,,ii #aaf? ,,congress #b;d ,session ,s4 #dfbf ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,septemb] #ag1 #bjbj ,mr4 ,wick] 7= himself1 ,mr4 ,?une1 ,mrs4 ,blackburn1 & ,mrs4 ,fis*]7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to e/abli% data privacy & data security protections = consum]s 9 ! ,unit$ ,/ates4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,sett+ an ,am]ican ,framework to ,ensure ,data ,access1 ,transp>5cy1 & ,acc\ntability ,act or ! ,,safe ,,data ,act4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4 ,sec4 #b4 ,def9itions4 ,sec4 #c4 ,effective date4 ,,title ,i--,individual consum] data rights ,sec4 #aja4 ,consum] loyalty4 ,sec4 #ajb4 ,transp>5cy4 ,sec4 #ajc4 ,individual control4 ,sec4 #ajd4 ,rights to cons5t4 ,sec4 #aje4 ,m9imiz+ data collection1 process+1 & ret5tion4 ,sec4 #ajf4 ,s]vice provid]s & ?ird p>ties4 ,sec4 #ajg4 ,privacy impact assessm5ts4 ,sec4 #ajh4 ,scope ( cov]age4 ,,title ,,ii--,data transp>5cy1 integrity1 & security ,sec4 #bja4 ,algori?m bias1 detection1 & mitigation4 ,sec4 #bjb4 ,digital cont5t =g]ies4 ,sec4 #bjc4 ,data brok]s4 ,sec4 #bjd4 ,protection ( cov]$ data4 ,sec4 #bje4 ,filt] bubble transp>5cy4 ,sec4 #bjf4 ,unfair & deceptive acts & practices relat+ to ! manipulation ( us] int]faces4 ,,title ,,iii--,corporate acc\ntability ,sec4 #cja4 ,designation ( data privacy (fic] & data security (fic]4 ,sec4 #cjb4 ,int]nal controls4 ,sec4 #cjc4 ,:i/lebl[] protections4 ,,title ,,iv--,en=cem5t au?ority & new programs ,sec4 #dja4 ,en=cem5t by ! ,f$]al ,trade ,commission4 ,sec4 #djb4 ,en=cem5t by ,/ate attorneys g5]al4 ,sec4 #djc4 ,au?ority ( ,commission to seek p]man5t injunction & o!r equitable rem$ies4 ,sec4 #djd4 ,approv$ c]tification programs4 ,sec4 #dje4 ,relation%ip betwe5 ,f$]al & ,/ate law4 ,sec4 #djf4 ,con/itutional avoidance4 ,sec4 #djg4 ,sev]ability4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,affirmative express cons5t ,! t]m affirmative express cons5t means1 ^u be+ pres5t$ ) a cle> & conspicu\s description ( an act or practice = :i* cons5t is s\ght1 an affirmative act by ! individual cle>ly communicat+ ! individual's au?orization = ! act or practice4 7#b7 ,algori?m ,! t]m algori?m means a computational process d]iv$ f ma*9e le>n+1 /ati/ics1 or o!r data process+ or artificial intellig5ce te*niques1 t processes cov]$ data = ! purpose ( mak+ a decision or facilitat+ human decision mak+4 7#c7 ,algori?mic rank+ sy/em ,! t]m algori?mic rank+ sy/em means a computational process1 includ+ "o d]iv$ f algori?mic decision mak+1 ma*9e le>n+1 /ati/ical analysis1 or o!r data process+ or artificial intellig5ce te*niques1 us$ to det]m9e ! ord] or mann] t a set ( in=mation is provid$ to a us] on a cov]$ int]net plat=m1 includ+ ! rank+ ( se>* results1 ! provision ( cont5t recomm5dations1 ! display ( social m$ia po/s1 or any o!r me?od ( automat$ cont5t selection4 7#d7 ,behavioral or psy*ological exp]im5ts or rese>* ,! t]m behavioral or psy*ological exp]im5ts or rese>* means ! /udy1 includ+ ?r\gh human exp]im5tation1 ( ov]t or obs]vable actions & m5tal ph5om5a inf]r$ f behavior1 includ+ int]actions betwe5 & among individuals & ! activities ( social gr\ps4 7#e7 ,collection ,! t]m collection means buy+1 r5t+1 ga!r+1 obta9+1 receiv+1 or access+ any cov]$ data ( an individual by any means4 7#f7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#g7 ,common br&+ ,! t]m common br&+ means a %>$ "n1 s]vicem>k1 or tradem>k4 7#h7 ,compulsive usage ,! t]m compulsive usage means any response /imulat$ by ext]nal factors t causes an individual to engage 9 repetitive1 purposeful1 & int5tional behavior caus+ psy*ological di/ress1 loss ( control1 anxiety1 depression1 or h>mful /ress responses4 7#i7 ,connect$ device ,= purposes ( p>agraphs 7#bj7 & 7#cg71 ! t]m connect$ device means a physical object t-- 7,a7 is capable ( connect+ to ! int]net1 ei!r directly or indirectly ?r\gh a network1 to communicate in=mation at ! direction ( an individual2 & 7,b7 has comput] process+ capabilities = collect+1 s5d+1 receiv+1 or analyz+ data4 7#aj7 ,cov]$ data 7,a7 ,9 g5]al ,! t]m cov]$ data means in=mation t id5tifies or is l9k$ or reasonably l9kable to an individual or a device t is l9k$ or reasonably l9kable to an individual4 7,b7 ,l9k$ or reasonably l9kable ,= purposes ( subp>agraph 7,a71 in=mation held by a cov]$ entity is l9k$ or reasonably l9kable to an individual or a device if1 z a practical matt]1 x c be us$ on its own or 9 comb9ation ) o!r in=mation held by1 or readily accessible to1 ! cov]$ entity to id5tify su* individual or su* device4 7,c7 ,exclusions ,su* t]m does n include-- 7i7 aggregat$ data2 7ii7 de-id5tifi$ data2 7iii7 employee data2 or 7iv7 publicly available in=mation4 7,d7 ,aggregat$ data ,= purposes ( subp>agraph 7,c71 ! t]m aggregat$ data means in=mation t relates to a gr\p or category ( individuals or devices t does n id5tify & is n l9k$ or reasonably l9kable to any individual4 7,e7 ,de-id5tifi$ data ,= purposes ( subp>agraph 7,c71 ! t]m de-id5tifi$ data means in=mation held by a cov]$ entity t-- 7i7 does n id5tify1 & is n l9k$ or reasonably l9kable to1 an individual or device2 7ii7 does n conta9 any p]si/5t id5tifi] or o!r in=mation t c\ld readily be us$ to re-id5tify ! individual to :om1 or ! device to :i*1 ! id5tifi] or in=mation p]ta9s2 7iii7 is subject to a public commitm5t by ! cov]$ entity-- 7,i7 to refra9 f attempt+ to use su* in=mation to id5tify any individual or device2 & 7,,ii7 to adopt te*nical & organizational measures to ensure t su* in=mation is n l9k$ to any individual or device2 & 7iv7 is n disclos$ by ! cov]$ entity to any o!r p>ty unless ! disclosure is subject to a contractually or o!r legally b9d+ requirem5t t-- 7,i7 ! recipi5t ( ! in=mation %all n use ! in=mation to id5tify any individual or device2 & 7,,ii7 all onw>d disclosures ( ! in=mation %all be subject to ! requirem5t describ$ 9 subclause 7,i74 7,f7 ,employee data ,= purposes ( subp>agraph 7,c71 ! t]m employee data means-- 7i7 in=mation relat+ to an individual collect$ by a cov]$ entity 9 ! c\rse ( ! individual act+ z a job applicant to1 or employee 7reg>dless ( :e!r su* employee is paid or unpaid1 or employ$ on a tempor>y basis71 own]1 director1 (fic]1 /aff memb]1 tra9ee1 v5dor1 visitor1 volunte]1 int]n1 or contractor (1 ! entity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ by ! cov]$ entity solely = purposes relat$ to ! individual's /atus z a curr5t or =m] job applicant to1 or an employee1 own]1 director1 (fic]1 /aff memb]1 tra9ee1 v5dor1 visitor1 volunte]1 int]n1 or contractor (1 t cov]$ entity2 7ii7 bus9ess contact in=mation ( an individual1 includ+ ! individual's "n1 position or title1 bus9ess telephone numb]1 bus9ess address1 bus9ess email address1 qualifications1 & o!r simil> in=mation1 t is provid$ to a cov]$ entity by an individual :o is act+ 9 a pr(essional capacity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = purposes relat$ to su* individual's pr(essional activities2 7iii7 em]g5cy contact in=mation collect$ by a cov]$ entity t relates to an individual :o is act+ 9 a role describ$ 9 clause 7i7 ) respect to ! cov]$ entity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = ! purpose ( hav+ an em]g5cy contact on file = ! individual2 or 7iv7 in=mation relat+ to an individual 7or a relative or b5efici>y ( su* individual7 t is necess>y = ! cov]$ entity to collect1 process1 or transf] = ! purpose ( adm9i/]+ b5efits to :i* su* individual 7or relative or b5efici>y ( su* individual7 is entitl$ on ! basis ( ! individual act+ 9 a role describ$ 9 clause 7i7 ) respect to ! entity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = ! purpose ( adm9i/]+ su* b5efits4 7,g7 ,publicly available in=mation 7i7 ,9 g5]al ,= ! purposes ( subp>agraph 7,c71 ! t]m publicly available in=mation means any in=mation t a cov]$ entity has a reasonable basis to believe-- 7,i7 has be5 lawfully made available to ! g5]al public f ,f$]al1 ,/ate1 or local gov]nm5t records2 7,,ii7 is widely available to ! g5]al public1 includ+ in=mation f-- 7aa7 a telephone book or onl9e directory2 7bb7 television1 int]net1 or radio cont5t or programm+2 or 7cc7 ! news m$ia or a website t is lawfully available to ! g5]al public on an unre/rict$ basis 7= purposes ( ?is subclause a website is n re/rict$ solely because !re is a fee or log-9 requirem5t associat$ ) access+ ! website72 or 7,,iii7 is a disclosure to ! g5]al public t is requir$ to be made by ,f$]al1 ,/ate1 or local law4 7ii7 ,exclusions ,su* t]m does n include an obsc5e visual depiction 7z def9$ = purposes ( section #adfj ( title #ah1 ,unit$ ,/ates ,code74 7#aa7 ,cov]$ entity ,! t]m cov]$ entity means any p]son t-- 7,a7 is subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 or is-- 7i7 a common c>ri] describ$ 9 section #e7;a77#b7 ( su* ,act 7#ae ,u4,s4,c4 #de7;a77#b772 or 7ii7 an organization n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s2 7,b7 collects1 processes1 or transf]s cov]$ data2 & 7,c7 det]m9es ! purposes & means ( su* collection1 process+1 or transf]4 7#ab7 ,cov]$ int]net plat=m 7,a7 ,9 g5]al ,! t]m cov]$ int]net plat=m means any public-fac+ website1 int]net application1 or mobile application1 includ+ a social network site1 video %>+ s]vice1 se>* eng9e1 or cont5t aggregation s]vice4 7,b7 ,exclusions ,su* t]m %all n include a plat=m t-- 7i7 is :olly own$1 controll$1 & op]at$ by a p]son t-- 7,i7 = ! mo/ rec5t #f-mon? p]iod1 did n employ m ?an #ejj employees2 7,,ii7 = ! mo/ rec5t #c-ye> p]iod1 av]ag$ less ?an #ej1jjj1jjj 9 annual gross receipts2 & 7,,iii7 collects or processes on an annual basis ! p]sonal data ( less ?an #a1jjj1jjj individuals2 or 7ii7 is op]at$ = ! sole purpose ( conduct+ rese>* t is n made = pr(it ei!r directly or indirectly4 7#ac7 ,data ,brok] 7,a7 ,9 g5]al ,! t]m data brok] means a cov]$ entity ^: pr9cipal s\rce ( rev5ue is d]iv$ f process+ or transf]r+ ! cov]$ data ( individuals ) :om ! entity does n h a direct relation%ip on behalf ( ?ird p>ties = su* ?ird p>ties' use4 7,b7 ,exclusion ,su* t]m does n include a s]vice provid]4 7#ad7 ,delete ,! t]m delete means to remove or de/roy in=mation su* t x is n ma9ta9$ 9 human or ma*9e readable =m & _c be retriev$ or utiliz$ 9 su* =m 9 ! normal c\rse ( bus9ess4 7#ae7 ,executive ag5cy ,! t]m ,executive ag5cy has ! mean+ set =? 9 section #aje ( title #e1 ,unit$ ,/ates ,code4 7#af7 ,indep5d5t review bo>d ,! t]m indep5d5t review bo>d means a bo>d1 committee1 or o!r gr\p =mally designat$ by a l>ge onl9e op]ator to review1 to approve ! initiation (1 & to conduct p]iodic review (1 any rese>* by1 or at ! direction or discretion ( a l>ge onl9e op]ator1 involv+ human subjects4 7#ag7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7#ah7 ,inf]r$ data ,! t]m inf]r$ data means in=mation t is creat$ by a cov]$ entity ?r\gh ! d]ivation ( in=mation1 data1 assumptions1 or conclusions f facts1 evid5ce1 or ano!r s\rce ( in=mation or data4 7#ai7 ,in=m$ cons5t ,= purposes ( section #bjf1 ! t]m in=m$ cons5t-- 7,a7 means a process by :i* a rese>* subject is provid$ adequate in=mation prior to be+ includ$ 9 any exp]im5t or /udy to all[ = an in=m$ decision ab\t volunt>y p>ticipation 9 a behavioral or psy*ological rese>* exp]im5t or /udy1 :ile ensur+ ! und]/&+ ( ! pot5tial p>ticipant ( ! furni%$ in=mation & any associat$ b5efits1 risks1 or consequ5ces ( p>ticipation prior to obta9+ ! volunt>y agreem5t to p>ticipate by ! p>ticipant2 & 7,b7 does n include-- 7i7 ! cons5t ( an individual "u ! age ( #ac2 or 7ii7 ! cons5t to a provision conta9$ 9 a g5]al contract or s]vice agreem5t4 7#bj7 ,input-transp>5t algori?m 7,a7 ,9 g5]al ,= purposes ( section #bje1 ! t]m input-transp>5t algori?m means an algori?mic rank+ sy/em t does n use ! us]-specific data ( a us] to det]m9e ! ord] or mann] t in=mation is furni%$ to su* us] on a cov]$ int]net plat=m1 unless ! us]-specific data is expressly provid$ to ! plat=m by ! us] = su* purpose4 7,b7 ,inclusion ( age-appropriate cont5t filt]s ,su* t]m %all include an algori?mic rank+ sy/em t uses us]-specific data to det]m9e :e!r a us] is old en\gh to access age-re/rict$ cont5t on a cov]$ int]net plat=m1 provid$ t ! sy/em o!rwise meets ! requirem5ts ( subp>agraph 7,a74 7,c7 ,data provid$ = express purpose ( int]action ) plat=m ,= purposes ( subp>agraph 7,a71 us]-specific data t is provid$ by a us] = ! express purpose ( det]m9+ ! ord] or mann] t in=mation is furni%$ to a us] on a cov]$ int]net plat=m-- 7i7 %all include us]-suppli$ se>* t]ms1 filt]s1 spee* patt]ns 7if provid$ = ! purpose ( enabl+ ! plat=m to accept spok5 input or select+ ! language 9 :i* ! us] int]acts ) ! plat=m71 sav$ pref]5ces1 & ! us]'s curr5t geographical location2 7ii7 %all include data suppli$ to ! plat=m by ! us] t expresses ! us]'s desire t in=mation be furni%$ to !m1 su* z ! social m$ia pr(iles ! us] foll[s1 ! video *annels ! us] subscribes to1 or o!r s\rces ( cont5t on ! plat=m ! us] foll[s2 7iii7 %all n include ! hi/ory ( ! us]'s connect$ device1 includ+ ! us]'s hi/ory ( web se>*es & br[s+1 geographical locations1 physical activity1 device int]action1 & f9ancial transactions2 & 7iv7 %all n include inf]5ces ab\t ! us] or ! us]'s connect$ device1 )\t reg>d to :e!r su* inf]5ces are bas$ on data describ$ 9 clause 7i74 7#ba7 ,l>ge data hold] ,! t]m l>ge data hold] means a cov]$ entity t 9 ! mo/ rec5t cal5d> ye>-- 7,a7 process$ or transf]r$ ! cov]$ data ( m ?an #h1jjj1jjj individuals2 or 7,b7 process$ or transf]r$ ! s5sitive cov]$ data ( m ?an #cjj1jjj individuals or devices t are l9k$ or reasonably l9kable to an individual 7exclud+ any in/ance :]e ! cov]$ entity processes ! log-9 in=mation ( an individual or device to all[ ! individual or device to log 9 to an acc\nt adm9i/]$ by ! cov]$ entity74 7#bb7 ,l>ge onl9e op]ator ,= purposes ( section #bjf1 ! t]m l>ge onl9e op]ator means any p]son t-- 7,a7 provides an onl9e s]vice2 7,b7 has m ?an #ajj1jjj1jjj au!nticat$ us]s ( an onl9e s]vice 9 any #cj-;day p]iod2 & 7,c7 is subject to ! jurisdiction ( ! ,commission "u ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#bc7 ,mat]ial ,! t]m mat]ial means1 ) respect to an act1 practice1 or repres5tation ( a cov]$ entity 7includ+ a repres5tation made by ! cov]$ entity 9 a privacy policy or simil> disclosure to individuals71 t su* act1 practice1 or repres5tation is likely to affect an individual's decision or conduct reg>d+ a product or s]vice4 7#bd7 ,onl9e s]vice ,= purposes ( section #bjf1 ! t]m onl9e s]vice means a website or a s]vice1 o!r ?an an int]net access s]vice1 t is made available to ! public ov] ! int]net1 includ+ a social network1 a se>* eng9e1 or email s]vice4 7#be7 ,opaque algori?m 7,a7 ,9 g5]al ,! t]m opaque algori?m means an algori?mic rank+ sy/em t det]m9es ! ord] or mann] t in=mation is furni%$ to a us] on a cov]$ int]net plat=m bas$1 9 :ole or "p1 on us]-specific data t 0 n expressly provid$ by ! us] to ! plat=m = su* purpose4 7,b7 ,exception = age-appropriate cont5t filt]s ,su* t]m %all n include an algori?mic rank+ sy/em us$ by a cov]$ int]net plat=m if-- 7i7 ! only us]-specific data 7includ+ inf]5ces ab\t ! us]7 t ! sy/em uses is in=mation relat+ to ! age ( ! us]2 & 7ii7 su* in=mation is only us$ to re/rict a us]'s access to cont5t on ! basis t ! individual is n old en\gh to access su* cont5t4 7#bf7 ,process ,! t]m process means any op]ation or set ( op]ations p]=m$ on cov]$ data includ+ analysis1 organization1 /ructur+1 reta9+1 us+1 or o!rwise h&l+ cov]$ data4 7#bg7 ,process+ purpose ,! t]m process+ purpose means a reason = :i* a cov]$ entity processes cov]$ data4 7#bh7 ,rese>* ,! t]m rese>* means ! sci5tific analysis ( in=mation1 includ+ cov]$ data1 by a cov]$ entity or ^? ) :om ! cov]$ entity is coop]at+ or o!rs act+ at ! direction or on behalf ( ! cov]$ entity1 t is conduct$ = ! prim>y purpose ( advanc+ sci5tific k & may be = ! comm]cial b5efit ( ! cov]$ entity4 7#bi7 ,se>* syndication contract2 up/ream provid]2 d[n/ream provid] 7,a7 ,se>* syndication contract ,! t]m se>* syndication contract means a contract or subcontract = ! sale1 lic5se1 or o!r "r to access an index ( web pages on ! int]net = ! purpose ( op]at+ an int]net se>* eng9e4 7,b7 ,up/ream provid] ,! t]m up/ream provid] means1 ) respect to a se>* syndication contract1 ! p]son t grants access to an index ( web pages on ! int]net to a d[n/ream provid] "u ! contract4 7,c7 ,d[n/ream provid] ,! t]m d[n/ream provid] means1 ) respect to a se>* syndication contract1 ! p]son t receives access to an index ( web pages on ! int]net f an up/ream provid] "u su* contract4 7#cj7 ,s5sitive cov]$ data 7,a7 ,9 g5]al ,! t]m s5sitive cov]$ data means any ( ! foll[+ =ms ( cov]$ data ( an individual3 7i7 ,a unique1 gov]nm5t-issu$ id5tifi]1 su* z a ,social ,security numb]1 passport numb]1 or driv]'s lic5se numb]1 t is n requir$ to be display$ to ! public4 7ii7 ,any cov]$ data t describes or reveals ! diagnosis or treatm5t ( ! pa/1 pres5t1 or future physical heal?1 m5tal heal?1 or disability ( an individual4 7iii7 ,a f9ancial acc\nt numb]1 debit c>d numb]1 cr$it c>d numb]1 or any requir$ security or access code1 password1 or cr$5tials all[+ access to any su* acc\nt4 7iv7 ,cov]$ data t is biometric in=mation4 7v7 ,a p]si/5t id5tifi]4 7vi7 ,precise geolocation in=mation4 7vii7 ,! cont5ts ( an individual's private communications1 su* z emails1 texts1 direct messages1 or mail1 or ! id5tity ( ! p>ties subject to su* communications1 unless ! cov]$ entity is ! int5d$ recipi5t ( ! communication4 7viii7 ,acc\nt log-9 cr$5tials su* z a us] "n or email address1 9 comb9ation ) a password or security "q & answ] t w\ld p]mit access to an onl9e acc\nt4 7ix7 ,cov]$ data reveal+ an individual's racial or e?nic orig91 or religion 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ ! process+ or transf] ( su* in=mation4 7x7 ,cov]$ data reveal+ ! sexual ori5tation or sexual behavior ( an individual 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ ! process+ or transf] ( su* in=mation4 7xi7 ,cov]$ data ab\t ! onl9e activities ( an individual t addresses or reveals a category ( cov]$ data describ$ 9 ano!r subp>agraph ( ?is p>agraph4 7xii7 ,cov]$ data t is cal5d> in=mation1 address book in=mation1 phone or text logs1 photos1 or videos ma9ta9$ = private use on an individual's device4 7xiii7 ,any cov]$ data collect$ or process$ by a cov]$ entity = ! purpose ( id5tify+ cov]$ data describ$ 9 ano!r clause ( ?is p>agraph4 7xiv7 ,any o!r category ( cov]$ data designat$ by ! ,commission pursuant to a rulemak+ "u section #eec ( title #e1 ,unit$ ,/ates ,code4 7,b7 ,biometric in=mation ,= purposes ( subp>agraph 7,a71 ! t]m biometric in=mation-- 7i7 means ! physiological or biological *>act]i/ics ( an individual1 includ+ deoxyribonucleic acid1 t are us$1 s+ly or 9 comb9ation ) ea* o!r or ) o!r id5tify+ data1 to e/abli% ! id5tity ( an individual2 & 7ii7 includes-- 7,i7 imag]y ( ! iris1 ret9a1 f+]pr9t1 face1 h&1 palm1 ve9 patt]ns1 & voice record+s1 f :i* an id5tifi] template1 su* z a facepr9t1 a m9utiae template1 or a voicepr9t1 c be extract$2 & 7,,ii7 key/roke patt]ns or rhy?ms1 gait patt]ns or rhy?ms1 & sleep1 heal?1 or ex]cise data t conta9 id5tify+ in=mation4 7,c7 ,p]si/5t id5tifi] ,= purposes ( subp>agraph 7,a71 ! t]m p]si/5t id5tifi] means a te*nologically d]iv$ id5tifi] t id5tifies an individual1 or is l9k$ or reasonably l9kable to an individual ov] "t & across s]vices & plat=ms1 :i* may include a cu/om] numb] held 9 a cookie1 a /atic ,int]net ,protocol address1 a processor or device s]ial numb]1 or ano!r unique device id5tifi]4 7,d7 ,precise geolocation in=mation ,= purposes ( subp>agraph 7,a71 ! t]m precise geolocation in=mation means te*nologically d]iv$ in=mation capable ( det]m9+ ! pa/ or pres5t actual physical location ( an individual or an individual's device at a specific po9t 9 "t to )9 #a1gej feet4 7#ca7 ,s]vice provid] ,! t]m s]vice provid] means1 ) respect to a set ( cov]$ data1 a cov]$ entity t processes or transf]s su* cov]$ data = ! purpose ( p]=m+ "o or m s]vices or functions on behalf (1 & at ! direction (1 ano!r cov]$ entity t-- 7,a7 is n relat$ to ! cov]$ entity provid+ ! s]vice or function by common own]%ip or corporate control2 & 7,b7 does n %>e common br&+ ) ! cov]$ entity provid+ ! s]vice or function4 7#cb7 ,s]vice provid] data ,! t]m s]vice provid] data means1 ) respect to a set ( cov]$ data & a s]vice provid]1 cov]$ data t is collect$ by ! s]vice provid] on behalf ( a cov]$ entity or transf]r$ to ! s]vice provid] by a cov]$ entity = ! purpose ( all[+ ! s]vice provid] to p]=m a s]vice or function on behalf (1 & at ! direction (1 su* cov]$ entity4 7#cc7 ,?ird p>ty ,! t]m ?ird p>ty means1 ) respect to a set ( cov]$ data1 a cov]$ entity-- 7,a7 t is n a s]vice provid] ) respect to su* cov]$ data2 & 7,b7 t receiv$ su* cov]$ data f ano!r cov]$ entity-- 7i7 t is n relat$ to ! cov]$ entity by common own]%ip or corporate control2 & 7ii7 t does n %>e common br&+ ) ! cov]$ entity4 7#cd7 ,?ird p>ty data ,! t]m ?ird p>ty data means1 ) respect to a ?ird p>ty1 cov]$ data t has be5 transf]r$ to ! ?ird p>ty by a cov]$ entity4 7#ce7 ,transf] ,! t]m transf] means to disclose1 release1 %>e1 dissem9ate1 make available1 or lic5se 9 writ+1 electronically1 or by any o!r means = consid]ation ( any k9d or = a comm]cial purpose4 7#cf7 ,us] data ,= purposes ( section #bjf1 ! t]m us] data means any in=mation relat+ to an id5tifi$ or id5tifiable individual us]1 :e!r directly submitt$ to ! l>ge onl9e op]ator by ! us]1 or d]iv$ f ! obs]v$ activity ( ! us] by ! l>ge onl9e op]ator4 7#cg7 ,us]-specific data ,= purposes ( section #bje1 ! t]m us]-specific data means in=mation relat+ to an individual or a specific connect$ device t w\ld n necess>ily be true ( e individual or device4 #c4 ,effective date ,except z o!rwise provid$ 9 ?is ,act1 ?is ,act %all take effect #ah mon?s aft] ! date ( enactm5t ( ?is ,act4 ,i ,individual consum] data rights #aja4 ,consum] loyalty 7a7 ,prohibition on ! d5ial ( products or s]vices 7#a7 ,9 g5]al ,subject to p>agraph 7#b71 a cov]$ entity %all n d5y products or s]vices to an individual because ! individual ex]cises a "r e/abli%$ "u subp>agraph 7,a71 7,b71 or 7,d7 ( section #ajc7;a77#a74 7#b7 ,rules ( application ,a cov]$ entity-- 7,a7 %all n be 9 violation ( p>agraph 7#a7 ) respect to a product or s]vice & an individual if ! ex]cise ( a "r describ$ 9 su* p>agraph by ! individual precludes ! cov]$ entity f provid+ su* product or s]vice to su* individual2 & 7,b7 may (f] diff]5t types ( pric+ & functionalities ) respect to a product or s]vice bas$ on an individual's ex]cise ( a "r describ$ 9 su* p>agraph4 7b7 ,no waiv] ( individual controls ,! rights & obligations creat$ "u section #ajc may n be waiv$ 9 an agreem5t betwe5 a cov]$ entity & an individual4 #ajb4 ,transp>5cy 7a7 ,9 g5]al ,a cov]$ entity t processes cov]$ data %all1 ) respect to su* data1 publi% a privacy policy t is-- 7#a7 disclos$1 9 a cle> & conspicu\s mann]1 to an individual prior to or at ! po9t ( ! collection ( cov]$ data f ! individual2 & 7#b7 made available1 9 a cle> & conspicu\s mann]1 to ! public4 7b7 ,cont5t ( privacy policy ,! privacy policy requir$ "u subsection 7a7 %all include ! foll[+3 7#a7 ,! id5tity & ! contact in=mation ( ! cov]$ entity 7includ+ ! cov]$ entity's po9ts ( contact = privacy & data security inquiries7 & ! id5tity ( any affiliate to :i* cov]$ data may be transf]r$ by ! cov]$ entity4 7#b7 ,! categories ( cov]$ data ! cov]$ entity collects4 7#c7 ,! process+ purposes = ea* category ( cov]$ data ! cov]$ entity collects4 7#d7 ,:e!r ! cov]$ entity transf]s cov]$ data1 ! categories ( recipi5ts to :om ! cov]$ entity transf]s cov]$ data1 & ! purposes ( ! transf]s4 7#e7 ,a g5]al description ( ! cov]$ entity's data ret5tion practices = cov]$ data & ! purposes = su* ret5tion4 7#f7 ,h[ individuals c ex]cise _! rights "u section #ajc4 7#g7 ,a g5]al description ( ! cov]$ entity's data security practices4 7#h7 ,! effective date ( ! privacy policy4 7c7 ,languages ,a privacy policy requir$ "u subsection 7a7 %all be made available 9 all ( ! languages 9 :i* ! cov]$ entity provides a product or s]vice t is subject to ! policy1 or c>ries out activities relat$ to su* product or s]vice4 7d7 ,mat]ial *anges ,if a cov]$ entity makes a mat]ial *ange to its privacy policy1 x %all notify ! individuals affect$ be=e fur!r process+ or transf]r+ ( previ\sly collect$ cov]$ data & provide an opportunity to )draw cons5t to fur!r process+ or transf]r+ ( ! cov]$ data "u ! *ang$ policy4 ,! cov]$ entity %all provide direct notification1 :]e possible1 reg>d+ a mat]ial *ange to ! privacy policy to affect$ individuals1 tak+ into acc\nt available te*nology & ! nature ( ! relation%ip4 7e7 ,application to indirect transf]s ,:]e ! own]%ip ( an individual's device is transf]r$ directly f "o individual to ano!r individual1 a cov]$ entity may satisfy its obligation to disclose a privacy policy prior to or at ! po9t ( collection ( cov]$ data by mak+ ! privacy policy available "u subsection 7a77#b74 #ajc4 ,individual control 7a7 ,access to1 & correction1 deletion1 & portability (1 cov]$ data 7#a7 ,9 g5]al ,subject to p>agraphs 7#b7 & 7#c71 a cov]$ entity %all provide an individual1 imm$iately or z quickly z possible & 9 no case lat] ?an #ij days aft] receiv+ a v]ifi$ reque/ f ! individual1 ) ! "r to reasonably-- 7,a7 access-- 7i7 ! cov]$ data ( ! individual1 or an accurate repres5tation ( ! cov]$ data ( ! individual1 t is or has be5 process$ by ! cov]$ entity or any s]vice provid] ( ! cov]$ entity2 7ii7 if applicable1 a li/ ( categories ( ?ird p>ties & s]vice provid]s to :om ! cov]$ entity has transf]r$ ! cov]$ data ( ! individual2 & 7iii7 if a cov]$ entity transf]s cov]$ data1 a description ( ! purpose = :i* ! cov]$ entity transf]r$ ! cov]$ data ( ! individual to a s]vice provid] or ?ird p>ty2 7,b7 reque/ t ! cov]$ entity-- 7i7 correct mat]ial inaccuracies or mat]ially incomplete in=mation ) respect to ! cov]$ data ( ! individual t is ma9ta9$ by ! cov]$ entity2 & 7ii7 notify any s]vice provid] or ?ird p>ty to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! correct$ in=mation2 7,c7 reque/ t ! cov]$ entity-- 7i7 ei!r delete or de-id5tify cov]$ data ( ! individual t is or has be5 ma9ta9$ by ! cov]$ entity2 & 7ii7 notify any s]vice provid] or ?ird p>ty to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! individual's reque/1 unless ! transf] ( su* data to ! ?ird p>ty 0 made at ! direction ( ! individual2 & 7,d7 to ! ext5t t is te*nically feasible1 provide cov]$ data ( ! individual t is or has be5 g5]at$ & submitt$ to ! cov]$ entity by ! individual & ma9ta9$ by ! cov]$ entity 9 a portable1 /ructur$1 & ma*9e-readable =mat t is n subject to lic5s+ re/rictions4 7#b7 ,frequ5cy & co/ ( access ,a cov]$ entity %all-- 7,a7 provide an individual ) ! opportunity to ex]cise ! rights describ$ 9 p>agraph 7#a7 n less ?an twice 9 any #ab-mon? p]iod2 & 7,b7 ) respect to ! fir/ #b times t an individual ex]cises ! rights describ$ 9 p>agraph 7#a7 9 any #ab-mon? p]iod1 all[ ! individual to ex]cise su* rights free ( *>ge4 7#c7 ,exceptions ,a cov]$ entity-- 7,a7 %all n comply ) a reque/ to ex]cise ! rights describ$ 9 p>agraph 7#a7 if ! cov]$ entity _c v]ify t ! individual mak+ ! reque/ is ! individual to :om ! cov]$ data t is ! subject ( ! reque/ relates2 7,b7 may decl9e to comply ) a reque/ t w\ld-- 7i7 require ! cov]$ entity to reta9 any cov]$ data = ! sole purpose ( fulfill+ ! reque/2 7ii7 be impossible or demon/rably impracticable to comply )2 or 7iii7 require ! cov]$ entity to comb9e1 rel9k1 or o!rwise re-id5tify cov]$ data t has be5 de-id5tifi$2 7iv7 result 9 ! release ( trade secrets1 or o!r propriet>y or confid5tial data or bus9ess practices2 7v7 int]f]e ) law en=cem5t1 judicial proce$+s1 inve/igations1 or reasonable ef=ts to gu>d aga9/1 detect1 or inve/igate malici\s or unlawful activity1 or en=ce contracts2 7vi7 require disproportionate ef=t1 tak+ into consid]ation available te*nology1 or w\ld n be reasonably feasible on te*nical gr\nds2 7vii7 compromise ! privacy1 security1 or o!r rights ( ! cov]$ data ( ano!r individual2 7viii7 be excessive or abusive to ano!r individual2 or 7ix7 violate ,f$]al or ,/ate law or ! rights & fre$oms ( ano!r individual1 includ+ "u ! ,con/itution ( ! ,unit$ ,/ates2 & 7,c7 may delete cov]$ data in/ead ( provid+ access & correction rights "u subp>agraphs 7,a7 & 7,b7 ( p>agraph 7#a7 if su* cov]$ data-- 7i7 is n s5sitive cov]$ data2 & 7ii7 is us$ only = ! purposes ( contact+ individuals ) respect to m>ket+ communications4 7b7 ,regulations ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 e/abli%+ requirem5ts = cov]$ entities ) respect to ! v]ification ( reque/s to ex]cise rights describ$ 9 subsection 7a77#a74 #ajd4 ,rights to cons5t 7a7 ,cons5t ,except z provid$ 9 section #ajh1 a cov]$ entity %all n1 )\t ! prior1 affirmative express cons5t ( an individual-- 7#a7 transf] s5sitive cov]$ data ( ! individual to a ?ird p>ty2 or 7#b7 process s5sitive cov]$ data ( ! individual4 7b7 ,requirem5ts = affirmative express cons5t ,9 obta9+ ! affirmative express cons5t ( an individual to process ! s5sitive cov]$ data ( ! individual z requir$ "u subsection 7a77#b71 a cov]$ entity %all provide ! individual ) notice t %all-- 7#a7 include a cle> description ( ! process+ purpose = :i* ! s5sitive cov]$ data w be process$2 7#b7 cle>ly id5tify any process+ purpose t is necess>y to fulfill a reque/ made by ! individual2 7#c7 include a prom95t head+ t w\ld enable a reasonable individual to easily id5tify ! process+ purpose = :i* cons5t is s\ght2 & 7#d7 cle>ly expla9 ! individual's "r to provide or )hold cons5t4 7c7 ,requirem5ts relat$ to m9ors ,a cov]$ entity %all n transf] ! cov]$ data ( an individual to a ?ird p>ty )\t affirmative express cons5t f ! individual or ! individual's p>5t or gu>dian if ! cov]$ entity has actual k t ! individual is betwe5 #ac & #af ye>s ( age4 7d7 ,"r ,to opt out ,except z provid$ 9 section #ajh1 a cov]$ entity %all provide an individual ) ! ability to opt out ( ! collection1 process+1 or transf] ( su* individual's cov]$ data be=e su* collection1 process+1 or transf] occurs4 7e7 ,prohibition on inf]r$ cons5t ,a cov]$ entity %all n inf] t an individual has provid$ affirmative express cons5t to a process+ purpose f ! inaction ( ! individual or ! individual's cont9u$ use ( a s]vice or product provid$ by ! cov]$ entity4 7f7 ,)drawal ( cons5t ,a cov]$ entity %all provide an individual ) a cle> & conspicu\s means to )draw affirmative express cons5t4 7g7 ,rulemak+ ,! ,commission may promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to e/abli% requirem5ts = cov]$ entities reg>d+ cle> & conspicu\s proc$ures = all[+ individuals to provide or )draw affirmative express cons5t = ! collection ( s5sitive cov]$ data4 #aje4 ,m9imiz+ data collection1 process+1 & ret5tion 7a7 ,9 g5]al ,a cov]$ entity %all n collect1 process1 or transf] cov]$ data beyond-- 7#a7 :at is reasonably necess>y1 proportionate1 & limit$ to provide or improve a product1 s]vice1 or a communication ab\t a product or s]vice1 includ+ :at is reasonably necess>y1 proportionate1 & limit$ to provide a product or s]vice specifically reque/$ by an individual or reasonably anticipat$ )9 ! context ( ! cov]$ entity's ongo+ relation%ip ) an individual2 7#b7 :at is reasonably necess>y1 proportionate1 or limit$ to o!rwise process or transf] cov]$ data 9 a mann] t is describ$ 9 ! privacy policy t ! cov]$ entity is requir$ to publi% "u section #ajb7;a72 or 7#c7 :at is expressly p]mitt$ by ?is ,act or any o!r applicable ,f$]al law4 7b7 ,be/ practices ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidel9es recomm5d+ be/ practices = cov]$ entities to m9imize ! collection1 process+1 & transf] ( cov]$ data 9 accordance ) ?is section4 7c7 ,rule ( con/ruction ,not)/&+ section #dje ( ?is ,act1 no?+ 9 ?is section sup]s$es any o!r provision ( ?is ,act or o!r applicable ,f$]al law4 #ajf4 ,s]vice provid]s & ?ird p>ties 7a7 ,s]vice provid]s ,a s]vice provid]-- 7#a7 %all n process s]vice provid] data = any process+ purpose t is n p]=m$ on behalf (1 & at ! direction (1 ! cov]$ entity t transf]r$ ! data to ! s]vice provid]2 7#b7 %all n transf] s]vice provid] data to a ?ird p>ty = any purpose o!r ?an a purpose p]=m$ on behalf (1 or at ! direction (1 ! cov]$ entity t transf]r$ ! data to ! s]vice provid] )\t ! affirmative express cons5t ( ! individual to :om ! s]vice provid] data relates2 7#c7 at ! direction ( ! cov]$ entity t transf]r$ s]vice provid] data to ! s]vice provid]1 %all delete or de-id5tify su* data-- 7,a7 z soon z practicable aft] ! s]vice provid] has complet$ provid+ ! s]vice or function = :i* ! data 0 transf]r$ to ! s]vice provid]2 or 7,b7 z soon z practicable aft] ! end ( ! p]iod dur+ :i* ! s]vice provid] is to provide s]vices ) respect to su* data1 z agre$ to by ! s]vice provid] & ! cov]$ entity t transf]r$ ! data2 7#d7 is exempt f ! requirem5ts ( section #ajc ) respect to s]vice provid] data1 b %all1 to ! ext5t practicable-- 7,a7 assi/ ! cov]$ entity f :i* x receiv$ ! s]vice provid] data 9 fulfill+ reque/s to ex]cise rights "u section #ajc7;a72 & 7,b7 ^u receiv+ notice f a cov]$ entity ( a v]ifi$ reque/ made "u section #ajc7;a77#a7 to delete1 de-id5tify1 or correct s]vice provid] data held by ! s]vice provid]1 delete1 de-id5tify1 or correct su* data2 & 7#e7 is exempt f ! requirem5ts ( sections #ajd & #aje4 7b7 ,?ird p>ties ,a ?ird p>ty-- 7#a7 %all n process ?ird p>ty data = a process+ purpose inconsi/5t ) ! reasonable expectation ( ! individual to :om su* data relates2 7#b7 = purposes ( p>agraph 7#a71 may reasonably rely on repres5tations made by ! cov]$ entity t transf]r$ ?ird p>ty data reg>d+ ! reasonable expectations ( individuals to :om su* data relates1 provid$ t ! ?ird p>ty conducts reasonable due dilig5ce on ! repres5tations ( ! cov]$ entity & f9ds ^? repres5tations to be cr$ible2 & 7#c7 is exempt f ! requirem5ts ( sections #ajd & #aje4 7c7 ,bankruptcy ,9 ! ev5t t a cov]$ entity ent]s into a bankruptcy proce$+ :i* w\ld lead to ! disclosure ( cov]$ data to a ?ird p>ty1 ! cov]$ entity %all 9 a reasonable "t prior to ! disclosure-- 7#a7 provide notice ( ! propos$ disclosure ( cov]$ data1 includ+ ! "n ( ! ?ird p>ty & _! policies & practices ) respect to ! cov]$ data1 to all affect$ individuals2 & 7#b7 provide ea* affect$ individual ) ! opportunity to )draw any previ\s affirmative express cons5t relat$ to ! cov]$ data ( ! individual or reque/ ! deletion or de-id5tification ( ! cov]$ data ( ! individual4 7d7 ,additional obligations on cov]$ entities 7#a7 ,9 g5]al ,a cov]$ entity %all ex]cise reasonable due dilig5ce to ensure compliance ) ?is section be=e-- 7,a7 select+ a s]vice provid]2 or 7,b7 decid+ to transf] cov]$ data to a ?ird p>ty4 7#b7 ,guidance ,n lat] ?an #b ye>s aft] ! effective date ( ?is ,act1 ! ,commission %all publi% guidance reg>d+ compliance ) ?is subsection4 ,su* guidance %all1 to ! ext5t practicable1 m9imize unreasonable burd5s on small- & m$ium-siz$ cov]$ entities4 #ajg4 ,privacy impact assessm5ts 7a7 ,privacy impact assessm5ts ( new or mat]ial *anges to process+ ( cov]$ data 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act 7or1 if lat]1 n lat] ?an #a ye> aft] a cov]$ entity fir/ meets ! def9ition ( a l>ge data hold] 7z def9$ 9 section #b771 ea* cov]$ entity t is a l>ge data hold] %all conduct a privacy impact assessm5t ( ea* ( _! process+ activities involv+ cov]$ data t pres5t a height5$ risk ( h>m to individuals1 & ea* su* assessm5t %all weigh ! b5efits ( ! cov]$ entity's cov]$ data collection1 process+1 & transf] practices aga9/ ! pot5tial adv]se consequ5ces to individual privacy ( su* practices4 7#b7 ,assessm5t requirem5ts ,a privacy impact assessm5t requir$ "u p>agraph 7#a7-- 7,a7 %all be reasonable & appropriate 9 scope giv5-- 7i7 ! nature ( ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7ii7 ! volume ( ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7iii7 ! size ( ! cov]$ entity2 & 7iv7 ! pot5tial risks pos$ to ! privacy ( individuals by ! collection1 process+1 or transf] ( cov]$ data by ! cov]$ entity2 7,b7 %all be docum5t$ 9 writt5 =m & ma9ta9$ by ! cov]$ entity unless r5d]$ out ( date by a subsequ5t assessm5t conduct$ "u subsection 7b72 & 7,c7 %all be approv$ by ! data privacy (fic] ( ! cov]$ entity4 7b7 ,ongo+ privacy impact assessm5ts 7#a7 ,9 g5]al ,a cov]$ entity t is a l>ge data hold] %all1 n less frequ5tly ?an once e #b ye>s aft] ! cov]$ entity conduct$ ! privacy impact assessm5t requir$ "u subsection 7a71 conduct a privacy impact assessm5t ( ! collection1 process+1 & transf] ( cov]$ data by ! cov]$ entity to assess ! ext5t to :i*-- 7,a7 ! ongo+ practices ( ! cov]$ entity are consi/5t ) ! cov]$ entity's publi%$ privacy policies & o!r repres5tations t ! cov]$ entity makes to individuals2 7,b7 any cu/omizable privacy sett+s includ$ 9 a s]vice or product (f]$ by ! cov]$ entity are adequately accessible to individuals :o use ! s]vice or product & are effective 9 meet+ ! privacy pref]5ces ( su* individuals2 7,c7 ! practices & privacy sett+s describ$ 9 subp>agraphs 7,a7 & 7,b71 respectively-- 7i7 meet ! expectations ( a reasonable individual2 & 7ii7 provide an individual ) adequate control ov] ! individual's cov]$ data2 7,d7 ! cov]$ entity c\ld enhance ! privacy & security ( cov]$ data ?r\gh te*nical or op]ational safegu>ds su* z encryption1 de-id5tification1 & o!r privacy-enhanc+ te*nologies2 & 7,e7 ! process+ ( cov]$ data is compatible ) ! /at$ purposes = :i* x 0 collect$4 7#b7 ,approval by data privacy (fic] ,! data privacy (fic] ( a cov]$ entity %all approve ! f9d+s ( an assessm5t conduct$ by ! cov]$ entity "u ?is subsection4 #ajh4 ,scope ( cov]age 7a7 ,g5]al exceptions ,not)/&+ any provision ( ?is title o!r ?an subsections 7a7 ?r\gh 7c7 ( section #ajb1 a cov]$ entity may collect1 process or transf] cov]$ data = any ( ! foll[+ purposes1 provid$ t ! collection1 process+1 or transf] is reasonably necess>y1 proportionate1 & limit$ to su* purpose3 7#a7 ,to initiate or complete a transaction or to fulfill an ord] or provide a s]vice specifically reque/$ by an individual1 includ+ associat$ r\t9e adm9i/rative activities su* z bill+1 %ipp+1 f9ancial report+1 & acc\nt+4 7#b7 ,to p]=m int]nal sy/em ma9t5ance1 diagno/ics1 product or s]vice managem5t1 inv5tory managem5t1 & network managem5t4 7#c7 ,to prev5t1 detect1 or respond to a security incid5t or trespass+1 provide a secure environm5t1 or ma9ta9 ! safety & security ( a product1 s]vice1 or individual4 7#d7 ,to protect aga9/ malici\s1 deceptive1 fraudul5t1 or illegal activity4 7#e7 ,to comply ) a legal obligation or ! e/abli%m5t1 ex]cise1 analysis1 or def5se ( legal claims or rights1 or z requir$ or specifically au?oriz$ by law4 7#f7 ,to comply ) a civil1 crim9al1 or regulatory inquiry1 inve/igation1 subpo5a1 or summons by an ,executive ag5cy4 7#g7 ,to coop]ate ) an ,executive ag5cy or a law en=cem5t (ficial act+ "u ! au?ority ( an ,executive or ,/ate ag5cy conc]n+ conduct or activity t ! ,executive ag5cy or law en=cem5t (ficial reasonably & 9 good fai? believes may violate ,f$]al1 ,/ate1 or local law1 or pose a ?reat to public safety or national security4 7#h7 ,to address risks to ! safety ( an individual or gr\p ( individuals1 or to ensure cu/om] safety1 includ+ by au!nticat+ individuals 9 ord] to provide access to l>ge v5ues op5 to ! public4 7#i7 ,to effectuate a product recall pursuant to ,f$]al or ,/ate law4 7#aj7 ,to conduct public or pe]-review$ sci5tific1 hi/orical1 or /ati/ical rese>* t-- 7,a7 is 9 ! public int]e/2 7,b7 adh]es to all applicable e?ics & privacy laws2 & 7,c7 is approv$1 monitor$1 & gov]n$ by an in/itutional review bo>d or o!r ov]sight entity t meets /&>ds promulgat$ by ! ,commission pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code4 7#aa7 ,to transf] cov]$ data to a s]vice provid]4 7#ab7 ,= a purpose id5tifi$ by ! ,commission pursuant to a regulation promulgat$ "u subsection 7b74 7b7 ,additional purposes ,! ,commission may promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 id5tify+ additional purposes = :i* a cov]$ entity may collect1 process or transf] cov]$ data4 7c7 ,small bus9ess exception ,sections #ajc1 #aje1 & #cja %all n apply 9 ! case ( a cov]$ entity t c e/abli% t1 = ! #c prec$+ cal5d> ye>s 7or = ! p]iod dur+ :i* ! cov]$ entity has be5 9 exi/5ce if su* p]iod is less ?an #c ye>s7-- 7#a7 ! cov]$ entity's av]age annual gross rev5ues did n exce$ #ej1jjj1jjj2 7#b7 on av]age1 ! cov]$ entity annually process$ ! cov]$ data ( less ?an #a1jjj1jjj individuals2 7#c7 ! cov]$ entity nev] employ$ m ?an #ejj individuals at any "o "t2 & 7#d7 ! cov]$ entity d]iv$ less ?an #ej p]c5t ( its rev5ues f transf]r+ cov]$ data4 ,,ii ,data transp>5cy1 integrity1 & security #bja4 ,algori?m bias1 detection1 & mitigation 7a7 ,,ftc en=cem5t assi/ance 7#a7 ,9 g5]al ,:5ev] ! ,commission obta9s in=mation t a cov]$ entity may h process$ or transf]r$ cov]$ data 9 violation ( ,f$]al anti-discrim9ation laws1 ! ,commission %all transmit su* in=mation 7exclud+ any su* in=mation t is a trade secret z def9$ by section #ahci ( title #ah1 ,unit$ ,/ates ,code7 to ! appropriate ,executive ag5cy or ,/ate ag5cy ) au?ority to initiate proce$+s relat+ to su* violation4 7#b7 ,annual report ,beg9n+ 9 #bjba1 ! ,commission %all submit an annual report to ,congress t includes-- 7,a7 a summ>y ( ! types ( in=mation ! ,commission transmitt$ to ,executive ag5cies or ,/ate ag5cies dur+ ! prec$+ ye> pursuant to ?is subsection2 & 7,b7 a summ>y ( h[ su* in=mation relates to ,f$]al anti-discrim9ation laws4 7#c7 ,coop]ation ) o!r ag5cies ,! ,commission may implem5t ?is subsection by execut+ agreem5ts or memor&a ( und]/&+ ) ! appropriate ,executive ag5cies4 7#d7 ,relation%ip to o!r laws ,not)/&+ section #dje1 no?+ 9 ?is subsection %all sup]s$e any o!r provision ( law4 7b7 ,algori?m transp>5cy reports 7#a7 ,/udy & report 7,a7 ,/udy ,! ,commission %all conduct a /udy1 us+ ! ,commission's au?ority "u section #f7;b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;b771 exam9+ ! use ( algori?ms to process cov]$ data 9 a mann] t may violate ,f$]al anti-discrim9ation laws4 7,b7 ,report ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all publi% a report conta9+ ! results ( ! /udy requir$ "u subp>agraph 7,a74 7,c7 ,guidance ,! ,commission %all use ! results ( ! /udy describ$ 9 p>agraph 7,a7 to develop guidance to assi/ cov]$ entities 9 avoid+ ! discrim9atory use ( algori?ms4 7#b7 ,updat$ report ,n lat] ?an #e ye>s aft] ! publication ( ! report requir$ "u p>agraph 7#a71 ! ,commission %all publi% an updat$ report4 #bjb4 ,digital cont5t =g]ies 7a7 ,def9ition ,n lat] ?an #f mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,national ,in/itute ( ,/&>ds & ,te*nology %all develop & publi% a def9ition ( digital cont5t =g]y & accompany+ explanatory mat]ials4 7b7 ,elem5ts ( def9ition ,9 develop+ a def9ition ( digital cont5t =g]y "u subsection 7a71 ! ,national ,in/itute ( ,/&>ds & ,te*nology %all consid] ! foll[+ factors3 7#a7 ,:e!r ! cont5t is creat$ ) ! int5t to deceive an individual into believ+ ! cont5t 0 g5u9e4 7#b7 ,:e!r ! cont5t is g5u9e or manipulat$4 7#c7 ,! impression ! cont5t makes on a reasonable individual t obs]ves ! cont5t4 7#d7 ,:e!r ! production ( ! cont5t 0 sub/antially dep5d5t ^u te*nical means1 r ?an ! ability ( ano!r individual to physically or v]bally imp]sonate su* individual4 7#e7 ,! scope ( te*nologies t may be utiliz$ dur+ ! creation or publication ( digital cont5t =g]ies1 includ+-- 7,a7 video record+ or film2 7,b7 s\nd record+2 7,c7 electronic image or photograph2 or 7,d7 any digital repres5tation ( spee* or conduct4 7c7 ,scope ( def9ition ,! def9ition publi%$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology "u subsection 7a7 %all n sup]s$e any o!r provision ( law or be con/ru$ to limit ! au?ority ( any ,executive ag5cy relat$ to digital cont5t =g]ies4 7d7 ,commission reports 7#a7 ,initial report ,n lat] ?an #a ye> aft] ! ,national ,in/itute ( ,/&>ds & ,te*nology publi%es ! def9ition & mat]ials requir$ "u subsection 7a71 ! ,commission %all publi% a report reg>d+ ! impact ( digital cont5t =g]ies on individuals & competition4 7#b7 ,subsequ5t reports ,n lat] ?an #b ye>s aft] ! publication ( ! report requir$ "u p>agraph 7#a71 & z (t5 z ! ,commission %all deem necess>y !reaft]1 ! ,commission %all publi% an updat$ v]sion ( su* report4 7#c7 ,cont5t ( reports ,ea* report requir$ "u ?is subsection %all include-- 7,a7 a description ( ! types ( digital cont5t =g]ies1 includ+ ^? us$ to commit fraud1 cause adv]se consequ5ces1 violate any provision ( law en=c$ by ! ,commission1 or violate civil rights recogniz$ "u ,f$]al law2 7,b7 a description ( ! common s\rces 9 ! ,unit$ ,/ates ( digital cont5t =g]ies & comm]cial s\rces ( digital cont5t =g]y te*nologies2 7,c7 an assessm5t ( ! uses1 applications1 & adv]se consequ5ces ( digital cont5t =g]ies1 includ+ ! impact ( digital cont5t =g]ies on individuals1 digital id5tity1 & competition2 7,d7 an analysis ( ! me?ods available to individuals to id5tify digital cont5t =g]ies z well z a description ( comm]cial te*nological c\nt]measures t are1 or c\ld be1 us$ to address conc]ns ) digital cont5t =g]ies1 :i* may include c\nt]measures t w>n individuals ( suspect cont5t2 7,e7 a description ( any rem$ies available to protect an individual's id5tity & reputation f adv]se consequ5ces caus$ by digital cont5t =g]ies1 su* z protections or rem$ies available "u ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 or any o!r law2 & 7,f7 any additional in=mation ! ,commission det]m9es appropriate4 7e7 ,e/abli%m5t ( digital cont5t =g]y prize competition ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 9 coord9ation ) ! ,commission1 %all e/abli% "u section #bd ( ! ,/ev5son-,wydl] ,te*nology ,innovation ,act ( #aihj 7#ae ,u4,s4,c4 #cgai7 a prize competition to spur ! developm5t ( te*nical solutions to assi/ individuals & ! public 9 id5tify+ digital cont5t =g]ies & relat$ te*nologies4 #bjc4 ,data brok]s 7a7 ,9 g5]al ,n lat] ?an ,janu>y #ca ( ea* cal5d> ye> t foll[s a cal5d> ye> dur+ :i* a cov]$ entity act$ z a data brok]1 su* cov]$ entity %all regi/] ) ! ,commission pursuant to ! requirem5ts ( ?is section4 7b7 ,regi/ration requirem5ts ,9 regi/]+ ) ! ,commission z requir$ "u subsection 7a71 a data brok] %all d ! foll[+3 7#a7 ,pay to ! ,commission a regi/ration fee ( #ajj4 7#b7 ,provide ! ,commission ) ! foll[+ in=mation3 7,a7 ,! "n & prim>y physical1 email1 & int]net addresses ( ! data brok]4 7,b7 ,any additional in=mation or explanation ! data brok] *ooses to provide conc]n+ its data collection & process+ practices4 7c7 ,p5alties ,a data brok] t fails to regi/] z requir$ "u subsection 7a7 %all be liable =-- 7#a7 a civil p5alty ( #ej = ea* day x fails to regi/]1 n to exce$ a total ( #aj1jjj = ea* ye>2 & 7#b7 an am\nt equal to ! fees due "u ?is section = ea* ye> t x fail$ to regi/] z requir$ "u subsection 7a74 7d7 ,publication ( regi/ration in=mation ,! ,commission %all publi% on ! int]net website ( ! ,commission ! regi/ration in=mation provid$ by data brok]s "u ?is section4 #bjd4 ,protection ( cov]$ data 7a7 ,9 g5]al ,a cov]$ entity %all e/abli%1 implem5t1 & ma9ta9 reasonable adm9i/rative1 te*nical1 & physical data security policies & practices to protect aga9/ risks to ! confid5tiality1 security1 & integrity ( cov]$ data4 7b7 ,data security requirem5ts ,! data security policies & practices requir$ "u subsection 7a7 %all be-- 7#a7 appropriate to ! size & complexity ( ! cov]$ entity1 ! nature & scope ( ! cov]$ entity's collection or process+ ( cov]$ data1 ! volume & nature ( ! cov]$ data at issue1 & ! co/ ( available tools to improve security & r$uce vuln]abilities2 & 7#b7 design$ to-- 7,a7 id5tify & assess vuln]abilities to cov]$ data2 7,b7 take reasonable prev5tative & corrective action to address kn[n vuln]abilities to cov]$ data2 & 7,c7 detect1 respond to1 & recov] f cyb]security incid5ts relat$ to cov]$ data4 7c7 ,rulemak+ & guidance 7#a7 ,rulemak+ au?ority & scope 7,a7 ,9 g5]al ,! ,commission may1 pursuant to a proce$+ 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 issue regulations to id5tify processes = receiv+ & assess+ in=mation reg>d+ vuln]abilities to cov]$ data t are report$ to ! cov]$ entity4 7,b7 ,consultation ) ,,ni/ ,9 promulgat+ regulations "u ?is p>agraph1 ! ,commission %all consult )1 & take into consid]ation guidance f1 ! ,national ,in/itute = ,/&>ds & ,te*nology 7#b7 ,guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance to cov]$ entities on h[ to-- 7,a7 id5tify & assess vuln]abilities to cov]$ data1 includ+-- 7i7 ! pot5tial = unau?oriz$ access to cov]$ data2 7ii7 vuln]abilities 9 ! cov]$ entity's collection or process+ ( cov]$ data2 7iii7 ! managem5t ( access rights2 & 7iv7 ! use ( s]vice provid]s to process cov]$ data2 7,b7 take reasonable prev5tative & corrective action to address vuln]abilities to cov]$ data2 & 7,c7 detect1 respond to1 & recov] f cyb]security incid5ts & ev5ts4 7d7 ,applicability ( o!r in=mation security laws ,a cov]$ entity t is requir$ to comply ) title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 or ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq471 & is 9 compliance ) ! in=mation security requirem5ts ( su* ,act1 %all be deem$ to be 9 compliance ) ! requirem5ts ( ?is section ) respect to cov]$ data t is subject to ! requirem5ts ( su* ,act4 #bje4 ,filt] bubble transp>5cy 7a7 ,9 g5]al ,beg9n+ on ! date t is #a ye> aft] ! date ( enactm5t ( ?is ,act1 x %all be unlawful-- 7#a7 = any p]son to op]ate a cov]$ int]net plat=m t uses an opaque algori?m unless ! p]son complies ) ! requirem5ts ( subsection 7b72 or 7#b7 = any up/ream provid] to grant access to an index ( web pages on ! int]net "u a se>* syndication contract t does n comply ) ! requirem5ts ( subsection 7c74 7b7 ,opaque algori?m requirem5ts 7#a7 ,9 g5]al ,! requirem5ts ( ?is subsection ) respect to a p]son t op]ates a cov]$ int]net plat=m t uses an opaque algori?m are ! foll[+3 7,a7 ,! p]son provides notice to us]s ( ! plat=m t ! plat=m uses an opaque algori?m t makes inf]5ces bas$ on us]-specific data to select ! cont5t ! us] sees4 ,su* notice %all be pres5t$ 9 a cle>1 conspicu\s mann] on ! plat=m :5ev] ! us] int]acts ) an opaque algori?m = ! fir/ "t1 & may be a "o-"t notice t c be dismiss$ by ! us]4 7,b7 ,! p]son makes available a v]sion ( ! plat=m t uses an input-transp>5t algori?m & enables us]s to easily swit* betwe5 ! v]sion ( ! plat=m t uses an opaque algori?m & ! v]sion ( ! plat=m t uses ! input-transp>5t algori?m by select+ a prom95tly plac$ icon1 :i* %all be display$ :]ev] ! us] int]acts ) an opaque algori?m4 7#b7 ,nonapplication to c]ta9 d[n/ream provid]s ,p>agraph 7#a7 %all n apply ) respect to an int]net se>* eng9e if-- 7,a7 ! se>* eng9e is op]at$ by a d[n/ream provid] ) few] ?an #a1jjj employees2 & 7,b7 ! se>* eng9e uses an index ( web pages on ! int]net to :i* su* provid] receiv$ access "u a se>* syndication contract4 7c7 ,se>* syndication contract requirem5t ,! requirem5ts ( ?is subsection ) respect to a se>* syndication contract are t-- 7#a7 z "p ( ! contract1 ! up/ream provid] makes available to ! d[n/ream provid] ! same input-transp>5t algori?m us$ by ! up/ream provid] = purposes ( comply+ ) subsection 7b77#a77;,b72 & 7#b7 ! up/ream provid] does n impose any additional co/s1 degrad$ quality1 r$uc$ spe$1 or o!r con/ra9t on ! function+ ( su* algori?m :5 us$ by ! d[n/ream provid] to op]ate an int]net se>* eng9e relative to ! p]=mance ( su* algori?m :5 us$ by ! up/ream provid] to op]ate an int]net se>* eng9e4 #bjf4 ,unfair & deceptive acts & practices relat+ to ! manipulation ( us] int]faces 7a7 ,conduct prohibit$ 7#a7 ,9 g5]al ,x %all be unlawful = any l>ge onl9e op]ator-- 7,a7 to design1 modify1 or manipulate a us] int]face ) ! purpose or sub/antial effect ( obscur+1 subv]t+1 or impair+ us] autonomy1 decision mak+1 or *oice to obta9 cons5t or us] data2 7,b7 to subdivide or segm5t consum]s ( onl9e s]vices into gr\ps = ! purposes ( behavioral or psy*ological exp]im5ts or /udies1 except ) ! in=m$ cons5t ( ea* us] involv$2 or 7,c7 to design1 modify1 or manipulate a us] int]face on a website or onl9e s]vice1 or portion !re(1 t is direct$ to an individual "u ! age ( #ac1 ) ! purpose or sub/antial effect ( cultivat+ compulsive usage1 includ+ video auto-play functions initiat$ )\t ! cons5t ( a us]4 7b7 ,duties ( l>ge onl9e op]ators ,any l>ge onl9e op]ator t engages 9 any =m ( behavioral or psy*ological rese>* bas$ on ! activity or data ( its us]s %all-- 7#a7 disclose to its us]s on a r\t9e basis1 b n less ?an once ea* #ij days1 any exp]im5ts or /udies t a us] 0 subject$ to or enroll$ 9 ) ! purpose ( promot+ engagem5t or product conv]sion2 7#b7 disclose to ! public on a r\t9e basis1 b n less ?an once ea* #ij days1 any exp]im5ts or /udies ) ! purposes ( promot+ engagem5t or product conv]sion be+ curr5tly und]tak51 or conclud$ s9ce ! prior disclosure2 7#c7 %all pres5t ! disclosures 9 p>agraphs 7#a7 & 7#b7 9 a mann] t-- 7,a7 is cle>1 conspicu\s1 context appropriate1 & easily accessible2 & 7,b7 is n deceptively obscur$2 7#d7 e/abli% an ,indep5d5t ,review ,bo>d = any behavioral or psy*ological rese>*1 ( any purpose1 conduct$ on us]s or on ! basis ( us] activity or data1 :i* %all review & h au?ority to approve1 require modification 91 or disapprove all behavioral or psy*ological exp]im5ts or rese>*2 & 7#e7 ensure t any ,indep5d5t ,review ,bo>d e/abli%$ "u p>agraph 7#d7 %all regi/] ) ! ,commission1 includ+ provid+ to ! ,commission-- 7,a7 ! names & resumes ( e bo>d memb]2 7,b7 ! composition & report+ /ructure ( ! ,bo>d to ! managem5t ( ! op]ator2 7,c7 ! process by :i* ! ,bo>d is to be notifi$ ( propos$ /udies or modifications along ) ! processes by :i* ! ,bo>d is capable ( veto+ or am5d+ su* proposals2 7,d7 any comp5sation provid$ to bo>d memb]s2 & 7,e7 any conflict ( int]e/ t might exi/ conc]n+ a bo>d memb]'s p>ticipation 9 ! ,bo>d4 7c7 ,regi/]$ pr(essional /&>ds body 7#a7 ,9 g5]al ,an association ( l>ge onl9e op]ators may regi/] z a pr(essional /&>ds body by fil+ ) ! ,commission an application = regi/ration 9 su* =m z ! ,commission1 by rule1 may prescribe conta9+ ! rules ( ! association & su* o!r in=mation & docum5ts z ! ,commission1 by rule1 may prescribe z necess>y or appropriate 9 ! public int]e/ or = protect+ ! welf>e ( us]s ( l>ge onl9e op]ators4 7#b7 ,pr(essional /&>ds body ,an association ( l>ge onl9e op]ators may n regi/] z a pr(essional /&>ds body unless ! ,commission det]m9es t-- 7,a7 ! association is s organiz$ & has ! capacity to en=ce compliance by its memb]s & p]sons associat$ ) its memb]s1 ) ! provisions ( ?is ,act2 7,b7 ! rules ( ! association provide t any l>ge onl9e op]ator may become a memb] ( su* association2 7,c7 ! rules ( ! association ensure a fair repres5tation ( its memb]s 9 ! selection ( its directors & adm9i/ration ( its affairs & provide t "o or m directors %all be repres5tative ( us]s & n be associat$ )1 or receive any direct or indirect fund+ f1 a memb] ( ! association or any l>ge onl9e op]ator2 7,d7 ! rules ( ! association are design$ to prev5t exploitative & manipulative acts or practices1 to promote transp>5t & fair pr9ciples ( te*nology developm5t & design1 to promote rese>* 9 keep+ ) be/ practices ( /udy design & in=m$ cons5t1 & to cont9ually evaluate indu/ry practices & issue b9d+ guidance consi/5t ) ! objectives ( ?is ,act2 7,e7 ! rules ( ! association provide t its memb]s & p]sons associat$ ) its memb]s %all be appropriately discipl9$ = violation ( any provision ( ?is ,act1 ! rules or regulations !reund]1 or ! rules ( ! association1 by expulsion1 susp5sion1 limitation ( activities1 functions1 f9e1 c5sure1 be+ susp5d$ or b>r$ f be+ associat$ ) a memb]1 or any o!r appropriate sanction2 & 7,f7 ! rules ( ! association are 9 accordance ) ! provisions ( ?is ,act1 &1 9 g5]al1 provide a fair proc$ure = ! discipl9+ ( memb]s & p]sons associat$ ) memb]s1 ! d5ial ( memb]%ip to any p]son seek+ memb]%ip !re91 ! b>r+ ( any p]son f becom+ associat$ ) a memb] !re(1 & ! prohibition or limitation by ! association ( any p]son ) respect to access to s]vices (f]$ by ! association or a memb] !re(4 7#c7 ,responsibilities & activities 7,a7 ,bright-l9e rules ,an association %all develop1 on a cont9u+ basis1 guidance & bright-l9e rules = ! developm5t & design ( te*nology products ( l>ge onl9e op]ators consi/5t ) subp>agraph 7,b74 7,b7 ,safe h>bors ,9 =mulat+ guidance "u subp>agraph 7,a71 ! association %all def9e conduct t does n h ! purpose or sub/antial effect ( subv]t+ or impair+ us] autonomy1 decision mak+1 or *oice1 or ( cultivat+ compulsive usage = *ildr5 su* z-- 7i7 de m9imis us] int]face *anges d]iv$ f te/+ consum] pref]5ces1 includ+ diff]5t /yles1 lay\ts1 or text1 :]e su* *anges are n done ) ! purpose ( obta9+ us] cons5t or us] data2 7ii7 algori?ms or data outputs outside ! control ( a l>ge onl9e op]ator or its affiliates2 & 7iii7 e/abli%+ default sett+s t provide enhanc$ privacy protection to us]s or o!rwise enhance _! autonomy & decision-mak+ ability4 7d7 ,en=cem5t by ! ,commission 7#a7 ,unfair or deceptive acts or practice ,a violation ( subsection 7a7 or 7b7 %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,det]m9ation ,= purposes ( en=cem5t ( ?is ,act1 ! ,commission %all det]m9e an act or practice is unfair or deceptive if ! act or practice-- 7,a7 has ! purpose1 or sub/antial effect1 ( subv]t+ or impair+ us] autonomy1 decision mak+1 or *oice to obta9 cons5t or us] data2 or 7,b7 has ! purpose1 or sub/antial effect1 ( cultivat+ compulsive usage by a *ild "u #ac4 7#c7 ,regulations ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 t-- 7,a7 e/abli% rules & proc$ures = obta9+ ! in=m$ cons5t ( us]s2 7,b7 e/abli% rules = ! regi/ration1 =mation1 ov]sight1 & managem5t ( ! indep5d5t review bo>ds1 includ+ /&>ds t ensure effective indep5d5ce ( su* entities f improp] or undue influ5ce by a l>ge onl9e op]ator2 7,c7 e/abli% rules = ! regi/ration1 =mation1 ov]sight1 & managem5t ( pr(essional /&>ds bodies1 includ+ proc$ures = ! regul> ov]sight ( su* bodies & revocation ( _! designation2 & 7,d7 9 consultation ) a pr(essional /&>ds body e/abli%$ "u subsection 7c71 def9e conduct t does n h ! purpose or sub/antial effect ( subv]t+ or impair+ us] autonomy1 decision mak+1 or *oice1 or ( cultivat+ compulsive usage = *ildr5 su* z-- 7i7 de m9imis us] int]face *anges d]iv$ f te/+ consum] pref]5ces1 includ+ diff]5t /yles1 lay\ts1 or text1 :]e su* *anges are n done ) ! purpose ( obta9+ us] cons5t or us] data2 7ii7 algori?ms or data outputs outside ! control ( a l>ge onl9e op]ator or its affiliates2 & 7iii7 e/abli%+ default sett+s t provide enhanc$ privacy protection to us]s or o!rwise enhance _! autonomy & decision-mak+ ability4 7#d7 ,safe h>bor ,! ,commission may n br+ an en=cem5t action "u ?is section aga9/ any l>ge onl9e op]ator t reli$ 9 good fai? on ! guidance ( a pr(essional /&>ds body4 ,,iii ,corporate acc\ntability #cja4 ,designation ( data privacy (fic] & data security (fic] 7a7 ,9 g5]al ,a cov]$ entity %all designate-- 7#a7 "o or m qualifi$ employees or contractors z data privacy (fic]s2 & 7#b7 "o or m qualifi$ employees or contractors 79 addition to any employee or contractor designat$ "u p>agraph 7#a77 z data security (fic]s4 7b7 ,responsibilities ( data privacy (fic]s & data security (fic]s ,an employee or contractor :o is designat$ by a cov]$ entity z a data privacy (fic] or a data security (fic] %all be responsible =1 at a m9imum1 coord9at+ ! cov]$ entity's policies & practices reg>d+-- 7#a7 9 ! case ( a data privacy (fic]1 compliance ) ! privacy requirem5ts ) respect to cov]$ data "u ?is ,act2 & 7#b7 9 ! case ( a data security (fic]1 ! security requirem5ts ) respect to cov]$ data "u ?is ,act4 #cjb4 ,int]nal controls ,a cov]$ entity %all ma9ta9 int]nal controls & report+ /ructures to ensure t appropriate s5ior managem5t (ficials ( ! cov]$ entity are involv$ 9 assess+ risks & mak+ decisions t implicate compliance ) ?is ,act4 #cjc4 ,:i/lebl[] protections 7a7 ,def9itions ,= purposes ( ?is section3 7#a7 ,:i/lebl[] ,! t]m :i/lebl[] means any employee or contractor ( a cov]$ entity :o volunt>ily provides to ! ,commission orig9al in=mation relat+ to non-compliance )1 or any violation or alleg$ violation (1 ?is ,act or any regulation promulgat$ "u ?is ,act4 7#b7 ,orig9al ,in=mation ,! t]m orig9al in=mation means in=mation t is provid$ to ! ,commission by an individual &-- 7,a7 is d]iv$ f ! indep5d5t k or analysis ( an individual2 7,b7 is n kn[n to ! ,commission f any o!r s\rce at ! "t ! individual provides ! in=mation2 & 7,c7 is n exclusively d]iv$ f an allegation made 9 a judicial or an adm9i/rative action1 9 a gov]nm5tal report1 a he>+1 an audit1 or an inve/igation1 or f news m$ia1 unless ! individual is a s\rce ( ! allegation4 7b7 ,effect ( :i/lebl[] retaliations on p5alties ,9 seek+ p5alties "u section #dja = a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act by a cov]$ entity1 ! ,commission %all consid] :e!r ! cov]$ entity retaliat$ aga9/ an individual :o 0 a :i/lebl[] ) respect to orig9al in=mation t l$ to ! successful resolution ( an adm9i/rative or judicial action br\ght by ! ,commission or ! ,attorney ,g5]al ( ! ,unit$ ,/ates "u ?is ,act aga9/ su* cov]$ entity4 ,,iv ,en=cem5t au?ority & new programs #dja4 ,en=cem5t by ! ,f$]al ,trade ,commission 7a7 ,en=cem5t by ! ,f$]al ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,p[]s ( commission 7,a7 ,9 g5]al ,except z provid$ 9 p>agraphs 7#c7 & 7#d71 ! ,commission %all en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 7,b7 ,privileges & immunities ,any p]son :o violates ?is ,act or a regulation promulgat$ "u ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,limit+ c]ta9 actions unrelat$ to ?is ,act2 au?ority pres]v$ 7i7 ,9 g5]al ,! ,commission %all n br+ any action to en=ce ! prohibition 9 section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 on unfair or deceptive acts or practices ) respect to ! privacy or security ( cov]$ data1 unless su* action is consi/5t ) ?is ,act4 7ii7 ,rule ( con/ruction ,except z provid$ 9 p>agraph 7#a71 no?+ 9 ?is ,act %all be con/ru$ to limit ! au?ority ( ! ,commission "u any o!r provision ( law1 or to limit ! ,commission's au?ority to br+ actions "u section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 relat+ to unfair or deceptive acts or practices to en=ce ! provisions ( ?is ,act & regulations promulgat$ !reund]1 includ+ to ensure t privacy policies requir$ "u section #ajb are tru?ful & non-mislead+4 7#c7 ,common c>ri]s & nonpr(it organizations ,not)/&+ section #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation ( ! ,commission1 ! ,commission %all also en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act1 9 ! same mann] provid$ 9 p>agraphs 7#a7 & 7#b7 ( ?is subsection1 ) respect to-- 7,a7 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto2 & 7,b7 organizations n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s4 7#d7 ,data privacy & security fund 7,a7 ,e/abli%m5t ( ,victims ,relief ,fund ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a sep>ate fund to be kn[n z ! ,data ,privacy & ,security ,victims ,relief ,fund 7ref]r$ to 9 ?is p>agraph z ! ,victims ,relief ,fund74 7,b7 ,deposits 7i7 ,deposits f ! commission ,! ,commission %all deposit into ! ,victims ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any action ! ,commission comm5ces to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act4 7ii7 ,deposits f ! ,attorney ,g5]al ,! ,attorney ,g5]al ( ! ,unit$ ,/ates %all deposit into ! ,victims ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any action ! ,attorney ,g5]al comm5ces on behalf ( ! ,commission to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act4 7,c7 ,use ( fund am\nts ,am\nts 9 ! ,victims ,relief ,fund %all be available to ! ,commission1 )\t fiscal ye> limitation1 to provide r$ress1 paym5ts or comp5sation1 or o!r monet>y relief to individuals affect$ by an act or practice = :i* civil p5alties h be5 impos$ "u ?is ,act4 ,to ! ext5t t individuals _c be locat$ or su* r$ress1 paym5ts or comp5sation1 or o!r monet>y relief are o!rwise n practicable1 ! ,commission may use su* funds = ! purpose ( consum] or bus9ess education relat+ to data privacy & security or = ! purpose ( engag+ 9 te*nological rese>* t ! ,commission consid]s necess>y to en=ce ?is ,act4 7,d7 ,am\nts n subject to apportionm5t ,not)/&+ any o!r provision ( law1 am\nts 9 ! ,victims ,relief ,fund %all n be subject to apportionm5t = purposes ( *apt] #ae ( title #ca1 ,unit$ ,/ates ,code1 or "u any o!r au?ority4 7#e7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to ! ,commission #ajj1jjj1jjj to c>ry out ?is ,act4 7b7 ,en=cem5t ( section #bjf ,?is section %all n apply to a violation ( section #bjf or a regulation promulgat$ "u su* section1 & su* section %all be en=c$ "u subsection 7d7 ( su* section4 #djb4 ,en=cem5t by ,/ate attorneys g5]al 7a7 ,civil action ,except z provid$ 9 subsection 7h71 9 any case 9 :i* ! attorney g5]al ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( t ,/ate has be5 or is adv]sely affect$ by ! engagem5t ( any cov]$ entity 9 an act or practice t violates ?is ,act or a regulation promulgat$ "u ?is ,act1 ! attorney g5]al ( ! ,/ate1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7#a7 enjo9 t act or practice2 7#b7 en=ce compliance ) ?is ,act or ! regulation2 7#c7 obta9 damages1 civil p5alties1 re/itution1 or o!r comp5sation on behalf ( ! resid5ts ( ! ,/ate2 or 7#d7 obta9 su* o!r relief z ! c\rt may consid] to be appropriate4 7b7 ,rights ( ! commission 7#a7 ,9 g5]al ,except :]e n feasible1 ! attorney g5]al ( a ,/ate %all notify ! ,commission 9 writ+ prior to initiat+ a civil action "u subsection 7a74 ,su* notice %all include a copy ( ! compla9t to be fil$ to initiate su* action4 ,^u receiv+ su* notice1 ! ,commission may int]v5e 9 su* action &1 ^u int]v5+-- 7,a7 be he>d on all matt]s aris+ 9 su* action2 & 7,b7 file petitions = appeal ( a decision 9 su* action4 7#b7 ,notification timel9e ,:]e x is n feasible = ! attorney g5]al ( a ,/ate to provide ! notification requir$ by p>agraph 7#b7 be=e initiat+ a civil action "u p>agraph 7#a71 ! attorney g5]al %all notify ! ,commission imm$iately aft] initiat+ ! civil action4 7c7 ,consolidation ( actions br\ght by two or m ,/ate attorneys g5]al ,:5ev] a civil action "u subsection 7a7 is p5d+ & ano!r civil action or actions are comm5c$ pursuant to su* subsection 9 a diff]5t ,f$]al di/rict c\rt or c\rts t involve "o or m common que/ions ( fact1 su* action or actions %all be transf]r$ = ! purposes ( consolidat$ pretrial proce$+s & trial to ! ,unit$ ,/ates ,di/rict ,c\rt = ! ,di/rict ( ,columbia2 provid$ h[ev]1 t no su* action %all be transf]r$ if pretrial proce$+s 9 t action h be5 conclud$ be=e a subsequ5t action is fil$ by ! attorney g5]al ( ! ,/ate4 7d7 ,actions by commission ,9 any case 9 :i* a civil action is in/itut$ by or on behalf ( ! ,commission = violation ( ?is ,act or a regulation promulgat$ "u ?is ,act1 no attorney g5]al ( a ,/ate may1 dur+ ! p5d5cy ( su* action1 in/itute a civil action aga9/ any def5dant nam$ 9 ! compla9t 9 ! action in/itut$ by or on behalf ( ! ,commission = violation ( ?is ,act or a regulation promulgat$ "u ?is ,act t is alleg$ 9 su* compla9t4 7e7 ,inve/igatory p[]s ,no?+ 9 ?is section %all be con/ru$ to prev5t ! attorney g5]al ( a ,/ate or ano!r au?oriz$ (ficial ( a ,/ate f ex]cis+ ! p[]s conf]r$ on ! attorney g5]al or ! ,/ate (ficial by ! laws ( ! ,/ate to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7f7 ,v5ue2 s]vice ( process 7#a7 ,v5ue ,any action br\ght "u subsection 7a7 may be br\ght 9 ! di/rict c\rt ( ! ,unit$ ,/ates t meets applicable requirem5ts relat+ to v5ue "u section #acia ( title #bh1 ,unit$ ,/ates ,code4 7#b7 ,s]vice ( process ,9 an action br\ght "u subsection 7a71 process may be s]v$ 9 any di/rict 9 :i* ! def5dant-- 7,a7 is an inhabitant2 or 7,b7 may be f\nd4 7g7 ,actions by o!r ,/ate (ficials 7#a7 ,9 g5]al ,any ,/ate (ficial :o is au?oriz$ by ! ,/ate attorney g5]al to be ! exclusive au?ority 9 t ,/ate to en=ce ?is ,act may br+ a civil action "u subsection 7a71 subject to ! same requirem5ts & limitations t apply "u ?is section to civil actions br\ght "u su* subsection by ,/ate attorneys g5]al4 7#b7 ,au?ority pres]v$ ,no?+ 9 ?is section %all be con/ru$ to prohibit an au?oriz$ (ficial ( a ,/ate f initiat+ or cont9u+ any proce$+ 9 a c\rt ( ! ,/ate = a violation ( any civil or crim9al law ( ! ,/ate4 7h7 ,exclusion ( section #bjf ,?is section %all n apply to a violation ( section #bjf or a regulation promulgat$ "u su* section4 #djc4 ,au?ority ( ,commission to seek p]man5t injunction & o!r equitable rem$ies 7a7 ,9 g5]al ,section #ac ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #ec7 is am5d$-- 7#a7 9 subsection 7b7-- 7,a7 9 p>agraph 7#a71 by /rik+ is violat+1 or is ab\t to violate1 & ins]t+ has violat$1 is violat+1 or is ab\t to violate2 7,b7 9 p>agraph 7#b7-- 7i7 by ins]t+ ei!r 7,a7 be=e ! enjo9+ !re(2 & 7ii7 by ins]t+ or 7,b7 ! p]man5t enjo9+ !re( or ! ord]+ ( an equitable rem$y "u subsection 7e7 aft] f9al12 & 7,c7 9 ! flu% text foll[+ p>agraph 7#b7-- 7i7 by /rik+ to enjo9 any su* act or practice & ins]t+ to obta9 su* injunction or rem$y2 7ii7 by /rik+ ,^u a prop] %[+ t & ins]t+ ,9 a case br\ght "u p>agraph 7#b77;,a71 ^u a prop] %[+ t2 7iii7 by /rik+ su* action & ins]t+ a tempor>y re/ra9+ ord] or prelim9>y injunction2 7iv7 by /rik+ )\t bond2 7v7 by /rik+ ,t 9 prop] cases ! ,commission may seek1 & aft] prop] pro(1 ! c\rt may issue1 a p]man5t injunction4 & ins]t+ ! foll[+3 ,t 9 a case br\ght "u p>agraph 7#b77;,b71 aft] prop] pro( & ^u a %[+ t a p]man5t injunction or equitable rem$y "u subsection 7e7 w\ld be 9 ! public int]e/1 ! c\rt may issue a p]man5t injunction1 an equitable rem$y "u subsection 7e71 or any o!r relief z ! c\rt det]m9es to be j & prop]1 includ+ tempor>y or prelim9>y equitable relief42 7vi7 by ins]t+ "u p>agraph 7#b7 aft] ,any suit2 & 7vii7 by /rik+ any suit "u ?is section & ins]t+ any su* suit2 & 7#b7 by add+ at ! end ! foll[+ new subsection3 7e7 ,equitable rem$ies 7#a7 ,re/itution2 contract rescission & re=mation 7,a7 ,9 g5]al ,9 a suit br\ght "u subsection 7b77#b77;,b7 ) respect to a violation ( a provision ( law en=c$ by ! ,commission1 ! ,commission may seek1 & ! c\rt may ord]-- 7i7 re/itution = consum] loss result+ f su* violation2 7ii7 rescission or re=mation ( contracts2 & 7iii7 ! refund ( money or return ( prop]ty4 7,b7 ,limitations p]iod ,relief "u ?is p>agraph %all n be available = a claim aris+ m ?an #aj ye>s be=e ! fil+ ( ! ,commission's suit "u subsection 7b77#b77;,b7 ) respect to ! violation t gave rise to ! claim4 7#b7 ,disgorgem5t 7,a7 ,9 g5]al ,9 a suit br\ght "u subsection 7b77#b77;,b7 ) respect to a violation ( a provision ( law en=c$ by ! ,commission1 ! ,commission may seek1 & ! c\rt may ord]1 disgorgem5t ( any unju/ enri*m5t t a p]son obta9$ z a result ( t violation4 7,b7 ,calculation ,any disgorgem5t t is ord]$ ) respect to a p]son "u subp>agraph 7,a7 %all be (fset by any am\nt ( re/itution t ! p]son is ord]$ to pay "u p>agraph 7#a74 7,c7 ,limitations p]iod ,disgorgem5t "u ?is p>agraph %all be limit$ to any unju/ enri*m5t a p]son1 p>tn]%ip1 or corporation obta9$ 9 ! #aj ye>s prec$+ ! fil+ ( ! ,commission's suit "u subsection 7b77#b77;,b7 ) respect to ! violation t result$ 9 su* unju/ enri*m5t4 7#c7 ,calculation ( limitations p]iods ,= purposes ( calculat+ any limitations p]iod ) respect to a claim = relief "u p>agraph 7#a7 or a disgorgem5t ord] "u p>agraph 7#b71 any "t 9 :i* a p]son1 p>tn]%ip1 or corporation aga9/ :i* su* relief or ord] is s\ght is outside ! ,unit$ ,/ates %all n be c\nt$ = purposes ( calculat+ su* p]iod4 4 7b7 ,con=m+ am5dm5ts ,section #af7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #ef7;a77#b77 is am5d$-- 7#a7 9 subp>agraph 7,a71 by /rik+ 7relat+ to injunctive relief72 & 7#b7 9 subp>agraph 7,b71 by /rik+ 7relat+ to consum] r$ress74 7c7 ,applicability ,! am5dm5ts made by ?is section %all apply ) respect to any action or proce$+ t is comm5c$ on or aft] ! date ( enactm5t ( ?is ,act4 #djd4 ,approv$ c]tification programs 7a7 ,9 g5]al ,! ,commission %all e/abli% a program 9 :i* ! ,commission %all approve volunt>y cons5sus /&>ds or c]tification programs t cov]$ entities may use to comply ) "o or m provisions 9 ?is ,act4 7b7 ,effect ( approval ,a cov]$ entity 9 compliance ) a volunt>y cons5sus /&>d approv$ by ! ,commission %all be deem$ to be 9 compliance ) ! provisions ( ?is ,act4 7c7 ,"t = approval ,! ,commission %all issue a decision reg>d+ ! approval ( a propos$ volunt>y cons5sus /&>d n lat] ?an #ahj days aft] a reque/ = approval is submitt$4 7d7 ,effect ( non-,compliance ,a cov]$ entity t claims compliance ) an approv$ volunt>y cons5sus /&>d & is f\nd n to be 9 compliance ) su* program by ! ,commission or 9 any judicial proce$+ %all be consid]$ to be 9 violation ( ! section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 prohibition on unfair or deceptive acts or practices4 7e7 ,rulemak+ ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 e/abli%+ a process = review ( reque/s = approval ( propos$ volunt>y cons5sus /&>ds "u ?is section4 7f7 ,requirem5ts ,to be eligible = approval by ! ,commission1 a volunt>y cons5sus /&>d %all meet ! requirem5ts = volunt>y cons5sus /&>ds set =? 9 ,(fice ( ,managem5t & ,budget ,circul> ,a-#aai1 or o!r equival5t guidance docum5t1 ensur+ t !y are ! result ( due process proc$ures & appropriately balance ! int]e/s ( all ! /akehold]s1 includ+ individuals1 bus9esses1 organizations1 & o!r entities mak+ lawful uses ( ! cov]$ data cov]$ by ! /&>d1 &-- 7#a7 specify cle> & en=ceable requirem5ts = cov]$ entities p>ticipat+ 9 ! program t provide an ov]all level ( data privacy or data security protection t is equival5t to or great] ?an t provid$ 9 ! relevant provisions 9 ?is ,act2 7#b7 require ea* p>ticipat+ cov]$ entity to po/ 9 a prom95t place a cle> & conspicu\s public atte/ation ( compliance & a l9k to ! website describ$ 9 p>agraph 7#d72 7#c7 include a process = an indep5d5t assessm5t ( a p>ticipat+ cov]$ entity's compliance ) ! volunt>y cons5sus /&>d or c]tification program prior to c]tification & at reasonable int]vals !reaft]2 7#d7 create a website describ+ ! volunt>y cons5sus /&>d or c]tification program's goals & requirem5ts1 li/+ p>ticipat+ cov]$ entities1 & provid+ a me?od = individuals to ask que/ions & file compla9ts ab\t ! program or any p>ticipat+ cov]$ entity2 7#e7 take mean+ful action = non-compliance ) ! relevant provisions ( ?is ,act by any p>ticipat+ cov]$ entity1 :i* %all dep5d on ! sev]ity ( ! non-compliance & may include-- 7,a7 remov+ ! cov]$ entity f ! program2 7,b7 ref]r+ ! cov]$ entity to ! ,commission or o!r appropriate ,f$]al or ,/ate ag5cies = en=cem5t2 7,c7 publicly report+ ! discipl9>y action tak5 ) respect to ! cov]$ entity2 7,d7 provid+ r$ress to individuals h>m$ by ! non-compliance2 7,e7 mak+ volunt>y paym5ts to ! ,unit$ ,/ates ,treasury2 & 7,f7 tak+ any o!r action or actions to ensure ! compliance ( ! cov]$ entity ) respect to ! relevant provisions ( ?is ,act2 & 7#f7 issue annual reports to ! ,commission & to ! public detail+ ! activities ( ! program & its effectiv5ess dur+ ! prec$+ ye> 9 ensur+ compliance ) ! relevant provisions ( ?is ,act by p>ticipat+ cov]$ entities & tak+ mean+ful discipl9>y action = non-compliance ) su* provisions by su* entities4 #dje4 ,relation%ip betwe5 ,f$]al & ,/ate law 7a7 ,relation%ip to ,/ate law ,no ,/ate or political subdivision ( a ,/ate may adopt1 ma9ta91 en=ce1 or cont9ue 9 effect any law1 regulation1 rule1 requirem5t1 or /&>d relat$ to ! data privacy or data security & associat$ activities ( cov]$ entities4 7b7 ,sav+s provision ,subsection 7a7 may n be con/ru$ to preempt ,/ate laws t directly e/abli% requirem5ts = ! notification ( consum]s 9 ! ev5t ( a data brea*4 7c7 ,relation%ip to o!r ,f$]al laws 7#a7 ,9 g5]al ,except z provid$ 9 p>agraphs 7#b7 & 7#c71 ! requirem5ts ( ?is ,act %all sup]s$e any o!r ,f$]al law or regulation relat+ to ! privacy or security ( cov]$ data or associat$ activities ( cov]$ entities4 7#b7 ,sav+s provision ,?is ,act may n be con/ru$ to modify1 limit1 or sup]s$e ! op]ation ( ! foll[+3 7,a7 ,! ,*ildr5's ,onl9e ,privacy ,protection ,act 7#ae ,u4,s4,c4 #feja et seq474 7,b7 ,! ,communications ,assi/ance = ,law ,en=cem5t ,act 7#dg ,u4,s4,c4 #ajja et seq474 7,c7 ,section #bbg ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbg74 7,d7 ,title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7,e7 ,! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq474 7,f7 ,! ,heal? ,insurance ,portability & ,acc\ntability ,act 7,public ,law #ajd-aia74 7,g7 ,! ,electronic ,communications ,privacy ,act 7#ah ,u4,s4,c4 #beaj et seq474 7,h7 ,section #ddd ( ! ,g5]al ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly ref]r$ to z ! ,family ,educational ,rights & ,privacy ,act ( #aigd74 7,i7 ,! ,driv]'s ,privacy ,protection ,act ( #aiid 7#ah ,u4,s4,c4 #bgba et seq474 7,j7 ,! ,f$]al ,aviation ,act ( #aieh 7#di ,u4,s4,c4 ,app4 #acja et seq474 7,k7 ,! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq474 7#c7 ,compliance ) sav$ ,f$]al laws ,to ! ext5t t ! data collection1 process+1 or transf] activities ( a cov]$ entity are subject to a law li/$ 9 p>agraph 7#b71 su* activities ( su* entity %all n be subject to ! requirem5ts ( ?is ,act4 7#d7 ,nonapplication ( ,,fcc laws & regulations to cov]$ entities ,not)/&+ any o!r provision ( law1 nei!r any provision ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto nor any regulation promulgat$ by ! ,f$]al ,communications ,commission "u su* ,acts %all apply to any cov]$ entity ) respect to ! collection1 use1 process+1 transf]r+1 or security ( individual in=mation1 except to ! ext5t t su* provision or regulation p]ta9s solely to #iaa l9es or o!r em]g5cy l9e ( a hospital1 m$ical provid] or s]vice (fice1 heal? c>e facility1 poison control c5t]1 fire protection ag5cy1 or law en=cem5t ag5cy4 #djf4 ,con/itutional avoidance ,! provisions ( ?is ,act %all be con/ru$1 to ! greate/ ext5t possible1 to avoid conflict+ ) ! ,con/itution ( ! ,unit$ ,/ates1 includ+ ! protections ( free spee* & fre$om ( ! press e/abli%$ "u ! ,fir/ ,am5dm5t to ! ,con/itution ( ! ,unit$ ,/ates4 #djg4 ,sev]ability ,if any provision ( ?is ,act1 or an am5dm5t made by ?is ,act1 is det]m9$ to be un5=ceable or invalid1 ! rema9+ provisions ( ?is ,act & ! am5dm5ts made by ?is ,act %all n be affect$4