,,ib ,union ,cal5d> ,no4 #dhh #aag? ,,congress #b;d ,session ,h4 ,r4 #haeb ,report ,no4 #aag-ffi ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,june #ba1 #bjbb,mr4 ,pallone 7= himself1 ,mrs4 ,rodg]s ( ,wa%+ton1 ,ms4 ,s*ak[sky1 & ,mr4 ,bilirakis7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce ,decemb] #cj1 #bjbb,report$ ) an am5dm5t1 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union1 & ord]$ to be printed,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic,for text ( introduc$ bill1 see copy ( bill z introduc$ on ,june #ba1 #bjbb ,a ,,bill ,to provide consum]s ) f\ndational data privacy rights1 create /rong ov]sight me*anisms1 & e/abli% mean+ful en=cem5t4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,am]ican ,data ,privacy & ,protection ,act4 7b7 ,table ( cont5ts ,! table ( cont5ts ( ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,sec4 #b4 ,def9itions4,title ,i--,duty ( ,loyalty,sec4 #aja4 ,data m9imization4,sec4 #ajb4 ,loyalty duties4,sec4 #ajc4 ,privacy by design4,sec4 #ajd4 ,loyalty to individuals ) respect to pric+4,title ,,ii--,consum] ,data ,rights,sec4 #bja4 ,consum] aw>5ess4,sec4 #bjb4 ,transp>5cy4,sec4 #bjc4 ,individual data own]%ip & control4,sec4 #bjd4 ,"r to cons5t & object4,sec4 #bje4 ,data protections = *ildr5 & m9ors4,sec4 #bjf4 ,?ird-p>ty collect+ entities4,sec4 #bjg4 ,civil rights & algori?ms4,sec4 #bjh4 ,data security & protection ( cov]$ data4,sec4 #bji4 ,small bus9ess protections4,sec4 #baj4 ,unifi$ opt-out me*anisms4,title ,,iii--,corporate ,accountability,sec4 #cja4 ,executive responsibility4,sec4 #cjb4 ,s]vice provid]s & ?ird p>ties4,sec4 #cjc4 ,te*nical compliance programs4,sec4 #cjd4 ,commission approv$ compliance guidel9es4,sec4 #cje4 ,digital cont5t =g]ies4,title ,,iv--,en=cem5t1 ,applicability1 & ,miscellaneous,sec4 #dja4 ,en=cem5t by ! ,f$]al ,trade ,commission4,sec4 #djb4 ,en=cem5t by ,/ates4,sec4 #djc4 ,en=cem5t by p]sons4,sec4 #djd4 ,relation%ip to ,f$]al & ,/ate laws4,sec4 #dje4 ,sev]ability4,sec4 #djf4 ,,coppa4,sec4 #djg4 ,au?orization ( appropriations4,sec4 #djh4 ,effective date4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,affirmative express cons5t 7,a7 ,9 g5]al ,! t]m affirmative express cons5t means an affirmative act by an individual t cle>ly communicates ! individual's freely giv51 specific1 & unambigu\s au?orization = an act or practice aft] hav+ be5 in=m$1 9 response to a specific reque/ f a cov]$ entity t meets ! requirem5ts ( subp>agraph 7,b74 7,b7 ,reque/ requirem5ts ,! requirem5ts ( ?is subp>agraph ) respect to a reque/ f a cov]$ entity to an individual are ! foll[+3 7i7 ,! reque/ is provid$ to ! individual 9 a cle> & conspicu\s /&alone disclosure made ?r\gh ! prim>y m$ium us$ to (f] ! cov]$ entity's product or s]vice1 or only if ! product or s]vice is n (f]$ 9 a m$ium t p]mits ! mak+ ( ! reque/ "u ?is p>agraph1 ano!r m$ium regul>ly us$ 9 conjunction ) ! cov]$ entity's product or s]vice4 7ii7 ,! reque/ includes a description ( ! process+ purpose = :i* ! individual's cons5t is s\ght &-- 7,i7 cle>ly /ates ! specific categories ( cov]$ data t ! cov]$ entity %all collect1 process1 & transf] necess>y to effectuate ! process+ purpose2 & 7,,ii7 includes a prom95t head+ & is writt5 9 easy-to-und]/& language t w\ld enable a reasonable individual to id5tify & und]/& ! process+ purpose = :i* cons5t is s\ght & ! cov]$ data to be collect$1 process$1 or transf]r$ by ! cov]$ entity = su* process+ purpose4 7iii7 ,! reque/ cle>ly expla9s ! individual's applicable rights relat$ to cons5t4 7iv7 ,! reque/ is made 9 a mann] reasonably accessible to & usable by individuals ) disabilities4 7v7 ,! reque/ is made available to ! individual 9 ea* cov]$ language 9 :i* ! cov]$ entity provides a product or s]vice = :i* au?orization is s\ght4 7vi7 ,! option to refuse cons5t %all be at lea/ z prom95t z ! option to accept1 & ! option to refuse cons5t %all take ! same numb] ( /eps or few] z ! option to accept4 7vii7 ,process+ or transf]r+ any cov]$ data collect$ pursuant to affirmative express cons5t = a diff]5t process+ purpose ?an t = :i* affirmative express cons5t 0 obta9$ %all require affirmative express cons5t = ! subsequ5t process+ purpose4 7,c7 ,express cons5t requir$ ,a cov]$ entity may n inf] t an individual has provid$ affirmative express cons5t to an act or practice f ! inaction ( ! individual or ! individual's cont9u$ use ( a s]vice or product provid$ by ! cov]$ entity4 7,d7 ,pretextual cons5t prohibit$ ,a cov]$ entity may n obta9 or attempt to obta9 ! affirmative express cons5t ( an individual ?r\gh-- 7i7 ! use ( any false1 fictiti\s1 fraudul5t1 or mat]ially mislead+ /atem5t or repres5tation2 or 7ii7 ! design1 modification1 or manipulation ( any us] int]face ) ! purpose or sub/antial effect ( obscur+1 subv]t+1 or impair+ a reasonable individual's autonomy1 decision mak+1 or *oice to provide su* cons5t or any cov]$ data4 7#b7 ,au!ntication ,! t]m au!ntication means ! process ( v]ify+ an individual or entity = security purposes4 7#c7 ,biometric in=mation 7,a7 ,9 g5]al ,! t]m biometric in=mation means any cov]$ data g5]at$ f ! te*nological process+ ( an individual's unique biological1 physical1 or physiological *>act]i/ics t is l9k$ or reasonably l9kable to an individual1 includ+-- 7i7 f+]pr9ts2 7ii7 voice pr9ts2 7iii7 iris or ret9a scans2 7iv7 facial or h& mapp+1 geometry1 or templates2 or 7v7 gait or p]sonally id5tify+ physical movem5ts4 7,b7 ,exclusion ,! t]m biometric in=mation does n include-- 7i7 a digital or physical photograph2 7ii7 an audio or video record+2 or 7iii7 data g5]at$ f a digital or physical photograph1 or an audio or video record+1 t _c be us$ to id5tify an individual4 7#d7 ,collect2 collection ,! t]ms collect & collection mean buy+1 r5t+1 ga!r+1 obta9+1 receiv+1 access+1 or o!rwise acquir+ cov]$ data by any means4 7#e7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#f7 ,control ,! t]m control means1 ) respect to an entity-- 7,a7 own]%ip (1 or ! p[] to vote1 m ?an #ej p]c5t ( ! out/&+ %>es ( any class ( vot+ security ( ! entity2 7,b7 control ov] ! election ( a majority ( ! directors ( ! entity 7or ( individuals ex]cis+ simil> functions72 or 7,c7 ! p[] to ex]cise a controll+ influ5ce ov] ! managem5t ( ! entity4 7#g7 ,cov]$ algori?m ,! t]m cov]$ algori?m means a computational process t uses ma*9e le>n+1 natural language process+1 artificial intellig5ce te*niques1 or o!r computational process+ te*niques ( simil> or great] complexity & t makes a decision or facilitates human decision-mak+ ) respect to cov]$ data1 includ+ to det]m9e ! provision ( products or s]vices or to rank1 ord]1 promote1 recomm5d1 amplify1 or simil>ly det]m9e ! deliv]y or display ( in=mation to an individual4 7#h7 ,cov]$ data 7,a7 ,9 g5]al ,! t]m cov]$ data means in=mation t id5tifies or is l9k$ or reasonably l9kable1 alone or 9 comb9ation ) o!r in=mation1 to an individual or a device t id5tifies or is l9k$ or reasonably l9kable to an individual1 & may include d]iv$ data & unique p]si/5t id5tifi]s4 7,b7 ,exclusions ,! t]m cov]$ data does n include-- 7i7 de-id5tifi$ data2 7ii7 employee data2 7iii7 publicly available in=mation2 or 7iv7 inf]5ces made exclusively f multiple indep5d5t s\rces ( publicly available in=mation t d n reveal s5sitive cov]$ data ) respect to an individual4 7,c7 ,employee data def9$ ,= purposes ( subp>agraph 7,b71 ! t]m employee data means-- 7i7 in=mation relat+ to a job applicant collect$ by a cov]$ entity act+ z a prospective employ] ( su* job applicant 9 ! c\rse ( ! application1 or hir+ process1 if su* in=mation is collect$1 process$1 or transf]r$ by ! prospective employ] solely = purposes relat$ to ! employee's /atus z a curr5t or =m] job applicant ( su* employ]2 7ii7 in=mation process$ by an employ] relat+ to an employee :o is act+ 9 a pr(essional capacity = ! employ]1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = purposes relat$ to su* employee's pr(essional activities on behalf ( ! employ]2 7iii7 ! bus9ess contact in=mation ( an employee1 includ+ ! employee's "n1 position or title1 bus9ess telephone numb]1 bus9ess address1 or bus9ess email address t is provid$ to an employ] by an employee :o is act+ 9 a pr(essional capacity1 if su* in=mation is collect$1 process$1 or transf]r$ solely = purposes relat$ to su* employee's pr(essional activities on behalf ( ! employ]2 7iv7 em]g5cy contact in=mation collect$ by an employ] t relates to an employee ( t employ]1 if su* in=mation is collect$1 process$1 or transf]r$ solely = ! purpose ( hav+ an em]g5cy contact on file = ! employee & = process+ or transf]r+ su* in=mation 9 case ( an em]g5cy2 or 7v7 in=mation relat+ to an employee 7or a sp\se1 dep5d5t1 o!r cov]$ family memb]1 or b5efici>y ( su* employee7 t is necess>y = ! employ] to collect1 process1 or transf] solely = ! purpose ( adm9i/]+ b5efits to :i* su* employee 7or sp\se1 dep5d5t1 o!r cov]$ family memb]1 or b5efici>y ( su* employee7 is entitl$ on ! basis ( ! employee's position ) t employ]4 7#i7 ,cov]$ entity 7,a7 ,9 g5]al ,! t]m cov]$ entity-- 7i7 means any entity or any p]son1 o!r ?an an individual act+ 9 a non-comm]cial context1 t alone or jo9tly ) o!rs det]m9es ! purposes & means ( collect+1 process+1 or transf]r+ cov]$ data &-- 7,i7 is subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 7,,ii7 is a common c>ri] subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto2 or 7,,iii7 is an organization n organiz$ to c>ry on bus9ess = its own pr(it or t ( its memb]s2 & 7ii7 includes any entity or p]son t controls1 is controll$ by1 or is "u common control ) ! cov]$ entity4 7,b7 ,exclusions ,! t]m cov]$ entity does n include-- 7i7 a ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity su* z a body1 au?ority1 bo>d1 bureau1 commission1 di/rict1 ag5cy1 or political subdivision ( ! ,f$]al ,gov]nm5t or a ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t2 7ii7 a p]son or an entity t is collect+1 process+1 or transf]r+ cov]$ data on behalf ( a ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity1 9 s f> z su* p]son or entity is act+ z a s]vice provid] to ! gov]nm5t entity2 or 7iii7 an entity t s]ves z a congressionally designat$ nonpr(it1 national res\rce c5t]1 & cle>+h\se to provide assi/ance to victims1 families1 *ild-s]v+ pr(essionals1 & ! g5]al public on miss+ & exploit$ *ildr5 issues4 7,c7 ,non-application to s]vice provid]s ,an entity %all n be consid]$ to be a cov]$ entity = purposes ( ?is ,act 9 s f> z ! entity is act+ z a s]vice provid] 7z def9$ 9 p>agraph 7#bi774 7#aj7 ,cov]$ language ,! t]m cov]$ language means ! t5 languages ) ! mo/ us]s 9 ! ,unit$ ,/ates1 accord+ to ! mo/ rec5t ,unit$ ,/ates ,c5sus4 7#aa7 ,cov]$ m9or ,! t]m cov]$ m9or means an individual "u ! age ( #ag4 7#ab7 ,de-id5tifi$ data ,! t]m de-id5tifi$ data means in=mation t does n id5tify & is n l9k$ or reasonably l9kable to a di/9ct individual or a device1 reg>dless ( :e!r ! in=mation is aggregat$1 & if ! cov]$ entity or s]vice provid]-- 7,a7 takes reasonable te*nical measures to ensure t ! in=mation _c1 at any po9t1 be us$ to re-id5tify any individual or device t id5tifies or is l9k$ or reasonably l9kable to an individual2 7,b7 publicly commits 9 a cle> & conspicu\s mann]-- 7i7 to process & transf] ! in=mation solely 9 a de-id5tifi$ =m )\t any reasonable means = re-id5tification2 & 7ii7 to n attempt to re-id5tify ! in=mation ) any individual or device t id5tifies or is l9k$ or reasonably l9kable to an individual2 & 7,c7 contractually obligates any p]son or entity t receives ! in=mation f ! cov]$ entity or s]vice provid]-- 7i7 to comply ) all ( ! provisions ( ?is p>agraph ) respect to ! in=mation2 & 7ii7 to require t su* contractual obligations be includ$ contractually 9 all subsequ5t in/ances = :i* ! data may be receiv$4 7#ac7 ,d]iv$ data ,! t]m d]iv$ data means cov]$ data t is creat$ by ! d]ivation ( in=mation1 data1 assumptions1 correlations1 inf]5ces1 pr$ictions1 or conclusions f facts1 evid5ce1 or ano!r s\rce ( in=mation or data ab\t an individual or an individual's device4 7#ad7 ,device ,! t]m device means any electronic equipm5t capable ( collect+1 process+1 or transf]r+ cov]$ data t is us$ by "o or m individuals4 7#ae7 ,employee ,! t]m employee means an individual :o is an employee1 director1 (fic]1 /aff memb] individual work+ z an indep5d5t contractor t is n a s]vice provid]1 tra9ee1 volunte]1 or int]n ( an employ]1 reg>dless ( :e!r su* individual is paid1 unpaid1 or employ$ on a tempor>y basis4 7#af7 ,executive ag5cy ,! ,executive ag5cy has ! mean+ giv5 su* t]m 9 section #aje ( title #e1 ,unit$ ,/ates ,code4 7#ag7 ,fir/ p>ty adv]tis+ or m>ket+ ,! t]m fir/ p>ty adv]tis+ or m>ket+ means adv]tis+ or m>ket+ conduct$ by a fir/ p>ty ei!r ?r\gh direct communications ) a us] su* z direct mail1 email1 or text message communications1 or adv]tis+ or m>ket+ conduct$ entirely )9 ! fir/-p>ty context1 su* z 9 a physical location op]at$ by ! fir/ p>ty1 or on a web site or app op]at$ by ! fir/ p>ty4 7#ah7 ,g5etic in=mation ,! t]m g5etic in=mation means any cov]$ data1 reg>dless ( its =mat1 t conc]ns an individual's g5etic *>act]i/ics1 includ+-- 7,a7 raw sequ5ce data t results f ! sequ5c+ ( ! complete1 or a portion ( !1 extract$ deoxyribonucleic acid 7,,dna7 ( an individual2 or 7,b7 g5otypic & ph5otypic in=mation t results f analyz+ raw sequ5ce data describ$ 9 subp>agraph 7,a74 7#ai7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7#bj7 ,k 7,a7 ,9 g5]al ,! t]m k means-- 7i7 ) respect to a cov]$ entity t is a cov]$ high-impact social m$ia company1 ! entity knew or %\ld h kn[n ! individual 0 a cov]$ m9or2 7ii7 ) respect to a cov]$ entity or s]vice provid] t is a l>ge data hold]1 & o!rwise is n a cov]$ high-impact social m$ia company1 t ! cov]$ entity knew or act$ 9 willful disreg>d ( ! fact t ! individual 0 a cov]$ m9or2 & 7iii7 ) respect to a cov]$ entity or s]vice provid] t does n meet ! requirem5ts ( clause 7i7 or 7ii71 actual k4 7,b7 ,cov]$ high-impact social m$ia company ,= purposes ( ?is p>agraph1 ! t]m cov]$ high-impact social m$ia company means a cov]$ entity t provides any int]net-accessible plat=m :]e-- 7i7 su* cov]$ entity g5]ates #c1jjj1jjj1jjj or m 9 annual rev5ue2 7ii7 su* plat=m has #cjj1jjj1jjj or m mon?ly active us]s = n few] ?an #c ( ! prec$+ #ab mon?s on ! onl9e product or s]vice ( su* cov]$ entity2 & 7iii7 su* plat=m con/itutes an onl9e product or s]vice t is prim>ily us$ by us]s to access or %>e1 us]-g5]at$ cont5t4 7#ba7 ,l>ge data hold] 7,a7 ,9 g5]al ,! t]m l>ge data hold] means a cov]$ entity or s]vice provid] t1 9 ! mo/ rec5t cal5d> ye>-- 7i7 _h annual gross rev5ues ( #bej1jjj1jjj or m2 & 7ii7 collect$1 process$1 or transf]r$-- 7,i7 ! cov]$ data ( m ?an #e1jjj1jjj individuals or devices t id5tify or are l9k$ or reasonably l9kable to #a or m individuals1 exclud+ cov]$ data collect$ & process$ solely = ! purpose ( initiat+1 r5d]+1 bill+ =1 f9aliz+1 complet+1 or o!rwise collect+ paym5t = a reque/$ product or s]vice2 & 7,,ii7 ! s5sitive cov]$ data ( m ?an #bjj1jjj individuals or devices t id5tify or are l9k$ or reasonably l9kable to #a or m individuals4 7,b7 ,exclusions ,! t]m l>ge data hold] does n include any in/ance 9 :i* ! cov]$ entity or s]vice provid] w\ld qualify z a l>ge data hold] solely on ! basis ( collect+ or process+-- 7i7 p]sonal email addresses2 7ii7 p]sonal telephone numb]s2 or 7iii7 log-9 in=mation ( an individual or device to all[ ! individual or device to log 9 to an acc\nt adm9i/]$ by ! cov]$ entity or s]vice provid]4 7,c7 ,rev5ue ,= purposes ( det]m9+ :e!r any cov]$ entity or s]vice provid] is a l>ge data hold]1 ! t]m rev5ue1 ) respect to any cov]$ entity or s]vice provid] t is n organiz$ to c>ry on bus9ess = its own pr(it or t ( its memb]s-- 7i7 means ! gross receipts ! cov]$ entity or s]vice provid] receiv$1 9 :atev] =m1 f all s\rces1 )\t subtract+ any co/s or exp5ses2 & 7ii7 includes contributions1 gifts1 grants1 dues or o!r assessm5ts1 income f inve/m5ts1 & proce$s f ! sale ( real or p]sonal prop]ty4 7#bb7 ,m>ket rese>* ,! t]m m>ket rese>* means ! collection1 process+1 or transf] ( cov]$ data z reasonably necess>y & proportionate to inve/igate ! m>ket = or m>ket+ ( products1 s]vices1 or ideas1 :]e ! cov]$ data is n-- 7,a7 integrat$ into any product or s]vice2 7,b7 o!rwise us$ to contact any individual or individual's device2 or 7,c7 us$ to adv]tise or m>ket to any individual or individual's device4 7#bc7 ,mat]ial ,! t]m mat]ial means1 ) respect to an act1 practice1 or repres5tation ( a cov]$ entity 7includ+ a repres5tation made by ! cov]$ entity 9 a privacy policy or simil> disclosure to individuals7 involv+ ! collection1 process+1 or transf] ( cov]$ data1 t su* act1 practice1 or repres5tation is likely to affect a reasonable individual's decision or conduct reg>d+ a product or s]vice4 7#bd7 ,precise geolocation in=mation 7,a7 ,9 g5]al ,! t]m precise geolocation in=mation means in=mation t is d]iv$ f a device or te*nology t reveals ! pa/ or pres5t physical location ( an individual or device t id5tifies or is l9k$ or reasonably l9kable to #a or m individuals1 ) suffici5t precision to id5tify /reet level location in=mation ( an individual or device or ! location ( an individual or device )9 a range ( #a1hej feet or less4 7,b7 ,exclusion ,! t]m precise geolocation in=mation does n include geolocation in=mation id5tifiable or d]iv$ solely f ! visual cont5t ( a legally obta9$ image1 includ+ ! location ( ! device t captur$ su* image4 7#be7 ,process ,! t]m process means to conduct or direct any op]ation or set ( op]ations p]=m$ on cov]$ data1 includ+ analyz+1 organiz+1 /ructur+1 reta9+1 /or+1 us+1 or o!rwise h&l+ cov]$ data4 7#bf7 ,process+ purpose ,! t]m process+ purpose means a reason = :i* a cov]$ entity or s]vice provid] collects1 processes1 or transf]s cov]$ data t is specific & granul> en\gh = a reasonable individual to und]/& ! mat]ial facts ( h[ & :y ! cov]$ entity or s]vice provid] collects1 processes1 or transf]s ! cov]$ data4 7#bg7 ,publicly available in=mation 7,a7 ,9 g5]al ,! t]m publicly available in=mation means any in=mation t a cov]$ entity or s]vice provid] has a reasonable basis to believe has be5 lawfully made available to ! g5]al public f-- 7i7 ,f$]al1 ,/ate1 or local gov]nm5t records1 if ! cov]$ entity collects1 processes1 & transf]s su* in=mation 9 accordance ) any re/rictions or t]ms ( use plac$ on ! in=mation by ! relevant gov]nm5t entity2 7ii7 widely di/ribut$ m$ia2 7iii7 a website or onl9e s]vice made available to all memb]s ( ! public1 = free or = a fee1 includ+ :]e all memb]s ( ! public1 = free or = a fee1 c log 9 to ! website or onl9e s]vice2 7iv7 a disclosure t has be5 made to ! g5]al public z requir$ by ,f$]al1 ,/ate1 or local law2 or 7v7 ! visual obs]vation ( ! physical pres5ce ( an individual or a device 9 a public place1 n includ+ data collect$ by a device 9 ! individual's possession4 7,b7 ,cl>ifications2 limitations 7i7 ,available to all memb]s ( ! public ,= purposes ( ?is p>agraph1 in=mation f a website or onl9e s]vice is n available to all memb]s ( ! public if ! individual :o made ! in=mation available via ! website or onl9e s]vice has re/rict$ ! in=mation to a specific audi5ce4 7ii7 ,o!r limitations ,! t]m publicly available in=mation does n include-- 7,i7 any obsc5e visual depiction 7z def9$ 9 section #adfj ( title #ah1 ,unit$ ,/ates ,code72 7,,ii7 any inf]5ce made exclusively f multiple indep5d5t s\rces ( publicly available in=mation t reveals s5sitive cov]$ data ) respect to an individual2 7,,iii7 biometric in=mation2 7,,iv7 publicly available in=mation t has be5 comb9$ ) cov]$ data2 7,v7 g5etic in=mation1 unless o!rwise made available by ! individual to :om ! in=mation p]ta9s z describ$ 9 clause 7ii7 or 7iii7 ( subp>agraph 7,a72 or 7,,vi7 intimate images kn[n to be noncons5sual4 7#bh7 ,s5sitive cov]$ data 7,a7 ,9 g5]al ,! t]m s5sitive cov]$ data means ! foll[+ types ( cov]$ data3 7i7 ,a gov]nm5t-issu$ id5tifi]1 su* z a ,social ,security numb]1 passport numb]1 or driv]'s lic5se numb]1 t is n requir$ by law to be display$ 9 public4 7ii7 ,any in=mation t describes or reveals ! pa/1 pres5t1 or future physical heal?1 m5tal heal?1 disability1 diagnosis1 or heal?c>e condition or treatm5t ( an individual4 7iii7 ,a f9ancial acc\nt numb]1 debit c>d numb]1 cr$it c>d numb]1 or in=mation t describes or reveals ! income level or bank acc\nt balances ( an individual1 except t ! la/ f\r digits ( a debit or cr$it c>d numb] %all n be deem$ s5sitive cov]$ data4 7iv7 ,biometric in=mation4 7v7 ,g5etic in=mation4 7vi7 ,precise geolocation in=mation4 7vii7 ,an individual's private communications su* z voicemails1 emails1 texts1 direct messages1 or mail1 or in=mation id5tify+ ! p>ties to su* communications1 voice communications1 video communications1 & any in=mation t p]ta9s to ! transmission ( su* communications1 includ+ telephone numb]s call$1 telephone numb]s f :i* calls 7 plac$1 ! "t calls 7 made1 call duration1 & location in=mation ( ! p>ties to ! call1 unless ! cov]$ entity or a s]vice provid] act+ on behalf ( ! cov]$ entity is ! s5d] or an int5d$ recipi5t ( ! communication4 ,communications are n private = purposes ( ?is clause if su* communications are made f or to a device provid$ by an employ] to an employee ins(> z su* employ] provides conspicu\s notice t su* employ] may access su* communications4 7viii7 ,acc\nt or device log-9 cr$5tials1 or security or access codes = an acc\nt or device4 7ix7 ,in=mation id5tify+ ! sexual behavior ( an individual 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ ! collection1 process+1 or transf] ( su* in=mation4 7x7 ,cal5d> in=mation1 address book in=mation1 phone or text logs1 photos1 audio record+s1 or videos1 ma9ta9$ = private use by an individual1 reg>dless ( :e!r su* in=mation is /or$ on ! individual's device or is accessible f t device & is back$ up 9 a sep>ate location4 ,su* in=mation is n s5sitive = purposes ( ?is p>agraph if su* in=mation is s5t f or to a device provid$ by an employ] to an employee ins(> z su* employ] provides conspicu\s notice t x may access su* in=mation4 7xi7 ,a photograph1 film1 video record+1 or o!r simil> m$ium t %[s ! nak$ or und]g>m5t-clad private area ( an individual4 7xii7 ,in=mation reveal+ ! video cont5t reque/$ or select$ by an individual collect$ by a cov]$ entity t is n a provid] ( a s]vice describ$ 9 section #ajb7d74 ,?is clause does n include cov]$ data us$ solely = transf]s = indep5d5t video measurem5t4 7xiii7 ,in=mation ab\t an individual :5 ! cov]$ entity or s]vice provid] has k t ! individual is a cov]$ m9or4 7xiv7 ,an individual's race1 color1 e?nicity1 religion1 or union memb]%ip4 7xv7 ,in=mation id5tify+ an individual's onl9e activities ov] "t & across ?ird p>ty websites or onl9e s]vices4 7xvi7 ,any o!r cov]$ data collect$1 process$1 or transf]r$ = ! purpose ( id5tify+ ! types ( cov]$ data li/$ 9 clauses 7i7 ?r\gh 7xv74 7,b7 ,rulemak+ ,! ,commission may comm5ce a rulemak+ pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code1 to include 9 ! def9ition ( s5sitive cov]$ data any o!r type ( cov]$ data t may require a simil> level ( protection z ! types ( cov]$ data li/$ 9 clauses 7i7 ?r\gh 7xvi7 ( subp>agraph 7,a7 z a result ( any new me?od ( collect+1 process+1 or transf]r+ cov]$ data4 7#bi7 ,s]vice provid] 7,a7 ,9 g5]al ,! t]m s]vice provid] means a p]son or entity t-- 7i7 collects1 processes1 or transf]s cov]$ data on behalf (1 & at ! direction (1 a cov]$ entity or a ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity2 & 7ii7 receives cov]$ data f or on behalf ( a cov]$ entity or a ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity4 7,b7 ,treatm5t ) respect to s]vice provid] data ,a s]vice provid] t receives s]vice provid] data f ano!r s]vice provid] z p]mitt$ "u ?is ,act %all be treat$ z a s]vice provid] "u ?is ,act ) respect to su* data4 7#cj7 ,s]vice provid] data ,! t]m s]vice provid] data means cov]$ data t is collect$ or process$ by or has be5 transf]r$ to a s]vice provid] by or on behalf ( a cov]$ entity1 a ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity1 or ano!r s]vice provid] = ! purpose ( all[+ ! s]vice provid] to :om su* cov]$ data is transf]r$ to p]=m a s]vice or function on behalf (1 & at ! direction (1 su* cov]$ entity or ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity4 7#ca7 ,/ate ,! t]m ,/ate means any ( ! #ej ,/ates1 ! ,di/rict ( ,columbia1 ! ,commonweal? ( ,pu]to ,rico1 ! ,virg9 ,isl&s ( ! ,unit$ ,/ates1 ,guam1 ,am]ican ,samoa1 or ! ,commonweal? ( ! ,nor!rn ,m>iana ,isl&s4 7#cb7 ,/ate privacy au?ority ,! t]m ,/ate privacy au?ority means-- 7,a7 ! *ief consum] protection (fic] ( a ,/ate2 or 7,b7 a ,/ate consum] protection ag5cy ) exp]tise 9 data protection1 includ+ ! ,cali=nia ,privacy ,protection ,ag5cy4 7#cc7 ,sub/antial privacy risk ,! t]m sub/antial privacy risk means ! collection1 process+1 or transf] ( cov]$ data 9 a mann] t may result 9 any reasonably =eseeable sub/antial physical injury1 economic injury1 highly (f5sive intrusion into ! privacy expectations ( a reasonable individual "u ! circum/ances1 or discrim9ation on ! basis ( race1 color1 religion1 national orig91 sex1 or disability4 7#cd7 ,t>get$ adv]tis+ ,! t]m t>get$ adv]tis+-- 7,a7 means pres5t+ to an individual or device id5tifi$ by a unique id5tifi]1 or gr\ps ( individuals or devices id5tifi$ by unique id5tifi]s1 an onl9e adv]tisem5t t is select$ bas$ on kn[n or pr$ict$ pref]5ces1 *>act]i/ics1 or int]e/s associat$ ) ! individual or a device id5tifi$ by a unique id5tifi]2 & 7,b7 does n include-- 7i7 adv]tis+ or m>ket+ to an individual or an individual's device 9 response to ! individual's specific reque/ = in=mation or fe$back2 7ii7 contextual adv]tis+1 :i* is :5 an adv]tisem5t is display$ bas$ on ! cont5t 9 :i* ! adv]tisem5t appe>s & does n v>y bas$ on :o is view+ ! adv]tisem5t2 or 7iii7 process+ cov]$ data solely = measur+ or report+ adv]tis+ or cont5t1 p]=mance1 rea*1 or frequ5cy1 includ+ indep5d5t measurem5t4 7#ce7 ,?ird p>ty ,! t]m ?ird p>ty-- 7,a7 means any p]son or entity1 includ+ a cov]$ entity1 t-- 7i7 collects1 processes1 or transf]s cov]$ data t ! p]son or entity did n collect directly f ! individual l9k$ or l9kable to su* cov]$ data2 & 7ii7 is n a s]vice provid] ) respect to su* data2 & 7,b7 does n include a p]son or entity t collects cov]$ data f ano!r entity if ! #b entities are relat$ by common own]%ip or corporate control1 b only if a reasonable consum]'s reasonable expectation w\ld be t su* entities %>e in=mation4 7#cf7 ,?ird-p>ty collect+ entity 7,a7 ,9 g5]al ,! t]m ?ird-p>ty collect+ entity-- 7i7 means a cov]$ entity ^: pr9cipal s\rce ( rev5ue is d]iv$ f process+ or transf]r+ cov]$ data t ! cov]$ entity did n collect directly f ! individuals l9k$ or l9kable to ! cov]$ data2 & 7ii7 does n include a cov]$ entity ins(> z su* entity processes employee data collect$ by & receiv$ f a ?ird p>ty conc]n+ any individual :o is an employee ( ! ?ird p>ty = ! sole purpose ( su* ?ird p>ty provid+ b5efits to ! employee4 7,b7 ,pr9cipal s\rce ( rev5ue def9$ ,= purposes ( ?is p>agraph1 ! t]m pr9cipal s\rce ( rev5ue means1 = ! prior #ab-mon? p]iod1 ei!r-- 7i7 m ?an #ej p]c5t ( all rev5ue ( ! cov]$ entity2 or 7ii7 obta9+ rev5ue f process+ or transf]r+ ! cov]$ data ( m ?an #e1jjj1jjj individuals t ! cov]$ entity did n collect directly f ! individuals l9k$ or l9kable to ! cov]$ data4 7,c7 ,non-application to s]vice provid]s ,an entity may n be consid]$ to be a ?ird-p>ty collect+ entity = purposes ( ?is ,act if ! entity is act+ z a s]vice provid]4 7#cg7 ,?ird p>ty data ,! t]m ?ird p>ty data means cov]$ data t has be5 transf]r$ to a ?ird p>ty4 7#ch7 ,transf] ,! t]m transf] means to disclose1 release1 dissem9ate1 make available1 lic5se1 r5t1 or %>e cov]$ data orally1 9 writ+1 electronically1 or by any o!r means4 7#ci7 ,unique p]si/5t id5tifi] ,! t]m unique id5tifi]-- 7,a7 means an id5tifi] to ! ext5t t su* id5tifi] is reasonably l9kable to an individual or device t id5tifies or is l9k$ or reasonably l9kable to #a or m individuals1 includ+ a device id5tifi]1 ,int]net ,protocol address1 cookie1 beacon1 pixel tag1 mobile ad id5tifi]1 or simil> te*nology1 cu/om] numb]1 unique pseudonym1 us] alias1 telephone numb]1 or o!r =m ( p]si/5t or probabili/ic id5tifi] t is l9k$ or reasonably l9kable to an individual or device2 & 7,b7 does n include an id5tifi] assign$ by a cov]$ entity = ! specific purpose ( giv+ effect to an individual's ex]cise ( affirmative express cons5t or opt-outs ( ! collection1 process+1 & transf] ( cov]$ data pursuant to section #bjd or o!rwise limit+ ! collection1 process+1 or transf] ( su* in=mation4 7#dj7 ,widely di/ribut$ m$ia ,! t]m widely di/ribut$ m$ia means in=mation t is available to ! g5]al public1 includ+ in=mation f a telephone book or onl9e directory1 a television1 int]net1 or radio program1 ! news m$ia1 or an int]net site t is available to ! g5]al public on an unre/rict$ basis1 b does n include an obsc5e visual depiction 7z def9$ 9 section #adfj ( title #ah1 ,unit$ ,/ates ,code74 ,i ,duty ( ,loyalty #aja4 ,data m9imization 7a7 ,9 g5]al ,a cov]$ entity may n collect1 process1 or transf] cov]$ data unless ! collection1 process+1 or transf] is limit$ to :at is reasonably necess>y & proportionate to-- 7#a7 provide or ma9ta9 a specific product or s]vice reque/$ by ! individual to :om ! data p]ta9s2 or 7#b7 effect a purpose p]mitt$ "u subsection 7b74 7b7 ,p]missible purposes ,a cov]$ entity may collect1 process1 or transf] cov]$ data = any ( ! foll[+ purposes if ! collection1 process+1 or transf] is limit$ to :at is reasonably necess>y & proportionate to su* purpose3 7#a7 ,to initiate1 manage1 or complete a transaction or fulfill an ord] = specific products or s]vices reque/$ by an individual1 includ+ any associat$ r\t9e adm9i/rative1 op]ational1 & acc\nt-s]vic+ activity su* z bill+1 %ipp+1 deliv]y1 /orage1 & acc\nt+4 7#b7 ,) respect to cov]$ data previ\sly collect$ 9 accordance ) ?is ,act1 not)/&+ ?is exception-- 7,a7 to process su* data z necess>y to p]=m sy/em ma9t5ance or diagno/ics2 7,b7 to develop1 ma9ta91 repair1 or enhance a product or s]vice = :i* su* data 0 collect$2 7,c7 to conduct int]nal rese>* or analytics to improve a product or s]vice = :i* su* data 0 collect$2 7,d7 to p]=m inv5tory managem5t or reasonable network managem5t2 7,e7 to protect aga9/ spam2 or 7,f7 to debug or repair errors t impair ! functionality ( a s]vice or product = :i* su* data 0 collect$4 7#c7 ,to au!nticate us]s ( a product or s]vice4 7#d7 ,to fulfill a product or s]vice w>ranty4 7#e7 ,to prev5t1 detect1 protect aga9/1 or respond to a security incid5t4 ,= purposes ( ?is p>agraph1 security is def9$ z network security & physical security & life safety1 includ+ an intrusion or trespass1 m$ical al]ts1 fire al>ms1 & access control security4 7#f7 ,to prev5t1 detect1 protect aga9/1 or respond to fraud1 h>assm5t1 or illegal activity4 ,= purposes ( ?is p>agraph1 ! t]m illegal activity means a violation ( a ,f$]al1 ,/ate1 or local law puni%able z a felony or misdemeanor t c directly h>m4 7#g7 ,to comply ) a legal obligation impos$ by ,f$]al1 ,tribal1 local1 or ,/ate law1 or to inve/igate1 e/abli%1 prep>e =1 ex]cise1 or def5d legal claims involv+ ! cov]$ entity or s]vice provid]4 7#h7 ,to prev5t an individual1 or gr\p ( individuals1 f suff]+ h>m :]e ! cov]$ entity or s]vice provid] believes 9 good fai? t ! individual1 or gr\p ( individuals1 is at risk ( dea?1 s]i\s physical injury1 or o!r s]i\s heal? risk4 7#i7 ,to effectuate a product recall pursuant to ,f$]al or ,/ate law4 7#aj7 7,a7 ,to conduct a public or pe]-review$ sci5tific1 hi/orical1 or /ati/ical rese>* project t-- 7i7 is 9 ! public int]e/2 & 7ii7 adh]es to all relevant laws & regulations gov]n+ su* rese>*1 includ+ regulations = ! protection ( human subjects1 or is exclud$ f crit]ia ( ! in/itutional review bo>d4 7,b7 ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %\ld issue guidel9es to help cov]$ entities ensure ! privacy ( affect$ us]s & ! security ( cov]$ data1 p>ticul>ly z data is be+ transf]r$ to & /or$ by rese>*]s4 ,su* guidel9es %\ld consid] risks z !y p]ta9 to projects us+ cov]$ data ) special consid]ations = projects t are exempt "u "p #df ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulation7 or are exclud$ f ! crit]ia = in/itutional review bo>d review4 7#aa7 ,to deliv] a communication t is n an adv]tisem5t to an individual1 if ! communication is reasonably anticipat$ by ! individual )9 ! context ( ! individual's int]actions ) ! cov]$ entity4 7#ab7 ,to deliv] a communication at ! direction ( an individual betwe5 su* individual & "o or m individuals or entities4 7#ac7 ,to transf] assets to a ?ird p>ty 9 ! context ( a m]g]1 acquisition1 bankruptcy1 or simil> transaction :5 ! ?ird p>ty assumes control1 9 :ole or 9 "p1 ( ! cov]$ entity's assets1 only if ! cov]$ entity1 9 a reasonable "t prior to su* transf]1 provides ea* affect$ individual )-- 7,a7 a notice describ+ su* transf]1 includ+ ! "n ( ! entity or entities receiv+ ! individual's cov]$ data & _! privacy policies z describ$ 9 section #bjb2 & 7,b7 a reasonable opportunity to )draw any previ\sly giv5 cons5ts 9 accordance ) ! requirem5ts ( affirmative express cons5t "u ?is ,act relat$ to ! individual's cov]$ data & a reasonable opportunity to reque/ ! deletion ( ! individual's cov]$ data1 z describ$ 9 section #bjc4 7#ad7 ,to ensure ! data security & integrity ( cov]$ data1 z describ$ 9 section #bjh4 7#ae7 ,) respect to cov]$ data previ\sly collect$ 9 accordance ) ?is ,act1 a s]vice provid] act+ at ! direction ( a gov]nm5t entity1 or a s]vice provid$ to a gov]nm5t entity by a cov]$ entity1 & only ins(> z au?oriz$ by /atute1 to prev5t1 detect1 protect aga9/ or respond to a public safety incid5t1 includ+ trespass1 natural disa/]1 or national security incid5t4 ,?is p>agraph does n p]mit1 h[ev]1 ! transf] ( cov]$ data = paym5t or o!r valuable consid]ation to a gov]nm5t entity4 7#af7 ,) respect to cov]$ data collect$ 9 accordance ) ?is ,act1 not)/&+ ?is exception1 to process su* data z necess>y to provide fir/ p>ty adv]tis+ or m>ket+ ( products or s]vices provid$ by ! cov]$ entity = individuals :o are n-cov]$ m9ors4 7#ag7 ,) respect to cov]$ data previ\sly collect$ 9 accordance ) ?is ,act1 not)/&+ ?is exception & provid$ su* collection1 process+1 & transf]r+ o!rwise complies ) ! requirem5ts ( ?is ,act1 includ+ section #bjd7;c71 to provide t>get$ adv]tis+4 7c7 ,guidance ,! ,commission %all issue guidance reg>d+ :at is reasonably necess>y & proportionate to comply ) ?is section4 ,su* guidance %all take into consid]ation-- 7#a7 ! size (1 & ! nature1 scope1 & complexity ( ! activities engag$ 9 by1 ! cov]$ entity1 includ+ :e!r ! cov]$ entity is a l>ge data hold]1 nonpr(it organization1 cov]$ entity meet+ ! requirem5ts ( section #bji1 ?ird p>ty1 or ?ird-p>ty collect+ entity2 7#b7 ! s5sitivity ( cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7#c7 ! volume ( cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 & 7#d7 ! numb] ( individuals & devices to :i* ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity relates4 7d7 ,deceptive m>ket+ ( a product or s]vice ,a cov]$ entity or s]vice provid] may n engage 9 deceptive adv]tis+ or m>ket+ ) respect to a product or s]vice (f]$ to an individual4 7e7 ,j\rnalism ,no?+ 9 ?is ,act %all be con/ru$ to limit or dim9i% ,fir/ ,am5dm5t fre$oms gu>ante$ "u ! ,con/itution4 #ajb4 ,loyalty duties ,not)/&+ section #aja & unless an exception applies1 ) respect to cov]$ data1 a cov]$ entity or s]vice provid] may n-- 7#a7 collect1 process1 or transf] a ,social ,security numb]1 except :5 necess>y to facilitate an ext5sion ( cr$it1 au!ntication1 fraud & id5tity fraud detection & prev5tion1 ! paym5t or collection ( taxes1 ! en=cem5t ( a contract betwe5 p>ties1 or ! prev5tion1 inve/igation1 or prosecution ( fraud or illegal activity1 or z o!rwise requir$ by ,f$]al1 ,/ate1 or local law2 7#b7 collect or process s5sitive cov]$ data1 except :]e su* collection or process+ is /rictly necess>y to provide or ma9ta9 a specific product or s]vice reque/$ by ! individual to :om ! cov]$ data p]ta9s1 or is /rictly necess>y to effect a purpose enum]at$ 9 p>agraphs 7#a7 ?r\gh 7#ab7 & 7#ad7 ?r\gh 7#ae7 ( section #aja7;b72 7#c7 transf] an individual's s5sitive cov]$ data to a ?ird p>ty1 unless-- 7,a7 ! transf] is made pursuant to ! affirmative express cons5t ( ! individual2 7,b7 ! transf] is necess>y to comply ) a legal obligation impos$ by ,f$]al1 ,/ate1 ,tribal1 or local law1 or to e/abli%1 ex]cise1 or def5d legal claims2 7,c7 ! transf] is necess>y to prev5t an individual f imm95t injury :]e ! cov]$ entity believes 9 good fai? t ! individual is at risk ( dea?1 s]i\s physical injury1 or s]i\s heal? risk2 7,d7 ) respect to cov]$ data collect$ 9 accordance ) ?is ,act1 not)/&+ ?is exception1 a s]vice provid] act+ at ! direction ( a gov]nm5t entity1 or a s]vice provid$ to a gov]nm5t entity by a cov]$ entity1 & only ins(> z au?oriz$ by /atute1 ! transf] is necess>y to prev5t1 detect1 protect aga9/ or respond to a public safety incid5t includ+ trespass1 natural disa/]1 or national security incid5t4 ,?is p>agraph does n p]mit1 h[ev]1 ! transf] ( cov]$ data = paym5t or o!r valuable consid]ation to a gov]nm5t entity2 7,e7 9 ! case ( ! transf] ( a password1 ! transf] is necess>y to use a designat$ password manag] or is to a cov]$ entity = ! exclusive purpose ( id5tify+ passwords t are be+ re-us$ across sites or acc\nts2 7,f7 9 ! case ( ! transf] ( g5etic in=mation1 ! transf] is necess>y to p]=m a m$ical diagnosis or m$ical treatm5t specifically reque/$ by an individual1 or to conduct m$ical rese>* 9 accordance ) conditions ( section #aja7;b77#aj72 or 7,g7 to transf] assets 9 ! mann] describ$ 9 p>agraph 7#ac7 ( section #aja7;b72 or 7#d7 9 ! case ( a provid] ( broadca/ television s]vice1 cable s]vice1 satellite s]vice1 /ream+ m$ia s]vice1 or o!r video programm+ s]vice describ$ 9 section #gac7;h77#b7 ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #fac7;h77#b771 transf] to an unaffiliat$ ?ird p>ty cov]$ data t reveals ! video cont5t or s]vices reque/$ or select$ by an individual f su* s]vice1 except ) ! affirmative express cons5t ( ! individual or pursuant to "o ( ! p]missible purposes enum]at$ 9 p>agraphs 7#a7 ?r\gh 7#ae7 ( section #aja7;b74 #ajc4 ,privacy by design 7a7 ,policies1 practices1 & proc$ures ,a cov]$ entity & a s]vice provid] %all e/abli%1 implem5t1 & ma9ta9 reasonable policies1 practices1 & proc$ures t reflect ! role ( ! cov]$ entity or s]vice provid] 9 ! collection1 process+1 & transf]r+ ( cov]$ data & t-- 7#a7 consid] applicable ,f$]al laws1 rules1 or regulations relat$ to cov]$ data ! cov]$ entity or s]vice provid] collects1 processes1 or transf]s2 7#b7 id5tify1 assess1 & mitigate privacy risks relat$ to cov]$ m9ors 7includ+1 if applicable1 ) respect to a cov]$ entity t is n an entity meet+ ! requirem5ts ( section #bji1 9 a mann] t consid]s ! developm5tal ne$s ( diff]5t age ranges ( cov]$ m9ors7 to result 9 reasonably necess>y & proportionate residual risk to cov]$ m9ors2 7#c7 mitigate privacy risks1 includ+ sub/antial privacy risks1 relat$ to ! products & s]vices ( ! cov]$ entity or ! s]vice provid]1 includ+ 9 ! design1 developm5t1 & implem5tation ( su* products & s]vices1 tak+ into acc\nt ! role ( ! cov]$ entity or s]vice provid] & ! in=mation available to x2 & 7#d7 implem5t reasonable tra9+ & safegu>ds )9 ! cov]$ entity & s]vice provid] to promote compliance ) all privacy laws applicable to cov]$ data ! cov]$ entity collects1 processes1 or transf]s or cov]$ data ! s]vice provid] collects1 processes1 or transf]s on behalf ( ! cov]$ entity & mitigate privacy risks1 includ+ sub/antial privacy risks1 tak+ into acc\nt ! role ( ! cov]$ entity or s]vice provid] & ! in=mation available to x4 7b7 ,factors to consid] ,! policies1 practices1 & proc$ures e/abli%$ by a cov]$ entity & a s]vice provid] "u subsection 7a71 %all correspond )1 z applicable-- 7#a7 ! size ( ! cov]$ entity or ! s]vice provid] & ! nature1 scope1 & complexity ( ! activities engag$ 9 by ! cov]$ entity or s]vice provid]1 includ+ :e!r ! cov]$ entity or s]vice provid] is a l>ge data hold]1 nonpr(it organization1 entity meet+ ! requirem5ts ( section #bji1 ?ird p>ty1 or ?ird-p>ty collect+ entity1 tak+ into acc\nt ! role ( ! cov]$ entity or s]vice provid] & ! in=mation available to x2 7#b7 ! s5sitivity ( ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity or s]vice provid]2 7#c7 ! volume ( cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity or s]vice provid]2 7#d7 ! numb] ( individuals & devices to :i* ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity or s]vice provid] relates2 & 7#e7 ! co/ ( implem5t+ su* policies1 practices1 & proc$ures 9 relation to ! risks & nature ( ! cov]$ data4 7c7 ,commission guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance z to :at con/itutes reasonable policies1 practices1 & proc$ures z requir$ by ?is section4 ,! ,commission %all consid] unique circum/ances applicable to nonpr(it organizations1 to entities meet+ ! requirem5ts ( section #bji1 & to s]vice provid]s4 #ajd4 ,loyalty to individuals ) respect to pric+ 7a7 ,retaliation ?r\gh s]vice or pric+ prohibit$ ,a cov]$ entity may n retaliate aga9/ an individual = ex]cis+ any ( ! rights gu>ante$ by ! ,act1 or any regulations promulgat$ "u ?is ,act1 includ+ d5y+ goods or s]vices1 *>g+ diff]5t prices or rates = goods or s]vices1 or provid+ a diff]5t level ( quality ( goods or s]vices4 7b7 ,rules ( con/ruction ,no?+ 9 subsection 7a7 may be con/ru$ to-- 7#a7 prohibit ! relation ( ! price ( a s]vice or ! level ( s]vice provid$ to an individual to ! provision1 by ! individual1 ( f9ancial in=mation t is necess>ily collect$ & process$ only = ! purpose ( initiat+1 r5d]+1 bill+ =1 or collect+ paym5t = a s]vice or product reque/$ by ! individual2 7#b7 prohibit a cov]$ entity f (f]+ a diff]5t price1 rate1 level1 quality or selection ( goods or s]vices to an individual1 includ+ (f]+ goods or s]vices = no fee1 if ! (f]+ is 9 connection ) an individual's volunt>y p>ticipation 9 a bona fide loyalty program2 7#c7 require a cov]$ entity to provide a bona fide loyalty program t w\ld require ! cov]$ entity to collect1 process1 or transf] cov]$ data t ! cov]$ entity o!rwise w\ld n collect1 process1 or transf]2 7#d7 prohibit a cov]$ entity f (f]+ a f9ancial inc5tive or o!r consid]ation to an individual = p>ticipation 9 m>ket rese>*2 7#e7 prohibit a cov]$ entity f (f]+ diff]5t types ( pric+ or functionalities ) respect to a product or s]vice bas$ on an individual's ex]cise ( a "r "u section #bjc7;a77#c72 or 7#f7 prohibit a cov]$ entity f decl9+ to provide a product or s]vice ins(> z ! collection & process+ ( cov]$ data is /rictly necess>y = su* product or s]vice4 7c7 ,bona fide loyalty program def9$ ,= purposes ( ?is section1 ! t]m bona fide loyalty program includes rew>ds1 premium features1 disc\nt or club c>d programs4 ,,ii ,consum] ,data ,rights #bja4 ,consum] aw>5ess 7a7 ,9 g5]al ,n lat] ?an #ij days aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all publi%1 on ! public website ( ! ,commission1 a webpage t describes ea* provision1 "r1 obligation1 & requirem5t ( ?is ,act1 li/$ sep>ately = individuals & = cov]$ entities & s]vice provid]s1 & ! rem$ies1 exemptions1 & protections associat$ ) ?is ,act1 9 pla9 & concise language & 9 an easy-to-und]/& mann]4 7b7 ,updates ,! ,commission %all update ! in=mation publi%$ "u subsection 7a7 on a qu>t]ly basis z necessitat$ by any *ange 9 law1 regulation1 guidance1 or judicial decisions4 7c7 ,accessibility ,! ,commission %all publi% ! in=mation requir$ to be publi%$ "u subsection 7a7 9 ! t5 languages ) ! mo/ us]s 9 ! ,unit$ ,/ates1 accord+ to ! mo/ rec5t ,unit$ ,/ates ,c5sus4 #bjb4 ,transp>5cy 7a7 ,9 g5]al ,ea* cov]$ entity %all make publicly available1 9 a cle>1 conspicu\s1 n mislead+1 & easy-to-read & readily accessible mann]1 a privacy policy t provides a detail$ & accurate repres5tation ( ! data collection1 process+1 & transf] activities ( ! cov]$ entity4 7b7 ,cont5t ( privacy policy ,a cov]$ entity or s]vice provid] %all h a privacy policy t includes1 at a m9imum1 ! foll[+3 7#a7 ,! id5tity & ! contact in=mation (-- 7,a7 ! cov]$ entity or s]vice provid] to :i* ! privacy policy applies 7includ+ ! cov]$ entity's or s]vice provid]'s po9ts ( contact & g5]ic electronic mail addresses1 z applicable = privacy & data security inquiries72 & 7,b7 any o!r entity )9 ! same corporate /ructure z ! cov]$ entity or s]vice provid] to :i* cov]$ data is transf]r$ by ! cov]$ entity4 7#b7 ,! categories ( cov]$ data ! cov]$ entity or s]vice provid] collects or processes4 7#c7 ,! process+ purposes = ea* category ( cov]$ data ! cov]$ entity or s]vice provid] collects or processes4 7#d7 ,:e!r ! cov]$ entity or s]vice provid] transf]s cov]$ data &1 if s1 ea* category ( s]vice provid] & ?ird p>ty to :i* ! cov]$ entity or s]vice provid] transf]s cov]$ data1 ! "n ( ea* ?ird-p>ty collect+ entity to :i* ! cov]$ entity or s]vice provid] transf]s cov]$ data1 & ! purposes = :i* su* data is transf]r$ to su* categories ( s]vice provid]s & ?ird p>ties or ?ird-p>ty collect+ entities1 except = a transf] to a gov]nm5tal entity pursuant to a c\rt ord] or law t prohibits ! cov]$ entity or s]vice provid] f disclos+ su* transf]1 except = transf]s to gov]nm5tal entities pursuant to a c\rt ord] or law t prohibits ! cov]$ entity f disclos+ ! transf]4 7#e7 ,! l5g? ( "t ! cov]$ entity or s]vice provid] int5ds to reta9 ea* category ( cov]$ data1 includ+ s5sitive cov]$ data1 or1 if x is n possible to id5tify t timeframe1 ! crit]ia us$ to det]m9e ! l5g? ( "t ! cov]$ entity or s]vice provid] int5ds to reta9 categories ( cov]$ data4 7#f7 ,a prom95t description ( h[ an individual c ex]cise ! rights describ$ 9 ?is ,act4 7#g7 ,a g5]al description ( ! cov]$ entity's or s]vice provid]'s data security practices4 7#h7 ,! effective date ( ! privacy policy4 7#i7 ,:e!r or n any cov]$ data collect$ by ! cov]$ entity or s]vice provid] is transf]r$ to1 process$ 91 /or$ 91 or o!rwise accessible to ! ,p's ,republic ( ,*9a1 ,russia1 ,iran1 or ,nor? ,korea4 7c7 ,languages ,! privacy policy requir$ "u subsection 7a7 %all be made available to ! public 9 ea* cov]$ language 9 :i* ! cov]$ entity or s]vice provid]-- 7#a7 provides a product or s]vice t is subject to ! privacy policy2 or 7#b7 c>ries out activities relat$ to su* product or s]vice4 7d7 ,accessibility ,! cov]$ entity or s]vice provid] %all also provide ! disclosures "u ?is section 9 a mann] t is reasonably accessible to & usable by individuals ) disabilities4 7e7 ,mat]ial *anges 7#a7 ,affirmative express cons5t ,if a cov]$ entity makes a mat]ial *ange to its privacy policy or practices1 ! cov]$ entity %all notify ea* individual affect$ by su* mat]ial *ange be=e implem5t+ ! mat]ial *ange ) respect to any prospectively collect$ cov]$ data &1 except z provid$ 9 p>agraphs 7#a7 ?r\gh 7#ae7 ( section #aja7;b71 provide a reasonable opportunity = ea* individual to )draw cons5t to any fur!r mat]ially diff]5t collection1 process+1 or transf] ( previ\sly collect$ cov]$ data "u ! *ang$ policy4 7#b7 ,notification ,! cov]$ entity %all take all reasonable electronic measures to provide direct notification reg>d+ mat]ial *anges to ! privacy policy to ea* affect$ individual1 9 ea* cov]$ language 9 :i* ! privacy policy is made available1 & tak+ into acc\nt available te*nology & ! nature ( ! relation%ip4 7#c7 ,cl>ification ,no?+ 9 ?is section may be con/ru$ to affect ! requirem5ts = cov]$ entities "u section #ajb or #bjd4 7#d7 ,log ( mat]ial *anges ,ea* l>ge data hold] %all reta9 copies ( previ\s v]sions ( its privacy policy = at lea/ #aj ye>s beg9n+ aft] ! date ( enactm5t ( ?is ,act & publi% !m on its website4 ,su* l>ge data hold] %all make publicly available1 9 a cle>1 conspicu\s1 & readily accessible mann]1 a log describ+ ! date & nature ( ea* mat]ial *ange to its privacy policy ov] ! pa/ #aj ye>s4 ,! descriptions %all be suffici5t = a reasonable individual to und]/& ! mat]ial effect ( ea* mat]ial *ange4 ,! obligations 9 ?is p>agraph %all n apply to any previ\s v]sions ( a l>ge data hold]'s privacy policy1 or any mat]ial *anges to su* policy1 t prec$e ! date ( enactm5t ( ?is ,act4 7f7 ,%ort-=m notice to consum]s by l>ge data hold]s 7#a7 ,9 g5]al ,9 addition to ! privacy policy requir$ "u subsection 7a71 a l>ge data hold] t is a cov]$ entity %all provide a %ort-=m notice ( its cov]$ data practices 9 a mann] t is-- 7,a7 concise1 cle>1 conspicu\s1 & n mislead+2 7,b7 readily accessible to ! individual1 bas$ on :at is reasonably anticipat$ )9 ! context ( ! relation%ip betwe5 ! individual & ! l>ge data hold]2 7,c7 inclusive ( an ov]view ( individual rights & disclosures to reasonably draw att5tion to data practices t may reasonably be unexpect$ to a reasonable p]son or t involve s5sitive cov]$ data2 & 7,d7 no m ?an #ejj words 9 l5g?4 7#b7 ,rulemak+ ,! ,commission %all issue a rule pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code1 e/abli%+ ! m9imum data disclosures necess>y = ! %ort-=m notice requir$ "u p>agraph 7#a71 :i* %all n exce$ ! cont5t requirem5ts 9 subsection 7b7 & %all include templates or models ( %ort-=m notices4 #bjc4 ,individual data own]%ip & control 7a7 ,access to1 & correction1 deletion1 & portability (1 cov]$ data ,9 accordance ) subsections 7b7 & 7c71 a cov]$ entity %all provide an individual1 aft] receiv+ a v]ifi$ reque/ f ! individual1 ) ! "r to-- 7#a7 access-- 7,a7 9 a human-readable =mat t a reasonable individual c und]/& & d[nload f ! int]net1 ! cov]$ data 7except cov]$ data 9 a back-up or ar*ival sy/em7 ( ! individual mak+ ! reque/ t is collect$1 process$1 or transf]r$ by ! cov]$ entity or any s]vice provid] ( ! cov]$ entity )9 ! #bd mon?s prec$+ ! reque/2 7,b7 ! categories ( any ?ird p>ty1 if applicable1 & an option = consum]s to obta9 ! names ( any su* ?ird p>ty z well z & ! categories ( any s]vice provid]s to :om ! cov]$ entity has transf]r$ = consid]ation ! cov]$ data ( ! individual1 z well z ! categories ( s\rces f :i* ! cov]$ data 0 collect$2 & 7,c7 a description ( ! purpose = :i* ! cov]$ entity transf]r$ ! cov]$ data ( ! individual to a ?ird p>ty or s]vice provid]2 7#b7 correct any v]ifiable sub/antial inaccuracy or sub/antially incomplete in=mation ) respect to ! cov]$ data ( ! individual t is process$ by ! cov]$ entity & in/ruct ! cov]$ entity to make reasonable ef=ts to notify all ?ird p>ties or s]vice provid]s to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! correct$ in=mation2 7#c7 delete cov]$ data ( ! individual t is process$ by ! cov]$ entity & in/ruct ! cov]$ entity to make reasonable ef=ts to notify all ?ird p>ties or s]vice provid] to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! individual's deletion reque/2 & 7#d7 to ! ext5t te*nically feasible1 export to ! individual or directly to ano!r entity ! cov]$ data ( ! individual t is process$ by ! cov]$ entity1 includ+ inf]5ces l9k$ or reasonably l9kable to ! individual b n includ+ o!r d]iv$ data1 )\t lic5s+ re/rictions t limit su* transf]s 9-- 7,a7 a human-readable =mat t a reasonable individual c und]/& & d[nload f ! int]net2 & 7,b7 a portable1 /ructur$1 int]op]able1 & ma*9e-readable =mat4 7b7 ,individual autonomy ,a cov]$ entity may n condition1 effectively condition1 attempt to condition1 or attempt to effectively condition ! ex]cise ( a "r describ$ 9 subsection 7a7 ?r\gh-- 7#a7 ! use ( any false1 fictiti\s1 fraudul5t1 or mat]ially mislead+ /atem5t or repres5tation2 or 7#b7 ! design1 modification1 or manipulation ( any us] int]face ) ! purpose or sub/antial effect ( obscur+1 subv]t+1 or impair+ a reasonable individual's autonomy1 decision mak+1 or *oice to ex]cise su* "r4 7c7 ,tim+ 7#a7 ,9 g5]al ,subject to subsections 7d7 & 7e71 ea* reque/ "u subsection 7a7 %all be complet$ by any-- 7,a7 l>ge data hold] )9 #de days ( su* reque/ f an individual1 unless x is demon/rably impracticable or impracticably co/ly to v]ify su* individual2 7,b7 cov]$ entity t is n a l>ge data hold] or a cov]$ entity meet+ ! requirem5ts ( section #bji )9 #fj days ( su* reque/ f an individual1 unless x is demon/rably impracticable or impracticably co/ly to v]ify su* individual2 or 7,c7 cov]$ entity meet+ ! requirem5ts ( section #bji )9 #ij days ( su* reque/ f an individual1 unless x is demon/rably impracticable or impracticably co/ly to v]ify su* individual4 7#b7 ,ext5sion ,a response p]iod set =? 9 ?is subsection may be ext5d$ once by #de additional days :5 reasonably necess>y1 consid]+ ! complexity & numb] ( ! individual's reque/s1 s long z ! cov]$ entity in=ms ! individual ( any su* ext5sion )9 ! initial #de-;day response p]iod1 toge!r ) ! reason = ! ext5sion4 7d7 ,frequ5cy & co/ ( access ,a cov]$ entity-- 7#a7 %all provide an individual ) ! opportunity to ex]cise ea* ( ! rights describ$ 9 subsection 7a72 & 7#b7 ) respect to-- 7,a7 ! fir/ #b times t an individual ex]cises any "r describ$ 9 subsection 7a7 9 any #ab-mon? p]iod1 %all all[ ! individual to ex]cise su* "r free ( *>ge2 & 7,b7 any "t beyond ! initial #b times describ$ 9 subp>agraph 7,a71 may all[ ! individual to ex]cise su* "r = a reasonable fee = ea* reque/4 7e7 ,v]ification & exceptions 7#a7 ,requir$ exceptions ,a cov]$ entity may n p]mit an individual to ex]cise a "r describ$ 9 subsection 7a71 9 :ole or 9 "p1 if ! cov]$ entity-- 7,a7 _c reasonably v]ify t ! individual mak+ ! reque/ to ex]cise ! "r is ! individual ^: cov]$ data is ! subject ( ! reque/ or an individual au?oriz$ to make su* a reque/ on ! individual's behalf2 7,b7 reasonably believes t ! reque/ is made to int]f]e ) a contract betwe5 ! cov]$ entity & ano!r individual2 7,c7 det]m9es t ! ex]cise ( ! "r w\ld require access to or correction ( ano!r individual's s5sitive cov]$ data2 7,d7 reasonably believes t ! ex]cise ( ! "r w\ld require ! cov]$ entity to engage 9 an unfair or deceptive practice "u section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de72 or 7,e7 reasonably believes t ! reque/ is made to fur!r fraud1 support crim9al activity1 or ! ex]cise ( ! "r pres5ts a data security ?reat4 7#b7 ,additional in=mation ,if a cov]$ entity _c reasonably v]ify t a reque/ to ex]cise a "r describ$ 9 subsection 7a7 is made by ! individual ^: cov]$ data is ! subject ( ! reque/ 7or an individual au?oriz$ to make su* a reque/ on ! individual's behalf71 ! cov]$ entity-- 7,a7 may reque/ t ! individual mak+ ! reque/ to ex]cise ! "r provide any additional in=mation necess>y = ! sole purpose ( v]ify+ ! id5tity ( ! individual2 & 7,b7 may n process or transf] su* additional in=mation = any o!r purpose4 7#c7 ,p]missive exceptions 7,a7 ,9 g5]al ,a cov]$ entity may decl9e1 ) adequate explanation to ! individual1 to comply ) a reque/ to ex]cise a "r describ$ 9 subsection 7a71 9 :ole or 9 "p1 t w\ld-- 7i7 require ! cov]$ entity to reta9 any cov]$ data collect$ = a s+le1 "o-"t transaction1 if su* cov]$ data is n process$ or transf]r$ by ! cov]$ entity = any purpose o!r ?an complet+ su* transaction2 7ii7 be demon/rably impracticable or prohibitively co/ly to comply )1 & ! cov]$ entity %all provide a description to ! reque/or detail+ ! inability to comply ) ! reque/2 7iii7 require ! cov]$ entity to attempt to re-id5tify de-id5tifi$ data2 7iv7 require ! cov]$ entity to ma9ta9 cov]$ data 9 an id5tifiable =m or collect1 reta91 or access any data 9 ord] to be capable ( associat+ a v]ifi$ individual reque/ ) cov]$ data ( su* individual2 7v7 result 9 ! release ( trade secrets or o!r privileg$ or confid5tial bus9ess in=mation2 7vi7 require ! cov]$ entity to correct any cov]$ data t _c be reasonably v]ifi$ z be+ inaccurate or incomplete2 7vii7 int]f]e ) law en=cem5t1 judicial proce$+s1 inve/igations1 or reasonable ef=ts to gu>d aga9/1 detect1 prev5t1 or inve/igate fraudul5t1 malici\s1 or unlawful activity1 or en=ce valid contracts2 7viii7 violate ,f$]al or ,/ate law or ! rights & fre$oms ( ano!r individual1 includ+ "u ! ,con/itution ( ! ,unit$ ,/ates2 7ix7 prev5t a cov]$ entity f be+ able to ma9ta9 a confid5tial record ( deletion reque/s1 ma9ta9$ solely = ! purpose ( prev5t+ cov]$ data ( an individual f be+ recollect$ aft] ! individual submitt$ a deletion reque/ & reque/$ t ! cov]$ entity no long] collect1 process1 or transf] su* data2 7x7 fall )9 an exception enum]at$ 9 ! regulations promulgat$ by ! ,commission pursuant to subp>agraph 7,d72 or 7xi7 ) respect to reque/s = deletion-- 7,i7 unreasonably int]f]e ) ! provision ( products or s]vices by ! cov]$ entity to ano!r p]son x curr5tly s]ves2 7,,ii7 delete cov]$ data t relates to a public figure & = :i* ! reque/+ individual has no reasonable expectation ( privacy2 7,,iii7 delete cov]$ data reasonably necess>y to p]=m a contract betwe5 ! cov]$ entity & ! individual2 7,,iv7 delete cov]$ data t ! cov]$ entity ne$s to reta9 9 ord] to comply ) pr(essional e?ical obligations2 7,v7 delete cov]$ data t ! cov]$ entity reasonably believes may be evid5ce ( unlawful activity or an abuse ( ! cov]$ entity's products or s]vices2 or 7,,vi7 = private elem5t>y & second>y s*ools z def9$ by ,/ate law & private in/itutions ( high] education z def9$ by title ,i ( ! ,high] ,education ,act ( #aife1 delete cov]$ data t w\ld unreasonably int]f]e ) ! provision ( education s]vices by or ! ord9>y op]ation ( ! s*ool or in/itution4 7,b7 ,p>tial compliance ,9 a circum/ance t w\ld all[ a d5ial pursuant to subp>agraph 7,a71 a cov]$ entity %all p>tially comply ) ! rema9d] ( ! reque/ if x is possible & n unduly burd5some to d s4 7,c7 ,numb] ( reque/s ,= purposes ( subp>agraph 7,a77ii71 ! receipt ( a l>ge numb] ( v]ifi$ reque/s1 on its own1 may n be consid]$ to r5d] compliance ) a reque/ demon/rably impracticable4 7,d7 ,fur!r exceptions ,! ,commission may1 by regulation z describ$ 9 subsection 7g71 e/abli% additional p]missive exceptions necess>y to protect ! rights ( individuals1 alleviate undue burd5s on cov]$ entities1 prev5t unju/ or unreasonable outcomes f ! ex]cise ( access1 correction1 deletion1 or portability rights1 or z o!rwise necess>y to fulfill ! purposes ( ?is section4 ,9 e/abli%+ su* exceptions1 ! ,commission %\ld consid] any relevant *anges 9 te*nology1 means = protect+ privacy & o!r rights1 & b5eficial uses ( cov]$ data by cov]$ entities4 7f7 ,l>ge data hold] metrics report+ ,a l>ge data hold] t is a cov]$ entity %all1 = ea* cal5d> ye> 9 :i* x 0 a l>ge data hold]1 d ! foll[+3 7#a7 ,compile ! foll[+ metrics = ! prior cal5d> ye>3 7,a7 ,! numb] ( v]ifi$ access reque/s "u subsection 7a77#a74 7,b7 ,! numb] ( v]ifi$ deletion reque/s "u subsection 7a77#c74 7,c7 ,! numb] ( reque/s to opt-out ( cov]$ data transf]s "u section #bjd7;b74 7,d7 ,! numb] ( reque/s to opt-out ( t>get$ adv]tis+ "u section #bjd7;c74 7,e7 ,! numb] ( reque/s 9 ea* ( subp>agraphs 7,a7 ?r\gh 7,d7 t su* l>ge data hold] 7i7 compli$ ) 9 :ole or 9 "p & 7ii7 d5i$4 7,f7 ,! m$ian or mean numb] ( days )9 :i* su* l>ge data hold] sub/antively respond$ to ! reque/s 9 ea* ( subp>agraphs 7,a7 ?r\gh 7,d74 7#b7 ,disclose by ,july #a ( ea* applicable cal5d> ye> ! in=mation compil$ 9 p>agraph 7#a7 )9 su* l>ge data hold]'s privacy policy requir$ "u section #bjb or on ! publicly accessible website ( su* l>ge data hold] t is accessible f a hyp]l9k includ$ 9 ! privacy policy4 7g7 ,regulations ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations1 pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code1 z necess>y to e/abli% processes by :i* cov]$ entities are to comply ) ! provisions ( ?is section4 ,su* regulations %all take into consid]ation-- 7#a7 ! size (1 & ! nature1 scope1 & complexity ( ! activities engag$ 9 by ! cov]$ entity1 includ+ :e!r ! cov]$ entity is a l>ge data hold]1 nonpr(it organization1 cov]$ entity meet+ ! requirem5ts ( section #bji1 ?ird p>ty1 or ?ird-p>ty collect+ entity2 7#b7 ! s5sitivity ( cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7#c7 ! volume ( cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7#d7 ! numb] ( individuals & devices to :i* ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity relates2 & 7#e7 aft] consult+ ! ,national ,in/itute ( ,/&>ds & ,te*nology1 /&>ds = ensur+ ! deletion ( cov]$ data "u ?is ,act :]e appropriate4 7h7 ,accessibility ,a cov]$ entity %all facilitate ! ability ( individuals to make reque/s "u subsection 7a7 9 any cov]$ language 9 :i* ! cov]$ entity provides a product or s]vice4 ,! me*anisms by :i* a cov]$ entity enables individuals to make reque/s "u subsection 7a7 %all be readily accessible & usable by ) individuals ) disabilities4 #bjd4 ,"r to cons5t & object 7a7 ,)drawal ( cons5t ,a cov]$ entity %all provide an individual ) a cle> & conspicu\s1 easy-to-execute means to )draw any affirmative express cons5t previ\sly provid$ by ! individual t is z easy to execute by a reasonable individual z ! means to provide cons5t1 ) respect to ! process+ or transf] ( ! cov]$ data ( ! individual4 7b7 ,"r to opt out ( cov]$ data transf]s 7#a7 ,9 g5]al ,a cov]$ entity-- 7,a7 may n transf] or direct ! transf] ( ! cov]$ data ( an individual to a ?ird p>ty if ! individual objects to ! transf]2 & 7,b7 %all all[ an individual to object to su* a transf] ?r\gh an opt-out me*anism1 z describ$ 9 section #baj4 7#b7 ,exception ,except z provid$ 9 section #bjf7;b77#c77;,c71 a cov]$ entity ne$ n all[ an individual to opt out ( ! collection1 process+1 or transf] ( cov]$ data made pursuant to ! exceptions 9 p>agraphs 7#a7 ?r\gh 7#ae7 ( section #aja7;b74 7c7 ,"r to opt out ( t>get$ adv]tis+ 7#a7 ,a cov]$ entity or s]vice provid] t directly deliv]s a t>get$ adv]tisem5t %all-- 7,a7 prior to engag+ 9 t>get$ adv]tis+ to an individual or device & at all times !reaft]1 provide su* individual ) a cle> & conspicu\s means to opt out ( t>get$ adv]tis+2 7,b7 abide by any opt-out designation by an individual ) respect to t>get$ adv]tis+ & notify ! cov]$ entity t direct$ ! s]vice provid] to deliv] ! t>get$ adv]tisem5t ( ! opt-out decision2 & 7,c7 all[ an individual to make an opt-out designation ) respect to t>get$ adv]tis+ ?r\gh an opt-out me*anism1 z describ$ 9 section #baj4 7#b7 ,a cov]$ entity or s]vice provid] t receives an opt-out notification pursuant to p>agraph 7#a77;,b7 or ?is p>agraph %all abide by su* opt-out designations by an individual & notify any o!r p]son t direct$ ! cov]$ entity or s]vice provid] to s]ve1 deliv]1 or o!rwise h&le ! adv]tisem5t ( ! opt-out decision4 7d7 ,individual autonomy ,a cov]$ entity may n condition1 effectively condition1 attempt to condition1 or attempt to effectively condition ! ex]cise ( any individual "r "u ?is section ?r\gh-- 7#a7 ! use ( any false1 fictiti\s1 fraudul5t1 or mat]ially mislead+ /atem5t or repres5tation2 or 7#b7 ! design1 modification1 or manipulation ( any us] int]face ) ! purpose or sub/antial effect ( obscur+1 subv]t+1 or impair+ a reasonable individual's autonomy1 decision mak+1 or *oice to ex]cise any su* "r4 #bje4 ,data protections = *ildr5 & m9ors 7a7 ,prohibition on t>get$ adv]tis+ to *ildr5 & m9ors ,a cov]$ entity may n engage 9 t>get$ adv]tis+ to any individual if ! cov]$ entity has k t ! individual is a cov]$ m9or4 7b7 ,data transf] requirem5ts relat$ to cov]$ m9ors 7#a7 ,9 g5]al ,a cov]$ entity may n transf] or direct ! transf] ( ! cov]$ data ( a cov]$ m9or to a ?ird p>ty if ! cov]$ entity-- 7,a7 has k t ! individual is a cov]$ m9or2 & 7,b7 has n obta9$ affirmative express cons5t f ! cov]$ m9or or ! cov]$ m9or's p>5t or gu>dian4 7#b7 ,exception ,a cov]$ entity or s]vice provid] may collect1 process1 or transf] cov]$ data ( an individual ! cov]$ entity or s]vice provid] kn[s is "u ! age ( #ah solely 9 ord] to submit in=mation relat+ to *ild victimization to law en=cem5t or to ! nonpr(it1 national res\rce c5t] & cle>+h\se congressionally designat$ to provide assi/ance to victims1 families1 *ild-s]v+ pr(essionals1 & ! g5]al public on miss+ & exploit$ *ildr5 issues4 7c7 ,y\? privacy & m>ket+ division 7#a7 ,e/abli%m5t ,!re is e/abli%$ )9 ! ,commission 9 ! privacy bureau e/abli%$ 9 ?is ,act1 a division to be kn[n z ! ,y\? ,privacy & ,m>ket+ ,division 79 ?is section ref]r$ to z ! ,division74 7#b7 ,director ,! ,division %all be head$ by a ,director1 :o %all be appo9t$ by ! ,*air ( ! ,commission4 7#c7 ,duties ,! ,division %all be responsible = assi/+ ! ,commission 9 address+1 z x relates to ?is ,act-- 7,a7 ! privacy ( *ildr5 & m9ors2 & 7,b7 m>ket+ direct$ at *ildr5 & m9ors4 7#d7 ,/aff ,! ,director ( ! ,division %all hire adequate /aff to c>ry out ! duties describ$ 9 p>agraph 7#c71 includ+ by hir+ individuals :o are exp]ts 9 data protection1 digital adv]tis+1 data analytics1 & y\? developm5t4 7#e7 ,reports ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,commission %all submit to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report t includes-- 7,a7 a description ( ! "w ( ! ,division reg>d+ em]g+ conc]ns relat+ to y\? privacy & m>ket+ practices2 & 7,b7 an assessm5t ( h[ effectively ! ,division has1 dur+ ! p]iod = :i* ! report is submitt$1 assi/$ ! ,commission to address y\? privacy & m>ket+ practices4 7#f7 ,publication ,n lat] ?an #aj days aft] ! date on :i* a report is submitt$ "u p>agraph 7#e71 ! ,commission %all publi% ! report on its website4 7d7 ,report by ! inspector g5]al 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & bi5nially !reaft]1 ! ,inspector ,g5]al ( ! ,commission %all submit to ! ,commission & to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report reg>d+ ! safe h>bor provisions 9 section #acjd ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #fejc71 :i* %all include-- 7,a7 an analysis ( :e!r ! safe h>bor provisions are-- 7i7 op]at+ fairly & effectively2 & 7ii7 effectively protect+ ! int]e/s ( *ildr5 & m9ors2 & 7,b7 any proposal or recomm5dation = policy *anges t w\ld improve ! effectiv5ess ( ! safe h>bor provisions4 7#b7 ,publication ,n lat] ?an #aj days aft] ! date on :i* a report is submitt$ "u p>agraph 7#a71 ! ,commission %all publi% ! report on ! website ( ! ,commission4 #bjf4 ,?ird-p>ty collect+ entities 7a7 ,notice ,ea* ?ird-p>ty collect+ entity %all place a cle>1 conspicu\s1 n mislead+1 & readily accessible notice on ! website or mobile application ( ! ?ird-p>ty collect+ entity 7if ! ?ird-p>ty collect+ entity ma9ta9s su* a website or mobile application7 t-- 7#a7 notifies individuals t ! entity is a ?ird-p>ty collect+ entity us+ specific language t ! ,commission %all develop ?r\gh rulemak+ "u section #eec ( title #e1 ,unit$ ,/ates ,code2 7#b7 includes a l9k to ! website e/abli%$ "u subsection 7b77#c72 & 7#c7 is reasonably accessible to & usable by individuals ) disabilities4 7b7 ,?ird-p>ty collect+ entity regi/ration 7#a7 ,9 g5]al ,n lat] ?an ,janu>y #ca ( ea* cal5d> ye> t foll[s a cal5d> ye> dur+ :i* a cov]$ entity act$ z a ?ird-p>ty collect+ entity & process$ cov]$ data p]ta9+ to m ?an #e1jjj individuals or devices t id5tify or are l9k$ or reasonably l9kable to an individual1 su* cov]$ entity %all regi/] ) ! ,commission 9 accordance ) ?is subsection4 7#b7 ,regi/ration requirem5ts ,9 regi/]+ ) ! ,commission z requir$ "u p>agraph 7#a71 a ?ird-p>ty collect+ entity %all d ! foll[+3 7,a7 ,pay to ! ,commission a regi/ration fee ( #ajj4 7,b7 ,provide ! ,commission ) ! foll[+ in=mation3 7i7 ,! legal "n & prim>y physical1 email1 & int]net addresses ( ! ?ird-p>ty collect+ entity4 7ii7 ,a description ( ! categories ( cov]$ data ! ?ird-p>ty collect+ entity processes & transf]s4 7iii7 ,! contact in=mation ( ! ?ird-p>ty collect+ entity1 includ+ a contact p]son1 a telephone numb]1 an e-mail address1 a website1 & a physical mail+ address4 7iv7 ,a l9k to a website ?r\gh :i* an individual may easily ex]cise ! rights provid$ "u ?is subsection4 7#c7 ,?ird-p>ty collect+ entity regi/ry ,! ,commission %all e/abli% & ma9ta9 on a website a se>*able1 publicly available1 c5tral regi/ry ( ?ird-p>ty collect+ entities t are regi/]$ ) ! ,commission "u ?is subsection t includes ! foll[+3 7,a7 ,a li/+ ( all regi/]$ ?ird-p>ty collect+ entities & a se>* feature t all[s memb]s ( ! public to id5tify individual ?ird-p>ty collect+ entities4 7,b7 ,= ea* regi/]$ ?ird-p>ty collect+ entity1 ! in=mation provid$ "u p>agraph 7#b77;,b74 7,c7 7i7 ,a ,d ,n ,collect regi/ry l9k & me*anism by :i* an individual may1 easily submit a reque/ to all regi/]$ ?ird-p>ty collect+ entities t are n consum] report+ ag5cies 7z def9$ 9 section #fjc7;f7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7f7771 & to ! ext5t su* ?ird-p>ty collect+ entities are n act+ z consum] report+ ag5cies 7z s def9$71 to-- 7,i7 delete all cov]$ data relat$ to su* individual t ! ?ird-p>ty collect+ entity did n collect f su* individual directly or :5 act+ z a s]vice provid]2 & 7,,ii7 ensure t ! ?ird-p>ty collect+ entity no long] collects cov]$ data relat$ to su* individual )\t ! affirmative express cons5t ( su* individual1 except ins(> z ! ?ird-p>ty collect+ entity is act+ z a s]vice provid]4 7ii7 ,ea* ?ird-p>ty collect+ entity t receives su* a reque/ f an individual %all delete all ! cov]$ data ( ! individual n lat] ?an #cj days aft] ! reque/ is receiv$ by ! ?ird-p>ty collect+ entity4 7iii7 ,not)/&+ ! provisions ( clauses 7i7 & 7ii71 a ?ird-p>ty collect+ entity may decl9e to fulfill a ,d ,n ,collect reque/ f an individual :o x has actual k has be5 convict$ ( a crime relat$ to ! abduction or sexual exploitation ( a *ild1 & ! data ! entity is collect+ is necess>y to effectuate ! purposes ( a national or ,/ate-run sex (f5d] regi/ry or ! congressionally designat$ entity t s]ves z ! nonpr(it national res\rce c5t] & cle>+h\se to provide assi/ance to victims1 families1 *ild-s]v+ pr(essionals1 & ! g5]al public on miss+ & exploit$ *ildr5 issues4 7c7 ,p5alties 7#a7 ,9 g5]al ,a ?ird-p>ty collect+ entity t fails to regi/] or provide ! notice z requir$ "u ?is section %all be liable =-- 7,a7 a civil p5alty ( #ajj = ea* day ! ?ird-p>ty collect+ entity fails to regi/] or provide notice z requir$ "u ?is section1 n to exce$ a total ( #aj1jjj = any ye>2 & 7,b7 an am\nt equal to ! regi/ration fees due "u p>agraph 7#b77;,a7 ( subsection 7b7 = ea* ye> t ! ?ird-p>ty collect+ entity fail$ to regi/] z requir$ "u p>agraph 7#a7 ( su* subsection4 7#b7 ,rule ( con/ruction ,no?+ 9 ?is subsection %all be con/ru$ z alt]+1 limit+1 or affect+ any en=cem5t au?orities or rem$ies "u ?is ,act4 #bjg4 ,civil rights & algori?ms 7a7 ,civil rights protections 7#a7 ,9 g5]al ,a cov]$ entity or a s]vice provid] may n collect1 process1 or transf] cov]$ data 9 a mann] t discrim9ates 9 or o!rwise makes unavailable ! equal enjoym5t ( goods or s]vices on ! basis ( race1 color1 religion1 national orig91 sex1 or disability4 7#b7 ,exceptions ,?is subsection %all n apply to-- 7,a7 ! collection1 process+1 or transf] ( cov]$ data = ! purpose (-- 7i7 a cov]$ entity's or a s]vice provid]'s self-te/+ to prev5t or mitigate unlawful discrim9ation2 or 7ii7 div]sify+ an applicant1 p>ticipant1 or cu/om] pool2 or 7,b7 any private club or gr\p n op5 to ! public1 z describ$ 9 section #bja7;e7 ( ! ,civil ,rights ,act ( #aifd 7#db ,u4,s4,c4 #bjjj;a7e774 7b7 ,,ftc en=cem5t assi/ance 7#a7 ,9 g5]al ,:5ev] ! ,commission obta9s in=mation t a cov]$ entity or s]vice provid] may h collect$1 process$1 or transf]r$ cov]$ data 9 violation ( subsection 7a71 ! ,commission %all transmit su* in=mation z all[able "u ,f$]al law to any ,executive ag5cy ) au?ority to initiate en=cem5t actions or proce$+s relat+ to su* violation4 7#b7 ,annual report ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,commission %all submit to ,congress a report t includes a summ>y (-- 7,a7 ! types ( in=mation ! ,commission transmitt$ to ,executive ag5cies "u p>agraph 7#a7 dur+ ! previ\s #a-ye> p]iod2 & 7,b7 h[ su* in=mation relates to ,f$]al civil rights laws4 7#c7 ,te*nical assi/ance ,9 transmitt+ in=mation "u p>agraph 7#a71 ! ,commission may consult & coord9ate )1 & provide te*nical & inve/igative assi/ance1 z appropriate1 to su* ,executive ag5cy4 7#d7 ,coop]ation ) o!r ag5cies ,! ,commission may implem5t ?is subsection by execut+ agreem5ts or memor&a ( und]/&+ ) ! appropriate ,executive ag5cies4 7c7 ,cov]$ algori?m impact & evaluation 7#a7 ,cov]$ algori?m impact assessm5t 7,a7 ,impact assessm5t ,not)/&+ any o!r provision ( law1 n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 a l>ge data hold] t uses a cov]$ algori?m 9 a mann] t poses a consequ5tial risk ( h>m to an individual or gr\p ( individuals1 & uses su* cov]$ algori?m solely or 9 "p1 to collect1 process1 or transf] cov]$ data %all conduct an impact assessm5t ( su* algori?m 9 accordance ) subp>agraph 7,b74 7,b7 ,impact assessm5t scope ,! impact assessm5t requir$ "u subp>agraph 7,a7 %all provide ! foll[+3 7i7 ,a detail$ description ( ! design process & me?odologies ( ! cov]$ algori?m4 7ii7 ,a /atem5t ( ! purpose & propos$ uses ( ! cov]$ algori?m4 7iii7 ,a detail$ description ( ! data us$ by ! cov]$ algori?m1 includ+ ! specific categories ( data t w be process$ z input & any data us$ to tra9 ! model t ! cov]$ algori?m relies on1 if applicable4 7iv7 ,a description ( ! outputs produc$ by ! cov]$ algori?m4 7v7 ,an assessm5t ( ! necessity & proportionality ( ! cov]$ algori?m 9 relation to its /at$ purpose4 7vi7 ,a detail$ description ( /eps ! l>ge data hold] has tak5 or w take to mitigate pot5tial h>ms f ! cov]$ algori?m to an individual or gr\p ( individuals1 includ+ relat$ to-- 7,i7 cov]$ m9ors2 7,,ii7 mak+ or facilitat+ adv]tis+ =1 or det]m9+ access to1 or re/rictions on ! use ( h\s+1 education1 employm5t1 heal?c>e1 insurance1 or cr$it opportunities2 7,,iii7 det]m9+ access to1 or re/rictions on ! use (1 any place ( public accommodation1 p>ticul>ly z su* h>ms relate to ! protect$ *>act]i/ics ( individuals1 includ+ race1 color1 religion1 national orig91 sex1 or disability2 7,,iv7 disp>ate impact on ! basis ( individuals' race1 color1 religion1 national orig91 sex1 or disability /atus2 or 7,v7 disp>ate impact on ! basis ( individuals' political p>ty regi/ration /atus4 7#b7 ,algori?m design evaluation ,not)/&+ any o!r provision ( law1 n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 a cov]$ entity or s]vice provid] t kn[+ly develops a cov]$ algori?m t is design$ to1 solely or 9 "p1 to collect1 process1 or transf] cov]$ data 9 fur!rance ( a consequ5tial decision %all prior to deploy+ ! cov]$ algori?m 9 int]/ate comm]ce evaluate ! design1 /ructure1 & inputs ( ! cov]$ algori?m1 includ+ any tra9+ data us$ to develop ! cov]$ algori?m1 to r$uce ! risk ( ! pot5tial h>ms id5tifi$ "u p>agraph 7#a77;,b74 7#c7 ,o!r consid]ations 7,a7 ,focus ,9 comply+ ) p>agraphs 7#a7 & 7#b71 a cov]$ entity & a s]vice provid] may focus ! impact assessm5t or evaluation on any cov]$ algori?m1 or portions ( a cov]$ algori?m1 t w be put to use & may reasonably contribute to ! risk ( ! pot5tial h>ms id5tifi$ "u p>agraph 7#a77;,b74 7,b7 ,availability 7i7 ,9 g5]al ,a cov]$ entity & a s]vice provid]-- 7,i7 %all1 n lat] ?an #cj days aft] complet+ an impact assessm5t or evaluation1 submit ! impact assessm5t or evaluation conduct$ "u p>agraph 7#a7 or 7#b7 to ! ,commission2 7,,ii7 %all1 ^u reque/1 make su* impact assessm5t & evaluation available to ,congress2 & 7,,iii7 may make a summ>y ( su* impact assessm5t & evaluation publicly available 9 a place t is easily accessible to individuals4 7ii7 ,trade secrets ,cov]$ entities & s]vice provid]s may r$act & segregate any trade secret 7z def9$ 9 section #ahci ( title #ah1 ,unit$ ,/ates ,code7 or o!r confid5tial or propriet>y in=mation f public disclosure "u ?is subp>agraph & ! ,commission %all abide by its obligations "u section #f7;f7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;f77 9 reg>d to su* in=mation4 7,c7 ,en=cem5t ,! ,commission may n use any in=mation obta9$ solely & exclusively ?r\gh a cov]$ entity or a s]vice provid]'s disclosure ( in=mation to ! ,commission 9 compliance ) ?is section = any purpose o!r ?an en=c+ ?is ,act ) ! exception ( en=c+ cons5t ord]s1 includ+ ! /udy & report provisions 9 p>agraph 7#f74 ,?is subp>agraph does n preclude ! ,commission f provid+ ?is in=mation to ,congress 9 response to a subpo5a4 7#d7 ,guidance ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all1 9 consultation ) ! ,secret>y ( ,comm]ce1 or _! respective designees1 publi% guidance reg>d+ compliance ) ?is section4 7#e7 ,rulemak+ & exemption ,! ,commission %all h au?ority "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to promulgate regulations z necess>y to e/abli% processes by :i* a l>ge data hold]-- 7,a7 %all submit an impact assessm5t to ! ,commission "u p>agraph 7#c77;,b77i77,i72 & 7,b7 may exclude f ?is subsection any cov]$ algori?m t pres5ts l[ or m9imal consequ5tial risk ( h>m to an individual or gr\p ( individuals4 7#f7 ,/udy & report 7,a7 ,/udy ,! ,commission1 9 consultation ) ! ,secret>y ( ,comm]ce or ! ,secret>y's designee1 %all conduct a /udy1 to review any impact assessm5t or evaluation submitt$ "u ?is subsection4 ,su* /udy %all include an exam9ation (-- 7i7 be/ practices = ! assessm5t & evaluation ( cov]$ algori?ms2 & 7ii7 me?ods to r$uce ! risk ( h>m to individuals t may be relat$ to ! use ( cov]$ algori?ms4 7,b7 ,report 7i7 ,initial report ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission1 9 consultation ) ! ,secret>y ( ,comm]ce or ! ,secret>y's designee1 %all submit to ,congress a report conta9+ ! results ( ! /udy conduct$ "u subp>agraph 7,a71 toge!r ) recomm5dations = su* legislation & adm9i/rative action z ! ,commission det]m9es appropriate4 7ii7 ,additional reports ,n lat] ?an #c ye>s aft] submission ( ! initial report "u clause 7i71 & z ! ,commission det]m9es necess>y !reaft]1 ! ,commission %all submit to ,congress an updat$ v]sion ( su* report4 #bjh4 ,data security & protection ( cov]$ data 7a7 ,e/abli%m5t ( data security practices 7#a7 ,9 g5]al ,a cov]$ entity or s]vice provid] %all e/abli%1 implem5t1 & ma9ta9 reasonable adm9i/rative1 te*nical1 & physical data security practices & proc$ures to protect & secure cov]$ data aga9/ unau?oriz$ access & acquisition4 7#b7 ,consid]ations ,! reasonable adm9i/rative1 te*nical1 & physical data security practices requir$ "u p>agraph 7#a7 %all be appropriate to-- 7,a7 ! size & complexity ( ! cov]$ entity or s]vice provid]2 7,b7 ! nature & scope ( ! cov]$ entity or ! s]vice provid]'s collect+1 process+1 or transf]r+ ( cov]$ data2 7,c7 ! volume & nature ( ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity or s]vice provid]2 7,d7 ! s5sitivity ( ! cov]$ data collect$1 process$1 or transf]r$2 7,e7 ! curr5t /ate ( ! art 7& limitations !re(7 9 adm9i/rative1 te*nical1 & physical safegu>ds = protect+ su* cov]$ data2 & 7,f7 ! co/ ( available tools to improve security & r$uce vuln]abilities to unau?oriz$ access & acquisition ( su* cov]$ data 9 relation to ! risks & nature ( ! cov]$ data4 7b7 ,specific requirem5ts ,! data security practices ( ! cov]$ entity & ( ! s]vice provid] requir$ "u subsection 7a7 %all include1 = ea* respective entity's own sy/em or sy/ems1 at a m9imum1 ! foll[+ practices3 7#a7 ,assess vuln]abilities ,id5tify+ & assess+ any mat]ial int]nal & ext]nal risk to1 & vuln]ability 91 ! security ( ea* sy/em ma9ta9$ by ! cov]$ entity t collects1 processes1 or transf]s cov]$ data1 or s]vice provid] t collects1 processes1 or transf]s cov]$ data on behalf ( ! cov]$ entity1 includ+ unau?oriz$ access to or risks to su* cov]$ data1 human vuln]abilities1 access rights1 & ! use ( s]vice provid]s4 ,) respect to l>ge data hold]s1 su* activities %all include a plan to receive & reasonably respond to unsolicit$ reports ( vuln]abilities by any entity or individual & by p]=m+ a reasonable inve/igation ( su* reports4 7#b7 ,prev5tive & corrective action ,tak+ prev5tive & corrective action design$ to mitigate reasonably =eseeable risks or vuln]abilities to cov]$ data id5tifi$ by ! cov]$ entity or s]vice provid]1 consi/5t ) ! nature ( su* risk or vuln]ability & ! entity's role 9 collect+1 process+1 or transf]r+ ! data4 ,su* action may include implem5t+ adm9i/rative1 te*nical1 or physical safegu>ds or *anges to data security practices or ! ar*itecture1 in/allation1 or implem5tation ( network or op]at+ s(tw>e1 among o!r actions4 7#c7 ,evaluation ( prev5tive & corrective action ,evaluat+ & mak+ reasonable adju/m5ts to ! action describ$ 9 p>agraph 7#b7 9 light ( any mat]ial *anges 9 te*nology1 int]nal or ext]nal ?reats to cov]$ data1 & ! cov]$ entity or s]vice provid]'s own *ang+ bus9ess arrangem5ts or op]ations4 7#d7 ,in=mation ret5tion & disposal ,dispos+ ( cov]$ data 9 accordance ) a ret5tion s*$ule t %all require ! deletion ( cov]$ data :5 su* data is requir$ to be delet$ by law or is no long] necess>y = ! purpose = :i* ! data 0 collect$1 process$1 or transf]r$1 unless an individual has provid$ affirmative express cons5t to su* ret5tion4 ,su* disposal %all include de/roy+1 p]man5tly eras+1 or o!rwise modify+ ! cov]$ data to make su* data p]man5tly unreadable or indeciph]able & unrecov]able to ensure ongo+ compliance ) ?is section4 ,s]vice provid]s %all e/abli% practices to delete or return cov]$ data to a cov]$ entity z reque/$ at ! end ( ! provision ( s]vices unless ret5tion ( ! cov]$ data is requir$ by law1 consi/5t ) section #cjb7;a77#f74 7#e7 ,tra9+ ,tra9+ ea* employee ) access to cov]$ data on h[ to safegu>d cov]$ data & updat+ su* tra9+ z necess>y4 7#f7 ,designation ,designat+ an (fic]1 employee1 or employees to ma9ta9 & implem5t su* practices4 7#g7 ,incid5t response ,implem5t+ proc$ures to detect1 respond to1 or recov] f security incid5ts1 includ+ brea*es4 7c7 ,regulations ,! ,commission may promulgate1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 te*nology-neutral regulations to e/abli% processes = comply+ ) ?is section4 ,! ,commission %all consult ) ! ,national ,in/itute ( ,/&>ds & ,te*nology 9 e/abli%+ su* processes4 #bji4 ,small bus9ess protections 7a7 ,e/abli%m5t ( exemption ,any cov]$ entity or s]vice provid] t c e/abli% t x met ! requirem5ts describ$ 9 subsection 7b7 = ! p]iod ( ! #c prec$+ cal5d> ye>s 7or = ! p]iod dur+ :i* ! cov]$ entity or s]vice provid] has be5 9 exi/5ce if su* p]iod is less ?an #c ye>s7 %all-- 7#a7 be exempt f compliance ) section #bjc7;a77#d71 p>agraphs 7#a7 ?r\gh 7#c7 & 7#e7 ?r\gh 7#g7 ( section #bjh7;b71 & section #cja7;c72 & 7#b7 at ! cov]$ entity's sole discretion1 h ! option ( comply+ ) section #bjc7;a77#b7 by1 aft] receiv+ a v]ifi$ reque/ f an individual to correct cov]$ data ( ! individual "u su* section1 delet+ su* cov]$ data 9 its entirety in/ead ( mak+ ! reque/$ correction4 7b7 ,exemption requirem5ts ,! requirem5ts ( ?is subsection are1 ) respect to a cov]$ entity or a s]vice provid]1 ! foll[+3 7#a7 ,! cov]$ entity or s]vice provid]'s av]age annual gross rev5ues dur+ ! p]iod did n exce$ #da1jjj1jjj4 7#b7 ,! cov]$ entity or s]vice provid]1 on av]age1 did n annually collect or process ! cov]$ data ( m ?an #bjj1jjj individuals dur+ ! p]iod beyond ! purpose ( initiat+1 r5d]+1 bill+ =1 f9aliz+1 complet+1 or o!rwise collect+ paym5t = a reque/$ s]vice or product1 s long z all cov]$ data = su* purpose 0 delet$ or de-id5tifi$ )9 #ij days1 except :5 necess>y to inve/igate fraud or z consi/5t ) a cov]$ entity's return policy4 7#c7 ,! cov]$ entity or s]vice provid] did n d]ive m ?an #ej p]c5t ( its rev5ue f transf]r+ cov]$ data dur+ any ye> 7or "p ( a ye> if ! cov]$ entity has be5 9 exi/5ce = less ?an #a ye>7 t occurs dur+ ! p]iod4 7c7 ,rev5ue def9$ ,= purposes ( ?is section1 ! t]m rev5ue z x relates to any cov]$ entity or s]vice provid] t is n organiz$ to c>ry on bus9ess = its own pr(it or t ( its memb]s1 means ! gross receipts ! cov]$ entity or s]vice provid] receiv$ 9 :atev] =m f all s\rces )\t subtract+ any co/s or exp5ses1 & includes contributions1 gifts1 grants1 dues or o!r assessm5ts1 income f inve/m5ts1 or proce$s f ! sale ( real or p]sonal prop]ty4 #baj4 ,unifi$ opt-out me*anisms 7a7 ,9 g5]al ,= ! rights e/abli%$ "u subsection 7b7 ( section #bjd1 subsection 7c7 ( section #bjd 7except z provid$ = "u section #aja7;b77#af771 & section #bjf7;b77#c77;,c71 foll[+ public notice & opportunity to comm5t & n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all e/abli% or recognize "o or m acceptable privacy protective1 c5traliz$ me*anisms1 includ+ global privacy signals su* z br[s] or device privacy sett+s1 o!r tools (f]$ by cov]$ entities or s]vice provid]s1 & regi/ries ( id5tifi]s1 = individuals to ex]cise all su* rights ?r\gh a s+le int]face = a cov]$ entity or s]vice provid] to utilize to all[ an individual to make su* opt out designations ) respect to cov]$ data relat$ to su* individual4 7b7 ,requirem5ts ,any su* c5traliz$ opt-out me*anism %all-- 7#a7 require cov]$ entities or s]vice provid]s act+ on behalf ( cov]$ entities to in=m individuals ab\t ! c5traliz$ opt-out *oice2 7#b7 n be requir$ to be ! default sett+1 b may be ! default sett+ provid$ t 9 all cases ! me*anism cle>ly repres5ts ! individual's affirmative1 freely giv51 & unambigu\s *oice to opt out2 7#c7 be consum]-fri5dly1 cle>ly describ$1 & easy-to-use by a reasonable individual2 7#d7 p]mit ! cov]$ entity or s]vice provid] act+ on behalf ( a cov]$ entity to h an au!ntication process ! cov]$ entity or s]vice provid] act+ on behalf ( a cov]$ entity may use to det]m9e if ! me*anism repres5ts a legitimate reque/ to opt out2 7#e7 be provid$ 9 any cov]$ language 9 :i* ! cov]$ entity provides products or s]vices subject to ! opt-out2 & 7#f7 be provid$ 9 a mann] t is reasonably accessible to & usable by individuals ) disabilities4 ,,iii ,corporate ,acc\ntability #cja4 ,executive responsibility 7a7 ,9 g5]al ,beg9n+ #a ye> aft] ! date ( enactm5t ( ?is ,act1 an executive (fic] ( a l>ge data hold] %all annually c]tify1 9 good fai?1 to ! ,commission1 9 a mann] specifi$ by ! ,commission by regulation "u section #eec ( title #e1 ,unit$ ,/ates ,code1 t ! entity ma9ta9s-- 7#a7 int]nal controls reasonably design$ to comply ) ?is ,act2 & 7#b7 int]nal report+ /ructures to ensure t su* c]tify+ executive (fic] is involv$ 9 & responsible = ! decisions t impact ! compliance by ! l>ge data hold] ) ?is ,act4 7b7 ,requirem5ts ,a c]tification submitt$ "u subsection 7a7 %all be bas$ on a review ( ! effectiv5ess ( ! int]nal controls & report+ /ructures ( ! l>ge data hold] t is conduct$ by ! c]tify+ executive (fic] n m ?an #ij days be=e ! submission ( ! c]tification4 ,a c]tification submitt$ "u subsection 7a7 is made 9 good fai? if ! c]tify+ (fic] _h1 aft] a reasonable inve/igation1 reasonable gr\nd to believe & did believe1 at ! "t t c]tification 0 submitt$1 t ! /atem5ts !re9 7 true & t !re 0 no omission to /ate a mat]ial fact requir$ to be /at$ !re9 or necess>y to make ! /atem5ts !re9 n mislead+4 7c7 ,designation ( privacy & data security (fic] 7#a7 ,9 g5]al ,a cov]$ entity or s]vice provid] t h m ?an #ae employees1 %all designate-- 7,a7 #a or m qualifi$ employees z privacy (fic]s2 & 7,b7 #a or m qualifi$ employees 79 addition to any employee designat$ "u subp>agraph 7,a77 z data security (fic]s4 7#b7 ,requirem5ts = (fic]s ,an employee :o is designat$ by a cov]$ entity or a s]vice provid] z a privacy (fic] or a data security (fic] pursuant to p>agraph 7#a7 %all1 at a m9imum-- 7,a7 implem5t a data privacy program & data security program to safegu>d ! privacy & security ( cov]$ data 9 compliance ) ! requirem5ts ( ?is ,act2 & 7,b7 facilitate ! cov]$ entity or s]vice provid]'s ongo+ compliance ) ?is ,act4 7#c7 ,additional requirem5ts = l>ge data hold]s ,a l>ge data hold] %all designate at lea/ #a ( ! (fic]s describ$ 9 p>agraph 7#a7 to report directly to ! highe/ (ficial at ! l>ge data hold] z a privacy protection (fic] :o %all1 9 addition to ! requirem5ts 9 p>agraph 7#b71 ei!r directly or ?r\gh a sup]vis$ designee or designees-- 7,a7 e/abli% processes to p]iodically review & update ! privacy & security policies1 practices1 & proc$ures ( ! l>ge data hold]1 z necess>y2 7,b7 conduct bi5nial & compreh5sive audits to ensure ! policies1 practices1 & proc$ures ( ! l>ge data hold] ensure ! l>ge data hold] is 9 compliance ) ?is ,act & ensure su* audits are accessible to ! ,commission ^u reque/2 7,c7 develop a program to educate & tra9 employees ab\t compliance requirem5ts ( ?is ,act2 7,d7 ma9ta9 updat$1 accurate1 cle>1 & und]/&able records ( all mat]ial privacy & data security practices und]tak5 by ! l>ge data hold]2 & 7,e7 s]ve z ! po9t ( contact betwe5 ! l>ge data hold] & en=cem5t au?orities4 7d7 ,l>ge data hold] privacy impact assessm5ts 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act or #a ye> aft] ! date on :i* a cov]$ entity fir/ meets ! def9ition ( l>ge data hold]1 :i*ev] is e>li]1 & bi5nially !reaft]1 ea* cov]$ entity t is a l>ge data hold] %all conduct a privacy impact assessm5t t weighs ! b5efits ( ! l>ge data hold]'s cov]$ data collect+1 process+1 & transf] practices aga9/ ! pot5tial adv]se consequ5ces ( su* practices1 includ+ sub/antial privacy risks1 to individual privacy4 7#b7 ,assessm5t requirem5ts ,a privacy impact assessm5t requir$ "u p>agraph 7#a7 %all be-- 7,a7 reasonable & appropriate 9 scope giv5-- 7i7 ! nature ( ! cov]$ data collect$1 process$1 & transf]r$ by ! l>ge data hold]2 7ii7 ! volume ( ! cov]$ data collect$1 process$1 & transf]r$ by ! l>ge data hold]2 & 7iii7 ! pot5tial mat]ial risks pos$ to ! privacy ( individuals by ! collect+1 process+1 & transf] ( cov]$ data by ! l>ge data hold]2 7,b7 docum5t$ 9 writt5 =m & ma9ta9$ by ! l>ge data hold] unless r5d]$ out ( date by a subsequ5t assessm5t conduct$ "u p>agraph 7#a72 & 7,c7 approv$ by ! privacy protection (fic] designat$ 9 subsection 7c77#c7 ( ! l>ge data hold]1 z applicable4 7#c7 ,additional factors to include 9 assessm5t ,9 assess+ ! privacy risks1 includ+ sub/antial privacy risks1 ! l>ge data hold] mu/ include reviews ( ! means by :i* te*nologies1 includ+ block*a9 & di/ribut$ l$g] te*nologies & o!r em]g+ te*nologies1 are us$ to secure cov]$ data4 7e7 ,o!r privacy impact assessm5ts 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act & bi5nially !reaft]1 ea* cov]$ entity t is n l>ge data hold] & does n meet ! requirem5ts = cov]$ entities "u section #bji %all conduct a privacy impact assessm5t4 ,su* assessm5t %all weigh ! b5efits ( ! cov]$ entity's cov]$ data collect+1 process+1 & transf] practices t may cause a sub/antial privacy risk aga9/ ! pot5tial mat]ial adv]se consequ5ces ( su* practices to individual privacy4 7#b7 ,assessm5t requirem5ts ,a privacy impact assessm5t requir$ "u p>agraph 7#a7 %all be-- 7,a7 reasonable & appropriate 9 scope giv5-- 7i7 ! nature ( ! cov]$ data collect$1 process$1 & transf]r$ by ! cov]$ entity2 7ii7 ! volume ( ! cov]$ data collect$1 process$1 & transf]r$ by ! cov]$ entity2 & 7iii7 ! pot5tial risks pos$ to ! privacy ( individuals by ! collect+1 process+1 & transf] ( cov]$ data by ! cov]$ entity2 & 7,b7 docum5t$ 9 writt5 =m & ma9ta9$ by ! cov]$ entity unless r5d]$ out ( date by a subsequ5t assessm5t conduct$ "u p>agraph 7#a74 7#c7 ,additional factors to include 9 assessm5t ,9 assess+ ! privacy risks1 includ+ sub/antial privacy risks1 ! cov]$ entity may include reviews ( ! means by :i* te*nologies1 includ+ block*a9 & di/ribut$ l$g] te*nologies & o!r em]g+ te*nologies1 are us$ to secure cov]$ data4 #cjb4 ,s]vice provid]s & ?ird p>ties 7a7 ,s]vice provid]s ,a s]vice provid]-- 7#a7 %all adh]e to ! in/ructions ( a cov]$ entity & only collect1 process1 & transf] s]vice provid] data to ! ext5t necess>y & proportionate to provide a s]vice reque/$ by ! cov]$ entity1 z set out 9 ! contract requir$ by subsection 7b71 & ?is p>agraph does n require a s]vice provid] to collect1 process1 or transf] cov]$ data if ! s]vice provid] w\ld n o!rwise d s2 7#b7 may n collect1 process1 or transf] s]vice provid] data if ! s]vice provid] has actual k t a cov]$ entity violat$ ?is ,act ) respect to su* data2 7#c7 %all assi/ a cov]$ entity 9 respond+ to a reque/ made by an individual "u section #bjc or #bjd1 by ei!r-- 7,a7 provid+ appropriate te*nical & organizational measures1 tak+ into acc\nt ! nature ( ! process+ & ! in=mation reasonably available to ! s]vice provid]1 = ! cov]$ entity to comply ) su* reque/ = s]vice provid] data2 or 7,b7 fulfill+ a reque/ by a cov]$ entity to execute an individual rights reque/ t ! cov]$ entity has det]m9$ %\ld be compli$ )1 by ei!r-- 7i7 comply+ ) ! reque/ pursuant to ! cov]$ entity's in/ructions2 or 7ii7 provid+ writt5 v]ification to ! cov]$ entity t x does n hold cov]$ data relat$ to ! reque/1 t comply+ ) ! reque/ w\ld be inconsi/5t ) its legal obligations1 or t ! reque/ falls )9 an exception to section #bjc or #bjd2 7#d7 may engage ano!r s]vice provid] = purposes ( process+ s]vice provid] data on behalf ( a cov]$ entity only aft] provid+ t cov]$ entity ) notice & pursuant to a writt5 contract t requires su* o!r s]vice provid] to satisfy ! obligations ( ! s]vice provid] ) respect to su* s]vice provid] data1 includ+ t ! o!r s]vice provid] be treat$ z a s]vice provid] "u ?is ,act2 7#e7 %all1 ^u ! reasonable reque/ ( ! cov]$ entity1 make available to ! cov]$ entity in=mation necess>y to demon/rate ! compliance ( ! s]vice provid] ) ! requirem5ts ( ?is ,act1 :i* may include mak+ available a report ( an indep5d5t assessm5t arrang$ by ! s]vice provid] on t]ms agre$ to by ! s]vice provid] & ! cov]$ entity1 provid+ in=mation necess>y to enable ! cov]$ entity to conduct & docum5t a privacy impact assessm5t requir$ by subsection 7d7 or 7e7 ( section #cja1 & mak+ available ! report requir$ "u section #bjg7;c77#b72 7#f7 %all1 at ! cov]$ entity's direction1 delete or return all cov]$ data to ! cov]$ entity z reque/$ at ! end ( ! provision ( s]vices1 unless ret5tion ( ! cov]$ data is requir$ by law2 7#g7 %all develop1 implem5t1 & ma9ta9 reasonable adm9i/rative1 te*nical1 & physical safegu>ds t are design$ to protect ! security & confid5tiality ( cov]$ data ! s]vice provid] processes consi/5t ) section #bjh2 & 7#h7 %all all[ & coop]ate )1 reasonable assessm5ts by ! cov]$ entity or ! cov]$ entity's designat$ assessor2 alt]natively1 ! s]vice provid] may arrange = a qualifi$ & indep5d5t assessor to conduct an assessm5t ( ! s]vice provid]'s policies & te*nical & organizational measures 9 support ( ! obligations "u ?is ,act us+ an appropriate & accept$ control /&>d or framework & assessm5t proc$ure = su* assessm5ts4 ,! s]vice provid] %all provide a report ( su* assessm5t to ! cov]$ entity ^u reque/4 7b7 ,contracts ,betwe5 ,cov]$ ,entities & ,s]vice ,provid]s 7#a7 ,requirem5ts ,a p]son or entity may only act z a s]vice provid] pursuant to a writt5 contract betwe5 ! cov]$ entity & ! s]vice provid]1 or a writt5 contract betwe5 "o s]vice provid] & a second s]vice provid] z describ$ "u subsection 7a77#d71 if ! contract-- 7,a7 sets =? ! data process+ proc$ures ( ! s]vice provid] ) respect to collection1 process+1 or transf] p]=m$ on behalf ( ! cov]$ entity or s]vice provid]2 7,b7 cle>ly sets =?-- 7i7 in/ructions = collect+1 process+1 or transf]r+ data2 7ii7 ! nature & purpose ( collect+1 process+1 or transf]r+2 7iii7 ! type ( data subject to collect+1 process+1 or transf]r+2 7iv7 ! duration ( process+2 & 7v7 ! rights & obligations ( bo? p>ties1 includ+ a me?od by :i* ! s]vice provid] %all notify ! cov]$ entity ( mat]ial *anges to its privacy practices2 7,c7 does n relieve a cov]$ entity or a s]vice provid] ( any requirem5t or liability impos$ on su* cov]$ entity or s]vice provid] "u ?is ,act2 & 7,d7 prohibits-- 7i7 collect+1 process+1 or transf]r+ cov]$ data 9 contrav5tion to subsection 7a72 & 7ii7 comb9+ s]vice provid] data ) cov]$ data :i* ! s]vice provid] receives f or on behalf ( ano!r p]son or p]sons or collects f ! int]action ( ! s]vice provid] ) an individual1 provid$ t su* comb9+ is n necess>y to effectuate a purpose describ$ 9 p>agraphs 7#a7 ?r\gh 7#ae7 ( section #aja7;b7 & is o!rwise p]mitt$ "u ! contract requir$ by ?is subsection4 7#b7 ,contract t]ms ,ea* s]vice provid] %all reta9 copies ( previ\s contracts ent]$ into 9 compliance ) ?is subsection ) ea* cov]$ entity to :i* x provides reque/$ products or s]vices4 7c7 ,relation%ip ,betwe5 ,cov]$ ,entities & ,s]vice ,provid]s 7#a7 ,det]m9+ :e!r a p]son is act+ z a cov]$ entity or s]vice provid] ) respect to a specific process+ ( cov]$ data is a fact-bas$ det]m9ation t dep5ds ^u ! context 9 :i* su* data is process$4 7#b7 ,a p]son t is n limit$ 9 its process+ ( cov]$ data pursuant to ! in/ructions ( a cov]$ entity1 or t fails to adh]e to su* in/ructions1 is a cov]$ entity & n a s]vice provid] ) respect to a specific process+ ( cov]$ data4 ,a s]vice provid] t cont9ues to adh]e to ! in/ructions ( a cov]$ entity ) respect to a specific process+ ( cov]$ data rema9s a s]vice provid]4 ,if a s]vice provid] beg9s1 alone or jo9tly ) o!rs1 det]m9+ ! purposes & means ( ! process+ ( cov]$ data1 x is a cov]$ entity & n a s]vice provid] ) respect to ! process+ ( su* data4 7#c7 ,a cov]$ entity t transf]s cov]$ data to a s]vice provid] or a s]vice provid] t transf]s cov]$ data to a cov]$ entity or ano!r s]vice provid]1 9 compliance ) ! requirem5ts ( ?is ,act1 is n liable = a violation ( ?is ,act by ! s]vice provid] or cov]$ entity to :om su* cov]$ data 0 transf]r$1 if at ! "t ( transf]r+ su* cov]$ data1 ! cov]$ entity or s]vice provid] did n h actual k t ! s]vice provid] or cov]$ entity w\ld violate ?is ,act4 7#d7 ,a cov]$ entity or s]vice provid] t receives cov]$ data 9 compliance ) ! requirem5ts ( ?is ,act is n 9 violation ( ?is ,act z a result ( a violation by a cov]$ entity or s]vice provid] f :i* su* data 0 receiv$4 7d7 ,?ird p>ties ,a ?ird p>ty-- 7#a7 %all n process ?ird p>ty data = a process+ purpose o!r ?an1 9 ! case ( s5sitive cov]$ data1 ! process+ purpose = :i* ! individual gave affirmative express cons5t or to effect a purpose enum]at$ 9 p>agraph 7#a71 7#c71 or 7#e7 ( section #aja7;b7 &1 9 ! case ( non-s5sitive data1 ! process+ purpose = :i* ! cov]$ entity made a disclosure pursuant to section #bjb7;b77#d72 & 7#b7 = purposes ( p>agraph 7#a71 may reasonably rely on repres5tations made by ! cov]$ entity t transf]r$ ! ?ird p>ty data if ! ?ird p>ty conducts reasonable due dilig5ce on ! repres5tations ( ! cov]$ entity & f9ds ^? repres5tations to be cr$ible4 7e7 ,additional obligations on cov]$ entities 7#a7 ,9 g5]al ,a cov]$ entity or s]vice provid] %all ex]cise reasonable due dilig5ce 9-- 7,a7 select+ a s]vice provid]2 & 7,b7 decid+ to transf] cov]$ data to a ?ird p>ty4 7#b7 ,guidance ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all publi% guidance reg>d+ compliance ) ?is subsection1 tak+ into consid]ation ! burd5s on l>ge data hold]s1 cov]$ entities :o are n l>ge data hold]s1 & cov]$ entities meet+ ! requirem5ts ( section #bji4 7f7 ,rule ( con/ruction ,solely = ! purposes ( ?is section1 ! requirem5ts = s]vice provid]s to contract )1 assi/1 & foll[ ! in/ructions ( cov]$ entities %all be read to include requirem5ts to contract )1 assi/1 & foll[ ! in/ructions ( a gov]nm5t entity if ! s]vice provid] is provid+ a s]vice to a gov]nm5t entity4 #cjc4 ,te*nical compliance programs 7a7 ,9 g5]al ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to e/abli% a process = ! proposal & approval ( te*nical compliance programs "u ?is section us$ by a cov]$ entity to collect1 process1 or transf] cov]$ data4 7b7 ,scope ( programs ,! te*nical compliance programs e/abli%$ "u ?is section %all1 ) respect to a te*nology1 product1 s]vice1 or me?od us$ by a cov]$ entity to collect1 process1 or transf] cov]$ data-- 7#a7 e/abli% publicly available guidel9es = compliance ) ?is ,act2 & 7#b7 meet or exce$ ! requirem5ts ( ?is ,act4 7c7 ,approval process 7#a7 ,9 g5]al ,any reque/ = approval1 am5dm5t1 or repeal ( a te*nical compliance program may be submitt$ to ! ,commission by any p]son1 includ+ a cov]$ entity1 a repres5tative ( a cov]$ entity1 an association ( cov]$ entities1 or a public int]e/ gr\p or organization4 ,)9 #ij days aft] ! reque/ is made1 ! ,commission %all publi% ! reque/ & provide an opportunity = public comm5t on ! proposal4 7#b7 ,exp$it$ response to reque/s ,beg9n+ #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all act ^u a reque/ = ! proposal & approval ( a te*nical compliance program n lat] ?an #a ye> aft] ! fil+ ( ! reque/1 & %all set =? publicly 9 writ+ ! conclusions ( ! ,commission ) reg>d to su* reque/4 7d7 ,"r to ,appeal ,f9al action by ! ,commission on a reque/ = approval1 am5dm5t1 or repeal ( a te*nical compliance program1 or ! failure to act )9 ! #a-ye> p]iod aft] a reque/ = approval1 am5dm5t1 or repeal ( a te*nical compliance program is made "u subsection 7c71 may be appeal$ to a ,f$]al di/rict c\rt ( ! ,unit$ ,/ates ( appropriate jurisdiction z provid$ = 9 section #gjb ( title #e1 ,unit$ ,/ates ,code4 7e7 ,effect on en=cem5t 7#a7 ,9 g5]al ,prior to comm5c+ an inve/igation or en=cem5t action aga9/ any cov]$ entity "u ?is ,act1 ! ,commission & ,/ate attorney g5]al %all consid] ! cov]$ entity's hi/ory ( compliance ) any te*nical compliance program approv$ "u ?is section & any action tak5 by ! cov]$ entity to rem$y noncompliance ) su* program4 ,if su* en=cem5t action describ$ 9 section #djc is br\ght1 ! cov]$ entity's hi/ory ( compliance ) any te*nical compliance program approv$ "u ?is section & any action tak5 by ! cov]$ entity to rem$y noncompliance ) su* program %all be tak5 into consid]ation :5 det]m9+ liability or a p5alty4 ,! cov]$ entity's hi/ory ( compliance ) any te*nical compliance program %all n affect any burd5 ( pro( or ! weight giv5 to evid5ce 9 an en=cem5t or judicial proce$+4 7#b7 ,commission au?ority ,approval ( a te*nical compliance program %all n limit ! au?ority ( ! ,commission1 includ+ ! ,commission's au?ority to comm5ce an inve/igation or en=cem5t action aga9/ any cov]$ entity "u ?is ,act or any o!r ,act4 7#c7 ,rule ( con/ruction ,no?+ 9 ?is subsection %all provide any individual1 class ( individuals1 or p]son ) any "r to seek discov]y ( any non-public ,commission delib]ation or activity or impose any plead+ requirem5t on ! ,commission if ! ,commission br+s an en=cem5t action ( any k9d4 #cjd4 ,commission approv$ compliance guidel9es 7a7 ,application = compliance guidel9e ,approval 7#a7 ,9 g5]al ,a cov]$ entity t is n a ?ird-p>ty collect+ entity & meets ! requirem5ts ( section #bji1 or a gr\p ( su* cov]$ entities1 may apply to ! ,commission = approval ( #a or m sets ( compliance guidel9es gov]n+ ! collection1 process+1 & transf] ( cov]$ data by ! cov]$ entity or gr\p ( cov]$ entities4 7#b7 ,application requirem5ts ,su* application %all include-- 7,a7 a description ( h[ ! propos$ guidel9es w meet or exce$ ! requirem5ts ( ?is ,act2 7,b7 a description ( ! entities or activities ! propos$ set ( compliance guidel9es is design$ to cov]2 7,c7 a li/ ( ! cov]$ entities t meet ! requirem5ts ( section #bji & are n ?ird-p>ty collect+ entities1 if any are kn[n at ! "t ( application1 t int5d to adh]e to ! compliance guidel9es2 & 7,d7 a description ( h[ su* cov]$ entities w be indep5d5tly assess$ = adh]5ce to su* compliance guidel9es1 includ+ ! indep5d5t organization n associat$ ) any ( ! cov]$ entities t may p>ticipate 9 guidel9es t w adm9i/] su* guidel9es4 7#c7 ,commission review 7,a7 ,initial approval 7i7 ,public comm5t p]iod ,)9 #ij days aft] ! receipt ( propos$ guidel9es submitt$ pursuant to p>agraph 7#b71 ! ,commission %all publi% ! application & provide an opportunity = public comm5t on su* compliance guidel9es4 7ii7 ,approval ,! ,commission %all approve an application reg>d+ propos$ guidel9es "u p>agraph 7#b7 if ! applicant demon/rates t ! compliance guidel9es-- 7,i7 meet or exce$ requirem5ts ( ?is ,act2 7,,ii7 provide = ! regul> review & validation by an indep5d5t organization n associat$ ) any ( ! cov]$ entities t may p>ticipate 9 ! guidel9es & t is approv$ by ! ,commission to conduct su* reviews ( ! compliance guidel9es ( ! cov]$ entity or entities to ensure t ! cov]$ entity or entities cont9ue to meet or exce$ ! requirem5ts ( ?is ,act2 & 7,,iii7 include a means ( en=cem5t if a cov]$ entity does n meet or exce$ ! requirem5ts 9 ! guidel9es1 :i* may include ref]ral to ! ,commission = en=cem5t consi/5t ) section #dja or ref]ral to ! appropriate ,/ate attorney g5]al = en=cem5t consi/5t ) section #djb4 7iii7 ,timel9e ,)9 #a ye> aft] receiv+ an application reg>d+ propos$ guidel9es "u p>agraph 7#b71 ! ,commission %all issue a det]m9ation approv+ or d5y+ ! application & provid+ its reasons = approv+ or d5y+ su* application4 7,b7 ,approval ( modifications 7i7 ,9 g5]al ,if ! indep5d5t organization adm9i/]+ a set ( guidel9es makes mat]ial *anges to guidel9es previ\sly approv$ by ! ,commission1 ! indep5d5t organization %all submit ! updat$ guidel9es to ! ,commission = approval4 ,z soon z feasible1 ! ,commission %all publi% ! updat$ guidel9es & provide an opportunity = public comm5t4 7ii7 ,timel9e ,! ,commission %all approve or d5y any mat]ial *ange to ! guidel9es )9 #a ye> aft] receipt ( ! submission = approval4 7b7 ,)drawal ( ,approval ,if at any "t ! ,commission det]m9es t ! guidel9es previ\sly approv$ no long] meet ! requirem5ts ( ?is ,act or a regulation promulgat$ "u ?is ,act or t compliance ) ! approv$ guidel9es is insuffici5tly en=c$ by ! indep5d5t organization adm9i/]+ ! guidel9es1 ! ,commission %all notify ! cov]$ entities or gr\p ( su* entities & ! indep5d5t organization ( ! det]m9ation ( ! ,commission to )draw approval ( su* guidel9es & ! basis = do+ s4 ,)9#ahj days aft] receipt ( su* notice1 ! cov]$ entity or gr\p ( su* entities & ! indep5d5t organization may cure any alleg$ defici5cy ) ! guidel9es or ! en=cem5t ( su* guidel9es & submit ea* propos$ cure to ! ,commission4 ,if ! ,commission det]m9es t su* cures elim9ate ! alleg$ defici5cy 9 ! guidel9es1 !n ! ,commission may n )draw approval ( su* guidel9es on ! basis ( su* det]m9ation4 7c7 ,deem$ compliance ,a cov]$ entity t is eligible to p>ticipate "u subsection 7a77#a7 & p>ticipates 9 guidel9es approv$ "u ?is section %all be deem$ 9 compliance ) ! relevant provisions ( ?is ,act if su* cov]$ entity is 9 compliance ) su* guidel9es4 #cje4 ,digital cont5t =g]ies 7a7 ,reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,secret>y ( ,comm]ce or ! ,secret>y's designee %all publi% a report reg>d+ digital cont5t =g]ies4 7b7 ,requirem5ts ,ea* report "u subsection 7a7 %all include ! foll[+3 7#a7 ,a def9ition ( digital cont5t =g]ies along ) accompany+ explanatory mat]ials4 7#b7 ,a description ( ! common s\rces ( digital cont5t =g]ies 9 ! ,unit$ ,/ates & comm]cial s\rces ( digital cont5t =g]y te*nologies4 7#c7 ,an assessm5t ( ! uses1 applications1 & h>ms ( digital cont5t =g]ies4 7#d7 ,an analysis ( ! me?ods & /&>ds available to id5tify digital cont5t =g]ies z well z a description ( ! comm]cial te*nological c\nt]-measures t are1 or c\ld be1 us$ to address conc]ns ) digital cont5t =g]ies1 :i* may include ! provision ( w>n+s to view]s ( suspect cont5t4 7#e7 ,a description ( ! types ( digital cont5t =g]ies1 includ+ ^? us$ to commit fraud1 cause h>m1 or violate any provision ( law4 7#f7 ,any o!r in=mation det]m9$ appropriate by ! ,secret>y ( ,comm]ce or ! ,secret>y's designee4 ,,iv ,en=cem5t1 ,applicability1 & ,miscellane\s #dja4 ,en=cem5t by ! ,f$]al ,trade ,commission 7a7 ,bureau ( ,privacy 7#a7 ,9 g5]al ,! ,commission %all e/abli% )9 ! ,commission a new bureau to be kn[n z ! ,bureau ( ,privacy1 :i* %all be ( simil> /ructure1 size1 organization1 & au?ority z ! exi/+ bureaus )9 ! ,commission relat$ to consum] protection & competition4 7#b7 ,mission ,! mission ( ! ,bureau e/abli%$ "u p>agraph 7#a7 %all be to assi/ ! ,commission 9 c>ry+ out ! duties ( ! ,commission "u ?is ,act & relat$ duties "u o!r provisions ( law4 7#c7 ,timel9e ,! ,bureau requir$ to be e/abli%$ "u p>agraph 7#a7 %all be e/abli%$1 /aff$1 & fully op]ational n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act4 7b7 ,(fice ( ,bus9ess ,m5tor%ip ,! ,director ( ! ,bureau e/abli%$ "u subsection 7a77#a7 %all e/abli% )9 ! ,bureau an (fice to be kn[n z ! ,(fice ( ,bus9ess ,m5tor%ip to provide guidance & education to cov]$ entities & s]vice provid]s reg>d+ compliance ) ?is ,act4 ,cov]$ entities or s]vice provid]s may reque/ advice f ! ,commission or ! ,(fice ) respect to a c\rse ( action t ! cov]$ entity or s]vice provid] proposes to pursue & t may relate to ! requirem5ts ( ?is ,act4 7c7 ,en=cem5t by ! ,f$]al ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,p[]s ( ! commission 7,a7 ,9 g5]al ,except z provid$ 9 p>agraphs 7#c71 7#d71 & 7#e71 ! ,commission %all en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 7,b7 ,privileges & immunities ,any p]son :o violates ?is ,act or a regulation promulgat$ "u ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,limit+ c]ta9 actions unrelat$ to ?is act ,if ! ,commission br+s a civil action alleg+ t an act or practice violates ?is ,act or a regulation promulgat$ "u ?is ,act1 ! ,commission may n seek a cease & desi/ ord] aga9/ ! same def5dant "u section #e7;b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;b77 to /op t same act or practice on ! gr\nds t su* act or practice con/itutes an unfair or deceptive act or practice4 7#d7 ,common c>ri]s & nonpr(it organizations ,not)/&+ any jurisdictional limitation ( ! ,commission ) respect to consum] protection or privacy1 ! ,commission %all en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act1 9 ! same mann] provid$ 9 p>agraphs 7#a71 7#b71 7#c71 & 7#e71 ) respect to common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto & organizations n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s4 7#e7 ,privacy & security victims relief fund 7,a7 ,e/abli%m5t ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a sep>ate fund to be kn[n z ! ,privacy & ,security ,victims ,relief ,fund 9 ?is p>agraph ref]r$ to z ! ,victims ,relief ,fund74 7,b7 ,deposits ,not)/&+ section #ccjb ( title #ca1 ,unit$ ,/ates ,code1 9 any judicial or adm9i/rative action to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act1 ! am\nt ( any civil p5alty obta9$ aga9/ a cov]$ entity or s]vice provid]1 or any o!r monet>y relief ord]$ to be paid by a cov]$ entity or s]vice provid] to provide r$ress1 paym5t1 comp5sation1 or o!r relief to individuals t _c be locat$ or ! paym5t ( :i* w\ld o!rwise n be practicable1 %all be deposit$ into ! ,victims ,relief ,fund4 7,c7 ,use ( funds 7i7 ,use by commission ,am\nts 9 ! ,victims ,relief ,fund %all be available to ! ,commission1 )\t fiscal ye> limitation1 to provide r$ress1 paym5t1 comp5sation1 or o!r monet>y relief to individuals affect$ by an act or practice = :i* relief has be5 obta9$ "u ?is ,act4 7ii7 ,o!r p]missible uses ,to ! ext5t t ! individuals describ$ 9 clause 7i7 _c be locat$ or su* r$ress1 paym5ts1 comp5sation1 or o!r monet>y relief are o!rwise n practicable1 ! ,commission may use su* funds = ! purpose (-- 7,i7 fund+ ! activities ( ! ,(fice ( ,bus9ess ,m5tor%ip e/abli%$ "u subsection 7b72 or 7,,ii7 engag+ 9 te*nological rese>* t ! ,commission consid]s necess>y to en=ce or adm9i/] ?is ,act4 #djb4 ,en=cem5t by ,/ates 7a7 ,civil action ,9 any case 9 :i* ! attorney g5]al or ,/ate ,privacy ,au?ority ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( t ,/ate has be51 may be1 or is adv]sely affect$ by a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act by a cov]$ entity or s]vice provid]1 ! attorney g5]al or ,/ate ,privacy ,au?ority may br+ a civil action 9 ! "n ( ! ,/ate1 or z p>5s patriae on behalf ( ! resid5ts ( ! ,/ate4 ,any su* action %all be br\ght exclusively 9 an appropriate ,f$]al di/rict c\rt ( ! ,unit$ ,/ates to-- 7#a7 enjo9 su* act or practice2 7#b7 en=ce compliance ) ?is ,act or su* regulation2 7#c7 obta9 damages1 civil p5alties1 re/itution1 or o!r comp5sation on behalf ( ! resid5ts ( su* ,/ate2 or 7#d7 obta9 reasonable attorneys' fees & o!r litigation co/s reasonably incurr$4 7b7 ,rights ( ! ,commission 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 ! attorney g5]al or ,/ate ,privacy ,au?ority ( a ,/ate %all notify ! ,commission 9 writ+ prior to initiat+ a civil action "u subsection 7a74 ,su* notification %all include a copy ( ! compla9t to be fil$ to initiate su* action4 ,^u receiv+ su* notification1 ! ,commission may int]v5e 9 su* action z a matt] ( "r pursuant to ! ,f$]al ,rules ( ,civil ,proc$ure4 7#b7 ,feasibility ,if ! notification requir$ by p>agraph 7#a7 is n feasible1 ! attorney g5]al or ,/ate ,privacy ,au?ority %all notify ! ,commission imm$iately aft] initiat+ ! civil action4 7c7 ,actions by ! ,commission ,9 any case 9 :i* a civil action is in/itut$ by or on behalf ( ! ,commission = violation ( ?is ,act or a regulation promulgat$ "u ?is ,act1 no attorney g5]al or ,/ate ,privacy ,au?ority ( a ,/ate may1 dur+ ! p5d5cy ( su* action1 in/itute a civil action aga9/ any def5dant nam$ 9 ! compla9t 9 ! action in/itut$ by or on behalf ( ! ,commission = a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act t is alleg$ 9 su* compla9t1 if su* compla9t alleges su* violation affect$ ! resid5ts ( su* ,/ate or individuals nationwide4 ,if ! ,commission br+s a civil action aga9/ a cov]$ entity or s]vice provid] = a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act t affects ! int]e/s ( ! resid5ts ( a ,/ate1 ! attorney g5]al or ,/ate ,privacy ,au?ority ( su* ,/ate may int]v5e 9 su* action z a matt] ( "r pursuant to ! ,f$]al ,rules ( ,civil ,proc$ure4 7d7 ,rule ( con/ruction ,no?+ 9 ?is section may be con/ru$ to prev5t ! attorney g5]al or ,/ate ,privacy ,au?ority ( a ,/ate f ex]cis+ ! p[]s conf]r$ on ! attorney g5]al or ,/ate ,privacy ,au?ority to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7e7 ,pres]vation ( /ate p[]s ,except z provid$ 9 subsection 7c71 no?+ 9 ?is section may be con/ru$ z alt]+1 limit+1 or affect+ ! au?ority ( ! attorney g5]al or ,/ate ,privacy ,au?ority ( a ,/ate to-- 7#a7 br+ an action or o!r regulatory proce$+ aris+ solely "u ! law 9 effect 9 ! ,/ate t is preempt$ by ?is ,act or "u ano!r applicable ,f$]al law2 or 7#b7 ex]cise ! p[]s conf]r$ on ! attorney g5]al or ,/ate ,privacy ,au?ority by ! laws ( ! ,/ate1 includ+ ! ability to conduct inve/igations1 adm9i/] oa?s or affirmations1 or compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 #djc4 ,en=cem5t by p]sons 7a7 ,en=cem5t by p]sons 7#a7 ,9 g5]al ,beg9n+ on ! date t is #b ye>s aft] ! date on :i* ?is ,act takes effect1 any p]son or class ( p]sons = a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act by a cov]$ entity or s]vice provid] may br+ a civil action aga9/ su* entity 9 any ,f$]al c\rt ( compet5t jurisdiction4 7#b7 ,relief ,9 a civil action br\ght "u p>agraph 7#a7 9 :i* a pla9tiff prevails1 ! c\rt may aw>d ! pla9tiff-- 7,a7 an am\nt equal to ! sum ( any comp5satory damages2 7,b7 injunctive relief2 7,c7 decl>atory relief2 & 7,d7 reasonable attorney's fees & litigation co/s4 7#c7 ,rights ( ! ,commission & ,/ate attorneys g5]al 7,a7 ,9 g5]al ,prior to a p]son br++ a civil action "u p>agraph 7#a71 su* p]son %all notify ! ,commission & ! attorney g5]al ( ! ,/ate :]e su* p]son resides 9 writ+ t su* p]son int5ds to br+ a civil action "u su* p>agraph4 ,^u receiv+ su* notice1 ! ,commission & ,/ate attorney g5]al %all ea* or jo9tly make a det]m9ation & respond to su* p]son n lat] ?an #fj days aft] receiv+ su* notice1 z to :e!r !y w int]v5e 9 su* action pursuant to ! ,f$]al ,rules ( ,civil ,proc$ure4 ,if a /ate attorney g5]al does int]v5e1 !y %all only be he>d ) respect to ! int]e/s ( ! resid5ts ( _! ,/ate 7,b7 ,reta9$ au?ority ,subp>agraph 7,a7 may n be con/ru$ to limit ! au?ority ( ! ,commission or any applicable ,/ate attorney g5]al or ,/ate ,privacy ,au?ority to lat] comm5ce a proce$+ or civil action or int]v5e by motion if ! ,commission or ,/ate attorney g5]al or ,/ate ,privacy ,au?ority does n comm5ce a proce$+ or civil action )9 ! #fj-;day p]iod4 7,c7 ,bad fai? ,any writt5 communication f c\nsel = an aggriev$ p>ty to a cov]$ entity or s]vice provid] reque/+ a monet>y paym5t f t cov]$ entity or s]vice provid] reg>d+ a specific claim describ$ 9 a lett] s5t pursuant to subsection 7d71 n includ+ fil+s 9 c\rt proce$+s1 arbitrations1 m$iations1 judgm5t collection processes1 or o!r communications relat$ to previ\sly initiat$ litigation or arbitrations1 %all be consid]$ to h be5 s5t 9 bad fai? & %all be unlawful z def9$ 9 ?is ,act1 if ! writt5 communication 0 s5t prior to ! date t is #fj days aft] ei!r a ,/ate attorney g5]al or ! ,commission has receiv$ ! notice requir$ "u subp>agraph 7,a74 7#d7 ,,ftc /udy ,beg9n+ on ! date t is #e ye>s aft] ! date ( enactm5t ( ?is ,act & e #e ye>s !reaft]1 ! ,commission's ,bureau ( ,economics & ,bureau ( ,privacy %all assi/ ! ,commission 9 conduct+ a /udy to det]m9e ! economic impacts 9 ! ,unit$ ,/ates ( dem& lett]s s5t pursuant to ?is section & ! scope ( ! rights ( a p]son "u ?is section to br+ =? civil actions aga9/ cov]$ entities & s]vice provid]s4 ,su* /udy %all include ! foll[+3 7,a7 ,! impact on insurance rates 9 ! ,unit$ ,/ates4 7,b7 ,! impact on ! ability ( cov]$ entities to (f] new products or s]vices4 7,c7 ,! impact on ! creation & gr[? ( new />tup companies1 includ+ new te*nology companies4 7,d7 ,any em]g+ risks1 b5efits1 & long-t]m tr5ds 9 relevant m>ketplaces1 supply *a9s1 & labor availability4 7,e7 ,! impact on r$uc+1 prev5t+1 or rem$iat+ h>ms to individuals1 includ+ f fraud1 id5tity !ft1 spam1 discrim9ation1 defective products1 & violations ( rights4 7,f7 ,! impact on ! volume & sev]ity ( data security incid5ts1 & ! ability to respond to data security incid5ts4 7,g7 ,o!r intangible direct & indirect co/s & b5efits to individuals4 7#e7 ,report to ,congress ,n lat] ?an #e ye>s aft] ! fir/ day on :i* p]sons & classes ( p]sons are able to br+ civil actions "u ?is subsection1 & annually !reaft]1 ! ,commission %all submit to ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate a report t conta9s ! results ( ! /udy conduct$ "u p>agraph 7#d74 7b7 ,arbitration agreem5ts & pre-dispute jo9t action waiv]s 7#a7 ,pre-dispute arbitration agreem5ts 7,a7 ,not)/&+ any o!r provision ( law1 no pre-dispute arbitration agreem5t ) respect to an individual "u ! age ( #ah is en=ceable ) reg>d to a dispute aris+ "u ?is ,act4 7,b7 ,not)/&+ any o!r provision ( law1 no pre-dispute arbitration agreem5t is en=ceable ) reg>d to a dispute aris+ "u ?is ,act conc]n+ a claim relat$ to g5d] or p>tn]-bas$ viol5ce or physical h>m4 7#b7 ,pre-dispute jo9t-action waiv]s ,not)/&+ any o!r provision ( law1 no pre-dispute jo9t-action waiv] ) respect to an individual "u ! age ( #ah is en=ceable ) reg>d to a dispute aris+ "u ?is ,act4 7#c7 ,def9itions ,= purposes ( ?is subsection3 7,a7 ,pre-dispute arbitration agreem5t ,! t]m pre-dispute arbitration agreem5t means any agreem5t to arbitrate a dispute t has n aris5 at ! "t ( ! mak+ ( ! agreem5t4 7,b7 ,pre-dispute jo9t-action waiv] ,! t]m pre-dispute jo9t-action waiv] means an agreem5t1 :e!r or n "p ( a pre-dispute arbitration agreem5t1 t w\ld prohibit or waive ! "r ( #a ( ! p>ties to ! agreem5t to p>ticipate 9 a jo9t1 class1 or collective action 9 a judicial1 arbitral1 adm9i/rative1 or o!r relat$ =um1 conc]n+ a dispute t has n yet aris5 at ! "t ( ! mak+ ( ! agreem5t4 7c7 ,"r to cure 7#a7 ,notice ,subject to p>agraph 7#c71 ) respect to a claim "u ?is section =-- 7,a7 injunctive relief2 or 7,b7 an action aga9/ a cov]$ entity or s]vice provid] t meets ! requirem5ts ( section #bji ( ?is ,act1 su* claim may be br\ght by a p]son or class ( p]sons if--prior to ass]t+ su* claim--! p]son or class or p]sons provides to ! cov]$ entity or s]vice provid] #de days' writt5 notice id5tify+ ! specific provisions ( ?is ,act ! p]son or class ( p]sons alleges h be5 or are be+ violat$4 7#b7 ,effect ( cure ,subject to p>agraph 7#c71 9 ! ev5t a cure is possible1 if )9 ! #de days ! cov]$ entity or s]vice provid] demon/rates to ! c\rt t x has cur$ ! notic$ violation or violations & provides ! p]son or class ( p]sons an express writt5 /atem5t t ! violation or violations has be5 cur$ & t no fur!r violations %all occur1 a claim = injunctive relief %all n be p]mitt$ & may be reasonably dismiss$4 7#c7 ,rule ( con/ruction ,! notice describ$ 9 p>agraph 7#a7 & ! reasonable dismissal 9 p>agraph 7#b7 %all n apply m ?an once to any alleg$ und]ly+ violation by ! same cov]$ entity4 7d7 ,dem& lett] ,if a p]son or a id5tifi$ memb]s ( a class ( p]sons repres5t$ by c\nsel 9 reg>d to an alleg$ violation or violations ( ! ,act & has correspond5ce s5t to a cov]$ entity or s]vice provid] by c\nsel alleg+ a violation or violations ( ! provisions ( ?is ,act & reque/s a monet>y paym5t1 su* correspond5ce %all include ! foll[+ language3 ,please visit ! website ( ! ,f$]al ,trade ,commission = a g5]al description ( y\r rights "u ! ,am]ican ,data ,privacy & ,protection ,act foll[$ by a hyp]l9k to ! webpage ( ! ,commission requir$ "u section #bja4 ,if su* correspond5ce does n include su* language & hyp]l9k1 a civil action br\ght "u ?is section by su* p]son or id5tifi$ memb]s ( ! class ( p]sons repres5t$ by c\nsel may be dismiss$ )\t prejudice & %all n be re9/at$ until su* p]son or p]sons has compli$ ) ?is subsection4 7e7 ,applicability 7#a7 ,9 g5]al ,?is section %all only apply to a claim alleg+ a violation ( section #ajb1 #ajd1 #bjb1 #bjc1 #bjd1 #bje7;a71 #bje7;b71 #bjf7;b77#c77;,c71 #bjg7;a71 #bjh7;a71 or #cjb1 or a regulation promulgat$ "u any su* section4 7#b7 ,exception ,?is section %all n apply to any claim aga9/ a cov]$ entity t has less ?an #be1jjj1jjj p] ye> 9 rev5ue1 collects1 processes1 or transf]s ! cov]$ data ( few] ?an #ej1jjj individuals1 & d]ives less ?an #ej p]c5t ( its rev5ue f transf]r+ cov]$ data4 #djd4 ,relation%ip to ,f$]al & ,/ate laws 7a7 ,f$]al law pres]vation 7#a7 ,9 g5]al ,no?+ 9 ?is ,act or a regulation promulgat$ "u ?is ,act may be con/ru$ to limit-- 7,a7 ! au?ority ( ! ,commission1 or any o!r ,executive ag5cy1 "u any o!r provision ( law2 7,b7 any requirem5t = a common c>ri] subject to section #fd4bjaa ( title #dg1 ,code ( ,f$]al ,regulations 7or any successor regulation7 reg>d+ in=mation security brea*es2 or 7,c7 any o!r provision ( ,f$]al law1 except z o!rwise provid$ 9 ?is ,act4 7#b7 ,antitru/ sav+s clause 7,a7 ,full application ( ! antitru/ law ,no?+ 9 ?is ,act may be con/ru$ to modify1 impair or sup]s$e ! op]ation ( ! antitru/ law or any o!r provision ( law4 7,b7 ,no immunity f ! antitru/ law ,no?+ 9 ! regulatory regime adopt$ by ?is ,act %all be con/ru$ z op]at+ to limit any law det]r+ anticompetitive conduct or dim9i%+ ! ne$ = full application ( ! antitru/ law4 ,no?+ 9 ?is ,act explicitly or implicitly precludes ! application ( ! antitru/ law4 7,c7 ,def9ition ( antitru/ law ,= purposes ( ?is section1 ! t]m antitru/ law has ! same mean+ z 9 subsection 7a7 ( ! fir/ section ( ! ,clayton ,act 7#ae ,u4,s4,c4 #ab71 except t su* t]m includes section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 to ! ext5t t su* section #e applies to unfair me?ods ( competition4 7#c7 ,applicability ( o!r privacy requirem5ts ,a cov]$ entity t is requir$ to comply ) title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq471 "p ,c ( title ,,xi ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq471 ! ,family ,educational ,rights & ,privacy ,act 7#bj ,u4,s4,c4 #abcb;g2 "p #ii ( title #cd1 ,code ( ,f$]al ,regulations7 to ! ext5t su* cov]$ entity is a s*ool z def9$ 9 #bj ,u4,s4,c4 #abcb;g7a77#c7 or #cd ,c4,f4,r4 #ii4a7;a71 section #ddd ( ! ,g5]al ,education ,provisions ,act 7commonly kn[n z ! ,family ,educational ,rights & ,privacy ,act ( #aigd7 7#bj ,u4,s4,c4 #abcb;g7 & "p #ii ( title #cd1 ,code ( ,f$]al ,regulations 7or any successor regulation71 ! ,confid5tiality ( ,alcohol & ,drug ,abuse ,pati5t ,records at #db ,u4,s4,c4 #bij;dd-#b & its implem5t+ regulations at #db ,,cfr "p #b1 ! ,g5etic ,in=mation ,non-discrim9ation ,act 7,,g9a71 or ! regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 & is 9 compliance ) ! data privacy requirem5ts ( su* regulations1 "p1 title1 or ,act 7z applicable71 %all be deem$ to be 9 compliance ) ! relat$ requirem5ts ( ?is ,act1 except = section #bjh1 solely & exclusively ) respect to data subject to ! requirem5ts ( su* regulations1 "p1 title1 or ,act4 ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance describ+ ! implem5tation ( ?is p>agraph4 7#d7 ,applicability ( o!r data security requirem5ts ,a cov]$ entity t is requir$ to comply ) title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq471 "p ,c ( title ,,xi ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq471 or ! regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 & is 9 compliance ) ! in=mation security requirem5ts ( su* regulations1 "p1 title1 or ,act 7z applicable71 %all be deem$ to be 9 compliance ) ! requirem5ts ( section #bjh1 solely & exclusively ) respect to data subject to ! requirem5ts ( su* regulations1 "p1 title1 or ,act4 ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance describ+ ! implem5tation ( ?is p>agraph4 7b7 ,preemption ( ,/ate laws 7#a7 ,9 g5]al ,no ,/ate or political subdivision ( a ,/ate may adopt1 ma9ta91 en=ce1 prescribe1 or cont9ue 9 effect any law1 regulation1 rule1 /&>d1 requirem5t1 or o!r provision hav+ ! =ce & effect ( law ( any ,/ate1 or political subdivision ( a ,/ate1 cov]$ by ! provisions ( ?is ,act1 or a rule1 regulation1 or requirem5t promulgat$ "u ?is ,act4 7#b7 ,/ate law pres]vation ,p>agraph 7#a7 may n be con/ru$ to preempt1 displace1 or supplant ! foll[+ ,/ate laws1 rules1 regulations1 or requirem5ts3 7,a7 ,consum] protection laws ( g5]al applicability1 su* z laws regulat+ deceptive1 unfair1 or unconscionable practices1 except t ! fact ( a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act may n be plead$ z an elem5t ( any violation ( su* a law4 7,b7 ,civil rights laws4 7,c7 ,provisions ( laws1 9 s f> z1 t gov]n ! privacy rights or o!r protections ( employees1 employee in=mation1 /ud5ts1 or /ud5t in=mation4 7,d7 ,laws t address notification requirem5ts 9 ! ev5t ( a data brea*4 7,e7 ,contract or tort law4 7,f7 ,crim9al laws4 7,g7 ,civil laws gov]n+ fraud1 !ft 7includ+ id5tity !ft71 unau?oriz$ access to in=mation or electronic devices1 unau?oriz$ use ( in=mation1 malici\s behavior1 or simil> provisions ( law4 7,h7 ,civil laws reg>d+ cyb]/alk+1 cyb]bully+1 noncons5sual pornography1 sexual h>assm5t1 *ild abuse mat]ial1 *ild pornography1 *ild abduction or attempt$ *ild abduction1 co]cion or enticem5t ( a *ild = sexual activity1 or *ild sex traffick+4 7,i7 ,public safety or sector specific laws unrelat$ to privacy or security4 7,j7 ,provisions ( law1 ins(> z su* provisions address public records1 crim9al ju/ice in=mation sy/ems1 arre/ records1 mug %ots1 conviction records1 or non-conviction records4 7,k7 ,provisions ( law1 ins(> z su* provisions address bank+ records1 f9ancial records1 tax records1 ,social ,security numb]s1 cr$it c>ds1 consum] & cr$it report+ & inve/igations1 cr$it repair1 cr$it cl9ics1 or *eck-ca%+ s]vices4 7,l7 ,provisions ( law1 ins(> z su* provisions address facial recognition or facial recognition te*nologies1 electronic surveillance1 wiretapp+1 or telephone monitor+4 7,m7 ,! ,biometric ,in=mation ,privacy ,act 7#gdj ,,icls #ad et seq47 & ! ,g5etic ,in=mation ,privacy ,act 7#daj ,,ilcs #eac et seq474 7,n7 ,provisions ( laws1 9 s f> z1 su* provisions to address unsolicit$ email or text messages1 telephone solicitation1 or call] id5tification4 7,o7 ,provisions ( laws1 9 s f> z1 su* provisions address heal? in=mation1 m$ical in=mation1 m$ical records1 ,,hiv /atus1 or ,,hiv te/+4 7,p7 ,provisions ( laws1 9 s f> z1 su* provisions p]ta9 to public heal? activities1 report+1 data1 or s]vices4 7,q7 ,provisions ( law1 ins(> z su* provisions address ! confid5tiality ( libr>y records4 7,r7 ,section #agih4aej ( ! ,cali=nia ,civil ,code 7z am5d$ on ,novemb] #c1 #bjbj by initiative ,proposition #bd1 ,section #af74 7,s7 ,laws p]ta9+ to ! use ( encryption z a means ( provid+ data security4 7#c7 ,,cppa en=cem5t ,not)/&+ any o!r provisions ( law1 ! ,cali=nia ,privacy ,protection ,ag5cy e/abli%$ "u #agih4aii4aj7;a7 ( ! ,cali=nia ,privacy ,rights ,act may en=ce ?is ,act1 9 ! same mann]1 x w\ld o!rwise en=ce ! ,cali=nia ,consum] ,privacy ,act1 ,section #agih4ajej et4 seq4 7#d7 ,nonapplication ( fcc privacy laws & regulations to c]ta9 cov]$ entities ,not)/&+ any o!r provision ( law1 sections #bbb1 #cch7;i71 & #fca ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea71 & any regulations & ord]s promulgat$ by ! ,f$]al ,communications ,commission "u any su* section1 d n apply to any cov]$ entity ) respect to ! collection1 process+1 transf]1 or security ( cov]$ data or its equival5t1 & ! relat$ privacy & data security activities ( a cov]$ entity t w\ld o!rwise be regulat$ "u su* sections %all be gov]n$ exclusively by ! provisions ( ?is ,act1 except =-- 7,a7 any em]g5cy s]vices1 z def9$ 9 section #g ( ! ,wireless ,communications & ,public ,safety ,act ( #aiii 7#dg ,u4,s4,c4 #fae;b72 7,b7 subsections 7b7 & 7g7 ( section #bbb ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb72 & 7,c7 any obligation ( an int]national treaty relat$ to ! ex*ange ( traffic implem5t$ & en=c$ by ! ,f$]al ,communications ,commission4 7c7 ,pres]vation ( common law or /atutory causes ( action = civil relief ,no?+ 9 ?is ,act1 nor any am5dm5t1 /&>d1 rule1 requirem5t1 assessm5t1 or regulation promulgat$ "u ?is ,act1 may be con/ru$ to preempt1 displace1 or supplant any ,f$]al or ,/ate common law rights or rem$ies1 or any /atute creat+ a rem$y = civil relief1 includ+ any cause ( action = p]sonal injury1 wrongful dea?1 prop]ty damage1 or o!r f9ancial1 physical1 reputational1 or psy*ological injury bas$ 9 neglig5ce1 /rict liability1 products liability1 failure to w>n1 an objectively (f5sive intrusion into ! private affairs or conc]ns ( ! individual1 or any o!r legal !ory ( liability "u any ,f$]al or ,/ate common law1 or any ,/ate /atutory law4 #dje4 ,sev]ability ,if any provision ( ?is ,act1 or ! application !re( to any p]son or circum/ance1 is held invalid1 ! rema9d] ( ?is ,act1 & ! application ( su* provision to o!r p]sons n simil>ly situat$ or to o!r circum/ances1 %all n be affect$ by ! invalidation4 #djf4 ,,coppa 7a7 ,9 g5]al ,no?+ 9 ?is ,act may be con/ru$ to relieve or *ange any obligation t a cov]$ entity or o!r p]son may h "u ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq474 7b7 ,updat$ regulations ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all am5d its rules issu$ pursuant to ! regulations promulgat$ by ! ,commission "u ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq47 to make ref]5ce to ! additional requirem5ts plac$ on cov]$ entities "u ?is ,act1 9 addition to ! requirem5ts "u ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih t may already apply to c]ta9 cov]$ entities4 #djg4 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to ! ,commission su* sums z may be necess>y to c>ry out ?is ,act4 #djh4 ,effective date ,?is ,act %all take effect on ! date t is #ahj days aft] ! date ( enactm5t ( ?is ,act4 ,decemb] #cj1 #bjbb,report$ ) an am5dm5t1 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union1 & ord]$ to be pr9t$