,,ii #aafth ,,congress #ast ,session ,s4 #abad ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #aa1 #bjai ,mr4 ,markey introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish and protect individual and collective privacy rights1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,privacy ,bill of ,rights ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,act prohibited4 ,sec4 #d4 ,right to notice4 ,sec4 #e4 ,right to control4 ,sec4 #f4 ,right to access1 correction1 deletion1 and data portability4 ,sec4 #g4 ,prohibition on re-identifying personal information4 ,sec4 #h4 ,prohibition on take-it-or-leave-it4 ,sec4 #i4 ,prohibition on financial incentives4 ,sec4 #aj4 ,prohibition on disclosing information to third parties without proper assurances4 ,sec4 #aa4 ,use limitations4 ,sec4 #ab4 ,data minimization4 ,sec4 #ac4 ,right to data security4 ,sec4 #ad4 ,privacy and security officer4 ,sec4 #ae4 ,federal enforcement4 ,sec4 #af4 ,state enforcement4 ,sec4 #ag4 ,private right of action4 ,sec4 #ah4 ,relation to other laws4 ,sec4 #ai4 ,effective date4 #b4 ,definitions ,in this ,act3 7#a7 ,breach of security ,the term breach of security means any instance in which a person1 without authorization or in violation of any authorization provided to the person1 gains access to1 uses1 or discloses personal information4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered entity ,the term covered entity means any person that collects or otherwise obtains personal information4 7#d7 ,data broker ,the term data broker means a commercial entity that collects1 assembles1 or maintains personal information concerning an individual who is not a customer or employee of the entity1 and who has not established a subscription or account with the entity1 in order to sell the information or provide third-party access to the information4 7#e7 ,de-identified ,the term de-identified1 with respect to information1 means information that cannot reasonably identify1 relate to1 describe1 or be capable of being associated with or linked to1 directly or indirectly1 a particular individual4 7#f7 ,disclose ,the term disclose means to disclose1 release1 transfer1 share1 disseminate1 make available1 or otherwise communicate orally1 in writing1 electronically1 or by any other means to any third party4 7#g7 ,minor ,the term minor means any individual who is under #af years of age4 7#h7 ,mobile application ,the term mobile application means a software program that runs on the operating system of a mobile device4 7#i7 ,opt-in approval ,the term opt-in approval means affirmative1 express consent of an individual for a covered entity to use1 disclose1 or permit access to the individual's personal information after the individual has received explicit notification of the request of the covered entity with respect to that information4 7#aj7 ,personal information 7,a7 ,in general ,the term personal information means information that directly or indirectly identifies1 relates to1 describes1 is capable of being associated with1 or could reasonably be linked to1 a particular individual4 7,b7 ,examples ,the term personal information includes-- 7i7 an identifier such as a real name1 alias1 signature1 date of birth1 gender identity1 sexual orientation1 marital status1 physical characteristic or description1 postal address1 telephone number1 unique personal identifier1 military identification number1 online identifier1 ,internet ,protocol address1 email address1 account name1 mother's maiden name1 social security number1 driver's license number1 passport number1 or other similar identifier2 7ii7 information such as employment1 employment history1 bank account number1 credit card number1 debit card number1 insurance policy number1 or any other financial information1 medical information1 mental health information1 or health insurance information2 7iii7 commercial information1 including a record of personal property1 income1 assets1 leases1 rentals1 products or services purchased1 obtained1 or considered1 or other purchasing or consuming history2 7iv7 biometric information1 including a retina or iris scan1 fingerprint1 voiceprint1 or scan of hand or face geometry2 7v7 internet or other electronic network activity information1 including browsing history1 search history1 content1 including text1 photographs1 audio or video recordings1 or other user generated-content1 non-public communications1 and information regarding an individual's interaction with an internet website1 mobile application1 or advertisement2 7vi7 historical or real-time geolocation data2 7vii7 audio1 electronic1 visual1 thermal1 olfactory1 or similar information2 7viii7 education records1 as defined in section #ii4c of title #cd1 ,code of ,federal ,regulations1 or any successor regulation2 7ix7 political information or information on criminal convictions or arrests2 7x7 any required security code1 access code1 password1 or username necessary to permit access to the account of an individual2 7xi7 characteristics of protected classes under ,federal law1 including race1 color1 national origin1 religion1 sex1 age1 or disability2 or 7xii7 an inference drawn from any of the information described in this subparagraph to create a profile about an individual reflecting the individual's preferences1 characteristics1 psychological trends1 preferences1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 or aptitudes4 7,c7 ,exclusions 7i7 ,in general ,the term personal information does not include publicly available information4 7ii7 ,publicly available information ,for purposes of clause 7i71 the term publicly available information-- 7,i7 means information that is lawfully made available from ,federal1 ,state1 or local government records2 and 7,,ii7 does not include-- 7aa7 biometric information collected by a covered entity about an individual without the individual's knowledge2 7bb7 information used for a purpose that is not compatible with the purpose for which the information is maintained and made available in government records2 or 7cc7 information of an individual that is de-identified4 7#aa7 ,third party ,the term third party1 with respect to personal information of an individual1 means any person that is not-- 7,a7 the covered entity that is disclosing the personal information2 7,b7 solely performing an outsourced function of the covered entity diclosing the personal information if-- 7i7 the person is contractually or legally prohibited from using1 retaining1 sharing1 or selling the personal information after the conclusion of the outsourced function2 and 7ii7 the person is complying with the regulations promulgated under this ,act2 or 7,c7 a person with respect to which the individual gave specific opt-in approval for the covered entity to disclose the personal information of the individual to the person4 #c4 ,act prohibited 7a7 ,in general ,it shall be unlawful for a covered entity to violate the privacy of an individual in a manner that violates a regulation promulgated under this ,act4 7b7 ,regulations ,in carrying out this ,act1 the ,commission shall-- 7#a7 not later than #a year after the date of enactment of this ,act1 promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to protect the individual and collective privacy rights set forth in this ,act2 7#b7 ensure the regulations promulgated under paragraph 7#a7 take effect not later than #ij days after the date on which the regulations are promulgated2 7#c7 establish a centralized internet website for the benefit of individuals that provides information to individuals about their rights under this ,act in a clear1 concise1 well-organized1 understandably written1 and complete manner2 and 7#d7 establish a centralized internet website for the benefit of individuals that lists each data broker in the ,united ,states4 #d4 ,right to notice 7a7 ,in general ,in promulgating regulations under section #c1 the ,commission shall require a covered entity to-- 7#a7 develop and make available to customers a short-form notice about the collection1 retention1 use1 and sharing of the personal information of individuals by the covered entity that includes-- 7,a7 what personal information is being collected1 used1 or retained2 7,b7 the manner in which the personal information is collected2 7,c7 how and for what purpose the covered entity is collecting1 using1 retaining1 sharing1 or selling the personal information2 7,d7 how long the personal information will be held2 7,e7 which third parties the covered entity shares personal information with or leases or sells personal information to1 not including-- 7i7 a governmental entity with which the covered entity shares personal information pursuant to a court order or law that prohibits the covered entity from revealing that instance of sharing to the individual to whom the personal information pertains2 7ii7 a third party if the personal information is-- 7,i7 made available to and readily accessible by the general public with the consent of the individual to whom the personal information pertains2 and 7,,ii7 shared with1 or leased or sold to1 the third party through a mechanism available to any member of the general public2 or 7iii7 a third party with which the covered entity shares1 or to which the covered entity leases or sells1 personal information of an individual that the covered entity did not obtain from the individual1 if revealing that instance of sharing1 leasing1 or selling personal information would expose another individual to likely harm2 7,f7 in the case of the sharing1 leasing1 or selling of personal information described in subparagraph 7,e7 that is not excluded under clause 7i71 7ii71 or 7iii7 of that subparagraph1 what personal information is shared with or leased or sold to third parties and for what purpose2 7,g7 how an individual can access1 correct1 and delete the personal information of the individual that the covered entity retains as required under section #f2 7,h7 the practices of the covered entity for collecting personal information of an individual1 including offline practices1 when the individual is not directly interacting with the covered entity2 7,i7 the practices of the covered entity for using personal information in automated decisionmaking2 and 7,j7 the right of an individual to provide opt-in approval and revoke approval consistent with section #e2 7#b7 ensure that the short-form notice developed under paragraph 7#a7-- 7,a7 is clear1 concise1 well-organized1 understandably written1 and complete2 7,b7 does not contain unrelated1 confusing1 or contradictory materials2 and 7,c7 is in a format that is-- 7i7 prominent and easily accessible2 7ii7 of reasonable length2 and 7iii7 clearly distinguishable from other matters2 7#c7 not later than #ae days after making a material change to the privacy practices or policies of the covered entity1 update the short-form notice developed under paragraph 7#a72 7#d7 make the short-form notice required under paragraph 7#a7 persistently and conspicuously available-- 7,a7 on the website or mobile application of the covered entity1 if the covered entity maintains a website or mobile application2 and 7,b7 at the physical place of business or any other offline equivalent maintained by the covered entity2 and 7#e7 ensure that the short-form notice required under paragraph 7#a7 is made available to an individual-- 7,a7 7i7 at the point of sale of a product or service of1 subscription to a service of1 or establishment of an account with1 the covered entity1 prior to the sale1 subscription1 or establishment1 whether that point of sale1 subscription1 or establishment is in person1 online1 over the telephone1 or through another means2 or 7ii7 if there is no such sale1 subscription1 or establishment1 before the individual uses the product or service of the covered entity2 and 7,b7 regardless of the decision of the individual as to whether to provide opt-in approval to the covered entity4 7b7 ,requirements for unexpected collection or use of personal information 7#a7 ,in general ,in promulgating regulations under section #c1 the ,commission shall apply the requirements under paragraph 7#b7 of this subsection to any collection or use of personal information of an individual by a covered entity other than collection or use that-- 7,a7 is necessary for the performance of a contract to which the individual is party2 7,b7 consists of actions that an individual would consider necessary in order to provide a requested product or service2 or 7,c7 consists of actions taken at the request of the individual prior to entering into a contract to which the individual is party4 7#b7 ,requirements ,a covered entity that is subject to paragraph 7#a71 with respect to any individual whose personal information the covered entity collects or uses as described in that paragraph-- 7,a7 shall provide the short-form notice developed under subsection 7a77#a7 to the individual in a manner that ensures that the individual reviews the notice and can provide opt-in approval under section #e2 7,b7 shall notify the individual of any material change to the privacy practices or policies of the covered entity not later than the date on which the covered entity updates the short-form notice under subsection 7a77#c72 7,c7 may not collect any personal information of the individual not specified in the short-form notice most recently provided to the individual in accordance with subparagraph 7,a7 unless the covered entity provides the individual with a new short-form notice consistent with that subparagraph at the point of collection of the additional information2 and 7,d7 may not use personal information of the individual for a purpose not specified in the short-form notice most recently provided to the individual in accordance with subparagraph 7,a7 unless the covered entity provides the individual with a new short-form notice consistent with that paragraph that discloses the additional purpose4 7c7 ,standardized short-,form privacy notice 7#a7 ,standardized notice ,the ,commission shall establish standardized short-form privacy notices that comply with this section4 7#b7 ,use of standardized notice ,a covered entity may satisfy the requirements of subsection 7a7 by adopting a standardized short-form privacy notice established by the ,commission under paragraph 7#a7 of this subsection4 7d7 ,joint notice for affiliated covered entities ,two or more affiliated covered entities may use a single joint short-form notice for purposes of this section if the short-form notice-- 7#a7 states that the notice applies to multiple affiliated covered entities and names each such covered entity2 and 7#b7 is accurate with respect to the actions of each covered entity using the notice4 #e4 ,right to control 7a7 ,opt-,in approval required ,in promulgating regulations under section #c1 the ,commission shall require a covered entity to obtain opt-in approval from an individual to-- 7#a7 collect1 use1 retain1 share1 or sell the individual's personal information2 or 7#b7 make any material changes in the collection1 use1 retention1 sharing1 or sale of the individual's personal information4 7b7 ,rules for approval 7#a7 ,procedures ,a covered entity shall obtain approval under subsection 7a7 in accordance with the procedures for notification under section #d4 7#b7 ,manner ,in order to satisfy subsection 7a71 approval shall be freely given1 specific1 informed1 and unambiguous4 7#c7 ,withdrawal ,an individual shall have the right to withdraw his or her approval at any time4 7#d7 ,means ,a covered entity shall seek to obtain approval through the primary medium used to offer or deliver the covered entity's product or service4 7c7 ,exceptions ,a covered entity shall not be required to obtain opt-in approval from an individual under subsection 7a7-- 7#a7 if collection is necessary for the performance of a contract to which the individual is party2 7#b7 to take steps that an individual would consider necessary in order to provide a requested product or service2 or 7#c7 to take steps at the request of the individual prior to entering into a contract to which the individual is party4 7d7 ,emergency or exigent circumstances 7#a7 ,in general ,subject to paragraph 7#b71 a covered entity shall not be required to obtain opt-in approval under subsection 7a7 if the covered entity1 in good faith1 believes danger of death or serious physical injury to any individual requires use1 access1 or disclosure without delay of personal information relating to the emergency4 7#b7 ,notice requirement ,not later than #ij days after the date on which a covered entity uses1 accesses1 or discloses personal information of an individual without obtaining opt-in approval under paragraph 7#a71 the covered entity shall inform the individual of-- 7,a7 the personal information that the covered entity used1 accessed1 or disclosed2 7,b7 the details of the emergency or exigent circumstances2 and 7,c7 the reasons why the covered entity needed to use1 access1 or disclose the personal information4 7e7 ,exemptions 7#a7 ,in general ,in promulgating regulations under subsection 7a71 the ,commission may grant an exemption to a specific covered entity from the control requirements under this section after taking into account-- 7,a7 privacy risks posed by the use of personal information by the covered entity2 7,b7 the costs and benefits of applying the regulations to the covered entity2 and 7,c7 whether-- 7i7 the personal information held by the covered entity is-- 7,i7 necessary and used1 retained1 or shared only to protect the security of the covered entity's service2 7,,ii7 7aa7 necessary for providing a service requested by an individual2 and 7bb7 consistent with the context of the service provided2 7,,iii7 necessary to initiate1 render1 bill for1 or collect payment for a service or product requested by an individual from the covered entity2 or 7,,iv7 necessary to protect-- 7aa7 the rights or property of the covered entity2 or 7bb7 individuals who use the services or products provided by the covered entity or other covered entities from fraudulent1 abusive1 or unlawful use of the service or product2 or 7ii7 the covered entity-- 7,i7 de-identifies the personal information held by the covered entity2 and 7,,ii7 where possible1 provides individuals with the choice to opt-out of the collection and use of the de-identified information of the individuals4 7#b7 ,reporting requirement ,if the ,commission grants an exemption to a covered entity under paragraph 7#a71 the ,commission shall list the covered entity on the website of the ,commission established under section #c7;b77#c7 and provide a brief justification for granting the exemption to the covered entity4 #f4 ,right to access1 correction1 deletion1 and data portability 7a7 ,in general ,in promulgating regulations under section #c1 the ,commission shall require a covered entity to-- 7#a7 upon request1 provide confirmation to an individual who uses a product or service of the covered entity1 or has established a subscription or account with the covered entity1 as to whether the covered entity retains personal information pertaining to the individual2 7#b7 if the covered entity retains the individual's personal information1 provide to the individual-- 7,a7 reasonable means to access the personal information2 7,b7 a description of-- 7i7 the personal information being retained2 7ii7 each date on which the covered entity collected the personal information2 7iii7 the third parties to which the covered entity has disclosed or will disclose the personal information2 and 7iv7 if possible1 how long the personal information will be retained or stored1 or if not possible1 the criteria used for determining how long the personal information will be retained or stored2 and 7,c7 notice of the right to correct and delete personal information2 7#c7 provide the access to the personal information under paragraph 7#b77;,a7 in the form of a portable electronic table that-- 7,a7 is in a usable and searchable format2 7,b7 allows the individual to transfer the personal information from one entity to another entity without hindrance2 and 7,c7 to the extent that the ,commission determines practicable and appropriate1 delineates between-- 7i7 personal information collected and shared in order to provide the individual with the desired product or service2 and 7ii7 personal information that was sold by the covered entity to a third party2 7#d7 provide an individual with a mechanism to correct inaccurate personal information retained or stored by the covered entity2 7#e7 7,a7 provide an individual with a mechanism to request the deletion of the personal information of the individual that the covered entity retains or stores about the individual2 and 7,b7 when the covered entity receives a request from an individual under subparagraph 7,a71 delete the personal information collected from the individual unless the covered entity needs to retain the personal information in order to-- 7i7 7,i7 complete the transaction for which the personal information was collected2 7,,ii7 provide a good or service requested by the individual or reasonably anticipated within the context of the covered entity's ongoing relationship with the individual2 or 7,,iii7 otherwise perform a contract to which the individual is party2 7ii7 detect security incidents1 protect against activity that violates the covered entity's terms of service or malicious1 deceptive1 fraudulent1 or illegal activity1 or prosecute persons responsible for such activity2 7iii7 debug to identify and repair errors that impair existing functionality2 7iv7 exercise free speech1 ensure the ability of another individual to exercise his or her right to free speech1 or exercise another right provided for by law2 7v7 comply with chapter #aai1 #aba1 or #bjf of title #ah1 ,united ,states ,code2 7vi7 engage in public or peer-reviewed scientific1 historical1 or statistical research in the public interest that adheres to all other applicable ethics and privacy laws1 if-- 7,i7 the covered entity's deletion of the information is likely to render impossible or seriously impair the achievement of such research2 7,,ii7 the individual has provided informed consent2 and 7,,iii7 the research is already in progress at the time that deletion is requested2 or 7vii7 comply with a legal obligation2 7#f7 provide the mechanisms under paragraphs 7#d7 and 7#e7 in a form that is-- 7,a7 clear and conspicuous2 and 7,b7 made available-- 7i7 at no additional cost to the user2 7ii7 without requiring an individual to establish an account with the covered entity2 7iii7 in a language other than ,english1 if the provider transacts business with individuals in that other language2 7iv7 to individuals regardless of whether the information was obtained by the covered entity directly from the individual1 not to include publicly available or de-identified personal information2 7v7 7,i7 through a toll-free number2 7,,ii7 on the covered entity's website1 if the covered entity maintains a website2 or 7,,iii7 through the primary mechanism through which the covered entity engages in a relationship with the individual in order to provide a product or service2 and 7vi7 such that an individual has the opportunity to request correction or deletion of personal information not less frequently than once every #f months2 7#g7 inform any entity with which the covered entity has shared1 sold1 or disclosed an individual's personal information of any request from the individual for confirmation of1 access to1 correction of1 or deletion of the individual's personal information under this subsection2 7#h7 comply with an individual's request for confirmation1 access1 correction1 or deletion under this subsection even if the request is received from another covered entity1 if the receiving covered entity can verify that the request is originally from the individual2 and 7#i7 comply with an individual's request for confirmation1 access1 correction1 or deletion under this subsection not later than #ij days after receiving a verifiable request from the individual or another covered entity4 7b7 ,right of parents and guardians of minors ,for purposes of subsection 7a71 a parent or guardian of a minor may act on behalf of the minor with respect to personal information of the minor held by a covered entity1 including by requesting confirmation of1 access to1 correction of1 or deletion of the personal information4 7c7 ,prohibition on de-,identifying personal information subsequent ,to request ,a covered entity may not de-identify an individual's personal information during the #ij-;day period beginning on the date on which the covered entity receives a request from the individual for confirmation1 access1 correction1 or deletion of the individual's personal information under subsection 7a74 #g4 ,prohibition on re-identifying personal information 7a7 ,in general ,in promulgating regulations under section #c1 the ,commission shall require a covered entity to ensure that personal information that has been de-identified is not restored such that the information can be linked to a specific individual or device4 7b7 ,actions required ,in carrying out subsection 7a71 the ,commission shall-- 7#a7 require a covered entity to implement-- 7,a7 technical safeguards that prohibit identification of the individual to whom or device to which the information may pertain2 7,b7 processes that specifically prohibit reidentification of the information2 and 7,c7 processes that prevent inadvertent release of de-identified information2 and 7#b7 prohibit a covered entity from making any attempt to reidentify the information4 #h4 ,prohibition on take-it-or-leave-it ,a covered entity may not refuse to serve an individual who does not approve the collection1 use1 retention1 sharing1 or sale of the individual's personal information for commercial purposes on the basis of that lack of approval 7commonly known as a take-it-or-leave-it-offer74 #i4 ,prohibition on financial incentives 7a7 ,in general ,a covered entity may not offer an individual a program that relates the price of a product or service to the privacy protections afforded the individual1 including by providing a discount or other incentive in exchange for the opt-in approval of the individual to the use and sharing of the individual's personal information4 7b7 ,rule of construction ,nothing in subsection 7a7 shall be construed to prohibit the relation of price of a service or the level of service provided to an individual to the provision1 by the individual1 of financial information that is necessarily collected and used only for the purpose of initiating1 rendering1 billing for1 or collecting payment for a service or product requested by the individual from the covered entity4 7c7 ,exemptions ,the ,commission may exempt a specific type of financial incentive offered by a particular covered entity from the prohibition under subsection 7a7 if the ,commission determines that the type of financial incentive1 as offered by that covered entity1 is reasonable1 just1 and non-coercive4 #aj4 ,prohibition on disclosing information to third parties without proper assurances 7a7 ,in general ,a covered entity may not disclose the personal information of an individual to a third party under a written contract unless-- 7#a7 the contract prohibits the third party from-- 7,a7 using the personal information for any reason other than performing the specified service on behalf of the covered entity2 or 7,b7 disclosing the personal information to another third party for any reason other than performing the specified service on behalf of the covered entity2 and 7#b7 the covered entity ensures that the third party effectively enforces the prohibitions described in paragraph 7#a71 including by auditing the data security and data information practices of the third party not less frequently than once every #b years4 7b7 ,rule of construction ,nothing in subsection 7a7 shall be construed to prevent the disclosure of personal information of an individual-- 7#a7 by a covered entity to a third party if necessary to comply with applicable law or a court-issued subpoena1 warrant1 or order2 7#b7 by a covered entity to a third party that is reasonably necessary to-- 7,a7 address fraud1 security1 or technical issues2 7,b7 protect the individual's rights or property2 or 7,c7 protect individuals or the public from illegal activities as required or permitted by law2 or 7#c7 if the individual has specifically approved of the disclosure4 #aa4 ,use limitations 7a7 ,in general ,in promulgating regulations under section #c1 the ,commission shall prohibit a covered entity from using personal information for unreasonable purposes1 including-- 7#a7 selling1 leasing1 trading1 or otherwise profiting from an individual's biometric information2 7#b7 sharing1 resharing1 or otherwise disseminating an individual's biometric information without first obtaining specific consent from the individual1 unless-- 7,a7 the dissemination is required by ,state or ,federal law or municipal ordinance2 or 7,b7 the dissemination is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction2 7#c7 processing personal information for the purpose of advertising1 marketing1 soliciting1 offering1 selling1 leasing1 licensing1 renting1 or otherwise commercially contracting for employment1 finance1 healthcare1 credit1 insurance1 housing1 or education opportunities1 in a manner that discriminates against or otherwise makes the opportunity unavailable on the basis of a person's or class of persons' actual or perceived race1 color1 ethnicity1 religion1 national origin1 sex1 gender1 gender identity1 sexual orientation1 familial status1 biometric information1 lawful source of income1 or disability2 or 7#d7 processing personal information in a manner that segregates1 discriminates in1 or otherwise makes unavailable the goods1 services1 facilities1 privileges1 advantages1 or accommodations of any place of public accommodation on the basis of a person's or class of persons' actual or perceived race1 color1 ethnicity1 religion1 national origin1 sex1 gender1 gender identity1 sexual orientation1 or disability4 7b7 ,definition of place of public accommodation ,for purposes of subsection 7a71 the term place of public accommodation means-- 7#a7 any entity considered a place of public accommodation under section #bja7;b7 of the ,civil ,rights ,act of #aifd 7#db ,u4,s4,c4 #bjjj;a7b77 or section #cja of the ,americans with ,disabilities ,act of #aiij 7#db ,u4,s4,c4 #abaha72 and 7#b7 any entity that offers goods or services through the internet to the general public4 #ab4 ,data minimization ,in promulgating regulations under section #c1 the ,commission shall prohibit a covered entity from-- 7#a7 collecting personal information of an individual beyond what is adequate1 relevant1 and necessary-- 7,a7 for the performance of a contract to which the individual is party2 7,b7 to provide a requested product or service2 or 7,c7 to take steps at the request of the individual prior to entering into a contract to which the individual is party2 or 7#b7 accessing the personal information of an individual later than #ij days after the latest date on which-- 7,a7 the covered entity concludes the performance of a contract to which the individual is party2 7,b7 the covered entity concludes taking steps that an individual would consider necessary in order to provide a requested product or service1 including steps to prevent fraud1 ensure safety1 or ensure compliance with the covered entity's terms of service2 or 7,c7 the individual otherwise terminates his or her relationship with the covered entity4 #ac4 ,right to data security 7a7 ,reasonable procedures 7#a7 ,in general ,in promulgating regulations under section #c1 the ,commission shall require a covered entity to establish and maintain reasonable data security practices to protect the confidentiality1 integrity1 and availability of personal information4 7#b7 ,proportionality ,the requirements prescribed under paragraph 7#a7 shall provide for security procedures that are proportional to the volume and nature of the personal information a covered entity collects4 7#c7 ,commission guidance2 industry practices ,the requirements prescribed under paragraph 7#a7 shall be consistent with guidance provided by the ,commission and recognized industry practices for safety and security1 including administrative1 technical1 and physical safeguards to secure the personal information of users4 7#d7 ,technologically neutral ,the ,commission may not require a specific technological means of meeting a requirement under paragraph 7#a74 7b7 ,other requirements ,in promulgating regulations under section #c1 the ,commission shall require a covered entity-- 7#a7 to make publicly available a description of the practices established by the covered entity under subsection 7a7 that details-- 7,a7 how the covered entity will address privacy and security risks associated with the development of new products and services2 7,b7 the access that employees and contractors of the covered entity have to the personal information of an individual who uses a service or product of the covered entity2 and 7,c7 the internal policies of the covered entity for the use of the personal information described in subparagraph 7,b72 7#b7 7,a7 to notify an individual if the covered entity determines that-- 7i7 an unauthorized disclosure of the personal information of the individual has occurred2 and 7ii7 harm is reasonably likely to occur2 and 7,b7 as part of the notification under subparagraph 7,a71 to offer the individual-- 7i7 the option to prohibit the covered entity from collecting1 using1 retaining1 sharing1 or selling the personal information of the individual2 and 7ii7 the option to have the covered entity-- 7,i7 erase all personal information of the individual held by the covered entity2 7,,ii7 cease sharing and selling the personal information of the individual2 7,,iii7 provide the individual a copy of the personal information of the individual that the covered entity holds about the individual in a format consistent with section #f7;a77#c72 or 7,,iv7 close the individual's account or otherwise terminate the individual's relationship with the covered entity2 and 7#c7 not less frequently than once every #b years-- 7,a7 to audit the privacy and security practices in place that protect the confidentiality1 integrity1 and availability of personal information held by the covered entity2 or 7,b7 if the ,commission determines it appropriate based on the volume and nature of the personal information collected by the covered entity1 to-- 7i7 have an independent third-party auditor conduct the audit described in subparagraph 7,a72 and 7ii7 make the results of the audit available to the ,commission upon completion4 #ad4 ,privacy and security officer ,in promulgating regulations under section #c1 the ,commission shall require a covered entity to-- 7#a7 designate not less than #a employee of the covered entity to coordinate the efforts to comply with and carry out the responsibilities of the covered entity under this ,act1 including any request or challenge related to personal information2 and 7#b7 provide publicly accessible contact information for each employee designated under paragraph 7#a74 #ae4 ,federal enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,except as provided in subsection 7b71 a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,except as provided in subsection 7b71 the ,commission shall enforce this ,act and any regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7b7 ,entities not regulated by the ,commission ,compliance with this ,act and the regulations promulgated under this ,act shall be enforced as follows3 7#a7 ,under section #h of the ,federal ,deposit ,insurance ,act 7#ab ,u4,s4,c4 #ahah7 by the appropriate ,federal banking agency1 with respect to an insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac774 7#b7 ,under the ,federal ,credit ,union ,act 7#ab ,u4,s4,c4 #agea et seq47 by the ,national ,credit ,union ,administration ,board1 with respect to any ,federal credit union4 7#c7 ,under part ,a of subtitle ,,vii of title #di1 ,united ,states ,code1 by the ,secretary of ,transportation1 with respect to any air carrier or foreign air carrier subject to that part4 7#d7 ,under the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq47 7except as provided in section #djf of that ,act 7#g ,u4,s4,c4 #bbf1 #bbg77 by the ,secretary of ,agriculture1 with respect to any activities subject to that ,act4 7#e7 ,under the ,farm ,credit ,act of #aiga 7#ab ,u4,s4,c4 #bjja et seq47 by the ,farm ,credit ,administration1 with respect to any ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association4 7c7 ,relation to private agreements ,it shall be unlawful for any covered entity to commit an act prohibited under this ,act or a regulation promulgated under this ,act1 regardless of any specific agreement between entities or individuals4 7d7 ,no waiver of rights and remedies ,the rights and remedies provided under this ,act may not be waived or limited by contract or otherwise4 #af4 ,state enforcement 7a7 ,in general ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any covered entity in a practice that violates this ,act or a regulation promulgated under this ,act1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to-- 7#a7 enjoin that practice2 7#b7 enforce compliance with this ,act or the regulation2 7#c7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 or 7#d7 obtain any other relief that the court considers appropriate4 7b7 ,notice 7#a7 ,in general ,before filing an action under subsection 7a71 the attorney general of the ,state involved shall provide to the ,commission-- 7,a7 written notice of the action2 and 7,b7 a copy of the complaint for the action4 7#b7 ,exemption 7,a7 ,in general ,paragraph 7#a7 shall not apply with respect to the filing of an action by an attorney general of a ,state if the attorney general determines that it is not feasible to provide the notice described in that paragraph before the filing of the action4 7,b7 ,notification ,in an action described in subparagraph 7,a71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,commission at the same time as the attorney general files the action4 7c7 ,intervention 7#a7 ,in general ,upon receiving notice under subsection 7b71 the ,commission shall have the right to intervene in the action that is the subject of the notice4 7#b7 ,effect ,if the ,commission intervenes in an action under paragraph 7#a71 the ,commission shall have the right-- 7,a7 to be heard with respect to any matter that arises in the action2 and 7,b7 to file a petition for appeal4 7d7 ,rule of construction ,for purposes of bringing a civil action under subsection 7a71 nothing in this ,act shall be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to-- 7#a7 conduct investigations2 7#b7 administer oaths or affirmations2 or 7#c7 compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,preemptive action by ,commission ,if the ,commission institutes an action with respect to a violation of this ,act or a regulation promulgated under this ,act1 a ,state may not1 during the pendency of that action1 institute an action under subsection 7a7 against any defendant named in the complaint in the action instituted by the ,commission based on the same set of facts giving rise to the violation with respect to which the ,commission instituted the action4 #ag4 ,private right of action 7a7 ,right of action 7#a7 ,in general ,any individual alleging a violation of this ,act or a regulation promulgated under this ,act may bring a civil action in any court of competent jurisdiction4 7#b7 ,injury in fact ,a violation of this ,act or a regulation promulgated under this ,act with respect to the personal information of an individual constitutes an injury in fact to that individual4 7b7 ,relief ,in a civil action brought under subsection 7a7 in which the plaintiff prevails1 the court may award-- 7#a7 actual damages2 7#b7 punitive damages2 7#c7 reasonable attorney's fees and costs2 and 7#d7 any other relief1 including an injunction1 that the court determines appropriate4 7c7 ,pre-,dispute arbitration agreements 7#a7 ,in general ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement shall be valid or enforceable with respect to a dispute between a covered entity and an individual that relates to a violation of this ,act or a regulation promulgated under this ,act4 7#b7 ,applicability ,an issue as to whether this subsection applies with respect to a dispute shall be determined by a court4 ,the validity and enforceability of an agreement to which this subsection applies shall be determined by a court1 rather than an arbitrator1 irrespective of whether the agreement purports to delegate such determinations to an arbitrator4 #ah4 ,relation to other laws 7a7 ,in general ,except as provided in subsection 7b71 nothing in this ,act shall be construed to-- 7#a7 modify1 limit1 or supersede the operation of any privacy or security provision in-- 7,a7 section #eeb;a of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd72 7,b7 the ,right to ,financial ,privacy ,act of #aigh 7#ab ,u4,s4,c4 #cdja et seq472 7,c7 the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq472 7,d7 the ,fair ,debt ,collection ,practices ,act 7#ae ,u4,s4,c4 #afib et seq472 7,e7 the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq472 7,f7 title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq472 7,g7 chapters #aai1 #abc1 and #bjf of title #ah1 ,united ,states ,code2 7,h7 section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd72 7,i7 section #dde of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;h72 7,j7 the ,privacy ,protection ,act of #aihj 7#db ,u4,s4,c4 #bjjj;aa et seq472 7,k7 the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 as those regulations relate to-- 7i7 a person described in section #aagb7;a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#a7;a772 or 7ii7 transactions referred to in section #aagc7;a77#a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#b7;a77#a772 7,l7 the ,communications ,assistance for ,law ,enforcement ,act 7#dg ,u4,s4,c4 #ajja et seq472 7,m7 sections #bbb and #bbg of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb1 #bbg72 or 7,n7 any other privacy or security provision of ,federal law2 7#b7 limit the authority of the ,commission under any other provision of law2 or 7#c7 limit the authority of the ,federal ,communications ,commission to promulgate regulations and enforce any privacy law not in contradiction with this ,act4 7b7 ,applicability to minors ,to the extent that a provision of this ,act or a regulation promulgated under this ,act is inconsistent with a provision of any other ,federal law relating to the protection and control of the personal information of minors1 the provision that provides the most protection and control to minors and their parents or guardians shall apply4 #ai4 ,effective date ,this ,act shall take effect on the date that is #ij days after the date of enactment of this ,act4