,,ii #aafth ,,congress #ast ,session ,s4 #aajh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #aj1 #bjai,mr4 ,wyden 7for himself and ,mr4 ,booker7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to direct the ,federal ,trade ,commission to require entities that use1 store1 or share personal information to conduct automated decision system impact assessments and data protection impact assessments4 #a4 ,short title ,this ,act may be cited as the ,algorithmic ,accountability ,act of #bjai4 #b4 ,definitions ,in this ,act3 7#a7 ,automated decision system ,the term automated decision system means a computational process1 including one derived from machine learning1 statistics1 or other data processing or artificial intelligence techniques1 that makes a decision or facilitates human decision making1 that impacts consumers4 7#b7 ,automated decision system impact assessment ,the term automated decision system impact assessment means a study evaluating an automated decision system and the automated decision system's development process1 including the design and training data of the automated decision system1 for impacts on accuracy1 fairness1 bias1 discrimination1 privacy1 and security that includes1 at a minimum-- 7,a7 a detailed description of the automated decision system1 its design1 its training1 data1 and its purpose2 7,b7 an assessment of the relative benefits and costs of the automated decision system in light of its purpose1 taking into account relevant factors1 including-- 7i7 data minimization practices2 7ii7 the duration for which personal information and the results of the automated decision system are stored2 7iii7 what information about the automated decision system is available to consumers2 7iv7 the extent to which consumers have access to the results of the automated decision system and may correct or object to its results2 and 7v7 the recipients of the results of the automated decision system2 7,c7 an assessment of the risks posed by the automated decision system to the privacy or security of personal information of consumers and the risks that the automated decision system may result in or contribute to inaccurate1 unfair1 biased1 or discriminatory decisions impacting consumers2 and 7,d7 the measures the covered entity will employ to minimize the risks described in subparagraph 7,c71 including technological and physical safeguards4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,consumer ,the term consumer means an individual4 7#e7 ,covered entity ,the term covered entity means any person1 partnership1 or corporation over which the ,commission has jurisdiction under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 that-- 7,a7 had greater than #ej1jjj1jjj in average annual gross receipts for the #c-taxable-year period preceding the most recent fiscal year1 as determined in accordance with paragraphs 7#b7 and 7#c7 of section #ddh7;c7 of the ,internal ,revenue ,code of #aihf2 7,b7 possesses or controls personal information on more than-- 7i7 #a1jjj1jjj consumers2 or 7ii7 #a1jjj1jjj consumer devices2 7,c7 is substantially owned1 operated1 or controlled by a person1 partnership1 or corporation that meets the requirements under subparagraph 7,a7 or 7,b72 or 7,d7 is a data broker or other commercial entity that1 as a substantial part of its business1 collects1 assembles1 or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell or trade the information or provide third-party access to the information4 7#f7 ,data protection impact assessment ,the term data protection impact assessment means a study evaluating the extent to which an information system protects the privacy and security of personal information the system processes4 7#g7 ,high-risk automated decision system ,the term high-risk automated decision system means an automated decision system that-- 7,a7 taking into account the novelty of the technology used and the nature1 scope1 context1 and purpose of the automated decision system1 poses a significant risk-- 7i7 to the privacy or security of personal information of consumers2 or 7ii7 of resulting in or contributing to inaccurate1 unfair1 biased1 or discriminatory decisions impacting consumers2 7,b7 makes decisions1 or facilitates human decision making1 based on systematic and extensive evaluations of consumers1 including attempts to analyze or predict sensitive aspects of their lives1 such as their work performance1 economic situation1 health1 personal preferences1 interests1 behavior1 location1 or movements1 that-- 7i7 alter legal rights of consumers2 or 7ii7 otherwise significantly impact consumers2 7,c7 involves the personal information of a significant number of consumers regarding race1 color1 national origin1 political opinions1 religion1 trade union membership1 genetic data1 biometric data1 health1 gender1 gender identity1 sexuality1 sexual orientation1 criminal convictions1 or arrests2 7,d7 systematically monitors a large1 publicly accessible physical place2 or 7,e7 meets any other criteria established by the ,commission in regulations issued under section #c7;b77#a74 7#h7 ,high-risk information system ,the term high-risk information system means an information system that-- 7,a7 taking into account the novelty of the technology used and the nature1 scope1 context1 and purpose of the information system1 poses a significant risk to the privacy or security of personal information of consumers2 7,b7 involves the personal information of a significant number of consumers regarding race1 color1 national origin1 political opinions1 religion1 trade union membership1 genetic data1 biometric data1 health1 gender1 gender identity1 sexuality1 sexual orientation1 criminal convictions1 or arrests2 7,c7 systematically monitors a large1 publicly accessible physical place2 or 7,d7 meets any other criteria established by the ,commission in regulations issued under section #c7;b77#a74 7#i7 ,information system ,the term information system-- 7,a7 means a process1 automated or not1 that involves personal information1 such as the collection1 recording1 organization1 structuring1 storage1 alteration1 retrieval1 consultation1 use1 sharing1 disclosure1 dissemination1 combination1 restriction1 erasure1 or destruction of personal information2 and 7,b7 does not include automated decision systems4 7#aj7 ,personal information ,the term personal information means any information1 regardless of how the information is collected1 inferred1 or obtained that is reasonably linkable to a specific consumer or consumer device4 7#aa7 ,store ,the term store-- 7,a7 means the actions of a person1 partnership1 or corporation to retain information2 and 7,b7 includes actions to store1 collect1 assemble1 possess1 control1 or maintain information4 7#ab7 ,use ,the term use means the actions of a person1 partnership1 or corporation in using information1 including actions to use1 process1 or access information4 #c4 ,data protection authority 7a7 ,acts prohibited ,it is unlawful for any covered entity to-- 7#a7 violate a regulation promulgated under subsection 7b72 or 7#b7 knowingly provide substantial assistance to any person1 partnership1 or corporation whose actions violate subsection 7b74 7b7 ,regulations 7#a7 ,in general ,not later than #b years after the date of enactment of this section1 the ,commission shall promulgate regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 that-- 7,a7 require each covered entity to conduct automated decision system impact assessments of-- 7i7 existing high-risk automated decision systems1 as frequently as the ,commission determines is necessary2 and 7ii7 new high-risk automated decision systems1 prior to implementation1 provided that a covered entity may evaluate similar high-risk automated decision systems that present similar risks in a single assessment2 7,b7 require each covered entity to conduct data protection impact assessments of-- 7i7 existing high-risk information systems1 as frequently as the ,commission determines is necessary2 and 7ii7 new high-risk information systems1 prior to implementation1 provided that a covered entity may evaluate similar high-risk information systems that present similar risks in a single assessment2 7,c7 require each covered entity to conduct the impact assessments under subparagraphs 7,a7 and 7,b71 if reasonably possible1 in consultation with external third parties1 including independent auditors and independent technology experts2 and 7,d7 require each covered entity to reasonably address in a timely manner the results of the impact assessments under subparagraphs 7,a7 and 7,b74 7#b7 ,optional publication of impact assessments ,the impact assessments under subparagraphs 7,a7 and 7,b7 may be made public by the covered entity at its sole discretion4 7c7 ,preemption of private contracts ,it shall be unlawful for any covered entity to commit the acts prohibited in subsection 7a71 regardless of specific agreements between entities or consumers4 7d7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of subsection 7a7 shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,the ,commission shall enforce this section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this section4 7,b7 ,privileges and immunities ,any person who violates subsection 7a7 shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this section shall be construed to limit the authority of the ,commission under any other provision of law4 7e7 ,enforcement by ,states 7#a7 ,in general ,if the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is being threatened or adversely affected by a practice that violates subsection 7a71 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief4 7#b7 ,rights of ,commission 7,a7 ,notice to ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state1 before initiating a civil action under paragraph 7#a71 shall provide written notification to the ,commission that the attorney general intends to bring such civil action4 7ii7 ,contents ,the notification required under clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required under clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which-- 7i7 the defendant is an inhabitant1 may be found1 or transacts business2 or 7ii7 venue is proper under section #acia of title #bh1 ,united ,states ,code4 7#e7 ,actions by other ,state officials 7,a7 ,in general ,in addition to a civil action brought by an attorney general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #d4 ,no preemption ,nothing in this ,act may be construed to preempt any ,state law4