,,ii #aaf? ,,congress #a/ ,session ,s4 #bfcg ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,octob] #ag1 #bjai,mr4 ,wyd5 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,f9ance ,a ,,bill ,to am5d ! ,f$]al ,trade ,commission ,act to e/abli% requirem5ts & responsibilities = entities t use1 /ore1 or %>e p]sonal in=mation1 to protect p]sonal in=mation1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,m9d ,y\r ,own ,bus9ess ,act ( #bjai4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,automat$ decision sy/em ,! t]m automat$ decision sy/em means a computational process1 includ+ "o d]iv$ f ma*9e le>n+1 /ati/ics1 or o!r data process+ or artificial intellig5ce te*niques1 t makes a decision or facilitates human decision mak+1 t impacts consum]s4 7#b7 ,automat$ decision sy/em impact assessm5t ,! t]m automat$ decision sy/em impact assessm5t means a /udy evaluat+ an automat$ decision sy/em & ! automat$ decision sy/em's developm5t process1 includ+ ! design & tra9+ data ( ! automat$ decision sy/em1 = impacts on accuracy1 fairness1 bias1 discrim9ation1 privacy1 & security t includes1 at a m9imum-- 7,a7 a detail$ description ( ! automat$ decision sy/em1 its design1 its tra9+1 data1 & its purpose2 7,b7 an assessm5t ( ! relative b5efits & co/s ( ! automat$ decision sy/em 9 light ( its purpose1 tak+ into acc\nt relevant factors1 includ+-- 7i7 data m9imization practices2 7ii7 ! duration = :i* p]sonal in=mation & ! results ( ! automat$ decision sy/em are /or$2 7iii7 :at in=mation ab\t ! automat$ decision sy/em is available to consum]s2 7iv7 ! ext5t to :i* consum]s h access to ! results ( ! automat$ decision sy/em & may correct or object to its results2 & 7v7 ! recipi5ts ( ! results ( ! automat$ decision sy/em2 7,c7 an assessm5t ( ! risks pos$ by ! automat$ decision sy/em to ! privacy or security ( p]sonal in=mation ( consum]s & ! risks t ! automat$ decision sy/em may result 9 or contribute to inaccurate1 unfair1 bias$1 or discrim9atory decisions impact+ consum]s2 & 7,d7 ! measures ! cov]$ entity w employ to m9imize ! risks describ$ 9 subp>agraph 7,c71 includ+ te*nological & physical safegu>ds4 7#c7 ,commission ,! t]m ,commission means ,f$]al ,trade ,commission4 7#d7 ,consum] ,! t]m consum] means an individual4 7#e7 ,cov]$ entity ,! t]m cov]$ entity-- 7,a7 means any p]son1 p>tn]%ip1 or corporation ov] :i* ! ,commission has jurisdiction "u section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 t-- 7i7 _h great] ?an #ej1jjj1jjj 9 av]age annual gross receipts = ! #c-taxable-ye> p]iod prec$+ ! mo/ rec5t fiscal ye>1 z det]m9$ 9 accordance ) p>agraphs 7#b7 & 7#c7 ( section #ddh7;c7 ( ! ,int]nal ,rev5ue ,code ( #aihf2 7ii7 possesses or controls p]sonal in=mation on m ?an-- 7,i7 #a1jjj1jjj consum]s2 or 7,,ii7 #a1jjj1jjj consum] devices2 7iii7 is sub/antially own$1 op]at$1 or controll$ by a p]son1 p>tn]%ip1 or corporation t meets ! requirem5ts "u clauses 7i7 or 7ii72 or 7iv7 is a data brok] or o!r comm]cial entity t1 z a sub/antial "p ( _! bus9ess1 collects1 assembles1 or ma9ta9s p]sonal in=mation conc]n+ an individual :o is n a cu/om] or an employee ( t entity 9 ord] to sell or trade ! in=mation or provide ?ird-p>ty access to ! in=mation4 7#f7 ,data protection impact assessm5t ,! t]m data protection impact assessm5t means a /udy evaluat+ ! ext5t to :i* an in=mation sy/em protects ! privacy & security ( p]sonal in=mation ! sy/em processes4 7#g7 ,executive capacity ,! t]m executive capacity means an assignm5t )9 an organization 9 :i* ! employee prim>ily-- 7,a7 directs ! managem5t ( ! organization or a major compon5t or function ( ! organization2 7,b7 e/abli%es ! goals & policies ( ! organization1 compon5t1 or function2 7,c7 ex]cises wide latitude 9 discretion>y decision mak+2 & 7,d7 receives only g5]al sup]vision or direction f high] level executives1 ! bo>d ( directors1 or /ockhold]s ( ! organization4 7#h7 ,high-risk automat$ decision sy/em ,! t]m high-risk automat$ decision sy/em means an automat$ decision sy/em t-- 7,a7 tak+ into acc\nt ! novelty ( ! te*nology us$ & ! nature1 scope1 context1 & purpose ( ! automat$ decision sy/em1 poses a significant risk-- 7i7 to ! privacy or security ( p]sonal in=mation ( consum]s2 or 7ii7 ( result+ 9 or contribut+ to inaccurate1 unfair1 bias$1 or discrim9atory decisions impact+ consum]s2 7,b7 makes decisions1 or facilitates human decision mak+1 bas$ on sy/ematic & ext5sive evaluations ( consum]s1 includ+ attempts to analyze or pr$ict s5sitive aspects ( _! lives1 su* z _! "w p]=mance1 economic situation1 heal?1 p]sonal pref]5ces1 int]e/s1 behavior1 location1 or movem5ts1 t-- 7i7 alt] legal rights ( consum]s2 or 7ii7 o!rwise significantly impact consum]s2 7,c7 involves ! p]sonal in=mation ( a significant numb] ( consum]s reg>d+ race1 color1 national orig91 political op9ions1 religion1 trade union memb]%ip1 g5etic data1 biometric data1 heal?1 g5d]1 g5d] id5tity1 sexuality1 sexual ori5tation1 crim9al convictions1 or arre/s2 7,d7 sy/ematically monitors a l>ge1 publicly accessible physical place2 or 7,e7 meets any o!r crit]ia e/abli%$ by ! ,commission 9 regulations issu$ "u section #g7;b77#a74 7#i7 ,high-risk in=mation sy/em ,! t]m high-risk in=mation sy/em means an in=mation sy/em t-- 7,a7 tak+ into acc\nt ! novelty ( ! te*nology us$ & ! nature1 scope1 context1 & purpose ( ! in=mation sy/em1 poses a significant risk to ! privacy or security ( p]sonal in=mation ( consum]s2 7,b7 involves ! p]sonal in=mation ( a significant numb] ( consum]s reg>d+ race1 color1 national orig91 political op9ions1 religion1 trade union memb]%ip1 g5etic data1 biometric data1 heal?1 g5d]1 g5d] id5tity1 sexuality1 sexual ori5tation1 crim9al convictions1 or arre/s2 7,c7 sy/ematically monitors a l>ge1 publicly accessible physical place2 or 7,d7 meets any o!r crit]ia e/abli%$ by ! ,commission 9 regulations issu$ "u section #g7;b77#a74 7#aj7 ,in=mation sy/em ,! t]m in=mation sy/em-- 7,a7 means a process1 automat$ or n1 t involves p]sonal in=mation1 su* z ! collection1 record+1 organization1 /ructur+1 /orage1 alt]ation1 retrieval1 consultation1 use1 %>+1 disclosure1 dissem9ation1 comb9ation1 re/riction1 erasure1 or de/ruction ( p]sonal in=mation2 & 7,b7 does n include automat$ decision sy/ems4 7#aa7 ,j\rnalism ,! t]m j\rnalism means ! ga!r+1 prep>+1 collect+1 photograph+1 record+1 writ+1 edit+1 report+1 or publi%+ ( news or in=mation t conc]ns local1 national1 or int]national ev5ts or o!r matt]s ( public int]e/ = dissem9ation to ! public4 7#ab7 ,p]sonal in=mation ,! t]m p]sonal in=mation means any in=mation1 reg>dless ( h[ ! in=mation is collect$1 inf]r$1 or obta9$ t is reasonably l9kable to a specific consum] or consum] device4 7#ac7 ,%>e ,! t]m %>e-- 7,a7 means ! actions ( a p]son1 p>tn]%ip1 or corporation transf]r+ in=mation to ano!r p]son1 p>tn]%ip1 or corporation2 & 7,b7 includes actions to kn[+ly-- 7i7 %>e1 ex*ange1 transf]1 sell1 lease1 r5t1 provide1 disclose1 or o!rwise p]mit access to in=mation2 7ii7 enable or facilitate ! collection ( p]sonal in=mation by a ?ird p>ty2 or 7iii7 use p]sonal in=mation sub/antially at ! direction ( or sub/antially = ! b5efit ( a ?ird p>ty4 7#ad7 ,/ore ,! t]m /ore-- 7,a7 means ! actions ( a p]son1 p>tn]%ip1 or corporation to reta9 in=mation2 & 7,b7 includes actions to /ore1 collect1 assemble1 possess1 control1 or ma9ta9 in=mation4 7#ae7 ,?ird p>ty ,! t]m ?ird p>ty means any p]son1 p>tn]%ip1 or corporation t is n-- 7,a7 ! p]son1 p>tn]%ip1 or corporation1 :e!r a cov]$ entity or n1 t is %>+ ! p]sonal in=mation2 7,b7 solely p]=m+ an outs\rc$ function ( ! p]son1 p>tn]%ip1 or corporation %>+ ! p]sonal in=mation if-- 7i7 ! p]son1 p>tn]%ip1 or corporation is contractually or legally prohibit$ f us+1 /or+1 or %>+ ! p]sonal in=mation aft] ! conclusion ( ! outs\rc$ function2 & 7ii7 ! p]son1 p>tn]%ip1 or corporation is comply+ ) regulations promulgat$ "u subp>agraphs 7,a7 & 7,b7 ( section #g7;b77#a71 reg>dless ( :e!r ! p]son1 p>tn]%ip1 or corporation is a cov]$ entity2 or 7,c7 a p]son1 p>tn]%ip1 or corporation = :om ! consum] gave opt-9 cons5t = ! cov]$ entity to disclose ! p]sonal in=mation ( ! consum]4 7#af7 ,use ,! t]m use means ! actions ( a p]son1 p>tn]%ip1 or corporation 9 us+ in=mation1 includ+ actions to use1 process1 or access in=mation4 #c4 ,noneconomic injury ,! fir/ s5t5ce ( section #e7n7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7n77 is am5d$ by ins]t+ 1 includ+ ^? involv+ noneconomic impacts & ^? creat+ a significant risk ( unju/ifi$ exposure ( p]sonal in=mation1 aft] cause sub/antial injury4 #d4 ,civil p5alty au?ority ,section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 is am5d$-- 7#a7 9 subsection 7b7-- 7,a7 9 ! fif? s5t5ce1 by ins]t+ 1 & x may1 9 its discretion dep5d+ on ! nature & sev]ity ( ! violation1 include 9 ! cease & desi/ ord] an assessm5t ( a civil p5alty1 :i* %all be n m ?an an am\nt t is ! great] ( #ej1jjj p] violation1 tak5 z an aggregate sum ( all violations1 & #d p]c5t ( ! total annual gross rev5ue ( ! p]son1 p>tn]%ip1 or corporation = ! prior fiscal ye> be=e ! p]iod at ! end2 7#b7 9 subsection 7l7-- 7,a7 9 ! fir/ s5t5ce1 by /rik+ ( n m ?an #aj1jjj = ea* violation & ins]t+ 1 :i* %all be n m ?an an am\nt t is ! great] ( #ej1jjj p] violation1 tak5 z an aggregate sum ( all violations1 & #d p]c5t ( ! total annual gross rev5ue ( ! p]son1 p>tn]%ip1 or corporation = ! prior fiscal ye>2 & 7#c7 9 subsection 7m77#a7-- 7,a7 9 subp>agraph 7,a71 9 ! second s5t5ce1 by /rik+ ( n m ?an #aj1jjj = ea* violation & ins]t+ 1 :i* %all be n m ?an an am\nt t is ! great] ( #ej1jjj p] violation1 tak5 z an aggregate sum ( all violations1 & #d p]c5t ( ! total annual gross rev5ue ( ! p]son1 p>tn]%ip1 or corporation = ! prior fiscal ye>2 & 7,b7 9 subp>agraph 7,b71 9 ! matt] foll[+ p>agraph 7#b71 by /rik+ ( n m ?an #aj1jjj = ea* violation & ins]t+ 1 :i* %all be n m ?an an am\nt t is ! great] ( #ej1jjj p] violation1 tak5 z an aggregate sum ( all violations1 & #d p]c5t ( ! total annual gross rev5ue ( ! p]son1 p>tn]%ip1 or corporation = ! prior fiscal ye>4 #e4 ,annual data protection reports 7a7 ,reports 7#a7 ,9 g5]al ,ea* cov]$ entity t has n less ?an #a1jjj1jjj1jjj p] ye> 9 rev5ue & /ores1 %>es1 or uses p]sonal in=mation on m ?an #a1jjj1jjj consum]s or consum] devices or any cov]$ entity t /ores1 %>es1 or uses p]sonal in=mation on m ?an #ej1jjj1jjj consum]s or consum] devices %all submit to ! ,commission an annual data protection report describ+ 9 detail :e!r1 dur+ ! report+ p]iod1 ! cov]$ entity compli$ ) ! regulations promulgat$ 9 accordance ) subp>agraphs 7,a7 & 7,b7 ( section #g7;b77#a74 ,to ! ext5t t ! cov]$ entity did n comply ) ^! regulations1 ?is /atem5t %all include a description ( :i* regulations 7 violat$ & ! numb] ( consum]s ^: p]sonal in=mation 0 impact$4 7#b7 ,regulations ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,f$]al ,trade ,commission %all promulgate regulations 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 c>ry+ out ?is subsection4 7b7 ,failure ( corporate (fic]s ,to c]tify privacy & data security reports 7#a7 ,9 g5]al ,*apt] #fc ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #aceb4 ,failure ( corporate (fic]s to c]tify data protection reports 7a7 ,def9itions ,9 ?is section3 7#a7 ,cov]$ entity ,! t]m cov]$ entity has ! mean+ giv5 ! t]m 9 section #b ( ! ,m9d ,y\r ,own ,bus9ess ,act ( #bjai4 7#b7 ,willfully ,! t]m willfully means ! volunt>y1 int5tional violation ( a kn[n legal duty4 7b7 ,c]tification ( annual data protection reports ,ea* annual report fil$ by a company ) ! ,f$]al ,trade ,commission pursuant to section #e7;a7 ( ! ,m9d ,y\r ,own ,bus9ess ,act ( #bjai %all be accompani$ by a writt5 /atem5t by ! *ief executive (fic] & *ief privacy (fic] 7or equival5t !re(7 ( ! company4 7c7 ,cont5t ,! /atem5t requir$ "u subsection 7b7 %all c]tify t ! annual report fully complies ) ! requirem5ts ( section #e7;a7 ( ! ,m9d ,y\r ,own ,bus9ess ,act ( #bjai4 7d7 ,crim9al p5alties ,:oev]-- 7#a7 c]tifies any /atem5t z set =? 9 subsections 7b7 & 7c7 ( ?is section kn[+ t ! annual report accompany+ ! /atem5t does n comport ) all ! requirem5ts set =? 9 ?is section %all be f9$ n m ?an ! great] ( #a1jjj1jjj or #e p]c5t ( ! l>ge/ am\nt ( annual comp5sation ! p]son receiv$ dur+ ! previ\s #c-ye> p]iod f ! cov]$ entity1 imprison$ n m ?an #aj ye>s1 or bo?2 or 7#b7 willfully c]tifies any /atem5t z set =? 9 subsections 7b7 & 7c7 ( ?is section kn[+ t ! annual report accompany+ ! /atem5t does n comport ) all ! requirem5ts set =? 9 ?is section %all be f9$ n m ?an #e1jjj1jjj or #be p]c5t ( ! l>ge/ am\nt ( annual comp5sation ! p]son receiv$ dur+ ! previ\s #c-ye> p]iod f ! cov]$ entity1 imprison$ n m ?an #bj ye>s1 or bo?4 4 7#b7 ,te*nical & con=m+ am5dm5t ,! table ( sections = *apt] #fc ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #aceb4 ,failure ( corporate (fic]s to c]tify data protection reports4 4 #f4 ,d n track data %>+ opt out 7a7 ,regulations ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 to-- 7#a7 implem5t & ma9ta9 a ,d ,n ,track data %>+ opt-out website-- 7,a7 t all[s consum]s to opt out ( data %>+ ) #a click aft] ! consum] is logg$ into ! website1 view _! opt-out /atus1 & *ange _! opt-out /atus2 7,b7 ! effect ( :i* opt out is to prev5t-- 7i7 cov]$ entities f %>+ ! p]sonal in=mation ( ! consum] ) ?ird p>ties1 includ+ p]sonal in=mation %>$ ) or /or$ by ! cov]$ entity prior to ! opt out unless-- 7,i7 ! %>+ is necess>y = ! prim>y purpose = :i* ! consum] provid$ ! p]sonal in=mation2 & 7,,ii7 ! ?ird p>ty ) :om ! p]sonal in=mation 0 %>$ does n reta9 or use ! p]sonal in=mation = second>y purposes2 & 7ii7 cov]$ entities f /or+ or us+ p]sonal in=mation ( ! consum] t has be5 %>$ ) !m by non-cov]$ entities1 n includ+ p]sonal in=mation %>$ ) or /or$ by ! cov]$ entity prior to ! opt out2 7,c7 t is reasonably accessible & usable by consum]s2 & 7,d7 t enables consum]s to make use ( ! features describ$ 9 subp>agraph 7,a7 ?r\gh an ,application ,programm+ ,int]face2 7#b7 z "p ( ! implem5tation ( ! opt-out website describ$ 9 p>agraph 7#a7-- 7,a7 ma9ta9 a record ( ! opt-out /atus ( consum]s enroll$ ?r\gh ! opt-out website1 includ+ ! date & "t :5 ! consum] opt$ out2 7,b7 enable consum]s to convey _! opt-out /atus to cov]$ entities 9 #a or m privacy-protect+ ways ?r\gh te*nological means det]m9$ by ! ,commission1 su* z ?r\gh a consum]'s web br[s] or op]at+ sy/em2 7,c7 enable cov]$ entities to det]m9e :e!r a p>ticul> consum] is enroll$ 9 ! opt-out website 9 a privacy-pres]v+ way t does n result 9 ! disclosure ( any p]sonal in=mation o!r ?an a consum]'s opt-out /atus to t cov]$ entity2 & 7,d7 enable cov]$ entities to make use ( ! me*anism describ$ 9 subp>agraph 7,c7 ?r\gh an ,application ,programm+ ,int]face1 = :i* ! ,commission may *>ge a reasonable fee to cov] ! co/s ( op]at+ ! opt-out regi/ry & access to ! sy/em2 7#c7 require t a cov]$ entity be b\nd by ! opt out ( a consum] :5 ! opt out is convey$ ?r\gh ! opt-out website implem5t$ & ma9ta9$ by ! ,commission-- 7,a7 imm$iately = new cu/om]s2 & 7,b7 )9 #cj days = exi/+ cu/om]s or consum]s :o are n cu/om]s1 unless1 aft] ! consum] has opt$ out 9 ! mann] describ$ 9 p>agraph 7#a77;,a71 ! cov]$ entity receives1 9 accordance ) ! proc$ures describ$ 9 p>agraph 7#aj71 cons5t f ! consum] to n be b\nd by ! consum]'s opt out2 7#d7 require cov]$ entities t /ore or use p]sonal data on consum]s ) :i* !y-- 7,a7 d n h a direct relation%ip2 or 7,b7 o!rwise d n h ! ability to det]m9e ! consum]'s opt-out pref]5ce ?r\gh "o ( ! te*nological means e/abli%$ pursuant to p>agraph 7#b77;,b71 to make a good-fai? ef=t to det]m9e ! consum]'s opt-out /atus at lea/ z frequ5tly z det]m9$ by ! ,commission1 ?r\gh ! ,application ,programm+ ,int]face ma9ta9$ by ! ,commission pursuant to p>agraph 7#b77;,d72 7#e7 p]mit cov]$ entities to n be b\nd by ! consum]'s opt out =-- 7,a7 disclosures made to ! gov]nm5t t are ei!r requir$ or p]mitt$ by law2 7,b7 disclosures made pursuant to an ord] ( a c\rt or adm9i/rative tribunal2 7,c7 disclosures made 9 response to a subpo5a1 discov]y reque/1 or o!r lawful process provid$ t su* process is accompani$ by a protective ord] t-- 7i7 prohibits ! p>ties f us+ or disclos+ ! p]sonal in=mation = any purpose o!r ?an ! litigation or proce$+ = :i* su* p]sonal in=mation 0 reque/$2 & 7ii7 requires ! return to ! cov]$ entity or de/ruction ( ! p]sonal in=mation 7includ+ all copies made7 at ! end ( ! litigation or proce$+2 or 7,d7 disclosures made to inve/igate1 protect !mselves & _! cu/om]s f1 or recov] f fraud1 cyb] attacks1 or o!r unlawful activity2 7#f7 e/abli% /&>ds & proc$ures1 includ+ ?r\gh an ,application ,programm+ ,int]face1 = a cov]$ entity to reque/1 n m frequ5tly ?an once p] cal5d> ye> unless a consum] is sign+ up = a product or s]vice1 & obta9 cons5t f a consum] :o has opt$ out 9 ! mann] describ$ 9 p>agraph 7#a77;,a7 = ! cov]$ entity to n be b\nd by ! opt out1 provid$ su* /&>ds & proc$ures-- 7,a7 require ! cov]$ entity to provide ! consum]1 at ! "t ! cov]$ entity is seek+ cons5t1 9 accordance ) p>agraph 7#aj71 & 9 a =m t is und]/&able to a reasonable consum]-- 7i7 a li/ ( ea* ?ird p>ty ) :om ! p]sonal in=mation ( ! consum] w or may be %>$ by ! cov]$ entity2 7ii7 a description ( ! p]sonal in=mation ( t consum] t w or may be %>$2 & 7iii7 a description ( ! purposes = :i* ! p]sonal in=mation ( t consum] w or may be %>$2 7,b7 if ! cov]$ entity requires cons5t z a condition = provid+ a product or s]vice1 require ! cov]$ entity to-- 7i7 notify ! consum] t he or %e c obta9 a sub/antially simil> product or s]vice 9 ex*ange = monet>y paym5t or o!r comp5sation r ?an by p]mitt+ ! cov]$ entity to %>e ! consum]'s p]sonal in=mation1 z provid$ 9 subsection 7b77#a77;,b72 & 7ii7 ) respect to ! notice describ$ 9 clause 7i7-- 7,i7 make ! notice 9 a cle> & conspicu\s mann]2 & 7,,ii7 include ! co/ ( ! fee1 if any1 & in/ructions = obta9+ ! sub/antially simil> product or s]vice describ$ 9 clause 7i72 7,c7 if ! cov]$ entity does n require cons5t z a condition = provid+ a product or s]vice1 require ! cov]$ entity to cle>ly & conspicu\sly notify ! consum] t ! consum] may refuse to provide cons5t b /ill obta9 ! product or s]vice2 & 7,d7 require ! cov]$ entity to notify ! consum] ( 8 or h] "r1 & h[ to ex]cise t "r1 to lat] )draw cons5t = ! cov]$ entity to n be b\nd by ! consum]'s opt out2 7#g7 n less frequ5tly ?an e #b ye>s1 exam9e ! in=mation t is pres5t$ to consum]s 9 accordance ) ! proc$ures describ$ 9 p>agraph 7#f7 to make sure t ! in=mation is useful1 und]/&able1 & to ! ext5t possible1 does n result 9 notification & cons5t fatigue2 7#h7 e/abli% /&>ds & proc$ures requir+ t :5 a non-cov]$ entity t is n ! consum] %>es p]sonal in=mation ab\t t consum] ) a cov]$ entity1 ! cov]$ entity %all make reasonable ef=ts to v]ify ! opt-out /atus ( ! consum] ^: p]sonal in=mation has be5 %>$ ) ! cov]$ entity1 aft] :i* ! cov]$ entity may only /ore or use t p]sonal in=mation = ! b5efit ( ! cov]$ entity-- 7,a7 if ! consum] has n opt$ out 9 ! mann] describ$ 9 p>agraph 7#b77;,a72 or 7,b7 7i7 if ! non-cov]$ entity kn[+ly enabl$ or facilitat$ ! collection ( p]sonal in=mation by ! cov]$ entity & ! cov]$ entity itself receives cons5t f ! consum] to /ore or use ! consum]'s p]sonal in=mation 9 accordance ) p>agraph 7#i72 or 7ii7 if ! non-cov]$ entity o!rwise %>es ! in=mation ) ! cov]$ entity & ! consum] has giv5 cons5t 9 accordance ) p>agraph 7#i7 to ! cov]$ entity or non-cov]$ entity = ! non-cov]$ entity to %>e ! consum]'s p]sonal in=mation ) ! specific cov]$ entity2 7#i7 e/abli% /&>ds & proc$ures = a p]son1 p>tn]%ip1 or corporation to reque/ & obta9 cons5t f a consum]1 9 accordance ) p>agraph 7#h77;,b7 t cle>ly id5tifies ! cov]$ entity t w be /or+ or us+ ! p]sonal in=mation & provides ! consum]1 at ! "t ! p]son1 p>tn]%ip1 or corporation is seek+ cons5t1 9 accordance ) p>agraph 7#aj71 & 9 a =m t is und]/&able to a reasonable consum]-- 7,a7 ! "n & contact in=mation ( ! p]son1 p>tn]%ip1 or corporation f :om ! p]sonal in=mation ( t consum] is to be obta9$2 7,b7 a description ( ! p]sonal in=mation ( t consum] t w be %>$2 & 7,c7 a description ( ! purposes = :i* ! p]sonal in=mation ( t consum] w be %>$2 7#aj7 detail ! /&>diz$ =m & mann] 9 :i* c]ta9 in=mation relat$ to %>+ %all be disclos$ to consum]s1 :i* %all1 to ! ext5t t ! ,commission det]m9es to be practicable & appropriate1 be 9 ! =m ( a table t-- 7,a7 conta9s cle> & concise head+s = ea* item ( su* in=mation2 & 7,b7 provides a cle> & concise =m = /at+ ea* item ( in=mation requir$ to be disclos$ "u ea* su* head+2 & 7#aa7 p]mit a consum] to )draw 8 or h] cons5t to a cov]$ entity to n be b\nd by ! consum]'s opt out at any "t1 includ+ ?r\gh an ,application ,programm+ ,int]face4 7b7 ,acts prohibit$ 7#a7 ,9 g5]al ,x %all be unlawful = any cov]$ entity to condition its products or s]vices ^u a requirem5t t consum]s-- 7,a7 *ange _! opt-out /atus ?r\gh ! opt-out website ma9ta9$ by ! ,commission pursuant to subsection 7a77#b72 or 7,b7 give ! cov]$ entity cons5t to n be b\nd by ! consum]'s opt-out /atus1 unless ! consum] is also giv5 an option to pay a fee to use a sub/antially simil> s]vice t is n condition$ ^u a requirem5t t ! consum] give ! cov]$ entity cons5t to n be b\nd by ! consum]'s opt-out /atus4 7#b7 ,fee 7,a7 ,disclosure ,ea* cov]$ entity %all disclose to a consum] ! am\nt ( ! fee describ$ 9 p>agraph 7#a77;,b71 includ+ ! am\nt t ! cov]$ entity-- 7i7 w\ld h *>g$ ! consum] if ! consum] _h n opt$ out2 & 7ii7 ! am\nt t ! cov]$ entity is *>g+ to rec\p ! co/ ( provid+ s]vice to l[-income consum]s4 7,b7 ,am\nt ,except z provid$ 9 subp>agraph 7,c71 ! fee describ$ 9 p>agraph 7#a77;,b7 %all n be great] ?an ! am\nt ( monet>y ga9 ! cov]$ entity w\ld h e>n$ _h ! av]age consum] n opt$ out4 7,c7 ,exception ,no cov]$ entity may *>ge a fee to any consum] t meets ! requirem5ts describ$ 9 subsection 7a7 or 7b7 ( section #ed4dji ( title #dg1 ,code ( ,f$]al ,regulations 7or successor regulation74 7,d7 ,rulemak+ ,! ,commission may promulgate regulations to facilitate & ensure t cov]$ entities are comply+ ) subp>agraph 7,c74 7c7 ,en=cem5t by ! commission ,a violation ( subsection 7b7 %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 #g4 ,data protection au?ority 7a7 ,acts prohibit$ ,x is unlawful = any cov]$ entity to-- 7#a7 violate a regulation promulgat$ "u subsection 7b72 or 7#b7 kn[+ly provide sub/antial assi/ance to any p]son1 p>tn]%ip1 or corporation ^: actions violate ?is ,act4 7b7 ,regulations 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is section1 ! ,commission %all promulgate regulations1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 t-- 7,a7 require ea* cov]$ entity to e/abli% & implem5t reasonable cyb] security & privacy policies1 practices1 & proc$ures to protect p]sonal in=mation us$1 /or$1 or %>$ by ! cov]$ entity f improp] access1 disclosure1 exposure1 or use2 7,b7 require ea* cov]$ entity to implem5t reasonable physical1 te*nical1 & organizational measures to ensure t te*nologies or products us$1 produc$1 sold1 (f]$1 or leas$ by ! cov]$ entity t ! cov]$ entity kn[s or has reason to believe /ore1 process1 or o!rwise int]act ) p]sonal in=mation are built & function consi/5tly ) reasonable data protection practices2 7,c7 require ea* cov]$ entity to designate at lea/ #a employee :o reports directly to an employee act+ 9 an executive capacity 9 ! cov]$ entity1 to coord9ate its ef=ts to comply ) & c>ry out its responsibilities "u ?is ,act1 includ+ any reque/ or *all5ge relat$ to ! %>+ ( p]sonal in=mation2 7,d7 require ea* cov]$ entity to provide once p] cal5d> ye>1 at no co/1 n lat] ?an #cj bus9ess days aft] receiv+ a writt5 reque/ f a v]ifi$ consum] ab\t :om ! cov]$ entity /ores p]sonal in=mation-- 7i7 a reasonable means to review any /or$ p]sonal in=mation ( t v]ifi$ consum]1 includ+ ! mann] 9 :i* ! in=mation 0 collect$ & ! date ( collection1 9 a =m t is und]/&able to a reasonable consum]2 7ii7 a reasonable means to *all5ge ! accuracy ( any /or$ p]sonal in=mation ( t v]ifi$ consum]1 includ+-- 7,i7 by provid+ publicly accessible contact in=mation = any employee responsible = ov]see+ su* a *all5ge2 & 7,,ii7 implem5t+ a reasonable process = respond+ to su* *all5ges1 includ+ ! ability ( ! cov]$ entity to t]m9ate an inve/igation ( in=mation disput$ by a consum] "u ?is clause1 & provid+ notice to ! consum] ( su* t]m9ation1 if ! cov]$ entity reasonably det]m9es t ! dispute by ! consum] is frivol\s or irrelevant1 includ+ by reason ( a failure by a consum] to provide suffici5t in=mation to inve/igate ! disput$ in=mation2 7iii7 a li/ ( ea* p]son1 p>tn]%ip1 or corporation ) :om ! p]sonal in=mation ( t v]ifi$ consum] 0 %>$ by ! cov]$ entity t-- 7,i7 does n include-- 7aa7 disclosures to gov]nm5tal entities pursuant to a c\rt ord] or law t prohibits ! cov]$ entity f reveal+ t disclosure to ! consum]2 7bb7 disclosures ( p]sonal in=mation to ?ird p>ties :5 ! p]sonal in=mation ( ! consum] 0 made available to & readily accessible by ! g5]al public ) ! cons5t ( ! v]ifi$ consum] & %>$ ) ! ?ird p>ty ?r\gh a me*anism available to any memb] ( ! g5]al public2 or 7cc7 disclosures ( in=mation ab\t ! v]ifi$ consum] t ! cov]$ entity did n obta9 f t consum]1 if reveal+ t disclosure ( in=mation w\ld expose ano!r consum] to likely h>m2 & 7,,ii7 except z provid$ 9 subp>agraph 7,i71 includes1 at a m9imum-- 7aa7 ! "n & contact in=mation ( ea* p]son1 p>tn]%ip1 or corporation ) :om ! p]sonal in=mation ( t v]ifi$ consum] 0 %>$2 7bb7 a description ( ! p]sonal in=mation ( t v]ifi$ consum] t 0 %>$1 9 a =m t is und]/&able to a reasonable consum]2 7cc7 a /atem5t ( ! purposes = :i* ! p]sonal in=mation ( t v]ifi$ consum] 0 %>$2 7dd7 if ! cov]$ entity claims cons5t f ! consum] z ! basis = %>+1 a /atem5t ( ! circum/ances surr\nd+ t consum] cons5t1 specifically :51 :]e1 & h[ ! cons5t 0 obta9$ & by :om ! cons5t 0 obta9$2 & 7ee7 a /atem5t ( :5 ! p]sonal in=mation ( t v]ifi$ consum] 0 %>$2 & 7iv7 = any p]sonal in=mation ab\t t v]ifi$ consum] /or$ by ! cov]$ entity t ! cov]$ entity did n obta9 directly f t v]ifi$ consum]1 a li/ id5tify+-- 7,i7 ! "n & contact in=mation ( ea* p]son1 p>tn]%ip1 or corporation f :om ! p]sonal in=mation ( t v]ifi$ consum] 0 obta9$2 7,,ii7 a description ( ! p]sonal in=mation1 9 a =m t is und]/&able to a reasonable consum]2 7,,iii7 a /atem5t ( ! purposes = :i* ! p]sonal in=mation ( t v]ifi$ consum] 0 obta9$ by ! cov]$ entity2 & 7,,iv7 a /atem5t ( ! purposes = :i* ! p]sonal in=mation ( t v]ifi$ consum] 0 %>$ ) ! cov]$ entity2 7,e7 detail ! /&>diz$ =m & mann] 9 :i* ! in=mation 9 subp>agraph 7,d7 %all be disclos$ to consum]s :i* %all1 to ! ext5t ! ,commission det]m9es to be practicable & appropriate1 be 9 ! =m ( a table t-- 7i7 conta9s cle> & concise head+s = ea* item ( in=mation2 & 7ii7 provides a cle> & concise =m = /at+ ea* item ( in=mation requir$ to be disclos$ "u ea* su* head+2 7,f7 require ea* cov]$ entity to correct ! /or$ p]sonal in=mation ( ! v]ifi$ consum] if1 aft] inve/igat+ a *all5ge by a v]ifi$ consum] "u subp>agraph 7,d71 ! cov]$ entity det]m9es t ! p]sonal in=mation is inaccurate2 7,g7 require ea* cov]$ entity to conduct automat$ decision sy/em impact assessm5ts (-- 7i7 exi/+ high-risk automat$ decision sy/ems1 z frequ5tly z ! ,commission det]m9es is necess>y2 & 7ii7 new high-risk automat$ decision sy/ems1 prior to implem5tation1 provid$ t a cov]$ entity may evaluate simil> high-risk automat$ decision sy/ems t pres5t simil> risks 9 a s+le assessm5t2 7,h7 require ea* cov]$ entity to conduct data protection impact assessm5ts (-- 7i7 exi/+ high-risk in=mation sy/ems1 z frequ5tly z ! ,commission det]m9es is necess>y2 & 7ii7 new high-risk in=mation sy/ems1 prior to implem5tation1 provid$ t a cov]$ entity may evaluate simil> high-risk in=mation sy/ems t pres5t simil> risks 9 a s+le assessm5t2 7,i7 require ea* cov]$ entity to conduct ! impact assessm5ts "u subp>agraphs 7,g7 & 7,h71 if reasonably possible1 9 consultation ) ext]nal ?ird p>ties1 includ+ indep5d5t auditors & indep5d5t te*nology exp]ts2 & 7,j7 require ea* cov]$ entity to reasonably address 9 a timely mann] ! results ( ! impact assessm5ts "u subp>agraphs 7,g7 & 7,h74 7#b7 ,consultation ,! ,commission %all promulgate regulations "u subp>agraphs 7,a7 & 7,b7 ( p>agraph 7#a7 9 consultation ) ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7#c7 ,optional publication ( impact assessm5ts ,! impact assessm5ts "u subp>agraphs 7,g7 & 7,h7 may be made public by ! cov]$ entity at its sole discretion4 7#d7 ,applicability ,! regulations promulgat$ "u subp>agraphs 7,d7 & 7,f7 ( p>agraph 7#a7 %all only apply to in=mation /or$ by a cov]$ entity = ! cov]$ entity & n on behalf ( ano!r entity4 7#e7 ,reasonable fee ,a cov]$ entity may *>ge a consum] a reasonable fee to cov] ! co/ ( any additional reque/ describ$ 9 p>agraph 7#a77;,d74 7c7 ,preemption ( private contracts ,x %all be unlawful = any cov]$ entity to commit ! acts prohibit$ 9 subsection 7a71 reg>dless ( specific agreem5ts betwe5 entities or consum]s4 7d7 ,en=cem5t by ! commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( subsection 7a7 %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,p[]s ( ! commission 7,a7 ,9 g5]al ,! ,commission %all en=ce ?is section 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is section4 7,b7 ,privileges & immunities ,any p]son :o violates subsection 7a7 %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,au?ority pres]v$ ,no?+ 9 ?is section %all be con/ru$ to limit ! au?ority ( ! ,commission "u any o!r provision ( law4 7e7 ,en=cem5t by ,/ates 7#a7 ,9 g5]al ,if ! attorney g5]al ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( ! ,/ate has be5 or is be+ ?reat5$ or adv]sely affect$ by a practice t violates subsection 7a71 ! attorney g5]al ( ! ,/ate may1 z p>5s patriae1 br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to obta9 appropriate relief4 7#b7 ,rights ( ,commission 7,a7 ,notice to ,commission 7i7 ,9 g5]al ,except z provid$ 9 clause 7iii71 ! attorney g5]al ( a ,/ate1 be=e initiat+ a civil action "u p>agraph 7#a71 %all provide writt5 notification to ! ,commission t ! attorney g5]al int5ds to br+ su* civil action4 7ii7 ,cont5ts ,! notification requir$ "u clause 7i7 %all include a copy ( ! compla9t to be fil$ to initiate ! civil action4 7iii7 ,exception ,if x is n feasible = ! attorney g5]al ( a ,/ate to provide ! notification requir$ "u clause 7i7 be=e initiat+ a civil action "u p>agraph 7#a71 ! attorney g5]al %all notify ! ,commission imm$iately ^u in/itut+ ! civil action4 7,b7 ,int]v5tion by ,commission ,! ,commission may-- 7i7 int]v5e 9 any civil action br\ght by ! attorney g5]al ( a ,/ate "u p>agraph 7#a72 & 7ii7 ^u int]v5+-- 7,i7 be he>d on all matt]s aris+ 9 ! civil action2 & 7,,ii7 file petitions = appeal ( a decision 9 ! civil action4 7#c7 ,inve/igatory p[]s ,no?+ 9 ?is subsection may be con/ru$ to prev5t ! attorney g5]al ( a ,/ate f ex]cis+ ! p[]s conf]r$ on ! attorney g5]al by ! laws ( ! ,/ate to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7#d7 ,v5ue2 s]vice ( process 7,a7 ,v5ue ,any action br\ght "u p>agraph 7#a7 may be br\ght 9-- 7i7 ! di/rict c\rt ( ! ,unit$ ,/ates t meets applicable requirem5ts relat+ to v5ue "u section #acia ( title #bh1 ,unit$ ,/ates ,code2 or 7ii7 ano!r c\rt ( compet5t jurisdiction4 7,b7 ,s]vice ( process ,9 an action br\ght "u p>agraph 7#a71 process may be s]v$ 9 any di/rict 9 :i*-- 7i7 ! def5dant is an inhabitant1 may be f\nd1 or transacts bus9ess2 or 7ii7 v5ue is prop] "u section #acia ( title #bh1 ,unit$ ,/ates ,code4 7#e7 ,actions by o!r ,/ate (ficials 7,a7 ,9 g5]al ,9 addition to a civil action br\ght by an attorney g5]al ( a ,/ate "u p>agraph 7#a71 any o!r (fic] ( a ,/ate :o is au?oriz$ by ! attorney g5]al ( ! ,/ate to d s may br+ a civil action "u p>agraph 7#a71 subject to ! same requirem5ts & limitations t apply "u ?is subsection to civil actions br\ght by ,/ate attorneys g5]al4 7,b7 ,sav+s provision ,no?+ 9 ?is subsection may be con/ru$ to prohibit an au?oriz$ (ficial ( a ,/ate f initiat+ or cont9u+ any proce$+ 9 a c\rt ( ! ,/ate = a violation ( any civil or crim9al law ( ! ,/ate4 7f7 ,"r ( action by protection & advocacy organizations 7#a7 ,9 g5]al ,a protection & advocacy organization designat$ "u p>agraph 7#c7 may br+ a civil action aga9/ a cov]$ entity t violates subsection 7a7 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to obta9 appropriate relief4 7#b7 ,grants 7,a7 ,9 g5]al ,( ! f9es collect$ by ! ,commission1 ! ,commission may aw>d grants to protection & advocacy organizations designat$ "u p>agraph 7#c74 7,b7 ,allocation ,! ,commission %all di/ribute am\nts "u ?is p>agraph on ! basis ( ! ratio ( ! population ( ea* ,/ate repres5t$ by a designat$ protection & advocacy organization to ! population ( all ,/ates repres5t$ by designat$ protection & advocacy organizations4 7#c7 ,designation ,ea* ,/ate may designate #a protection & advocacy organization to br+ a civil action "u p>agraph 7#a74 #h4 ,bureau ( ,te*nology 7a7 ,e/abli%m5t ,!re is e/abli%$ 9 ! ,f$]al ,trade ,commission a bureau to be kn[n z ! ,bureau ( ,te*nology 7ref]r$ to 9 ?is section z ! ,bureau74 7b7 ,*ief ,te*nologi/ ,! ,bureau %all be head$ by a *ief te*nologi/1 :o %all be appo9t$ by ! ,*airman ( ! ,commission4 7c7 ,/aff 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 ! ,director ( ! ,bureau may1 )\t reg>d to ! civil s]vice laws 7includ+ regulations71 appo9t & t]m9ate #ej additional p]sonnel ) exp]tise 9 managem5t1 te*nology1 digital design1 us] exp]i5ce1 product managem5t1 s(tw>e eng9e]+1 & o!r relat$ fields to te*nologi/ & managem5t positions to enable ! ,bureau to p]=m ! duties ( ! ,bureau4 7#b7 ,except$ s]vice ,n few] ?an #dj ( ! additional p]sonnel appo9t$ "u p>agraph 7#a7 %all be appo9t$ to positions describ$ 9 section #bac4cajb7r7 ( title #e1 ,code ( ,f$]al ,regulations4 7d7 ,au?orization ( appropriations ,!re is au?oriz$ to be appropriat$ to ! ,bureau su* sums z are necess>y to c>ry out ?is section4 #i4 ,additional p]sonnel 9 ! ,bureau ( ,consum] ,protection 7a7 ,9 g5]al ,not)/&+ any o!r provision ( law1 ! ,director ( ! ,bureau ( ,consum] ,protection ( ! ,f$]al ,trade ,commission may1 )\t reg>d to ! civil s]vice laws 7includ+ regulations71 appo9t-- 7#a7 #ajj additional p]sonnel 9 ! ,division ( ,privacy & ,id5tity ,protection ( ! ,bureau ( ,consum] ,protection2 & 7#b7 #be additional p]sonnel 9 ! ,division ( ,en=cem5t ( ! ,bureau ( ,consum] ,protection4 7b7 ,au?orization ( appropriations ,!re is au?oriz$ to be appropriat$ to ! ,director ( ! ,bureau ( ,consum] ,protection su* sums z may be necess>y to c>ry out ?is section4 #aj4 ,compla9t resolution ,! ,commission %all create rules & guidance e/abli%+ proc$ures = ! resolution ( compla9ts by consum]s reg>d+ cov]$ entities t improp]ly use1 /ore1 or %>e ! p]sonal in=mation ( consum]s1 includ+ proc$ures to-- 7#a7 prop]ly process & /ore compla9ts2 7#b7 provide a consum] ) email updates reg>d+ ! /atus ( ! consum]'s compla9t2 7#c7 create an onl9e portal t all[s a consum] to log 9 & track ! /atus ( ! consum]'s compla9t2 7#d7 review & =w>d compla9ts to ! correct p]son1 p>tn]%ip1 corporation1 gov]nm5t ag5cy1 or o!r entity2 & 7#e7 process & /ore ea* response f a p]son1 p>tn]%ip1 corporation1 gov]nm5t ag5cy1 or o!r entity to :i* a compla9t 0 =w>d$4 #aa4 ,application programm+ int]faces ,! ,commission %all1 9 consultation ) ! ,national ,in/itute ( ,/&>ds & ,te*nology & relevant /akehold]s1 includ+ consum] advocates & indep5d5t te*nology exp]ts-- 7#a7 /&>dize ,application ,programm+ ,int]faces necess>y to p]mit consum]s & cov]$ entities to programmatically avail !mselves ( ! rights & responsibilities creat$ by ?is ,act2 7#b7 p]mit & enable consum]s to securely delegate ! ability to make reque/s on _! behalf2 & 7#c7 require cov]$ entities to implem5t ! ,application ,programm+ ,int]faces1 z appropriate4 #ab4 ,news m$ia protections ,cov]$ entities engag$ 9 j\rnalism %all n be subject to ! obligations impos$ "u ?is ,act to ! ext5t t ^? obligations directly infr+e on ! j\rnalism1 r ?an ! bus9ess practices1 ( ! cov]$ entity4 #ac4 ,excise tax 7a7 ,9 g5]al ,subtitle ,d ( ! ,int]nal ,rev5ue ,code ( #aihf is am5d$ by add+ at ! end ! foll[+ new *apt]3 #ej;,a ,failure to c]tify data protection reports ,sec4 #ejjj;,d4 ,failure to c]tify data protection reports4 #ejjj;,d4 ,failure to c]tify data protection reports 7a7 ,imposition ( tax ,9 ! case ( any cov]$ report+ entity ) respect to :i* a responsible executive has be5 convict$ "u section #aceb7;d7 ( title #ah1 ,unit$ ,/ates ,code1 !re is impos$ a tax equal to ! am\nt det]m9$ "u subsection 7b74 7b7 ,am\nt ( tax 7#a7 ,9 g5]al ,! am\nt det]m9$ "u ?is subsection is ! applicable p]c5tage ( ! am\nt det]m9$ "u p>agraph 7#c74 7#b7 ,applicable p]c5tage ,= purposes ( p>agraph 7#a71 ! applicable p]c5tage is-- 7,a7 9 ! case ( a cov]$ report+ entity t is a corporation1 ! highe/ rate ( tax 9 effect "u section #aa = ! taxable ye> :i* includes ! date on :i* ! specifi$ annual data protection report to :i* ! conviction relates is due1 & 7,b7 9 ! case ( any o!r cov]$ report+ entity1 ! highe/ rate ( tax 9 effect "u section #a = su* taxable ye>4 7#c7 ,am\nt det]m9$ 7,a7 ,9 g5]al ,! am\nt det]m9$ "u ?is p>agraph is ! sum ( ! cov]$ comp5sation am\nts ( ea* responsible executive ( ! cov]$ report+ entity :o has be5 convict$ "u section #aceb7;d7 ( title #ah1 ,unit$ ,/ates ,code4 7,b7 ,cov]$ comp5sation am\nt ,= purposes ( subp>agraph 7,a71 ! cov]$ comp5sation am\nt ) respect to any responsible executive is ! l>ge/ am\nt ( annual wages 7z def9$ 9 section #caba7;a71 det]m9$ )\t reg>d to any doll> limitation conta9$ 9 su* section7 ( ! responsible executive ) respect to s]vices p]=m$ = ! cov]$ report+ entity dur+ ! #c-ye> p]iod prec$+ ! ye> to :i* ! specifi$ annual data protection report relates4 7c7 ,def9itions ,= purposes ( ?is section-- 7#a7 ,cov]$ report+ entity 7,a7 ,9 g5]al ,! t]m cov]$ report+ entity means any cov]$ entity 7z def9$ "u section #b ( ! ,m9d ,y\r ,own ,bus9ess ,act ( #bjai7 :i* is requir$ to file a specifi$ annual data protection report4 7,b7 ,aggregation rules ,= purposes ( ?is p>agraph1 all cov]$ entities :o are treat$ z a s+le employ] "u subsection 7b71 7c71 7m71 or 7o7 ( section #dad %all be treat$ z "o p]son4 7#b7 ,responsible executive ,= purposes ( ?is subsection1 ! t]m responsible executive means1 ) respect to a cov]$ report+ entity1 any ( ! foll[+ (fic]s3 7,a7 ,! *ief executive (fic]4 7,b7 ,! *ief privacy (fic] 7or equival5t !re(74 7#c7 ,specifi$ annual data protection report ,! t]m specifi$ annual data protection report means ! report requir$ to be fil$ "u section #e7;a7 ( ! ,m9d ,y\r ,own ,bus9ess ,act ( #bjai4 4 7b7 ,cl]ical am5dm5t ,! table ( *apt]s = subtitle ,d ( ! ,int]nal ,rev5ue ,code ( #aihf is am5d$ by add+ at ! end ! foll[+ new item3 ,*apt] #ej;,a--,failure ,to c]tify data protection reports 4 #ad4 ,no preemption ,no?+ 9 ?is ,act may be con/ru$ to preempt any ,/ate law4