,i #aafth ,,congress #ast ,session ,h4 ,r4 #bjac ,,in ,,the ,,house ,,of ,,representatives ,april #a1 #bjai,ms4 ,del,bene 7for herself1 ,miss ,rice of ,new ,york1 and ,mr4 ,suozzi7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to require the ,federal ,trade ,commission to promulgate regulations related to sensitive personal information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,information ,transparency ,personal ,data ,control ,act4 #b4 ,sense of ,congress ,it is the ,sense of ,congress that-- 7#a7 the ,united ,states must develop a balanced1 high-standard digital framework that establishes global standards2 7#b7 a key element of this framework is a strong national standard that combats anti-consumer practices2 7#c7 it is critical that the ,federal ,government provide guidance on the collection and storage of sensitive data2 7#d7 it is important to provide our country with fair and thoughtful digital consumer rights2 and 7#e7 it is important to ensure that our enforcement authorities have the resources needed to protect consumers from bad actors in the privacy and security space4 #c4 ,requirements for sensitive personal information 7a7 ,regulations ,not later than #a year after the date of the enactment of this ,act1 the ,federal ,trade ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require1 except as provided in subsection 7b71 any controller that provides services to the public involving the collection1 storage1 processing1 sale1 sharing with third parties1 or other use of sensitive personal information from ,united ,states persons or persons located in the ,united ,states when the data is collected1 to meet the following requirements3 7#a7 ,affirmative1 express1 and opt-in consent ,provide users with notice through a privacy and data use policy of a specific request to use their sensitive personal information and require that users provide affirmative1 express1 and opt-in consent to any functionality that involves the collection1 storage1 processing1 sale1 sharing1 or other use of sensitive personal information1 including sharing sensitive personal information with third parties4 7#b7 ,privacy and data use policy ,provide users with an up-to-date1 transparent privacy1 security1 and data use policy that meets general requirements1 including that such policy1 presented to users in the context where it applies-- 7,a7 is concise and intelligible2 7,b7 is clear and prominent in appearance2 7,c7 uses clear and plain language2 7,d7 uses visualizations where appropriate to make complex information understandable by the ordinary user2 and 7,e7 is provided free of charge4 7#c7 ,additional requirements for privacy and data use policy ,the privacy1 security1 and data use policy required under paragraph 7#b7 shall include the following3 7,a7 ,identity and contact information of the entity collecting the sensitive personal information4 7,b7 ,the purpose or use for collecting1 storing1 processing1 selling1 sharing1 or otherwise using the sensitive personal information4 7,c7 ,third parties with whom the sensitive personal information will be shared and for what purposes4 7,d7 ,the storage period for how long the sensitive personal information will be retained by the controller and any third party1 as applicable4 7,e7 ,how consent to collecting1 storing1 processing1 selling1 sharing1 or otherwise using the sensitive personal information1 including sharing with third parties1 may be withdrawn4 7,f7 ,how a user can view or obtain the sensitive personal information that they have provided to a controller and whether it can be exported to other web-based platforms4 7,g7 ,what kind of sensitive personal information is collected and shared4 7,h7 ,whether the sensitive personal information will be used to create profiles about users and whether they will be integrated across platforms4 7,i7 ,how sensitive personal information is protected from unauthorized access or acquisition4 7#d7 ,opt-out consent ,for any collection1 storage1 processing1 selling1 sharing1 or other use of non-sensitive personal information1 including sharing with third parties1 controllers shall provide users with the ability to opt out at any time4 7#e7 ,privacy audits 7,a7 ,in general ,except as provided in subparagraphs 7,c7 and 7,d71 annually1 each controller collecting1 storing1 processing1 selling1 sharing1 or otherwise using sensitive personal information shall-- 7i7 obtain a privacy audit from a qualified1 objective1 independent third-party2 and 7ii7 shall make public whether or not the privacy audit found the controller compliant4 7,b7 ,audit requirements ,each such audit shall-- 7i7 set forth the privacy1 security1 and data use controls that the controller has implemented and maintained during the reporting period2 7ii7 describe whether such controls are appropriate to the size and complexity of the controller1 the nature and scope of the activities of the controller1 and the nature of the sensitive personal information or behavioral data collected by the controller2 7iii7 certify whether the privacy and security controls operate with sufficient effectiveness to provide reasonable assurance to protect the privacy and security of sensitive personal information or behavioral data1 including with respect to data shared with third parties1 and that the controls have so operated throughout the reporting period2 7iv7 be prepared and completed within #fj days after the end of the reporting period to which the audit applies2 and 7v7 be provided to the ,federal ,trade ,commission or to the attorney general of a ,state1 or other authorized ,state officer1 within #aj days of notification by the ,commission or the attorney general of a ,state1 or other authorized ,state officer where such person has presented to the controller allegations that a violation of this ,act or any regulation issued under this ,act has been committed by the controller4 7,c7 ,small business audit exemption ,the audit requirements described in this paragraph shall not apply to controllers who collect1 store1 process1 sell1 share1 or otherwise use sensitive personal information relating to #e1jjj or fewer individuals4 7,d7 ,non-sensitive personal information exemption ,the audit requirements set forth above shall not apply to controllers who do not collect1 store1 process1 sell1 share1 or otherwise use sensitive personal information4 7b7 ,exemptions 7#a7 ,necessary operations and security purposes ,subsection 7a7 shall not apply to the processing1 collecting1 storing1 sharing1 selling of sensitive personal information for the following purposes3 7,a7 ,preventing or detecting fraud1 identity theft1 or criminal activity4 7,b7 ,the use of such information to identify errors that impair functionality or otherwise enhancing or maintaining the availability of the services or information systems of the controller for authorized access and use4 7,c7 ,protecting the vital interests of the consumer or another natural person4 7,d7 ,responding in good faith to valid legal process or providing information as otherwise required or authorized by law4 7,e7 ,monitoring or enforcing agreements between the controller and an individual1 including but not limited to1 terms of service1 terms of use1 user agreements1 or agreements concerning monitoring criminal activity4 7,f7 ,protecting the property1 services1 or information systems of the controller against unauthorized access or use4 7,g7 ,advancing a substantial public interest1 including archival purposes1 scientific or historical research1 and public health1 if such processing does not create a significant risk of harm to consumers4 7#b7 ,reasonable expectation of users ,the regulations promulgated pursuant to subsection 7a7 with respect to the requirement to provide opt-in consent shall not apply to the processing1 storage1 and collection of sensitive personal information or behavioral data in which such processing does not deviate from purposes consistent with a controller's relationship with users as understood by the reasonable user4 #d4 ,application and enforcement by the ,federal ,trade ,commission 7a7 ,common carriers ,notwithstanding the limitations in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 on ,commission authority with respect to common carriers1 this ,act applies1 according to its terms1 to common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto4 7b7 ,enforcement 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of ,commission ,except as provided in subsection 7a71 the ,federal ,trade ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7c7 ,construction ,nothing in this ,act shall be construed to limit the authority of the ,federal ,trade ,commission under any other provision of law4 #e4 ,right of action 7a7 ,right of action ,except as provided in subsection 7e71 the attorney general of a ,state1 or other authorized ,state officer1 alleging a violation of this ,act or any regulation issued under this ,act that affects or may affect such ,state or its residents may bring an action on behalf of the residents of the ,state in any ,united ,states district court for the district in which the defendant is found1 resides1 or transacts business1 or wherever venue is proper under section #acia of title #bh1 to obtain appropriate injunctive relief4 7b7 ,notice to ,commission required ,a ,state shall provide prior written notice to the ,federal ,trade ,commission of any civil action under subsection 7a7 together with a copy of its complaint1 except that if it is not feasible for the ,state to provide such prior notice1 the ,state shall provide such notice immediately upon instituting such action4 7c7 ,intervention by the ,commission ,the ,commission may intervene in such civil action and upon intervening-- 7#a7 be heard on all matters arising in such civil action2 and 7#b7 file petitions for appeal of a decision in such civil action4 7d7 ,construction ,nothing in this section shall be construed-- 7#a7 to prevent the attorney general of a ,state1 or other authorized ,state officer1 from exercising the powers conferred on the attorney general1 or other authorized ,state officer1 by the laws of such ,state2 or 7#b7 to prohibit the attorney general of a ,state1 or other authorized ,state officer1 from proceeding in ,state or ,federal court on the basis of an alleged violation of any civil or criminal statute of that ,state4 7e7 ,limitation 7#a7 ,no separate action ,an action may not be brought under subsection 7a7 if the same alleged violation is the subject of a pending action by the ,commission or the ,united ,states4 7#b7 ,exclusive period to act by ,commission ,an action-- 7,a7 may not be brought under subsection 7a7 until the expiration of the #fj-;day period that begins on the date on which a violation is discovered by the ,commission or the date on which the ,commission is notified of the violation2 and 7,b7 may only be brought under subsection 7a7 if the ,commission does not bring an action related to the violation during such period4 #f4 ,privacy and data security employees and funding for the ,commission 7a7 ,employment authority ,the ,commission shall hire #ej new full-time employees to focus on privacy and data security1 #ae of which shall have technology expertise4 7b7 ,additional funding for privacy and data security ,there is authorized to be appropriated to the ,commission #ce1jjj1jjj for issues related to privacy and data security4 #g4 ,definitions ,in this ,act3 7#a7 ,call detail record ,the term call detail record-- 7,a7 means session-identifying information 7including an originating or terminating telephone number1 an ,international ,mobile ,subscriber ,identity number1 or an ,international ,mobile ,station ,equipment ,identity number71 a telephone calling card number1 or the time or duration of a call2 7,b7 does not include-- 7i7 the contents 7as defined in section #beaj7h7 of title #ah1 ,united ,states ,code7 of any communication2 7ii7 the name1 address1 or financial information of a subscriber or customer2 7iii7 cell site location or global positioning system information2 or 7iv7 business customers4 7#b7 ,clear and prominent ,the term clear and prominent means in any communication medium1 the required disclosure is-- 7,a7 of a type1 size1 and location sufficiently noticeable for an ordinary consumer to read and comprehend the communication2 7,b7 provided in a manner such that an ordinary consumer is able to read and comprehend the communication2 7,c7 is presented in an understandable language and syntax2 7,d7 includes nothing contrary to1 inconsistent with1 or that mitigates any statement contained within the disclosure or within any document linked to or referenced therein2 and 7,e7 includes an option that is compliant with applicable obligations of the controller under title ,,iii of the ,americans with ,disabilities ,act of #aiij 7#db ,u4,s4,c4 #abaha et seq474 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,controller ,the term controller means a person that1 on its own or jointly with other entities1 determines the purposes and means of processing sensitive personal information4 7#e7 ,processor ,the term processor means a person that processes data on behalf of the controller4 7#f7 ,sensitive personal information 7,a7 ,the term sensitive personal information means information relating to an identified or identifiable individual1 including the following3 7i7 ,financial account information4 7ii7 ,health information4 7iii7 ,genetic data4 7iv7 ,information pertaining to children under #ac years of age4 7v7 ,social ,security numbers4 7vi7 ,unique government-issued identifiers 7vii7 ,authentication credentials1 such as a username and password4 7viii7 ,precise geolocation information4 7ix7 ,content of a wire communication1 oral communication1 or electronic communication with respect to any entity that is not the intended recipient of the communication4 7x7 ,call detail records4 7xi7 ,web browsing history1 application usage history1 and the functional equivalent of either4 7xii7 ,biometric information4 7xiii7 ,sexual orientation4 7xiv7 ,religious beliefs4 7,b7 ,the term sensitive personal information does not include-- 7i7 de-identified information 7or the process of transforming personal data so that it is not directly relatable to an identified or identifiable consumer72 7ii7 information related to employment2 or 7iii7 publicly available information4 7#g7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 and each commonwealth1 territory1 or possession of the ,united ,states4 7#h7 ,third party ,the term third party means an individual or entity that uses or receives sensitive personal information or behavioral data obtained by or on behalf of a controller1 other than-- 7,a7 a service provider of a controller to whom the controller discloses the consumer's sensitive personal information for an operational purpose pursuant to an agreement that prohibits the service provider receiving the sensitive personal information from using or disclosing the sensitive personal information for the benefit of the provider2 and 7,b7 any entity that uses sensitive personal information only as reasonably necessary-- 7i7 to comply with applicable law1 regulation1 or legal process2 7ii7 to enforce the terms of use of a controller2 or 7iii7 to detect1 prevent1 or mitigate fraud or security vulnerabilities4 #h4 ,rule of construction ,nothing in this ,act may be construed to preclude the acquisition by the ,federal ,government of-- 7#a7 the contents of a wire or electronic communication pursuant to other lawful authorities1 including the authorities under chapter #aai of title #ah1 ,united ,states ,code 7commonly known as the ,wiretap ,act71 the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja et seq471 or any other provision of ,federal law not specifically amended by this ,act2 or 7#b7 records or other information relating to a subscriber or customer of any electronic communication service or remote computing service 7not including the content of such communications7 pursuant to the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja et seq471 chapter #aai of title #ah1 ,united ,states ,code 7commonly known as the ,wiretap ,act71 or any other provision of ,federal law not specifically amended by this ,act4 #i4 ,national standard 7a7 ,preemption ,for a controller that is subject to this ,act1 or any regulation promulgated pursuant to this ,act1 the provisions of this ,act1 or any such regulation1 shall preempt any civil provision of the law of any ,state or political subdivision of a ,state to the degree the law is focused on the reduction of privacy risk through the regulation of the collection of sensitive personal information and the collection1 storage1 processing1 sale1 sharing with third parties1 or other use of such information4 7b7 ,consumer protection laws ,except as provided in subsection 7a71 this section may not be construed to limit the enforcement1 or the bringing of a claim pursuant to any ,state consumer protection law by an attorney general of a ,state1 other than the extent to which any such law regulates the collection of sensitive personal information and the collection1 storage1 processing1 sale1 sharing with third parties1 or other use of such information4 7c7 ,protection of certain ,state law ,nothing in this ,act may be construed to preempt the applicability of any of the following3 7#a7 ,state constitutional1 trespass1 contract1 data breach notification1 or tort law1 other than to the degree such law is substantially intended to govern the collection of sensitive personal information and the collection1 storage1 processing1 sale1 sharing with third parties1 or other use of such information4 7#b7 ,any other ,state law to the extent that the law relates to acts of fraud1 wiretapping1 or the protection of social security numbers4 7#c7 ,any ,state law to the extent the law provides additional provisions to specifically regulate the covered entities as defined for purposes of the regulations promulgated pursuant to section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia71 section #ddd of the ,general ,education ,provisions ,act 7commonly known as the ,family ,educational ,rights and ,privacy ,act of #aigd7 7#bj ,u4,s4,c4 #abcb;g71 the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq471 or the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fgja et seq474 7#d7 ,any private contract based on a ,state law that requires a party to provide additional or greater privacy for sensitive personal information or data security protections to an individual than this ,act1 or any regulation promulgated pursuant to this ,act4 #aj4 ,effective date ,this ,act shall take effect #ahj days after the date of the enactment of this ,act4