,,ii #aafth ,,congress #ast ,session ,s4 #adb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #af1 #bjai,mr4 ,rubio introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to impose privacy requirements on providers of internet services similar to the requirements imposed on ,federal agencies under the ,privacy ,act of #aigd4 #a4 ,short title ,this ,act may be cited as the ,american ,data ,dissemination ,act of #bjai or the ,,add ,act4 #b4 ,definitions 7a7 ,in general ,in this ,act-- 7#a7 the term agency has the meaning given the term in section #eeb;a of title #e1 ,united ,states ,code2 7#b7 the term appropriate committees of ,congress means-- 7,a7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 and 7,b7 the ,committee on ,energy and ,commerce of the ,house of ,representatives2 7#c7 the term collect means to buy1 rent1 gather1 obtain1 receive1 or access information about an individual by any means1 including by-- 7,a7 receiving information from the individual1 either actively or passively2 or 7,b7 observing the behavior of the individual2 7#d7 the term ,commission means the ,federal ,trade ,commission2 7#e7 the term covered provider means a person that-- 7,a7 provides a service that uses the internet2 and 7,b7 in providing the service under subparagraph 7,a71 collects records2 7#f7 the term disclose means to release1 disseminate1 make available1 transfer1 or otherwise communicate orally1 in writing1 or by electronic or other means2 7#g7 the term maintain includes maintain1 collect1 use1 disclose1 or process2 7#h7 the term ,privacy ,act of #aigd means section #eeb;a of title #e1 ,united ,states ,code2 7#i7 the term process means to perform an operation or set of operations on information or on sets of information1 whether or not by automated means2 7#aj7 subject to subsection 7b71 the term record means any item1 collection1 or grouping of information about an individual that-- 7,a7 is maintained by a covered provider1 including the education1 financial transactions1 medical history1 and criminal or employment history of the individual2 and 7,b7 contains any name or number that may be used1 alone or in conjunction with any other information1 to identify a specific individual1 including any-- 7i7 name1 social security number1 date of birth1 official driver's license or identification number issued by a ,state1 alien registration number1 government passport number1 or employer or taxpayer identification number2 7ii7 unique biometric data1 such as fingerprint1 voice print1 retina or iris image1 or other unique physical representation2 7iii7 unique electronic identification number1 address1 or routing code2 7iv7 telecommunication identifying information or access device 7as those terms are defined in section #ajbi7;e7 of title #ah1 ,united ,states ,code72 or 7v7 user-generated content2 and 7#aa7 the term sell means to disclose information about an individual to another person for monetary or other valuable consideration4 7b7 ,modification of definition ,if the ,commission promulgates regulations under section #d7;a71 the ,commission may modify1 at any time1 the definition of the term record under subsection 7a7 of this section as necessary to conform to new ,federal laws or regulations4 #c4 ,recommended privacy requirements for providers of internet services 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall submit to the appropriate committees of ,congress detailed recommendations for privacy requirements that ,congress could impose on covered providers that would be substantially similar1 to the extent practicable1 to the requirements applicable to agencies under the ,privacy ,act of #aigd4 7b7 ,subjects for recommendations ,the recommendations under subsection 7a7 shall address the issues described in section #d4 #d4 ,regulations imposing privacy requirements on providers of internet services 7a7 ,regulations 7#a7 ,proposed regulations ,not earlier than #a year after the date on which the ,commission submits detailed recommendations for privacy requirements under section #c7;a71 and not later than #ae months after that date1 the ,commission shall publish and submit to the appropriate committees of ,congress proposed regulations to impose privacy requirements on covered providers that are substantially similar1 to the extent practicable1 to the requirements applicable to agencies under the ,privacy ,act of #aigd4 7#b7 ,final regulations ,if a law imposing privacy requirements on covered providers that are substantially similar1 to the extent practicable1 to the requirements applicable to agencies under the ,privacy ,act of #aigd is not enacted by the date that is #b years after the date of enactment of this ,act1 the ,commission shall1 not later than #bg months after that date of enactment1 promulgate final regulations that impose such privacy requirements4 7b7 ,contents ,in promulgating regulations under subsection 7a71 the ,commission-- 7#a7 shall-- 7,a7 establish criteria for exempting certain small1 newly formed covered providers from the requirements under the regulations1 taking into account factors including-- 7i7 the period of time during which the covered provider has been operating as a covered provider2 7ii7 the annual revenue of the covered provider2 and 7iii7 the number of individuals about whom the covered provider collects records2 7,b7 restrict disclosure of records maintained by covered providers2 7,c7 provide that-- 7i7 an individual may request access to a record 7or a portion thereof7 maintained by a covered provider that relates to the individual2 and 7ii7 upon a request under clause 7i71 the covered provider shall-- 7,i7 provide the individual with access to the record 7or the relevant portion thereof72 or 7,,ii7 if the covered provider so elects1 delete the record 7or the relevant portion thereof71 subject to the requirements to keep and provide an accounting under subparagraph 7,g72 7,d7 provide that if an individual demonstrates that a record relating to the individual is not accurate1 relevant1 timely1 or complete 7as those terms are defined by the ,commission7-- 7i7 the individual may request that the covered provider amend the record2 and 7ii7 upon a request under clause 7i71 the covered provider shall amend the record2 7,e7 establish a process modeled on the process established under section #faa7;a7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;i7a77-- 7i7 through which an individual and a covered provider may resolve a dispute under subparagraph 7,d7 of this paragraph regarding the assertion that a record relating to the individual is not accurate1 relevant1 timely1 or complete2 and 7ii7 that does not require the individual to incur any expense2 7,f7 in accordance with accepted standards and in consultation with the ,secretary of ,commerce1 establish a code of fair information practices1 for the secure collection1 maintenance1 and dissemination of records1 with which a covered provider must comply2 7,g7 require a covered provider1 in a manner substantially similar1 to the extent practicable1 to the requirements applicable to agencies under section #eeb;a7c7 of title #e1 ,united ,states ,code1 to-- 7i7 keep an accounting of certain disclosures of records for a reasonable period of time1 as determined by the ,commission2 and 7ii7 make available to an individual1 upon request1 the accounting made under clause 7i7 of disclosures of records relating to the individual1 unless the period of time described in that clause has expired2 and 7,h7 to the extent practicable1 incorporate the exceptions under paragraphs 7#a7 through 7#ab7 of section #eeb;a7b7 of title #e1 ,united ,states ,code2 and 7#b7 may promulgate regulations not described in paragraph 7#a7 that are modeled on section #eeb;a of title #e1 ,united ,states ,code1 and the regulations promulgated under that section4 7c7 ,application with other ,federal laws 7#a7 ,exemption for persons subject to other ,federal privacy laws ,to the extent that a person is subject to a ,federal privacy law described in paragraph 7#b7 of this subsection1 the regulations promulgated under subsection 7a7 shall not apply to the person with respect to any information or records governed by that ,federal privacy law4 7#b7 ,other ,federal privacy laws described ,the ,federal privacy laws described in this paragraph are as follows3 7,a7 ,the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 as those regulations relate to-- 7i7 a person described in section #aagb7;a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#a7;a772 or 7ii7 transactions referred to in section #aagc7;a77#a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#b7;a77#a774 7,b7 ,section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd74 7,c7 ,section #eeb;a of title #e1 ,united ,states ,code4 7#c7 ,conflicts 7,a7 ,children's ,online ,privacy ,protection ,act ,in the case of a conflict between the regulations promulgated under subsection 7a7 of this section and the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq47 7and any regulations promulgated under that ,act71 the ,commission shall determine which provision of law shall apply4 7,b7 ,gramm-,leach-,bliley ,act ,in the case of a conflict between the regulations promulgated under subsection 7a7 of this section and title ,v of the ,gramm-,leach-,bliley ,act of #aiii 7#ae ,u4,s4,c4 #fhja et seq47 7and any regulations promulgated under that ,act71 the ,commission shall determine which provision of law shall apply4 #e4 ,enforcement 7a7 ,unfair or deceptive acts or practices ,a violation of a regulation promulgated under section #d7;a7 shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7b7 ,powers of ,commission 7#a7 ,in general ,except as provided in paragraph 7#c71 if the ,commission promulgates regulations under section #d7;a71 the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7#b7 ,privileges and immunities ,except as provided in paragraph 7#c71 any person who violates a regulation promulgated under section #d7;a7 shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,common carriers ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,commission1 if the ,commission promulgates regulations under section #d7;a71 the ,commission shall also enforce this ,act1 in the same manner provided in paragraphs 7#a7 and 7#b7 of this subsection1 with respect to common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and ,acts amendatory thereof and supplementary thereto4 7#d7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 #f4 ,effect on ,state laws ,this ,act1 including any regulations promulgated under section #d7;a71 shall supersede any provision of the law of a ,state relating to a covered provider that is subject to such a regulation1 to the extent that the provision relates to the maintenance of-- 7#a7 records covered by this ,act2 or 7#b7 any other personally identifiable information or personal identification information4