,,ii #aaf? ,,congress #b;d ,session ,s4 #chfa ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,june #a1 #bjbj,ms4 ,cantwell 7= h]self & ,mr4 ,cassidy7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to e/abli% privacy requirem5ts = op]ators ( infecti\s disease exposure notification s]vices4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,exposure ,notification ,privacy ,act4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,sec4 #b4 ,def9itions4,sec4 #c4 ,public tru/ 9 automat$ exposure notification s]vices4,sec4 #d4 ,volunt>y p>ticipation & transp>5cy4,sec4 #e4 ,data re/rictions4,sec4 #f4 ,data deletion4,sec4 #g4 ,data security4,sec4 #h4 ,fre$om ( movem5t & nondiscrim9ation4,sec4 #i4 ,ov]sight4,sec4 #aj4 ,en=cem5t4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,affirmative express cons5t 7,a7 ,9 g5]al ,! t]m affirmative express cons5t means an affirmative act by an individual t cle>ly communicates ! individual's au?orization = an act or practice1 9 response to a specific reque/ t-- 7i7 is provid$ to ! individual 9 a cle> & conspicu\s disclosure t is sep>ate f o!r options or acceptance ( g5]al t]ms2 & 7ii7 includes a description ( ea* act or practice = :i* ! individual's cons5t is s\ght &-- 7,i7 is writt5 concisely & 9 easy-to-und]/& language2 & 7,,ii7 includes a prom95t head+ t w\ld enable a reasonable individual to id5tify & und]/& ! act or practice4 7,b7 ,express cons5t requir$ ,affirmative express cons5t %all n be inf]r$ f ! inaction ( an individual or ! individual's cont9u$ use ( a s]vice or product4 7,c7 ,volunt>y ,affirmative express cons5t %all be freely giv5 & noncondition$4 7#b7 ,aggregate data ,! t]m aggregate data means in=mation t relates to a gr\p or category ( individuals t is n l9k$ or reasonably l9kable to any individual or device t is l9k$ or reasonably l9kable to an individual1 provid$ t a plat=m op]ator or op]ator ( an automat$ exposure notification s]vice-- 7,a7 takes reasonable measures to safegu>d ! data f reid5tification2 7,b7 publicly commits 9 a conspicu\s mann] n to attempt to reid5tify or associate ! data ) any individual or device l9k$ or reasonably l9kable to an individual2 7,c7 processes ! data = public heal? purposes only2 & 7,d7 contractually requires ! same commitm5t = all transf]s ( ! data4 7#c7 ,au?oriz$ diagnosis ,! t]m au?oriz$ diagnosis means an actual1 pot5tial1 or presumptive positive diagnosis ( an infecti\s disease confirm$ by a public heal? au?ority or a lic5s$ heal? c>e provid]4 7#d7 ,automat$ exposure notification s]vice 7,a7 ,9 g5]al ,! t]m automat$ exposure notification s]vice means a website1 onl9e s]vice1 onl9e application1 mobile application1 or mobile op]at+ sy/em t is (f]$ 9 comm]ce 9 ! ,unit$ ,/ates & t is design$1 9 "p or 9 full1 specifically to be us$ =1 or m>ket$ =1 ! purpose ( digitally notify+1 9 an automat$ mann]1 an individual :o may h become expos$ to an infecti\s disease 7or ! device ( su* individual1 or a p]son or entity t reviews su* disclosures74 7,b7 ,limitations ,su* t]m does n include-- 7i7 any te*nology t a public heal? au?ority uses z a means to facilitate traditional 9-p]son1 email1 or telephonic contact trac+ activities1 or any simil> te*nology t is us$ to assi/ individuals to evaluate if !y are exp]i5c+ symptoms relat$ to an infecti\s disease to ! ext5t ! te*nology is n us$ z an automat$ exposure notification s]vice2 or 7ii7 any plat=m op]ator or s]vice provid] t provides te*nology to facilitate an automat$ exposure notification s]vice to ! ext5t ! te*nology acts only to facilitate su* s]vices & is n itself us$ z an automat$ exposure notification s]vice4 7#e7 ,collect2 collection ,! t]ms collect & collection mean buy+1 r5t+1 ga!r+1 obta9+1 receiv+1 access+1 or o!rwise acquir+ cov]$ data by any means1 includ+ by passively or actively obs]v+ ! behavior ( an individual4 7#f7 ,cov]$ data ,! t]m cov]$ data means any in=mation t is-- 7,a7 l9k$ or reasonably l9kable to any individual or device l9k$ or reasonably l9kable to an individual2 7,b7 n aggregate data2 & 7,c7 collect$1 process$1 or transf]r$ 9 connection ) an automat$ exposure notification s]vice4 7#g7 ,deceptive act or practice ,! t]m deceptive act or practice means a deceptive act or practice 9 violation ( section #e7;a77#a7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#a774 7#h7 ,delete ,! t]m delete means de/roy+1 p]man5tly eras+1 or o!rwise modify+ cov]$ data to make su* cov]$ data p]man5tly unreadable or indeciph]able & unrecov]able4 7#i7 ,executive ag5cy ,! t]m ,executive ag5cy has ! mean+ giv5 su* t]m 9 section #aje ( title #e1 ,unit$ ,/ates ,code4 7#aj7 ,indian tribe ,! t]m ,indian tribe-- 7,a7 has ! mean+ giv5 su* t]m 9 section #d ( ! ,indian ,self-,det]m9ation & ,education ,assi/ance ,act 7#be ,u4,s4,c4 #ecjd72 & 7,b7 includes a ,native ,hawaiian organization z def9$ 9 section #fbjg ( ! ,elem5t>y & ,second>y ,education ,act ( #aife 7#bj ,u4,s4,c4 #geag74 7#aa7 ,op]ator ( an automat$ exposure notification s]vice ,! t]m op]ator ( an automat$ exposure notification s]vice means any p]son or entity t op]ates an automat$ exposure notification s]vice1 o!r ?an a public heal? au?ority1 & t is-- 7,a7 subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 or 7,b7 describ$ 9 section #aj7;a77#d74 7#ab7 ,plat=m op]ator ,! t]m plat=m op]ator means any p]son or entity o!r ?an a s]vice provid] :o provides an op]at+ sy/em t includes features supportive ( an automat$ exposure notification s]vice & facilitates ! use or di/ribution ( su* automat$ exposure notification s]vice to ! ext5t ! te*nology is n us$ by ! plat=m op]ator z an automat$ exposure notification s]vice4 7#ac7 ,process ,! t]m process means any op]ation or set ( op]ations p]=m$ on cov]$ data1 includ+ collection1 analysis1 organization1 /ructur+1 reta9+1 us+1 secur+1 or o!rwise h&l+ cov]$ data4 7#ad7 ,public heal? au?ority ,! t]m public heal? au?ority means an ag5cy or au?ority ( ! ,unit$ ,/ates1 a ,/ate1 a t]ritory1 a political subdivision ( a ,/ate or t]ritory1 or an ,indian tribe t is responsible = public heal? matt]s z "p ( its (ficial m&ate1 or a p]son or entity act+ "u a grant ( au?ority f or contract ) su* public ag5cy4 7#ae7 ,s]vice provid] ,! t]m s]vice provid] means any p]son or entity1 o!r ?an a plat=m op]ator1 t processes or transf]s cov]$ data 9 ! c\rse ( p]=m+ a s]vice or function on behalf (1 & at ! direction (1 a plat=m op]ator1 an op]ator ( an automat$ exposure notification s]vice1 or a public heal? au?ority1 b only to ! ext5t t su* process+ or transf] relates to ! p]=mance ( su* s]vice or function4 7#af7 ,/ate ,! t]m ,/ate means any ( ! sev]al ,/ates1 ! ,di/rict ( ,columbia1 ! ,commonweal? ( ,pu]to ,rico1 ! ,virg9 ,isl&s1 ,guam1 ,am]ican ,samoa1 & ! ,commonweal? ( ! ,nor!rn ,m>iana ,isl&s4 7#ag7 ,transf] ,! t]m transf] means to disclose1 release1 %>e1 dissem9ate1 make available1 all[ access to1 sell1 lic5se1 or o!rwise communicate cov]$ data by any means to a nonaffiliat$ entity or p]son4 #c4 ,public tru/ 9 automat$ exposure notification s]vices 7a7 ,collaboration ) public heal? ,an op]ator ( an automat$ exposure notification s]vice %all collaborate ) a public heal? au?ority 9 ! op]ation ( su* s]vice4 7b7 ,diagnosis in=mation ,an op]ator ( an automat$ exposure notification s]vice may n collect1 process1 or transf] an actual1 pot5tial1 or presumptive positive diagnosis ( an infecti\s disease z "p ( ! automat$ exposure notification s]vice1 unless su* diagnosis is an au?oriz$ diagnosis4 7c7 ,accuracy & reliability ,an op]ator ( an automat$ exposure notification s]vice %all publi%-- 7#a7 guidance = ! public on ! functionality ( ! s]vice & h[ to int]pret ! notifications1 includ+ any limitation ) respect to ! accuracy or reliability ( ! exposure risk2 & 7#b7 measures ( ! effectiv5ess ( ! s]vice (f]$1 includ+ adoption rates4 7d7 ,prev5tion ( deceptive acts or practices ,x %all be unlawful = a plat=m op]ator or an op]ator ( an automat$ exposure notification s]vice to engage 9 a deceptive act or practice conc]n+ an automat$ exposure notification s]vice4 7e7 ,s]vice provid] requirem5t ,:5 a s]vice provid] has actual k t an op]ator ( an automat$ exposure notification s]vice or a public heal? au?ority has engag$ 9 an act or practice t fails to adh]e to ! /&>ds set =? 9 sections #c ?r\gh #h ( ?is ,act1 ! s]vice provid] %all notify ! automat$ exposure notification s]vice or ! public heal? au?ority1 z applicable1 ( ! pot5tial violation or failure to adh]e to su* /&>ds4 #d4 ,volunt>y p>ticipation & transp>5cy 7a7 ,volunt>y p>ticipation 7#a7 ,enrollm5t ) affirmative express cons5t ,an op]ator ( an automat$ exposure notification s]vice-- 7,a7 may n enroll an individual 9 ! automat$ exposure notification s]vice )\t ! individual's prior affirmative express cons5t2 & 7,b7 %all provide an individual ) a cle> & conspicu\s means to )draw affirmative express cons5t to ! individual's enrollm5t 9 ! automat$ exposure notification s]vice4 7#b7 ,"r to id5tify a diagnosis ,an individual ) an au?oriz$ diagnosis %all det]m9e :e!r ! individual's au?oriz$ diagnosis is process$ z "p ( ! automat$ exposure notification s]vice4 7b7 ,notice ( cov]$ data practices ,an op]ator ( an automat$ exposure notification s]vice & a plat=m op]ator %all make publicly & p]si/5tly available1 9 a conspicu\s & readily accessible mann]1 a privacy policy t provides a detail$ & accurate repres5tation ( t p]son or entity's cov]$ data collection1 process+1 & transf] activities 9 connection ) su* p]son or entity's automat$ exposure notification s]vice or ! facilitation ( su* s]vice4 ,su* privacy policy %all include1 at a m9imum-- 7#a7 ! id5tity & ! contact in=mation ( ! p]son or entity1 includ+ ! contact in=mation = ! p]son or entity's repres5tative = privacy & cov]$ data security inquiries2 7#b7 ea* category ( cov]$ data ! p]son or entity collects & ! limit$ all[able process+ purposes = :i* su* cov]$ data is collect$ 9 accordance ) section #e2 7#c7 :e!r ! p]son or entity transf]s cov]$ data = ! limit$ all[able purposes 9 section #e &1 if s1 a detail$ description ( ! data transf]r$1 ! purpose ( ! transf]1 & ! id5tity ( ! recipi5t ( ! transf]2 7#d7 a description ( ! p]son or entity's cov]$ data m9imization & ret5tion policies2 7#e7 h[ an individual c ex]cise ! individual rights describ$ 9 ?is title2 7#f7 a description ( ! p]son or entity's cov]$ data security policies2 & 7#g7 ! effective date ( ! privacy policy4 7c7 ,languages ,a p]son or entity %all make ! privacy policy requir$ "u ?is section available to ! public 9 all ( ! languages 9 :i* ! p]son or entity provides1 or facilitates ! provision (1 an automat$ exposure notification s]vice4 #e4 ,data re/rictions 7a7 ,collection & process+ re/rictions ,an op]ator ( an automat$ exposure notification s]vice may n collect or process any cov]$ data-- 7#a7 beyond ! m9imum am\nt necess>y to implem5t an automat$ exposure notification s]vice = public heal? purposes2 or 7#b7 = any comm]cial purpose4 7b7 ,transf] re/rictions ,an op]ator ( an automat$ exposure notification s]vice may n transf] any cov]$ data1 except-- 7#a7 to provide notification ( a pot5tial exposure to an individual :o has enroll$ 9 ! automat$ exposure notification s]vice2 7#b7 to a public heal? au?ority = public heal? purposes relat$ to an infecti\s disease2 7#c7 to its s]vice provid]1 by contract1 to-- 7,a7 p]=m sy/em ma9t5ance1 debug sy/ems1 or repair any error to ensure ! functionality ( ! automat$ exposure notification s]vice1 provid$ su* process+ is limit$ to ?is purpose2 or 7,b7 detect or respond to a security incid5t1 provide a secure environm5t1 or ma9ta9 ! safety ( ! automat$ exposure notification s]vice1 provid$ su* process is limit$ to ?is purpose2 or 7#d7 to comply ) ! e/abli%m5t1 ex]cise1 or def5se ( a legal claim4 7c7 ,fur!r re/rictions 7#a7 ,9 g5]al ,x %all be unlawful = any p]son1 entity1 or ,executive ag5cy to transf] cov]$ data to any ,executive ag5cy unless ! in=mation is transf]r$ 9 connection ) an inve/igation or en=cem5t proce$+ "u ?is ,act4 7#b7 ,prohibition ,an ,executive ag5cy may n process or transf] cov]$ data1 except-- 7,a7 = a public heal? purpose relat$ to an infecti\s disease2 or 7,b7 9 connection ) an inve/igation or en=cem5t proce$+ "u ?is ,act4 7d7 ,rese>* ,?is section %all n be con/ru$ to prohibit data collection1 process+1 or transf]s to c>ry out rese>*-- 7#a7 conduct$ pursuant to ! ,f$]al policy = ! protection ( human subjects "u "p #df ( title #de1 ,code ( ,f$]al ,regulations2 or 7#b7 = ! developm5t1 manufacture1 or di/ribution ( a drug1 biological product1 or vacc9e t relates to an infecti\s disease conduct$ pursuant to "p #ej ( title #ba1 ,code ( ,f$]al ,regulations4 #f4 ,data deletion 7a7 ,deletion ^u reque/ ,^u ! reque/ ( an individual1 an op]ator ( an automat$ exposure notification s]vice %all delete1 or all[ ! individual to delete1 all cov]$ data ( ! individual t is process$ by ! op]ator4 7b7 ,recurr+ deletion ,an op]ator ( an automat$ exposure notification s]vice %all delete ! cov]$ data ( a p>ticipat+ individual )9 #cj days ( receipt ( su* cov]$ data1 on a roll+ basis1 or at su* times z is consi/5t ) a /&>d publi%$ by a public heal? au?ority )9 an applicable jurisdiction4 7c7 ,applicability to s]vice provid]s ,an op]ator ( an automat$ exposure notification s]vice %all in/ruct any s]vice provid] to :i* ! entity transf]s cov]$ data to delete su* data 9 accordance ) ! requirem5ts ( ?is subsection4 7d7 ,rese>* ,?is section %all n be con/ru$ to prohibit data ret5tion = public heal? rese>* purposes consi/5t ) ! requirem5ts 9 section #e7;d74 #g4 ,data security 7a7 ,9 g5]al ,an op]ator ( an automat$ exposure notification s]vice %all e/abli%1 implem5t1 & ma9ta9 data security practices to protect ! confid5tiality1 integrity1 availability1 & accessibility ( cov]$ data4 ,su* cov]$ data security practices %all be consi/5t ) /&>ds g5]ally accept$ by exp]ts 9 ! in=mation security field4 7b7 ,specific requirem5ts ,cov]$ data security practices requir$ "u subsection 7a7 %all include1 at a m9imum1 ! foll[+3 7#a7 ,assess risks & vuln]abilities ,id5tify+ & assess+ any reasonably =eseeable risks to1 & vuln]abilities 91 ea* sy/em ma9ta9$ by ! p]son or entity t processes or transf]s cov]$ data1 includ+ unau?oriz$ access to or risks to cov]$ data1 human & te*nical vuln]abilities1 access rights1 & use ( s]vice provid]s4 ,su* activities %all include a plan to receive & respond to unsolicit$ reports ( risks & vuln]abilities by entities & individuals1 develop+ & te/+ sy/ems = monitor+ ! security ( cov]$ data1 & resili5ce aga9/ d5ial ( s]vice attacks & malici\s dis9=mation4 7#b7 ,prev5tive & corrective action ,tak+ prev5tive & corrective action to mitigate any risks or vuln]abilities to cov]$ data id5tifi$ by ! p]son or entity1 :i* may include implem5t+ adm9i/rative1 te*nical1 or physical safegu>ds or *anges to cov]$ data security practices or ! ar*itecture1 in/allation1 or implem5tation ( network or op]at+ s(tw>e4 7#c7 ,brea* notification ,ma9ta9+ plans = respond+ to security incid5ts involv+ cov]$ data &1 9 ! mo/ exp$i5t "t possible1 consi/5t ) ! legitimate ne$s ( law en=cem5t1 notify+ any individual ^: data is subject to a security brea*1 z well z ! ,f$]al ,trade ,commission1 ( ! brea*1 ! data involv$1 any reasonably =eseeable impacts ( ! brea* = individuals ^: data is subject to ! brea*1 ! /eps individuals may take to mitigate ^? impacts1 & ! measures ! op]ator ( ! automat$ exposure notification s]vice is tak+ to prev5t a future incid5t4 ,an op]ator ( an automat$ exposure notification s]vice %all require its s]vice provid]s to provide notice to ! op]ator ( ! automat$ exposure notification s]vice ( any brea* ( ! security ( ! cov]$ data imm$iately foll[+ ! discov]y ( ! brea*4 7c7 ,int]f]5ce prohibit$ ,x %all be unlawful = any p]son or entity to transmit signals ) ! int5t to cause an automat$ exposure notification s]vice to produce inaccurate notifications or to o!rwise int]f]e ) ! int5d$ function+ ( su* a s]vice4 #h4 ,fre$om ( movem5t & nondiscrim9ation ,x %all be unlawful = any p]son or entity to segregate1 discrim9ate aga9/1 or o!rwise make unavailable to an individual or class ( individuals ! goods1 s]vices1 facilities1 privileges1 advantages1 or accommodations ( any place ( public accommodation 7z su* t]m is def9$ 9 section #cja ( ! ,am]icans ,) ,disabilities ,act ( #aiij 7#db ,u4,s4,c4 #abaha771 bas$ on cov]$ data collect$ or process$ ?r\gh an automat$ exposure notification s]vice or an individual's *oice to use or n use an automat$ exposure notification s]vice4 #i4 ,ov]sight 7a7 ,9 g5]al ,section #ajfa ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee7 is am5d$-- 7#a7 9 subsection 7c7-- 7,a7 9 p>agraph 7#a71 by ins]t+ or to respond to heal?-relat$ epidemics aft] f t]rorism2 & 7,b7 9 p>agraph 7#b71 by ins]t+ or to respond to heal?-relat$ epidemics aft] aga9/ t]rorism2 & 7#b7 9 subsection 7d7-- 7,a7 9 p>agraph 7#a71 by ins]t+ or to respond to heal?-relat$ epidemics aft] f t]rorism ea* place x appe>s2 & 7,b7 9 p>agraph 7#b7-- 7i7 9 subp>agraph 7,b71 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,c71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,d7 ! collection1 use1 /orage1 & %>+ ( cov]$ data by ,f$]al1 ,/ate1 or local gov]nm5t 9 connection ) respond+ to a ,f$]al decl>ation ( a public heal? em]g5cy to ensure t privacy & civil lib]ties are protect$4 4 7b7 ,reports ,section #ajfa7;e7 ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee7e77 is am5d$ by add+ at ! end ! foll[+3 7#c7 ,report on ,,covid-#ai mitigation activities ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is p>agraph1 ! ,bo>d %all issue a report1 :i* %all be publicly available to ! greate/ ext5t possible1 assess+ ! impact on privacy & civil lib]ties ( ,gov]nm5t activities 9 response to ! public heal? em]g5cy relat$ to ! ,coronavirus #bjai 7,,covid-#ai71 & mak+ recomm5dations = h[ ! ,gov]nm5t %\ld mitigate ! ?reats pos$ by su* em]g5cy4 7#d7 ,reports on public heal? em]g5cy response ,n lat] ?an #a ye> aft] any ,f$]al em]g5cy or disa/] decl>ation relat$ to public heal?1 or n lat] ?an #a ye> aft] ! t]m9ation ( su* decl>ation1 ! ,bo>d %all issue a report1 :i* %all be publicly available to ! greate/ ext5t possible1 assess+ ! impact on privacy & civil lib]ties ( ,gov]nm5t activities 9 response to su* em]g5cy or disa/]1 & mak+ recomm5dations = h[ ! ,gov]nm5t %\ld mitigate ! ?reats pos$ by su* em]g5cy or disa/]4 4 #aj4 ,en=cem5t 7a7 ,en=cem5t by ! ,f$]al ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,p[]s ( ! ,commission 7,a7 ,9 g5]al ,except z provid$ 9 p>agraphs 7#c7 & 7#d7 ( ?is subsection1 ! ,f$]al ,trade ,commission 7ref]r$ to 9 ?is ,act z ! ,commission7 %all en=ce ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 7,b7 ,privileges & immunities ,any p]son :o violates ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act4 7,c7 ,effect on o!r laws ,no?+ 9 ?is ,act %all be con/ru$ to limit ! au?ority ( ! ,commission "u any o!r provision ( law4 7#c7 ,indep5d5t litigation au?ority ,not)/&+ section #af ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #ef71 ! ,commission may comm5ce1 def5d1 or int]v5e 91 & sup]vise ! litigation (1 any civil action "u ?is ,act 7includ+ an action to collect a civil p5alty7 & any appeal ( su* action 9 its own "n by any ( its attorneys designat$ by x = su* purpose4 ,! ,commission %all notify ! ,attorney ,g5]al ( any su* action & may consult ) ! ,attorney ,g5]al ) respect to any su* action or reque/ ! ,attorney ,g5]al on behalf ( ! ,commission to comm5ce1 def5d1 or int]v5e 9 any su* action4 7#d7 ,nonpr(it organizations & communications common c>ri]s ,not)/&+ section #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any o!r jurisdictional limitation ( ! ,commission1 ! ,commission %all also en=ce ?is ,act 9 ! same mann] provid$ 9 p>agraphs 7#a71 7#b71 & 7#c7 ( ?is subsection1 ) respect to-- 7,a7 any organization n organiz$ to c>ry on bus9ess = ! organization's own pr(it or t ( ! organization's memb]s2 & 7,b7 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto4 7b7 ,en=cem5t by ,/ate attorneys g5]al 7#a7 ,9 g5]al ,if ! *ief law en=cem5t (fic] ( a ,/ate1 or an (ficial or ag5cy designat$ by a ,/ate1 has reason to believe t any p]son has violat$ or is violat+ ?is ,act1 ! attorney g5]al1 (ficial1 or ag5cy ( ! ,/ate1 9 addition to any au?ority x may h to br+ an action 9 ,/ate c\rt "u its consum] protection law1 may br+ a civil action 9 any appropriate ,unit$ ,/ates di/rict c\rt or 9 any o!r c\rt ( compet5t jurisdiction1 includ+ a ,/ate c\rt1 to-- 7,a7 enjo9 fur!r su* violation by su* p]son2 7,b7 en=ce compliance ) ?is ,act2 7,c7 obta9 civil p5alties2 & 7,d7 obta9 damages1 re/itution1 or o!r comp5sation on behalf ( resid5ts ( ! ,/ate4 7#b7 ,notice & int]v5tion by ! ,,ftc ,! attorney g5]al ( a ,/ate %all provide prior writt5 notice ( any action "u p>agraph 7#a7 to ! ,commission & provide ! ,commission ) a copy ( ! compla9t 9 ! action1 except 9 any case 9 :i* su* prior notice is n feasible1 9 :i* case ! attorney g5]al %all s]ve su* notice imm$iately ^u in/itut+ su* action4 ,! ,commission %all h ! "r-- 7,a7 to int]v5e 9 ! action2 7,b7 ^u s int]v5+1 to be he>d on all matt]s aris+ !re92 & 7,c7 to file petitions = appeal4 7#c7 ,relation%ip ) ,/ate law claims ,if ! attorney g5]al ( a ,/ate has au?ority to br+ an action "u ,/ate law direct$ at any act or practice t also violates ?is ,act1 ! attorney g5]al may ass]t ! ,/ate law claim & a claim "u ?is ,act 9 ! same civil action4 7c7 ,/ate law pres]vation ,no?+ 9 ?is ,act %all be con/ru$ to preempt1 displace1 or supplant any ,/ate law1 rule1 regulation1 or requirem5t1 includ+-- 7#a7 any consum] protection law ( g5]al applicability su* z any law regulat+ deceptive1 unfair1 or unconscionable practices2 7#b7 any heal? privacy or infecti\s disease law2 7#c7 any civil rights law2 7#d7 any law t gov]ns ! privacy rights or o!r protections ( employees1 employee in=mation1 or /ud5ts or /ud5t in=mation2 7#e7 any law t addresses notification requirem5ts 9 ! ev5t ( a cov]$ data brea*2 7#f7 contract or tort law2 7#g7 any crim9al law gov]n+ fraud1 !ft1 unau?oriz$ access to in=mation or unau?oriz$ use ( in=mation1 malici\s behavior1 & simil> provisions1 & any law ( crim9al proc$ure2 7#h7 any law specify+ a rem$y or a cause ( action to an individual2 or 7#i7 any public safety or sector-specific law unrelat$ to privacy or security4 7d7 ,pres]vation ( common law or /atutory causes ( action = civil relief ,no?+ 9 ?is ,act1 nor any am5dm5t1 /&>d1 rule1 requirem5t1 assessm5t1 law1 or regulation promulgat$ "u ?is ,act1 %all be con/ru$ to preempt1 displace1 or supplant any ,f$]al or ,/ate common law "r or rem$y1 or any /atute creat+ a rem$y = civil relief1 includ+ any cause ( action = p]sonal injury1 wrongful dea?1 prop]ty damage1 or o!r f9ancial1 physical1 reputational1 or psy*ological injury bas$ 9 neglig5ce1 /rict liability1 products liability1 failure to w>n1 an objectively (f5sive intrusion into ! private affairs or conc]ns ( ! individual1 or any o!r legal !ory ( liability "u any ,f$]al or ,/ate common law1 or any ,/ate /atutory law4 7e7 ,sev]ability ,if any provision ( ?is ,act1 or ! application !re( to any p]son or entity or circum/ance1 is held invalid1 ! rema9d] ( ?is ,act & ! application ( su* provision to o!r p]sons or entities n simil>ly situat$ or to o!r circum/ances %all n be affect$ by ! invalidation4 7f7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ su* sums z are necess>y to c>ry out ?is ,act & ! am5dm5ts made by ?is ,act4 7g7 ,effective date ,?is ,act & ! am5dm5ts made by ?is ,act %all take effect on ! date ( ! enactm5t ( ?is ,act4