,,ii #aacth ,,congress #b;d ,session ,s4 #bcgh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,may #ba1 #bjad ,mr4 ,menendez introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish a regulatory framework for the comprehensive protection of personal data for individuals under the aegis of the ,federal ,trade ,commission1 to amend the ,children's ,online ,privacy ,protection ,act of #aiih to improve provisions relating to collection1 use1 and disclosure of personal information of children1 and for other purposes4 #a4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,table of contents4 ,,title ,i--,commercial privacy ,sec4 #aja4 ,short title4 ,sec4 #ajb4 ,findings4 ,sec4 #ajc4 ,definitions4 ,subtitle ,a--,right to security and accountability ,sec4 #aaa4 ,security4 ,sec4 #aab4 ,accountability4 ,sec4 #aac4 ,privacy by design4 ,subtitle ,b--,right to notice and individual participation ,sec4 #aba4 ,transparent notice of practices and purposes4 ,sec4 #abb4 ,individual participation4 ,subtitle ,c--,rights relating to data minimization1 constraints on distribution1 and data integrity ,sec4 #aca4 ,data minimization4 ,sec4 #acb4 ,constraints on distribution of information4 ,sec4 #acc4 ,data integrity4 ,subtitle ,d--,right to notice of breaches of security ,sec4 #ada4 ,definitions4 ,sec4 #adb4 ,notice to individuals4 ,sec4 #adc4 ,notice to law enforcement4 ,subtitle ,e--,enforcement ,sec4 #aea4 ,general application4 ,sec4 #aeb4 ,enforcement by the ,federal ,trade ,commission4 ,sec4 #aec4 ,enforcement by ,attorney ,general4 ,sec4 #aed4 ,enforcement by ,states4 ,sec4 #aee4 ,civil penalties4 ,sec4 #aef4 ,effect on other laws4 ,sec4 #aeg4 ,no private right of action4 ,subtitle ,f--,co-,regulatory safe harbor programs ,sec4 #afa4 ,establishment of safe harbor programs4 ,sec4 #afb4 ,participation in safe harbor program4 ,subtitle ,g--,application with other ,federal laws ,sec4 #aga4 ,application with other ,federal laws4 ,subtitle ,h--,development of commercial data privacy policy in the ,department of ,commerce ,sec4 #aha4 ,direction to develop commercial data privacy policy4 ,,title ,,ii--,online privacy of children ,sec4 #bja4 ,short title4 ,sec4 #bjb4 ,findings4 ,sec4 #bjc4 ,definitions4 ,sec4 #bjd4 ,online collection1 use1 and disclosure of personal information of children4 ,sec4 #bje4 ,targeted marketing to children or minors4 ,sec4 #bjf4 ,digital ,marketing ,bill of ,rights for ,teens and ,fair ,information ,practices ,principles4 ,sec4 #bjg4 ,online collection of geolocation information of children and minors4 ,sec4 #bjh4 ,removal of content4 ,sec4 #bji4 ,enforcement and applicability4 ,sec4 #baj4 ,rule for treatment of users of websites1 services1 and applications directed to children or minors4 ,sec4 #baa4 ,effective dates4 ,i ,commercial privacy #aja4 ,short title ,this title may be cited as the ,commercial ,privacy ,bill of ,rights ,act of #bjad4 #ajb4 ,findings ,the ,congress finds the following3 7#a7 ,personal privacy is worthy of protection through appropriate legislation4 7#b7 ,trust in the treatment of personally identifiable information collected on and off the ,internet is essential for businesses to succeed4 7#c7 ,persons interacting with others engaged in interstate commerce have a significant interest in their personal information1 as well as a right to control how that information is collected1 used1 stored1 or transferred4 7#d7 ,persons engaged in interstate commerce and collecting personally identifiable information on individuals have a responsibility to treat that information with respect and in accordance with common standards4 7#e7 ,on the day before the date of the enactment of this ,act1 the laws of the ,federal ,government and ,state and local governments provided inadequate privacy protection for individuals engaging in and interacting with persons engaged in interstate commerce4 7#f7 ,as of the day before the date of the enactment of this ,act1 with the exception of ,federal ,trade ,commission enforcement of laws against unfair and deceptive practices1 the ,federal ,government has eschewed general commercial privacy laws in favor of industry self-regulation1 which has led to several self-policing schemes1 some of which are enforceable1 and some of which provide insufficient privacy protection to individuals4 7#g7 ,as of the day before the date of the enactment of this ,act1 many collectors of personally identifiable information have yet to provide baseline fair information practice protections for individuals4 7#h7 ,the ease of gathering and compiling personal information on the ,internet and off1 both overtly and surreptitiously1 is becoming increasingly efficient and effortless due to advances in technology which have provided information gatherers the ability to compile seamlessly highly detailed personal histories of individuals4 7#i7 ,personal information requires greater privacy protection than is available on the day before the date of the enactment of this ,act4 ,vast amounts of personal information1 including sensitive information1 about individuals are collected on and off the ,internet1 often combined and sold or otherwise transferred to third parties1 for purposes unknown to an individual to whom the personally identifiable information pertains4 7#aj7 ,toward the close of the #bjth century1 as individuals' personal information was increasingly collected1 profiled1 and shared for commercial purposes1 and as technology advanced to facilitate these practices1 ,congress enacted numerous statutes to protect privacy4 7#aa7 ,those statutes apply to the government1 telephones1 cable television1 e-mail1 video tape rentals1 and the ,internet 7but only with respect to children and law enforcement requests74 7#ab7 ,as in those instances1 the ,federal ,government has a substantial interest in creating a level playing field of protection across all collectors of personally identifiable information1 both in the ,united ,states and abroad4 7#ac7 ,enhancing individual privacy protection in a balanced way that establishes clear1 consistent rules1 both domestically and internationally1 will stimulate commerce by instilling greater consumer confidence at home and greater confidence abroad as more and more entities digitize personally identifiable information1 whether collected1 stored1 or used online or offline4 #ajc4 ,definitions 7a7 ,in general ,subject to subsection 7b71 in this title3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,covered entity ,the term covered entity means any person to whom this title applies under section #aea4 7#c7 ,covered information 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term covered information means only the following3 7i7 ,personally identifiable information4 7ii7 ,unique identifier information4 7iii7 ,any information that is collected1 used1 or stored in connection with personally identifiable information or unique identifier information in a manner that may reasonably be used by the party collecting the information to identify a specific individual4 7,b7 ,exception ,the term covered information does not include the following3 7i7 ,personally identifiable information obtained from public records that is not merged with covered information gathered elsewhere4 7ii7 ,personally identifiable information that is obtained from a forum-- 7,i7 where the individual voluntarily shared the information or authorized the information to be shared2 and 7,,ii7 that-- 7aa7 is widely and publicly available and was not made publicly available in bad faith2 and 7bb7 contains no restrictions on who can access and view such information4 7iii7 ,personally identifiable information reported in public media4 7iv7 ,personally identifiable information dedicated to contacting an individual at the individual's place of work4 7#d7 ,established business relationship ,the term established business relationship means1 with respect to a covered entity and a person1 a relationship formed with or without the exchange of consideration1 involving the establishment of an account by the person with the covered entity for the receipt of products or services offered by the covered entity4 7#e7 ,personally identifiable information ,the term personally identifiable information means only the following3 7,a7 ,any of the following information about an individual3 7i7 ,the first name 7or initial7 and last name of an individual1 whether given at birth or time of adoption1 or resulting from a lawful change of name4 7ii7 ,the postal address of a physical place of residence of such individual4 7iii7 ,an e-mail address4 7iv7 ,a telephone number or mobile device number4 7v7 ,a social security number or other government issued identification number issued to such individual4 7vi7 ,the account number of a credit card issued to such individual4 7vii7 ,unique identifier information that alone can be used to identify a specific individual4 7viii7 ,biometric data about such individual1 including fingerprints and retina scans4 7,b7 ,if used1 transferred1 or stored in connection with #a or more of the items of information described in subparagraph 7,a71 any of the following3 7i7 ,a date of birth4 7ii7 ,the number of a certificate of birth or adoption4 7iii7 ,a place of birth4 7iv7 ,unique identifier information that alone cannot be used to identify a specific individual4 7v7 ,precise geographic location1 at the same degree of specificity as a global positioning system or equivalent system1 and not including any general geographic information that may be derived from an ,internet ,protocol address4 7vi7 ,information about an individual's quantity1 technical configuration1 type1 destination1 location1 and amount of uses of voice services1 regardless of technology used4 7vii7 ,any other information concerning an individual that may reasonably be used by the party using1 collecting1 or storing that information to identify that individual4 7#f7 ,sensitive personally identifiable information ,the term sensitive personally identifiable information means-- 7,a7 personally identifiable information which1 if lost1 compromised1 or disclosed without authorization either alone or with other information1 carries a significant risk of economic or physical harm2 or 7,b7 information related to-- 7i7 a particular medical condition or a health record2 or 7ii7 the religious affiliation of an individual4 7#g7 ,third party 7,a7 ,in general ,the term third party means1 with respect to a covered entity1 a person that-- 7i7 is-- 7,i7 not related to the covered entity by common ownership or corporate control2 or 7,,ii7 related to the covered entity by common ownership or corporate control and an ordinary consumer would not understand that the covered entity and the person were related by common ownership or corporate control2 7ii7 is not a service provider used by the covered entity to receive personally identifiable information or sensitive personally identifiable information in performing services or functions on behalf of and under the instruction of the covered entity2 and 7iii7 with respect to the collection of covered information of an individual1 does not have an established business relationship with the individual and does not identify itself to the individual at the time of such collection in a clear and conspicuous manner that is visible to the individual4 7,b7 ,common brands ,the term third party may include1 with respect to a covered entity1 a person who operates under a common brand with the covered entity4 7#h7 ,unauthorized use 7,a7 ,in general ,the term unauthorized use means the use of covered information by a covered entity or its service provider for any purpose not authorized by the individual to whom such information relates4 7,b7 ,exceptions ,except as provided in subparagraph 7,c71 the term unauthorized use does not include use of covered information relating to an individual by a covered entity or its service provider as follows3 7i7 ,to process and enforce a transaction or deliver a service requested by that individual4 7ii7 ,to operate the covered entity that is providing a transaction or delivering a service requested by that individual1 such as inventory management1 financial reporting and accounting1 planning1 and product or service improvement or forecasting4 7iii7 ,to prevent or detect fraud or to provide for a physically or virtually secure environment4 7iv7 ,to investigate a possible crime4 7v7 ,that is required by a provision of law or legal process4 7vi7 ,to market or advertise to an individual from a covered entity within the context of a covered entity's own ,internet website1 services1 or products if the covered information used for such marketing or advertising was-- 7,i7 collected directly by the covered entity2 or 7,,ii7 shared with the covered entity-- 7aa7 at the affirmative request of the individual2 or 7bb7 by an entity with which the individual has an established business relationship4 7vii7 ,use that is necessary for the improvement of transaction or service delivery through research1 testing1 analysis1 and development4 7viii7 ,use that is necessary for internal operations1 including the following3 7,i7 ,collecting customer satisfaction surveys and conducting customer research to improve customer service information4 7,,ii7 ,information collected by an ,internet website about the visits to such website and the click-through rates at such website-- 7aa7 to improve website navigation and performance2 or 7bb7 to understand and improve the interaction of an individual with the advertising of a covered entity4 7ix7 ,use-- 7,i7 by a covered entity with which an individual has an established business relationship2 7,,ii7 which the individual could have reasonably expected1 at the time such relationship was established1 was related to a service provided pursuant to such relationship2 and 7,,iii7 which does not constitute a material change in use or practice from what could have reasonably been expected4 7,c7 ,savings ,a use of covered information regarding an individual by a covered entity or its service provider may only be excluded under subparagraph 7,b7 from the definition of unauthorized use under subparagraph 7,a7 if the use is reasonable and consistent with the practices and purposes described in the notice given the individual in accordance with section #aba7;a77#a74 7#i7 ,unique identifier information ,the term unique identifier information means a unique persistent identifier associated with an individual or a networked device1 including a customer number held in a cookie1 a user ,,id1 a processor serial number1 or a device serial number4 7b7 ,modified definition by rulemaking ,if the ,commission determines that a term defined in any of paragraphs 7#c7 through 7#h7 is not reasonably sufficient to protect an individual from unfair or deceptive acts or practices1 the ,commission may by rule modify such definition as the ,commission considers appropriate to protect such individual from an unfair or deceptive act or practice to the extent that the ,commission determines will not unreasonably impede interstate commerce4 ,a ,right to security and accountability #aaa4 ,security 7a7 ,rulemaking required ,not later than #ahj days after the date of the enactment of this ,act1 the ,commission shall initiate a rulemaking proceeding to require each covered entity to carry out security measures to protect the covered information it collects and maintains4 7b7 ,proportion ,the requirements prescribed under subsection 7a7 shall provide for security measures that are proportional to the size1 type1 nature1 and sensitivity of the covered information a covered entity collects4 7c7 ,consistency ,the requirements prescribed under subsection 7a7 shall be consistent with guidance provided by the ,commission and recognized industry practices for safety and security on the day before the date of the enactment of this ,act4 7d7 ,technological means ,in a rule prescribed under subsection 7a71 the ,commission may not require a specific technological means of meeting a requirement4 #aab4 ,accountability ,each covered entity shall1 in a manner proportional to the size1 type1 and nature of the covered information it collects-- 7#a7 have managerial accountability1 proportional to the size and structure of the covered entity1 for the adoption and implementation of policies consistent with this title2 7#b7 have a process to respond to non-frivolous inquiries from individuals regarding the collection1 use1 transfer1 or storage of covered information relating to such individuals2 and 7#c7 describe the means of compliance of the covered entity with the requirements of this ,act upon request from-- 7,a7 the ,commission2 or 7,b7 an appropriate safe harbor program established under section #aea4 #aac4 ,privacy by design ,each covered entity shall1 in a manner proportional to the size1 type1 and nature of the covered information that it collects1 implement a comprehensive information privacy program by-- 7#a7 incorporating necessary development processes and practices throughout the product life cycle that are designed to safeguard the personally identifiable information that is covered information of individuals based on-- 7,a7 the reasonable expectations of such individuals regarding privacy2 and 7,b7 the relevant threats that need to be guarded against in meeting those expectations2 and 7#b7 maintaining appropriate management processes and practices throughout the data life cycle that are designed to ensure that information systems comply with-- 7,a7 the provisions of this title2 7,b7 the privacy policies of a covered entity2 and 7,c7 the privacy preferences of individuals that are consistent with the consent choices and related mechanisms of individual participation as described in section #abb4 ,b ,right to notice and individual participation #aba4 ,transparent notice of practices and purposes 7a7 ,in general ,not later than #fj days after the date of the enactment of this ,act1 the ,commission shall initiate a rulemaking proceeding to require each covered entity-- 7#a7 to provide accurate1 clear1 concise1 and timely notice to individuals of-- 7,a7 the practices of the covered entity regarding the collection1 use1 transfer1 and storage of covered information2 and 7,b7 the specific purposes of those practices2 7#b7 to provide accurate1 clear1 concise1 and timely notice to individuals before implementing a material change in such practices2 and 7#c7 to maintain the notice required by paragraph 7#a7 in a form that individuals can readily access4 7b7 ,compliance and other considerations ,in the rulemaking required by subsection 7a71 the ,commission-- 7#a7 shall consider the types of devices and methods individuals will use to access the required notice2 7#b7 may provide that a covered entity unable to provide the required notice when information is collected may comply with the requirement of subsection 7a77#a7 by providing an alternative time and means for an individual to receive the required notice promptly2 7#c7 may draft guidance for covered entities to use in designing their own notice and may include a draft model template for covered entities to use in designing their own notice2 and 7#d7 may provide guidance on how to construct computer-readable notices or how to use other technology to deliver the required notice4 #abb4 ,individual participation 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,commission shall initiate a rulemaking proceeding to require each covered entity-- 7#a7 to offer individuals a clear and conspicuous mechanism for opt-in consent for any use of their covered information that would otherwise be unauthorized use2 7#b7 to offer individuals a robust1 clear1 and conspicuous mechanism for opt-in consent for the use by third parties of the individuals' covered information for behavioral advertising or marketing2 7#c7 to provide any individual to whom the personally identifiable information that is covered information pertains1 and which the covered entity or its service provider stores1 appropriate and reasonable-- 7,a7 access to such information2 and 7,b7 mechanisms to correct such information to improve the accuracy of such information2 and 7#d7 in the case that a covered entity enters bankruptcy or an individual requests the termination of a service provided by the covered entity to the individual or termination of some other relationship with the covered entity1 to permit the individual to easily request that-- 7,a7 all of the personally identifiable information that is covered information that the covered entity maintains relating to the individual1 except for information the individual authorized the sharing of or which the individual shared with the covered entity in a forum that is widely and publicly available1 be rendered not personally identifiable2 or 7,b7 if rendering such information not personally identifiable is not possible1 to cease the unauthorized use or transfer to a third party for an unauthorized use of such information or to cease use of such information for marketing1 unless such unauthorized use or transfer is otherwise required by a provision of law4 7b7 ,unauthorized use transfers ,in the rulemaking required by subsection 7a71 the ,commission shall provide that with respect to transfers of covered information to a third party for which an individual provides opt-in consent1 the third party to which the information is transferred may not use such information for any unauthorized use other than a use-- 7#a7 specified pursuant to the purposes stated in the required notice under section #aba7;a72 and 7#b7 authorized by the individual when the individual granted consent for the transfer of the information to the third party4 7c7 ,alternative means ,to terminate use of covered information ,in the rulemaking required by subsection 7a71 the ,commission shall allow a covered entity to provide individuals an alternative means1 in lieu of the access1 consent1 and correction requirements1 of prohibiting a covered entity from use or transfer of that individual's covered information4 7d7 ,service providers 7#a7 ,in general ,the use of a service provider by a covered entity to receive covered information in performing services or functions on behalf of and under the instruction of the covered entity does not constitute an unauthorized use of such information by the covered entity if the covered entity and the service provider execute a contract that requires the service provider to collect1 use1 and store the information on behalf of the covered entity in a manner consistent with-- 7,a7 the requirements of this title2 and 7,b7 the policies and practices related to such information of the covered entity4 7#b7 ,transfers between service providers for a covered entity ,the disclosure by a service provider of covered information pursuant to a contract with a covered entity to another service provider in order to perform the same service or functions for that covered entity does not constitute an unauthorized use4 7#c7 ,liability remains with covered entity ,a covered entity remains responsible and liable for the protection of covered information that has been transferred to a service provider for processing1 notwithstanding any agreement to the contrary between a covered entity and the service provider4 ,c ,rights relating to data minimization1 constraints on distribution1 and data integrity #aca4 ,data minimization ,each covered entity shall-- 7#a7 collect only as much covered information relating to an individual as is reasonably necessary-- 7,a7 to process or enforce a transaction or deliver a service requested by such individual2 7,b7 for the covered entity to provide a transaction or delivering a service requested by such individual1 such as inventory management1 financial reporting and accounting1 planning1 product or service improvement or forecasting1 and customer support and service2 7,c7 to prevent or detect fraud or to provide for a secure environment2 7,d7 to investigate a possible crime2 7,e7 to comply with a provision of law2 7,f7 for the covered entity to market or advertise to such individual if the covered information used for such marketing or advertising was collected directly by the covered entity2 or 7,g7 for internal operations1 including-- 7i7 collecting customer satisfaction surveys and conducting customer research to improve customer service2 and 7ii7 collection from an ,internet website of information about visits and click-through rates relating to such website to improve-- 7,i7 website navigation and performance2 and 7,,ii7 the customer's experience2 7#b7 retain covered information for only such duration as-- 7,a7 with respect to the provision of a transaction or delivery of a service to an individual-- 7i7 is necessary to provide such transaction or deliver such service to such individual2 or 7ii7 if such service is ongoing1 is reasonable for the ongoing nature of the service2 or 7,b7 is required by a provision of law2 7#c7 retain covered information only for the purpose it was collected1 or reasonably related purposes2 and 7#d7 exercise reasonable data retention procedures with respect to both the initial collection and subsequent retention4 #acb4 ,constraints on distribution of information 7a7 ,in general ,each covered entity shall-- 7#a7 require by contract that any third party to which it transfers covered information use the information only for purposes that are consistent with-- 7,a7 the provisions of this title2 and 7,b7 as specified in the contract2 7#b7 require by contract that such third party may not combine information that the covered entity has transferred to it1 that relates to an individual1 and that is not personally identifiable information with other information in order to identify such individual1 unless the covered entity has obtained the opt-in consent of such individual for such combination and identification2 and 7#c7 before executing a contract with a third party-- 7,a7 assure through due diligence that the third party is a legitimate organization2 and 7,b7 in the case of a material violation of the contract1 at a minimum notify the ,commission of such violation4 7b7 ,transfers to unreliable third parties prohibited ,a covered entity may not transfer covered information to a third party that the covered entity knows-- 7#a7 has intentionally or willfully violated a contract required by subsection 7a72 and 7#b7 is reasonably likely to violate such contract4 7c7 ,application of rules to third parties 7#a7 ,in general ,except as provided in paragraph 7#b71 a third party that receives covered information from a covered entity shall be subject to the provisions of this ,act as if it were a covered entity4 7#b7 ,exemption ,the ,commission may1 as it determines appropriate1 exempt classes of third parties from liability under any provision of subtitle ,b if the ,commission finds that-- 7,a7 such class of third parties cannot reasonably comply with such provision2 or 7,b7 with respect to covered information relating to individuals that is transferred to such class1 compliance by such class with such provision would not sufficiently benefit such individuals4 #acc4 ,data integrity 7a7 ,in general ,each covered entity shall attempt to establish and maintain reasonable procedures to ensure that personally identifiable information that is covered information and maintained by the covered entity is accurate in those instances where the covered information could be used to deny consumers benefits or cause significant harm4 7b7 ,exception ,subsection 7a7 shall not apply to covered information of an individual maintained by a covered entity that is provided-- 7#a7 directly to the covered entity by the individual2 7#b7 to the covered entity by another entity at the request of the individual2 7#c7 to prevent or detect fraud2 or 7#d7 to provide for a secure environment4 ,d ,right to notice of breaches of security #ada4 ,definitions ,in this subtitle3 7#a7 ,breach of security 7,a7 ,in general ,the term breach of security means compromise of the security1 confidentiality1 or integrity of1 or loss of1 data in electronic form that results in1 or there is a reasonable basis to conclude has resulted in1 unauthorized access to or acquisition of personally identifiable information from a covered entity4 7,b7 ,exclusions ,the term breach of security does not include-- 7i7 a good faith acquisition of personally identifiable information by a covered entity1 or an employee or agent of a covered entity1 if the personally identifiable information is not subject to further use or unauthorized disclosure2 7ii7 any lawfully authorized investigative1 protective1 or intelligence activity of a law enforcement or an intelligence agency of the ,united ,states1 a ,state1 or a political subdivision of a ,state2 or 7iii7 the release of a public record not otherwise subject to confidentiality or nondisclosure requirements4 7#b7 ,data in electronic form ,the term data in electronic form means any data stored electronically or digitally on any computer system or other database1 including recordable tapes and other mass storage devices4 7#c7 ,designated entity ,the term designated entity means the ,federal ,government entity designated by the ,secretary of ,homeland ,security under section #adc7;a74 7#d7 ,identity theft ,the term identity theft means the unauthorized use of another person's personally identifiable information for the purpose of engaging in commercial transactions under the identity of such other person1 including any contact that violates section #ajbh;,a of title #ah1 ,united ,states ,code4 7#e7 ,major credit reporting agency ,the term major credit reporting agency means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis within the meaning of section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#f7 ,service provider ,the term service provider means a person that provides electronic data transmission1 routing1 intermediate and transient storage1 or connections to its system or network1 where the person providing such services does not select or modify the content of the electronic data1 is not the sender or the intended recipient of the data1 and does not differentiate personally identifiable information from other information that such person transmits1 routes1 or stores1 or for which such person provides connections4 ,any such person shall be treated as a service provider under this subtitle only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage1 or connections4 #adb4 ,notice to individuals 7a7 ,in general ,a covered entity that owns or possesses data in electronic form containing personally identifiable information1 following the discovery of a breach of security of the system maintained by the covered entity that contains such information1 shall notify-- 7#a7 each individual who is a citizen or resident of the ,united ,states and whose personally identifiable information has been1 or is reasonably believed to have been1 acquired or accessed from the covered entity as a result of the breach of security2 and 7#b7 the ,commission1 unless the covered entity has notified the designated entity under section #adc4 7b7 ,special notification requirements 7#a7 ,third parties ,in the event of a breach of security of a system maintained by a third party that has been contracted to maintain or process data in electronic form containing personally identifiable information on behalf of a covered entity who owns or possesses such data1 the third party shall notify the covered entity of the breach of security4 7#b7 ,service providers ,if a service provider becomes aware of a breach of security of data in electronic form containing personally identifiable information that is owned or possessed by another covered entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 the service provider shall notify of the breach of security only the covered entity who initiated such connection1 transmission1 routing1 or storage if such covered entity can be reasonably identified4 7#c7 ,coordination of notification with credit reporting agencies 7,a7 ,in general ,if a covered entity is required to provide notification to more than #e1jjj individuals under subsection 7a77#a71 the covered entity also shall notify each major credit reporting agency of the timing and distribution of the notices1 except when the only personally identifiable information that is the subject of the breach of security is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code4 7,b7 ,notice to credit reporting agencies before individuals ,such notice shall be given to each credit reporting agency without unreasonable delay and1 if it will not delay notice to the affected individuals1 prior to the distribution of notices to the affected individuals4 7c7 ,timeliness of notification 7#a7 ,in general ,all notifications required under this section shall be made without unreasonable delay following the discovery by the covered entity of a security breach4 7#b7 ,reasonable delay 7,a7 ,in general ,reasonable delay under this subsection may include any time necessary to determine the scope of the security breach1 prevent further disclosures1 restore the reasonable integrity of the data system1 and provide notice to law enforcement when required4 7,b7 ,extension 7i7 ,in general ,except as provided in subsection 7d71 delay of notification shall not exceed #fj days following the discovery of the security breach1 unless the covered entity requests an extension of time and the ,commission determines in writing that additional time is reasonably necessary to determine the scope of the security breach1 prevent further disclosures1 restore the reasonable integrity of the data system1 or to provide notice to the designated entity4 7ii7 ,approval of request ,if the ,commission approves the request for delay1 the covered entity may delay the period for notification for additional periods of up to #cj days4 7#c7 ,burden of production ,the covered entity1 third party1 or service provider required to provide notice under this title shall1 upon the request of the ,commission provide records or other evidence of the notifications required under this subtitle1 including to the extent applicable1 the reasons for any delay of notification4 7d7 ,method and content of notification 7#a7 ,direct notification 7,a7 ,method of direct notification ,except as provided in paragraph 7#b71 a covered entity shall be in compliance with the notification requirement under subsection 7a77#a7 if-- 7i7 the covered entity provides conspicuous and clearly identified notification-- 7,i7 in writing2 or 7,,ii7 by e-mail or other electronic means if-- 7aa7 the covered entity's primary method of communication with the individual is by e-mail or such other electronic means2 or 7bb7 the individual has consented to receive notification by e-mail or such other electronic means and such notification is provided in a manner that is consistent with the provisions permitting electronic transmission of notices under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja72 and 7ii7 the method of notification selected under clause 7i7 can reasonably be expected to reach the intended individual4 7,b7 ,content of direct notification ,each method of notification under subparagraph 7,a7 shall include the following3 7i7 ,the date1 estimated date1 or estimated date range of the breach of security4 7ii7 ,a description of the personally identifiable information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security4 7iii7 ,a telephone number that an individual can use at no cost to the individual to contact the covered entity to inquire about the breach of security or the information the covered entity maintained about that individual4 7iv7 ,notice that the individual may be entitled to consumer credit reports under subsection 7e77#a74 7v7 ,instructions how an individual can request consumer credit reports under subsection 7e77#a74 7vi7 ,a telephone number1 that an individual can use at no cost to the individual1 and an address to contact each major credit reporting agency4 7vii7 ,a telephone number1 that an individual can use at no cost to the individual1 and an ,internet website address to obtain information regarding identity theft from the ,commission4 7#b7 ,substitute notification 7,a7 ,circumstances giving rise to substitute notification ,a covered entity required to provide notification to individuals under subsection 7a77#a7 may provide notification under this paragraph instead of paragraph 7#a7 of this subsection if-- 7i7 notification under paragraph 7#a7 is not feasible due to lack of sufficient contact information for the individual required to be notified2 or 7ii7 the covered entity owns or possesses data in electronic form containing personally identifiable information of fewer than #aj1jjj individuals and direct notification is not feasible due to excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity1 as determined in accordance with the regulations issued by the ,commission under paragraph 7#c77;,a74 7,b7 ,method of substitute notification ,notification under this paragraph shall include the following3 7i7 ,conspicuous and clearly identified notification by e-mail to the extent the covered entity has an e-mail address for an individual who is entitled to notification under subsection 7a77#a74 7ii7 ,conspicuous and clearly identified notification on the ,internet website of the covered entity if the covered entity maintains an ,internet website4 7iii7 ,notification to print and to broadcast media1 including major media in metropolitan and rural areas where the individuals whose personally identifiable information was acquired or accessed reside4 7,c7 ,content of substitute notification ,each method of notification under this paragraph shall include the following3 7i7 ,the date1 estimated date1 or estimated date range of the breach of security4 7ii7 ,a description of the types of personally identifiable information that were or are reasonably believed to have been acquired or accessed as a result of the breach of security4 7iii7 ,notice that an individual may be entitled to consumer credit reports under subsection 7e77#a74 7iv7 ,instructions how an individual can request consumer credit reports under subsection 7e77#a74 7v7 ,a telephone number that an individual can use at no cost to the individual to learn whether the individual's personally identifiable information is included in the breach of security4 7vi7 ,a telephone number1 that an individual can use at no cost to the individual1 and an address to contact each major credit reporting agency4 7vii7 ,a telephone number1 that an individual can use at no cost to the individual1 and an ,internet website address to obtain information from the ,commission regarding identity theft4 7#c7 ,regulations and guidance 7,a7 ,regulations concerning substitute notification 7i7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall prescribe criteria for determining circumstances under which notification may be provided under paragraph 7#b71 including criteria for determining whether providing notification under paragraph 7#a7 is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity4 7ii7 ,other circumstances ,the regulations required by clause 7i7 may also identify other circumstances in which notification under paragraph 7#b7 would be appropriate1 including circumstances under which the cost of providing direct notification exceeds the benefits to individuals4 7,b7 ,guidance 7i7 ,in general ,the ,commission1 in consultation with the ,administrator of the ,small ,business ,administration1 shall publish and otherwise make available general guidance with respect to compliance with this subsection4 7ii7 ,contents ,the guidance required by clause 7i7 shall include the following3 7,i7 ,a description of written or e-mail notification that complies with paragraph 7#a74 7,,ii7 ,guidance on the content of notification under paragraph 7#b71 including the extent of notification to print and broadcast media that complies with subparagraph 7,b77iii7 of such paragraph4 7e7 ,other obligations following breach 7#a7 ,in general ,subject to the provisions of this subsection1 not later than #fj days after the date of a request by an individual who received notification under subsection 7a77#a7 and quarterly thereafter for #b years1 a covered entity required to provide notification under such subsection to such individual shall provide1 or arrange for the provision of1 to such individual at no cost to such individual1 consumer credit reports from at least #a major credit reporting agency4 7#b7 ,limitation ,paragraph 7#a7 shall not apply if the only personally identifiable information that is the subject of the breach of security is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code4 7#c7 ,rulemaking ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall prescribe the following3 7,a7 ,criteria for determining the circumstances under which a covered entity required to provide notification under subsection 7a77#a7 must provide or arrange for the provision of free consumer credit reports under this subsection4 7,b7 ,a simple process under which a covered entity that is a small business concern or small nonprofit organization may request a full or a partial waiver or a modified or an alternative means of complying with this subsection if providing free consumer credit reports is not feasible due to excessive costs relative to the resources of such covered entity and relative to the level of harm1 to affected individuals1 caused by the breach of security4 7#d7 ,definitions ,in this subsection3 7,a7 ,small business concern ,the term small business concern has the meaning given such term under section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7,b7 ,small nonprofit organization ,the term small nonprofit organization has the meaning the ,commission shall give such term for purposes of this subsection4 7f7 ,delay of notification authorized for national security and law enforcement purposes 7#a7 ,in general ,if the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation determines that notification under this section would impede a criminal investigation or a national security activity1 such notification shall be delayed upon written notice from the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation to the covered entity that experienced the breach of security4 ,the notification from the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation shall specify the period of delay requested for national security or law enforcement purposes4 7#b7 ,subsequent delay of notification 7,a7 ,in general ,if the notification required under subsection 7a77#a7 is delayed pursuant to paragraph 7#a71 a covered entity shall give notice not more than #cj days after the day such law enforcement or national security delay was invoked unless a ,federal law enforcement or intelligence agency provides written notification that further delay is necessary4 7,b7 ,written justification requirements 7i7 ,united ,states ,secret ,service ,if the ,united ,states ,secret ,service instructs a covered entity to delay notification under this section beyond the #cj-;day period set forth in subparagraph 7,a7 7referred to in this clause as subsequent delay71 the ,united ,states ,secret ,service shall submit written justification for the subsequent delay to the ,secretary of ,homeland ,security before the subsequent delay begins4 7ii7 ,federal ,bureau of ,investigation ,if the ,federal ,bureau of ,investigation instructs a covered entity to delay notification under this section beyond the #cj-;day period set forth in subparagraph 7,a7 7referred to in this clause as subsequent delay71 the ,federal ,bureau of ,investigation shall submit written justification for the subsequent delay to the ,attorney ,general before the subsequent delay begins4 7#c7 ,law enforcement immunity ,no cause of action shall lie in any court against any ,federal agency for acts relating to the delay of notification for national security or law enforcement purposes under this subtitle4 7g7 ,general exemption 7#a7 ,in general ,a covered entity shall be exempt from the requirements under this section if1 following a breach of security1 the covered entity reasonably concludes that there is no reasonable risk of identity theft1 fraud1 or other unlawful conduct4 7#b7 ,,ftc guidance ,not later than #a year after the date of the enactment of this ,act1 the ,commission1 after consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall issue guidance regarding the application of the exemption under paragraph 7#a74 7h7 ,exemptions for national security and law enforcement purposes 7#a7 ,in general ,a covered entity shall be exempt from the notice requirements under this section if-- 7,a7 a determination is made-- 7i7 by the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation that notification of the breach of security could be reasonably expected to reveal sensitive sources and methods or similarly impede the ability of the ,government to conduct law enforcement or intelligence investigations2 or 7ii7 by the ,federal ,bureau of ,investigation that notification of the breach of security could be reasonably expected to cause damage to the national security2 and 7,b7 the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation1 as the case may be1 provides written notice of its determination under subparagraph 7,a7 to the covered entity4 7#b7 ,united ,states ,secret ,service ,if the ,united ,states ,secret ,service invokes an exemption under paragraph 7#a71 the ,united ,states ,secret ,service shall submit written justification for invoking the exemption to the ,secretary of ,homeland ,security before the exemption is invoked4 7#c7 ,federal ,bureau of ,investigation ,if the ,federal ,bureau of ,investigation invokes an exemption under paragraph 7#a71 the ,federal ,bureau of ,investigation shall submit written justification for invoking the exemption to the ,attorney ,general before the exemption is invoked4 7#d7 ,immunity ,no cause of action shall lie in any court against any ,federal agency for acts relating to the exemption from notification for national security or law enforcement purposes under this subtitle4 7#e7 ,reports ,not later than #edj days after the date of the enactment of this ,act1 and upon request by ,congress thereafter1 the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation shall submit to ,congress a report on the number and nature of breaches of security subject to the exemptions for national security and law enforcement purposes under this subsection4 7i7 ,financial fraud prevention exemption 7#a7 ,in general ,a covered entity shall be exempt from the notice requirements under this section if the covered entity utilizes or participates in a security program that-- 7,a7 effectively blocks the use of the personally identifiable information to initiate an unauthorized financial transaction before it is charged to the account of the individual2 and 7,b7 provides notice to each affected individual after a breach of security that resulted in attempted fraud or an attempted unauthorized transaction4 7#b7 ,limitations ,an exemption under paragraph 7#a7 shall not apply if-- 7,a7 the breach of security includes personally identifiable information1 other than a credit card number or credit card security code1 of any type2 or 7,b7 the breach of security includes both the individual's credit card number and the individual's first and last name4 7j7 ,financial institutions regulated by ,federal functional regulators 7#a7 ,in general ,a covered financial institution shall be deemed in compliance with this section if-- 7,a7 the ,federal functional regulator with jurisdiction over the covered financial institution has issued a standard by regulation or guideline under title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 that-- 7i7 requires financial institutions within its jurisdiction to provide notification to individuals following a breach of security2 and 7ii7 provides protections substantially similar to1 or greater than1 those required under this ,act2 and 7,b7 the covered financial institution is in compliance with the standard under subparagraph 7,a74 7#b7 ,definitions ,in this subsection3 7,a7 ,covered financial institution ,the term covered financial institution means a financial institution that is subject to-- 7i7 the data security requirements of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq472 7ii7 any implementing standard issued by regulation or guideline issued under that ,act2 and 7iii7 the jurisdiction of a ,federal functional regulator under that ,act4 7,b7 ,federal functional regulator ,the term ,federal functional regulator has the meaning given the term in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji74 7,c7 ,financial institution ,the term financial institution has the meaning given the term in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji74 7k7 ,exemption2 health privacy 7#a7 ,covered entity or business associate under ,,hitech ,act ,to the extent that a covered entity under this section acts as a covered entity or a business associate under section #acdjb of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicb71 has the obligation to provide notification to individuals following a breach of security under that ,act or its implementing regulations1 and is in compliance with that obligation1 the covered entity shall be deemed in compliance with this section4 7#b7 ,entity subject to ,,hitech ,act ,to the extent that a covered entity under this section acts as a vendor of personal health records1 a third party service provider1 or other entity subject to section #acdjg of the ,health ,information ,technology for ,economical and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg71 has the obligation to provide notification to individuals following a breach of security under that ,act or its implementing regulations1 and is in compliance with that obligation1 the covered entity shall be deemed in compliance with this section4 7#c7 ,limitation of statutory construction ,nothing in this subtitle may be construed in any way to give effect to the sunset provision under section #acdjg7;g77#b7 of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg7;g77#b77 or to otherwise limit or affect the applicability1 under section #acdjg of that ,act1 of the requirement to provide notification to individuals following a breach of security for vendors of personal health records and each entity described in clause 7ii71 7iii71 or 7iv7 of section #acdbd7;b77#a77;,a7 of that ,act 7#db ,u4,s4,c4 #agiec7;b77#a77;,a774 7l7 ,internet website notice of ,federal ,trade ,commission ,if the ,commission1 upon receiving notification of any breach of security that is reported to the ,commission1 finds that notification of the breach of security via the ,commission's ,internet website would be in the public interest or for the protection of consumers1 the ,commission shall place such a notice in a clear and conspicuous location on its ,internet website4 7m7 ,,ftc study on notification in languages in addition to ,english ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall conduct a study on the feasibility and advisability of requiring notification provided pursuant to subsection 7d77#a7 to be provided in a language in addition to ,english to individuals known to speak only such other language4 #adc4 ,notice to law enforcement 7a7 ,designation of ,government entity ,to receive notice ,not later than #fj days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security shall designate a ,federal ,government entity to receive notice under this section4 7b7 ,notice to designated entity ,a covered entity shall notify the designated entity of a breach of security if-- 7#a7 the number of individuals whose personally identifiable information was1 or is reasonably believed to have been1 acquired or accessed as a result of the breach of security exceeds #aj1jjj2 7#b7 the breach of security involves a database1 networked or integrated databases1 or other data system containing the personally identifiable information of more than #a1jjj1jjj individuals2 7#c7 the breach of security involves databases owned by the ,federal ,government2 or 7#d7 the breach of security involves primarily personally identifiable information of individuals known to the covered entity to be employees or contractors of the ,federal ,government involved in national security or law enforcement4 7c7 ,content of notices 7#a7 ,in general ,each notice under subsection 7b7 shall contain the following3 7,a7 ,the date1 estimated date1 or estimated date range of the breach of security4 7,b7 ,a description of the nature of the breach of security4 7,c7 ,a description of each type of personally identifiable information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security4 7,d7 ,a statement of each paragraph under subsection 7b7 that applies to the breach of security4 7#b7 ,construction ,nothing in this section shall be construed to require a covered entity to reveal specific or identifying information about an individual as part of the notice under paragraph 7#a74 7d7 ,notice by designated entity ,the designated entity shall promptly provide each notice it receives under subsection 7b7 to the following3 7#a7 ,the ,united ,states ,secret ,service4 7#b7 ,the ,federal ,bureau of ,investigation4 7#c7 ,the ,commission4 7#d7 ,the ,united ,states ,postal ,inspection ,service1 if the breach of security involves mail fraud4 7#e7 ,the attorney general of each ,state affected by the breach of security4 7#f7 ,such other ,federal agencies as the designated entity considers appropriate for law enforcement1 national security1 or data security purposes4 7e7 ,timing of notices ,notice under this section shall be delivered as follows3 7#a7 ,notice under subsection 7b7 shall be delivered as promptly as possible1 but-- 7,a7 not less than #c business days before notification to an individual under section #adb7;a77#a72 and 7,b7 not later than #aj days after the date of discovery of the events requiring notice4 7#b7 ,notice under subsection 7d7 shall be delivered as promptly as possible1 but not later than #a business day after the date that the designated entity receives notice of a breach of security from a covered entity4 ,e ,enforcement #aea4 ,general application ,the requirements of this title shall apply to any person who-- 7#a7 collects1 uses1 transfers1 or stores covered information concerning more than #e1jjj individuals during any consecutive #ab-month period2 and 7#b7 is-- 7,a7 a person over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 7,b7 a common carrier subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq471 notwithstanding the definition of the term ,acts to regulate commerce in section #d of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd7 and the exception provided by section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 for such carriers2 or 7,c7 a nonprofit organization1 including any organization described in section #eja7;c7 of the ,internal ,revenue ,code of #aihf that is exempt from taxation under section #eja7;a7 of such ,code1 notwithstanding the definition of the term ,acts to regulate commerce in section #d of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd7 and the exception provided by section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 for such organizations4 #aeb4 ,enforcement by the ,federal ,trade ,commission 7a7 ,unfair or deceptive acts or practices ,a reckless or repetitive violation of a provision of this title1 except section #adc1 shall be treated as an unfair or deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7b7 ,powers of commission 7#a7 ,in general ,except as provided in paragraph 7#c71 the ,commission shall enforce this title1 except section #adc1 in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this title4 7#b7 ,privileges and immunities ,except as provided in paragraph 7#c71 any person who violates a provision of this title1 except section #adc1 shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,common carriers and nonprofit organizations ,the ,commission shall enforce this title1 except section #adc1 with respect to common carriers and nonprofit organizations described in section #aea to the extent necessary to effectuate the purposes of this title as if such carriers and nonprofit organizations were persons over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b774 7c7 ,rulemaking authority 7#a7 ,limitation ,in promulgating rules under this title1 the ,commission may not require the deployment or use of any specific products or technologies1 including any specific computer software or hardware4 7#b7 ,administrative procedure ,the ,commission shall promulgate regulations under this title in accordance with section #eec of title #e1 ,united ,states ,code4 7d7 ,rule of construction ,nothing in this title shall be construed to limit the authority of the ,commission under any other provision of law4 #aec4 ,enforcement by ,attorney ,general 7a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any covered entity that engages in conduct constituting a violation of section #adc4 7b7 ,penalties 7#a7 ,in general ,upon proof of such conduct by a preponderance of the evidence1 a covered entity shall be subject to a civil penalty of not more than #a1jjj per individual whose personally identifiable information was or is reasonably believed to have been accessed or acquired as a result of the breach of security that is the basis of the violation1 up to a maximum of #ajj1jjj per day while such violation persists4 7#b7 ,limitations ,the total amount of the civil penalty assessed under this subsection against a covered entity for acts or omissions relating to a single breach of security shall not exceed #c1jjj1jjj1 unless the conduct constituting a violation of subtitle ,d was reckless or repeated1 in which case an additional civil penalty of up to #c1jjj1jjj may be imposed4 7#c7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of the enactment of this ,act1 and each year thereafter1 the amounts specified in paragraphs 7#a7 and 7#b7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7c7 ,injunctive actions ,if it appears that a covered entity has engaged1 or is engaged1 in any act or practice that constitutes a violation of subtitle ,d1 the ,attorney ,general may petition an appropriate ,united ,states district court for an order enjoining such practice or enforcing compliance with such subtitle4 7d7 ,issuance of order ,a court may issue such an order under paragraph 7c7 if it finds that the conduct in question constitutes a violation of subtitle ,d4 #aed4 ,enforcement by ,states 7a7 ,civil action ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is adversely affected by a covered entity who violates any part of this title in a manner that results in economic or physical harm to an individual or engages in a pattern or practice that violates any part of this title other than section #adc1 the attorney general may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states-- 7#a7 to enjoin further violation of this title or a regulation promulgated under this title by the defendant2 7#b7 to compel compliance with this title or a regulation promulgated under this title2 or 7#c7 for violations of this title or a regulation promulgated under this title to obtain civil penalties in the amount determined under section title4 7b7 ,rights of ,federal ,trade ,commission 7#a7 ,notice to ,federal ,trade ,commission 7,a7 ,in general ,except as provided in subparagraph 7,c71 the attorney general of a ,state shall notify the ,commission in writing of any civil action under subsection 7b71 prior to initiating such civil action4 7,b7 ,contents ,the notice required by subparagraph 7,a7 shall include a copy of the complaint to be filed to initiate such civil action4 7,c7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notice required by subparagraph 7,a71 the ,state shall provide notice immediately upon instituting a civil action under subsection 7b74 7#b7 ,intervention by ,federal ,trade ,commission ,upon receiving notice required by paragraph 7#a7 with respect to a civil action1 the ,commission may-- 7,a7 intervene in such action2 and 7,b7 upon intervening-- 7i7 be heard on all matters arising in such civil action2 and 7ii7 file petitions for appeal of a decision in such action4 7c7 ,preemptive action by ,federal ,trade ,commission ,if the ,commission institutes a civil action for violation of this title or a regulation promulgated under this title1 no attorney general of a ,state may bring a civil action under subsection 7a7 against any defendant named in the complaint of the ,commission for violation of this title or a regulation promulgated under this title that is alleged in such complaint4 7d7 ,investigatory powers ,nothing in this section may be construed to prevent the attorney general of a ,state from exercising the powers conferred on such attorney general by the laws of such ,state to conduct investigations or to administer oaths or affirmations or to compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,venue2 service of process 7#a7 ,venue ,any action brought under subsection 7a7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 7f7 ,actions by other ,state officials 7#a7 ,in general ,in addition to civil actions brought by attorneys general under subsection 7a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under subsection 7a71 subject to the same requirements and limitations that apply under this section to civil actions brought by attorneys general4 7#b7 ,savings provision ,nothing in this section may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #aee4 ,civil penalties 7a7 ,in general ,in an action brought under section #aed1 in addition to any other penalty otherwise applicable to a violation of this title or any regulation promulgated under this title1 the following civil penalties shall apply3 7#a7 ,subtitle ,a violations ,a covered entity that recklessly or repeatedly violates subtitle ,a is liable for a civil penalty equal to the amount calculated by multiplying the number of days that the entity is not in compliance with such subtitle by an amount not to exceed #cc1jjj4 7#b7 ,subtitle ,b violations ,a covered entity that recklessly or repeatedly violates subtitle ,b is liable for a civil penalty equal to the amount calculated by multiplying the number of days that such an entity is not in compliance with such subtitle1 or the number of individuals for whom the entity failed to obtain consent as required by such subtitle1 whichever is greater1 by an amount not to exceed #cc1jjj4 7#c7 ,subtitle ,d violations ,a covered entity that recklessly or repeatedly violates section #adb is liable for a civil penalty equal to the amount calculated by multiplying the number of violations of such section by an amount not to exceed #cc1jjj4 ,each failure to send notification as required under such section to a resident of the ,state shall be treated as a separate violation4 7b7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index for ,all ,urban ,consumers is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of the enactment of this ,act1 and each year thereafter1 each of the amounts specified in subsection 7a7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7c7 ,maximum total liability ,notwithstanding the number of actions which may be brought against a covered entity under section #aed1 the maximum civil penalty for which any covered entity may be liable under this section in such actions shall not exceed-- 7#a7 #f1jjj1jjj for any related series of violations of any rule promulgated under subtitle ,a2 7#b7 #f1jjj1jjj for any related series of violations of subtitle ,b2 and 7#c7 #f1jjj1jjj for any related series of violations of section #adb4 #aef4 ,effect on other laws 7a7 ,preemption of ,state laws ,the provisions of this title shall supersede any provisions of the law of any ,state relating to those entities covered by the regulations issued pursuant to this title1 to the extent that such provisions relate to the collection1 use1 or disclosure of-- 7#a7 covered information addressed in this title2 or 7#b7 personally identifiable information or personal identification information addressed in provisions of the law of a ,state4 7b7 ,unauthorized civil actions2 certain ,state laws 7#a7 ,unauthorized actions ,no person other than a person specified in section #aed may bring a civil action under the laws of any ,state if such action is premised in whole or in part upon the defendant violating this title or a regulation promulgated under this title4 7#b7 ,protection of certain state laws ,this title shall not be construed to preempt the applicability of-- 7,a7 ,state laws that address the collection1 use1 or disclosure of health information or financial information2 or 7,b7 other ,state laws to the extent that those laws relate to acts of fraud4 7c7 ,rule of construction relating to required disclosures to government entities ,this title shall not be construed to expand or limit the duty or authority of a covered entity or third party to disclose personally identifiable information to a government entity under any provision of law4 #aeg4 ,no private right of action ,this title may not be construed to provide any private right of action4 ,f ,co-,regulatory safe harbor programs #afa4 ,establishment of safe harbor programs 7a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall initiate a rulemaking proceeding to establish requirements for the establishment and administration of safe harbor programs under which a nongovernmental organization will administer a program that-- 7#a7 establishes a mechanism for participants to implement the requirements of this title with regards to-- 7,a7 certain types of unauthorized uses of covered information as described in paragraph 7#b72 or 7,b7 any unauthorized use of covered information2 and 7#b7 offers consumers a clear1 conspicuous1 persistent1 and effective means of opting out of the transfer of covered information by a covered entity participating in the safe harbor program to a third party for-- 7,a7 behavioral advertising purposes2 7,b7 location-based advertising purposes2 7,c7 other specific types of unauthorized use2 or 7,d7 any unauthorized use4 7b7 ,selection of nongovernmental organizations ,to administer program 7#a7 ,submittal of applications ,an applicant seeking to administer a program under the requirements established pursuant to subsection 7a7 shall submit to the ,commission an application therefor at such time1 in such manner1 and containing such information as the ,commission may require4 7#b7 ,notice and receipt of applications ,upon completion of the rulemaking proceedings required by subsection 7a71 the ,commission shall-- 7,a7 publish a notice in the ,federal ,register that it will receive applications for approval of safe harbor programs under this subtitle2 and 7,b7 begin receiving applications under paragraph 7#a74 7#c7 ,selection ,not later than #bgj days after the date on which the ,commission receives a completed application under this subsection1 the ,commission shall grant or deny the application on the basis of the ,commission's evaluation of the applicant's capacity to provide protection of individuals' covered information with regard to specific types of unauthorized uses of covered information as described in subsection 7a77#b7 that is substantially equivalent to or superior to the protection otherwise provided under this title4 7#d7 ,written findings ,any decision reached by the ,commission under this subsection shall be accompanied by written findings setting forth the basis for and reasons supporting such decision4 7c7 ,scope of safe harbor protection ,the scope of protection offered by safe harbor programs approved by the ,commission that establish mechanisms for participants to implement the requirements of the title only for certain uses of covered information as described in subsection 7a77#b7 shall be limited to participating entities' use of those particular types of covered information4 7d7 ,supervision by ,federal ,trade ,commission 7#a7 ,in general ,the ,commission shall exercise oversight and supervisory authority of a safe harbor program approved under this section through-- 7,a7 ongoing review of the practices of the nongovernmental organization administering the program2 7,b7 the imposition of civil penalties on the nongovernmental organization if it is not compliant with the requirements established under subsection 7a72 and 7,c7 withdrawal of authorization to administer the safe harbor program under this subtitle4 7#b7 ,annual reports by nongovernmental organizations ,each year1 each nongovernmental organization administering a safe harbor program under this section shall submit to the ,commission a report on its activities under this subtitle during the preceding year4 #afb4 ,participation in safe harbor program 7a7 ,exemption ,any covered entity that participates in1 and demonstrates compliance with1 a safe harbor program administered under section #afa shall be exempt from any provision of subtitle ,b or subtitle ,c if the ,commission finds that the requirements of the safe harbor program are substantially the same as or more protective of privacy of individuals than the requirements of the provision from which the exemption is granted4 7b7 ,limitation ,nothing in this subtitle shall be construed to exempt any covered entity participating in a safe harbor program from compliance with any other requirement of the regulations promulgated under this title for which the safe harbor does not provide an exception4 ,g ,application with other ,federal laws #aga4 ,application with other ,federal laws 7a7 ,qualified exemption for persons subject to other ,federal privacy laws ,if a person is subject to a provision of this title and a provision of a ,federal privacy law described in subsection 7d71 such provision of this title shall not apply to such person to the extent that such provision of ,federal privacy law applies to such person4 7b7 ,protection of other ,federal privacy laws ,nothing in this title may be construed to modify1 limit1 or supersede the operation of the ,federal privacy laws described in subsection 7d7 or the provision of information permitted or required1 expressly or by implication1 by such laws1 with respect to ,federal rights and practices4 7c7 ,communications infrastructure and privacy ,if a person is subject to a provision of section #bbb or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb and #eea7 and a provision of this title1 such provision of such section #bbb or #fca shall not apply to such person to the extent that such provision of this title applies to such person4 7d7 ,other ,federal privacy laws described ,the ,federal privacy laws described in this subsection are as follows3 7#a7 ,section #eeb;a of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd74 7#b7 ,the ,right to ,financial ,privacy ,act of #aigh 7#ab ,u4,s4,c4 #cdja et seq474 7#c7 ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq474 7#d7 ,the ,fair ,debt ,collection ,practices ,act 7#ae ,u4,s4,c4 #afib et seq474 7#e7 ,the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq474 7#f7 ,title ,v of the ,gramm-,leach-,bliley ,act of #aiii 7#ae ,u4,s4,c4 #fhja et seq474 7#g7 ,chapters #aai1 #abc1 and #bjf of title #ah1 ,united ,states ,code4 7#h7 ,section #bgaj of title #ah1 ,united ,states ,code4 7#i7 ,section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd74 7#aj7 ,section #dde of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;h74 7#aa7 ,the ,privacy ,protection ,act of #aihj 7#db ,u4,s4,c4 #bjjj;aa et seq474 7#ab7 ,the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 as such regulations relate to a person described in section #aagb7;a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#a7;a77 or to transactions referred to in section #aagc7;a77#a7 of such ,act 7#db ,u4,s4,c4 #acbj;d-#b7;a77#a774 7#ac7 ,the ,communications ,assistance for ,law ,enforcement ,act 7#dg ,u4,s4,c4 #ajja et seq474 7#ad7 ,section #bbg of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbg74 ,h ,development of commercial data privacy policy in the ,department of ,commerce #aha4 ,direction to develop commercial data privacy policy ,the ,secretary of ,commerce shall contribute to the development of commercial data privacy policy by-- 7#a7 convening private sector stakeholders1 including members of industry1 civil society groups1 academia1 in open forums1 to develop codes of conduct in support of applications for safe harbor programs under subtitle ,f2 7#b7 expanding interoperability between the ,united ,states commercial data privacy framework and other national and regional privacy frameworks2 7#c7 conducting research related to improving privacy protection under this title2 and 7#d7 conducting research related to improving data sharing practices1 including the use of anonymised data1 and growing the information economy4 ,,ii ,online privacy of children #bja4 ,short title ,this title may be cited as the ,do ,not ,track ,kids ,act of #bjad4 #bjb4 ,findings ,congress finds the following3 7#a7 ,since the enactment of the ,children's ,online ,privacy ,protection ,act of #aiih1 the ,world ,wide ,web has changed dramatically1 with the creation of tens of millions of websites1 the proliferation of entirely new media platforms1 and the emergence of a diverse ecosystem of services1 devices1 and applications that enable users to connect wirelessly within an online environment without being tethered to a desktop computer4 7#b7 ,the explosive growth of the ,internet ecosystem has unleashed a wide array of opportunities to learn1 communicate1 participate in civic life1 access entertainment1 and engage in commerce4 7#c7 ,in addition to these significant benefits1 the ,internet also presents challenges1 particularly with respect to the efforts of entities to track the online activities of children and minors and to collect1 use1 and disclose personal information about them1 including their geolocation1 for commercial purposes4 7#d7 ,children and teens are visiting numerous companies' websites1 and marketers are using multimedia games1 online quizzes1 and mobile phone and tablet applications to create ties to children and teens4 7#e7 ,according to a study by the ,wall ,street ,journal in #bjaj1 websites directed to children and teens were more likely to use cookies and other tracking tools than sites directed to a general audience4 7#f7 ,this study examined #ej popular websites for children and teens in the ,united ,states and found that these #ej sites placed #d1abc cookies1 beacons1 and other tracking tools on the test computer used for the study4 7#g7 ,this is #cj percent greater than the number of such tracking tools that were placed on the test computer in a similar study of the #ej overall most popular websites in the ,united ,states1 which are generally directed to adults4 7#h7 ,children and teens lack the cognitive ability to distinguish advertising from program content and to understand that the purpose of advertising is to persuade them1 making them unable to activate the defenses on which adults rely4 7#i7 ,children and teens are less able than adults to understand the potential long-term consequences of having their information available to third parties1 including advertisers1 and other individuals4 7#aj7 ,according to ,common ,sense ,media and the ,center for ,digital ,democracy1 #ij percent of teens have used some form of social media1 #ge percent have a social networking site1 and #ea percent check their social networking site at least once a day4 7#aa7 ,ninety-one percent of parents and #ia percent of adults believe it is not okay for advertisers to collect information about a child's location from that child's mobile phone4 7#ab7 ,ninety-four percent of parents and #ia percent of adults agree that advertisers should receive the parent's permission before putting tracking software on a child's computer4 7#ac7 ,ninety-six percent of parents and #id percent of adults expressed disapproval when asked if it is okay for a website to ask children for personal information about their friends4 7#ad7 ,eighty-eight percent of parents would support a law that requires search engines and social networking sites to get users' permission before using their personal information4 7#ae7 ,a ,commonsense ,media_/,zogby poll found that #id percent of parents and #id percent of adults believe individuals should have the ability to request the deletion1 after a specific period of time1 of all of their personal information held by an online search engine1 social networking site1 or marketing company4 7#af7 ,according to a ,pew_/,berkman ,center poll1 #fi percent of parents of teens who engage in online activity are concerned about how that activity might affect their children's future academic or employment opportunities4 7#ag7 ,eighty-one percent of parents of teens who engage in online activity say they are concerned about how much information advertisers can learn about their children's online activity4 #bjc4 ,definitions 7a7 ,in general ,in this title3 7#a7 ,minor ,the term minor means an individual over the age of #ab and under the age of #af4 7#b7 ,targeted marketing ,the term targeted marketing means advertising or other efforts to market a product or service that are directed to a specific individual or device-- 7,a7 based on the personal information of the individual or a unique identifier of the device2 and 7,b7 as a result of use by the individual1 or access by the device1 of a website1 online service1 online application1 or mobile application4 7b7 ,terms defined by ,commission ,in this title1 the terms directed to minors and geolocation information shall have the meanings given such terms by the ,commission by regulation4 ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations that define such terms broadly enough so that they are not limited to current technology1 consistent with the principles articulated by the ,commission regarding the definition of the term ,internet in its statement of basis and purpose on the final rule under the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq47 promulgated on ,november #c1 #aiii 7#fd ,fed4 ,reg4 #eihia74 7c7 ,other definitions ,the definitions set forth in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja71 as amended by section #c7;a71 shall apply in this title1 except to the extent the ,commission provides otherwise by regulations issued under section #eec of title #e1 ,united ,states ,code4 #bjd4 ,online collection1 use1 and disclosure of personal information of children 7a7 ,definitions ,section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 is amended-- 7#a7 by amending paragraph 7#b7 to read as follows3 7#b7 ,operator ,the term operator-- 7,a7 means any person who1 for commercial purposes1 in interstate or foreign commerce1 operates or provides a website on the ,internet1 online service1 online application1 or mobile application1 and who-- 7i7 collects or maintains1 either directly or through a service provider1 personal information from or about the users of such website1 service1 or application2 7ii7 allows another person to collect personal information directly from users of such website1 service1 or application 7in which case the operator is deemed to have collected the information72 or 7iii7 allows users of such website1 service1 or application to publicly disclose personal information 7in which case the operator is deemed to have collected the information72 and 7,b7 does not include any nonprofit entity that would otherwise be exempt from coverage under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 2 7#b7 in paragraph 7#d7-- 7,a7 by amending subparagraph 7,a7 to read as follows3 7,a7 the release of personal information for any purpose1 except where such information is provided to a person other than an operator who provides support for the internal operations of the website1 online service1 online application1 or mobile application of the operator and does not disclose or use that information for any other purpose2 and 2 and 7,b7 in subparagraph 7,b71 by striking website or online service and inserting website1 online service1 online application1 or mobile application2 7#c7 in paragraph 7#h7-- 7,a7 by amending subparagraph 7,g7 to read as follows3 7,g7 information concerning a child or the parents of that child 7including any unique or substantially unique identifier1 such as a customer number7 that an operator collects online from the child and combines with an identifier described in subparagraphs 7,a7 through 7,g74 2 7,b7 by redesignating subparagraphs 7,f7 and 7,g7 as subparagraphs 7,g7 and 7,h71 respectively2 and 7,c7 by inserting after subparagraph 7,e7 the following new subparagraph3 7,f7 information 7including an ,internet protocol address7 that permits the identification of an individual1 the computer of an individual1 or any other device used by an individual to access the ,internet or an online service1 online application1 or mobile application2 2 7#d7 by striking paragraph 7#aj7 and redesignating paragraphs 7#aa7 and 7#ab7 as paragraphs 7#aj7 and 7#aa71 respectively2 and 7#e7 by adding at the end the following new paragraph3 7#ab7 ,online1 online service1 online application1 mobile application1 directed to children ,the terms online1 online service1 online application1 mobile application1 and directed to children shall have the meanings given such terms by the ,commission by regulation4 ,not later than #a year after the date of the enactment of the ,commercial ,privacy ,bill of ,rights ,act of #bjad1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations that define such terms broadly enough so that they are not limited to current technology1 consistent with the principles articulated by the ,commission regarding the definition of the term ,internet in its statement of basis and purpose on the final rule under this title promulgated on ,november #c1 #aiii 7#fd ,fed4 ,reg4 #eihia74 ,the definition of the term online service in such regulations shall include broadband ,internet access service 7as defined in the ,report and ,order of the ,federal ,communications ,commission relating to the matter of preserving the open ,internet and broadband industry practices 7,,fcc #aj-bja1 adopted by the ,commission on ,december #ba1 #bjaj774 4 7b7 ,online collection1 use1 and disclosure of personal information of children ,section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejb7 is amended-- 7#a7 by striking the heading and inserting the following3 ,online collection1 use1 and disclosure of personal information of children42 7#b7 in subsection 7a7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,in general ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to children1 or an operator having actual knowledge that personal information being collected is from a child1 to collect personal information from a child in a manner that violates the regulations prescribed under subsection 7b74 2 and 7,b7 in paragraph 7#b7-- 7i7 by striking of such a website or online service2 and 7ii7 by striking subsection 7b77#a77;,b77iii7 and inserting subsection 7b77#a77;,c77iii72 and 7#c7 in subsection 7b7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,in general ,not later than #a year after the date of the enactment of the ,commercial ,privacy ,bill of ,rights ,act of #bjad1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to require an operator of a website1 online service1 online application1 or mobile application directed to children1 or an operator having actual knowledge that personal information being collected is from a child-- 7,a7 to provide clear and conspicuous notice in clear and plain language of the types of personal information the operator collects1 how the operator uses such information1 whether the operator discloses such information1 and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children except in accordance with the regulations promulgated under this paragraph2 7,b7 to obtain verifiable parental consent for the collection1 use1 or disclosure of personal information of a child2 7,c7 to provide to a parent whose child has provided personal information to the operator1 upon request by and proper identification of the parent-- 7i7 a description of the specific types of personal information collected from the child by the operator2 7ii7 the opportunity at any time to refuse to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of personal information collected from the child2 and 7iii7 a means that is reasonable under the circumstances for the parent to obtain any personal information collected from the child1 if such information is available to the operator at the time the parent makes the request2 7,d7 not to condition participation in a game1 or use of a website1 service1 or application1 by a child on the provision by the child of more personal information than is reasonably required to participate in the game or use the website1 service1 or application2 and 7,e7 to establish and maintain reasonable procedures to protect the confidentiality1 security1 and integrity of personal information collected from children4 2 7,b7 in paragraph 7#b7-- 7i7 in the matter preceding subparagraph 7,a71 by striking paragraph 7#a77;,a77ii7 and inserting paragraph 7#a77;,b72 and 7ii7 in subparagraph 7,a71 by inserting or to contact a different child after to recontact the child2 7,c7 by amending paragraph 7#c7 to read as follows3 7#c7 ,continuation of service ,the regulations shall prohibit an operator from discontinuing service provided to a child on the basis of refusal by the parent of the child1 under the regulations prescribed under paragraph 7#a77;,c77ii71 to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of personal information collected from the child1 to the extent that the operator is capable of providing such service without such information4 2 and 7,d7 by adding at the end the following3 7#d7 ,rule for treatment of users of websites1 services1 and applications directed to children ,an operator of a website1 online service1 online application1 or mobile application that is directed to children shall treat all users of such website1 service1 or application as children for purposes of this title1 except as permitted by the ,commission by a regulation promulgated under this title4 4 7c7 ,administration and applicability of ,act ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking 1 in the case of and all that follows and inserting the following3 by the appropriate ,federal banking agency with respect to any insured depository institution 7as such terms are defined in section #c of such ,act 7#ab ,u4,s4,c4 #ahac7722 and 7,b7 by striking paragraph 7#b7 and redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#b7 through 7#e71 respectively2 and 7#b7 by adding at the end the following new subsection3 7f7 ,telecommunications carriers and cable operators 7#a7 ,enforcement by ,,ftc ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this title shall be enforced by the ,commission with respect to any telecommunications carrier 7as defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec774 7#b7 ,relationship to other law ,to the extent that sections #bbb1 #cch7;i71 and #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea7 are inconsistent with this title1 this title controls4 4 #bje4 ,targeted marketing to children or minors 7a7 ,acts prohibited ,it is unlawful for-- 7#a7 an operator of a website1 online service1 online application1 or mobile application directed to children1 or an operator having actual knowledge that personal information being collected is from a child1 to use1 disclose to third parties1 or compile personal information for targeted marketing purposes without verifiable parental consent2 or 7#b7 an operator of a website1 online service1 online application1 or mobile application directed to minors1 or an operator having actual knowledge that personal information being collected is from a minor1 to use1 disclose to third parties1 or compile personal information for targeted marketing purposes without the consent of the minor4 7b7 ,regulations ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section4 #bjf4 ,digital ,marketing ,bill of ,rights for ,teens and ,fair ,information ,practices ,principles 7a7 ,acts prohibited ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to minors1 or an operator having actual knowledge that personal information being collected is from a minor1 to collect personal information from a minor unless such operator has adopted and complies with a ,digital ,marketing ,bill of ,rights for ,teens that is consistent with the ,fair ,information ,practices ,principles described in subsection 7b74 7b7 ,fair ,information ,practices ,principles ,the ,fair ,information ,practices ,principles described in this subsection are the following3 7#a7 ,collection limitation principle ,except as provided in paragraph 7#c71 personal information should be collected from a minor only when collection of the personal information is-- 7,a7 consistent with the context of a particular transaction or service or the relationship of the minor with the operator1 including collection necessary to fulfill a transaction or provide a service requested by the minor2 or 7,b7 required or specifically authorized by law4 7#b7 ,data quality principle ,the personal information of a minor should be accurate1 complete1 and kept up-to-date to the extent necessary to fulfill the purposes described in subparagraphs 7,a7 through 7,d7 of paragraph 7#c74 7#c7 ,purpose specification principle ,the purposes for which personal information is collected should be specified to the minor not later than at the time of the collection of the information4 ,the subsequent use or disclosure of the information should be limited to-- 7,a7 fulfillment of the transaction or service requested by the minor2 7,b7 support for the internal operations of the website1 service1 or application1 as described in section #cab4b of title #af1 ,code of ,federal ,regulations2 7,c7 compliance with legal process or other purposes expressly authorized under specific legal authority2 or 7,d7 other purposes-- 7i7 that are specified in a notice to the minor2 and 7ii7 to which the minor has consented under paragraph 7#g7 before the information is used or disclosed for such other purposes4 7#d7 ,retention limitation principle ,the personal information of a minor should not be retained for longer than is necessary to fulfill a transaction or provide a service requested by the minor or such other purposes specified in subparagraphs 7,a7 through 7,d7 of paragraph 7#c74 ,the operator should implement a reasonable and appropriate data disposal policy based on the nature and sensitivity of such personal information4 7#e7 ,security safeguards principle ,the personal information of a minor should be protected by reasonable and appropriate security safeguards against risks such as loss or unauthorized access1 destruction1 use1 modification1 or disclosure4 7#f7 ,openness principle 7,a7 ,in general ,the operator should maintain a general policy of openness about developments1 practices1 and policies with respect to the personal information of a minor4 ,the operator should provide each minor using the website1 online service1 online application1 or mobile application of the operator with a clear and prominent means-- 7i7 to identify and contact the operator1 by1 at a minimum1 disclosing1 clearly and prominently1 the identity of the operator and-- 7,i7 in the case of an operator who is an individual1 the address of the principal residence of the operator and an e-mail address and telephone number for the operator2 or 7,,ii7 in the case of any other operator1 the address of the principal place of business of the operator and an e-mail address and telephone number for the operator2 7ii7 to determine whether the operator possesses any personal information of the minor1 the nature of any such information1 and the purposes for which the information was collected and is being retained2 7iii7 to obtain any personal information of the minor that is in the possession of the operator from the operator1 or from a person specified by the operator1 within a reasonable time after making a request1 at a charge 7if any7 that is not excessive1 in a reasonable manner1 and in a form that is readily intelligible to the minor2 7iv7 to challenge the accuracy of personal information of the minor that is in the possession of the operator2 and 7v7 if the minor establishes the inaccuracy of personal information in a challenge under clause 7iv71 to have such information erased1 corrected1 completed1 or otherwise amended4 7,b7 ,limitation ,nothing in this paragraph shall be construed to permit an operator to erase or otherwise modify personal information requested by a law enforcement agency pursuant to legal authority4 7#g7 ,individual participation principle ,the operator should-- 7,a7 obtain consent from a minor before using or disclosing the personal information of the minor for any purpose other than the purposes described in subparagraphs 7,a7 through 7,c7 of paragraph 7#c72 and 7,b7 obtain affirmative express consent from a minor before using or disclosing previously collected personal information of the minor for purposes that constitute a material change in practice from the original purposes specified to the minor under paragraph 7#c74 7c7 ,regulations ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section1 including regulations further defining the ,fair ,information ,practices ,principles described in subsection 7b74 #bjg4 ,online collection of geolocation information of children and minors 7a7 ,acts prohibited 7#a7 ,in general ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to children or minors1 or an operator having actual knowledge that geolocation information being collected is from a child or minor1 to collect geolocation information from a child or minor in a manner that violates the regulations prescribed under subsection 7b74 7#b7 ,disclosure to parent or minor protected ,notwithstanding paragraph 7#a71 neither an operator nor the operator's agent shall be held to be liable under any ,federal or ,state law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of geolocation information under subparagraph 7,c77ii77,,iii7 or 7,d77ii77,,iii7 of subsection 7b77#a74 7b7 ,regulations 7#a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations that require an operator of a website1 online service1 online application1 or mobile application directed to children or minors1 or an operator having actual knowledge that geolocation information being collected is from a child or minor-- 7,a7 to provide clear and conspicuous notice in clear and plain language of any geolocation information the operator collects1 how the operator uses such information1 and whether the operator discloses such information2 7,b7 to establish procedures or mechanisms to ensure that geolocation information is not collected from children or minors except in accordance with regulations promulgated under this paragraph2 7,c7 in the case of collection of geolocation information from a child-- 7i7 prior to collecting such information1 to obtain verifiable parental consent2 and 7ii7 after collecting such information1 to provide to the parent of the child1 upon request by and proper identification of the parent-- 7,i7 a description of the geolocation information collected from the child by the operator2 7,,ii7 the opportunity at any time to refuse to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of geolocation information from the child2 and 7,,iii7 a means that is reasonable under the circumstances for the parent to obtain any geolocation information collected from the child1 if such information is available to the operator at the time the parent makes the request2 and 7,d7 in the case of collection of geolocation information from a minor-- 7i7 prior to collecting such information1 to obtain affirmative express consent from such minor2 and 7ii7 after collecting such information1 to provide to the minor1 upon request-- 7,i7 a description of the geolocation information collected from the minor by the operator2 7,,ii7 the opportunity at any time to refuse to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of geolocation information from the minor2 and 7,,iii7 a means that is reasonable under the circumstances for the minor to obtain any geolocation information collected from the minor1 if such information is available to the operator at the time the minor makes the request4 7#b7 ,when consent not required ,the regulations promulgated under paragraph 7#a7 shall provide that verifiable parental consent under subparagraph 7,c77i7 of such paragraph or affirmative express consent under subparagraph 7,d77i7 of such paragraph is not required when the collection of the geolocation information of a child or minor is necessary1 to the extent permitted under other provisions of law1 to provide information to law enforcement agencies or for an investigation on a matter related to public safety4 7#c7 ,continuation of service ,the regulations promulgated under paragraph 7#a7 shall prohibit an operator from discontinuing service provided to-- 7,a7 a child on the basis of refusal by the parent of the child1 under subparagraph 7,c77ii77,,ii7 of such paragraph1 to permit the further use or maintenance in retrievable form1 or future online collection1 of geolocation information from the child by the operator1 to the extent that the operator is capable of providing such service without such information2 or 7,b7 a minor on the basis of refusal by the minor1 under subparagraph 7,d77ii77,,ii7 of such paragraph1 to permit the further use or maintenance in retrievable form1 or future online collection1 of geolocation information from the minor by the operator1 to the extent that the operator is capable of providing such service without such information4 7c7 ,inconsistent ,state law ,no ,state or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this section that is inconsistent with the treatment of those activities or actions under this section4 #bjh4 ,removal of content 7a7 ,acts prohibited ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application to make publicly available through the website1 service1 or application content or information that contains or displays personal information of children or minors in a manner that violates the regulations prescribed under subsection 7b74 7b7 ,regulations 7#a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations that require an operator-- 7,a7 to the extent technologically feasible1 to implement mechanisms that permit a user of the website1 service1 or application of the operator to erase or otherwise eliminate content or information submitted to the website1 service1 or application by such user that is publicly available through the website1 service1 or application and contains or displays personal information of children or minors2 and 7,b7 to take appropriate steps to make users aware of such mechanisms and to provide notice to users that such mechanisms do not necessarily provide comprehensive removal of the content or information submitted by such users4 7#b7 ,exception ,the regulations promulgated under paragraph 7#a7 may not require an operator or third party to erase or otherwise eliminate content or information that-- 7,a7 any other provision of ,federal or ,state law requires the operator or third party to maintain2 or 7,b7 was submitted to the website1 service1 or application of the operator by any person other than the user who is attempting to erase or otherwise eliminate such content or information1 including content or information submitted by such user that was republished or resubmitted by another person4 7#c7 ,limitation ,nothing in this section shall be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction4 #bji4 ,enforcement and applicability 7a7 ,enforcement by the ,commission 7#a7 ,in general ,except as otherwise provided1 this title and the regulations prescribed under this title shall be enforced by the ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#b7 ,unfair or deceptive acts or practices ,subject to subsection 7b71 a violation of this title or a regulation prescribed under this title shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,actions by the ,commission 7,a7 ,in general ,subject to subsection 7b71 and except as provided in subsection 7d77#a71 the ,commission shall prevent any person from violating this title or a regulation prescribed under this title in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this title4 7,b7 ,privileges and immunities ,any person who violates this title or a regulation prescribed under this title shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7b7 ,enforcement by certain other agencies ,notwithstanding subsection 7a71 compliance with the requirements imposed under this title shall be enforced as follows3 7#a7 ,under section #h of the ,federal ,deposit ,insurance ,act 7#ab ,u4,s4,c4 #ahah7 by the appropriate ,federal banking agency1 with respect to an insured depository institution 7as such terms are defined in section #c of such ,act 7#ab ,u4,s4,c4 #ahac774 7#b7 ,under the ,federal ,credit ,union ,act 7#ab ,u4,s4,c4 #agea et seq47 by the ,national ,credit ,union ,administration ,board1 with respect to any ,federal credit union4 7#c7 ,under part ,a of subtitle ,,vii of title #di1 ,united ,states ,code1 by the ,secretary of ,transportation1 with respect to any air carrier or foreign air carrier subject to such part4 7#d7 ,under the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq47 7except as provided in section #djf of such ,act 7#g ,u4,s4,c4 #bbf2 #bbg77 by the ,secretary of ,agriculture1 with respect to any activities subject to such ,act4 7#e7 ,under the ,farm ,credit ,act of #aiga 7#ab ,u4,s4,c4 #bjja et seq47 by the ,farm ,credit ,administration1 with respect to any ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association4 7c7 ,enforcement by ,states 7#a7 ,civil actions ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any person in a practice that violates this title or a regulation prescribed under this title1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7,a7 enjoin that practice2 7,b7 enforce compliance with this title or such regulation2 7,c7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 or 7,d7 obtain such other relief as the court may consider to be appropriate4 7#b7 ,rights of ,federal ,trade ,commission 7,a7 ,notice to ,federal ,trade ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,federal ,trade ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 before initiating the civil action4 7ii7 ,contents ,the notification required by clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,federal ,trade ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,federal ,trade ,commission ,the ,federal ,trade ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,investigatory powers ,for purposes of bringing any civil action under paragraph 7#a71 nothing in this title shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths or affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7#d7 ,preemptive action by ,federal ,trade ,commission ,if the ,federal ,trade ,commission institutes a civil action or an administrative action with respect to a violation of this title1 the attorney general of a ,state may not1 during the pendency of such action1 bring a civil action under paragraph 7#a7 against any defendant named in the complaint of the ,commission for the violation with respect to which the ,commission instituted such action4 7#e7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7#f7 ,actions by other ,state officials 7,a7 ,in general ,in addition to civil actions brought by attorneys general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 7d7 ,telecommunications carriers and cable operators 7#a7 ,enforcement by ,,ftc ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this title shall be enforced by the ,commission with respect to any telecommunications carrier 7as defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec774 7#b7 ,relationship to other law ,to the extent that sections #bbb1 #cch7;i71 and #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea7 are inconsistent with this title1 this title controls4 #baj4 ,rule for treatment of users of websites1 services1 and applications directed to children or minors ,an operator of a website1 online service1 online application1 or mobile application that is directed to children or minors shall treat all users of such website1 service1 or application as children or minors 7as the case may be7 for purposes of this title1 except as permitted by the ,commission by a regulation promulgated under this title4 #baa4 ,effective dates 7a7 ,in general ,except as provided in subsections 7b7 and 7c71 this title and the amendments made by this title shall take effect on the date that is #a year after the date of the enactment of this ,act4 7b7 ,authority ,to promulgate regulations ,the following shall take effect on the date of the enactment of this ,act3 7#a7 ,the amendments made by subsections 7a77#e7 and 7b77#c77;,a7 of section #bjd4 7#b7 ,sections #bje7;b71 #bjf7;c71 #bjg7;b71 and #bjh7;b74 7#c7 ,subsections 7b7 and 7c7 of section #bjc4 7c7 ,digital ,marketing ,bill of ,rights for ,teens ,section #bjf1 except for subsection 7c7 of such section1 shall take effect on the date that is #ahj days after the promulgation of regulations under such subsection4