,,ii #aafth ,,congress #ast ,session ,s4 #bfcg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #ag1 #bjai,mr4 ,wyden introduced the following bill2 which was read twice and referred to the ,committee on ,finance ,a ,,bill ,to amend the ,federal ,trade ,commission ,act to establish requirements and responsibilities for entities that use1 store1 or share personal information1 to protect personal information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,mind ,your ,own ,business ,act of #bjai4 #b4 ,definitions ,in this ,act3 7#a7 ,automated decision system ,the term automated decision system means a computational process1 including one derived from machine learning1 statistics1 or other data processing or artificial intelligence techniques1 that makes a decision or facilitates human decision making1 that impacts consumers4 7#b7 ,automated decision system impact assessment ,the term automated decision system impact assessment means a study evaluating an automated decision system and the automated decision system's development process1 including the design and training data of the automated decision system1 for impacts on accuracy1 fairness1 bias1 discrimination1 privacy1 and security that includes1 at a minimum-- 7,a7 a detailed description of the automated decision system1 its design1 its training1 data1 and its purpose2 7,b7 an assessment of the relative benefits and costs of the automated decision system in light of its purpose1 taking into account relevant factors1 including-- 7i7 data minimization practices2 7ii7 the duration for which personal information and the results of the automated decision system are stored2 7iii7 what information about the automated decision system is available to consumers2 7iv7 the extent to which consumers have access to the results of the automated decision system and may correct or object to its results2 and 7v7 the recipients of the results of the automated decision system2 7,c7 an assessment of the risks posed by the automated decision system to the privacy or security of personal information of consumers and the risks that the automated decision system may result in or contribute to inaccurate1 unfair1 biased1 or discriminatory decisions impacting consumers2 and 7,d7 the measures the covered entity will employ to minimize the risks described in subparagraph 7,c71 including technological and physical safeguards4 7#c7 ,commission ,the term ,commission means ,federal ,trade ,commission4 7#d7 ,consumer ,the term consumer means an individual4 7#e7 ,covered entity ,the term covered entity-- 7,a7 means any person1 partnership1 or corporation over which the ,commission has jurisdiction under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 that-- 7i7 had greater than #ej1jjj1jjj in average annual gross receipts for the #c-taxable-year period preceding the most recent fiscal year1 as determined in accordance with paragraphs 7#b7 and 7#c7 of section #ddh7;c7 of the ,internal ,revenue ,code of #aihf2 7ii7 possesses or controls personal information on more than-- 7,i7 #a1jjj1jjj consumers2 or 7,,ii7 #a1jjj1jjj consumer devices2 7iii7 is substantially owned1 operated1 or controlled by a person1 partnership1 or corporation that meets the requirements under clauses 7i7 or 7ii72 or 7iv7 is a data broker or other commercial entity that1 as a substantial part of their business1 collects1 assembles1 or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell or trade the information or provide third-party access to the information4 7#f7 ,data protection impact assessment ,the term data protection impact assessment means a study evaluating the extent to which an information system protects the privacy and security of personal information the system processes4 7#g7 ,executive capacity ,the term executive capacity means an assignment within an organization in which the employee primarily-- 7,a7 directs the management of the organization or a major component or function of the organization2 7,b7 establishes the goals and policies of the organization1 component1 or function2 7,c7 exercises wide latitude in discretionary decision making2 and 7,d7 receives only general supervision or direction from higher level executives1 the board of directors1 or stockholders of the organization4 7#h7 ,high-risk automated decision system ,the term high-risk automated decision system means an automated decision system that-- 7,a7 taking into account the novelty of the technology used and the nature1 scope1 context1 and purpose of the automated decision system1 poses a significant risk-- 7i7 to the privacy or security of personal information of consumers2 or 7ii7 of resulting in or contributing to inaccurate1 unfair1 biased1 or discriminatory decisions impacting consumers2 7,b7 makes decisions1 or facilitates human decision making1 based on systematic and extensive evaluations of consumers1 including attempts to analyze or predict sensitive aspects of their lives1 such as their work performance1 economic situation1 health1 personal preferences1 interests1 behavior1 location1 or movements1 that-- 7i7 alter legal rights of consumers2 or 7ii7 otherwise significantly impact consumers2 7,c7 involves the personal information of a significant number of consumers regarding race1 color1 national origin1 political opinions1 religion1 trade union membership1 genetic data1 biometric data1 health1 gender1 gender identity1 sexuality1 sexual orientation1 criminal convictions1 or arrests2 7,d7 systematically monitors a large1 publicly accessible physical place2 or 7,e7 meets any other criteria established by the ,commission in regulations issued under section #g7;b77#a74 7#i7 ,high-risk information system ,the term high-risk information system means an information system that-- 7,a7 taking into account the novelty of the technology used and the nature1 scope1 context1 and purpose of the information system1 poses a significant risk to the privacy or security of personal information of consumers2 7,b7 involves the personal information of a significant number of consumers regarding race1 color1 national origin1 political opinions1 religion1 trade union membership1 genetic data1 biometric data1 health1 gender1 gender identity1 sexuality1 sexual orientation1 criminal convictions1 or arrests2 7,c7 systematically monitors a large1 publicly accessible physical place2 or 7,d7 meets any other criteria established by the ,commission in regulations issued under section #g7;b77#a74 7#aj7 ,information system ,the term information system-- 7,a7 means a process1 automated or not1 that involves personal information1 such as the collection1 recording1 organization1 structuring1 storage1 alteration1 retrieval1 consultation1 use1 sharing1 disclosure1 dissemination1 combination1 restriction1 erasure1 or destruction of personal information2 and 7,b7 does not include automated decision systems4 7#aa7 ,journalism ,the term journalism means the gathering1 preparing1 collecting1 photographing1 recording1 writing1 editing1 reporting1 or publishing of news or information that concerns local1 national1 or international events or other matters of public interest for dissemination to the public4 7#ab7 ,personal information ,the term personal information means any information1 regardless of how the information is collected1 inferred1 or obtained that is reasonably linkable to a specific consumer or consumer device4 7#ac7 ,share ,the term share-- 7,a7 means the actions of a person1 partnership1 or corporation transferring information to another person1 partnership1 or corporation2 and 7,b7 includes actions to knowingly-- 7i7 share1 exchange1 transfer1 sell1 lease1 rent1 provide1 disclose1 or otherwise permit access to information2 7ii7 enable or facilitate the collection of personal information by a third party2 or 7iii7 use personal information substantially at the direction of or substantially for the benefit of a third party4 7#ad7 ,store ,the term store-- 7,a7 means the actions of a person1 partnership1 or corporation to retain information2 and 7,b7 includes actions to store1 collect1 assemble1 possess1 control1 or maintain information4 7#ae7 ,third party ,the term third party means any person1 partnership1 or corporation that is not-- 7,a7 the person1 partnership1 or corporation1 whether a covered entity or not1 that is sharing the personal information2 7,b7 solely performing an outsourced function of the person1 partnership1 or corporation sharing the personal information if-- 7i7 the person1 partnership1 or corporation is contractually or legally prohibited from using1 storing1 or sharing the personal information after the conclusion of the outsourced function2 and 7ii7 the person1 partnership1 or corporation is complying with regulations promulgated under subparagraphs 7,a7 and 7,b7 of section #g7;b77#a71 regardless of whether the person1 partnership1 or corporation is a covered entity2 or 7,c7 a person1 partnership1 or corporation for whom the consumer gave opt-in consent for the covered entity to disclose the personal information of the consumer4 7#af7 ,use ,the term use means the actions of a person1 partnership1 or corporation in using information1 including actions to use1 process1 or access information4 #c4 ,noneconomic injury ,the first sentence of section #e7n7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7n77 is amended by inserting 1 including those involving noneconomic impacts and those creating a significant risk of unjustified exposure of personal information1 after cause substantial injury4 #d4 ,civil penalty authority ,section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in the fifth sentence1 by inserting 1 and it may1 in its discretion depending on the nature and severity of the violation1 include in the cease and desist order an assessment of a civil penalty1 which shall be not more than an amount that is the greater of #ej1jjj per violation1 taken as an aggregate sum of all violations1 and #d percent of the total annual gross revenue of the person1 partnership1 or corporation for the prior fiscal year before the period at the end2 7#b7 in subsection 7l7-- 7,a7 in the first sentence1 by striking of not more than #aj1jjj for each violation and inserting 1 which shall be not more than an amount that is the greater of #ej1jjj per violation1 taken as an aggregate sum of all violations1 and #d percent of the total annual gross revenue of the person1 partnership1 or corporation for the prior fiscal year2 and 7#c7 in subsection 7m77#a7-- 7,a7 in subparagraph 7,a71 in the second sentence1 by striking of not more than #aj1jjj for each violation and inserting 1 which shall be not more than an amount that is the greater of #ej1jjj per violation1 taken as an aggregate sum of all violations1 and #d percent of the total annual gross revenue of the person1 partnership1 or corporation for the prior fiscal year2 and 7,b7 in subparagraph 7,b71 in the matter following paragraph 7#b71 by striking of not more than #aj1jjj for each violation and inserting 1 which shall be not more than an amount that is the greater of #ej1jjj per violation1 taken as an aggregate sum of all violations1 and #d percent of the total annual gross revenue of the person1 partnership1 or corporation for the prior fiscal year4 #e4 ,annual data protection reports 7a7 ,reports 7#a7 ,in general ,each covered entity that has not less than #a1jjj1jjj1jjj per year in revenue and stores1 shares1 or uses personal information on more than #a1jjj1jjj consumers or consumer devices or any covered entity that stores1 shares1 or uses personal information on more than #ej1jjj1jjj consumers or consumer devices shall submit to the ,commission an annual data protection report describing in detail whether1 during the reporting period1 the covered entity complied with the regulations promulgated in accordance with subparagraphs 7,a7 and 7,b7 of section #g7;b77#a74 ,to the extent that the covered entity did not comply with these regulations1 this statement shall include a description of which regulations were violated and the number of consumers whose personal information was impacted4 7#b7 ,regulations ,not later than #b years after the date of enactment of this ,act1 the ,federal ,trade ,commission shall promulgate regulations in accordance with section #eec of title #e1 ,united ,states ,code1 carrying out this subsection4 7b7 ,failure of corporate officers ,to certify privacy and data security reports 7#a7 ,in general ,chapter #fc of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #aceb4 ,failure of corporate officers to certify data protection reports 7a7 ,definitions ,in this section3 7#a7 ,covered entity ,the term covered entity has the meaning given the term in section #b of the ,mind ,your ,own ,business ,act of #bjai4 7#b7 ,willfully ,the term willfully means the voluntary1 intentional violation of a known legal duty4 7b7 ,certification of annual data protection reports ,each annual report filed by a company with the ,federal ,trade ,commission pursuant to section #e7;a7 of the ,mind ,your ,own ,business ,act of #bjai shall be accompanied by a written statement by the chief executive officer and chief privacy officer 7or equivalent thereof7 of the company4 7c7 ,content ,the statement required under subsection 7b7 shall certify that the annual report fully complies with the requirements of section #e7;a7 of the ,mind ,your ,own ,business ,act of #bjai4 7d7 ,criminal penalties ,whoever-- 7#a7 certifies any statement as set forth in subsections 7b7 and 7c7 of this section knowing that the annual report accompanying the statement does not comport with all the requirements set forth in this section shall be fined not more than the greater of #a1jjj1jjj or #e percent of the largest amount of annual compensation the person received during the previous #c-year period from the covered entity1 imprisoned not more than #aj years1 or both2 or 7#b7 willfully certifies any statement as set forth in subsections 7b7 and 7c7 of this section knowing that the annual report accompanying the statement does not comport with all the requirements set forth in this section shall be fined not more than #e1jjj1jjj or #be percent of the largest amount of annual compensation the person received during the previous #c-year period from the covered entity1 imprisoned not more than #bj years1 or both4 4 7#b7 ,technical and conforming amendment ,the table of sections for chapter #fc of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #aceb4 ,failure of corporate officers to certify data protection reports4 4 #f4 ,do not track data sharing opt out 7a7 ,regulations ,not later than #b years after the date of enactment of this ,act1 the ,commission shall promulgate regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 to-- 7#a7 implement and maintain a ,do ,not ,track data sharing opt-out website-- 7,a7 that allows consumers to opt out of data sharing with #a click after the consumer is logged into the website1 view their opt-out status1 and change their opt-out status2 7,b7 the effect of which opt out is to prevent-- 7i7 covered entities from sharing the personal information of the consumer with third parties1 including personal information shared with or stored by the covered entity prior to the opt out unless-- 7,i7 the sharing is necessary for the primary purpose for which the consumer provided the personal information2 and 7,,ii7 the third party with whom the personal information was shared does not retain or use the personal information for secondary purposes2 and 7ii7 covered entities from storing or using personal information of the consumer that has been shared with them by non-covered entities1 not including personal information shared with or stored by the covered entity prior to the opt out2 7,c7 that is reasonably accessible and usable by consumers2 and 7,d7 that enables consumers to make use of the features described in subparagraph 7,a7 through an ,application ,programming ,interface2 7#b7 as part of the implementation of the opt-out website described in paragraph 7#a7-- 7,a7 maintain a record of the opt-out status of consumers enrolled through the opt-out website1 including the date and time when the consumer opted out2 7,b7 enable consumers to convey their opt-out status to covered entities in #a or more privacy-protecting ways through technological means determined by the ,commission1 such as through a consumer's web browser or operating system2 7,c7 enable covered entities to determine whether a particular consumer is enrolled in the opt-out website in a privacy-preserving way that does not result in the disclosure of any personal information other than a consumer's opt-out status to that covered entity2 and 7,d7 enable covered entities to make use of the mechanism described in subparagraph 7,c7 through an ,application ,programming ,interface1 for which the ,commission may charge a reasonable fee to cover the costs of operating the opt-out registry and access to the system2 7#c7 require that a covered entity be bound by the opt out of a consumer when the opt out is conveyed through the opt-out website implemented and maintained by the ,commission-- 7,a7 immediately for new customers2 and 7,b7 within #cj days for existing customers or consumers who are not customers1 unless1 after the consumer has opted out in the manner described in paragraph 7#a77;,a71 the covered entity receives1 in accordance with the procedures described in paragraph 7#aj71 consent from the consumer to not be bound by the consumer's opt out2 7#d7 require covered entities that store or use personal data on consumers with which they-- 7,a7 do not have a direct relationship2 or 7,b7 otherwise do not have the ability to determine the consumer's opt-out preference through one of the technological means established pursuant to paragraph 7#b77;,b71 to make a good-faith effort to determine the consumer's opt-out status at least as frequently as determined by the ,commission1 through the ,application ,programming ,interface maintained by the ,commission pursuant to paragraph 7#b77;,d72 7#e7 permit covered entities to not be bound by the consumer's opt out for-- 7,a7 disclosures made to the government that are either required or permitted by law2 7,b7 disclosures made pursuant to an order of a court or administrative tribunal2 7,c7 disclosures made in response to a subpoena1 discovery request1 or other lawful process provided that such process is accompanied by a protective order that-- 7i7 prohibits the parties from using or disclosing the personal information for any purpose other than the litigation or proceeding for which such personal information was requested2 and 7ii7 requires the return to the covered entity or destruction of the personal information 7including all copies made7 at the end of the litigation or proceeding2 or 7,d7 disclosures made to investigate1 protect themselves and their customers from1 or recover from fraud1 cyber attacks1 or other unlawful activity2 7#f7 establish standards and procedures1 including through an ,application ,programming ,interface1 for a covered entity to request1 not more frequently than once per calendar year unless a consumer is signing up for a product or service1 and obtain consent from a consumer who has opted out in the manner described in paragraph 7#a77;,a7 for the covered entity to not be bound by the opt out1 provided such standards and procedures-- 7,a7 require the covered entity to provide the consumer1 at the time the covered entity is seeking consent1 in accordance with paragraph 7#aj71 and in a form that is understandable to a reasonable consumer-- 7i7 a list of each third party with whom the personal information of the consumer will or may be shared by the covered entity2 7ii7 a description of the personal information of that consumer that will or may be shared2 and 7iii7 a description of the purposes for which the personal information of that consumer will or may be shared2 7,b7 if the covered entity requires consent as a condition for providing a product or service1 require the covered entity to-- 7i7 notify the consumer that he or she can obtain a substantially similar product or service in exchange for monetary payment or other compensation rather than by permitting the covered entity to share the consumer's personal information1 as provided in subsection 7b77#a77;,b72 and 7ii7 with respect to the notice described in clause 7i7-- 7,i7 make the notice in a clear and conspicuous manner2 and 7,,ii7 include the cost of the fee1 if any1 and instructions for obtaining the substantially similar product or service described in clause 7i72 7,c7 if the covered entity does not require consent as a condition for providing a product or service1 require the covered entity to clearly and conspicuously notify the consumer that the consumer may refuse to provide consent but still obtain the product or service2 and 7,d7 require the covered entity to notify the consumer of his or her right1 and how to exercise that right1 to later withdraw consent for the covered entity to not be bound by the consumer's opt out2 7#g7 not less frequently than every #b years1 examine the information that is presented to consumers in accordance with the procedures described in paragraph 7#f7 to make sure that the information is useful1 understandable1 and to the extent possible1 does not result in notification and consent fatigue2 7#h7 establish standards and procedures requiring that when a non-covered entity that is not the consumer shares personal information about that consumer with a covered entity1 the covered entity shall make reasonable efforts to verify the opt-out status of the consumer whose personal information has been shared with the covered entity1 after which the covered entity may only store or use that personal information for the benefit of the covered entity-- 7,a7 if the consumer has not opted out in the manner described in paragraph 7#b77;,a72 or 7,b7 7i7 if the non-covered entity knowingly enabled or facilitated the collection of personal information by the covered entity and the covered entity itself receives consent from the consumer to store or use the consumer's personal information in accordance with paragraph 7#i72 or 7ii7 if the non-covered entity otherwise shares the information with the covered entity and the consumer has given consent in accordance with paragraph 7#i7 to the covered entity or non-covered entity for the non-covered entity to share the consumer's personal information with the specific covered entity2 7#i7 establish standards and procedures for a person1 partnership1 or corporation to request and obtain consent from a consumer1 in accordance with paragraph 7#h77;,b7 that clearly identifies the covered entity that will be storing or using the personal information and provides the consumer1 at the time the person1 partnership1 or corporation is seeking consent1 in accordance with paragraph 7#aj71 and in a form that is understandable to a reasonable consumer-- 7,a7 the name and contact information of the person1 partnership1 or corporation from whom the personal information of that consumer is to be obtained2 7,b7 a description of the personal information of that consumer that will be shared2 and 7,c7 a description of the purposes for which the personal information of that consumer will be shared2 7#aj7 detail the standardized form and manner in which certain information related to sharing shall be disclosed to consumers1 which shall1 to the extent that the ,commission determines to be practicable and appropriate1 be in the form of a table that-- 7,a7 contains clear and concise headings for each item of such information2 and 7,b7 provides a clear and concise form for stating each item of information required to be disclosed under each such heading2 and 7#aa7 permit a consumer to withdraw his or her consent to a covered entity to not be bound by the consumer's opt out at any time1 including through an ,application ,programming ,interface4 7b7 ,acts prohibited 7#a7 ,in general ,it shall be unlawful for any covered entity to condition its products or services upon a requirement that consumers-- 7,a7 change their opt-out status through the opt-out website maintained by the ,commission pursuant to subsection 7a77#b72 or 7,b7 give the covered entity consent to not be bound by the consumer's opt-out status1 unless the consumer is also given an option to pay a fee to use a substantially similar service that is not conditioned upon a requirement that the consumer give the covered entity consent to not be bound by the consumer's opt-out status4 7#b7 ,fee 7,a7 ,disclosure ,each covered entity shall disclose to a consumer the amount of the fee described in paragraph 7#a77;,b71 including the amount that the covered entity-- 7i7 would have charged the consumer if the consumer had not opted out2 and 7ii7 the amount that the covered entity is charging to recoup the cost of providing service to low-income consumers4 7,b7 ,amount ,except as provided in subparagraph 7,c71 the fee described in paragraph 7#a77;,b7 shall not be greater than the amount of monetary gain the covered entity would have earned had the average consumer not opted out4 7,c7 ,exception ,no covered entity may charge a fee to any consumer that meets the requirements described in subsection 7a7 or 7b7 of section #ed4dji of title #dg1 ,code of ,federal ,regulations 7or successor regulation74 7,d7 ,rulemaking ,the ,commission may promulgate regulations to facilitate and ensure that covered entities are complying with subparagraph 7,c74 7c7 ,enforcement by the commission ,a violation of subsection 7b7 shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 #g4 ,data protection authority 7a7 ,acts prohibited ,it is unlawful for any covered entity to-- 7#a7 violate a regulation promulgated under subsection 7b72 or 7#b7 knowingly provide substantial assistance to any person1 partnership1 or corporation whose actions violate this ,act4 7b7 ,regulations 7#a7 ,in general ,not later than #b years after the date of enactment of this section1 the ,commission shall promulgate regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 that-- 7,a7 require each covered entity to establish and implement reasonable cyber security and privacy policies1 practices1 and procedures to protect personal information used1 stored1 or shared by the covered entity from improper access1 disclosure1 exposure1 or use2 7,b7 require each covered entity to implement reasonable physical1 technical1 and organizational measures to ensure that technologies or products used1 produced1 sold1 offered1 or leased by the covered entity that the covered entity knows or has reason to believe store1 process1 or otherwise interact with personal information are built and function consistently with reasonable data protection practices2 7,c7 require each covered entity to designate at least #a employee who reports directly to an employee acting in an executive capacity in the covered entity1 to coordinate its efforts to comply with and carry out its responsibilities under this ,act1 including any request or challenge related to the sharing of personal information2 7,d7 require each covered entity to provide once per calendar year1 at no cost1 not later than #cj business days after receiving a written request from a verified consumer about whom the covered entity stores personal information-- 7i7 a reasonable means to review any stored personal information of that verified consumer1 including the manner in which the information was collected and the date of collection1 in a form that is understandable to a reasonable consumer2 7ii7 a reasonable means to challenge the accuracy of any stored personal information of that verified consumer1 including-- 7,i7 by providing publicly accessible contact information for any employee responsible for overseeing such a challenge2 and 7,,ii7 implementing a reasonable process for responding to such challenges1 including the ability of the covered entity to terminate an investigation of information disputed by a consumer under this clause1 and providing notice to the consumer of such termination1 if the covered entity reasonably determines that the dispute by the consumer is frivolous or irrelevant1 including by reason of a failure by a consumer to provide sufficient information to investigate the disputed information2 7iii7 a list of each person1 partnership1 or corporation with whom the personal information of that verified consumer was shared by the covered entity that-- 7,i7 does not include-- 7aa7 disclosures to governmental entities pursuant to a court order or law that prohibits the covered entity from revealing that disclosure to the consumer2 7bb7 disclosures of personal information to third parties when the personal information of the consumer was made available to and readily accessible by the general public with the consent of the verified consumer and shared with the third party through a mechanism available to any member of the general public2 or 7cc7 disclosures of information about the verified consumer that the covered entity did not obtain from that consumer1 if revealing that disclosure of information would expose another consumer to likely harm2 and 7,,ii7 except as provided in subparagraph 7,i71 includes1 at a minimum-- 7aa7 the name and contact information of each person1 partnership1 or corporation with whom the personal information of that verified consumer was shared2 7bb7 a description of the personal information of that verified consumer that was shared1 in a form that is understandable to a reasonable consumer2 7cc7 a statement of the purposes for which the personal information of that verified consumer was shared2 7dd7 if the covered entity claims consent from the consumer as the basis for sharing1 a statement of the circumstances surrounding that consumer consent1 specifically when1 where1 and how the consent was obtained and by whom the consent was obtained2 and 7ee7 a statement of when the personal information of that verified consumer was shared2 and 7iv7 for any personal information about that verified consumer stored by the covered entity that the covered entity did not obtain directly from that verified consumer1 a list identifying-- 7,i7 the name and contact information of each person1 partnership1 or corporation from whom the personal information of that verified consumer was obtained2 7,,ii7 a description of the personal information1 in a form that is understandable to a reasonable consumer2 7,,iii7 a statement of the purposes for which the personal information of that verified consumer was obtained by the covered entity2 and 7,,iv7 a statement of the purposes for which the personal information of that verified consumer was shared with the covered entity2 7,e7 detail the standardized form and manner in which the information in subparagraph 7,d7 shall be disclosed to consumers which shall1 to the extent the ,commission determines to be practicable and appropriate1 be in the form of a table that-- 7i7 contains clear and concise headings for each item of information2 and 7ii7 provides a clear and concise form for stating each item of information required to be disclosed under each such heading2 7,f7 require each covered entity to correct the stored personal information of the verified consumer if1 after investigating a challenge by a verified consumer under subparagraph 7,d71 the covered entity determines that the personal information is inaccurate2 7,g7 require each covered entity to conduct automated decision system impact assessments of-- 7i7 existing high-risk automated decision systems1 as frequently as the ,commission determines is necessary2 and 7ii7 new high-risk automated decision systems1 prior to implementation1 provided that a covered entity may evaluate similar high-risk automated decision systems that present similar risks in a single assessment2 7,h7 require each covered entity to conduct data protection impact assessments of-- 7i7 existing high-risk information systems1 as frequently as the ,commission determines is necessary2 and 7ii7 new high-risk information systems1 prior to implementation1 provided that a covered entity may evaluate similar high-risk information systems that present similar risks in a single assessment2 7,i7 require each covered entity to conduct the impact assessments under subparagraphs 7,g7 and 7,h71 if reasonably possible1 in consultation with external third parties1 including independent auditors and independent technology experts2 and 7,j7 require each covered entity to reasonably address in a timely manner the results of the impact assessments under subparagraphs 7,g7 and 7,h74 7#b7 ,consultation ,the ,commission shall promulgate regulations under subparagraphs 7,a7 and 7,b7 of paragraph 7#a7 in consultation with the ,national ,institute of ,standards and ,technology4 7#c7 ,optional publication of impact assessments ,the impact assessments under subparagraphs 7,g7 and 7,h7 may be made public by the covered entity at its sole discretion4 7#d7 ,applicability ,the regulations promulgated under subparagraphs 7,d7 and 7,f7 of paragraph 7#a7 shall only apply to information stored by a covered entity for the covered entity and not on behalf of another entity4 7#e7 ,reasonable fee ,a covered entity may charge a consumer a reasonable fee to cover the cost of any additional request described in paragraph 7#a77;,d74 7c7 ,preemption of private contracts ,it shall be unlawful for any covered entity to commit the acts prohibited in subsection 7a71 regardless of specific agreements between entities or consumers4 7d7 ,enforcement by the commission 7#a7 ,unfair or deceptive acts or practices ,a violation of subsection 7a7 shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the commission 7,a7 ,in general ,the ,commission shall enforce this section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this section4 7,b7 ,privileges and immunities ,any person who violates subsection 7a7 shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this section shall be construed to limit the authority of the ,commission under any other provision of law4 7e7 ,enforcement by ,states 7#a7 ,in general ,if the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is being threatened or adversely affected by a practice that violates subsection 7a71 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief4 7#b7 ,rights of ,commission 7,a7 ,notice to ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state1 before initiating a civil action under paragraph 7#a71 shall provide written notification to the ,commission that the attorney general intends to bring such civil action4 7ii7 ,contents ,the notification required under clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required under clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which-- 7i7 the defendant is an inhabitant1 may be found1 or transacts business2 or 7ii7 venue is proper under section #acia of title #bh1 ,united ,states ,code4 7#e7 ,actions by other ,state officials 7,a7 ,in general ,in addition to a civil action brought by an attorney general of a ,state under paragraph 7#a71 any other officer of a ,state who is authorized by the attorney general of the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by ,state attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 7f7 ,right of action by protection and advocacy organizations 7#a7 ,in general ,a protection and advocacy organization designated under paragraph 7#c7 may bring a civil action against a covered entity that violates subsection 7a7 in an appropriate district court of the ,united ,states to obtain appropriate relief4 7#b7 ,grants 7,a7 ,in general ,of the fines collected by the ,commission1 the ,commission may award grants to protection and advocacy organizations designated under paragraph 7#c74 7,b7 ,allocation ,the ,commission shall distribute amounts under this paragraph on the basis of the ratio of the population of each ,state represented by a designated protection and advocacy organization to the population of all ,states represented by designated protection and advocacy organizations4 7#c7 ,designation ,each ,state may designate #a protection and advocacy organization to bring a civil action under paragraph 7#a74 #h4 ,bureau of ,technology 7a7 ,establishment ,there is established in the ,federal ,trade ,commission a bureau to be known as the ,bureau of ,technology 7referred to in this section as the ,bureau74 7b7 ,chief ,technologist ,the ,bureau shall be headed by a chief technologist1 who shall be appointed by the ,chairman of the ,commission4 7c7 ,staff 7#a7 ,in general ,except as provided in paragraph 7#b71 the ,director of the ,bureau may1 without regard to the civil service laws 7including regulations71 appoint and terminate #ej additional personnel with expertise in management1 technology1 digital design1 user experience1 product management1 software engineering1 and other related fields to technologist and management positions to enable the ,bureau to perform the duties of the ,bureau4 7#b7 ,excepted service ,not fewer than #dj of the additional personnel appointed under paragraph 7#a7 shall be appointed to positions described in section #bac4cajb7r7 of title #e1 ,code of ,federal ,regulations4 7d7 ,authorization of appropriations ,there is authorized to be appropriated to the ,bureau such sums as are necessary to carry out this section4 #i4 ,additional personnel in the ,bureau of ,consumer ,protection 7a7 ,in general ,notwithstanding any other provision of law1 the ,director of the ,bureau of ,consumer ,protection of the ,federal ,trade ,commission may1 without regard to the civil service laws 7including regulations71 appoint-- 7#a7 #ajj additional personnel in the ,division of ,privacy and ,identity ,protection of the ,bureau of ,consumer ,protection2 and 7#b7 #be additional personnel in the ,division of ,enforcement of the ,bureau of ,consumer ,protection4 7b7 ,authorization of appropriations ,there is authorized to be appropriated to the ,director of the ,bureau of ,consumer ,protection such sums as may be necessary to carry out this section4 #aj4 ,complaint resolution ,the ,commission shall create rules and guidance establishing procedures for the resolution of complaints by consumers regarding covered entities that improperly use1 store1 or share the personal information of consumers1 including procedures to-- 7#a7 properly process and store complaints2 7#b7 provide a consumer with email updates regarding the status of the consumer's complaint2 7#c7 create an online portal that allows a consumer to log in and track the status of the consumer's complaint2 7#d7 review and forward complaints to the correct person1 partnership1 corporation1 government agency1 or other entity2 and 7#e7 process and store each response from a person1 partnership1 corporation1 government agency1 or other entity to which a complaint was forwarded4 #aa4 ,application programming interfaces ,the ,commission shall1 in consultation with the ,national ,institute of ,standards and ,technology and relevant stakeholders1 including consumer advocates and independent technology experts-- 7#a7 standardize ,application ,programming ,interfaces necessary to permit consumers and covered entities to programmatically avail themselves of the rights and responsibilities created by this ,act2 7#b7 permit and enable consumers to securely delegate the ability to make requests on their behalf2 and 7#c7 require covered entities to implement the ,application ,programming ,interfaces1 as appropriate4 #ab4 ,news media protections ,covered entities engaged in journalism shall not be subject to the obligations imposed under this ,act to the extent that those obligations directly infringe on the journalism1 rather than the business practices1 of the covered entity4 #ac4 ,excise tax 7a7 ,in general ,subtitle ,d of the ,internal ,revenue ,code of #aihf is amended by adding at the end the following new chapter3 #ej;,a ,failure to certify data protection reports ,sec4 #ejjj;,d4 ,failure to certify data protection reports4 #ejjj;,d4 ,failure to certify data protection reports 7a7 ,imposition of tax ,in the case of any covered reporting entity with respect to which a responsible executive has been convicted under section #aceb7;d7 of title #ah1 ,united ,states ,code1 there is imposed a tax equal to the amount determined under subsection 7b74 7b7 ,amount of tax 7#a7 ,in general ,the amount determined under this subsection is the applicable percentage of the amount determined under paragraph 7#c74 7#b7 ,applicable percentage ,for purposes of paragraph 7#a71 the applicable percentage is-- 7,a7 in the case of a covered reporting entity that is a corporation1 the highest rate of tax in effect under section #aa for the taxable year which includes the date on which the specified annual data protection report to which the conviction relates is due1 and 7,b7 in the case of any other covered reporting entity1 the highest rate of tax in effect under section #a for such taxable year4 7#c7 ,amount determined 7,a7 ,in general ,the amount determined under this paragraph is the sum of the covered compensation amounts of each responsible executive of the covered reporting entity who has been convicted under section #aceb7;d7 of title #ah1 ,united ,states ,code4 7,b7 ,covered compensation amount ,for purposes of subparagraph 7,a71 the covered compensation amount with respect to any responsible executive is the largest amount of annual wages 7as defined in section #caba7;a71 determined without regard to any dollar limitation contained in such section7 of the responsible executive with respect to services performed for the covered reporting entity during the #c-year period preceding the year to which the specified annual data protection report relates4 7c7 ,definitions ,for purposes of this section-- 7#a7 ,covered reporting entity 7,a7 ,in general ,the term covered reporting entity means any covered entity 7as defined under section #b of the ,mind ,your ,own ,business ,act of #bjai7 which is required to file a specified annual data protection report4 7,b7 ,aggregation rules ,for purposes of this paragraph1 all covered entities who are treated as a single employer under subsection 7b71 7c71 7m71 or 7o7 of section #dad shall be treated as one person4 7#b7 ,responsible executive ,for purposes of this subsection1 the term responsible executive means1 with respect to a covered reporting entity1 any of the following officers3 7,a7 ,the chief executive officer4 7,b7 ,the chief privacy officer 7or equivalent thereof74 7#c7 ,specified annual data protection report ,the term specified annual data protection report means the report required to be filed under section #e7;a7 of the ,mind ,your ,own ,business ,act of #bjai4 4 7b7 ,clerical amendment ,the table of chapters for subtitle ,d of the ,internal ,revenue ,code of #aihf is amended by adding at the end the following new item3 ,chapter #ej;,a--,failure ,to certify data protection reports 4 #ad4 ,no preemption ,nothing in this ,act may be construed to preempt any ,state law4