,,ii #aag? ,,congress #a/ ,session ,s4 #bdii ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,july #bh1 #bjba,mr4 ,wick] 7= himself & ,mrs4 ,blackburn7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to e/abli% data privacy & data security protections = consum]s 9 ! ,unit$ ,/ates4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,sett+ an ,am]ican ,framework to ,ensure ,data ,access1 ,transp>5cy1 & ,acc\ntability ,act or ! ,,safe ,,data ,act4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,sec4 #b4 ,def9itions4,sec4 #c4 ,effective date4,,title ,i--,individual consum] data rights,sec4 #aja4 ,consum] loyalty4,sec4 #ajb4 ,transp>5cy4,sec4 #ajc4 ,individual control4,sec4 #ajd4 ,rights to cons5t4,sec4 #aje4 ,m9imiz+ data collection1 process+1 & ret5tion4,sec4 #ajf4 ,s]vice provid]s & ?ird p>ties4,sec4 #ajg4 ,privacy impact assessm5ts4,sec4 #ajh4 ,scope ( cov]age4,,title ,,ii--,data transp>5cy1 integrity1 & security,sec4 #bja4 ,civil rights1 algori?m bias1 detection1 & mitigation4,sec4 #bjb4 ,data brok]s4,sec4 #bjc4 ,protection ( cov]$ data4,,title ,,iii--,corporate accountability,sec4 #cja4 ,designation ( data privacy (fic] & data security (fic]4,sec4 #cjb4 ,int]nal controls4,sec4 #cjc4 ,:i/lebl[] protections4,,title ,,iv--,en=cem5t au?ority & new programs,sec4 #dja4 ,en=cem5t by ! ,f$]al ,trade ,commission4,sec4 #djb4 ,en=cem5t by ,/ate attorneys g5]al4,sec4 #djc4 ,approv$ c]tification programs4,sec4 #djd4 ,relation%ip betwe5 ,f$]al & ,/ate law4,sec4 #dje4 ,con/itutional avoidance4,sec4 #djf4 ,sev]ability4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,affirmative express cons5t ,! t]m affirmative express cons5t means1 ^u be+ pres5t$ ) a cle> & conspicu\s description ( an act or practice = :i* cons5t is s\ght1 an affirmative act by ! individual cle>ly communicat+ ! individual's au?orization = ! act or practice4 7#b7 ,algori?m ,! t]m algori?m means a computational process d]iv$ f ma*9e le>n+1 /ati/ics1 or o!r data process+ or artificial intellig5ce te*niques1 t processes cov]$ data = ! purpose ( mak+ a decision or facilitat+ human decision-mak+4 7#c7 ,collection ,! t]m collection means buy+1 r5t+1 ga!r+1 obta9+1 receiv+1 or access+ any cov]$ data ( an individual by any means4 7#d7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#e7 ,common br&+ ,! t]m common br&+ means a %>$ "n1 s]vicem>k1 or tradem>k4 7#f7 ,cov]$ data 7,a7 ,9 g5]al ,! t]m cov]$ data means in=mation t id5tifies or is l9k$ or reasonably l9kable to an individual or a device t is l9k$ or reasonably l9kable to an individual4 7,b7 ,l9k$ or reasonably l9kable ,= purposes ( subp>agraph 7,a71 in=mation held by a cov]$ entity is l9k$ or reasonably l9kable to an individual or a device if1 z a practical matt]1 x c be us$ on its own or 9 comb9ation ) o!r in=mation held by1 or readily accessible to1 ! cov]$ entity to id5tify su* individual or su* device4 7,c7 ,exclusions ,su* t]m does n include-- 7i7 aggregat$ data2 7ii7 de-id5tifi$ data2 7iii7 employee data2 or 7iv7 publicly available in=mation4 7,d7 ,aggregat$ data ,= purposes ( subp>agraph 7,c71 ! t]m aggregat$ data means in=mation t relates to a gr\p or category ( individuals or devices t does n id5tify & is n l9k$ or reasonably l9kable to any individual or device4 7,e7 ,de-id5tifi$ data ,= purposes ( subp>agraph 7,c71 ! t]m de-id5tifi$ data means in=mation held by a cov]$ entity t-- 7i7 does n id5tify1 & is n l9k$ or reasonably l9kable to1 an individual or device2 7ii7 does n conta9 any p]si/5t id5tifi] or o!r in=mation t c\ld readily be us$ to reid5tify ! individual to :om1 or ! device to :i*1 ! id5tifi] or in=mation p]ta9s2 7iii7 is subject to a public commitm5t by ! cov]$ entity-- 7,i7 to refra9 f attempt+ to use su* in=mation to id5tify any individual or device2 & 7,,ii7 to adopt te*nical & organizational measures to ensure t su* in=mation is n l9k$ to any individual or device2 & 7iv7 is n disclos$ by ! cov]$ entity to any o!r p>ty unless ! disclosure is subject to a contractually or o!r legally b9d+ requirem5t t-- 7,i7 ! recipi5t ( ! in=mation %all n use ! in=mation to id5tify any individual or device2 & 7,,ii7 all onw>d disclosures ( ! in=mation %all be subject to ! requirem5t describ$ 9 subclause 7,i74 7,f7 ,employee data ,= purposes ( subp>agraph 7,c71 ! t]m employee data means-- 7i7 in=mation relat+ to an individual collect$ by a cov]$ entity 9 ! c\rse ( ! individual act+ z a job applicant to1 or employee 7reg>dless ( :e!r su* employee is paid or unpaid1 or employ$ on a tempor>y basis71 own]1 director1 (fic]1 /aff memb]1 tra9ee1 v5dor1 visitor1 volunte]1 int]n1 or contractor (1 ! entity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ by ! cov]$ entity solely = purposes relat$ to ! individual's /atus z a curr5t or =m] job applicant to1 or an employee1 own]1 director1 (fic]1 /aff memb]1 tra9ee1 v5dor1 visitor1 volunte]1 int]n1 or contractor (1 t cov]$ entity2 7ii7 bus9ess contact in=mation ( an individual1 includ+ ! individual's "n1 position or title1 bus9ess telephone numb]1 bus9ess address1 bus9ess email address1 qualifications1 & o!r simil> in=mation1 t is provid$ to a cov]$ entity by an individual :o is act+ 9 a pr(essional capacity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = purposes relat$ to su* individual's pr(essional activities2 7iii7 em]g5cy contact in=mation collect$ by a cov]$ entity t relates to an individual :o is act+ 9 a role describ$ 9 clause 7i7 ) respect to ! cov]$ entity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = ! purpose ( hav+ an em]g5cy contact on file = ! individual2 or 7iv7 in=mation relat+ to an individual 7or a relative or b5efici>y ( su* individual7 t is necess>y = ! cov]$ entity to collect1 process1 or transf] = ! purpose ( adm9i/]+ b5efits to :i* su* individual 7or relative or b5efici>y ( su* individual7 is entitl$ on ! basis ( ! individual act+ 9 a role describ$ 9 clause 7i7 ) respect to ! entity1 provid$ t su* in=mation is collect$1 process$1 or transf]r$ solely = ! purpose ( adm9i/]+ su* b5efits4 7,g7 ,publicly available in=mation 7i7 ,9 g5]al ,= ! purposes ( subp>agraph 7,c71 ! t]m publicly available in=mation means any in=mation t a cov]$ entity has a reasonable basis to believe-- 7,i7 has be5 lawfully made available to ! g5]al public f ,f$]al1 ,/ate1 or local gov]nm5t records2 7,,ii7 is widely available to ! g5]al public1 includ+ in=mation f-- 7aa7 a telephone book or onl9e directory2 7bb7 television1 int]net1 or radio cont5t or programm+2 or 7cc7 ! news m$ia or a website t is lawfully available to ! g5]al public on an unre/rict$ basis 7= purposes ( ?is subclause a website is n re/rict$ solely because !re is a fee or log-9 requirem5t associat$ ) access+ ! website72 or 7,,iii7 is a disclosure to ! g5]al public t is requir$ to be made by ,f$]al1 ,/ate1 or local law4 7ii7 ,exclusions ,su* t]m does n include an obsc5e visual depiction 7z def9$ = purposes ( section #adfj ( title #ah1 ,unit$ ,/ates ,code74 7#g7 ,cov]$ entity ,! t]m cov]$ entity means any p]son t-- 7,a7 is subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 or is-- 7i7 a common c>ri] describ$ 9 section #e7;a77#b7 ( su* ,act 7#ae ,u4,s4,c4 #de7;a77#b772 or 7ii7 an organization n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s2 7,b7 collects1 processes1 or transf]s cov]$ data2 & 7,c7 det]m9es ! purposes & means ( su* collection1 process+1 or transf]4 7#h7 ,data ,brok] 7,a7 ,9 g5]al ,! t]m data brok] means a cov]$ entity ^: pr9cipal s\rce ( rev5ue is d]iv$ f process+ or transf]r+ ! cov]$ data ( individuals ) :om ! entity does n h a direct relation%ip on behalf ( ?ird p>ties = su* ?ird p>ties' use4 7,b7 ,exclusion ,su* t]m does n include a s]vice provid]4 7#i7 ,delete ,! t]m delete means to remove or de/roy in=mation su* t x is n ma9ta9$ 9 human or ma*9e readable =m & _c be retriev$ or utiliz$ 9 su* =m 9 ! normal c\rse ( bus9ess4 7#aj7 ,executive ag5cy ,! t]m ,executive ag5cy has ! mean+ set =? 9 section #aje ( title #e1 ,unit$ ,/ates ,code4 7#aa7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7#ab7 ,l>ge data hold] ,! t]m l>ge data hold] means a cov]$ entity t 9 ! mo/ rec5t cal5d> ye>-- 7,a7 process$ or transf]r$ ! cov]$ data ( m ?an #h1jjj1jjj individuals2 or 7,b7 process$ or transf]r$ ! s5sitive cov]$ data ( m ?an #cjj1jjj individuals or devices t are l9k$ or reasonably l9kable to an individual 7exclud+ any in/ance :]e ! cov]$ entity processes ! log-9 in=mation ( an individual or device to all[ ! individual or device to log 9 to an acc\nt adm9i/]$ by ! cov]$ entity74 7#ac7 ,mat]ial ,! t]m mat]ial means1 ) respect to an act1 practice1 or repres5tation ( a cov]$ entity 7includ+ a repres5tation made by ! cov]$ entity 9 a privacy policy or simil> disclosure to individuals71 t su* act1 practice1 or repres5tation is likely to affect an individual's decision or conduct reg>d+ a product or s]vice4 7#ad7 ,process ,! t]m process means any op]ation or set ( op]ations p]=m$ on cov]$ data includ+ analysis1 organization1 /ructur+1 reta9+1 us+1 or o!rwise h&l+ cov]$ data4 7#ae7 ,process+ purpose ,! t]m process+ purpose means a reason = :i* a cov]$ entity processes cov]$ data4 7#af7 ,rese>* ,! t]m rese>* means ! sci5tific analysis ( in=mation1 includ+ cov]$ data1 by a cov]$ entity or ^? ) :om ! cov]$ entity is coop]at+ or o!rs act+ at ! direction or on behalf ( ! cov]$ entity1 t is conduct$ = ! prim>y purpose ( advanc+ sci5tific k & may be = ! comm]cial b5efit ( ! cov]$ entity4 7#ag7 ,s5sitive cov]$ data 7,a7 ,9 g5]al ,! t]m s5sitive cov]$ data means any ( ! foll[+ =ms ( cov]$ data ( an individual3 7i7 ,a unique1 gov]nm5t-issu$ id5tifi]1 su* z a ,social ,security numb]1 passport numb]1 or driv]'s lic5se numb]1 t is n requir$ to be display$ to ! public4 7ii7 ,any cov]$ data t describes or reveals ! diagnosis or treatm5t ( ! pa/1 pres5t1 or future physical heal?1 m5tal heal?1 or disability ( an individual4 7iii7 ,a f9ancial acc\nt numb]1 debit c>d numb]1 cr$it c>d numb]1 or any requir$ security or access code1 password1 or cr$5tials all[+ access to any su* acc\nt4 7iv7 ,cov]$ data t is biometric in=mation4 7v7 ,precise geolocation in=mation4 7vi7 ,a p]si/5t id5tifi]4 7vii7 ,! cont5ts ( an individual's private communications1 su* z emails1 texts1 direct messages1 or mail1 or ! id5tity ( ! p>ties subject to su* communications1 unless ! cov]$ entity is ! int5d$ recipi5t ( ! communication4 7viii7 ,acc\nt log-9 cr$5tials su* z a us] "n or email address1 9 comb9ation ) a password or security "q & answ] t w\ld p]mit access to an onl9e acc\nt4 7ix7 ,cov]$ data reveal+ an individual's racial or e?nic orig91 or religion 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ ! process+ or transf] ( su* in=mation4 7x7 ,cov]$ data reveal+ ! sexual ori5tation or sexual behavior ( an individual 9 a mann] inconsi/5t ) ! individual's reasonable expectation reg>d+ ! process+ or transf] ( su* in=mation4 7xi7 ,cov]$ data ab\t ! onl9e activities ( an individual t addresses or reveals a category ( cov]$ data describ$ 9 ano!r clause ( ?is subp>agraph4 7xii7 ,cov]$ data t is cal5d> in=mation1 address book in=mation1 phone or text logs1 photos1 or videos ma9ta9$ = private use on an individual's device4 7xiii7 ,any cov]$ data collect$ or process$ by a cov]$ entity = ! purpose ( id5tify+ cov]$ data describ$ 9 ano!r clause ( ?is subp>agraph4 7xiv7 ,any o!r category ( cov]$ data designat$ by ! ,commission pursuant to a rulemak+ "u section #eec ( title #e1 ,unit$ ,/ates ,code4 7,b7 ,biometric in=mation ,= purposes ( subp>agraph 7,a71 ! t]m biometric in=mation-- 7i7 means ! physiological or biological *>act]i/ics ( an individual1 includ+ deoxyribonucleic acid1 t are us$1 s+ly or 9 comb9ation ) ea* o!r or ) o!r id5tify+ data1 to e/abli% ! id5tity ( an individual2 & 7ii7 includes-- 7,i7 imag]y ( ! iris1 ret9a1 f+]pr9t1 face1 h&1 palm1 ve9 patt]ns1 & voice record+s1 f :i* an id5tifi] template1 su* z a facepr9t1 a m9utiae template1 or a voicepr9t1 c be extract$2 & 7,,ii7 key/roke patt]ns or rhy?ms1 gait patt]ns or rhy?ms1 & sleep1 heal?1 or ex]cise data t conta9 id5tify+ in=mation4 7,c7 ,p]si/5t id5tifi] ,= purposes ( subp>agraph 7,a71 ! t]m p]si/5t id5tifi] means a te*nologically d]iv$ id5tifi] t id5tifies an individual1 or is l9k$ or reasonably l9kable to an individual ov] "t & across s]vices & plat=ms1 :i* may include a cu/om] numb] held 9 a cookie1 a /atic ,int]net ,protocol address1 a processor or device s]ial numb]1 or ano!r unique device id5tifi]4 7,d7 ,precise geolocation in=mation ,= purposes ( subp>agraph 7,a71 ! t]m precise geolocation in=mation means te*nologically d]iv$ in=mation capable ( det]m9+ ! pa/ or pres5t actual physical location ( an individual or an individual's device at a specific po9t 9 "t to )9 #a1gej feet4 7#ah7 ,s]vice provid] ,! t]m s]vice provid] means1 ) respect to a set ( cov]$ data1 a cov]$ entity t processes or transf]s su* cov]$ data = ! purpose ( p]=m+ #a or m s]vices or functions on behalf (1 & at ! direction (1 a cov]$ entity t-- 7,a7 is n relat$ to ! cov]$ entity provid+ ! s]vice or function by common own]%ip or corporate control2 & 7,b7 does n %>e common br&+ ) ! cov]$ entity provid+ ! s]vice or function4 7#ai7 ,s]vice provid] data ,! t]m s]vice provid] data means cov]$ data t is collect$ by ! s]vice provid] on behalf ( a cov]$ entity or transf]r$ to ! s]vice provid] by a cov]$ entity = ! purpose ( all[+ ! s]vice provid] to p]=m a s]vice or function on behalf (1 & at ! direction (1 su* cov]$ entity4 7#bj7 ,?ird p>ty ,! t]m ?ird p>ty means1 ) respect to a set ( cov]$ data1 a cov]$ entity-- 7,a7 t is n a s]vice provid] ) respect to su* cov]$ data2 & 7,b7 t receiv$ su* cov]$ data f ano!r cov]$ entity-- 7i7 t is n relat$ to ! cov]$ entity by common own]%ip or corporate control2 & 7ii7 t does n %>e common br&+ ) ! cov]$ entity4 7#ba7 ,?ird p>ty data ,! t]m ?ird p>ty data means1 ) respect to a ?ird p>ty1 cov]$ data t has be5 transf]r$ to ! ?ird p>ty by a cov]$ entity4 7#bb7 ,transf] ,! t]m transf] means to disclose1 release1 %>e1 dissem9ate1 make available1 or lic5se 9 writ+1 electronically1 or by any o!r means = consid]ation ( any k9d or = a comm]cial purpose4 #c4 ,effective date ,except z o!rwise provid$ 9 ?is ,act1 ?is ,act %all take effect #ah mon?s aft] ! date ( enactm5t ( ?is ,act4 ,i ,individual consum] data rights #aja4 ,consum] loyalty 7a7 ,prohibition on ! d5ial ( products or s]vices 7#a7 ,9 g5]al ,subject to p>agraph 7#b71 a cov]$ entity %all n d5y products or s]vices to an individual because ! individual ex]cises a "r e/abli%$ "u subp>agraph 7,a71 7,b71 or 7,d7 ( section #ajc7;a77#a74 7#b7 ,rules ( application ,a cov]$ entity-- 7,a7 %all n be 9 violation ( p>agraph 7#a7 ) respect to a product or s]vice & an individual if ! ex]cise ( a "r describ$ 9 su* p>agraph by ! individual precludes ! cov]$ entity f provid+ su* product or s]vice to su* individual2 & 7,b7 may (f] diff]5t types ( pric+ & functionalities ) respect to a product or s]vice bas$ on an individual's ex]cise ( a "r describ$ 9 su* p>agraph4 7b7 ,no waiv] ( individual controls ,! rights & obligations creat$ "u section #ajc may n be waiv$ 9 an agreem5t betwe5 a cov]$ entity & an individual4 #ajb4 ,transp>5cy 7a7 ,9 g5]al ,a cov]$ entity t processes cov]$ data %all1 ) respect to su* data1 publi% a privacy policy t is-- 7#a7 disclos$1 9 a cle> & conspicu\s mann]1 to an individual prior to or at ! po9t ( ! collection ( cov]$ data f ! individual2 & 7#b7 made available1 9 a cle> & conspicu\s mann]1 to ! public4 7b7 ,cont5t ( privacy policy ,! privacy policy requir$ "u subsection 7a7 %all include ! foll[+3 7#a7 ,! id5tity & ! contact in=mation ( ! cov]$ entity 7includ+ ! cov]$ entity's po9ts ( contact = privacy & data security inquiries7 & ! id5tity ( any affiliate to :i* cov]$ data may be transf]r$ by ! cov]$ entity4 7#b7 ,! categories ( cov]$ data ! cov]$ entity collects4 7#c7 ,! process+ purposes = ea* category ( cov]$ data ! cov]$ entity collects4 7#d7 ,:e!r ! cov]$ entity transf]s cov]$ data1 ! categories ( recipi5ts to :om ! cov]$ entity transf]s cov]$ data1 & ! purposes ( ! transf]s4 7#e7 ,a g5]al description ( ! cov]$ entity's data ret5tion practices = cov]$ data & ! purposes = su* ret5tion4 7#f7 ,h[ individuals c ex]cise _! rights "u section #ajc4 7#g7 ,a g5]al description ( ! cov]$ entity's data security practices4 7#h7 ,! effective date ( ! privacy policy4 7c7 ,languages ,a privacy policy requir$ "u subsection 7a7 %all be made available 9 all ( ! languages 9 :i* ! cov]$ entity provides a product or s]vice t is subject to ! policy1 or c>ries out activities relat$ to su* product or s]vice4 7d7 ,mat]ial *anges ,if a cov]$ entity makes a mat]ial *ange to its privacy policy1 x %all notify ! individuals affect$ be=e fur!r process+ or transf]r+ ( previ\sly collect$ cov]$ data &1 except z provid$ 9 section #ajh1 provide an opportunity to )draw cons5t to fur!r process+ or transf]r+ ( ! cov]$ data "u ! *ang$ policy4 ,! cov]$ entity %all provide direct notification1 :]e possible1 reg>d+ a mat]ial *ange to ! privacy policy to affect$ individuals1 tak+ into acc\nt available te*nology & ! nature ( ! relation%ip4 7e7 ,application to indirect transf]s ,:]e ! own]%ip ( an individual's device is transf]r$ directly f "o individual to ano!r individual1 a cov]$ entity may satisfy its obligation to disclose a privacy policy prior to or at ! po9t ( collection ( cov]$ data by mak+ ! privacy policy available "u subsection 7a77#b74 #ajc4 ,individual control 7a7 ,access to1 & correction1 deletion1 & portability (1 cov]$ data 7#a7 ,9 g5]al ,subject to p>agraphs 7#b7 & 7#c7 & section #ajh1 a cov]$ entity %all provide an individual1 imm$iately or z quickly z possible & 9 no case lat] ?an #ij days aft] receiv+ a v]ifi$ reque/ f ! individual1 ) ! "r to reasonably-- 7,a7 access-- 7i7 ! cov]$ data ( ! individual1 or an accurate repres5tation ( ! cov]$ data ( ! individual1 t is or has be5 process$ by ! cov]$ entity or any s]vice provid] on behalf ( ! cov]$ entity2 7ii7 if applicable1 a li/ ( categories ( ?ird p>ties & s]vice provid]s to :om ! cov]$ entity has transf]r$ ! cov]$ data ( ! individual2 & 7iii7 if a cov]$ entity transf]s cov]$ data1 a description ( ! purpose = :i* ! cov]$ entity transf]r$ ! cov]$ data ( ! individual to a s]vice provid] or ?ird p>ty2 7,b7 reque/ t ! cov]$ entity-- 7i7 correct inaccuracies or incomplete in=mation ) respect to ! cov]$ data ( ! individual t is ma9ta9$ by ! cov]$ entity2 & 7ii7 notify any s]vice provid] or ?ird p>ty to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! correct$ in=mation2 7,c7 reque/ t ! cov]$ entity-- 7i7 ei!r delete or deid5tify cov]$ data ( ! individual t is or has be5 ma9ta9$ by ! cov]$ entity2 & 7ii7 notify any s]vice provid] or ?ird p>ty to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! individual's reque/ "u clause 7i71 unless ! transf] ( su* data to ! ?ird p>ty 0 made at ! direction ( ! individual2 & 7,d7 to ! ext5t t is te*nically feasible1 provide cov]$ data ( ! individual t is or has be5 g5]at$ & submitt$ to ! cov]$ entity by ! individual & ma9ta9$ by ! cov]$ entity 9 a portable1 /ructur$1 & ma*9e-readable =mat t is n subject to lic5s+ re/rictions4 7#b7 ,frequ5cy & co/ ( access ,a cov]$ entity %all-- 7,a7 provide an individual ) ! opportunity to ex]cise ! rights describ$ 9 p>agraph 7#a7 n less ?an twice 9 any #ab-mon? p]iod2 & 7,b7 ) respect to ! fir/ #b times t an individual ex]cises ! rights describ$ 9 p>agraph 7#a7 9 any #ab-mon? p]iod1 all[ ! individual to ex]cise su* rights free ( *>ge4 7#c7 ,exceptions ,a cov]$ entity-- 7,a7 %all n comply ) a reque/ to ex]cise ! rights describ$ 9 p>agraph 7#a7 if ! cov]$ entity _c v]ify-- 7i7 t ! individual mak+ ! reque/ is ! individual to :om ! cov]$ data t is ! subject ( ! reque/ relates2 or 7ii7 ! individual's ass]tion "u p>agraph 7#a77;,b7 t su* in=mation is inaccurate or incomplete2 7,b7 may decl9e to comply ) a reque/ t w\ld-- 7i7 require ! cov]$ entity to reta9 any cov]$ data = ! sole purpose ( fulfill+ ! reque/2 7ii7 be impossible or demon/rably impracticable to comply )2 7iii7 require ! cov]$ entity to comb9e1 rel9k1 or o!rwise reid5tify cov]$ data t has be5 deid5tifi$2 7iv7 result 9 ! release ( trade secrets1 or o!r propriet>y or confid5tial data or bus9ess practices2 7v7 int]f]e ) law en=cem5t1 judicial proce$+s1 inve/igations1 or reasonable ef=ts to gu>d aga9/1 detect1 or inve/igate malici\s or unlawful activity1 or en=ce contracts2 7vi7 require disproportionate ef=t1 tak+ into consid]ation available te*nology1 or w\ld n be reasonably feasible on te*nical gr\nds2 7vii7 compromise ! privacy1 security1 or o!r rights ( ! cov]$ data ( ano!r individual2 7viii7 be excessive or abusive to ano!r individual2 or 7ix7 violate ,f$]al or ,/ate law or ! rights & fre$oms ( ano!r individual1 includ+ "u ! ,con/itution ( ! ,unit$ ,/ates2 & 7,c7 may delete cov]$ data in/ead ( provid+ access & correction rights "u subp>agraphs 7,a7 & 7,b7 ( p>agraph 7#a7 if su* cov]$ data-- 7i7 is n s5sitive cov]$ data2 & 7ii7 is us$ only = ! purposes ( contact+ individuals ) respect to m>ket+ communications4 7b7 ,regulations ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 e/abli%+ processes by :i* cov]$ entities may v]ify reque/s to ex]cise rights describ$ 9 subsection 7a77#a74 #ajd4 ,rights to cons5t 7a7 ,cons5t ,except z provid$ 9 section #ajh1 a cov]$ entity %all n1 )\t ! prior1 affirmative express cons5t ( an individual-- 7#a7 transf] s5sitive cov]$ data ( ! individual to a ?ird p>ty2 or 7#b7 process s5sitive cov]$ data ( ! individual4 7b7 ,requirem5ts = affirmative express cons5t ,9 obta9+ ! affirmative express cons5t ( an individual to process ! s5sitive cov]$ data ( ! individual z requir$ "u subsection 7a77#b71 a cov]$ entity %all provide ! individual ) notice t %all-- 7#a7 include a cle> description ( ! process+ purpose = :i* ! s5sitive cov]$ data w be process$2 7#b7 cle>ly id5tify any process+ purpose t is necess>y to fulfill a reque/ made by ! individual2 7#c7 include a prom95t head+ t w\ld enable a reasonable individual to easily id5tify ! process+ purpose = :i* cons5t is s\ght2 & 7#d7 cle>ly expla9 ! individual's "r to provide or )hold cons5t4 7c7 ,requirem5ts relat$ to m9ors ,a cov]$ entity %all n transf] ! cov]$ data ( an individual to a ?ird-p>ty )\t affirmative express cons5t f ! individual or ! individual's p>5t or gu>dian if ! cov]$ entity has actual k t ! individual is betwe5 #ac & #af ye>s ( age4 7d7 ,"r ,to opt out ,except z provid$ 9 section #ajh1 a cov]$ entity %all provide an individual ) ! ability to opt out ( ! collection1 process+1 or transf] ( su* individual's cov]$ data be=e su* collection1 process+1 or transf] occurs4 7e7 ,prohibition on inf]r$ cons5t ,a cov]$ entity %all n inf] t an individual has provid$ affirmative express cons5t to a process+ purpose f ! inaction ( ! individual or ! individual's cont9u$ use ( a s]vice or product provid$ by ! cov]$ entity4 7f7 ,)drawal ( cons5t ,a cov]$ entity %all provide an individual ) a cle> & conspicu\s means to )draw affirmative express cons5t4 7g7 ,rulemak+ ,! ,commission may promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to e/abli% cle> & conspicu\s proc$ures = all[+ individuals to provide or )draw affirmative express cons5t = ! collection ( s5sitive cov]$ data4 #aje4 ,m9imiz+ data collection1 process+1 & ret5tion 7a7 ,9 g5]al ,except z provid$ 9 section #ajh1 a cov]$ entity %all n collect1 process1 or transf] cov]$ data beyond-- 7#a7 :at is reasonably necess>y1 proportionate1 & limit$ to provide or improve a product1 s]vice1 or a communication ab\t a product or s]vice1 includ+ :at is reasonably necess>y1 proportionate1 & limit$ to provide a product or s]vice specifically reque/$ by an individual or reasonably anticipat$ )9 ! context ( ! cov]$ entity's ongo+ relation%ip ) an individual2 7#b7 :at is reasonably necess>y1 proportionate1 or limit$ to o!rwise process or transf] cov]$ data 9 a mann] t is describ$ 9 ! privacy policy t ! cov]$ entity is requir$ to publi% "u section #ajb7;a72 or 7#c7 :at is expressly p]mitt$ by ?is ,act or any o!r applicable ,f$]al law4 7b7 ,be/ practices ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidel9es recomm5d+ be/ practices = cov]$ entities to m9imize ! collection1 process+1 & transf] ( cov]$ data 9 accordance ) ?is section4 7c7 ,rule ( con/ruction ,not)/&+ section #djd ( ?is ,act1 no?+ 9 ?is section sup]s$es any o!r provision ( ?is ,act or o!r applicable ,f$]al law4 #ajf4 ,s]vice provid]s & ?ird p>ties 7a7 ,s]vice provid]s ,a s]vice provid]-- 7#a7 %all n process s]vice provid] data = any process+ purpose t is n p]=m$ on behalf (1 & at ! direction (1 ! cov]$ entity t transf]r$ ! data to ! s]vice provid]2 7#b7 %all n transf] s]vice provid] data to a ?ird p>ty = any purpose o!r ?an a purpose p]=m$ on behalf (1 or at ! direction (1 ! cov]$ entity t transf]r$ ! data to ! s]vice provid]2 7#c7 at ! direction ( ! cov]$ entity t transf]r$ s]vice provid] data to ! s]vice provid]1 %all delete or deid5tify su* data-- 7,a7 z soon z practicable aft] ! s]vice provid] has complet$ provid+ ! s]vice or function = :i* ! data 0 transf]r$ to ! s]vice provid]2 or 7,b7 z soon z practicable aft] ! end ( ! p]iod dur+ :i* ! s]vice provid] is to provide s]vices ) respect to su* data1 z agre$ to by ! s]vice provid] & ! cov]$ entity t transf]r$ ! data2 7#d7 is exempt f ! requirem5ts ( section #ajc ) respect to s]vice provid] data1 b %all1 to ! ext5t practicable-- 7,a7 assi/ ! cov]$ entity f :i* x receiv$ ! s]vice provid] data 9 fulfill+ reque/s to ex]cise rights "u section #ajc7;a72 & 7,b7 ^u receiv+ notice f a cov]$ entity ( a v]ifi$ reque/ made "u section #ajc7;a77#a7 to delete1 deid5tify1 or correct s]vice provid] data held by ! s]vice provid]1 delete1 deid5tify1 or correct su* data2 & 7#e7 is exempt f ! requirem5ts ( sections #ajd & #aje4 7b7 ,?ird p>ties ,a ?ird p>ty-- 7#a7 %all n process ?ird p>ty data = a process+ purpose inconsi/5t ) ! reasonable expectation ( ! individual to :om su* data relates2 7#b7 = purposes ( p>agraph 7#a71 may reasonably rely on repres5tations made by ! cov]$ entity t transf]r$ ?ird p>ty data reg>d+ ! reasonable expectations ( individuals to :om su* data relates1 provid$ t ! ?ird p>ty conducts reasonable due dilig5ce on ! repres5tations ( ! cov]$ entity & f9ds ^? repres5tations to be cr$ible2 & 7#c7 is exempt f ! requirem5ts ( sections #ajd & #aje4 7c7 ,bankruptcy ,9 ! ev5t t a cov]$ entity ent]s into a bankruptcy proce$+ :i* w\ld lead to ! disclosure ( cov]$ data to a ?ird p>ty1 ! cov]$ entity %all 9 a reasonable "t prior to ! disclosure-- 7#a7 provide notice ( ! propos$ disclosure ( cov]$ data1 includ+ ! "n ( ! ?ird p>ty & its policies & practices ) respect to ! cov]$ data1 to all affect$ individuals2 & 7#b7 provide ea* affect$ individual ) ! opportunity to )draw any previ\s affirmative express cons5t relat$ to ! cov]$ data ( ! individual or reque/ ! deletion or deid5tification ( ! cov]$ data ( ! individual4 7d7 ,additional obligations on cov]$ entities 7#a7 ,9 g5]al ,a cov]$ entity %all ex]cise reasonable due dilig5ce to ensure compliance ) ?is section be=e-- 7,a7 select+ a s]vice provid]2 or 7,b7 decid+ to transf] cov]$ data to a ?ird p>ty4 7#b7 ,guidance ,n lat] ?an #b ye>s aft] ! effective date ( ?is ,act1 ! ,commission %all publi% guidance reg>d+ compliance ) ?is subsection4 ,su* guidance %all1 to ! ext5t practicable1 m9imize unreasonable burd5s on small- & m$ium-siz$ cov]$ entities4 #ajg4 ,privacy impact assessm5ts 7a7 ,privacy impact assessm5ts ( new or mat]ial *anges to process+ ( cov]$ data 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act 7or1 if lat]1 n lat] ?an #a ye> aft] a cov]$ entity fir/ meets ! def9ition ( a l>ge data hold] 7z def9$ 9 section #b771 ea* cov]$ entity t is a l>ge data hold] %all conduct a privacy impact assessm5t ( ea* ( its process+ activities involv+ cov]$ data t pres5t a height5$ risk ( h>m to individuals1 & ea* su* assessm5t %all weigh ! b5efits ( ! cov]$ entity's cov]$ data collection1 process+1 & transf] practices aga9/ ! pot5tial adv]se consequ5ces to individual privacy ( su* practices4 7#b7 ,assessm5t requirem5ts ,a privacy impact assessm5t requir$ "u p>agraph 7#a7-- 7,a7 %all be reasonable & appropriate 9 scope giv5-- 7i7 ! nature ( ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7ii7 ! volume ( ! cov]$ data collect$1 process$1 or transf]r$ by ! cov]$ entity2 7iii7 ! size ( ! cov]$ entity2 & 7iv7 ! pot5tial risks pos$ to ! privacy ( individuals by ! collection1 process+1 or transf] ( cov]$ data by ! cov]$ entity2 7,b7 %all be docum5t$ 9 writt5 =m & ma9ta9$ by ! cov]$ entity unless r5d]$ out ( date by a subsequ5t assessm5t conduct$ "u subsection 7b72 & 7,c7 %all be approv$ by ! data privacy (fic] ( ! cov]$ entity4 7b7 ,ongo+ privacy impact assessm5ts 7#a7 ,9 g5]al ,a cov]$ entity t is a l>ge data hold] %all1 n less frequ5tly ?an once e #b ye>s aft] ! cov]$ entity conduct$ ! privacy impact assessm5t requir$ "u subsection 7a71 conduct a privacy impact assessm5t ( ! collection1 process+1 & transf] ( cov]$ data by ! cov]$ entity to assess ! ext5t to :i*-- 7,a7 ! ongo+ practices ( ! cov]$ entity are consi/5t ) ! cov]$ entity's publi%$ privacy policies2 7,b7 any cu/omizable privacy sett+s includ$ 9 a s]vice or product (f]$ by ! cov]$ entity are adequately accessible to individuals :o use ! s]vice or product & are effective 9 meet+ ! privacy pref]5ces ( su* individuals2 7,c7 ! practices & privacy sett+s describ$ 9 subp>agraphs 7,a7 & 7,b71 respectively-- 7i7 meet ! expectations ( a reasonable individual2 & 7ii7 provide an individual ) adequate control ov] ! individual's cov]$ data2 7,d7 ! cov]$ entity c\ld enhance ! privacy & security ( cov]$ data ?r\gh te*nical or op]ational safegu>ds su* z encryption1 deid5tification1 & o!r privacy-enhanc+ te*nologies2 & 7,e7 ! process+ ( cov]$ data is compatible ) ! /at$ purposes = :i* x 0 collect$4 7#b7 ,approval by data privacy (fic] ,! data privacy (fic] ( a cov]$ entity %all approve ! f9d+s ( an assessm5t conduct$ by ! cov]$ entity "u ?is subsection4 #ajh4 ,scope ( cov]age 7a7 ,g5]al exceptions ,not)/&+ any provision ( ?is title o!r ?an subsections 7a7 ?r\gh 7c7 ( section #ajb1 a cov]$ entity may collect1 process or transf] cov]$ data = any ( ! foll[+ purposes1 provid$ t ! collection1 process+1 or transf] is reasonably necess>y1 proportionate1 & limit$ to su* purpose3 7#a7 ,to initiate or complete a transaction or to fulfill an ord] or provide a s]vice specifically reque/$ by an individual1 includ+ associat$ r\t9e adm9i/rative activities su* z bill+1 %ipp+1 f9ancial report+1 & acc\nt+4 7#b7 ,to p]=m int]nal sy/em ma9t5ance1 diagno/ics1 product or s]vice managem5t1 inv5tory managem5t1 & network managem5t4 7#c7 ,to prev5t1 detect1 or respond to a security incid5t or trespass+1 provide a secure environm5t1 or ma9ta9 ! safety & security ( a product1 s]vice1 network1 or individual4 7#d7 ,to protect aga9/ malici\s1 deceptive1 fraudul5t1 or illegal activity4 7#e7 ,to comply ) a legal obligation or ! e/abli%m5t1 ex]cise1 analysis1 or def5se ( legal claims or rights1 or z requir$ or specifically au?oriz$ by law4 7#f7 ,to comply ) a civil1 crim9al1 or regulatory inquiry1 inve/igation1 subpo5a1 or summons by an ,executive ag5cy4 7#g7 ,to coop]ate ) an ,executive ag5cy or a law en=cem5t (ficial act+ "u ! au?ority ( an ,executive or ,/ate ag5cy conc]n+ conduct or activity t ! ,executive ag5cy or law en=cem5t (ficial reasonably & 9 good fai? believes may violate ,f$]al1 ,/ate1 or local law1 or pose a ?reat to public safety or national security4 7#h7 ,to address risks to ! safety ( an individual or gr\p ( individuals1 or to ensure cu/om] safety1 includ+ by au!nticat+ individuals 9 ord] to provide access to l>ge v5ues op5 to ! public4 7#i7 ,to effectuate a product recall pursuant to ,f$]al or ,/ate law4 7#aj7 ,to conduct public or pe]-review$ sci5tific1 hi/orical1 or /ati/ical rese>* t-- 7,a7 is 9 ! public int]e/2 7,b7 adh]es to all applicable e?ics & privacy laws2 & 7,c7 is approv$1 monitor$1 & gov]n$ by an in/itutional review bo>d or o!r ov]sight entity t meets /&>ds promulgat$ by ! ,commission pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code4 7#aa7 ,to transf] cov]$ data to a s]vice provid]4 7#ab7 ,= a purpose id5tifi$ by ! ,commission pursuant to a regulation promulgat$ "u subsection 7b74 7b7 ,additional purposes ,! ,commission may promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 id5tify+ additional purposes = :i* a cov]$ entity may collect1 process or transf] cov]$ data4 7c7 ,small bus9ess exception ,sections #ajc1 #aje1 & #cja %all n apply 9 ! case ( a cov]$ entity t c e/abli% t1 = ! #c prec$+ cal5d> ye>s 7or = ! p]iod dur+ :i* ! cov]$ entity has be5 9 exi/5ce if su* p]iod is less ?an #c ye>s7-- 7#a7 ! cov]$ entity's av]age annual gross rev5ues did n exce$ #ej1jjj1jjj2 7#b7 on av]age1 ! cov]$ entity annually process$ ! cov]$ data ( less ?an #a1jjj1jjj individuals2 7#c7 ! cov]$ entity nev] employ$ m ?an #ejj individuals at any "o "t2 & 7#d7 ! cov]$ entity d]iv$ less ?an #ej p]c5t ( its rev5ues f transf]r+ cov]$ data4 ,,ii ,data transp>5cy1 integrity1 & security #bja4 ,civil rights1 algori?m bias1 detection1 & mitigation 7a7 ,civil rights protections ,a cov]$ entity1 s]vice provid]1 or ?ird p>ty may n collect1 process1 or transf] cov]$ data 9 violation ( ,f$]al civil rights laws4 7b7 ,,ftc en=cem5t assi/ance 7#a7 ,9 g5]al ,:5ev] ! ,commission obta9s in=mation t a cov]$ entity may h process$ or transf]r$ cov]$ data 9 violation ( ,f$]al civil rights laws1 ! ,commission %all transmit su* in=mation 7exclud+ any su* in=mation t is a trade secret z def9$ by section #ahci ( title #ah1 ,unit$ ,/ates ,code7 to ! appropriate ,executive ag5cy or ,/ate ag5cy ) au?ority to initiate proce$+s relat+ to su* violation4 7#b7 ,annual report ,beg9n+ 9 #bjbb1 ! ,commission %all submit an annual report to ,congress t includes-- 7,a7 a summ>y ( ! types ( in=mation ! ,commission transmitt$ to ,executive ag5cies or ,/ate ag5cies dur+ ! prec$+ ye> pursuant to ?is subsection2 & 7,b7 a summ>y ( h[ su* in=mation relates to ,f$]al civil rights laws4 7#c7 ,coop]ation ) o!r ag5cies ,! ,commission may implem5t ?is subsection by execut+ agreem5ts or memor&a ( und]/&+ ) ! appropriate ,executive ag5cies4 7#d7 ,relation%ip to o!r laws ,not)/&+ section #djd1 no?+ 9 ?is subsection %all sup]s$e any o!r provision ( law4 7c7 ,algori?m transp>5cy reports 7#a7 ,/udy & report 7,a7 ,/udy ,! ,commission %all conduct a /udy1 us+ ! ,commission's au?ority "u section #f7;b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;b771 exam9+ ! use ( algori?ms to process cov]$ data 9 a mann] t may violate ,f$]al anti-discrim9ation laws4 7,b7 ,report ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all publi% a report conta9+ ! results ( ! /udy requir$ "u subp>agraph 7,a74 7,c7 ,guidance ,! ,commission %all use ! results ( ! /udy describ$ 9 subp>agraph 7,a7 to develop guidance to assi/ cov]$ entities 9 avoid+ ! use ( algori?ms to process cov]$ data 9 a mann] t violates ,f$]al civil rights laws4 7#b7 ,updat$ report ,n lat] ?an #e ye>s aft] ! publication ( ! report requir$ "u p>agraph 7#a71 ! ,commission %all publi% an updat$ report4 #bjb4 ,data brok]s 7a7 ,9 g5]al ,n lat] ?an ,janu>y #ca ( ea* cal5d> ye> t foll[s a cal5d> ye> dur+ :i* a cov]$ entity act$ z a data brok]1 su* cov]$ entity %all regi/] ) ! ,commission pursuant to ! requirem5ts ( ?is section4 7b7 ,regi/ration requirem5ts ,9 regi/]+ ) ! ,commission z requir$ "u subsection 7a71 a data brok] %all d ! foll[+3 7#a7 ,pay to ! ,commission a regi/ration fee ( #ajj4 7#b7 ,provide ! ,commission ) ! foll[+ in=mation3 7,a7 ,! "n & prim>y physical1 email1 & int]net addresses ( ! data brok]4 7,b7 ,any additional in=mation or explanation ! data brok] *ooses to provide conc]n+ its data collection & process+ practices4 7c7 ,p5alties ,a data brok] t fails to regi/] z requir$ "u subsection 7a7 %all be liable =-- 7#a7 a civil p5alty ( #ej = ea* day x fails to regi/]1 n to exce$ a total ( #aj1jjj = ea* ye>2 & 7#b7 an am\nt equal to ! fees due "u ?is section = ea* ye> t x fail$ to regi/] z requir$ "u subsection 7a74 7d7 ,publication ( regi/ration in=mation ,! ,commission %all publi% on ! int]net website ( ! ,commission ! regi/ration in=mation provid$ by data brok]s "u ?is section4 #bjc4 ,protection ( cov]$ data 7a7 ,9 g5]al ,a cov]$ entity %all e/abli%1 implem5t1 & ma9ta9 reasonable adm9i/rative1 te*nical1 & physical data security policies & practices to protect aga9/ risks to ! confid5tiality1 security1 & integrity ( cov]$ data4 7b7 ,data security requirem5ts ,! data security policies & practices requir$ "u subsection 7a7 %all be-- 7#a7 appropriate to ! size & complexity ( ! cov]$ entity1 ! nature & scope ( ! cov]$ entity's collection or process+ ( cov]$ data1 ! volume & nature ( ! cov]$ data at issue1 & ! co/ ( available tools to improve security & r$uce vuln]abilities2 & 7#b7 design$ to-- 7,a7 id5tify & assess vuln]abilities to cov]$ data2 7,b7 take reasonable prev5tative & corrective action to address kn[n vuln]abilities to cov]$ data2 & 7,c7 detect1 respond to1 & recov] f cyb]security incid5ts relat$ to cov]$ data4 7c7 ,rulemak+ & guidance 7#a7 ,rulemak+ au?ority & scope 7,a7 ,9 g5]al ,! ,commission may1 pursuant to a proce$+ 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 issue regulations to id5tify processes = receiv+ & assess+ in=mation reg>d+ vuln]abilities to cov]$ data t are report$ to ! cov]$ entity4 7,b7 ,consultation ) ,,ni/ ,9 promulgat+ regulations "u ?is p>agraph1 ! ,commission %all consult )1 & take into consid]ation guidance f1 ! ,national ,in/itute = ,/&>ds & ,te*nology4 7#b7 ,guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all issue guidance to cov]$ entities on h[ to-- 7,a7 id5tify & assess vuln]abilities to cov]$ data1 includ+-- 7i7 ! pot5tial = unau?oriz$ access to cov]$ data2 7ii7 vuln]abilities 9 ! cov]$ entity's collection or process+ ( cov]$ data2 7iii7 ! managem5t ( access rights2 & 7iv7 ! use ( s]vice provid]s to process cov]$ data2 7,b7 take reasonable prev5tative & corrective action to address vuln]abilities to cov]$ data2 & 7,c7 detect1 respond to1 & recov] f cyb]security incid5ts & ev5ts4 7d7 ,applicability ( o!r in=mation security laws ,a cov]$ entity t is requir$ to comply ) title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 or ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq471 & is 9 compliance ) ! in=mation security requirem5ts ( su* ,act1 %all be deem$ to be 9 compliance ) ! requirem5ts ( ?is section ) respect to cov]$ data t is subject to ! requirem5ts ( su* ,act4 ,,iii ,corporate acc\ntability #cja4 ,designation ( data privacy (fic] & data security (fic] 7a7 ,9 g5]al ,a cov]$ entity %all designate-- 7#a7 #a or m qualifi$ employees or contractors z a data privacy (fic]2 & 7#b7 #a or m qualifi$ employees or contractors 79 addition to any employee or contractor designat$ "u p>agraph 7#a77 z a data security (fic]4 7b7 ,responsibilities ( data privacy (fic]s & data security (fic]s ,an employee or contractor :o is designat$ by a cov]$ entity z a data privacy (fic] or a data security (fic] %all be responsible =1 at a m9imum1 coord9at+ ! cov]$ entity's policies & practices reg>d+-- 7#a7 9 ! case ( a data privacy (fic]1 compliance ) ! privacy requirem5ts ) respect to cov]$ data "u ?is ,act2 & 7#b7 9 ! case ( a data security (fic]1 ! security requirem5ts ) respect to cov]$ data "u ?is ,act4 #cjb4 ,int]nal controls ,a cov]$ entity %all ma9ta9 int]nal controls & report+ /ructures to ensure t appropriate s5ior managem5t (ficials ( ! cov]$ entity are involv$ 9 assess+ risks & mak+ decisions t implicate compliance ) ?is ,act4 #cjc4 ,:i/lebl[] protections 7a7 ,def9itions ,= purposes ( ?is section3 7#a7 ,:i/lebl[] ,! t]m :i/lebl[] means any employee or contractor ( a cov]$ entity :o volunt>ily provides to ! ,commission orig9al in=mation relat+ to non-compliance )1 or any violation or alleg$ violation (1 ?is ,act or any regulation promulgat$ "u ?is ,act4 7#b7 ,orig9al ,in=mation ,! t]m orig9al in=mation means in=mation t is provid$ to ! ,commission by an individual &-- 7,a7 is d]iv$ f ! indep5d5t k or analysis ( an individual2 7,b7 is n kn[n to ! ,commission f any o!r s\rce at ! "t ! individual provides ! in=mation2 & 7,c7 is n exclusively d]iv$ f an allegation made 9 a judicial or an adm9i/rative action1 9 a gov]nm5tal report1 a he>+1 an audit1 or an inve/igation1 or f news m$ia1 unless ! individual is a s\rce ( ! allegation4 7b7 ,effect ( :i/lebl[] retaliations on p5alties ,9 seek+ p5alties "u section #dja = a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act by a cov]$ entity1 ! ,commission %all consid] :e!r ! cov]$ entity retaliat$ aga9/ an individual :o 0 a :i/lebl[] ) respect to orig9al in=mation t l$ to ! successful resolution ( an adm9i/rative or judicial action br\ght by ! ,commission or ! ,attorney ,g5]al ( ! ,unit$ ,/ates on behalf ( ! ,commission "u ?is ,act aga9/ su* cov]$ entity4 ,,iv ,en=cem5t au?ority & new programs #dja4 ,en=cem5t by ! ,f$]al ,trade ,commission 7a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7b7 ,p[]s ( commission 7#a7 ,9 g5]al ,except z provid$ 9 subsections 7c7 & 7d71 ! ,commission %all en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 7#b7 ,privileges & immunities ,any p]son :o violates ?is ,act or a regulation promulgat$ "u ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,limit+ c]ta9 actions unrelat$ to ?is ,act2 au?ority pres]v$ ,! ,commission %all n br+ any action to en=ce ! prohibition 9 section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 on unfair or deceptive acts or practices ) respect to ! privacy or security ( cov]$ data1 unless su* alleg$ act ( practice violates ?is ,act4 7c7 ,common c>ri]s & nonpr(it organizations ,not)/&+ section #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation ( ! ,commission1 ! ,commission %all also en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act1 9 ! same mann] provid$ 9 subsections 7a7 & 7b7 ( ?is subsection1 ) respect to-- 7#a7 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto2 & 7#b7 organizations n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s4 7d7 ,data privacy & security fund 7#a7 ,e/abli%m5t ( ,victims ,relief ,fund ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a sep>ate fund to be kn[n z ! ,data ,privacy & ,security ,victims ,relief ,fund 7ref]r$ to 9 ?is p>agraph z ! ,victims ,relief ,fund74 7#b7 ,deposits 7,a7 ,deposits f ! commission ,! ,commission %all deposit into ! ,victims ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any action ! ,commission comm5ces to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act4 7,b7 ,deposits f ! ,attorney ,g5]al ,! ,attorney ,g5]al ( ! ,unit$ ,/ates %all deposit into ! ,victims ,relief ,fund ! am\nt ( any civil p5alty obta9$ aga9/ any cov]$ entity 9 any action ! ,attorney ,g5]al comm5ces on behalf ( ! ,commission to en=ce ?is ,act or a regulation promulgat$ "u ?is ,act4 7#c7 ,use ( fund am\nts ,am\nts 9 ! ,victims ,relief ,fund %all be available to ! ,commission1 )\t fiscal ye> limitation1 to provide r$ress1 paym5ts or comp5sation1 or o!r monet>y relief to individuals h>m$ by an act or practice = :i* civil p5alties h be5 impos$ "u ?is ,act4 ,to ! ext5t t individuals _c be locat$ or su* r$ress1 paym5ts or comp5sation1 or o!r monet>y relief are o!rwise n practicable1 ! ,commission may use su* funds = ! purpose ( consum] or bus9ess education relat+ to data privacy & security or = ! purpose ( engag+ 9 te*nological rese>* t ! ,commission consid]s necess>y to en=ce ?is ,act4 7#d7 ,am\nts n subject to apportionm5t ,not)/&+ any o!r provision ( law1 am\nts 9 ! ,victims ,relief ,fund %all n be subject to apportionm5t = purposes ( *apt] #ae ( title #ca1 ,unit$ ,/ates ,code1 or "u any o!r au?ority4 7e7 ,au?orization ( appropriations ,!re is au?oriz$ to be appropriat$ to ! ,commission #ajj1jjj1jjj to c>ry out ?is ,act4 #djb4 ,en=cem5t by ,/ate attorneys g5]al 7a7 ,civil action ,9 any case 9 :i* ! attorney g5]al ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( t ,/ate has be5 or is adv]sely affect$ by ! engagem5t ( any cov]$ entity 9 an act or practice t violates ?is ,act or a regulation promulgat$ "u ?is ,act1 ! attorney g5]al ( ! ,/ate1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7#a7 enjo9 t act or practice2 7#b7 en=ce compliance ) ?is ,act or ! regulation2 7#c7 obta9 damages1 civil p5alties1 re/itution1 or o!r comp5sation on behalf ( ! resid5ts ( ! ,/ate2 or 7#d7 obta9 su* o!r relief z ! c\rt may consid] to be appropriate4 7b7 ,rights ( ! commission 7#a7 ,9 g5]al ,except :]e n feasible1 ! attorney g5]al ( a ,/ate %all notify ! ,commission 9 writ+ prior to initiat+ a civil action "u subsection 7a74 ,su* notice %all include a copy ( ! compla9t to be fil$ to initiate su* action4 ,^u receiv+ su* notice1 ! ,commission may int]v5e 9 su* action &1 ^u int]v5+-- 7,a7 be he>d on all matt]s aris+ 9 su* action2 & 7,b7 file petitions = appeal ( a decision 9 su* action4 7#b7 ,notification timel9e ,:]e x is n feasible = ! attorney g5]al ( a ,/ate to provide ! notification requir$ by p>agraph 7#b7 be=e initiat+ a civil action "u p>agraph 7#a71 ! attorney g5]al %all notify ! ,commission imm$iately aft] initiat+ ! civil action4 7c7 ,consolidation ( actions br\ght by two or m ,/ate attorneys g5]al ,:5ev] a civil action "u subsection 7a7 is p5d+ & ano!r civil action or actions are comm5c$ pursuant to su* subsection 9 a diff]5t ,f$]al di/rict c\rt or c\rts t involve #a or m common que/ions ( fact1 a def5dant 9 su* action or actions my reque/ t su* action or actions be transf]r$ = ! purposes ( consolidat$ pretrial proce$+s & trial to ! ,unit$ ,/ates ,di/rict ,c\rt = ! ,di/rict ( ,columbia2 provid$ h[ev]1 t no su* action %all be transf]r$ if pretrial proce$+s 9 t action h be5 conclud$ be=e a subsequ5t action is fil$ by ! attorney g5]al ( ! ,/ate4 7d7 ,actions by commission ,9 any case 9 :i* a civil action is in/itut$ by or on behalf ( ! ,commission = violation ( ?is ,act or a regulation promulgat$ "u ?is ,act1 no attorney g5]al ( a ,/ate may1 dur+ ! p5d5cy ( su* action1 in/itute a civil action aga9/ any def5dant nam$ 9 ! compla9t 9 ! action in/itut$ by or on behalf ( ! ,commission = violation ( ?is ,act or a regulation promulgat$ "u ?is ,act t is alleg$ 9 su* compla9t4 7e7 ,inve/igatory p[]s ,no?+ 9 ?is section %all be con/ru$ to prev5t ! attorney g5]al ( a ,/ate or ano!r au?oriz$ (ficial ( a ,/ate f ex]cis+ ! p[]s conf]r$ on ! attorney g5]al or ! ,/ate (ficial by ! laws ( ! ,/ate to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7f7 ,v5ue2 s]vice ( process 7#a7 ,v5ue ,any action br\ght "u subsection 7a7 may be br\ght 9 ! di/rict c\rt ( ! ,unit$ ,/ates t meets applicable requirem5ts relat+ to v5ue "u section #acia ( title #bh1 ,unit$ ,/ates ,code4 7#b7 ,s]vice ( process ,9 an action br\ght "u subsection 7a71 process may be s]v$ 9 any di/rict 9 :i* ! def5dant-- 7,a7 is an inhabitant2 or 7,b7 may be f\nd4 7g7 ,actions by o!r ,/ate (ficials ,any ,/ate (ficial :o is au?oriz$ by ! ,/ate attorney g5]al to be ! exclusive au?ority 9 t ,/ate to en=ce ?is ,act may br+ a civil action "u subsection 7a71 subject to ! same requirem5ts & limitations t apply "u ?is section to civil actions br\ght "u su* subsection by ,/ate attorneys g5]al4 #djc4 ,approv$ c]tification programs 7a7 ,9 g5]al ,! ,commission %all e/abli% a program 9 :i* ! ,commission %all approve volunt>y cons5sus /&>ds or c]tification programs t cov]$ entities may use to comply ) #a or m provisions 9 ?is ,act4 7b7 ,effect ( approval ,a cov]$ entity 9 compliance ) a volunt>y cons5sus /&>d approv$ by ! ,commission %all be deem$ to be 9 compliance ) ! provisions ( ?is ,act4 7c7 ,"t = approval ,! ,commission %all issue a decision reg>d+ ! approval ( a propos$ volunt>y cons5sus /&>d n lat] ?an #ahj days aft] a reque/ = approval is submitt$4 7d7 ,effect ( non-,compliance ,a cov]$ entity t claims compliance ) an approv$ volunt>y cons5sus /&>d & is f\nd n to be 9 compliance ) su* program by ! ,commission or 9 any judicial proce$+ %all be consid]$ to be 9 violation ( ?is ,act4 7e7 ,rulemak+ ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 e/abli%+ a process = review ( reque/s = approval ( propos$ volunt>y cons5sus /&>ds "u ?is section4 7f7 ,requirem5ts ,to be eligible = approval by ! ,commission1 a volunt>y cons5sus /&>d %all meet ! requirem5ts = volunt>y cons5sus /&>ds set =? 9 ,(fice ( ,managem5t & ,budget ,circul> ,a-#aai1 or o!r equival5t guidance docum5t1 ensur+ t !y are ! result ( due process proc$ures & appropriately balance ! int]e/s ( all ! /akehold]s1 includ+ individuals1 bus9esses1 organizations1 & o!r entities mak+ lawful uses ( ! cov]$ data cov]$ by ! /&>d1 &-- 7#a7 specify cle> & en=ceable requirem5ts = cov]$ entities p>ticipat+ 9 ! program t provide an ov]all level ( data privacy or data security protection t is equival5t to or great] ?an t provid$ 9 ! relevant provisions 9 ?is ,act2 7#b7 require ea* p>ticipat+ cov]$ entity to po/ 9 a prom95t place a cle> & conspicu\s public atte/ation ( compliance & a l9k to ! website describ$ 9 p>agraph 7#d72 7#c7 include a process = an indep5d5t assessm5t ( a p>ticipat+ cov]$ entity's compliance ) ! volunt>y cons5sus /&>d or c]tification program prior to c]tification & at reasonable int]vals !reaft]2 7#d7 create a website describ+ ! volunt>y cons5sus /&>d or c]tification program's goals & requirem5ts1 li/+ p>ticipat+ cov]$ entities1 & provid+ a me?od = individuals to ask que/ions & file compla9ts ab\t ! program or any p>ticipat+ cov]$ entity2 7#e7 take mean+ful action = non-compliance ) ! relevant provisions ( ?is ,act by any p>ticipat+ cov]$ entity1 :i* %all dep5d on ! sev]ity ( ! non-compliance & may include-- 7,a7 remov+ ! cov]$ entity f ! program2 7,b7 ref]r+ ! cov]$ entity to ! ,commission or o!r appropriate ,f$]al or ,/ate ag5cies = en=cem5t2 7,c7 publicly report+ ! discipl9>y action tak5 ) respect to ! cov]$ entity2 7,d7 provid+ r$ress to individuals h>m$ by ! non-compliance2 7,e7 mak+ volunt>y paym5ts to ! ,unit$ ,/ates ,treasury2 & 7,f7 tak+ any o!r action or actions to ensure ! compliance ( ! cov]$ entity ) respect to ! relevant provisions ( ?is ,act2 & 7#f7 issue annual reports to ! ,commission & to ! public detail+ ! activities ( ! program & its effectiv5ess dur+ ! prec$+ ye> 9 ensur+ compliance ) ! relevant provisions ( ?is ,act by p>ticipat+ cov]$ entities & tak+ mean+ful discipl9>y action = non-compliance ) su* provisions by su* entities4 #djd4 ,relation%ip betwe5 ,f$]al & ,/ate law 7a7 ,relation%ip to ,/ate law ,no ,/ate or political subdivision ( a ,/ate may adopt1 ma9ta91 en=ce1 or cont9ue 9 effect any law1 regulation1 rule1 requirem5t1 or /&>d relat$ to ! data privacy or data security & associat$ activities ( cov]$ entities4 7b7 ,sav+s provision ,subsection 7a7 may n be con/ru$ to preempt ,/ate laws t directly e/abli% requirem5ts = ! notification ( consum]s 9 ! ev5t ( a data brea*4 7c7 ,relation%ip to o!r ,f$]al laws 7#a7 ,9 g5]al ,except z provid$ 9 p>agraphs 7#b7 & 7#c71 ! requirem5ts ( ?is ,act %all sup]s$e any o!r ,f$]al law or regulation relat+ to ! privacy or security ( cov]$ data or associat$ activities ( cov]$ entities4 7#b7 ,sav+s provision ,?is ,act may n be con/ru$ to modify1 limit1 or sup]s$e ! op]ation ( ! foll[+3 7,a7 ,! ,*ildr5's ,onl9e ,privacy ,protection ,act 7#ae ,u4,s4,c4 #feja et seq474 7,b7 ,! ,communications ,assi/ance = ,law ,en=cem5t ,act 7#dg ,u4,s4,c4 #ajja et seq474 7,c7 ,section #bbg ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbg74 7,d7 ,title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7,e7 ,! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq474 7,f7 ,! ,heal? ,insurance ,portability & ,acc\ntability ,act 7,public ,law #ajd-aia74 7,g7 ,! ,electronic ,communications ,privacy ,act 7#ah ,u4,s4,c4 #beaj et seq474 7,h7 ,section #ddd ( ! ,g5]al ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly ref]r$ to z ! ,family ,educational ,rights & ,privacy ,act ( #aigd74 7,i7 ,! ,driv]'s ,privacy ,protection ,act ( #aiid 7#ah ,u4,s4,c4 #bgba et seq474 7,j7 ,! ,f$]al ,aviation ,act ( #aieh 7#di ,u4,s4,c4 ,app4 #acja et seq474 7,k7 ,! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agica et seq474 7#c7 ,compliance ) sav$ ,f$]al laws ,to ! ext5t t ! data collection1 process+1 or transf] activities ( a cov]$ entity are subject to a law li/$ 9 p>agraph 7#b71 su* activities ( su* entity %all n be subject to ! requirem5ts ( ?is ,act4 7#d7 ,nonapplication ( ,,fcc laws & regulations to cov]$ entities ,not)/&+ any o!r provision ( law1 nei!r any provision ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq47 & all ,acts am5datory !re( & supplem5t>y !reto nor any regulation promulgat$ by ! ,f$]al ,communications ,commission "u su* ,acts %all apply to any cov]$ entity ) respect to ! collection1 use1 process+1 transf]r+1 or security ( individual in=mation1 except to ! ext5t t su* provision or regulation p]ta9s solely to #iaa l9es or o!r em]g5cy l9e ( a hospital1 m$ical provid] or s]vice (fice1 heal? c>e facility1 poison control c5t]1 fire protection ag5cy1 or law en=cem5t ag5cy4 #dje4 ,con/itutional avoidance ,! provisions ( ?is ,act %all be con/ru$1 to ! greate/ ext5t possible1 to avoid conflict+ ) ! ,con/itution ( ! ,unit$ ,/ates1 includ+ ! protections ( free spee* & fre$om ( ! press e/abli%$ "u ! ,fir/ ,am5dm5t to ! ,con/itution ( ! ,unit$ ,/ates4 #djf4 ,sev]ability ,if any provision ( ?is ,act1 or an am5dm5t made by ?is ,act1 is det]m9$ to be un5=ceable or invalid1 ! rema9+ provisions ( ?is ,act & ! am5dm5ts made by ?is ,act %all n be affect$4