,,ii #aafth ,,congress #ast ,session ,s4 #bifa ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #b1 #bjai,mr4 ,schatz 7for himself1 ,mr4 ,bennet1 ,ms4 ,cortez ,masto1 ,mr4 ,markey1 ,ms4 ,duckworth1 ,ms4 ,baldwin1 ,mr4 ,manchin1 ,mr4 ,durbin1 ,mr4 ,brown1 ,mr4 ,booker1 ,ms4 ,klobuchar1 ,ms4 ,hassan1 ,mr4 ,heinrich1 ,mrs4 ,murray1 ,mr4 ,sanders1 and ,mr4 ,murphy7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish duties for online service providers with respect to end user data that such providers collect and use4 #a4 ,short title ,this ,act may be cited as the ,data ,care ,act of #bjai4 #b4 ,definitions ,in this ,act3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,end user ,the term end user means an individual who engages with an online service provider or logs into or uses services provided by the online service provider over the internet or any other digital network4 7#c7 ,individual identifying data ,the term individual identifying data means any data that is-- 7,a7 collected over the internet or any other digital network2 and 7,b7 linked1 or reasonably linkable1 to-- 7i7 a specific end user2 or 7ii7 a computing device that is associated with or routinely used by an end user4 7#d7 ,online service provider ,the term online service provider means an entity that-- 7,a7 is engaged in interstate commerce over the internet or any other digital network2 and 7,b7 in the course of business1 collects individual identifying data about end users1 including in a manner that is incidental to the business conducted4 7#e7 ,sensitive data ,the term sensitive data means any data that includes-- 7,a7 a social security number2 7,b7 personal information 7as defined in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja77 collected from a child 7as defined in such section #acjb72 7,c7 a driver's license number1 passport number1 military identification number1 or any other similar number issued on a government document used to verify identity2 7,d7 a financial account number1 credit or debit card number1 or any required security code1 access code1 or password that is necessary to permit access to a financial account of an individual2 7,e7 unique biometric data such as a finger print1 voice print1 a retina or iris image1 or any other unique physical representation2 7,f7 information sufficient to access an account of an individual1 such as user name and password or email address and password2 7,g7 the first and last name of an individual1 or first initial and last name1 or other unique identifier in combination with-- 7i7 the month1 day1 and year of birth of the individual2 7ii7 the maiden name of the mother of the individual2 or 7iii7 the past or present precise geolocation of the individual2 7,h7 information that relates to-- 7i7 the past1 present1 or future physical or mental health or condition of an individual2 or 7ii7 the provision of health care to an individual2 and 7,i7 the nonpublic communications or other nonpublic user-created content of an individual4 #c4 ,provider duties 7a7 ,in general ,an online service provider shall fulfill the duties of care1 loyalty1 and confidentiality under paragraphs 7#a71 7#b71 and 7#c71 respectively1 of subsection 7b74 7b7 ,duties 7#a7 ,duty of care ,an online service provider shall-- 7,a7 reasonably secure individual identifying data from unauthorized access2 and 7,b7 subject to subsection 7d71 promptly inform an end user of any breach of the duty described in subparagraph 7,a7 of this paragraph with respect to sensitive data of that end user4 7#b7 ,duty of loyalty ,an online service provider may not use individual identifying data1 or data derived from individual identifying data1 in any way that-- 7,a7 will benefit the online service provider to the detriment of an end user2 and 7,b7 7i7 will result in reasonably foreseeable and material physical or financial harm to an end user2 or 7ii7 would be unexpected and highly offensive to a reasonable end user4 7#c7 ,duty of confidentiality ,an online service provider-- 7,a7 may not disclose or sell individual identifying data to1 or share individual identifying data with1 any other person except as consistent with the duties of care and loyalty under paragraphs 7#a7 and 7#b71 respectively2 7,b7 may not disclose or sell individual identifying data to1 or share individual identifying data with1 any other person unless that person enters into a contract with the online service provider that imposes on the person the same duties of care1 loyalty1 and confidentiality toward the applicable end user as are imposed on the online service provider under this subsection2 and 7,c7 shall take reasonable steps to ensure that the practices of any person to whom the online service provider discloses or sells1 or with whom the online service provider shares1 individual identifying data fulfill the duties of care1 loyalty1 and confidentiality assumed by the person under the contract described in subparagraph 7,b71 including by auditing1 on a regular basis1 the data security and data information practices of any such person4 7c7 ,application of duties to third parties ,if an online service provider transfers or otherwise provides access to individual identifying data to another person1 the requirements of paragraphs 7#a71 7#b71 and 7#c7 of subsection 7b7 shall apply to such person with respect to such data in the same manner that such requirements apply to the online service provider4 7d7 ,expansion of duty ,to inform regarding breaches ,the ,commission may promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to apply the breach notification requirement under subsection 7b77#a77;,b7 with respect to specific categories of individual identifying data other than sensitive data1 as the ,commission determines necessary4 7e7 ,exceptions 7#a7 ,regulations ,the ,commission may promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to exempt categories of online service providers or persons described in subsection 7c7 from the requirement under subsection 7a7 or subsection 7c7 7as applicable74 7#b7 ,considerations ,in promulgating regulations under paragraph 7#a71 the ,commission shall consider1 among other factors-- 7,a7 the privacy risks posed by the use of individual identifying data by an online service provider or person described in subsection 7c7 based on-- 7i7 the size of the provider or person2 7ii7 the complexity of the offerings of the provider2 7iii7 the nature and scope of the activities of the provider or person2 and 7iv7 the sensitivity of the consumer information handled by the provider or person2 and 7,b7 the costs and benefits of applying the requirement under subsection 7a7 or subsection 7c7 7as applicable7 to online service providers or persons with particular combinations of characteristics considered under subparagraph 7,a7 of this paragraph4 #d4 ,enforcement 7a7 ,enforcement by ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #c by an online service provider or a person described in section #c7;c7 shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of ,commission 7,a7 ,in general ,except as provided in subparagraph 7,c71 the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,except as provided in subparagraph 7,c71 any person who violates section #c shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,nonprofit organizations and common carriers ,notwithstanding section #d or #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b77 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act1 in the same manner provided in subparagraphs 7,a7 and 7,b7 of this paragraph1 with respect to-- 7i7 organizations not organized to carry on business for their own profit or that of their members2 and 7ii7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq474 7#c7 ,rulemaking authority ,the ,commission shall promulgate regulations under this ,act in accordance with section #eec of title #e1 ,united ,states ,code4 7b7 ,enforcement by ,states 7#a7 ,authorization ,subject to paragraph 7#c71 in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is threatened or adversely affected by the engagement of an online service provider or a person described in section #c7;c7 in a practice that violates section #c1 the attorney general of the ,state may1 as parens patriae1 bring a civil action against the online service provider or person on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief1 including civil penalties in the amount determined under paragraph 7#b74 7#b7 ,civil penalties ,an online service provider or person described in section #c7;c7 that is found1 in an action brought under paragraph 7#a71 to have knowingly or repeatedly violated section #c shall1 in addition to any other penalty otherwise applicable to a violation of section #c1 be liable for a civil penalty equal to the amount calculated by multiplying-- 7,a7 the greater of-- 7i7 the number of days during which the online service provider or person was not in compliance with that section2 or 7ii7 the number of end users who were harmed as a result of the violation1 by 7,b7 an amount not to exceed the maximum civil penalty for which a person1 partnership1 or corporation may be liable under section #e7m77#a77;,a7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m77#a77;,a77 7including any adjustments for inflation74 7#c7 ,rights of ,federal ,trade ,commission 7,a7 ,notice to ,federal ,trade ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 before initiating the civil action4 7ii7 ,contents ,the notification required under clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required under clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,federal ,trade ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#d7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths or affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary or other evidence4 7#e7 ,preemptive action by ,federal ,trade ,commission ,if the ,commission institutes a civil action or an administrative action with respect to a violation of section #c1 the attorney general of a ,state may not1 during the pendency of the action1 bring a civil action under paragraph 7#a7 against any defendant named in the complaint of the ,commission based on the same set of facts giving rise to the alleged violation with respect to which the ,commission instituted the action4 7#f7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7#g7 ,actions by other ,state officials 7,a7 ,in general ,in addition to civil actions brought by attorneys general under paragraph 7#a71 any other consumer protection officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #e4 ,nonenforceability of certain provisions waiving rights and remedies ,the rights and remedies provided under this ,act may not be waived or limited by contract or otherwise4 #f4 ,relation to other privacy and security laws ,nothing in this ,act may be construed to-- 7#a7 modify1 limit1 or supersede the operation of any privacy or security provision in any other ,federal or ,state statute or regulation2 or 7#b7 limit the authority of the ,commission under any other provision of law4 #g4 ,effective date 7a7 ,in general ,this ,act shall take effect on the date of enactment of this ,act4 7b7 ,applicability ,section #c shall apply with respect to an online service provider or person described in section #c7;c7 on and after the date that is #ahj days after the date of enactment of this ,act4