,,ii #aaeth ,,congress #ast ,session ,s4 #ahae ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #ad1 #bjag,mr4 ,markey 7for himself1 ,mr4 ,blumenthal1 ,mr4 ,whitehouse1 ,mr4 ,franken1 and ,mr4 ,sanders7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require data brokers to establish procedures to ensure the accuracy of collected personal information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,broker ,accountability and ,transparency ,act of #bjag4 #b4 ,definitions ,in this ,act3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,covered data broker 7,a7 ,in general ,the term covered data broker includes all data brokers except those data brokers excepted under subparagraph 7,b74 7,b7 ,exceptions ,the ,commission may except a data broker if the ,commission considers1 by rule1 a data broker outside the scope of this ,act1 such as a data broker who processes information collected by or on behalf of and received from or on behalf of a nonaffiliated third party concerning an individual who is a customer or an employee of that third party to enable that third party1 directly or through parties acting on its behalf1 to provide benefits for its employees or directly transact business with its customers4 7#c7 ,data broker ,the term data broker means a commercial entity that collects1 assembles1 or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell the information or provide third-party access to the information4 7#d7 ,non-public information ,the term non-public information means information about an individual that is-- 7,a7 of a private nature2 7,b7 not available to the general public2 and 7,c7 not obtained from a public record4 7#e7 ,public record information ,the term public record information means information about an individual that has been obtained originally from records of a ,federal1 ,state1 or local government entity that are available for public inspection4 #c4 ,prohibition on obtaining or solicitation to obtain personal information by false pretenses 7a7 ,in general ,a covered data broker may not obtain or attempt to obtain1 or cause to be disclosed or attempt to cause to be disclosed to any person1 personal information or any other information relating to any person by making a false1 fictitious1 or fraudulent statement or representation to any person1 including by providing any document to any person1 that the covered data broker knows or should know-- 7#a7 to be forged1 counterfeit1 lost1 stolen1 or fraudulently obtained2 or 7#b7 contains a false1 fictitious1 or fraudulent statement or representation4 7b7 ,solicitation ,a covered data broker may not request a person to obtain personal information1 or any other information1 relating to any other person if the covered data broker knows or should know that the person to whom the request is made will obtain or attempt to obtain that information in the manner described in subsection 7a74 #d4 ,requirements concerning accuracy of and access to personal information 7a7 ,accuracy 7#a7 ,in general ,except as provided in paragraph 7#b71 a covered data broker shall establish procedures to ensure1 to the maximum extent practicable1 the accuracy of-- 7,a7 the personal information it collects1 assembles1 or maintains2 and 7,b7 any other information it collects1 assembles1 or maintains that specifically identifies an individual1 unless the information only identifies an individual's name or address4 7#b7 ,exception ,a covered data broker may collect or maintain information that may be inaccurate with respect to a particular individual if that information is being collected or maintained solely for the purpose of-- 7,a7 indicating whether there may be a discrepancy or irregularity in the personal information that is associated with an individual2 7,b7 helping to identify1 or to authenticate the identity of1 an individual2 or 7,c7 helping to protect against or investigate fraud or other unlawful conduct4 7b7 ,consumer access 7#a7 ,in general ,subject to paragraph 7#d71 a covered data broker shall provide an individual a means to review any personal information or other information that specifically identifies that individual1 that the covered data broker collects1 assembles1 or maintains on that individual4 7#b7 ,review requirements ,the means for review under paragraph 7#a7 shall be provided-- 7,a7 at an individual's request2 7,b7 after verifying the identity of the individual2 7,c7 at least #a time per year2 7,d7 at no cost to the individual2 and 7,e7 in a format that can be readily understood by a consumer1 as determined by the ,commission4 7#c7 ,period of review ,a covered data broker shall provide an individual the means required under paragraph 7#a7 within such period after receiving a request from such individual as the ,commission shall determine1 by rule1 is appropriate4 7#d7 ,exceptions ,the ,commission may1 by rule1 establish such exceptions to paragraph 7#a7 as the ,commission considers appropriate1 such as for child protection1 law enforcement1 fraud prevention1 or other government purposes4 7#e7 ,limitation on use of verifying information ,if a covered data broker collects information from an individual to verify the identity of the individual under paragraph 7#b77;,b7 that the data broker did not have before such collection1 the data broker may not use such information for any purpose other than for purposes of verifying the identity of the individual under such paragraph4 7c7 ,disputed information 7#a7 ,in general ,an individual whose personal information is maintained by a covered data broker may dispute the accuracy of any information described under subsection 7b77#a7 by requesting1 in writing1 that the covered data broker correct the information4 7#b7 ,correction requirements ,a covered data broker1 after verifying the identity of an individual making a request under paragraph 7#a7 to correct information1 and unless there are reasonable grounds to believe the request is frivolous or irrelevant1 shall-- 7,a7 with regard to public record information-- 7i7 inform the individual of the source of the information and1 if reasonably available1 where to direct the individual's request for correction2 or 7ii7 if the individual provides proof that the public record has been corrected or that the covered data broker was reporting the information incorrectly1 correct the inaccuracy in the covered data broker's records2 and 7,b7 with regard to non-public information-- 7i7 note the information that is disputed1 including the individual's written request2 7ii7 if the information can be independently verified1 use the procedures established under subsection 7a7 to independently verify the information2 and 7iii7 if the covered data broker was reporting the information incorrectly1 correct the inaccuracy in the covered data broker's records4 7#c7 ,period of correction ,in a case in which a covered data broker is subject to a requirement under paragraph 7#b7 due to a request made by an individual under paragraph 7#a71 such covered data broker shall take such action as may be required to satisfy such requirement within such period as the ,commission shall determine1 by rule1 is appropriate4 7d7 ,notice 7#a7 ,in general ,a covered data broker shall maintain an ,internet website and place a clear and conspicuous notice on that ,internet website instructing an individual how-- 7,a7 to review information under subsection 7b77#a72 and 7,b7 to express a preference under subsection 7e77#b74 7#b7 ,form ,a covered data broker shall ensure that the notice the covered data broker places under paragraph 7#a7 conforms to such model form as the ,commission shall promulgate for purposes of this subsection4 7e7 ,certain marketing information 7#a7 ,in general ,a covered data broker may not use1 share1 or sell any information for marketing purposes that is subject to an expressed preference under paragraph 7#b74 7#b7 ,expression of preferences ,a covered data broker that maintains any information described under subsection 7a7 and that uses1 shares1 or sells that information for marketing purposes shall provide each individual whose information the covered data broker maintains with a reasonable means of expressing a preference not to have that individual's information used for those purposes4 7f7 ,auditing 7#a7 ,in general ,subject to paragraph 7#b71 each covered data broker shall establish measures that facilitate the auditing or retracing of any internal or external access to1 or transmission of1 any data containing personal information collected1 assembled1 or maintained by the covered data broker4 7#b7 ,exceptions ,the ,commission may establish1 by rule1 such exceptions to paragraph 7#a7 as the ,commission considers appropriate to further or protect law enforcement or national security activities4 7g7 ,security 7#a7 ,in general ,each covered data broker shall develop and implement a comprehensive consumer privacy and data security program to protect against harm that may be caused by-- 7,a7 loss of personal information collected1 assembled1 or maintained by the covered data broker2 or 7,b7 unauthorized access1 destruction1 use1 modification1 or disclosure of such personal information4 7#b7 ,notice ,whenever a covered data broker determines that personal information of an individual that is collected1 assembled1 or maintained by the covered data broker has been lost or the subject of an unauthorized access1 destruction1 use1 modification1 or disclosure1 the covered data broker shall notify such individual of such loss1 access1 destruction1 use1 modification1 or disclosure4 7h7 ,persons regulated by the ,fair ,credit ,reporting ,act ,a covered data broker shall be considered to be in compliance with subsections 7a7 through 7f7 of this section with respect to information that is subject to the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq47 if the covered data broker is in compliance with sections #fji1 #faj1 and #faa of that ,act 7#ae ,u4,s4,c4 #afha;g1 #afha;h1 #afha;i74 #e4 ,regulations 7a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to carry out this ,act4 7b7 ,elements ,the regulations promulgated under subsection 7a7 shall include the following3 7#a7 ,such exceptions the ,commission considers appropriate to promulgate under section #b7b77;,b74 7#b7 ,the period of review required under section #d7;b77#c74 7#c7 ,such exceptions as the ,commission considers appropriate to promulgate under section #d7;b77#d74 7#d7 ,the period of correction required under section #d7;c77#c74 7#e7 ,the model form required by section #d7;d77#b74 7#f7 ,requirements for auditing under paragraph 7#a7 of section #d7;f7 and such exceptions under paragraph 7#b7 of such section as the ,commission considers appropriate4 7#g7 ,establishment of a centralized ,internet website for the benefit of consumers that-- 7,a7 lists the covered data brokers that are subject to a requirement of section #d2 and 7,b7 provides information to consumers about their rights under this ,act4 7#h7 ,such other regulations as the ,commission considers appropriate to carry out this ,act4 #f4 ,enforcement 7a7 ,enforcement by ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #c or #d or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of ,commission 7,a7 ,in general ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates a regulation prescribed under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7b7 ,enforcement by ,states 7#a7 ,civil action ,except as provided under paragraph 7#e71 in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by any person subject to a provision of section #c or #d or a regulation promulgated under this ,act in a practice that violates such provision or regulation1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states-- 7,a7 to enjoin further violation of such provision or regulation by such person2 7,b7 to compel compliance with such provision or regulation2 7,c7 to obtain damages1 restitution1 or other compensation on behalf of such residents2 7,d7 to obtain such other relief as the court considers appropriate2 or 7,e7 to obtain civil penalties in the amount determined under paragraph 7#b74 7#b7 ,civil penalties 7,a7 ,calculation ,for purposes of imposing a civil penalty under paragraph 7#a77;,e71 the amount determined under this paragraph is the amount calculated by multiplying the number of separate violations of a rule by an amount not greater than #af1jjj4 7,b7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of enactment of this ,act1 and each year thereafter1 the amount specified in subparagraph 7,a7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7#c7 ,rights of ,federal ,trade ,commission 7,a7 ,notice to ,federal ,trade ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 before initiating the civil action4 7ii7 ,contents ,the notification required by clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,federal ,trade ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#d7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#e7 ,preemptive action by ,federal ,trade ,commission ,if the ,commission institutes a civil action or an administrative action with respect to a violation of a provision of section #c or #d or a regulation promulgated under this ,act1 the attorney general of a ,state may not1 during the pendency of such action1 bring a civil action under paragraph 7#a7 against any defendant named in the complaint of the ,commission for the violation with respect to which the ,commission instituted such action4 7#f7 ,actions by other ,state officials 7,a7 ,in general ,in addition to civil actions brought by attorneys general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #g4 ,effect on other laws 7a7 ,preservation of ,commission authority ,nothing in this ,act may be construed in any way to limit or affect the ,commission's authority under any other provision of law4 7b7 ,preservation of other ,federal law ,nothing in this ,act may be construed in any way to supersede1 restrict1 or limit the application of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq47 or any other ,federal law4