,,ii  #aaf? ,,congress  #a/ ,session    
,s4 #bcdb  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #cj1 #bjai ,mr4  
,pet]s 7= himself & ,ms4 ,mc,sally7     
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,comm]ce1 ,sci5ce1 & ,transportation  ,a
 ,,bill  ,to provide = requirem5ts =    
data brok]s ) respect to ! acquisition1 
use1 & protection ( brok]$ p]sonal      
in=mation & to require t data brok]s    
annually regi/] ) ! ,f$]al ,trade       
,commission4  #a4 ,%ort title  ,?is ,act
 may be cit$ z ! ,data ,brok] ,li/ ,act 
( #bjai4  #b4 ,requirem5ts = data brok]s
  7a7 ,requirem5ts ) respect to !       
acquisition & use ( brok]$ p]sonal      
in=mation ,a data brok] %all n-- 7#a7   
acquire brok]$ p]sonal in=mation ?r\gh  
fraudul5t means2  7#b7 acquire or use   
brok]$ p]sonal in=mation = ! purpose (--
 7,a7 /alk+ or h>ass+ ano!r p]son2  7,b7
 committ+ fraud1 includ+ id5tity !ft1   
f9ancial fraud1 or e-mail fraud2 or     
7,c7 engag+ 9 unlawful discrim9ation1   

includ+ unlawful discrim9ation 9        
decisions reg>d+ employm5t1 h\s+1 &     
cr$it eligibility2 or  7#c7 sell or     
transf] brok]$ p]sonal in=mation to a   
?ird p>ty if ! data brok] kn[s or       
reasonably %\ld "k t ! ?ird p>ty int5ds 
to engage 9 any conduct prohibit$ by ?is
 ,act4  7b7 ,duty ,to protect brok]$    
p]sonal in=mation  7#a7 ,9 g5]al ,a data
 brok] %all develop1 implem5t1 & ma9ta9 
a compreh5sive in=mation security       
program 9 ord] to protect f security    
brea*es or o!r inadv]t5t or improp]     
disclosure ! brok]$ p]sonal in=mation   
acquir$ by ! data brok]4  7#b7 ,program 
requirem5ts ,! compreh5sive in=mation   
security program requir$ "u p>agraph    
7#a7 %all-- 7,a7 be writt5 9 "o or m    
readily accessible p>ts2 &  7,b7 conta9 
adm9i/rative1 te*nical1 & physical      
safegu>ds t are appropriate to-- 7i7 !  
size1 scope1 & type ( bus9ess ( ! data  
brok]2  7ii7 ! am\nt ( res\rces         
available to ! data brok]2  7iii7 !     
am\nt ( /or$ data ( ! data brok]2 &     

7iv7 ! ne$ = security & confid5tiality (
 brok]$ p]sonal in=mation4  7c7 ,annual 
regi/ration  7#a7 ,9 g5]al ,annually1 on
 or be=e ,janu>y #ca1 a data brok]      
%all--  7,a7 regi/] ) ! ,commission2 &  
7,b7 provide ! foll[+ in=mation ) su*   
regi/ration3  7i7 ,! "n & prim>y        
physical1 e-mail1 & int]net addresses ( 
! data brok]4  7ii7 ,if ! data brok]    
p]mits a consum] to opt out ( ! data    
brok]'s collection ( brok]$ p]sonal     
in=mation1 opt out ( its databases1 or  
opt out ( c]ta9 sales ( data--  7,i7 !  
me?od = reque/+ an opt-out2  7,,ii7 if !
 opt-out applies to only c]ta9          
activities or sales1 :i* ones2 &        
7,,iii7 :e!r ! data brok] p]mits a      
consum] to au?orize a ?ird p>ty to p]=m 
! opt-out on ! consum]'s behalf4  7iii7 
,a /atem5t specify+ ! data collection1  
databases1 or sales activities f :i* a  
consum] may n opt out4  7iv7 ,a /atem5t 
z to :e!r ! data brok] implem5ts a      
pur*as] cr$5tial+ process4  7v7 ,! numb]
 ( security brea*es t ! data brok]      

exp]i5c$ dur+ ! previ\s ye>1 & if kn[n1 
! total numb] ( consum]s ^: p]sonal     
in=mation 0 access$1 d[nload$1 view$1 or
 o!rwise affect$ 9 a brea*4  7vi7 ,:]e !
 data brok] has actual k t x possesses !
 brok]$ p]sonal in=mation ( m9ors1 a    
sep>ate /atem5t detail+ ! data          
collection practices1 databases1 sales  
activities1 & opt-out policies t are    
applicable to ! brok]$ p]sonal in=mation
 ( m9ors4  7vii7 ,any additional        
in=mation or explanation ! data brok]   
*ooses to provide conc]n+ its data      
collection practices4  7#b7 ,exception  
,! requirem5ts "u p>agraph 7#a7 %all n  
apply to a data brok] t is already      
requir$ to comply ) su* requirem5ts )   
respect to ano!r ,f$]al ag5cy4  7#c7    
,public availability ,! ,commission %all
 make ! in=mation describ$ 9 p>agraph   
7#a7 available = public inspection1     
except z necess>y to protect ! integrity
 ( ongo+ inve/igations or to protect !  
privacy ( consum]s1 or if x is 9 !      
int]e/ ( public safety or welf>e4  #c4  

,en=cem5t by ! ,f$]al ,trade ,commission
  7a7 ,unfair or deceptive acts or      
practices ,a violation ( section #b %all
 be treat$ z a violation ( a rule def9+ 
an unfair or a deceptive act or practice
 "u section #ah7;a77#a77;,b7 ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#eg;a7a77#a77;,b774 ,! ,commission %all 
beg9 en=cem5t ( su* violations by n lat]
 ?an #a ye> aft] ! date ( ! enactm5t (  
?is ,act4  7b7 ,p[]s ( ,commission  7#a7
 ,9 g5]al ,! ,commission %all en=ce ?is 
section 9 ! same mann]1 by ! same means1
 & ) ! same jurisdiction1 p[]s1 & duties
 z ?\gh all applicable t]ms & provisions
 ( ! ,f$]al ,trade ,commission ,act 7#ae
 ,u4,s4,c4 #da et seq47 7 incorporat$   
into & made a "p ( ?is section4  7#b7   
,privileges & immunities ,any data brok]
 :o violates section #b %all be subject 
to ! p5alties & entitl$ to ! privileges 
& immunities provid$ 9 ! ,f$]al ,trade  
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq474  7#c7 ,au?ority pres]v$ ,no?+ 9  
?is section %all be con/ru$ to limit !  

au?ority ( ! ,f$]al ,trade ,commission  
"u any o!r provision ( law4  7c7        
,rulemak+ au?ority = ! ,f$]al ,trade    
,commission ,! ,commission %all h       
au?ority "u section #eec ( title #e1    
,unit$ ,/ates ,code1 to promulgate      
regulations ! ,commission det]m9es to be
 necess>y to c>ry out ! provisions ( ?is
 ,act4  #d4 ,,ftc annual review & report
  7a7 ,annual review ,! ,commission %all
 conduct an annual review ( !           
implem5tation ( ! provisions ( ?is ,act4
 ,su* /udy %all include an analysis (-- 
7#a7 compliance by data brok]s ) !      
requirem5ts "u section #b2  7#b7        
en=cem5t actions tak5 by ! ,commission )
 respect to violations ( su*            
requirem5ts2 &  7#c7 o!r areas det]m9$  
appropriate by ! ,commission4  7b7      
,annual report ,n lat] ?an #a ye> aft] !
 date ( ! enactm5t ( ?is ,act1 &        
annually !reaft] ! ,commission %all     
submit to ,congress a report on ! review
 conduct$ "u subsection 7a71 toge!r )   
recomm5dations = su* legislation &      

adm9i/rative action z ! ,commission     
det]m9es appropriate4  #e4 ,def9itions  
,9 ?is section3 7#a7 ,brok]$ p]sonal    
in=mation ,! t]m brok]$ p]sonal         
in=mation means any p]sonal in=mation t 
is categoriz$ or organiz$ = sale to a   
?ird p>ty4  7#b7 ,bus9ess  7,a7 ,9 g5]al
 ,! t]m bus9ess means a comm]cial       
entity1 includ+ a sole proprietor%ip1   
p>tn]%ip1 corporation1 association1     
limit$ liability company1 or o!r gr\p1  
h[ev] organiz$ & :e!r or n organiz$ to  
op]ate at a pr(it1 includ+ a f9ancial   
in/itution organiz$1 *>t]$1 or hold+ a  
lic5se or au?orization c]tificate "u !  
laws ( a ,/ate1 ! ,unit$ ,/ates1 or any 
o!r c\ntry1 or ! p>5t1 affiliate1 or    
subsidi>y ( a f9ancial in/itution4  7,b7
 ,exclusion ,! t]m bus9ess does n       
include a ,/ate1 a ,/ate ag5cy1 any     
political subdivision ( a ,/ate1 or a   
v5dor act+ solely on behalf (1 & at !   
direction (1 a ,/ate4  7#c7 ,commission 
,! t]m ,commission means ! ,f$]al ,trade
 ,commission4  7#d7 ,consum] ,! t]m     

consum] means an individual resid+ 9 !  
,unit$ ,/ates act+ 9 a p]sonal1 family1 
or h\sehold capacity4  7#e7 ,data brok] 
7,a7 ,9 g5]al ,! t]m data brok] means a 
bus9ess t collects or obta9s a consum]'s
 p]sonal in=mation & sells1 lic5ses1    
trades1 or provides = consid]ation t    
in=mation to ano!r bus9ess ) :om a      
consum] does n h a direct relation%ip4  
7,b7 ,direct relation%ip ,= purposes (  
subp>agraph 7,a71 a direct relation%ip )
 a bus9ess exi/s if ! consum]-- 7i7 is a
 curr5t cu/om]2  7ii7 obta9$ a good or  
s]vice f ! bus9ess )9 ! prior #ah mon?s2
 or  7iii7 made an inquiry ab\t !       
products or s]vices ( ! bus9ess )9 !    
prior #ij days4  7,c7 ,exclusion ,!     
foll[+ activities conduct$ by a bus9ess1
 & ! collection & sale or lic5s+ (      
brok]$ p]sonal in=mation incid5tal to   
conduct+ ^! activities1 d n qualify !   
bus9ess z a data brok]3  7i7 ,provid+   
#daa directory assi/ance or directory   
in=mation s]vices1 includ+ "n1 address1 
& telephone numb]1 on behalf ( or z a   

function ( a telecommunications c>ri]4  
7ii7 ,provid+ a consum]'s publicly      
available in=mation if ! in=mation is   
be+ us$ by ! recipi5t z x relates to t  
consum]'s bus9ess or pr(ession4  7iii7  
,provid+ publicly available in=mation   
via real-"t or ne>-real-"t al]t s]vices 
= heal? or safety purposes4  7iv7       
,provid+ or us+ in=mation 9 a mann] t is
 regulat$ "u ano!r ,f$]al law1 includ+ !
 ,fair ,cr$it ,report+ ,act1 !          
,gramm-,lea*-,bliley ,act1 or ! ,heal?  
,insurance ,portability & ,acc\ntability
 ,act4  7v7 ,provid+ data to a ?ird p>ty
 at ! direction ( ! cu/om] & ) !        
cu/om]'s cons5t4  7,d7 ,exclusion f sale
 ,= purposes ( ?is p>agraph1 ! t]m sells
 does n include a "o-"t or occasional   
sale ( assets ( a bus9ess z "p ( a      
transf] ( control ( ^? assets t is n "p 
( ! ord9>y conduct ( ! bus9ess4  7#f7   
,data brok] security brea*  7,a7 ,9     
g5]al ,! t]m data brok] security brea*  
means an unau?oriz$ acquisition or a    
reasonable belief ( an unau?oriz$       

acquisition ( m ?an "o elem5t ( brok]$  
p]sonal in=mation ma9ta9$ by a data     
brok] :5 ! brok]$ p]sonal in=mation is n
 encrypt$1 r$act$1 or protect$ by ano!r 
me?od t r5d]s ! in=mation unreadable or 
unusable by an unau?oriz$ data brok]4   
7,b7 ,exclusion ,! t]m data brok]       
security brea* does n include good fai? 
b unau?oriz$ acquisition ( brok]$       
p]sonal in=mation by an employee or ag5t
 ( ! data brok] = a legitimate purpose (
 ! data brok]1 provid$ t ! brok]$       
p]sonal in=mation is n us$ = a purpose  
unrelat$ to ! data brok]'s bus9ess or   
subject to fur!r unau?oriz$ disclosure4 
7,c7 ,application ,9 det]m9+ :e!r brok]$
 p]sonal in=mation has be5 acquir$ or is
 reasonably believ$ to h be5 acquir$ by 
a data brok] )\t valid au?orization1 a  
data brok] may consid] ! foll[+ factors1
 among o!rs3  7i7 ,indications t !      
brok]$ p]sonal in=mation is 9 ! physical
 possession & control ( a p]son )\t     
valid au?orization1 su* z a lo/ or /ol5 
comput] or o!r device conta9+ brok]$    

p]sonal in=mation4  7ii7 ,indications t 
! brok]$ p]sonal in=mation has be5      
d[nload$ or copi$4  7iii7 ,indications t
 ! brok]$ p]sonal in=mation 0 us$ by an 
unau?oriz$ data brok]1 su* z fraudul5t  
acc\nts op5$ or in/ances ( id5tity !ft  
report$4  7iv7 ,t ! brok]$ p]sonal      
in=mation has be5 made public4  7#g7    
,p]sonal in=mation ,! t]m p]sonal       
in=mation means in=mation :i* is relat$ 
to any id5tifi$ or id5tifiable p]son4   
7#h7 ,/ate ,! t]m ,/ate means any ,/ate 
( ! ,unit$ ,/ates1 ! ,di/rict (         
,columbia1 ! ,commonweal? ( ,pu]to      
,rico1 ,guam1 ,am]ican ,samoa1 !        
,commonweal? ( ,nor!rn ,m>iana ,isl&s1 &
 ! ,unit$ ,/ates ,virg9 ,isl&s4