,,ii #aafth ,,congress #ast ,session ,s4 #bifh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #c1 #bjai,ms4 ,cantwell 7for herself1 ,mr4 ,schatz1 ,ms4 ,klobuchar1 and ,mr4 ,markey7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to provide consumers with foundational data privacy rights1 create strong oversight mechanisms1 and establish meaningful enforcement4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,consumer ,online ,privacy ,rights ,act4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,sec4 #c4 ,effective date4,,title ,i--,data privacy rights,sec4 #aja4 ,duty of loyalty4,sec4 #ajb4 ,right to access and transparency4,sec4 #ajc4 ,right to delete4,sec4 #ajd4 ,right to correct inaccuracies4,sec4 #aje4 ,right to controls4,sec4 #ajf4 ,right to data minimization4,sec4 #ajg4 ,right to data security4,sec4 #ajh4 ,civil rights4,sec4 #aji4 ,prohibition on waiver of rights4,sec4 #aaj4 ,limitations and applicability4,,title ,,ii--,oversight and responsibility,sec4 #bja4 ,executive responsibility4,sec4 #bjb4 ,privacy and data security officers2 comprehensive privacy and data security programs2 risk assessments and compliance4,sec4 #bjc4 ,service providers and third parties4,sec4 #bjd4 ,whistleblower protections4,sec4 #bje4 ,digital content forgeries4,,title ,,iii--,miscellaneous,sec4 #cja4 ,enforcement1 civil penalties1 and applicability4,sec4 #cjb4 ,relationship to ,federal and ,state laws4,sec4 #cjc4 ,severability4,sec4 #cjd4 ,authorization of appropriations4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative express consent 7,a7 ,in general ,the term affirmative express consent means an affirmative act by an individual that clearly communicates the individual's authorization for an act or practice1 in response to a specific request that meets the requirements of subparagraph 7,b74 7,b7 ,request requirements ,the requirements of this subparagraph with respect to a request from a covered entity to an individual are the following3 7i7 ,the request is provided to the individual in a standalone disclosure4 7ii7 ,the request includes a description of each act or practice for which the individual's consent is sought and-- 7,i7 clearly distinguishes between an act or practice which is necessary to fulfill a request of the individual and an act or practice which is for another purpose2 and 7,,ii7 is written in easy-to-understand language and includes a prominent heading that would enable a reasonable individual to identify and understand the act or practice4 7iii7 ,the request clearly explains the individual's applicable rights related to consent4 7,c7 ,express consent required ,an entity shall not infer that an individual has provided affirmative express consent to an act or practice from the inaction of the individual or the individual's continued use of a service or product provided by the entity4 7#b7 ,algorithmic decision-making ,the term algorithmic decision-making means a computational process1 including one derived from machine learning1 statistics1 or other data processing or artificial intelligence techniques that makes a decision or facilitates human decision-making with respect to covered data4 7#c7 ,biometric information 7,a7 ,in general ,the term biometric information means any covered data generated from the measurement or specific technological processing of an individual's biological1 physical1 or physiological characteristics1 including-- 7i7 fingerprints2 7ii7 voice prints2 7iii7 iris or retina scans2 7iv7 facial scans or templates2 7v7 deoxyribonucleic acid 7,,dna7 information2 and 7vi7 gait4 7,b7 ,exclusions ,such term does not include writing samples1 written signatures1 photographs1 voice recordings1 demographic data1 or physical characteristics such as height1 weight1 hair color1 or eye color1 provided that such data is not used for the purpose of identifying an individual's unique biological1 physical1 or physiological characteristics4 7#d7 ,collect2 collection ,the terms collect and collection mean buying1 renting1 gathering1 obtaining1 receiving1 accessing1 or otherwise acquiring covered data by any means1 including by passively or actively observing the individual's behavior4 7#e7 ,common branding ,the term common branding means a shared name1 servicemark1 or trademark4 7#f7 ,control ,the term control means1 with respect to an entity-- 7,a7 ownership of1 or the power to vote1 more than #ej percent of the outstanding shares of any class of voting security of the entity2 7,b7 control in any manner over the election of a majority of the directors of the entity 7or of individuals exercising similar functions72 or 7,c7 the power to exercise a controlling influence over the management of the entity4 7#g7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#h7 ,covered data 7,a7 ,in general ,the term covered data means information that identifies1 or is linked or reasonably linkable to an individual or a consumer device1 including derived data4 7,b7 ,exclusions ,such term does not include-- 7i7 de-identified data2 7ii7 employee data2 and 7iii7 public records4 7#i7 ,covered entity 7,a7 ,in general ,the term covered entity means any entity or person that-- 7i7 is subject to the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 and 7ii7 processes or transfers covered data4 7,b7 ,inclusion of commonly controlled and commonly branded entities ,such term includes any entity or person that controls1 is controlled by1 is under common control with1 or shares common branding with a covered entity4 7,c7 ,exclusion of small business ,such term does not include a small business4 7#aj7 ,de-identified data ,term de-identified data means information that cannot reasonably be used to infer information about1 or otherwise be linked to1 an individual1 a household1 or a device used by an individual or household1 provided that the entity-- 7,a7 takes reasonable measures to ensure that the information cannot be reidentified1 or associated with1 an individual1 a household1 or a device used by an individual or household2 7,b7 publicly commits in a conspicuous manner-- 7i7 to process and transfer the information in a de-identified form2 and 7ii7 not to attempt to reidentify or associate the information with any individual1 household1 or device used by an individual or household2 and 7,c7 contractually obligates any person or entity that receives the information from the covered entity to comply with all of the provisions of this paragraph4 7#aa7 ,derived data ,the term derived data means covered data that is created by the derivation of information1 data1 assumptions1 or conclusions from facts1 evidence1 or another source of information or data about an individual1 household1 or device used by an individual or household4 7#ab7 ,employee data ,the term employee data means-- 7,a7 covered data that is collected by a covered entity or the covered entity's service provider about an individual in the course of the individual's employment or application for employment 7including on a contract or temporary basis7 provided that such data is retained or processed by the covered entity or the covered entity's service provider solely for purposes necessary for the individual's employment or application for employment2 7,b7 covered data that is collected by a covered entity or the covered entity's service provider that is emergency contact information for an individual who is an employee1 contractor1 or job applicant of the covered entity provided that such data is retained or processed by the covered entity or the covered entity's service provider solely for the purpose of having an emergency contact for such individual on file2 and 7,c7 covered data that is collected by a covered entity or the covered entity's service provider about an individual 7or a relative of an individual7 who is an employee or former employee of the covered entity for the purpose of administering benefits to which such individual or relative is entitled on the basis of the individual's employment with the covered entity1 provided that such data is retained or processed by the covered entity or the covered entity's service provider solely for the purpose of administering such benefits4 7#ac7 ,executive agency ,the term ,executive agency has the meaning given such term in section #aje of title #e1 ,united ,states ,code4 7#ad7 ,individual ,the term individual means a natural person residing in the ,united ,states1 however identified1 including by any unique identifier4 7#ae7 ,large data holder ,the term large data holder means a covered entity that1 in the most recent calendar year-- 7,a7 processed or transferred the covered data of more than #e1jjj1jjj individuals1 devices used by individuals or households1 or households2 or 7,b7 processed or transferred the sensitive covered data of more than #ajj1jjj individuals1 devices used by individuals or households1 or households4 7#af7 ,process ,the term process means any operation or set of operations performed on covered data including collection1 analysis1 organization1 structuring1 retaining1 using1 or otherwise handling covered data4 7#ag7 ,processing purpose ,the term processing purpose means an adequately specific and granular reason for which a covered entity processes covered data that clearly describes the processing activity4 7#ah7 ,publicly available information 7,a7 ,in general ,the term publicly available information means-- 7i7 information that a covered entity has a reasonable basis to believe is lawfully made available to the general public from widely distributed media2 and 7ii7 information that is directly and voluntarily disclosed to the general public by the individual to whom the information relates4 7,b7 ,limitation ,such term does not include-- 7i7 information derived from publicly available information2 7ii7 biometric information2 or 7iii7 nonpublicly available information that has been combined with publicly available information4 7#ai7 ,public records ,the term public records means information that is lawfully made available from ,federal1 ,state1 or local government records provided that the covered entity processes and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity4 7#bj7 ,sensitive covered data ,the term sensitive covered data means the following forms of covered data3 7,a7 ,a government-issued identifier1 such as a ,social ,security number1 passport number1 or driver's license number4 7,b7 ,any information that describes or reveals the past1 present1 or future physical health1 mental health1 disability1 or diagnosis of an individual4 7,c7 ,a financial account number1 debit card number1 credit card number1 or any required security or access code1 password1 or credentials allowing access to any such account4 7,d7 ,biometric information4 7,e7 ,precise geolocation information that reveals the past or present actual physical location of an individual or device4 7,f7 ,the content or metadata of an individual's private communications or the identity of the parties to such communications unless the covered entity is an intended recipient of the communication4 7,g7 ,an email address1 telephone number1 or account log-in credentials4 7,h7 ,information revealing an individual's race1 ethnicity1 national origin1 religion1 or union membership in a manner inconsistent with the individual's reasonable expectation regarding disclosure of such information4 7,i7 ,information revealing the sexual orientation or sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding disclosure of such information4 7,j7 ,information revealing online activities over time and across third party websites or online services4 7,k7 ,calendar information1 address book information1 phone or text logs1 photos1 or videos maintained on an individual's device4 7,l7 ,a photograph1 film1 video recording1 or other similar medium that shows the naked or undergarment-clad private area of an individual4 7,m7 ,any other covered data processed or transferred for the purpose of identifying the above data types4 7,n7 ,any other covered data that the ,commission determines to be sensitive covered data through a rulemaking pursuant to section #eec of title #e1 ,united ,states ,code4 7#ba7 ,service provider 7,a7 ,in general ,the term service provider means a covered entity that processes or transfers covered data in the course of performing a service or function on behalf of1 and at the direction of1 another covered entity1 but only to the extent that such processing or transferral-- 7i7 relates to the performance of such service or function2 or 7ii7 is necessary to comply with a legal obligation or to establish1 exercise1 or defend legal claims4 7,b7 ,exclusion ,such term does not include a covered entity that processes or transfers the covered data outside of the direct relationship between the service provider and the covered entity4 7#bb7 ,service provider data ,the term service provider data means covered data that is collected by or has been transferred to a service provider by a covered entity for the purpose of allowing the service provider to perform a service or function on behalf of1 and at the direction of1 such covered entity4 7#bc7 ,small business 7,a7 ,in general ,the term small business means an entity that can establish that1 with respect to the #c preceding calendar years 7or for the period during which the entity has been in existence if1 as of such date1 such period is less than #c years7 the entity does not-- 7i7 maintain annual average gross revenue in excess of #be1jjj1jjj2 7ii7 annually process the covered data of an average of #ajj1jjj or more individuals1 households1 or devices used by individuals or households2 and 7iii7 derive #ej percent or more of its annual revenue from transferring individuals' covered data4 7,b7 ,common control2 common branding ,for purposes of subparagraph 7,a71 the annual average gross revenue1 data processing volume1 and percentage of annual revenue of an entity shall include the revenue and processing activities of any person that controls1 is controlled by1 is under common control with1 or shares common branding with such entity4 7#bd7 ,third party ,the term third party-- 7,a7 means any person or entity that-- 7i7 processes or transfers third party data2 and 7ii7 is not a service provider with respect to such data2 and 7,b7 does not include a person or entity that collects covered data from another entity if the two entities are related by common ownership or corporate control and share common branding4 7#be7 ,third party data ,the term third party data means covered data that is transferred to a third party by a covered entity4 7#bf7 ,transfer ,the term transfer means to disclose1 release1 share1 disseminate1 make available1 sell1 license1 or otherwise communicate covered data by any means to a service provider or third party-- 7,a7 in exchange for consideration2 or 7,b7 for a commercial purpose4 7#bg7 ,unique identifier ,the term unique identifier means an identifier that is reasonably linkable to an individual1 household1 or device used by an individual or household1 including a device identifier1 an ,internet ,protocol address1 cookies1 beacons1 pixel tags1 mobile ad identifiers1 or similar technology1 customer number1 unique pseudonym1 or user alias1 telephone numbers1 or other forms of persistent or probabilistic identifiers that can be used to identify a particular individual1 a household1 or a device4 7#bh7 ,widely distributed media ,the term widely distributed media means information that is available to the general public1 including information from a telephone book or online directory1 a television1 internet1 or radio program1 the news media1 or an internet site that is available to the general public on an unrestricted basis1 but does not include an obscene visual depiction as defined in section #adfj of title #ah1 ,united ,states ,code4 #c4 ,effective date ,this ,act shall take effect on the date that is #ahj days after the date of enactment of this ,act4 ,i ,data privacy rights #aja4 ,duty of loyalty 7a7 ,in general ,a covered entity shall not-- 7#a7 engage in a deceptive data practice or a harmful data practice2 or 7#b7 process or transfer covered data in a manner that violates any provision of this ,act4 7b7 ,definitions 7#a7 ,deceptive data practice ,the term deceptive data practice means an act or practice involving the processing or transfer of covered data in a manner that constitutes a deceptive act or practice in violation of section #e7;a77#a7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#a774 7#b7 ,harmful data practice ,the term harmful data practice means the processing or transfer of covered data in a manner that causes or is likely to cause any of the following3 7,a7 ,financial1 physical1 or reputational injury to an individual4 7,b7 ,physical or other offensive intrusion upon the solitude or seclusion of an individual or the individual's private affairs or concerns1 where such intrusion would be offensive to a reasonable person4 7,c7 ,other substantial injury to an individual4 #ajb4 ,right to access and transparency 7a7 ,right ,to access ,a covered entity1 upon the verified request of an individual1 shall provide the individual1 in a human-readable format that a reasonable individual can understand1 with-- 7#a7 a copy or accurate representation of the covered data of the individual processed or transferred by the covered entity2 and 7#b7 the name of any third party to whom covered data of the individual has been transferred by the covered entity and a description of the purpose for which the entity transferred such data to such third party4 7b7 ,right to transparency ,a covered entity shall make publicly and persistently available1 in a conspicuous and readily accessible manner1 a privacy policy that provides a detailed and accurate representation of the entity's data processing and data transfer activities4 ,such privacy policy shall include1 at a minimum-- 7#a7 the identity and the contact information of the covered entity1 including the contact information for the covered entity's representative for privacy and data security inquiries2 7#b7 each category of data the covered entity collects and the processing purposes for which such data is collected2 7#c7 whether the covered entity transfers covered data and1 if so-- 7,a7 each category of service provider and third party to which the covered entity transfers covered data and the purposes for which such data is transferred to such categories2 and 7,b7 the identity of each third party to which the covered entity transfers covered data and the purposes for which such data is transferred to such third party1 except for transfers to governmental entities pursuant to a court order or law that prohibits the covered entity from disclosing such transfer2 7#d7 how long covered data processed by the covered entity will be retained by the covered entity and a description of the covered entity's data minimization policies2 7#e7 how individuals can exercise the individual rights described in this title2 7#f7 a description of the covered entity's data security policies2 and 7#g7 the effective date of the privacy policy4 7c7 ,languages ,a covered entity shall make the privacy policy required under this section available to the public in all of the languages in which the covered entity provides a product or service or carries out any other activities to which the privacy policy relates4 7d7 ,right ,to consent to material changes ,a covered entity shall not make a material change to its privacy policy or practices with respect to previously collected covered data that would weaken the privacy protections applicable to such data without first obtaining prior affirmative express consent from the individuals affected4 ,the covered entity shall provide direct notification1 where possible1 regarding material changes to affected individuals1 taking into account available technology and the nature of the relationship4 #ajc4 ,right to delete ,a covered entity1 upon the verified request of an individual1 shall-- 7#a7 delete1 or allow the individual to delete1 any information in the covered data of the individual that is processed by the covered entity2 and 7#b7 inform any service provider or third party to which the covered entity transferred such data of the individual's deletion request4 #ajd4 ,right to correct inaccuracies ,a covered entity1 upon the verified request of an individual1 shall-- 7#a7 correct1 or allow the individual to correct1 inaccurate or incomplete information in the covered data of the individual that is processed by the covered entity2 and 7#b7 inform any service provider or third party to which the covered entity transferred such data of the corrected information4 #aje4 ,right to controls 7a7 ,right to data portability ,a covered entity1 upon the verified request of an individual1 shall export the individual's covered data1 except for derived data1 without licensing restrictions-- 7#a7 in a human-readable format that allows the individual to understand such covered data of the individual2 and 7#b7 in a structured1 interoperable1 and machine-readable format that includes all covered data or other information that the covered entity collected to the extent feasible4 7b7 ,right ,to opt out of transfers 7#a7 ,in general ,a covered entity-- 7,a7 shall not transfer an individual's covered data to a third party if the individual objects to the transfer2 and 7,b7 shall allow an individual to object to the covered entity transferring covered data of the individual to a third party through a process established under the rule issued by the ,commission pursuant to paragraph 7#b74 7#b7 ,rulemaking 7,a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,commission shall issue a rule under section #eec of title #e1 ,united ,states ,code1 establishing one or more acceptable processes for covered entities to follow in allowing individuals to opt out of transfers of covered data4 7,b7 ,requirements ,the processes established by the ,commission pursuant to this subparagraph shall-- 7i7 be centralized1 to the extent feasible1 to minimize the number of opt-out designations of a similar type that a consumer must make2 7ii7 include clear and conspicuous opt-out notices and consumer friendly mechanisms to allow an individual to opt out of transfers of covered data2 7iii7 allow an individual that objects to a transfer of covered data to view the status of such objection2 7iv7 allow an individual that objects to a transfer of covered data to change the status of such objection2 7v7 be privacy protective2 and 7vi7 be informed by the ,commission's experience developing and implementing the ,national ,do ,not ,call ,registry4 7c7 ,sensitive data ,a covered entity-- 7#a7 shall not process the sensitive covered data of an individual without the individual's prior1 affirmative express consent2 7#b7 shall not transfer the sensitive covered data of an individual without the individual's prior1 affirmative express consent2 7#c7 shall provide an individual with a consumer-friendly means to withdraw affirmative express consent to process the sensitive covered data of the individual2 and 7#d7 is not required to obtain prior1 affirmative express consent to process or transfer publicly available information4 #ajf4 ,right to data minimization ,a covered entity shall not process or transfer covered data beyond what is reasonably necessary1 proportionate1 and limited-- 7#a7 to carry out the specific processing purposes and transfers described in the privacy policy made available by the covered entity as required under section #ajb2 7#b7 to carry out a specific processing purpose or transfer for which the covered entity has obtained affirmative express consent2 or 7#c7 for a purpose specifically permitted under subsection 7d7 of section #aaj4 ,covered data processing and transfers consistent with this section shall not supersede any other provision of this ,act4 #ajg4 ,right to data security 7a7 ,in general ,a covered entity shall establish1 implement1 and maintain reasonable data security practices to protect the confidentiality1 integrity1 and accessibility of covered data4 ,such data security practices shall be appropriate to the volume and nature of the covered data at issue4 7b7 ,specific requirements ,data security practices required under subsection 7a7 shall include1 at a minimum1 the following3 7#a7 ,assess vulnerabilities ,identifying and assessing any reasonably foreseeable risks to1 and vulnerabilities in1 each system maintained by the covered entity that processes or transfers covered data1 including unauthorized access to or risks to covered data1 human vulnerabilities1 access rights1 and use of service providers4 ,such activities shall include a plan to receive and respond to unsolicited reports of vulnerabilities by entities and individuals4 7#b7 ,preventive and correction action ,taking preventive and corrective action to mitigate any risks or vulnerabilities to covered data identified by the covered entity1 which may include implementing administrative1 technical1 or physical safeguards or changes to data security practices or the architecture1 installation1 or implementation of network or operating software4 7#c7 ,information retention and disposal ,disposing covered data that is required to be deleted or is no longer necessary for the purpose for which the data was collected unless an individual has provided affirmative express consent to such retention4 ,such process shall include destroying1 permanently erasing1 or otherwise modifying the covered data to make such data permanently unreadable or indecipherable and unrecoverable and data hygiene practices to ensure ongoing compliance with this subsection4 7#d7 ,training ,training all employees with access to covered data on how to safeguard covered data and protect individual privacy and updating that training as necessary4 7c7 ,training guidelines ,not later than #a year after the date of enactment of this ,act1 the ,commission1 in conjunction with the ,national ,institute of ,standards and ,technology1 shall publish guidance for covered entities on how to provide effective data security and privacy training as described in subsection 7b77#d74 #ajh4 ,civil rights 7a7 ,protections 7#a7 ,in general ,a covered entity shall not process or transfer covered data on the basis of an individual's or class of individuals' actual or perceived race1 color1 ethnicity1 religion1 national origin1 sex1 gender1 gender identity1 sexual orientation1 familial status1 biometric information1 lawful source of income1 or disability-- 7,a7 for the purpose of advertising1 marketing1 soliciting1 offering1 selling1 leasing1 licensing1 renting1 or otherwise commercially contracting for a housing1 employment1 credit1 or education opportunity1 in a manner that unlawfully discriminates against or otherwise makes the opportunity unavailable to the individual or class of individuals2 or 7,b7 in a manner that unlawfully segregates1 discriminates against1 or otherwise makes unavailable to the individual or class of individuals the goods1 services1 facilities1 privileges1 advantages1 or accommodations of any place of public accommodation4 7#b7 ,exception ,nothing in this section shall limit a covered entity from processing covered data for legitimate internal testing for the purpose of preventing unlawful discrimination or otherwise determining the extent or effectiveness of the covered entity's compliance with this ,act4 7#c7 ,,ftc advisory opinions ,a covered entity may request advice from the ,commission concerning the covered entity's potential compliance with this subsection1 in accordance with the ,commission's rules of practice on advisory opinions4 7b7 ,algorithmic decision-,making impact assessment 7#a7 ,impact assessment ,notwithstanding any other provision of law1 a covered entity engaged in algorithmic decision-making1 or in assisting others in algorithmic decision-making for the purpose of processing or transferring covered data1 solely or in part to make or facilitate advertising for housing1 education1 employment or credit opportunities1 or an eligibility determination for housing1 education1 employment or credit opportunities or determining access to1 or restrictions on the use of1 any place of public accommodation1 must annually conduct an impact assessment of such algorithmic decision-making that-- 7,a7 describes and evaluates the development of the covered entity's algorithmic decision-making processes including the design and training data used to develop the algorithmic decision-making process1 how the algorithmic decision-making process was tested for accuracy1 fairness1 bias and discrimination2 and 7,b7 assesses whether the algorithmic decision-making system produces discriminatory results on the basis of an individual's or class of individuals' actual or perceived race1 color1 ethnicity1 religion1 national origin1 sex1 gender1 gender identity1 sexual orientation1 familial status1 biometric information1 lawful source of income1 or disability4 7#b7 ,external1 independent auditor or researcher ,a covered entity may utilize an external1 independent auditor or researcher to conduct such assessments4 7#c7 ,availability ,the covered entity-- 7,a7 shall make the impact assessment available to the ,commission upon request2 and 7,b7 may make the impact assessment public4 ,a covered entity may redact and segregate trade secrets as defined by section #ahci of title #ah1 ,united ,states ,code1 from public disclosure under this subsection4 7#d7 ,study ,not later than #c years after the date of enactment of this ,act1 the ,commission shall publish a report containing the results of a study1 using the ,commission's authority under section #f7;b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;b771 examining the use of algorithms for the purposes described in this subsection4 ,not later than #c years after the publication of the initial report1 and as necessary thereafter1 the ,commission shall publish a new and updated version of such report4 #aji4 ,prohibition on waiver of rights ,a covered entity shall not condition the provision of a service or product to an individual on the individual's agreement to waive privacy rights guaranteed by-- 7#a7 sections #aja1 #aje7;a71 and #ajf through #aji of this ,act2 and 7#b7 sections #ajb through #ajd1 and #aje7;b7 and 7c7 of this ,act1 except in the case where-- 7,a7 there exists a direct relationship between the individual and the covered entity initiated by the individual2 7,b7 the provision of the service or product requested by the individual requires the processing or transferring of the specific covered data of the individual and the covered data is strictly necessary to provide the service or product2 and 7,c7 an individual provides affirmative express consent to such specific limitations4 #aaj4 ,limitations and applicability 7a7 ,verification of requests 7#a7 ,in general ,a covered entity shall not permit an individual to exercise a right described in sections #ajb through #aje7;a7 if-- 7,a7 the covered entity cannot reasonably verify that the individual making the request to exercise the right is the individual whose covered data is the subject of the request or an individual authorized to make such a request on the individual's behalf2 or 7,b7 the covered entity reasonably believes that the request is made to interfere with a contract between the covered entity and another individual4 7#b7 ,additional information ,if a covered entity cannot reasonably verify that a request to exercise a right described in sections #ajb through #aje7;a7 is made by the individual whose covered data is the subject of the request 7or an individual authorized to make such a request on the individual's behalf71 the covered entity shall request the provision of additional information necessary for the sole purpose of verifying the identity of the individual and shall not process or transfer such additional information for any other purpose4 7#c7 ,burden minimization ,a covered entity shall minimize the inconvenience to consumers relating to the verification or authentication of requests4 7b7 ,cost of access ,a covered entity shall carry out the rights described in sections #ajb through #aje7;a7 free of charge4 7c7 ,exceptions to sections #ajb through #aje7;b7 ,a covered entity may decline to comply with an individual's request to exercise a right described in sections #ajb through #aje7;b7 if-- 7#a7 complying with the request would be demonstrably impossible 7for purposes of this paragraph1 the receipt of a large number of verified requests1 on its own1 shall not be considered to render compliance with a request demonstrably impossible72 7#b7 complying with the request would prevent the covered entity from carrying out internal audits1 performing accounting functions1 processing refunds1 or fulfilling warranty claims1 provided that the covered data that is the subject of the request is not processed or transferred for any purpose other than such specific activities2 7#c7 the request is made to correct or delete publicly available information1 and then only to the extent the data is publicly available information2 7#d7 complying with the request would impair the publication of newsworthy information of legitimate public concern to the public by a covered entity1 or the processing or transfer of information by a covered entity for such purpose2 7#e7 complying with the request would impair the privacy of another individual or the rights of another to exercise free speech2 or 7#f7 the covered entity processes or will process the data subject to the request for a specific purpose described in subsection 7d7 of this section1 and complying with the request would prevent the covered entity from using such data for such specific purpose4 7d7 ,exceptions to affirmative express consent 7#a7 ,in general ,a covered entity may process or transfer covered data without the individual's affirmative express consent for any of the following purposes1 provided that the processing or transfer is reasonably necessary1 proportionate1 and limited to such purpose3 7,a7 ,to complete a transaction or fulfill an order or service specifically requested by an individual1 such as billing1 shipping1 or accounting4 7,b7 ,to perform system maintenance1 debug systems1 or repair errors to ensure the functionality of a product or service provided by the covered entity4 7,c7 ,to detect or respond to a security incident1 provide a secure environment1 or maintain the safety of a product or service4 7,d7 ,to protect against malicious1 deceptive1 fraudulent1 or illegal activity4 7,e7 ,to comply with a legal obligation or the establishment1 exercise1 or defense of legal claims4 7,f7 ,to prevent an individual from suffering harm where the covered entity believes in good faith that the individual is in danger of suffering death or serious physical injury4 7,g7 ,to effectuate a product recall pursuant to ,federal or ,state law4 7,h7 ,to conduct scientific1 historical1 or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved1 monitored1 and governed by an institutional review board or a similar oversight entity that meets standards promulgated by the ,commission pursuant to section #eec of title #e1 ,united ,states ,code4 7#b7 ,biometric information ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations pursuant to section #eec of title #e1 ,united ,states ,code1 identifying privacy protective requirements for the processing of biometric information for a purpose described in subparagraph 7,c7 or 7,d7 of paragraph 7#a74 ,such regulations shall include-- 7,a7 strict data processing limitations1 including a prohibition on the processing of biometric information unless the covered entity has a reasonable suspicion1 after a specific criminal incident involving the covered entity1 that the individual may engage in criminal activity2 7,b7 strict data transfer limitations1 including a prohibition on the transfer of biometric information to a third party other than to comply with a legal obligation or to establish1 exercise1 or defend a legal claim2 and 7,c7 strict transparency obligations1 including requiring disclosures in a conspicuous and readily accessible manner regarding specific data processing and transfer activities4 7e7 ,journalism exception ,nothing in this title shall apply to the publication of newsworthy information of legitimate public concern to the public by a covered entity1 or to the processing or transfer of information by a covered entity for that purpose4 7f7 ,applicability of other data privacy requirements ,a covered entity that is required to comply with title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq471 part ,c of title ,,xi of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq471 the ,family ,educational ,rights and ,privacy ,act 7#bj ,u4,s4,c4 #abcb;g2 part #ii of title #cd1 ,code of ,federal ,regulations71 or the regulations promulgated pursuant to section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 and is in compliance with the data privacy requirements of such regulations1 part1 title1 or ,act 7as applicable71 shall be deemed to be in compliance with the related requirements of this title1 except for section #ajg1 with respect to data subject to the requirements of such regulations1 part1 title1 or ,act4 ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance describing the implementation of this subsection4 7g7 ,applicability of other data security requirements ,a covered entity that is required to comply with title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq471 part ,c of title ,,xi of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 or the regulations promulgated pursuant to section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 and is in compliance with the information security requirements of such regulations1 part1 title1 or ,act 7as applicable71 shall be deemed to be in compliance with the requirements of section #ajg with respect to data subject to the requirements of such regulations1 part1 title1 or ,act4 ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance describing the implementation of this subsection4 7h7 ,in general ,the ,commission shall have authority under section #eec of title #e1 ,united ,states ,code1 to promulgate regulations necessary to carry out the provisions of this title4 ,,ii ,oversight and responsibility #bja4 ,executive responsibility 7a7 ,in general ,beginning #a year after the date of enactment of this ,act1 the chief executive officer of a covered entity that is a large data holder 7or1 if the entity does not have a chief executive officer1 the highest ranking officer of the entity7 and each privacy officer and data security officer of such entity shall annually certify to the ,commission1 in a manner specified by the ,commission1 that the entity maintains-- 7#a7 adequate internal controls to comply with this ,act2 and 7#b7 reporting structures to ensure that such certifying officers are involved in1 and are responsible for1 decisions that impact the entity's compliance with this ,act4 7b7 ,requirements ,a certification submitted under subsection 7a7 shall be based on a review of the effectiveness of a covered entity's internal controls and reporting structures that is conducted by the certifying officers no more than #ij days before the submission of the certification4 #bjb4 ,privacy and data security officers2 comprehensive privacy and data security programs2 risk assessments and compliance 7a7 ,privacy and data security officer ,a covered entity shall designate-- 7#a7 #a or more qualified employees as privacy officers2 and 7#b7 #a or more qualified employees 7in addition to any employee designated under paragraph 7#a77 as data security officers4 7b7 ,comprehensive privacy and data security programs1 risk assessments1 and compliance ,an employee who is designated by a covered entity as a privacy officer or a data security officer shall be responsible for1 at a minimum-- 7#a7 implementing a comprehensive written data privacy program and data security program to safeguard the privacy and security of covered data throughout the life cycle of development and operational practices of the covered entity's products or services2 7#b7 annually conducting privacy and data security risk assessments1 data hygiene1 and other quality control practices2 and 7#c7 facilitating the covered entity's ongoing compliance with this ,act4 #bjc4 ,service providers and third parties 7a7 ,service providers ,a service provider-- 7#a7 shall not process service provider data for any processing purpose other than one performed on behalf of1 and at the direction of1 the covered entity that transferred such data to the service provider1 except that a service provider may process data to comply with a legal obligation or the establishment1 exercise1 or defense of legal claims2 7#b7 shall not transfer service provider data to a third party without the affirmative express consent1 obtained by1 or on behalf of1 the covered entity1 of the individual to whom the service provider data is linked or reasonably linkable2 7#c7 shall delete or de-identify service provider data after the agreed upon end of the provision of services2 7#d7 is exempt from the requirements of sections #ajb7;a71 #ajc1 #ajd1 and #aje7;a7 with respect to service provider data1 but shall1 to the extent practicable-- 7,a7 assist the covered entity from which it received the service provider data in fulfilling requests made by individuals under such sections2 and 7,b7 shall delete1 de-identify1 or correct 7as applicable71 any service provider data that is subject to a verified request from an individual described in section #ajc or #ajd2 and 7#e7 is exempt from the requirements of section #ajf with respect to service provider data1 but shall have the same responsibilities and obligations as a covered entity with respect to such data under all other provisions of this ,act4 7b7 ,third parties ,a third party-- 7#a7 shall not process third party data for a purpose that is inconsistent with the expectations of a reasonable individual2 7#b7 may reasonably rely on representations made by the covered entity that transferred third party data regarding the expectation of a reasonable individual1 provided the third party conducts reasonable due diligence on the representations of the covered entity and finds those representations to be credible2 and 7#c7 upon receipt of any third party data1 is exempt from the requirements of section #aje7;c7 with respect to such data1 but shall have the same responsibilities and obligations as a covered entity with respect to such data under all other provisions of this ,act4 7c7 ,additional obligations on covered entities 7#a7 ,in general ,a covered entity shall-- 7,a7 exercise reasonable due diligence in selecting a service provider and conduct reasonable oversight of its service providers to ensure compliance with the applicable requirements of this section2 and 7,b7 exercise reasonable due diligence in deciding to transfer covered data to a third party1 and conduct oversight of third parties to which it transfers data to ensure compliance with the applicable requirements of this subsection4 7#b7 ,guidance ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance for covered entities regarding compliance with this subsection4 7d7 ,in general ,the ,commission shall have authority under section #eec of title #e1 ,united ,states ,code1 to promulgate regulations necessary to carry out the provisions of this section4 #bjd4 ,whistleblower protections 7a7 ,in general ,a covered entity shall not1 directly or indirectly1 discharge1 demote1 suspend1 threaten1 harass1 or in any other manner discriminate against a covered individual of the covered entity because-- 7#a7 the covered individual1 or anyone perceived as assisting the covered individual1 takes 7or the covered entity suspects that the covered individual has taken or will take7 a lawful action in providing to the ,federal ,government or the attorney general of a ,state information relating to any act or omission that the covered individual reasonably believes to be a violation of this ,act or any regulation promulgated under this ,act2 7#b7 the covered individual provides information that the covered individual reasonably believes evidences such a violation to-- 7,a7 a person with supervisory authority over the covered individual at the covered entity2 or 7,b7 another individual working for the covered entity who the covered individual reasonably believes has the authority to investigate1 discover1 or terminate the violation or to take any other action to address the violation2 7#c7 the covered individual testifies 7or the covered entity expects that the covered individual will testify7 in an investigation or judicial or administrative proceeding concerning such a violation2 or 7#d7 the covered individual assists or participates 7or the covered entity expects that the covered individual will assist or participate7 in such an investigation or judicial or administrative proceeding1 or the covered individual takes any other action to assist in carrying out the purposes of this ,act4 7b7 ,enforcement ,an individual who alleges discharge or other discrimination in violation of subsection 7a7 may bring an action governed by the rules1 procedures1 statute of limitations1 and legal burdens of proof in section #dbaba7;b7 of title #di1 ,united ,states ,code4 ,if the individual has not received a decision within #ahj days and there is no showing that such delay is due to the bad faith of the claimant1 the individual may bring an action for a jury trial1 governed by the burden of proof in section #dbaba7;b7 of title #di1 ,united ,states ,code1 in the appropriate district court of the ,united ,states for the following relief3 7#a7 ,temporary relief while the case is pending4 7#b7 ,reinstatement with the same seniority status that the individual would have had1 but for the discharge or discrimination4 7#c7 ,three times the amount of back pay otherwise owed to the individual1 with interest4 7#d7 ,consequential and compensatory damages1 and compensation for litigation costs1 expert witness fees1 and reasonable attorneys' fees4 7c7 ,waiver of rights and remedies ,the rights and remedies provided for in this section shall not be waived by any policy form or condition of employment1 including by a predispute arbitration agreement4 7d7 ,predispute arbitration agreements ,no predispute arbitration agreement shall be valid or enforceable if the agreement requires arbitration of a dispute arising under this section4 7e7 ,covered ,individual defined ,in this section1 the term covered individual means an applicant1 current or former employee1 contractor1 subcontractor1 grantee1 or agent of an employer4 #bje4 ,digital content forgeries 7a7 ,reports ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 the ,director of the ,national ,institute of ,standards and ,technology shall publish a report regarding digital content forgeries4 7b7 ,requirements ,each report under subsection 7a7 shall include the following3 7#a7 ,a definition of digital content forgeries along with accompanying explanatory materials4 ,the definition developed pursuant to this section shall not supersede any other provision of law or be construed to limit the authority of any executive agency related to digital content forgeries4 7#b7 ,a description of the common sources in the ,united ,states of digital content forgeries and commercial sources of digital content forgery technologies4 7#c7 ,an assessment of the uses1 applications1 and harms of digital content forgeries4 7#d7 ,an analysis of the methods and standards available to identify digital content forgeries as well as a description of the commercial technological counter-measures that are1 or could be1 used to address concerns with digital content forgeries1 which may include the provision of warnings to viewers of suspect content4 7#e7 ,a description of the types of digital content forgeries1 including those used to commit fraud1 cause harm or violate any provision of law4 7#f7 ,any other information determined appropriate by the ,director4 ,,iii ,miscellaneous #cja4 ,enforcement1 civil penalties1 and applicability 7a7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,new bureau 7,a7 ,in general ,the ,commission shall establish a new ,bureau within the ,commission comparable in structure1 size1 organization1 and authority to the existing ,bureaus with the ,commission related to consumer protection and competition4 7,b7 ,mission ,the mission of the ,bureau established under this paragraph shall be to assist the ,commission in exercising the ,commission's authority under this ,act and under other ,federal laws addressing privacy1 data security1 and related issues4 7,c7 ,timeline ,such ,bureau shall be established1 staffed1 and fully operational within #b years of enactment of this ,act4 7#b7 ,treatment as violation of rule ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,powers of ,commission 7,a7 ,in general ,except as provided in subparagraph 7,c71 the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,independent litigation authority ,the ,commission may commence1 defend1 or intervene in1 and supervise the litigation of any civil action under this subsection 7including an action to collect a civil penalty7 and any appeal of such action in its own name by any of its attorneys designated by it for such purpose4 ,the ,commission shall notify the ,attorney ,general of any such action and may consult with the ,attorney ,general with respect to any such action or request the ,attorney ,general on behalf of the ,commission to commence1 defend1 or intervene in any such action4 7#d7 ,data privacy and security relief fund 7,a7 ,establishment of relief fund ,there is established in the ,treasury of the ,united ,states a separate fund to be known as the ,data ,privacy and ,security ,relief ,fund 7referred to in this paragraph as the ,relief ,fund74 7,b7 ,deposits 7i7 ,deposits from the commission ,the ,commission shall deposit into the ,relief ,fund the amount of any civil penalty obtained against any covered entity in any judicial or administrative action the ,commission commences to enforce this ,act or a regulation promulgated under this ,act4 7ii7 ,deposits from the attorney general ,the ,attorney ,general of the ,united ,states shall deposit into the ,relief ,fund the amount of any civil penalty obtained against any covered entity in any judicial or administrative action the ,attorney ,general commences on behalf of the ,commission to enforce this ,act or a regulation promulgated under this ,act4 7,c7 ,use of fund amounts ,notwithstanding section #ccjb of title #ca1 ,united ,states ,code1 amounts in the ,relief ,fund shall be available to the ,commission1 without fiscal year limitation1 to provide redress1 payments or compensation1 or other monetary relief to individuals affected by an act or practice for which civil penalties have been obtained under this ,act4 ,to the extent that individuals cannot be located or such redress1 payments or compensation1 or other monetary relief are otherwise not practicable1 the ,commission may use such funds for the purpose of consumer or business education relating to data privacy and security or for the purpose of engaging in technological research that the ,commission considers necessary to enforce this ,act4 7,d7 ,amounts not subject to apportionment ,notwithstanding any other provision of law1 amounts in the ,relief ,fund shall not be subject to apportionment for purposes of chapter #ae of title #ca1 ,united ,states ,code1 or under any other authority4 7b7 ,enforcement by ,state attorneys general 7#a7 ,civil action ,in any case in which the attorney general of a ,state or a consumer protection officer of a ,state has reason to believe that an interest of the residents of that ,state has been or is adversely affected by the engagement of any covered entity in an act or practice that violates this ,act or a regulation promulgated under this ,act1 the attorney general of the ,state1 or a consumer protection officer of the ,state acting on behalf of the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to-- 7,a7 enjoin that act or practice2 7,b7 enforce compliance with this ,act or the regulation2 7,c7 obtain damages1 civil penalties1 restitution1 or other compensation on behalf of the residents of the ,state2 or 7,d7 obtain such other relief as the court may consider to be appropriate4 7#b7 ,notice to the commission and rights of the commission ,except where not feasible1 the ,state shall notify the ,commission in writing prior to initiating a civil action under paragraph 7#a74 ,such notice shall include a copy of the complaint to be filed to initiate such action4 ,if prior notice is not practicable1 the ,state shall provide a copy of the complaint to the ,commission immediately upon instituting the action4 ,upon receiving such notice1 the ,commission may intervene in such action and1 upon intervening-- 7,a7 be heard on all matters arising in such action2 and 7,b7 file petitions for appeal of a decision in such action4 7#c7 ,preservation of ,state powers ,no provision of this section shall be construed as altering1 limiting1 or affecting the authority of a ,state attorney general or a consumer protection officer of a ,state to-- 7,a7 bring an action or other regulatory proceeding arising solely under the law in effect in that ,state2 or 7,b7 exercise the powers conferred on the attorney general or on a consumer protection officer of a ,state by the laws of the ,state1 including the ability to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7c7 ,enforcement by individuals 7#a7 ,in general ,any individual alleging a violation of this ,act or a regulation promulgated under this ,act may bring a civil action in any court of competent jurisdiction1 ,state or ,federal4 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7,a7 an amount not less than #ajj and not greater than #a1jjj per violation per day or actual damages1 whichever is greater2 7,b7 punitive damages2 7,c7 reasonable attorney's fees and litigation costs2 and 7,d7 any other relief1 including equitable or declaratory relief1 that the court determines appropriate4 7#c7 ,injury in fact ,a violation of this ,act or a regulation promulgated under this ,act with respect to the covered data of an individual constitutes a concrete and particularized injury in fact to that individual4 7d7 ,invalidity of pre-,dispute arbitration agreements and pre-,dispute joint action waivers 7#a7 ,in general ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement or pre-dispute joint action waiver shall be valid or enforceable with respect to a privacy or data security dispute arising under this ,act4 7#b7 ,applicability ,any determination as to whether or how this subsection applies to any privacy or data security dispute shall be made by a court1 rather than an arbitrator1 without regard to whether such agreement purports to delegate such determination to an arbitrator4 7#c7 ,definitions ,for purposes of this subsection3 7,a7 ,the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement4 7,b7 ,the term pre-dispute joint-action waiver means an agreement1 whether or not part of a pre-dispute arbitration agreement1 that would prohibit1 or waive the right of1 one of the parties to the agreement to participate in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other forum1 concerning a dispute that has not yet arisen at the time of the making of the agreement4 7,c7 ,the term privacy or data security dispute means any claim relating to an alleged violation of this ,act1 or a regulation promulgated under this ,act1 and between an individual and a covered entity4 #cjb4 ,relationship to ,federal and ,state laws 7a7 ,federal law preservation ,nothing in this ,act or a regulation promulgated under this ,act shall be construed to limit-- 7#a7 the authority of the ,commission1 or any other ,executive agency1 under any other provision of law2 or 7#b7 any other provision of ,federal law unless as specifically authorized by this ,act4 7b7 ,state law preservation ,nothing in this ,act shall be construed to preempt1 displace1 or supplant the following ,state laws1 rules1 regulations1 or requirements3 7#a7 ,consumer protection laws of general applicability such as laws regulating deceptive1 unfair1 or unconscionable practices4 7#b7 ,civil rights laws4 7#c7 ,laws that govern the privacy rights or other protections of employees1 employee information1 or students or student information4 7#d7 ,laws that address notification requirements in the event of a data breach4 7#e7 ,contract or tort law4 7#f7 ,criminal laws governing fraud1 theft1 unauthorized access to information or unauthorized use of information1 malicious behavior1 and similar provisions1 and laws of criminal procedure4 7#g7 ,laws specifying remedies or a cause of action to individuals4 7#h7 ,public safety or sector specific laws unrelated to privacy or security4 7c7 ,preemption of directly conflicting ,state laws ,except as provided in subsections 7b7 and 7d71 this ,act shall supersede any ,state law to the extent such law directly conflicts with the provisions of this ,act1 or a standard1 rule1 or regulation promulgated under this ,act1 and then only to the extent of such direct conflict4 ,any ,state law1 rule1 or regulation shall not be considered in direct conflict if it affords a greater level of protection to individuals protected under this ,act4 7d7 ,preservation of common law or statutory causes of action for civil relief ,nothing in this ,act1 nor any amendment1 standard1 rule1 requirement1 assessment1 law or regulation promulgated under this ,act1 shall be construed to preempt1 displace1 or supplant any ,federal or ,state common law rights or remedies1 or any statute creating a remedy for civil relief1 including any cause of action for personal injury1 wrongful death1 property damage1 or other financial1 physical1 reputational1 or psychological injury based in negligence1 strict liability1 products liability1 failure to warn1 an objectively offensive intrusion into the private affairs or concerns of the individual1 or any other legal theory of liability under any ,federal or ,state common law1 or any ,state statutory law4 #cjc4 ,severability ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act and the application of such provision to other persons not similarly situated or to other circumstances shall not be affected by the invalidation4 #cjd4 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission such sums as may be necessary to carry out this ,act4