,,ii #aaf? ,,congress #a/ ,session ,s4 #bifh ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,decemb] #c1 #bjai,ms4 ,cantwell 7= h]self1 ,mr4 ,s*atz1 ,ms4 ,klobu*>1 & ,mr4 ,m>key7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to provide consum]s ) f\ndational data privacy rights1 create /rong ov]sight me*anisms1 & e/abli% mean+ful en=cem5t4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,consum] ,onl9e ,privacy ,rights ,act4 7b7 ,table ( cont5ts ,! table ( cont5ts ( ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,sec4 #b4 ,def9itions4,sec4 #c4 ,effective date4,,title ,i--,data privacy rights,sec4 #aja4 ,duty ( loyalty4,sec4 #ajb4 ,"r to access & transp>5cy4,sec4 #ajc4 ,"r to delete4,sec4 #ajd4 ,"r to correct inaccuracies4,sec4 #aje4 ,"r to controls4,sec4 #ajf4 ,"r to data m9imization4,sec4 #ajg4 ,"r to data security4,sec4 #ajh4 ,civil rights4,sec4 #aji4 ,prohibition on waiv] ( rights4,sec4 #aaj4 ,limitations & applicability4,,title ,,ii--,ov]sight & responsibility,sec4 #bja4 ,executive responsibility4,sec4 #bjb4 ,privacy & data security (fic]s2 compreh5sive privacy & data security programs2 risk assessm5ts & compliance4,sec4 #bjc4 ,s]vice provid]s & ?ird p>ties4,sec4 #bjd4 ,:i/lebl[] protections4,sec4 #bje4 ,digital cont5t =g]ies4,,title ,,iii--,miscellaneous,sec4 #cja4 ,en=cem5t1 civil p5alties1 & applicability4,sec4 #cjb4 ,relation%ip to ,f$]al & ,/ate laws4,sec4 #cjc4 ,sev]ability4,sec4 #cjd4 ,au?orization ( appropriations4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,affirmative express cons5t 7,a7 ,9 g5]al ,! t]m affirmative express cons5t means an affirmative act by an individual t cle>ly communicates ! individual's au?orization = an act or practice1 9 response to a specific reque/ t meets ! requirem5ts ( subp>agraph 7,b74 7,b7 ,reque/ requirem5ts ,! requirem5ts ( ?is subp>agraph ) respect to a reque/ f a cov]$ entity to an individual are ! foll[+3 7i7 ,! reque/ is provid$ to ! individual 9 a /&alone disclosure4 7ii7 ,! reque/ includes a description ( ea* act or practice = :i* ! individual's cons5t is s\ght &-- 7,i7 cle>ly di/+ui%es betwe5 an act or practice :i* is necess>y to fulfill a reque/ ( ! individual & an act or practice :i* is = ano!r purpose2 & 7,,ii7 is writt5 9 easy-to-und]/& language & includes a prom95t head+ t w\ld enable a reasonable individual to id5tify & und]/& ! act or practice4 7iii7 ,! reque/ cle>ly expla9s ! individual's applicable rights relat$ to cons5t4 7,c7 ,express cons5t requir$ ,an entity %all n inf] t an individual has provid$ affirmative express cons5t to an act or practice f ! inaction ( ! individual or ! individual's cont9u$ use ( a s]vice or product provid$ by ! entity4 7#b7 ,algori?mic decision-mak+ ,! t]m algori?mic decision-mak+ means a computational process1 includ+ "o d]iv$ f ma*9e le>n+1 /ati/ics1 or o!r data process+ or artificial intellig5ce te*niques t makes a decision or facilitates human decision-mak+ ) respect to cov]$ data4 7#c7 ,biometric in=mation 7,a7 ,9 g5]al ,! t]m biometric in=mation means any cov]$ data g5]at$ f ! measurem5t or specific te*nological process+ ( an individual's biological1 physical1 or physiological *>act]i/ics1 includ+-- 7i7 f+]pr9ts2 7ii7 voice pr9ts2 7iii7 iris or ret9a scans2 7iv7 facial scans or templates2 7v7 deoxyribonucleic acid 7,,dna7 in=mation2 & 7vi7 gait4 7,b7 ,exclusions ,su* t]m does n include writ+ samples1 writt5 signatures1 photographs1 voice record+s1 demographic data1 or physical *>act]i/ics su* z height1 weight1 hair color1 or eye color1 provid$ t su* data is n us$ = ! purpose ( id5tify+ an individual's unique biological1 physical1 or physiological *>act]i/ics4 7#d7 ,collect2 collection ,! t]ms collect & collection mean buy+1 r5t+1 ga!r+1 obta9+1 receiv+1 access+1 or o!rwise acquir+ cov]$ data by any means1 includ+ by passively or actively obs]v+ ! individual's behavior4 7#e7 ,common br&+ ,! t]m common br&+ means a %>$ "n1 s]vicem>k1 or tradem>k4 7#f7 ,control ,! t]m control means1 ) respect to an entity-- 7,a7 own]%ip (1 or ! p[] to vote1 m ?an #ej p]c5t ( ! out/&+ %>es ( any class ( vot+ security ( ! entity2 7,b7 control 9 any mann] ov] ! election ( a majority ( ! directors ( ! entity 7or ( individuals ex]cis+ simil> functions72 or 7,c7 ! p[] to ex]cise a controll+ influ5ce ov] ! managem5t ( ! entity4 7#g7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#h7 ,cov]$ data 7,a7 ,9 g5]al ,! t]m cov]$ data means in=mation t id5tifies1 or is l9k$ or reasonably l9kable to an individual or a consum] device1 includ+ d]iv$ data4 7,b7 ,exclusions ,su* t]m does n include-- 7i7 de-id5tifi$ data2 7ii7 employee data2 & 7iii7 public records4 7#i7 ,cov]$ entity 7,a7 ,9 g5]al ,! t]m cov]$ entity means any entity or p]son t-- 7i7 is subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 & 7ii7 processes or transf]s cov]$ data4 7,b7 ,inclusion ( commonly controll$ & commonly br&$ entities ,su* t]m includes any entity or p]son t controls1 is controll$ by1 is "u common control )1 or %>es common br&+ ) a cov]$ entity4 7,c7 ,exclusion ( small bus9ess ,su* t]m does n include a small bus9ess4 7#aj7 ,de-id5tifi$ data ,t]m de-id5tifi$ data means in=mation t _c reasonably be us$ to inf] in=mation ab\t1 or o!rwise be l9k$ to1 an individual1 a h\sehold1 or a device us$ by an individual or h\sehold1 provid$ t ! entity-- 7,a7 takes reasonable measures to ensure t ! in=mation _c be reid5tifi$1 or associat$ )1 an individual1 a h\sehold1 or a device us$ by an individual or h\sehold2 7,b7 publicly commits 9 a conspicu\s mann]-- 7i7 to process & transf] ! in=mation 9 a de-id5tifi$ =m2 & 7ii7 n to attempt to reid5tify or associate ! in=mation ) any individual1 h\sehold1 or device us$ by an individual or h\sehold2 & 7,c7 contractually obligates any p]son or entity t receives ! in=mation f ! cov]$ entity to comply ) all ( ! provisions ( ?is p>agraph4 7#aa7 ,d]iv$ data ,! t]m d]iv$ data means cov]$ data t is creat$ by ! d]ivation ( in=mation1 data1 assumptions1 or conclusions f facts1 evid5ce1 or ano!r s\rce ( in=mation or data ab\t an individual1 h\sehold1 or device us$ by an individual or h\sehold4 7#ab7 ,employee data ,! t]m employee data means-- 7,a7 cov]$ data t is collect$ by a cov]$ entity or ! cov]$ entity's s]vice provid] ab\t an individual 9 ! c\rse ( ! individual's employm5t or application = employm5t 7includ+ on a contract or tempor>y basis7 provid$ t su* data is reta9$ or process$ by ! cov]$ entity or ! cov]$ entity's s]vice provid] solely = purposes necess>y = ! individual's employm5t or application = employm5t2 7,b7 cov]$ data t is collect$ by a cov]$ entity or ! cov]$ entity's s]vice provid] t is em]g5cy contact in=mation = an individual :o is an employee1 contractor1 or job applicant ( ! cov]$ entity provid$ t su* data is reta9$ or process$ by ! cov]$ entity or ! cov]$ entity's s]vice provid] solely = ! purpose ( hav+ an em]g5cy contact = su* individual on file2 & 7,c7 cov]$ data t is collect$ by a cov]$ entity or ! cov]$ entity's s]vice provid] ab\t an individual 7or a relative ( an individual7 :o is an employee or =m] employee ( ! cov]$ entity = ! purpose ( adm9i/]+ b5efits to :i* su* individual or relative is entitl$ on ! basis ( ! individual's employm5t ) ! cov]$ entity1 provid$ t su* data is reta9$ or process$ by ! cov]$ entity or ! cov]$ entity's s]vice provid] solely = ! purpose ( adm9i/]+ su* b5efits4 7#ac7 ,executive ag5cy ,! t]m ,executive ag5cy has ! mean+ giv5 su* t]m 9 section #aje ( title #e1 ,unit$ ,/ates ,code4 7#ad7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates1 h[ev] id5tifi$1 includ+ by any unique id5tifi]4 7#ae7 ,l>ge data hold] ,! t]m l>ge data hold] means a cov]$ entity t1 9 ! mo/ rec5t cal5d> ye>-- 7,a7 process$ or transf]r$ ! cov]$ data ( m ?an #e1jjj1jjj individuals1 devices us$ by individuals or h\seholds1 or h\seholds2 or 7,b7 process$ or transf]r$ ! s5sitive cov]$ data ( m ?an #ajj1jjj individuals1 devices us$ by individuals or h\seholds1 or h\seholds4 7#af7 ,process ,! t]m process means any op]ation or set ( op]ations p]=m$ on cov]$ data includ+ collection1 analysis1 organization1 /ructur+1 reta9+1 us+1 or o!rwise h&l+ cov]$ data4 7#ag7 ,process+ purpose ,! t]m process+ purpose means an adequately specific & granul> reason = :i* a cov]$ entity processes cov]$ data t cle>ly describes ! process+ activity4 7#ah7 ,publicly available in=mation 7,a7 ,9 g5]al ,! t]m publicly available in=mation means-- 7i7 in=mation t a cov]$ entity has a reasonable basis to believe is lawfully made available to ! g5]al public f widely di/ribut$ m$ia2 & 7ii7 in=mation t is directly & volunt>ily disclos$ to ! g5]al public by ! individual to :om ! in=mation relates4 7,b7 ,limitation ,su* t]m does n include-- 7i7 in=mation d]iv$ f publicly available in=mation2 7ii7 biometric in=mation2 or 7iii7 nonpublicly available in=mation t has be5 comb9$ ) publicly available in=mation4 7#ai7 ,public records ,! t]m public records means in=mation t is lawfully made available f ,f$]al1 ,/ate1 or local gov]nm5t records provid$ t ! cov]$ entity processes & transf]s su* in=mation 9 accordance ) any re/rictions or t]ms ( use plac$ on ! in=mation by ! relevant gov]nm5t entity4 7#bj7 ,s5sitive cov]$ data ,! t]m s5sitive cov]$ data means ! foll[+ =ms ( cov]$ data3 7,a7 ,a gov]nm5t-issu$ id5tifi]1 su* z a ,social ,security numb]1 passport numb]1 or driv]'s lic5se numb]4 7,b7 ,any in=mation t describes or reveals ! pa/1 pres5t1 or future physical heal?1 m5tal heal?1 disability1 or diagnosis ( an individual4 7,c7 ,a f9ancial acc\nt numb]1 debit c>d numb]1 cr$it c>d numb]1 or any requir$ security or access code1 password1 or cr$5tials all[+ access to any su* acc\nt4 7,d7 ,biometric in=mation4 7,e7 ,precise geolocation in=mation t reveals ! pa/ or pres5t actual physical location ( an individual or device4 7,f7 ,! cont5t or metadata ( an individual's private communications or ! id5tity ( ! p>ties to su* communications unless ! cov]$ entity is an int5d$ recipi5t ( ! communication4 7,g7 ,an email address1 telephone numb]1 or acc\nt log-9 cr$5tials4 7,h7 ,in=mation reveal+ an individual's race1 e?nicity1 national orig91 religion1 or union memb]%ip 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ disclosure ( su* in=mation4 7,i7 ,in=mation reveal+ ! sexual ori5tation or sexual behavior ( an individual 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ disclosure ( su* in=mation4 7,j7 ,in=mation reveal+ onl9e activities ov] "t & across ?ird p>ty websites or onl9e s]vices4 7,k7 ,cal5d> in=mation1 address book in=mation1 phone or text logs1 photos1 or videos ma9ta9$ on an individual's device4 7,l7 ,a photograph1 film1 video record+1 or o!r simil> m$ium t %[s ! nak$ or und]g>m5t-clad private area ( an individual4 7,m7 ,any o!r cov]$ data process$ or transf]r$ = ! purpose ( id5tify+ ! above data types4 7,n7 ,any o!r cov]$ data t ! ,commission det]m9es to be s5sitive cov]$ data ?r\gh a rulemak+ pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code4 7#ba7 ,s]vice provid] 7,a7 ,9 g5]al ,! t]m s]vice provid] means a cov]$ entity t processes or transf]s cov]$ data 9 ! c\rse ( p]=m+ a s]vice or function on behalf (1 & at ! direction (1 ano!r cov]$ entity1 b only to ! ext5t t su* process+ or transf]ral-- 7i7 relates to ! p]=mance ( su* s]vice or function2 or 7ii7 is necess>y to comply ) a legal obligation or to e/abli%1 ex]cise1 or def5d legal claims4 7,b7 ,exclusion ,su* t]m does n include a cov]$ entity t processes or transf]s ! cov]$ data outside ( ! direct relation%ip betwe5 ! s]vice provid] & ! cov]$ entity4 7#bb7 ,s]vice provid] data ,! t]m s]vice provid] data means cov]$ data t is collect$ by or has be5 transf]r$ to a s]vice provid] by a cov]$ entity = ! purpose ( all[+ ! s]vice provid] to p]=m a s]vice or function on behalf (1 & at ! direction (1 su* cov]$ entity4 7#bc7 ,small bus9ess 7,a7 ,9 g5]al ,! t]m small bus9ess means an entity t c e/abli% t1 ) respect to ! #c prec$+ cal5d> ye>s 7or = ! p]iod dur+ :i* ! entity has be5 9 exi/5ce if1 z ( su* date1 su* p]iod is less ?an #c ye>s7 ! entity does n-- 7i7 ma9ta9 annual av]age gross rev5ue 9 excess ( #be1jjj1jjj2 7ii7 annually process ! cov]$ data ( an av]age ( #ajj1jjj or m individuals1 h\seholds1 or devices us$ by individuals or h\seholds2 & 7iii7 d]ive #ej p]c5t or m ( its annual rev5ue f transf]r+ individuals' cov]$ data4 7,b7 ,common control2 common br&+ ,= purposes ( subp>agraph 7,a71 ! annual av]age gross rev5ue1 data process+ volume1 & p]c5tage ( annual rev5ue ( an entity %all include ! rev5ue & process+ activities ( any p]son t controls1 is controll$ by1 is "u common control )1 or %>es common br&+ ) su* entity4 7#bd7 ,?ird p>ty ,! t]m ?ird p>ty-- 7,a7 means any p]son or entity t-- 7i7 processes or transf]s ?ird p>ty data2 & 7ii7 is n a s]vice provid] ) respect to su* data2 & 7,b7 does n include a p]son or entity t collects cov]$ data f ano!r entity if ! two entities are relat$ by common own]%ip or corporate control & %>e common br&+4 7#be7 ,?ird p>ty data ,! t]m ?ird p>ty data means cov]$ data t is transf]r$ to a ?ird p>ty by a cov]$ entity4 7#bf7 ,transf] ,! t]m transf] means to disclose1 release1 %>e1 dissem9ate1 make available1 sell1 lic5se1 or o!rwise communicate cov]$ data by any means to a s]vice provid] or ?ird p>ty-- 7,a7 9 ex*ange = consid]ation2 or 7,b7 = a comm]cial purpose4 7#bg7 ,unique id5tifi] ,! t]m unique id5tifi] means an id5tifi] t is reasonably l9kable to an individual1 h\sehold1 or device us$ by an individual or h\sehold1 includ+ a device id5tifi]1 an ,int]net ,protocol address1 cookies1 beacons1 pixel tags1 mobile ad id5tifi]s1 or simil> te*nology1 cu/om] numb]1 unique pseudonym1 or us] alias1 telephone numb]s1 or o!r =ms ( p]si/5t or probabili/ic id5tifi]s t c be us$ to id5tify a p>ticul> individual1 a h\sehold1 or a device4 7#bh7 ,widely di/ribut$ m$ia ,! t]m widely di/ribut$ m$ia means in=mation t is available to ! g5]al public1 includ+ in=mation f a telephone book or onl9e directory1 a television1 int]net1 or radio program1 ! news m$ia1 or an int]net site t is available to ! g5]al public on an unre/rict$ basis1 b does n include an obsc5e visual depiction z def9$ 9 section #adfj ( title #ah1 ,unit$ ,/ates ,code4 #c4 ,effective date ,?is ,act %all take effect on ! date t is #ahj days aft] ! date ( enactm5t ( ?is ,act4 ,i ,data privacy rights #aja4 ,duty ( loyalty 7a7 ,9 g5]al ,a cov]$ entity %all n-- 7#a7 engage 9 a deceptive data practice or a h>mful data practice2 or 7#b7 process or transf] cov]$ data 9 a mann] t violates any provision ( ?is ,act4 7b7 ,def9itions 7#a7 ,deceptive data practice ,! t]m deceptive data practice means an act or practice involv+ ! process+ or transf] ( cov]$ data 9 a mann] t con/itutes a deceptive act or practice 9 violation ( section #e7;a77#a7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#a774 7#b7 ,h>mful data practice ,! t]m h>mful data practice means ! process+ or transf] ( cov]$ data 9 a mann] t causes or is likely to cause any ( ! foll[+3 7,a7 ,f9ancial1 physical1 or reputational injury to an individual4 7,b7 ,physical or o!r (f5sive intrusion ^u ! solitude or seclusion ( an individual or ! individual's private affairs or conc]ns1 :]e su* intrusion w\ld be (f5sive to a reasonable p]son4 7,c7 ,o!r sub/antial injury to an individual4 #ajb4 ,"r to access & transp>5cy 7a7 ,"r ,to access ,a cov]$ entity1 ^u ! v]ifi$ reque/ ( an individual1 %all provide ! individual1 9 a human-readable =mat t a reasonable individual c und]/&1 )-- 7#a7 a copy or accurate repres5tation ( ! cov]$ data ( ! individual process$ or transf]r$ by ! cov]$ entity2 & 7#b7 ! "n ( any ?ird p>ty to :om cov]$ data ( ! individual has be5 transf]r$ by ! cov]$ entity & a description ( ! purpose = :i* ! entity transf]r$ su* data to su* ?ird p>ty4 7b7 ,"r to transp>5cy ,a cov]$ entity %all make publicly & p]si/5tly available1 9 a conspicu\s & readily accessible mann]1 a privacy policy t provides a detail$ & accurate repres5tation ( ! entity's data process+ & data transf] activities4 ,su* privacy policy %all include1 at a m9imum-- 7#a7 ! id5tity & ! contact in=mation ( ! cov]$ entity1 includ+ ! contact in=mation = ! cov]$ entity's repres5tative = privacy & data security inquiries2 7#b7 ea* category ( data ! cov]$ entity collects & ! process+ purposes = :i* su* data is collect$2 7#c7 :e!r ! cov]$ entity transf]s cov]$ data &1 if s-- 7,a7 ea* category ( s]vice provid] & ?ird p>ty to :i* ! cov]$ entity transf]s cov]$ data & ! purposes = :i* su* data is transf]r$ to su* categories2 & 7,b7 ! id5tity ( ea* ?ird p>ty to :i* ! cov]$ entity transf]s cov]$ data & ! purposes = :i* su* data is transf]r$ to su* ?ird p>ty1 except = transf]s to gov]nm5tal entities pursuant to a c\rt ord] or law t prohibits ! cov]$ entity f disclos+ su* transf]2 7#d7 h[ long cov]$ data process$ by ! cov]$ entity w be reta9$ by ! cov]$ entity & a description ( ! cov]$ entity's data m9imization policies2 7#e7 h[ individuals c ex]cise ! individual rights describ$ 9 ?is title2 7#f7 a description ( ! cov]$ entity's data security policies2 & 7#g7 ! effective date ( ! privacy policy4 7c7 ,languages ,a cov]$ entity %all make ! privacy policy requir$ "u ?is section available to ! public 9 all ( ! languages 9 :i* ! cov]$ entity provides a product or s]vice or c>ries out any o!r activities to :i* ! privacy policy relates4 7d7 ,"r ,to cons5t to mat]ial *anges ,a cov]$ entity %all n make a mat]ial *ange to its privacy policy or practices ) respect to previ\sly collect$ cov]$ data t w\ld weak5 ! privacy protections applicable to su* data )\t fir/ obta9+ prior affirmative express cons5t f ! individuals affect$4 ,! cov]$ entity %all provide direct notification1 :]e possible1 reg>d+ mat]ial *anges to affect$ individuals1 tak+ into acc\nt available te*nology & ! nature ( ! relation%ip4 #ajc4 ,"r to delete ,a cov]$ entity1 ^u ! v]ifi$ reque/ ( an individual1 %all-- 7#a7 delete1 or all[ ! individual to delete1 any in=mation 9 ! cov]$ data ( ! individual t is process$ by ! cov]$ entity2 & 7#b7 in=m any s]vice provid] or ?ird p>ty to :i* ! cov]$ entity transf]r$ su* data ( ! individual's deletion reque/4 #ajd4 ,"r to correct inaccuracies ,a cov]$ entity1 ^u ! v]ifi$ reque/ ( an individual1 %all-- 7#a7 correct1 or all[ ! individual to correct1 inaccurate or incomplete in=mation 9 ! cov]$ data ( ! individual t is process$ by ! cov]$ entity2 & 7#b7 in=m any s]vice provid] or ?ird p>ty to :i* ! cov]$ entity transf]r$ su* data ( ! correct$ in=mation4 #aje4 ,"r to controls 7a7 ,"r to data portability ,a cov]$ entity1 ^u ! v]ifi$ reque/ ( an individual1 %all export ! individual's cov]$ data1 except = d]iv$ data1 )\t lic5s+ re/rictions-- 7#a7 9 a human-readable =mat t all[s ! individual to und]/& su* cov]$ data ( ! individual2 & 7#b7 9 a /ructur$1 int]op]able1 & ma*9e-readable =mat t includes all cov]$ data or o!r in=mation t ! cov]$ entity collect$ to ! ext5t feasible4 7b7 ,"r ,to opt out ( transf]s 7#a7 ,9 g5]al ,a cov]$ entity-- 7,a7 %all n transf] an individual's cov]$ data to a ?ird p>ty if ! individual objects to ! transf]2 & 7,b7 %all all[ an individual to object to ! cov]$ entity transf]r+ cov]$ data ( ! individual to a ?ird p>ty ?r\gh a process e/abli%$ "u ! rule issu$ by ! ,commission pursuant to p>agraph 7#b74 7#b7 ,rulemak+ 7,a7 ,9 g5]al ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue a rule "u section #eec ( title #e1 ,unit$ ,/ates ,code1 e/abli%+ "o or m acceptable processes = cov]$ entities to foll[ 9 all[+ individuals to opt out ( transf]s ( cov]$ data4 7,b7 ,requirem5ts ,! processes e/abli%$ by ! ,commission pursuant to ?is subp>agraph %all-- 7i7 be c5traliz$1 to ! ext5t feasible1 to m9imize ! numb] ( opt-out designations ( a simil> type t a consum] mu/ make2 7ii7 include cle> & conspicu\s opt-out notices & consum] fri5dly me*anisms to all[ an individual to opt out ( transf]s ( cov]$ data2 7iii7 all[ an individual t objects to a transf] ( cov]$ data to view ! /atus ( su* objection2 7iv7 all[ an individual t objects to a transf] ( cov]$ data to *ange ! /atus ( su* objection2 7v7 be privacy protective2 & 7vi7 be in=m$ by ! ,commission's exp]i5ce develop+ & implem5t+ ! ,national ,d ,n ,call ,regi/ry4 7c7 ,s5sitive data ,a cov]$ entity-- 7#a7 %all n process ! s5sitive cov]$ data ( an individual )\t ! individual's prior1 affirmative express cons5t2 7#b7 %all n transf] ! s5sitive cov]$ data ( an individual )\t ! individual's prior1 affirmative express cons5t2 7#c7 %all provide an individual ) a consum]-fri5dly means to )draw affirmative express cons5t to process ! s5sitive cov]$ data ( ! individual2 & 7#d7 is n requir$ to obta9 prior1 affirmative express cons5t to process or transf] publicly available in=mation4 #ajf4 ,"r to data m9imization ,a cov]$ entity %all n process or transf] cov]$ data beyond :at is reasonably necess>y1 proportionate1 & limit$-- 7#a7 to c>ry out ! specific process+ purposes & transf]s describ$ 9 ! privacy policy made available by ! cov]$ entity z requir$ "u section #ajb2 7#b7 to c>ry out a specific process+ purpose or transf] = :i* ! cov]$ entity has obta9$ affirmative express cons5t2 or 7#c7 = a purpose specifically p]mitt$ "u subsection 7d7 ( section #aaj4 ,cov]$ data process+ & transf]s consi/5t ) ?is section %all n sup]s$e any o!r provision ( ?is ,act4 #ajg4 ,"r to data security 7a7 ,9 g5]al ,a cov]$ entity %all e/abli%1 implem5t1 & ma9ta9 reasonable data security practices to protect ! confid5tiality1 integrity1 & accessibility ( cov]$ data4 ,su* data security practices %all be appropriate to ! volume & nature ( ! cov]$ data at issue4 7b7 ,specific requirem5ts ,data security practices requir$ "u subsection 7a7 %all include1 at a m9imum1 ! foll[+3 7#a7 ,assess vuln]abilities ,id5tify+ & assess+ any reasonably =eseeable risks to1 & vuln]abilities 91 ea* sy/em ma9ta9$ by ! cov]$ entity t processes or transf]s cov]$ data1 includ+ unau?oriz$ access to or risks to cov]$ data1 human vuln]abilities1 access rights1 & use ( s]vice provid]s4 ,su* activities %all include a plan to receive & respond to unsolicit$ reports ( vuln]abilities by entities & individuals4 7#b7 ,prev5tive & correction action ,tak+ prev5tive & corrective action to mitigate any risks or vuln]abilities to cov]$ data id5tifi$ by ! cov]$ entity1 :i* may include implem5t+ adm9i/rative1 te*nical1 or physical safegu>ds or *anges to data security practices or ! ar*itecture1 in/allation1 or implem5tation ( network or op]at+ s(tw>e4 7#c7 ,in=mation ret5tion & disposal ,dispos+ cov]$ data t is requir$ to be delet$ or is no long] necess>y = ! purpose = :i* ! data 0 collect$ unless an individual has provid$ affirmative express cons5t to su* ret5tion4 ,su* process %all include de/roy+1 p]man5tly eras+1 or o!rwise modify+ ! cov]$ data to make su* data p]man5tly unreadable or indeciph]able & unrecov]able & data hygi5e practices to ensure ongo+ compliance ) ?is subsection4 7#d7 ,tra9+ ,tra9+ all employees ) access to cov]$ data on h[ to safegu>d cov]$ data & protect individual privacy & updat+ t tra9+ z necess>y4 7c7 ,tra9+ guidel9es ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission1 9 conjunction ) ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all publi% guidance = cov]$ entities on h[ to provide effective data security & privacy tra9+ z describ$ 9 subsection 7b77#d74 #ajh4 ,civil rights 7a7 ,protections 7#a7 ,9 g5]al ,a cov]$ entity %all n process or transf] cov]$ data on ! basis ( an individual's or class ( individuals' actual or p]ceiv$ race1 color1 e?nicity1 religion1 national orig91 sex1 g5d]1 g5d] id5tity1 sexual ori5tation1 familial /atus1 biometric in=mation1 lawful s\rce ( income1 or disability-- 7,a7 = ! purpose ( adv]tis+1 m>ket+1 solicit+1 (f]+1 sell+1 leas+1 lic5s+1 r5t+1 or o!rwise comm]cially contract+ = a h\s+1 employm5t1 cr$it1 or education opportunity1 9 a mann] t unlawfully discrim9ates aga9/ or o!rwise makes ! opportunity unavailable to ! individual or class ( individuals2 or 7,b7 9 a mann] t unlawfully segregates1 discrim9ates aga9/1 or o!rwise makes unavailable to ! individual or class ( individuals ! goods1 s]vices1 facilities1 privileges1 advantages1 or accommodations ( any place ( public accommodation4 7#b7 ,exception ,no?+ 9 ?is section %all limit a cov]$ entity f process+ cov]$ data = legitimate int]nal te/+ = ! purpose ( prev5t+ unlawful discrim9ation or o!rwise det]m9+ ! ext5t or effectiv5ess ( ! cov]$ entity's compliance ) ?is ,act4 7#c7 ,,ftc advisory op9ions ,a cov]$ entity may reque/ advice f ! ,commission conc]n+ ! cov]$ entity's pot5tial compliance ) ?is subsection1 9 accordance ) ! ,commission's rules ( practice on advisory op9ions4 7b7 ,algori?mic decision-,mak+ impact assessm5t 7#a7 ,impact assessm5t ,not)/&+ any o!r provision ( law1 a cov]$ entity engag$ 9 algori?mic decision-mak+1 or 9 assi/+ o!rs 9 algori?mic decision-mak+ = ! purpose ( process+ or transf]r+ cov]$ data1 solely or 9 "p to make or facilitate adv]tis+ = h\s+1 education1 employm5t or cr$it opportunities1 or an eligibility det]m9ation = h\s+1 education1 employm5t or cr$it opportunities or det]m9+ access to1 or re/rictions on ! use (1 any place ( public accommodation1 mu/ annually conduct an impact assessm5t ( su* algori?mic decision-mak+ t-- 7,a7 describes & evaluates ! developm5t ( ! cov]$ entity's algori?mic decision-mak+ processes includ+ ! design & tra9+ data us$ to develop ! algori?mic decision-mak+ process1 h[ ! algori?mic decision-mak+ process 0 te/$ = accuracy1 fairness1 bias & discrim9ation2 & 7,b7 assesses :e!r ! algori?mic decision-mak+ sy/em produces discrim9atory results on ! basis ( an individual's or class ( individuals' actual or p]ceiv$ race1 color1 e?nicity1 religion1 national orig91 sex1 g5d]1 g5d] id5tity1 sexual ori5tation1 familial /atus1 biometric in=mation1 lawful s\rce ( income1 or disability4 7#b7 ,ext]nal1 indep5d5t auditor or rese>*] ,a cov]$ entity may utilize an ext]nal1 indep5d5t auditor or rese>*] to conduct su* assessm5ts4 7#c7 ,availability ,! cov]$ entity-- 7,a7 %all make ! impact assessm5t available to ! ,commission ^u reque/2 & 7,b7 may make ! impact assessm5t public4 ,a cov]$ entity may r$act & segregate trade secrets z def9$ by section #ahci ( title #ah1 ,unit$ ,/ates ,code1 f public disclosure "u ?is subsection4 7#d7 ,/udy ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all publi% a report conta9+ ! results ( a /udy1 us+ ! ,commission's au?ority "u section #f7;b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;b771 exam9+ ! use ( algori?ms = ! purposes describ$ 9 ?is subsection4 ,n lat] ?an #c ye>s aft] ! publication ( ! initial report1 & z necess>y !reaft]1 ! ,commission %all publi% a new & updat$ v]sion ( su* report4 #aji4 ,prohibition on waiv] ( rights ,a cov]$ entity %all n condition ! provision ( a s]vice or product to an individual on ! individual's agreem5t to waive privacy rights gu>ante$ by-- 7#a7 sections #aja1 #aje7;a71 & #ajf ?r\gh #aji ( ?is ,act2 & 7#b7 sections #ajb ?r\gh #ajd1 & #aje7;b7 & 7c7 ( ?is ,act1 except 9 ! case :]e-- 7,a7 !re exi/s a direct relation%ip betwe5 ! individual & ! cov]$ entity initiat$ by ! individual2 7,b7 ! provision ( ! s]vice or product reque/$ by ! individual requires ! process+ or transf]r+ ( ! specific cov]$ data ( ! individual & ! cov]$ data is /rictly necess>y to provide ! s]vice or product2 & 7,c7 an individual provides affirmative express cons5t to su* specific limitations4 #aaj4 ,limitations & applicability 7a7 ,v]ification ( reque/s 7#a7 ,9 g5]al ,a cov]$ entity %all n p]mit an individual to ex]cise a "r describ$ 9 sections #ajb ?r\gh #aje7;a7 if-- 7,a7 ! cov]$ entity _c reasonably v]ify t ! individual mak+ ! reque/ to ex]cise ! "r is ! individual ^: cov]$ data is ! subject ( ! reque/ or an individual au?oriz$ to make su* a reque/ on ! individual's behalf2 or 7,b7 ! cov]$ entity reasonably believes t ! reque/ is made to int]f]e ) a contract betwe5 ! cov]$ entity & ano!r individual4 7#b7 ,additional in=mation ,if a cov]$ entity _c reasonably v]ify t a reque/ to ex]cise a "r describ$ 9 sections #ajb ?r\gh #aje7;a7 is made by ! individual ^: cov]$ data is ! subject ( ! reque/ 7or an individual au?oriz$ to make su* a reque/ on ! individual's behalf71 ! cov]$ entity %all reque/ ! provision ( additional in=mation necess>y = ! sole purpose ( v]ify+ ! id5tity ( ! individual & %all n process or transf] su* additional in=mation = any o!r purpose4 7#c7 ,burd5 m9imization ,a cov]$ entity %all m9imize ! inconv5i5ce to consum]s relat+ to ! v]ification or au!ntication ( reque/s4 7b7 ,co/ ( access ,a cov]$ entity %all c>ry out ! rights describ$ 9 sections #ajb ?r\gh #aje7;a7 free ( *>ge4 7c7 ,exceptions to sections #ajb ?r\gh #aje7;b7 ,a cov]$ entity may decl9e to comply ) an individual's reque/ to ex]cise a "r describ$ 9 sections #ajb ?r\gh #aje7;b7 if-- 7#a7 comply+ ) ! reque/ w\ld be demon/rably impossible 7= purposes ( ?is p>agraph1 ! receipt ( a l>ge numb] ( v]ifi$ reque/s1 on its own1 %all n be consid]$ to r5d] compliance ) a reque/ demon/rably impossible72 7#b7 comply+ ) ! reque/ w\ld prev5t ! cov]$ entity f c>ry+ out int]nal audits1 p]=m+ acc\nt+ functions1 process+ refunds1 or fulfill+ w>ranty claims1 provid$ t ! cov]$ data t is ! subject ( ! reque/ is n process$ or transf]r$ = any purpose o!r ?an su* specific activities2 7#c7 ! reque/ is made to correct or delete publicly available in=mation1 & !n only to ! ext5t ! data is publicly available in=mation2 7#d7 comply+ ) ! reque/ w\ld impair ! publication ( newswor?y in=mation ( legitimate public conc]n to ! public by a cov]$ entity1 or ! process+ or transf] ( in=mation by a cov]$ entity = su* purpose2 7#e7 comply+ ) ! reque/ w\ld impair ! privacy ( ano!r individual or ! rights ( ano!r to ex]cise free spee*2 or 7#f7 ! cov]$ entity processes or w process ! data subject to ! reque/ = a specific purpose describ$ 9 subsection 7d7 ( ?is section1 & comply+ ) ! reque/ w\ld prev5t ! cov]$ entity f us+ su* data = su* specific purpose4 7d7 ,exceptions to affirmative express cons5t 7#a7 ,9 g5]al ,a cov]$ entity may process or transf] cov]$ data )\t ! individual's affirmative express cons5t = any ( ! foll[+ purposes1 provid$ t ! process+ or transf] is reasonably necess>y1 proportionate1 & limit$ to su* purpose3 7,a7 ,to complete a transaction or fulfill an ord] or s]vice specifically reque/$ by an individual1 su* z bill+1 %ipp+1 or acc\nt+4 7,b7 ,to p]=m sy/em ma9t5ance1 debug sy/ems1 or repair errors to ensure ! functionality ( a product or s]vice provid$ by ! cov]$ entity4 7,c7 ,to detect or respond to a security incid5t1 provide a secure environm5t1 or ma9ta9 ! safety ( a product or s]vice4 7,d7 ,to protect aga9/ malici\s1 deceptive1 fraudul5t1 or illegal activity4 7,e7 ,to comply ) a legal obligation or ! e/abli%m5t1 ex]cise1 or def5se ( legal claims4 7,f7 ,to prev5t an individual f suff]+ h>m :]e ! cov]$ entity believes 9 good fai? t ! individual is 9 dang] ( suff]+ dea? or s]i\s physical injury4 7,g7 ,to effectuate a product recall pursuant to ,f$]al or ,/ate law4 7,h7 ,to conduct sci5tific1 hi/orical1 or /ati/ical rese>* 9 ! public int]e/ t adh]es to all o!r applicable e?ics & privacy laws & is approv$1 monitor$1 & gov]n$ by an in/itutional review bo>d or a simil> ov]sight entity t meets /&>ds promulgat$ by ! ,commission pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code4 7#b7 ,biometric in=mation ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code1 id5tify+ privacy protective requirem5ts = ! process+ ( biometric in=mation = a purpose describ$ 9 subp>agraph 7,c7 or 7,d7 ( p>agraph 7#a74 ,su* regulations %all include-- 7,a7 /rict data process+ limitations1 includ+ a prohibition on ! process+ ( biometric in=mation unless ! cov]$ entity has a reasonable suspicion1 aft] a specific crim9al incid5t involv+ ! cov]$ entity1 t ! individual may engage 9 crim9al activity2 7,b7 /rict data transf] limitations1 includ+ a prohibition on ! transf] ( biometric in=mation to a ?ird p>ty o!r ?an to comply ) a legal obligation or to e/abli%1 ex]cise1 or def5d a legal claim2 & 7,c7 /rict transp>5cy obligations1 includ+ requir+ disclosures 9 a conspicu\s & readily accessible mann] reg>d+ specific data process+ & transf] activities4 7e7 ,j\rnalism exception ,no?+ 9 ?is title %all apply to ! publication ( newswor?y in=mation ( legitimate public conc]n to ! public by a cov]$ entity1 or to ! process+ or transf] ( in=mation by a cov]$ entity = t purpose4 7f7 ,applicability ( o!r data privacy requirem5ts ,a cov]$ entity t is requir$ to comply ) title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq471 "p ,c ( title ,,xi ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq471 ! ,family ,educational ,rights & ,privacy ,act 7#bj ,u4,s4,c4 #abcb;g2 "p #ii ( title #cd1 ,code ( ,f$]al ,regulations71 or ! regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 & is 9 compliance ) ! data privacy requirem5ts ( su* regulations1 "p1 title1 or ,act 7z applicable71 %all be deem$ to be 9 compliance ) ! relat$ requirem5ts ( ?is title1 except = section #ajg1 ) respect to data subject to ! requirem5ts ( su* regulations1 "p1 title1 or ,act4 ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance describ+ ! implem5tation ( ?is subsection4 7g7 ,applicability ( o!r data security requirem5ts ,a cov]$ entity t is requir$ to comply ) title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq471 "p ,c ( title ,,xi ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 or ! regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 & is 9 compliance ) ! in=mation security requirem5ts ( su* regulations1 "p1 title1 or ,act 7z applicable71 %all be deem$ to be 9 compliance ) ! requirem5ts ( section #ajg ) respect to data subject to ! requirem5ts ( su* regulations1 "p1 title1 or ,act4 ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance describ+ ! implem5tation ( ?is subsection4 7h7 ,9 g5]al ,! ,commission %all h au?ority "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to promulgate regulations necess>y to c>ry out ! provisions ( ?is title4 ,,ii ,ov]sight & responsibility #bja4 ,executive responsibility 7a7 ,9 g5]al ,beg9n+ #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! *ief executive (fic] ( a cov]$ entity t is a l>ge data hold] 7or1 if ! entity does n h a *ief executive (fic]1 ! highe/ rank+ (fic] ( ! entity7 & ea* privacy (fic] & data security (fic] ( su* entity %all annually c]tify to ! ,commission1 9 a mann] specifi$ by ! ,commission1 t ! entity ma9ta9s-- 7#a7 adequate int]nal controls to comply ) ?is ,act2 & 7#b7 report+ /ructures to ensure t su* c]tify+ (fic]s are involv$ 91 & are responsible =1 decisions t impact ! entity's compliance ) ?is ,act4 7b7 ,requirem5ts ,a c]tification submitt$ "u subsection 7a7 %all be bas$ on a review ( ! effectiv5ess ( a cov]$ entity's int]nal controls & report+ /ructures t is conduct$ by ! c]tify+ (fic]s no m ?an #ij days be=e ! submission ( ! c]tification4 #bjb4 ,privacy & data security (fic]s2 compreh5sive privacy & data security programs2 risk assessm5ts & compliance 7a7 ,privacy & data security (fic] ,a cov]$ entity %all designate-- 7#a7 #a or m qualifi$ employees z privacy (fic]s2 & 7#b7 #a or m qualifi$ employees 79 addition to any employee designat$ "u p>agraph 7#a77 z data security (fic]s4 7b7 ,compreh5sive privacy & data security programs1 risk assessm5ts1 & compliance ,an employee :o is designat$ by a cov]$ entity z a privacy (fic] or a data security (fic] %all be responsible =1 at a m9imum-- 7#a7 implem5t+ a compreh5sive writt5 data privacy program & data security program to safegu>d ! privacy & security ( cov]$ data ?r\gh\t ! life cycle ( developm5t & op]ational practices ( ! cov]$ entity's products or s]vices2 7#b7 annually conduct+ privacy & data security risk assessm5ts1 data hygi5e1 & o!r quality control practices2 & 7#c7 facilitat+ ! cov]$ entity's ongo+ compliance ) ?is ,act4 #bjc4 ,s]vice provid]s & ?ird p>ties 7a7 ,s]vice provid]s ,a s]vice provid]-- 7#a7 %all n process s]vice provid] data = any process+ purpose o!r ?an "o p]=m$ on behalf (1 & at ! direction (1 ! cov]$ entity t transf]r$ su* data to ! s]vice provid]1 except t a s]vice provid] may process data to comply ) a legal obligation or ! e/abli%m5t1 ex]cise1 or def5se ( legal claims2 7#b7 %all n transf] s]vice provid] data to a ?ird p>ty )\t ! affirmative express cons5t1 obta9$ by1 or on behalf (1 ! cov]$ entity1 ( ! individual to :om ! s]vice provid] data is l9k$ or reasonably l9kable2 7#c7 %all delete or de-id5tify s]vice provid] data aft] ! agre$ ^u end ( ! provision ( s]vices2 7#d7 is exempt f ! requirem5ts ( sections #ajb7;a71 #ajc1 #ajd1 & #aje7;a7 ) respect to s]vice provid] data1 b %all1 to ! ext5t practicable-- 7,a7 assi/ ! cov]$ entity f :i* x receiv$ ! s]vice provid] data 9 fulfill+ reque/s made by individuals "u su* sections2 & 7,b7 %all delete1 de-id5tify1 or correct 7z applicable71 any s]vice provid] data t is subject to a v]ifi$ reque/ f an individual describ$ 9 section #ajc or #ajd2 & 7#e7 is exempt f ! requirem5ts ( section #ajf ) respect to s]vice provid] data1 b %all h ! same responsibilities & obligations z a cov]$ entity ) respect to su* data "u all o!r provisions ( ?is ,act4 7b7 ,?ird p>ties ,a ?ird p>ty-- 7#a7 %all n process ?ird p>ty data = a purpose t is inconsi/5t ) ! expectations ( a reasonable individual2 7#b7 may reasonably rely on repres5tations made by ! cov]$ entity t transf]r$ ?ird p>ty data reg>d+ ! expectation ( a reasonable individual1 provid$ ! ?ird p>ty conducts reasonable due dilig5ce on ! repres5tations ( ! cov]$ entity & f9ds ^? repres5tations to be cr$ible2 & 7#c7 ^u receipt ( any ?ird p>ty data1 is exempt f ! requirem5ts ( section #aje7;c7 ) respect to su* data1 b %all h ! same responsibilities & obligations z a cov]$ entity ) respect to su* data "u all o!r provisions ( ?is ,act4 7c7 ,additional obligations on cov]$ entities 7#a7 ,9 g5]al ,a cov]$ entity %all-- 7,a7 ex]cise reasonable due dilig5ce 9 select+ a s]vice provid] & conduct reasonable ov]sight ( its s]vice provid]s to ensure compliance ) ! applicable requirem5ts ( ?is section2 & 7,b7 ex]cise reasonable due dilig5ce 9 decid+ to transf] cov]$ data to a ?ird p>ty1 & conduct ov]sight ( ?ird p>ties to :i* x transf]s data to ensure compliance ) ! applicable requirem5ts ( ?is subsection4 7#b7 ,guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance = cov]$ entities reg>d+ compliance ) ?is subsection4 7d7 ,9 g5]al ,! ,commission %all h au?ority "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to promulgate regulations necess>y to c>ry out ! provisions ( ?is section4 #bjd4 ,:i/lebl[] protections 7a7 ,9 g5]al ,a cov]$ entity %all n1 directly or indirectly1 dis*>ge1 demote1 susp5d1 ?reat51 h>ass1 or 9 any o!r mann] discrim9ate aga9/ a cov]$ individual ( ! cov]$ entity because-- 7#a7 ! cov]$ individual1 or anyone p]ceiv$ z assi/+ ! cov]$ individual1 takes 7or ! cov]$ entity suspects t ! cov]$ individual has tak5 or w take7 a lawful action 9 provid+ to ! ,f$]al ,gov]nm5t or ! attorney g5]al ( a ,/ate in=mation relat+ to any act or omission t ! cov]$ individual reasonably believes to be a violation ( ?is ,act or any regulation promulgat$ "u ?is ,act2 7#b7 ! cov]$ individual provides in=mation t ! cov]$ individual reasonably believes evid5ces su* a violation to-- 7,a7 a p]son ) sup]visory au?ority ov] ! cov]$ individual at ! cov]$ entity2 or 7,b7 ano!r individual work+ = ! cov]$ entity :o ! cov]$ individual reasonably believes has ! au?ority to inve/igate1 discov]1 or t]m9ate ! violation or to take any o!r action to address ! violation2 7#c7 ! cov]$ individual te/ifies 7or ! cov]$ entity expects t ! cov]$ individual w te/ify7 9 an inve/igation or judicial or adm9i/rative proce$+ conc]n+ su* a violation2 or 7#d7 ! cov]$ individual assi/s or p>ticipates 7or ! cov]$ entity expects t ! cov]$ individual w assi/ or p>ticipate7 9 su* an inve/igation or judicial or adm9i/rative proce$+1 or ! cov]$ individual takes any o!r action to assi/ 9 c>ry+ out ! purposes ( ?is ,act4 7b7 ,en=cem5t ,an individual :o alleges dis*>ge or o!r discrim9ation 9 violation ( subsection 7a7 may br+ an action gov]n$ by ! rules1 proc$ures1 /atute ( limitations1 & legal burd5s ( pro( 9 section #dbaba7;b7 ( title #di1 ,unit$ ,/ates ,code4 ,if ! individual has n receiv$ a decision )9 #ahj days & !re is no %[+ t su* delay is due to ! bad fai? ( ! claimant1 ! individual may br+ an action = a jury trial1 gov]n$ by ! burd5 ( pro( 9 section #dbaba7;b7 ( title #di1 ,unit$ ,/ates ,code1 9 ! appropriate di/rict c\rt ( ! ,unit$ ,/ates = ! foll[+ relief3 7#a7 ,tempor>y relief :ile ! case is p5d+4 7#b7 ,re9/atem5t ) ! same s5iority /atus t ! individual w\ld h _h1 b = ! dis*>ge or discrim9ation4 7#c7 ,?ree times ! am\nt ( back pay o!rwise ow$ to ! individual1 ) int]e/4 7#d7 ,consequ5tial & comp5satory damages1 & comp5sation = litigation co/s1 exp]t witness fees1 & reasonable attorneys' fees4 7c7 ,waiv] ( rights & rem$ies ,! rights & rem$ies provid$ = 9 ?is section %all n be waiv$ by any policy =m or condition ( employm5t1 includ+ by a pr$ispute arbitration agreem5t4 7d7 ,pr$ispute arbitration agreem5ts ,no pr$ispute arbitration agreem5t %all be valid or en=ceable if ! agreem5t requires arbitration ( a dispute aris+ "u ?is section4 7e7 ,cov]$ ,individual def9$ ,9 ?is section1 ! t]m cov]$ individual means an applicant1 curr5t or =m] employee1 contractor1 subcontractor1 grantee1 or ag5t ( an employ]4 #bje4 ,digital cont5t =g]ies 7a7 ,reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all publi% a report reg>d+ digital cont5t =g]ies4 7b7 ,requirem5ts ,ea* report "u subsection 7a7 %all include ! foll[+3 7#a7 ,a def9ition ( digital cont5t =g]ies along ) accompany+ explanatory mat]ials4 ,! def9ition develop$ pursuant to ?is section %all n sup]s$e any o!r provision ( law or be con/ru$ to limit ! au?ority ( any executive ag5cy relat$ to digital cont5t =g]ies4 7#b7 ,a description ( ! common s\rces 9 ! ,unit$ ,/ates ( digital cont5t =g]ies & comm]cial s\rces ( digital cont5t =g]y te*nologies4 7#c7 ,an assessm5t ( ! uses1 applications1 & h>ms ( digital cont5t =g]ies4 7#d7 ,an analysis ( ! me?ods & /&>ds available to id5tify digital cont5t =g]ies z well z a description ( ! comm]cial te*nological c\nt]-measures t are1 or c\ld be1 us$ to address conc]ns ) digital cont5t =g]ies1 :i* may include ! provision ( w>n+s to view]s ( suspect cont5t4 7#e7 ,a description ( ! types ( digital cont5t =g]ies1 includ+ ^? us$ to commit fraud1 cause h>m or violate any provision ( law4 7#f7 ,any o!r in=mation det]m9$ appropriate by ! ,director4 ,,iii ,miscellane\s #cja4 ,en=cem5t1 civil p5alties1 & applicability 7a7 ,en=cem5t by ! ,f$]al ,trade ,commission 7#a7 ,new bureau 7,a7 ,9 g5]al ,! ,commission %all e/abli% a new ,bureau )9 ! ,commission comp>able 9 /ructure1 size1 organization1 & au?ority to ! exi/+ ,bureaus ) ! ,commission relat$ to consum] protection & competition4 7,b7 ,mission ,! mission ( ! ,bureau e/abli%$ "u ?is p>agraph %all be to assi/ ! ,commission 9 ex]cis+ ! ,commission's au?ority "u ?is ,act & "u o!r ,f$]al laws address+ privacy1 data security1 & relat$ issues4 7,c7 ,timel9e ,su* ,bureau %all be e/abli%$1 /aff$1 & fully op]ational )9 #b ye>s ( enactm5t ( ?is ,act4 7#b7 ,treatm5t z violation ( rule ,a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,p[]s ( ,commission 7,a7 ,9 g5]al ,except z provid$ 9 subp>agraph 7,c71 ! ,commission %all en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 7,b7 ,privileges & immunities ,any p]son :o violates ?is ,act or a regulation promulgat$ "u ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,indep5d5t litigation au?ority ,! ,commission may comm5ce1 def5d1 or int]v5e 91 & sup]vise ! litigation ( any civil action "u ?is subsection 7includ+ an action to collect a civil p5alty7 & any appeal ( su* action 9 its own "n by any ( its attorneys designat$ by x = su* purpose4 ,! ,commission %all notify ! ,attorney ,g5]al ( any su* action & may consult ) ! ,attorney ,g5]al ) respect to any su* action or reque/ ! ,attorney ,g5]al on behalf ( ! ,commission to comm5ce1 def5d1 or int]v5e 9 any su* action4 7#d7 ,data privacy & security relief fund 7,a7 ,e/abli%m5t ( relief fund ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a sep>ate fund to be kn[n z ! ,data ,privacy & ,security ,relief ,fund 7ref]r$ to 9 ?is p>agraph z ! ,relief ,fund74 7,b7 ,deposits 7i7 ,deposits f ! commission ,! ,commission %all deposit into ! ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any judicial or adm9i/rative action ! ,commission comm5ces to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act4 7ii7 ,deposits f ! attorney g5]al ,! ,attorney ,g5]al ( ! ,unit$ ,/ates %all deposit into ! ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any judicial or adm9i/rative action ! ,attorney ,g5]al comm5ces on behalf ( ! ,commission to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act4 7,c7 ,use ( fund am\nts ,not)/&+ section #ccjb ( title #ca1 ,unit$ ,/ates ,code1 am\nts 9 ! ,relief ,fund %all be available to ! ,commission1 )\t fiscal ye> limitation1 to provide r$ress1 paym5ts or comp5sation1 or o!r monet>y relief to individuals affect$ by an act or practice = :i* civil p5alties h be5 obta9$ "u ?is ,act4 ,to ! ext5t t individuals _c be locat$ or su* r$ress1 paym5ts or comp5sation1 or o!r monet>y relief are o!rwise n practicable1 ! ,commission may use su* funds = ! purpose ( consum] or bus9ess education relat+ to data privacy & security or = ! purpose ( engag+ 9 te*nological rese>* t ! ,commission consid]s necess>y to en=ce ?is ,act4 7,d7 ,am\nts n subject to apportionm5t ,not)/&+ any o!r provision ( law1 am\nts 9 ! ,relief ,fund %all n be subject to apportionm5t = purposes ( *apt] #ae ( title #ca1 ,unit$ ,/ates ,code1 or "u any o!r au?ority4 7b7 ,en=cem5t by ,/ate attorneys g5]al 7#a7 ,civil action ,9 any case 9 :i* ! attorney g5]al ( a ,/ate or a consum] protection (fic] ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( t ,/ate has be5 or is adv]sely affect$ by ! engagem5t ( any cov]$ entity 9 an act or practice t violates ?is ,act or a regulation promulgat$ "u ?is ,act1 ! attorney g5]al ( ! ,/ate1 or a consum] protection (fic] ( ! ,/ate act+ on behalf ( ! ,/ate1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7,a7 enjo9 t act or practice2 7,b7 en=ce compliance ) ?is ,act or ! regulation2 7,c7 obta9 damages1 civil p5alties1 re/itution1 or o!r comp5sation on behalf ( ! resid5ts ( ! ,/ate2 or 7,d7 obta9 su* o!r relief z ! c\rt may consid] to be appropriate4 7#b7 ,notice to ! commission & rights ( ! commission ,except :]e n feasible1 ! ,/ate %all notify ! ,commission 9 writ+ prior to initiat+ a civil action "u p>agraph 7#a74 ,su* notice %all include a copy ( ! compla9t to be fil$ to initiate su* action4 ,if prior notice is n practicable1 ! ,/ate %all provide a copy ( ! compla9t to ! ,commission imm$iately ^u in/itut+ ! action4 ,^u receiv+ su* notice1 ! ,commission may int]v5e 9 su* action &1 ^u int]v5+-- 7,a7 be he>d on all matt]s aris+ 9 su* action2 & 7,b7 file petitions = appeal ( a decision 9 su* action4 7#c7 ,pres]vation ( ,/ate p[]s ,no provision ( ?is section %all be con/ru$ z alt]+1 limit+1 or affect+ ! au?ority ( a ,/ate attorney g5]al or a consum] protection (fic] ( a ,/ate to-- 7,a7 br+ an action or o!r regulatory proce$+ aris+ solely "u ! law 9 effect 9 t ,/ate2 or 7,b7 ex]cise ! p[]s conf]r$ on ! attorney g5]al or on a consum] protection (fic] ( a ,/ate by ! laws ( ! ,/ate1 includ+ ! ability to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7#d7 ,v5ue2 s]vice ( process 7,a7 ,v5ue ,any action br\ght "u p>agraph 7#a7 may be br\ght 9 ! di/rict c\rt ( ! ,unit$ ,/ates t meets applicable requirem5ts relat+ to v5ue "u section #acia ( title #bh1 ,unit$ ,/ates ,code4 7,b7 ,s]vice ( process ,9 an action br\ght "u p>agraph 7#a71 process may be s]v$ 9 any di/rict 9 :i* ! def5dant-- 7i7 is an inhabitant2 or 7ii7 may be f\nd4 7c7 ,en=cem5t by individuals 7#a7 ,9 g5]al ,any individual alleg+ a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act may br+ a civil action 9 any c\rt ( compet5t jurisdiction1 ,/ate or ,f$]al4 7#b7 ,relief ,9 a civil action br\ght "u p>agraph 7#a7 9 :i* ! pla9tiff prevails1 ! c\rt may aw>d-- 7,a7 an am\nt n less ?an #ajj & n great] ?an #a1jjj p] violation p] day or actual damages1 :i*ev] is great]2 7,b7 punitive damages2 7,c7 reasonable attorney's fees & litigation co/s2 & 7,d7 any o!r relief1 includ+ equitable or decl>atory relief1 t ! c\rt det]m9es appropriate4 7#c7 ,injury 9 fact ,a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act ) respect to ! cov]$ data ( an individual con/itutes a concrete & p>ticul>iz$ injury 9 fact to t individual4 7d7 ,invalidity ( pre-,dispute arbitration agreem5ts & pre-,dispute jo9t action waiv]s 7#a7 ,9 g5]al ,not)/&+ any o!r provision ( law1 no pre-dispute arbitration agreem5t or pre-dispute jo9t action waiv] %all be valid or en=ceable ) respect to a privacy or data security dispute aris+ "u ?is ,act4 7#b7 ,applicability ,any det]m9ation z to :e!r or h[ ?is subsection applies to any privacy or data security dispute %all be made by a c\rt1 r ?an an arbitrator1 )\t reg>d to :e!r su* agreem5t purports to delegate su* det]m9ation to an arbitrator4 7#c7 ,def9itions ,= purposes ( ?is subsection3 7,a7 ,! t]m pre-dispute arbitration agreem5t means any agreem5t to arbitrate a dispute t has n aris5 at ! "t ( ! mak+ ( ! agreem5t4 7,b7 ,! t]m pre-dispute jo9t-action waiv] means an agreem5t1 :e!r or n "p ( a pre-dispute arbitration agreem5t1 t w\ld prohibit1 or waive ! "r (1 "o ( ! p>ties to ! agreem5t to p>ticipate 9 a jo9t1 class1 or collective action 9 a judicial1 arbitral1 adm9i/rative1 or o!r =um1 conc]n+ a dispute t has n yet aris5 at ! "t ( ! mak+ ( ! agreem5t4 7,c7 ,! t]m privacy or data security dispute means any claim relat+ to an alleg$ violation ( ?is ,act1 or a regulation promulgat$ "u ?is ,act1 & betwe5 an individual & a cov]$ entity4 #cjb4 ,relation%ip to ,f$]al & ,/ate laws 7a7 ,f$]al law pres]vation ,no?+ 9 ?is ,act or a regulation promulgat$ "u ?is ,act %all be con/ru$ to limit-- 7#a7 ! au?ority ( ! ,commission1 or any o!r ,executive ag5cy1 "u any o!r provision ( law2 or 7#b7 any o!r provision ( ,f$]al law unless z specifically au?oriz$ by ?is ,act4 7b7 ,/ate law pres]vation ,no?+ 9 ?is ,act %all be con/ru$ to preempt1 displace1 or supplant ! foll[+ ,/ate laws1 rules1 regulations1 or requirem5ts3 7#a7 ,consum] protection laws ( g5]al applicability su* z laws regulat+ deceptive1 unfair1 or unconscionable practices4 7#b7 ,civil rights laws4 7#c7 ,laws t gov]n ! privacy rights or o!r protections ( employees1 employee in=mation1 or /ud5ts or /ud5t in=mation4 7#d7 ,laws t address notification requirem5ts 9 ! ev5t ( a data brea*4 7#e7 ,contract or tort law4 7#f7 ,crim9al laws gov]n+ fraud1 !ft1 unau?oriz$ access to in=mation or unau?oriz$ use ( in=mation1 malici\s behavior1 & simil> provisions1 & laws ( crim9al proc$ure4 7#g7 ,laws specify+ rem$ies or a cause ( action to individuals4 7#h7 ,public safety or sector specific laws unrelat$ to privacy or security4 7c7 ,preemption ( directly conflict+ ,/ate laws ,except z provid$ 9 subsections 7b7 & 7d71 ?is ,act %all sup]s$e any ,/ate law to ! ext5t su* law directly conflicts ) ! provisions ( ?is ,act1 or a /&>d1 rule1 or regulation promulgat$ "u ?is ,act1 & !n only to ! ext5t ( su* direct conflict4 ,any ,/ate law1 rule1 or regulation %all n be consid]$ 9 direct conflict if x af=ds a great] level ( protection to individuals protect$ "u ?is ,act4 7d7 ,pres]vation ( common law or /atutory causes ( action = civil relief ,no?+ 9 ?is ,act1 nor any am5dm5t1 /&>d1 rule1 requirem5t1 assessm5t1 law or regulation promulgat$ "u ?is ,act1 %all be con/ru$ to preempt1 displace1 or supplant any ,f$]al or ,/ate common law rights or rem$ies1 or any /atute creat+ a rem$y = civil relief1 includ+ any cause ( action = p]sonal injury1 wrongful dea?1 prop]ty damage1 or o!r f9ancial1 physical1 reputational1 or psy*ological injury bas$ 9 neglig5ce1 /rict liability1 products liability1 failure to w>n1 an objectively (f5sive intrusion into ! private affairs or conc]ns ( ! individual1 or any o!r legal !ory ( liability "u any ,f$]al or ,/ate common law1 or any ,/ate /atutory law4 #cjc4 ,sev]ability ,if any provision ( ?is ,act1 or ! application !re( to any p]son or circum/ance1 is held invalid1 ! rema9d] ( ?is ,act & ! application ( su* provision to o!r p]sons n simil>ly situat$ or to o!r circum/ances %all n be affect$ by ! invalidation4 #cjd4 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to ! ,commission su* sums z may be necess>y to c>ry out ?is ,act4