,,ii #aafth ,,congress #ast ,session ,s4 #bcih ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ca1 #bjai ,mrs4 ,feinstein introduced the following bill2 which was read twice and referred to the ,committee on ,rules and ,administration ,a ,,bill ,to amend the ,federal ,election ,campaign ,act of #aiga to ensure privacy with respect to voter information4 #a4 ,short title ,this ,act may be cited as the ,voter ,privacy ,act of #bjai4 #b4 ,findings ,congress makes the following findings3 7#a7 ,according to the ,pew ,research ,center1 #ij percent of ,americans reported using the internet in #bjai1 which was an increase from #eb percent in #bjjj4 7#b7 ,internet service providers1 browsers1 websites1 search engines1 email providers1 device manufacturers1 and certain social media companies collect unique data on nearly every ,american's online and increasingly offline activities1 every day4 7#c7 ,one ,united ,states based search engine advertises its ability to track hundreds of categories of data about specific individuals including age1 gender1 occupation1 income level1 sexual orientation1 national origin1 religion1 medical conditions such as ,a,i,ds1 erectile dysfunction1 bipolar disorder1 eating disorders1 and sexually transmitted diseases1 family information such as number of children1 children with special needs1 infertility1 and substance misuse1 and support for social issues such as reproductive rights1 unions and labor issues1 and support for gun rights4 7#d7 ,targeting services1 such as certain large search engines and social media platforms1 maintain sophisticated data profiles on nearly every ,american4 ,these targeting services are used by third parties to target and deliver communications to specific individuals based on their sensitive personal information1 even if a third party does not control any individual's personal information4 7#e7 ,in testimony before the ,committee on the ,judiciary of the ,senate titled1 ,understanding ,digital ,advertising ,ecosystem and the ,impact on ,data ,privacy1 the ,committee received the following testimony regarding behavioral advertising3 almost every single time you visit a website3 data about you is broadcast to tens or hundreds of companies1 which lets advertisers compete for the opportunity to show you an ad4 ,advertising is necessary1 and this sounds ,,ok4 ,but wait until you hear what information about you is in that big broadcast3 it can include your - inferred sexual orientation1 political views1 whether you are ,christian1 ,jewish1 or ,muslim1 etc41 whether you have ,a,i,ds1 erectile dysfunction1 or bi-polar disorder4 ,it includes what you are reading1 watching1 and listening to4 ,it includes your location1 sometimes right up to your exact ,,gps coordinates4 ,and it includes unique ,,id codes that are as specific to you as is your social security number1 so that all of this data can be tied to you over time4 ,this allows companies you have never heard of to maintain intimate profiles on you1 and on everyone you have ever known44 7#f7 ,online surveillance techniques are becoming more sophisticated4 ,according to the ,center for ,information ,technology ,policy at ,princeton ,university1 new website tracking software can provide real-time surveillance of an individual's online activity3 ,unlike typical analytics services1 that provide aggregate statistics1 these scripts are intended for recording and playback of individual browsing sessions1 as if someone is looking over your shoulder44 7#g7 ,the volume of data now publicly available and attributable to a specific individual permits researchers to infer private information about that individual that the individual never disclosed publicly4 7#h7 ,according to a study from researchers at ,cambridge ,university and ,microsoft ,research1 an individual's social media posts1 pictures1 and profile information can be combined to reliably infer that individual's latent personality traits1 including openness1 conscientiousness1 extraversion1 agreeableness1 and neuroticism4 ,prior to internet-based data tracking1 the only way to obtain that type of sensitive psychological data would have been for an individual to elect to respond to a detailed personality questionnaire4 7#i7 ,according to a study published by the ,national ,academy of ,sciences1 computers can predict an individual's latent personality traits better than humans4 ,specifically1 researchers found that a computer needed only #aj social media impressions to better predict an individual's responses to a personality questionnaire than a coworker1 #gj for a cohabitant or friend1 #aej for a family member1 and #cjj for a spouse4 7#aj7 ,communications tailored to an individual's unique personality traits are designed to manipulate cognitive function rather than to persuade via appeals to rational decision making4 ,a forthcoming publication by ,julie ,e4 ,cohen titled ,between ,truth and ,power describes the phenomenon as follows ,the operation of the digital information environment has begun to mimic the operation of the collection of brain structures that mid-twentieth-century neurologists christened the limbic system and that play vital roles in a number of precognitive functions1 including emotion1 motivation1 and habit-formation1 and observed that today's networked information flows are optimized to produce what social psychologist ,shoshana ,zuboff calls instrumentarian power3 ,they employ a radical behaviorist approach to human psychology to mobilize and reinforce patterns of motivation1 cognition1 and behavior that operate on automatic1 near-instinctual levels and that may be manipulated instrumentally4 7#aa7 ,according to numerous studies1 messages tailored to an individual's unique personality traits are materially more effective at altering an individual's behavior4 7#ab7 ,a recent study published in the ,national ,academy of ,sciences found that it is possible to conduct psychological manipulation efforts online that are targeted and customized to each individual's unique personality traits on a national scale4 7#ac7 ,candidates1 campaigns1 and political organizations are increasingly using online data to infer personality traits and other psychological characteristics regarding specific ,united ,states persons1 using that nonpublic information to target psychologically manipulative communications and using algorithms and other automated processes to automatically refine communications over time to improve their effectiveness4 7#ad7 ,according to a study titled ,voter ,privacy in the ,age of ,big ,data1 political entities assemble a vast array of personally identifiable information into detailed dossiers on practically every ,american voter in order to target voters with individualized messages ''' ,most voters are ignorant of the steps taken to create these dossiers and know even less about related targeting practices44 7#ae7 ,the study further found that ,political databases hold records on almost #bjj million eligible ,american voters4 ,each records contains hundreds if not thousands of fields derived from voter rolls1 donor and response data1 campaign web data1 and consumer and other data obtained from data brokers1 all of which is combined into a giant assemblage ''' ,ubiquitous personal identifiers 7name1 address1 telephone numbers1 email addresses1 ,,ip addresses1 cookies1 mobile devices ,i,ds1 and other unique ,i,ds7 allow campaigns to link and integrate these diverse data sets1 while data mining and sophisticated statistical techniques allow them to engage in highly strategic and cost-effective analysis and targeting1 and that ,campaign insiders and paid consultants who not only view voter microtargeting as highly effective but also have assigned it a crucial role in determining the outcome of the past three presidential campaigns44 7#af7 ,the political consulting firm ,cambridge ,analytica reportedly used a database of #bbj1jjj1jjj ,americans1 including thousands of unique data points on each individual and inferred personality trait analysis1 to conduct psychological operations changing people's minds not through persuasion but through informational dominance1 a set of techniques that includes rumor1 disinformation and fake news4 ,cambridge ,analytica reportedly worked in #dd ,united ,states elections in #bjad and another #ej in #bjaf1 including on behalf of #b major ,presidential campaigns4 7#ag7 ,in ,sorrell v4 ,,ims ,health ,inc41 the ,supreme ,court invalidated a ,vermont ,state law regarding restrictions on the use of personal information as violating the ,first ,amendment4 ,the court held that the government's prohibition disfavored ''' speech with a particular content1 namely marketing1 and disfavored specific speakers1 namely pharmaceutical manufacturers because it interfered with the manufacturers' attempts to persuade recipients to use their products4 ,psychological targeting techniques seek to manipulate1 not to persuade4 7#ah7 ,in ,citizens ,united v4 ,,fec1 the ,supreme ,court invalidated the ,federal ,election ,campaign ,act's prohibition on corporate independent expenditures on the grounds that the ,first ,amendment does not allow political speech restrictions based on a speaker's corporate identity4 ,allowing individuals to control the use of their own personal information in the context of an election does not restrict the political speech of any person based on their identity4 7#ai7 ,in ,buckley v4 ,valeo1 the ,supreme ,court invalidated the ,federal ,election ,campaign ,act's expenditure limitations1 finding that they impose direct and substantial restraints on the quantity of political speech4 ,allowing individuals to control the use of their own personal information in the context of an election does not limit the any person's quantity of political speech4 #c4 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 the ,federal ,government has a compelling interest in protecting voters from surveillance and manipulation2 and 7#b7 the ,voter ,privacy ,act of #bjai is the most narrowly tailored approach to protecting voters from psychological manipulation online1 however the ,federal ,government's interest would justify additional prohibitions if this ,act is insufficient4 #d4 ,voter data privacy 7a7 ,in general ,title ,,iii of the ,federal ,election ,campaign ,act of #aiga 7#eb ,u4,s4,c4 #cjaja7 is amended by adding at the end the following new subtitle3 ,b ,privacy of ,voter's ,personal ,information #cea4 ,definitions ,in this subtitle3 7#a7 ,covered entity ,the term covered entity means-- 7,a7 any candidate1 political committee1 national committee1 connected organization1 or political party 7as those terms are defined in section #cja72 7,b7 any political organization under section #ebg of the ,internal ,revenue ,code of #aihf2 and 7,c7 any person that obtains an individual's personal information for the purpose of conducting-- 7i7 a public communication as defined in section #cja7bb71 except for purposes of this subtitle such term includes a communication by means of any paid internet or paid digital communication2 7ii7 an electioneering communication as defined in section #cjd7;f77#c72 7iii7 any communication that would be an electioneering communication as defined in such section if such section were applied-- 7,i7 by taking into account communications made over the internet2 7,,ii7 without regard to subparagraph 7,a77i77,,iii7 of such section with respect to communications described in subclause 7,i7 of this clause2 and 7,,iii7 by treating the facilities of any online or digital newspaper1 magazine1 blog1 publication1 or periodical in the same manner as the facilities of a broadcasting station for purposes of subparagraph 7,b77i7 of such section2 7iv7 an independent expenditure as defined in section #cja7ag72 or 7v7 a generic campaign activity as defined in section #cja7ba74 7#b7 ,targeting service ,the term targeting service means any interactive computer service1 as defined in section #bcj7;f77#b7 of the ,communications ,act of #aicd 7#db ,u4,s4,c4 #bcj7;f77#b771 that allows a third party to target communications to an individual based on that individual's personal information4 7#c7 ,individual ,the term individual means a natural person1 however identified1 including by any unique identifier4 7#d7 ,personal information 7,a7 ,in general ,subject to subparagraph 7,b71 the term personal information means information that identifies1 relates to1 describes1 is capable of being associated with1 or could reasonably be linked1 directly or indirectly1 with a particular individual or household that includes-- 7i7 identifiers such as internet protocol address1 email address1 account name1 social security number1 driver's license number1 passport number1 or other similar identifiers2 7ii7 characteristics of any protected class under title ,,vii of the ,civil ,rights ,act of #aifd 7#db ,u4,s4,c4 #bjjj;e et seq472 7iii7 commercial information1 including records of personal property1 products or services purchased1 obtained1 or considered1 or other purchasing or consuming histories or tendencies2 7iv7 biometric information2 7v7 internet or other electronic network activity information1 including browsing history1 search history1 and information regarding consumer's interaction with an internet website1 application1 or advertisement2 7vi7 geolocation data2 7vii7 health insurance information2 7viii7 audio1 electronic1 visual1 thermal1 olfactory1 or similar information2 7ix7 professional or employment-related information2 7x7 education information2 and 7xi7 inferences drawn from any of the information identified in this subparagraph to create a profile regarding an individual reflecting the individual's preferences1 characteristics1 psychological traits1 psychographic modeling1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 and aptitudes4 7,b7 ,exclusions 7i7 ,in general ,the term personal information does not include the following3 7,i7 ,publicly available information4 7,,ii7 ,deidentified information4 7,,iii7 ,aggregate polling information4 7ii7 ,definitions ,for purposes of clause 7i73 7,i7 ,publicly available information ,the term publicly available information means information obtained from a ,federal1 ,state1 or local voter registration database that is lawfully made available to the public4 7,,ii7 ,deidentified information ,the term deidentified information means information that cannot reasonably identify1 relate to1 describe1 be capable of being associated with1 or be linked1 directly or indirectly1 to a particular individual4 7,,iii7 ,aggregate polling information ,the term aggregate polling information means information that relates to a group or category of individuals1 from which individual identities have been removed1 that is not linked or reasonably linkable to any known individual1 including via a device or other unique identifier4 7#e7 ,biometric information ,the term biometric information means an individual's physiological1 biological1 or behavioral characteristics1 including an individual's deoxyribonucleic acid 7,,dna71 that can be used1 singly or in combination with each other or with other identifying data1 to establish individual identity4 ,biometric information includes imagery of the iris1 retina1 fingerprint1 face1 hand1 palm1 vein patterns1 and voice recordings1 from which an identifier template1 such as a faceprint1 a minutiae template1 or a voiceprint1 can be extracted1 and keystroke patterns or rhythms1 and sleep1 health1 or exercise data that contain identifying information4 7#f7 ,health insurance information ,the term health insurance information means an individual's insurance policy number or subscriber identification number1 any unique identifier used by a health insurer to identify a person1 or any information in the individual's application and claims history4 7#g7 ,categories of personal information ,the term categories of personal information means the enumerated categories of information described in clauses 7i7 through 7xi7 of paragraph 7#d77;,a71 except as modified pursuant to regulations or guidance of the ,commission pursuant to section #cei7;b74 7#h7 ,verifiable request ,the term verifiable request means a request made by an individual that a covered entity can reasonably verify1 pursuant to regulations adopted by the ,commission pursuant to section #cei1 to be the individual about whom the covered entity has collected information4 7#i7 ,collect or collected ,the terms collect or collected mean1 with respect to an individual1 any personal information that is gathered directly from that individual4 7#aj7 ,received ,the term received means any individual's personal information that is not collected by a covered entity directly from that individual1 including any personal information that is bought1 rented1 licensed1 acquired1 or accessed1 by a covered entity from any third party4 7#aa7 ,obtained ,the term obtained means any personal information that is either collected or received4 7#ab7 ,processing ,the term processing means any operation or set of operations that are performed on personal information or on sets of personal information1 whether or not by automated means4 7#ac7 ,third party ,the term third party means a person who is not-- 7,a7 the person that collects an individual's personal information directly from that individual2 or 7,b7 a person to whom a covered entity discloses an individual's personal information for processing pursuant to a written contract1 provided that the contract prohibits the person receiving the personal information from-- 7i7 selling or transferring the personal information to a third party2 or 7ii7 retaining1 using1 or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the written contract4 #ceb4 ,voter's right of access 7a7 ,in general ,an individual shall have the right to direct a covered entity that obtains an individual's personal information to disclose to that individual the categories of personal information and specific pieces of personal information the covered entity has obtained with respect to the individual4 7b7 ,requirement ,a covered entity that receives a verifiable request from an individual to access that individual's personal information pursuant to subsection 7a71 shall provide the requested information in accordance with subsection 7e74 7c7 ,verifiable request ,a covered entity shall provide the information specified in subsection 7a7 only upon receipt of a verifiable request4 7d7 ,timing ,a covered entity shall comply with all verifiable requests made pursuant to subsection 7a7 within a reasonable period after receiving such a request1 but not later than #aj calendar days after receiving such a request4 7e7 ,contents ,each request under subsection 7a71 with respect to the personal information of the requesting individual1 shall include the following3 7#a7 ,the categories of personal information obtained regarding that individual4 7#b7 ,the specific sources from which the personal information was obtained4 7#c7 ,the specific third party or third parties to whom the personal information has been transferred or disclosed4 7#d7 ,the period for which the personal information will be stored by the covered entity4 7#e7 ,the existence of the right of an individual to request a copy of that individual's specific pieces of personal information under subsection 7f74 7#f7 ,the existence of the right of an individual to request erasure of that individual's personal information under section #cec4 7#g7 ,the existence of the right to request prohibition of the transfer of personal information to any third party under section #ced4 7#h7 ,information regarding the right to lodge a complaint with the ,commission under section #cji7;a7 as described in section #cef regarding any potential violation of this subtitle4 7f7 ,specific pieces of personal information ,in addition to the information provided under subsection 7e71 upon specific1 verifiable request an individual shall have the right to access all of that individual's specific pieces of personal information obtained by a covered entity4 7g7 ,format ,a covered entity shall provide information as required under this section to the requesting individual in a concise1 and easily accessible form1 using clear and plain language4 ,the information required under this subsection may be delivered by mail or electronic mail1 or made available via a secured internet website4 7h7 ,cost ,a covered entity that receives a verifiable request from an individual shall provide information required under this section free of charge4 7i7 ,limitation ,a covered entity shall not be required to provide an individual's personal information to the individual pursuant to this section more than two times in a #ab-month period4 7j7 ,prohibition on third-,party requests ,no third party shall submit a verifiable request to a covered entity on behalf of another individual4 ,no individual may authorize a third party to submit a verifiable request to a covered entity on their behalf4 #cec4 ,voter's right of erasure 7a7 ,in general ,an individual shall have the right to direct a covered entity to delete any of that individual's personal information obtained by a covered entity4 7b7 ,requirement ,a covered entity that receives a verifiable request to delete an individual's personal information pursuant to subsection 7a7-- 7#a7 shall immediately cease processing such personal information1 and as soon as practicable1 permanently delete such information1 except as provided under subsections 7c71 7d71 and 7e72 and 7#b7 shall not1 unless the covered entity receives written authorization from the individual1 re-collect or otherwise obtain any of the individual's personal information1 except as provided under such subsections4 7c7 ,limitation ,the requirement to delete personal information in subsection 7b7 does not apply to publicly available information as defined in this subtitle4 7d7 ,records ,notwithstanding subsections 7a7 and 7b71 a covered entity shall maintain such personal information as is necessary to maintain adequate records of a request to delete information under subsection 7a7 or to comply with section #ceb7;e77#c7 and section #ced of this subtitle4 ,any personal information retained consistent with this subsection shall not be processed for any other purpose1 and shall be reviewable by the ,commission4 7e7 ,confirmation ,a covered entity shall provide confirmation to the individual requesting deletion of personal information under subsection 7a7 not later than #e days following the deletion of the information4 #ced4 ,voter's right to prohibit transfer 7a7 ,in general ,an individual shall have the right to direct a covered entity not to sell or otherwise transfer any of that individual's personal information obtained by a covered entity to any third party4 7b7 ,requirement ,a covered entity that receives a verifiable request from an individual not to transfer that individual's personal information pursuant to subsection 7a71 shall not transfer that personal information directly or indirectly to a third party4 7c7 ,notice ,a covered entity that seeks to sell or transfer an individual's personal information to any third party shall provide notice as required under section #cee7;b77#c74 7d7 ,records ,notwithstanding section #cec1 a covered entity shall retain sufficient records1 including any necessary personal information1 to determine whether an individual has directed the covered entity not to transfer that individual's data to a third party4 ,any personal information retained pursuant to this section shall not be used for any other purpose1 and shall be reviewable by the ,commission4 7e7 ,prohibition on transfer overseas 7#a7 ,offense ,it shall be unlawful for any covered entity to knowingly transfer outside of the ,united ,states any individual's personal information1 publicly available information1 or anonymized information as defined in this subtitle4 7#b7 ,penalty ,any person who violates paragraph 7#a7 shall be fined under title #ah1 ,united ,states ,code1 imprisoned not more than #c years1 or both4 #cee4 ,notice of receipt of voter's personal information 7a7 ,notice ,a covered entity that receives any individual's personal information from a third party shall inform such individual as to the scope and purpose of receiving such personal information4 7b7 ,timing ,a covered entity shall provide notice required in subsection 7a7 to an individual within a reasonable period after receiving that individual's personal information1 but not later than-- 7#a7 except as provided in paragraphs 7#b7 and 7#c71 #cj days after receiving such information1 or if personal information is received in an anonymized format then #cj days after the personal information is connected to an identifiable individual2 7#b7 if the personal information is to be used for a communication or targeted advertisement with an individual1 at the time of the first communication with that individual2 and 7#c7 if the personal information is to be transferred or sold to a third party1 #ad days prior to that transfer or sale4 7c7 ,contents ,notice required under subsection 7a7 shall include the following3 7#a7 ,the identity and the contact information of the covered entity4 7#b7 ,the categories of personal information received4 7#c7 ,the purposes for which the personal information was received4 7#d7 ,the period for which the personal information will be retained4 7#e7 ,the existence of the right to request from the covered entity access to all specific pieces of personal information under section #ceb7;f74 7#f7 ,the existence of the right of an individual to request erasure of all that individual's personal information obtained by a covered entity under section #cec4 7#g7 ,the existence of the right of an individual to prohibit the transfer of that individual's personal information to a third party under section #ced4 7#h7 ,information regarding the right to lodge a complaint with the ,commission under section #cji7;a7 as described in section #ceg regarding any violation of this subtitle4 7d7 ,format ,notice required under subsection 7a7 shall be provided in a concise and easily accessible form1 using clear and plain language4 7e7 ,cost ,notice required under subsection 7a7 shall be provided at no cost to any individual with respect to whom a covered entity has received personal information4 7f7 ,additional notice ,a covered entity shall not receive additional categories of personal information1 process personal information for an additional purpose1 or transfer personal information to an additional third party without providing such persons notice consistent with this section4 #cef4 ,voter's right to prohibit targeting based on personal information 7a7 ,in general ,an individual shall have the right to prohibit a targeting service from using that individual's personal information to deliver targeted communications to that individual-- 7#a7 on behalf of a covered entity2 and 7#b7 on behalf of all covered entities4 7b7 ,requirement ,a targeting service that receives a verifiable request pursuant to paragraph 7#a7 or 7#b7 of subsection 7a7-- 7#a7 shall immediately cease providing access1 use1 or processing of that individual's personal information to any or all covered entities with respect to which such request is made1 including for use in delivering targeted communications to that individual based on that individual's personal information2 and 7#b7 shall not provide any future access1 use1 or processing of that individual's personal information to any or all covered entities with respect to which such request is made1 including for use in delivering targeted communications to that individual based on their personal information without express written permission from that individual4 7c7 ,notice 7#a7 ,in general 7,a7 ,notice by covered entity ,a covered entity shall provide notice to a targeting service of the covered entity's status as a covered entity under this subtitle1 prior to accessing1 using1 or processing any individual's personal information provided by the targeting service4 7,b7 ,notice by targeting service ,a targeting service shall provide notice to any individual whose personal information is accessed1 used1 or processed1 including for use in delivering a targeted communication based on that individual's personal information1 by a covered entity4 7#b7 ,contents ,notice required under paragraph 7#a77;,b7 shall include-- 7,a7 the identity and the contact information for the targeting service2 7,b7 the identity and the contact information of the covered entity2 7,c7 the categories of personal information accessed1 used1 or otherwise made available to a covered entity1 including any personal information used to target an advertisement or other information to that individual on behalf of a covered entity2 and 7,d7 information on the right of an individual to prohibit a covered entity or all covered entities from using a targeting service to deliver advertisements or other information to that individual based on that individual's personal information under this section4 7#c7 ,timing ,notice required under paragraph 7#a77;,b7 shall be provided by a targeting service at the time of each targeted communication with an individual by the targeting service on behalf of a covered entity that is based on the individual's personal information4 7#d7 ,format ,notice required under paragraph 7#a77;,b7 shall be provided in a concise and easily accessible form1 using clear and plain language4 7d7 ,confirmation ,a targeting service shall provide confirmation of an individual's verifiable request to prohibit targeted communications from a covered entity or all covered entities based on that individual's personal information not later than #c days following receipt of a verifiable request from that individual pursuant to subsection 7a74 7e7 ,records 7#a7 ,targeting service ,a targeting service shall maintain adequate records of any individual's request under subsection 7a7 and1 if applicable1 any written permission provided under subsection 7b77#b7 to ensure such individuals do not receive targeted communications from a covered entity unless such written permission is provided4 7#b7 ,covered entity ,a covered entity shall maintain records of all notices provided to a targeting service as required under subsection 7c77#a77;,a74 7#c7 ,review ,all records required under this subsection shall be reviewable by the ,commission4 7f7 ,rule of construction ,nothing in this section shall be interpreted-- 7#a7 to prohibit a covered entity from using a targeting service to deliver information to an individual that is not based on that individual's personal information2 or 7#b7 to prohibit a targeting service from using an individual's personal information to deliver targeted communications to that individual on behalf of a third party that is not a covered entity4 #ceg4 ,right to lodge a complaint ,an individual who believes a violation of this subtitle has occurred may file a complaint with the ,commission pursuant to section #cji7;a74 #ceh4 ,enforcement ,any person who knowingly and willfully commits a violation of any provision of this subtitle shall be fined under this title or imprisoned not more than #c years1 or both4 #cei4 ,commission rulemaking 7a7 ,in general ,not later than #ahj days after the date of enactment of this subtitle1 the ,commission shall conduct a rulemaking to implement the requirements of this subtitle1 including to provide guidance on the definition of a verifiable request1 which will ensure individuals can exercise their rights under this subtitle in a secure manner4 7b7 ,updating as needed ,the ,commission shall produce and update as needed guidance and regulations relating to adding categories of personal information for purposes of this subtitle in addition to those described in section #cea7d77;,a71 in order to address changes in technology1 data practices of covered entities1 and privacy concerns4 4 7b7 ,severability ,if any provision of this ,act or amendment made by this ,act1 or the application of a provision or amendment to any person or circumstance1 is held to be unconstitutional1 the remainder of this ,act and amendments made by this ,act1 and the application of the provisions and amendment to any person or circumstance1 shall not be affected by the holding4 7c7 ,effective date ,the amendments made by this ,act shall apply with respect to personal information obtained1 stored1 or processed on or after #cfj days after the date of enactment of this ,act1 and shall take effect without regard to whether or not the ,federal ,election ,commission has promulgated regulations to carry out such amendments4