,,ii #aafth ,,congress #ast ,session ,s4 #bcdb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #cj1 #bjai ,mr4 ,peters 7for himself and ,ms4 ,mc,sally7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to provide for requirements for data brokers with respect to the acquisition1 use1 and protection of brokered personal information and to require that data brokers annually register with the ,federal ,trade ,commission4 #a4 ,short title ,this ,act may be cited as the ,data ,broker ,list ,act of #bjai4 #b4 ,requirements for data brokers 7a7 ,requirements with respect to the acquisition and use of brokered personal information ,a data broker shall not-- 7#a7 acquire brokered personal information through fraudulent means2 7#b7 acquire or use brokered personal information for the purpose of-- 7,a7 stalking or harassing another person2 7,b7 committing fraud1 including identity theft1 financial fraud1 or e-mail fraud2 or 7,c7 engaging in unlawful discrimination1 including unlawful discrimination in decisions regarding employment1 housing1 and credit eligibility2 or 7#c7 sell or transfer brokered personal information to a third party if the data broker knows or reasonably should know that the third party intends to engage in any conduct prohibited by this ,act4 7b7 ,duty ,to protect brokered personal information 7#a7 ,in general ,a data broker shall develop1 implement1 and maintain a comprehensive information security program in order to protect from security breaches or other inadvertent or improper disclosure the brokered personal information acquired by the data broker4 7#b7 ,program requirements ,the comprehensive information security program required under paragraph 7#a7 shall-- 7,a7 be written in one or more readily accessible parts2 and 7,b7 contain administrative1 technical1 and physical safeguards that are appropriate to-- 7i7 the size1 scope1 and type of business of the data broker2 7ii7 the amount of resources available to the data broker2 7iii7 the amount of stored data of the data broker2 and 7iv7 the need for security and confidentiality of brokered personal information4 7c7 ,annual registration 7#a7 ,in general ,annually1 on or before ,january #ca1 a data broker shall-- 7,a7 register with the ,commission2 and 7,b7 provide the following information with such registration3 7i7 ,the name and primary physical1 e-mail1 and internet addresses of the data broker4 7ii7 ,if the data broker permits a consumer to opt out of the data broker's collection of brokered personal information1 opt out of its databases1 or opt out of certain sales of data-- 7,i7 the method for requesting an opt-out2 7,,ii7 if the opt-out applies to only certain activities or sales1 which ones2 and 7,,iii7 whether the data broker permits a consumer to authorize a third party to perform the opt-out on the consumer's behalf4 7iii7 ,a statement specifying the data collection1 databases1 or sales activities from which a consumer may not opt out4 7iv7 ,a statement as to whether the data broker implements a purchaser credentialing process4 7v7 ,the number of security breaches that the data broker experienced during the previous year1 and if known1 the total number of consumers whose personal information was accessed1 downloaded1 viewed1 or otherwise affected in a breach4 7vi7 ,where the data broker has actual knowledge that it possesses the brokered personal information of minors1 a separate statement detailing the data collection practices1 databases1 sales activities1 and opt-out policies that are applicable to the brokered personal information of minors4 7vii7 ,any additional information or explanation the data broker chooses to provide concerning its data collection practices4 7#b7 ,exception ,the requirements under paragraph 7#a7 shall not apply to a data broker that is already required to comply with such requirements with respect to another ,federal agency4 7#c7 ,public availability ,the ,commission shall make the information described in paragraph 7#a7 available for public inspection1 except as necessary to protect the integrity of ongoing investigations or to protect the privacy of consumers1 or if it is in the interest of public safety or welfare4 #c4 ,enforcement by the ,federal ,trade ,commission 7a7 ,unfair or deceptive acts or practices ,a violation of section #b shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 ,the ,commission shall begin enforcement of such violations by not later than #a year after the date of the enactment of this ,act4 7b7 ,powers of ,commission 7#a7 ,in general ,the ,commission shall enforce this section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this section4 7#b7 ,privileges and immunities ,any data broker who violates section #b shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,authority preserved ,nothing in this section shall be construed to limit the authority of the ,federal ,trade ,commission under any other provision of law4 7c7 ,rulemaking authority for the ,federal ,trade ,commission ,the ,commission shall have authority under section #eec of title #e1 ,united ,states ,code1 to promulgate regulations the ,commission determines to be necessary to carry out the provisions of this ,act4 #d4 ,,ftc annual review and report 7a7 ,annual review ,the ,commission shall conduct an annual review of the implementation of the provisions of this ,act4 ,such study shall include an analysis of-- 7#a7 compliance by data brokers with the requirements under section #b2 7#b7 enforcement actions taken by the ,commission with respect to violations of such requirements2 and 7#c7 other areas determined appropriate by the ,commission4 7b7 ,annual report ,not later than #a year after the date of the enactment of this ,act1 and annually thereafter the ,commission shall submit to ,congress a report on the review conducted under subsection 7a71 together with recommendations for such legislation and administrative action as the ,commission determines appropriate4 #e4 ,definitions ,in this section3 7#a7 ,brokered personal information ,the term brokered personal information means any personal information that is categorized or organized for sale to a third party4 7#b7 ,business 7,a7 ,in general ,the term business means a commercial entity1 including a sole proprietorship1 partnership1 corporation1 association1 limited liability company1 or other group1 however organized and whether or not organized to operate at a profit1 including a financial institution organized1 chartered1 or holding a license or authorization certificate under the laws of a ,state1 the ,united ,states1 or any other country1 or the parent1 affiliate1 or subsidiary of a financial institution4 7,b7 ,exclusion ,the term business does not include a ,state1 a ,state agency1 any political subdivision of a ,state1 or a vendor acting solely on behalf of1 and at the direction of1 a ,state4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,consumer ,the term consumer means an individual residing in the ,united ,states acting in a personal1 family1 or household capacity4 7#e7 ,data broker 7,a7 ,in general ,the term data broker means a business that collects or obtains a consumer's personal information and sells1 licenses1 trades1 or provides for consideration that information to another business with whom a consumer does not have a direct relationship4 7,b7 ,direct relationship ,for purposes of subparagraph 7,a71 a direct relationship with a business exists if the consumer-- 7i7 is a current customer2 7ii7 obtained a good or service from the business within the prior #ah months2 or 7iii7 made an inquiry about the products or services of the business within the prior #ij days4 7,c7 ,exclusion ,the following activities conducted by a business1 and the collection and sale or licensing of brokered personal information incidental to conducting these activities1 do not qualify the business as a data broker3 7i7 ,providing #daa directory assistance or directory information services1 including name1 address1 and telephone number1 on behalf of or as a function of a telecommunications carrier4 7ii7 ,providing a consumer's publicly available information if the information is being used by the recipient as it relates to that consumer's business or profession4 7iii7 ,providing publicly available information via real-time or near-real-time alert services for health or safety purposes4 7iv7 ,providing or using information in a manner that is regulated under another ,federal law1 including the ,fair ,credit ,reporting ,act1 the ,gramm-,leach-,bliley ,act1 or the ,health ,insurance ,portability and ,accountability ,act4 7v7 ,providing data to a third party at the direction of the customer and with the customer's consent4 7,d7 ,exclusion from sale ,for purposes of this paragraph1 the term sells does not include a one-time or occasional sale of assets of a business as part of a transfer of control of those assets that is not part of the ordinary conduct of the business4 7#f7 ,data broker security breach 7,a7 ,in general ,the term data broker security breach means an unauthorized acquisition or a reasonable belief of an unauthorized acquisition of more than one element of brokered personal information maintained by a data broker when the brokered personal information is not encrypted1 redacted1 or protected by another method that renders the information unreadable or unusable by an unauthorized data broker4 7,b7 ,exclusion ,the term data broker security breach does not include good faith but unauthorized acquisition of brokered personal information by an employee or agent of the data broker for a legitimate purpose of the data broker1 provided that the brokered personal information is not used for a purpose unrelated to the data broker's business or subject to further unauthorized disclosure4 7,c7 ,application ,in determining whether brokered personal information has been acquired or is reasonably believed to have been acquired by a data broker without valid authorization1 a data broker may consider the following factors1 among others3 7i7 ,indications that the brokered personal information is in the physical possession and control of a person without valid authorization1 such as a lost or stolen computer or other device containing brokered personal information4 7ii7 ,indications that the brokered personal information has been downloaded or copied4 7iii7 ,indications that the brokered personal information was used by an unauthorized data broker1 such as fraudulent accounts opened or instances of identity theft reported4 7iv7 ,that the brokered personal information has been made public4 7#g7 ,personal information ,the term personal information means information which is related to any identified or identifiable person4 7#h7 ,state ,the term ,state means any ,state of the ,united ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,commonwealth of ,northern ,mariana ,islands1 and the ,united ,states ,virgin ,islands4