,,ii #aaeth ,,congress #b;d ,session ,s4 #bfci ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #aj1 #bjah ,mr4 ,markey 7for himself and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require the ,federal ,trade ,commission to establish privacy protections for customers of online edge providers1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,customer ,online ,notification for ,stopping ,edge-provider ,network ,transgressions or the ,,consent ,act4 #b4 ,privacy of customers of edge providers 7a7 ,definitions ,in this section-- 7#a7 the term breach of security means any instance in which a person1 without authorization or in violation of any authorization provided to the person1 gains access to1 uses1 or discloses sensitive customer proprietary information2 7#b7 the term ,commission means the ,federal ,trade ,commission2 7#c7 the term customer means-- 7,a7 an individual who is a customer of an edge provider2 and 7,b7 an individual who is a user of an edge service provided by an edge provider2 7#d7 the term edge provider means a person that provides an edge service1 but only to the extent to which the person provides that service2 7#e7 the term edge service-- 7,a7 means a service that is provided over the ,internet-- 7i7 for which the edge provider requires the customer to subscribe or establish an account in order to use the service2 7ii7 that the customer purchases from the edge provider without a subscription or account2 7iii7 through which a program searches for and identifies items in a database that correspond to keywords or characters specified by the customer2 or 7iv7 through which a customer divulges sensitive customer proprietary information of the customer2 and 7,b7 includes any service that is provided-- 7i7 through a software program1 including a mobile application2 or 7ii7 over the ,internet1 directly or indirectly1 through a connected device2 7#f7 the term opt-in consent means a method by which an edge provider may obtain from a customer affirmative1 express consent to use1 disclose1 or permit access to the sensitive customer proprietary information of the customer after the customer has received explicit notification of the request of the edge provider with respect to that information2 7#g7 the term personally identifiable information means any information that is linked1 or reasonably may be linked1 to a specific individual or device2 and 7#h7 the term sensitive customer proprietary information includes-- 7,a7 financial information2 7,b7 health information2 7,c7 information pertaining to children2 7,d7 ,social ,security numbers2 7,e7 precise geolocation information2 7,f7 content of communications2 7,g7 call detail information2 7,h7 web browsing history1 application usage history1 and the functional equivalents of either2 and 7,i7 any other personally identifiable information that the ,commission determines to be sensitive4 7b7 ,privacy of customers of edge providers 7#a7 ,act prohibited ,it is unlawful for an edge provider to violate the privacy of a customer in a manner that violates a regulation prescribed under paragraph 7#b74 7#b7 ,regulations 7,a7 ,in general ,in carrying out this ,act1 the ,commission shall-- 7i7 not later than #a year after the date of enactment of this ,act1 promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to protect the privacy of customers of edge providers2 and 7ii7 ensure that the regulations promulgated under clause 7i7 take effect not later than #ahj days after the date on which the regulations are promulgated4 7,b7 ,requirements under regulations ,in promulgating regulations under subparagraph 7,a71 the ,commission shall-- 7i7 require an edge provider to notify a customer about the collection1 use1 and sharing of the sensitive customer proprietary information of the customer1 including by-- 7,i7 notifying the customer about the types of sensitive customer proprietary information the edge provider collects2 7,,ii7 specifying how and for what purposes the edge provider uses and shares sensitive customer proprietary information2 and 7,,iii7 identifying the types of entities with which the edge provider shares sensitive customer proprietary information2 7ii7 require an edge provider to-- 7,i7 supply the information described in clause 7i7 when a customer initially subscribes to1 establishes an account for1 purchases1 or begins receiving an edge service2 and 7,,ii7 update a customer when the policies of the edge provider relating to the information described in clause 7i7 change in a significant way2 7iii7 require an edge provider to obtain opt-in consent from a customer to use1 share1 or sell the sensitive customer proprietary information of the customer2 7iv7 implement strong protection for sensitive customer proprietary information that has been de-identified to prevent the restoration of any personally identifiable information that has been previously removed1 including by-- 7,i7 requiring an edge provider to alter the customer information so that the customer information cannot be reasonably linked to a specific individual or device2 7,,ii7 requiring an edge provider to publically commit to maintain and use sensitive customer proprietary information in an unidentifiable format and to not attempt to restore any personally identifiable information that has been previously removed from the sensitive customer proprietary information2 and 7,,iii7 requiring an edge provider to contractually prohibit the practice of restoring any personally identifiable information that has been previously removed from sensitive customer proprietary information2 7v7 determine on a case-by-case basis the reasonableness of any program that relates the price of an edge service to the privacy protections afforded to customers1 and require an edge provider to fully disclose plans that provide discounts or other incentives in exchange for a express affirmative consent of the customer to the use and sharing of the sensitive customer proprietary information of the customer2 7vi7 prohibit an edge provider from refusing to serve a customer who does not consent to the use and sharing of the customer proprietary information of the customer for commercial purposes 7commonly known as a take-it-or-leave-it offer7 on the basis of that refusal to consent by the customer2 and 7vii7 require an edge provider to-- 7,i7 develop reasonable data security practices2 and 7,,ii7 notify a customer if a breach of security has occurred if the edge provider determines that an unauthorized disclosure of the sensitive customer proprietary information of the customer has occurred and harm is reasonably likely to occur4 7c7 ,enforcement by the ,commission 7#a7 ,in general ,except as otherwise provided1 this ,act and the regulations prescribed under this ,act shall be enforced by the ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#b7 ,unfair or deceptive acts or practices ,subject to subsection 7d71 a violation of this ,act or a regulation prescribed under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,actions by the ,commission ,subject to subsection 7d71 and except as provided in subsection 7f77#a71 the ,commission shall prevent any person from violating this ,act or a regulation prescribed under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act1 and any person who violates this ,act or such regulation shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7d7 ,enforcement by certain other agencies ,compliance with the requirements imposed under this ,act shall be enforced as follows3 7#a7 ,under section #h of the ,federal ,deposit ,insurance ,act 7#ab ,u4,s4,c4 #ahah7 by the appropriate ,federal banking agency1 with respect to an insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac774 7#b7 ,under the ,federal ,credit ,union ,act 7#ab ,u4,s4,c4 #agea et seq47 by the ,national ,credit ,union ,administration ,board1 with respect to any ,federal credit union4 7#c7 ,under part ,a of subtitle ,,vii of title #di1 ,united ,states ,code1 by the ,secretary of ,transportation1 with respect to any air carrier or foreign air carrier subject to that part4 7#d7 ,under the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq47 7except as provided in section #djf of that ,act 7#g ,u4,s4,c4 #bbf2 #bbg77 by the ,secretary of ,agriculture1 with respect to any activities subject to that ,act4 7#e7 ,under the ,farm ,credit ,act of #aiga 7#ab ,u4,s4,c4 #bjja et seq47 by the ,farm ,credit ,administration1 with respect to any ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association4 7e7 ,enforcement by ,state attorneys general 7#a7 ,in general 7,a7 ,civil actions ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any person in a practice that violates this ,act or a regulation prescribed under this ,act1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7i7 enjoin that practice2 7ii7 enforce compliance with this ,act or such regulation2 7iii7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 or 7iv7 obtain such other relief as the court may consider to be appropriate4 7,b7 ,notice 7i7 ,in general ,before filing an action under subparagraph 7,a71 the attorney general of the ,state involved shall provide to the ,commission-- 7,i7 written notice of that action2 and 7,,ii7 a copy of the complaint for that action4 7ii7 ,exemption 7,i7 ,in general ,clause 7i7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this paragraph if the attorney general determines that it is not feasible to provide the notice described in that clause before the filing of the action4 7,,ii7 ,notification ,in an action described in subclause 7,i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,commission at the same time as the attorney general files the action4 7#b7 ,intervention 7,a7 ,in general ,on receiving notice under paragraph 7#a77;,b71 the ,commission shall have the right to intervene in the action that is the subject of the notice4 7,b7 ,effect of intervention ,if the ,commission intervenes in an action under paragraph 7#a71 it shall have the right-- 7i7 to be heard with respect to any matter that arises in that action2 and 7ii7 to file a petition for appeal4 7#c7 ,construction ,for purposes of bringing any civil action under paragraph 7#a71 nothing in this ,act shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths or affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7#d7 ,actions by the ,commission ,in any case in which an action is instituted by or on behalf of the ,commission for violation of this ,act or a regulation prescribed under this ,act1 no ,state may1 during the pendency of that action1 institute an action under paragraph 7#a7 against any defendant named in the complaint in the action instituted by or on behalf of the ,commission for that violation4 7#e7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7f7 ,telecommunications carriers 7#a7 ,definition ,in this subsection1 the term telecommunications carrier has the meaning given the term in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec74 7#b7 ,enforcement by the commission ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this ,act shall be enforced by the ,commission with respect to any telecommunications carrier1 but only to the extent that the telecommunications carrier is operating as an edge provider4 7#c7 ,relationship to other law ,to the extent that the applicability of section #bbb1 #cch7;i71 or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb1 #cch7;i71 #eea7 to a telecommunications carrier is inconsistent with this ,act1 this ,act shall supersede those sections only to the extent that the telecommunications carrier is operating as an edge provider4