,,ii #aagth ,,congress #ast ,session ,s4 #bacd ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #ag1 #bjba ,mrs4 ,gillibrand 7for herself and ,mr4 ,brown7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish the ,data ,protection ,agency4 #a4 ,short title ,this ,act may be cited as the ,data ,protection ,act of #bjba4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term ,agency means the ,data ,protection ,agency established under section #c4 7#b7 ,anonymized data ,the term anonymized data means information-- 7,a7 that does not identify an individual2 and 7,b7 with respect to which there is no reasonable basis to believe that the information can be used on its own or in combination with other reasonably available information to identify an individual4 7#c7 ,automated decision system ,the term automated decision system means a computational process1 including one derived from machine learning1 statistics1 or other data processing or artificial intelligence techniques1 that makes a decision1 or facilitates human decision making4 7#d7 ,biometric information ,the term biometric information-- 7,a7 means information regarding the physiological or biological characteristics of an individual that may be used1 singly or in combination with each other or with other identifying data1 to establish the identity of an individual2 7,b7 includes-- 7i7 genetic data2 7ii7 imagery of the iris1 retina1 fingerprint1 face1 hand1 palm1 vein patterns1 and voice recordings1 from which an identifier template1 such as a faceprint1 a minutiae template1 or a voiceprint1 can be extracted2 7iii7 keystroke patterns or rhythms1 gait patterns or rhythms1 and sleep1 health1 or exercise data that contain identifying information2 and 7iv7 any mathematical code1 profile1 or algorithmic model derived from information regarding the physiological or biological characteristics of an individual2 7,c7 does not include information captured from a patient in a health care setting for a medical purpose or information collected1 used1 or stored for health care treatment1 payment1 or operations under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia72 and 7,d7 does not include an ,x-ray1 roentgen process1 computed tomography1 ,,mri1 ,,pet scan1 mammography1 or other image or film of the human anatomy used to diagnose1 prognose1 or treat an illness or other medical condition or to further validate scientific testing or screening4 7#e7 ,collect ,the term collect-- 7,a7 means buying1 renting1 gathering1 obtaining1 receiving1 or accessing any personal data by any means2 and 7,b7 includes-- 7i7 receiving personal data from an individual or device2 and 7ii7 creating1 deriving1 or inferring personal data by analyzing data about an individual or about groups of individuals similar to the individual4 7#f7 ,data aggregator ,the term data aggregator-- 7,a7 means any person that collects1 uses1 or shares1 in or affecting interstate commerce1 an amount of personal data that is not de minimis1 as well as entities related to that person by common ownership or corporate control2 and 7,b7 does not include an individual who collects1 uses1 or shares personal data solely for non-commercial reasons4 7#g7 ,device ,the term device means any physical object that-- 7,a7 is capable of connecting to the internet or other communication network2 or 7,b7 has computer processing capabilities that can collect1 send1 receive1 or store data4 7#h7 ,director ,the term ,director means the ,director of the ,data ,protection ,agency4 7#i7 ,electronic data ,the term electronic data means any information that is in an electronic or digital format or any electronic or digital reference that contains information about an individual or device4 7#aj7 ,federal privacy law ,the term ,federal privacy law means the provisions of this ,act1 any other rule or order prescribed by the ,agency under this ,act1 and the following laws 7including any amendments made to such laws73 7,a7 ,title ,v of the ,gramm-,leach-,bliley ,act 7,public ,law #ajf-ajb2 #aac ,stat4 #acch74 7,b7 ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq474 7,c7 ,the ,telemarketing and ,consumer ,fraud and ,abuse ,prevention ,act 7#ae ,u4,s4,c4 #faja et seq474 7,d7 ,the ,fair and ,accurate ,credit ,transactions ,act of #bjjc 7,public ,law #ajh-aei2 #aag ,stat4 #aieb74 7,e7 ,the ,,can-,,spam ,act of #bjjc 7#ae ,u4,s4,c4 #ggja et seq474 7,f7 ,sections #bbb1 #bbg1 #cch7l71 #fca1 and #gje of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb1 #bbg1 #cch7l71 #eea1 #gje74 7,g7 ,the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq474 7,h7 ,the ,right to ,financial ,privacy ,act of #aigh 7#ab ,u4,s4,c4 #cdja et seq474 7,i7 ,the ,identity ,theft ,assumption and ,deterrence ,act of #aiih 7,public ,law #aje-cah2 #aag ,stat4 #cjjg74 7,j7 ,the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abba et seq47 7commonly known as the ,family ,educational ,rights and ,privacy ,act of #aigd74 7,k7 ,section #eeb;a of title #e1 ,united ,states ,code4 7,l7 ,the ,e-,government ,act of #bjjb 7,public ,law #ajg-cdg2 #aaf ,stat4 #bhii74 7,m7 ,the ,computer ,security ,act of #aihg 7#dj ,u4,s4,c4 #adda note74 7,n7 ,the ,employee ,polygraph ,protection ,act of #aihh 7#bi ,u4,s4,c4 #bjja et seq474 7,o7 ,the ,communications ,assistance for ,law ,enforcement ,act 7,public ,law #ajc-dad2 #ajh ,stat4 #dbgi74 7,p7 ,sections #ajbh;,a1 #ajcj1 #ahja1 #bgaj1 and #bgba and chapter #aai1 of title #ah1 ,united ,states ,code4 7,q7 ,the ,genetic ,information ,nondiscrimination ,act of #bjjh 7,public ,law #aaj-bcc2 #abb ,stat4 #hha74 7,r7 ,the ,taxpayer ,browsing ,protection ,act 7,public ,law #aje-ce2 #aaa ,stat4 #aajd74 7,s7 ,the ,privacy ,protection ,act of #aihj 7#db ,u4,s4,c4 #bjjj;aa et seq474 7,t7 ,the ,cable ,communications ,policy ,act of #aihd 7,public ,law #ih-edi2 #ih ,stat4 #bggi74 7,u7 ,the ,do-,not-,call ,implementation ,act 7,public ,law #ajh-aj2 #aag ,stat4 #eeg74 7,v7 ,the ,wireless ,communications and ,public ,safety ,act of #aiii 7,public ,law #ajf-ha2 #aac ,stat4 #abhf74 7,w7 ,title ,,xxx of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #cjj;jj et seq474 7#aa7 ,high-risk data practice ,the term high-risk data practice means an action by a data aggregator that involves-- 7,a7 the use of an automated decision system2 7,b7 the processing of data in a manner that involves an individual's protected class1 familial status1 lawful source of income1 financial status such as the individual's income or assets71 veteran status1 criminal convictions or arrests1 citizenship1 past1 present1 or future physical or mental health or condition1 psychological states1 or any other factor used as a proxy for identifying any of these characteristics2 7,c7 a systematic processing of publicly accessible data on a large scale2 7,d7 processing involving the use of new technologies1 or combinations of technologies1 that causes or materially contributes to privacy harm2 7,e7 decisions about an individual's access to a product1 service1 opportunity1 or benefit which is based to any extent on automated decision system processing2 7,f7 any profiling of individuals on a large scale2 7,g7 any processing of biometric information for the purpose of uniquely identifying an individual1 with the exception of one-to-one biometric authentication2 7,h7 combining1 comparing1 or matching personal data obtained from multiple sources2 7,i7 processing which involves an individual's precise geolocation2 7,j7 the processing of personal data of children and teens under #ag or other vulnerable individuals such as the elderly1 people with disabilities1 and other groups known to be susceptible for exploitation for marketing purposes1 profiling1 or automated processing2 or 7,k7 consumer scoring or other business practices that pertain to the eligibility of an individual1 and related terms1 rights1 benefits1 and privileges1 for employment 7including hiring1 firing1 promotion1 demotion1 and compensation71 credit1 insurance1 housing1 education1 professional certification1 or the provision of health care and related services4 7#ab7 ,high-risk data practice impact evaluation ,the term high-risk data practice impact evaluation means a study conducted after deployment of a high-risk data practice that includes1 at a minimum-- 7,a7 an evaluation of a high-risk data practice's accuracy1 disparate impacts on the basis of protected class1 and privacy harms2 7,b7 an evaluation of the effectiveness of measures taken to minimize risks as outlined in any prior high-risk data practice risk assessments2 and 7,c7 recommended measures to further minimize risks to accuracy1 disparate impacts on the basis of protected class1 and privacy harms4 7#ac7 ,high-risk data practice risk assessment ,the term high-risk data practice risk assessment means a study evaluating a high-risk data practice and the high-risk data practice's development process1 including the design and training data of the high-risk data practice1 if applicable1 for likelihood and severity of risks to accuracy1 bias1 discrimination1 and privacy harms that includes1 at a minimum-- 7,a7 a detailed description of the high-risk data practice1 including-- 7i7 its design and methodologies2 7ii7 training data characteristics2 7iii7 data2 and 7iv7 purpose2 7,b7 an assessment of the relative benefits and costs of the high-risk data practice in light of its purpose1 potential unintended consequences1 and taking into account relevant factors1 including-- 7i7 data minimization practices2 7ii7 the duration and methods for which personal data and the results of the high-risk data practice are stored2 7iii7 what information about the high-risk data practice is available to individuals2 7iv7 the extent to which individuals have access to the results of the high-risk data practice and may correct or object to its results2 and 7v7 the recipients of the results of the high-risk data practice2 7,c7 an assessment of the risks of privacy harm posed by the high-risk data practice and the risks that the high-risk data practice may result in or contribute to inaccurate1 biased1 or discriminatory decisions impacting individuals or groups of individuals2 and 7,d7 the decision to accept1 reject1 or mitigate and minimize risks and the measures a data aggregator will employ including to minimize the risks described in subparagraph7,c71 including technological and physical safeguards4 7#ad7 ,individual ,the term individual means a natural person4 7#ae7 ,person ,the term person means an individual1 a local1 ,state1 or ,federal governmental entity1 a partnership1 a company1 a corporation1 an association 7incorporated or unincorporated71 a trust1 an estate1 a cooperative organization1 another entity1 or any other organization or group of such entities acting in concert4 7#af7 ,personal data ,the term personal data means electronic data that1 alone or in combination with other data-- 7,a7 identifies1 relates to1 describes1 is capable of being associated with1 or could reasonably be linked1 directly or indirectly1 with a particular individual1 household1 or device2 or 7,b7 could be used to determine that an individual or household is part of a protected class4 7#ag7 ,precise geolocation ,the term precise geolocation means any data that is derived from a device and that is used or intended to be used to locate an individual within a geographic area that is equal to or less than the area of a circle with a radius of one thousand1 eight hundred and fifty 7#a1hej7 feet4 7#ah7 ,privacy harm ,the term privacy harm means an adverse consequence1 or a potential adverse consequence1 to an individual1 a group of individuals1 or society caused1 in whole or in part1 by the collection1 processing1 or sharing of personal data1 including-- 7,a7 direct or indirect financial loss or economic harm1 including financial loss or economic harm arising from fraudulent activities or data security breaches2 7,b7 physical harm1 harassment1 or a threat to an individual or property2 7,c7 psychological harm1 including anxiety1 embarrassment1 fear1 other trauma1 stigmatization1 reputational harm1 or the revealing or exposing of an individual1 or a characteristic of an individual1 in an unexpected way2 7,d7 an adverse outcome or decision1 including relating to the eligibility of an individual for the rights1 benefits1 or privileges in credit and insurance 7including the denial of an application or obtaining less favorable terms71 housing1 education1 professional certification1 employment 7including hiring1 firing1 promotion1 demotion1 and compensation71 or the provision of health care and related services2 7,e7 discrimination1 including both differential treatment on the basis of a protected class and disparate impact on a protected class2 7,f7 the chilling of free expression or action of an individual1 or society generally1 due to perceived or actual pervasive and excessive collection1 processing1 or sharing of personal data2 7,g7 the use of information technology to covertly influence an individual's decision-making1 by targeting and exploiting decision-making vulnerabilities2 and 7,h7 any other adverse consequence1 or potential adverse consequence1 prohibited by or defined by ,federal privacy laws2 provisions of ,federal civil rights laws related to the processing of personal information2 provisions of ,federal consumer protection laws related to the processing of personal information2 the ,first ,amendment2 and other constitutional rights protecting privacy4 7#ai7 ,process ,the term process means to perform an operation or set of operations on personal data1 either manually or by automated means1 including collecting1 recording1 organizing1 structuring1 storing1 adapting or altering1 retrieving1 consulting1 using1 disclosing by transmission1 sorting1 classifying1 disseminating or otherwise making available1 aligning or combining1 restricting1 erasing or destroying4 7#bj7 ,profile ,the term profile means the use of an automated decision system to process data 7including personal data and other data7 to derive1 infer1 predict or evaluate information about an individual or group1 such as the processing of data to analyze or predict an individual's identity1 attributes1 interests or behavior4 7#ba7 ,protected class ,the term protected class means the actual or perceived race1 color1 ethnicity1 national origin1 religion1 sex1 gender1 gender identity or expression1 sexual orientation1 familial status1 biometric information1 genetic information1 or disability of an individual or a group of individuals4 7#bb7 ,service provider ,the term service provider means a data aggregator that collects1 uses1 or shares personal data only on behalf of another data aggregator in order to carry out a permissible purpose1 and only to the extent of such activity4 7#bc7 ,share ,the term share means disseminating1 making available1 transferring1 or otherwise communicating orally1 in writing1 or by electronic or other means1 personal data4 #c4 ,establishment of the data protection agency 7a7 ,agency established ,there is established in the ,executive branch an independent agency to be known as the ,data ,protection ,agency1 which shall regulate high-risk data practices and the collection1 processing1 and sharing of personal data4 7b7 ,director and deputy director 7#a7 ,in general ,there is established a position of the ,director of the ,data ,protection ,agency 7referred to in this ,act as the ,director71 who shall serve as the head of the ,agency4 7#b7 ,appointment ,subject to paragraph 7#c71 the ,director shall be appointed by the ,president1 by and with the advice and consent of the ,senate4 7#c7 ,qualification ,the ,president shall nominate the ,director from among members of the public at large who are well qualified for service at the ,agency based on their knowledge and expertise in-- 7,a7 technology2 7,b7 protection of personal data2 7,c7 civil rights and liberties2 7,d7 law2 and 7,e7 social sciences4 7#d7 ,compensation 7,a7 ,in general ,the ,director shall be compensated at the rate prescribed for level ,,ii of the ,executive ,schedule under section #ecac of title #e1 ,united ,states ,code4 7,b7 ,conforming amendment ,section #ecac of title #e1 ,united ,states ,code1 is amended by inserting after the item relating to the ,federal ,transit ,administrator1 the following new item3 ,director of the ,data ,protection ,agency44 7#e7 ,deputy director ,there is established the position of ,deputy ,director1 who shall-- 7,a7 be appointed by the ,director2 and 7,b7 serve as the acting ,director in the absence or unavailability of the ,director4 7#f7 ,acting director ,in the event of the death1 resignation1 sickness1 or absence of the ,director1 the ,president shall designate the ,deputy ,director to serve as acting ,director until the return of the ,director1 or the appointment of a successor pursuant to subsection 7b74 7c7 ,term 7#a7 ,in general ,the ,director shall serve for a term of #e years4 7#b7 ,expiration of term ,an individual may serve as ,director after the expiration of the term for which appointed until a successor has been appointed and qualified4 7#c7 ,removal ,the ,president may remove the ,director at will4 7#d7 ,vacancy ,a vacancy in the position of ,director that occurs before the expiration of the term for which a ,director was appointed shall be filled in the manner established under paragraph 7#b71 and the ,director appointed to fill such vacancy shall be appointed only for the remainder of such term4 7d7 ,service restriction ,no ,director or ,deputy ,director may engage in any other employment during the period of service of such person as ,director or ,deputy ,director4 7e7 ,offices ,the principal office of the ,agency shall be in the ,district of ,columbia4 ,the ,director may establish regional offices of the ,agency4 7f7 ,applicability of other laws ,except as otherwise provided expressly by law1 all ,federal laws dealing with public or ,federal contracts1 property1 works1 officers1 employees1 budgets1 or funds1 including the provisions of chapter #e and #g of title #e1 ,united ,states ,codes1 shall apply to the exercise of the powers of the ,agency4 #d4 ,executive and administrative powers 7a7 ,powers of the agency ,the ,director is authorized to establish the general powers of the ,agency with respect to all executive and administrative functions1 including-- 7#a7 the establishment of rules for conducting the general business of the ,agency1 in a manner not inconsistent with this ,act2 7#b7 to bind the ,agency and enter into contracts2 7#c7 directing the establishment and maintenance of divisions or other offices within the ,agency1 in order to carry out the responsibilities under this ,act and ,federal privacy law1 and to satisfy the requirements of applicable law2 7#d7 to coordinate and oversee the operation of all administrative1 enforcement1 and research activities of the ,agency2 7#e7 to adopt and use a seal2 7#f7 to determine the character of and necessity for the obligations by the ,agency2 7#g7 the appointment and supervision of personnel employed by the ,agency2 7#h7 the distribution of business among personnel appointed and supervised by the ,agency2 7#i7 the use and expenditure of funds2 7#aj7 implementing this ,act and ,federal privacy laws through rules1 orders1 guidance1 interpretations1 statements of policy1 examinations1 and enforcement actions2 and 7#aa7 performing such other functions as may be authorized or required by law4 7b7 ,delegation of authority ,the ,director may delegate to any duly authorized employee1 representative1 or agent any power vested in the ,agency by law4 7c7 ,office responsibilities ,notwithstanding subsections 7a7 and 7b71 section #c7;a71 and any other provision of law1 with respect to the specific functional units and offices described in section #e7;b71 the ,director-- 7#a7 shall ensure that such functional units and offices perform the functions1 duties1 and coordination assigned to them under the applicable provision of section #e2 and 7#b7 may not reorganize or rename such units or offices in a manner not provided for under the applicable provisions of section #e4 7d7 ,autonomy of agency ,no officer or agency of the ,united ,states shall have any authority to require the ,director or any other officer of the ,agency to submit legislative recommendations1 or testimony or comments on legislation1 to any officer or agency of the ,united ,states for approval1 comments1 or review prior to the submission of such recommendations1 testimony1 or comments to the ,congress1 if such recommendations1 testimony1 or comments to the ,congress include a statement indicating that the views expressed therein are those of the ,director or such officer1 and do not necessarily reflect the views of the ,president4 #e4 ,administration 7a7 ,personnel 7#a7 ,appointment 7,a7 ,in general ,the ,director may fix the number of1 and appoint and direct1 all employees of the ,agency1 in accordance with the applicable provisions of title #e1 ,united ,states ,code4 7,b7 ,employees of the agency ,the ,director may employ attorneys1 compliance examiners1 compliance supervision analysts1 economists1 technologists1 data scientists1 designers1 ethicists1 privacy experts1 statisticians1 and other employees as may be deemed necessary to conduct the business of the ,agency4 ,unless otherwise provided expressly by law1 any individual appointed under this section shall be an employee1 as defined in section #baje of title #e1 ,united ,states ,code1 and subject to the provisions of such title and other laws generally applicable to the employees of an ,executive agency4 7,c7 ,waiver authority 7i7 ,in general ,in making any appointment under subparagraph 7,a71 the ,director may waive the requirements of chapter #cc of title #e1 ,united ,states ,code1 and the regulations implementing such chapter1 to the extent necessary to appoint employees on terms and conditions that are consistent with those set forth in section #aa7a7 of the ,federal ,reserve ,act 7#ab ,u4,s4,c4 #bdh7a771 while providing for-- 7,i7 fair1 credible1 and transparent methods of establishing qualification requirements for1 recruitment for1 and appointments to positions2 7,,ii7 fair and open competition and equitable treatment in the consideration and selection of individuals to positions2 and 7,,iii7 fair1 credible1 and transparent methods of assigning1 reassigning1 detailing1 transferring1 and promoting employees4 7ii7 ,veterans preferences ,in implementing this subparagraph1 the ,director shall comply with the provisions of section #bcjb7;b77#aa7 of title #e1 ,united ,states ,code1 regarding veterans' preference requirements1 in a manner consistent with that in which such provisions are applied under chapter #cc of that title4 ,the authority under this subparagraph to waive the requirements of that chapter #cc shall expire #e years after the date of enactment of this ,act4 7,d7 ,duty to provide adequate staffing ,the ,director shall ensure that the specific functional units and offices established under section #e1 as well as other units and offices with supervisory1 rulemaking1 and enforcement duties1 are provided with sufficient staff to carry out the functions1 duties1 and coordination of those units and offices4 7,e7 ,limitation on political appointees 7i7 ,in general ,in appointing employees of the ,agency who are political appointees1 the ,director shall ensure that the number and duties of such political appointees are as similar as possible to those of other ,federal regulatory agencies4 7ii7 ,political appointees defined ,for purposes of this subparagraph1 the term political appointee means an employee who holds-- 7,i7 a position which has been excepted from the competitive service by reason of its confidential1 policy-determining1 policymaking1 or policy-advocating character2 7,,ii7 a position in the ,senior ,executive ,service as a noncareer appointee 7as such term is defined in section #cacb7;a7 of title #e1 ,united ,states ,code72 or 7,,iii7 a position under the ,executive ,schedule 7subchapter ,,ii of chapter #ec of title #e1 ,united ,states ,code74 7#b7 ,compensation ,notwithstanding any otherwise applicable provision of title #e1 ,united ,states ,code1 concerning compensation1 including the provisions of chapter #ea and chapter #ec1 the following provisions shall apply with respect to employees of the ,agency3 7,a7 ,the rates of basic pay for all employees of the ,agency may be set and adjusted by the ,director4 7,b7 ,the ,director shall at all times provide compensation 7including benefits7 to each class of employees that1 at a minimum1 are comparable to the compensation and benefits then being provided by the ,board of ,governors of the ,federal ,reserve ,system or the ,bureau of ,consumer ,financial ,protection for the corresponding class of employees4 7,c7 ,all such employees shall be compensated 7including benefits7 on terms and conditions that are consistent with the terms and conditions set forth in section #aa7l7 of the ,federal ,reserve ,act 7#ab ,u4,s4,c4 #bdh7l774 7#c7 ,labor-management relations ,chapter #ga of title #e1 ,united ,states ,code1 shall apply to the ,agency and the employees of the ,agency4 7b7 ,specific functional units 7#a7 ,office of civil rights ,the ,director shall establish an office whose powers and duties shall include-- 7,a7 providing oversight and enforcement of this ,act1 rules and orders promulgated under this ,act1 and ,federal privacy laws to ensure that the collection1 processing1 and sharing of personal data is fair1 equitable1 and non-discriminatory in treatment and effect2 7,b7 developing1 establishing1 and promoting data processing practices that affirmatively further equal opportunity to and expand access to housing1 employment1 credit1 insurance1 education1 healthcare1 and other aspects of interstate commerce2 7,c7 coordinating the ,agency's civil rights efforts with other ,federal agencies and ,state regulators1 as appropriate1 to promote consistent1 efficient1 and effective enforcement of ,federal civil rights laws2 7,d7 working with civil rights advocates1 privacy organizations1 and data aggregators on the promotion of compliance with the civil rights provisions under this ,act1 rules and orders promulgated under this ,act1 and ,federal privacy laws2 7,e7 liaising with communities and consumers impacted by practices regulated by this ,act and the ,agency1 to ensure that their needs and views are appropriately taken into account2 7,f7 providing annual reports to ,congress on the efforts of the ,agency to fulfill its civil rights mandate2 and 7,g7 such additional powers and duties as the ,director may determine are appropriate4 7#b7 ,research ,the ,director shall establish a unit whose functions shall include researching1 analyzing1 assessing1 and reporting on-- 7,a7 the collection and processing of personal data1 including automated decision systems2 7,b7 the collection and processing of personal data by government agencies1 including contracts between government agencies and data aggregators2 and 7,c7 unfair1 deceptive1 or discriminatory outcomes that result or are likely to result from the use of automated decision systems1 including disparate treatment or disparate impact on the basis of protected class or proxies for protected class4 7#c7 ,collecting and tracking complaints 7,a7 ,in general 7i7 ,establishment of unit ,the ,director shall establish a unit1 the functions of which shall include identifying and facilitating the development of best practices for consumers to file a complaint1 and establishing a single toll-free telephone number1 a publicly available website1 and a publicly available database1 or utilizing an existing publicly available database1 to facilitate the centralized collection of1 monitoring of1 and response to complaints regarding the collection1 processing1 and sharing of personal data4 7ii7 ,website requirements ,the ,director shall ensure that-- 7,i7 the landing page of the main website of the ,agency contains a clear and conspicuous hyperlink to the complaint database described in clause 7i7 and shall ensure that such database is user-friendly and in plain writing1 as that term is defined in section #c of the ,plain ,writing ,act of #bjaj 7#e ,u4,s4,c4 #cja note72 and 7,,ii7 that all information on the website or the database that explains how a complaint with the ,agency1 as well as reports of the ,agency with respect to information contained in that database1 shall be provided in each of the #e most commonly spoken languages1 other than ,english1 in the ,united ,states1 as determined by the ,bureau of the ,census on an ongoing basis1 and in formats accessible to individuals with hearing or vision impairments4 7,b7 ,public availability of information 7i7 ,in general ,the ,director shall-- 7,i7 make all complaints available to the public on a website of the ,agency2 7,,ii7 place a clear and conspicuous hyperlink on the landing page of the main website of the ,agency to the website described under subclause 7,i72 and 7,,iii7 ensure that such website-- 7aa7 is searchable and sortable by an data aggregator2 and 7bb7 is user-friendly and written in plain language4 7ii7 ,removal of personal data ,in making the information described under clause 7i7 available to the public1 the ,director shall remove all personal data4 7c7 ,agency ombudsman 7#a7 ,establishment required ,the ,director shall appoint an ombudsman4 7#b7 ,duties of ombudsman ,the ombudsman appointed in accordance with paragraph 7#a7 shall-- 7,a7 act as a liaison between the ,agency and any affected person with respect to any problem that such person may have in dealing with the ,agency1 resulting from the regulatory activities of the ,agency2 and 7,b7 assure that safeguards exist to encourage complainants to come forward and preserve confidentiality4 #f4 ,coordination ,the ,agency shall coordinate with the ,consumer ,financial ,protection ,bureau1 the ,federal ,communications ,commission1 the ,federal ,trade ,commission1 the ,department of ,commerce1 the ,department of ,health and ,human ,services1 the ,department of ,housing and ,urban ,development1 the ,department of ,education1 the ,equal ,employment ,opportunity ,commission1 the ,national ,security ,agency1 the ,national ,institute of ,standards and ,technology1 the ,white ,house ,office of ,science and ,technology ,policy1 the ,cybersecurity and ,infrastructure ,security ,agency1 and other ,federal agencies and ,state regulators1 as appropriate1 to promote consistent regulatory treatment of personal data4 #g4 ,appearances before and reports to congress 7a7 ,appearances before congress ,the ,director of the ,agency shall appear before ,congress at semi-annual hearings regarding the reports required under subsection 7b74 7b7 ,reports required ,the ,agency shall1 concurrent with each semi-annual hearing referred to in subsection 7a71 prepare and submit to the ,president and ,congress1 a report1 beginning with the session following the designated transfer date1 and shall publish such report on the website of the ,agency4 7c7 ,contents ,the reports required by subsection 7b7 shall include-- 7#a7 a discussion of the significant problems faced by persons in exercising their rights under this ,act and ,federal privacy laws2 7#b7 a justification of the budget request of the previous year2 7#c7 a list of the significant rules and orders adopted by the ,agency1 as well as other significant initiatives conducted by the ,agency1 during the preceding year and the plan of the ,agency for rules1 orders1 or other initiatives to be undertaken during the upcoming period2 7#d7 an analysis of complaints about practices relating to the collection1 processing1 or sharing of personal data that the ,agency has received and collected in its central database on complaints during the preceding year2 7#e7 a list1 with a brief statement of the issues1 of the public supervisory and enforcement actions to which the ,agency was a party during the preceding year2 7#f7 the actions taken regarding rules1 orders1 and supervisory actions with respect to data aggregators2 7#g7 an assessment of significant actions by ,state attorneys general or ,state regulators relating to this ,act or other ,federal privacy laws2 7#h7 an analysis of the efforts of the ,agency to fulfill the civil rights mandate of the ,agency2 and 7#i7 an analysis of the efforts of the ,agency to increase workforce and contracting diversity4 #h4 ,funding2 penalties and fines 7a7 ,funding 7#a7 ,assessments1 fees1 charges 7,a7 ,general authority ,the ,director may collect an assessment1 fee1 or other charge from a data aggregator that has annual gross revenues that exceed #be1jjj1jjj or annually collects1 uses1 or shares1 alone or in combination1 the personal data of #ej1jjj or more individuals1 households1 or devices4 7,b7 ,determination of amount ,in establishing the amount of any assessment1 fee1 or charge collected from a data aggregator under this section1 the ,director may take into account any factor that the ,director determines is appropriate4 7#b7 ,authority of director ,the ,director shall have sole authority to determine the manner in which the obligations of the ,agency shall be incurred and its disbursements and expenses allowed and paid1 in accordance with this section1 except as provided in chapter #ga of title #e1 ,united ,states ,code 7with respect to compensation74 7b7 ,data protection agency fund 7#a7 ,separate fund in federal reserve established ,there is established in the ,federal ,reserve a separate fund1 to be known as the ,data ,protection ,agency ,fund 7referred to in this section as the ,agency ,fund74 ,the ,agency ,fund shall be maintained and established at a ,federal reserve bank1 in accordance with such requirements as the ,board of ,governors may impose4 7#b7 ,fund receipts ,all amounts transferred to the ,agency under subsection 7a7 shall be deposited into the ,agency ,fund4 7#c7 ,investment authority 7,a7 ,amounts in agency fund may be invested ,the ,agency may request the ,board of ,governors to direct the investment of the portion of the ,agency ,fund that is not1 in the judgment of the ,agency1 required to meet the current needs of the ,agency4 7,b7 ,eligible investments ,investments authorized by this paragraph shall be made in obligations of the ,united ,states or obligations that are guaranteed as to principal and interest by the ,united ,states1 with maturities suitable to the needs of the ,agency ,fund1 as determined by the ,agency4 7,c7 ,interest and proceeds credited ,the interest on1 and the proceeds from the sale or redemption of1 any obligations held in the ,agency ,fund shall be credited to the ,agency ,fund4 7c7 ,use of funds 7#a7 ,in general ,funds obtained by1 transferred to1 or credited to the ,agency ,fund shall be immediately available to the ,agency and under the control of the ,director1 and shall remain available until expended1 to pay the expenses of the ,agency in carrying out its duties and responsibilities4 ,the compensation of the ,director and other employees of the ,agency and all other expenses thereof may be paid from1 obtained by1 transferred to1 or credited to the ,agency ,fund under this section4 7#b7 ,funds that are not government funds ,funds obtained by or transferred to the ,agency ,fund shall not be construed to be ,government funds or appropriated monies4 7#c7 ,amounts not subject to apportionment ,notwithstanding any other provision of law1 amounts in the ,agency ,fund and in the ,civil ,penalty ,fund established under subsection 7d7 shall not be subject to apportionment for purposes of chapter #ae of title #ca1 ,united ,states ,code1 or under any other authority4 7d7 ,penalties and fines 7#a7 ,establishment of victims relief fund ,there is established in the ,federal ,reserve a separate fund1 to be known as the ,data ,protection ,civil ,penalty ,fund 7referred to in this section as the ,civil ,penalty ,fund74 ,the ,civil ,penalty ,fund shall be maintained and established at a ,federal reserve bank1 in accordance with such requirements as the ,board of ,governors may impose4 ,if the ,agency obtains a civil penalty against any person in any judicial or administrative action under ,federal laws1 the ,agency shall deposit into the ,civil ,penalty ,fund1 the amount of the penalty collected4 7#b7 ,payment to victims ,amounts in the ,civil ,penalty ,fund shall be available to the ,agency1 without fiscal year limitation1 for payments to the victims of activities for which civil penalties have been imposed under this ,act and for other violations of other ,federal privacy laws4 ,if individual victims can be identified through reasonable effort1 and the distributions are sufficiently large to make individual distributions economically viable1 penalties should be distributed directly to individual victims4 ,to the extent that individuals cannot be located or such redress1 payments or compensation1 or other monetary relief are otherwise not practicable or economically viable1 the ,agency may-- 7,a7 use such funds for the purpose of consumer or business education relating to data protection or for the purpose of engaging in technological research that the ,agency considers necessary to enforce this ,act and ,federal privacy laws2 and 7,b7 utilize a cy-pres approach to distribute funds in order to advance data protection and privacy in the ,united ,states4 ,the ,agency may identify recipients1 including charitable and civil society organizations1 whose interests reasonable approximate those of the victims of the activities for which civil penalties have been imposed and distribute funds from the ,civil ,penalty ,fund to those recipients4 #i4 ,purpose1 objectives1 and functions 7a7 ,purpose ,the ,agency shall seek to protect individuals' privacy1 prevent and remediate privacy harms1 prevent1 remediate1 and reduce discrimination on the basis of protected class through the processing of personal information1 including both differential treatment on the basis of a protected class and disparate impact on a protected class1 and limit the collection1 processing1 and sharing of personal data2 and is authorized to exercise its authorities under this ,act for such purposes4 7b7 ,objectives ,the ,agency is authorized to exercise its authorities under this ,act to-- 7#a7 protect individuals from violations of this ,act1 other ,federal privacy laws1 or rules and orders issued under this ,act2 7#b7 promote and affirmatively further equal opportunity in all aspects of economic life as it relates to the fair and non-discriminatory processing of personal information2 7#c7 oversee the use of high-risk data practices2 7#d7 promote the minimization of collection of personal data for commercial purposes2 7#e7 prevent and remediate privacy harms2 and 7#f7 ensure that ,federal privacy law is enforced consistently and in order to protect individuals' privacy4 7c7 ,functions ,the primary functions of the ,agency are-- 7#a7 providing leadership and coordination to the efforts of all ,federal departments and agencies to enforce all ,federal statutes1 ,executive orders1 regulations and policies which involve privacy or data protection2 7#b7 maximizing effort1 promoting efficiency1 and eliminating conflict1 competition1 duplication1 and inconsistency among the operations1 functions1 and jurisdictions of ,federal departments and agencies responsible for privacy or data protection1 and data protection rights and standards2 7#c7 providing active leadership1 guidance1 education1 and appropriate assistance to private sector businesses1 organizations1 groups1 institutions1 and individuals regarding privacy and data protection rights and standards2 7#d7 requiring and overseeing ex-ante high-risk data practice risk assessments and ex-post high-risk data practice impact evaluations to advance fair and just data practices2 7#e7 protecting individuals and groups of individuals from privacy harms2 7#f7 examining the social1 ethical1 economic1 and civil rights impacts of data collection and processing practices and proposing remedies2 7#g7 protecting civil rights1 combating unlawful discrimination1 and affirmatively furthering equal opportunity as they relate to the processing of personal information2 7#h7 ensuring that high-risk data privacy practices are fair1 just1 non-deceptive1 and do not discriminate against a protected class2 7#i7 collecting1 researching1 and responding to complaints2 7#aj7 developing model privacy and data protection standards1 guidelines1 and policies for use by the private sector2 and 7#aa7 enforcing other privacy statutes and rules as authorized by ,congress4 #aj4 ,rulemaking authority 7a7 ,in general ,the ,agency is authorized to exercise its authorities under this ,act to administer1 enforce1 and otherwise implement the provisions of this ,act and ,federal privacy law4 7b7 ,rulemaking1 orders1 and guidance 7#a7 ,general authority ,the ,director may prescribe rules and issue orders and guidance1 as may be necessary or appropriate to enable the ,agency to administer and carry out the purposes and objectives of this ,act and other ,federal privacy laws1 and to prevent evasions of this ,act and other ,federal privacy laws4 7#b7 ,regulations ,the ,agency shall issue such regulations1 after notice and comment in accordance with section #eec of title #e1 ,united ,states ,code1 as may be necessary to carry out this ,act4 ,the ,agency shall prescribe rules applicable to a data aggregator or service provider identifying-- 7,a7 high-risk data practices in connection with the collection1 processing1 or sharing of personal data1 which may include requirements for the purpose of auditing1 preventing1 or restricting such acts or practices2 7,b7 acts or practices in connection with the collection1 processing1 or sharing of personal data that causes or are likely to cause privacy harm to individuals or groups of individuals1 which may include requirements for the purpose of preventing or restricting such acts or practices2 7,c7 unlawful1 unfair1 deceptive1 abusive1 or discriminatory acts or practices in connection with the collection1 processing1 or sharing of personal data1 which may include requirements for the purpose of preventing or restricting such acts or practices1 for the purpose of preventing disparate impacts on the basis of protected class1 or for the purpose of affirmatively furthering equal opportunity2 7,d7 rights that data aggregators must provide to individuals1 including the right to access and correct1 limit the processing of1 and request deletion of the individual's personal data2 and 7,e7 obligations on data aggregators1 including transparency about business practices1 data collection limitations1 processing and disclosure limitations1 purpose specification and legal basis for processing requirements1 accountability requirements1 confidentiality and security requirements1 and data accuracy requirements4 7#c7 ,no limitation ,rules prescribed under this section shall not limit the authority of the ,agency to administer1 enforce1 and otherwise implement the provisions of this ,act and ,federal privacy law4 7#d7 ,standards for rulemaking ,in prescribing a rule under this ,act or ,federal privacy laws-- 7,a7 the ,agency shall consider the impact of proposed rules on an individual or groups of individuals2 7,b7 the ,agency may provide that a rule shall only apply to a subcategory of data aggregators1 as defined by the ,agency2 and 7,c7 the ,agency shall consult with civil society groups and members of the public4 7#e7 ,rule of construction ,nothing in this paragraph may be construed to require the ,agency to engage in cost-benefit analysis or submit a rulemaking for review to the ,president or the ,office of ,management and ,budget4 7#f7 ,standard for review ,if this ,act is silent or ambiguous1 and the ,agency has followed the procedures in section #eec or #eed of title #e1 ,united ,states ,code1 as applicable1 a reviewing court shall defer to the ,agency's reasonable or permissible interpretation of this ,act4 7c7 ,monitoring ,in order to support its rulemaking and other functions1 the ,agency shall monitor for risks to individuals or groups of individuals in the collection1 processing1 or sharing of personal data4 #aa4 ,supervision of data aggregators 7a7 ,in general ,a large data aggregator is a data aggregator that satisfies one or more of the following thresholds3 7#a7 ,the data aggregator has annual gross revenues that exceed #be1jjj1jjj4 7#b7 ,the data aggregator annually collects1 uses1 or shares1 alone or in combination1 the personal data of #ej1jjj or more individuals1 households1 or devices4 7b7 ,supervision ,the ,agency may require reports and conduct examinations on a periodic basis of large data aggregators described in subsection 7a7 for purposes of-- 7#a7 assessing compliance with the requirements of this ,act1 rules and orders issued by the ,agency1 or other ,federal privacy laws2 7#b7 obtaining information about the activities subject to such laws and the associated compliance systems or procedures of such entities2 7#c7 detecting and assessing associated risks to individuals and groups of individuals2 and 7#d7 requiring and overseeing high-risk data practice risk impact assessments and high-risk data practice impact evaluations to advance fair and just data practices4 7c7 ,publicly accessible list ,the ,agency shall maintain a publicly accessible list of data aggregators that collect1 process1 or share personal data of more than #aj1jjj persons or households1 and the permissible purposes for which the data aggregators purport to collect personal data4 7d7 ,merger review ,the ,agency shall conduct a review and submit to the ,federal ,trade ,commission and ,department of ,justice a report on the privacy and data protection implications of-- 7#a7 any merger involving a data aggregator described in subsection 7a72 or 7#b7 any merger that proposes the transfer of personal data of #ej1jjj or more individuals4 #ab4 ,prohibited acts ,it shall be unlawful for-- 7#a7 any data aggregator or service provider to commit any act or omission in violation of this ,act1 ,federal privacy law1 or any rule or order issued by the ,agency under this ,act2 7#b7 any data aggregator or service provider to commit any unlawful1 unfair1 deceptive1 abusive1 or discriminatory acts or practices in connection with the collection1 processing1 or sharing of personal data2 7#c7 any data aggregator or service provider to fail or refuse as required by this ,act or ,federal privacy law1 or any rule or order issued by the ,agency thereunder-- 7,a7 to permit access to or copying of records2 7,b7 to establish or maintain records2 or 7,c7 to make reports or provide information to the ,agency2 7#d7 any person to knowingly or recklessly provide substantial assistance to a data aggregator or service provider in violation of this ,act or ,federal privacy law1 or any rule or order issued thereunder1 and notwithstanding any provision of this ,act1 the provider of such substantial assistance shall be deemed to be in violation of this ,act or ,federal privacy law to the same extent as the person to whom substantial assistance is provided2 or 7#e7 any person1 data aggregator1 or service provider to re-identify1 or attempt to re-identify1 an individual1 household1 or device from anonymized data1 unless such person1 data aggregator1 or service provider is conducting authorized testing to prove personal data has been anonymized4 #ac4 ,enforcement powers 7a7 ,definitions ,for purposes of this section1 the following definitions shall apply3 7#a7 ,agency investigation ,the term ,agency investigation means any inquiry conducted by an ,agency investigator for the purpose of ascertaining whether any person is or has been engaged in any conduct that is a violation1 as defined in this section4 7#b7 ,agency investigator ,the term ,agency investigator means any attorney or investigator employed by the ,agency who is charged with the duty of enforcing or carrying into effect this ,act any other ,federal privacy law4 7#c7 ,custodian ,the term custodian means the custodian or any deputy custodian designated by the ,agency4 7#d7 ,documentary material ,the term documentary material includes the original or any copy of any book1 document1 record1 report1 memorandum1 paper1 communication1 tabulation1 chart1 logs1 electronic files1 or other data or data compilations stored in any medium4 7#e7 ,violation ,the term violation means any act or omission that1 if proved1 would constitute a violation of any provision of this ,act or any other ,federal privacy law4 7b7 ,investigations and administrative discovery 7#a7 ,joint investigations 7,a7 ,in general ,the ,agency or1 where appropriate1 an ,agency investigator1 may engage in joint investigations and requests for information1 as authorized under this ,act4 7,b7 ,civil rights ,the authority under subparagraph 7,a7 includes matters relating to protection of individuals' civil rights under this ,act and joint investigations with1 and requests for information from1 the ,director of the ,bureau of ,consumer ,financial ,protection1 the ,federal ,trade ,commission1 the ,secretary of ,housing and ,urban ,development1 the ,department of ,education1 the ,equal ,employment ,opportunity ,commission1 the ,department of ,health and ,human ,services1 or the ,attorney ,general4 7#b7 ,subpoenas 7,a7 ,in general ,the ,agency or an ,agency investigator may issue subpoenas for the attendance and testimony of witnesses and the production of relevant papers1 books1 documents1 or other material in connection with hearings under this ,act4 7,b7 ,failure to obey ,in the case of contumacy or refusal to obey a subpoena issued pursuant to this subparagraph and served upon any person1 the district court of the ,united ,states for any district in which such person is found1 resides1 or transacts business1 upon application by the ,agency or an ,agency investigator and after notice to such person1 may issue an order requiring such person to appear and give testimony or to appear and produce documents or other material4 7,c7 ,contempt ,any failure to obey an order of the court under this subparagraph may be punished by the court as a contempt thereof4 7#c7 ,demands 7,a7 ,in general ,whenever the ,agency has reason to believe that any person may be in possession1 custody1 or control of any documentary material or tangible things1 or may have any information1 relevant to a violation1 the ,agency may1 before the institution of any proceedings under this ,act1 issue in writing1 and cause to be served upon such person1 a civil investigative demand requiring such person to-- 7i7 produce such documentary material for inspection and copying or reproduction in the form or medium requested by the ,agency2 7ii7 submit such tangible things2 7iii7 file written reports or answers to questions2 7iv7 give oral testimony concerning documentary material1 tangible things1 or other information2 or 7v7 furnish any combination of such material1 answers1 or testimony4 7,b7 ,requirements ,each civil investigative demand shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation4 7,c7 ,production of documents ,each civil investigative demand for the production of documentary material shall-- 7i7 describe each class of documentary material to be produced under the demand with such definiteness and certainty as to permit such material to be fairly identified2 7ii7 prescribe a return date or dates which will provide a reasonable period of time within which the material so demanded may be assembled and made available for inspection and copying or reproduction2 and 7iii7 identify the custodian to whom such material shall be made available4 7,d7 ,production of things ,each civil investigative demand for the submission of tangible things shall-- 7i7 describe each class of tangible things to be submitted under the demand with such definiteness and certainty as to permit such things to be fairly identified2 7ii7 prescribe a return date or dates which will provide a reasonable period of time within which the things so demanded may be assembled and submitted2 and 7iii7 identify the custodian to whom such things shall be submitted4 7,e7 ,demand for written reports or answers ,each civil investigative demand for written reports or answers to questions shall-- 7i7 propound with definiteness and certainty the reports to be produced or the questions to be answered2 7ii7 prescribe a date or dates at which time written reports or answers to questions shall be submitted2 and 7iii7 identify the custodian to whom such reports or answers shall be submitted4 7,f7 ,oral testimony ,each civil investigative demand for the giving of oral testimony shall-- 7i7 prescribe a date1 time1 and place at which oral testimony shall be commenced2 and 7ii7 identify an ,agency investigator who shall conduct the investigation and the custodian to whom the transcript of such investigation shall be submitted4 7,g7 ,service ,any civil investigative demand issued1 and any enforcement petition filed1 under this paragraph may be served-- 7i7 by any ,agency investigator at any place within the territorial jurisdiction of any court of the ,united ,states2 and 7ii7 upon any person who is not found within the territorial jurisdiction of any court of the ,united ,states-- 7,i7 in such manner as the ,federal ,rules of ,civil ,procedure prescribe for service in a foreign nation2 and 7,,ii7 to the extent that the courts of the ,united ,states have authority to assert jurisdiction over such person1 consistent with due process1 the ,united ,states ,district ,court for the ,district of ,columbia shall have the same jurisdiction to take any action respecting compliance with this section by such person that such district court would have if such person were personally within the jurisdiction of such district court4 7,h7 ,method of service ,service of any civil investigative demand or any enforcement petition filed under this paragraph may be made upon a person1 including any legal entity1 by-- 7i7 delivering a duly executed copy of such demand or petition to the individual or to any partner1 executive officer1 managing agent1 or general agent of such person1 or to any agent of such person authorized by appointment or by law to receive service of process on behalf of such person2 7ii7 delivering a duly executed copy of such demand or petition to the principal office or place of business of the person to be served2 or 7iii7 depositing a duly executed copy in the ,united ,states mails1 by registered or certified mail1 return receipt requested1 duly addressed to such person at the principal office or place of business of such person4 7,i7 ,proof of service 7i7 ,in general ,a verified return by the individual serving any civil investigative demand or any enforcement petition filed under this paragraph setting forth the manner of such service shall be proof of such service4 7ii7 ,return receipts ,in the case of service by registered or certified mail1 such return shall be accompanied by the return post office receipt of delivery of such demand or enforcement petition4 7,j7 ,production of documentary material ,the production of documentary material in response to a civil investigative demand shall be made under a sworn certificate1 in such form as the demand designates1 by the person1 if a natural person1 to whom the demand is directed or1 if not a natural person1 by any person having knowledge of the facts and circumstances relating to such production1 to the effect that all of the documentary material required by the demand and in the possession1 custody1 or control of the person to whom the demand is directed has been produced and made available to the custodian4 7,k7 ,submission of tangible things ,the submission of tangible things in response to a civil investigative demand shall be made under a sworn certificate1 in such form as the demand designates1 by the person to whom the demand is directed or1 if not a natural person1 by any person having knowledge of the facts and circumstances relating to such production1 to the effect that all of the tangible things required by the demand and in the possession1 custody1 or control of the person to whom the demand is directed have been submitted to the custodian4 7,l7 ,separate answers ,each reporting requirement or question in a civil investigative demand shall be answered separately and fully in writing under oath1 unless it is objected to1 in which event the reasons for the objection shall be stated in lieu of an answer1 and it shall be submitted under a sworn certificate1 in such form as the demand designates1 by the person1 if a natural person1 to whom the demand is directed or1 if not a natural person1 by any person responsible for answering each reporting requirement or question1 to the effect that all information required by the demand and in the possession1 custody1 control1 or knowledge of the person to whom the demand is directed has been submitted4 7,m7 ,testimony 7i7 ,in general 7,i7 ,oath and recordation ,the examination of any person pursuant to a demand for oral testimony served under this paragraph shall be taken before an officer authorized to administer oaths and affirmations by the laws of the ,united ,states or of the place at which the examination is held4 ,the officer before whom oral testimony is to be taken shall put the witness on oath or affirmation and shall personally1 or by any individual acting under the direction of and in the presence of the officer1 record the testimony of the witness4 7,,ii7 ,transcription ,the testimony shall be taken stenographically and transcribed4 7,,iii7 ,transmission to custodian ,after the testimony is fully transcribed1 the officer investigator before whom the testimony is taken shall promptly transmit a copy of the transcript of the testimony to the custodian4 7ii7 ,parties present ,any ,agency investigator before whom oral testimony is to be taken shall exclude from the place where the testimony is to be taken all other persons1 except the person giving the testimony1 the attorney for that person1 the officer before whom the testimony is to be taken1 an investigator or representative of an agency with which the ,agency is engaged in a joint investigation1 and any stenographer taking such testimony4 7iii7 ,location ,the oral testimony of any person taken pursuant to a civil investigative demand shall be taken in the judicial district of the ,united ,states in which such person resides1 is found1 or transacts business1 or in such other place as may be agreed upon by the ,agency investigator before whom the oral testimony of such person is to be taken and such person4 7iv7 ,attorney representation 7,i7 ,in general ,any person compelled to appear under a civil investigative demand for oral testimony pursuant to this section may be accompanied1 represented1 and advised by an attorney4 7,,ii7 ,authority ,the attorney may advise a person described in subclause 7,i71 in confidence1 either upon the request of such person or upon the initiative of the attorney1 with respect to any question asked of such person4 7,,iii7 ,objections ,a person described in subclause 7,i71 or the attorney for that person1 may object on the record to any question1 in whole or in part1 and such person shall briefly state for the record the reason for the objection4 ,an objection may properly be made1 received1 and entered upon the record when it is claimed that such person is entitled to refuse to answer the question on grounds of any constitutional or other legal right or privilege1 including the privilege against self-incrimination1 but such person shall not otherwise object to or refuse to answer any question1 and such person or attorney shall not otherwise interrupt the oral examination4 7,,iv7 ,refusal to answer ,if a person described in subclause 7,i7 refuses to answer any question-- 7aa7 the ,agency may petition the district court of the ,united ,states pursuant to this section for an order compelling such person to answer such question2 and 7bb7 if the refusal is on grounds of the privilege against self-incrimination1 the testimony of such person may be compelled in accordance with the provisions of section #fjjd of title #ah1 ,united ,states ,code4 7v7 ,transcripts ,for purposes of this paragraph-- 7,i7 after the testimony of any witness is fully transcribed1 the ,agency investigator shall afford the witness 7who may be accompanied by an attorney7 a reasonable opportunity to examine the transcript2 7,,ii7 the transcript shall be read to or by the witness1 unless such examination and reading are waived by the witness2 7,,iii7 any changes in form or substance which the witness desires to make shall be entered and identified upon the transcript by the ,agency investigator1 with a statement of the reasons given by the witness for making such changes2 7,,iv7 the transcript shall be signed by the witness1 unless the witness in writing waives the signing1 is ill1 cannot be found1 or refuses to sign2 and 7,v7 if the transcript is not signed by the witness during the #cj-;day period following the date on which the witness is first afforded a reasonable opportunity to examine the transcript1 the ,agency investigator shall sign the transcript and state on the record the fact of the waiver1 illness1 absence of the witness1 or the refusal to sign1 together with any reasons given for the failure to sign4 7vi7 ,certification by investigator ,the ,agency investigator shall certify on the transcript that the witness was duly sworn by him or her and that the transcript is a true record of the testimony given by the witness1 and the ,agency investigator shall promptly deliver the transcript or send it by registered or certified mail to the custodian4 7vii7 ,copy of transcript ,the ,agency investigator shall furnish a copy of the transcript 7upon payment of reasonable charges for the transcript7 to the witness only1 except that the ,agency may for good cause limit such witness to inspection of the official transcript of his testimony4 7viii7 ,witness fees ,any witness appearing for the taking of oral testimony pursuant to a civil investigative demand shall be entitled to the same fees and mileage which are paid to witnesses in the district courts of the ,united ,states4 7#d7 ,confidential treatment of demand material 7,a7 ,in general ,documentary materials and tangible things received as a result of a civil investigative demand shall be subject to requirements and procedures regarding confidentiality1 in accordance with rules established by the ,agency4 7,b7 ,disclosure to congress ,no rule established by the ,agency regarding the confidentiality of materials submitted to1 or otherwise obtained by1 the ,agency shall be intended to prevent disclosure to either ,house of ,congress or to an appropriate committee of the ,congress1 except that the ,agency is permitted to adopt rules allowing prior notice to any party that owns or otherwise provided the material to the ,agency and had designated such material as confidential4 7#e7 ,petition for enforcement 7,a7 ,in general ,whenever any person fails to comply with any civil investigative demand duly served upon such person under this section1 or whenever satisfactory copying or reproduction of material requested pursuant to the demand cannot be accomplished and such person refuses to surrender such material1 the ,agency1 through such officers or attorneys as it may designate1 may file1 in the district court of the ,united ,states for any judicial district in which such person resides1 is found1 or transacts business1 and serve upon such person1 a petition for an order of such court for the enforcement of this paragraph4 7,b7 ,service of process ,all process of any court to which application may be made as provided in this subparagraph may be served in any judicial district4 7#f7 ,petition for order modifying or setting aside demand 7,a7 ,in general ,not later than #bj days after the service of any civil investigative demand upon any person under subparagraph 7,b71 or at any time before the return date specified in the demand1 whichever period is shorter1 or within such period exceeding #bj days after service or in excess of such return date as may be prescribed in writing1 subsequent to service1 by any ,agency investigator named in the demand1 such person may file with the ,agency a petition for an order by the ,agency modifying or setting aside the demand4 7,b7 ,compliance during pendency ,the time permitted for compliance with the demand in whole or in part1 as determined proper and ordered by the ,agency1 shall not run during the pendency of a petition under clause 7i7 at the ,agency1 except that such person shall comply with any portions of the demand not sought to be modified or set aside4 7,c7 ,specific grounds ,a petition under subparagraph 7,a7 shall specify each ground upon which the petitioner relies in seeking relief1 and may be based upon any failure of the demand to comply with the provisions of this section1 or upon any constitutional or other legal right or privilege of such person4 7#g7 ,custodial control ,at any time during which any custodian is in custody or control of any documentary material1 tangible things1 reports1 answers to questions1 or transcripts of oral testimony given by any person in compliance with any civil investigative demand1 such person may file1 in the district court of the ,united ,states for the judicial district within which the office of such custodian is situated1 and serve upon such custodian1 a petition for an order of such court requiring the performance by such custodian of any duty imposed upon him by this section or rule promulgated by the ,agency4 7#h7 ,jurisdiction of court 7,a7 ,in general ,whenever any petition is filed in any district court of the ,united ,states under this paragraph1 such court shall have jurisdiction to hear and determine the matter so presented1 and to enter such order or orders as may be required to carry out the provisions of this section4 7,b7 ,appeal ,any final order entered as described in subparagraph 7,a7 shall be subject to appeal pursuant to section #abia of title #bh1 ,united ,states ,code4 7c7 ,hearings and adjudicatory proceedings 7#a7 ,in general ,the ,agency is authorized to conduct hearings and adjudication proceedings with respect to any person in the manner prescribed by chapter #e of title #e1 ,united ,states ,code in order to ensure or enforce compliance with-- 7,a7 the provisions of this ,act and other ,federal privacy laws1 including any rules prescribed by the ,agency under this ,act and other ,federal privacy laws2 and 7,b7 any other ,federal privacy law that the ,agency is authorized to enforce1 and any rules or order prescribed thereunder1 unless such ,federal privacy law specifically limits the ,agency from conducting a hearing or adjudication proceeding and only to the extent of such limitation4 7#b7 ,special rules for cease-and-desist proceedings 7,a7 ,orders authorized 7i7 ,in general ,if1 in the opinion of the ,agency1 any data aggregator is engaging or has engaged in an activity that violates a law1 rule1 or any condition imposed in writing on the person by the ,agency1 the ,agency may issue and serve upon the data aggregator or service provider a notice of charges in respect thereof4 7ii7 ,content of notice ,the notice under clause 7i7 shall contain a statement of the facts constituting the alleged violation or violations1 and shall fix a time and place at which a hearing will be held to determine whether an order to cease and desist should issue against the data aggregator or service provider1 such hearing to be held not earlier than #cj days nor later than #fj days after the date of service of such notice1 unless an earlier or a later date is set by the ,agency1 at the request of any party so served4 7iii7 ,consent ,unless the party or parties served under clause 7ii7 appear at the hearing personally or by a duly authorized representative1 such person shall be deemed to have consented to the issuance of the cease-and-desist order4 7iv7 ,procedure ,in the event of consent under clause 7ii71 or if1 upon the record made at any such hearing1 the ,agency finds that any violation specified in the notice of charges has been established1 the ,agency may issue and serve upon the data aggregator or service provider an order to cease and desist from the violation or practice4 ,such order may1 by provisions which may be mandatory or otherwise1 require the data aggregator or service provider to cease and desist from the subject activity1 and to take affirmative action to correct the conditions resulting from any such violation4 7,b7 ,effectiveness of order ,a cease-and-desist order shall become effective at the expiration of #cj days after the date of service of an order under subparagraph 7,a7 upon the data aggregator or service provider concerned 7except in the case of a cease-and-desist order issued upon consent1 which shall become effective at the time specified therein71 and shall remain effective and enforceable as provided therein1 except to such extent as the order is stayed1 modified1 terminated1 or set aside by action of the ,agency or a reviewing court4 7,c7 ,decision and appeal ,any hearing provided for in this subsection shall be held in the ,federal judicial district or in the territory in which the residence or principal office or place of business of the person is located unless the person consents to another place1 and shall be conducted in accordance with the provisions of chapter #e of title #e of the ,united ,states ,code4 ,after such hearing1 and within #ij days after the ,agency has notified the parties that the case has been submitted to the ,agency for final decision1 the ,agency shall render its decision 7which shall include findings of fact upon which its decision is predicated7 and shall issue and serve upon each party to the proceeding an order or orders consistent with the provisions of this section4 ,judicial review of any such order shall be exclusively as provided in this subsection4 ,unless a petition for review is timely filed in a court of appeals of the ,united ,states1 as provided in subparagraph 7,d71 and thereafter until the record in the proceeding has been filed as provided in subparagraph 7,d71 the ,agency may at any time1 upon such notice and in such manner as the ,agency shall determine proper1 modify1 terminate1 or set aside any such order4 ,upon filing of the record as provided1 the ,agency may modify1 terminate1 or set aside any such order with permission of the court4 7,d7 ,appeal to court of appeals ,any party to any proceeding under this subsection may obtain a review of any order served pursuant to this subparagraph 7other than an order issued with the consent of the person concerned7 by the filing in the court of appeals of the ,united ,states for the circuit in which the principal office of the covered person is located1 or in the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit1 within #cj days after the date of service of such order1 a written petition praying that the order of the ,agency be modified1 terminated1 or set aside4 ,a copy of such petition shall be forthwith transmitted by the clerk of the court to the ,agency1 and thereupon the ,agency shall file in the court the record in the proceeding1 as provided in section #baab of title #bh of the ,united ,states ,code4 ,upon the filing of such petition1 such court shall have jurisdiction1 which upon the filing of the record shall except as provided in the last sentence of subparagraph 7,c7 be exclusive1 to affirm1 modify1 terminate1 or set aside1 in whole or in part1 the order of the ,agency4 ,review of such proceedings shall be had as provided in chapter #g of title #e of the ,united ,states ,code4 ,the judgment and decree of the court shall be final1 except that the same shall be subject to review by the ,supreme ,court of the ,united ,states1 upon certiorari1 as provided in section #abed of title #bh of the ,united ,states ,code4 7,e7 ,no stay ,the commencement of proceedings for judicial review under clause 7iv7 shall not1 unless specifically ordered by the court1 operate as a stay of any order issued by the ,agency4 7#c7 ,special rules for temporary cease-and-desist proceedings 7,a7 ,in general ,whenever the ,agency determines that the violation specified in the notice of charges served upon a data aggregator1 including a service provider1 pursuant to paragraph 7#b71 or the continuation thereof1 is likely to cause the person to be insolvent or otherwise prejudice the interests of individuals before the completion of the proceedings conducted pursuant to paragraph 7#b71 the ,agency may issue a temporary order requiring the data aggregator or service provider to cease and desist from any such violation or practice and to take affirmative action to prevent or remedy such insolvency or other condition pending completion of such proceedings4 ,such order may include any requirement authorized under this ,act4 ,such order shall become effective upon service upon the data aggregator or servicer provider and1 unless set aside1 limited1 or suspended by a court in proceedings authorized by clause 7ii71 shall remain effective and enforceable pending the completion of the administrative proceedings pursuant to such notice and until such time as the ,agency shall dismiss the charges specified in such notice1 or if a cease-and-desist order is issued against the person1 until the effective date of such order4 7,b7 ,appeal ,not later than #aj days after the data aggregator or service provider concerned has been served with a temporary cease-and-desist order1 the data aggregator or service provider may apply to the ,united ,states district court for the judicial district in which the residence or principal office or place of business of such data aggregator or servicer provider is located1 or the ,united ,states ,district ,court for the ,district of ,columbia1 for an injunction setting aside1 limiting1 or suspending the enforcement1 operation1 or effectiveness of such order pending the completion of the administrative proceedings pursuant to the notice of charges served upon the data aggregator or servicer provider under subparagraph 7,b71 and such court shall have jurisdiction to issue such injunction4 7,c7 ,incomplete or inaccurate records 7i7 ,temporary order ,if a notice of charges served under paragraph 7#b7 specifies1 on the basis of particular facts and circumstances1 that the books and records of a data aggregator or service provider are so incomplete or inaccurate that the ,agency is unable to determine the financial condition of that data aggregator or service provider or the details or purpose of any transaction or transactions that may have a material effect on the financial condition of that person1 the ,agency may issue a temporary order requiring-- 7,i7 the cessation of any activity or practice which gave rise1 whether in whole or in part1 to the incomplete or inaccurate state of the books or records2 or 7,,ii7 affirmative action to restore such books or records to a complete and accurate state1 until the completion of the proceedings under paragraph 7#b77;,a74 7ii7 ,effective period ,any temporary order issued under clause 7i7-- 7,i7 shall become effective upon service2 and 7,,ii7 unless set aside1 limited1 or suspended by a court in proceedings under subparagraph 7,b71 shall remain in effect and enforceable until the earlier of-- 7aa7 the completion of the proceeding initiated under paragraph 7#b7 in connection with the notice of charges2 or 7bb7 the date the ,agency determines1 by examination or otherwise1 that the books and records of the covered person or service provider are accurate and reflect the financial condition thereof4 7#d7 ,special rules for enforcement of orders 7,a7 ,in general ,the ,agency may in its discretion apply to the ,united ,states district court within the jurisdiction of which the principal office or place of business of the person is located1 for the enforcement of any effective and outstanding notice or order issued under this section1 and such court shall have jurisdiction and power to order and require compliance herewith4 7,b7 ,exception ,except as otherwise provided in this subparagraph1 no court shall have jurisdiction to affect by injunction or otherwise the issuance or enforcement of any notice or order or to review1 modify1 suspend1 terminate1 or set aside any such notice or order4 7#e7 ,rules ,the ,agency shall prescribe rules establishing such procedures as may be necessary to carry out this paragraph4 7d7 ,litigation authority 7#a7 ,in general ,if any person violates this ,act1 a rule or order issued under this ,act1 or a ,federal privacy law1 the ,agency may commence a civil action against such person to impose a civil penalty or to seek all appropriate legal and equitable relief including a permanent or temporary injunction as permitted by law4 7#b7 ,representation ,the ,agency may act in its own name and through its own attorneys in enforcing any provision of this ,act1 rules thereunder1 or any other law or regulation1 or in any action1 suit1 or proceeding to which the ,agency is a party4 7#c7 ,compromise of actions ,the ,agency may compromise or settle any action if such compromise is approved by the court4 7#d7 ,notice to the attorney general 7,a7 ,in general ,when commencing a civil action under this ,act or any ,federal privacy law1 or any rule thereunder1 the ,agency shall notify the ,attorney ,general4 7,b7 ,notice and coordination 7i7 ,notice of other actions ,in addition to any notice required under subparagraph 7,a71 the ,agency shall notify the ,attorney ,general concerning any action1 suit1 or proceeding to which the ,agency is a party1 except an action1 suit1 or proceeding that involves a violation of this ,act or a ,federal privacy law4 7ii7 ,coordination ,in order to avoid conflicts and promote consistency regarding litigation of matters under ,federal law1 the ,attorney ,general and the ,agency shall consult regarding the coordination of investigations and proceedings1 including by negotiating an agreement for coordination by not later than #ahj days after the designated transfer date4 ,the agreement under this subclause shall include provisions to ensure that parallel investigations and proceedings involving the ,federal privacy laws are conducted in a manner that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7iii7 ,rule of construction ,nothing in this paragraph shall be construed to limit the authority of the ,agency under this title1 including the authority to interpret ,federal privacy law 4 7#e7 ,appearance before the supreme court ,the ,agency may represent itself in its own name before the ,supreme ,court of the ,united ,states1 if the ,agency makes a written request to the ,attorney ,general within the #aj-;day period that begins on the date of entry of the judgment that would permit any party to file a petition for writ of certiorari1 and the ,attorney ,general concurs with such request or fails to take action within #fj days of the request of the ,agency4 7#f7 ,forum ,any civil action brought under a ,federal privacy law may be brought in a ,united ,states district court or in any court of competent jurisdiction of a ,state in a district in which the defendant is located or resides or is doing business1 and such court shall have jurisdiction to enjoin such person and to require compliance with any ,federal privacy law4 7#g7 ,time for bringing action ,except as otherwise permitted by law or equity1 no action may be brought under this ,act or other ,federal privacy law more than #e years after the date of discovery of the violation to which an action relates4 7e7 ,relief available 7#a7 ,administrative proceedings or court actions 7,a7 ,jurisdiction ,the court 7or the ,agency1 as the case may be7 in an action or adjudication proceeding brought under this ,act or a ,federal privacy law1 shall have jurisdiction to grant any appropriate legal or equitable relief with respect to a violation of this ,act or ,federal privacy law1 including a violation of a rule or order prescribed under this ,act or ,federal privacy law4 7,b7 ,relief ,relief under this section may include1 without limitation-- 7i7 rescission or reformation of contracts2 7ii7 refund of moneys or return of real property2 7iii7 restitution2 7iv7 disgorgement of any revenue1 data1 or technologies1 including automated decision systems1 data sets1 or algorithms1 attributable to a violation of this ,act1 ,federal privacy law1 or any rule or order issued by the ,agency under this ,act2 7v7 payment of damages or other monetary relief2 7vi7 public notification regarding the violation1 including the costs of notification2 7vii7 limits on the activities or functions of the person2 and 7viii7 civil money penalties1 as set forth more fully in paragraph 7#c74 7,c7 ,no exemplary or punitive damages ,nothing in this subparagraph shall be construed as authorizing the imposition of exemplary or punitive damages in an action brought by the ,agency4 7#b7 ,recovery of costs ,in any action brought by the ,agency1 a ,state attorney general1 or any ,state regulator to enforce this ,act or any ,federal privacy law1 the ,agency1 the ,state attorney general1 or the ,state regulator may recover its costs in connection with prosecuting such action if the ,agency1 the ,state attorney general1 or the ,state regulator is the prevailing party in the action4 7#c7 ,civil money penalty in court and administrative actions 7,a7 ,in general ,any person that violates1 through any act or omission1 any provision of this ,act or any ,federal privacy law shall forfeit and pay a civil penalty pursuant to this subparagraph4 7,b7 ,penalty amounts 7i7 ,first tier ,for any violation of a law1 rule1 or final order or condition imposed in writing by the ,agency1 a civil penalty may not exceed-- 7,i7 #e1jjj for each day during which such violation or failure to pay continues2 or 7,,ii7 #ae1jjj for each day during which such violation or failure to pay continues if such violation involves the personal data of individuals under the age of #ac4 7ii7 ,second tier ,notwithstanding clause 7i71 for any person that recklessly engages in a violation of this ,act or any ,federal privacy law1 a civil penalty may not exceed-- 7,i7 #be1jjj for each day during which such violation or failure to pay continues2 or 7,,ii7 #ge1jjj for each day during which such violation or failure to pay continues if such violation involves the personal data of individuals under the age of #ac4 7iii7 ,third tier ,notwithstanding clauses 7i7 and 7ii71 for any person that knowingly violates this ,act or any ,federal privacy law1 a civil penalty may not exceed-- 7,i7 #a1jjj1jjj for each day during which such violation continues2 or 7,,ii7 #c1jjj1jjj for each day during which such violation or failure to pay continues if such violation involves the personal data of individuals under the age of #ac4 7,c7 ,penalties for re-identifying data ,any person that re-identifies1 or attempts to re-identify1 anonymized data shall be assessed a third tier civil penalty under subparagraph 7,b71 unless conducting authorized testing to prove personal data has been anonymized4 7,d7 ,mitigating factors ,in determining the amount of any penalty assessed under subparagraph 7,b71 the ,agency or the court shall take into account the appropriateness of the penalty with respect to-- 7i7 the size of financial resources and good faith of the person charged2 7ii7 the gravity of the violation or failure to pay2 7iii7 the severity of the risks or harms to individuals2 7iv7 the history of previous violations2 and 7v7 such other matters as justice may require4 7,e7 ,authority to modify or remit penalty ,the ,agency may compromise1 modify1 or remit any penalty which may be assessed or had already been assessed under subparagraph 7,b74 ,the amount of such penalty1 when finally determined1 shall be exclusive of any sums owed by the person to the ,united ,states in connection with the costs of the proceeding1 and may be deducted from any sums owed by the ,united ,states to the person charged4 7,f7 ,notice and hearing ,no civil penalty may be assessed under this subsection with respect to a violation of this ,act or any ,federal privacy law1 unless-- 7i7 the ,agency gives notice and an opportunity for a hearing to the person accused of the violation2 or 7ii7 the appropriate court has ordered such assessment and entered judgment in favor of the ,agency4 7f7 ,referrals for criminal proceedings ,if the ,agency obtains evidence that any person1 domestic or foreign1 has engaged in conduct that may constitute a violation of ,federal criminal law1 the ,agency shall transmit such evidence to the ,attorney ,general of the ,united ,states1 who may institute criminal proceedings under appropriate law4 ,nothing in this section affects any other authority of the ,agency to disclose information4 #ad4 ,transfers of functions 7a7 ,federal trade commission ,the authority of the ,federal ,trade ,commission under a ,federal privacy law to prescribe rules1 issue guidelines1 or conduct a study or issue a report mandated under such law shall be transferred to the ,agency on the transfer date4 ,nothing in this ,act shall be construed to require a mandatory transfer of any employee of the ,federal ,trade ,commission4 7b7 ,agency authority 7#a7 ,in general ,the ,agency shall have all powers and duties under the ,federal privacy laws to prescribe rules1 issue guidelines1 or to conduct studies or issue reports mandated by such laws1 that were vested in the ,federal ,trade ,commission on the day before the transfer date4 7#b7 ,federal trade commission act ,the ,agency may enforce a rule prescribed under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 by the ,federal ,trade ,commission with respect to the collection1 disclosure1 processing and misuse of personal data4 7c7 ,authority of the federal trade commission ,no provision of this ,act shall be construed as modifying1 limiting1 or otherwise affecting the authority of the ,federal ,trade ,commission1 including the authority with respect to large data collectors described in section #aa7;a77#a7 of this ,act1 under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq471 or any other law1 other than the authority under a ,federal privacy law to prescribe rules1 issue official guidelines1 or conduct a study or issue a report mandated under such law4 7d7 ,authority of the bureau of consumer financial protection ,no provision of this ,act shall be construed as modifying1 limiting1 or otherwise affecting the authority of the ,bureau of ,consumer ,financial ,protection under the ,dodd-,frank ,wall ,street ,reform and ,consumer ,protection ,act 7#ab ,u4,s4,c4 #ecja et seq47 or any other law4 #ae4 ,authorization of appropriations ,there are authorized to be appropriated to the ,agency such sums as may be necessary to carry out this ,act4 #af4 ,relation to ,federal and ,state law 7a7 ,relation to state law 7#a7 ,rule of construction ,this ,act may not be construed as annulling1 altering1 or affecting1 or exempting any person subject to the provisions of this title from complying with1 the statutes1 regulations1 orders1 or interpretations in effect in any ,state1 except to the extent that any such provision of law is inconsistent with the provisions of this title1 and then only to the extent of the inconsistency4 7#b7 ,greater protection under state law ,for purposes of this paragraph1 a statute1 regulation1 order1 or interpretation in effect in any ,state is not inconsistent with the provisions of this title if the protection that such statute1 regulation1 order1 or interpretation affords to individuals is greater than the protection provided under this ,act4 ,a determination regarding whether a statute1 regulation1 order1 or interpretation in effect in any ,state is inconsistent with the provisions of this title may be made by the ,agency on its own motion or in response to a nonfrivolous petition initiated by any interested person4 7b7 ,relation to other provisions of federal privacy laws that relate to state law ,no provision of this ,act shall be construed as modifying1 limiting1 or superseding the operation of any provision of a ,federal privacy law that relates to the application of a law in effect in any ,state with respect to such ,federal law4 7c7 ,preservation of enforcement powers of states ,the attorney general 7or the equivalent thereof7 of any ,state may bring a civil action in the name of such ,state in any district court of the ,united ,states in that ,state or in ,state court that is located in that ,state and that has jurisdiction over the defendant1 to enforce provisions of this title or rules or orders issued under this ,act1 and to secure remedies under provisions of this title or remedies otherwise provided under other law4 ,a ,state regulator may bring a civil action or other appropriate proceeding to enforce the provisions of this title or rules or orders issued under this ,act with respect to any entity that is ,state-chartered1 incorporated1 licensed1 or otherwise authorized to do business under ,state law 7except as provided in paragraph 7#b771 and to secure remedies under provisions of this title or remedies otherwise provided under other provisions of law with respect to such an entity4 7d7 ,preservation of state authority 7#a7 ,state claims ,no provision of this section shall be construed as altering1 limiting1 or affecting the authority of a ,state attorney general or any other regulatory or enforcement agency or authority to bring an action or other regulatory proceeding arising solely under the law in effect in that ,state4 7#b7 ,state consumer protection1 privacy1 and data regulators ,no provision of this title shall be construed as altering1 limiting1 or affecting the authority of a ,state consumer protection1 data protection1 or privacy agency 7or any agency or office performing like functions7 under ,state law to adopt rules1 initiate enforcement proceedings1 or take any other action with respect to a person regulated by such commission or authority4 #ag4 ,inspector general ,section #ab of the ,inspector ,general ,act of #aigh 7#e ,u4,s4,c4 ,app47 is amended-- 7#a7 in paragraph 7#a71 by inserting the ,director of the ,data ,protection ,agency2 after the ,president of the ,export-,import ,bank22 and 7#b7 in paragraph 7#b71 by inserting the ,data ,protection ,agency1 after the ,export-,import ,bank14