,,ii  #aaf? ,,congress  #b;d ,session   
,s4 #cdef  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,m>* #ab1 #bjbj,mr4    
,moran introduc$ ! foll[+ bill2 :i* 0   
read twice & ref]r$ to ! ,committee on  
,comm]ce1 ,sci5ce1 & ,transportation  ,a
 ,,bill  ,to protect ! privacy (        
consum]s4  #a4 ,%ort title2 table (     
cont5ts  7a7 ,%ort title ,?is ,act may  
be cit$ z ! ,consum] ,data ,privacy &   
,security ,act ( #bjbj4  7b7 ,table (   
cont5ts ,! table ( cont5ts ( ?is ,act is
 z foll[s3 ,sec4 #a4 ,%ort title2 table 
( cont5ts4,sec4 #b4 ,def9itions4,sec4   
#c4 ,collection & process+ ( p]sonal    
data4,sec4 #d4 ,"r to "k4,sec4 #e4      
,individual control4,sec4 #f4           
,security4,sec4 #g4 ,acc\ntability4,sec4
 #h4 ,rules relat+ to s]vice            
provid]s4,sec4 #i4 ,en=cem5t4,sec4 #aj4 
,relation to o!r laws4,sec4 #aa4        
,commission res\rces4,sec4 #ab4         
,guidance & report+4,sec4 #ac4          
,sev]ability4,sec4 #ad4 ,effective date4
  #b4 ,def9itions ,9 ?is ,act3 7#a7     

,biometric in=mation ,! t]m biometric   
in=mation means in=mation1 result+ f    
specific te*nical process+ relat$ to !  
physical1 biological1 physiological1    
g5etic1 or behavioral *>act]i/ics ( an  
individual1 t id5tifies ! individual4   
7#b7 ,collection ,! t]m collection means
 acquir+ p]sonal data by any means1     
includ+ by receiv+1 pur*as+1 or leas+ ! 
data or by obs]v+ or int]act+ ) !       
individual to :om ! data relates4  7#c7 
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#d7 ,cov]$ 
entity  7,a7 ,9 g5]al ,! t]m cov]$      
entity means any entity t-- 7i7 alone1  
or jo9tly ) o!rs1 det]m9es ! purpose &  
means ( collect+ or process+ p]sonal    
data2 &  7ii7 is-- 7,i7 a p]son ov] :i* 
! ,commission has au?ority pursuant to  
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b772  7,,ii7 a common c>ri]    
subject to ! ,communications ,act (     
#aicd 7#dg ,u4,s4,c4 #aea et seq47 &    
,acts am5datory !re( & supplem5t>y      

!reto2 or  7,,iii7 a nonpr(it           
organization1 includ+ any organization t
 is n organiz$ to c>ry on bus9ess = its 
own pr(it or t ( its memb]s4  7,b7      
,limitation ,an entity %all n be        
consid]$ to be a cov]$ entity ) respect 
to p]sonal data to ! ext5t t ! entity is
 a s]vice provid] ) respect to su* data4
  7#e7 ,de-id5tify ,! t]m de-id5tify    
means1 ) respect to p]sonal data held by
 a cov]$ entity or s]vice provid]1 t !  
cov]$ entity or s]vice provid]-- 7,a7   
alt]s1 anonymizes1 or aggregates ! data 
s t !re is a reasonable basis = expect+ 
t ! data c\ld n be l9k$ 7includ+ by !   
entity or s]vice provid]7 z a practical 
matt] to a specific individual2  7,b7   
publicly commits to refra9 f attempt+ to
 re-id5tify ! data ) a specific         
individual1 & adopts controls to prev5t 
su* id5tification2 &  7,c7 causes ! data
 to be cov]$ by a contractual or o!r    
legally en=ceable prohibition on ea*    
entity to :i* ! cov]$ entity or s]vice  
provid] discloses ! data f attempt+ to  

use ! data to id5tify a specific        
individual & requires ! same ( all onw>d
 disclosures4  7#f7 ,delete ,! t]m      
delete means to remove or de/roy        
in=mation su* t ! in=mation is n able to
 be retriev$ 9 ! ord9>y c\rse ( bus9ess4
  7#g7 ,individual ,! t]m individual    
means a natural p]son resid+ 9 ! ,unit$ 
,/ates4  7#h7 ,mat]ial *ange ,! t]m     
mat]ial *ange means a *ange to a policy 
or practice ( a cov]$ entity or s]vice  
provid] t-- 7,a7 relates to ! collection
 or process+ ( p]sonal data by ! cov]$  
entity or s]vice provid]2  7,b7 is      
likely to affect ! conduct or decision (
 a reasonable individual ) respect to   
any p]sonal data ( ! individual t is    
subject to su* policy or practice2 &    
7,c7 9 ! case ( a s]vice provid]1 is    
made at ! direction ( ! cov]$ entity on 
^: behalf ! s]vice provid] is p]=m+ a   
s]vice or function4  7#i7 ,p]sonal data 
7,a7 ,9 g5]al ,! t]m p]sonal data means 
in=mation t id5tifies or is l9k$ or     
reasonably l9kable to a specific        

individual4  7,b7 ,l9k$ or reasonably   
l9kable  7i7 ,9 g5]al ,= purposes (     
subp>agraph 7,a71 in=mation held by a   
cov]$ entity or s]vice provid] is l9k$  
or reasonably l9kable to a specific     
individual if x c be us$ on its own or 9
 comb9ation ) o!r in=mation held by1 or 
readily accessible to1 ! cov]$ entity or
 s]vice provid] to id5tify ! individual4
  7ii7 ,application to device-level     
id5tifi]s ,a p]si/5t id5tifi] t is us$  
to id5tify a specific individual ov] "t 
& across s]vices & plat=ms1 includ+ a   
cu/om] numb] held 9 a cookie1 a /atic   
,int]net ,protocol 7,,ip7 address1 a    
processor or device s]ial numb]1 or     
ano!r unique device id5tifi]1 %all be   
consid]$ in=mation t is l9k$ or         
reasonably l9kable to ! individual =    
purposes ( subp>agraph 7,a74  7,c7      
,exclusion ,! t]m p]sonal data does n   
include-- 7i7 de-id5tifi$ data2  7ii7   
data t has be5 r5d]$ unreadable or      
indeciph]able2  7iii7 in=mation ab\t    
employees or employm5t /atus collect$ or

 us$ by an employ] pursuant to an       
employ]-employee relation%ip1 includ+   
in=mation relat$ to prospective         
employees & relevant application        
mat]ials2  7iv7 publicly available      
in=mation2  7v7 data t has und]gone     
pseudnymization2 or  7vi7 employee data4
  7,d7 ,employee data ,= purposes (     
subp>agraph 7,c71 ! t]m employee data   
means in=mation collect$ by a cov]$     
entity or ! s]vice provid] ( a cov]$    
entity t is-- 7i7 contact in=mation = an
 individual or ! individual's em]g5cy   
contact t is collect$ 9 ! c\rse ( !     
individual's employm5t or application = 
employm5t 7includ+ on a contract or     
tempor>y basis7 ) ! cov]$ entity1       
provid$ t su* in=mation is reta9$ or    
process$ by ! cov]$ entity or s]vice    
provid] solely = purposes relat$ to !   
individual's employm5t or application = 
employm5t ) ! cov]$ entity2 or  7ii7    
in=mation ab\t an individual :o is an   
employee or =m] employee ( ! cov]$      
entity 7or a relative ( su* an          

individual7 t is necess>y to adm9i/]    
b5efits to :i* su* individual or        
relative is entitl$ on ! basis ( !      
individual's employm5t ) ! cov]$ entity1
 provid$ t su* data is reta9$ or        
process$ by ! cov]$ entity or s]vice    
provid] solely = ! purpose ( adm9i/]+   
su* b5efits4  7#aj7 ,pseudonymization ,!
 t]m pseudnymization means ! process+ ( 
p]sonal data s t ! p]sonal data c no    
long] be attribut$ or reasonably l9k$ to
 a specific individual )\t ! use (      
additional in=mation1 provid$ t su*     
additional in=mation-- 7,a7 is kept     
sep>ately2 &  7,b7 is subject to        
te*nical & organizational measures to   
ensure t ! p]sonal data is n attribut$  
to a specific individual4  7#aa7        
,privacy (fic] ,! t]m privacy (fic]     
means an individual designat$ by a cov]$
 entity or s]vice provid] "u section    
#g7;b77#a7 to be ! privacy (fic] ( !    
cov]$ entity4  7#ab7 ,process+ ,! t]m   
process+ means any op]ation or set (    
op]ations p]=m$ on p]sonal data1 includ+

 ! analysis1 organization1 /ructur+1    
reta9+1 us+1 disclos+1 transmitt+1 %>+1 
transf]r+1 sell+1 lic5s+1 or o!rwise    
h&l+ ( p]sonal data4  7#ac7 ,publicly   
available in=mation  7,a7 ,9 g5]al ,!   
t]m publicly available in=mation means  
any in=mation t a cov]$ entity or s]vice
 provid] has a reasonable basis to      
believe is lawfully made available to ! 
g5]al public f-- 7i7 a ,f$]al1 ,/ate1 or
 local gov]nm5t record2  7ii7 widely    
di/ribut$ m$ia2 or  7iii7 a disclosure  
to ! g5]al public t is made volunt>ily  
by an individual1 or requir$ to be made 
by a ,f$]al1 ,/ate1 or local law4  7,b7 
,reasonable basis to believe ,= purposes
 ( subp>agraph 7,a71 reasonable bases = 
believ+ t in=mation is lawfully made    
available to ! g5]al public %all include
 a writt5 det]m9ation by a cov]$ entity 
or s]vice provid] t ! in=mation is ( a  
type t is lawfully made available to !  
g5]al public4  7#ad7 ,s5sitive p]sonal  
data ,! t]m s5sitive p]sonal data means 
p]sonal data t is-- 7,a7 a unique1      

gov]nm5t-issu$ id5tifi]1 su* z a social 
security numb]1 passport numb]1 driv]'s 
lic5se numb]1 or taxpay] id5tification  
numb]2  7,b7 a us] "n or email address 9
 comb9ation ) a password or security "q 
& answ] t w\ld p]mit access to an onl9e 
acc\nt2  7,c7 biometric in=mation ( an  
individual2  7,d7 ! cont5t ( a wire     
communication1 oral communication1 or   
electronic communication1 z ^? t]ms are 
def9$ 9 section #beaj ( title #ah1      
,unit$ ,/ates ,code1 to :i* ! individual
 is a p>ty1 unless ! cov]$ entity is !  
int5d$ recipi5t ( ! communication2  7,e7
 in=mation t relates to-- 7i7 ! pa/1    
pres5t1 or future diagnos$ physical or  
m5tal heal? or condition ( an           
individual2  7ii7 ! provision ( heal?   
c>e to an individual2 or  7iii7 ! pa/1  
pres5t1 or future paym5t = ! provision (
 heal? c>e to an individual2  7,f7 a    
f9ancial acc\nt numb]1 debit c>d numb]1 
cr$it c>d numb]1 if comb9$ ) an access  
code1 password1 or cr$5tials t provide  
access to su* an acc\nt2  7,g7 ! race or

 e?nicity ( ! individual2  7,h7 !       
religi\s beliefs or affiliation ( !     
individual2  7,i7 ! sexual ori5tation ( 
! individual2  7,j7 ! precise           
geolocation ( an individual t is        
te*nically d]iv$ & t is capable (       
det]m9+ ) reasonable specificity ! pa/  
or pres5t actual physical location ( !  
individual m precisely ?an a zip code1  
/reet1 or t[n or city level2 or  7,k7   
su* o!r specific categories ( p]sonal   
data z ! ,commission may def9e by rule  
issu$ 9 accordance ) section #eec (     
title #e1 ,unit$ ,/ates ,code1 !        
collection or process+ ( :i* c\ld lead  
to reasonably =eseeable h>m to an       
individual4  7#ae7 ,s]vice provid] ,!   
t]m s]vice provid] means an entity t    
collects or processes p]sonal data on   
behalf (1 & at ! direction (1 a cov]$   
entity to :i* ! s]vice provid] is       
unaffiliat$1 b only-- 7,a7 ) respect to 
! p]sonal data collect$ or process$ on !
 behalf (1 & at ! direction (1 su* cov]$
 entity2 &  7,b7 to ! ext5t t !         

collection or process+-- 7i7 is on !    
behalf (1 & at ! direction (1 su* cov]$ 
entity2 or  7ii7 is p]mitt$ "u section  
#c7;c74  7#af7 ,small bus9ess ,! t]m    
small bus9ess means any cov]$ entity or 
s]vice provid] t-- 7,a7 = ! mo/ rec5t   
#f-mon? p]iod-- 7i7 employs n m ?an #ejj
 employees2 &  7ii7 ma9ta9s less ?an    
#ej1jjj1jjj 9 av]age gross receipts = ! 
previ\s #c ye>s2 &  7,b7 collects or    
processes on an annual basis-- 7i7 !    
p]sonal data ( few] ?an #a1jjj1jjj      
individuals2 or  7ii7 ! s5sitive p]sonal
 data ( few] ?an #ajj1jjj individuals4  
7#ag7 ,?ird p>ty  7,a7 ,9 g5]al ,! t]m  
?ird p>ty means a cov]$ entity t        
receives ?ird p>ty p]sonal data f an    
unaffiliat$ cov]$ entity1 b only )      
respect to su* ?ird p>ty p]sonal data4  
7,b7 ,?ird p>ty p]sonal data ,= purposes
 ( subp>agraph 7,a71 ! t]m ?ird p>ty    
p]sonal data means p]sonal data t a     
cov]$ entity discloses to ano!r         
unaffiliat$ cov]$ entity & su*          
disclosure-- 7i7 is n direct$ by !      

individual to :om ! p]sonal data        
relates2 &  7ii7 is n necess>y to       
complete a transaction or fulfill a     
reque/ made by ! individual to :om su*  
data relates4  7#ah7 ,unaffiliat$ ,! t]m
 unaffiliat$ means1 ) respect to two or 
m entities1 t ! entities d n %>e        
int]relat$ op]ations1 common managem5t1 
c5traliz$ control ( labor relations1 or 
common own]%ip or f9ancial control4  #c4
 ,collection & process+ ( p]sonal data  
7a7 ,requirem5ts  7#a7 ,9 g5]al ,except 
z provid$ 9 p>agraphs 7#b7 & 7#c71 a    
cov]$ entity %all n collect or process  
p]sonal data ( an individual unless--   
7,a7 ! individual has cons5t$ explicitly
 or implicitly to su* collection or     
process+ = a specific purpose1 9        
accordance ) subsection 7b72 or  7,b7 ! 
cov]$ entity collects or processes !    
p]sonal data 9 accordance ) a p]missible
 purpose describ$ 9 subsection 7c74     
7#b7 ,application to ?ird p>ties  7,a7  
,9 g5]al ,a cov]$ entity t is a ?ird    
p>ty ) respect to ! p]sonal data ( an   

individual may collect or process su*   
p]sonal data )\t directly obta9+ !      
individual's cons5t z requir$ "u        
p>agraph 7#a77;,a7 if-- 7i7 ! cov]$     
entity f :om ! ?ird p>ty receiv$ !      
p]sonal data ( ! individual involv$--   
7,i7 has provid$ ! individual ) notice  
(-- 7aa7 ! fact t ! cov]$ entity w\ld   
disclose ! individual's p]sonal data to 
! ?ird p>ty2 &  7bb7 ! purposes = :i* ! 
?ird p>ty w collect or process ! p]sonal
 data ( ! individual2 &  7,,ii7 !       
individual has cons5t$ to su* disclosure
 & su* collection or process+ ( !       
individual's p]sonal data2 or  7ii7 !   
?ird p>ty collects or process ! p]sonal 
data 9 accordance ) a p]missible purpose
 describ$ 9 subsection 7c74  7,b7       
,notice & cons5t requirem5t = diff]5t or
 additional collection or process+ ,a   
cov]$ entity t is a ?ird p>ty ) respect 
to ! p]sonal data ( an individual %all  
obta9 ! cons5t ( su* individual 9       
accordance ) subsection 7b7 be=e        
collect+ or process+ su* p]sonal data if

 ! specific purpose = su* collection or 
process+-- 7i7 is n a purpose describ$ 9
 p>agraph 7#a71 7#b71 7#d71 or 7#f7 (   
subsection 7c72 &  7ii7 is diff]5t f1 or
 9 addition to1 ! purpose = any         
collection or process+ to :i* !         
individual previ\sly cons5t$ 9          
accordance ) subsection 7b74  7,c7 ,duty
 to ex]cise reasonable due dilig5ce     
prior to reliance on cov]$ entity       
repres5tations ,= purposes ( subp>agraph
 7,a71 a cov]$ entity t is a ?ird p>ty )
 respect to ! p]sonal data ( an         
individual may reasonably rely on       
repres5tations made by ! cov]$ entity f 
:om ! ?ird p>ty receiv$ su* data reg>d+ 
! notice provid$ to1 & ! cons5t obta9$  
f1 su* individual1 provid$ t ! ?ird p>ty
 has det]m9$1 aft] ex]cis+ reasonable   
due dilig5ce1 t ! cov]$ entity is       
cr$ible4  7#c7 ,notice & cons5t obta9$  
by s]vice provid]s ,a s]vice provid] may
 provide notice to1 & obta9 cons5t f1 an
 individual 9 accordance ) subsection   
7b7 on behalf ( a cov]$ entity4  7b7    

,cons5t  7#a7 ,9 g5]al  7,a7 ,implicit  
cons5t ,except z provid$ 9 subp>agraph  
7,b71 an individual %all be deem$ to h  
cons5t$ to a reque/ to collect or       
process ! individual's p]sonal data if !
 individual fails to decl9e ! reque/    
aft] be+ provid$ ) ! notice describ$ 9  
p>agraph 7#b7 & a reasonable am\nt ( "t 
to respond to ! reque/4  7,b7 ,express  
affirmative cons5t requirem5t  7i7 ,9   
g5]al ,! express affirmative cons5t ( an
 individual is requir$ to collect or    
process ! p]sonal data ( ! individual if
 ! collection or process+-- 7,i7        
involves s5sitive p]sonal data ( !      
individual2 or  7,,ii7 involves !       
disclosure ( p]sonal data to a ?ird p>ty
 = a purpose t is n describ$ 9          
subsection 7c74  7ii7 ,requirem5ts =    
valid express affirmative cons5t ,=     
purposes ( clause 7i71 ! express        
affirmative cons5t ( an individual to a 
reque/ to collect or process ! p]sonal  
data ( ! individual-- 7,i7 %all be      
cle>ly1 prom95tly1 & unmi/akably /at$2  

7,,ii7 %all be provid$ 9 response to a  
reque/ t includes ! notice describ$ 9   
p>agraph 7#b72 &  7,,iii7 _c be inf]r$ f
 inaction4  7#b7 ,notice requir$  7,a7  
,9 g5]al ,9 reque/+ ! cons5t ( an       
individual to collect or process !      
individual's p]sonal data1 a cov]$      
entity %all provide ! individual )      
notice1 9 a concise1 mean+ful1 timely1  
prom95t1 & easy-to-und]/& =mat1 t       
includes-- 7i7 ! types ( p]sonal data   
collect$ & process$2  7ii7 a description
 ( ! purposes = :i* ! cov]$ entity seeks
 to collect or process t individual's   
p]sonal data2 &  7iii7 ! in=mation      
describ$ 9 subp>agraph 7,b74  7,b7      
,cont5ts ,! notice provid$ by a cov]$   
entity "u subp>agraph 7,a7 %all         
include-- 7i7 in=mation on h[ !         
individual may access ! privacy policy (
 ! cov]$ entity describ$ 9 section      
#d7;a72  7ii7 in=mation on h[ !         
individual may ex]cise ! rights provid$ 
= "u ?is ,act2 &  7iii7 notice ( :e!r ! 
collection or process+ by ! cov]$       

entity-- 7,i7 includes ! disclosure (   
p]sonal data to ?ird p>ties2 or  7,,ii7 
involves s5sitive p]sonal data4  7,c7   
,sep>ation ,if cons5t is obta9$ 9 !     
context ( a notice t also conc]ns matt]s
 o!r ?an ! collection or process+ (     
p]sonal data1 ! reque/ = cons5t %all be 
pres5t$ 9 a mann] t is cle>ly           
di/+ui%able f ! o!r matt]s4  7#c7       
,)drawal ( cons5t  7,a7 ,9 g5]al ,a     
cov]$ entity %all provide an individual 
) ! means to )draw previ\sly giv5 cons5t
 to collect or process ! p]sonal data ( 
! individual-- 7i7 at any "t & place t  
is reasonably practicable2 &  7ii7 9 a  
mann] t is z accessible z reasonably    
practicable4  7,b7 ,effect ,a )drawal   
made "u subp>agraph 7,a7-- 7i7 %all take
 effect )\t undue delay2  7ii7 %all     
rema9 9 effect until ! individual       
revokes or limits t d5ial or )drawal2 & 
7iii7 %all n apply to any collection or 
process+ ( p]sonal data t occurr$ be=e !
 date on :i* ! )drawal is made4  7c7    
,p]missible purposes ,a cov]$ entity or 

s]vice provid] may collect or process ! 
p]sonal data ( an individual )\t cons5t 
to ! ext5t t su* collection or process+ 
is reasonably necess>y & limit$ to !    
foll[+ purposes 7except t a cov]$ entity
 t is a ?ird p>ty ) respect to p]sonal  
data may n collect or process su* data  
)\t cons5t = ! purposes describ$ 9      
p>agraphs 7#c71 7#e71 & 7#f773 7#a7     
,provision ( s]vice or p]=mance ( a     
contract ,to-- 7,a7 provide a s]vice1   
p]=m a contract1 or conduct a           
transaction t ! individual has initiat$2
 or  7,b7 take /eps 9 fur!rance ( !     
reque/ initiat$ by ! individual prior to
 provid+ ! s]vice or ent]+ into a       
contract or transaction4  7#b7          
,compliance ) laws ,to comply ) a       
,f$]al1 ,/ate1 or local law or ano!r    
applicable legal requirem5t1 includ+ a  
subpo5a1 summons1 or o!r prop]ly execut$
 compulsory process1 or to ex]cise or   
def5d a legal claim1 z specifically     
au?oriz$ by law4  7#c7 ,imm$iate dang]  
,to prev5t imm95t dang] to ! p]sonal    

safety ( any individual1 includ+ by     
effectuat+ a product recall pursuant to 
,f$]al or ,/ate law4  7#d7 ,fraud       
prev5tion & protection ( security ,to   
protect ! rights1 prop]ty1 s]vices1 or  
in=mation sy/ems ( ! cov]$ entity or    
s]vice provid]1 or any individual1      
includ+ to inve/igate a possible crime  
or to protect aga9/ security ?reats1    
abuse1 malici\s conduct1 deception1     
fraud1 !ft1 unau?oriz$ transactions1 or 
any o!r unlawful activity4  7#e7 ,rese>*
 ,9 ! case ( a cov]$ entity only1 to    
conduct rese>* t-- 7,a7 is p]=m$ = !    
prim>y purpose ( advanc+ a broadly      
recogniz$ public int]e/2  7,b7 is p]=m$ 
by ! cov]$ entity 7or by a s]vice       
provid] at ! direction ( ! cov]$ entity7
 & is n disclos$ to any ?ird p>ty2  7,c7
 is broadly compatible ) ! purposes =   
:i* ! data 0 orig9ally collect$ or      
process$2 &  7,d7 adh]es to all         
applicable e?ics & privacy laws4  7#f7  
,op]ational purposes ,to-- 7,a7 p]=m    
int]nal op]ations or analytics = a      

product or s]vice (f]$ by ! cov]$ entity
 or s]vice provid]1 su* z bill+1 %ipp+1 
int]nal sy/ems ma9t5ance1 diagno/ics1   
inv5tory managem5t1 f9ancial report+ or 
acc\nt+1 s]v+ an int]net website1 or    
network managem5t2  7,b7 use on a       
%ort-t]m1 transi5t basis1 provid$ t !   
p]sonal data-- 7i7 is n disclos$ to a   
?ird p>ty2 &  7ii7 is n us$ to build a  
p]si/5t pr(ile ( ! individual2  7,c7 9 !
 case ( a cov]$ entity only1 m>ket or   
adv]tise a s]vice or product to an      
individual if ! p]sonal data us$ = !    
m>ket+ or adv]tis+ 0 collect$ directly f
 ! individual by ! cov]$ entity or by a 
s]vice provid] on behalf ( ! cov]$      
entity2  7,d7 improve a product1 s]vice1
 or activity us$1 reque/$1 or au?oriz$  
by ! individual1 includ+ analytics1     
=eca/+1 ! repair ( errors t impair exi/+
 int5d$ functionality1 actions to v]ify 
or ma9ta9 quality or safety ( ! product1
 s]vice1 or activity1 or ! ongo+        
provision ( cu/om] s]vice & support by !
 cov]$ entity or s]vice provid]2 or     

7,e7 o!r additional specific categories 
( op]ational purposes t ! ,commission   
may def9e by rule1 issu$ 9 accordance ) 
section #eec ( title #e1 ,unit$ ,/ates  
,code4  7d7 ,limit+ ! ret5tion (        
s5sitive p]sonal data ,a cov]$ entity   
%all delete or de-id5tify s5sitive      
p]sonal data1 & %all direct its s]vice  
provid]s to delete or de-id5tify        
s5sitive p]sonal data1 aft] ! data is no
 long] reasonably necess>y to accompli% 
! int5d$ purposes p]mitt$ by ?is        
section1 unless su* deletion or         
de-id5tification is impossible or       
demon/rably impracticable4  7e7         
,bankruptcy ,if a cov]$ entity or s]vice
 provid] comm5ces a case "u title #aa ( 
! ,unit$ ,/ates ,code1 & ! case or any  
proce$+ "u ! case is expect$ to lead to 
! disclosure ( ! p]sonal data ( any     
individual1 ! cov]$ entity or s]vice    
provid] %all1 9 a reasonable am\nt ( "t 
be=e ! disclosure1 provide ea*          
individual ^: p]sonal data is subject to
 ! disclosure )-- 7#a7 a notice ( !     

propos$ disclosure1 includ+-- 7,a7 ! "n 
( ea* ?ird p>ty to :i* ! p]sonal data w 
be disclos$2 &  7,b7 a description ( !  
policies & practices relat+ to p]sonal  
data ( ea* su* ?ird p>ty2 &  7#b7 !     
opportunity to-- 7,a7 d5y cons5t1 or    
)draw previ\sly giv5 cons5t1 to !       
disclosure ( ! p]sonal data2 or  7,b7   
reque/ t ! cov]$ entity or s]vice       
provid] delete or de-id5tify ! p]sonal  
data4  #d4 ,"r to "k  7a7 ,9 g5]al ,a   
cov]$ entity %all make publicly         
available1 9 a cle> & prom95t location &
 9 easy-to-und]/& language1 a privacy   
policy t includes-- 7#a7 a cle> &       
specific description ( ! entity's       
policies & practices ) respect to       
p]sonal data2  7#b7 a cle> & specific   
description ( ! rights ( individuals )  
respect to _! p]sonal data 7includ+ !   
rights describ$ 9 section #e7 &         
in=mation on h[ to ex]cise ^? rights2 & 
7#c7 ! in=mation describ$ 9 subsection  
7c74  7b7 ,availability ( previ\s       
v]sions ,a cov]$ entity %all make       

publicly available any previ\s v]sion ( 
a privacy policy requir$ "u subsection  
7a74  7c7 ,cont5ts ,a privacy policy    
requir$ "u subsection 7a7 %all include--
 7#a7 ! id5tity & ! contact details ( ! 
cov]$ entity1 includ+1 :]e applicable1 !
 repres5tative ( ! cov]$ entity =       
purposes ( privacy inquiries or its     
privacy (fic]2  7#b7 a cle> description 
( ea* category ( p]sonal data collect$  
by ! cov]$ entity & ! purposes = :i* ea*
 su* category is collect$ & process$2   
7#c7 a cle> description ( any relevant  
ret5tion p]iods 7if possible7 & any     
crit]ia & o!r in=mation ) respect to !  
deletion or de-id5tification ( p]sonal  
data collect$ & process$ by ! cov]$     
entity2  7#d7 :e!r1 & = :at purposes1 ! 
cov]$ entity discloses p]sonal data to  
?ird p>ties1 ea* category ( p]sonal data
 disclos$ to ?ird p>ties1 & ! types (   
?ird p>ties to :i* ^? categories (      
p]sonal data are disclos$2  7#e7 :e!r1 &
 = :at purposes1 ! cov]$ entity receives
 p]sonal data f ?ird p>ties1 !          

categories ( p]sonal data receiv$ f ?ird
 p>ties1 & ! types ( ?ird p>ties f :i* !
 cov]$ entity receives p]sonal data2    
7#f7 a cle> description ( ! process by  
:i* ! cov]$ entity in=ms individuals (  
mat]ial *anges to its policies &        
practices ) respect to its collection & 
process+ ( p]sonal data2  7#g7 !        
specific /eps an individual may take to 
m9imize ! collection or process+ by !   
cov]$ entity ( ! individual's p]sonal   
data1 & ! relevant implications to !    
individual f m9imiz+ su* collection or  
process+2 &  7#h7 ! effective date ( !  
privacy policy4  7d7 ,exceptions ,a     
cov]$ entity %all n be requir$ to make  
available a privacy policy "u ?is       
subsection ) respect to ! collection or 
process+ ( p]sonal data t is reasonably 
necess>y & limit$ to-- 7#a7 an 9-p]son  
transaction :]e ! p]sonal data is n     
process$ = fur!r purposes incompatible )
 t transaction2  7#b7 comply a ,f$]al1  
,/ate1 or local law or ano!r applicable 
legal requirem5t1 includ+ a subpo5a1    

summons1 or o!r prop]ly execut$         
compulsory process2  7#c7 prev5t imm95t 
dang] to ! p]sonal safety ( any         
individual2 or  7#d7 protect ! rights or
 data security ( ! cov]$ entity1 a      
s]vice provid] ( ! cov]$ entity1 or any 
individual1 includ+ to inve/igate a     
possible crime or to protect aga9/      
security ?reats1 abuse1 fraud1 !ft1     
unau?oriz$ transactions1 or any o!r     
unlawful activity4  7e7 ,mat]ial *anges 
7#a7 ,9 g5]al ,a cov]$ entity1 ^u any   
mat]ial *ange to ! privacy policy ( !   
cov]$ entity or a mat]ial *ange to !    
privacy policy ( a s]vice provid] t is  
made at ! direction ( ! cov]$ entity--  
7,a7 %all notify ea* individual ^:      
p]sonal data is collect$ or process$ by 
! cov]$ entity1 or a s]vice provid] on  
behalf ( ! cov]$ entity1 ) a description
 ( ! mat]ial *ange1 includ+-- 7i7 *ange 
to ! categories ( p]sonal data ! cov]$  
entity or s]vice provid] processes2     
7ii7 *ange to ! purposes = :i* ! cov]$  
entity or s]vice provid] processes      

p]sonal data2  7iii7 *ange to ! mann] 9 
:i* ! cov]$ entity or s]vice provid]    
discloses p]sonal data to ?ird p>ties2 &
  7iv7 :i*1 if any1 *anges are          
retroactive2 &  7,b7 %all n process 7or1
 9 ! case ( a mat]ial *ange to ! privacy
 policy ( a s]vice provid] t is direct$ 
by ! cov]$ entity1 %all n direct !      
s]vice provid] to process7 any s5sitive 
p]sonal data ( an individual t 0        
collect$ by ! cov]$ entity or s]vice    
provid] be=e ! effective date ( !       
mat]ial *ange 9 a mann] t is inconsi/5t 
) ! privacy policy t 0 applicable at !  
"t su* data 0 collect$ until !          
individual provides express affirmative 
cons5t to su* process+4  7#b7 ,direct   
notice ( mat]ial *ange to affect$       
individuals ,a cov]$ entity %all1 if    
op]ationally & te*nically feasible1     
directly provide ! notice ( a mat]ial   
*ange requir$ "u p>agraph 7#a77;,a7 to  
ea* affect$ individual1 tak+ into acc\nt
 available te*nology & ! nature ( !     
relation%ip betwe5 ! cov]$ entity & !   

individual4  7#c7 ,public notice (      
mat]ial *ange ,:]e directly provid+ !   
notice ( a mat]ial *ange requir$ "u     
p>agraph 7#a77;,a7 to ea* affect$       
individual is impossible or demon/rably 
impracticable1 a cov]$ entity-- 7,a7    
%all publi% ! notice 9 a reasonably     
prom95t location2 &  7,b7 %all n process
 p]sonal data t 0 collect$ by ! cov]$   
entity be=e ! effective date ( ! mat]ial
 *ange 9 a mann] t is inconsi/5t ) !    
privacy policy t 0 applicable at ! "t   
su* data 0 collect$ until aft] ! notice 
has be5 s publi%$ = a p]iod ( "t t is   
reasonably suffici5t to give affect$    
individuals ! opportunity to ex]cise _! 
rights ) respect to _! p]sonal data4    
#e4 ,individual control  7a7 ,privacy   
controls ,ea* cov]$ entity %all-- 7#a7  
provide ea* individual ^: p]sonal data  
is collect$ or process$ by ! cov]$      
entity ) a reasonably accessible1 cle> &
 conspicu\s1 & easy-to-use means to     
ex]cise ! individual's rights e/abli%$  
"u ?is section ) respect to su* data2   

7#b7 if applicable1 (f] ! means requir$ 
"u p>agraph 7#a7 ?r\gh ! same means t ! 
individual r\t9ely uses to int]act ) !  
cov]$ entity2 &  7#c7 make ! means      
requir$ "u p>agraph 7#a7 available at no
 additional co/ to ! individual4  7b7   
,"r ,to access  7#a7 ,9 g5]al ,a cov]$  
entity %all1 9 response to a v]ifi$     
reque/ f an individual-- 7,a7 confirm   
:e!r or n ! cov]$ entity has collect$ or
 process$ ! p]sonal data ( ! individual2
 &  7,b7 if ! cov]$ entity has collect$ 
or process$ ! p]sonal data ( !          
individual1 provide1 )9 a reasonable "t 
aft] receiv+ ! reque/1 ! individual )-- 
7i7 a copy1 or an accurate              
repres5tation1 ( ! p]sonal data p]ta9+  
to ! individual collect$ & process$ by !
 cov]$ entity2 &  7ii7 a li/ ( !        
categories ( ?ird p>ties to :i* ! cov]$ 
entity has disclos$ ! p]sonal data ( !  
individual1 if applicable4  7#b7 ,ease (
 access  7,a7 ,=mat ,! cov]$ entity %all
 provide ! in=mation describ$ 9 p>agraph
 7#a77;,b7 9 an electronic =mat unless--

 7i7 ! individual reque/s to receive !  
in=mation by o!r means2 or  7ii7 provid+
 ! in=mation electronically is          
impossible or demon/rably impracticable4
  7,b7 ,data portability ,if a cov]$    
entity provides an individual )         
in=mation 9 an electronic =mat "u       
subp>agraph 7,a71 ! cov]$ entity %all1  
:]e te*nically feasible & reasonably    
practicable1 provide ! individual )--   
7i7 ! ability to export ! p]sonal data  
g5]at$ & submitt$ by ! individual 9 a   
/ructur$1 commonly-us$1 & ma*9e-readable
 =mat2 &  7ii7 ! ability to transmit su*
 in=mation to ano!r entity )\t con/ra9ts
 or conditions4  7c7 ,rights to accuracy
 & correction  7#a7 ,9 g5]al ,a cov]$   
entity %all e/abli% reasonable proc$ures
 design$ to-- 7,a7 ensure t ! p]sonal   
data t ! cov]$ entity collects &        
processes ) respect to an individual is 
accurate & up-to-date2 &  7,b7 provide  
individuals ) ! ability to submit a     
v]ifi$ reque/ to ! cov]$ entity to-- 7i7
 dispute ! accuracy & complet5ess ( su* 

p]sonal data2 &  7ii7 reque/ !          
appropriate correction ( su* p]sonal    
data4  7#b7 ,dispute & correction ,ea*  
cov]$ entity %all ensure t ! ability (  
an individual to dispute or reque/ t !  
cov]$ entity correct p]sonal data z     
describ$ 9 p>agraph 7#a7 is provid$ 9 a 
mann] t is appropriate & reasonable bas$
 on ! b5efits & risks ( h>m to !        
individual reg>d+ ! accuracy ( ! p]sonal
 data4  7#c7 ,exceptions = publicly     
available in=mation ,a cov]$ entity %all
 n be requir$ to v]ify ! accuracy (     
publicly available in=mation if ! cov]$ 
entity has reasonable proc$ures to      
ensure t ! publicly available in=mation 
assembl$ or ma9ta9$ by ! cov]$ entity   
accurately reflects ! in=mation         
available to ! g5]al public4  7d7 ,"r to
 erasure  7#a7 ,9 g5]al ,except =       
p]sonal data collect$ & process$ 9      
accordance ) a p]missible purpose       
describ$ 9 section #c7;c71 ^u a v]ifi$  
reque/ f an individual1 a cov]$ entity  
%all1 )\t undue delay1 delete or        

de-id5tify ! p]sonal data ( !           
individual1 & %all direct any s]vice    
provid]s ( ! cov]$ entity to delete or  
de-id5tify su* data4  7#b7 ,special     
consid]ations ,9 det]m9+ :e!r a cov]$   
entity t is a small bus9ess has compli$ 
) a v]ifi$ reque/ "u p>agraph 7#a7 9 a  
timely fa%ion1 ! ,commission %all take  
into acc\nt ! am\nt ( "t t ! entity     
requires to comply ) ! reque/ consid]+ !
 te*nical feasibility1 co/1 & burd5 to !
 entity ( comply+ ) ! reque/4  7e7      
,frequ5cy & co/ ,to ex]cise rights  7#a7
 ,9 g5]al ,a cov]$ entity-- 7,a7 %all   
comply ) a v]ifi$ reque/ f any          
individual to ex]cise ea* ( ! rights    
describ$ 9 subsections 7b71 7c71 & 7d7 n
 less frequ5tly ?an twice 9 any #ab-mon?
 p]iod2 &  7,b7 ! fir/ #b times t an    
individual makes a v]ifi$ reque/        
describ$ 9 subp>agraph 7,a7 9 any       
#ab-mon? p]iod1 %all comply ) su*       
reque/s )\t any *>ge to ! individual4   
7#b7 ,manife/ly unf\nd$ & excessive     
reque/s ,if an individual submits a     

manife/ly unf\nd$ or frivol\s reque/ to 
ex]cise a "r "u subsection 7b71 7c71 or 
7d71 or an excessive numb] ( reque/s "u 
su* subsections1 ! cov]$ entity may--   
7,a7 *>ge a reasonable fee1 tak+ into   
acc\nt ! adm9i/rative co/s ( provid+ !  
p]sonal data1 communication1 or tak+ !  
action reque/$ by ! individual2 or  7,b7
 refuse to act on ! reque/4  7f7 ,v]ifi$
 reque/  7#a7 ,9 g5]al ,a reque/ to     
ex]cise a "r describ$ 9 ?is section %all
 only be consid]$ a v]ifi$ reque/ if !  
cov]$ entity v]ifies t ! individual mak+
 ! reque/ is ! individual ^: p]sonal    
data is ! subject ( ! reque/4  7#b7     
,v]ification ( id5tity  7,a7 ,9 g5]al ,a
 cov]$ entity %all make a reasonable    
ef=t to v]ify ! id5tity ( any individual
 :o submits a reque/ to ex]cise a "r "u 
?is section4  7,b7 ,additional in=mation
 ,if a cov]$ entity _c v]ify ! id5tity (
 ! individual submitt+ a reque/ "u ?is  
subsection1 ! cov]$ entity-- 7i7 may    
reque/ t ! individual provide su*       
additional in=mation z is necess>y to   

confirm ! id5tity ( ! individual2 &     
7ii7 %all only process additional       
in=mation provid$ "u clause 7i7 = !     
purpose ( v]ify+ ! id5tity ( !          
individual4  7g7 ,decl9ation ( reque/s  
7#a7 ,9 g5]al ,a cov]$ entity-- 7,a7    
%all decl9e to act on a reque/ "u ?is   
section :]e1 aft] und]tak+ a reasonable 
ef=t1 ! entity _c v]ify t ! individual  
mak+ ! reque/ is ! individual ^: p]sonal
 data is ! subject ( ! reque/2  7,b7 may
 decl9e to act on a reque/ "u ?is       
section :]e fulfill+ ! reque/ w\ld-- 7i7
 require ! cov]$ entity or a s]vice     
provid] ( ! cov]$ entity to reta9 any   
p]sonal data collect$ = a s+le1 "o-"t   
transaction1 if su* p]sonal data is n   
process$ = additional purposes2  7ii7 be
 impossible or demon/rably              
impracticable1 or require any /eps or   
measures to re-id5tify1 or o!rwise alt] 
or manipulate1 in=mation t is           
de-id5tifi$2  7iii7 be contr>y to !     
legitimate int]e/s ( ! cov]$ entity or a
 s]vice provid] ( ! cov]$ entity1 su* z 

complet+ a transaction1 repair+         
functionality or errors1 or p]=m+ a     
contract betwe5 ! cov]$ entity & !      
individual2  7iv7 impair ! ability ( !  
cov]$ entity or a s]vice provid] ( !    
cov]$ entity to detect or respond to a  
security incid5t1 provide a secure      
environm5t1 or protect aga9/ malici\s1  
deceptive1 fraudul5t1 or illegal        
activity2  7v7 h9d] compliance ) a legal
 obligation or legally recogniz$        
privilege1 su* z a requirem5t to reta9  
c]ta9 in=mation1 or ! e/abli%m5t1       
ex]cise1 or def5se ( legal claims2  7vi7
 int]f]e ) rese>* 7conduct$ 9 accordance
 ) section #c7;c77#e77 :5 ! deletion ( !
 p]sonal data is likely to r5d]         
impossible or s]i\sly impair su* rese>*2
 or  7vii7 create a legitimate risk to !
 privacy1 security1 safety1 or o!r      
rights ( ! individual1 an individual o!r
 ?an ! reque/]1 or ! cov]$ entity1 bas$ 
on a reasonable individualiz$           
det]m9ation by ! cov]$ entity2 &  7,c7  
%all n be requir$ to act on a reque/ "u 

?is section if ! cov]$ entity is unable 
to fulfill ! reque/ because-- 7i7 !     
cov]$ entity requires ! assi/ance ( a   
s]vice provid] to fulfill ! reque/2 &   
7ii7 ! s]vice provid] has in=m$ ! cov]$ 
entity t ! s]vice provid] is unable to  
assi/ ! cov]$ entity 9 fulfill+ ! reque/
 = a reason specifi$ 9 section          
#h7;c77#c77;,a77ii77,,iv74  7#b7 ,notice
 ( reasons = decl9ation ,if ! cov]$     
entity decl9es to act on a reque/       
pursuant to p>agraph 7#a71 ! cov]$      
entity %all in=m ! individual :o made ! 
reque/ ( ! reasons = su* decl9ation &   
any rights ! individual may h to appeal 
! decision ( ! cov]$ entity4  7h7       
,exception = small bus9esses ,!         
requirem5ts "u subsections 7b7 & 7c7    
%all n apply to a cov]$ entity t is a   
small bus9ess4  7i7 ,guidance ,!        
,commission %all1 aft] consult+ ) &     
solicit+ comm5ts f consum] data indu/ry 
repres5tatives1 issue guidance describ+ 
nonb9d+ be/ practices = cov]$ entities &
 s]vice provid]s ( diff]5t bus9ess sizes

 & types to develop privacy controls z  
describ$ 9 ?is section4  #f4 ,security  
7a7 ,9 g5]al ,ea* cov]$ entity & s]vice 
provid] %all develop1 docum5t1 implem5t1
 & ma9ta9 a compreh5sive data security  
program t conta9s reasonable            
adm9i/rative1 te*nical1 & physical      
safegu>ds design$ to protect ! security1
 confid5tiality1 & integrity ( p]sonal  
data f unau?oriz$ access1 use1          
de/ruction1 acquisition1 modification1  
or disclosure4  7b7 ,consid]ations (    
safegu>ds ,! safegu>ds requir$ "u       
subsection 7a7 ) respect to a cov]$     
entity or s]vice provid] %all be        
appropriate to-- 7#a7 ! size1           
complexity1 & res\rces ( ! cov]$ entity 
or s]vice provid]2  7#b7 ! nature &     
scope ( ! activities ( ! cov]$ entity or
 s]vice provid]2  7#c7 ! te*nical       
feasibility & co/ ( available tools1    
ext]nal audits or assessm5ts1 & o!r     
measures us$ by ! cov]$ entity or s]vice
 provid] to improve security & r$uce    
vuln]abilities2  7#d7 ! s5sitivity ( !  

p]sonal data involv$2 &  7#e7 ! pot5tial
 = unau?oriz$ access1 use1 de/ruction1  
acquisition1 modification1 or disclosure
 ( ! p]sonal data involv$ to result 9   
economic loss1 id5tity !ft1 fraud1 or   
physical injury to ! individuals to :om 
su* data relates4  7c7 ,requirem5ts =   
program ,a compreh5sive data security   
program "u ?is section %all be design$  
to1 at a m9imum-- 7#a7 designate an     
employee or employees to be responsible 
= ov]see+ & ma9ta9+ its safegu>ds2  7#b7
 id5tify mat]ial int]nal & ext]nal risks
 to ! security & confid5tiality (       
p]sonal data & assess ! suffici5cy ( any
 safegu>ds 9 place to control ^! risks1 
includ+ consid]ation ( risks 9 ea*      
relevant area ( ! op]ations ( ! cov]$   
entity or s]vice provid]1 includ+-- 7,a7
 employee tra9+ & managem5t2  7,b7      
in=mation sy/ems1 includ+ network &     
s(tw>e design1 z well z in=mation       
process+1 /orage1 transmission1 &       
disposal2  7,c7 detect+1 prev5t+1 &     
respond+ to attacks1 intrusions1 or o!r 

sy/ems failures2 &  7,d7 :e!r ! cov]$   
entity or s]vice provid] has tak5 action
 to address & prev5t reasonably kn[n &  
addressable security vuln]abilities2    
7#c7 implem5t safegu>ds design$ to      
control ! risks id5tifi$ 9 ! cov]$      
entity's or s]vice provid]'s risk       
assessm5t1 & regul>ly assess !          
effectiv5ess ( ^? safegu>ds2  7#d7      
ma9ta9 reasonable proc$ures to require t
 ?ird p>ties & s]vice provid]s to :om   
p]sonal data is transf]r$ by ! cov]$    
entity or s]vice provid] involv$ ma9ta9 
reasonable adm9i/rative1 te*nical1 &    
physical safegu>ds design$ to protect ! 
security & confid5tiality ( p]sonal     
data2 &  7#e7 evaluate & make reasonable
 adju/m5ts to ! safegu>ds 9 light (     
mat]ial *anges 9 te*nology1 int]nal or  
ext]nal ?reats to p]sonal data1 & !     
*ang+ bus9ess arrangem5ts or op]ations (
 ! cov]$ entity or s]vice provid]4  #g4 
,acc\ntability  7a7 ,def9ition (        
applicable entity ,9 ?is section1 ! t]m 
applicable entity means a cov]$ entity  

or s]vice provid] t1 on an annual basis1
 conducts collection & process+ (-- 7#a7
 ! p]sonal data ( m ?an #bj1jjj1jjj     
individuals2 or  7#b7 ! s5sitive p]sonal
 data ( m ?an #a1jjj1jjj individuals4   
7b7 ,privacy (fic]  7#a7 ,designation   
,ea* applicable entity %all-- 7,a7      
designate an employee ( ! applicable    
entity1 or an individual :o is a        
contractor ( ! applicable entity1 to be 
! privacy (fic] responsible = ov]see+   
its policies & practices relat+ to !    
collection & process+ ( p]sonal data2 & 
7,b7 ensure t ! privacy (fic] is involv$
 9 all issues relat+ to ! privacy &     
security ( p]sonal data4  7#b7          
,conflicts ( int]e/ ,! privacy (fic] may
 p]=m o!r tasks & duties = ! applicable 
entity1 b only to ! ext5t t ! applicable
 entity ensures t ! p]=mance ( ^? o!r   
tasks or duties does n pres5t a conflict
 ( int]e/ ) respect to ! duties &       
responsibilities ( ! privacy (fic] role4
  7#c7 ,responsibilities ,! privacy     
(fic] %all-- 7,a7 in=m & advise !       

applicable entity ( ! obligations ( !   
applicable entity "u ?is ,act2  7,b7    
monitor compliance by ! applicable      
entity ) ?is ,act2  7,c7 ov]see-- 7i7 9 
! case ( an applicable entity t is a    
cov]$ entity1 ea* privacy impact        
assessm5t c>ri$ out "u subsection 7c72 &
  7ii7 ! compreh5sive privacy program   
implem5t$ "u subsection 7d72 &  7,d7 act
 z a contact = ! ,commission1 o!r       
,f$]al1 ,/ate1 & local au?orities1 & !  
applicable entity ) respect to matt]s   
relat+ to ! privacy & security ( p]sonal
 data4  7c7 ,consid]ation ( privacy     
implications ( mat]ial *anges 9 process+
 s5sitive p]sonal data  7#a7 ,9 g5]al   
,if an applicable entity t is a cov]$   
entity int5ds to beg9 a new collection  
or process+ activity or to make a       
mat]ial *ange 9 its process+ ( s5sitive 
p]sonal data1 ! applicable entity %all1 
be=e beg9n+ ! new process+ activity or  
mak+ ! mat]ial *ange1 consid] ! privacy 
implications1 if any ( ! *ange4  7#b7   
,consid]ations ,an applicable entity t  

is a cov]$ entity %all ensure1 9        
consid]+ ! privacy implications ( a     
mat]ial *ange z requir$ "u p>agraph     
7#a71 t ! consid]ation is reasonable &  
appropriate ) respect to ! s5sitive     
p]sonal data t w be affect$ by ! new    
process+ activity or ! mat]ial *ange 9  
process+ by consid]+-- 7,a7 ! nature &  
volume ( ! s5sitive p]sonal data2 &     
7,b7 ! pot5tial = ! new process+        
activity or ! mat]ial *ange to be a     
proximate cause ( h>m to individuals to 
:om ! s5sitive p]sonal data p]ta9s4     
7#c7 ,approval ,! privacy (fic] %all be 
requir$ to approve ! f9d+s ( a privacy  
impact assessm5t c>ri$ out "u p>agraph  
7#a7 be=e a applicable entity t is a    
cov]$ entity may beg9 ! new process+    
activity or make ! mat]ial *ange t is ! 
subject ( ! privacy impact assessm5t4   
7#d7 ,docum5tation ,an applicable entity
 t is a cov]$ entity %all docum5t &     
ma9ta9 9 writt5 =m any privacy impact   
assessm5t c>ri$ out "u p>agraph 7#a7 if 
! new process+ activity or mat]ial *ange

 t is ! subject ( ! privacy impact      
assessm5t involves s5sitive p]sonal     
data4  7d7 ,compreh5sive privacy program
  7#a7 ,9 g5]al ,ea* applicable entity  
%all implem5t a compreh5sive privacy    
program to safegu>d ! privacy & security
 ( p]sonal data collect$ or process$ by 
! applicable entity = ! life cycle (    
developm5t & op]ational practices ( its 
products or s]vices1 includ+ by-- 7,a7  
enhanc+ ! privacy & security ( p]sonal  
data collect$ or process$ by !          
applicable entity ?r\gh appropriate     
te*nical or op]ational safegu>ds1 su* z 
encryption1 de-id5tification1 & o!r     
privacy enhanc+ te*nologies2  7,b7      
v]ify+ t ! applicable entity's practices
 relat+ to ! collection & process+ (    
p]sonal data are consi/5t )-- 7i7 !     
entity's policies & docum5tation ( su*  
policies2  7ii7 9 ! case ( an applicable
 entity t is a cov]$ entity1            
repres5tations ! entity makes to        
individuals2 &  7iii7 9 ! case ( an     
applicable entity t is a s]vice provid]1

 repres5tations ! entity makes to cov]$ 
entities to :i* ! entity provides       
s]vices2 &  7,c7 ensur+ t ! privacy     
controls ( ! applicable entity are      
adequately accessible to1 & effective at
 safegu>d+ ! express$ pref]5ces (-- 7i7 
9 ! case ( an applicable entity t is a  
cov]$ entity1 ea* individual ^: p]sonal 
data is collect$ or process$ by ! cov]$ 
entity 7exclud+ any p]sonal data )      
respect to :i* ! cov]$ entity is a ?ird 
p>ty72 &  7ii7 9 ! case ( an applicable 
entity t is a s]vice provid]1 ea* cov]$ 
entity to :i* ! entity provides s]vices4
  7#b7 ,consid]ations ,9 implem5t+ a    
compreh5sive privacy program "u p>agraph
 7#a71 ea* applicable entity %all-- 7,a7
 take into consid]ation1 z applicable   
giv5 ! entity's role z a cov]$ entity or
 s]vice provid]-- 7i7 ! relevant risks  
to ! privacy & security ( p]sonal data  
aga9/ :i* ! applicable entity mu/ gu>d 9
 meet+ ! expectations ( individuals2    
7ii7 ! requirem5ts "u ?is ,act2  7iii7 !
 size & complexity ( ! applicable       

entity2 &  7iv7 ! s5sitivity & volume ( 
! p]sonal data t ! applicable entity    
processes2 &  7,b7 address ! f9d+s &    
implem5t ! recomm5dations conta9$ 9     
privacy impact assessm5ts t ! applicable
 entity c>ries out "u subsection 7c74   
#h4 ,rules relat+ to s]vice provid]s    
7a7 ,obligations ( cov]$ entities )     
respect to s]vice provid]s  7#a7 ,9     
g5]al ,a cov]$ entity %all only disclose
 p]sonal data to a s]vice provid]       
pursuant to a contract t is b9d+ on bo? 
p>ties & meets ! requirem5ts (          
subsection 7b74  7#b7 ,due dilig5ce     
7,a7 ,9 g5]al ,any cov]$ entity t       
discloses p]sonal data to a s]vice      
provid] %all-- 7i7 take reasonable /eps 
to id5tify :e!r ! s]vice provid] has    
e/abli%$ appropriate proc$ures &        
controls = ensur+ ! privacy & security (
 ! p]sonal data 9 a mann] t complies ) !
 requirem5ts ( ?is ,act1 includ+ ?r\gh  
reasonable repres5tations made to !     
cov]$ entity by ! s]vice provid] 9 !    
contract gov]n+ ! disclosure ( p]sonal  

data to ! s]vice provid]2 &  7ii7       
inve/igate any circum/ances = :i* a     
reasonable p]son w\ld det]m9e t !re is a
 high probability t ! s]vice provid] is 
n 9 compliance ) a requirem5t ( ?is     
,act1 &1 if necess>y bas$ on ! f9d+s (  
su* inve/igation1 take reasonable /eps  
to protect ! privacy & security ( any   
p]sonal data disclos$ by ! cov]$ entity 
to ! s]vice provid] t is at risk z a    
result ( ! s]vice provid]'s             
noncompliance ) a requirem5t ( ?is ,act4
  7,b7 ,consid]ations ,9 det]m9+ :e!r a 
cov]$ entity has act$ reasonably 9      
comply+ ) clause 7i7 or 7ii7 (          
subp>agraph 7,a71 ! ,commission %all    
take into acc\nt-- 7i7 ! size1          
complexity1 & res\rces ( ! cov]$ entity 
& :e!r ! cov]$ entity is a small        
bus9ess2 &  7ii7 ! risk ( h>m reasonably
 expect$ to occur z a result ( ! cov]$  
entity disclos+ p]sonal data to a s]vice
 provid] )\t comply+ ) su* clause4  7b7 
,contractual requirem5ts  7#a7 ,9 g5]al 
,a contract betwe5 a cov]$ entity & a   

s]vice provid] gov]n+ ! disclosure (    
p]sonal data by ! cov]$ entity to !     
s]vice provid] %all-- 7,a7 require !    
s]vice provid] to only collect or       
process ! p]sonal data z direct$ by !   
cov]$ entity2  7,b7 e/abli% ! purposes  
=1 & means (1 ! collect+ or process+ ( !
 p]sonal data by ! s]vice provid]1      
includ+ in/ructions1 policies1 &        
practices1 z applicable1 ) :i* ! s]vice 
provid] is requir$ to comply2 &  7,c7   
include a reasonable repres5tation by ! 
s]vice provid] indicat+ t ! s]vice      
provid] has e/abli%$ appropriate        
proc$ures & controls to comply ) !      
requirem5ts ( ?is ,act4  7#b7           
,limitation ,no contract gov]n+ !       
disclosure ( p]sonal data by a cov]$    
entity to a s]vice provid] %all relieve 
a cov]$ entity or s]vice provid] ( any  
requirem5t or obligation ) respect to   
su* p]sonal data t is impos$ on ! cov]$ 
entity or s]vice provid]1 z applicable1 
by ?is ,act4  7c7 ,s]vice provid]       
obligations  7#a7 ,notice ( process+ (  

p]sonal data to comply ) legal          
requirem5t ,9 ! ev5t t a s]vice provid] 
is requir$ to process p]sonal data 9    
ord] to comply ) a legal requirem5t1    
includ+ a subpo5a1 summons1 or o!r      
prop]ly execut$ compulsory process1 !   
s]vice provid] %all in=m ! cov]$ entity 
f :i* x receiv$ ! p]sonal data involv$ (
 su* legal requirem5t be=e su* process+1
 unless ! s]vice provid] is o!rwise     
prohibit$ by law f provid+ su*          
notification4  7#b7 ,notice ( *ange to  
policies or practices ,if a s]vice      
provid] am5ds its policies or practices 
relat+ to p]sonal data 9 a mann] t is   
relevant to compliance ) any provision (
 ?is ,act1 ! s]vice provid] %all provide
 reasonable notice 9 advance ( su* *ange
 to any cov]$ entity on ^: behalf !     
s]vice provid] collects or processes    
p]sonal data4  7#c7 ,responsibilities   
7,a7 ,individual control reque/s ,a     
s]vice provid] t collects or processes  
p]sonal data on behalf ( a cov]$ entity 
%all1 to ! ext5t possible1 ei!r-- 7i7   

provide ! cov]$ entity ) appropriate    
te*nical & organizational measures to   
enable ! cov]$ entity to comply )       
reque/s to ex]cise rights describ$ 9    
section #e ) respect to any su* p]sonal 
data t is held by1 & reasonably         
accessible to1 ! s]vice provid]2 or     
7ii7 respond to any reque/ made by !    
cov]$ entity = assi/ance 9 comply+ ) a  
reque/ to ex]cise su* a "r ) respect to 
su* p]sonal data t ! cov]$ entity has   
v]ifi$ z describ$ 9 section #e7;f7 & has
 det]m9$ mu/ be compli$ ) "u ?is ,act   
by1 z appropriate-- 7,i7 9 ! case ( a   
reque/ describ$ 9 subsection 7b7 (      
section #e1 provid+ ! cov]$ entity )    
access to any relevant p]sonal data held
 by1 & reasonably available to1 ! s]vice
 provid]2  7,,ii7 9 ! case ( a reque/   
describ$ 9 subsection 7c7 ( su* section1
 by correct+ any relevant p]sonal data  
held by1 & reasonably accessible to1 !  
s]vice provid]1 & provid+ ! cov]$ entity
 ) notice ( su* correction2  7,,iii7 9 !
 case ( a reque/ describ$ 9 subsection  

7d7 ( su* section1 by delet+1           
de-id5tify+1 or return+ to ! cov]$      
entity any relevant p]sonal data held   
by1 & reasonably accessible to1 ! s]vice
 provid]1 & provid+ ! cov]$ entity )    
notice ( su* action2 or  7,,iv7 in=m+ ! 
cov]$ entity t-- 7aa7 ! s]vice provid]  
does n hold any p]sonal data relat$ to !
 reque/2  7bb7 ! s]vice provid] _c      
reasonably access any p]sonal data      
relat$ to ! reque/2 or  7cc7 comply+ ) !
 reque/ w\ld be inconsi/5t ) a legal    
requirem5t to :i* ! s]vice provid] is   
subject4  7,b7 ,deletion ( data ^u      
completion ( s]vice ,except z o!rwise   
requir$ by law1 z soon z practicable    
aft] ! completion ( ! s]vice or function
 = :i* a s]vice provid] collect$ or     
process$ p]sonal data on behalf ( a     
cov]$ entity1 ! s]vice provid] %all     
delete1 de-id5tify1 or return to ! cov]$
 entity all su* p]sonal data4  7,c7     
,assurance ( compliance  7i7 ,9 g5]al   
,subject to clause 7ii71 a s]vice       
provid] %all make available to a cov]$  

entity on ^: behalf ! s]vice provid]    
collects or processes p]sonal data      
in=mation necess>y to demon/rate !      
s]vice provid]'s compliance )           
subp>agraph 7,a74  7ii7 ,writt5         
repres5tation ( compliance ,if !        
in=mation describ$ 9 clause 7i7 is n    
te*nically available to a s]vice        
provid]1 ! s]vice provid] may comply )  
clause 7i7 by provid+ ! cov]$ entity ) a
 writt5 repres5tation /at+ t ! s]vice   
provid] is 9 compliance ) subp>agraph   
7,a74  7#d7 ,subcontractor requirem5ts  
,a s]vice provid] t is collect+ or      
process+ p]sonal data on behalf ( a     
cov]$ entity %all n employ a            
subcontractor to c>ry out or assi/ 9 su*
 collection or process+ unless-- 7,a7 ! 
s]vice provid] has provid$ ! cov]$      
entity ) an opportunity to object to !  
use ( su* subcontractor2 &  7,b7 !      
subcontractor is subject 7pursuant to an
 agreem5t betwe5 ! s]vice provid] & !   
subcontractor7 to ! same requirem5ts &  
obligations z ! s]vice provid] ) respect

 to ! collection & process+ ( ! p]sonal 
data4  7#e7 ,consid]ations ,9 det]m9+   
:e!r a s]vice provid] has act$          
reasonably 9 comply+ ) ?is subsection1 !
 ,commission %all take into acc\nt--    
7,a7 ! size1 complexity1 & res\rces ( ! 
s]vice provid] & :e!r ! s]vice provid]  
is a small bus9ess2 &  7,b7 ! risk ( h>m
 reasonably expect$ to occur z a result 
( ! s]vice provid] n comply+ ) ?is      
subsection4  #i4 ,en=cem5t  7a7         
,en=cem5t by ! ,commission  7#a7 ,unfair
 or deceptive acts or practices ,a      
violation ( ?is ,act or a regulation    
promulgat$ "u ?is ,act %all be treat$ z 
an unfair or deceptive act or practice 9
 violation ( a rule promulgat$ "u       
section #ah7;a77#a77;,b7 ( ! ,f$]al     
,trade ,commission ,act 7#ae ,u4,s4,c4  
#eg;a7a77#a77;,b774  7#b7 ,p[]s ( !     
,commission  7,a7 ,9 g5]al ,except z    
provid$ 9 subp>agraph 7,c71 !           
,commission %all en=ce ?is ,act & any   
regulation promulgat$ "u ?is ,act 9 !   
same mann]1 by ! same means1 & ) ! same 

jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4  7,b7 ,privileges &     
immunities ,any cov]$ entity or s]vice  
provid] :o violates ?is ,act or a       
regulation promulgat$ "u ?is ,act %all  
be subject to ! p5alties & entitl$ to ! 
privileges & immunities provid$ 9 !     
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #da et seq474  7,c7 ,common   
c>ri]s & nonpr(it organizations ,not)/&+
 section #d1 #e7;a77#b71 or #f ( !      
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any 
jurisdictional limitation ( !           
,commission1 ! ,commission %all also    
en=ce ?is ,act1 ) respect to common     
c>ri]s & nonpr(it organizations describ$
 9 section #b7d7 ( ?is ,act1 9 ! same   
mann] provid$ 9 subp>agraphs 7,a7 & 7,b7
 ( ?is p>agraph4  7,d7 ,au?ority pres]v$
 ,no?+ 9 ?is ,act %all be con/ru$ to    
limit ! ,commission's au?ority "u !     

,f$]al ,trade ,commission ,act or any   
o!r provision ( law4  7#c7 ,civil       
p5alties  7,a7 ,9 g5]al ,not)/&+ section
 #e7m7 ( ! ,f$]al ,trade ,commission    
,act 7#ae ,u4,s4,c4 #de7m771 9 an action
 br\ght by ! ,commission to en=ce ?is   
,act & ! regulations promulgat$ "u ?is  
,act1 9 addition to any injunctive      
relief obta9$ by ! ,commission 9 !      
action1 a cov]$ entity or s]vice provid]
 %all be liable = a civil p5alty 9 an   
am\nt describ$ 9 subp>agraph 7,b7 if !  
cov]$ entity or s]vice provid]1 ) actual
 k1 violates ?is ,act or a regulation   
promulgat$ "u ?is ,act4  7,b7 ,am\nt    
7i7 ,calculation ,except z provid$ 9    
clause 7ii71 ! am\nt ( a civil p5alty   
describ$ 9 subp>agraph 7,a7 %all be !   
numb] ( individuals affect$ by a        
violation describ$ 9 t subp>agraph      
multipli$ by an am\nt n to exce$        
#db1ecj4  7ii7 ,consid]ations ,9 det]m9+
 ! am\nt ( a civil p5alty to seek "u    
subp>agraph 7,a7 = a violation describ$ 
9 t subp>agraph1 ! ,commission %all     

consid]1 ) respect to ! cov]$ entity or 
s]vice provid] t committ$ ! violation-- 
7,i7 ! degree ( h>m associat$ ) !       
privacy & security ( p]sonal data (     
individuals creat$ by ! violation2      
7,,ii7 ! int5t ( ! cov]$ entity or      
s]vice provid] 9 committ+ ! violation2  
7,,iii7 ! size1 complexity1 & res\rces (
 ! cov]$ entity or s]vice provid]1      
includ+ if x is a small bus9ess2  7,,iv7
 reasonable expectations relat+ to      
privacy & security ( p]sonal data (     
individuals2  7,v7 ! degree to :i* !    
cov]$ entity or s]vice provid] put 9    
place appropriate controls or compli$ ) 
! requirem5ts ( section #g1 if          
applicable2  7,,vi7 :e!r ! cov]$ entity 
or s]vice provid] self-report$ !        
violation to ! ,commission2 &  7,,vii7  
:at1 if any1 ef=ts ! cov]$ entity or    
s]vice provid] has tak5 to mitigate any 
risk to ! privacy & security ( p]sonal  
data ( individuals creat$ by ! process+4
  7b7 ,en=cem5t by ,/ate attorneys g5]al
  7#a7 ,civil action ,9 any case 9 :i*  

an attorney g5]al ( a ,/ate has reason  
to believe t an int]e/ ( ! resid5ts ( t 
,/ate has be5 or is ?reat5$ or adv]sely 
affect$ by ! engagem5t ( any cov]$      
entity or s]vice provid] 9 a practice t 
violates ?is ,act or a regulation       
promulgat$ "u ?is ,act1 ! attorney g5]al
 ( ! ,/ate may1 z p>5s patriae1 br+ a   
civil action on behalf ( ! resid5ts ( ! 
,/ate 9 an appropriate di/rict c\rt ( ! 
,unit$ ,/ates to-- 7,a7 enjo9 t         
practice2  7,b7 en=ce compliance ) ?is  
,act or ! regulation2 or  7,c7 9 ! case 
( a violation describ$ 9 subsection     
7a77#c77;,a71 impose a civil p5alty 9 an
 am\nt describ$ 9 subsection            
7a77#c77;,b74  7#b7 ,rights ( !         
,commission  7,a7 ,notice to ,commission
  7i7 ,9 g5]al ,except z provid$ 9      
clause 7iii71 ! attorney g5]al ( a ,/ate
 %all notify ! ,commission 9 writ+ t !  
attorney g5]al int5ds to br+ a civil    
action "u p>agraph 7#a7 n lat] ?an #aj  
days be=e initiat+ ! civil action4  7ii7
 ,cont5ts ,! notification requir$ by    

clause 7i7 ) respect to a civil action  
%all include a copy ( ! compla9t to be  
fil$ to initiate ! civil action4  7iii7 
,exception ,if x is n feasible = !      
attorney g5]al ( a ,/ate to provide !   
notification requir$ by clause 7i7 be=e 
initiat+ a civil action "u p>agraph     
7#a71 ! attorney g5]al %all notify !    
,commission imm$iately ^u in/itut+ !    
civil action4  7,b7 ,int]v5tion by !    
,commission ,! ,commission may-- 7i7    
int]v5e 9 any civil action br\ght by !  
attorney g5]al ( a ,/ate "u p>agraph    
7#a72 &  7ii7 ^u int]v5+ "u clause 7i7--
 7,i7 be he>d on all matt]s aris+ 9 !   
civil action2 &  7,,ii7 file petitions =
 appeal ( a decision 9 ! civil action4  
7#c7 ,consolidation ( actions br\ght by 
two or m ,/ate attorneys g5]al  7,a7 ,9 
g5]al ,subject to subp>agraph 7,b71 if a
 civil action "u p>agraph 7#a7 is p5d+ 9
 a di/rict c\rt ( ! ,unit$ ,/ates & "o  
or m civil actions are comm5c$ pursuant 
to p>agraph 7#a7 9 a diff]5t di/rict    
c\rt ( ! ,unit$ ,/ates t involve "o or m

 common que/ions ( fact1 all su* civil  
actions %all be transf]r$ = ! purposes (
 consolidat$ pretrial proce$+s & trial  
to ! ,unit$ ,/ates ,di/rict ,c\rt = !   
,di/rict ( ,columbia4  7,b7 ,exception  
,a civil action %all n be transf]r$     
pursuant to subp>agraph 7,a7 if pretrial
 proce$+s 9 su* civil action h conclud$ 
be=e ! subsequ5t action is comm5c$      
pursuant to p>agraph 7#a74  7c7         
,limitation on ,/ate action :ile ,f$]al 
action is p5d+ ,if ! ,commission        
in/itutes an action "u subsection 7a7 ) 
respect to a violation ( ?is ,act or a  
regulation promulgat$ "u ?is ,act1 a    
,/ate may n1 dur+ ! p5d5cy ( t action1  
in/itute an action "u subsection 7b7    
aga9/ any def5dant nam$ 9 ! compla9t 9 !
 action in/itut$ by ! ,commission bas$  
on ! same set ( facts giv+ rise to !    
violation ) respect to :i* ! ,commission
 in/itut$ ! action4  7d7 ,no private "r 
( action ,!re %all be no private "r (   
action "u ?is ,act & no?+ 9 ?is ,act may
 be con/ru$ to provide a basis = a      

private "r ( action4  #aj4 ,relation to 
o!r laws  7a7 ,congressional int5t ,to  
preempt ,/ate privacy & security law ,x 
is ! express int5tion ( ,congress to    
promote consi/5cy 9 consum]             
expectations1 competitive p>ity1 &      
innovation ?r\gh ! e/abli%m5t ( a uni=m 
,f$]al privacy framework t preempts1 &  
occupies ! field ) respect to1 !        
au?ority ( any ,/ate or political       
subdivision ( a ,/ate ov] ! conduct or  
activities ( cov]$ entities cov]$ by ?is
 ,act 7or "u a law enum]at$ 9 subsection
 7c77 relat+ to ! privacy or security ( 
p]sonal data1 includ+ consum] controls  
relat+ to p]sonal data su* z rights to  
access1 correction1 & deletion4  7b7    
,express preemption ( ,/ate law  7#a7 ,9
 g5]al ,except z provid$ 9 p>agraph     
7#b71 ?is ,act %all sup]s$e any         
provision ( a law1 rule1 regulation1 or 
o!r requirem5t ( any ,/ate or political 
subdivision ( a ,/ate to ! ext5t t su*  
provision relates to ! privacy or       
security ( p]sonal data4  7#b7          

,pres]vation ( ,/ate & local laws ,!    
provisions ( ?is ,act %all n be con/ru$ 
to preempt or sup]s$e ! applicability ( 
any ( ! foll[+ laws ( a ,/ate or        
political subdivision ( a ,/ate to !    
ext5t t su* law is n inconsi/5t ) ?is   
,act3 7,a7 ,laws t address notification 
requirem5ts 9 ! ev5t ( a data brea*4    
7,b7 ,rules ( crim9al or civil proc$ure4
  7,c7 ,laws t relate to ! g5]al /&>ds (
 fraud or public safety4  7,d7 ,laws t  
address ! privacy ( any gr\p ( /ud5ts 7z
 def9$ 9 section #ddd7;a7 ( ! ,g5]al    
,education ,provisions ,act 7#bj        
,u4,s4,c4 #abcb;g7a77 7commonly ref]r$  
to z ! ,family ,educational ,rights &   
,privacy ,act ( #aigd774  7,e7 ,laws t  
address f9ancial in=mation held by      
f9ancial in/itutions 7z def9$ 9 section 
#eji ( ! ,gramm-,lea*-,bliley ,act 7#ae 
,u4,s4,c4 #fhji774  7,f7 ,laws t address
 protect$ heal? in=mation held by cov]$ 
entities & bus9ess associates 7z su*    
t]ms are def9$ = purposes ( regulations 
promulgat$ "u section #bfd7;c7 ( !      

,heal? ,insurance ,portability &        
,acc\ntability ,act ( #aiif 7#db        
,u4,s4,c4 #acbj;d-#b note774  7,g7 ,laws
 gov]n+ employm5t & employm5t-relat$    
data includ+ data collect$ or us$ by an 
employ] pursuant to an employ]-employee 
relation%ip4  7,h7 ,laws protect+ ! "r (
 individuals to be free ( discrim9ation 
bas$ on race1 sex1 national orig91 or   
o!r suspect classification id5tifi$ "u  
,/ate law4  7c7 ,relation to o!r ,f$]al 
laws  7#a7 ,9 g5]al ,except z o!rwise   
provid$ 9 p>agraphs 7#b7 & 7#d71 ?is    
,act %all sup]s$e any o!r ,f$]al /atute 
or regulation relat+ to ! privacy or    
security ( p]sonal data4  7#b7 ,sav+s   
provision ,?is ,act %all n be con/ru$ to
 modify1 limit1 or sup]s$e ! op]ation ( 
any ( ! foll[+ laws3 7,a7 ,! ,*ildr5's  
,onl9e ,privacy ,protection ,act 7#ae   
,u4,s4,c4 #feja et seq474  7,b7 ,!      
,communications ,assi/ance = ,law       
,en=cem5t ,act 7#dg ,u4,s4,c4 #ajja et  
seq474  7,c7 ,section #bbg ( !          
,communications ,act ( #aicd 7#dg       

,u4,s4,c4 #bbg74  7,d7 ,title ,v ( !    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq474  7,e7 ,! ,fair ,cr$it  
,report+ ,act 7#ae ,u4,s4,c4 #afha et   
seq474  7,f7 ,! ,heal? ,insurance       
,portability & ,acc\ntability ,act      
7,public ,law #ajd-aia74  7,g7 ,! ,heal?
 ,in=mation ,te*nology = ,economic &    
,cl9ical ,heal? ,act 7#db ,u4,s4,c4     
#agica et seq474  7,h7 ,section #ddd ( !
 ,g5]al ,education ,provisions ,act 7#bj
 ,u4,s4,c4 #abcb;g7 7commonly ref]r$ to 
z ! ,family ,educational ,rights &      
,privacy ,act ( #aigd74  7,i7 ,!        
,electronic ,communications ,privacy    
,act 7#ah ,u4,s4,c4 #beaj et seq474     
7,j7 ,! ,driv]'s ,privacy ,protection   
,act ( #aiid 7#ah ,u4,s4,c4 #bgba et    
seq474  7,k7 ,! ,f$]al ,aviation ,act ( 
#aieh 7#di ,u4,s4,c4 ,app4 #acja et     
seq474  7#c7 ,deem$ compliance ,a cov]$ 
entity t is requir$ to comply ) a law   
specifi$ 9 p>agraph 7#b7 & is 9         
compliance ) ! data collection1         
process+1 or security requirem5ts ( su* 

law %all be deem$ to be 9 compliance ) !
 requirem5ts ( ?is ,act ) respect to    
p]sonal data cov]$ by su* law4  7#d7    
,nonapplication ( ,,fcc laws &          
regulations to cov]$ entities ,not)/&+  
any o!r provision ( law1 nei!r any      
provision ( ! ,communications ,act (    
#aicd 7#dg ,u4,s4,c4 #aea et seq47 & all
 ,acts am5datory !re( & supplem5t>y     
!reto nor any regulation promulgat$ by !
 ,f$]al ,communications ,commission "u  
su* ,acts %all apply to any cov]$ entity
 ) respect to ! collection1 use1        
process+1 transf]r+1 or security (      
p]sonal data1 except to ! ext5t t su*   
provision or regulation p]ta9s solely to
 #iaa l9es or any o!r em]g5cy l9e ( a   
hospital1 m$ical provid] or s]vice      
(fice1 heal? c>e facility1 poison       
control c5t]1 fire protection ag5cy1 or 
law en=cem5t ag5cy4  #aa4 ,commission   
res\rces  7a7 ,appo9tm5t ( attorneys1   
te*nologi/s1 & support p]sonnel ,not)/&+
 any o!r provision ( law1 ! ,*air ( !   
,commission %all appo9t no few] ?an #ddj

 additional individuals to s]ve z       
p]sonnel to en=ce ?is ,act & o!r laws   
relat+ to privacy & data security t !   
,commission is au?oriz$ to en=ce4  7b7  
,assessm5t ( ,commission res\rces ,n    
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 ! ,commission %all submit to 
,congress a report t includes-- 7#a7 an 
assessm5t ( ! res\rces1 includ+         
p]sonnel1 available to ! ,commission to 
c>ry out ?is ,act2 &  7#b7 a description
 ( any res\rces1 includ+ p]sonnel-- 7,a7
 t are n available to ! ,commission2 &  
7,b7 t ! ,commission requires to        
effectively c>ry out ?is ,act4  7c7     
,au?orization ( appropriations ,!re are 
au?oriz$ to be appropriat$ to !         
,commission su* sums z may be necess>y  
to c>ry out ?is section4  #ab4 ,guidance
 & report+  7a7 ,int]national           
coord9ation & coop]ation  7#a7 ,9 g5]al 
,if necess>y1 ! ,commission %all        
coord9ate any en=cem5t action by !      
,commission "u ?is ,act ) any relevant  
data protection au?ority e/abli%$ by a  

=eign c\ntry or any simil> (fice ( a    
=eign c\ntry 9 a mann] consi/5t )       
subsections 7j7 & 7k7 ( section #f ( !  
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #df74  7#b7 ,int]national     
int]op]ability ,! ,secret>y ( ,comm]ce1 
9 consultation ) ! ,commission & ! heads
 ( o!r relevant ,f$]al ag5cies1 %all--  
7,a7 id5tify laws ( =eign c\ntries or   
regions t relate to ! process+ ( p]sonal
 data = comm]cial purposes2  7,b7 engage
 ) relevant (ficials ( =eign c\ntries or
 regions t h implem5t$ laws describ$ 9  
subp>agraph 7,a7 9 ord] to id5tify      
requirem5ts "u ^? laws t c\ld disrupt   
cross-bord] transf]s ( p]sonal data2    
7,c7 develop me*anisms & recomm5dations 
to prev5t disruptions describ$ 9        
subp>agraph 7,b72 &  7,d7 n lat] ?an #a 
ye> aft] ! date ( enactm5t ( ?is ,act1 &
 once a ye> ea* ye> !reaft] = #e ye>s1  
submit to ,congress a report on !       
progress ( ef=ts made "u ?is section4   
7b7 ,reports to ,congress ,n lat] ?an   
#ahj days aft] ! date ( enactm5t ( ?is  

,act1 & n less frequ5tly ?an annually   
!reaft]1 ! ,commission %all submit to   
,congress1 & make available on a public 
website1 a report t conta9s in=mation   
relat+ to-- 7#a7 ! effectiv5ess ( ?is   
,act & regulations promulgat$ "u ?is    
,act2  7#b7 compliance ) ! provisions ( 
?is ,act & regulations promulgat$ "u ?is
 ,act2  7#c7 violations ( ! provisions (
 ?is ,act & regulations promulgat$ "u   
?is ,act2  7#d7 en=cem5t actions by !   
,commission & ,/ate attorneys g5]al =   
violations ( ! provisions ( ?is ,act &  
regulations promulgat$ "u ?is ,act2     
7#e7 priorities ( ! ,commission 9 en=c+ 
! provisions ( ?is ,act & regulations   
promulgat$ "u ?is ,act2 &  7#f7 res\rces
 ne$$ by ! ,commission to fully implem5t
 & en=ce ! provisions ( ?is ,act &      
regulations promulgat$ "u ?is ,act4  7c7
 ,/udy & report by ! ,gov]nm5t          
,acc\ntability ,(fice ,n lat] ?an #c    
ye>s aft] ! date ( enactm5t ( ?is ,act1 
& once e #c ye>s !reaft]1 ! ,comptroll] 
,g5]al ( ! ,unit$ ,/ates %all submit to 

! ,presid5t & ,congress a report t      
surveys ,f$]al data privacy & security  
laws 9 ord] to-- 7#a7 id5tify any       
inconsi/5cy betwe5 ! requirem5ts "u ?is 
,act & ! requirem5ts "u any law relat$  
to ! privacy & security ( p]sonal data2 
7#b7 review ! impact ( ! provisions (   
?is ,act on small bus9esses & provide   
recomm5dations1 if necess>y1 to improve 
compliance & en=cem5t2  7#c7 provide    
recomm5dations on am5d+ ,f$]al data     
privacy & security laws 9 light ( *ang+ 
te*nological & economic tr5ds2 &  7#d7  
detail ! ,f$]al data privacy & security 
en=cem5t activities c>ri$ out by !      
,commission & o!r ,f$]al ag5cies4  #ac4 
,sev]ability ,if any provision ( ?is    
,act or ! application ( su* provision to
 any p]son or circum/ance is held to be 
uncon/itutional1 ! rema9d] ( ?is ,act1 &
 ! application ( ! provision to any o!r 
p]son or circum/ance1 %all n be affect$4
  #ad4 ,effective date ,?is ,act %all   
take effect on ! date t is #a ye> aft] !
 date ( enactm5t ( ?is ,act1 except t   

section #aj %all take effect ^u ! date (
 enactm5t ( ?is ,act4