,,ii #aafth ,,congress #b;d ,session ,s4 #cdef ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ab1 #bjbj,mr4 ,moran introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect the privacy of consumers4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,consumer ,data ,privacy and ,security ,act of #bjbj4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,sec4 #c4 ,collection and processing of personal data4,sec4 #d4 ,right to know4,sec4 #e4 ,individual control4,sec4 #f4 ,security4,sec4 #g4 ,accountability4,sec4 #h4 ,rules relating to service providers4,sec4 #i4 ,enforcement4,sec4 #aj4 ,relation to other laws4,sec4 #aa4 ,commission resources4,sec4 #ab4 ,guidance and reporting4,sec4 #ac4 ,severability4,sec4 #ad4 ,effective date4 #b4 ,definitions ,in this ,act3 7#a7 ,biometric information ,the term biometric information means information1 resulting from specific technical processing related to the physical1 biological1 physiological1 genetic1 or behavioral characteristics of an individual1 that identifies the individual4 7#b7 ,collection ,the term collection means acquiring personal data by any means1 including by receiving1 purchasing1 or leasing the data or by observing or interacting with the individual to whom the data relates4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,covered entity 7,a7 ,in general ,the term covered entity means any entity that-- 7i7 alone1 or jointly with others1 determines the purpose and means of collecting or processing personal data2 and 7ii7 is-- 7,i7 a person over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 7,,ii7 a common carrier subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and ,acts amendatory thereof and supplementary thereto2 or 7,,iii7 a nonprofit organization1 including any organization that is not organized to carry on business for its own profit or that of its members4 7,b7 ,limitation ,an entity shall not be considered to be a covered entity with respect to personal data to the extent that the entity is a service provider with respect to such data4 7#e7 ,de-identify ,the term de-identify means1 with respect to personal data held by a covered entity or service provider1 that the covered entity or service provider-- 7,a7 alters1 anonymizes1 or aggregates the data so that there is a reasonable basis for expecting that the data could not be linked 7including by the entity or service provider7 as a practical matter to a specific individual2 7,b7 publicly commits to refrain from attempting to re-identify the data with a specific individual1 and adopts controls to prevent such identification2 and 7,c7 causes the data to be covered by a contractual or other legally enforceable prohibition on each entity to which the covered entity or service provider discloses the data from attempting to use the data to identify a specific individual and requires the same of all onward disclosures4 7#f7 ,delete ,the term delete means to remove or destroy information such that the information is not able to be retrieved in the ordinary course of business4 7#g7 ,individual ,the term individual means a natural person residing in the ,united ,states4 7#h7 ,material change ,the term material change means a change to a policy or practice of a covered entity or service provider that-- 7,a7 relates to the collection or processing of personal data by the covered entity or service provider2 7,b7 is likely to affect the conduct or decision of a reasonable individual with respect to any personal data of the individual that is subject to such policy or practice2 and 7,c7 in the case of a service provider1 is made at the direction of the covered entity on whose behalf the service provider is performing a service or function4 7#i7 ,personal data 7,a7 ,in general ,the term personal data means information that identifies or is linked or reasonably linkable to a specific individual4 7,b7 ,linked or reasonably linkable 7i7 ,in general ,for purposes of subparagraph 7,a71 information held by a covered entity or service provider is linked or reasonably linkable to a specific individual if it can be used on its own or in combination with other information held by1 or readily accessible to1 the covered entity or service provider to identify the individual4 7ii7 ,application to device-level identifiers ,a persistent identifier that is used to identify a specific individual over time and across services and platforms1 including a customer number held in a cookie1 a static ,internet ,protocol 7,,ip7 address1 a processor or device serial number1 or another unique device identifier1 shall be considered information that is linked or reasonably linkable to the individual for purposes of subparagraph 7,a74 7,c7 ,exclusion ,the term personal data does not include-- 7i7 de-identified data2 7ii7 data that has been rendered unreadable or indecipherable2 7iii7 information about employees or employment status collected or used by an employer pursuant to an employer-employee relationship1 including information related to prospective employees and relevant application materials2 7iv7 publicly available information2 7v7 data that has undergone pseudonymization2 or 7vi7 employee data4 7,d7 ,employee data ,for purposes of subparagraph 7,c71 the term employee data means information collected by a covered entity or the service provider of a covered entity that is-- 7i7 contact information for an individual or the individual's emergency contact that is collected in the course of the individual's employment or application for employment 7including on a contract or temporary basis7 with the covered entity1 provided that such information is retained or processed by the covered entity or service provider solely for purposes related to the individual's employment or application for employment with the covered entity2 or 7ii7 information about an individual who is an employee or former employee of the covered entity 7or a relative of such an individual7 that is necessary to administer benefits to which such individual or relative is entitled on the basis of the individual's employment with the covered entity1 provided that such data is retained or processed by the covered entity or service provider solely for the purpose of administering such benefits4 7#aj7 ,pseudonymization ,the term pseudonymization means the processing of personal data so that the personal data can no longer be attributed or reasonably linked to a specific individual without the use of additional information1 provided that such additional information-- 7,a7 is kept separately2 and 7,b7 is subject to technical and organizational measures to ensure that the personal data is not attributed to a specific individual4 7#aa7 ,privacy officer ,the term privacy officer means an individual designated by a covered entity or service provider under section #g7;b77#a7 to be the privacy officer of the covered entity4 7#ab7 ,processing ,the term processing means any operation or set of operations performed on personal data1 including the analysis1 organization1 structuring1 retaining1 using1 disclosing1 transmitting1 sharing1 transferring1 selling1 licensing1 or otherwise handling of personal data4 7#ac7 ,publicly available information 7,a7 ,in general ,the term publicly available information means any information that a covered entity or service provider has a reasonable basis to believe is lawfully made available to the general public from-- 7i7 a ,federal1 ,state1 or local government record2 7ii7 widely distributed media2 or 7iii7 a disclosure to the general public that is made voluntarily by an individual1 or required to be made by a ,federal1 ,state1 or local law4 7,b7 ,reasonable basis to believe ,for purposes of subparagraph 7,a71 reasonable bases for believing that information is lawfully made available to the general public shall include a written determination by a covered entity or service provider that the information is of a type that is lawfully made available to the general public4 7#ad7 ,sensitive personal data ,the term sensitive personal data means personal data that is-- 7,a7 a unique1 government-issued identifier1 such as a social security number1 passport number1 driver's license number1 or taxpayer identification number2 7,b7 a user name or email address in combination with a password or security question and answer that would permit access to an online account2 7,c7 biometric information of an individual2 7,d7 the content of a wire communication1 oral communication1 or electronic communication1 as those terms are defined in section #beaj of title #ah1 ,united ,states ,code1 to which the individual is a party1 unless the covered entity is the intended recipient of the communication2 7,e7 information that relates to-- 7i7 the past1 present1 or future diagnosed physical or mental health or condition of an individual2 7ii7 the provision of health care to an individual2 or 7iii7 the past1 present1 or future payment for the provision of health care to an individual2 7,f7 a financial account number1 debit card number1 credit card number1 if combined with an access code1 password1 or credentials that provide access to such an account2 7,g7 the race or ethnicity of the individual2 7,h7 the religious beliefs or affiliation of the individual2 7,i7 the sexual orientation of the individual2 7,j7 the precise geolocation of an individual that is technically derived and that is capable of determining with reasonable specificity the past or present actual physical location of the individual more precisely than a zip code1 street1 or town or city level2 or 7,k7 such other specific categories of personal data as the ,commission may define by rule issued in accordance with section #eec of title #e1 ,united ,states ,code1 the collection or processing of which could lead to reasonably foreseeable harm to an individual4 7#ae7 ,service provider ,the term service provider means an entity that collects or processes personal data on behalf of1 and at the direction of1 a covered entity to which the service provider is unaffiliated1 but only-- 7,a7 with respect to the personal data collected or processed on the behalf of1 and at the direction of1 such covered entity2 and 7,b7 to the extent that the collection or processing-- 7i7 is on the behalf of1 and at the direction of1 such covered entity2 or 7ii7 is permitted under section #c7;c74 7#af7 ,small business ,the term small business means any covered entity or service provider that-- 7,a7 for the most recent #f-month period-- 7i7 employs not more than #ejj employees2 and 7ii7 maintains less than #ej1jjj1jjj in average gross receipts for the previous #c years2 and 7,b7 collects or processes on an annual basis-- 7i7 the personal data of fewer than #a1jjj1jjj individuals2 or 7ii7 the sensitive personal data of fewer than #ajj1jjj individuals4 7#ag7 ,third party 7,a7 ,in general ,the term third party means a covered entity that receives third party personal data from an unaffiliated covered entity1 but only with respect to such third party personal data4 7,b7 ,third party personal data ,for purposes of subparagraph 7,a71 the term third party personal data means personal data that a covered entity discloses to another unaffiliated covered entity and such disclosure-- 7i7 is not directed by the individual to whom the personal data relates2 and 7ii7 is not necessary to complete a transaction or fulfill a request made by the individual to whom such data relates4 7#ah7 ,unaffiliated ,the term unaffiliated means1 with respect to two or more entities1 that the entities do not share interrelated operations1 common management1 centralized control of labor relations1 or common ownership or financial control4 #c4 ,collection and processing of personal data 7a7 ,requirements 7#a7 ,in general ,except as provided in paragraphs 7#b7 and 7#c71 a covered entity shall not collect or process personal data of an individual unless-- 7,a7 the individual has consented explicitly or implicitly to such collection or processing for a specific purpose1 in accordance with subsection 7b72 or 7,b7 the covered entity collects or processes the personal data in accordance with a permissible purpose described in subsection 7c74 7#b7 ,application to third parties 7,a7 ,in general ,a covered entity that is a third party with respect to the personal data of an individual may collect or process such personal data without directly obtaining the individual's consent as required under paragraph 7#a77;,a7 if-- 7i7 the covered entity from whom the third party received the personal data of the individual involved-- 7,i7 has provided the individual with notice of-- 7aa7 the fact that the covered entity would disclose the individual's personal data to the third party2 and 7bb7 the purposes for which the third party will collect or process the personal data of the individual2 and 7,,ii7 the individual has consented to such disclosure and such collection or processing of the individual's personal data2 or 7ii7 the third party collects or process the personal data in accordance with a permissible purpose described in subsection 7c74 7,b7 ,notice and consent requirement for different or additional collection or processing ,a covered entity that is a third party with respect to the personal data of an individual shall obtain the consent of such individual in accordance with subsection 7b7 before collecting or processing such personal data if the specific purpose for such collection or processing-- 7i7 is not a purpose described in paragraph 7#a71 7#b71 7#d71 or 7#f7 of subsection 7c72 and 7ii7 is different from1 or in addition to1 the purpose for any collection or processing to which the individual previously consented in accordance with subsection 7b74 7,c7 ,duty to exercise reasonable due diligence prior to reliance on covered entity representations ,for purposes of subparagraph 7,a71 a covered entity that is a third party with respect to the personal data of an individual may reasonably rely on representations made by the covered entity from whom the third party received such data regarding the notice provided to1 and the consent obtained from1 such individual1 provided that the third party has determined1 after exercising reasonable due diligence1 that the covered entity is credible4 7#c7 ,notice and consent obtained by service providers ,a service provider may provide notice to1 and obtain consent from1 an individual in accordance with subsection 7b7 on behalf of a covered entity4 7b7 ,consent 7#a7 ,in general 7,a7 ,implicit consent ,except as provided in subparagraph 7,b71 an individual shall be deemed to have consented to a request to collect or process the individual's personal data if the individual fails to decline the request after being provided with the notice described in paragraph 7#b7 and a reasonable amount of time to respond to the request4 7,b7 ,express affirmative consent requirement 7i7 ,in general ,the express affirmative consent of an individual is required to collect or process the personal data of the individual if the collection or processing-- 7,i7 involves sensitive personal data of the individual2 or 7,,ii7 involves the disclosure of personal data to a third party for a purpose that is not described in subsection 7c74 7ii7 ,requirements for valid express affirmative consent ,for purposes of clause 7i71 the express affirmative consent of an individual to a request to collect or process the personal data of the individual-- 7,i7 shall be clearly1 prominently1 and unmistakably stated2 7,,ii7 shall be provided in response to a request that includes the notice described in paragraph 7#b72 and 7,,iii7 cannot be inferred from inaction4 7#b7 ,notice required 7,a7 ,in general ,in requesting the consent of an individual to collect or process the individual's personal data1 a covered entity shall provide the individual with notice1 in a concise1 meaningful1 timely1 prominent1 and easy-to-understand format1 that includes-- 7i7 the types of personal data collected and processed2 7ii7 a description of the purposes for which the covered entity seeks to collect or process that individual's personal data2 and 7iii7 the information described in subparagraph 7,b74 7,b7 ,contents ,the notice provided by a covered entity under subparagraph 7,a7 shall include-- 7i7 information on how the individual may access the privacy policy of the covered entity described in section #d7;a72 7ii7 information on how the individual may exercise the rights provided for under this ,act2 and 7iii7 notice of whether the collection or processing by the covered entity-- 7,i7 includes the disclosure of personal data to third parties2 or 7,,ii7 involves sensitive personal data4 7,c7 ,separation ,if consent is obtained in the context of a notice that also concerns matters other than the collection or processing of personal data1 the request for consent shall be presented in a manner that is clearly distinguishable from the other matters4 7#c7 ,withdrawal of consent 7,a7 ,in general ,a covered entity shall provide an individual with the means to withdraw previously given consent to collect or process the personal data of the individual-- 7i7 at any time and place that is reasonably practicable2 and 7ii7 in a manner that is as accessible as reasonably practicable4 7,b7 ,effect ,a withdrawal made under subparagraph 7,a7-- 7i7 shall take effect without undue delay2 7ii7 shall remain in effect until the individual revokes or limits that denial or withdrawal2 and 7iii7 shall not apply to any collection or processing of personal data that occurred before the date on which the withdrawal is made4 7c7 ,permissible purposes ,a covered entity or service provider may collect or process the personal data of an individual without consent to the extent that such collection or processing is reasonably necessary and limited to the following purposes 7except that a covered entity that is a third party with respect to personal data may not collect or process such data without consent for the purposes described in paragraphs 7#c71 7#e71 and 7#f773 7#a7 ,provision of service or performance of a contract ,to-- 7,a7 provide a service1 perform a contract1 or conduct a transaction that the individual has initiated2 or 7,b7 take steps in furtherance of the request initiated by the individual prior to providing the service or entering into a contract or transaction4 7#b7 ,compliance with laws ,to comply with a ,federal1 ,state1 or local law or another applicable legal requirement1 including a subpoena1 summons1 or other properly executed compulsory process1 or to exercise or defend a legal claim1 as specifically authorized by law4 7#c7 ,immediate danger ,to prevent imminent danger to the personal safety of any individual1 including by effectuating a product recall pursuant to ,federal or ,state law4 7#d7 ,fraud prevention and protection of security ,to protect the rights1 property1 services1 or information systems of the covered entity or service provider1 or any individual1 including to investigate a possible crime or to protect against security threats1 abuse1 malicious conduct1 deception1 fraud1 theft1 unauthorized transactions1 or any other unlawful activity4 7#e7 ,research ,in the case of a covered entity only1 to conduct research that-- 7,a7 is performed for the primary purpose of advancing a broadly recognized public interest2 7,b7 is performed by the covered entity 7or by a service provider at the direction of the covered entity7 and is not disclosed to any third party2 7,c7 is broadly compatible with the purposes for which the data was originally collected or processed2 and 7,d7 adheres to all applicable ethics and privacy laws4 7#f7 ,operational purposes ,to-- 7,a7 perform internal operations or analytics for a product or service offered by the covered entity or service provider1 such as billing1 shipping1 internal systems maintenance1 diagnostics1 inventory management1 financial reporting or accounting1 serving an internet website1 or network management2 7,b7 use on a short-term1 transient basis1 provided that the personal data-- 7i7 is not disclosed to a third party2 and 7ii7 is not used to build a persistent profile of the individual2 7,c7 in the case of a covered entity only1 market or advertise a service or product to an individual if the personal data used for the marketing or advertising was collected directly from the individual by the covered entity or by a service provider on behalf of the covered entity2 7,d7 improve a product1 service1 or activity used1 requested1 or authorized by the individual1 including analytics1 forecasting1 the repair of errors that impair existing intended functionality1 actions to verify or maintain quality or safety of the product1 service1 or activity1 or the ongoing provision of customer service and support by the covered entity or service provider2 or 7,e7 other additional specific categories of operational purposes that the ,commission may define by rule1 issued in accordance with section #eec of title #e1 ,united ,states ,code4 7d7 ,limiting the retention of sensitive personal data ,a covered entity shall delete or de-identify sensitive personal data1 and shall direct its service providers to delete or de-identify sensitive personal data1 after the data is no longer reasonably necessary to accomplish the intended purposes permitted by this section1 unless such deletion or de-identification is impossible or demonstrably impracticable4 7e7 ,bankruptcy ,if a covered entity or service provider commences a case under title #aa of the ,united ,states ,code1 and the case or any proceeding under the case is expected to lead to the disclosure of the personal data of any individual1 the covered entity or service provider shall1 in a reasonable amount of time before the disclosure1 provide each individual whose personal data is subject to the disclosure with-- 7#a7 a notice of the proposed disclosure1 including-- 7,a7 the name of each third party to which the personal data will be disclosed2 and 7,b7 a description of the policies and practices relating to personal data of each such third party2 and 7#b7 the opportunity to-- 7,a7 deny consent1 or withdraw previously given consent1 to the disclosure of the personal data2 or 7,b7 request that the covered entity or service provider delete or de-identify the personal data4 #d4 ,right to know 7a7 ,in general ,a covered entity shall make publicly available1 in a clear and prominent location and in easy-to-understand language1 a privacy policy that includes-- 7#a7 a clear and specific description of the entity's policies and practices with respect to personal data2 7#b7 a clear and specific description of the rights of individuals with respect to their personal data 7including the rights described in section #e7 and information on how to exercise those rights2 and 7#c7 the information described in subsection 7c74 7b7 ,availability of previous versions ,a covered entity shall make publicly available any previous version of a privacy policy required under subsection 7a74 7c7 ,contents ,a privacy policy required under subsection 7a7 shall include-- 7#a7 the identity and the contact details of the covered entity1 including1 where applicable1 the representative of the covered entity for purposes of privacy inquiries or its privacy officer2 7#b7 a clear description of each category of personal data collected by the covered entity and the purposes for which each such category is collected and processed2 7#c7 a clear description of any relevant retention periods 7if possible7 and any criteria and other information with respect to the deletion or de-identification of personal data collected and processed by the covered entity2 7#d7 whether1 and for what purposes1 the covered entity discloses personal data to third parties1 each category of personal data disclosed to third parties1 and the types of third parties to which those categories of personal data are disclosed2 7#e7 whether1 and for what purposes1 the covered entity receives personal data from third parties1 the categories of personal data received from third parties1 and the types of third parties from which the covered entity receives personal data2 7#f7 a clear description of the process by which the covered entity informs individuals of material changes to its policies and practices with respect to its collection and processing of personal data2 7#g7 the specific steps an individual may take to minimize the collection or processing by the covered entity of the individual's personal data1 and the relevant implications to the individual from minimizing such collection or processing2 and 7#h7 the effective date of the privacy policy4 7d7 ,exceptions ,a covered entity shall not be required to make available a privacy policy under this subsection with respect to the collection or processing of personal data that is reasonably necessary and limited to-- 7#a7 an in-person transaction where the personal data is not processed for further purposes incompatible with that transaction2 7#b7 comply a ,federal1 ,state1 or local law or another applicable legal requirement1 including a subpoena1 summons1 or other properly executed compulsory process2 7#c7 prevent imminent danger to the personal safety of any individual2 or 7#d7 protect the rights or data security of the covered entity1 a service provider of the covered entity1 or any individual1 including to investigate a possible crime or to protect against security threats1 abuse1 fraud1 theft1 unauthorized transactions1 or any other unlawful activity4 7e7 ,material changes 7#a7 ,in general ,a covered entity1 upon any material change to the privacy policy of the covered entity or a material change to the privacy policy of a service provider that is made at the direction of the covered entity-- 7,a7 shall notify each individual whose personal data is collected or processed by the covered entity1 or a service provider on behalf of the covered entity1 with a description of the material change1 including-- 7i7 change to the categories of personal data the covered entity or service provider processes2 7ii7 change to the purposes for which the covered entity or service provider processes personal data2 7iii7 change to the manner in which the covered entity or service provider discloses personal data to third parties2 and 7iv7 which1 if any1 changes are retroactive2 and 7,b7 shall not process 7or1 in the case of a material change to the privacy policy of a service provider that is directed by the covered entity1 shall not direct the service provider to process7 any sensitive personal data of an individual that was collected by the covered entity or service provider before the effective date of the material change in a manner that is inconsistent with the privacy policy that was applicable at the time such data was collected until the individual provides express affirmative consent to such processing4 7#b7 ,direct notice of material change to affected individuals ,a covered entity shall1 if operationally and technically feasible1 directly provide the notice of a material change required under paragraph 7#a77;,a7 to each affected individual1 taking into account available technology and the nature of the relationship between the covered entity and the individual4 7#c7 ,public notice of material change ,where directly providing the notice of a material change required under paragraph 7#a77;,a7 to each affected individual is impossible or demonstrably impracticable1 a covered entity-- 7,a7 shall publish the notice in a reasonably prominent location2 and 7,b7 shall not process personal data that was collected by the covered entity before the effective date of the material change in a manner that is inconsistent with the privacy policy that was applicable at the time such data was collected until after the notice has been so published for a period of time that is reasonably sufficient to give affected individuals the opportunity to exercise their rights with respect to their personal data4 #e4 ,individual control 7a7 ,privacy controls ,each covered entity shall-- 7#a7 provide each individual whose personal data is collected or processed by the covered entity with a reasonably accessible1 clear and conspicuous1 and easy-to-use means to exercise the individual's rights established under this section with respect to such data2 7#b7 if applicable1 offer the means required under paragraph 7#a7 through the same means that the individual routinely uses to interact with the covered entity2 and 7#c7 make the means required under paragraph 7#a7 available at no additional cost to the individual4 7b7 ,right ,to access 7#a7 ,in general ,a covered entity shall1 in response to a verified request from an individual-- 7,a7 confirm whether or not the covered entity has collected or processed the personal data of the individual2 and 7,b7 if the covered entity has collected or processed the personal data of the individual1 provide1 within a reasonable time after receiving the request1 the individual with-- 7i7 a copy1 or an accurate representation1 of the personal data pertaining to the individual collected and processed by the covered entity2 and 7ii7 a list of the categories of third parties to which the covered entity has disclosed the personal data of the individual1 if applicable4 7#b7 ,ease of access 7,a7 ,format ,the covered entity shall provide the information described in paragraph 7#a77;,b7 in an electronic format unless-- 7i7 the individual requests to receive the information by other means2 or 7ii7 providing the information electronically is impossible or demonstrably impracticable4 7,b7 ,data portability ,if a covered entity provides an individual with information in an electronic format under subparagraph 7,a71 the covered entity shall1 where technically feasible and reasonably practicable1 provide the individual with-- 7i7 the ability to export the personal data generated and submitted by the individual in a structured1 commonly-used1 and machine-readable format2 and 7ii7 the ability to transmit such information to another entity without constraints or conditions4 7c7 ,rights to accuracy and correction 7#a7 ,in general ,a covered entity shall establish reasonable procedures designed to-- 7,a7 ensure that the personal data that the covered entity collects and processes with respect to an individual is accurate and up-to-date2 and 7,b7 provide individuals with the ability to submit a verified request to the covered entity to-- 7i7 dispute the accuracy and completeness of such personal data2 and 7ii7 request the appropriate correction of such personal data4 7#b7 ,dispute and correction ,each covered entity shall ensure that the ability of an individual to dispute or request that the covered entity correct personal data as described in paragraph 7#a7 is provided in a manner that is appropriate and reasonable based on the benefits and risks of harm to the individual regarding the accuracy of the personal data4 7#c7 ,exceptions for publicly available information ,a covered entity shall not be required to verify the accuracy of publicly available information if the covered entity has reasonable procedures to ensure that the publicly available information assembled or maintained by the covered entity accurately reflects the information available to the general public4 7d7 ,right to erasure 7#a7 ,in general ,except for personal data collected and processed in accordance with a permissible purpose described in section #c7;c71 upon a verified request from an individual1 a covered entity shall1 without undue delay1 delete or de-identify the personal data of the individual1 and shall direct any service providers of the covered entity to delete or de-identify such data4 7#b7 ,special considerations ,in determining whether a covered entity that is a small business has complied with a verified request under paragraph 7#a7 in a timely fashion1 the ,commission shall take into account the amount of time that the entity requires to comply with the request considering the technical feasibility1 cost1 and burden to the entity of complying with the request4 7e7 ,frequency and cost ,to exercise rights 7#a7 ,in general ,a covered entity-- 7,a7 shall comply with a verified request from any individual to exercise each of the rights described in subsections 7b71 7c71 and 7d7 not less frequently than twice in any #ab-month period2 and 7,b7 the first #b times that an individual makes a verified request described in subparagraph 7,a7 in any #ab-month period1 shall comply with such requests without any charge to the individual4 7#b7 ,manifestly unfounded and excessive requests ,if an individual submits a manifestly unfounded or frivolous request to exercise a right under subsection 7b71 7c71 or 7d71 or an excessive number of requests under such subsections1 the covered entity may-- 7,a7 charge a reasonable fee1 taking into account the administrative costs of providing the personal data1 communication1 or taking the action requested by the individual2 or 7,b7 refuse to act on the request4 7f7 ,verified request 7#a7 ,in general ,a request to exercise a right described in this section shall only be considered a verified request if the covered entity verifies that the individual making the request is the individual whose personal data is the subject of the request4 7#b7 ,verification of identity 7,a7 ,in general ,a covered entity shall make a reasonable effort to verify the identity of any individual who submits a request to exercise a right under this section4 7,b7 ,additional information ,if a covered entity cannot verify the identity of the individual submitting a request under this subsection1 the covered entity-- 7i7 may request that the individual provide such additional information as is necessary to confirm the identity of the individual2 and 7ii7 shall only process additional information provided under clause 7i7 for the purpose of verifying the identity of the individual4 7g7 ,declination of requests 7#a7 ,in general ,a covered entity-- 7,a7 shall decline to act on a request under this section where1 after undertaking a reasonable effort1 the entity cannot verify that the individual making the request is the individual whose personal data is the subject of the request2 7,b7 may decline to act on a request under this section where fulfilling the request would-- 7i7 require the covered entity or a service provider of the covered entity to retain any personal data collected for a single1 one-time transaction1 if such personal data is not processed for additional purposes2 7ii7 be impossible or demonstrably impracticable1 or require any steps or measures to re-identify1 or otherwise alter or manipulate1 information that is de-identified2 7iii7 be contrary to the legitimate interests of the covered entity or a service provider of the covered entity1 such as completing a transaction1 repairing functionality or errors1 or performing a contract between the covered entity and the individual2 7iv7 impair the ability of the covered entity or a service provider of the covered entity to detect or respond to a security incident1 provide a secure environment1 or protect against malicious1 deceptive1 fraudulent1 or illegal activity2 7v7 hinder compliance with a legal obligation or legally recognized privilege1 such as a requirement to retain certain information1 or the establishment1 exercise1 or defense of legal claims2 7vi7 interfere with research 7conducted in accordance with section #c7;c77#e77 when the deletion of the personal data is likely to render impossible or seriously impair such research2 or 7vii7 create a legitimate risk to the privacy1 security1 safety1 or other rights of the individual1 an individual other than the requester1 or the covered entity1 based on a reasonable individualized determination by the covered entity2 and 7,c7 shall not be required to act on a request under this section if the covered entity is unable to fulfill the request because-- 7i7 the covered entity requires the assistance of a service provider to fulfill the request2 and 7ii7 the service provider has informed the covered entity that the service provider is unable to assist the covered entity in fulfilling the request for a reason specified in section #h7;c77#c77;,a77ii77,,iv74 7#b7 ,notice of reasons for declination ,if the covered entity declines to act on a request pursuant to paragraph 7#a71 the covered entity shall inform the individual who made the request of the reasons for such declination and any rights the individual may have to appeal the decision of the covered entity4 7h7 ,exception for small businesses ,the requirements under subsections 7b7 and 7c7 shall not apply to a covered entity that is a small business4 7i7 ,guidance ,the ,commission shall1 after consulting with and soliciting comments from consumer data industry representatives1 issue guidance describing nonbinding best practices for covered entities and service providers of different business sizes and types to develop privacy controls as described in this section4 #f4 ,security 7a7 ,in general ,each covered entity and service provider shall develop1 document1 implement1 and maintain a comprehensive data security program that contains reasonable administrative1 technical1 and physical safeguards designed to protect the security1 confidentiality1 and integrity of personal data from unauthorized access1 use1 destruction1 acquisition1 modification1 or disclosure4 7b7 ,considerations of safeguards ,the safeguards required under subsection 7a7 with respect to a covered entity or service provider shall be appropriate to-- 7#a7 the size1 complexity1 and resources of the covered entity or service provider2 7#b7 the nature and scope of the activities of the covered entity or service provider2 7#c7 the technical feasibility and cost of available tools1 external audits or assessments1 and other measures used by the covered entity or service provider to improve security and reduce vulnerabilities2 7#d7 the sensitivity of the personal data involved2 and 7#e7 the potential for unauthorized access1 use1 destruction1 acquisition1 modification1 or disclosure of the personal data involved to result in economic loss1 identity theft1 fraud1 or physical injury to the individuals to whom such data relates4 7c7 ,requirements for program ,a comprehensive data security program under this section shall be designed to1 at a minimum-- 7#a7 designate an employee or employees to be responsible for overseeing and maintaining its safeguards2 7#b7 identify material internal and external risks to the security and confidentiality of personal data and assess the sufficiency of any safeguards in place to control these risks1 including consideration of risks in each relevant area of the operations of the covered entity or service provider1 including-- 7,a7 employee training and management2 7,b7 information systems1 including network and software design1 as well as information processing1 storage1 transmission1 and disposal2 7,c7 detecting1 preventing1 and responding to attacks1 intrusions1 or other systems failures2 and 7,d7 whether the covered entity or service provider has taken action to address and prevent reasonably known and addressable security vulnerabilities2 7#c7 implement safeguards designed to control the risks identified in the covered entity's or service provider's risk assessment1 and regularly assess the effectiveness of those safeguards2 7#d7 maintain reasonable procedures to require that third parties and service providers to whom personal data is transferred by the covered entity or service provider involved maintain reasonable administrative1 technical1 and physical safeguards designed to protect the security and confidentiality of personal data2 and 7#e7 evaluate and make reasonable adjustments to the safeguards in light of material changes in technology1 internal or external threats to personal data1 and the changing business arrangements or operations of the covered entity or service provider4 #g4 ,accountability 7a7 ,definition of applicable entity ,in this section1 the term applicable entity means a covered entity or service provider that1 on an annual basis1 conducts collection and processing of-- 7#a7 the personal data of more than #bj1jjj1jjj individuals2 or 7#b7 the sensitive personal data of more than #a1jjj1jjj individuals4 7b7 ,privacy officer 7#a7 ,designation ,each applicable entity shall-- 7,a7 designate an employee of the applicable entity1 or an individual who is a contractor of the applicable entity1 to be the privacy officer responsible for overseeing its policies and practices relating to the collection and processing of personal data2 and 7,b7 ensure that the privacy officer is involved in all issues relating to the privacy and security of personal data4 7#b7 ,conflicts of interest ,the privacy officer may perform other tasks and duties for the applicable entity1 but only to the extent that the applicable entity ensures that the performance of those other tasks or duties does not present a conflict of interest with respect to the duties and responsibilities of the privacy officer role4 7#c7 ,responsibilities ,the privacy officer shall-- 7,a7 inform and advise the applicable entity of the obligations of the applicable entity under this ,act2 7,b7 monitor compliance by the applicable entity with this ,act2 7,c7 oversee-- 7i7 in the case of an applicable entity that is a covered entity1 each privacy impact assessment carried out under subsection 7c72 and 7ii7 the comprehensive privacy program implemented under subsection 7d72 and 7,d7 act as a contact for the ,commission1 other ,federal1 ,state1 and local authorities1 and the applicable entity with respect to matters relating to the privacy and security of personal data4 7c7 ,consideration of privacy implications of material changes in processing sensitive personal data 7#a7 ,in general ,if an applicable entity that is a covered entity intends to begin a new collection or processing activity or to make a material change in its processing of sensitive personal data1 the applicable entity shall1 before beginning the new processing activity or making the material change1 consider the privacy implications1 if any of the change4 7#b7 ,considerations ,an applicable entity that is a covered entity shall ensure1 in considering the privacy implications of a material change as required under paragraph 7#a71 that the consideration is reasonable and appropriate with respect to the sensitive personal data that will be affected by the new processing activity or the material change in processing by considering-- 7,a7 the nature and volume of the sensitive personal data2 and 7,b7 the potential for the new processing activity or the material change to be a proximate cause of harm to individuals to whom the sensitive personal data pertains4 7#c7 ,approval ,the privacy officer shall be required to approve the findings of a privacy impact assessment carried out under paragraph 7#a7 before a applicable entity that is a covered entity may begin the new processing activity or make the material change that is the subject of the privacy impact assessment4 7#d7 ,documentation ,an applicable entity that is a covered entity shall document and maintain in written form any privacy impact assessment carried out under paragraph 7#a7 if the new processing activity or material change that is the subject of the privacy impact assessment involves sensitive personal data4 7d7 ,comprehensive privacy program 7#a7 ,in general ,each applicable entity shall implement a comprehensive privacy program to safeguard the privacy and security of personal data collected or processed by the applicable entity for the life cycle of development and operational practices of its products or services1 including by-- 7,a7 enhancing the privacy and security of personal data collected or processed by the applicable entity through appropriate technical or operational safeguards1 such as encryption1 de-identification1 and other privacy enhancing technologies2 7,b7 verifying that the applicable entity's practices relating to the collection and processing of personal data are consistent with-- 7i7 the entity's policies and documentation of such policies2 7ii7 in the case of an applicable entity that is a covered entity1 representations the entity makes to individuals2 and 7iii7 in the case of an applicable entity that is a service provider1 representations the entity makes to covered entities to which the entity provides services2 and 7,c7 ensuring that the privacy controls of the applicable entity are adequately accessible to1 and effective at safeguarding the expressed preferences of-- 7i7 in the case of an applicable entity that is a covered entity1 each individual whose personal data is collected or processed by the covered entity 7excluding any personal data with respect to which the covered entity is a third party72 and 7ii7 in the case of an applicable entity that is a service provider1 each covered entity to which the entity provides services4 7#b7 ,considerations ,in implementing a comprehensive privacy program under paragraph 7#a71 each applicable entity shall-- 7,a7 take into consideration1 as applicable given the entity's role as a covered entity or service provider-- 7i7 the relevant risks to the privacy and security of personal data against which the applicable entity must guard in meeting the expectations of individuals2 7ii7 the requirements under this ,act2 7iii7 the size and complexity of the applicable entity2 and 7iv7 the sensitivity and volume of the personal data that the applicable entity processes2 and 7,b7 address the findings and implement the recommendations contained in privacy impact assessments that the applicable entity carries out under subsection 7c74 #h4 ,rules relating to service providers 7a7 ,obligations of covered entities with respect to service providers 7#a7 ,in general ,a covered entity shall only disclose personal data to a service provider pursuant to a contract that is binding on both parties and meets the requirements of subsection 7b74 7#b7 ,due diligence 7,a7 ,in general ,any covered entity that discloses personal data to a service provider shall-- 7i7 take reasonable steps to identify whether the service provider has established appropriate procedures and controls for ensuring the privacy and security of the personal data in a manner that complies with the requirements of this ,act1 including through reasonable representations made to the covered entity by the service provider in the contract governing the disclosure of personal data to the service provider2 and 7ii7 investigate any circumstances for which a reasonable person would determine that there is a high probability that the service provider is not in compliance with a requirement of this ,act1 and1 if necessary based on the findings of such investigation1 take reasonable steps to protect the privacy and security of any personal data disclosed by the covered entity to the service provider that is at risk as a result of the service provider's noncompliance with a requirement of this ,act4 7,b7 ,considerations ,in determining whether a covered entity has acted reasonably in complying with clause 7i7 or 7ii7 of subparagraph 7,a71 the ,commission shall take into account-- 7i7 the size1 complexity1 and resources of the covered entity and whether the covered entity is a small business2 and 7ii7 the risk of harm reasonably expected to occur as a result of the covered entity disclosing personal data to a service provider without complying with such clause4 7b7 ,contractual requirements 7#a7 ,in general ,a contract between a covered entity and a service provider governing the disclosure of personal data by the covered entity to the service provider shall-- 7,a7 require the service provider to only collect or process the personal data as directed by the covered entity2 7,b7 establish the purposes for1 and means of1 the collecting or processing of the personal data by the service provider1 including instructions1 policies1 and practices1 as applicable1 with which the service provider is required to comply2 and 7,c7 include a reasonable representation by the service provider indicating that the service provider has established appropriate procedures and controls to comply with the requirements of this ,act4 7#b7 ,limitation ,no contract governing the disclosure of personal data by a covered entity to a service provider shall relieve a covered entity or service provider of any requirement or obligation with respect to such personal data that is imposed on the covered entity or service provider1 as applicable1 by this ,act4 7c7 ,service provider obligations 7#a7 ,notice of processing of personal data to comply with legal requirement ,in the event that a service provider is required to process personal data in order to comply with a legal requirement1 including a subpoena1 summons1 or other properly executed compulsory process1 the service provider shall inform the covered entity from which it received the personal data involved of such legal requirement before such processing1 unless the service provider is otherwise prohibited by law from providing such notification4 7#b7 ,notice of change to policies or practices ,if a service provider amends its policies or practices relating to personal data in a manner that is relevant to compliance with any provision of this ,act1 the service provider shall provide reasonable notice in advance of such change to any covered entity on whose behalf the service provider collects or processes personal data4 7#c7 ,responsibilities 7,a7 ,individual control requests ,a service provider that collects or processes personal data on behalf of a covered entity shall1 to the extent possible1 either-- 7i7 provide the covered entity with appropriate technical and organizational measures to enable the covered entity to comply with requests to exercise rights described in section #e with respect to any such personal data that is held by1 and reasonably accessible to1 the service provider2 or 7ii7 respond to any request made by the covered entity for assistance in complying with a request to exercise such a right with respect to such personal data that the covered entity has verified as described in section #e7;f7 and has determined must be complied with under this ,act by1 as appropriate-- 7,i7 in the case of a request described in subsection 7b7 of section #e1 providing the covered entity with access to any relevant personal data held by1 and reasonably available to1 the service provider2 7,,ii7 in the case of a request described in subsection 7c7 of such section1 by correcting any relevant personal data held by1 and reasonably accessible to1 the service provider1 and providing the covered entity with notice of such correction2 7,,iii7 in the case of a request described in subsection 7d7 of such section1 by deleting1 de-identifying1 or returning to the covered entity any relevant personal data held by1 and reasonably accessible to1 the service provider1 and providing the covered entity with notice of such action2 or 7,,iv7 informing the covered entity that-- 7aa7 the service provider does not hold any personal data related to the request2 7bb7 the service provider cannot reasonably access any personal data related to the request2 or 7cc7 complying with the request would be inconsistent with a legal requirement to which the service provider is subject4 7,b7 ,deletion of data upon completion of service ,except as otherwise required by law1 as soon as practicable after the completion of the service or function for which a service provider collected or processed personal data on behalf of a covered entity1 the service provider shall delete1 de-identify1 or return to the covered entity all such personal data4 7,c7 ,assurance of compliance 7i7 ,in general ,subject to clause 7ii71 a service provider shall make available to a covered entity on whose behalf the service provider collects or processes personal data information necessary to demonstrate the service provider's compliance with subparagraph 7,a74 7ii7 ,written representation of compliance ,if the information described in clause 7i7 is not technically available to a service provider1 the service provider may comply with clause 7i7 by providing the covered entity with a written representation stating that the service provider is in compliance with subparagraph 7,a74 7#d7 ,subcontractor requirements ,a service provider that is collecting or processing personal data on behalf of a covered entity shall not employ a subcontractor to carry out or assist in such collection or processing unless-- 7,a7 the service provider has provided the covered entity with an opportunity to object to the use of such subcontractor2 and 7,b7 the subcontractor is subject 7pursuant to an agreement between the service provider and the subcontractor7 to the same requirements and obligations as the service provider with respect to the collection and processing of the personal data4 7#e7 ,considerations ,in determining whether a service provider has acted reasonably in complying with this subsection1 the ,commission shall take into account-- 7,a7 the size1 complexity1 and resources of the service provider and whether the service provider is a small business2 and 7,b7 the risk of harm reasonably expected to occur as a result of the service provider not complying with this subsection4 #i4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as an unfair or deceptive act or practice in violation of a rule promulgated under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,except as provided in subparagraph 7,c71 the ,commission shall enforce this ,act and any regulation promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any covered entity or service provider who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,common carriers and nonprofit organizations ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act1 with respect to common carriers and nonprofit organizations described in section #b7d7 of this ,act1 in the same manner provided in subparagraphs 7,a7 and 7,b7 of this paragraph4 7,d7 ,authority preserved ,nothing in this ,act shall be construed to limit the ,commission's authority under the ,federal ,trade ,commission ,act or any other provision of law4 7#c7 ,civil penalties 7,a7 ,in general ,notwithstanding section #e7m7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m771 in an action brought by the ,commission to enforce this ,act and the regulations promulgated under this ,act1 in addition to any injunctive relief obtained by the ,commission in the action1 a covered entity or service provider shall be liable for a civil penalty in an amount described in subparagraph 7,b7 if the covered entity or service provider1 with actual knowledge1 violates this ,act or a regulation promulgated under this ,act4 7,b7 ,amount 7i7 ,calculation ,except as provided in clause 7ii71 the amount of a civil penalty described in subparagraph 7,a7 shall be the number of individuals affected by a violation described in that subparagraph multiplied by an amount not to exceed #db1ecj4 7ii7 ,considerations ,in determining the amount of a civil penalty to seek under subparagraph 7,a7 for a violation described in that subparagraph1 the ,commission shall consider1 with respect to the covered entity or service provider that committed the violation-- 7,i7 the degree of harm associated with the privacy and security of personal data of individuals created by the violation2 7,,ii7 the intent of the covered entity or service provider in committing the violation2 7,,iii7 the size1 complexity1 and resources of the covered entity or service provider1 including if it is a small business2 7,,iv7 reasonable expectations relating to privacy and security of personal data of individuals2 7,v7 the degree to which the covered entity or service provider put in place appropriate controls or complied with the requirements of section #g1 if applicable2 7,,vi7 whether the covered entity or service provider self-reported the violation to the ,commission2 and 7,,vii7 what1 if any1 efforts the covered entity or service provider has taken to mitigate any risk to the privacy and security of personal data of individuals created by the processing4 7b7 ,enforcement by ,state attorneys general 7#a7 ,civil action ,in any case in which an attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any covered entity or service provider in a practice that violates this ,act or a regulation promulgated under this ,act1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to-- 7,a7 enjoin that practice2 7,b7 enforce compliance with this ,act or the regulation2 or 7,c7 in the case of a violation described in subsection 7a77#c77;,a71 impose a civil penalty in an amount described in subsection 7a77#c77;,b74 7#b7 ,rights of the ,commission 7,a7 ,notice to ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 not later than #aj days before initiating the civil action4 7ii7 ,contents ,the notification required by clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by the ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening under clause 7i7-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,consolidation of actions brought by two or more ,state attorneys general 7,a7 ,in general ,subject to subparagraph 7,b71 if a civil action under paragraph 7#a7 is pending in a district court of the ,united ,states and one or more civil actions are commenced pursuant to paragraph 7#a7 in a different district court of the ,united ,states that involve one or more common questions of fact1 all such civil actions shall be transferred for the purposes of consolidated pretrial proceedings and trial to the ,united ,states ,district ,court for the ,district of ,columbia4 7,b7 ,exception ,a civil action shall not be transferred pursuant to subparagraph 7,a7 if pretrial proceedings in such civil action have concluded before the subsequent action is commenced pursuant to paragraph 7#a74 7c7 ,limitation on ,state action while ,federal action is pending ,if the ,commission institutes an action under subsection 7a7 with respect to a violation of this ,act or a regulation promulgated under this ,act1 a ,state may not1 during the pendency of that action1 institute an action under subsection 7b7 against any defendant named in the complaint in the action instituted by the ,commission based on the same set of facts giving rise to the violation with respect to which the ,commission instituted the action4 7d7 ,no private right of action ,there shall be no private right of action under this ,act and nothing in this ,act may be construed to provide a basis for a private right of action4 #aj4 ,relation to other laws 7a7 ,congressional intent ,to preempt ,state privacy and security law ,it is the express intention of ,congress to promote consistency in consumer expectations1 competitive parity1 and innovation through the establishment of a uniform ,federal privacy framework that preempts1 and occupies the field with respect to1 the authority of any ,state or political subdivision of a ,state over the conduct or activities of covered entities covered by this ,act 7or under a law enumerated in subsection 7c77 relating to the privacy or security of personal data1 including consumer controls relating to personal data such as rights to access1 correction1 and deletion4 7b7 ,express preemption of ,state law 7#a7 ,in general ,except as provided in paragraph 7#b71 this ,act shall supersede any provision of a law1 rule1 regulation1 or other requirement of any ,state or political subdivision of a ,state to the extent that such provision relates to the privacy or security of personal data4 7#b7 ,preservation of ,state and local laws ,the provisions of this ,act shall not be construed to preempt or supersede the applicability of any of the following laws of a ,state or political subdivision of a ,state to the extent that such law is not inconsistent with this ,act3 7,a7 ,laws that address notification requirements in the event of a data breach4 7,b7 ,rules of criminal or civil procedure4 7,c7 ,laws that relate to the general standards of fraud or public safety4 7,d7 ,laws that address the privacy of any group of students 7as defined in section #ddd7;a7 of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7a77 7commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd774 7,e7 ,laws that address financial information held by financial institutions 7as defined in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji774 7,f7 ,laws that address protected health information held by covered entities and business associates 7as such terms are defined for purposes of regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note774 7,g7 ,laws governing employment and employment-related data including data collected or used by an employer pursuant to an employer-employee relationship4 7,h7 ,laws protecting the right of individuals to be free of discrimination based on race1 sex1 national origin1 or other suspect classification identified under ,state law4 7c7 ,relation to other ,federal laws 7#a7 ,in general ,except as otherwise provided in paragraphs 7#b7 and 7#d71 this ,act shall supersede any other ,federal statute or regulation relating to the privacy or security of personal data4 7#b7 ,savings provision ,this ,act shall not be construed to modify1 limit1 or supersede the operation of any of the following laws3 7,a7 ,the ,children's ,online ,privacy ,protection ,act 7#ae ,u4,s4,c4 #feja et seq474 7,b7 ,the ,communications ,assistance for ,law ,enforcement ,act 7#dg ,u4,s4,c4 #ajja et seq474 7,c7 ,section #bbg of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbg74 7,d7 ,title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7,e7 ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq474 7,f7 ,the ,health ,insurance ,portability and ,accountability ,act 7,public ,law #ajd-aia74 7,g7 ,the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq474 7,h7 ,section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd74 7,i7 ,the ,electronic ,communications ,privacy ,act 7#ah ,u4,s4,c4 #beaj et seq474 7,j7 ,the ,driver's ,privacy ,protection ,act of #aiid 7#ah ,u4,s4,c4 #bgba et seq474 7,k7 ,the ,federal ,aviation ,act of #aieh 7#di ,u4,s4,c4 ,app4 #acja et seq474 7#c7 ,deemed compliance ,a covered entity that is required to comply with a law specified in paragraph 7#b7 and is in compliance with the data collection1 processing1 or security requirements of such law shall be deemed to be in compliance with the requirements of this ,act with respect to personal data covered by such law4 7#d7 ,nonapplication of ,,fcc laws and regulations to covered entities ,notwithstanding any other provision of law1 neither any provision of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto nor any regulation promulgated by the ,federal ,communications ,commission under such ,acts shall apply to any covered entity with respect to the collection1 use1 processing1 transferring1 or security of personal data1 except to the extent that such provision or regulation pertains solely to #iaa lines or any other emergency line of a hospital1 medical provider or service office1 health care facility1 poison control center1 fire protection agency1 or law enforcement agency4 #aa4 ,commission resources 7a7 ,appointment of attorneys1 technologists1 and support personnel ,notwithstanding any other provision of law1 the ,chair of the ,commission shall appoint no fewer than #ddj additional individuals to serve as personnel to enforce this ,act and other laws relating to privacy and data security that the ,commission is authorized to enforce4 7b7 ,assessment of ,commission resources ,not later than #a year after the date of enactment of this ,act1 the ,commission shall submit to ,congress a report that includes-- 7#a7 an assessment of the resources1 including personnel1 available to the ,commission to carry out this ,act2 and 7#b7 a description of any resources1 including personnel-- 7,a7 that are not available to the ,commission2 and 7,b7 that the ,commission requires to effectively carry out this ,act4 7c7 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission such sums as may be necessary to carry out this section4 #ab4 ,guidance and reporting 7a7 ,international coordination and cooperation 7#a7 ,in general ,if necessary1 the ,commission shall coordinate any enforcement action by the ,commission under this ,act with any relevant data protection authority established by a foreign country or any similar office of a foreign country in a manner consistent with subsections 7j7 and 7k7 of section #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #df74 7#b7 ,international interoperability ,the ,secretary of ,commerce1 in consultation with the ,commission and the heads of other relevant ,federal agencies1 shall-- 7,a7 identify laws of foreign countries or regions that relate to the processing of personal data for commercial purposes2 7,b7 engage with relevant officials of foreign countries or regions that have implemented laws described in subparagraph 7,a7 in order to identify requirements under those laws that could disrupt cross-border transfers of personal data2 7,c7 develop mechanisms and recommendations to prevent disruptions described in subparagraph 7,b72 and 7,d7 not later than #a year after the date of enactment of this ,act1 and once a year each year thereafter for #e years1 submit to ,congress a report on the progress of efforts made under this section4 7b7 ,reports to ,congress ,not later than #ahj days after the date of enactment of this ,act1 and not less frequently than annually thereafter1 the ,commission shall submit to ,congress1 and make available on a public website1 a report that contains information relating to-- 7#a7 the effectiveness of this ,act and regulations promulgated under this ,act2 7#b7 compliance with the provisions of this ,act and regulations promulgated under this ,act2 7#c7 violations of the provisions of this ,act and regulations promulgated under this ,act2 7#d7 enforcement actions by the ,commission and ,state attorneys general for violations of the provisions of this ,act and regulations promulgated under this ,act2 7#e7 priorities of the ,commission in enforcing the provisions of this ,act and regulations promulgated under this ,act2 and 7#f7 resources needed by the ,commission to fully implement and enforce the provisions of this ,act and regulations promulgated under this ,act4 7c7 ,study and report by the ,government ,accountability ,office ,not later than #c years after the date of enactment of this ,act1 and once every #c years thereafter1 the ,comptroller ,general of the ,united ,states shall submit to the ,president and ,congress a report that surveys ,federal data privacy and security laws in order to-- 7#a7 identify any inconsistency between the requirements under this ,act and the requirements under any law related to the privacy and security of personal data2 7#b7 review the impact of the provisions of this ,act on small businesses and provide recommendations1 if necessary1 to improve compliance and enforcement2 7#c7 provide recommendations on amending ,federal data privacy and security laws in light of changing technological and economic trends2 and 7#d7 detail the ,federal data privacy and security enforcement activities carried out by the ,commission and other ,federal agencies4 #ac4 ,severability ,if any provision of this ,act or the application of such provision to any person or circumstance is held to be unconstitutional1 the remainder of this ,act1 and the application of the provision to any other person or circumstance1 shall not be affected4 #ad4 ,effective date ,this ,act shall take effect on the date that is #a year after the date of enactment of this ,act1 except that section #aj shall take effect upon the date of enactment of this ,act4