,,ii #aaf? ,,congress #a/ ,session ,s4 #bhhe ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,novemb] #ah1 #bjai,mr4 ,cassidy 7= himself & ,ms4 ,ros57 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ,a ,,bill ,to prohibit ! transf] or sale ( c]ta9 consum] heal? in=mation1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,/op ,m>ket+ ,& ,reveal+ ,! ,we>ables ,& ,track]s ,consum] ,heal? ,data ,act or ! ,,sm>twat* ,data ,act4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,aggregat$ ,! t]m aggregat$1 ) respect to consum] heal? in=mation-- 7,a7 means ! removal ( individual consum] id5tities1 s t ! in=mation is n l9k$ or reasonably l9kable to any consum]1 includ+ a p]sonal consum] device2 & 7,b7 does n include "o or m individual consum] records t h n be5 deid5tifi$4 7#b7 ,biometric in=mation ,! t]m biometric in=mation-- 7,a7 means ! physiological1 biological1 or behavioral *>act]i/ics ( an individual1 & ! record$1 copi$1 captur$1 conv]t$1 /or$ d]ivatives ( any su* *>act]i/ics1 t c be us$1 s+ly or 9 comb9ation ) ea* o!r or ) o!r id5tify+ data1 to e/abli% ! id5tity ( an individual2 & 7,b7 includes deoxyribonucleic acid1 imag]y ( ! iris1 ret9a1 f+]pr9t1 face1 h&1 palm1 ve9 patt]ns1 & voice record+s1 f :i* an id5tifi] template1 su* z a facepr9t1 a m9utiae template1 or a voicepr9t1 c be extract$4 7#c7 ,bus9ess associate2 cov]$ entity2 protect$ heal? in=mation ,! t]ms bus9ess associate1 cov]$ entity1 & protect$ heal? in=mation h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7#d7 ,comm]cial purposes ,! t]m comm]cial purposes-- 7,a7 means an action int5d$-- 7i7 to advance ! comm]cial or economic int]e/s ( a p]son1 su* z by induc+ ano!r p]son to buy1 r5t1 lease1 jo91 subscribe to1 provide1 or ex*ange products1 goods1 prop]ty1 in=mation1 or s]vices2 or 7ii7 to enable or affect1 directly or indirectly1 a comm]cial transaction2 & 7,b7 does n include engag+ 9 spee* t ,/ate or ,f$]al c\rts h recogniz$ z noncomm]cial spee*1 includ+ political spee* & j\rnalism4 7#e7 ,consum] device ,! t]m consum] device-- 7,a7 means a comm]cially produc$ piece ( equipm5t1 application s(tw>e1 or me*anism t has ! prim>y function or capability to collect1 /ore1 or transmit consum] heal? in=mation2 & 7,b7 may include a device1 z def9$ 9 section #bja7;h7 ( ! ,f$]al ,food1 ,drug1 & ,cosmetic ,act 7#ba ,u4,s4,c4 #cba7;h774 7#f7 ,consum] heal? in=mation ,! t]m consum] heal? in=mation means any in=mation ab\t ! heal? /atus1 p]sonal biometric in=mation1 or p]sonal k9e/hetic in=mation ab\t a specific individual t is creat$ or collect$ by a p]sonal consum] device1 :e!r detect$ f s5sors or input manually4 7#g7 ,deid5tifi$ ,! t]m deid5tifi$ means in=mation t _c reasonably id5tify1 relate to1 describe1 be capable ( be+ associat$ )1 or be l9k$1 directly or indirectly1 to a p>ticul> consum]1 comput]1 or o!r device4 7#h7 ,in=mation brok] ,! t]m in=mation brok] means any entity t collects consum]s' p]sonal in=mation & resells or %>es t in=mation ) ano!r p]son4 7#i7 ,k9e/hetic in=mation ,! t]m k9e/hetic in=mation means key/roke patt]ns or rhy?ms1 gait patt]ns or rhy?ms1 sleep in=mation1 & o!r data t relates to ! p]sonal heal? ( an individual4 #c4 ,prohibitions 7a7 ,9 g5]al ,subject to subsection 7b71 no entity t collects consum] heal? in=mation may-- 7#a7 transf]1 sell1 %>e1 or all[ access to any consum] heal? in=mation 7unless aggregat$ or anonymiz$7 or any o!r individually id5tifiable consum] heal? in=mation collect$1 record$1 or d]iv$ f p]sonal consum] devices to any dome/ic in=mation brok] or o!r dome/ic entity if-- 7,a7 ! prim>y bus9ess function ( su* dome/ic in=mation brok] or o!r dome/ic entity is collect+ or analyz+ consum] in=mation = pr(it2 or 7,b7 ! purpose = transf]r+1 sell+1 %>+1 or all[+ access to su* in=mation is to o!rwise add value to ! entity t collects consum] heal? in=mation1 = comm]cial purposes2 or 7#b7 transf]1 sell1 or all[ access to any consum] heal? in=mation collect$1 /or$1 record$1 or d]iv$ f p]sonal consum] devices to any in=mation brok] or any entity outside ( ! jurisdiction ( ! ,unit$ ,/ates4 7b7 ,exceptions 7#a7 ,9 g5]al ,subject to p>agraph 7#c71 ! prohibition "u subsection 7a77#a7 %all n apply if-- 7,a7 ! entity obta9s ! in=m$ cons5t ( ! consum]2 7,b7 ! in=mation is provid$ to a cov]$ entity1 z def9$ 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 7,c7 su* in=mation is provid$ to a gov]nm5t organization or ag5cy1 includ+ law en=cem5t or regulators1 to comply ) applicable laws1 regulations1 or rules1 or reque/s ( law en=cem5t1 regulatory1 or o!r gov]nm5tal ag5cies or 9 response to a legal process 9 connection ) a subpo5a1 w>rant1 discov]y ord]1 or o!r reque/ or ord] f a law en=cem5t ag5cy2 7,d7 su* in=mation is provid$ to ! entity's affiliates or o!r tru/$ bus9esses or p]sons to process ! in=mation z "p ( ! entity's ext]nal process+ proc$ures1 bas$ on ! entity's in/ructions & 9 compliance ) privacy protections & any o!r appropriate confid5tiality & security measures2 7,e7 su* in=mation is provid$ 9 connection ) a sub/antial corporate transaction ( ! entity1 su* z ! transf] ( own]%ip1 a m]g]1 consolidation1 asset sale1 or bankruptcy or insolv5cy2 or 7,f7 su* in=mation is provid$ to academic1 m$ical1 rese>* in/itutions1 or o!r nonpr(it organizations act+ 9 ! public int]e/ = ! purpose ( detect+ or respond+ to security incid5ts2 prev5t+ fraud2 conduct+ sci5tific1 hi/orical1 or /ati/ical rese>*2 or pres]v+ ! security & safety ( p or prop]ty4 7#b7 ,transf]s to =eign entities ,subject to p>agraph 7#c71 ! prohibition "u subsection 7a77#b7 %all n apply if-- 7,a7 ! transf] is made only = limit$ & specific purposes consi/5t ) ! cons5t provid$ by ! individual & ) assurances t ! recipi5t w notify ! entity provid+ ! data if su* recipi5t makes a det]m9ation t x c no long] use ! data consi/5t ) su* cons5t2 7,b7 ! entity transf]r+ ! in=mation det]m9es t ! recipi5t ( ! in=mation w provide ! same level ( privacy protection z is requir$ by ! entity transf]r+ ! in=mation2 7,c7 ! entity transf]r+ ! in=mation takes reasonable & appropriate /eps to ensure t ! ?ird p>ty effectively processes ! p]sonal in=mation transf]r$ 9 a mann] consi/5t ) ! ?ird p>ty's obligations "u ! second p>ty's privacy pr9ciples2 & 7,d7 ! entity transf]r+ ! in=mation agrees to take reasonable /eps to /op & rem$iate unau?oriz$ process+ ( in=mation by ! entity to :om su* in=mation is transf]r$4 7#c7 ,limitation ,none ( ! exceptions "u p>agraphs 7#a7 & 7#b7 %all sup]s$e any contr>y rule promulgat$ by ! ,f$]al ,trade ,commission t is 9 effect on ! date ( enactm5t ( ?is ,act4 7c7 ,treatm5t ( consum] heal? in=mation z protect$ heal? in=mation ,if a cov]$ entity or bus9ess associate1 act+ 9 its capacity z a bus9ess associate1 receives consum] heal? in=mation g5]at$ by a p]sonal consum] device at any "t = any reason1 su* consum] heal? in=mation is consid]$ protect$ heal? in=mation & is subject to ! same protections & re/rictions "u p>ts #afb & #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 z any o!r protect$ heal? in=mation4 #d4 ,en=cem5t ,! ,secret>y ( ,heal? & ,human ,s]vices %all en=ce ! requirem5ts ( section #c aga9/ an entity t collects or receives consum] heal? in=mation 9 ! same mann] & to ! same ext5t1 z su* secret>y en=ces ! privacy regulations promulgat$ "u section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7,public ,law #ajd-aia2 #aaj ,/at4 #bjcc7 aga9/ a cov]$ entity4