,,ii #aafth ,,congress #b;d ,session ,s4 #dfbf ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #ag1 #bjbj ,mr4 ,wicker 7for himself1 ,mr4 ,thune1 ,mrs4 ,blackburn1 and ,mrs4 ,fischer7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish data privacy and data security protections for consumers in the ,united ,states4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,setting an ,american ,framework to ,ensure ,data ,access1 ,transparency1 and ,accountability ,act or the ,,safe ,,data ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,effective date4 ,,title ,i--,individual consumer data rights ,sec4 #aja4 ,consumer loyalty4 ,sec4 #ajb4 ,transparency4 ,sec4 #ajc4 ,individual control4 ,sec4 #ajd4 ,rights to consent4 ,sec4 #aje4 ,minimizing data collection1 processing1 and retention4 ,sec4 #ajf4 ,service providers and third parties4 ,sec4 #ajg4 ,privacy impact assessments4 ,sec4 #ajh4 ,scope of coverage4 ,,title ,,ii--,data transparency1 integrity1 and security ,sec4 #bja4 ,algorithm bias1 detection1 and mitigation4 ,sec4 #bjb4 ,digital content forgeries4 ,sec4 #bjc4 ,data brokers4 ,sec4 #bjd4 ,protection of covered data4 ,sec4 #bje4 ,filter bubble transparency4 ,sec4 #bjf4 ,unfair and deceptive acts and practices relating to the manipulation of user interfaces4 ,,title ,,iii--,corporate accountability ,sec4 #cja4 ,designation of data privacy officer and data security officer4 ,sec4 #cjb4 ,internal controls4 ,sec4 #cjc4 ,whistleblower protections4 ,,title ,,iv--,enforcement authority and new programs ,sec4 #dja4 ,enforcement by the ,federal ,trade ,commission4 ,sec4 #djb4 ,enforcement by ,state attorneys general4 ,sec4 #djc4 ,authority of ,commission to seek permanent injunction and other equitable remedies4 ,sec4 #djd4 ,approved certification programs4 ,sec4 #dje4 ,relationship between ,federal and ,state law4 ,sec4 #djf4 ,constitutional avoidance4 ,sec4 #djg4 ,severability4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative express consent ,the term affirmative express consent means1 upon being presented with a clear and conspicuous description of an act or practice for which consent is sought1 an affirmative act by the individual clearly communicating the individual's authorization for the act or practice4 7#b7 ,algorithm ,the term algorithm means a computational process derived from machine learning1 statistics1 or other data processing or artificial intelligence techniques1 that processes covered data for the purpose of making a decision or facilitating human decision making4 7#c7 ,algorithmic ranking system ,the term algorithmic ranking system means a computational process1 including one derived from algorithmic decision making1 machine learning1 statistical analysis1 or other data processing or artificial intelligence techniques1 used to determine the order or manner that a set of information is provided to a user on a covered internet platform1 including the ranking of search results1 the provision of content recommendations1 the display of social media posts1 or any other method of automated content selection4 7#d7 ,behavioral or psychological experiments or research ,the term behavioral or psychological experiments or research means the study1 including through human experimentation1 of overt or observable actions and mental phenomena inferred from behavior1 including interactions between and among individuals and the activities of social groups4 7#e7 ,collection ,the term collection means buying1 renting1 gathering1 obtaining1 receiving1 or accessing any covered data of an individual by any means4 7#f7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#g7 ,common branding ,the term common branding means a shared name1 servicemark1 or trademark4 7#h7 ,compulsive usage ,the term compulsive usage means any response stimulated by external factors that causes an individual to engage in repetitive1 purposeful1 and intentional behavior causing psychological distress1 loss of control1 anxiety1 depression1 or harmful stress responses4 7#i7 ,connected device ,for purposes of paragraphs 7#bj7 and 7#cg71 the term connected device means a physical object that-- 7,a7 is capable of connecting to the internet1 either directly or indirectly through a network1 to communicate information at the direction of an individual2 and 7,b7 has computer processing capabilities for collecting1 sending1 receiving1 or analyzing data4 7#aj7 ,covered data 7,a7 ,in general ,the term covered data means information that identifies or is linked or reasonably linkable to an individual or a device that is linked or reasonably linkable to an individual4 7,b7 ,linked or reasonably linkable ,for purposes of subparagraph 7,a71 information held by a covered entity is linked or reasonably linkable to an individual or a device if1 as a practical matter1 it can be used on its own or in combination with other information held by1 or readily accessible to1 the covered entity to identify such individual or such device4 7,c7 ,exclusions ,such term does not include-- 7i7 aggregated data2 7ii7 de-identified data2 7iii7 employee data2 or 7iv7 publicly available information4 7,d7 ,aggregated data ,for purposes of subparagraph 7,c71 the term aggregated data means information that relates to a group or category of individuals or devices that does not identify and is not linked or reasonably linkable to any individual4 7,e7 ,de-identified data ,for purposes of subparagraph 7,c71 the term de-identified data means information held by a covered entity that-- 7i7 does not identify1 and is not linked or reasonably linkable to1 an individual or device2 7ii7 does not contain any persistent identifier or other information that could readily be used to re-identify the individual to whom1 or the device to which1 the identifier or information pertains2 7iii7 is subject to a public commitment by the covered entity-- 7,i7 to refrain from attempting to use such information to identify any individual or device2 and 7,,ii7 to adopt technical and organizational measures to ensure that such information is not linked to any individual or device2 and 7iv7 is not disclosed by the covered entity to any other party unless the disclosure is subject to a contractually or other legally binding requirement that-- 7,i7 the recipient of the information shall not use the information to identify any individual or device2 and 7,,ii7 all onward disclosures of the information shall be subject to the requirement described in subclause 7,i74 7,f7 ,employee data ,for purposes of subparagraph 7,c71 the term employee data means-- 7i7 information relating to an individual collected by a covered entity in the course of the individual acting as a job applicant to1 or employee 7regardless of whether such employee is paid or unpaid1 or employed on a temporary basis71 owner1 director1 officer1 staff member1 trainee1 vendor1 visitor1 volunteer1 intern1 or contractor of1 the entity1 provided that such information is collected1 processed1 or transferred by the covered entity solely for purposes related to the individual's status as a current or former job applicant to1 or an employee1 owner1 director1 officer1 staff member1 trainee1 vendor1 visitor1 volunteer1 intern1 or contractor of1 that covered entity2 7ii7 business contact information of an individual1 including the individual's name1 position or title1 business telephone number1 business address1 business email address1 qualifications1 and other similar information1 that is provided to a covered entity by an individual who is acting in a professional capacity1 provided that such information is collected1 processed1 or transferred solely for purposes related to such individual's professional activities2 7iii7 emergency contact information collected by a covered entity that relates to an individual who is acting in a role described in clause 7i7 with respect to the covered entity1 provided that such information is collected1 processed1 or transferred solely for the purpose of having an emergency contact on file for the individual2 or 7iv7 information relating to an individual 7or a relative or beneficiary of such individual7 that is necessary for the covered entity to collect1 process1 or transfer for the purpose of administering benefits to which such individual 7or relative or beneficiary of such individual7 is entitled on the basis of the individual acting in a role described in clause 7i7 with respect to the entity1 provided that such information is collected1 processed1 or transferred solely for the purpose of administering such benefits4 7,g7 ,publicly available information 7i7 ,in general ,for the purposes of subparagraph 7,c71 the term publicly available information means any information that a covered entity has a reasonable basis to believe-- 7,i7 has been lawfully made available to the general public from ,federal1 ,state1 or local government records2 7,,ii7 is widely available to the general public1 including information from-- 7aa7 a telephone book or online directory2 7bb7 television1 internet1 or radio content or programming2 or 7cc7 the news media or a website that is lawfully available to the general public on an unrestricted basis 7for purposes of this subclause a website is not restricted solely because there is a fee or log-in requirement associated with accessing the website72 or 7,,iii7 is a disclosure to the general public that is required to be made by ,federal1 ,state1 or local law4 7ii7 ,exclusions ,such term does not include an obscene visual depiction 7as defined for purposes of section #adfj of title #ah1 ,united ,states ,code74 7#aa7 ,covered entity ,the term covered entity means any person that-- 7,a7 is subject to the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 or is-- 7i7 a common carrier described in section #e7;a77#b7 of such ,act 7#ae ,u4,s4,c4 #de7;a77#b772 or 7ii7 an organization not organized to carry on business for their own profit or that of their members2 7,b7 collects1 processes1 or transfers covered data2 and 7,c7 determines the purposes and means of such collection1 processing1 or transfer4 7#ab7 ,covered internet platform 7,a7 ,in general ,the term covered internet platform means any public-facing website1 internet application1 or mobile application1 including a social network site1 video sharing service1 search engine1 or content aggregation service4 7,b7 ,exclusions ,such term shall not include a platform that-- 7i7 is wholly owned1 controlled1 and operated by a person that-- 7,i7 for the most recent #f-month period1 did not employ more than #ejj employees2 7,,ii7 for the most recent #c-year period1 averaged less than #ej1jjj1jjj in annual gross receipts2 and 7,,iii7 collects or processes on an annual basis the personal data of less than #a1jjj1jjj individuals2 or 7ii7 is operated for the sole purpose of conducting research that is not made for profit either directly or indirectly4 7#ac7 ,data ,broker 7,a7 ,in general ,the term data broker means a covered entity whose principal source of revenue is derived from processing or transferring the covered data of individuals with whom the entity does not have a direct relationship on behalf of third parties for such third parties' use4 7,b7 ,exclusion ,such term does not include a service provider4 7#ad7 ,delete ,the term delete means to remove or destroy information such that it is not maintained in human or machine readable form and cannot be retrieved or utilized in such form in the normal course of business4 7#ae7 ,executive agency ,the term ,executive agency has the meaning set forth in section #aje of title #e1 ,united ,states ,code4 7#af7 ,independent review board ,the term independent review board means a board1 committee1 or other group formally designated by a large online operator to review1 to approve the initiation of1 and to conduct periodic review of1 any research by1 or at the direction or discretion of a large online operator1 involving human subjects4 7#ag7 ,individual ,the term individual means a natural person residing in the ,united ,states4 7#ah7 ,inferred data ,the term inferred data means information that is created by a covered entity through the derivation of information1 data1 assumptions1 or conclusions from facts1 evidence1 or another source of information or data4 7#ai7 ,informed consent ,for purposes of section #bjf1 the term informed consent-- 7,a7 means a process by which a research subject is provided adequate information prior to being included in any experiment or study to allow for an informed decision about voluntary participation in a behavioral or psychological research experiment or study1 while ensuring the understanding of the potential participant of the furnished information and any associated benefits1 risks1 or consequences of participation prior to obtaining the voluntary agreement to participate by the participant2 and 7,b7 does not include-- 7i7 the consent of an individual under the age of #ac2 or 7ii7 the consent to a provision contained in a general contract or service agreement4 7#bj7 ,input-transparent algorithm 7,a7 ,in general ,for purposes of section #bje1 the term input-transparent algorithm means an algorithmic ranking system that does not use the user-specific data of a user to determine the order or manner that information is furnished to such user on a covered internet platform1 unless the user-specific data is expressly provided to the platform by the user for such purpose4 7,b7 ,inclusion of age-appropriate content filters ,such term shall include an algorithmic ranking system that uses user-specific data to determine whether a user is old enough to access age-restricted content on a covered internet platform1 provided that the system otherwise meets the requirements of subparagraph 7,a74 7,c7 ,data provided for express purpose of interaction with platform ,for purposes of subparagraph 7,a71 user-specific data that is provided by a user for the express purpose of determining the order or manner that information is furnished to a user on a covered internet platform-- 7i7 shall include user-supplied search terms1 filters1 speech patterns 7if provided for the purpose of enabling the platform to accept spoken input or selecting the language in which the user interacts with the platform71 saved preferences1 and the user's current geographical location2 7ii7 shall include data supplied to the platform by the user that expresses the user's desire that information be furnished to them1 such as the social media profiles the user follows1 the video channels the user subscribes to1 or other sources of content on the platform the user follows2 7iii7 shall not include the history of the user's connected device1 including the user's history of web searches and browsing1 geographical locations1 physical activity1 device interaction1 and financial transactions2 and 7iv7 shall not include inferences about the user or the user's connected device1 without regard to whether such inferences are based on data described in clause 7i74 7#ba7 ,large data holder ,the term large data holder means a covered entity that in the most recent calendar year-- 7,a7 processed or transferred the covered data of more than #h1jjj1jjj individuals2 or 7,b7 processed or transferred the sensitive covered data of more than #cjj1jjj individuals or devices that are linked or reasonably linkable to an individual 7excluding any instance where the covered entity processes the log-in information of an individual or device to allow the individual or device to log in to an account administered by the covered entity74 7#bb7 ,large online operator ,for purposes of section #bjf1 the term large online operator means any person that-- 7,a7 provides an online service2 7,b7 has more than #ajj1jjj1jjj authenticated users of an online service in any #cj-;day period2 and 7,c7 is subject to the jurisdiction of the ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#bc7 ,material ,the term material means1 with respect to an act1 practice1 or representation of a covered entity 7including a representation made by the covered entity in a privacy policy or similar disclosure to individuals71 that such act1 practice1 or representation is likely to affect an individual's decision or conduct regarding a product or service4 7#bd7 ,online service ,for purposes of section #bjf1 the term online service means a website or a service1 other than an internet access service1 that is made available to the public over the internet1 including a social network1 a search engine1 or email service4 7#be7 ,opaque algorithm 7,a7 ,in general ,the term opaque algorithm means an algorithmic ranking system that determines the order or manner that information is furnished to a user on a covered internet platform based1 in whole or part1 on user-specific data that was not expressly provided by the user to the platform for such purpose4 7,b7 ,exception for age-appropriate content filters ,such term shall not include an algorithmic ranking system used by a covered internet platform if-- 7i7 the only user-specific data 7including inferences about the user7 that the system uses is information relating to the age of the user2 and 7ii7 such information is only used to restrict a user's access to content on the basis that the individual is not old enough to access such content4 7#bf7 ,process ,the term process means any operation or set of operations performed on covered data including analysis1 organization1 structuring1 retaining1 using1 or otherwise handling covered data4 7#bg7 ,processing purpose ,the term processing purpose means a reason for which a covered entity processes covered data4 7#bh7 ,research ,the term research means the scientific analysis of information1 including covered data1 by a covered entity or those with whom the covered entity is cooperating or others acting at the direction or on behalf of the covered entity1 that is conducted for the primary purpose of advancing scientific knowledge and may be for the commercial benefit of the covered entity4 7#bi7 ,search syndication contract2 upstream provider2 downstream provider 7,a7 ,search syndication contract ,the term search syndication contract means a contract or subcontract for the sale1 license1 or other right to access an index of web pages on the internet for the purpose of operating an internet search engine4 7,b7 ,upstream provider ,the term upstream provider means1 with respect to a search syndication contract1 the person that grants access to an index of web pages on the internet to a downstream provider under the contract4 7,c7 ,downstream provider ,the term downstream provider means1 with respect to a search syndication contract1 the person that receives access to an index of web pages on the internet from an upstream provider under such contract4 7#cj7 ,sensitive covered data 7,a7 ,in general ,the term sensitive covered data means any of the following forms of covered data of an individual3 7i7 ,a unique1 government-issued identifier1 such as a ,social ,security number1 passport number1 or driver's license number1 that is not required to be displayed to the public4 7ii7 ,any covered data that describes or reveals the diagnosis or treatment of the past1 present1 or future physical health1 mental health1 or disability of an individual4 7iii7 ,a financial account number1 debit card number1 credit card number1 or any required security or access code1 password1 or credentials allowing access to any such account4 7iv7 ,covered data that is biometric information4 7v7 ,a persistent identifier4 7vi7 ,precise geolocation information4 7vii7 ,the contents of an individual's private communications1 such as emails1 texts1 direct messages1 or mail1 or the identity of the parties subject to such communications1 unless the covered entity is the intended recipient of the communication4 7viii7 ,account log-in credentials such as a user name or email address1 in combination with a password or security question and answer that would permit access to an online account4 7ix7 ,covered data revealing an individual's racial or ethnic origin1 or religion in a manner inconsistent with the individual's reasonable expectation regarding the processing or transfer of such information4 7x7 ,covered data revealing the sexual orientation or sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the processing or transfer of such information4 7xi7 ,covered data about the online activities of an individual that addresses or reveals a category of covered data described in another subparagraph of this paragraph4 7xii7 ,covered data that is calendar information1 address book information1 phone or text logs1 photos1 or videos maintained for private use on an individual's device4 7xiii7 ,any covered data collected or processed by a covered entity for the purpose of identifying covered data described in another clause of this paragraph4 7xiv7 ,any other category of covered data designated by the ,commission pursuant to a rulemaking under section #eec of title #e1 ,united ,states ,code4 7,b7 ,biometric information ,for purposes of subparagraph 7,a71 the term biometric information-- 7i7 means the physiological or biological characteristics of an individual1 including deoxyribonucleic acid1 that are used1 singly or in combination with each other or with other identifying data1 to establish the identity of an individual2 and 7ii7 includes-- 7,i7 imagery of the iris1 retina1 fingerprint1 face1 hand1 palm1 vein patterns1 and voice recordings1 from which an identifier template1 such as a faceprint1 a minutiae template1 or a voiceprint1 can be extracted2 and 7,,ii7 keystroke patterns or rhythms1 gait patterns or rhythms1 and sleep1 health1 or exercise data that contain identifying information4 7,c7 ,persistent identifier ,for purposes of subparagraph 7,a71 the term persistent identifier means a technologically derived identifier that identifies an individual1 or is linked or reasonably linkable to an individual over time and across services and platforms1 which may include a customer number held in a cookie1 a static ,internet ,protocol address1 a processor or device serial number1 or another unique device identifier4 7,d7 ,precise geolocation information ,for purposes of subparagraph 7,a71 the term precise geolocation information means technologically derived information capable of determining the past or present actual physical location of an individual or an individual's device at a specific point in time to within #a1gej feet4 7#ca7 ,service provider ,the term service provider means1 with respect to a set of covered data1 a covered entity that processes or transfers such covered data for the purpose of performing one or more services or functions on behalf of1 and at the direction of1 another covered entity that-- 7,a7 is not related to the covered entity providing the service or function by common ownership or corporate control2 and 7,b7 does not share common branding with the covered entity providing the service or function4 7#cb7 ,service provider data ,the term service provider data means1 with respect to a set of covered data and a service provider1 covered data that is collected by the service provider on behalf of a covered entity or transferred to the service provider by a covered entity for the purpose of allowing the service provider to perform a service or function on behalf of1 and at the direction of1 such covered entity4 7#cc7 ,third party ,the term third party means1 with respect to a set of covered data1 a covered entity-- 7,a7 that is not a service provider with respect to such covered data2 and 7,b7 that received such covered data from another covered entity-- 7i7 that is not related to the covered entity by common ownership or corporate control2 and 7ii7 that does not share common branding with the covered entity4 7#cd7 ,third party data ,the term third party data means1 with respect to a third party1 covered data that has been transferred to the third party by a covered entity4 7#ce7 ,transfer ,the term transfer means to disclose1 release1 share1 disseminate1 make available1 or license in writing1 electronically1 or by any other means for consideration of any kind or for a commercial purpose4 7#cf7 ,user data ,for purposes of section #bjf1 the term user data means any information relating to an identified or identifiable individual user1 whether directly submitted to the large online operator by the user1 or derived from the observed activity of the user by the large online operator4 7#cg7 ,user-specific data ,for purposes of section #bje1 the term user-specific data means information relating to an individual or a specific connected device that would not necessarily be true of every individual or device4 #c4 ,effective date ,except as otherwise provided in this ,act1 this ,act shall take effect #ah months after the date of enactment of this ,act4 ,i ,individual consumer data rights #aja4 ,consumer loyalty 7a7 ,prohibition on the denial of products or services 7#a7 ,in general ,subject to paragraph 7#b71 a covered entity shall not deny products or services to an individual because the individual exercises a right established under subparagraph 7,a71 7,b71 or 7,d7 of section #ajc7;a77#a74 7#b7 ,rules of application ,a covered entity-- 7,a7 shall not be in violation of paragraph 7#a7 with respect to a product or service and an individual if the exercise of a right described in such paragraph by the individual precludes the covered entity from providing such product or service to such individual2 and 7,b7 may offer different types of pricing and functionalities with respect to a product or service based on an individual's exercise of a right described in such paragraph4 7b7 ,no waiver of individual controls ,the rights and obligations created under section #ajc may not be waived in an agreement between a covered entity and an individual4 #ajb4 ,transparency 7a7 ,in general ,a covered entity that processes covered data shall1 with respect to such data1 publish a privacy policy that is-- 7#a7 disclosed1 in a clear and conspicuous manner1 to an individual prior to or at the point of the collection of covered data from the individual2 and 7#b7 made available1 in a clear and conspicuous manner1 to the public4 7b7 ,content of privacy policy ,the privacy policy required under subsection 7a7 shall include the following3 7#a7 ,the identity and the contact information of the covered entity 7including the covered entity's points of contact for privacy and data security inquiries7 and the identity of any affiliate to which covered data may be transferred by the covered entity4 7#b7 ,the categories of covered data the covered entity collects4 7#c7 ,the processing purposes for each category of covered data the covered entity collects4 7#d7 ,whether the covered entity transfers covered data1 the categories of recipients to whom the covered entity transfers covered data1 and the purposes of the transfers4 7#e7 ,a general description of the covered entity's data retention practices for covered data and the purposes for such retention4 7#f7 ,how individuals can exercise their rights under section #ajc4 7#g7 ,a general description of the covered entity's data security practices4 7#h7 ,the effective date of the privacy policy4 7c7 ,languages ,a privacy policy required under subsection 7a7 shall be made available in all of the languages in which the covered entity provides a product or service that is subject to the policy1 or carries out activities related to such product or service4 7d7 ,material changes ,if a covered entity makes a material change to its privacy policy1 it shall notify the individuals affected before further processing or transferring of previously collected covered data and provide an opportunity to withdraw consent to further processing or transferring of the covered data under the changed policy4 ,the covered entity shall provide direct notification1 where possible1 regarding a material change to the privacy policy to affected individuals1 taking into account available technology and the nature of the relationship4 7e7 ,application to indirect transfers ,where the ownership of an individual's device is transferred directly from one individual to another individual1 a covered entity may satisfy its obligation to disclose a privacy policy prior to or at the point of collection of covered data by making the privacy policy available under subsection 7a77#b74 #ajc4 ,individual control 7a7 ,access to1 and correction1 deletion1 and portability of1 covered data 7#a7 ,in general ,subject to paragraphs 7#b7 and 7#c71 a covered entity shall provide an individual1 immediately or as quickly as possible and in no case later than #ij days after receiving a verified request from the individual1 with the right to reasonably-- 7,a7 access-- 7i7 the covered data of the individual1 or an accurate representation of the covered data of the individual1 that is or has been processed by the covered entity or any service provider of the covered entity2 7ii7 if applicable1 a list of categories of third parties and service providers to whom the covered entity has transferred the covered data of the individual2 and 7iii7 if a covered entity transfers covered data1 a description of the purpose for which the covered entity transferred the covered data of the individual to a service provider or third party2 7,b7 request that the covered entity-- 7i7 correct material inaccuracies or materially incomplete information with respect to the covered data of the individual that is maintained by the covered entity2 and 7ii7 notify any service provider or third party to which the covered entity transferred such covered data of the corrected information2 7,c7 request that the covered entity-- 7i7 either delete or de-identify covered data of the individual that is or has been maintained by the covered entity2 and 7ii7 notify any service provider or third party to which the covered entity transferred such covered data of the individual's request1 unless the transfer of such data to the third party was made at the direction of the individual2 and 7,d7 to the extent that is technically feasible1 provide covered data of the individual that is or has been generated and submitted to the covered entity by the individual and maintained by the covered entity in a portable1 structured1 and machine-readable format that is not subject to licensing restrictions4 7#b7 ,frequency and cost of access ,a covered entity shall-- 7,a7 provide an individual with the opportunity to exercise the rights described in paragraph 7#a7 not less than twice in any #ab-month period2 and 7,b7 with respect to the first #b times that an individual exercises the rights described in paragraph 7#a7 in any #ab-month period1 allow the individual to exercise such rights free of charge4 7#c7 ,exceptions ,a covered entity-- 7,a7 shall not comply with a request to exercise the rights described in paragraph 7#a7 if the covered entity cannot verify that the individual making the request is the individual to whom the covered data that is the subject of the request relates2 7,b7 may decline to comply with a request that would-- 7i7 require the covered entity to retain any covered data for the sole purpose of fulfilling the request2 7ii7 be impossible or demonstrably impracticable to comply with2 or 7iii7 require the covered entity to combine1 relink1 or otherwise re-identify covered data that has been de-identified2 7iv7 result in the release of trade secrets1 or other proprietary or confidential data or business practices2 7v7 interfere with law enforcement1 judicial proceedings1 investigations1 or reasonable efforts to guard against1 detect1 or investigate malicious or unlawful activity1 or enforce contracts2 7vi7 require disproportionate effort1 taking into consideration available technology1 or would not be reasonably feasible on technical grounds2 7vii7 compromise the privacy1 security1 or other rights of the covered data of another individual2 7viii7 be excessive or abusive to another individual2 or 7ix7 violate ,federal or ,state law or the rights and freedoms of another individual1 including under the ,constitution of the ,united ,states2 and 7,c7 may delete covered data instead of providing access and correction rights under subparagraphs 7,a7 and 7,b7 of paragraph 7#a7 if such covered data-- 7i7 is not sensitive covered data2 and 7ii7 is used only for the purposes of contacting individuals with respect to marketing communications4 7b7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 establishing requirements for covered entities with respect to the verification of requests to exercise rights described in subsection 7a77#a74 #ajd4 ,rights to consent 7a7 ,consent ,except as provided in section #ajh1 a covered entity shall not1 without the prior1 affirmative express consent of an individual-- 7#a7 transfer sensitive covered data of the individual to a third party2 or 7#b7 process sensitive covered data of the individual4 7b7 ,requirements for affirmative express consent ,in obtaining the affirmative express consent of an individual to process the sensitive covered data of the individual as required under subsection 7a77#b71 a covered entity shall provide the individual with notice that shall-- 7#a7 include a clear description of the processing purpose for which the sensitive covered data will be processed2 7#b7 clearly identify any processing purpose that is necessary to fulfill a request made by the individual2 7#c7 include a prominent heading that would enable a reasonable individual to easily identify the processing purpose for which consent is sought2 and 7#d7 clearly explain the individual's right to provide or withhold consent4 7c7 ,requirements related to minors ,a covered entity shall not transfer the covered data of an individual to a third party without affirmative express consent from the individual or the individual's parent or guardian if the covered entity has actual knowledge that the individual is between #ac and #af years of age4 7d7 ,right ,to opt out ,except as provided in section #ajh1 a covered entity shall provide an individual with the ability to opt out of the collection1 processing1 or transfer of such individual's covered data before such collection1 processing1 or transfer occurs4 7e7 ,prohibition on inferred consent ,a covered entity shall not infer that an individual has provided affirmative express consent to a processing purpose from the inaction of the individual or the individual's continued use of a service or product provided by the covered entity4 7f7 ,withdrawal of consent ,a covered entity shall provide an individual with a clear and conspicuous means to withdraw affirmative express consent4 7g7 ,rulemaking ,the ,commission may promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to establish requirements for covered entities regarding clear and conspicuous procedures for allowing individuals to provide or withdraw affirmative express consent for the collection of sensitive covered data4 #aje4 ,minimizing data collection1 processing1 and retention 7a7 ,in general ,a covered entity shall not collect1 process1 or transfer covered data beyond-- 7#a7 what is reasonably necessary1 proportionate1 and limited to provide or improve a product1 service1 or a communication about a product or service1 including what is reasonably necessary1 proportionate1 and limited to provide a product or service specifically requested by an individual or reasonably anticipated within the context of the covered entity's ongoing relationship with an individual2 7#b7 what is reasonably necessary1 proportionate1 or limited to otherwise process or transfer covered data in a manner that is described in the privacy policy that the covered entity is required to publish under section #ajb7;a72 or 7#c7 what is expressly permitted by this ,act or any other applicable ,federal law4 7b7 ,best practices ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidelines recommending best practices for covered entities to minimize the collection1 processing1 and transfer of covered data in accordance with this section4 7c7 ,rule of construction ,notwithstanding section #dje of this ,act1 nothing in this section supersedes any other provision of this ,act or other applicable ,federal law4 #ajf4 ,service providers and third parties 7a7 ,service providers ,a service provider-- 7#a7 shall not process service provider data for any processing purpose that is not performed on behalf of1 and at the direction of1 the covered entity that transferred the data to the service provider2 7#b7 shall not transfer service provider data to a third party for any purpose other than a purpose performed on behalf of1 or at the direction of1 the covered entity that transferred the data to the service provider without the affirmative express consent of the individual to whom the service provider data relates2 7#c7 at the direction of the covered entity that transferred service provider data to the service provider1 shall delete or de-identify such data-- 7,a7 as soon as practicable after the service provider has completed providing the service or function for which the data was transferred to the service provider2 or 7,b7 as soon as practicable after the end of the period during which the service provider is to provide services with respect to such data1 as agreed to by the service provider and the covered entity that transferred the data2 7#d7 is exempt from the requirements of section #ajc with respect to service provider data1 but shall1 to the extent practicable-- 7,a7 assist the covered entity from which it received the service provider data in fulfilling requests to exercise rights under section #ajc7;a72 and 7,b7 upon receiving notice from a covered entity of a verified request made under section #ajc7;a77#a7 to delete1 de-identify1 or correct service provider data held by the service provider1 delete1 de-identify1 or correct such data2 and 7#e7 is exempt from the requirements of sections #ajd and #aje4 7b7 ,third parties ,a third party-- 7#a7 shall not process third party data for a processing purpose inconsistent with the reasonable expectation of the individual to whom such data relates2 7#b7 for purposes of paragraph 7#a71 may reasonably rely on representations made by the covered entity that transferred third party data regarding the reasonable expectations of individuals to whom such data relates1 provided that the third party conducts reasonable due diligence on the representations of the covered entity and finds those representations to be credible2 and 7#c7 is exempt from the requirements of sections #ajd and #aje4 7c7 ,bankruptcy ,in the event that a covered entity enters into a bankruptcy proceeding which would lead to the disclosure of covered data to a third party1 the covered entity shall in a reasonable time prior to the disclosure-- 7#a7 provide notice of the proposed disclosure of covered data1 including the name of the third party and their policies and practices with respect to the covered data1 to all affected individuals2 and 7#b7 provide each affected individual with the opportunity to withdraw any previous affirmative express consent related to the covered data of the individual or request the deletion or de-identification of the covered data of the individual4 7d7 ,additional obligations on covered entities 7#a7 ,in general ,a covered entity shall exercise reasonable due diligence to ensure compliance with this section before-- 7,a7 selecting a service provider2 or 7,b7 deciding to transfer covered data to a third party4 7#b7 ,guidance ,not later than #b years after the effective date of this ,act1 the ,commission shall publish guidance regarding compliance with this subsection4 ,such guidance shall1 to the extent practicable1 minimize unreasonable burdens on small- and medium-sized covered entities4 #ajg4 ,privacy impact assessments 7a7 ,privacy impact assessments of new or material changes to processing of covered data 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act 7or1 if later1 not later than #a year after a covered entity first meets the definition of a large data holder 7as defined in section #b771 each covered entity that is a large data holder shall conduct a privacy impact assessment of each of their processing activities involving covered data that present a heightened risk of harm to individuals1 and each such assessment shall weigh the benefits of the covered entity's covered data collection1 processing1 and transfer practices against the potential adverse consequences to individual privacy of such practices4 7#b7 ,assessment requirements ,a privacy impact assessment required under paragraph 7#a7-- 7,a7 shall be reasonable and appropriate in scope given-- 7i7 the nature of the covered data collected1 processed1 or transferred by the covered entity2 7ii7 the volume of the covered data collected1 processed1 or transferred by the covered entity2 7iii7 the size of the covered entity2 and 7iv7 the potential risks posed to the privacy of individuals by the collection1 processing1 or transfer of covered data by the covered entity2 7,b7 shall be documented in written form and maintained by the covered entity unless rendered out of date by a subsequent assessment conducted under subsection 7b72 and 7,c7 shall be approved by the data privacy officer of the covered entity4 7b7 ,ongoing privacy impact assessments 7#a7 ,in general ,a covered entity that is a large data holder shall1 not less frequently than once every #b years after the covered entity conducted the privacy impact assessment required under subsection 7a71 conduct a privacy impact assessment of the collection1 processing1 and transfer of covered data by the covered entity to assess the extent to which-- 7,a7 the ongoing practices of the covered entity are consistent with the covered entity's published privacy policies and other representations that the covered entity makes to individuals2 7,b7 any customizable privacy settings included in a service or product offered by the covered entity are adequately accessible to individuals who use the service or product and are effective in meeting the privacy preferences of such individuals2 7,c7 the practices and privacy settings described in subparagraphs 7,a7 and 7,b71 respectively-- 7i7 meet the expectations of a reasonable individual2 and 7ii7 provide an individual with adequate control over the individual's covered data2 7,d7 the covered entity could enhance the privacy and security of covered data through technical or operational safeguards such as encryption1 de-identification1 and other privacy-enhancing technologies2 and 7,e7 the processing of covered data is compatible with the stated purposes for which it was collected4 7#b7 ,approval by data privacy officer ,the data privacy officer of a covered entity shall approve the findings of an assessment conducted by the covered entity under this subsection4 #ajh4 ,scope of coverage 7a7 ,general exceptions ,notwithstanding any provision of this title other than subsections 7a7 through 7c7 of section #ajb1 a covered entity may collect1 process or transfer covered data for any of the following purposes1 provided that the collection1 processing1 or transfer is reasonably necessary1 proportionate1 and limited to such purpose3 7#a7 ,to initiate or complete a transaction or to fulfill an order or provide a service specifically requested by an individual1 including associated routine administrative activities such as billing1 shipping1 financial reporting1 and accounting4 7#b7 ,to perform internal system maintenance1 diagnostics1 product or service management1 inventory management1 and network management4 7#c7 ,to prevent1 detect1 or respond to a security incident or trespassing1 provide a secure environment1 or maintain the safety and security of a product1 service1 or individual4 7#d7 ,to protect against malicious1 deceptive1 fraudulent1 or illegal activity4 7#e7 ,to comply with a legal obligation or the establishment1 exercise1 analysis1 or defense of legal claims or rights1 or as required or specifically authorized by law4 7#f7 ,to comply with a civil1 criminal1 or regulatory inquiry1 investigation1 subpoena1 or summons by an ,executive agency4 7#g7 ,to cooperate with an ,executive agency or a law enforcement official acting under the authority of an ,executive or ,state agency concerning conduct or activity that the ,executive agency or law enforcement official reasonably and in good faith believes may violate ,federal1 ,state1 or local law1 or pose a threat to public safety or national security4 7#h7 ,to address risks to the safety of an individual or group of individuals1 or to ensure customer safety1 including by authenticating individuals in order to provide access to large venues open to the public4 7#i7 ,to effectuate a product recall pursuant to ,federal or ,state law4 7#aj7 ,to conduct public or peer-reviewed scientific1 historical1 or statistical research that-- 7,a7 is in the public interest2 7,b7 adheres to all applicable ethics and privacy laws2 and 7,c7 is approved1 monitored1 and governed by an institutional review board or other oversight entity that meets standards promulgated by the ,commission pursuant to section #eec of title #e1 ,united ,states ,code4 7#aa7 ,to transfer covered data to a service provider4 7#ab7 ,for a purpose identified by the ,commission pursuant to a regulation promulgated under subsection 7b74 7b7 ,additional purposes ,the ,commission may promulgate regulations under section #eec of title #e1 ,united ,states ,code1 identifying additional purposes for which a covered entity may collect1 process or transfer covered data4 7c7 ,small business exception ,sections #ajc1 #aje1 and #cja shall not apply in the case of a covered entity that can establish that1 for the #c preceding calendar years 7or for the period during which the covered entity has been in existence if such period is less than #c years7-- 7#a7 the covered entity's average annual gross revenues did not exceed #ej1jjj1jjj2 7#b7 on average1 the covered entity annually processed the covered data of less than #a1jjj1jjj individuals2 7#c7 the covered entity never employed more than #ejj individuals at any one time2 and 7#d7 the covered entity derived less than #ej percent of its revenues from transferring covered data4 ,,ii ,data transparency1 integrity1 and security #bja4 ,algorithm bias1 detection1 and mitigation 7a7 ,,ftc enforcement assistance 7#a7 ,in general ,whenever the ,commission obtains information that a covered entity may have processed or transferred covered data in violation of ,federal anti-discrimination laws1 the ,commission shall transmit such information 7excluding any such information that is a trade secret as defined by section #ahci of title #ah1 ,united ,states ,code7 to the appropriate ,executive agency or ,state agency with authority to initiate proceedings relating to such violation4 7#b7 ,annual report ,beginning in #bjba1 the ,commission shall submit an annual report to ,congress that includes-- 7,a7 a summary of the types of information the ,commission transmitted to ,executive agencies or ,state agencies during the preceding year pursuant to this subsection2 and 7,b7 a summary of how such information relates to ,federal anti-discrimination laws4 7#c7 ,cooperation with other agencies ,the ,commission may implement this subsection by executing agreements or memoranda of understanding with the appropriate ,executive agencies4 7#d7 ,relationship to other laws ,notwithstanding section #dje1 nothing in this subsection shall supersede any other provision of law4 7b7 ,algorithm transparency reports 7#a7 ,study and report 7,a7 ,study ,the ,commission shall conduct a study1 using the ,commission's authority under section #f7;b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;b771 examining the use of algorithms to process covered data in a manner that may violate ,federal anti-discrimination laws4 7,b7 ,report ,not later than #c years after the date of enactment of this ,act1 the ,commission shall publish a report containing the results of the study required under subparagraph 7,a74 7,c7 ,guidance ,the ,commission shall use the results of the study described in paragraph 7,a7 to develop guidance to assist covered entities in avoiding the discriminatory use of algorithms4 7#b7 ,updated report ,not later than #e years after the publication of the report required under paragraph 7#a71 the ,commission shall publish an updated report4 #bjb4 ,digital content forgeries 7a7 ,definition ,not later than #f months after the date of enactment of this ,act1 the ,national ,institute of ,standards and ,technology shall develop and publish a definition of digital content forgery and accompanying explanatory materials4 7b7 ,elements of definition ,in developing a definition of digital content forgery under subsection 7a71 the ,national ,institute of ,standards and ,technology shall consider the following factors3 7#a7 ,whether the content is created with the intent to deceive an individual into believing the content was genuine4 7#b7 ,whether the content is genuine or manipulated4 7#c7 ,the impression the content makes on a reasonable individual that observes the content4 7#d7 ,whether the production of the content was substantially dependent upon technical means1 rather than the ability of another individual to physically or verbally impersonate such individual4 7#e7 ,the scope of technologies that may be utilized during the creation or publication of digital content forgeries1 including-- 7,a7 video recording or film2 7,b7 sound recording2 7,c7 electronic image or photograph2 or 7,d7 any digital representation of speech or conduct4 7c7 ,scope of definition ,the definition published by the ,national ,institute of ,standards and ,technology under subsection 7a7 shall not supersede any other provision of law or be construed to limit the authority of any ,executive agency related to digital content forgeries4 7d7 ,commission reports 7#a7 ,initial report ,not later than #a year after the ,national ,institute of ,standards and ,technology publishes the definition and materials required under subsection 7a71 the ,commission shall publish a report regarding the impact of digital content forgeries on individuals and competition4 7#b7 ,subsequent reports ,not later than #b years after the publication of the report required under paragraph 7#a71 and as often as the ,commission shall deem necessary thereafter1 the ,commission shall publish an updated version of such report4 7#c7 ,content of reports ,each report required under this subsection shall include-- 7,a7 a description of the types of digital content forgeries1 including those used to commit fraud1 cause adverse consequences1 violate any provision of law enforced by the ,commission1 or violate civil rights recognized under ,federal law2 7,b7 a description of the common sources in the ,united ,states of digital content forgeries and commercial sources of digital content forgery technologies2 7,c7 an assessment of the uses1 applications1 and adverse consequences of digital content forgeries1 including the impact of digital content forgeries on individuals1 digital identity1 and competition2 7,d7 an analysis of the methods available to individuals to identify digital content forgeries as well as a description of commercial technological countermeasures that are1 or could be1 used to address concerns with digital content forgeries1 which may include countermeasures that warn individuals of suspect content2 7,e7 a description of any remedies available to protect an individual's identity and reputation from adverse consequences caused by digital content forgeries1 such as protections or remedies available under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 or any other law2 and 7,f7 any additional information the ,commission determines appropriate4 7e7 ,establishment of digital content forgery prize competition ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology1 in coordination with the ,commission1 shall establish under section #bd of the ,stevenson-,wydler ,technology ,innovation ,act of #aihj 7#ae ,u4,s4,c4 #cgai7 a prize competition to spur the development of technical solutions to assist individuals and the public in identifying digital content forgeries and related technologies4 #bjc4 ,data brokers 7a7 ,in general ,not later than ,january #ca of each calendar year that follows a calendar year during which a covered entity acted as a data broker1 such covered entity shall register with the ,commission pursuant to the requirements of this section4 7b7 ,registration requirements ,in registering with the ,commission as required under subsection 7a71 a data broker shall do the following3 7#a7 ,pay to the ,commission a registration fee of #ajj4 7#b7 ,provide the ,commission with the following information3 7,a7 ,the name and primary physical1 email1 and internet addresses of the data broker4 7,b7 ,any additional information or explanation the data broker chooses to provide concerning its data collection and processing practices4 7c7 ,penalties ,a data broker that fails to register as required under subsection 7a7 shall be liable for-- 7#a7 a civil penalty of #ej for each day it fails to register1 not to exceed a total of #aj1jjj for each year2 and 7#b7 an amount equal to the fees due under this section for each year that it failed to register as required under subsection 7a74 7d7 ,publication of registration information ,the ,commission shall publish on the internet website of the ,commission the registration information provided by data brokers under this section4 #bjd4 ,protection of covered data 7a7 ,in general ,a covered entity shall establish1 implement1 and maintain reasonable administrative1 technical1 and physical data security policies and practices to protect against risks to the confidentiality1 security1 and integrity of covered data4 7b7 ,data security requirements ,the data security policies and practices required under subsection 7a7 shall be-- 7#a7 appropriate to the size and complexity of the covered entity1 the nature and scope of the covered entity's collection or processing of covered data1 the volume and nature of the covered data at issue1 and the cost of available tools to improve security and reduce vulnerabilities2 and 7#b7 designed to-- 7,a7 identify and assess vulnerabilities to covered data2 7,b7 take reasonable preventative and corrective action to address known vulnerabilities to covered data2 and 7,c7 detect1 respond to1 and recover from cybersecurity incidents related to covered data4 7c7 ,rulemaking and guidance 7#a7 ,rulemaking authority and scope 7,a7 ,in general ,the ,commission may1 pursuant to a proceeding in accordance with section #eec of title #e1 ,united ,states ,code1 issue regulations to identify processes for receiving and assessing information regarding vulnerabilities to covered data that are reported to the covered entity4 7,b7 ,consultation with ,,nist ,in promulgating regulations under this paragraph1 the ,commission shall consult with1 and take into consideration guidance from1 the ,national ,institute for ,standards and ,technology 7#b7 ,guidance ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance to covered entities on how to-- 7,a7 identify and assess vulnerabilities to covered data1 including-- 7i7 the potential for unauthorized access to covered data2 7ii7 vulnerabilities in the covered entity's collection or processing of covered data2 7iii7 the management of access rights2 and 7iv7 the use of service providers to process covered data2 7,b7 take reasonable preventative and corrective action to address vulnerabilities to covered data2 and 7,c7 detect1 respond to1 and recover from cybersecurity incidents and events4 7d7 ,applicability of other information security laws ,a covered entity that is required to comply with title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 or the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq471 and is in compliance with the information security requirements of such ,act1 shall be deemed to be in compliance with the requirements of this section with respect to covered data that is subject to the requirements of such ,act4 #bje4 ,filter bubble transparency 7a7 ,in general ,beginning on the date that is #a year after the date of enactment of this ,act1 it shall be unlawful-- 7#a7 for any person to operate a covered internet platform that uses an opaque algorithm unless the person complies with the requirements of subsection 7b72 or 7#b7 for any upstream provider to grant access to an index of web pages on the internet under a search syndication contract that does not comply with the requirements of subsection 7c74 7b7 ,opaque algorithm requirements 7#a7 ,in general ,the requirements of this subsection with respect to a person that operates a covered internet platform that uses an opaque algorithm are the following3 7,a7 ,the person provides notice to users of the platform that the platform uses an opaque algorithm that makes inferences based on user-specific data to select the content the user sees4 ,such notice shall be presented in a clear1 conspicuous manner on the platform whenever the user interacts with an opaque algorithm for the first time1 and may be a one-time notice that can be dismissed by the user4 7,b7 ,the person makes available a version of the platform that uses an input-transparent algorithm and enables users to easily switch between the version of the platform that uses an opaque algorithm and the version of the platform that uses the input-transparent algorithm by selecting a prominently placed icon1 which shall be displayed wherever the user interacts with an opaque algorithm4 7#b7 ,nonapplication to certain downstream providers ,paragraph 7#a7 shall not apply with respect to an internet search engine if-- 7,a7 the search engine is operated by a downstream provider with fewer than #a1jjj employees2 and 7,b7 the search engine uses an index of web pages on the internet to which such provider received access under a search syndication contract4 7c7 ,search syndication contract requirement ,the requirements of this subsection with respect to a search syndication contract are that-- 7#a7 as part of the contract1 the upstream provider makes available to the downstream provider the same input-transparent algorithm used by the upstream provider for purposes of complying with subsection 7b77#a77;,b72 and 7#b7 the upstream provider does not impose any additional costs1 degraded quality1 reduced speed1 or other constraint on the functioning of such algorithm when used by the downstream provider to operate an internet search engine relative to the performance of such algorithm when used by the upstream provider to operate an internet search engine4 #bjf4 ,unfair and deceptive acts and practices relating to the manipulation of user interfaces 7a7 ,conduct prohibited 7#a7 ,in general ,it shall be unlawful for any large online operator-- 7,a7 to design1 modify1 or manipulate a user interface with the purpose or substantial effect of obscuring1 subverting1 or impairing user autonomy1 decision making1 or choice to obtain consent or user data2 7,b7 to subdivide or segment consumers of online services into groups for the purposes of behavioral or psychological experiments or studies1 except with the informed consent of each user involved2 or 7,c7 to design1 modify1 or manipulate a user interface on a website or online service1 or portion thereof1 that is directed to an individual under the age of #ac1 with the purpose or substantial effect of cultivating compulsive usage1 including video auto-play functions initiated without the consent of a user4 7b7 ,duties of large online operators ,any large online operator that engages in any form of behavioral or psychological research based on the activity or data of its users shall-- 7#a7 disclose to its users on a routine basis1 but not less than once each #ij days1 any experiments or studies that a user was subjected to or enrolled in with the purpose of promoting engagement or product conversion2 7#b7 disclose to the public on a routine basis1 but not less than once each #ij days1 any experiments or studies with the purposes of promoting engagement or product conversion being currently undertaken1 or concluded since the prior disclosure2 7#c7 shall present the disclosures in paragraphs 7#a7 and 7#b7 in a manner that-- 7,a7 is clear1 conspicuous1 context appropriate1 and easily accessible2 and 7,b7 is not deceptively obscured2 7#d7 establish an ,independent ,review ,board for any behavioral or psychological research1 of any purpose1 conducted on users or on the basis of user activity or data1 which shall review and have authority to approve1 require modification in1 or disapprove all behavioral or psychological experiments or research2 and 7#e7 ensure that any ,independent ,review ,board established under paragraph 7#d7 shall register with the ,commission1 including providing to the ,commission-- 7,a7 the names and resumes of every board member2 7,b7 the composition and reporting structure of the ,board to the management of the operator2 7,c7 the process by which the ,board is to be notified of proposed studies or modifications along with the processes by which the ,board is capable of vetoing or amending such proposals2 7,d7 any compensation provided to board members2 and 7,e7 any conflict of interest that might exist concerning a board member's participation in the ,board4 7c7 ,registered professional standards body 7#a7 ,in general ,an association of large online operators may register as a professional standards body by filing with the ,commission an application for registration in such form as the ,commission1 by rule1 may prescribe containing the rules of the association and such other information and documents as the ,commission1 by rule1 may prescribe as necessary or appropriate in the public interest or for protecting the welfare of users of large online operators4 7#b7 ,professional standards body ,an association of large online operators may not register as a professional standards body unless the ,commission determines that-- 7,a7 the association is so organized and has the capacity to enforce compliance by its members and persons associated with its members1 with the provisions of this ,act2 7,b7 the rules of the association provide that any large online operator may become a member of such association2 7,c7 the rules of the association ensure a fair representation of its members in the selection of its directors and administration of its affairs and provide that one or more directors shall be representative of users and not be associated with1 or receive any direct or indirect funding from1 a member of the association or any large online operator2 7,d7 the rules of the association are designed to prevent exploitative and manipulative acts or practices1 to promote transparent and fair principles of technology development and design1 to promote research in keeping with best practices of study design and informed consent1 and to continually evaluate industry practices and issue binding guidance consistent with the objectives of this ,act2 7,e7 the rules of the association provide that its members and persons associated with its members shall be appropriately disciplined for violation of any provision of this ,act1 the rules or regulations thereunder1 or the rules of the association1 by expulsion1 suspension1 limitation of activities1 functions1 fine1 censure1 being suspended or barred from being associated with a member1 or any other appropriate sanction2 and 7,f7 the rules of the association are in accordance with the provisions of this ,act1 and1 in general1 provide a fair procedure for the disciplining of members and persons associated with members1 the denial of membership to any person seeking membership therein1 the barring of any person from becoming associated with a member thereof1 and the prohibition or limitation by the association of any person with respect to access to services offered by the association or a member thereof4 7#c7 ,responsibilities and activities 7,a7 ,bright-line rules ,an association shall develop1 on a continuing basis1 guidance and bright-line rules for the development and design of technology products of large online operators consistent with subparagraph 7,b74 7,b7 ,safe harbors ,in formulating guidance under subparagraph 7,a71 the association shall define conduct that does not have the purpose or substantial effect of subverting or impairing user autonomy1 decision making1 or choice1 or of cultivating compulsive usage for children such as-- 7i7 de minimis user interface changes derived from testing consumer preferences1 including different styles1 layouts1 or text1 where such changes are not done with the purpose of obtaining user consent or user data2 7ii7 algorithms or data outputs outside the control of a large online operator or its affiliates2 and 7iii7 establishing default settings that provide enhanced privacy protection to users or otherwise enhance their autonomy and decision-making ability4 7d7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practice ,a violation of subsection 7a7 or 7b7 shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,determination ,for purposes of enforcement of this ,act1 the ,commission shall determine an act or practice is unfair or deceptive if the act or practice-- 7,a7 has the purpose1 or substantial effect1 of subverting or impairing user autonomy1 decision making1 or choice to obtain consent or user data2 or 7,b7 has the purpose1 or substantial effect1 of cultivating compulsive usage by a child under #ac4 7#c7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 that-- 7,a7 establish rules and procedures for obtaining the informed consent of users2 7,b7 establish rules for the registration1 formation1 oversight1 and management of the independent review boards1 including standards that ensure effective independence of such entities from improper or undue influence by a large online operator2 7,c7 establish rules for the registration1 formation1 oversight1 and management of professional standards bodies1 including procedures for the regular oversight of such bodies and revocation of their designation2 and 7,d7 in consultation with a professional standards body established under subsection 7c71 define conduct that does not have the purpose or substantial effect of subverting or impairing user autonomy1 decision making1 or choice1 or of cultivating compulsive usage for children such as-- 7i7 de minimis user interface changes derived from testing consumer preferences1 including different styles1 layouts1 or text1 where such changes are not done with the purpose of obtaining user consent or user data2 7ii7 algorithms or data outputs outside the control of a large online operator or its affiliates2 and 7iii7 establishing default settings that provide enhanced privacy protection to users or otherwise enhance their autonomy and decision-making ability4 7#d7 ,safe harbor ,the ,commission may not bring an enforcement action under this section against any large online operator that relied in good faith on the guidance of a professional standards body4 ,,iii ,corporate accountability #cja4 ,designation of data privacy officer and data security officer 7a7 ,in general ,a covered entity shall designate-- 7#a7 one or more qualified employees or contractors as data privacy officers2 and 7#b7 one or more qualified employees or contractors 7in addition to any employee or contractor designated under paragraph 7#a77 as data security officers4 7b7 ,responsibilities of data privacy officers and data security officers ,an employee or contractor who is designated by a covered entity as a data privacy officer or a data security officer shall be responsible for1 at a minimum1 coordinating the covered entity's policies and practices regarding-- 7#a7 in the case of a data privacy officer1 compliance with the privacy requirements with respect to covered data under this ,act2 and 7#b7 in the case of a data security officer1 the security requirements with respect to covered data under this ,act4 #cjb4 ,internal controls ,a covered entity shall maintain internal controls and reporting structures to ensure that appropriate senior management officials of the covered entity are involved in assessing risks and making decisions that implicate compliance with this ,act4 #cjc4 ,whistleblower protections 7a7 ,definitions ,for purposes of this section3 7#a7 ,whistleblower ,the term whistleblower means any employee or contractor of a covered entity who voluntarily provides to the ,commission original information relating to non-compliance with1 or any violation or alleged violation of1 this ,act or any regulation promulgated under this ,act4 7#b7 ,original ,information ,the term original information means information that is provided to the ,commission by an individual and-- 7,a7 is derived from the independent knowledge or analysis of an individual2 7,b7 is not known to the ,commission from any other source at the time the individual provides the information2 and 7,c7 is not exclusively derived from an allegation made in a judicial or an administrative action1 in a governmental report1 a hearing1 an audit1 or an investigation1 or from news media1 unless the individual is a source of the allegation4 7b7 ,effect of whistleblower retaliations on penalties ,in seeking penalties under section #dja for a violation of this ,act or a regulation promulgated under this ,act by a covered entity1 the ,commission shall consider whether the covered entity retaliated against an individual who was a whistleblower with respect to original information that led to the successful resolution of an administrative or judicial action brought by the ,commission or the ,attorney ,general of the ,united ,states under this ,act against such covered entity4 ,,iv ,enforcement authority and new programs #dja4 ,enforcement by the ,federal ,trade ,commission 7a7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of commission 7,a7 ,in general ,except as provided in paragraphs 7#c7 and 7#d71 the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,limiting certain actions unrelated to this ,act2 authority preserved 7i7 ,in general ,the ,commission shall not bring any action to enforce the prohibition in section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 on unfair or deceptive acts or practices with respect to the privacy or security of covered data1 unless such action is consistent with this ,act4 7ii7 ,rule of construction ,except as provided in paragraph 7#a71 nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law1 or to limit the ,commission's authority to bring actions under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 relating to unfair or deceptive acts or practices to enforce the provisions of this ,act and regulations promulgated thereunder1 including to ensure that privacy policies required under section #ajb are truthful and non-misleading4 7#c7 ,common carriers and nonprofit organizations ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act and the regulations promulgated under this ,act1 in the same manner provided in paragraphs 7#a7 and 7#b7 of this subsection1 with respect to-- 7,a7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto2 and 7,b7 organizations not organized to carry on business for their own profit or that of their members4 7#d7 ,data privacy and security fund 7,a7 ,establishment of ,victims ,relief ,fund ,there is established in the ,treasury of the ,united ,states a separate fund to be known as the ,data ,privacy and ,security ,victims ,relief ,fund 7referred to in this paragraph as the ,victims ,relief ,fund74 7,b7 ,deposits 7i7 ,deposits from the commission ,the ,commission shall deposit into the ,victims ,relief ,fund the amount of any civil penalty obtained against any covered entity in any action the ,commission commences to enforce this ,act or a regulation promulgated under this ,act4 7ii7 ,deposits from the ,attorney ,general ,the ,attorney ,general of the ,united ,states shall deposit into the ,victims ,relief ,fund the amount of any civil penalty obtained against any covered entity in any action the ,attorney ,general commences on behalf of the ,commission to enforce this ,act or a regulation promulgated under this ,act4 7,c7 ,use of fund amounts ,amounts in the ,victims ,relief ,fund shall be available to the ,commission1 without fiscal year limitation1 to provide redress1 payments or compensation1 or other monetary relief to individuals affected by an act or practice for which civil penalties have been imposed under this ,act4 ,to the extent that individuals cannot be located or such redress1 payments or compensation1 or other monetary relief are otherwise not practicable1 the ,commission may use such funds for the purpose of consumer or business education relating to data privacy and security or for the purpose of engaging in technological research that the ,commission considers necessary to enforce this ,act4 7,d7 ,amounts not subject to apportionment ,notwithstanding any other provision of law1 amounts in the ,victims ,relief ,fund shall not be subject to apportionment for purposes of chapter #ae of title #ca1 ,united ,states ,code1 or under any other authority4 7#e7 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission #ajj1jjj1jjj to carry out this ,act4 7b7 ,enforcement of section #bjf ,this section shall not apply to a violation of section #bjf or a regulation promulgated under such section1 and such section shall be enforced under subsection 7d7 of such section4 #djb4 ,enforcement by ,state attorneys general 7a7 ,civil action ,except as provided in subsection 7h71 in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is adversely affected by the engagement of any covered entity in an act or practice that violates this ,act or a regulation promulgated under this ,act1 the attorney general of the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to-- 7#a7 enjoin that act or practice2 7#b7 enforce compliance with this ,act or the regulation2 7#c7 obtain damages1 civil penalties1 restitution1 or other compensation on behalf of the residents of the ,state2 or 7#d7 obtain such other relief as the court may consider to be appropriate4 7b7 ,rights of the commission 7#a7 ,in general ,except where not feasible1 the attorney general of a ,state shall notify the ,commission in writing prior to initiating a civil action under subsection 7a74 ,such notice shall include a copy of the complaint to be filed to initiate such action4 ,upon receiving such notice1 the ,commission may intervene in such action and1 upon intervening-- 7,a7 be heard on all matters arising in such action2 and 7,b7 file petitions for appeal of a decision in such action4 7#b7 ,notification timeline ,where it is not feasible for the attorney general of a ,state to provide the notification required by paragraph 7#b7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately after initiating the civil action4 7c7 ,consolidation of actions brought by two or more ,state attorneys general ,whenever a civil action under subsection 7a7 is pending and another civil action or actions are commenced pursuant to such subsection in a different ,federal district court or courts that involve one or more common questions of fact1 such action or actions shall be transferred for the purposes of consolidated pretrial proceedings and trial to the ,united ,states ,district ,court for the ,district of ,columbia2 provided however1 that no such action shall be transferred if pretrial proceedings in that action have been concluded before a subsequent action is filed by the attorney general of the ,state4 7d7 ,actions by commission ,in any case in which a civil action is instituted by or on behalf of the ,commission for violation of this ,act or a regulation promulgated under this ,act1 no attorney general of a ,state may1 during the pendency of such action1 institute a civil action against any defendant named in the complaint in the action instituted by or on behalf of the ,commission for violation of this ,act or a regulation promulgated under this ,act that is alleged in such complaint4 7e7 ,investigatory powers ,nothing in this section shall be construed to prevent the attorney general of a ,state or another authorized official of a ,state from exercising the powers conferred on the attorney general or the ,state official by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7f7 ,venue2 service of process 7#a7 ,venue ,any action brought under subsection 7a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7#b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 7g7 ,actions by other ,state officials 7#a7 ,in general ,any ,state official who is authorized by the ,state attorney general to be the exclusive authority in that ,state to enforce this ,act may bring a civil action under subsection 7a71 subject to the same requirements and limitations that apply under this section to civil actions brought under such subsection by ,state attorneys general4 7#b7 ,authority preserved ,nothing in this section shall be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 7h7 ,exclusion of section #bjf ,this section shall not apply to a violation of section #bjf or a regulation promulgated under such section4 #djc4 ,authority of ,commission to seek permanent injunction and other equitable remedies 7a7 ,in general ,section #ac of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #ec7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking is violating1 or is about to violate1 and inserting has violated1 is violating1 or is about to violate2 7,b7 in paragraph 7#b7-- 7i7 by inserting either 7,a7 before the enjoining thereof2 and 7ii7 by inserting or 7,b7 the permanent enjoining thereof or the ordering of an equitable remedy under subsection 7e7 after final12 and 7,c7 in the flush text following paragraph 7#b7-- 7i7 by striking to enjoin any such act or practice and inserting to obtain such injunction or remedy2 7ii7 by striking ,upon a proper showing that and inserting ,in a case brought under paragraph 7#b77;,a71 upon a proper showing that2 7iii7 by striking such action and inserting a temporary restraining order or preliminary injunction2 7iv7 by striking without bond2 7v7 by striking ,that in proper cases the ,commission may seek1 and after proper proof1 the court may issue1 a permanent injunction4 and inserting the following3 ,that in a case brought under paragraph 7#b77;,b71 after proper proof and upon a showing that a permanent injunction or equitable remedy under subsection 7e7 would be in the public interest1 the court may issue a permanent injunction1 an equitable remedy under subsection 7e71 or any other relief as the court determines to be just and proper1 including temporary or preliminary equitable relief42 7vi7 by inserting under paragraph 7#b7 after ,any suit2 and 7vii7 by striking any suit under this section and inserting any such suit2 and 7#b7 by adding at the end the following new subsection3 7e7 ,equitable remedies 7#a7 ,restitution2 contract rescission and reformation 7,a7 ,in general ,in a suit brought under subsection 7b77#b77;,b7 with respect to a violation of a provision of law enforced by the ,commission1 the ,commission may seek1 and the court may order-- 7i7 restitution for consumer loss resulting from such violation2 7ii7 rescission or reformation of contracts2 and 7iii7 the refund of money or return of property4 7,b7 ,limitations period ,relief under this paragraph shall not be available for a claim arising more than #aj years before the filing of the ,commission's suit under subsection 7b77#b77;,b7 with respect to the violation that gave rise to the claim4 7#b7 ,disgorgement 7,a7 ,in general ,in a suit brought under subsection 7b77#b77;,b7 with respect to a violation of a provision of law enforced by the ,commission1 the ,commission may seek1 and the court may order1 disgorgement of any unjust enrichment that a person obtained as a result of that violation4 7,b7 ,calculation ,any disgorgement that is ordered with respect to a person under subparagraph 7,a7 shall be offset by any amount of restitution that the person is ordered to pay under paragraph 7#a74 7,c7 ,limitations period ,disgorgement under this paragraph shall be limited to any unjust enrichment a person1 partnership1 or corporation obtained in the #aj years preceding the filing of the ,commission's suit under subsection 7b77#b77;,b7 with respect to the violation that resulted in such unjust enrichment4 7#c7 ,calculation of limitations periods ,for purposes of calculating any limitations period with respect to a claim for relief under paragraph 7#a7 or a disgorgement order under paragraph 7#b71 any time in which a person1 partnership1 or corporation against which such relief or order is sought is outside the ,united ,states shall not be counted for purposes of calculating such period4 4 7b7 ,conforming amendments ,section #af7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #ef7;a77#b77 is amended-- 7#a7 in subparagraph 7,a71 by striking 7relating to injunctive relief72 and 7#b7 in subparagraph 7,b71 by striking 7relating to consumer redress74 7c7 ,applicability ,the amendments made by this section shall apply with respect to any action or proceeding that is commenced on or after the date of enactment of this ,act4 #djd4 ,approved certification programs 7a7 ,in general ,the ,commission shall establish a program in which the ,commission shall approve voluntary consensus standards or certification programs that covered entities may use to comply with one or more provisions in this ,act4 7b7 ,effect of approval ,a covered entity in compliance with a voluntary consensus standard approved by the ,commission shall be deemed to be in compliance with the provisions of this ,act4 7c7 ,time for approval ,the ,commission shall issue a decision regarding the approval of a proposed voluntary consensus standard not later than #ahj days after a request for approval is submitted4 7d7 ,effect of non-,compliance ,a covered entity that claims compliance with an approved voluntary consensus standard and is found not to be in compliance with such program by the ,commission or in any judicial proceeding shall be considered to be in violation of the section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 prohibition on unfair or deceptive acts or practices4 7e7 ,rulemaking ,not later than #abj days after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 establishing a process for review of requests for approval of proposed voluntary consensus standards under this section4 7f7 ,requirements ,to be eligible for approval by the ,commission1 a voluntary consensus standard shall meet the requirements for voluntary consensus standards set forth in ,office of ,management and ,budget ,circular ,a-#aai1 or other equivalent guidance document1 ensuring that they are the result of due process procedures and appropriately balance the interests of all the stakeholders1 including individuals1 businesses1 organizations1 and other entities making lawful uses of the covered data covered by the standard1 and-- 7#a7 specify clear and enforceable requirements for covered entities participating in the program that provide an overall level of data privacy or data security protection that is equivalent to or greater than that provided in the relevant provisions in this ,act2 7#b7 require each participating covered entity to post in a prominent place a clear and conspicuous public attestation of compliance and a link to the website described in paragraph 7#d72 7#c7 include a process for an independent assessment of a participating covered entity's compliance with the voluntary consensus standard or certification program prior to certification and at reasonable intervals thereafter2 7#d7 create a website describing the voluntary consensus standard or certification program's goals and requirements1 listing participating covered entities1 and providing a method for individuals to ask questions and file complaints about the program or any participating covered entity2 7#e7 take meaningful action for non-compliance with the relevant provisions of this ,act by any participating covered entity1 which shall depend on the severity of the non-compliance and may include-- 7,a7 removing the covered entity from the program2 7,b7 referring the covered entity to the ,commission or other appropriate ,federal or ,state agencies for enforcement2 7,c7 publicly reporting the disciplinary action taken with respect to the covered entity2 7,d7 providing redress to individuals harmed by the non-compliance2 7,e7 making voluntary payments to the ,united ,states ,treasury2 and 7,f7 taking any other action or actions to ensure the compliance of the covered entity with respect to the relevant provisions of this ,act2 and 7#f7 issue annual reports to the ,commission and to the public detailing the activities of the program and its effectiveness during the preceding year in ensuring compliance with the relevant provisions of this ,act by participating covered entities and taking meaningful disciplinary action for non-compliance with such provisions by such entities4 #dje4 ,relationship between ,federal and ,state law 7a7 ,relationship to ,state law ,no ,state or political subdivision of a ,state may adopt1 maintain1 enforce1 or continue in effect any law1 regulation1 rule1 requirement1 or standard related to the data privacy or data security and associated activities of covered entities4 7b7 ,savings provision ,subsection 7a7 may not be construed to preempt ,state laws that directly establish requirements for the notification of consumers in the event of a data breach4 7c7 ,relationship to other ,federal laws 7#a7 ,in general ,except as provided in paragraphs 7#b7 and 7#c71 the requirements of this ,act shall supersede any other ,federal law or regulation relating to the privacy or security of covered data or associated activities of covered entities4 7#b7 ,savings provision ,this ,act may not be construed to modify1 limit1 or supersede the operation of the following3 7,a7 ,the ,children's ,online ,privacy ,protection ,act 7#ae ,u4,s4,c4 #feja et seq474 7,b7 ,the ,communications ,assistance for ,law ,enforcement ,act 7#dg ,u4,s4,c4 #ajja et seq474 7,c7 ,section #bbg of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbg74 7,d7 ,title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7,e7 ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq474 7,f7 ,the ,health ,insurance ,portability and ,accountability ,act 7,public ,law #ajd-aia74 7,g7 ,the ,electronic ,communications ,privacy ,act 7#ah ,u4,s4,c4 #beaj et seq474 7,h7 ,section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly referred to as the ,family ,educational ,rights and ,privacy ,act of #aigd74 7,i7 ,the ,driver's ,privacy ,protection ,act of #aiid 7#ah ,u4,s4,c4 #bgba et seq474 7,j7 ,the ,federal ,aviation ,act of #aieh 7#di ,u4,s4,c4 ,app4 #acja et seq474 7,k7 ,the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq474 7#c7 ,compliance with saved ,federal laws ,to the extent that the data collection1 processing1 or transfer activities of a covered entity are subject to a law listed in paragraph 7#b71 such activities of such entity shall not be subject to the requirements of this ,act4 7#d7 ,nonapplication of ,,fcc laws and regulations to covered entities ,notwithstanding any other provision of law1 neither any provision of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto nor any regulation promulgated by the ,federal ,communications ,commission under such ,acts shall apply to any covered entity with respect to the collection1 use1 processing1 transferring1 or security of individual information1 except to the extent that such provision or regulation pertains solely to #iaa lines or other emergency line of a hospital1 medical provider or service office1 health care facility1 poison control center1 fire protection agency1 or law enforcement agency4 #djf4 ,constitutional avoidance ,the provisions of this ,act shall be construed1 to the greatest extent possible1 to avoid conflicting with the ,constitution of the ,united ,states1 including the protections of free speech and freedom of the press established under the ,first ,amendment to the ,constitution of the ,united ,states4 #djg4 ,severability ,if any provision of this ,act1 or an amendment made by this ,act1 is determined to be unenforceable or invalid1 the remaining provisions of this ,act and the amendments made by this ,act shall not be affected4