collection organization and that voluntarily participates in a self-regulatory program under this section shall enjoy the rights and benefits provided under this section in any action or investigation under section 5 of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45</external-xref>) to the extent that such action or investigation pertains to the entity’s privacy policy or practices required for participation in the self-regulatory program.</text></subsection></section> <section id="H7A578E8B706246E7A89B00CB511B2821"><enum>107.</enum><header>Enforcement</header> <subsection id="H842CD3141C514F64A1C3C0584970C4A9"><enum>(a)</enum><header>Unfair or deceptive Act or practice</header><text>A violation of any provision of this title by a data collection organization is an unfair or deceptive act or practice unlawful under section 5(a)(1) of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C. 45(a)(1)</external-xref>), except that the amount of any civil penalty under such Act shall be doubled for a violation of this title, but may not exceed $500,000 for all related violations by a single violator (without respect to the number of consumers affected or the duration of the related violations).</text></subsection> <subsection id="H50DD3A1E3D65496485C678F20219CD4"><enum>(b)</enum><header>Guidelines and opinions</header><text>In order to assist in compliance with this title, the Federal Trade Commission may promulgate regulations and interpretive rules under section 18 of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/57a">15 U.S.C. 57a</external-xref>), with respect to specific types of acts or practices that would, or would not, comply with this title.</text></subsection></section> <section id="HEE3541ED478F47F19F58AF268600C24B"><enum>108.</enum><header>No private right of action</header><text display-inline="no-display-inline">This title may not be considered or construed to provide any private right of action. No private civil action relating to any act or practice governed under this title may be commenced or maintained in any State court or under State law (including a pendent State claim to an action under Federal law).</text></section> <section id="H73B5EDFE02FD4A5D93856EAADC7BA03D"><enum>109.</enum><header>Effect on other laws</header> <subsection id="H5E5E29100F05422791B1000885A0906D"><enum>(a)</enum><header>Qualified exemption for compliance with other Federal privacy laws</header><text>To the extent that personally identifiable information protected under this title is also protected under a provision of Federal privacy law described in subsection (c), a data collection organization that complies with the relevant provision of such other Federal privacy law shall be deemed to have complied with the corresponding provision of this title.</text></subsection> <subsection id="HE9A0400BA0E94653994995B246BDEAED"><enum>(b)</enum><header>Protection of other Federal privacy laws</header><text>Nothing in this title may be construed to modify, limit, or supersede the operation of the Federal privacy laws described in subsection (c) or the provision of information permitted or required, expressly or by implication, by such laws, with respect to Federal rights and practices.</text></subsection> <subsection id="H7B4D82143AD849889E1993325800F0EC"><enum>(c)</enum><header>Other Federal privacy laws described</header><text>The provisions of law to which subsections (a) and (b) apply are the following:</text> <paragraph id="H21FA84A24BBD4558BDA7387266A7BED5"><enum>(1)</enum><text><external-xref legal-doc="usc" parsable-cite="usc/5/552a">Section 552a</external-xref> of title 5, United States Code (commonly known as the Privacy Act of 1974).</text></paragraph> <paragraph id="HD25023E1BB924A53B22F7216C1658B40"><enum>(2)</enum><text>The <act-name parsable-cite="RFPA78">Right to Financial Privacy Act of 1978</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/12/3401">12 U.S.C. 3401 et seq.</external-xref>).</text></paragraph> <paragraph id="H2172C51798624091B3ACCA6CB6338E66"><enum>(3)</enum><text>The <act-name parsable-cite="FCRA">Fair Credit Reporting Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/1681">15 U.S.C. 1681 et seq.</external-xref>).</text></paragraph> <paragraph id="HF4F00D7EAD0B4E99004D2B7626A6AE89"><enum>(4)</enum><text>The Fair Debt Collection Practices Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1692">15 U.S.C. 1692 et seq.</external-xref>).</text></paragraph> <paragraph id="HF1DD8C0C422F4DB09BC0BDCC42F1A92F"><enum>(5)</enum><text>The Children’s Online Privacy Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6501">15 U.S.C. 6501 et seq.</external-xref>).</text></paragraph> <paragraph id="H4E4B5F7593584979A8E01884D159F96"><enum>(6)</enum><text>Title V of the Gramm-Leach-Bliley Act of 1999 (<external-xref legal-doc="usc" parsable-cite="usc/15/6801">15 U.S.C. 6801 et seq.</external-xref>).</text></paragraph> <paragraph id="H0EA81BBD714A40E0B34B455DB3DEE7FD"><enum>(7)</enum><text>The Electronic Communications Privacy Act of 1986 (<external-xref legal-doc="public-law" parsable-cite="pl/99/508">Public Law 99–508</external-xref>).</text></paragraph> <paragraph id="H2E298B1E3E724345A671BD90328617D8"><enum>(8)</enum><text>The Driver’s Privacy Protection Act of 1994 (<external-xref legal-doc="usc" parsable-cite="usc/18/2721">18 U.S.C. 2721 et seq.</external-xref>).</text></paragraph> <paragraph id="HF684CD5B47BF465A8D76AF24AE8B2B00"><enum>(9)</enum><text>The Family Educational Rights and Privacy Act of 1974 (<external-xref legal-doc="usc" parsable-cite="usc/20/1221">20 U.S.C. 1221</external-xref> note, 1232g).</text></paragraph> <paragraph id="H9A4D389362CA47CDA5E8B88B0002D9E4"><enum>(10)</enum><text>Section 445 of the General Education Provisions Act (<external-xref legal-doc="usc" parsable-cite="usc/20/1232h">20 U.S.C. 1232h</external-xref>).</text></paragraph> <paragraph id="H351F286B94DE405183F12359D7424D7E"><enum>(11)</enum><text>The Privacy Protection Act of 1980 (<external-xref legal-doc="usc" parsable-cite="usc/42/2000aa">42 U.S.C. 2000aa et seq.</external-xref>).</text></paragraph> <paragraph id="HB90CD512A15E40C6B8DD3305145DD92C"><enum>(12)</enum><text>Section 222 of the <act-name parsable-cite="CA34">Communications Act of 1934</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/47/222">47 U.S.C. 222</external-xref>) relating to the Customer Proprietary Network Information.</text></paragraph> <paragraph id="H2C453C9B0E0740EBBB9C104133E019AB"><enum>(13)</enum><text>The Cable Communications Policy Act of 1984 (<external-xref legal-doc="usc" parsable-cite="usc/47/521">47 U.S.C. 521 et seq.</external-xref>).</text></paragraph> <paragraph id="H8FAFC9BDB28A4FE800E6E4FA579197C3"><enum>(14)</enum><text>The Communications Assistance for Law Enforcement Act (<external-xref legal-doc="usc" parsable-cite="usc/47/1001">47 U.S.C. 1001 et seq.</external-xref>).</text></paragraph> <paragraph id="HA5D6D3BD627943FF9BC23ECAB45E0BE"><enum>(15)</enum><text>The Video Privacy Protection Act of 1988 (<external-xref legal-doc="public-law" parsable-cite="pl/100/618">Public Law 100–618</external-xref>).</text></paragraph> <paragraph id="H3E848575F52640279F4180E618A51ED"><enum>(16)</enum><text>The Telephone Consumer Protection Act of 1991 (<external-xref legal-doc="public-law" parsable-cite="pl/102/243">Public Law 102–243</external-xref>).</text></paragraph> <paragraph id="H0048F7DD9FA340FE9F8B16A0DC45BB30"><enum>(17)</enum><text>The <act-name parsable-cite="HIPAA">Health Insurance Portability and Accountability Act of 1996</act-name> (<external-xref legal-doc="public-law" parsable-cite="pl/104/191">Public Law 104–191</external-xref>), as it relates to an entity described in section 1172(a) of the <act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-1">42 U.S.C. 1320d–1(a)</external-xref>) or to activities regulated under section 1173 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-2">42 U.S.C. 1320d–2</external-xref>).</text></paragraph></subsection> <subsection id="HA0A4697C1FAE4E61B8FA00794E048090"><enum>(d)</enum><header>Preemption of State privacy laws</header><text>This title preempts any statutory law, common law, rule, or regulation of a State, or a political subdivision of a State, to the extent such law, rule, or regulation relates to or affects the collection, use, sale, disclosure, retention, or dissemination of personally identifiable information in commerce. No State, or political subdivision of a State, may take any action to enforce this title.</text></subsection></section> <section id="HC957B43079F945DD8D91E111A737D360"><enum>110.</enum><header>Effective date</header><text display-inline="no-display-inline">This title shall apply with respect to personally identifiable information collected on or after the date that is 1 year after the date of enactment of this Act.</text></section>

Table of contents

The table of contents for this Act is as follows:

Sec. 1. Short title

Sec. 2. Table of contents

Sec. 3. Definitions

Title I—Protection of individual privacy in interstate commerce

Sec. 101. Privacy notices to consumers

Sec. 102. Privacy policy statements

Sec. 103. Consumer opportunity to limit sale or disclosure of information

Sec. 104. Consumer opportunity to limit other information practices

Sec. 105. Information security obligations

Sec. 106. Self-regulatory programs

Sec. 107. Enforcement

Sec. 108. No private right of action

Sec. 109. Effect on other laws

Sec. 110. Effective date

Title II—Identity theft prevention and remedies

Sec. 201. Facilitating electronic identity theft affidavits

Sec. 202. Promoting use of common identity theft affidavit

Sec. 203. Timely resolution of identity theft disputes

Sec. 204. Improvements to consumer clearinghouse

Sec. 205. Improved identity theft data

Sec. 206. Change of address protections

Sec. 207. Effective date

Title III—International provisions

Sec. 301. Study by Comptroller General

Sec. 302. Remediation of discriminatory impact by Secretary of Commerce

Sec. 303. Effect of nonremediation

Sec. 304. Harmonization of international privacy laws, regulations, and agreements

Definitions

In this Act: (1)The term Commission means the Federal Trade Commission. (2)The term consumer means an individual acting in the individual’s personal, family, or household capacity. (3) (A)The term data collection organization means an entity (or an agent or affiliate of the entity) that collects (by any means, through any medium), sells, discloses for consideration, or uses personally identifiable information of the consumer. (B)Such term does not include— (i)a governmental agency; (ii)a not-for-profit entity, to the extent that personally identifiable information is not used for a commercial purpose; (iii)an entity that— (I)has annual gross revenue under $1,000,000 (based on the value of such amount in fiscal year 2000, adjusted for current dollars); (II)has fewer than 25 employees; (III)collects or uses personally identifiable information from fewer than 1,000 consumers for a purpose unrelated to a transaction with the consumer; (IV)does not process personally identifiable information of consumers; and (V)does not sell or disclose for consideration such information to another person; (iv)a provider of professional services, or any affiliate thereof, to the extent that such provider is obligated by rules of professional ethics, or by applicable law or regulation, not to voluntarily disclose confidential client information without the consent of the client; or (v)a data processing outsourcing entity. (4) (A)The term personally identifiable information, with respect to a data collection organization means individually identifiable information relating to a living individual who can be identified from that information. (B)Such term includes— (i)first and last name, whether given at birth or adoption, assumed, or legally changed; (ii)home or other physical address including street name and name of a city or town; (iii)electronic mail address; (iv)telephone number; (v)social security number; or (vi)any other unique identifying information that a data collector and processor collects and combines with any information described in the preceding subparagraphs of this paragraph. (C)Such term does not include— (i)anonymous or aggregate data, or any other information that does not identify a unique living individual; (ii)information about a consumer inferred from data maintained about a consumer; or (iii)information about a consumer obtained from a public record. (5)The term affiliate means any company that controls, is controlled by, or is under common control with another company. (6)The term information-sharing affiliate means any affiliate that is under common control with a data collection organization, and is contractually obligated to comply with the practices enumerated under the privacy policy statement of the organization required under section 102. (7)The term data processing outsourcing entity means, with respect to a data collection organization, a non-affiliated entity that— (A)provides information technology processing, Web hosting, or telecommunications services to the data collection organization; (B)is contractually obligated to comply with security controls specified by the data collection organization; and (C)has no right to use the data collection organization’s personally identifiable information other than for performing data processing outsourcing services for the data collection organization or as required by law. (8)The term process, with respect to personally identifiable information, means any value-added activity performed on data by automated means. (9)The term transaction means an interaction between a consumer and a data collection organization resulting in— (A)any use of information that is necessary to complete the interaction in the course of which information is collected, or to maintain the provisioning of a good or service requested by the consumer, including use— (i)to approve, guarantee, process, administer, complete, enforce, provide, or market a product, service, account, benefit, transaction, or payment method that is requested or approved by the consumer; or (ii)to deliver goods, services, funds, or other consideration to, or on behalf of, the consumer; (B)any disclosure of information that is necessary for the consumer to enforce any right of the consumer; (C)any disclosure of information that is required by law or by a court order; and (D)any use of information to verify personally identifiable information by the consumer, evaluate, detect, or reduce the risk of fraud or other criminal activity, or other risk-management activities. (10)The term display means intentionally communicating or otherwise making available (on the Internet or in any other manner) to another person. (11)The term public record means any item, collection, or grouping of information about an individual that is maintained by a Federal, State, or local government entity and that is made available to the public. (12)The term purchase means providing, directly or indirectly, anything of value in exchange for a good or service. (13)The term State includes the several States, the District of Columbia, the Commonwealth of Puerto Rico, the Commonwealth of the Northern Mariana Islands, American Samoa, Guam, the Virgin Islands, the Freely Associated States, and any other territory or possession of the United States.