,,ib ,union ,calendar ,no4 #dhh #aagth ,,congress #b;d ,session ,h4 ,r4 #haeb ,report ,no4 #aag-ffi ,,in ,,the ,,house ,,of ,,representatives ,june #ba1 #bjbb,mr4 ,pallone 7for himself1 ,mrs4 ,rodgers of ,washington1 ,ms4 ,schakowsky1 and ,mr4 ,bilirakis7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,december #cj1 #bjbb,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed,strike out all after the enacting clause and insert the part printed in italic,for text of introduced bill1 see copy of bill as introduced on ,june #ba1 #bjbb ,a ,,bill ,to provide consumers with foundational data privacy rights1 create strong oversight mechanisms1 and establish meaningful enforcement4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,american ,data ,privacy and ,protection ,act4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,title ,i--,duty of ,loyalty,sec4 #aja4 ,data minimization4,sec4 #ajb4 ,loyalty duties4,sec4 #ajc4 ,privacy by design4,sec4 #ajd4 ,loyalty to individuals with respect to pricing4,title ,,ii--,consumer ,data ,rights,sec4 #bja4 ,consumer awareness4,sec4 #bjb4 ,transparency4,sec4 #bjc4 ,individual data ownership and control4,sec4 #bjd4 ,right to consent and object4,sec4 #bje4 ,data protections for children and minors4,sec4 #bjf4 ,third-party collecting entities4,sec4 #bjg4 ,civil rights and algorithms4,sec4 #bjh4 ,data security and protection of covered data4,sec4 #bji4 ,small business protections4,sec4 #baj4 ,unified opt-out mechanisms4,title ,,iii--,corporate ,accountability,sec4 #cja4 ,executive responsibility4,sec4 #cjb4 ,service providers and third parties4,sec4 #cjc4 ,technical compliance programs4,sec4 #cjd4 ,commission approved compliance guidelines4,sec4 #cje4 ,digital content forgeries4,title ,,iv--,enforcement1 ,applicability1 and ,miscellaneous,sec4 #dja4 ,enforcement by the ,federal ,trade ,commission4,sec4 #djb4 ,enforcement by ,states4,sec4 #djc4 ,enforcement by persons4,sec4 #djd4 ,relationship to ,federal and ,state laws4,sec4 #dje4 ,severability4,sec4 #djf4 ,,coppa4,sec4 #djg4 ,authorization of appropriations4,sec4 #djh4 ,effective date4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative express consent 7,a7 ,in general ,the term affirmative express consent means an affirmative act by an individual that clearly communicates the individual's freely given1 specific1 and unambiguous authorization for an act or practice after having been informed1 in response to a specific request from a covered entity that meets the requirements of subparagraph 7,b74 7,b7 ,request requirements ,the requirements of this subparagraph with respect to a request from a covered entity to an individual are the following3 7i7 ,the request is provided to the individual in a clear and conspicuous standalone disclosure made through the primary medium used to offer the covered entity's product or service1 or only if the product or service is not offered in a medium that permits the making of the request under this paragraph1 another medium regularly used in conjunction with the covered entity's product or service4 7ii7 ,the request includes a description of the processing purpose for which the individual's consent is sought and-- 7,i7 clearly states the specific categories of covered data that the covered entity shall collect1 process1 and transfer necessary to effectuate the processing purpose2 and 7,,ii7 includes a prominent heading and is written in easy-to-understand language that would enable a reasonable individual to identify and understand the processing purpose for which consent is sought and the covered data to be collected1 processed1 or transferred by the covered entity for such processing purpose4 7iii7 ,the request clearly explains the individual's applicable rights related to consent4 7iv7 ,the request is made in a manner reasonably accessible to and usable by individuals with disabilities4 7v7 ,the request is made available to the individual in each covered language in which the covered entity provides a product or service for which authorization is sought4 7vi7 ,the option to refuse consent shall be at least as prominent as the option to accept1 and the option to refuse consent shall take the same number of steps or fewer as the option to accept4 7vii7 ,processing or transferring any covered data collected pursuant to affirmative express consent for a different processing purpose than that for which affirmative express consent was obtained shall require affirmative express consent for the subsequent processing purpose4 7,c7 ,express consent required ,a covered entity may not infer that an individual has provided affirmative express consent to an act or practice from the inaction of the individual or the individual's continued use of a service or product provided by the covered entity4 7,d7 ,pretextual consent prohibited ,a covered entity may not obtain or attempt to obtain the affirmative express consent of an individual through-- 7i7 the use of any false1 fictitious1 fraudulent1 or materially misleading statement or representation2 or 7ii7 the design1 modification1 or manipulation of any user interface with the purpose or substantial effect of obscuring1 subverting1 or impairing a reasonable individual's autonomy1 decision making1 or choice to provide such consent or any covered data4 7#b7 ,authentication ,the term authentication means the process of verifying an individual or entity for security purposes4 7#c7 ,biometric information 7,a7 ,in general ,the term biometric information means any covered data generated from the technological processing of an individual's unique biological1 physical1 or physiological characteristics that is linked or reasonably linkable to an individual1 including-- 7i7 fingerprints2 7ii7 voice prints2 7iii7 iris or retina scans2 7iv7 facial or hand mapping1 geometry1 or templates2 or 7v7 gait or personally identifying physical movements4 7,b7 ,exclusion ,the term biometric information does not include-- 7i7 a digital or physical photograph2 7ii7 an audio or video recording2 or 7iii7 data generated from a digital or physical photograph1 or an audio or video recording1 that cannot be used to identify an individual4 7#d7 ,collect2 collection ,the terms collect and collection mean buying1 renting1 gathering1 obtaining1 receiving1 accessing1 or otherwise acquiring covered data by any means4 7#e7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#f7 ,control ,the term control means1 with respect to an entity-- 7,a7 ownership of1 or the power to vote1 more than #ej percent of the outstanding shares of any class of voting security of the entity2 7,b7 control over the election of a majority of the directors of the entity 7or of individuals exercising similar functions72 or 7,c7 the power to exercise a controlling influence over the management of the entity4 7#g7 ,covered algorithm ,the term covered algorithm means a computational process that uses machine learning1 natural language processing1 artificial intelligence techniques1 or other computational processing techniques of similar or greater complexity and that makes a decision or facilitates human decision-making with respect to covered data1 including to determine the provision of products or services or to rank1 order1 promote1 recommend1 amplify1 or similarly determine the delivery or display of information to an individual4 7#h7 ,covered data 7,a7 ,in general ,the term covered data means information that identifies or is linked or reasonably linkable1 alone or in combination with other information1 to an individual or a device that identifies or is linked or reasonably linkable to an individual1 and may include derived data and unique persistent identifiers4 7,b7 ,exclusions ,the term covered data does not include-- 7i7 de-identified data2 7ii7 employee data2 7iii7 publicly available information2 or 7iv7 inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive covered data with respect to an individual4 7,c7 ,employee data defined ,for purposes of subparagraph 7,b71 the term employee data means-- 7i7 information relating to a job applicant collected by a covered entity acting as a prospective employer of such job applicant in the course of the application1 or hiring process1 if such information is collected1 processed1 or transferred by the prospective employer solely for purposes related to the employee's status as a current or former job applicant of such employer2 7ii7 information processed by an employer relating to an employee who is acting in a professional capacity for the employer1 provided that such information is collected1 processed1 or transferred solely for purposes related to such employee's professional activities on behalf of the employer2 7iii7 the business contact information of an employee1 including the employee's name1 position or title1 business telephone number1 business address1 or business email address that is provided to an employer by an employee who is acting in a professional capacity1 if such information is collected1 processed1 or transferred solely for purposes related to such employee's professional activities on behalf of the employer2 7iv7 emergency contact information collected by an employer that relates to an employee of that employer1 if such information is collected1 processed1 or transferred solely for the purpose of having an emergency contact on file for the employee and for processing or transferring such information in case of an emergency2 or 7v7 information relating to an employee 7or a spouse1 dependent1 other covered family member1 or beneficiary of such employee7 that is necessary for the employer to collect1 process1 or transfer solely for the purpose of administering benefits to which such employee 7or spouse1 dependent1 other covered family member1 or beneficiary of such employee7 is entitled on the basis of the employee's position with that employer4 7#i7 ,covered entity 7,a7 ,in general ,the term covered entity-- 7i7 means any entity or any person1 other than an individual acting in a non-commercial context1 that alone or jointly with others determines the purposes and means of collecting1 processing1 or transferring covered data and-- 7,i7 is subject to the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 7,,ii7 is a common carrier subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto2 or 7,,iii7 is an organization not organized to carry on business for its own profit or that of its members2 and 7ii7 includes any entity or person that controls1 is controlled by1 or is under common control with the covered entity4 7,b7 ,exclusions ,the term covered entity does not include-- 7i7 a ,federal1 ,state1 ,tribal1 territorial1 or local government entity such as a body1 authority1 board1 bureau1 commission1 district1 agency1 or political subdivision of the ,federal ,government or a ,state1 ,tribal1 territorial1 or local government2 7ii7 a person or an entity that is collecting1 processing1 or transferring covered data on behalf of a ,federal1 ,state1 ,tribal1 territorial1 or local government entity1 in so far as such person or entity is acting as a service provider to the government entity2 or 7iii7 an entity that serves as a congressionally designated nonprofit1 national resource center1 and clearinghouse to provide assistance to victims1 families1 child-serving professionals1 and the general public on missing and exploited children issues4 7,c7 ,non-application to service providers ,an entity shall not be considered to be a covered entity for purposes of this ,act in so far as the entity is acting as a service provider 7as defined in paragraph 7#bi774 7#aj7 ,covered language ,the term covered language means the ten languages with the most users in the ,united ,states1 according to the most recent ,united ,states ,census4 7#aa7 ,covered minor ,the term covered minor means an individual under the age of #ag4 7#ab7 ,de-identified data ,the term de-identified data means information that does not identify and is not linked or reasonably linkable to a distinct individual or a device1 regardless of whether the information is aggregated1 and if the covered entity or service provider-- 7,a7 takes reasonable technical measures to ensure that the information cannot1 at any point1 be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual2 7,b7 publicly commits in a clear and conspicuous manner-- 7i7 to process and transfer the information solely in a de-identified form without any reasonable means for re-identification2 and 7ii7 to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual2 and 7,c7 contractually obligates any person or entity that receives the information from the covered entity or service provider-- 7i7 to comply with all of the provisions of this paragraph with respect to the information2 and 7ii7 to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received4 7#ac7 ,derived data ,the term derived data means covered data that is created by the derivation of information1 data1 assumptions1 correlations1 inferences1 predictions1 or conclusions from facts1 evidence1 or another source of information or data about an individual or an individual's device4 7#ad7 ,device ,the term device means any electronic equipment capable of collecting1 processing1 or transferring covered data that is used by one or more individuals4 7#ae7 ,employee ,the term employee means an individual who is an employee1 director1 officer1 staff member individual working as an independent contractor that is not a service provider1 trainee1 volunteer1 or intern of an employer1 regardless of whether such individual is paid1 unpaid1 or employed on a temporary basis4 7#af7 ,executive agency ,the ,executive agency has the meaning given such term in section #aje of title #e1 ,united ,states ,code4 7#ag7 ,first party advertising or marketing ,the term first party advertising or marketing means advertising or marketing conducted by a first party either through direct communications with a user such as direct mail1 email1 or text message communications1 or advertising or marketing conducted entirely within the first-party context1 such as in a physical location operated by the first party1 or on a web site or app operated by the first party4 7#ah7 ,genetic information ,the term genetic information means any covered data1 regardless of its format1 that concerns an individual's genetic characteristics1 including-- 7,a7 raw sequence data that results from the sequencing of the complete1 or a portion of the1 extracted deoxyribonucleic acid 7,,dna7 of an individual2 or 7,b7 genotypic and phenotypic information that results from analyzing raw sequence data described in subparagraph 7,a74 7#ai7 ,individual ,the term individual means a natural person residing in the ,united ,states4 7#bj7 ,knowledge 7,a7 ,in general ,the term knowledge means-- 7i7 with respect to a covered entity that is a covered high-impact social media company1 the entity knew or should have known the individual was a covered minor2 7ii7 with respect to a covered entity or service provider that is a large data holder1 and otherwise is not a covered high-impact social media company1 that the covered entity knew or acted in willful disregard of the fact that the individual was a covered minor2 and 7iii7 with respect to a covered entity or service provider that does not meet the requirements of clause 7i7 or 7ii71 actual knowledge4 7,b7 ,covered high-impact social media company ,for purposes of this paragraph1 the term covered high-impact social media company means a covered entity that provides any internet-accessible platform where-- 7i7 such covered entity generates #c1jjj1jjj1jjj or more in annual revenue2 7ii7 such platform has #cjj1jjj1jjj or more monthly active users for not fewer than #c of the preceding #ab months on the online product or service of such covered entity2 and 7iii7 such platform constitutes an online product or service that is primarily used by users to access or share1 user-generated content4 7#ba7 ,large data holder 7,a7 ,in general ,the term large data holder means a covered entity or service provider that1 in the most recent calendar year-- 7i7 had annual gross revenues of #bej1jjj1jjj or more2 and 7ii7 collected1 processed1 or transferred-- 7,i7 the covered data of more than #e1jjj1jjj individuals or devices that identify or are linked or reasonably linkable to #a or more individuals1 excluding covered data collected and processed solely for the purpose of initiating1 rendering1 billing for1 finalizing1 completing1 or otherwise collecting payment for a requested product or service2 and 7,,ii7 the sensitive covered data of more than #bjj1jjj individuals or devices that identify or are linked or reasonably linkable to #a or more individuals4 7,b7 ,exclusions ,the term large data holder does not include any instance in which the covered entity or service provider would qualify as a large data holder solely on the basis of collecting or processing-- 7i7 personal email addresses2 7ii7 personal telephone numbers2 or 7iii7 log-in information of an individual or device to allow the individual or device to log in to an account administered by the covered entity or service provider4 7,c7 ,revenue ,for purposes of determining whether any covered entity or service provider is a large data holder1 the term revenue1 with respect to any covered entity or service provider that is not organized to carry on business for its own profit or that of its members-- 7i7 means the gross receipts the covered entity or service provider received1 in whatever form1 from all sources1 without subtracting any costs or expenses2 and 7ii7 includes contributions1 gifts1 grants1 dues or other assessments1 income from investments1 and proceeds from the sale of real or personal property4 7#bb7 ,market research ,the term market research means the collection1 processing1 or transfer of covered data as reasonably necessary and proportionate to investigate the market for or marketing of products1 services1 or ideas1 where the covered data is not-- 7,a7 integrated into any product or service2 7,b7 otherwise used to contact any individual or individual's device2 or 7,c7 used to advertise or market to any individual or individual's device4 7#bc7 ,material ,the term material means1 with respect to an act1 practice1 or representation of a covered entity 7including a representation made by the covered entity in a privacy policy or similar disclosure to individuals7 involving the collection1 processing1 or transfer of covered data1 that such act1 practice1 or representation is likely to affect a reasonable individual's decision or conduct regarding a product or service4 7#bd7 ,precise geolocation information 7,a7 ,in general ,the term precise geolocation information means information that is derived from a device or technology that reveals the past or present physical location of an individual or device that identifies or is linked or reasonably linkable to #a or more individuals1 with sufficient precision to identify street level location information of an individual or device or the location of an individual or device within a range of #a1hej feet or less4 7,b7 ,exclusion ,the term precise geolocation information does not include geolocation information identifiable or derived solely from the visual content of a legally obtained image1 including the location of the device that captured such image4 7#be7 ,process ,the term process means to conduct or direct any operation or set of operations performed on covered data1 including analyzing1 organizing1 structuring1 retaining1 storing1 using1 or otherwise handling covered data4 7#bf7 ,processing purpose ,the term processing purpose means a reason for which a covered entity or service provider collects1 processes1 or transfers covered data that is specific and granular enough for a reasonable individual to understand the material facts of how and why the covered entity or service provider collects1 processes1 or transfers the covered data4 7#bg7 ,publicly available information 7,a7 ,in general ,the term publicly available information means any information that a covered entity or service provider has a reasonable basis to believe has been lawfully made available to the general public from-- 7i7 ,federal1 ,state1 or local government records1 if the covered entity collects1 processes1 and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity2 7ii7 widely distributed media2 7iii7 a website or online service made available to all members of the public1 for free or for a fee1 including where all members of the public1 for free or for a fee1 can log in to the website or online service2 7iv7 a disclosure that has been made to the general public as required by ,federal1 ,state1 or local law2 or 7v7 the visual observation of the physical presence of an individual or a device in a public place1 not including data collected by a device in the individual's possession4 7,b7 ,clarifications2 limitations 7i7 ,available to all members of the public ,for purposes of this paragraph1 information from a website or online service is not available to all members of the public if the individual who made the information available via the website or online service has restricted the information to a specific audience4 7ii7 ,other limitations ,the term publicly available information does not include-- 7,i7 any obscene visual depiction 7as defined in section #adfj of title #ah1 ,united ,states ,code72 7,,ii7 any inference made exclusively from multiple independent sources of publicly available information that reveals sensitive covered data with respect to an individual2 7,,iii7 biometric information2 7,,iv7 publicly available information that has been combined with covered data2 7,v7 genetic information1 unless otherwise made available by the individual to whom the information pertains as described in clause 7ii7 or 7iii7 of subparagraph 7,a72 or 7,,vi7 intimate images known to be nonconsensual4 7#bh7 ,sensitive covered data 7,a7 ,in general ,the term sensitive covered data means the following types of covered data3 7i7 ,a government-issued identifier1 such as a ,social ,security number1 passport number1 or driver's license number1 that is not required by law to be displayed in public4 7ii7 ,any information that describes or reveals the past1 present1 or future physical health1 mental health1 disability1 diagnosis1 or healthcare condition or treatment of an individual4 7iii7 ,a financial account number1 debit card number1 credit card number1 or information that describes or reveals the income level or bank account balances of an individual1 except that the last four digits of a debit or credit card number shall not be deemed sensitive covered data4 7iv7 ,biometric information4 7v7 ,genetic information4 7vi7 ,precise geolocation information4 7vii7 ,an individual's private communications such as voicemails1 emails1 texts1 direct messages1 or mail1 or information identifying the parties to such communications1 voice communications1 video communications1 and any information that pertains to the transmission of such communications1 including telephone numbers called1 telephone numbers from which calls were placed1 the time calls were made1 call duration1 and location information of the parties to the call1 unless the covered entity or a service provider acting on behalf of the covered entity is the sender or an intended recipient of the communication4 ,communications are not private for purposes of this clause if such communications are made from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that such employer may access such communications4 7viii7 ,account or device log-in credentials1 or security or access codes for an account or device4 7ix7 ,information identifying the sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the collection1 processing1 or transfer of such information4 7x7 ,calendar information1 address book information1 phone or text logs1 photos1 audio recordings1 or videos1 maintained for private use by an individual1 regardless of whether such information is stored on the individual's device or is accessible from that device and is backed up in a separate location4 ,such information is not sensitive for purposes of this paragraph if such information is sent from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that it may access such information4 7xi7 ,a photograph1 film1 video recording1 or other similar medium that shows the naked or undergarment-clad private area of an individual4 7xii7 ,information revealing the video content requested or selected by an individual collected by a covered entity that is not a provider of a service described in section #ajb7d74 ,this clause does not include covered data used solely for transfers for independent video measurement4 7xiii7 ,information about an individual when the covered entity or service provider has knowledge that the individual is a covered minor4 7xiv7 ,an individual's race1 color1 ethnicity1 religion1 or union membership4 7xv7 ,information identifying an individual's online activities over time and across third party websites or online services4 7xvi7 ,any other covered data collected1 processed1 or transferred for the purpose of identifying the types of covered data listed in clauses 7i7 through 7xv74 7,b7 ,rulemaking ,the ,commission may commence a rulemaking pursuant to section #eec of title #e1 ,united ,states ,code1 to include in the definition of sensitive covered data any other type of covered data that may require a similar level of protection as the types of covered data listed in clauses 7i7 through 7xvi7 of subparagraph 7,a7 as a result of any new method of collecting1 processing1 or transferring covered data4 7#bi7 ,service provider 7,a7 ,in general ,the term service provider means a person or entity that-- 7i7 collects1 processes1 or transfers covered data on behalf of1 and at the direction of1 a covered entity or a ,federal1 ,state1 ,tribal1 territorial1 or local government entity2 and 7ii7 receives covered data from or on behalf of a covered entity or a ,federal1 ,state1 ,tribal1 territorial1 or local government entity4 7,b7 ,treatment with respect to service provider data ,a service provider that receives service provider data from another service provider as permitted under this ,act shall be treated as a service provider under this ,act with respect to such data4 7#cj7 ,service provider data ,the term service provider data means covered data that is collected or processed by or has been transferred to a service provider by or on behalf of a covered entity1 a ,federal1 ,state1 ,tribal1 territorial1 or local government entity1 or another service provider for the purpose of allowing the service provider to whom such covered data is transferred to perform a service or function on behalf of1 and at the direction of1 such covered entity or ,federal1 ,state1 ,tribal1 territorial1 or local government entity4 7#ca7 ,state ,the term ,state means any of the #ej ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands of the ,united ,states1 ,guam1 ,american ,samoa1 or the ,commonwealth of the ,northern ,mariana ,islands4 7#cb7 ,state privacy authority ,the term ,state privacy authority means-- 7,a7 the chief consumer protection officer of a ,state2 or 7,b7 a ,state consumer protection agency with expertise in data protection1 including the ,california ,privacy ,protection ,agency4 7#cc7 ,substantial privacy risk ,the term substantial privacy risk means the collection1 processing1 or transfer of covered data in a manner that may result in any reasonably foreseeable substantial physical injury1 economic injury1 highly offensive intrusion into the privacy expectations of a reasonable individual under the circumstances1 or discrimination on the basis of race1 color1 religion1 national origin1 sex1 or disability4 7#cd7 ,targeted advertising ,the term targeted advertising-- 7,a7 means presenting to an individual or device identified by a unique identifier1 or groups of individuals or devices identified by unique identifiers1 an online advertisement that is selected based on known or predicted preferences1 characteristics1 or interests associated with the individual or a device identified by a unique identifier2 and 7,b7 does not include-- 7i7 advertising or marketing to an individual or an individual's device in response to the individual's specific request for information or feedback2 7ii7 contextual advertising1 which is when an advertisement is displayed based on the content in which the advertisement appears and does not vary based on who is viewing the advertisement2 or 7iii7 processing covered data solely for measuring or reporting advertising or content1 performance1 reach1 or frequency1 including independent measurement4 7#ce7 ,third party ,the term third party-- 7,a7 means any person or entity1 including a covered entity1 that-- 7i7 collects1 processes1 or transfers covered data that the person or entity did not collect directly from the individual linked or linkable to such covered data2 and 7ii7 is not a service provider with respect to such data2 and 7,b7 does not include a person or entity that collects covered data from another entity if the #b entities are related by common ownership or corporate control1 but only if a reasonable consumer's reasonable expectation would be that such entities share information4 7#cf7 ,third-party collecting entity 7,a7 ,in general ,the term third-party collecting entity-- 7i7 means a covered entity whose principal source of revenue is derived from processing or transferring covered data that the covered entity did not collect directly from the individuals linked or linkable to the covered data2 and 7ii7 does not include a covered entity insofar as such entity processes employee data collected by and received from a third party concerning any individual who is an employee of the third party for the sole purpose of such third party providing benefits to the employee4 7,b7 ,principal source of revenue defined ,for purposes of this paragraph1 the term principal source of revenue means1 for the prior #ab-month period1 either-- 7i7 more than #ej percent of all revenue of the covered entity2 or 7ii7 obtaining revenue from processing or transferring the covered data of more than #e1jjj1jjj individuals that the covered entity did not collect directly from the individuals linked or linkable to the covered data4 7,c7 ,non-application to service providers ,an entity may not be considered to be a third-party collecting entity for purposes of this ,act if the entity is acting as a service provider4 7#cg7 ,third party data ,the term third party data means covered data that has been transferred to a third party4 7#ch7 ,transfer ,the term transfer means to disclose1 release1 disseminate1 make available1 license1 rent1 or share covered data orally1 in writing1 electronically1 or by any other means4 7#ci7 ,unique persistent identifier ,the term unique identifier-- 7,a7 means an identifier to the extent that such identifier is reasonably linkable to an individual or device that identifies or is linked or reasonably linkable to #a or more individuals1 including a device identifier1 ,internet ,protocol address1 cookie1 beacon1 pixel tag1 mobile ad identifier1 or similar technology1 customer number1 unique pseudonym1 user alias1 telephone number1 or other form of persistent or probabilistic identifier that is linked or reasonably linkable to an individual or device2 and 7,b7 does not include an identifier assigned by a covered entity for the specific purpose of giving effect to an individual's exercise of affirmative express consent or opt-outs of the collection1 processing1 and transfer of covered data pursuant to section #bjd or otherwise limiting the collection1 processing1 or transfer of such information4 7#dj7 ,widely distributed media ,the term widely distributed media means information that is available to the general public1 including information from a telephone book or online directory1 a television1 internet1 or radio program1 the news media1 or an internet site that is available to the general public on an unrestricted basis1 but does not include an obscene visual depiction 7as defined in section #adfj of title #ah1 ,united ,states ,code74 ,i ,duty of ,loyalty #aja4 ,data minimization 7a7 ,in general ,a covered entity may not collect1 process1 or transfer covered data unless the collection1 processing1 or transfer is limited to what is reasonably necessary and proportionate to-- 7#a7 provide or maintain a specific product or service requested by the individual to whom the data pertains2 or 7#b7 effect a purpose permitted under subsection 7b74 7b7 ,permissible purposes ,a covered entity may collect1 process1 or transfer covered data for any of the following purposes if the collection1 processing1 or transfer is limited to what is reasonably necessary and proportionate to such purpose3 7#a7 ,to initiate1 manage1 or complete a transaction or fulfill an order for specific products or services requested by an individual1 including any associated routine administrative1 operational1 and account-servicing activity such as billing1 shipping1 delivery1 storage1 and accounting4 7#b7 ,with respect to covered data previously collected in accordance with this ,act1 notwithstanding this exception-- 7,a7 to process such data as necessary to perform system maintenance or diagnostics2 7,b7 to develop1 maintain1 repair1 or enhance a product or service for which such data was collected2 7,c7 to conduct internal research or analytics to improve a product or service for which such data was collected2 7,d7 to perform inventory management or reasonable network management2 7,e7 to protect against spam2 or 7,f7 to debug or repair errors that impair the functionality of a service or product for which such data was collected4 7#c7 ,to authenticate users of a product or service4 7#d7 ,to fulfill a product or service warranty4 7#e7 ,to prevent1 detect1 protect against1 or respond to a security incident4 ,for purposes of this paragraph1 security is defined as network security and physical security and life safety1 including an intrusion or trespass1 medical alerts1 fire alarms1 and access control security4 7#f7 ,to prevent1 detect1 protect against1 or respond to fraud1 harassment1 or illegal activity4 ,for purposes of this paragraph1 the term illegal activity means a violation of a ,federal1 ,state1 or local law punishable as a felony or misdemeanor that can directly harm4 7#g7 ,to comply with a legal obligation imposed by ,federal1 ,tribal1 local1 or ,state law1 or to investigate1 establish1 prepare for1 exercise1 or defend legal claims involving the covered entity or service provider4 7#h7 ,to prevent an individual1 or group of individuals1 from suffering harm where the covered entity or service provider believes in good faith that the individual1 or group of individuals1 is at risk of death1 serious physical injury1 or other serious health risk4 7#i7 ,to effectuate a product recall pursuant to ,federal or ,state law4 7#aj7 7,a7 ,to conduct a public or peer-reviewed scientific1 historical1 or statistical research project that-- 7i7 is in the public interest2 and 7ii7 adheres to all relevant laws and regulations governing such research1 including regulations for the protection of human subjects1 or is excluded from criteria of the institutional review board4 7,b7 ,not later than #ah months after the date of enactment of this ,act1 the ,commission should issue guidelines to help covered entities ensure the privacy of affected users and the security of covered data1 particularly as data is being transferred to and stored by researchers4 ,such guidelines should consider risks as they pertain to projects using covered data with special considerations for projects that are exempt under part #df of title #de1 ,code of ,federal ,regulations 7or any successor regulation7 or are excluded from the criteria for institutional review board review4 7#aa7 ,to deliver a communication that is not an advertisement to an individual1 if the communication is reasonably anticipated by the individual within the context of the individual's interactions with the covered entity4 7#ab7 ,to deliver a communication at the direction of an individual between such individual and one or more individuals or entities4 7#ac7 ,to transfer assets to a third party in the context of a merger1 acquisition1 bankruptcy1 or similar transaction when the third party assumes control1 in whole or in part1 of the covered entity's assets1 only if the covered entity1 in a reasonable time prior to such transfer1 provides each affected individual with-- 7,a7 a notice describing such transfer1 including the name of the entity or entities receiving the individual's covered data and their privacy policies as described in section #bjb2 and 7,b7 a reasonable opportunity to withdraw any previously given consents in accordance with the requirements of affirmative express consent under this ,act related to the individual's covered data and a reasonable opportunity to request the deletion of the individual's covered data1 as described in section #bjc4 7#ad7 ,to ensure the data security and integrity of covered data1 as described in section #bjh4 7#ae7 ,with respect to covered data previously collected in accordance with this ,act1 a service provider acting at the direction of a government entity1 or a service provided to a government entity by a covered entity1 and only insofar as authorized by statute1 to prevent1 detect1 protect against or respond to a public safety incident1 including trespass1 natural disaster1 or national security incident4 ,this paragraph does not permit1 however1 the transfer of covered data for payment or other valuable consideration to a government entity4 7#af7 ,with respect to covered data collected in accordance with this ,act1 notwithstanding this exception1 to process such data as necessary to provide first party advertising or marketing of products or services provided by the covered entity for individuals who are not-covered minors4 7#ag7 ,with respect to covered data previously collected in accordance with this ,act1 notwithstanding this exception and provided such collection1 processing1 and transferring otherwise complies with the requirements of this ,act1 including section #bjd7;c71 to provide targeted advertising4 7c7 ,guidance ,the ,commission shall issue guidance regarding what is reasonably necessary and proportionate to comply with this section4 ,such guidance shall take into consideration-- 7#a7 the size of1 and the nature1 scope1 and complexity of the activities engaged in by1 the covered entity1 including whether the covered entity is a large data holder1 nonprofit organization1 covered entity meeting the requirements of section #bji1 third party1 or third-party collecting entity2 7#b7 the sensitivity of covered data collected1 processed1 or transferred by the covered entity2 7#c7 the volume of covered data collected1 processed1 or transferred by the covered entity2 and 7#d7 the number of individuals and devices to which the covered data collected1 processed1 or transferred by the covered entity relates4 7d7 ,deceptive marketing of a product or service ,a covered entity or service provider may not engage in deceptive advertising or marketing with respect to a product or service offered to an individual4 7e7 ,journalism ,nothing in this ,act shall be construed to limit or diminish ,first ,amendment freedoms guaranteed under the ,constitution4 #ajb4 ,loyalty duties ,notwithstanding section #aja and unless an exception applies1 with respect to covered data1 a covered entity or service provider may not-- 7#a7 collect1 process1 or transfer a ,social ,security number1 except when necessary to facilitate an extension of credit1 authentication1 fraud and identity fraud detection and prevention1 the payment or collection of taxes1 the enforcement of a contract between parties1 or the prevention1 investigation1 or prosecution of fraud or illegal activity1 or as otherwise required by ,federal1 ,state1 or local law2 7#b7 collect or process sensitive covered data1 except where such collection or processing is strictly necessary to provide or maintain a specific product or service requested by the individual to whom the covered data pertains1 or is strictly necessary to effect a purpose enumerated in paragraphs 7#a7 through 7#ab7 and 7#ad7 through 7#ae7 of section #aja7;b72 7#c7 transfer an individual's sensitive covered data to a third party1 unless-- 7,a7 the transfer is made pursuant to the affirmative express consent of the individual2 7,b7 the transfer is necessary to comply with a legal obligation imposed by ,federal1 ,state1 ,tribal1 or local law1 or to establish1 exercise1 or defend legal claims2 7,c7 the transfer is necessary to prevent an individual from imminent injury where the covered entity believes in good faith that the individual is at risk of death1 serious physical injury1 or serious health risk2 7,d7 with respect to covered data collected in accordance with this ,act1 notwithstanding this exception1 a service provider acting at the direction of a government entity1 or a service provided to a government entity by a covered entity1 and only insofar as authorized by statute1 the transfer is necessary to prevent1 detect1 protect against or respond to a public safety incident including trespass1 natural disaster1 or national security incident4 ,this paragraph does not permit1 however1 the transfer of covered data for payment or other valuable consideration to a government entity2 7,e7 in the case of the transfer of a password1 the transfer is necessary to use a designated password manager or is to a covered entity for the exclusive purpose of identifying passwords that are being re-used across sites or accounts2 7,f7 in the case of the transfer of genetic information1 the transfer is necessary to perform a medical diagnosis or medical treatment specifically requested by an individual1 or to conduct medical research in accordance with conditions of section #aja7;b77#aj72 or 7,g7 to transfer assets in the manner described in paragraph 7#ac7 of section #aja7;b72 or 7#d7 in the case of a provider of broadcast television service1 cable service1 satellite service1 streaming media service1 or other video programming service described in section #gac7;h77#b7 of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #fac7;h77#b771 transfer to an unaffiliated third party covered data that reveals the video content or services requested or selected by an individual from such service1 except with the affirmative express consent of the individual or pursuant to one of the permissible purposes enumerated in paragraphs 7#a7 through 7#ae7 of section #aja7;b74 #ajc4 ,privacy by design 7a7 ,policies1 practices1 and procedures ,a covered entity and a service provider shall establish1 implement1 and maintain reasonable policies1 practices1 and procedures that reflect the role of the covered entity or service provider in the collection1 processing1 and transferring of covered data and that-- 7#a7 consider applicable ,federal laws1 rules1 or regulations related to covered data the covered entity or service provider collects1 processes1 or transfers2 7#b7 identify1 assess1 and mitigate privacy risks related to covered minors 7including1 if applicable1 with respect to a covered entity that is not an entity meeting the requirements of section #bji1 in a manner that considers the developmental needs of different age ranges of covered minors7 to result in reasonably necessary and proportionate residual risk to covered minors2 7#c7 mitigate privacy risks1 including substantial privacy risks1 related to the products and services of the covered entity or the service provider1 including in the design1 development1 and implementation of such products and services1 taking into account the role of the covered entity or service provider and the information available to it2 and 7#d7 implement reasonable training and safeguards within the covered entity and service provider to promote compliance with all privacy laws applicable to covered data the covered entity collects1 processes1 or transfers or covered data the service provider collects1 processes1 or transfers on behalf of the covered entity and mitigate privacy risks1 including substantial privacy risks1 taking into account the role of the covered entity or service provider and the information available to it4 7b7 ,factors to consider ,the policies1 practices1 and procedures established by a covered entity and a service provider under subsection 7a71 shall correspond with1 as applicable-- 7#a7 the size of the covered entity or the service provider and the nature1 scope1 and complexity of the activities engaged in by the covered entity or service provider1 including whether the covered entity or service provider is a large data holder1 nonprofit organization1 entity meeting the requirements of section #bji1 third party1 or third-party collecting entity1 taking into account the role of the covered entity or service provider and the information available to it2 7#b7 the sensitivity of the covered data collected1 processed1 or transferred by the covered entity or service provider2 7#c7 the volume of covered data collected1 processed1 or transferred by the covered entity or service provider2 7#d7 the number of individuals and devices to which the covered data collected1 processed1 or transferred by the covered entity or service provider relates2 and 7#e7 the cost of implementing such policies1 practices1 and procedures in relation to the risks and nature of the covered data4 7c7 ,commission guidance ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance as to what constitutes reasonable policies1 practices1 and procedures as required by this section4 ,the ,commission shall consider unique circumstances applicable to nonprofit organizations1 to entities meeting the requirements of section #bji1 and to service providers4 #ajd4 ,loyalty to individuals with respect to pricing 7a7 ,retaliation through service or pricing prohibited ,a covered entity may not retaliate against an individual for exercising any of the rights guaranteed by the ,act1 or any regulations promulgated under this ,act1 including denying goods or services1 charging different prices or rates for goods or services1 or providing a different level of quality of goods or services4 7b7 ,rules of construction ,nothing in subsection 7a7 may be construed to-- 7#a7 prohibit the relation of the price of a service or the level of service provided to an individual to the provision1 by the individual1 of financial information that is necessarily collected and processed only for the purpose of initiating1 rendering1 billing for1 or collecting payment for a service or product requested by the individual2 7#b7 prohibit a covered entity from offering a different price1 rate1 level1 quality or selection of goods or services to an individual1 including offering goods or services for no fee1 if the offering is in connection with an individual's voluntary participation in a bona fide loyalty program2 7#c7 require a covered entity to provide a bona fide loyalty program that would require the covered entity to collect1 process1 or transfer covered data that the covered entity otherwise would not collect1 process1 or transfer2 7#d7 prohibit a covered entity from offering a financial incentive or other consideration to an individual for participation in market research2 7#e7 prohibit a covered entity from offering different types of pricing or functionalities with respect to a product or service based on an individual's exercise of a right under section #bjc7;a77#c72 or 7#f7 prohibit a covered entity from declining to provide a product or service insofar as the collection and processing of covered data is strictly necessary for such product or service4 7c7 ,bona fide loyalty program defined ,for purposes of this section1 the term bona fide loyalty program includes rewards1 premium features1 discount or club card programs4 ,,ii ,consumer ,data ,rights #bja4 ,consumer awareness 7a7 ,in general ,not later than #ij days after the date of enactment of this ,act1 the ,commission shall publish1 on the public website of the ,commission1 a webpage that describes each provision1 right1 obligation1 and requirement of this ,act1 listed separately for individuals and for covered entities and service providers1 and the remedies1 exemptions1 and protections associated with this ,act1 in plain and concise language and in an easy-to-understand manner4 7b7 ,updates ,the ,commission shall update the information published under subsection 7a7 on a quarterly basis as necessitated by any change in law1 regulation1 guidance1 or judicial decisions4 7c7 ,accessibility ,the ,commission shall publish the information required to be published under subsection 7a7 in the ten languages with the most users in the ,united ,states1 according to the most recent ,united ,states ,census4 #bjb4 ,transparency 7a7 ,in general ,each covered entity shall make publicly available1 in a clear1 conspicuous1 not misleading1 and easy-to-read and readily accessible manner1 a privacy policy that provides a detailed and accurate representation of the data collection1 processing1 and transfer activities of the covered entity4 7b7 ,content of privacy policy ,a covered entity or service provider shall have a privacy policy that includes1 at a minimum1 the following3 7#a7 ,the identity and the contact information of-- 7,a7 the covered entity or service provider to which the privacy policy applies 7including the covered entity's or service provider's points of contact and generic electronic mail addresses1 as applicable for privacy and data security inquiries72 and 7,b7 any other entity within the same corporate structure as the covered entity or service provider to which covered data is transferred by the covered entity4 7#b7 ,the categories of covered data the covered entity or service provider collects or processes4 7#c7 ,the processing purposes for each category of covered data the covered entity or service provider collects or processes4 7#d7 ,whether the covered entity or service provider transfers covered data and1 if so1 each category of service provider and third party to which the covered entity or service provider transfers covered data1 the name of each third-party collecting entity to which the covered entity or service provider transfers covered data1 and the purposes for which such data is transferred to such categories of service providers and third parties or third-party collecting entities1 except for a transfer to a governmental entity pursuant to a court order or law that prohibits the covered entity or service provider from disclosing such transfer1 except for transfers to governmental entities pursuant to a court order or law that prohibits the covered entity from disclosing the transfer4 7#e7 ,the length of time the covered entity or service provider intends to retain each category of covered data1 including sensitive covered data1 or1 if it is not possible to identify that timeframe1 the criteria used to determine the length of time the covered entity or service provider intends to retain categories of covered data4 7#f7 ,a prominent description of how an individual can exercise the rights described in this ,act4 7#g7 ,a general description of the covered entity's or service provider's data security practices4 7#h7 ,the effective date of the privacy policy4 7#i7 ,whether or not any covered data collected by the covered entity or service provider is transferred to1 processed in1 stored in1 or otherwise accessible to the ,people's ,republic of ,china1 ,russia1 ,iran1 or ,north ,korea4 7c7 ,languages ,the privacy policy required under subsection 7a7 shall be made available to the public in each covered language in which the covered entity or service provider-- 7#a7 provides a product or service that is subject to the privacy policy2 or 7#b7 carries out activities related to such product or service4 7d7 ,accessibility ,the covered entity or service provider shall also provide the disclosures under this section in a manner that is reasonably accessible to and usable by individuals with disabilities4 7e7 ,material changes 7#a7 ,affirmative express consent ,if a covered entity makes a material change to its privacy policy or practices1 the covered entity shall notify each individual affected by such material change before implementing the material change with respect to any prospectively collected covered data and1 except as provided in paragraphs 7#a7 through 7#ae7 of section #aja7;b71 provide a reasonable opportunity for each individual to withdraw consent to any further materially different collection1 processing1 or transfer of previously collected covered data under the changed policy4 7#b7 ,notification ,the covered entity shall take all reasonable electronic measures to provide direct notification regarding material changes to the privacy policy to each affected individual1 in each covered language in which the privacy policy is made available1 and taking into account available technology and the nature of the relationship4 7#c7 ,clarification ,nothing in this section may be construed to affect the requirements for covered entities under section #ajb or #bjd4 7#d7 ,log of material changes ,each large data holder shall retain copies of previous versions of its privacy policy for at least #aj years beginning after the date of enactment of this ,act and publish them on its website4 ,such large data holder shall make publicly available1 in a clear1 conspicuous1 and readily accessible manner1 a log describing the date and nature of each material change to its privacy policy over the past #aj years4 ,the descriptions shall be sufficient for a reasonable individual to understand the material effect of each material change4 ,the obligations in this paragraph shall not apply to any previous versions of a large data holder's privacy policy1 or any material changes to such policy1 that precede the date of enactment of this ,act4 7f7 ,short-form notice to consumers by large data holders 7#a7 ,in general ,in addition to the privacy policy required under subsection 7a71 a large data holder that is a covered entity shall provide a short-form notice of its covered data practices in a manner that is-- 7,a7 concise1 clear1 conspicuous1 and not misleading2 7,b7 readily accessible to the individual1 based on what is reasonably anticipated within the context of the relationship between the individual and the large data holder2 7,c7 inclusive of an overview of individual rights and disclosures to reasonably draw attention to data practices that may reasonably be unexpected to a reasonable person or that involve sensitive covered data2 and 7,d7 no more than #ejj words in length4 7#b7 ,rulemaking ,the ,commission shall issue a rule pursuant to section #eec of title #e1 ,united ,states ,code1 establishing the minimum data disclosures necessary for the short-form notice required under paragraph 7#a71 which shall not exceed the content requirements in subsection 7b7 and shall include templates or models of short-form notices4 #bjc4 ,individual data ownership and control 7a7 ,access to1 and correction1 deletion1 and portability of1 covered data ,in accordance with subsections 7b7 and 7c71 a covered entity shall provide an individual1 after receiving a verified request from the individual1 with the right to-- 7#a7 access-- 7,a7 in a human-readable format that a reasonable individual can understand and download from the internet1 the covered data 7except covered data in a back-up or archival system7 of the individual making the request that is collected1 processed1 or transferred by the covered entity or any service provider of the covered entity within the #bd months preceding the request2 7,b7 the categories of any third party1 if applicable1 and an option for consumers to obtain the names of any such third party as well as and the categories of any service providers to whom the covered entity has transferred for consideration the covered data of the individual1 as well as the categories of sources from which the covered data was collected2 and 7,c7 a description of the purpose for which the covered entity transferred the covered data of the individual to a third party or service provider2 7#b7 correct any verifiable substantial inaccuracy or substantially incomplete information with respect to the covered data of the individual that is processed by the covered entity and instruct the covered entity to make reasonable efforts to notify all third parties or service providers to which the covered entity transferred such covered data of the corrected information2 7#c7 delete covered data of the individual that is processed by the covered entity and instruct the covered entity to make reasonable efforts to notify all third parties or service provider to which the covered entity transferred such covered data of the individual's deletion request2 and 7#d7 to the extent technically feasible1 export to the individual or directly to another entity the covered data of the individual that is processed by the covered entity1 including inferences linked or reasonably linkable to the individual but not including other derived data1 without licensing restrictions that limit such transfers in-- 7,a7 a human-readable format that a reasonable individual can understand and download from the internet2 and 7,b7 a portable1 structured1 interoperable1 and machine-readable format4 7b7 ,individual autonomy ,a covered entity may not condition1 effectively condition1 attempt to condition1 or attempt to effectively condition the exercise of a right described in subsection 7a7 through-- 7#a7 the use of any false1 fictitious1 fraudulent1 or materially misleading statement or representation2 or 7#b7 the design1 modification1 or manipulation of any user interface with the purpose or substantial effect of obscuring1 subverting1 or impairing a reasonable individual's autonomy1 decision making1 or choice to exercise such right4 7c7 ,timing 7#a7 ,in general ,subject to subsections 7d7 and 7e71 each request under subsection 7a7 shall be completed by any-- 7,a7 large data holder within #de days of such request from an individual1 unless it is demonstrably impracticable or impracticably costly to verify such individual2 7,b7 covered entity that is not a large data holder or a covered entity meeting the requirements of section #bji within #fj days of such request from an individual1 unless it is demonstrably impracticable or impracticably costly to verify such individual2 or 7,c7 covered entity meeting the requirements of section #bji within #ij days of such request from an individual1 unless it is demonstrably impracticable or impracticably costly to verify such individual4 7#b7 ,extension ,a response period set forth in this subsection may be extended once by #de additional days when reasonably necessary1 considering the complexity and number of the individual's requests1 so long as the covered entity informs the individual of any such extension within the initial #de-;day response period1 together with the reason for the extension4 7d7 ,frequency and cost of access ,a covered entity-- 7#a7 shall provide an individual with the opportunity to exercise each of the rights described in subsection 7a72 and 7#b7 with respect to-- 7,a7 the first #b times that an individual exercises any right described in subsection 7a7 in any #ab-month period1 shall allow the individual to exercise such right free of charge2 and 7,b7 any time beyond the initial #b times described in subparagraph 7,a71 may allow the individual to exercise such right for a reasonable fee for each request4 7e7 ,verification and exceptions 7#a7 ,required exceptions ,a covered entity may not permit an individual to exercise a right described in subsection 7a71 in whole or in part1 if the covered entity-- 7,a7 cannot reasonably verify that the individual making the request to exercise the right is the individual whose covered data is the subject of the request or an individual authorized to make such a request on the individual's behalf2 7,b7 reasonably believes that the request is made to interfere with a contract between the covered entity and another individual2 7,c7 determines that the exercise of the right would require access to or correction of another individual's sensitive covered data2 7,d7 reasonably believes that the exercise of the right would require the covered entity to engage in an unfair or deceptive practice under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de72 or 7,e7 reasonably believes that the request is made to further fraud1 support criminal activity1 or the exercise of the right presents a data security threat4 7#b7 ,additional information ,if a covered entity cannot reasonably verify that a request to exercise a right described in subsection 7a7 is made by the individual whose covered data is the subject of the request 7or an individual authorized to make such a request on the individual's behalf71 the covered entity-- 7,a7 may request that the individual making the request to exercise the right provide any additional information necessary for the sole purpose of verifying the identity of the individual2 and 7,b7 may not process or transfer such additional information for any other purpose4 7#c7 ,permissive exceptions 7,a7 ,in general ,a covered entity may decline1 with adequate explanation to the individual1 to comply with a request to exercise a right described in subsection 7a71 in whole or in part1 that would-- 7i7 require the covered entity to retain any covered data collected for a single1 one-time transaction1 if such covered data is not processed or transferred by the covered entity for any purpose other than completing such transaction2 7ii7 be demonstrably impracticable or prohibitively costly to comply with1 and the covered entity shall provide a description to the requestor detailing the inability to comply with the request2 7iii7 require the covered entity to attempt to re-identify de-identified data2 7iv7 require the covered entity to maintain covered data in an identifiable form or collect1 retain1 or access any data in order to be capable of associating a verified individual request with covered data of such individual2 7v7 result in the release of trade secrets or other privileged or confidential business information2 7vi7 require the covered entity to correct any covered data that cannot be reasonably verified as being inaccurate or incomplete2 7vii7 interfere with law enforcement1 judicial proceedings1 investigations1 or reasonable efforts to guard against1 detect1 prevent1 or investigate fraudulent1 malicious1 or unlawful activity1 or enforce valid contracts2 7viii7 violate ,federal or ,state law or the rights and freedoms of another individual1 including under the ,constitution of the ,united ,states2 7ix7 prevent a covered entity from being able to maintain a confidential record of deletion requests1 maintained solely for the purpose of preventing covered data of an individual from being recollected after the individual submitted a deletion request and requested that the covered entity no longer collect1 process1 or transfer such data2 7x7 fall within an exception enumerated in the regulations promulgated by the ,commission pursuant to subparagraph 7,d72 or 7xi7 with respect to requests for deletion-- 7,i7 unreasonably interfere with the provision of products or services by the covered entity to another person it currently serves2 7,,ii7 delete covered data that relates to a public figure and for which the requesting individual has no reasonable expectation of privacy2 7,,iii7 delete covered data reasonably necessary to perform a contract between the covered entity and the individual2 7,,iv7 delete covered data that the covered entity needs to retain in order to comply with professional ethical obligations2 7,v7 delete covered data that the covered entity reasonably believes may be evidence of unlawful activity or an abuse of the covered entity's products or services2 or 7,,vi7 for private elementary and secondary schools as defined by ,state law and private institutions of higher education as defined by title ,i of the ,higher ,education ,act of #aife1 delete covered data that would unreasonably interfere with the provision of education services by or the ordinary operation of the school or institution4 7,b7 ,partial compliance ,in a circumstance that would allow a denial pursuant to subparagraph 7,a71 a covered entity shall partially comply with the remainder of the request if it is possible and not unduly burdensome to do so4 7,c7 ,number of requests ,for purposes of subparagraph 7,a77ii71 the receipt of a large number of verified requests1 on its own1 may not be considered to render compliance with a request demonstrably impracticable4 7,d7 ,further exceptions ,the ,commission may1 by regulation as described in subsection 7g71 establish additional permissive exceptions necessary to protect the rights of individuals1 alleviate undue burdens on covered entities1 prevent unjust or unreasonable outcomes from the exercise of access1 correction1 deletion1 or portability rights1 or as otherwise necessary to fulfill the purposes of this section4 ,in establishing such exceptions1 the ,commission should consider any relevant changes in technology1 means for protecting privacy and other rights1 and beneficial uses of covered data by covered entities4 7f7 ,large data holder metrics reporting ,a large data holder that is a covered entity shall1 for each calendar year in which it was a large data holder1 do the following3 7#a7 ,compile the following metrics for the prior calendar year3 7,a7 ,the number of verified access requests under subsection 7a77#a74 7,b7 ,the number of verified deletion requests under subsection 7a77#c74 7,c7 ,the number of requests to opt-out of covered data transfers under section #bjd7;b74 7,d7 ,the number of requests to opt-out of targeted advertising under section #bjd7;c74 7,e7 ,the number of requests in each of subparagraphs 7,a7 through 7,d7 that such large data holder 7i7 complied with in whole or in part and 7ii7 denied4 7,f7 ,the median or mean number of days within which such large data holder substantively responded to the requests in each of subparagraphs 7,a7 through 7,d74 7#b7 ,disclose by ,july #a of each applicable calendar year the information compiled in paragraph 7#a7 within such large data holder's privacy policy required under section #bjb or on the publicly accessible website of such large data holder that is accessible from a hyperlink included in the privacy policy4 7g7 ,regulations ,not later than #b years after the date of enactment of this ,act1 the ,commission shall promulgate regulations1 pursuant to section #eec of title #e1 ,united ,states ,code1 as necessary to establish processes by which covered entities are to comply with the provisions of this section4 ,such regulations shall take into consideration-- 7#a7 the size of1 and the nature1 scope1 and complexity of the activities engaged in by the covered entity1 including whether the covered entity is a large data holder1 nonprofit organization1 covered entity meeting the requirements of section #bji1 third party1 or third-party collecting entity2 7#b7 the sensitivity of covered data collected1 processed1 or transferred by the covered entity2 7#c7 the volume of covered data collected1 processed1 or transferred by the covered entity2 7#d7 the number of individuals and devices to which the covered data collected1 processed1 or transferred by the covered entity relates2 and 7#e7 after consulting the ,national ,institute of ,standards and ,technology1 standards for ensuring the deletion of covered data under this ,act where appropriate4 7h7 ,accessibility ,a covered entity shall facilitate the ability of individuals to make requests under subsection 7a7 in any covered language in which the covered entity provides a product or service4 ,the mechanisms by which a covered entity enables individuals to make requests under subsection 7a7 shall be readily accessible and usable by with individuals with disabilities4 #bjd4 ,right to consent and object 7a7 ,withdrawal of consent ,a covered entity shall provide an individual with a clear and conspicuous1 easy-to-execute means to withdraw any affirmative express consent previously provided by the individual that is as easy to execute by a reasonable individual as the means to provide consent1 with respect to the processing or transfer of the covered data of the individual4 7b7 ,right to opt out of covered data transfers 7#a7 ,in general ,a covered entity-- 7,a7 may not transfer or direct the transfer of the covered data of an individual to a third party if the individual objects to the transfer2 and 7,b7 shall allow an individual to object to such a transfer through an opt-out mechanism1 as described in section #baj4 7#b7 ,exception ,except as provided in section #bjf7;b77#c77;,c71 a covered entity need not allow an individual to opt out of the collection1 processing1 or transfer of covered data made pursuant to the exceptions in paragraphs 7#a7 through 7#ae7 of section #aja7;b74 7c7 ,right to opt out of targeted advertising 7#a7 ,a covered entity or service provider that directly delivers a targeted advertisement shall-- 7,a7 prior to engaging in targeted advertising to an individual or device and at all times thereafter1 provide such individual with a clear and conspicuous means to opt out of targeted advertising2 7,b7 abide by any opt-out designation by an individual with respect to targeted advertising and notify the covered entity that directed the service provider to deliver the targeted advertisement of the opt-out decision2 and 7,c7 allow an individual to make an opt-out designation with respect to targeted advertising through an opt-out mechanism1 as described in section #baj4 7#b7 ,a covered entity or service provider that receives an opt-out notification pursuant to paragraph 7#a77;,b7 or this paragraph shall abide by such opt-out designations by an individual and notify any other person that directed the covered entity or service provider to serve1 deliver1 or otherwise handle the advertisement of the opt-out decision4 7d7 ,individual autonomy ,a covered entity may not condition1 effectively condition1 attempt to condition1 or attempt to effectively condition the exercise of any individual right under this section through-- 7#a7 the use of any false1 fictitious1 fraudulent1 or materially misleading statement or representation2 or 7#b7 the design1 modification1 or manipulation of any user interface with the purpose or substantial effect of obscuring1 subverting1 or impairing a reasonable individual's autonomy1 decision making1 or choice to exercise any such right4 #bje4 ,data protections for children and minors 7a7 ,prohibition on targeted advertising to children and minors ,a covered entity may not engage in targeted advertising to any individual if the covered entity has knowledge that the individual is a covered minor4 7b7 ,data transfer requirements related to covered minors 7#a7 ,in general ,a covered entity may not transfer or direct the transfer of the covered data of a covered minor to a third party if the covered entity-- 7,a7 has knowledge that the individual is a covered minor2 and 7,b7 has not obtained affirmative express consent from the covered minor or the covered minor's parent or guardian4 7#b7 ,exception ,a covered entity or service provider may collect1 process1 or transfer covered data of an individual the covered entity or service provider knows is under the age of #ah solely in order to submit information relating to child victimization to law enforcement or to the nonprofit1 national resource center and clearinghouse congressionally designated to provide assistance to victims1 families1 child-serving professionals1 and the general public on missing and exploited children issues4 7c7 ,youth privacy and marketing division 7#a7 ,establishment ,there is established within the ,commission in the privacy bureau established in this ,act1 a division to be known as the ,youth ,privacy and ,marketing ,division 7in this section referred to as the ,division74 7#b7 ,director ,the ,division shall be headed by a ,director1 who shall be appointed by the ,chair of the ,commission4 7#c7 ,duties ,the ,division shall be responsible for assisting the ,commission in addressing1 as it relates to this ,act-- 7,a7 the privacy of children and minors2 and 7,b7 marketing directed at children and minors4 7#d7 ,staff ,the ,director of the ,division shall hire adequate staff to carry out the duties described in paragraph 7#c71 including by hiring individuals who are experts in data protection1 digital advertising1 data analytics1 and youth development4 7#e7 ,reports ,not later than #b years after the date of enactment of this ,act1 and annually thereafter1 the ,commission shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that includes-- 7,a7 a description of the work of the ,division regarding emerging concerns relating to youth privacy and marketing practices2 and 7,b7 an assessment of how effectively the ,division has1 during the period for which the report is submitted1 assisted the ,commission to address youth privacy and marketing practices4 7#f7 ,publication ,not later than #aj days after the date on which a report is submitted under paragraph 7#e71 the ,commission shall publish the report on its website4 7d7 ,report by the inspector general 7#a7 ,in general ,not later than #b years after the date of enactment of this ,act1 and biennially thereafter1 the ,inspector ,general of the ,commission shall submit to the ,commission and to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report regarding the safe harbor provisions in section #acjd of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejc71 which shall include-- 7,a7 an analysis of whether the safe harbor provisions are-- 7i7 operating fairly and effectively2 and 7ii7 effectively protecting the interests of children and minors2 and 7,b7 any proposal or recommendation for policy changes that would improve the effectiveness of the safe harbor provisions4 7#b7 ,publication ,not later than #aj days after the date on which a report is submitted under paragraph 7#a71 the ,commission shall publish the report on the website of the ,commission4 #bjf4 ,third-party collecting entities 7a7 ,notice ,each third-party collecting entity shall place a clear1 conspicuous1 not misleading1 and readily accessible notice on the website or mobile application of the third-party collecting entity 7if the third-party collecting entity maintains such a website or mobile application7 that-- 7#a7 notifies individuals that the entity is a third-party collecting entity using specific language that the ,commission shall develop through rulemaking under section #eec of title #e1 ,united ,states ,code2 7#b7 includes a link to the website established under subsection 7b77#c72 and 7#c7 is reasonably accessible to and usable by individuals with disabilities4 7b7 ,third-party collecting entity registration 7#a7 ,in general ,not later than ,january #ca of each calendar year that follows a calendar year during which a covered entity acted as a third-party collecting entity and processed covered data pertaining to more than #e1jjj individuals or devices that identify or are linked or reasonably linkable to an individual1 such covered entity shall register with the ,commission in accordance with this subsection4 7#b7 ,registration requirements ,in registering with the ,commission as required under paragraph 7#a71 a third-party collecting entity shall do the following3 7,a7 ,pay to the ,commission a registration fee of #ajj4 7,b7 ,provide the ,commission with the following information3 7i7 ,the legal name and primary physical1 email1 and internet addresses of the third-party collecting entity4 7ii7 ,a description of the categories of covered data the third-party collecting entity processes and transfers4 7iii7 ,the contact information of the third-party collecting entity1 including a contact person1 a telephone number1 an e-mail address1 a website1 and a physical mailing address4 7iv7 ,a link to a website through which an individual may easily exercise the rights provided under this subsection4 7#c7 ,third-party collecting entity registry ,the ,commission shall establish and maintain on a website a searchable1 publicly available1 central registry of third-party collecting entities that are registered with the ,commission under this subsection that includes the following3 7,a7 ,a listing of all registered third-party collecting entities and a search feature that allows members of the public to identify individual third-party collecting entities4 7,b7 ,for each registered third-party collecting entity1 the information provided under paragraph 7#b77;,b74 7,c7 7i7 ,a ,do ,not ,collect registry link and mechanism by which an individual may1 easily submit a request to all registered third-party collecting entities that are not consumer reporting agencies 7as defined in section #fjc7;f7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7f7771 and to the extent such third-party collecting entities are not acting as consumer reporting agencies 7as so defined71 to-- 7,i7 delete all covered data related to such individual that the third-party collecting entity did not collect from such individual directly or when acting as a service provider2 and 7,,ii7 ensure that the third-party collecting entity no longer collects covered data related to such individual without the affirmative express consent of such individual1 except insofar as the third-party collecting entity is acting as a service provider4 7ii7 ,each third-party collecting entity that receives such a request from an individual shall delete all the covered data of the individual not later than #cj days after the request is received by the third-party collecting entity4 7iii7 ,notwithstanding the provisions of clauses 7i7 and 7ii71 a third-party collecting entity may decline to fulfill a ,do ,not ,collect request from an individual who it has actual knowledge has been convicted of a crime related to the abduction or sexual exploitation of a child1 and the data the entity is collecting is necessary to effectuate the purposes of a national or ,state-run sex offender registry or the congressionally designated entity that serves as the nonprofit national resource center and clearinghouse to provide assistance to victims1 families1 child-serving professionals1 and the general public on missing and exploited children issues4 7c7 ,penalties 7#a7 ,in general ,a third-party collecting entity that fails to register or provide the notice as required under this section shall be liable for-- 7,a7 a civil penalty of #ajj for each day the third-party collecting entity fails to register or provide notice as required under this section1 not to exceed a total of #aj1jjj for any year2 and 7,b7 an amount equal to the registration fees due under paragraph 7#b77;,a7 of subsection 7b7 for each year that the third-party collecting entity failed to register as required under paragraph 7#a7 of such subsection4 7#b7 ,rule of construction ,nothing in this subsection shall be construed as altering1 limiting1 or affecting any enforcement authorities or remedies under this ,act4 #bjg4 ,civil rights and algorithms 7a7 ,civil rights protections 7#a7 ,in general ,a covered entity or a service provider may not collect1 process1 or transfer covered data in a manner that discriminates in or otherwise makes unavailable the equal enjoyment of goods or services on the basis of race1 color1 religion1 national origin1 sex1 or disability4 7#b7 ,exceptions ,this subsection shall not apply to-- 7,a7 the collection1 processing1 or transfer of covered data for the purpose of-- 7i7 a covered entity's or a service provider's self-testing to prevent or mitigate unlawful discrimination2 or 7ii7 diversifying an applicant1 participant1 or customer pool2 or 7,b7 any private club or group not open to the public1 as described in section #bja7;e7 of the ,civil ,rights ,act of #aifd 7#db ,u4,s4,c4 #bjjj;a7e774 7b7 ,,ftc enforcement assistance 7#a7 ,in general ,whenever the ,commission obtains information that a covered entity or service provider may have collected1 processed1 or transferred covered data in violation of subsection 7a71 the ,commission shall transmit such information as allowable under ,federal law to any ,executive agency with authority to initiate enforcement actions or proceedings relating to such violation4 7#b7 ,annual report ,not later than #c years after the date of enactment of this ,act1 and annually thereafter1 the ,commission shall submit to ,congress a report that includes a summary of-- 7,a7 the types of information the ,commission transmitted to ,executive agencies under paragraph 7#a7 during the previous #a-year period2 and 7,b7 how such information relates to ,federal civil rights laws4 7#c7 ,technical assistance ,in transmitting information under paragraph 7#a71 the ,commission may consult and coordinate with1 and provide technical and investigative assistance1 as appropriate1 to such ,executive agency4 7#d7 ,cooperation with other agencies ,the ,commission may implement this subsection by executing agreements or memoranda of understanding with the appropriate ,executive agencies4 7c7 ,covered algorithm impact and evaluation 7#a7 ,covered algorithm impact assessment 7,a7 ,impact assessment ,notwithstanding any other provision of law1 not later than #b years after the date of enactment of this ,act1 and annually thereafter1 a large data holder that uses a covered algorithm in a manner that poses a consequential risk of harm to an individual or group of individuals1 and uses such covered algorithm solely or in part1 to collect1 process1 or transfer covered data shall conduct an impact assessment of such algorithm in accordance with subparagraph 7,b74 7,b7 ,impact assessment scope ,the impact assessment required under subparagraph 7,a7 shall provide the following3 7i7 ,a detailed description of the design process and methodologies of the covered algorithm4 7ii7 ,a statement of the purpose and proposed uses of the covered algorithm4 7iii7 ,a detailed description of the data used by the covered algorithm1 including the specific categories of data that will be processed as input and any data used to train the model that the covered algorithm relies on1 if applicable4 7iv7 ,a description of the outputs produced by the covered algorithm4 7v7 ,an assessment of the necessity and proportionality of the covered algorithm in relation to its stated purpose4 7vi7 ,a detailed description of steps the large data holder has taken or will take to mitigate potential harms from the covered algorithm to an individual or group of individuals1 including related to-- 7,i7 covered minors2 7,,ii7 making or facilitating advertising for1 or determining access to1 or restrictions on the use of housing1 education1 employment1 healthcare1 insurance1 or credit opportunities2 7,,iii7 determining access to1 or restrictions on the use of1 any place of public accommodation1 particularly as such harms relate to the protected characteristics of individuals1 including race1 color1 religion1 national origin1 sex1 or disability2 7,,iv7 disparate impact on the basis of individuals' race1 color1 religion1 national origin1 sex1 or disability status2 or 7,v7 disparate impact on the basis of individuals' political party registration status4 7#b7 ,algorithm design evaluation ,notwithstanding any other provision of law1 not later than #b years after the date of enactment of this ,act1 a covered entity or service provider that knowingly develops a covered algorithm that is designed to1 solely or in part1 to collect1 process1 or transfer covered data in furtherance of a consequential decision shall prior to deploying the covered algorithm in interstate commerce evaluate the design1 structure1 and inputs of the covered algorithm1 including any training data used to develop the covered algorithm1 to reduce the risk of the potential harms identified under paragraph 7#a77;,b74 7#c7 ,other considerations 7,a7 ,focus ,in complying with paragraphs 7#a7 and 7#b71 a covered entity and a service provider may focus the impact assessment or evaluation on any covered algorithm1 or portions of a covered algorithm1 that will be put to use and may reasonably contribute to the risk of the potential harms identified under paragraph 7#a77;,b74 7,b7 ,availability 7i7 ,in general ,a covered entity and a service provider-- 7,i7 shall1 not later than #cj days after completing an impact assessment or evaluation1 submit the impact assessment or evaluation conducted under paragraph 7#a7 or 7#b7 to the ,commission2 7,,ii7 shall1 upon request1 make such impact assessment and evaluation available to ,congress2 and 7,,iii7 may make a summary of such impact assessment and evaluation publicly available in a place that is easily accessible to individuals4 7ii7 ,trade secrets ,covered entities and service providers may redact and segregate any trade secret 7as defined in section #ahci of title #ah1 ,united ,states ,code7 or other confidential or proprietary information from public disclosure under this subparagraph and the ,commission shall abide by its obligations under section #f7;f7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;f77 in regard to such information4 7,c7 ,enforcement ,the ,commission may not use any information obtained solely and exclusively through a covered entity or a service provider's disclosure of information to the ,commission in compliance with this section for any purpose other than enforcing this ,act with the exception of enforcing consent orders1 including the study and report provisions in paragraph 7#f74 ,this subparagraph does not preclude the ,commission from providing this information to ,congress in response to a subpoena4 7#d7 ,guidance ,not later than #b years after the date of enactment of this ,act1 the ,commission shall1 in consultation with the ,secretary of ,commerce1 or their respective designees1 publish guidance regarding compliance with this section4 7#e7 ,rulemaking and exemption ,the ,commission shall have authority under section #eec of title #e1 ,united ,states ,code1 to promulgate regulations as necessary to establish processes by which a large data holder-- 7,a7 shall submit an impact assessment to the ,commission under paragraph 7#c77;,b77i77,i72 and 7,b7 may exclude from this subsection any covered algorithm that presents low or minimal consequential risk of harm to an individual or group of individuals4 7#f7 ,study and report 7,a7 ,study ,the ,commission1 in consultation with the ,secretary of ,commerce or the ,secretary's designee1 shall conduct a study1 to review any impact assessment or evaluation submitted under this subsection4 ,such study shall include an examination of-- 7i7 best practices for the assessment and evaluation of covered algorithms2 and 7ii7 methods to reduce the risk of harm to individuals that may be related to the use of covered algorithms4 7,b7 ,report 7i7 ,initial report ,not later than #c years after the date of enactment of this ,act1 the ,commission1 in consultation with the ,secretary of ,commerce or the ,secretary's designee1 shall submit to ,congress a report containing the results of the study conducted under subparagraph 7,a71 together with recommendations for such legislation and administrative action as the ,commission determines appropriate4 7ii7 ,additional reports ,not later than #c years after submission of the initial report under clause 7i71 and as the ,commission determines necessary thereafter1 the ,commission shall submit to ,congress an updated version of such report4 #bjh4 ,data security and protection of covered data 7a7 ,establishment of data security practices 7#a7 ,in general ,a covered entity or service provider shall establish1 implement1 and maintain reasonable administrative1 technical1 and physical data security practices and procedures to protect and secure covered data against unauthorized access and acquisition4 7#b7 ,considerations ,the reasonable administrative1 technical1 and physical data security practices required under paragraph 7#a7 shall be appropriate to-- 7,a7 the size and complexity of the covered entity or service provider2 7,b7 the nature and scope of the covered entity or the service provider's collecting1 processing1 or transferring of covered data2 7,c7 the volume and nature of the covered data collected1 processed1 or transferred by the covered entity or service provider2 7,d7 the sensitivity of the covered data collected1 processed1 or transferred2 7,e7 the current state of the art 7and limitations thereof7 in administrative1 technical1 and physical safeguards for protecting such covered data2 and 7,f7 the cost of available tools to improve security and reduce vulnerabilities to unauthorized access and acquisition of such covered data in relation to the risks and nature of the covered data4 7b7 ,specific requirements ,the data security practices of the covered entity and of the service provider required under subsection 7a7 shall include1 for each respective entity's own system or systems1 at a minimum1 the following practices3 7#a7 ,assess vulnerabilities ,identifying and assessing any material internal and external risk to1 and vulnerability in1 the security of each system maintained by the covered entity that collects1 processes1 or transfers covered data1 or service provider that collects1 processes1 or transfers covered data on behalf of the covered entity1 including unauthorized access to or risks to such covered data1 human vulnerabilities1 access rights1 and the use of service providers4 ,with respect to large data holders1 such activities shall include a plan to receive and reasonably respond to unsolicited reports of vulnerabilities by any entity or individual and by performing a reasonable investigation of such reports4 7#b7 ,preventive and corrective action ,taking preventive and corrective action designed to mitigate reasonably foreseeable risks or vulnerabilities to covered data identified by the covered entity or service provider1 consistent with the nature of such risk or vulnerability and the entity's role in collecting1 processing1 or transferring the data4 ,such action may include implementing administrative1 technical1 or physical safeguards or changes to data security practices or the architecture1 installation1 or implementation of network or operating software1 among other actions4 7#c7 ,evaluation of preventive and corrective action ,evaluating and making reasonable adjustments to the action described in paragraph 7#b7 in light of any material changes in technology1 internal or external threats to covered data1 and the covered entity or service provider's own changing business arrangements or operations4 7#d7 ,information retention and disposal ,disposing of covered data in accordance with a retention schedule that shall require the deletion of covered data when such data is required to be deleted by law or is no longer necessary for the purpose for which the data was collected1 processed1 or transferred1 unless an individual has provided affirmative express consent to such retention4 ,such disposal shall include destroying1 permanently erasing1 or otherwise modifying the covered data to make such data permanently unreadable or indecipherable and unrecoverable to ensure ongoing compliance with this section4 ,service providers shall establish practices to delete or return covered data to a covered entity as requested at the end of the provision of services unless retention of the covered data is required by law1 consistent with section #cjb7;a77#f74 7#e7 ,training ,training each employee with access to covered data on how to safeguard covered data and updating such training as necessary4 7#f7 ,designation ,designating an officer1 employee1 or employees to maintain and implement such practices4 7#g7 ,incident response ,implementing procedures to detect1 respond to1 or recover from security incidents1 including breaches4 7c7 ,regulations ,the ,commission may promulgate1 in accordance with section #eec of title #e1 ,united ,states ,code1 technology-neutral regulations to establish processes for complying with this section4 ,the ,commission shall consult with the ,national ,institute of ,standards and ,technology in establishing such processes4 #bji4 ,small business protections 7a7 ,establishment of exemption ,any covered entity or service provider that can establish that it met the requirements described in subsection 7b7 for the period of the #c preceding calendar years 7or for the period during which the covered entity or service provider has been in existence if such period is less than #c years7 shall-- 7#a7 be exempt from compliance with section #bjc7;a77#d71 paragraphs 7#a7 through 7#c7 and 7#e7 through 7#g7 of section #bjh7;b71 and section #cja7;c72 and 7#b7 at the covered entity's sole discretion1 have the option of complying with section #bjc7;a77#b7 by1 after receiving a verified request from an individual to correct covered data of the individual under such section1 deleting such covered data in its entirety instead of making the requested correction4 7b7 ,exemption requirements ,the requirements of this subsection are1 with respect to a covered entity or a service provider1 the following3 7#a7 ,the covered entity or service provider's average annual gross revenues during the period did not exceed #da1jjj1jjj4 7#b7 ,the covered entity or service provider1 on average1 did not annually collect or process the covered data of more than #bjj1jjj individuals during the period beyond the purpose of initiating1 rendering1 billing for1 finalizing1 completing1 or otherwise collecting payment for a requested service or product1 so long as all covered data for such purpose was deleted or de-identified within #ij days1 except when necessary to investigate fraud or as consistent with a covered entity's return policy4 7#c7 ,the covered entity or service provider did not derive more than #ej percent of its revenue from transferring covered data during any year 7or part of a year if the covered entity has been in existence for less than #a year7 that occurs during the period4 7c7 ,revenue defined ,for purposes of this section1 the term revenue as it relates to any covered entity or service provider that is not organized to carry on business for its own profit or that of its members1 means the gross receipts the covered entity or service provider received in whatever form from all sources without subtracting any costs or expenses1 and includes contributions1 gifts1 grants1 dues or other assessments1 income from investments1 or proceeds from the sale of real or personal property4 #baj4 ,unified opt-out mechanisms 7a7 ,in general ,for the rights established under subsection 7b7 of section #bjd1 subsection 7c7 of section #bjd 7except as provided for under section #aja7;b77#af771 and section #bjf7;b77#c77;,c71 following public notice and opportunity to comment and not later than #ah months after the date of enactment of this ,act1 the ,commission shall establish or recognize one or more acceptable privacy protective1 centralized mechanisms1 including global privacy signals such as browser or device privacy settings1 other tools offered by covered entities or service providers1 and registries of identifiers1 for individuals to exercise all such rights through a single interface for a covered entity or service provider to utilize to allow an individual to make such opt out designations with respect to covered data related to such individual4 7b7 ,requirements ,any such centralized opt-out mechanism shall-- 7#a7 require covered entities or service providers acting on behalf of covered entities to inform individuals about the centralized opt-out choice2 7#b7 not be required to be the default setting1 but may be the default setting provided that in all cases the mechanism clearly represents the individual's affirmative1 freely given1 and unambiguous choice to opt out2 7#c7 be consumer-friendly1 clearly described1 and easy-to-use by a reasonable individual2 7#d7 permit the covered entity or service provider acting on behalf of a covered entity to have an authentication process the covered entity or service provider acting on behalf of a covered entity may use to determine if the mechanism represents a legitimate request to opt out2 7#e7 be provided in any covered language in which the covered entity provides products or services subject to the opt-out2 and 7#f7 be provided in a manner that is reasonably accessible to and usable by individuals with disabilities4 ,,iii ,corporate ,accountability #cja4 ,executive responsibility 7a7 ,in general ,beginning #a year after the date of enactment of this ,act1 an executive officer of a large data holder shall annually certify1 in good faith1 to the ,commission1 in a manner specified by the ,commission by regulation under section #eec of title #e1 ,united ,states ,code1 that the entity maintains-- 7#a7 internal controls reasonably designed to comply with this ,act2 and 7#b7 internal reporting structures to ensure that such certifying executive officer is involved in and responsible for the decisions that impact the compliance by the large data holder with this ,act4 7b7 ,requirements ,a certification submitted under subsection 7a7 shall be based on a review of the effectiveness of the internal controls and reporting structures of the large data holder that is conducted by the certifying executive officer not more than #ij days before the submission of the certification4 ,a certification submitted under subsection 7a7 is made in good faith if the certifying officer had1 after a reasonable investigation1 reasonable ground to believe and did believe1 at the time that certification was submitted1 that the statements therein were true and that there was no omission to state a material fact required to be stated therein or necessary to make the statements therein not misleading4 7c7 ,designation of privacy and data security officer 7#a7 ,in general ,a covered entity or service provider that have more than #ae employees1 shall designate-- 7,a7 #a or more qualified employees as privacy officers2 and 7,b7 #a or more qualified employees 7in addition to any employee designated under subparagraph 7,a77 as data security officers4 7#b7 ,requirements for officers ,an employee who is designated by a covered entity or a service provider as a privacy officer or a data security officer pursuant to paragraph 7#a7 shall1 at a minimum-- 7,a7 implement a data privacy program and data security program to safeguard the privacy and security of covered data in compliance with the requirements of this ,act2 and 7,b7 facilitate the covered entity or service provider's ongoing compliance with this ,act4 7#c7 ,additional requirements for large data holders ,a large data holder shall designate at least #a of the officers described in paragraph 7#a7 to report directly to the highest official at the large data holder as a privacy protection officer who shall1 in addition to the requirements in paragraph 7#b71 either directly or through a supervised designee or designees-- 7,a7 establish processes to periodically review and update the privacy and security policies1 practices1 and procedures of the large data holder1 as necessary2 7,b7 conduct biennial and comprehensive audits to ensure the policies1 practices1 and procedures of the large data holder ensure the large data holder is in compliance with this ,act and ensure such audits are accessible to the ,commission upon request2 7,c7 develop a program to educate and train employees about compliance requirements of this ,act2 7,d7 maintain updated1 accurate1 clear1 and understandable records of all material privacy and data security practices undertaken by the large data holder2 and 7,e7 serve as the point of contact between the large data holder and enforcement authorities4 7d7 ,large data holder privacy impact assessments 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act or #a year after the date on which a covered entity first meets the definition of large data holder1 whichever is earlier1 and biennially thereafter1 each covered entity that is a large data holder shall conduct a privacy impact assessment that weighs the benefits of the large data holder's covered data collecting1 processing1 and transfer practices against the potential adverse consequences of such practices1 including substantial privacy risks1 to individual privacy4 7#b7 ,assessment requirements ,a privacy impact assessment required under paragraph 7#a7 shall be-- 7,a7 reasonable and appropriate in scope given-- 7i7 the nature of the covered data collected1 processed1 and transferred by the large data holder2 7ii7 the volume of the covered data collected1 processed1 and transferred by the large data holder2 and 7iii7 the potential material risks posed to the privacy of individuals by the collecting1 processing1 and transfer of covered data by the large data holder2 7,b7 documented in written form and maintained by the large data holder unless rendered out of date by a subsequent assessment conducted under paragraph 7#a72 and 7,c7 approved by the privacy protection officer designated in subsection 7c77#c7 of the large data holder1 as applicable4 7#c7 ,additional factors to include in assessment ,in assessing the privacy risks1 including substantial privacy risks1 the large data holder must include reviews of the means by which technologies1 including blockchain and distributed ledger technologies and other emerging technologies1 are used to secure covered data4 7e7 ,other privacy impact assessments 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act and biennially thereafter1 each covered entity that is not large data holder and does not meet the requirements for covered entities under section #bji shall conduct a privacy impact assessment4 ,such assessment shall weigh the benefits of the covered entity's covered data collecting1 processing1 and transfer practices that may cause a substantial privacy risk against the potential material adverse consequences of such practices to individual privacy4 7#b7 ,assessment requirements ,a privacy impact assessment required under paragraph 7#a7 shall be-- 7,a7 reasonable and appropriate in scope given-- 7i7 the nature of the covered data collected1 processed1 and transferred by the covered entity2 7ii7 the volume of the covered data collected1 processed1 and transferred by the covered entity2 and 7iii7 the potential risks posed to the privacy of individuals by the collecting1 processing1 and transfer of covered data by the covered entity2 and 7,b7 documented in written form and maintained by the covered entity unless rendered out of date by a subsequent assessment conducted under paragraph 7#a74 7#c7 ,additional factors to include in assessment ,in assessing the privacy risks1 including substantial privacy risks1 the covered entity may include reviews of the means by which technologies1 including blockchain and distributed ledger technologies and other emerging technologies1 are used to secure covered data4 #cjb4 ,service providers and third parties 7a7 ,service providers ,a service provider-- 7#a7 shall adhere to the instructions of a covered entity and only collect1 process1 and transfer service provider data to the extent necessary and proportionate to provide a service requested by the covered entity1 as set out in the contract required by subsection 7b71 and this paragraph does not require a service provider to collect1 process1 or transfer covered data if the service provider would not otherwise do so2 7#b7 may not collect1 process1 or transfer service provider data if the service provider has actual knowledge that a covered entity violated this ,act with respect to such data2 7#c7 shall assist a covered entity in responding to a request made by an individual under section #bjc or #bjd1 by either-- 7,a7 providing appropriate technical and organizational measures1 taking into account the nature of the processing and the information reasonably available to the service provider1 for the covered entity to comply with such request for service provider data2 or 7,b7 fulfilling a request by a covered entity to execute an individual rights request that the covered entity has determined should be complied with1 by either-- 7i7 complying with the request pursuant to the covered entity's instructions2 or 7ii7 providing written verification to the covered entity that it does not hold covered data related to the request1 that complying with the request would be inconsistent with its legal obligations1 or that the request falls within an exception to section #bjc or #bjd2 7#d7 may engage another service provider for purposes of processing service provider data on behalf of a covered entity only after providing that covered entity with notice and pursuant to a written contract that requires such other service provider to satisfy the obligations of the service provider with respect to such service provider data1 including that the other service provider be treated as a service provider under this ,act2 7#e7 shall1 upon the reasonable request of the covered entity1 make available to the covered entity information necessary to demonstrate the compliance of the service provider with the requirements of this ,act1 which may include making available a report of an independent assessment arranged by the service provider on terms agreed to by the service provider and the covered entity1 providing information necessary to enable the covered entity to conduct and document a privacy impact assessment required by subsection 7d7 or 7e7 of section #cja1 and making available the report required under section #bjg7;c77#b72 7#f7 shall1 at the covered entity's direction1 delete or return all covered data to the covered entity as requested at the end of the provision of services1 unless retention of the covered data is required by law2 7#g7 shall develop1 implement1 and maintain reasonable administrative1 technical1 and physical safeguards that are designed to protect the security and confidentiality of covered data the service provider processes consistent with section #bjh2 and 7#h7 shall allow and cooperate with1 reasonable assessments by the covered entity or the covered entity's designated assessor2 alternatively1 the service provider may arrange for a qualified and independent assessor to conduct an assessment of the service provider's policies and technical and organizational measures in support of the obligations under this ,act using an appropriate and accepted control standard or framework and assessment procedure for such assessments4 ,the service provider shall provide a report of such assessment to the covered entity upon request4 7b7 ,contracts ,between ,covered ,entities and ,service ,providers 7#a7 ,requirements ,a person or entity may only act as a service provider pursuant to a written contract between the covered entity and the service provider1 or a written contract between one service provider and a second service provider as described under subsection 7a77#d71 if the contract-- 7,a7 sets forth the data processing procedures of the service provider with respect to collection1 processing1 or transfer performed on behalf of the covered entity or service provider2 7,b7 clearly sets forth-- 7i7 instructions for collecting1 processing1 or transferring data2 7ii7 the nature and purpose of collecting1 processing1 or transferring2 7iii7 the type of data subject to collecting1 processing1 or transferring2 7iv7 the duration of processing2 and 7v7 the rights and obligations of both parties1 including a method by which the service provider shall notify the covered entity of material changes to its privacy practices2 7,c7 does not relieve a covered entity or a service provider of any requirement or liability imposed on such covered entity or service provider under this ,act2 and 7,d7 prohibits-- 7i7 collecting1 processing1 or transferring covered data in contravention to subsection 7a72 and 7ii7 combining service provider data with covered data which the service provider receives from or on behalf of another person or persons or collects from the interaction of the service provider with an individual1 provided that such combining is not necessary to effectuate a purpose described in paragraphs 7#a7 through 7#ae7 of section #aja7;b7 and is otherwise permitted under the contract required by this subsection4 7#b7 ,contract terms ,each service provider shall retain copies of previous contracts entered into in compliance with this subsection with each covered entity to which it provides requested products or services4 7c7 ,relationship ,between ,covered ,entities and ,service ,providers 7#a7 ,determining whether a person is acting as a covered entity or service provider with respect to a specific processing of covered data is a fact-based determination that depends upon the context in which such data is processed4 7#b7 ,a person that is not limited in its processing of covered data pursuant to the instructions of a covered entity1 or that fails to adhere to such instructions1 is a covered entity and not a service provider with respect to a specific processing of covered data4 ,a service provider that continues to adhere to the instructions of a covered entity with respect to a specific processing of covered data remains a service provider4 ,if a service provider begins1 alone or jointly with others1 determining the purposes and means of the processing of covered data1 it is a covered entity and not a service provider with respect to the processing of such data4 7#c7 ,a covered entity that transfers covered data to a service provider or a service provider that transfers covered data to a covered entity or another service provider1 in compliance with the requirements of this ,act1 is not liable for a violation of this ,act by the service provider or covered entity to whom such covered data was transferred1 if at the time of transferring such covered data1 the covered entity or service provider did not have actual knowledge that the service provider or covered entity would violate this ,act4 7#d7 ,a covered entity or service provider that receives covered data in compliance with the requirements of this ,act is not in violation of this ,act as a result of a violation by a covered entity or service provider from which such data was received4 7d7 ,third parties ,a third party-- 7#a7 shall not process third party data for a processing purpose other than1 in the case of sensitive covered data1 the processing purpose for which the individual gave affirmative express consent or to effect a purpose enumerated in paragraph 7#a71 7#c71 or 7#e7 of section #aja7;b7 and1 in the case of non-sensitive data1 the processing purpose for which the covered entity made a disclosure pursuant to section #bjb7;b77#d72 and 7#b7 for purposes of paragraph 7#a71 may reasonably rely on representations made by the covered entity that transferred the third party data if the third party conducts reasonable due diligence on the representations of the covered entity and finds those representations to be credible4 7e7 ,additional obligations on covered entities 7#a7 ,in general ,a covered entity or service provider shall exercise reasonable due diligence in-- 7,a7 selecting a service provider2 and 7,b7 deciding to transfer covered data to a third party4 7#b7 ,guidance ,not later than #b years after the date of enactment of this ,act1 the ,commission shall publish guidance regarding compliance with this subsection1 taking into consideration the burdens on large data holders1 covered entities who are not large data holders1 and covered entities meeting the requirements of section #bji4 7f7 ,rule of construction ,solely for the purposes of this section1 the requirements for service providers to contract with1 assist1 and follow the instructions of covered entities shall be read to include requirements to contract with1 assist1 and follow the instructions of a government entity if the service provider is providing a service to a government entity4 #cjc4 ,technical compliance programs 7a7 ,in general ,not later than #c years after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to establish a process for the proposal and approval of technical compliance programs under this section used by a covered entity to collect1 process1 or transfer covered data4 7b7 ,scope of programs ,the technical compliance programs established under this section shall1 with respect to a technology1 product1 service1 or method used by a covered entity to collect1 process1 or transfer covered data-- 7#a7 establish publicly available guidelines for compliance with this ,act2 and 7#b7 meet or exceed the requirements of this ,act4 7c7 ,approval process 7#a7 ,in general ,any request for approval1 amendment1 or repeal of a technical compliance program may be submitted to the ,commission by any person1 including a covered entity1 a representative of a covered entity1 an association of covered entities1 or a public interest group or organization4 ,within #ij days after the request is made1 the ,commission shall publish the request and provide an opportunity for public comment on the proposal4 7#b7 ,expedited response to requests ,beginning #a year after the date of enactment of this ,act1 the ,commission shall act upon a request for the proposal and approval of a technical compliance program not later than #a year after the filing of the request1 and shall set forth publicly in writing the conclusions of the ,commission with regard to such request4 7d7 ,right to ,appeal ,final action by the ,commission on a request for approval1 amendment1 or repeal of a technical compliance program1 or the failure to act within the #a-year period after a request for approval1 amendment1 or repeal of a technical compliance program is made under subsection 7c71 may be appealed to a ,federal district court of the ,united ,states of appropriate jurisdiction as provided for in section #gjb of title #e1 ,united ,states ,code4 7e7 ,effect on enforcement 7#a7 ,in general ,prior to commencing an investigation or enforcement action against any covered entity under this ,act1 the ,commission and ,state attorney general shall consider the covered entity's history of compliance with any technical compliance program approved under this section and any action taken by the covered entity to remedy noncompliance with such program4 ,if such enforcement action described in section #djc is brought1 the covered entity's history of compliance with any technical compliance program approved under this section and any action taken by the covered entity to remedy noncompliance with such program shall be taken into consideration when determining liability or a penalty4 ,the covered entity's history of compliance with any technical compliance program shall not affect any burden of proof or the weight given to evidence in an enforcement or judicial proceeding4 7#b7 ,commission authority ,approval of a technical compliance program shall not limit the authority of the ,commission1 including the ,commission's authority to commence an investigation or enforcement action against any covered entity under this ,act or any other ,act4 7#c7 ,rule of construction ,nothing in this subsection shall provide any individual1 class of individuals1 or person with any right to seek discovery of any non-public ,commission deliberation or activity or impose any pleading requirement on the ,commission if the ,commission brings an enforcement action of any kind4 #cjd4 ,commission approved compliance guidelines 7a7 ,application for compliance guideline ,approval 7#a7 ,in general ,a covered entity that is not a third-party collecting entity and meets the requirements of section #bji1 or a group of such covered entities1 may apply to the ,commission for approval of #a or more sets of compliance guidelines governing the collection1 processing1 and transfer of covered data by the covered entity or group of covered entities4 7#b7 ,application requirements ,such application shall include-- 7,a7 a description of how the proposed guidelines will meet or exceed the requirements of this ,act2 7,b7 a description of the entities or activities the proposed set of compliance guidelines is designed to cover2 7,c7 a list of the covered entities that meet the requirements of section #bji and are not third-party collecting entities1 if any are known at the time of application1 that intend to adhere to the compliance guidelines2 and 7,d7 a description of how such covered entities will be independently assessed for adherence to such compliance guidelines1 including the independent organization not associated with any of the covered entities that may participate in guidelines that will administer such guidelines4 7#c7 ,commission review 7,a7 ,initial approval 7i7 ,public comment period ,within #ij days after the receipt of proposed guidelines submitted pursuant to paragraph 7#b71 the ,commission shall publish the application and provide an opportunity for public comment on such compliance guidelines4 7ii7 ,approval ,the ,commission shall approve an application regarding proposed guidelines under paragraph 7#b7 if the applicant demonstrates that the compliance guidelines-- 7,i7 meet or exceed requirements of this ,act2 7,,ii7 provide for the regular review and validation by an independent organization not associated with any of the covered entities that may participate in the guidelines and that is approved by the ,commission to conduct such reviews of the compliance guidelines of the covered entity or entities to ensure that the covered entity or entities continue to meet or exceed the requirements of this ,act2 and 7,,iii7 include a means of enforcement if a covered entity does not meet or exceed the requirements in the guidelines1 which may include referral to the ,commission for enforcement consistent with section #dja or referral to the appropriate ,state attorney general for enforcement consistent with section #djb4 7iii7 ,timeline ,within #a year after receiving an application regarding proposed guidelines under paragraph 7#b71 the ,commission shall issue a determination approving or denying the application and providing its reasons for approving or denying such application4 7,b7 ,approval of modifications 7i7 ,in general ,if the independent organization administering a set of guidelines makes material changes to guidelines previously approved by the ,commission1 the independent organization shall submit the updated guidelines to the ,commission for approval4 ,as soon as feasible1 the ,commission shall publish the updated guidelines and provide an opportunity for public comment4 7ii7 ,timeline ,the ,commission shall approve or deny any material change to the guidelines within #a year after receipt of the submission for approval4 7b7 ,withdrawal of ,approval ,if at any time the ,commission determines that the guidelines previously approved no longer meet the requirements of this ,act or a regulation promulgated under this ,act or that compliance with the approved guidelines is insufficiently enforced by the independent organization administering the guidelines1 the ,commission shall notify the covered entities or group of such entities and the independent organization of the determination of the ,commission to withdraw approval of such guidelines and the basis for doing so4 ,within#ahj days after receipt of such notice1 the covered entity or group of such entities and the independent organization may cure any alleged deficiency with the guidelines or the enforcement of such guidelines and submit each proposed cure to the ,commission4 ,if the ,commission determines that such cures eliminate the alleged deficiency in the guidelines1 then the ,commission may not withdraw approval of such guidelines on the basis of such determination4 7c7 ,deemed compliance ,a covered entity that is eligible to participate under subsection 7a77#a7 and participates in guidelines approved under this section shall be deemed in compliance with the relevant provisions of this ,act if such covered entity is in compliance with such guidelines4 #cje4 ,digital content forgeries 7a7 ,reports ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 the ,secretary of ,commerce or the ,secretary's designee shall publish a report regarding digital content forgeries4 7b7 ,requirements ,each report under subsection 7a7 shall include the following3 7#a7 ,a definition of digital content forgeries along with accompanying explanatory materials4 7#b7 ,a description of the common sources of digital content forgeries in the ,united ,states and commercial sources of digital content forgery technologies4 7#c7 ,an assessment of the uses1 applications1 and harms of digital content forgeries4 7#d7 ,an analysis of the methods and standards available to identify digital content forgeries as well as a description of the commercial technological counter-measures that are1 or could be1 used to address concerns with digital content forgeries1 which may include the provision of warnings to viewers of suspect content4 7#e7 ,a description of the types of digital content forgeries1 including those used to commit fraud1 cause harm1 or violate any provision of law4 7#f7 ,any other information determined appropriate by the ,secretary of ,commerce or the ,secretary's designee4 ,,iv ,enforcement1 ,applicability1 and ,miscellaneous #dja4 ,enforcement by the ,federal ,trade ,commission 7a7 ,bureau of ,privacy 7#a7 ,in general ,the ,commission shall establish within the ,commission a new bureau to be known as the ,bureau of ,privacy1 which shall be of similar structure1 size1 organization1 and authority as the existing bureaus within the ,commission related to consumer protection and competition4 7#b7 ,mission ,the mission of the ,bureau established under paragraph 7#a7 shall be to assist the ,commission in carrying out the duties of the ,commission under this ,act and related duties under other provisions of law4 7#c7 ,timeline ,the ,bureau required to be established under paragraph 7#a7 shall be established1 staffed1 and fully operational not later than #a year after the date of enactment of this ,act4 7b7 ,office of ,business ,mentorship ,the ,director of the ,bureau established under subsection 7a77#a7 shall establish within the ,bureau an office to be known as the ,office of ,business ,mentorship to provide guidance and education to covered entities and service providers regarding compliance with this ,act4 ,covered entities or service providers may request advice from the ,commission or the ,office with respect to a course of action that the covered entity or service provider proposes to pursue and that may relate to the requirements of this ,act4 7c7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the commission 7,a7 ,in general ,except as provided in paragraphs 7#c71 7#d71 and 7#e71 the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,limiting certain actions unrelated to this act ,if the ,commission brings a civil action alleging that an act or practice violates this ,act or a regulation promulgated under this ,act1 the ,commission may not seek a cease and desist order against the same defendant under section #e7;b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;b77 to stop that same act or practice on the grounds that such act or practice constitutes an unfair or deceptive act or practice4 7#d7 ,common carriers and nonprofit organizations ,notwithstanding any jurisdictional limitation of the ,commission with respect to consumer protection or privacy1 the ,commission shall enforce this ,act and the regulations promulgated under this ,act1 in the same manner provided in paragraphs 7#a71 7#b71 7#c71 and 7#e71 with respect to common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto and organizations not organized to carry on business for their own profit or that of their members4 7#e7 ,privacy and security victims relief fund 7,a7 ,establishment ,there is established in the ,treasury of the ,united ,states a separate fund to be known as the ,privacy and ,security ,victims ,relief ,fund in this paragraph referred to as the ,victims ,relief ,fund74 7,b7 ,deposits ,notwithstanding section #ccjb of title #ca1 ,united ,states ,code1 in any judicial or administrative action to enforce this ,act or a regulation promulgated under this ,act1 the amount of any civil penalty obtained against a covered entity or service provider1 or any other monetary relief ordered to be paid by a covered entity or service provider to provide redress1 payment1 compensation1 or other relief to individuals that cannot be located or the payment of which would otherwise not be practicable1 shall be deposited into the ,victims ,relief ,fund4 7,c7 ,use of funds 7i7 ,use by commission ,amounts in the ,victims ,relief ,fund shall be available to the ,commission1 without fiscal year limitation1 to provide redress1 payment1 compensation1 or other monetary relief to individuals affected by an act or practice for which relief has been obtained under this ,act4 7ii7 ,other permissible uses ,to the extent that the individuals described in clause 7i7 cannot be located or such redress1 payments1 compensation1 or other monetary relief are otherwise not practicable1 the ,commission may use such funds for the purpose of-- 7,i7 funding the activities of the ,office of ,business ,mentorship established under subsection 7b72 or 7,,ii7 engaging in technological research that the ,commission considers necessary to enforce or administer this ,act4 #djb4 ,enforcement by ,states 7a7 ,civil action ,in any case in which the attorney general or ,state ,privacy ,authority of a ,state has reason to believe that an interest of the residents of that ,state has been1 may be1 or is adversely affected by a violation of this ,act or a regulation promulgated under this ,act by a covered entity or service provider1 the attorney general or ,state ,privacy ,authority may bring a civil action in the name of the ,state1 or as parens patriae on behalf of the residents of the ,state4 ,any such action shall be brought exclusively in an appropriate ,federal district court of the ,united ,states to-- 7#a7 enjoin such act or practice2 7#b7 enforce compliance with this ,act or such regulation2 7#c7 obtain damages1 civil penalties1 restitution1 or other compensation on behalf of the residents of such ,state2 or 7#d7 obtain reasonable attorneys' fees and other litigation costs reasonably incurred4 7b7 ,rights of the ,commission 7#a7 ,in general ,except as provided in paragraph 7#b71 the attorney general or ,state ,privacy ,authority of a ,state shall notify the ,commission in writing prior to initiating a civil action under subsection 7a74 ,such notification shall include a copy of the complaint to be filed to initiate such action4 ,upon receiving such notification1 the ,commission may intervene in such action as a matter of right pursuant to the ,federal ,rules of ,civil ,procedure4 7#b7 ,feasibility ,if the notification required by paragraph 7#a7 is not feasible1 the attorney general or ,state ,privacy ,authority shall notify the ,commission immediately after initiating the civil action4 7c7 ,actions by the ,commission ,in any case in which a civil action is instituted by or on behalf of the ,commission for violation of this ,act or a regulation promulgated under this ,act1 no attorney general or ,state ,privacy ,authority of a ,state may1 during the pendency of such action1 institute a civil action against any defendant named in the complaint in the action instituted by or on behalf of the ,commission for a violation of this ,act or a regulation promulgated under this ,act that is alleged in such complaint1 if such complaint alleges such violation affected the residents of such ,state or individuals nationwide4 ,if the ,commission brings a civil action against a covered entity or service provider for a violation of this ,act or a regulation promulgated under this ,act that affects the interests of the residents of a ,state1 the attorney general or ,state ,privacy ,authority of such ,state may intervene in such action as a matter of right pursuant to the ,federal ,rules of ,civil ,procedure4 7d7 ,rule of construction ,nothing in this section may be construed to prevent the attorney general or ,state ,privacy ,authority of a ,state from exercising the powers conferred on the attorney general or ,state ,privacy ,authority to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7e7 ,preservation of state powers ,except as provided in subsection 7c71 nothing in this section may be construed as altering1 limiting1 or affecting the authority of the attorney general or ,state ,privacy ,authority of a ,state to-- 7#a7 bring an action or other regulatory proceeding arising solely under the law in effect in the ,state that is preempted by this ,act or under another applicable ,federal law2 or 7#b7 exercise the powers conferred on the attorney general or ,state ,privacy ,authority by the laws of the ,state1 including the ability to conduct investigations1 administer oaths or affirmations1 or compel the attendance of witnesses or the production of documentary or other evidence4 #djc4 ,enforcement by persons 7a7 ,enforcement by persons 7#a7 ,in general ,beginning on the date that is #b years after the date on which this ,act takes effect1 any person or class of persons for a violation of this ,act or a regulation promulgated under this ,act by a covered entity or service provider may bring a civil action against such entity in any ,federal court of competent jurisdiction4 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which a plaintiff prevails1 the court may award the plaintiff-- 7,a7 an amount equal to the sum of any compensatory damages2 7,b7 injunctive relief2 7,c7 declaratory relief2 and 7,d7 reasonable attorney's fees and litigation costs4 7#c7 ,rights of the ,commission and ,state attorneys general 7,a7 ,in general ,prior to a person bringing a civil action under paragraph 7#a71 such person shall notify the ,commission and the attorney general of the ,state where such person resides in writing that such person intends to bring a civil action under such paragraph4 ,upon receiving such notice1 the ,commission and ,state attorney general shall each or jointly make a determination and respond to such person not later than #fj days after receiving such notice1 as to whether they will intervene in such action pursuant to the ,federal ,rules of ,civil ,procedure4 ,if a state attorney general does intervene1 they shall only be heard with respect to the interests of the residents of their ,state 7,b7 ,retained authority ,subparagraph 7,a7 may not be construed to limit the authority of the ,commission or any applicable ,state attorney general or ,state ,privacy ,authority to later commence a proceeding or civil action or intervene by motion if the ,commission or ,state attorney general or ,state ,privacy ,authority does not commence a proceeding or civil action within the #fj-;day period4 7,c7 ,bad faith ,any written communication from counsel for an aggrieved party to a covered entity or service provider requesting a monetary payment from that covered entity or service provider regarding a specific claim described in a letter sent pursuant to subsection 7d71 not including filings in court proceedings1 arbitrations1 mediations1 judgment collection processes1 or other communications related to previously initiated litigation or arbitrations1 shall be considered to have been sent in bad faith and shall be unlawful as defined in this ,act1 if the written communication was sent prior to the date that is #fj days after either a ,state attorney general or the ,commission has received the notice required under subparagraph 7,a74 7#d7 ,,ftc study ,beginning on the date that is #e years after the date of enactment of this ,act and every #e years thereafter1 the ,commission's ,bureau of ,economics and ,bureau of ,privacy shall assist the ,commission in conducting a study to determine the economic impacts in the ,united ,states of demand letters sent pursuant to this section and the scope of the rights of a person under this section to bring forth civil actions against covered entities and service providers4 ,such study shall include the following3 7,a7 ,the impact on insurance rates in the ,united ,states4 7,b7 ,the impact on the ability of covered entities to offer new products or services4 7,c7 ,the impact on the creation and growth of new startup companies1 including new technology companies4 7,d7 ,any emerging risks1 benefits1 and long-term trends in relevant marketplaces1 supply chains1 and labor availability4 7,e7 ,the impact on reducing1 preventing1 or remediating harms to individuals1 including from fraud1 identity theft1 spam1 discrimination1 defective products1 and violations of rights4 7,f7 ,the impact on the volume and severity of data security incidents1 and the ability to respond to data security incidents4 7,g7 ,other intangible direct and indirect costs and benefits to individuals4 7#e7 ,report to ,congress ,not later than #e years after the first day on which persons and classes of persons are able to bring civil actions under this subsection1 and annually thereafter1 the ,commission shall submit to the ,committee on ,energy and ,commerce of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate a report that contains the results of the study conducted under paragraph 7#d74 7b7 ,arbitration agreements and pre-dispute joint action waivers 7#a7 ,pre-dispute arbitration agreements 7,a7 ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement with respect to an individual under the age of #ah is enforceable with regard to a dispute arising under this ,act4 7,b7 ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement is enforceable with regard to a dispute arising under this ,act concerning a claim related to gender or partner-based violence or physical harm4 7#b7 ,pre-dispute joint-action waivers ,notwithstanding any other provision of law1 no pre-dispute joint-action waiver with respect to an individual under the age of #ah is enforceable with regard to a dispute arising under this ,act4 7#c7 ,definitions ,for purposes of this subsection3 7,a7 ,pre-dispute arbitration agreement ,the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement4 7,b7 ,pre-dispute joint-action waiver ,the term pre-dispute joint-action waiver means an agreement1 whether or not part of a pre-dispute arbitration agreement1 that would prohibit or waive the right of #a of the parties to the agreement to participate in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other related forum1 concerning a dispute that has not yet arisen at the time of the making of the agreement4 7c7 ,right to cure 7#a7 ,notice ,subject to paragraph 7#c71 with respect to a claim under this section for-- 7,a7 injunctive relief2 or 7,b7 an action against a covered entity or service provider that meets the requirements of section #bji of this ,act1 such claim may be brought by a person or class of persons if--prior to asserting such claim--the person or class or persons provides to the covered entity or service provider #de days' written notice identifying the specific provisions of this ,act the person or class of persons alleges have been or are being violated4 7#b7 ,effect of cure ,subject to paragraph 7#c71 in the event a cure is possible1 if within the #de days the covered entity or service provider demonstrates to the court that it has cured the noticed violation or violations and provides the person or class of persons an express written statement that the violation or violations has been cured and that no further violations shall occur1 a claim for injunctive relief shall not be permitted and may be reasonably dismissed4 7#c7 ,rule of construction ,the notice described in paragraph 7#a7 and the reasonable dismissal in paragraph 7#b7 shall not apply more than once to any alleged underlying violation by the same covered entity4 7d7 ,demand letter ,if a person or a identified members of a class of persons represented by counsel in regard to an alleged violation or violations of the ,act and has correspondence sent to a covered entity or service provider by counsel alleging a violation or violations of the provisions of this ,act and requests a monetary payment1 such correspondence shall include the following language3 ,please visit the website of the ,federal ,trade ,commission for a general description of your rights under the ,american ,data ,privacy and ,protection ,act followed by a hyperlink to the webpage of the ,commission required under section #bja4 ,if such correspondence does not include such language and hyperlink1 a civil action brought under this section by such person or identified members of the class of persons represented by counsel may be dismissed without prejudice and shall not be reinstated until such person or persons has complied with this subsection4 7e7 ,applicability 7#a7 ,in general ,this section shall only apply to a claim alleging a violation of section #ajb1 #ajd1 #bjb1 #bjc1 #bjd1 #bje7;a71 #bje7;b71 #bjf7;b77#c77;,c71 #bjg7;a71 #bjh7;a71 or #cjb1 or a regulation promulgated under any such section4 7#b7 ,exception ,this section shall not apply to any claim against a covered entity that has less than #be1jjj1jjj per year in revenue1 collects1 processes1 or transfers the covered data of fewer than #ej1jjj individuals1 and derives less than #ej percent of its revenue from transferring covered data4 #djd4 ,relationship to ,federal and ,state laws 7a7 ,federal law preservation 7#a7 ,in general ,nothing in this ,act or a regulation promulgated under this ,act may be construed to limit-- 7,a7 the authority of the ,commission1 or any other ,executive agency1 under any other provision of law2 7,b7 any requirement for a common carrier subject to section #fd4bjaa of title #dg1 ,code of ,federal ,regulations 7or any successor regulation7 regarding information security breaches2 or 7,c7 any other provision of ,federal law1 except as otherwise provided in this ,act4 7#b7 ,antitrust savings clause 7,a7 ,full application of the antitrust law ,nothing in this ,act may be construed to modify1 impair or supersede the operation of the antitrust law or any other provision of law4 7,b7 ,no immunity from the antitrust law ,nothing in the regulatory regime adopted by this ,act shall be construed as operating to limit any law deterring anticompetitive conduct or diminishing the need for full application of the antitrust law4 ,nothing in this ,act explicitly or implicitly precludes the application of the antitrust law4 7,c7 ,definition of antitrust law ,for purposes of this section1 the term antitrust law has the same meaning as in subsection 7a7 of the first section of the ,clayton ,act 7#ae ,u4,s4,c4 #ab71 except that such term includes section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 to the extent that such section #e applies to unfair methods of competition4 7#c7 ,applicability of other privacy requirements ,a covered entity that is required to comply with title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq471 part ,c of title ,,xi of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq471 the ,family ,educational ,rights and ,privacy ,act 7#bj ,u4,s4,c4 #abcb;g2 part #ii of title #cd1 ,code of ,federal ,regulations7 to the extent such covered entity is a school as defined in #bj ,u4,s4,c4 #abcb;g7a77#c7 or #cd ,c4,f4,r4 #ii4a7;a71 section #ddd of the ,general ,education ,provisions ,act 7commonly known as the ,family ,educational ,rights and ,privacy ,act of #aigd7 7#bj ,u4,s4,c4 #abcb;g7 and part #ii of title #cd1 ,code of ,federal ,regulations 7or any successor regulation71 the ,confidentiality of ,alcohol and ,drug ,abuse ,patient ,records at #db ,u4,s4,c4 #bij;dd-#b and its implementing regulations at #db ,,cfr part #b1 the ,genetic ,information ,non-discrimination ,act 7,,gina71 or the regulations promulgated pursuant to section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 and is in compliance with the data privacy requirements of such regulations1 part1 title1 or ,act 7as applicable71 shall be deemed to be in compliance with the related requirements of this ,act1 except for section #bjh1 solely and exclusively with respect to data subject to the requirements of such regulations1 part1 title1 or ,act4 ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance describing the implementation of this paragraph4 7#d7 ,applicability of other data security requirements ,a covered entity that is required to comply with title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica et seq471 part ,c of title ,,xi of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 or the regulations promulgated pursuant to section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 and is in compliance with the information security requirements of such regulations1 part1 title1 or ,act 7as applicable71 shall be deemed to be in compliance with the requirements of section #bjh1 solely and exclusively with respect to data subject to the requirements of such regulations1 part1 title1 or ,act4 ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance describing the implementation of this paragraph4 7b7 ,preemption of ,state laws 7#a7 ,in general ,no ,state or political subdivision of a ,state may adopt1 maintain1 enforce1 prescribe1 or continue in effect any law1 regulation1 rule1 standard1 requirement1 or other provision having the force and effect of law of any ,state1 or political subdivision of a ,state1 covered by the provisions of this ,act1 or a rule1 regulation1 or requirement promulgated under this ,act4 7#b7 ,state law preservation ,paragraph 7#a7 may not be construed to preempt1 displace1 or supplant the following ,state laws1 rules1 regulations1 or requirements3 7,a7 ,consumer protection laws of general applicability1 such as laws regulating deceptive1 unfair1 or unconscionable practices1 except that the fact of a violation of this ,act or a regulation promulgated under this ,act may not be pleaded as an element of any violation of such a law4 7,b7 ,civil rights laws4 7,c7 ,provisions of laws1 in so far as1 that govern the privacy rights or other protections of employees1 employee information1 students1 or student information4 7,d7 ,laws that address notification requirements in the event of a data breach4 7,e7 ,contract or tort law4 7,f7 ,criminal laws4 7,g7 ,civil laws governing fraud1 theft 7including identity theft71 unauthorized access to information or electronic devices1 unauthorized use of information1 malicious behavior1 or similar provisions of law4 7,h7 ,civil laws regarding cyberstalking1 cyberbullying1 nonconsensual pornography1 sexual harassment1 child abuse material1 child pornography1 child abduction or attempted child abduction1 coercion or enticement of a child for sexual activity1 or child sex trafficking4 7,i7 ,public safety or sector specific laws unrelated to privacy or security4 7,j7 ,provisions of law1 insofar as such provisions address public records1 criminal justice information systems1 arrest records1 mug shots1 conviction records1 or non-conviction records4 7,k7 ,provisions of law1 insofar as such provisions address banking records1 financial records1 tax records1 ,social ,security numbers1 credit cards1 consumer and credit reporting and investigations1 credit repair1 credit clinics1 or check-cashing services4 7,l7 ,provisions of law1 insofar as such provisions address facial recognition or facial recognition technologies1 electronic surveillance1 wiretapping1 or telephone monitoring4 7,m7 ,the ,biometric ,information ,privacy ,act 7#gdj ,,icls #ad et seq47 and the ,genetic ,information ,privacy ,act 7#daj ,,ilcs #eac et seq474 7,n7 ,provisions of laws1 in so far as1 such provisions to address unsolicited email or text messages1 telephone solicitation1 or caller identification4 7,o7 ,provisions of laws1 in so far as1 such provisions address health information1 medical information1 medical records1 ,,hiv status1 or ,,hiv testing4 7,p7 ,provisions of laws1 in so far as1 such provisions pertain to public health activities1 reporting1 data1 or services4 7,q7 ,provisions of law1 insofar as such provisions address the confidentiality of library records4 7,r7 ,section #agih4aej of the ,california ,civil ,code 7as amended on ,november #c1 #bjbj by initiative ,proposition #bd1 ,section #af74 7,s7 ,laws pertaining to the use of encryption as a means of providing data security4 7#c7 ,,cppa enforcement ,notwithstanding any other provisions of law1 the ,california ,privacy ,protection ,agency established under #agih4aii4aj7;a7 of the ,california ,privacy ,rights ,act may enforce this ,act1 in the same manner1 it would otherwise enforce the ,california ,consumer ,privacy ,act1 ,section #agih4ajej et4 seq4 7#d7 ,nonapplication of fcc privacy laws and regulations to certain covered entities ,notwithstanding any other provision of law1 sections #bbb1 #cch7;i71 and #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea71 and any regulations and orders promulgated by the ,federal ,communications ,commission under any such section1 do not apply to any covered entity with respect to the collection1 processing1 transfer1 or security of covered data or its equivalent1 and the related privacy and data security activities of a covered entity that would otherwise be regulated under such sections shall be governed exclusively by the provisions of this ,act1 except for-- 7,a7 any emergency services1 as defined in section #g of the ,wireless ,communications and ,public ,safety ,act of #aiii 7#dg ,u4,s4,c4 #fae;b72 7,b7 subsections 7b7 and 7g7 of section #bbb of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb72 and 7,c7 any obligation of an international treaty related to the exchange of traffic implemented and enforced by the ,federal ,communications ,commission4 7c7 ,preservation of common law or statutory causes of action for civil relief ,nothing in this ,act1 nor any amendment1 standard1 rule1 requirement1 assessment1 or regulation promulgated under this ,act1 may be construed to preempt1 displace1 or supplant any ,federal or ,state common law rights or remedies1 or any statute creating a remedy for civil relief1 including any cause of action for personal injury1 wrongful death1 property damage1 or other financial1 physical1 reputational1 or psychological injury based in negligence1 strict liability1 products liability1 failure to warn1 an objectively offensive intrusion into the private affairs or concerns of the individual1 or any other legal theory of liability under any ,federal or ,state common law1 or any ,state statutory law4 #dje4 ,severability ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act1 and the application of such provision to other persons not similarly situated or to other circumstances1 shall not be affected by the invalidation4 #djf4 ,,coppa 7a7 ,in general ,nothing in this ,act may be construed to relieve or change any obligation that a covered entity or other person may have under the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq474 7b7 ,updated regulations ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall amend its rules issued pursuant to the regulations promulgated by the ,commission under the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq47 to make reference to the additional requirements placed on covered entities under this ,act1 in addition to the requirements under the ,children's ,online ,privacy ,protection ,act of #aiih that may already apply to certain covered entities4 #djg4 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission such sums as may be necessary to carry out this ,act4 #djh4 ,effective date ,this ,act shall take effect on the date that is #ahj days after the date of enactment of this ,act4 ,december #cj1 #bjbb,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed