,,ii #aafth ,,congress #ast ,session ,s4 #begg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bf1 #bjai,mr4 ,markey 7for himself1 ,mr4 ,blumenthal1 and ,ms4 ,smith7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require data brokers to establish procedures to ensure the accuracy of collected personal information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,broker ,accountability and ,transparency ,act of #bjai4 #b4 ,definitions ,in this ,act3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,covered data broker 7,a7 ,in general ,the term covered data broker includes all data brokers except those data brokers excepted under subparagraph 7,b74 7,b7 ,exceptions ,the ,commission may except a data broker if the ,commission considers1 by rule1 a data broker outside the scope of this ,act1 such as a data broker who processes information collected by or on behalf of and received from or on behalf of a nonaffiliated third party concerning an individual who is a customer or an employee of that third party to enable that third party1 directly or through parties acting on its behalf1 to provide benefits for its employees or directly transact business with its customers4 7#c7 ,data broker ,the term data broker means a commercial entity that collects1 assembles1 or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell the information or provide third party access to the information4 7#d7 ,personal information 7,a7 ,in general ,the term personal information means information that directly or indirectly identifies1 relates to1 describes1 is capable of being associated with1 or could reasonably be linked to1 a particular individual4 7,b7 ,examples ,the term personal information includes-- 7i7 an identifier such as a real name1 alias1 signature1 date of birth1 gender identity1 sexual orientation1 marital status1 physical characteristic or description1 postal address1 telephone number1 unique personal identifier1 military identification number1 online identifier1 ,internet ,protocol address1 email address1 account name1 mother's maiden name1 social security number1 driver's license number1 passport number1 or other similar identifier2 7ii7 information such as employment1 employment history1 bank account number1 credit card number1 debit card number1 insurance policy number1 or any other financial information1 medical information1 mental health information1 or health insurance information2 7iii7 commercial information1 including a record of personal property1 income1 assets1 leases1 rentals1 products or services purchased1 obtained1 or considered1 or other purchasing or consuming history2 7iv7 biometric information1 including a retina or iris scan1 fingerprint1 voiceprint1 or scan of hand or face geometry2 7v7 internet or other electronic network activity information1 including browsing history1 search history1 content1 including text1 photographs1 audio or video recordings1 or other user generated-content1 non-public communications1 and information regarding an individual's interaction with an internet website1 mobile application1 or advertisement2 7vi7 historical or real-time geolocation data2 7vii7 audio1 electronic1 visual1 thermal1 olfactory1 or similar information2 7viii7 education records1 as defined in section #ii4c of title #cd1 ,code of ,federal ,regulations1 or any successor regulation2 7ix7 political information or information on criminal convictions or arrests2 7x7 any required security code1 access code1 password1 or username necessary to permit access to the account of an individual2 7xi7 characteristics of protected classes under ,federal law1 including race1 color1 national origin1 religion1 sex1 age1 or disability2 or 7xii7 an inference drawn from any of the information described in this subparagraph to create a profile about an individual reflecting the individual's preferences1 characteristics1 psychological trends1 preferences1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 or aptitudes4 7,c7 ,exclusions 7i7 ,in general ,the term personal information does not include publicly available information4 7ii7 ,publicly available information ,for purposes of clause 7i71 the term publicly available information means information that is lawfully made available from ,federal1 ,state1 or local government records4 7#e7 ,public record information ,the term public record information means information about an individual that has been obtained originally from records of a ,federal1 ,state1 or local government entity that are available for public inspection4 #c4 ,prohibition on obtaining or solicitation to obtain personal information by false pretenses 7a7 ,in general ,a covered data broker may not obtain or attempt to obtain1 or cause to be disclosed or attempt to cause to be disclosed to any person1 personal information or any other information relating to any person by making a false1 fictitious1 or fraudulent statement or representation to any person1 including by providing any document to any person1 that the covered data broker knows or should know-- 7#a7 to be forged1 counterfeit1 lost1 stolen1 or fraudulently obtained2 or 7#b7 contains a false1 fictitious1 or fraudulent statement or representation4 7b7 ,solicitation ,a covered data broker may not request a person to obtain personal information1 or any other information1 relating to any other person if the covered data broker knows or should know that the person to whom the request is made will obtain or attempt to obtain that information in the manner described in subsection 7a74 #d4 ,requirements concerning accuracy of and access to personal information 7a7 ,accuracy 7#a7 ,in general ,except as provided in paragraph 7#b71 a covered data broker shall establish procedures to ensure1 to the maximum extent practicable1 the accuracy of-- 7,a7 the personal information the broker collects1 assembles1 or maintains2 and 7,b7 any other information the broker collects1 assembles1 or maintains that specifically identifies an individual1 unless the information only identifies the name or address of an individual4 7#b7 ,exception ,a covered data broker may collect or maintain information that may be inaccurate with respect to a particular individual if that information is being collected or maintained solely for the purpose of-- 7,a7 indicating whether there may be a discrepancy or irregularity in the personal information that is associated with an individual2 7,b7 helping to identify1 or to authenticate the identity of1 an individual2 or 7,c7 helping to protect against or investigate fraud or other unlawful conduct4 7b7 ,consumer access 7#a7 ,in general ,subject to paragraph 7#d71 a covered data broker shall provide an individual a means to review any personal information or other information that specifically identifies that individual1 that the covered data broker collects1 assembles1 or maintains on that individual4 7#b7 ,review requirements 7,a7 ,elements ,as part of the review described in paragraph 7#a71 a covered data broker shall provide a description of-- 7i7 the personal information being retained2 7ii7 each date on which the covered entity collected the personal information2 7iii7 the third parties to which the covered entity has disclosed or will disclose the personal information2 and 7iv7 if possible1 how long the personal information will be retained or stored1 or if not possible1 the criteria used for determining how long the personal information will be retained or stored4 7,b7 ,additional requirements ,a covered data broker shall provide the means for review under paragraph 7#a7-- 7i7 at the request of an individual2 7ii7 after verifying the identity of the individual2 7iii7 not less than #a time per year2 7iv7 at no cost to the individual2 and 7v7 in a format that can be readily understood by a consumer1 as determined by the ,commission4 7#c7 ,period of review ,a covered data broker shall provide an individual the means required under paragraph 7#a7 within such period after receiving a request from the individual as the ,commission shall determine1 by rule1 is appropriate4 7#d7 ,exceptions ,the ,commission may1 by rule1 establish any exceptions to paragraph 7#a7 that the ,commission considers appropriate1 such as for child protection1 law enforcement1 fraud prevention1 or other government purposes4 7#e7 ,limitation on use of verifying information ,if a covered data broker collects information from an individual to verify the identity of the individual under paragraph 7#b77;,b7 that the data broker did not have before that collection1 the data broker may not use the information for any purpose other than for purposes of verifying the identity of the individual under that paragraph4 7c7 ,disputed information 7#a7 ,in general ,an individual whose personal information is maintained by a covered data broker may dispute the accuracy of any information described under subsection 7b77#a7 by requesting1 in writing1 that the covered data broker correct the information4 7#b7 ,correction requirements ,a covered data broker1 after verifying the identity of an individual making a request under paragraph 7#a7 to correct information1 and unless there are reasonable grounds to believe the request is frivolous or irrelevant1 shall-- 7,a7 with regard to publicly available information-- 7i7 inform the individual of the source of the information and1 if reasonably available1 where to direct the request for correction2 or 7ii7 if the individual provides proof that the public record has been corrected or that the covered data broker was reporting the information incorrectly1 correct the inaccuracy in the records of the covered data broker2 and 7,b7 with regard to personal information-- 7i7 note the information that is disputed1 including the written request of the individual2 7ii7 if the information can be independently verified1 use the procedures established under subsection 7a7 to independently verify the information2 and 7iii7 if the covered data broker was reporting the information incorrectly1 correct the inaccuracy in the records of the covered data broker4 7#c7 ,period of correction ,if a covered data broker is subject to a requirement under paragraph 7#b7 due to a request made by an individual under paragraph 7#a71 the covered data broker shall take any action that may be required to satisfy the requirement within a period determined appropriate by the ,commission1 by rule4 7d7 ,notice 7#a7 ,in general ,a covered data broker shall maintain an internet website and place a clear and conspicuous notice on that internet website instructing an individual how-- 7,a7 to review information under subsection 7b77#a72 and 7,b7 to express a preference under subsection 7e77#b74 7#b7 ,form ,a covered data broker shall ensure that the notice the covered data broker places under paragraph 7#a7 conforms to a model form that the ,commission shall promulgate for purposes of this subsection4 7e7 ,certain marketing information 7#a7 ,in general ,a covered data broker may not use1 share1 or sell any information for marketing purposes that is subject to an expressed preference under paragraph 7#b74 7#b7 ,expression of preferences ,a covered data broker that maintains any information described under subsection 7a7 and that uses1 shares1 or sells that information for marketing purposes shall provide each individual whose information the covered data broker maintains with a reasonable means of expressing a preference not to have that individual's information used for those purposes4 7f7 ,auditing 7#a7 ,in general ,subject to paragraph 7#b71 a covered data broker shall establish measures that facilitate the auditing or retracing of any internal or external access to1 or transmission of1 any data containing personal information collected1 assembled1 or maintained by the covered data broker4 7#b7 ,exceptions ,the ,commission may establish1 by rule1 any exceptions to paragraph 7#a7 that the ,commission considers appropriate to further or protect law enforcement or national security activities4 7g7 ,security 7#a7 ,in general ,a covered data broker shall develop and implement a comprehensive consumer privacy and data security program to protect against harm that may be caused by-- 7,a7 loss of personal information collected1 assembled1 or maintained by the covered data broker2 or 7,b7 unauthorized access1 destruction1 use1 modification1 or disclosure of personal information described in subparagraph 7,a74 7#b7 ,notice ,if a covered data broker determines that personal information of an individual that is collected1 assembled1 or maintained by the covered data broker has been lost or the subject of unauthorized access1 destruction1 use1 modification1 or disclosure1 the covered data broker shall notify the individual of the loss1 access1 destruction1 use1 modification1 or disclosure4 7h7 ,persons regulated by the ,fair ,credit ,reporting ,act ,a covered data broker shall be considered to be in compliance with subsections 7a7 through 7f7 of this section with respect to information that is subject to the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq47 if the covered data broker is in compliance with sections #fji1 #faj1 and #faa of that ,act 7#ae ,u4,s4,c4 #afha;g1 #afha;h1 #afha;i74 #e4 ,use limitations 7a7 ,in general ,a covered data broker shall not use personal information for unreasonable purposes1 including-- 7#a7 selling1 leasing1 trading1 or otherwise profiting from an individual's biometric information2 7#b7 sharing1 resharing1 or otherwise disseminating an individual's biometric information without first obtaining specific consent from the individual1 unless-- 7,a7 the dissemination is required by ,state or ,federal law or municipal ordinance2 or 7,b7 the dissemination is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction2 7#c7 processing personal information for the purpose of advertising1 marketing1 soliciting1 offering1 selling1 leasing1 licensing1 renting1 or otherwise commercially contracting for employment1 finance1 healthcare1 credit1 insurance1 housing1 or education opportunities1 in a manner that discriminates against or otherwise makes the opportunity unavailable on the basis of a person's or class of persons' actual or perceived race1 color1 ethnicity1 religion1 national origin1 sex1 gender1 gender identity1 sexual orientation1 familial status1 biometric information1 lawful source of income1 or disability2 or 7#d7 processing personal information in a manner that segregates1 discriminates in1 or otherwise makes unavailable the goods1 services1 facilities1 privileges1 advantages1 or accommodations of any place of public accommodation on the basis of a person's or class of persons' actual or perceived race1 color1 ethnicity1 religion1 national origin1 sex1 gender1 gender identity1 sexual orientation1 or disability4 7b7 ,definition of place of public accommodation ,for purposes of subsection 7a71 the term place of public accommodation means-- 7#a7 any entity considered a place of public accommodation under section #bja7;b7 of the ,civil ,rights ,act of #aifd 7#db ,u4,s4,c4 #bjjj;a7b77 or section #cja of the ,americans with ,disabilities ,act of #aiij 7#db ,u4,s4,c4 #abaha72 and 7#b7 any entity that offers goods or services through the internet to the general public4 #f4 ,regulations 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to carry out this ,act4 7b7 ,elements ,the regulations promulgated under subsection 7a7 shall include the following3 7#a7 ,any exceptions the ,commission considers appropriate to promulgate under section #b7b77;,b74 7#b7 ,the period of review required under section #d7;b77#c74 7#c7 ,any exceptions the ,commission considers appropriate to promulgate under section #d7;b77#d74 7#d7 ,the period of correction required under section #d7;c77#c74 7#e7 ,the model form required by section #d7;d77#b74 7#f7 ,requirements for auditing under paragraph 7#a7 of section #d7;f7 and any exceptions under paragraph 7#b7 of that section that the ,commission considers appropriate4 7#g7 ,establishment of a centralized internet website for the benefit of consumers that-- 7,a7 lists the covered data brokers that are subject to a requirement of section #d2 and 7,b7 provides information to consumers about their rights under this ,act4 7#h7 ,any other regulations that the ,commission considers appropriate to carry out this ,act4 #g4 ,enforcement 7a7 ,enforcement by ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #c1 #d1 or #e or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of ,commission 7,a7 ,in general ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates a regulation prescribed under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7b7 ,enforcement by ,states 7#a7 ,civil action ,except as provided under paragraph 7#e71 in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any person subject to a provision of section #c1 #d1 or #e or a regulation promulgated under this ,act in a practice that violates that provision or regulation1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states-- 7,a7 to enjoin further violation of that provision or regulation by the person2 7,b7 to compel compliance with that provision or regulation2 7,c7 to obtain damages1 restitution1 or other compensation on behalf of the residents2 7,d7 to obtain any other relief that the court considers appropriate2 or 7,e7 to obtain civil penalties in the amount determined under paragraph 7#b74 7#b7 ,civil penalties 7,a7 ,calculation ,for purposes of imposing a civil penalty under paragraph 7#a77;,e71 the amount determined under this paragraph is the amount calculated by multiplying the number of separate violations of a rule by an amount not greater than #af1jjj4 7,b7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of enactment of this ,act1 and each year thereafter1 the amount specified in subparagraph 7,a7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7#c7 ,rights of ,federal ,trade ,commission 7,a7 ,notice to ,federal ,trade ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 before initiating the civil action4 7ii7 ,contents ,the notification required by clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,federal ,trade ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#d7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#e7 ,preemptive action by ,federal ,trade ,commission ,if the ,commission institutes a civil action or an administrative action with respect to a violation of a provision of section #c1 #d1 or #e or a regulation promulgated under this ,act1 the attorney general of a ,state may not1 during the pendency of the action1 bring a civil action under paragraph 7#a7 against any defendant named in the complaint of the ,commission for the violation with respect to which the ,commission instituted the action4 7#f7 ,actions by other ,state officials 7,a7 ,in general ,in addition to civil actions brought by attorneys general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #h4 ,effect on other laws 7a7 ,preservation of ,commission authority ,nothing in this ,act may be construed in any way to limit or affect the authority of the ,commission under any other provision of law4 7b7 ,preservation of other ,federal law ,nothing in this ,act may be construed in any way to supersede1 restrict1 or limit the application of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq47 or any other ,federal law4