I 111th CONGRESS 2d Session H. R. 5777 IN THE HOUSE OF REPRESENTATIVES July 19, 2010 Mr. Rush introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To foster transparency about the commercial use of personal information, provide consumers with meaningful choice about the collection, use, and disclosure of such information, and for other purposes.
1.
Short title; table of contents
(a)
Short title
This Act may be cited as the Building Effective Strategies To Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards Act or the BEST PRACTICES Act. (b)
Table of contents
The table of contents for this Act is as follows: Sec. 1. Short title; table of contents. Sec. 2 Definitions. Title I—Transparency, Notice, and Individual Choice Sec. 101. Information to be made available. Sec. 102. Provision of notice or notices. Sec. 103. Opt-out consent required for collection and use of covered information by a covered entity. Sec. 104. Express affirmative consent. Sec. 105. Material changes to privacy practices. Sec. 106. Exceptions. Title II—Accuracy, Access, and Dispute Resolution Sec. 201. Accuracy. Sec. 202. Access and dispute resolution. Title III—Data Security, Data Minimization, and Accountability Sec. 301. Data security. Sec. 302. Accountability. Sec. 303. Data minimization obligations. Title IV—Safe Harbor and Self-Regulatory Choice Program Sec. 401. Safe harbor. Sec. 402. Approval by the Federal Trade Commission. Sec. 403. Requirements of self-regulatory program. Sec. 404. Rulemaking. Title V—Exemptions Sec. 501. Use of aggregate or deidentified information. Sec. 502. Activities covered by other Federal privacy laws. Title VI—Application and Enforcement Sec. 601. General application. Sec. 602. Enforcement by the Federal Trade Commission. Sec. 603. Enforcement by State attorneys general. Sec. 604. Private right of action. Sec. 605. Effect on other laws. Title VII—Miscellaneous Provisions Sec. 701. Review. Sec. 702. Consumer and business education campaign. Sec. 703. Effective date. Sec. 704. Severability.
2.
Definitions
As used in this Act, the following definitions apply: (1)
Aggregate information
The term aggregate information means data that relates to a group or category of services or individuals, from which all information identifying an individual has been removed. (2)
Commission
The term Commission means the Federal Trade Commission. (3)
Covered entity
The term covered entity means a person engaged in interstate commerce that collects or stores data containing covered information or sensitive information. Such term does not include— (A)the Federal Government or any instrumentality of the Federal Government, nor the government of any State or political subdivision of a State; or (B)any person that can demonstrate that such person— (i)stores covered information from or about fewer than 15,000 individuals; (ii)collects covered information from or about fewer than 10,000 individuals during any 12-month period; (iii)does not collect or store sensitive information; and (iv)does not use covered information to study, monitor, or analyze the behavior of individuals as the person’s primary business. (4)
Covered information
(A)
In general
The term covered information means, with respect to an individual, any of the following: (i)the first name or initial and last name; (ii)a postal address; (iii)an email address; (iv)a telephone or fax number; (v)a tax identification number, passport number, driver’s license number, or any other unique government-issued identification number; (vi)a financial account number, or credit card or debit card number, or any required security code, access code, or password that is necessary to permit access to an individual’s financial account; (vii)any unique persistent identifier, such as a customer number, unique pseudonym or user alias, IP address, or other unique identifier, where such identifier is used to collect, store or identify information about a specific individual or to create or maintain a preference profile; or (viii)any other information that is collected, stored, used, or disclosed in connection with any covered information described in clauses (i) through (vii). (B)
Exclusion
Such term shall not include— (i)the title, business address, business email address, business telephone number, or business fax number associated with an individual’s status as an employee of an organization, or an individual’s name when collected, stored, used, or disclosed in connection with such employment status; or (ii)any information collected from or about an employee by an employer, prospective employer, or former employer that directly relates to the employee-employer relationship. (5)
Operational purpose
(A)
In general
The term operational purpose means a purpose reasonably necessary to facilitate, improve, or safeguard the logistical or technical ability of a covered entity to provide goods or services, manage its operations, comply with legal obligations, or protect against risks and threats, including— (i)providing, operating, or improving a product or service used, requested, or authorized by an individual, including the ongoing provision of customer service and support; (ii)analyzing data related to use of the product or service for purposes of improving the covered entity’s products, services, or operations; (iii)basic business functions such as accounting, inventory and supply chain management, quality assurance, and internal auditing; (iv)protecting or defending the rights or property, including intellectual property, of the covered entity against actual or potential security threats, fraud, theft, unauthorized transactions, or other illegal activities; (v)preventing imminent danger to the personal safety of an individual or group of individuals; (vi)complying with a Federal, State, or local law, rule, or other applicable legal requirement, including disclosures pursuant to a court order, subpoena, summons, or other properly executed compulsory process; and (vii)any other category of operational use specified by the Commission by regulation that is consistent with the purposes of this Act. (B)
Exclusion
Such term shall not include— (i)the use of covered information for marketing or advertising purposes, or any use of or disclosure of covered information to a third party for such purposes; or (ii)the use of covered information for a purpose that an individual acting reasonably under the circumstances would not expect based on the product or service used, requested, or authorized by the individual and, if known to the individual, would likely affect the individual’s conduct or decisions with respect to the covered entity’s products or services. (6)
Preference profile
The term preference profile means a list of preferences, categories of information, or interests— (A)associated with an individual or with an individual’s computer or other device; (B)inferred from the actual behavior of the individual, the actual use of the individual’s computer or other device, or information supplied directly by the individual or other user of a computer or other device; and (C)compiled and maintained for the purpose of marketing or purposes related to marketing, advertising, or sales. (7)
Publicly available information
(A)
In general
The term publicly available information means any covered information or sensitive information that a covered entity has a reasonable basis to believe is lawfully made available to the general public from— (i)Federal, State, or local government records; (ii)widely distributed media; or (iii)disclosures to the general public that are required to be made by Federal, State, or local law. (B)
Construction
A covered entity has a reasonable basis to believe that information is lawfully made available to the general public if the covered entity has taken steps to determine— (i)that the information is of a type that is available to the general public; and (ii)whether an individual can direct that the information not be made available to the general public and, if so, that the individual has not done so. (8)
Sensitive information
(A)
Definition
The term sensitive information means— (i)any information that is associated with covered information of an individual and relates directly to that individual’s— (I)medical history, physical or mental health, or the provision of health care to the individual; (II)race or ethnicity; (III)religious beliefs and affiliation; (IV)sexual orientation or sexual behavior; (V)income, assets, liabilities, or financial records, and other financial information associated with a financial account, including balances and other financial information, except when financial account information is provided by the individual and is used only to process an authorized credit or debit to the account; or (VI)precise geolocation information and any information about the individual’s activities and relationships associated with such geolocation; or (ii)an individual’s— (I)unique biometric data, including a fingerprint or retina scan; or (II)Social Security number. (B)
Modified definition by rulemaking
The Commission may, by regulations promulgated under section 553 of title 5, United States Code, modify the scope or application of the definition of sensitive information for purposes of this Act. In promulgating such regulations, the Commission shall consider— (i)the purposes of the collection of the information and the context of the use of the information; (ii)how easily the information can be used to identify a specific individual; (iii)the nature and extent of authorized access to the information; (iv)an individual’s reasonable expectations under the circumstances; and (v)adverse effects that may be experienced by an individual if the information is disclosed to an unauthorized person. (9)
Service provider
The term service provider means an entity that collects, maintains, processes, stores, or otherwise handles covered information or sensitive information on behalf of a covered entity, including, for the purposes of serving as a data processing center, distributing the information, providing customer support, maintaining the covered entity’s records, information technology management, website or other hosting service, fraud detection, authentication, and other verification services, or performing other administrative support functions for the covered entity. (10)
Third party
(A)
In general
The term third party means, with respect to any covered entity, a person that— (i)is not related to the covered entity by common ownership or corporate control; or (ii)is a business unit or corporate entity that holds itself out to the public as separate from the covered entity, such that an individual acting reasonably under the circumstances would not expect it to be related to the covered entity or to have access to covered information the individual provides to that covered entity. (B)
Collection of information by multiple sources
For the purpose of this definition, where multiple persons collect covered information or sensitive information from or about visitors to an online or mobile service, including a website, all such persons other than the operator or publisher of the online or mobile service or website shall be considered third parties unless— (i)the person meets the requirements of the service provider exception in section 106(1); or (ii)the person otherwise does not satisfy the requirements for a third party pursuant to the regulations implemented pursuant to subparagraph (C). (C)
Rulemaking
Not later than 18 months after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to clarify or modify the definition of third party for purposes of this Act. In promulgating such regulations, the Commission shall consider— (i)the brand or brands associated with a covered entity; (ii)the scope and nature of the businesses engaged in by a covered entity and a third party, including the nature of the products or services offered by the covered entity and third party; and (iii)the relationship between a covered entity and a third party, taking into account such factors as ownership and control.
<enum>I</enum><header>Transparency, Notice, and Individual Choice</header> <section id="H6F9101100A334426B7FA0CF8EDE685AC"><enum>101.</enum><header>Information to be made available</header><text display-inline="no-display-inline">A covered entity shall, in accordance with the regulations issued under section 102, make available to individuals whose covered information or sensitive information it collects or maintains the following information about its information privacy practices and an individual’s options with regard to such practices:</text> <paragraph id="H2FC96D94CADB471E8A304829CE185F79"><enum>(1)</enum><text>The identity of the covered entity.</text> </paragraph><paragraph id="H50963D9BCF6B4F3A94292C53FEF956ED"><enum>(2)</enum><text>A description of any covered information or sensitive information collected or stored by the covered entity.</text> </paragraph><paragraph id="H1D2BA6B4391F41ADBF0B1A5E9384BBFF"><enum>(3)</enum><text display-inline="yes-display-inline">The specific purposes for which the covered entity collects and uses the covered information or sensitive information, including disclosure as to whether and how the covered entity customizes products or services or changes the prices of products or services based, in whole or in part, on covered information or sensitive information about individual customers or users.</text> </paragraph><paragraph id="H692EB5E2EBEA41579EA640A3A83E831B"><enum>(4)</enum><text display-inline="yes-display-inline">The specific purposes for which covered information or sensitive information may be disclosed to a third party and the categories of third parties who may receive such information for each such purpose.</text> </paragraph><paragraph id="HAF70513DA388488FB5D2F8B03368DAD2"><enum>(5)</enum><text display-inline="yes-display-inline">The choice and means the covered entity offers individuals for limiting the collection, use, and disclosure of covered information or sensitive information, in accordance with sections 103 and 104.</text> </paragraph><paragraph id="HFFEBFE38FD2E44BEABBF5226A0DDE4CD"><enum>(6)</enum><text>A description of the information for which an individual may request access and the means to request such access, in accordance with section 202.</text> </paragraph><paragraph id="H3792165C349149EBA4C952DD5868E201"><enum>(7)</enum><text display-inline="yes-display-inline">How the covered entity may merge, link, or combine covered information or sensitive information collected from the individual with other information about the individual that the covered entity may acquire from third parties.</text> </paragraph><paragraph id="H4E50E71F53C24B02BCD304B5E33AB317"><enum>(8)</enum><text display-inline="yes-display-inline">The retention schedule for covered information and sensitive information in days, months, or years, or a statement that the covered entity will retain such information indefinitely or permanently.</text> </paragraph><paragraph id="H039FB1CBE7044AD8A42C457E8E36C6C1"><enum>(9)</enum><text display-inline="yes-display-inline">Whether or not an individual has the right to direct the covered entity to delete information collected from or about the individual.</text> </paragraph><paragraph id="H85C66BCE79C14C55A5CA7A8C0416D5B7"><enum>(10)</enum><text display-inline="yes-display-inline">A reasonable means by which an individual may contact the covered entity with any inquiries or complaints regarding the covered entity’s practices concerning the collection, use, disclosure, or handling of the individual’s covered information or sensitive information in accordance with section 302(a).</text> </paragraph><paragraph id="H5C74010A9455486BA8A11471D23D46DE"><enum>(11)</enum><text>The process by which the covered entity notifies individuals of material changes to its policies and practices.</text> </paragraph><paragraph id="HC9B88B017D3140E982C8F538C70BAEDD"><enum>(12)</enum><text>A hyperlink to or a listing of the Commission’s online consumer complaint form or the toll-free number for the Commission’s Consumer Response Center.</text> </paragraph><paragraph id="H07E57F639BAB4703A42DC63E4BAA28B2"><enum>(13)</enum><text>The effective date of the privacy notice.</text> </paragraph></section><section id="H47F9A7390E4C4ECA88A361D7FF1AA582"><enum>102.</enum><header>Provision of notice or notices</header> <subsection id="H2A6FD82B2CB446E6A6D3323F74B88669"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">It shall be unlawful for a covered entity to collect, use, or disclose covered information or sensitive information unless it provides the information set forth in section 101 in concise, meaningful, timely, prominent, and easy-to-understand notice or notices, in accordance with the regulations issued by the Commission under subsection (b).</text> </subsection><subsection id="HC0D1E51819CD4C6B97212426C37AEB4B"><enum>(b)</enum><header>Rulemaking</header><text>Not later than 18 months after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to implement this section. In promulgating such regulations, the Commission—</text> <paragraph commented="no" id="H649D6A67B00E445DA8C242D5DEBDADB2"><enum>(1)</enum><text display-inline="yes-display-inline">shall determine the means and timing of the notices required under this section, taking into account the different media, devices, or methods through which the covered entity collects covered information or sensitive information;</text> </paragraph><paragraph id="H4E74C4BCBBB54B158AFC55517B7002D3"><enum>(2)</enum><text>shall have the authority to allow for, or require, the provision of short notices or limited disclosures that do not include all of the information set forth in section 101, if the Commission by regulation—</text> <subparagraph id="H216837C1D0A34B4EB7CF3F4AE4648F04"><enum>(A)</enum><text>requires the information to be otherwise clearly and conspicuously disclosed or available to individuals; and</text> </subparagraph><subparagraph id="HDA28DAD795974C84987F799E785B9ECC"><enum>(B)</enum><text display-inline="yes-display-inline">determines that the provision of such short notices or limited disclosures will accomplish the purposes of this Act to enhance transparency and provide individuals with meaningful choice regarding the collection, use, and disclosure of their covered information or sensitive information;</text> </subparagraph></paragraph><paragraph id="H657A9B128067489883BC235E44ECD66F"><enum>(3)</enum><text>shall consider—</text> <subparagraph id="H5F61B5411CED4B09BDF55AD828D4967F"><enum>(A)</enum><text>whether the notice or notices provide individuals with timely, effective, and meaningful notice that will enable an individual to understand relevant information and make informed choices;</text> </subparagraph><subparagraph id="HEC19C37B45C34D7891DD678B38DFE166"><enum>(B)</enum><text>whether providing notice to individuals prior to or contemporaneously with the collection of covered information is practical or reasonable under the circumstances;</text> </subparagraph><subparagraph id="H6E7ABFBF4960443E900703EB2CD8EC6D"><enum>(C)</enum><text>the costs of implementing the prescribed notice or notices;</text> </subparagraph><subparagraph id="H913B3A390C5E4F0DBD9AA59B1E02F1F9"><enum>(D)</enum><text>the different media and context through which covered information is collected;</text> </subparagraph><subparagraph id="H4A94300880B444C4BF9CF74DCFDAF223"><enum>(E)</enum><text display-inline="yes-display-inline">whether it is reasonable and appropriate under the circumstances for a third party or a service provider to be responsible for providing notice and obtaining consent as required by this title in lieu of a covered entity; and</text> </subparagraph><subparagraph id="H81D8962D252D4FA2A47D10D15DF4585A"><enum>(F)</enum><text>the risk to consumers and commerce of over-notification; and</text> </subparagraph></paragraph><paragraph id="HCC64914A05974550BBDD84F49636A7C7"><enum>(4)</enum><text>may issue model notices.</text> </paragraph></subsection><subsection id="H3EC9DF6F6D1A4E22B8D699F493B05816"><enum>(c)</enum><header>Exclusion from notice requirements</header> <paragraph id="H6848EA80DB014F7D80535892FD86D080"><enum>(1)</enum><header>Trade secret information</header><text>Nothing in this section shall require a covered entity to reveal confidential, trade secret, or proprietary information.</text> </paragraph><paragraph id="HA6888BB9C16A448FAE98B5529D2FDAB7"><enum>(2)</enum><header>In-person transactions</header><text>Notice under this section shall not be required for in-person collection of covered information if—</text> <subparagraph id="H9A23A70A950945F1B1C48A0608072B98"><enum>(A)</enum><text>the covered information is collected for an operational purpose; or</text> </subparagraph><subparagraph id="HDDC1E0833A41470A9F35649D4EAA1F09"><enum>(B)</enum><text>the covered entity only is collecting the name, address, email address, telephone or fax number of an individual and does not—</text> <clause id="H84118204281641408A7664200F8AEC87"><enum>(i)</enum><text>share the covered information with third parties; or</text> </clause><clause id="H17C01D33E9D1462E9D62B656AE73CD1E"><enum>(ii)</enum><text>use the covered information to acquire additional information about the individual from third parties.</text> </clause></subparagraph></paragraph></subsection><subsection id="H57BB460F0E494596843E9F182AF75670"><enum>(d)</enum><header>Retention</header><text>A covered entity shall retain copies of the notice or notices issued pursuant to this section for a period of 6 years after the date on which such notice was issued or the date when it was last in effect, whichever is later, unless the Commission determines pursuant to the rulemaking required under subsection (b) that such retention is not practical under the circumstances.</text> </subsection></section><section id="HFBE357C76EEB4EF29F511C4654B56B37"><enum>103.</enum><header>Opt-out consent required for collection and use of covered information by a covered entity</header> <subsection id="HC4DDE3BCB7DE421D9B4432557B548C23"><enum>(a)</enum><header>In general</header><text>Except as provided in subsections (e) and (f) and section 106, it shall be unlawful for a covered entity to collect or use covered information about an individual without the consent of that individual, as set forth in this section. A covered entity shall be considered to have the consent of an individual for the collection and use of covered information about the individual if—</text> <paragraph id="H334AABC2DC0241BFB65090D8ED142336"><enum>(1)</enum><text>the covered entity has provided to the individual notice required under section 102 and its implementing regulations;</text> </paragraph><paragraph id="HC044AB1F1A3D443783699D25B878FBB1"><enum>(2)</enum><text>the covered entity provides the individual with a reasonable means to exercise an opt-out right and decline consent for such collection and use; and</text> </paragraph><paragraph id="HC443320EFE544534A7F86108F94A752E"><enum>(3)</enum><text>the individual either affirmatively grants consent for such collection and use or does not decline consent at the time notice is presented or made available to the individual.</text> </paragraph></subsection><subsection id="H12EA534EB63F46C38548D47A3696D8D2"><enum>(b)</enum><header>Duration of individual’s opt-Out</header><text>An individual’s direction to opt out under this section is effective permanently, unless otherwise directed by the individual.</text> </subsection><subsection id="H62431FC1E9754E7BABD247A5F24FA83B"><enum>(c)</enum><header>Subsequent opt-Out</header><text>A covered entity shall provide an individual with a reasonable means to decline consent or revoke previously granted consent at any time.</text> </subsection><subsection id="HE7C85EBD70F343C88B0A28DD402C93E4"><enum>(d)</enum><header>More detailed options</header><text>A covered entity may comply with this section by enabling an individual to decline consent for specific uses of his or her covered information, provided the individual has been given the opportunity to decline consent for the collection and use of covered information for all purposes, other than for an operational purpose excepted by subsection (e), for which covered information may be collected and used by the covered entity.</text> </subsection><subsection id="HF23141D974E5490482D83165D4D5434B"><enum>(e)</enum><header>Exception for operational purposes</header><text>This section shall not apply to the collection or use of covered information for an operational purpose.</text> </subsection><subsection id="H3250B7218F8C4F3FBE3755F17F44ED2A"><enum>(f)</enum><header>Collection and use as a condition of service</header><text>Nothing in this section shall prohibit a covered entity from requiring, as a condition of an individual’s receipt of a service or other benefit, including the receipt of an enhanced or premium version of a product or service otherwise available, the reasonable collection and use of covered information about the individual, provided that—</text> <paragraph id="H6B32796CF074400FB2F980DCEE195B68"><enum>(1)</enum><text>the covered entity has a direct relationship with the individual;</text> </paragraph><paragraph id="H1A5BD2AE7E0846338F7954E5C4DB57ED"><enum>(2)</enum><text>the covered information is not shared with any third party except with the express affirmative consent as set forth in section 104;</text> </paragraph><paragraph id="H07E325BF23E14AA6A2A082723E1A90DE"><enum>(3)</enum><text>the covered entity provides a clear, prominent, and specific statement describing the specific purpose or purposes for which covered information may be used pursuant to section 101;</text> </paragraph><paragraph id="H4EA97B99D0694F0CBCC63ABB840C7C16"><enum>(4)</enum><text>the individual provides consent by acknowledging the specific uses set forth in the clear and prominent statement required under paragraph (3) as part of receiving the service or other benefit from the covered entity; and</text> </paragraph><paragraph id="H581DC0E2B5C44A35AB4E6716B1479869"><enum>(5)</enum><text>the individual is able to later withdraw consent for the use by canceling the service or otherwise indicating that he or she no longer wishes to receive the service or other benefit.</text> </paragraph></subsection></section><section id="H3DBC6B9F774E40A8AFB80074F45A3C34"><enum>104.</enum><header>Express affirmative consent</header> <subsection id="HA6F4F36895A8457C8D48920BA65E4697"><enum>(a)</enum><header>Disclosure of covered information to third parties</header> <paragraph id="HF8844899E7BD4DF9B714D6CA0A11B5D0"><enum>(1)</enum><header>Disclosure prohibited</header><text>Except as provided in section 106 and subject to title IV of this Act, it shall be unlawful for a covered entity to disclose covered information about an individual to a third party unless the covered entity has received express affirmative consent from the individual prior to the disclosure.</text> </paragraph><paragraph id="H844765620C1046A28B09A62CCA70AFA6"><enum>(2)</enum><header>Exception for joint marketing</header><text>Express affirmative consent shall not be required for any disclosure related to the performance of joint marketing, if the covered entity and the third party enter into a contractual agreement prohibiting the third party from disclosing or using the covered information except as necessary to carry out the joint marketing relationship.</text> </paragraph></subsection><subsection id="HE1013F1048E9493C93F321BE78CBD5D9"><enum>(b)</enum><header>Collection, use, or disclosure of sensitive information</header><text display-inline="yes-display-inline">Except as provided in section 106, a covered entity may not collect, use, or disclose sensitive information from or about an individual for any purpose unless the covered entity obtains the express affirmative consent of the individual.</text> </subsection><subsection id="H6549910A3C764FBBBE72EFCB79A50D68"><enum>(c)</enum><header>Comprehensive online data collection</header><text display-inline="yes-display-inline">A covered entity may not use hardware or software to monitor all or substantially all of the individual’s Internet browsing or other significant class of Internet or computer activity and collect, use, or disclose information concerning such activity, except—</text> <paragraph id="H115AF10E2A644D57BA37C67156C4F11F"><enum>(1)</enum><text>with the express affirmative consent of the individual;</text> </paragraph><paragraph id="H9C3BB801CE264B4589C17D5918B380A3"><enum>(2)</enum><text>for the purpose of making such information accessible to the individual or for use by the individual; or</text> </paragraph><paragraph id="H23EE96BF4DCA4D8F98CC8E1981A8DA32"><enum>(3)</enum><text>as provided in section 106.</text> </paragraph></subsection><subsection id="HAD61B39E261D41AE9482935B5408A075"><enum>(d)</enum><header>Limitation</header><text display-inline="yes-display-inline">A third party that receives covered information or sensitive information from a covered entity pursuant to this section shall only use such information for the specific purposes authorized by the individual when the individual granted express affirmative consent for the disclosure of the information to a third party.</text> </subsection><subsection id="H676356F869F1465C9FD60B509723AFAA"><enum>(e)</enum><header>Revocation of consent</header><text>A covered entity that has obtained the express affirmative consent of an individual pursuant to this section and section 105 shall provide the individual with a reasonable means, without charge, to withdraw consent at any time thereafter.</text> </subsection></section><section id="HF687475F9E184E67B9617236DBFA1EF4"><enum>105.</enum><header>Material changes to privacy practices</header> <subsection id="H3EB6FA50F32E45A9A91A2D891CEE5CA4"><enum>(a)</enum><header>Retroactive application</header><text>A covered entity shall provide the notice required by section 102 and obtain the express affirmative consent of the individual prior to making a material change in privacy practices governing previously collected covered information or sensitive information from that individual.</text> </subsection><subsection id="H40BE30AF6C044BE9B03A5EF8B38C3D3F"><enum>(b)</enum><header>Prospective application</header><text display-inline="yes-display-inline">A covered entity shall not make material changes to its privacy practices governing the collection, use, or disclosure of covered information or sensitive information that has not been previously collected unless, 30 days before the effective date of the material change—</text> <paragraph id="HE336EDBFD09B462EAC6F606E0416EB66"><enum>(1)</enum><text>the covered entity provides individuals with notice of the material change in accordance with section 102; and</text> </paragraph><paragraph id="H85CBE3AAB30D4508B10A6FA23BEB4165"><enum>(2)</enum><text>if required by sections 103 and 104, obtains the individual’s consent to the material change or allows the individual to terminate the individual’s relationship with the covered entity.</text> </paragraph></subsection></section><section id="HC447FEC498B7455AABE65CB44AFA9B52"><enum>106.</enum><header>Exceptions</header><text display-inline="no-display-inline">The consent requirements of sections 103 and 104 shall not apply to the following:</text> <paragraph id="HAF412A4D7B334DDCAECC4FDE46415306"><enum>(1)</enum><header>Service providers</header> <subparagraph id="H8F85D56E93024D6BA4C03C7DCD09C124"><enum>(A)</enum><text>When a covered entity discloses covered information or sensitive information to a service provider performing services or functions on behalf of and under the instruction of the covered entity, provided—</text> <clause id="H9CD24852134C4E2189275586685FBF7C"><enum>(i)</enum><text>the covered entity obtained the required consent for the initial collection of such information and provided notice as required by section 102;</text> </clause><clause id="H6D470304F36E4053A909CF208FD63AFE"><enum>(ii)</enum><text>the covered entity enters into a contractual agreement that prohibits the service provider from using or disclosing the information other than to carry out the purposes for which the information was disclosed; and</text> </clause><clause id="HB0726E29ED9640B48DDC3F370E249110"><enum>(iii)</enum><text display-inline="yes-display-inline">in such cases, the covered entity remains responsible and liable for the protection of covered information and sensitive information that has been transferred to a service provider for processing.</text> </clause></subparagraph><subparagraph id="HE39B4B19124F40F7AFF1E13EE06C101E"><enum>(B)</enum><text>When a service provider subsequently discloses the information to another service provider in order to perform the same services or functions described in paragraph (1) on behalf of the covered entity.</text> </subparagraph></paragraph><paragraph id="HF98BA401F8764D3080CBACC4F861D749"><enum>(2)</enum><header>Fraud detection</header><text>Collection, use, or disclosure necessary to protect or defend the rights or property, including intellectual property, of the covered entity against actual or potential security threats, fraud, theft, unauthorized transactions, or other illegal activities.</text> </paragraph><paragraph id="H47652D9B86D544A691C9DD364216681F"><enum>(3)</enum><header>Imminent danger</header><text display-inline="yes-display-inline">Collection, use, or disclosure necessary to prevent imminent danger to the personal safety of an individual or group of individuals.</text> </paragraph><paragraph id="H9EBC0CA15F2746A6840DD00223D1407A"><enum>(4)</enum><header>Compliance with law</header><text display-inline="yes-display-inline">Collection, use, or disclosure required in order to comply with a Federal, State, or local law, rule, or other applicable legal requirement, including disclosures pursuant to subpoena, summons, or other properly executed compulsory process.</text> </paragraph><paragraph id="HACD2443E4402442B91A676366E4BB3A3"><enum>(5)</enum><header>Publicly available information</header><text display-inline="yes-display-inline">Collection, use, or disclosure of publicly available information, except that a covered entity may not use publicly available information about an individual for marketing purposes if the individual has opted out of the use by such covered entity of covered information or sensitive information for marketing purposes.</text> </paragraph></section><enum>II</enum><header>Accuracy, Access, and Dispute Resolution</header> <section id="H6523EE39BCFD4089B8B3CA6C93C2D0C6"><enum>201.</enum><header>Accuracy</header> <subsection id="H9F86B23ECE944F6B965B050848128527"><enum>(a)</enum><header>Reasonable procedures</header><text display-inline="yes-display-inline">Each covered entity shall establish reasonable procedures to assure the accuracy of the covered information or sensitive information it collects, assembles, or maintains. Not later than 18 months after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to implement this section. In promulgating such regulations, the Commission shall consider—</text> <paragraph id="H34948A0E0A044B8E91EEFF11597E302C"><enum>(1)</enum><text>the costs and benefits of ensuring the accuracy of the information;</text> </paragraph><paragraph id="H5D6C1B0FDB95406B9C3B58AF12A05ADA"><enum>(2)</enum><text>the sensitivity of the information;</text> </paragraph><paragraph id="H3622D32128DE441692FA445DFDA7D6B0"><enum>(3)</enum><text>the purposes for which the information will be used; and</text> </paragraph><paragraph id="HE27534C81392416389BCEDBD06A3F201"><enum>(4)</enum><text>the harms from misuse of the information.</text> </paragraph></subsection><subsection id="HCB8C6B8E1BBE47F1918AA232F40B7E6E"><enum>(b)</enum><header>Limited exception for fraud databases</header><text>The requirement in subsection (a) shall not prevent the collection or maintenance of information that may be inaccurate with respect to a particular individual when that information is being collected or maintained solely—</text> <paragraph id="H1C270E854F684918A0CBB89ACFEDAD79"><enum>(1)</enum><text>for the purpose of indicating whether there may be a discrepancy or irregularity in the covered information or sensitive information that is associated with an individual; and</text> </paragraph><paragraph id="H2B250654A93E4080B6436F7EC1548986"><enum>(2)</enum><text>to help identify, or authenticate the identity of, an individual, or to protect against or investigate fraud or other unlawful conduct.</text> </paragraph></subsection><subsection id="HDE8E387AAA2C414B928240478AB5D446"><enum>(c)</enum><header>Limited exception for publicly available information</header><text>Subject to section 202, a covered entity shall not be required to verify the accuracy of publicly available information if the covered entity has reasonable procedures to ensure that the publicly available information assembled or maintained by the covered entity accurately reflects the information available to the general public.</text> </subsection></section><section id="H7F64D3685B984C3ABA829C66ED8AD856"><enum>202.</enum><header>Access and dispute resolution</header> <subsection id="H992B690B4B6B4C0FAB82A40815901D0B"><enum>(a)</enum><header>Access and correction</header><text>A covered entity shall, upon request, provide an individual with reasonable access to, and the ability to dispute the accuracy or completeness of, covered information or sensitive information about that individual if such information may be used for purposes that could result in an adverse decision against the individual, including the denial of a right, benefit, or privilege.</text> </subsection><subsection id="H745CEFAF7FAB42568BC2EA4A8D082735"><enum>(b)</enum><header>Access to personal profiles</header> <paragraph id="HA705325AF8BE432285FCFD109E737729"><enum>(1)</enum><header>In general</header><text>Subject to title IV, a covered entity shall, upon request, provide an individual with reasonable access to any personal profile about that individual that the entity stores in a manner that makes it accessible in the normal course of business.</text> </paragraph><paragraph id="HA0A9E71A4EA1410ABAFC1F408644B635"><enum>(2)</enum><header>Special rule for preference profiles</header><text display-inline="yes-display-inline">With respect to a preference profile, the obligation to provide access and correction under this section is met if the covered entity provides the ability to review and change the preference information associated with a unique persistent identifier.</text> </paragraph><paragraph id="HB1AAFA68BDB94C69A0DD5FA99EB2BA4C"><enum>(3)</enum><header>participation in Choice Program</header><text>This subsection shall not apply to a covered entity that participates in a Choice Program under title IV.</text> </paragraph></subsection><subsection id="HFCFDE0F8BB2642259DD96E0E7381B30A"><enum>(c)</enum><header>Notice in lieu of access</header><text display-inline="yes-display-inline">Subject to subsection (b), in those instances in which covered information or sensitive information is used only for purposes that could not reasonably result in an adverse decision against an individual, including the denial of a right, benefit, or privilege, a covered entity shall, upon request by an individual, provide the individual with a general notice or representative sample of the type or types of information the covered entity typically collects or stores for such purposes.</text> </subsection><subsection id="H7231FC490F2A4671931629DACEE1BC81"><enum>(d)</enum><header>Exceptions</header> <paragraph id="H0B06213F95044BDAA22A9CBD8ACDD04E"><enum>(1)</enum><text>A covered entity may decline to provide an individual with access to covered information or sensitive information if the covered entity reasonably believes—</text> <subparagraph id="H57EDB9E149CC4706BCF0F62A6E5FD51D"><enum>(A)</enum><text>the individual requesting access cannot reasonably verify his or her identity as the person to which the information relates;</text> </subparagraph><subparagraph id="H596589F445B24ABEA871D414B26F206C"><enum>(B)</enum><text>access by the individual to the information is limited by law or legally recognized privilege;</text> </subparagraph><subparagraph id="HDA073601173B4EDBA8D1D8BDE48A0074"><enum>(C)</enum><text>the information is used for a legitimate governmental or fraud prevention purpose that would be compromised by such access;</text> </subparagraph><subparagraph id="HAF27E76CEC934D82B46D2EAE33878834"><enum>(D)</enum><text>such request for access is frivolous or vexatious;</text> </subparagraph><subparagraph id="H37B7F0EF8E434B6ABF85947F3C072AFE"><enum>(E)</enum><text>the privacy or other rights of persons other than the individual would be violated; or</text> </subparagraph><subparagraph id="H886AE55905A3487D9FE4E9ED9772C05E"><enum>(F)</enum><text>proprietary or confidential information, technology, or business processes would be revealed as a result.</text> </subparagraph></paragraph><paragraph id="H2CF5FBE0CBC34C3E90F1DCE08D968641"><enum>(2)</enum><text>Where an exception described in paragraph (1) applies only to a portion of the covered information or sensitive information maintained by the covered entity, the covered entity shall provide access required under subsections (a) and (b) to the information to which the exception does not apply.</text> </paragraph><paragraph id="HF32A32B8E37549448E92850DCF04D72E"><enum>(3)</enum><text display-inline="yes-display-inline">A covered entity may decline an individual’s request to correct or amend covered information or sensitive information pertaining to that individual where—</text> <subparagraph id="HAF695F458574456A961058C8127FB413"><enum>(A)</enum><text>a reason for denying access to the information under paragraph (1) would also apply to the request to correct or amend the information; or</text> </subparagraph><subparagraph id="H839F23AC18274C058BD93B62667E4D2A"><enum>(B)</enum><text>doing so would be incompatible with a legal obligation, such as a requirement to retain certain information.</text> </subparagraph></paragraph></subsection><subsection id="HC581ED4D026949FD94F3D4D5BC49E1EF"><enum>(e)</enum><header>Fees</header><text>A covered entity may charge a reasonable fee, as determined by the Commission, for providing access in accordance with subsection (a) or (b).</text> </subsection><subsection id="H05766A4111DC4083A477F416735020BD"><enum>(f)</enum><header>Time limit</header><text>A covered entity shall respond to any access, correction, or amendment request within 30 days of the receipt of the request. Such response must consist of one or more of the following:</text> <paragraph id="HE5850317D6F046808EFE74D898A7627D"><enum>(1)</enum><text>The requested information in accordance with subsection (a) or (b).</text> </paragraph><paragraph id="H7504BF75ADC0403EAC805CCD4DE172D3"><enum>(2)</enum><text>The general notice in accordance with subsection (c).</text> </paragraph><paragraph id="H095DF1C3276D40738CA5BECCB11F7E0B"><enum>(3)</enum><text>Instructions for accessing, correcting, or amending the requested information through an automated mechanism.</text> </paragraph><paragraph id="H429BB2096FC04F6EB8D9D602BE534A4D"><enum>(4)</enum><text>A confirmation that the requested corrections or amendments have been made.</text> </paragraph><paragraph id="H57C6CC1336914598A012C86B87439271"><enum>(5)</enum><text>A notification that the covered entity is declining to correct or amend information pursuant to one of the exceptions described in subsection (d). Such notification shall include the reason or reasons for not making the suggested correction or amendment, unless one or more of such exceptions would also apply to the disclosure of the reason or reasons.</text> </paragraph><paragraph id="H00F9B0AAE36F44DB8510ACB57A4F145D"><enum>(6)</enum><text>A request to resubmit the access request and an explanation of why the original access request was deficient in cases where—</text> <subparagraph id="H6A194B228CF34B43B0A35868DC65ACD3"><enum>(A)</enum><text>the scope or nature of the request is unclear or the entity needs more information in order to respond to the request;</text> </subparagraph><subparagraph id="H47E114DBBD7D4CF88BFCDE9202D3047B"><enum>(B)</enum><text>the entity charges a fee as permitted under subsection (e), and the fee has not been paid; or</text> </subparagraph><subparagraph id="HF33D8453458E4F07BE87CD06E26AF93C"><enum>(C)</enum><text>the entity provides interested members of the public other reasonable and accessible instructions for submitting an access request and such instructions were not followed.</text> </subparagraph></paragraph><paragraph id="H0B021DC11A4644E0965D98DE8EB40683"><enum>(7)</enum><text>A notification that additional time is needed where—</text> <subparagraph id="HB9359C750A4E45B1B1E7FDDA3C92D76B"><enum>(A)</enum><text>the entity cannot reasonably provide a full response within 30 days of the receipt of the access; and</text> </subparagraph><subparagraph id="HC9348BA54F6343F4A38D3648F26FC6E2"><enum>(B)</enum><text>the time extension needed for a full response is no greater than an additional 30 days.</text> </subparagraph></paragraph></subsection><subsection id="HE632BEA6C00940BFAE4205F63398F021"><enum>(g)</enum><header>Rule of construction</header><text display-inline="yes-display-inline">Nothing in this Act creates an obligation on a covered entity to provide an individual with the right to delete information.</text> </subsection><subsection commented="no" id="H7630CAABB380492EB29CF23857C521CD"><enum>(h)</enum><header>Additional Requirements where correction or amendment is declined</header><text>If the covered entity declines to correct or amend the information described in subsection (a), the covered entity shall—</text> <paragraph commented="no" id="HB1CD3E5622FD4C61BF15FA30405E0DD2"><enum>(1)</enum><text>note that the information is disputed, including the individual’s statement disputing such information, and take reasonable steps to verify such information under the procedures outlined in section 201 if such information can be independently verified; and</text> </paragraph><paragraph commented="no" id="HC27BDBC81B3F440B92C93043F2E08CF7"><enum>(2)</enum><text>where the information was obtained from a third party or is publicly available information, inform the individual of the source of the information, and if reasonably available, where a request for correction may be directed, and, if the individual provides proof that the information is incorrect, correct the inaccuracy in the covered entity’s records.</text> </paragraph></subsection><subsection id="H8F1A9D59AAF74403813AEA8D2F6AD340"><enum>(i)</enum><header>Other limitations</header><text>The obligations under this section do not, by themselves, create any obligation on the covered entity to retain, maintain, reorganize, or restructure covered information or sensitive information.</text> </subsection><subsection id="H88A3D2D0EECA470EB0786FD4F6A1C07F"><enum>(j)</enum><header>Data retention exception</header><text>Covered information or sensitive information retained by the covered entity for under 30 days, or such other period of time as the Commission may determine, shall not be subject to this section.</text> </subsection><subsection id="H2F956146EA8B4E96B4010A140CFC1A99"><enum>(k)</enum><header>Rulemaking</header><text>Not later than 18 months after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to implement this section. In addition, the Commission shall promulgate regulations, as necessary, on the application of the exceptions and limitations in subsection (d), including any additional circumstances in which a covered entity may limit access to information under such subsection that the Commission determines to be appropriate.</text> </subsection></section><enum>III</enum><header>Data Security, Data Minimization, and Accountability</header> <section id="H4389267247704078BC63FEF0D2E25B97"><enum>301.</enum><header>Data security</header> <subsection id="H8D250F61380645DF87DB7C442DDEE6ED"><enum>(a)</enum><header>In general</header><text>Each covered entity and service provider shall establish, implement, and maintain reasonable and appropriate administrative, technical, and physical safeguards to—</text> <paragraph id="H87A598278F5941629FC1E86DA87778EF"><enum>(1)</enum><text>ensure the security, integrity, and confidentiality of the covered information or sensitive information it collects, assembles, or maintains;</text> </paragraph><paragraph id="HDE86F39156FD4D1B811EAF4146BD265B"><enum>(2)</enum><text>protect against any anticipated threats, reasonably foreseeable vulnerabilities, or hazards to the security or integrity of such information; and</text> </paragraph><paragraph id="HBA17803329A74E90BA1507429F8180A3"><enum>(3)</enum><text>protect against unauthorized access to or use of such information and loss, misuse, alteration, or destruction of such information.</text> </paragraph></subsection><subsection id="HA2BF1611DB734D0CA1F673D711629A4F"><enum>(b)</enum><header>Factors for appropriate safeguards</header><text display-inline="yes-display-inline">Not later than 18 months after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to implement this section. In promulgating such regulations, the Commission shall consider—</text> <paragraph id="H89DEC2AC07AC461EA8D29026B65C49AB"><enum>(1)</enum><text>the size and complexity of an entity;</text> </paragraph><paragraph id="H1DC1DA39874C4556A37443E07C2149CC"><enum>(2)</enum><text>the nature and scope of the activities of an entity;</text> </paragraph><paragraph id="H3D929F5B69A9471E80F1CA51328E74E2"><enum>(3)</enum><text>the sensitivity of the information;</text> </paragraph><paragraph id="H1C25D6CD78584C35839B01524F2ADC25"><enum>(4)</enum><text>the current state of the art in administrative, technical, and physical safeguards for protecting information; and</text> </paragraph><paragraph id="H56D02E8F03E04FDC95A5CE23BD97520F"><enum>(5)</enum><text>the cost of implementing such safeguards.</text> </paragraph></subsection></section><section id="H531A05660F1C47A4ADAA817B215A6868"><enum>302.</enum><header>Accountability</header> <subsection id="HC081BE84D01646C7BF8E5DEAED4E6485"><enum>(a)</enum><header>Complaints to the covered entity</header><text>A covered entity shall provide a process for individuals to make complaints concerning the covered entity’s policies and procedures required by this Act.</text> </subsection><subsection id="HF3D0579B7994420A9F76003FFB717BDE"><enum>(b)</enum><header>Privacy risk assessment</header><text display-inline="yes-display-inline">A covered entity shall conduct an assessment of the risks to individuals raised by the collection, use, and disclosure of covered information or sensitive information prior to the implementation of commercial projects, marketing initiatives, business models, applications, and other products or services in which the covered entity intends to collect, or believes there is a reasonable likelihood it will collect, covered information or sensitive information from or about more than 1,000,000 individuals.</text> </subsection><subsection id="H7ED79F904C3640B3BEBF965F302CC666"><enum>(c)</enum><header>Periodic evaluation of practices</header><text>A covered entity shall conduct periodic assessments to evaluate—</text> <paragraph id="H05634ABD78C04CA09007D129040085FB"><enum>(1)</enum><text>whether the covered information or sensitive information the covered entity has collected is and remains necessary for the purposes disclosed at the time of collection pursuant to section 101 (c) and (d); and</text> </paragraph><paragraph id="H81EDA979487F40F98C9FB04CA7A2F6C1"><enum>(2)</enum><text>whether the covered entity’s ongoing collection practices are and remain necessary for a legitimate business purpose.</text> </paragraph></subsection></section><section id="H3821E7568E74464CA7A4AEB9F4ACE1B5"><enum>303.</enum><header>Data minimization obligations</header><text display-inline="no-display-inline">A covered entity that uses covered information or sensitive information for any purpose shall retain such data only as long as necessary to fulfill a legitimate business purpose or comply with a legal requirement.</text> </section><enum>IV</enum><header>Safe Harbor and Self-Regulatory Choice Program</header> <section id="H908F05B1C4E94575A4DC09B36745595B"><enum>401.</enum><header>Safe harbor</header><text display-inline="no-display-inline">A covered entity that participates in, and is in compliance with, 1 or more self-regulatory programs approved by the Commission under section 402 (in this title referred to as a <quote>Choice Program</quote>) shall not be subject to—</text> <paragraph id="HBF5EC1332F3048D4A7C9237300A6DDC9"><enum>(1)</enum><text display-inline="yes-display-inline">the requirements for express affirmative consent required under subsection 104(a) for the specified uses of covered information addressed by the Choice Program as described in section 403(1)(A);</text> </paragraph><paragraph id="H1F240E53A4514C09BB6C530AB86AEC75"><enum>(2)</enum><text>the requirement of access to information under section 202(b); or</text> </paragraph><paragraph id="H33C6E3E24A2C422A98CEAD17DF460463"><enum>(3)</enum><text>liability in a private right of action brought under section 604.</text> </paragraph></section><section id="H21A469E6C74642DB857AAE937BC7EAE3"><enum>402.</enum><header>Approval by the Federal Trade Commission</header> <subsection id="HBA7E91E3025C43FF8CA3A9F26B8256DD"><enum>(a)</enum><header>Initial approval</header><text>Not later than 270 days after the submission of an application for approval of a Choice Program under this section, the Commission shall approve or decline to approve such program. The Commission shall only approve such program if the Commission finds, after notice and comment, that the program complies with the requirements of section 403.</text> </subsection><subsection id="H394622E05D1A4039BD2BB1C2F8B2BD51"><enum>(b)</enum><header>Approval of modifications</header><text>The Commission shall approve or decline to approve any material change in a Choice Program previously approved by the Commission within 120 days after submission of an application for approval by such program. The Commission shall only approve such material change if the Commission finds, after notice and comment, that the proposed change complies with the requirements of section 403.</text> </subsection><subsection id="H0627C37728F649FF9179ECD9B88169FD"><enum>(c)</enum><header>Duration</header><text>A Choice Program approved by the Commission under this section shall be approved for a period of 5 years.</text> </subsection><subsection id="HF9439DAD35064E23B84D703F882C3EFD"><enum>(d)</enum><header>Appeals</header><text>Final action by the Commission on a request for approval, or the failure to act within 270 days on a request for approval, submitted under this section may be appealed to a district court of the United States of appropriate jurisdiction as provided for in section 706 of title 5, United States Code.</text> </subsection></section><section id="H982A43AA8FA14D36B06060B25090C2EA"><enum>403.</enum><header>Requirements of self-regulatory program</header><text display-inline="no-display-inline">To be approved as a Choice Program under this section, a program shall—</text> <paragraph id="HC2563AD89A314A729B66B1EF33E017A0"><enum>(1)</enum><text>provide individuals with—</text> <subparagraph id="H7EE6AB44E8414117B0169B0BAEEA5505"><enum>(A)</enum><text>a clear and conspicuous opt-out mechanism that, when selected by the individual, prohibits all covered entities participating in the Choice Program from disclosing covered information to a third party for 1 or more specified uses, and may offer individuals a preference management tool that will enable an individual to make more detailed choices about the transfer of covered information to a third party; and</text> </subparagraph><subparagraph id="H4972FCD441EE4C9587C113FCA664F7CE"><enum>(B)</enum><text>a clear and conspicuous mechanism to set communication preferences, online behavioral advertising preferences, and such other preferences as the Choice Program may determine, subject to the approval of the Commission, that when selected by the individual, applies the individual’s selected preferences to all covered entities participating in the Choice Program; and</text> </subparagraph></paragraph><paragraph id="HE83D25CBE96147EA95697D1C8583CAA7"><enum>(2)</enum><text>establish—</text> <subparagraph id="H377D77FC2DC14BAD9584708D9E47EB68"><enum>(A)</enum><text display-inline="yes-display-inline">guidelines and procedures requiring a participating covered entity to provide equivalent or greater protections for individuals and their covered information and sensitive information as are provided under titles I and II;</text> </subparagraph><subparagraph id="H0548EAD6BF2C4FFEB82AA2E52F0CD456"><enum>(B)</enum><text>procedures for reviewing applications by covered entities to participate in the Choice Program;</text> </subparagraph><subparagraph id="HB165BD0F3D6444318BCB01E8C86D5156"><enum>(C)</enum><text>procedures for periodic assessment of its procedures and for conducting periodic random compliance testing of covered entities participating in such Choice Program; and</text> </subparagraph><subparagraph id="H094D63E719214DFB94B1AD839D84DCD1"><enum>(D)</enum><text>consequences for failure to comply with program requirements, such as public notice of the covered entity’s noncompliance, suspension, or expulsion from the program, or referral to the Commission for enforcement.</text> </subparagraph></paragraph></section><section id="HB44B0CA54D904E4E9414FFCC6A11FC86"><enum>404.</enum><header>Rulemaking</header><text display-inline="no-display-inline">Not later than 18 months after the date of enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to implement this section and to provide compliance guidance for entities seeking to be approved under this title, including regulations—</text> <paragraph id="H966FBD4A8C8D4E9DAC2DBC237D253FB2"><enum>(1)</enum><text display-inline="yes-display-inline">establishing criteria for the submission of the application, including evidence of how the Choice Program will comply with the requirements of section 403;</text> </paragraph><paragraph id="HC2B1B40C0BD64AAC9EFEEE592953F856"><enum>(2)</enum><text display-inline="yes-display-inline">establishing criteria for opt-out mechanisms and communication preferences, online behavioral advertising preferences, or other preferences meeting the requirements of this title;</text> </paragraph><paragraph id="H7A3DA1BCBBB147C2A72E294E5589BF93"><enum>(3)</enum><text display-inline="yes-display-inline">establishing consequences for failure to comply with the requirements of section 403, such as public notice of the Choice Program’s noncompliance and suspension or revocation of the Commission’s approval of such Program as described in section 402;</text> </paragraph><paragraph id="H893A8C32C8A14C73AE92D45EF4A91D82"><enum>(4)</enum><text>allowing for and promoting continued evolution and innovation in privacy protection, meaningful consumer control, simplified approaches to disclosure, and transparency; and</text> </paragraph><paragraph id="H3226F62EAF48492C9575FC9D306CDBD4"><enum>(5)</enum><text>providing additional incentives for self-regulation by covered entities to implement the protections afforded individuals under titles I and II of this Act, including provisions for ensuring that a covered entity will be considered to be in compliance with the requirements of titles I and II and the regulations issued under such titles if that covered entity complies with guidelines or requirements of a Choice Program approved under section 402.</text> </paragraph></section><enum>V</enum><header>Exemptions</header> <section id="H341BFBF295E7494DB395D12B5ECFE780"><enum>501.</enum><header>Use of aggregate or deidentified information</header> <subsection id="H2676BD2B01CC42A18E5DF99B72EE4EC9"><enum>(a)</enum><header>General exclusion</header><text>Subject to subsections (b) and (c), nothing in this Act shall preclude a covered entity from collecting, using, or disclosing—</text> <paragraph id="H85C09648A6384EC99458495DFB3851C8"><enum>(1)</enum><text>aggregate information; or</text> </paragraph><paragraph id="H2FACC8028B3243DC80DF34463668BDAE"><enum>(2)</enum><text display-inline="yes-display-inline">covered information or sensitive information from which identifying information has been obscured or removed using reasonable and appropriate methods such that the remaining information does not identify, and there is no reasonable basis to believe that the information can be used to identify—</text> <subparagraph id="HDCB6BD5917E44F2791AA3AF87FDE2441"><enum>(A)</enum><text>the specific individual to whom such covered information relates; or</text> </subparagraph><subparagraph id="HA030B923D94F4B6D971F34D07CB09754"><enum>(B)</enum><text>a computer or device owned or used by a specific individual.</text> </subparagraph></paragraph></subsection><subsection id="H166B93814B0B4889988362C2775CED48"><enum>(b)</enum><header>Reasonable procedures for disclosure</header><text>If a covered entity discloses the information described in paragraphs (1) and (2) of subsection (a) to a third party, the covered entity shall take reasonable steps to protect such information, including, in the case of the information described in such paragraph (2), not disclosing the algorithm or other mechanism used to obscure or remove the identifying information, and obtaining satisfactory written assurance that the third party will not attempt to reconstruct the identifying information.</text> </subsection><subsection id="H460770A6DC49447BA27AE82A48CC3194"><enum>(c)</enum><header>Prohibition on reconstructing or revealing identifying information</header> <paragraph id="HF1135CBE0C1A481F88371C2D29B97EBA"><enum>(1)</enum><header>In general</header><text>It shall be unlawful for any person to reconstruct or reveal the identifying information that has been removed or obscured (as described in subsection (a)(2)) and for which a covered entity claims or has claimed the benefit of the general exemption in subsection (a).</text> </paragraph><paragraph id="H967DC173927C455EB417339F3714A9A5"><enum>(2)</enum><header>Rulemaking</header><text display-inline="yes-display-inline">Not later than 18 months after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to establish exemptions to this subsection. In promulgating such regulations, the Commission shall consider—</text> <subparagraph id="H77D42A0452804D7E938FECE14F66F3EE"><enum>(A)</enum><text>the purposes for which such identifying information may need to be reconstructed or revealed;</text> </subparagraph><subparagraph id="H58BA2EADAB74435CA722AEBD79E415A3"><enum>(B)</enum><text>the size and sensitivity of the data set; and</text> </subparagraph><subparagraph id="H1AA89423D8094C92894EAE043A8AF994"><enum>(C)</enum><text>public policy issues such as health, safety, and national security.</text> </subparagraph></paragraph></subsection></section><section id="HF4333341DCE54FC5A2BADDB4C7E26CA6"><enum>502.</enum><header>Activities covered by other Federal privacy laws</header><text display-inline="no-display-inline">Except as provided expressly in this Act, this Act shall have no effect on activities covered by any of the following:</text> <paragraph id="HD1628B7808064253A5338345AE494EB5"><enum>(1)</enum><text>Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.).</text> </paragraph><paragraph id="H815AF1D6FF834E42B74DF6128F876B8A"><enum>(2)</enum><text>The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).</text> </paragraph><paragraph id="H902424E3A9AA4AD18C8C88E79356A369"><enum>(3)</enum><text>The Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191).</text> </paragraph><paragraph id="H4F3C19B34B224337AE7F936B36C49C24"><enum>(4)</enum><text>Part C of title XI of the Social Security Act (42 U.S.C. 1320d et seq.).</text> </paragraph><paragraph id="HD2D4B115F973409D9BE424A4F95B8D40"><enum>(5)</enum><text>Sections 222 and 631 of the Communications Act of 1934 (47 U.S.C. 222 and 47 U.S.C. 551).</text> </paragraph><paragraph id="H20CC4642CD16469883434ACB2F130A0C"><enum>(6)</enum><text>The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.).</text> </paragraph><paragraph id="H3D6BBDC68B054370AE3C75251DE1228F"><enum>(7)</enum><text>The CAN–SPAM Act of 2003 (15 U.S.C. 7701 et seq.).</text> </paragraph><paragraph id="H7B20E7460FD14A618A7B8546F52BA444"><enum>(8)</enum><text>The Electronic Communications Privacy Act of 1986 (18 U.S.C. 2510 et seq.).</text> </paragraph><paragraph id="H120B436DBE4341D0A8728E823564171E"><enum>(9)</enum><text>The Video Privacy Protection Act (18 U.S.C. 2710 et seq.).</text> </paragraph></section><enum>VI</enum><header>Application and Enforcement</header> <section id="HEEE9216A0F7B4A9D8C1A3F3F5A1BC71E"><enum>601.</enum><header>General application</header><text display-inline="no-display-inline">The requirements of this Act shall only apply to those persons over which the Commission has authority pursuant to section 5(a)(2) of the Federal Trade Commission Act. Notwithstanding any provision of such Act or any other provision of law, common carriers subject to the Communications Act of 1934 (47 U.S.C. 151 et seq.) and any amendment thereto shall be subject to the jurisdiction of the Commission for purposes of this Act.</text> </section><section id="HE1DB2B4184364C1A938B6E6C64049674"><enum>602.</enum><header>Enforcement by the Federal Trade Commission</header> <subsection id="HF2DAE4FE55B54A4E965AAA32D3C77A43"><enum>(a)</enum><header>Unfair or deceptive acts or practices</header><text>A violation of titles I, II, or III shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.</text> </subsection><subsection id="H21A1655E3AD84DA78EC17689811EED4D"><enum>(b)</enum><header>Powers of commission</header><text>The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates this Act or the regulations issued under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in that Act.</text> </subsection><subsection id="HDA15368906B140BFACDE5496D2066306"><enum>(c)</enum><header>Rulemaking authority</header> <paragraph id="HA7D122B63EA848F6B578FEFDBC23C960"><enum>(1)</enum><header>Rulemaking</header><text>The Commission may, in accordance with section 553 of title 5, United States Code, issue such regulations it determines to be necessary to carry out this Act.</text> </paragraph><paragraph id="H5A7A1BD8B49D4ED89CA55CBEAB04F1E0"><enum>(2)</enum><header>Authority to grant exceptions</header><text>The regulations prescribed under paragraph (1) may include such additional exceptions to titles I, II, III, IV, and V of this Act as the Commission considers consistent with the purposes of this Act.</text> </paragraph><paragraph id="H7B7EE5A185C84C75A5586779CD63D2A2"><enum>(3)</enum><header>Limitation</header><text>In promulgating rules under this Act, the Commission shall not require the deployment or use of any specific products or technologies, including any specific computer software or hardware.</text> </paragraph></subsection></section><section id="H32113EB2AFDA4EF2AA8B49F0FA0AF0BA"><enum>603.</enum><header>Enforcement by State attorneys general</header> <subsection id="H06FF5C4F159F4C12B722B4B9E7A10167"><enum>(a)</enum><header>Civil action</header><text>In any case in which the Attorney General of a State, or an official or agency of a State, has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by any person who violates this Act, the attorney general, official, or agency of the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate district court of the United States—</text> <paragraph id="H5637EBE4408F43FEB6DE95B5993145B3"><enum>(1)</enum><text>to enjoin further violation of this Act by the defendant;</text> </paragraph><paragraph id="HBDBB2A9A1D784255A873CA759E462947"><enum>(2)</enum><text>to compel compliance with this Act; or</text> </paragraph><paragraph id="HA80A5A8FDE5E4258B9890D54DFB5D394"><enum>(3)</enum><text>for violations of titles I, II, or III of this Act, to obtain civil penalties in the amount determined under subsection (b).</text> </paragraph></subsection><subsection id="H4C98969704E74DA0A3234CECDC98BBA4"><enum>(b)</enum><header>Civil penalties</header> <paragraph id="H65CF143A2BEE4343AC7B8281E90C938E"><enum>(1)</enum><header>Calculation</header><text display-inline="yes-display-inline">For purposes of calculating the civil penalties that may be obtained under subsection (a)(3)—</text> <subparagraph id="H980DCCA8DC74474E991860954BD4B20F"><enum>(A)</enum><text>with regard to a violation of title I, the amount determined under this paragraph is the amount calculated by multiplying the number of days that a covered entity is not in compliance with such title, or the number of individuals for whom the covered entity failed to obtain consent as required by such title, whichever is greater, by an amount not to exceed $11,000; and</text> </subparagraph><subparagraph id="HCFCCDACD689D4000B5513B2D3048E88E"><enum>(B)</enum><text>with regard to a violation of title II or III, the amount determined under this paragraph is the amount calculated by multiplying the number of days that a covered entity is not in compliance with such title or titles by an amount not to exceed $11,000.</text> </subparagraph></paragraph><paragraph id="H256CC095C40D4DC0BE1B5181729C6571"><enum>(2)</enum><header>Adjustment for inflation</header><text>Beginning on the date that the Consumer Price Index for All Urban Consumers is first published by the Bureau of Labor Statistics that is after 1 year after the date of enactment of this Act, and each year thereafter, the amounts specified in subparagraphs (A) and (B) of paragraph (1) shall be increased by the percentage increase in the Consumer Price Index published on that date from the Consumer Price Index published the previous year.</text> </paragraph><paragraph id="H08F84C334B3740C6A0B6F4002882E703"><enum>(3)</enum><header>Maximum total liability</header><text>Notwithstanding the number of actions which may be brought against a person under this section the maximum civil penalty for which any person may be liable under this section shall not exceed—</text> <subparagraph id="HED5E51D021584B4A9BD09C1355100D9B"><enum>(A)</enum><text>$5,000,000 for any related series of violations of title I; and</text> </subparagraph><subparagraph id="H7D16F609D3F14E669A0868764E9E601E"><enum>(B)</enum><text display-inline="yes-display-inline">$5,000,000 for any related series of violations of title II and title III.</text> </subparagraph></paragraph><paragraph id="H0B8947AA68424C1EAFC5ECC17A30E499"><enum>(4)</enum><header>Effect of participation in Choice Program</header><text>If a covered entity participates in a Choice Program established under title IV and cures the alleged violation of title I or II in a reasonable period of time after receiving notice of the alleged violation, such conduct shall be taken into consideration by a State or a court in determining the amount of civil penalties under this subsection.</text> </paragraph></subsection><subsection id="H7E6393653B6347349E96F3537F45EBBB"><enum>(c)</enum><header>Intervention by the FTC</header> <paragraph id="H65FA0F5EFBC143DABFFAF79421DF8692"><enum>(1)</enum><header>Notice and intervention</header><text>The State shall provide prior written notice of any action under subsection (a) to the Commission and provide the Commission with a copy of its complaint, except in any case in which such prior notice is not feasible, in which case the State shall serve such notice immediately upon instituting such action. The Commission shall have the right—</text> <subparagraph id="HC01D995DC09A4DB4874EF8BEA986FB58"><enum>(A)</enum><text>to intervene in the action;</text> </subparagraph><subparagraph id="HEAA9FC2EDD334E559DA412B35D9611C1"><enum>(B)</enum><text>upon so intervening, to be heard on all matters arising therein; and</text> </subparagraph><subparagraph id="HD79CB7C236984129BF8557CF7AF55971"><enum>(C)</enum><text>to file petitions for appeal.</text> </subparagraph></paragraph><paragraph id="HBECFA76130BC4DC182EB3CE020A8502D"><enum>(2)</enum><header>Limitation on state action while federal action is pending</header><text>If the Commission has instituted a civil action for violation of this Act, no attorney general of a State, or official, or agency of a State, may bring an action under this section during the pendency of that action against any defendant named in the complaint of the Commission for any violation of this Act alleged in the complaint.</text> </paragraph></subsection><subsection id="H3F06AE96872C4F12B831C885B65A19F9"><enum>(d)</enum><header>Construction</header><text>For purposes of bringing any civil action under subsection (a), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—</text> <paragraph id="H7042632AC8734C60827138C69305BB81"><enum>(1)</enum><text>conduct investigations;</text> </paragraph><paragraph id="H9FBA802E46DE4CB58733FAFDA53CFD44"><enum>(2)</enum><text>administer oaths or affirmations; or</text> </paragraph><paragraph id="HE012A449F3D0477AA0B479A8DA7B8E7D"><enum>(3)</enum><text>compel the attendance of witnesses or the production of documentary and other evidence.</text> </paragraph></subsection></section><section commented="no" id="HF736CA8049F846B995EF161170A5BA90"><enum>604.</enum><header>Private right of action</header> <subsection commented="no" id="H32E4B738E0B140F2B90BF4528DF352F6"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">A covered entity, other than a covered entity that participates in and is in compliance with a Choice Program established under title IV, who willfully fails to comply with sections 103 or 104 of this Act with respect to any individual is liable to that individual in a civil action brought in a district court of the United States of appropriate jurisdiction in an amount equal to the sum of—</text> <paragraph commented="no" id="HC725BCB50F744F47B10D2D1616FEFA70"><enum>(1)</enum><text>the greater of any actual damages of not less than $100 and not more than $1,000;</text> </paragraph><paragraph commented="no" id="HBDBFCDDACC61400988593461194304DC"><enum>(2)</enum><text>such amount of punitive damages as the court may allow; and</text> </paragraph><paragraph commented="no" id="H573149C1CCF540CA9CD031F8518E16B2"><enum>(3)</enum><text>in the case of any successful action under this section, the costs of the action together with reasonable attorney’s fees as determined by the court.</text> </paragraph></subsection><subsection commented="no" id="H40AF5CBA2DE54BBA9019461E9303DAF7"><enum>(b)</enum><header>Limitation</header><text>A civil action under this section may not be commenced later than 2 years after the date upon which the claimant first discovered or had a reasonable opportunity to discover the violation.</text> </subsection></section><section id="H21D5760CA23E4C9A87FA842C2A748793"><enum>605.</enum><header>Effect on other laws</header> <subsection id="H360F515783CF40B3A1A07D13E23D78F1"><enum>(a)</enum><header>Preemption of state laws</header><text>This Act supersedes any provision of a statute, regulation, or rule of a State or political subdivision of a State, with respect to those entities covered by the regulations issued pursuant to this Act, that expressly requires covered entities to implement requirements with respect to the collection, use, or disclosure of covered information addressed in this Act.</text> </subsection><subsection id="H2778D47DA4554B4F82ED45E21AEAC1A0"><enum>(b)</enum><header>Additional preemption</header> <paragraph id="HEC7B039D1DC34E92A4C3ADE6137C5CCA"><enum>(1)</enum><header>In general</header><text>No person other than a person specified in section 603 or 604 may bring a civil action under the laws of any State if such action is premised in whole or in part upon the defendant violating any provision of this Act.</text> </paragraph><paragraph id="HC8838D019C904022A2845E6759007446"><enum>(2)</enum><header>Protection of state consumer protection laws</header><text>This subsection shall not be construed to limit the enforcement of any State consumer protection law by an attorney general or other official of a State.</text> </paragraph></subsection><subsection id="HD6CFD5097455410DAF94098D80361022"><enum>(c)</enum><header>Protection of certain state laws</header><text>This Act shall not be construed to preempt the applicability of—</text> <paragraph id="H9D3FC0353E724DF49622D1B6042D5DBF"><enum>(1)</enum><text>State laws that address the collection, use, or disclosure of health information or financial information;</text> </paragraph><paragraph id="H59F54903C3434F9FA00E9843517BC07C"><enum>(2)</enum><text>State laws that address notification requirements in the event of a data breach;</text> </paragraph><paragraph id="H0DEDFF9C792D4458B7C08376C1D9850A"><enum>(3)</enum><text>State trespass, contract, or tort law; or</text> </paragraph><paragraph id="H412B8C38CC66424CADF95B067E3D2749"><enum>(4)</enum><text>other State laws to the extent that those laws relate to acts of fraud.</text> </paragraph></subsection><subsection id="H1DD400D999FE4B3F96EE3D8143516418"><enum>(d)</enum><header>Preservation of FTC authority</header><text>Nothing in this Act may be construed in any way to limit or affect the Commission’s authority under any provision of law.</text> </subsection><subsection id="H6C3FA098A75441418A3B9135A1259E67"><enum>(e)</enum><header>Rule of construction relating to required disclosures to government entities</header><text>This Act shall not be construed to expand or limit the duty or authority of a covered entity, service provider, or third party to disclose covered information or sensitive information to a government entity under any provision of law.</text> </subsection></section><enum>VII</enum><header>Miscellaneous Provisions</header> <section id="HDC31A9AAA3244DDF81AA79CDF301AD97"><enum>701.</enum><header>Review</header><text display-inline="no-display-inline">Not later than 5 years after the effective date of the regulations initially issued under this Act, the Commission shall—</text> <paragraph id="H429F2515084F42F8B9692EE9C5B9B0A2"><enum>(1)</enum><text display-inline="yes-display-inline">review the implementation of this Act, including the effect of the implementation of this Act on practices relating to the collection, use, and disclosure of covered information and sensitive information; and</text> </paragraph><paragraph id="HBB5DEB79C5C74AA9AD16E61254A2F5CB"><enum>(2)</enum><text>prepare and submit to Congress a report on the results of the review under paragraph (1).</text> </paragraph></section><section id="H3426AF4837194F47B5E47646DAC2437C"><enum>702.</enum><header>Consumer and business education campaign</header><text display-inline="no-display-inline">Beginning on the effective date of this Act as set forth in section 703, the Commission shall—</text> <paragraph id="H675BEFC128DD422286BB66CF4E195750"><enum>(1)</enum><text>conduct a consumer education campaign to inform individuals of the rights and protections afforded by this Act and the steps that individuals can take to affirmatively consent or decline consent to the collection, use, and disclosure of information under this Act and the regulations issued pursuant to this Act; and</text> </paragraph><paragraph id="H223B42E571914363A44616483C51E746"><enum>(2)</enum><text>provide guidance to businesses regarding their obligations under this Act, including guidance on how to participate in a Choice Program approved under title IV.</text> </paragraph></section><section id="HF5298F6837AC4B8CA6167D8074536D4A"><enum>703.</enum><header>Effective date</header><text display-inline="no-display-inline">This Act shall take effect 2 years after the date of the enactment of this Act. The Commission may stay enforcement of this Act for such period of time as the Commission determines necessary to allow for the establishment and Commission approval of a Choice Program under title IV and for covered entities to commence participation in such a program.</text> </section><section id="H0676E46CBFB545A18E9E1CD5368630FF"><enum>704.</enum><header>Severability</header><text display-inline="no-display-inline">If any provision of this Act, or the application thereof to any person or circumstance, is held unconstitutional or otherwise invalid, the validity of the remainder of the Act and the application of such provision to other persons and circumstances shall not be affected thereby.</text> </section>