,,ii #aaf? ,,congress #b;d ,session ,s4 #ccjj ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,febru>y #ac1 #bjbj,mrs4 ,gillibr& introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to e/abli% a ,f$]al data protection ag5cy1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,9 g5]al ,?is ,act may be cit$ z ! ,data ,protection ,act ( #bjbj4 7b7 ,table ( cont5ts ,! table ( cont5ts ( ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,sec4 #b4 ,f9d+s & purpose4,sec4 #c4 ,def9itions4,sec4 #d4 ,e/abli%m5t ( ! ,data ,protection ,ag5cy4,sec4 #e4 ,executive & adm9i/rative p[]s4,sec4 #f4 ,purpose1 objectives1 & functions ( ! ,ag5cy4,sec4 #g4 ,rulemak+ au?ority4,sec4 #h4 ,specific ag5cy au?orities4,sec4 #i4 ,en=cem5t p[]s4,sec4 #aj4 ,pres]vation ( ,/ate law4,sec4 #aa4 ,reports & in=mation4,sec4 #ab4 ,transf]s ( functions4,sec4 #ac4 ,au?orization ( appropriations4 #b4 ,f9d+s & purpose 7a7 ,f9d+s ,congress f9ds ! foll[+3 7#a7 ,privacy is an important fundam5tal individual "r protect$ by ! ,con/itution ( ! ,unit$ ,/ates4 7#b7 ,! "r ( privacy is widely recogniz$ 9 int]national legal in/rum5ts t ! ,unit$ ,/ates has endors$1 ratifi$1 or promot$4 7#c7 ,! "r to privacy protects ! individual aga9/ intrusions into seclusion1 protects individual autonomy1 safegu>ds fair process+ ( data t p]ta9s to ! individual1 advances ! j process+ ( data1 & contributes to respect = individual civil rights & fundam5tal fre$oms4 7#d7 ,privacy protections n only protect & b5efit ! individual1 b !y also advance o!r societal int]e/s1 includ+ ! protection ( m>g9aliz$ & vuln]able gr\ps ( individuals1 ! safegu>d+ ( o!r f\ndational values ( our democracy1 su* z fre$om ( in=mation1 fre$om ( spee*1 ju/ice1 & human +5uity & dignity1 z well z ! integrity ( democratic in/itutions1 includ+ fair & op5 elections4 7#e7 ,! privacy ( an individual is directly affect$ by ! collection1 ma9t5ance1 use1 & dissem9ation ( p]sonal data4 7#f7 ,! increas+ digitalization ( in=mation & its application 9 classify+ individuals & gr\ps ( individuals has greatly magnifi$ ! h>m to individual privacy t c occur f ! collection1 ma9t5ance1 use1 or dissem9ation ( p]sonal data4 7#g7 ,! opportunities = an individual to secure employm5t1 insurance1 cr$it1 & h\s+ & ! "r to due process & o!r legal protections are endang]$ by ! unre/rict$ collection1 disclosure1 process+1 & misuse ( p]sonal data4 7#h7 ,in=mation sy/ems lack+ privacy protection amplify bias4 7#i7 ,9 ord] to protect ! privacy ( individuals1 x is necess>y & prop] = ,congress to regulate ! collection1 ma9t5ance1 use1 process+1 /orage1 & dissem9ation ( in=mation4 7b7 ,purpose ,! purpose ( ?is ,act is to e/abli% a data protection ag5cy to-- 7#a7 safegu>d privacy1 promote innovation1 ensure compliance ) ! law1 & promote be/ practices2 7#b7 provide guidance on matt]s relat$ to electronic data /orage1 communication1 & usage2 7#c7 provide ! public ) in=mation & guidance on privacy protections & fair in=mation practices & pr9ciples2 7#d7 ov]see ,f$]al ag5cies' implem5tation ( section #eeb;a ( title #e1 ,unit$ ,/ates ,code2 7#e7 promote implem5tation ( fair in=mation practices 9 ! public & private sector2 & 7#f7 repres5t ! ,unit$ ,/ates 9 int]national =ums4 #c4 ,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! t]m ,ag5cy means ! ,data ,protection ,ag5cy e/abli%$ "u section #d4 7#b7 ,cov]$ entity ,! t]m cov]$ entity means any p]son t collects1 processes1 or o!rwise obta9s p]sonal data ) ! exception ( an individual process+ p]sonal data 9 ! c\rse ( p]sonal or h\sehold activity4 7#c7 ,f$]al privacy law 7,a7 ,9 g5]al ,! t]m ,f$]al privacy law means ! provisions ( ?is ,act1 ! laws specifi$ 9 subp>agraph 7,b71 & any rule or ord] prescrib$ by ! ,ag5cy "u ?is ,act or pursuant to ! au?orities transf]r$ "u ?is ,act4 ,su* t]m %all n include ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,b7 ,specifi$ laws ,! laws specifi$ 9 ?is subp>agraph are ! foll[+ laws 7includ+ any am5dm5ts made by su* laws73 7i7 ,! ,*ildr5's ,onl9e ,privacy ,protection ,act 7#ae ,u4,s4,c4 #feja et seq474 7ii7 ,! ,,c-,,spam ,act ( #bjjc 7#ae ,u4,s4,c #ggja et seq474 7iii7 ,! ,d-,n-,call ,implem5tation ,act 7#ae ,u4,s4,c4 #faeb et seq47 & ,public ,law #ajh-hb 7#ae ,u4,s4,c4 #faea74 7iv7 ,! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq474 7v7 ,title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7vi7 ,subtitle ,d ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agiba et seq474 7vii7 ,! ,id5tity ,!ft ,assumption & ,det]r5ce ,act ( #aiih 7,pub4 ,l4 #aje-cah74 7viii7 ,! ,telem>ket+ & ,consum] ,fraud & ,abuse ,prev5tion ,act 7#ae ,u4,s4,c4 #faja et seq474 7ix7 ,section #bbg ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbg7 7commonly kn[n z ! ,telephone ,consum] ,protection ,act ( #aiia74 7#d7 ,high-risk data practice ,! t]m high-risk data practice means an action by a cov]$ entity t involves-- 7,a7 a sy/ematic or ext5sive evaluation ( p]sonal data t is bas$ on automat$ process+1 includ+ pr(il+1 & on :i* decisions are bas$ t produce legal effects conc]n+ ! individual or h\sehold or simil>ly significantly affect ! individual or h\sehold2 7,b7 s5sitive data uses2 7,c7 a sy/emic monitor+ ( publicly accessible data on a l>ge scale2 7,d7 process+ involv+ ! use ( new te*nologies1 or comb9ations ( te*nologies1 t creates adv]se consequ5ces or pot5tial adv]se consequ5ces to an individual or society2 7,e7 decisions ab\t an individual's access to a product1 s]vice1 opportunity1 or b5efit :i* is bas$ to any ext5t on automat$ process+2 7,f7 any pr(il+ ( individuals on a l>ge scale2 7,g7 any process+ ( biometric data = ! purpose ( uniquely id5tify+ an individual2 7,h7 any process+ ( g5etic data1 o!r ?an data process$ by a heal? c>e pr(essional = ! purpose ( provid+ heal? c>e to ! individual2 7,i7 comb9+1 comp>+1 or mat*+ p]sonal data obta9$ f multiple s\rces2 7,j7 process+ ! p]sonal data ( an individual t has n be5 obta9$ directly f ! individual2 7,k7 process+ :i* involves track+ an individual's geolocation2 or 7,l7 ! use ( p]sonal data ( *ildr5 or o!r vuln]able individuals = m>ket+ purposes1 pr(il+1 or automat$ process+4 7#e7 ,p]sonal data ,! t]m p]sonal data means any in=mation t id5tifies1 relates to1 describes1 is capable ( be+ associat$ )1 or c\ld reasonably be l9k$1 directly or indirectly1 ) a p>ticul> individual or device1 includ+-- 7,a7 an id5tifi] su* z a real "n1 alias1 signature1 date ( bir?1 g5d] id5tity1 sexual ori5tation1 m>ital /atus1 physical *>act]i/ic or description1 po/al address1 telephone numb]1 unique p]sonal id5tifi]1 milit>y id5tification numb]1 onl9e id5tifi]1 ,int]net ,protocol address1 email address1 acc\nt "n1 "m's maid5 "n1 social security numb]1 driv]'s lic5se numb]1 passport numb]1 or o!r simil> id5tifi]s2 7,b7 in=mation su* z employm5t /atus1 employm5t hi/ory1 or o!r pr(essional or employm5t-relat$ in=mation2 7,c7 bank acc\nt numb]1 cr$it c>d numb]1 debit c>d numb]1 insurance policy numb]1 or any o!r f9ancial in=mation2 7,d7 m$ical in=mation1 m5tal heal? in=mation1 or heal? insurance in=mation2 7,e7 comm]cial in=mation1 includ+ records ( p]sonal prop]ty1 products or s]vices pur*as$1 obta9$1 or consid]$1 or o!r pur*as+ or consum+ hi/ories or t5d5cies2 7,f7 *>act]i/ics ( protect$ classes "u ,f$]al law1 includ+ race1 color1 national orig91 religion1 sex1 age1 or disability2 7,g7 biometric in=mation2 7,h7 int]net or o!r electronic network activity in=mation1 includ+ br[s+ hi/ory1 se>* hi/ory1 cont5t1 & in=mation reg>d+ an individual's int]action ) an int]net website1 mobile application1 or adv]tisem5t2 7,i7 hi/orical or real-"t geolocation data2 7,j7 audio1 electronic1 visual1 !rmal1 olfactory1 or simil> in=mation2 7,k7 education records2 7,l7 political in=mation2 7,m7 password-protect$ digital photographs & digital videos n o!rwise available to ! public2 7,n7 in=mation on crim9al convictions or arre/s2 7,o7 in=mation 7su* z an ,int]net ,protocol address or o!r simil> id5tifi]7 t all[s an individual or device to be s+l$ out = int]action1 ev5 )\t id5tification ( su* individual or device2 & 7,p7 inf]5ces drawn f any ( ! in=mation id5tifi$ 9 ?is subp>agraph to create a pr(ile ab\t an individual reflect+ ! individual's pref]5ces1 *>act]i/ics1 psy*ological tr5ds1 pr$ispositions1 behavior1 attitudes1 intellig5ce1 abilities1 & aptitudes4 7#f7 ,process ,! t]m process means to p]=m an op]ation or set ( op]ations on p]sonal data1 ei!r manually or by automat$ means1 includ+ b n limit$ to collect+1 record+1 organiz+1 /ructur+1 /or+1 adapt+ or alt]+1 retriev+1 consult+1 us+1 disclos+ by transmission1 sort+1 classify+1 dissem9at+ or o!rwise mak+ available1 align+ or comb9+1 re/rict+1 eras+ or de/roy+4 7#g7 ,pr(ile ,! t]m pr(ile means ! use ( an automat$ means to process data 7includ+ p]sonal data & o!r data7 to d]ive1 inf]1 pr$ict1 or evaluate in=mation ab\t an individual or gr\p1 su* z ! process+ ( data to analyze or pr$ict an individual's id5tity1 attributes1 int]e/s1 or behavior4 7#h7 ,s5sitive data use ,! t]m s5sitive data use means-- 7,a7 ! process+ ( data 9 a mann] t reveals an individual's race1 color1 e?nicity1 religion or cre$1 national orig9 or ance/ry1 sex1 g5d]1 g5d] id5tity1 sexuality1 sexual ori5tation1 political beliefs1 trade union memb]%ip1 familial /atus1 lawful s\rce ( income1 f9ancial /atus 7su* z ! individual's income or assets71 vet]an /atus1 crim9al convictions or arre/s1 citiz5%ip1 pa/1 pres5t1 or future physical or m5tal heal? or condition1 psy*ological /ates1 disability1 geospatial data1 or any o!r factor us$ z a proxy = id5tify+ any ( ^! *>act]i/ics2 or 7,b7 ! use ( ! biometric or g5etic data ( an individual4 7#i7 ,transf] date ,! t]m transf] date means ! date t is #a ye> aft] ! date ( enactm5t ( ?is ,act4 #d4 ,e/abli%m5t ( ! ,data ,protection ,ag5cy 7a7 ,e/abli%m5t 7#a7 ,9 g5]al ,!re is e/abli%$ 9 ! ,executive bran* an ag5cy to be kn[n z ! ,data ,protection ,ag5cy :i* %all regulate ! process+ ( p]sonal data4 7#b7 ,/atus ,! ,ag5cy %all be an indep5d5t e/abli%m5t 7z def9$ 9 section #ajd ( title #e1 ,unit$ ,/ates ,code74 7b7 ,director & deputy director 7#a7 ,9 g5]al ,!re is e/abli%$ a position ( ! ,director ( ! ,unit$ ,/ates ,data ,protection ,ag5cy 7ref]r$ to 9 ?is ,act z ! ,director71 :o %all s]ve z ! head ( ! ,ag5cy4 7#b7 ,appo9tm5t ,subject to p>agraph 7#c71 ! ,director %all be appo9t$ by ! ,presid5t1 by & ) ! advice & cons5t ( ! ,s5ate4 7#c7 ,qualification ,! ,presid5t %all nom9ate ! ,director f among memb]s ( ! public at l>ge :o are well qualifi$ = s]vice on ! ,ag5cy by virtue ( _! k & exp]tise 9-- 7,a7 te*nology2 7,b7 protection ( p]sonal data2 7,c7 civil rights & lib]ties2 7,d7 law2 7,e7 social sci5ces2 & 7,f7 bus9ess4 7#d7 ,comp5sation 7,a7 ,9 g5]al ,! ,director %all be comp5sat$ at ! rate prescrib$ = level ,,ii ( ! ,executive ,s*$ule "u section #ecac ( title #e1 ,unit$ ,/ates ,code4 7,b7 ,con=m+ am5dm5t ,section #ecac ( title #e1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] ! item relat+ to ! ,f$]al ,transit ,adm9i/rator ! foll[+ new item3 ,director ( ! ,unit$ ,/ates ,data ,protection ,ag5cy4 4 7#e7 ,deputy director ,!re is e/abli%$ ! position ( ,deputy ,director1 :o %all-- 7,a7 be appo9t$ by ! ,director2 & 7,b7 s]ve z act+ ,director 9 ! abs5ce or unavailability ( ! ,director4 7c7 ,t]m 7#a7 ,9 g5]al ,! ,director %all s]ve = a t]m ( #e ye>s4 7#b7 ,expiration ( t]m ,an individual may s]ve z ,director aft] ! expiration ( ! t]m = :i* appo9t$1 until a successor has be5 appo9t$ & qualifi$4 7#c7 ,removal = cause ,! ,presid5t may remove ! ,director = ineffici5cy1 neglect ( duty1 or malfeasance 9 (fice4 7d7 ,s]vice re/riction ,no ,director or ,deputy ,director may engage 9 any o!r employm5t dur+ ! p]iod ( s]vice ( su* p]son z ,director or ,deputy ,director4 7e7 ,(fices ,! pr9cipal (fice ( ! ,ag5cy %all be 9 ! ,di/rict ( ,columbia4 ,! ,director may e/abli% regional (fices ( ! ,ag5cy4 #e4 ,executive & adm9i/rative p[]s 7a7 ,p[]s ( ! ag5cy ,! ,director is au?oriz$ to e/abli% ! g5]al polices ( ! ,ag5cy ) respect to all executive & adm9i/rative functions1 includ+-- 7#a7 ! e/abli%m5t ( rules = conduct+ ! g5]al bus9ess ( ! ,ag5cy1 9 a mann] n inconsi/5t ) ?is ,act2 7#b7 to b9d ! ,ag5cy & ent] into contracts2 7#c7 direct+ ! e/abli%m5t & ma9t5ance ( divisions or o!r (fices )9 ! ,ag5cy1 9 ord] to c>ry out ! responsibilities ( ! ,ag5cy "u ?is ,act & ,f$]al privacy law1 & to satisfy ! requirem5ts ( o!r applicable law2 7#d7 to coord9ate & ov]see ! op]ation ( all adm9i/rative1 en=cem5t1 & rese>* activities ( ! ,ag5cy2 7#e7 to adopt & use a seal2 7#f7 to det]m9e ! "* ( & ! necessity = ! obligations & exp5ditures ( ! ,ag5cy2 7#g7 ! appo9tm5t & sup]vision ( p]sonnel employ$ by ! ,ag5cy2 7#h7 ! di/ribution ( bus9ess among p]sonnel appo9t$ & sup]vis$ by ! ,director & among adm9i/rative units ( ! ,ag5cy2 7#i7 ! use & exp5diture ( funds2 7#aj7 implem5t+ ?is ,act & ! ,f$]al privacy laws ?r\gh rules1 ord]s1 guidance1 int]pretations1 /atem5ts ( policy1 exam9ations1 & en=cem5t actions2 & 7#aa7 p]=m+ su* o!r functions z may be au?oriz$ or requir$ by law4 7b7 ,delegation ( au?ority ,! ,director may delegate to any duly au?oriz$ employee1 repres5tative1 or ag5t any p[] ve/$ 9 ! ,ag5cy by law4 7c7 ,autonomy ( ag5cy reg>d+ recomm5dations & te/imony ,no (fic] or ag5cy ( ! ,unit$ ,/ates %all h any au?ority to require ! ,director or any o!r (fic] ( ! ,ag5cy to submit legislative recomm5dations1 or te/imony or comm5ts on legislation1 to any (fic] or ag5cy ( ! ,unit$ ,/ates = approval1 comm5ts1 or review prior to ! submission ( su* recomm5dations1 te/imony1 or comm5ts to ! ,congress1 if su* recomm5dations1 te/imony1 or comm5ts to ! ,congress include a /atem5t indicat+ t ! views express$ !re9 are ^? ( ! ,director or su* (fic]1 & d n necess>ily reflect ! views ( ! ,presid5t4 #f4 ,purpose1 objectives1 & functions ( ! ,ag5cy 7a7 ,purpose ,! ,ag5cy %all seek to protect individuals' privacy & limit ! collection1 disclosure1 process+1 & misuse ( individuals' p]sonal data by cov]$ entities1 & is au?oriz$ to ex]cise its au?orities "u ?is ,act = su* purposes4 7b7 ,functions ,! prim>y functions ( ! ag5cy are-- 7#a7 provid+ lead]%ip & coord9ation to ! ef=ts ( all ,f$]al dep>tm5ts & ag5cies to en=ce all ,f$]al /atutes1 ,executive ord]s1 regulations & policies :i* involve privacy or data protection2 7#b7 maximiz+ ef=t1 promot+ effici5cy1 & elim9at+ conflict1 competition1 duplication1 & inconsi/5cy among ! op]ations1 functions1 & jurisdictions ( ,f$]al dep>tm5ts & ag5cies responsible = privacy or data protection1 data protection rights & /&>ds1 & fair in=mation practices & pr9ciples2 7#c7 provid+ active lead]%ip1 guidance1 education1 & appropriate assi/ance to private sector bus9esses1 & organizations1 gr\ps1 in/itutions1 & individuals reg>d+ privacy1 data protection rights & /&>ds1 & fair in=mation practices & pr9ciples2 7#d7 requir+ & ov]see+ ex-ante impact assessm5ts & ex-po/ outcomes audits ( high-risk data practices by cov]$ entities to advance fair & j data practices2 7#e7 exam9+ ! social1 e?ical1 economic1 & civil rights impacts ( high-risk data practices & propose rem$ies2 7#f7 ensur+ t privacy practices & process+ are fair1 j1 & comply ) fair in=mation practices2 7#g7 ensur+ fair contract t]ms 9 ! m>ket1 includ+ ! prohibition ( pay-=-privacy provisions & take-x-or leave x t]ms ( s]vice2 7#h7 promot+ privacy enhanc+ te*niques1 su* z privacy by design & data m9imization te*niques2 7#i7 collect+1 rese>*+1 & respond+ to consum] compla9ts2 7#aj7 initiat+ a =mal public rulemak+ process at ! ,ag5cy be=e any new high-risk data practice or o!r relat$ pr(il+ te*nique c be implem5t$2 7#aa7 review+ & approv+ new high-risk te*niques or applications1 giv+ special consid]ation to m9ors & s5sitive data uses2 7#ab7 regulat+ consum] scor+ & o!r bus9ess practices t p]ta9 to ! eligibility ( an individual = rights1 b5efits1 or privileges 9 employm5t 7includ+ hir+1 fir+1 promotion1 demotion1 & comp5sation71 cr$it & insurance 7includ+ d5ial ( an application or obta9+ less favorable t]ms71 h\s+1 education1 pr(essional c]tification1 or ! provision ( heal? c>e & relat$ s]vices2 7#ac7 develop+ model privacy1 data protection1 & fair in=mation practices1 /&>ds1 guidel9es1 policies1 & r\t9e uses = use by ! private sector2 7#ad7 issu+ rules1 ord]s1 & guidance implem5t+ ,f$]al privacy law2 7#ae7 ^u writt5 reque/1 provid+ appropriate assi/ance to ! private sector 9 implem5t+ privacy1 data protection1 & fair in=mation practices1 pr9ciples1 /&>ds1 guidel9es1 policies1 or r\t9e uses ( privacy & data protection1 & fair in=mation2 & 7#af7 en=ce o!r privacy /atutes & rules z au?oriz$ by ,congress4 #g4 ,rulemak+ au?ority 7a7 ,9 g5]al ,! ,ag5cy is au?oriz$ to ex]cise its au?orities "u ?is ,act & ,f$]al privacy law to adm9i/]1 en=ce1 & o!rwise implem5t ! provisions ( ?is ,act & ,f$]al privacy law4 7b7 ,rulemak+1 ord]s1 & guidance 7#a7 ,g5]al au?ority ,! ,director may prescribe rules & issue ord]s & guidance1 z may be necess>y or appropriate to enable ! ,ag5cy to adm9i/] & c>ry out ! purposes & objectives ( ?is ,act & ,f$]al privacy law1 & to prev5t evasions !re(4 7#b7 ,regulations ,! ,ag5cy may issue su* regulations1 aft] notice & comm5t 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 z may be necess>y to c>ry out ?is ,act4 7#c7 ,/&>ds = rulemak+ ,9 prescrib+ a rule "u ! ,f$]al privacy laws-- 7,a7 ! ,ag5cy %all consid]-- 7i7 ! pot5tial b5efits & co/s to individuals or gr\ps ( individuals2 & 7ii7 ! impact ( propos$ rules on individuals or gr\ps ( individuals2 7,b7 ! ,ag5cy may provide t a rule %all only apply to a subcategory ( cov]$ entities1 z def9$ by ! ,ag5cy2 & 7,c7 ! ,ag5cy %all consult ) civil society gr\ps & memb]s ( ! public4 7c7 ,monitor+ ,9 ord] to support its rulemak+ & o!r functions1 ! ,ag5cy %all monitor = risks to individuals 9 ! collection1 disclosure1 process+1 & misuse ( p]sonal data4 #h4 ,specific ag5cy au?orities 7a7 ,sup]vision ( v l>ge cov]$ entities 7#a7 ,9 g5]al ,?is subsection %all apply to any cov]$ entity t satisfies "o or m ( ! foll[+ ?re%olds3 7,a7 ,! entity has annual gross rev5ues t exce$ #be1jjj1jjj4 7,b7 ,! entity annually buys1 receives = ! cov]$ entity's comm]cial purposes1 sells1 or discloses = comm]cial purposes1 alone or 9 comb9ation1 ! p]sonal in=mation ( #ej1jjj or m individuals1 h\seholds1 or devices4 7,c7 ,! entity d]ives #ej p]c5t or m ( its annual rev5ues f ! sale ( p]sonal data4 7#b7 ,sup]vision ,! ,ag5cy may require reports & conduct exam9ations on a p]iodic basis ( cov]$ entities describ$ 9 p>agraph 7#a7 = purposes (-- 7,a7 assess+ compliance ) ! requirem5ts ( ,f$]al privacy laws2 7,b7 obta9+ in=mation ab\t ! activities subject to su* laws & ! associat$ compliance sy/ems or proc$ures ( su* entities2 7,c7 detect+ & assess+ associat$ risks to individuals & gr\ps ( individuals2 & 7,d7 requir+ & ov]see+ ex-ante impact assessm5ts & ex-po/ outcome audits ( high-risk data practices to advance fair & j data practices4 7b7 ,prohibit+ unfair or deceptive acts & practices 7#a7 ,9 g5]al ,! ,ag5cy may take any action au?oriz$ "u ?is ,act to prev5t a cov]$ entity f committ+ or engag+ 9 an unfair or deceptive act or practice 7z def9$ by ! ,ag5cy "u ?is subsection7 9 connection ) ! collection1 disclosure1 process+1 & misuse ( p]sonal data4 7#b7 ,rulemak+ ,! ,ag5cy may prescribe rules applicable to a cov]$ entity id5tify+ z unlawful1 unfair1 or deceptive acts or practices 9 connection ) ! collection1 disclosure1 process+1 & misuse ( p]sonal data4 ,rules "u ?is section may include requirem5ts = ! purpose ( prev5t+ su* acts or practices4 7#c7 ,unfairness 7,a7 ,9 g5]al ,! ,ag5cy %all h no au?ority "u ?is section to decl>e an act or practice 9 connection ) ! collection1 disclosure1 process+1 & misuse ( p]sonal data to be unlawful on ! gr\nds t su* act or practice is unfair1 unless ! ,ag5cy has a reasonable basis to conclude t-- 7i7 ! act or practice causes or is likely to cause sub/antial injury to consum]s :i* is n reasonably avoidable by consum]s2 & 7ii7 su* sub/antial injury is n outweigh$ by c\nt]vail+ b5efits to consum]s or to competition4 7,b7 ,consid]ation ( public policies ,9 det]m9+ :e!r an act or practice is unfair1 ! ,ag5cy may consid] e/abli%$ public policies z evid5ce to be consid]$ ) all o!r evid5ce4 ,su* public policy consid]ations may n s]ve z a prim>y basis = su* det]m9ation4 7c7 ,response to consum] compla9ts & inquiries 7#a7 ,timely regulator response to consum]s ,! ,ag5cy %all e/abli%1 9 consultation ) ! appropriate ,f$]al regulatory ag5cies1 reasonable proc$ures to provide a timely response to consum]s1 9 writ+ :]e appropriate1 to compla9ts aga9/1 or inquiries conc]n+1 a cov]$ entity1 includ+-- 7,a7 /eps t h be5 tak5 by ! regulator 9 response to ! compla9t or inquiry ( ! consum]2 7,b7 any responses receiv$ by ! regulator f ! cov]$ entity2 & 7,c7 any foll[-up actions or plann$ foll[-up actions by ! regulator 9 response to ! compla9t or inquiry ( ! consum]4 7#b7 ,timely response to regulator by cov]$ entity ,a cov]$ entity subject to sup]vision & prim>y en=cem5t by ! ,ag5cy pursuant to ?is ,act %all provide a timely response to ! ,ag5cy1 9 writ+ :]e appropriate1 conc]n+ a consum] compla9t or inquiry1 includ+-- 7,a7 /eps t h be5 tak5 by ! cov]$ entity to respond to ! compla9t or inquiry ( ! consum]2 7,b7 responses receiv$ by ! cov]$ entity f ! consum]2 & 7,c7 foll[-up actions or plann$ foll[-up actions by ! cov]$ entity to respond to ! compla9t or inquiry ( ! consum]4 7#c7 ,r\t+ compla9ts to /ates ,to ! ext5t practicable1 ,/ate ag5cies may receive appropriate compla9ts f ! sy/ems e/abli%$ by ! ,ag5cy "u ?is subsection1 if-- 7,a7 ! ,/ate ag5cy sy/em has ! functional capacity to receive calls or electronic reports r\t$ by ! ,ag5cy sy/ems2 7,b7 ! ,/ate ag5cy has satisfi$ any conditions ( p>ticipation 9 ! sy/em t ! ,ag5cy may e/abli%1 includ+ treatm5t ( p]sonal in=mation & %>+ ( in=mation on compla9t resolution or relat$ compliance proc$ures & res\rces2 & 7,c7 p>ticipation by ! ,/ate ag5cy includes measures necess>y to provide = protection ( p]sonal in=mation t con=m to ! /&>ds = protection ( ! confid5tiality ( p]sonal in=mation & = data integrity & security t apply to ,f$]al ag5cies4 #i4 ,en=cem5t p[]s 7a7 ,jo9t inve/igations ,! ,ag5cy or1 :]e appropriate1 an ,ag5cy inve/igator1 may engage 9 jo9t inve/igations & reque/s = in=mation1 z au?oriz$ "u ?is ,act4 7b7 ,subpo5as 7#a7 ,9 g5]al ,! ,ag5cy or an ,ag5cy inve/igator may issue subpo5as = ! att5dance & te/imony ( witnesses & ! production ( relevant pap]s1 books1 docum5ts1 or o!r mat]ial 9 connection ) he>+s "u ?is ,act4 7#b7 ,failure to obey ,9 ! case ( contumacy or refusal to obey a subpo5a issu$ pursuant to ?is p>agraph & s]v$ ^u any p]son1 ! di/rict c\rt ( ! ,unit$ ,/ates = any di/rict 9 :i* su* p]son is f\nd1 resides1 or transacts bus9ess1 ^u application by ! ,ag5cy or an ,ag5cy inve/igator & aft] notice to su* p]son1 may issue an ord] requir+ su* p]son to appe> & give te/imony or to appe> & produce docum5ts or o!r mat]ial4 7#c7 ,contempt ,any failure to obey an ord] ( ! c\rt "u ?is subsection may be puni%$ by ! c\rt z a contempt !re(4 7c7 ,litigation au?ority 7#a7 ,9 g5]al ,if any cov]$ entity violates a ,f$]al privacy law1 ! ,ag5cy may comm5ce a civil action aga9/ su* cov]$ entity to impose a civil p5alty or to seek all appropriate legal & equitable relief includ+ a p]man5t or tempor>y injunction z p]mitt$ by law4 7#b7 ,repres5tation ,! ,ag5cy may act 9 its own "n & ?r\gh its own attorneys 9 en=c+ any provision ( ?is ,act1 rules !reund]1 or any o!r law or regulation1 or 9 any action1 suit1 or proce$+ to :i* ! ,ag5cy is a p>ty4 7#c7 ,compromise ( actions ,! ,ag5cy may compromise or settle any action if su* compromise is approv$ by ! c\rt4 7#d7 ,notice to ! attorney g5]al 7,a7 ,9 g5]al ,:5 comm5c+ a civil action "u ,f$]al privacy law1 or any rule !reund]1 ! ,ag5cy %all notify ! ,attorney ,g5]al4 7,b7 ,notice & coord9ation 7i7 ,notice ( o!r actions ,9 addition to any notice requir$ "u subp>agraph 7,a71 ! ,ag5cy %all notify ! ,attorney ,g5]al conc]n+ any action1 suit1 or proce$+ to :i* ! ,ag5cy is a p>ty4 7ii7 ,coord9ation ,9 ord] to avoid conflicts & promote consi/5cy reg>d+ litigation ( matt]s "u ,f$]al law1 ! ,attorney ,g5]al & ! ,ag5cy %all consult reg>d+ ! coord9ation ( inve/igations & proce$+s1 includ+ by negotiat+ an agreem5t = coord9ation by n lat] ?an #ahj days aft] ! transf] date4 ,! agreem5t "u ?is clause %all include provisions to ensure t p>allel inve/igations & proce$+s involv+ ! ,f$]al privacy laws are conduct$ 9 a mann] t avoids conflicts & does n imp$e ! ability ( ! ,attorney ,g5]al to prosecute violations ( ,f$]al crim9al laws4 7iii7 ,rule ( con/ruction ,no?+ 9 ?is subp>agraph %all be con/ru$ to limit ! au?ority ( ! ,ag5cy "u ?is ,act1 includ+ ! au?ority to int]pret ,f$]al privacy law4 7#e7 ,=um ,any civil action br\ght "u ?is ,act may be br\ght 9 a ,unit$ ,/ates di/rict c\rt or 9 any c\rt ( compet5t jurisdiction ( a /ate 9 a di/rict 9 :i* ! def5dant is locat$ or resides or is do+ bus9ess1 & su* c\rt %all h jurisdiction to enjo9 su* p]son & to require compliance ) any ,f$]al privacy law4 7#f7 ,"t = br++ action 7,a7 ,9 g5]al ,except z o!rwise p]mitt$ by law or equity1 no action may be br\ght "u ?is ,act m ?an #c ye>s aft] ! date ( discov]y ( ! violation to :i* an action relates4 7,b7 ,limitations "u o!r f$]al laws 7i7 ,9 g5]al ,an action aris+ "u ?is ,act does n include claims aris+ solely "u ! ,f$]al privacy laws4 7ii7 ,ag5cy au?ority ,9 any action aris+ solely "u a ,f$]al privacy law1 ! ,ag5cy may comm5ce1 def5d1 or int]v5e 9 ! action 9 accordance ) ! requirem5ts ( t provision ( law1 z applicable4 7iii7 ,transf]r$ au?ority ,9 any action aris+ solely "u laws = :i* au?orities 7 transf]r$ "u ?is ,act1 ! ,ag5cy may comm5ce1 def5d1 or int]v5e 9 ! action 9 accordance ) ! requirem5ts ( t provision ( law1 z applicable4 7d7 ,relief available 7#a7 ,jurisdiction ,! c\rt 7or ! ,ag5cy1 z ! case may be7 9 an action or adjudication proce$+ br\ght "u ,f$]al privacy law1 %all h jurisdiction to grant any appropriate legal or equitable relief ) respect to a violation ( ,f$]al privacy law1 includ+ a violation ( a rule or ord] prescrib$ "u a ,f$]al privacy law4 7#b7 ,relief ,relief "u ?is section may include1 )\t limitation-- 7,a7 rescission or re=mation ( contracts2 7,b7 refund ( moneys2 7,c7 re/itution2 7,d7 disgorgem5t or comp5sation = unju/ enri*m5t2 7,e7 paym5t ( damages or o!r monet>y relief2 7,f7 public notification reg>d+ ! violation1 includ+ ! co/s ( notification2 7,g7 limits on ! activities or functions ( ! cov]$ entity2 & 7,h7 civil money p5alties1 z set =? m fully 9 subsection 7f74 7#c7 ,no exempl>y or punitive damages ,no?+ 9 ?is subsection %all be con/ru$ z au?oriz+ ! imposition ( exempl>y or punitive damages4 7e7 ,recov]y ( co/s ,9 any action br\ght by ! ,ag5cy1 a ,/ate attorney g5]al1 or any ,/ate regulator to en=ce any ,f$]al privacy law1 ! ,ag5cy1 ! ,/ate attorney g5]al1 or ! ,/ate regulator may recov] its co/s 9 connection ) prosecut+ su* action if ! ,ag5cy1 ! ,/ate attorney g5]al1 or ! ,/ate regulator is ! prevail+ p>ty 9 ! action4 7f7 ,civil money p5alty 9 c\rt & adm9i/rative actions 7#a7 ,9 g5]al ,any p]son t violates1 ?r\gh any act or omission1 any provision ( ,f$]al privacy law %all =feit & pay a civil p5alty pursuant to ?is subsection4 7#b7 ,p5alty am\nts 7,a7 ,fir/ ti] ,= any violation ( a law1 rule1 or f9al ord] or condition impos$ 9 writ+ by ! ,ag5cy1 a civil p5alty may n exce$ #e1jjj = ea* day dur+ :i* su* violation or failure to pay cont9ues4 7,b7 ,second ti] ,not)/&+ subp>agraph 7,a71 = any p]son t recklessly engages 9 a violation ( a ,f$]al privacy law1 a civil p5alty may n exce$ #be1jjj = ea* day dur+ :i* su* violation cont9ues4 7,c7 ,?ird ti] ,not)/&+ subp>agraphs 7,a7 & 7,b71 = any p]son t kn[+ly violates a ,f$]al privacy law1 a civil p5alty may n exce$ #a1jjj1jjj = ea* day dur+ :i* su* violation cont9ues4 7#c7 ,mitigat+ factors ,9 det]m9+ ! am\nt ( any p5alty assess$ "u p>agraph 7#b71 ! ,ag5cy or ! c\rt %all take into acc\nt ! appropriat5ess ( ! p5alty ) respect to-- 7,a7 ! size ( f9ancial res\rces & good fai? ( ! p]son *>g$2 7,b7 ! gravity ( ! violation or failure to pay2 7,c7 ! sev]ity ( ! risks to or losses ( ! individual or gr\p ( individuals affect$ by ! violation2 7,d7 ! hi/ory ( previ\s violations2 & 7,e7 su* o!r matt]s z ju/ice may require4 7#d7 ,au?ority to modify or remit p5alty ,! ,ag5cy may compromise1 modify1 or remit any p5alty :i* may be assess$ or _h already be5 assess$ "u p>agraph 7#b74 ,! am\nt ( su* p5alty1 :5 f9ally det]m9$1 %all be exclusive ( any sums ow$ by ! cov]$ entity to ! ,unit$ ,/ates 9 connection ) ! co/s ( ! proce$+1 & may be d$uct$ f any sums ow+ by ! ,unit$ ,/ates to ! cov]$ entity *>g$4 7#e7 ,notice & he>+ ,no civil p5alty may be assess$ "u ?is subsection ) respect to a violation ( any ,f$]al privacy law1 unless-- 7,a7 ! ,ag5cy gives notice & an opportunity = a he>+ to ! p]son accus$ ( ! violation2 or 7,b7 ! appropriate c\rt has ord]$ su* assessm5t & ent]$ judgm5t 9 favor ( ! ,ag5cy4 7g7 ,ref]rals = crim9al proce$+s ,if ! ,ag5cy obta9s evid5ce t any p]son1 dome/ic or =eign1 has engag$ 9 conduct t may con/itute a violation ( ,f$]al crim9al law1 ! ,ag5cy %all transmit su* evid5ce to ! ,attorney ,g5]al ( ! ,unit$ ,/ates1 :o may in/itute crim9al proce$+s "u appropriate law4 ,no?+ 9 ?is section affects any o!r au?ority ( ! ,ag5cy to disclose in=mation4 7h7 ,data protection relief fund 7#a7 ,e/abli%m5t ( relief fund ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a sep>ate fund to be kn[n z ! ,data ,protection ,relief ,fund 7ref]r$ to 9 ?is subsection z ! ,relief ,fund74 7#b7 ,deposits 7,a7 ,deposits f ! ag5cy ,! ,ag5cy %all deposit into ! ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any judicial or adm9i/rative action ! ,ag5cy comm5ces to en=ce ?is ,act1 a regulation promulgat$ "u ?is ,act1 or a ,f$]al privacy law4 7,b7 ,deposits f ! attorney g5]al ,! ,attorney ,g5]al ( ! ,unit$ ,/ates %all deposit into ! ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any judicial or adm9i/rative action ! ,attorney ,g5]al comm5ces on behalf ( ! ,ag5cy to en=ce ?is ,act1 a regulation promulgat$ "u ?is ,act1 or a ,f$]al privacy law4 7#c7 ,use ( fund am\nts ,not)/&+ section #ccjb ( title #ca1 ,unit$ ,/ates ,code1 am\nts 9 ! ,relief ,fund %all be available to ! ,ag5cy1 )\t fiscal ye> limitation1 to provide r$ress1 paym5ts or comp5sation1 or o!r monet>y relief to individuals affect$ by an act or practice = :i* civil p5alties h be5 obta9$ "u ?is ,act4 ,to ! ext5t t individuals _c be locat$ or su* r$ress1 paym5ts or comp5sation1 or o!r monet>y relief are o!rwise n practicable1 ! ,ag5cy may use su* funds = ! purpose ( consum] or bus9ess education relat+ to data protection or = ! purpose ( engag+ 9 te*nological rese>* t ! ,ag5cy consid]s necess>y to en=ce ?is ,act & ,f$]al privacy laws4 7#d7 ,am\nts n subject to apportionm5t ,not)/&+ any o!r provision ( law1 am\nts 9 ! ,relief ,fund %all n be subject to apportionm5t = purposes ( *apt] #ae ( title #ca1 ,unit$ ,/ates ,code1 or "u any o!r au?ority4 #aj4 ,pres]vation ( ,/ate law 7a7 ,relation to /ate law 7#a7 ,rule ( con/ruction ,?is ,act may n be con/ru$ z annull+1 alt]+1 or affect+1 or exempt+ any p]son subject to ! provisions ( ?is title f comply+ )1 ! /atutes1 regulations1 ord]s1 or int]pretations 9 effect 9 any ,/ate1 except to ! ext5t t any su* provision ( law is inconsi/5t ) ! provisions ( ?is title1 & !n only to ! ext5t ( ! inconsi/5cy4 7#b7 ,great] protection "u /ate law ,= purposes ( ?is p>agraph1 a /atute1 regulation1 ord]1 or int]pretation 9 effect 9 any ,/ate is n inconsi/5t ) ! provisions ( ?is title if ! protection t su* /atute1 regulation1 ord]1 or int]pretation af=ds to individuals is great] ?an ! protection provid$ "u ?is ,act4 ,a det]m9ation reg>d+ :e!r a /atute1 regulation1 ord]1 or int]pretation 9 effect 9 any ,/ate is inconsi/5t ) ! provisions ( ?is title may be made by ! ,ag5cy on its own motion or 9 response to a nonfrivol\s petition initiat$ by any int]e/$ p]son4 7b7 ,relation to o!r provisions ( ,f$]al privacy laws t relate to /ate law ,no provision ( ?is ,act %all be con/ru$ z modify+1 limit+1 or sup]s$+ ! op]ation ( any provision ( a ,f$]al privacy law t relates to ! application ( a law 9 effect 9 any ,/ate ) respect to su* ,f$]al law4 7c7 ,pres]vation ( en=cem5t p[]s ( /ates ,! attorney g5]al 7or ! equival5t !re(7 ( any ,/ate may br+ a civil action 9 ! "n ( su* ,/ate 9 any di/rict c\rt ( ! ,unit$ ,/ates 9 t ,/ate or 9 ,/ate c\rt t is locat$ 9 t ,/ate & t has jurisdiction ov] ! def5dant1 to en=ce provisions ( ?is title or regulations issu$ "u ?is ,act1 & to secure rem$ies "u provisions ( ?is title or rem$ies o!rwise provid$ "u o!r law4 ,a ,/ate regulator may br+ a civil action or o!r appropriate proce$+ to en=ce ! provisions ( ?is title or regulations issu$ "u ?is ,act ) respect to any entity t is ,/ate-*>t]$1 incorporat$1 lic5s$1 or o!rwise au?oriz$ to d bus9ess "u ,/ate law 7except z provid$ 9 p>agraph 7#b771 & to secure rem$ies "u provisions ( ?is title or rem$ies o!rwise provid$ "u o!r provisions ( law ) respect to su* an entity4 7d7 ,pres]vation ( /ate au?ority 7#a7 ,/ate claims ,no provision ( ?is section %all be con/ru$ z alt]+1 limit+1 or affect+ ! au?ority ( a ,/ate attorney g5]al or any o!r regulatory or en=cem5t ag5cy or au?ority to br+ an action or o!r regulatory proce$+ aris+ solely "u ! law 9 effect 9 t ,/ate4 7#b7 ,/ate consum] protection1 privacy1 & data regulators ,no provision ( ?is title %all be con/ru$ z alt]+1 limit+1 or affect+ ! au?ority ( a ,/ate consum] protection1 data protection1 or privacy ag5cy 7or any ag5cy or (fice p]=m+ l functions7 "u ,/ate law to adopt rules1 initiate en=cem5t proce$+s1 or take any o!r action ) respect to a p]son regulat$ by su* commission or au?ority4 #aa4 ,reports & in=mation 7a7 ,reports requir$ ,n lat] ?an #f mon?s aft] ! date ( ! enactm5t ( ?is ,act1 & e #f mon?s !reaft]1 ! ,director %all submit a report to ! ,presid5t & to ! ,committee on ,en]gy & ,comm]ce1 ! ,committee on ! ,judici>y1 & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation1 ! ,committee on ! ,judici>y1 & ! ,committee on ,appropriations ( ! ,s5ate1 & %all publi% su* report on ! website ( ! ,ag5cy4 7b7 ,cont5ts ,ea* report requir$ by subsection 7a7 %all include-- 7#a7 a discussion ( ! significant problems fac$ by individuals ) respect to ! privacy or security ( p]sonal in=mation2 7#b7 a ju/ification ( ! budget reque/ ( ! ,ag5cy = ! prec$+ ye>1 unless a ju/ification = su* ye> 0 includ$ 9 ! prec$+ report submitt$ "u su* subsection2 7#c7 a li/ ( ! significant rules & ord]s adopt$ by ! ,ag5cy1 z well z o!r significant initiatives conduct$ by ! ,ag5cy1 dur+ ! prec$+ #f-mon? p]iod & ! plan ( ! ,ag5cy = rules1 ord]s1 or o!r initiatives to be und]tak5 dur+ ! upcom+ #f-mon? p]iod2 7#d7 an analysis ( compla9ts ab\t ! privacy or security ( p]sonal in=mation t ! ,ag5cy has receiv$ & collect$ 9 ! database describ$ 9 section #h dur+ ! prec$+ #f-mon? p]iod2 7#e7 a li/1 ) a brief /atem5t ( ! issues1 ( ! public en=cem5t actions to :i* ! ,ag5cy 0 a p>ty dur+ ! prec$+ #f-mon? p]iod2 & 7#f7 an assessm5t ( significant actions by ,/ate attorneys g5]al or ,/ate ag5cies relat+ to ?is ,act or ! rules prescrib$ "u ?is ,act dur+ ! prec$+ #f-mon? p]iod4 #ab4 ,transf]s ( functions 7a7 ,f$]al trade commission ,! au?ority ( ! ,f$]al ,trade ,commission "u a ,f$]al privacy law specifi$ 9 section #c7c77;,b7 to prescribe rules1 issue guidel9es1 or conduct a /udy or issue a report m&at$ "u su* law %all be transf]r$ to ! ,ag5cy on ! transf] date4 ,no?+ 9 ?is title %all be con/ru$ to require a m&atory transf] ( any employee ( ! ,f$]al ,trade ,commission4 7b7 ,ag5cy au?ority 7#a7 ,9 g5]al ,! ,ag5cy %all h all p[]s & duties "u ! ,f$]al privacy laws to prescribe rules1 issue guidel9es1 or to conduct /udies or issue reports m&at$ by su* laws1 t 7 ve/$ 9 ! ,f$]al ,trade ,commission on ! day be=e ! transf] date4 7#b7 ,f$]al trade commission act ,! ,ag5cy may en=ce a rule prescrib$ "u ! ,f$]al ,trade ,commission ,act 7#de ,u4,s4,c4 #da et seq47 by ! ,f$]al ,trade ,commission ) respect to ! collection1 disclosure1 process+1 & misuse ( p]sonal data4 7c7 ,au?ority ( ! ,f$]al ,trade ,commission ,no provision ( ?is title %all be con/ru$ z modify+1 limit+1 or o!rwise affect+ ! au?ority ( ! ,f$]al ,trade ,commission 7includ+ its au?ority ) respect to v l>ge entities describ$ 9 section #h7;a77#a77 "u ! ,f$]al ,trade ,commission ,act or any o!r law1 o!r ?an ! au?ority "u a ,f$]al privacy law to prescribe rules1 issue (ficial guidel9es1 or conduct a /udy or issue a report m&at$ "u su* law4 7d7 ,au?ority ( ! ,consum] ,f9ancial ,protection ,bureau ,no provision ( ?is title %all be con/ru$ z modify+1 limit+1 or o!rwise affect+ ! au?ority ( ! ,consum] ,f9ancial ,protection ,bureau "u ! ,dodd-,frank ,wall ,/reet ,re=m & ,consum] ,protection ,act 7,public ,law #aaa-bjc7 or any o!r law4 #ac4 ,au?orization ( appropriations ,= fiscal ye> #bjbj & ea* subsequ5t fiscal ye>1 !re are au?oriz$ to be appropriat$ to ! ,ag5cy su* sums z may be necess>y to c>ry out ?is ,act4