,,ii #aafth ,,congress #ast ,session ,s4 #ehc ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #bg1 #bjai ,ms4 ,cortez ,masto introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to provide for digital accountability and transparency4 #a4 ,short title ,this ,act may be cited as the ,digital ,accountability and ,transparency to ,advance ,privacy ,act or the ,,data ,privacy ,act4 #b4 ,definitions 7a7 ,in general ,in this ,act3 7#a7 ,collect ,the term collect means taking any operation or set of operations to obtain covered data1 including by automated means1 including purchasing1 leasing1 assembling1 recording1 gathering1 acquiring1 or procuring4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered data ,the term covered data-- 7,a7 means any information that is-- 7i7 collected1 processed1 stored1 or disclosed by a covered entity2 7ii7 collected over the internet or other digital network2 and 7iii7 7,i7 linked to an individual or device associated with an individual2 or 7,,ii7 practicably linkable to an individual or device associated with an individual1 including by combination with separate information1 by the covered entity or any potential recipient of the data2 and 7,b7 does not include data that is-- 7i7 collected1 processed1 stored1 or disclosed solely for the purpose of employment of an individual2 and 7ii7 lawfully made available to the public from ,federal1 ,state1 or local government records4 7#d7 ,covered entity ,the term covered entity-- 7,a7 means any entity that collects1 processes1 stores1 or discloses covered data2 and 7,b7 does not include any entity that collects1 processes1 stores1 or discloses covered data relating to fewer than #c1jjj individuals and devices during any #ab-month period4 7#e7 ,disclose ,the term disclose means taking any action with respect to covered data1 including by automated means1 to sell1 share1 provide1 or otherwise transfer covered data to another entity1 person1 or the general public4 7#f7 ,privacy risk ,the term privacy risk means potential harm to an individual resulting from the collection1 processing1 storage1 or disclosure of covered data1 including-- 7,a7 direct or indirect financial loss2 7,b7 stigmatization or reputational harm2 7,c7 anxiety1 embarrassment1 fear1 and other severe emotional trauma2 7,d7 loss of economic opportunity2 or 7,e7 physical harm4 7#g7 ,process ,the term process means any operation or set of operations that is performed on covered data or on sets of covered data1 including by automated means1 including organizing1 combining1 adapting1 altering1 using1 or transforming4 7#h7 ,protected characteristic ,the term protected characteristic means an individual's race1 sex1 gender1 sexual orientation1 nationality1 religious belief1 or political affiliation4 7#i7 ,pseudonymous data ,the term pseudonymous data means covered data that may only be linked to the identity of an individual or the identity of a device associated with an individual if combined with separate information4 7#aj7 ,reasonable interest ,the term reasonable interest means-- 7,a7 a compelling business1 operational1 administrative1 legal1 or educational justification for the collection1 processing1 storage1 or disclosure of covered data exists2 7,b7 the use of covered data is within the context of the relationship between the covered entity and the individual linked to the covered data2 and 7,c7 the interest does not subject the individual to an unreasonable privacy risk4 7#aa7 ,sensitive data ,the term sensitive data means any covered data relating to-- 7,a7 the health1 biologic1 physiologic1 biometric1 sexual life1 or genetic information of an individual2 or 7,b7 the precise geolocation information of a device associated with an individual4 7#ab7 ,store ,the term store means any operation or set of operations to continue possession of covered data1 including by automated means4 7#ac7 ,third party service provider ,the term third party service provider means any covered entity that collects1 processes1 stores1 or discloses covered data at the direction of1 and for the sole benefit of1 another covered entity under a contract4 7b7 ,modified definition by rulemaking ,if the ,commission determines that a term defined in paragraph 7#i7 or 7#aa7 is not sufficient to protect an individual's data privacy1 the ,commission may promulgated regulations under section #eec of title #e1 ,united ,states ,code1 to modify the definition as the ,commission considers appropriate4 #c4 ,required privacy notice 7a7 ,privacy notice ,each covered entity shall post in an accessible location a notice that is concise1 in context1 in easily understandable language1 accurate1 clear1 timely1 updated1 uses visualizations where appropriate1 conspicuous1 and free of charge regarding the covered entity's privacy practices4 7b7 ,contents of notice ,the notice required by subsection 7a7 shall include-- 7#a7 a description of the covered data that the entity collects1 processes1 stores1 and discloses1 including the sources that provided the covered data if the covered entity did not collect the covered data2 7#b7 the purposes for and means by which the entity collects1 processes1 and stores the covered data2 7#c7 the persons and entities to whom1 and purposes for which1 the covered entity discloses the covered data2 and 7#d7 a conspicuous1 clear1 and understandable means for individuals to access the methods necessary to exercise their rights under sections #d and #e4 #d4 ,required data practices 7a7 ,regulations ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 that require covered entities to implement1 practice1 and maintain certain data procedures and processes that meet the following requirements3 7#a7 ,minimum data processing requirements ,except as provided in subsection 7b71 require covered entities to meet all of the following requirements regarding the means by and purposes for which covered data is collected1 processed1 stored1 and disclosed3 7,a7 ,reasonable ,except as provided in paragraph 7#c71 covered data collection1 processing1 storage1 and disclosure practices must meet a reasonable interest of the covered entity1 including-- 7i7 business1 educational1 and administrative operations that are relevant and appropriate to the context of the relationship between the covered entity and the individual linked to the covered data2 7ii7 relevant and appropriate product and service development and enhancement2 7iii7 preventing and detecting abuse1 fraud1 and other criminal activity2 7iv7 reasonable communications and marketing practices that follow best practices1 rules1 and ethical standards2 7v7 engaging in scientific1 medical1 or statistical research that follows commonly accepted ethical standards2 or 7vi7 any other purpose for which the ,commission considers to be reasonable4 7,b7 ,equitable ,covered data collection1 processing1 storage1 and disclosure practices may not be for purposes that result in discrimination against a protected characteristic1 including-- 7i7 discriminatory targeted advertising practices2 7ii7 price1 service1 or employment opportunity discrimination2 or 7iii7 any other practice the ,commission considers likely to result in unfair discrimination against a protected characteristic4 7,c7 ,forthright ,covered data collection1 processing1 storage1 and disclosure practices may not be accomplished with means or for purposes that are deceptive1 including-- 7i7 the use of inconspicuous recording or tracking devices and methods2 7ii7 the disclosure of covered data that a reasonable individual believes to be the content of a private communication with another party or parties2 7iii7 notices1 interfaces1 or other representations likely to mislead consumers2 or 7iv7 any other practice that the ,commission considers likely to mislead individuals regarding the purposes for and means by which covered data is collected1 processed1 stored1 or disclosed4 7#b7 ,requirements for opt-out consent ,except as provided in subsection 7b71 require covered entities to provide individuals with conspicuous access to a method that is in easily understandable language1 concise1 accurate1 clear1 to opt out of any collection1 processing1 storage1 or disclosure of covered data linked to the individual4 7#c7 ,requirements for affirmative consent ,except as provided in subsection 7b71 require covered entities to provide individuals with a notice that is concise1 in easily understandable language1 accurate1 clear1 timely1 and conspicuous to express affirmative1 opt-in consent-- 7,a7 before the covered entity collects or discloses sensitive data linked to the individual2 or 7,b7 before the covered entity collects1 processes1 stores1 or discloses data for purposes which are outside the context of the relationship of the covered entity with the individual linked to the data1 including-- 7i7 the use of covered data beyond what is necessary to provide1 improve1 or market a good or service that the individual requests2 7ii7 the processing or disclosure of covered data differs in material ways from the purposes described in the privacy policy that was in effect when the data was collected2 and 7iii7 any other purpose that ,commission considers outside of context4 7#d7 ,data minimization requirements ,except as provided in subsection 7b71 require covered entities to-- 7,a7 take reasonable measures to limit the collection1 processing1 storage1 and disclosure of covered data to the amount that is necessary to carry out the purposes for which the data is collected2 and 7,b7 store covered data only as long as is reasonably necessary to carry out the purposes for which the data was collected4 7b7 ,exemptions ,subsection 7a7 shall not apply if the limitations on the collection1 processing1 storage1 or disclosure of covered data would-- 7#a7 inhibit detection or prevention of a security risk or incident2 7#b7 risk the health1 safety1 or property of the covered entity or individual2 or 7#c7 prevent compliance with an applicable law 7including regulations7 or legal process4 #e4 ,individual control over data use 7a7 ,regulations ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require covered entities to provide conspicuous1 understandable1 clear1 and free of charge method to-- 7#a7 upon the request of an individual1 provide the individual with access to1 or an accurate representation of1 covered data linked to with the individual or the individual's device stored by the covered entity2 7#b7 upon the request of an individual1 provide the individual with a means to dispute and resolve the accuracy or completeness of the covered data linked to the individual or the individual's device stored by the entity2 7#c7 upon the request of an individual1 delete any covered data that the covered entity stores linked to the individual or the individual's device2 and 7#d7 when technically feasible1 upon the request of an individual1 allow the individual to transmit or transfer covered data linked to the individual or the individual's device that is maintained by the entity to the individual in a format that is standardized and interoperable4 7b7 ,pseudonymous data ,if the covered data that an individual has requested processed under subsection 7a7 is pseudonymous data1 a covered entity may decline the request if processing the request is not technically feasible4 7c7 ,timeliness of requests ,in fulfilling any requests made by the individual under subsection 7a7 the covered entity shall act in as timely a manner as is reasonably possible4 7d7 ,access to same service ,a covered entity shall not discriminate against an individual because of any action the individual took under their rights described in subsection 7a71 including-- 7#a7 denying goods or services to the individual2 7#b7 charging1 or advertising1 different prices or rates for goods or services2 or 7#c7 providing different quality of goods or services4 7e7 ,consideration ,the ,commission shall allow a covered entity1 by contract1 to provide relevant obligations to the individual under subsection 7a7 on behalf of a third party service provider that collects1 processes1 stores1 or discloses covered data only on behalf of the covered entity4 #f4 ,information security standards 7a7 ,required data security practices 7#a7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require covered entities to establish and implement policies and procedures regarding information security practices for the treatment and protection of covered data taking into consideration-- 7,a7 the level of identifiability of the covered data and the associated privacy risk2 7,b7 the sensitivity of the covered data collected1 processed1 and stored and the associated privacy risk2 7,c7 the currently available and widely accepted technological1 administrative1 and physical means to protect personal data under the control of the covered entity2 7,d7 the cost associated with implementing1 maintaining1 and regularly reviewing the safeguards2 and 7,e7 the impact of these requirements on small and medium-sized businesses4 7#b7 ,limitations ,in promulgating the regulations required under this section1 the ,commission shall consider a covered entity who is in compliance with existing information security laws that the ,commission determines are sufficiently rigorous to be in compliance with this section with respect to particular types of covered data to the extent those types of covered data are covered by such law1 including the following3 7,a7 ,title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7,b7 ,the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica74 7,c7 ,the ,health ,insurance ,portability and ,accountability ,act of #aiif ,security ,rule 7#de ,,cfr #afj4ajc and part #afd74 7,d7 ,any other existing law requiring a covered entity to implement and maintain information security practices and procedures that the ,commission determines to be sufficiently rigorous4 #g4 ,privacy protection officers 7a7 ,appointment of a privacy protection officer ,each covered entity with annual revenue in excess of #be1jjj1jjj the prior year shall designate at least #a appropriately qualified employee as a privacy protection officer who shall-- 7#a7 educate employees about compliance requirements2 7#b7 train employees involved in data processing2 7#c7 conduct regular1 comprehensive audits to ensure compliance and make records of the audits available to enforcement authorities upon request2 7#d7 maintain updated1 clear1 and understandable records of all data security practices undertaken by the covered entity2 7#e7 serve as the point of contact between the covered entity and enforcement authorities2 and 7#f7 advocate for policies and practices within the covered entity that promote individual privacy4 7b7 ,protections ,the privacy protection officer shall not be dismissed or otherwise penalized by the covered entity for performing any of the tasks assigned to the person under this section4 #h4 ,research into privacy enhancing technology ,section #d7;a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77 is amended-- 7#a7 by striking the subsection heading and inserting the following3 7a7 ,network security and information privacy research grants 2 and 7#b7 in paragraph 7#a71 by striking subparagraph 7,d7 and inserting the following3 7,d7 privacy and confidentiality1 including-- 7i7 cryptography2 7ii7 anonymization2 7iii7 pseudonymization2 7iv7 filtering tools2 7v7 anti-spying and anti-tracking tools2 and 7vi7 any other technology that the ,director determines will enhance individual privacy2 4 #i4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,in general ,except as otherwise provided1 this ,act and the regulations prescribed under this ,act shall be enforced by the ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#b7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation prescribed under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,actions by the ,commission ,subject to paragraph 7#d71 the ,commission shall prevent any person from violating this ,act or a regulation prescribed under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act1 and any person who violates this ,act or such regulation shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#d7 ,common carriers ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 and #df7 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act1 in the same manner provided in paragraphs 7#a71 7#b71 and 7#c7 with respect to common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and ,acts amendatory thereof and supplementary thereto4 7b7 ,enforcement by ,state attorneys general 7#a7 ,in general 7,a7 ,civil actions ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any person in a practice that violates this ,act or a regulation prescribed under this ,act1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7i7 enjoin that practice2 7ii7 enforce compliance with this ,act or such regulation2 7iii7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 7iv7 impose a civil penalty in an amount that is not greater than the product of the number of individuals whose information was affected by a violation and #dj1jjj2 or 7v7 obtain such other relief as the court may consider to be appropriate4 7,b7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of enactment of this ,act1 and each year thereafter1 the amounts specified in subparagraph 7,a77iv7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7,c7 ,notice 7i7 ,in general ,before filing an action under subparagraph 7,a71 the attorney general of the ,state involved shall provide to the ,commission-- 7,i7 written notice of that action2 and 7,,ii7 a copy of the complaint for that action4 7ii7 ,exemption 7,i7 ,in general ,clause 7i7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this paragraph if the attorney general determines that it is not feasible to provide the notice described in that clause before the filing of the action4 7,,ii7 ,notification ,in an action described in subclause 7,i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,commission at the same time as the attorney general files the action4 7c7 ,rights of the ,commission 7#a7 ,intervention by the ,commission ,the ,commission may intervene in any civil action brought by the attorney general of a ,state under subsection 7b7 and upon intervening-- 7,a7 be heard on all matters arising in the civil action2 and 7,b7 file petitions for appeal of a decision in the civil action4 7#b7 ,powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#c7 ,action by the commission ,if the ,commission institutes a civil action for violation of this title or a regulation promulgated under this title1 no attorney general of a ,state may bring a civil action under subsection 7b7 against any defendant named in the complaint of the ,commission for violation of this ,act or a regulation promulgated under this ,act that is alleged in the complaint4 7d7 ,venue and service of process 7#a7 ,venue ,any action brought under subsection 7b7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under subsection 7b71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 7e7 ,action of other ,state officials 7#a7 ,in general ,in addition to civil actions brought by attorneys general under subsection 7b71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under subsection 7b71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7#b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 7f7 ,preservation of authority ,nothing in this ,act shall be construed to limit the authority of the ,federal ,trade ,commission under any other provision of law4 #aj4 ,additional enforcement resources 7a7 ,in general ,notwithstanding any other provision of law the ,commission may1 without regard to the civil service laws 7including regulations71 appoint not more than #cjj additional personnel for the purposes of enforcing privacy and data security laws and regulations4 7b7 ,authorization of appropriations ,there is authorized to be appropriated to the ,commission such sums as may be necessary to carry out this section4