,,ii #aafth ,,congress #b;d ,session ,s4 #ccjj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #ac1 #bjbj,mrs4 ,gillibrand introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish a ,federal data protection agency1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,in general ,this ,act may be cited as the ,data ,protection ,act of #bjbj4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,findings and purpose4,sec4 #c4 ,definitions4,sec4 #d4 ,establishment of the ,data ,protection ,agency4,sec4 #e4 ,executive and administrative powers4,sec4 #f4 ,purpose1 objectives1 and functions of the ,agency4,sec4 #g4 ,rulemaking authority4,sec4 #h4 ,specific agency authorities4,sec4 #i4 ,enforcement powers4,sec4 #aj4 ,preservation of ,state law4,sec4 #aa4 ,reports and information4,sec4 #ab4 ,transfers of functions4,sec4 #ac4 ,authorization of appropriations4 #b4 ,findings and purpose 7a7 ,findings ,congress finds the following3 7#a7 ,privacy is an important fundamental individual right protected by the ,constitution of the ,united ,states4 7#b7 ,the right of privacy is widely recognized in international legal instruments that the ,united ,states has endorsed1 ratified1 or promoted4 7#c7 ,the right to privacy protects the individual against intrusions into seclusion1 protects individual autonomy1 safeguards fair processing of data that pertains to the individual1 advances the just processing of data1 and contributes to respect for individual civil rights and fundamental freedoms4 7#d7 ,privacy protections not only protect and benefit the individual1 but they also advance other societal interests1 including the protection of marginalized and vulnerable groups of individuals1 the safeguarding of other foundational values of our democracy1 such as freedom of information1 freedom of speech1 justice1 and human ingenuity and dignity1 as well as the integrity of democratic institutions1 including fair and open elections4 7#e7 ,the privacy of an individual is directly affected by the collection1 maintenance1 use1 and dissemination of personal data4 7#f7 ,the increasing digitalization of information and its application in classifying individuals and groups of individuals has greatly magnified the harm to individual privacy that can occur from the collection1 maintenance1 use1 or dissemination of personal data4 7#g7 ,the opportunities for an individual to secure employment1 insurance1 credit1 and housing and the right to due process and other legal protections are endangered by the unrestricted collection1 disclosure1 processing1 and misuse of personal data4 7#h7 ,information systems lacking privacy protection amplify bias4 7#i7 ,in order to protect the privacy of individuals1 it is necessary and proper for ,congress to regulate the collection1 maintenance1 use1 processing1 storage1 and dissemination of information4 7b7 ,purpose ,the purpose of this ,act is to establish a data protection agency to-- 7#a7 safeguard privacy1 promote innovation1 ensure compliance with the law1 and promote best practices2 7#b7 provide guidance on matters related to electronic data storage1 communication1 and usage2 7#c7 provide the public with information and guidance on privacy protections and fair information practices and principles2 7#d7 oversee ,federal agencies' implementation of section #eeb;a of title #e1 ,united ,states ,code2 7#e7 promote implementation of fair information practices in the public and private sector2 and 7#f7 represent the ,united ,states in international forums4 #c4 ,definitions ,in this ,act3 7#a7 ,agency ,the term ,agency means the ,data ,protection ,agency established under section #d4 7#b7 ,covered entity ,the term covered entity means any person that collects1 processes1 or otherwise obtains personal data with the exception of an individual processing personal data in the course of personal or household activity4 7#c7 ,federal privacy law 7,a7 ,in general ,the term ,federal privacy law means the provisions of this ,act1 the laws specified in subparagraph 7,b71 and any rule or order prescribed by the ,agency under this ,act or pursuant to the authorities transferred under this ,act4 ,such term shall not include the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,b7 ,specified laws ,the laws specified in this subparagraph are the following laws 7including any amendments made by such laws73 7i7 ,the ,children's ,online ,privacy ,protection ,act 7#ae ,u4,s4,c4 #feja et seq474 7ii7 ,the ,,can-,,spam ,act of #bjjc 7#ae ,u4,s4,c #ggja et seq474 7iii7 ,the ,do-,not-,call ,implementation ,act 7#ae ,u4,s4,c4 #faeb et seq47 and ,public ,law #ajh-hb 7#ae ,u4,s4,c4 #faea74 7iv7 ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq474 7v7 ,title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7vi7 ,subtitle ,d of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba et seq474 7vii7 ,the ,identity ,theft ,assumption and ,deterrence ,act of #aiih 7,pub4 ,l4 #aje-cah74 7viii7 ,the ,telemarketing and ,consumer ,fraud and ,abuse ,prevention ,act 7#ae ,u4,s4,c4 #faja et seq474 7ix7 ,section #bbg of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbg7 7commonly known as the ,telephone ,consumer ,protection ,act of #aiia74 7#d7 ,high-risk data practice ,the term high-risk data practice means an action by a covered entity that involves-- 7,a7 a systematic or extensive evaluation of personal data that is based on automated processing1 including profiling1 and on which decisions are based that produce legal effects concerning the individual or household or similarly significantly affect the individual or household2 7,b7 sensitive data uses2 7,c7 a systemic monitoring of publicly accessible data on a large scale2 7,d7 processing involving the use of new technologies1 or combinations of technologies1 that creates adverse consequences or potential adverse consequences to an individual or society2 7,e7 decisions about an individual's access to a product1 service1 opportunity1 or benefit which is based to any extent on automated processing2 7,f7 any profiling of individuals on a large scale2 7,g7 any processing of biometric data for the purpose of uniquely identifying an individual2 7,h7 any processing of genetic data1 other than data processed by a health care professional for the purpose of providing health care to the individual2 7,i7 combining1 comparing1 or matching personal data obtained from multiple sources2 7,j7 processing the personal data of an individual that has not been obtained directly from the individual2 7,k7 processing which involves tracking an individual's geolocation2 or 7,l7 the use of personal data of children or other vulnerable individuals for marketing purposes1 profiling1 or automated processing4 7#e7 ,personal data ,the term personal data means any information that identifies1 relates to1 describes1 is capable of being associated with1 or could reasonably be linked1 directly or indirectly1 with a particular individual or device1 including-- 7,a7 an identifier such as a real name1 alias1 signature1 date of birth1 gender identity1 sexual orientation1 marital status1 physical characteristic or description1 postal address1 telephone number1 unique personal identifier1 military identification number1 online identifier1 ,internet ,protocol address1 email address1 account name1 mother's maiden name1 social security number1 driver's license number1 passport number1 or other similar identifiers2 7,b7 information such as employment status1 employment history1 or other professional or employment-related information2 7,c7 bank account number1 credit card number1 debit card number1 insurance policy number1 or any other financial information2 7,d7 medical information1 mental health information1 or health insurance information2 7,e7 commercial information1 including records of personal property1 products or services purchased1 obtained1 or considered1 or other purchasing or consuming histories or tendencies2 7,f7 characteristics of protected classes under ,federal law1 including race1 color1 national origin1 religion1 sex1 age1 or disability2 7,g7 biometric information2 7,h7 internet or other electronic network activity information1 including browsing history1 search history1 content1 and information regarding an individual's interaction with an internet website1 mobile application1 or advertisement2 7,i7 historical or real-time geolocation data2 7,j7 audio1 electronic1 visual1 thermal1 olfactory1 or similar information2 7,k7 education records2 7,l7 political information2 7,m7 password-protected digital photographs and digital videos not otherwise available to the public2 7,n7 information on criminal convictions or arrests2 7,o7 information 7such as an ,internet ,protocol address or other similar identifier7 that allows an individual or device to be singled out for interaction1 even without identification of such individual or device2 and 7,p7 inferences drawn from any of the information identified in this subparagraph to create a profile about an individual reflecting the individual's preferences1 characteristics1 psychological trends1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 and aptitudes4 7#f7 ,process ,the term process means to perform an operation or set of operations on personal data1 either manually or by automated means1 including but not limited to collecting1 recording1 organizing1 structuring1 storing1 adapting or altering1 retrieving1 consulting1 using1 disclosing by transmission1 sorting1 classifying1 disseminating or otherwise making available1 aligning or combining1 restricting1 erasing or destroying4 7#g7 ,profile ,the term profile means the use of an automated means to process data 7including personal data and other data7 to derive1 infer1 predict1 or evaluate information about an individual or group1 such as the processing of data to analyze or predict an individual's identity1 attributes1 interests1 or behavior4 7#h7 ,sensitive data use ,the term sensitive data use means-- 7,a7 the processing of data in a manner that reveals an individual's race1 color1 ethnicity1 religion or creed1 national origin or ancestry1 sex1 gender1 gender identity1 sexuality1 sexual orientation1 political beliefs1 trade union membership1 familial status1 lawful source of income1 financial status 7such as the individual's income or assets71 veteran status1 criminal convictions or arrests1 citizenship1 past1 present1 or future physical or mental health or condition1 psychological states1 disability1 geospatial data1 or any other factor used as a proxy for identifying any of these characteristics2 or 7,b7 the use of the biometric or genetic data of an individual4 7#i7 ,transfer date ,the term transfer date means the date that is #a year after the date of enactment of this ,act4 #d4 ,establishment of the ,data ,protection ,agency 7a7 ,establishment 7#a7 ,in general ,there is established in the ,executive branch an agency to be known as the ,data ,protection ,agency which shall regulate the processing of personal data4 7#b7 ,status ,the ,agency shall be an independent establishment 7as defined in section #ajd of title #e1 ,united ,states ,code74 7b7 ,director and deputy director 7#a7 ,in general ,there is established a position of the ,director of the ,united ,states ,data ,protection ,agency 7referred to in this ,act as the ,director71 who shall serve as the head of the ,agency4 7#b7 ,appointment ,subject to paragraph 7#c71 the ,director shall be appointed by the ,president1 by and with the advice and consent of the ,senate4 7#c7 ,qualification ,the ,president shall nominate the ,director from among members of the public at large who are well qualified for service on the ,agency by virtue of their knowledge and expertise in-- 7,a7 technology2 7,b7 protection of personal data2 7,c7 civil rights and liberties2 7,d7 law2 7,e7 social sciences2 and 7,f7 business4 7#d7 ,compensation 7,a7 ,in general ,the ,director shall be compensated at the rate prescribed for level ,,ii of the ,executive ,schedule under section #ecac of title #e1 ,united ,states ,code4 7,b7 ,conforming amendment ,section #ecac of title #e1 ,united ,states ,code1 is amended by inserting after the item relating to the ,federal ,transit ,administrator the following new item3 ,director of the ,united ,states ,data ,protection ,agency4 4 7#e7 ,deputy director ,there is established the position of ,deputy ,director1 who shall-- 7,a7 be appointed by the ,director2 and 7,b7 serve as acting ,director in the absence or unavailability of the ,director4 7c7 ,term 7#a7 ,in general ,the ,director shall serve for a term of #e years4 7#b7 ,expiration of term ,an individual may serve as ,director after the expiration of the term for which appointed1 until a successor has been appointed and qualified4 7#c7 ,removal for cause ,the ,president may remove the ,director for inefficiency1 neglect of duty1 or malfeasance in office4 7d7 ,service restriction ,no ,director or ,deputy ,director may engage in any other employment during the period of service of such person as ,director or ,deputy ,director4 7e7 ,offices ,the principal office of the ,agency shall be in the ,district of ,columbia4 ,the ,director may establish regional offices of the ,agency4 #e4 ,executive and administrative powers 7a7 ,powers of the agency ,the ,director is authorized to establish the general polices of the ,agency with respect to all executive and administrative functions1 including-- 7#a7 the establishment of rules for conducting the general business of the ,agency1 in a manner not inconsistent with this ,act2 7#b7 to bind the ,agency and enter into contracts2 7#c7 directing the establishment and maintenance of divisions or other offices within the ,agency1 in order to carry out the responsibilities of the ,agency under this ,act and ,federal privacy law1 and to satisfy the requirements of other applicable law2 7#d7 to coordinate and oversee the operation of all administrative1 enforcement1 and research activities of the ,agency2 7#e7 to adopt and use a seal2 7#f7 to determine the character of and the necessity for the obligations and expenditures of the ,agency2 7#g7 the appointment and supervision of personnel employed by the ,agency2 7#h7 the distribution of business among personnel appointed and supervised by the ,director and among administrative units of the ,agency2 7#i7 the use and expenditure of funds2 7#aj7 implementing this ,act and the ,federal privacy laws through rules1 orders1 guidance1 interpretations1 statements of policy1 examinations1 and enforcement actions2 and 7#aa7 performing such other functions as may be authorized or required by law4 7b7 ,delegation of authority ,the ,director may delegate to any duly authorized employee1 representative1 or agent any power vested in the ,agency by law4 7c7 ,autonomy of agency regarding recommendations and testimony ,no officer or agency of the ,united ,states shall have any authority to require the ,director or any other officer of the ,agency to submit legislative recommendations1 or testimony or comments on legislation1 to any officer or agency of the ,united ,states for approval1 comments1 or review prior to the submission of such recommendations1 testimony1 or comments to the ,congress1 if such recommendations1 testimony1 or comments to the ,congress include a statement indicating that the views expressed therein are those of the ,director or such officer1 and do not necessarily reflect the views of the ,president4 #f4 ,purpose1 objectives1 and functions of the ,agency 7a7 ,purpose ,the ,agency shall seek to protect individuals' privacy and limit the collection1 disclosure1 processing1 and misuse of individuals' personal data by covered entities1 and is authorized to exercise its authorities under this ,act for such purposes4 7b7 ,functions ,the primary functions of the agency are-- 7#a7 providing leadership and coordination to the efforts of all ,federal departments and agencies to enforce all ,federal statutes1 ,executive orders1 regulations and policies which involve privacy or data protection2 7#b7 maximizing effort1 promoting efficiency1 and eliminating conflict1 competition1 duplication1 and inconsistency among the operations1 functions1 and jurisdictions of ,federal departments and agencies responsible for privacy or data protection1 data protection rights and standards1 and fair information practices and principles2 7#c7 providing active leadership1 guidance1 education1 and appropriate assistance to private sector businesses1 and organizations1 groups1 institutions1 and individuals regarding privacy1 data protection rights and standards1 and fair information practices and principles2 7#d7 requiring and overseeing ex-ante impact assessments and ex-post outcomes audits of high-risk data practices by covered entities to advance fair and just data practices2 7#e7 examining the social1 ethical1 economic1 and civil rights impacts of high-risk data practices and propose remedies2 7#f7 ensuring that privacy practices and processing are fair1 just1 and comply with fair information practices2 7#g7 ensuring fair contract terms in the market1 including the prohibition of pay-for-privacy provisions and take-it-or leave it terms of service2 7#h7 promoting privacy enhancing techniques1 such as privacy by design and data minimization techniques2 7#i7 collecting1 researching1 and responding to consumer complaints2 7#aj7 initiating a formal public rulemaking process at the ,agency before any new high-risk data practice or other related profiling technique can be implemented2 7#aa7 reviewing and approving new high-risk techniques or applications1 giving special consideration to minors and sensitive data uses2 7#ab7 regulating consumer scoring and other business practices that pertain to the eligibility of an individual for rights1 benefits1 or privileges in employment 7including hiring1 firing1 promotion1 demotion1 and compensation71 credit and insurance 7including denial of an application or obtaining less favorable terms71 housing1 education1 professional certification1 or the provision of health care and related services2 7#ac7 developing model privacy1 data protection1 and fair information practices1 standards1 guidelines1 policies1 and routine uses for use by the private sector2 7#ad7 issuing rules1 orders1 and guidance implementing ,federal privacy law2 7#ae7 upon written request1 providing appropriate assistance to the private sector in implementing privacy1 data protection1 and fair information practices1 principles1 standards1 guidelines1 policies1 or routine uses of privacy and data protection1 and fair information2 and 7#af7 enforce other privacy statutes and rules as authorized by ,congress4 #g4 ,rulemaking authority 7a7 ,in general ,the ,agency is authorized to exercise its authorities under this ,act and ,federal privacy law to administer1 enforce1 and otherwise implement the provisions of this ,act and ,federal privacy law4 7b7 ,rulemaking1 orders1 and guidance 7#a7 ,general authority ,the ,director may prescribe rules and issue orders and guidance1 as may be necessary or appropriate to enable the ,agency to administer and carry out the purposes and objectives of this ,act and ,federal privacy law1 and to prevent evasions thereof4 7#b7 ,regulations ,the ,agency may issue such regulations1 after notice and comment in accordance with section #eec of title #e1 ,united ,states ,code1 as may be necessary to carry out this ,act4 7#c7 ,standards for rulemaking ,in prescribing a rule under the ,federal privacy laws-- 7,a7 the ,agency shall consider-- 7i7 the potential benefits and costs to individuals or groups of individuals2 and 7ii7 the impact of proposed rules on individuals or groups of individuals2 7,b7 the ,agency may provide that a rule shall only apply to a subcategory of covered entities1 as defined by the ,agency2 and 7,c7 the ,agency shall consult with civil society groups and members of the public4 7c7 ,monitoring ,in order to support its rulemaking and other functions1 the ,agency shall monitor for risks to individuals in the collection1 disclosure1 processing1 and misuse of personal data4 #h4 ,specific agency authorities 7a7 ,supervision of very large covered entities 7#a7 ,in general ,this subsection shall apply to any covered entity that satisfies one or more of the following thresholds3 7,a7 ,the entity has annual gross revenues that exceed #be1jjj1jjj4 7,b7 ,the entity annually buys1 receives for the covered entity's commercial purposes1 sells1 or discloses for commercial purposes1 alone or in combination1 the personal information of #ej1jjj or more individuals1 households1 or devices4 7,c7 ,the entity derives #ej percent or more of its annual revenues from the sale of personal data4 7#b7 ,supervision ,the ,agency may require reports and conduct examinations on a periodic basis of covered entities described in paragraph 7#a7 for purposes of-- 7,a7 assessing compliance with the requirements of ,federal privacy laws2 7,b7 obtaining information about the activities subject to such laws and the associated compliance systems or procedures of such entities2 7,c7 detecting and assessing associated risks to individuals and groups of individuals2 and 7,d7 requiring and overseeing ex-ante impact assessments and ex-post outcome audits of high-risk data practices to advance fair and just data practices4 7b7 ,prohibiting unfair or deceptive acts and practices 7#a7 ,in general ,the ,agency may take any action authorized under this ,act to prevent a covered entity from committing or engaging in an unfair or deceptive act or practice 7as defined by the ,agency under this subsection7 in connection with the collection1 disclosure1 processing1 and misuse of personal data4 7#b7 ,rulemaking ,the ,agency may prescribe rules applicable to a covered entity identifying as unlawful1 unfair1 or deceptive acts or practices in connection with the collection1 disclosure1 processing1 and misuse of personal data4 ,rules under this section may include requirements for the purpose of preventing such acts or practices4 7#c7 ,unfairness 7,a7 ,in general ,the ,agency shall have no authority under this section to declare an act or practice in connection with the collection1 disclosure1 processing1 and misuse of personal data to be unlawful on the grounds that such act or practice is unfair1 unless the ,agency has a reasonable basis to conclude that-- 7i7 the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers2 and 7ii7 such substantial injury is not outweighed by countervailing benefits to consumers or to competition4 7,b7 ,consideration of public policies ,in determining whether an act or practice is unfair1 the ,agency may consider established public policies as evidence to be considered with all other evidence4 ,such public policy considerations may not serve as a primary basis for such determination4 7c7 ,response to consumer complaints and inquiries 7#a7 ,timely regulator response to consumers ,the ,agency shall establish1 in consultation with the appropriate ,federal regulatory agencies1 reasonable procedures to provide a timely response to consumers1 in writing where appropriate1 to complaints against1 or inquiries concerning1 a covered entity1 including-- 7,a7 steps that have been taken by the regulator in response to the complaint or inquiry of the consumer2 7,b7 any responses received by the regulator from the covered entity2 and 7,c7 any follow-up actions or planned follow-up actions by the regulator in response to the complaint or inquiry of the consumer4 7#b7 ,timely response to regulator by covered entity ,a covered entity subject to supervision and primary enforcement by the ,agency pursuant to this ,act shall provide a timely response to the ,agency1 in writing where appropriate1 concerning a consumer complaint or inquiry1 including-- 7,a7 steps that have been taken by the covered entity to respond to the complaint or inquiry of the consumer2 7,b7 responses received by the covered entity from the consumer2 and 7,c7 follow-up actions or planned follow-up actions by the covered entity to respond to the complaint or inquiry of the consumer4 7#c7 ,routing complaints to states ,to the extent practicable1 ,state agencies may receive appropriate complaints from the systems established by the ,agency under this subsection1 if-- 7,a7 the ,state agency system has the functional capacity to receive calls or electronic reports routed by the ,agency systems2 7,b7 the ,state agency has satisfied any conditions of participation in the system that the ,agency may establish1 including treatment of personal information and sharing of information on complaint resolution or related compliance procedures and resources2 and 7,c7 participation by the ,state agency includes measures necessary to provide for protection of personal information that conform to the standards for protection of the confidentiality of personal information and for data integrity and security that apply to ,federal agencies4 #i4 ,enforcement powers 7a7 ,joint investigations ,the ,agency or1 where appropriate1 an ,agency investigator1 may engage in joint investigations and requests for information1 as authorized under this ,act4 7b7 ,subpoenas 7#a7 ,in general ,the ,agency or an ,agency investigator may issue subpoenas for the attendance and testimony of witnesses and the production of relevant papers1 books1 documents1 or other material in connection with hearings under this ,act4 7#b7 ,failure to obey ,in the case of contumacy or refusal to obey a subpoena issued pursuant to this paragraph and served upon any person1 the district court of the ,united ,states for any district in which such person is found1 resides1 or transacts business1 upon application by the ,agency or an ,agency investigator and after notice to such person1 may issue an order requiring such person to appear and give testimony or to appear and produce documents or other material4 7#c7 ,contempt ,any failure to obey an order of the court under this subsection may be punished by the court as a contempt thereof4 7c7 ,litigation authority 7#a7 ,in general ,if any covered entity violates a ,federal privacy law1 the ,agency may commence a civil action against such covered entity to impose a civil penalty or to seek all appropriate legal and equitable relief including a permanent or temporary injunction as permitted by law4 7#b7 ,representation ,the ,agency may act in its own name and through its own attorneys in enforcing any provision of this ,act1 rules thereunder1 or any other law or regulation1 or in any action1 suit1 or proceeding to which the ,agency is a party4 7#c7 ,compromise of actions ,the ,agency may compromise or settle any action if such compromise is approved by the court4 7#d7 ,notice to the attorney general 7,a7 ,in general ,when commencing a civil action under ,federal privacy law1 or any rule thereunder1 the ,agency shall notify the ,attorney ,general4 7,b7 ,notice and coordination 7i7 ,notice of other actions ,in addition to any notice required under subparagraph 7,a71 the ,agency shall notify the ,attorney ,general concerning any action1 suit1 or proceeding to which the ,agency is a party4 7ii7 ,coordination ,in order to avoid conflicts and promote consistency regarding litigation of matters under ,federal law1 the ,attorney ,general and the ,agency shall consult regarding the coordination of investigations and proceedings1 including by negotiating an agreement for coordination by not later than #ahj days after the transfer date4 ,the agreement under this clause shall include provisions to ensure that parallel investigations and proceedings involving the ,federal privacy laws are conducted in a manner that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7iii7 ,rule of construction ,nothing in this subparagraph shall be construed to limit the authority of the ,agency under this ,act1 including the authority to interpret ,federal privacy law4 7#e7 ,forum ,any civil action brought under this ,act may be brought in a ,united ,states district court or in any court of competent jurisdiction of a state in a district in which the defendant is located or resides or is doing business1 and such court shall have jurisdiction to enjoin such person and to require compliance with any ,federal privacy law4 7#f7 ,time for bringing action 7,a7 ,in general ,except as otherwise permitted by law or equity1 no action may be brought under this ,act more than #c years after the date of discovery of the violation to which an action relates4 7,b7 ,limitations under other federal laws 7i7 ,in general ,an action arising under this ,act does not include claims arising solely under the ,federal privacy laws4 7ii7 ,agency authority ,in any action arising solely under a ,federal privacy law1 the ,agency may commence1 defend1 or intervene in the action in accordance with the requirements of that provision of law1 as applicable4 7iii7 ,transferred authority ,in any action arising solely under laws for which authorities were transferred under this ,act1 the ,agency may commence1 defend1 or intervene in the action in accordance with the requirements of that provision of law1 as applicable4 7d7 ,relief available 7#a7 ,jurisdiction ,the court 7or the ,agency1 as the case may be7 in an action or adjudication proceeding brought under ,federal privacy law1 shall have jurisdiction to grant any appropriate legal or equitable relief with respect to a violation of ,federal privacy law1 including a violation of a rule or order prescribed under a ,federal privacy law4 7#b7 ,relief ,relief under this section may include1 without limitation-- 7,a7 rescission or reformation of contracts2 7,b7 refund of moneys2 7,c7 restitution2 7,d7 disgorgement or compensation for unjust enrichment2 7,e7 payment of damages or other monetary relief2 7,f7 public notification regarding the violation1 including the costs of notification2 7,g7 limits on the activities or functions of the covered entity2 and 7,h7 civil money penalties1 as set forth more fully in subsection 7f74 7#c7 ,no exemplary or punitive damages ,nothing in this subsection shall be construed as authorizing the imposition of exemplary or punitive damages4 7e7 ,recovery of costs ,in any action brought by the ,agency1 a ,state attorney general1 or any ,state regulator to enforce any ,federal privacy law1 the ,agency1 the ,state attorney general1 or the ,state regulator may recover its costs in connection with prosecuting such action if the ,agency1 the ,state attorney general1 or the ,state regulator is the prevailing party in the action4 7f7 ,civil money penalty in court and administrative actions 7#a7 ,in general ,any person that violates1 through any act or omission1 any provision of ,federal privacy law shall forfeit and pay a civil penalty pursuant to this subsection4 7#b7 ,penalty amounts 7,a7 ,first tier ,for any violation of a law1 rule1 or final order or condition imposed in writing by the ,agency1 a civil penalty may not exceed #e1jjj for each day during which such violation or failure to pay continues4 7,b7 ,second tier ,notwithstanding subparagraph 7,a71 for any person that recklessly engages in a violation of a ,federal privacy law1 a civil penalty may not exceed #be1jjj for each day during which such violation continues4 7,c7 ,third tier ,notwithstanding subparagraphs 7,a7 and 7,b71 for any person that knowingly violates a ,federal privacy law1 a civil penalty may not exceed #a1jjj1jjj for each day during which such violation continues4 7#c7 ,mitigating factors ,in determining the amount of any penalty assessed under paragraph 7#b71 the ,agency or the court shall take into account the appropriateness of the penalty with respect to-- 7,a7 the size of financial resources and good faith of the person charged2 7,b7 the gravity of the violation or failure to pay2 7,c7 the severity of the risks to or losses of the individual or group of individuals affected by the violation2 7,d7 the history of previous violations2 and 7,e7 such other matters as justice may require4 7#d7 ,authority to modify or remit penalty ,the ,agency may compromise1 modify1 or remit any penalty which may be assessed or had already been assessed under paragraph 7#b74 ,the amount of such penalty1 when finally determined1 shall be exclusive of any sums owed by the covered entity to the ,united ,states in connection with the costs of the proceeding1 and may be deducted from any sums owing by the ,united ,states to the covered entity charged4 7#e7 ,notice and hearing ,no civil penalty may be assessed under this subsection with respect to a violation of any ,federal privacy law1 unless-- 7,a7 the ,agency gives notice and an opportunity for a hearing to the person accused of the violation2 or 7,b7 the appropriate court has ordered such assessment and entered judgment in favor of the ,agency4 7g7 ,referrals for criminal proceedings ,if the ,agency obtains evidence that any person1 domestic or foreign1 has engaged in conduct that may constitute a violation of ,federal criminal law1 the ,agency shall transmit such evidence to the ,attorney ,general of the ,united ,states1 who may institute criminal proceedings under appropriate law4 ,nothing in this section affects any other authority of the ,agency to disclose information4 7h7 ,data protection relief fund 7#a7 ,establishment of relief fund ,there is established in the ,treasury of the ,united ,states a separate fund to be known as the ,data ,protection ,relief ,fund 7referred to in this subsection as the ,relief ,fund74 7#b7 ,deposits 7,a7 ,deposits from the agency ,the ,agency shall deposit into the ,relief ,fund the amount of any civil penalty obtained against any covered entity in any judicial or administrative action the ,agency commences to enforce this ,act1 a regulation promulgated under this ,act1 or a ,federal privacy law4 7,b7 ,deposits from the attorney general ,the ,attorney ,general of the ,united ,states shall deposit into the ,relief ,fund the amount of any civil penalty obtained against any covered entity in any judicial or administrative action the ,attorney ,general commences on behalf of the ,agency to enforce this ,act1 a regulation promulgated under this ,act1 or a ,federal privacy law4 7#c7 ,use of fund amounts ,notwithstanding section #ccjb of title #ca1 ,united ,states ,code1 amounts in the ,relief ,fund shall be available to the ,agency1 without fiscal year limitation1 to provide redress1 payments or compensation1 or other monetary relief to individuals affected by an act or practice for which civil penalties have been obtained under this ,act4 ,to the extent that individuals cannot be located or such redress1 payments or compensation1 or other monetary relief are otherwise not practicable1 the ,agency may use such funds for the purpose of consumer or business education relating to data protection or for the purpose of engaging in technological research that the ,agency considers necessary to enforce this ,act and ,federal privacy laws4 7#d7 ,amounts not subject to apportionment ,notwithstanding any other provision of law1 amounts in the ,relief ,fund shall not be subject to apportionment for purposes of chapter #ae of title #ca1 ,united ,states ,code1 or under any other authority4 #aj4 ,preservation of ,state law 7a7 ,relation to state law 7#a7 ,rule of construction ,this ,act may not be construed as annulling1 altering1 or affecting1 or exempting any person subject to the provisions of this title from complying with1 the statutes1 regulations1 orders1 or interpretations in effect in any ,state1 except to the extent that any such provision of law is inconsistent with the provisions of this title1 and then only to the extent of the inconsistency4 7#b7 ,greater protection under state law ,for purposes of this paragraph1 a statute1 regulation1 order1 or interpretation in effect in any ,state is not inconsistent with the provisions of this title if the protection that such statute1 regulation1 order1 or interpretation affords to individuals is greater than the protection provided under this ,act4 ,a determination regarding whether a statute1 regulation1 order1 or interpretation in effect in any ,state is inconsistent with the provisions of this title may be made by the ,agency on its own motion or in response to a nonfrivolous petition initiated by any interested person4 7b7 ,relation to other provisions of ,federal privacy laws that relate to state law ,no provision of this ,act shall be construed as modifying1 limiting1 or superseding the operation of any provision of a ,federal privacy law that relates to the application of a law in effect in any ,state with respect to such ,federal law4 7c7 ,preservation of enforcement powers of states ,the attorney general 7or the equivalent thereof7 of any ,state may bring a civil action in the name of such ,state in any district court of the ,united ,states in that ,state or in ,state court that is located in that ,state and that has jurisdiction over the defendant1 to enforce provisions of this title or regulations issued under this ,act1 and to secure remedies under provisions of this title or remedies otherwise provided under other law4 ,a ,state regulator may bring a civil action or other appropriate proceeding to enforce the provisions of this title or regulations issued under this ,act with respect to any entity that is ,state-chartered1 incorporated1 licensed1 or otherwise authorized to do business under ,state law 7except as provided in paragraph 7#b771 and to secure remedies under provisions of this title or remedies otherwise provided under other provisions of law with respect to such an entity4 7d7 ,preservation of state authority 7#a7 ,state claims ,no provision of this section shall be construed as altering1 limiting1 or affecting the authority of a ,state attorney general or any other regulatory or enforcement agency or authority to bring an action or other regulatory proceeding arising solely under the law in effect in that ,state4 7#b7 ,state consumer protection1 privacy1 and data regulators ,no provision of this title shall be construed as altering1 limiting1 or affecting the authority of a ,state consumer protection1 data protection1 or privacy agency 7or any agency or office performing like functions7 under ,state law to adopt rules1 initiate enforcement proceedings1 or take any other action with respect to a person regulated by such commission or authority4 #aa4 ,reports and information 7a7 ,reports required ,not later than #f months after the date of the enactment of this ,act1 and every #f months thereafter1 the ,director shall submit a report to the ,president and to the ,committee on ,energy and ,commerce1 the ,committee on the ,judiciary1 and the ,committee on ,appropriations of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation1 the ,committee on the ,judiciary1 and the ,committee on ,appropriations of the ,senate1 and shall publish such report on the website of the ,agency4 7b7 ,contents ,each report required by subsection 7a7 shall include-- 7#a7 a discussion of the significant problems faced by individuals with respect to the privacy or security of personal information2 7#b7 a justification of the budget request of the ,agency for the preceding year1 unless a justification for such year was included in the preceding report submitted under such subsection2 7#c7 a list of the significant rules and orders adopted by the ,agency1 as well as other significant initiatives conducted by the ,agency1 during the preceding #f-month period and the plan of the ,agency for rules1 orders1 or other initiatives to be undertaken during the upcoming #f-month period2 7#d7 an analysis of complaints about the privacy or security of personal information that the ,agency has received and collected in the database described in section #h during the preceding #f-month period2 7#e7 a list1 with a brief statement of the issues1 of the public enforcement actions to which the ,agency was a party during the preceding #f-month period2 and 7#f7 an assessment of significant actions by ,state attorneys general or ,state agencies relating to this ,act or the rules prescribed under this ,act during the preceding #f-month period4 #ab4 ,transfers of functions 7a7 ,federal trade commission ,the authority of the ,federal ,trade ,commission under a ,federal privacy law specified in section #c7c77;,b7 to prescribe rules1 issue guidelines1 or conduct a study or issue a report mandated under such law shall be transferred to the ,agency on the transfer date4 ,nothing in this title shall be construed to require a mandatory transfer of any employee of the ,federal ,trade ,commission4 7b7 ,agency authority 7#a7 ,in general ,the ,agency shall have all powers and duties under the ,federal privacy laws to prescribe rules1 issue guidelines1 or to conduct studies or issue reports mandated by such laws1 that were vested in the ,federal ,trade ,commission on the day before the transfer date4 7#b7 ,federal trade commission act ,the ,agency may enforce a rule prescribed under the ,federal ,trade ,commission ,act 7#de ,u4,s4,c4 #da et seq47 by the ,federal ,trade ,commission with respect to the collection1 disclosure1 processing1 and misuse of personal data4 7c7 ,authority of the ,federal ,trade ,commission ,no provision of this title shall be construed as modifying1 limiting1 or otherwise affecting the authority of the ,federal ,trade ,commission 7including its authority with respect to very large entities described in section #h7;a77#a77 under the ,federal ,trade ,commission ,act or any other law1 other than the authority under a ,federal privacy law to prescribe rules1 issue official guidelines1 or conduct a study or issue a report mandated under such law4 7d7 ,authority of the ,consumer ,financial ,protection ,bureau ,no provision of this title shall be construed as modifying1 limiting1 or otherwise affecting the authority of the ,consumer ,financial ,protection ,bureau under the ,dodd-,frank ,wall ,street ,reform and ,consumer ,protection ,act 7,public ,law #aaa-bjc7 or any other law4 #ac4 ,authorization of appropriations ,for fiscal year #bjbj and each subsequent fiscal year1 there are authorized to be appropriated to the ,agency such sums as may be necessary to carry out this ,act4