,i #aaeth ,,congress #b;d ,session ,h4 ,r4 #fhfd ,,in ,,the ,,house ,,of ,,representatives ,september #bd1 #bjah,ms4 ,del,bene 7for herself and ,mr4 ,jeffries7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to require the ,federal ,trade ,commission to promulgate regulations related to sensitive personal information or behavioral data1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,information ,transparency ,personal ,data ,control ,act4 #b4 ,requirements for sensitive personal information or behavioral data 7a7 ,regulations ,not later than #a year after the date of the enactment of this ,act1 the ,federal ,trade ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require1 except as provided in subsection 7b71 any operator that provides services to the public involving the collection1 storage1 processing1 sale1 sharing with third parties1 or other use of sensitive personal information from ,united ,states persons or persons located in the ,united ,states when the data is collected1 to meet the following requirements3 7#a7 ,affirmative1 express1 and opt in consent ,provide users with notice through a privacy and data use policy of a specific request to use their data and require that users provide affirmative1 express1 and opt in consent to any functionality that involves the collection1 storage1 processing1 sale1 sharing1 or other use of sensitive personal information1 including sharing personal data with third parties4 7#b7 ,privacy and data use policy ,provide users with an up-to-date1 transparent privacy1 security1 and data use policy that meets general requirements1 including that such policy1 presented to users in the context where it applies-- 7,a7 is concise and intelligible2 7,b7 is clear and prominent in appearance2 7,c7 uses clear and plain language2 7,d7 uses visualizations where appropriate to make complex information understandable by the ordinary user2 and 7,e7 is provided free of charge4 7#c7 ,additional requirements for privacy and data use policy ,the privacy1 security1 and data use policy required under paragraph 7#b7 shall include the following3 7,a7 ,identity and contact information of the entity collecting the sensitive personal information4 7,b7 ,the purpose or use for collecting1 storing1 processing1 selling1 sharing1 or otherwise using the personal information1 including how the sensitive personal information is shared with third parties4 7,c7 ,third parties with whom the sensitive personal information will be shared and for what purposes4 7,d7 ,the storage period for how long the personal information will be retained by the operator and any third party1 as applicable4 7,e7 ,how consent to collecting1 storing1 processing1 selling1 sharing1 or otherwise using the sensitive personal information1 including sharing with third parties1 may be withdrawn4 7,f7 ,how a user can view the sensitive personal information that they have provided to an operator and whether it can be exported to other web-based platforms4 7,g7 ,what kind of sensitive personal information is collected4 7,h7 ,whether the sensitive personal information will be used to create profiles about users4 7,i7 ,how sensitive personal information is protected from unauthorized access or acquisition4 7#d7 ,opt out consent ,for any collection1 storage1 processing1 selling1 sharing1 or other use of non-sensitive personal information1 including sharing with third parties1 ,operators shall provide users with the ability to opt out at any time4 7#e7 ,privacy audits 7,a7 ,in general ,annually1 ,operators collecting1 storing1 processing1 selling1 sharing1 or otherwise using sensitive personal information shall obtain a privacy audit from an objective1 independent third-party professional with substantial experience in the field of privacy and data protection1 who uses procedures and standards generally accepted in such field4 7,b7 ,audit requirements ,each such audit shall-- 7i7 set forth the privacy1 security1 and data use controls that the operator has implemented and maintained during the reporting period2 7ii7 describe whether such controls are appropriate to the size and complexity of the operator1 the nature and scope of the activities of the operator1 and the nature of the sensitive personal information or behavioral data collected by the operator2 7iii7 certify whether the privacy and security controls operate with sufficient effectiveness to provide reasonable assurance to protect the privacy and security of sensitive personal information or behavioral data and that the controls have so operated throughout the reporting period2 7iv7 be prepared and completed within #fj days after the end of the reporting period to which the audit applies2 and 7v7 be provided to the ,federal ,trade ,commission or to the attorney general of a ,state1 or other authorized ,state officer1 within #aj days of notification by the ,commission or the attorney general of a ,state1 or other authorized ,state officer where such person has presented to the ,operator allegations that a violation of this ,act or any regulation issued under this ,act has been committed by the ,operator4 7,c7 ,small business exemption ,notwithstanding other authorities of the ,,ftc1 the audit requirements set forth above shall not apply to ,operators with #ejj or fewer employees4 7,d7 ,non-sensitive personal information exemption ,the audit requirements set forth above shall not apply to ,operators who do not collect1 store1 process1 sell1 share1 or otherwise use sensitive personal information4 7b7 ,exemptions 7#a7 ,necessary operations and security purposes ,subsection 7a7 shall not apply to the processing1 collecting1 storing1 sharing1 selling of sensitive personal information for the following purposes3 7,a7 ,preventing or detecting fraud4 7,b7 ,protecting the security of people1 devices1 networks1 or facilities4 7,c7 ,protecting the health1 safety1 rights1 or property of the covered entity or another person4 7,d7 ,responding in good faith to valid legal process or providing information as otherwise required or authorized by law4 7,e7 ,monitoring or enforcing agreements between the covered entity and an individual1 including but not limited to1 terms of service1 terms of use1 user agreements1 or agreements concerning monitoring criminal activity4 7#b7 ,reasonable expectation of users ,the regulations promulgated pursuant to subsection 7a7 with respect to the requirement to provide opt in consent shall not apply to the processing of sensitive personal information or behavioral data in which such processing does not deviate from purposes consistent with an operator's relationship with users as understood by the reasonable user4 #c4 ,application and enforcement by the ,federal ,trade ,commission 7a7 ,general application ,this ,act applies1 according to its terms1 to those persons1 partnerships1 and corporations over which the ,federal ,trade ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b774 ,notwithstanding the limitations in the ,federal ,trade ,commission ,act on ,commission authority with respect to common carriers1 this ,act also applies1 according to its terms1 to common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and ,acts amendatory thereof and supplementary thereto4 7b7 ,enforcement 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of ,commission ,except as provided in subsection 7a71 the ,federal ,trade ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7c7 ,construction ,nothing in this ,act shall be construed to limit the authority of the ,federal ,trade ,commission under any other provision of law4 #d4 ,definitions ,in this ,act3 7#a7 ,call detail record ,the term call detail record-- 7,a7 means session-identifying information 7including an originating or terminating telephone number1 an ,international ,mobile ,subscriber ,identity number1 or an ,international ,mobile ,station ,equipment ,identity number71 a telephone calling card number1 or the time or duration of a call2 7,b7 does not include-- 7i7 the contents 7as defined in section #beaj7h7 of title #ah1 ,united ,states ,code7 of any communication2 7ii7 the name1 address1 or financial information of a subscriber or customer2 or 7iii7 cell site location or global positioning system information4 7#b7 ,clear and prominent ,the term clear and prominent means in any communication medium1 the required disclosure is-- 7,a7 of a type1 size1 and location sufficiently noticeable for an ordinary consumer to read and comprehend the communication2 7,b7 provided in a manner such that an ordinary consumer is able to read and comprehend the communication2 7,c7 is presented in an understandable language and syntax2 7,d7 includes nothing contrary to1 inconsistent with1 or that mitigates any statement contained within the disclosure or within any document linked to or referenced therein2 and 7,e7 includes an option that is compliant with applicable obligations of the operator under title ,,iii of the ,americans with ,disabilities ,act of #aiij 7#db ,u4,s4,c4 #abaha et seq474 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,operator ,the term operator means any entity who operates a website located on the internet or an online service and who collects or maintains personal information from or about individuals1 or on whose behalf such information is collected or maintained1 where such website or online service is operated for commercial purposes1 including any entity that buys and sells consumer data without direct consumer interaction1 and any entity offering products or services for sale through that website or online service1 involving commerce among the ,states or with one or more foreign nations4 7#e7 ,sensitive personal information ,the term sensitive personal information means information relating to an identified or identifiable individual1 including the following3 7,a7 ,financial information4 7,b7 ,health information4 7,c7 ,relationships4 7,d7 ,information pertaining to children under #ac years of age4 7,e7 ,social ,security numbers4 7,f7 ,driver's license or other government-issued identification number4 7,g7 ,authentication credentials1 such as a username and password4 7,h7 ,precise geolocation information4 7,i7 ,content of communications4 7,j7 ,call detail records4 7,k7 ,web browsing history1 application usage history1 and the functional equivalent of either4 7,l7 ,biometric information4 7,m7 ,sexual orientation4 7,n7 ,political preferences4 7,o7 ,religious beliefs4 7,p7 ,any other personal or behavioral information that the ,commission determines to be sensitive4 7#f7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 and each commonwealth1 territory1 or possession of the ,united ,states4 7#g7 ,third party ,the term third party means an individual or entity that uses or receives sensitive personal information or behavioral data obtained by or on behalf of an operator1 other than-- 7,a7 a service provider of an operator to whom the operator discloses the consumer's sensitive personal information for an operational purpose pursuant to an agreement that prohibits the person receiving the personal information from using or disclosing the personal information for any purpose other than the purposes contemplated by the agreement2 and 7,b7 any entity that uses such data only as reasonably necessary-- 7i7 to comply with applicable law1 regulation1 or legal process2 7ii7 to enforce an operator's terms of use2 or 7iii7 to detect1 prevent1 or mitigate fraud or security vulnerabilities4 #e4 ,rule of construction ,nothing in this ,act shall be construed to preclude the acquisition by the ,federal ,government of-- 7#a7 the contents of a wire or electronic communication pursuant to other lawful authorities1 including the authorities under chapter #aai of title #ah1 ,united ,states ,code 7commonly known as the ,wiretap ,act71 the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja et seq471 or any other provision of ,federal law not specifically amended by this ,act2 or 7#b7 records or other information relating to a subscriber or customer of any electronic communication service or remote computing service 7not including the content of such communications7 pursuant to the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja et seq471 chapter #aai of title #ah1 ,united ,states ,code 7commonly known as the ,wiretap ,act71 or any other provision of ,federal law not specifically amended by this ,act4 #f4 ,right of action 7a7 ,right of action ,except as provided in subsection 7e71 the attorney general of a ,state1 or other authorized ,state officer1 alleging a violation of this ,act or any regulation issued under this ,act that affects or may affect such ,state or its residents may bring an action on behalf of the residents of the ,state in any ,united ,states district court for the district in which the defendant is found1 resides1 or transacts business1 or wherever venue is proper under section #acia of title #bh1 to obtain appropriate injunctive relief4 7b7 ,notice to commission required ,a ,state shall provide prior written notice to the ,federal ,trade ,commission of any civil action under subsection 7a7 together with a copy of its complaint1 except that if it is not feasible for the ,state to provide such prior notice1 the ,state shall provide such notice immediately upon instituting such action4 7c7 ,intervention by the ,commission ,the ,commission may intervene in such civil action and upon intervening-- 7#a7 be heard on all matters arising in such civil action2 and 7#b7 file petitions for appeal of a decision in such civil action4 7d7 ,construction ,nothing in this section shall be construed-- 7#a7 to prevent the attorney general of a ,state1 or other authorized ,state officer1 from exercising the powers conferred on the attorney general1 or other authorized ,state officer1 by the laws of such ,state2 or 7#b7 to prohibit the attorney general of a ,state1 or other authorized ,state officer1 from proceeding in ,state or ,federal court on the basis of an alleged violation of any civil or criminal statute of that ,state4 7e7 ,limitation ,no separate suit shall be brought under this section if1 at the time the suit is brought1 the same alleged violation is the subject of a pending action by the ,federal ,trade ,commission or the ,united ,states under this chapter4 #g4 ,effective date ,this ,act shall take effect #ahj days after the date of the enactment of this ,act4