[Congressional Record Volume 170, Number 80 (Wednesday, May 8, 2024)]
[Senate]
[Pages S3615-S3620]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 2053. Mr. WYDEN submitted an amendment intended to be proposed to 
amendment SA 1911 proposed by Ms. Cantwell (for herself, Mr. Cruz, Ms. 
Duckworth, and Mr. Moran) to the bill H.R. 3935, to amend title 49, 
United States Code, to reauthorize and improve the Federal Aviation 
Administration and other civil aviation programs, and for other 
purposes; which was ordered to lie on the table; as follows:

       At the appropriate place, insert the following:

                 TITLE ___--ALGORITHMIC ACCOUNTABILITY

     SEC. __01. DEFINITIONS.

       In this title:
       (1) Augmented critical decision process.--The term 
     ``augmented critical decision process'' means a process, 
     procedure, or other activity that employs an automated 
     decision system to make a critical decision.
       (2) Automated decision system.--The term ``automated 
     decision system'' means any system, software, or process 
     (including one derived from machine learning, statistics, or 
     other data processing or artificial intelligence techniques 
     and excluding passive computing infrastructure) that uses 
     computation, the result of which serves as a basis for a 
     decision or judgment.
       (3) Biometrics.--The term ``biometrics'' means any 
     information that represents a biological, physiological, or 
     behavioral attribute or feature of a consumer.
       (4) Chair.--The term ``Chair'' means the Chair of the 
     Commission.
       (5) Commission.--The term ``Commission'' means the Federal 
     Trade Commission.
       (6) Consumer.--The term ``consumer'' means an individual.
       (7) Covered entity.--
       (A) In general.--The term ``covered entity'' means any 
     person, partnership, or corporation over which the Commission 
     has jurisdiction under section 5(a)(2) of the Federal Trade 
     Commission Act (15 U.S.C. 45(a)(2))--
       (i) that deploys any augmented critical decision process; 
     and

       (I) had greater than $50,000,000 in average annual gross 
     receipts or is deemed to have greater than $250,000,000 in 
     equity value for the 3-taxable-year period (or for the period 
     during which the person, partnership, or corporation has been 
     in existence, if such period is less than 3 years) preceding 
     the most recent fiscal year, as determined in accordance with 
     paragraphs (2) and (3) of section 448(c) of the Internal 
     Revenue Code of 1986;
       (II) possesses, manages, modifies, handles, analyzes, 
     controls, or otherwise uses identifying information about 
     more than 1,000,000 consumers, households, or consumer 
     devices for the purpose of developing or deploying any 
     automated decision system or augmented critical decision 
     process; or
       (III) is substantially owned, operated, or controlled by a 
     person, partnership, or corporation that meets the 
     requirements under subclause (I) or (II);

       (ii) that--

       (I) had greater than $5,000,000 in average annual gross 
     receipts or is deemed to have greater than $25,000,000 in 
     equity value for the 3-taxable-year period (or for the period 
     during which the person, partnership, or corporation has been 
     in existence, if such period is less than 3 years) preceding 
     the most recent fiscal year, as determined in accordance with 
     paragraphs (2) and (3) of section 448(c) of the Internal 
     Revenue Code of 1986; and
       (II) deploys any automated decision system that is 
     developed for implementation or use, or that the person, 
     partnership, or corporation reasonably expects to be 
     implemented or used, in an augmented critical decision 
     process by any person, partnership, or corporation if such 
     person, partnership, or corporation meets the requirements 
     described in clause (i); or

       (iii) that met the criteria described in clause (i) or (ii) 
     within the previous 3 years.
       (B) Inflation adjustment.--For purposes of applying this 
     paragraph in any fiscal year after the first fiscal year that 
     begins on or after the date of enactment of this title, each 
     of the dollar amounts specified in subparagraph (A) shall be 
     increased by the percentage increase (if any) in the consumer 
     price index for all urban consumers (U.S. city average) from 
     such first fiscal year that begins after such date of 
     enactment to the fiscal year involved.
       (8) Critical decision.--The term ``critical decision'' 
     means a decision or judgment that has any legal, material, or 
     similarly significant effect on a consumer's life relating to 
     access to or the cost, terms, or availability of--
       (A) education and vocational training, including 
     assessment, accreditation, or certification;
       (B) employment, workers management, or self-employment;
       (C) essential utilities, such as electricity, heat, water, 
     internet or telecommunications access, or transportation;
       (D) family planning, including adoption services or 
     reproductive services;
       (E) financial services, including any financial service 
     provided by a mortgage company, mortgage broker, or creditor;
       (F) healthcare, including mental healthcare, dental, or 
     vision;
       (G) housing or lodging, including any rental or short-term 
     housing or lodging;
       (H) legal services, including private arbitration or 
     mediation; or
       (I) any other service, program, or opportunity decisions 
     about which have a comparably legal, material, or similarly 
     significant effect on a consumer's life as determined by the 
     Commission through rulemaking.
       (9) Deploy.--The term ``deploy'' means to implement, use, 
     or make available for sale, license, or other commercial 
     relationship.
       (10) Develop.--The term ``develop'' means to design, code, 
     produce, customize, or otherwise create or modify.

[[Page S3616]]

       (11) Identifying information.--The term ``identifying 
     information'' means any information, regardless of how the 
     information is collected, inferred, predicted, or obtained 
     that identifies or represents a consumer, household, or 
     consumer device through data elements or attributes, such as 
     name, postal address, telephone number, biometrics, email 
     address, internet protocol address, social security number, 
     or any other identifying number, identifier, or code.
       (12) Impact assessment.--The term ``impact assessment'' 
     means the ongoing study and evaluation of an automated 
     decision system or augmented critical decision process and 
     its impact on consumers.
       (13) Passive computing infrastructure.--The term ``passive 
     computing infrastructure'' means any intermediary technology 
     that does not influence or determine the outcome of a 
     decision, including--
       (A) web hosting;
       (B) domain registration;
       (C) networking;
       (D) caching;
       (E) data storage; or
       (F) cybersecurity.
       (14) State.--The term ``State'' means each of the 50 
     States, the District of Columbia, and any territory or 
     possession of the United States.
       (15) Summary report.--The term ``summary report'' means 
     documentation of a subset of information required to be 
     addressed by the impact assessment as described in this title 
     or determined appropriate by the Commission.
       (16) Third-party decision recipient.--The term ``third-
     party decision recipient'' means any person, partnership, or 
     corporation (beyond the consumer and the covered entity) that 
     receives a copy of or has access to the results of any 
     decision or judgment that results from a covered entity's 
     deployment of an automated decision system or augmented 
     critical decision process.

     SEC. __02. ASSESSING THE IMPACT OF AUTOMATED DECISION SYSTEMS 
                   AND AUGMENTED CRITICAL DECISION PROCESSES.

       (a) Acts Prohibited.--
       (1) In general.--It is unlawful for--
       (A) any covered entity to violate a regulation promulgated 
     under subsection (b); or
       (B) any person to knowingly provide substantial assistance 
     to any covered entity in violating subsection (b).
       (2) Preemption of private contracts.--It shall be unlawful 
     for any covered entity to commit the acts prohibited in 
     paragraph (1), regardless of specific agreements between 
     entities or consumers.
       (b) Regulations.--
       (1) In general.--Subject to paragraph (2), not later than 2 
     years after the date of enactment of this title, the 
     Commission shall, in consultation with the Director of the 
     National Institute of Standards and Technology, the Director 
     of the National Artificial Intelligence Initiative, the 
     Director of the Office of Science and Technology Policy, and 
     other relevant stakeholders, including standards bodies, 
     private industry, academia, technology experts, and advocates 
     for civil rights, consumers, and impacted communities, 
     promulgate regulations, in accordance with section 553 of 
     title 5, United States Code, that--
       (A) require each covered entity to perform impact 
     assessment of any--
       (i) deployed automated decision system that was developed 
     for implementation or use, or that the covered entity 
     reasonably expects to be implemented or used, in an augmented 
     critical decision process by any person, partnership, or 
     corporation that meets the requirements described in section 
     __01(7)(A)(i); and
       (ii) augmented critical decision process, both prior to and 
     after deployment by the covered entity;
       (B) require each covered entity to maintain documentation 
     of any impact assessment performed under subparagraph (A), 
     including the applicable information described in section 
     __03(a) for 3 years longer than the duration of time for 
     which the automated decision system or augmented critical 
     decision process is deployed;
       (C) require each person, partnership, or corporation that 
     meets the requirements described in section __01(7)(A)(i) to 
     disclose their status as a covered entity to any person, 
     partnership, or corporation that sells, licenses, or 
     otherwise provides through a commercial relationship any 
     automated decision system deployed by the covered entity in 
     an automated decision system or augmented critical decision 
     process;
       (D) require each covered entity to submit to the 
     Commission, on an annual basis, a summary report for ongoing 
     impact assessment of any deployed automated decision system 
     or augmented critical decision process;
       (E) require each covered entity to submit an initial 
     summary report to the Commission for any new automated 
     decision system or augmented critical decision process prior 
     to its deployment by the covered entity;
       (F) allow any person, partnership, or corporation over 
     which the Commission has jurisdiction under section 5(a)(2) 
     of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) that 
     deploys any automated decision system or augmented critical 
     decision process, but is not a covered entity, to submit to 
     the Commission a summary report for any impact assessment 
     performed with respect to such system or process;
       (G) require each covered entity, in performing the impact 
     assessment described in subparagraph (A), to the extent 
     possible, to meaningfully consult (including through 
     participatory design, independent auditing, or soliciting or 
     incorporating feedback) with relevant internal stakeholders 
     (such as employees, ethics teams, and responsible technology 
     teams) and independent external stakeholders (such as 
     representatives of and advocates for impacted groups, civil 
     society and advocates, and technology experts) as frequently 
     as necessary;
       (H) require each covered entity to attempt to eliminate or 
     mitigate, in a timely manner, any impact made by an augmented 
     critical decision process that demonstrates a likely material 
     negative impact that has legal or similarly significant 
     effects on a consumer's life;
       (I) establish definitions for--
       (i) what constitutes ``access to or the cost, terms, or 
     availability of'' with respect to a critical decision;
       (ii) what constitutes ``possession'', ``management'', 
     ``modification'', and ``control'' with respect to identifying 
     information;
       (iii) the different categories of third-party decision 
     recipients that a covered entity must document under section 
     __04(1)(H); and
       (iv) any of the services, programs, or opportunities 
     described in subparagraphs (A) through (I) of section __01(8) 
     for the purpose of informing consumers, covered entities, and 
     regulators, as the Commission deems necessary;
       (J) establish guidelines for any person, partnership, or 
     corporation to calculate the number of consumers, households, 
     or consumer devices for which the person, partnership, or 
     corporation possesses, manages, modifies, or controls 
     identifying information for the purpose of determining 
     covered entity status;
       (K) establish guidelines for a covered entity to prioritize 
     different automated decision systems and augmented critical 
     decision processes deployed by the covered entity for 
     performing impact assessment; and
       (L) establish a required format for any summary report, as 
     described in subparagraphs (D), (E), and (F), to ensure that 
     such reports are submitted in an accessible and machine-
     readable format.
       (2) Considerations.--In promulgating the regulations under 
     paragraph (1), the Commission--
       (A) shall take into consideration--
       (i) that certain assessment or documentation of an 
     automated decision system or augmented critical decision 
     process may only be possible at particular stages of the 
     development and deployment of such system or process or may 
     be limited or not possible based on the availability of 
     certain types of information or data or the nature of the 
     relationship between the covered entity and consumers;
       (ii) the duration of time between summary report 
     submissions and the timeliness of the reported information;
       (iii) the administrative burden placed on the Commission 
     and the covered entity;
       (iv) the benefits of standardizing and structuring summary 
     reports for comparative analysis compared with the benefits 
     of less-structured narrative reports to provide detail and 
     flexibility in reporting;
       (v) that summary reports submitted by different covered 
     entities may contain different fields according to the 
     requirements established by the Commission, and the 
     Commission may allow or require submission of incomplete 
     reports;
       (vi) that existing data privacy and other regulations may 
     inhibit a covered entity from storing or sharing certain 
     information; and
       (vii) that a covered entity may require information from 
     other persons, partnerships, or corporations that develop any 
     automated decision system deployed in an automated decision 
     system or augmented critical decision process by the covered 
     entity for the purpose of performing impact assessment; and
       (B) may develop specific requirements for impact 
     assessments and summary reports for particular--
       (i) categories of critical decisions, as described in 
     subparagraphs (A) through (I) of section __01(8) or any 
     subcategory developed by the Commission; and
       (ii) stages of development and deployment of an automated 
     decision system or augmented critical decision process.
       (3) Effective date.--The regulations described in paragraph 
     (1) shall take effect on the date that is 2 years after such 
     regulations are promulgated.

     SEC. __03. REQUIREMENTS FOR COVERED ENTITY IMPACT ASSESSMENT.

       (a) Requirements for Impact Assessment.--In performing any 
     impact assessment required under section __02(b)(1) for an 
     automated decision system or augmented critical decision 
     process, a covered entity shall do the following, to the 
     extent possible, as applicable to such covered entity as 
     determined by the Commission:
       (1) In the case of a new augmented critical decision 
     process, evaluate any previously existing critical decision-
     making process used for the same critical decision prior to 
     the deployment of the new augmented critical decision 
     process, along with any related documentation or information, 
     such as--
       (A) a description of the baseline process being enhanced or 
     replaced by the augmented critical decision process;

[[Page S3617]]

       (B) any known harm, shortcoming, failure case, or material 
     negative impact on consumers of the previously existing 
     process used to make the critical decision;
       (C) the intended benefits of and need for the augmented 
     critical decision process; and
       (D) the intended purpose of the automated decision system 
     or augmented critical decision process.
       (2) Identify and describe any consultation with relevant 
     stakeholders as required by section __02(b)(1)(G), including 
     by documenting--
       (A) the points of contact for the stakeholders who were 
     consulted;
       (B) the date of any such consultation; and
       (C) information about the terms and process of the 
     consultation, such as--
       (i) the existence and nature of any legal or financial 
     agreement between the stakeholders and the covered entity;
       (ii) any data, system, design, scenario, or other document 
     or material the stakeholder interacted with; and
       (iii) any recommendations made by the stakeholders that 
     were used to modify the development or deployment of the 
     automated decision system or augmented critical decision 
     process, as well as any recommendations not used and the 
     rationale for such nonuse.
       (3) In accordance with any relevant National Institute of 
     Standards and Technology or other Federal Government best 
     practices and standards, perform ongoing testing and 
     evaluation of the privacy risks and privacy-enhancing 
     measures of the automated decision system or augmented 
     critical decision process, such as--
       (A) assessing and documenting the data minimization 
     practices of such system or process and the duration for 
     which the relevant identifying information and any resulting 
     critical decision is stored;
       (B) assessing the information security measures in place 
     with respect to such system or process, including any use of 
     privacy-enhancing technology such as federated learning, 
     differential privacy, secure multi-party computation, de-
     identification, or secure data enclaves based on the level of 
     risk; and
       (C) assessing and documenting the current and potential 
     future or downstream positive and negative impacts of such 
     system or process on the privacy, safety, or security of 
     consumers and their identifying information.
       (4) Perform ongoing testing and evaluation of the current 
     and historical performance of the automated decision system 
     or augmented critical decision process using measures such as 
     benchmarking datasets, representative examples from the 
     covered entity's historical data, and other standards, 
     including by documenting--
       (A) a description of what is deemed successful performance 
     and the methods and technical and business metrics used by 
     the covered entity to assess performance;
       (B) a review of the performance of such system or process 
     under test conditions or an explanation of why such 
     performance testing was not conducted;
       (C) a review of the performance of such system or process 
     under deployed conditions or an explanation of why 
     performance was not reviewed under deployed conditions;
       (D) a comparison of the performance of such system or 
     process under deployed conditions to test conditions or an 
     explanation of why such a comparison was not possible;
       (E) an evaluation of any differential performance 
     associated with consumers' race, color, sex, gender, age, 
     disability, religion, family status, socioeconomic status, or 
     veteran status, and any other characteristics the Commission 
     deems appropriate (including any combination of such 
     characteristics) for which the covered entity has 
     information, including a description of the methodology for 
     such evaluation and information about and documentation of 
     the methods used to identify such characteristics in the data 
     (such as through the use of proxy data, including ZIP Codes); 
     and
       (F) if any subpopulations were used for testing and 
     evaluation, a description of which subpopulations were used 
     and how and why such subpopulations were determined to be of 
     relevance for the testing and evaluation.
       (5) Support and perform ongoing training and education for 
     all relevant employees, contractors, or other agents 
     regarding any documented material negative impacts on 
     consumers from similar automated decision systems or 
     augmented critical decision processes and any improved 
     methods of developing or performing an impact assessment for 
     such system or process based on industry best practices and 
     relevant proposals and publications from experts, such as 
     advocates, journalists, and academics.
       (6) Assess the need for and possible development of any 
     guard rail for or limitation on certain uses or applications 
     of the automated decision system or augmented critical 
     decision process, including whether such uses or applications 
     ought to be prohibited or otherwise limited through any terms 
     of use, licensing agreement, or other legal agreement between 
     entities.
       (7) Maintain and keep updated documentation of any data or 
     other input information used to develop, test, maintain, or 
     update the automated decision system or augmented critical 
     decision process, including--
       (A) how and when such data or other input information was 
     sourced and, if applicable, licensed, including information 
     such as--
       (i) metadata and information about the structure and type 
     of data or other input information, such as the file type, 
     the date of the file creation or modification, and a 
     description of data fields;
       (ii) an explanation of the methodology by which the covered 
     entity collected, inferred, or obtained the data or other 
     input information and, if applicable, labeled, categorized, 
     sorted, or clustered such data or other input information, 
     including whether such data or other input information was 
     labeled, categorized, sorted, or clustered prior to being 
     collected, inferred, or obtained by the covered entity; and
       (iii) whether and how consumers provided informed consent 
     for the inclusion and further use of data or other input 
     information about themselves and any limitations stipulated 
     on such inclusion or further use;
       (B) why such data or other input information was used and 
     what alternatives were explored; and
       (C) other information about the data or other input 
     information, such as--
       (i) the representativeness of the dataset and how this 
     factor was measured, including any assumption about the 
     distribution of the population on which the augmented 
     critical decision process is deployed; and
       (ii) the quality of the data, how the quality was 
     evaluated, and any measure taken to normalize, correct, or 
     clean the data.
       (8) Evaluate the rights of consumers, such as--
       (A) by assessing the extent to which the covered entity 
     provides consumers with--
       (i) clear notice that such system or process will be used; 
     and
       (ii) a mechanism for opting out of such use;
       (B) by assessing the transparency and explainability of 
     such system or process and the degree to which a consumer may 
     contest, correct, or appeal a decision or opt out of such 
     system or process, including--
       (i) the information available to consumers or 
     representatives or agents of consumers about the system or 
     process, such as any relevant factors that contribute to a 
     particular decision, including an explanation of which 
     contributing factors, if changed, would cause the system or 
     process to reach a different decision, and how such consumer, 
     representative, or agent can access such information;
       (ii) documentation of any complaint, dispute, correction, 
     appeal, or opt-out request submitted to the covered entity by 
     a consumer with respect to such system or process; and
       (iii) the process and outcome of any remediation measure 
     taken by the covered entity to address the concerns of or 
     harms to consumers; and
       (C) by describing the extent to which any third-party 
     decision recipient receives a copy of or has access to the 
     results of such system or process and the category of such 
     third-party decision recipient, as defined by the Commission 
     in section __02(b)(1)(I)(iii).
       (9) Identify any likely material negative impact of the 
     automated decision system or augmented critical decision 
     process on consumers and assess any applicable mitigation 
     strategy, such as by--
       (A) identifying and measuring any likely material negative 
     impact of the system or process on consumers, including 
     documentation of the steps taken to identify and measure such 
     impact;
       (B) documenting any steps taken to eliminate or reasonably 
     mitigate any likely material negative impact identified, 
     including steps such as removing the system or process from 
     the market or terminating its development;
       (C) with respect to the likely material negative impacts 
     identified, documenting which such impacts were left 
     unmitigated and the rationale for the inaction, including 
     details about the justifying non-discriminatory, compelling 
     interest and why such interest cannot be satisfied by other 
     means (such as where there is an equal, zero-sum trade-off 
     between impacts on 2 or more consumers or where the required 
     mitigating action would violate civil rights or other laws); 
     and
       (D) documenting standard protocols or practices used to 
     identify, measure, mitigate, or eliminate any likely material 
     negative impact on consumers and how relevant teams or staff 
     are informed of and trained about such protocols or 
     practices.
       (10) Describe any ongoing documentation of the development 
     and deployment process with respect to the automated decision 
     system or augmented critical decision process, including 
     information such as--
       (A) the date of any testing, deployment, licensure, or 
     other significant milestones; and
       (B) points of contact for any team, business unit, or 
     similar internal stakeholder that was involved.
       (11) Identify any capabilities, tools, standards, datasets, 
     security protocols, improvements to stakeholder engagement, 
     or other resources that may be necessary or beneficial to 
     improving the automated decision system, augmented critical 
     decision process, or the impact assessment of such system or 
     process, in areas such as--
       (A) performance, including accuracy, robustness, and 
     reliability;
       (B) fairness, including bias and nondiscrimination;
       (C) transparency, explainability, contestability, and 
     opportunity for recourse;
       (D) privacy and security;
       (E) personal and public safety;
       (F) efficiency and timeliness;
       (G) cost; or
       (H) any other area determined appropriate by the 
     Commission.

[[Page S3618]]

       (12) Document any of the impact assessment requirements 
     described in paragraphs (1) through (11) that were attempted 
     but were not possible to comply with because they were 
     infeasible, as well as the corresponding rationale for not 
     being able to comply with such requirements, which may 
     include--
       (A) the absence of certain information about an automated 
     decision system developed by other persons, partnerships, and 
     corporations;
       (B) the absence of certain information about how clients, 
     customers, licensees, partners, and other persons, 
     partnerships, or corporations are deploying an automated 
     decision system in their augmented critical decision 
     processes;
       (C) a lack of demographic or other data required to assess 
     differential performance because such data is too sensitive 
     to collect, infer, or store; or
       (D) a lack of certain capabilities, including technological 
     innovations, that would be necessary to conduct such 
     requirements.
       (13) Perform and document any other ongoing study or 
     evaluation determined appropriate by the Commission.
       (b) Rule of Construction.--Nothing in this title should be 
     construed to limit any covered entity from adding other 
     criteria, procedures, or technologies to improve the 
     performance of an impact assessment of their automated 
     decision system or augmented critical decision process.
       (c) Nondisclosure of Impact Assessment.--Nothing in this 
     title should be construed to require a covered entity to 
     share with or otherwise disclose to the Commission or the 
     public any information contained in an impact assessment 
     performed in accordance with this title, except for any 
     information contained in the summary report required under 
     subparagraph (D) or (E) of section __02(b)(1).

     SEC. __04. REQUIREMENTS FOR SUMMARY REPORTS TO THE 
                   COMMISSION.

       The summary report that a covered entity is required to 
     submit under subparagraph (D) or (E) of section __02(b)(1) 
     for any automated decision system or augmented critical 
     decision process shall, to the extent possible--
       (1) contain information from the impact assessment of such 
     system or process, as applicable, including--
       (A) the name, website, and point of contact for the covered 
     entity;
       (B) a detailed description of the specific critical 
     decision that the augmented critical decision process is 
     intended to make, including the category of critical decision 
     as described in subparagraphs (A) through (I) of section 
     __01(8);
       (C) the covered entity's intended purpose for the automated 
     decision system or augmented critical decision process;
       (D) an identification of any stakeholders consulted by the 
     covered entity as required by section __02(b)(1)(G) and 
     documentation of the existence and nature of any legal 
     agreements between the stakeholders and the covered entity;
       (E) documentation of the testing and evaluation of the 
     automated decision system or augmented critical decision 
     process, including--
       (i) the methods and technical and business metrics used to 
     assess the performance of such system or process and a 
     description of what metrics are deemed successful 
     performance;
       (ii) the results of any assessment of the performance of 
     such system or process and a comparison of the results of any 
     assessment under test and deployed conditions; and
       (iii) an evaluation of any differential performance of such 
     system or process assessed during the impact assessment;
       (F) any publicly stated guard rail for or limitation on 
     certain uses or applications of the automated decision system 
     or augmented critical decision process, including whether 
     such uses or applications ought to be prohibited or otherwise 
     limited through any terms of use, licensing agreement, or 
     other legal agreement between entities;
       (G) documentation about the data or other input information 
     used to develop, test, maintain, or update the automated 
     decision system or augmented critical decision process 
     including--
       (i) how and when the covered entity sourced such data or 
     other input information; and
       (ii) why such data or other input information was used and 
     what alternatives were explored;
       (H) documentation of whether and how the covered entity 
     implements any transparency or explainability measures, 
     including--
       (i) which categories of third-party decision recipients 
     receive a copy of or have access to the results of any 
     decision or judgment that results from such system or 
     process; and
       (ii) any mechanism by which a consumer may contest, 
     correct, or appeal a decision or opt out of such system or 
     process, including the corresponding website for such 
     mechanism, where applicable;
       (I) any likely material negative impact on consumers 
     identified by the covered entity and a description of the 
     steps taken to remediate or mitigate such impact;
       (J) a list of any impact assessment requirements that were 
     attempted but were not possible to comply with because they 
     were infeasible, as well as the corresponding rationale for 
     not being able to comply with such requirements; and
       (K) any additional capabilities, tools, standards, 
     datasets, security protocols, improvements to stakeholder 
     engagement, or other resources identified by an impact 
     assessment as necessary or beneficial to improve the 
     performance of impact assessment or the development and 
     deployment of any automated decision system or augmented 
     critical decision process that the covered entity determines 
     appropriate to share with the Commission;
       (2) include, in addition to the information required under 
     paragraph (1), any relevant additional information from 
     section __03(a) the covered entity wishes to share with the 
     Commission;
       (3) follow any format or structure requirements specified 
     by the Commission; and
       (4) include additional criteria that are essential for the 
     purpose of consumer protection, as determined by the 
     Commission.

     SEC. __05. REPORTING; PUBLICLY ACCESSIBLE REPOSITORY.

       (a) Annual Report.--Not later than 1 year after the 
     effective date described in section __02(b)(3), and annually 
     thereafter, the Commission shall publish publicly on the 
     website of the Commission a report describing and summarizing 
     the information from the summary reports submitted under 
     subparagraph (D), (E), or (F) of section __02(b)(1) that--
       (1) is accessible and machine readable in accordance with 
     the 21st Century Integrated Digital Experience Act (44 U.S.C. 
     3501 note); and
       (2) describes broad trends, aggregated statistics, and 
     anonymized lessons learned about performing impact 
     assessments of automated decision systems or augmented 
     critical decision processes, for the purposes of updating 
     guidance related to impact assessments and summary reporting, 
     oversight, and making recommendations to other regulatory 
     agencies.
       (b) Publicly Accessible Repository.--
       (1) In general.--
       (A) Establishment.--
       (i) Development.--Not later than 180 days after the 
     Commission promulgates the regulations required under section 
     __02(b)(1), the Commission shall develop a publicly 
     accessible repository designed to publish a limited subset of 
     the information about each automated decision system and 
     augmented critical decision process for which the Commission 
     received a summary report under subparagraph (D), (E), or (F) 
     of section __02(b)(1) in order to facilitate consumer 
     protection.
       (ii) Publication.--Not later than 180 days after the 
     effective date described in section __02(b)(3), the 
     Commission shall make the repository publicly accessible.
       (iii) Updates.--The Commission shall update the repository 
     on a quarterly basis.
       (B) Purpose.--The purposes of the repository established 
     under subparagraph (A) are--
       (i) to inform consumers about the use of automated decision 
     systems and augmented critical decision processes;
       (ii) to allow researchers and advocates to study the use of 
     automated decision systems and augmented critical decision 
     processes; and
       (iii) to ensure compliance with the requirements of this 
     title.
       (C) Considerations.--In establishing the repository under 
     subparagraph (A), the Commission shall consider--
       (i) how to provide consumers with pertinent information 
     regarding augmented critical decision processes while 
     minimizing any potential commercial risk to any covered 
     entity of providing such information;
       (ii) what information, if any, to include regarding the 
     specific automated decision systems deployed in the augmented 
     critical decision processes;
       (iii) how to document information, when applicable, about 
     how to contest or seek recourse for a critical decision in a 
     manner that is readily accessible by the consumer; and
       (iv) how to streamline the submission of summary reports 
     under subparagraph (D), (E), or (F) of section __02(b)(1) to 
     allow the Commission to efficiently populate information into 
     the repository to minimize or eliminate any burden on the 
     Commission.
       (D) Requirements.--The Commission shall design the 
     repository established under subparagraph (A) to--
       (i) be publicly available and easily discoverable on the 
     website of the Commission;
       (ii) allow users to sort and search the repository by 
     multiple characteristics (such as by covered entity, date 
     reported, or category of critical decision) simultaneously;
       (iii) allow users to make a copy of or download the 
     information obtained from the repository, including any 
     subsets of information obtained by sorting or searching as 
     described in clause (ii), in accordance with current guidance 
     from the Office of Management and Budget, such as the Open, 
     Public, Electronic, and Necessary Government Data Act (44 
     U.S.C. 101 note);
       (iv) be in accordance with user experience and 
     accessibility best practices such as those described in the 
     21st Century Integrated Digital Experience Act (44 U.S.C. 
     3501 note);
       (v) include a limited subset of information from the 
     summary reports, as applicable, under subparagraph (D), (E), 
     or (F) of section __02(b)(1) that includes--

       (I) the identity of the covered entity that submitted such 
     summary report, including any link to the website of the 
     covered entity;

[[Page S3619]]

       (II) the specific critical decision that the augmented 
     critical decision process makes, along with the category of 
     the critical decision;
       (III) any publicly stated prohibited applications of the 
     automated decision system or augmented critical decision 
     process, including whether such prohibition is enforced 
     through any terms of use, licensing agreement, or other legal 
     agreement between entities;
       (IV) to the extent possible, the sources of any data used 
     to develop, test, maintain, or update the automated decision 
     system or augmented critical decision process;
       (V) to the extent possible, the type of technical and 
     business metrics used to assess the performance of the 
     augmented critical decision process when deployed; and
       (VI) the link to any web page with instructions or other 
     information related to a mechanism by which a consumer may 
     contest, correct, or appeal a decision or opt out of the 
     automated decision system or augmented critical decision 
     process; and

       (vi) include information about design, use, and maintenance 
     of the repository, including--

       (I) how frequently the repository is updated;
       (II) the date of the most recent such update;
       (III) the types of information from the summary reports 
     submitted under subparagraph (D), (E), or (F) of section 
     __02(b)(1) that are and are not included in the repository; 
     and
       (IV) any other information about the design, use, and 
     maintenance the Commission determines is--

       (aa) relevant to consumers and researchers; or
       (bb) essential for consumer education and recourse.
       (2) Authorization of appropriations.--There are authorized 
     to be appropriated to the Commission such sums as are 
     necessary to carry out this subsection.

     SEC. __06. GUIDANCE AND TECHNICAL ASSISTANCE; OTHER 
                   REQUIREMENTS.

       (a) Guidance and Technical Assistance From the 
     Commission.--
       (1) In general.--The Commission shall publish guidance on 
     how to meet the requirements of sections __03 and __04, 
     including resources such as documentation templates and 
     guides for meaningful consultation, that is developed by the 
     Commission after consultation with the Director of the 
     National Institute of Standards and Technology, the Director 
     of the National Artificial Intelligence Initiative, the 
     Director of the Office of Science and Technology Policy, and 
     other relevant stakeholders, including standards bodies, 
     private industry, academia, technology experts, and advocates 
     for civil rights, consumers, and impacted communities.
       (2) Assistance in determining covered entity status.--In 
     addition to the guidance required under paragraph (1), the 
     Commission shall--
       (A) issue guidance and training materials to assist 
     persons, partnerships, and corporations in evaluating whether 
     they are a covered entity; and
       (B) regularly update such guidance and training materials 
     in accordance with any feedback or questions from covered 
     entities, experts, or other relevant stakeholders.
       (b) Other Requirements.--
       (1) Publication.--Nothing in this title shall be construed 
     to limit a covered entity from publicizing any documentation 
     of the impact assessment maintained under section 
     __02(b)(1)(B), including information beyond what is required 
     to be submitted in a summary report under subparagraph (D) or 
     (E) of section __02(b)(1), unless such publication would 
     violate the privacy of any consumer.
       (2) Periodic review of regulations.--The Commission shall 
     review the regulations promulgated under section __02(b) not 
     less than once every 5 years and update such regulations as 
     appropriate.
       (3) Review by nist and ostp.--The Commission shall make 
     available, in a private and secure manner, to the Director of 
     the National Institute of Standards and Technology, the 
     Director of the Office of Science and Technology Policy, and 
     the head of any Federal agency with relevant regulatory 
     jurisdiction over an augmented critical decision process any 
     summary report submitted under subparagraph (D), (E), or (F) 
     of section __02(b)(1) for review in order to develop future 
     standards or regulations.

     SEC. __07. RESOURCES AND AUTHORITIES.

       (a) Bureau of Technology.--
       (1) Establishment.--
       (A) In general.--There is established within the Commission 
     the Bureau of Technology (in this subsection referred to as 
     the ``Bureau'').
       (B) Duties.--The Bureau shall engage in activities that 
     include:
       (i) Aiding or advising the Commission with respect to the 
     technological aspects of the functions of the Commission, 
     including--

       (I) preparing, conducting, facilitating, managing, or 
     otherwise enabling studies, workshops, audits, community 
     participation opportunities, or other similar activities; and
       (II) any other assistance deemed appropriate by the 
     Commission or Chair.

       (ii) Aiding or advising the Commission with respect to the 
     enforcement of this title.
       (iii) Providing technical assistance to any enforcement 
     bureau within the Commission with respect to the 
     investigation and trial of cases.
       (2) Chief technologist.--The Bureau shall be headed by a 
     Chief Technologist.
       (3) Staff.--
       (A) Appointments.--
       (i) In general.--Subject to subparagraph (B), the Chair 
     may, without regard to the civil service laws (including 
     regulations), appoint personnel with experience in fields 
     such as management, technology, digital and product design, 
     user experience, information security, civil rights, 
     technology policy, privacy policy, humanities and social 
     sciences, product management, software engineering, machine 
     learning, statistics, or other related fields to enable the 
     Bureau to perform its duties.
       (ii) Minimum appointments.--Not later than 2 years after 
     the date of enactment of this title, the Chair shall appoint 
     not less than 50 personnel.
       (B) Excepted service.--The personnel appointed in 
     accordance with subparagraph (A) may be appointed to 
     positions described in section 213.3102(r) of title 5, Code 
     of Federal Regulations.
       (4) Authorization of appropriations.--There are authorized 
     to be appropriated to the Commission such sums as are 
     necessary to carry out this subsection.
       (b) Additional Personnel in the Bureau of Consumer 
     Protection.--
       (1) Additional personnel.--Notwithstanding any other 
     provision of law, the Chair may, without regard to the civil 
     service laws (including regulations), appoint 25 additional 
     personnel to the Division of Enforcement of the Bureau of 
     Consumer Protection.
       (2) Authorization of appropriations.--There are authorized 
     to be appropriated to the Commission such sums as are 
     necessary to carry out this subsection.
       (c) Establishment of Agreements of Cooperation.--The 
     Commission shall negotiate agreements of cooperation, as 
     needed, with any relevant Federal agency with respect to 
     information sharing and enforcement actions taken regarding 
     the development or deployment of an automated decision system 
     to make a critical decision or of an augmented critical 
     decision process. Such agreements shall include procedures 
     for determining which agency shall file an action and 
     providing notice to the non-filing agency, where feasible, 
     prior to initiating a civil action to enforce any Federal law 
     within such agencies' jurisdictions regarding the development 
     or deployment of an automated decision system to make a 
     critical decision or of an augmented critical decision 
     process by a covered entity.

     SEC. __08. ENFORCEMENT.

       (a) Enforcement by the Commission.--
       (1) Unfair or deceptive acts or practices.--A violation of 
     this title or a regulation promulgated thereunder shall be 
     treated as a violation of a rule defining an unfair or 
     deceptive act or practice under section 18(a)(1)(B) of the 
     Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
       (2) Powers of the commission.--
       (A) In general.--The Commission shall enforce this title 
     and the regulations promulgated under this title in the same 
     manner, by the same means, and with the same jurisdiction, 
     powers, and duties as though all applicable terms and 
     provisions of the Federal Trade Commission Act (15 U.S.C. 41 
     et seq.) were incorporated into and made a part of this 
     title.
       (B) Privileges and immunities.--Any person who violates 
     this title or a regulation promulgated thereunder shall be 
     subject to the penalties and entitled to the privileges and 
     immunities provided in the Federal Trade Commission Act (15 
     U.S.C. 41 et seq.).
       (C) Authority preserved.--Nothing in this title shall be 
     construed to limit the authority of the Commission under any 
     other provision of law.
       (D) Rulemaking.--The Commission shall promulgate in 
     accordance with section 553 of title 5, United States Code, 
     such additional rules as may be necessary to carry out this 
     title.
       (b) Enforcement by States.--
       (1) In general.--If the attorney general of a State has 
     reason to believe that an interest of the residents of the 
     State has been or is being threatened or adversely affected 
     by a practice that violates this title or a regulation 
     promulgated thereunder, the attorney general of the State 
     may, as parens patriae, bring a civil action on behalf of the 
     residents of the State in an appropriate district court of 
     the United States to obtain appropriate relief.
       (2) Rights of commission.--
       (A) Notice to commission.--
       (i) In general.--Except as provided in clause (iii), the 
     attorney general of a State, before initiating a civil action 
     under paragraph (1), shall provide written notification to 
     the Commission that the attorney general intends to bring 
     such civil action.
       (ii) Contents.--The notification required under clause (i) 
     shall include a copy of the complaint to be filed to initiate 
     the civil action.
       (iii) Exception.--If it is not feasible for the attorney 
     general of a State to provide the notification required under 
     clause (i) before initiating a civil action under paragraph 
     (1), the attorney general shall notify the Commission 
     immediately upon instituting the civil action.
       (B) Intervention by commission.--The Commission may--
       (i) intervene in any civil action brought by the attorney 
     general of a State under paragraph (1); and

[[Page S3620]]

       (ii) upon intervening--

       (I) be heard on all matters arising in the civil action; 
     and
       (II) file petitions for appeal of a decision in the civil 
     action.

       (3) Investigatory powers.--Nothing in this subsection may 
     be construed to prevent the attorney general of a State from 
     exercising the powers conferred on the attorney general by 
     the laws of the State to conduct investigations, to 
     administer oaths or affirmations, or to compel the attendance 
     of witnesses or the production of documentary or other 
     evidence.
       (4) Venue; service of process.--
       (A) Venue.--Any action brought under paragraph (1) may be 
     brought in--
       (i) the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code; or
       (ii) another court of competent jurisdiction.
       (B) Service of process.--In an action brought under 
     paragraph (1), process may be served in any district in 
     which--
       (i) the defendant is an inhabitant, may be found, or 
     transacts business; or
       (ii) venue is proper under section 1391 of title 28, United 
     States Code.
       (5) Actions by other state officials.--
       (A) In general.--In addition to a civil action brought by 
     an attorney general under paragraph (1), any other officer of 
     a State who is authorized by the State to do so may bring a 
     civil action under paragraph (1), subject to the same 
     requirements and limitations that apply under this subsection 
     to civil actions brought by attorneys general.
       (B) Savings provision.--Nothing in this subsection may be 
     construed to prohibit an authorized official of a State from 
     initiating or continuing any proceeding in a court of the 
     State for a violation of any civil or criminal law of the 
     State.

     SEC. __09. COORDINATION.

       In carrying out this title, the Commission shall coordinate 
     with any appropriate Federal agency or State regulator to 
     promote consistent regulatory treatment of automated decision 
     systems and augmented critical decision processes.

     SEC. __10. NO PREEMPTION.

       Nothing in this title may be construed to preempt any 
     State, tribal, city, or local law, regulation, or ordinance.
                                 ______