,,ii #aagth ,,congress #b;d ,session ,s4 #cegb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #c1 #bjbb,mr4 ,wyden 7for himself1 ,mr4 ,booker1 ,mr4 ,schatz1 ,ms4 ,hirono1 ,mr4 ,heinrich1 ,mr4 ,lujn1 ,ms4 ,baldwin1 and ,mr4 ,casey7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to direct the ,federal ,trade ,commission to require impact assessments of automated decision systems and augmented critical decision processes1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,algorithmic ,accountability ,act of #bjbb4 #b4 ,definitions ,in this ,act3 7#a7 ,augmented critical decision process ,the term augmented critical decision process means a process1 procedure1 or other activity that employs an automated decision system to make a critical decision4 7#b7 ,automated decision system ,the term automated decision system means any system1 software1 or process 7including one derived from machine learning1 statistics1 or other data processing or artificial intelligence techniques and excluding passive computing infrastructure7 that uses computation1 the result of which serves as a basis for a decision or judgment4 7#c7 ,biometrics ,the term biometrics means any information that represents a biological1 physiological1 or behavioral attribute or feature of a consumer4 7#d7 ,chair ,the term ,chair means the ,chair of the ,commission4 7#e7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#f7 ,consumer ,the term consumer means an individual4 7#g7 ,covered entity 7,a7 ,in general ,the term covered entity means any person1 partnership1 or corporation over which the ,commission has jurisdiction under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77-- 7i7 that deploys any augmented critical decision process2 and 7,i7 had greater than #ej1jjj1jjj in average annual gross receipts or is deemed to have greater than #bej1jjj1jjj in equity value for the #c-taxable-year period 7or for the period during which the person1 partnership1 or corporation has been in existence1 if such period is less than #c years7 preceding the most recent fiscal year1 as determined in accordance with paragraphs 7#b7 and 7#c7 of section #ddh7;c7 of the ,internal ,revenue ,code of #aihf2 7,,ii7 possesses1 manages1 modifies1 handles1 analyzes1 controls1 or otherwise uses identifying information about more than #a1jjj1jjj consumers1 households1 or consumer devices for the purpose of developing or deploying any automated decision system or augmented critical decision process2 or 7,,iii7 is substantially owned1 operated1 or controlled by a person1 partnership1 or corporation that meets the requirements under subclause 7,i7 or 7,,ii72 7ii7 that-- 7,i7 had greater than #e1jjj1jjj in average annual gross receipts or is deemed to have greater than #be1jjj1jjj in equity value for the #c-taxable-year period 7or for the period during which the person1 partnership1 or corporation has been in existence1 if such period is less than #c years7 preceding the most recent fiscal year1 as determined in accordance with paragraphs 7#b7 and 7#c7 of section #ddh7;c7 of the ,internal ,revenue ,code of #aihf2 and 7,,ii7 deploys any automated decision system that is developed for implementation or use1 or that the person1 partnership1 or corporation reasonably expects to be implemented or used1 in an augmented critical decision process by any person1 partnership1 or corporation if such person1 partnership1 or corporation meets the requirements described in clause 7i72 or 7iii7 that met the criteria described in clause 7i7 or 7ii7 within the previous #c years4 7,b7 ,inflation adjustment ,for purposes of applying this paragraph in any fiscal year after the first fiscal year that begins on or after the date of enactment of this ,act1 each of the dollar amounts specified in subparagraph 7,a7 shall be increased by the percentage increase 7if any7 in the consumer price index for all urban consumers 7,u4,s4 city average7 from such first fiscal year that begins after such date of enactment to the fiscal year involved4 7#h7 ,critical decision ,the term critical decision means a decision or judgment that has any legal1 material1 or similarly significant effect on a consumer's life relating to access to or the cost1 terms1 or availability of-- 7,a7 education and vocational training1 including assessment1 accreditation1 or certification2 7,b7 employment1 workers management1 or self-employment2 7,c7 essential utilities1 such as electricity1 heat1 water1 internet or telecommunications access1 or transportation2 7,d7 family planning1 including adoption services or reproductive services2 7,e7 financial services1 including any financial service provided by a mortgage company1 mortgage broker1 or creditor2 7,f7 healthcare1 including mental healthcare1 dental1 or vision2 7,g7 housing or lodging1 including any rental or short-term housing or lodging2 7,h7 legal services1 including private arbitration or mediation2 or 7,i7 any other service1 program1 or opportunity decisions about which have a comparably legal1 material1 or similarly significant effect on a consumer's life as determined by the ,commission through rulemaking4 7#i7 ,deploy ,the term deploy means to implement1 use1 or make available for sale1 license1 or other commercial relationship4 7#aj7 ,develop ,the term develop means to design1 code1 produce1 customize1 or otherwise create or modify4 7#aa7 ,identifying information ,the term identifying information means any information1 regardless of how the information is collected1 inferred1 predicted1 or obtained that identifies or represents a consumer1 household1 or consumer device through data elements or attributes1 such as name1 postal address1 telephone number1 biometrics1 email address1 internet protocol address1 social security number1 or any other identifying number1 identifier1 or code4 7#ab7 ,impact assessment ,the term impact assessment means the ongoing study and evaluation of an automated decision system or augmented critical decision process and its impact on consumers4 7#ac7 ,passive computing infrastructure ,the term passive computing infrastructure means any intermediary technology that does not influence or determine the outcome of a decision1 including-- 7,a7 web hosting2 7,b7 domain registration2 7,c7 networking2 7,d7 caching2 7,e7 data storage2 or 7,f7 cybersecurity4 7#ad7 ,state ,the term ,state means each of the #ej ,states1 the ,district of ,columbia1 and any territory or possession of the ,united ,states4 7#ae7 ,summary report ,the term summary report means documentation of a subset of information required to be addressed by the impact assessment as described in this ,act or determined appropriate by the ,commission4 7#af7 ,third-party decision recipient ,the term third-party decision recipient means any person1 partnership1 or corporation 7beyond the consumer and the covered entity7 that receives a copy of or has access to the results of any decision or judgment that results from a covered entity's deployment of an automated decision system or augmented critical decision process4 #c4 ,assessing the impact of automated decision systems and augmented critical decision processes 7a7 ,acts prohibited 7#a7 ,in general ,it is unlawful for-- 7,a7 any covered entity to violate a regulation promulgated under subsection 7b72 or 7,b7 any person to knowingly provide substantial assistance to any covered entity in violating subsection 7b74 7#b7 ,preemption of private contracts ,it shall be unlawful for any covered entity to commit the acts prohibited in paragraph 7#a71 regardless of specific agreements between entities or consumers4 7b7 ,regulations 7#a7 ,in general ,subject to paragraph 7#b71 not later than #b years after the date of enactment of this ,act1 the ,commission shall1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 the ,director of the ,national ,artificial ,intelligence ,initiative1 the ,director of the ,office of ,science and ,technology ,policy1 and other relevant stakeholders1 including standards bodies1 private industry1 academia1 technology experts1 and advocates for civil rights1 consumers1 and impacted communities1 promulgate regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 that-- 7,a7 require each covered entity to perform impact assessment of any-- 7i7 deployed automated decision system that was developed for implementation or use1 or that the covered entity reasonably expects to be implemented or used1 in an augmented critical decision process by any person1 partnership1 or corporation that meets the requirements described in section #b7g77;,a77i72 and 7ii7 augmented critical decision process1 both prior to and after deployment by the covered entity2 7,b7 require each covered entity to maintain documentation of any impact assessment performed under subparagraph 7,a71 including the applicable information described in section #d7;a7 for #c years longer than the duration of time for which the automated decision system or augmented critical decision process is deployed2 7,c7 require each person1 partnership1 or corporation that meets the requirements described in section #b7g77;,a77i7 to disclose their status as a covered entity to any person1 partnership1 or corporation that sells1 licenses1 or otherwise provides through a commercial relationship any automated decision system deployed by the covered entity in an automated decision system or augmented critical decision process2 7,d7 require each covered entity to submit to the ,commission1 on an annual basis1 a summary report for ongoing impact assessment of any deployed automated decision system or augmented critical decision process2 7,e7 require each covered entity to submit an initial summary report to the ,commission for any new automated decision system or augmented critical decision process prior to its deployment by the covered entity2 7,f7 allow any person1 partnership1 or corporation over which the ,commission has jurisdiction under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 that deploys any automated decision system or augmented critical decision process1 but is not a covered entity1 to submit to the ,commission a summary report for any impact assessment performed with respect to such system or process2 7,g7 require each covered entity1 in performing the impact assessment described in subparagraph 7,a71 to the extent possible1 to meaningfully consult 7including through participatory design1 independent auditing1 or soliciting or incorporating feedback7 with relevant internal stakeholders 7such as employees1 ethics teams1 and responsible technology teams7 and independent external stakeholders 7such as representatives of and advocates for impacted groups1 civil society and advocates1 and technology experts7 as frequently as necessary2 7,h7 require each covered entity to attempt to eliminate or mitigate1 in a timely manner1 any impact made by an augmented critical decision process that demonstrates a likely material negative impact that has legal or similarly significant effects on a consumer's life2 7,i7 establish definitions for-- 7i7 what constitutes access to or the cost1 terms1 or availability of with respect to a critical decision2 7ii7 what constitutes possession1 management1 modification1 and control with respect to identifying information2 7iii7 the different categories of third-party decision recipients that a covered entity must document under section #e7a77;,h72 and 7iv7 any of the services1 programs1 or opportunities described in subparagraphs 7,a7 through 7,i7 of section #b7h7 for the purpose of informing consumers1 covered entities1 and regulators1 as the ,commission deems necessary2 7,j7 establish guidelines for any person1 partnership1 or corporation to calculate the number of consumers1 households1 or consumer devices for which the person1 partnership1 or corporation possesses1 manages1 modifies1 or controls identifying information for the purpose of determining covered entity status2 7,k7 establish guidelines for a covered entity to prioritize different automated decision systems and augmented critical decision processes deployed by the covered entity for performing impact assessment2 and 7,l7 establish a required format for any summary report1 as described in subparagraphs 7,d71 7,e71 and 7,f71 to ensure that such reports are submitted in an accessible and machine-readable format4 7#b7 ,considerations ,in promulgating the regulations under paragraph 7#a71 the ,commission-- 7,a7 shall take into consideration-- 7i7 that certain assessment or documentation of an automated decision system or augmented critical decision process may only be possible at particular stages of the development and deployment of such system or process or may be limited or not possible based on the availability of certain types of information or data or the nature of the relationship between the covered entity and consumers2 7ii7 the duration of time between summary report submissions and the timeliness of the reported information2 7iii7 the administrative burden placed on the ,commission and the covered entity2 7iv7 the benefits of standardizing and structuring summary reports for comparative analysis compared with the benefits of less-structured narrative reports to provide detail and flexibility in reporting2 7v7 that summary reports submitted by different covered entities may contain different fields according to the requirements established by the ,commission1 and the ,commission may allow or require submission of incomplete reports2 7vi7 that existing data privacy and other regulations may inhibit a covered entity from storing or sharing certain information2 and 7vii7 that a covered entity may require information from other persons1 partnerships1 or corporations that develop any automated decision system deployed in an automated decision system or augmented critical decision process by the covered entity for the purpose of performing impact assessment2 and 7,b7 may develop specific requirements for impact assessments and summary reports for particular-- 7i7 categories of critical decisions1 as described in subparagraphs 7,a7 through 7,i7 of section #b7h7 or any subcategory developed by the ,commission2 and 7ii7 stages of development and deployment of an automated decision system or augmented critical decision process4 7#c7 ,effective date ,the regulations described in paragraph 7#a7 shall take effect on the date that is #b years after such regulations are promulgated4 #d4 ,requirements for covered entity impact assessment 7a7 ,requirements for impact assessment ,in performing any impact assessment required under section #c7;b77#a7 for an automated decision system or augmented critical decision process1 a covered entity shall do the following1 to the extent possible1 as applicable to such covered entity as determined by the ,commission3 7#a7 ,in the case of a new augmented critical decision process1 evaluate any previously existing critical decision-making process used for the same critical decision prior to the deployment of the new augmented critical decision process1 along with any related documentation or information1 such as-- 7,a7 a description of the baseline process being enhanced or replaced by the augmented critical decision process2 7,b7 any known harm1 shortcoming1 failure case1 or material negative impact on consumers of the previously existing process used to make the critical decision2 7,c7 the intended benefits of and need for the augmented critical decision process2 and 7,d7 the intended purpose of the automated decision system or augmented critical decision process4 7#b7 ,identify and describe any consultation with relevant stakeholders as required by section #c7;b77#a77;,g71 including by documenting-- 7,a7 the points of contact for the stakeholders who were consulted2 7,b7 the date of any such consultation2 and 7,c7 information about the terms and process of the consultation1 such as-- 7i7 the existence and nature of any legal or financial agreement between the stakeholders and the covered entity2 7ii7 any data1 system1 design1 scenario1 or other document or material the stakeholder interacted with2 and 7iii7 any recommendations made by the stakeholders that were used to modify the development or deployment of the automated decision system or augmented critical decision process1 as well as any recommendations not used and the rationale for such nonuse4 7#c7 ,in accordance with any relevant ,national ,institute of ,standards and ,technology or other ,federal ,government best practices and standards1 perform ongoing testing and evaluation of the privacy risks and privacy-enhancing measures of the automated decision system or augmented critical decision process1 such as-- 7,a7 assessing and documenting the data minimization practices of such system or process and the duration for which the relevant identifying information and any resulting critical decision is stored2 7,b7 assessing the information security measures in place with respect to such system or process1 including any use of privacy-enhancing technology such as federated learning1 differential privacy1 secure multi-party computation1 de-identification1 or secure data enclaves based on the level of risk2 and 7,c7 assessing and documenting the current and potential future or downstream positive and negative impacts of such system or process on the privacy1 safety1 or security of consumers and their identifying information4 7#d7 ,perform ongoing testing and evaluation of the current and historical performance of the automated decision system or augmented critical decision process using measures such as benchmarking datasets1 representative examples from the covered entity's historical data1 and other standards1 including by documenting-- 7,a7 a description of what is deemed successful performance and the methods and technical and business metrics used by the covered entity to assess performance2 7,b7 a review of the performance of such system or process under test conditions or an explanation of why such performance testing was not conducted2 7,c7 a review of the performance of such system or process under deployed conditions or an explanation of why performance was not reviewed under deployed conditions2 7,d7 a comparison of the performance of such system or process under deployed conditions to test conditions or an explanation of why such a comparison was not possible2 7,e7 an evaluation of any differential performance associated with consumers' race1 color1 sex1 gender1 age1 disability1 religion1 family status1 socioeconomic status1 or veteran status1 and any other characteristics the ,commission deems appropriate 7including any combination of such characteristics7 for which the covered entity has information1 including a description of the methodology for such evaluation and information about and documentation of the methods used to identify such characteristics in the data 7such as through the use of proxy data1 including zip codes72 and 7,f7 if any subpopulations were used for testing and evaluation1 a description of which subpopulations were used and how and why such subpopulations were determined to be of relevance for the testing and evaluation4 7#e7 ,support and perform ongoing training and education for all relevant employees1 contractors1 or other agents regarding any documented material negative impacts on consumers from similar automated decision systems or augmented critical decision processes and any improved methods of developing or performing an impact assessment for such system or process based on industry best practices and relevant proposals and publications from experts1 such as advocates1 journalists1 and academics4 7#f7 ,assess the need for and possible development of any guard rail for or limitation on certain uses or applications of the automated decision system or augmented critical decision process1 including whether such uses or applications ought to be prohibited or otherwise limited through any terms of use1 licensing agreement1 or other legal agreement between entities4 7#g7 ,maintain and keep updated documentation of any data or other input information used to develop1 test1 maintain1 or update the automated decision system or augmented critical decision process1 including-- 7,a7 how and when such data or other input information was sourced and1 if applicable1 licensed1 including information such as-- 7i7 metadata and information about the structure and type of data or other input information1 such as the file type1 the date of the file creation or modification1 and a description of data fields2 7ii7 an explanation of the methodology by which the covered entity collected1 inferred1 or obtained the data or other input information and1 if applicable1 labeled1 categorized1 sorted1 or clustered such data or other input information1 including whether such data or other input information was labeled1 categorized1 sorted1 or clustered prior to being collected1 inferred1 or obtained by the covered entity2 and 7iii7 whether and how consumers provided informed consent for the inclusion and further use of data or other input information about themselves and any limitations stipulated on such inclusion or further use2 7,b7 why such data or other input information was used and what alternatives were explored2 and 7,c7 other information about the data or other input information1 such as-- 7i7 the representativeness of the dataset and how this factor was measured1 including any assumption about the distribution of the population on which the augmented critical decision process is deployed2 and 7ii7 the quality of the data1 how the quality was evaluated1 and any measure taken to normalize1 correct1 or clean the data4 7#h7 ,evaluate the rights of consumers1 such as-- 7,a7 by assessing the extent to which the covered entity provides consumers with-- 7i7 clear notice that such system or process will be used2 and 7ii7 a mechanism for opting out of such use2 7,b7 by assessing the transparency and explainability of such system or process and the degree to which a consumer may contest1 correct1 or appeal a decision or opt out of such system or process1 including-- 7i7 the information available to consumers or representatives or agents of consumers about the system or process1 such as any relevant factors that contribute to a particular decision1 including an explanation of which contributing factors1 if changed1 would cause the system or process to reach a different decision1 and how such consumer1 representative1 or agent can access such information2 7ii7 documentation of any complaint1 dispute1 correction1 appeal1 or opt-out request submitted to the covered entity by a consumer with respect to such system or process2 and 7iii7 the process and outcome of any remediation measure taken by the covered entity to address the concerns of or harms to consumers2 and 7,c7 by describing the extent to which any third-party decision recipient receives a copy of or has access to the results of such system or process and the category of such third-party decision recipient1 as defined by the ,commission in section #c7;b77#a77;,i77iii74 7#i7 ,identify any likely material negative impact of the automated decision system or augmented critical decision process on consumers and assess any applicable mitigation strategy1 such as by-- 7,a7 identifying and measuring any likely material negative impact of the system or process on consumers1 including documentation of the steps taken to identify and measure such impact2 7,b7 documenting any steps taken to eliminate or reasonably mitigate any likely material negative impact identified1 including steps such as removing the system or process from the market or terminating its development2 7,c7 with respect to the likely material negative impacts identified1 documenting which such impacts were left unmitigated and the rationale for the inaction1 including details about the justifying non-discriminatory1 compelling interest and why such interest cannot be satisfied by other means 7such as where there is an equal1 zero-sum trade-off between impacts on #b or more consumers or where the required mitigating action would violate civil rights or other laws72 and 7,d7 documenting standard protocols or practices used to identify1 measure1 mitigate1 or eliminate any likely material negative impact on consumers and how relevant teams or staff are informed of and trained about such protocols or practices4 7#aj7 ,describe any ongoing documentation of the development and deployment process with respect to the automated decision system or augmented critical decision process1 including information such as-- 7,a7 the date of any testing1 deployment1 licensure1 or other significant milestones2 and 7,b7 points of contact for any team1 business unit1 or similar internal stakeholder that was involved4 7#aa7 ,identify any capabilities1 tools1 standards1 datasets1 security protocols1 improvements to stakeholder engagement1 or other resources that may be necessary or beneficial to improving the automated decision system1 augmented critical decision process1 or the impact assessment of such system or process1 in areas such as-- 7,a7 performance1 including accuracy1 robustness1 and reliability2 7,b7 fairness1 including bias and nondiscrimination2 7,c7 transparency1 explainability1 contestability1 and opportunity for recourse2 7,d7 privacy and security2 7,e7 personal and public safety2 7,f7 efficiency and timeliness2 7,g7 cost2 or 7,h7 any other area determined appropriate by the ,commission4 7#ab7 ,document any of the impact assessment requirements described in paragraphs 7#a7 through 7#aa7 that were attempted but were not possible to comply with because they were infeasible1 as well as the corresponding rationale for not being able to comply with such requirements1 which may include-- 7,a7 the absence of certain information about an automated decision system developed by other persons1 partnerships1 and corporations2 7,b7 the absence of certain information about how clients1 customers1 licensees1 partners1 and other persons1 partnerships1 or corporations are deploying an automated decision system in their augmented critical decision processes2 7,c7 a lack of demographic or other data required to assess differential performance because such data is too sensitive to collect1 infer1 or store2 or 7,d7 a lack of certain capabilities1 including technological innovations1 that would be necessary to conduct such requirements4 7#ac7 ,perform and document any other ongoing study or evaluation determined appropriate by the ,commission4 7b7 ,rule of construction ,nothing in this ,act should be construed to limit any covered entity from adding other criteria1 procedures1 or technologies to improve the performance of an impact assessment of their automated decision system or augmented critical decision process4 7c7 ,nondisclosure of impact assessment ,nothing in this ,act should be construed to require a covered entity to share with or otherwise disclose to the ,commission or the public any information contained in an impact assessment performed in accordance with this ,act1 except for any information contained in the summary report required under subparagraph 7,d7 or 7,e7 of section #c7;b77#a74 #e4 ,requirements for summary reports to the ,commission ,the summary report that a covered entity is required to submit under subparagraph 7,d7 or 7,e7 of section #c7;b77#a7 for any automated decision system or augmented critical decision process shall1 to the extent possible-- 7#a7 contain information from the impact assessment of such system or process1 as applicable1 including-- 7,a7 the name1 website1 and point of contact for the covered entity2 7,b7 a detailed description of the specific critical decision that the augmented critical decision process is intended to make1 including the category of critical decision as described in subparagraphs 7,a7 through 7,i7 of section #b7h72 7,c7 the covered entity's intended purpose for the automated decision system or augmented critical decision process2 7,d7 an identification of any stakeholders consulted by the covered entity as required by section #c7;b77#a77;,g7 and documentation of the existence and nature of any legal agreements between the stakeholders and the covered entity2 7,e7 documentation of the testing and evaluation of the automated decision system or augmented critical decision process1 including-- 7i7 the methods and technical and business metrics used to assess the performance of such system or process and a description of what metrics are deemed successful performance2 7ii7 the results of any assessment of the performance of such system or process and a comparison of the results of any assessment under test and deployed conditions2 and 7iii7 an evaluation of any differential performance of such system or process assessed during the impact assessment2 7,f7 any publicly stated guard rail for or limitation on certain uses or applications of the automated decision system or augmented critical decision process1 including whether such uses or applications ought to be prohibited or otherwise limited through any terms of use1 licensing agreement1 or other legal agreement between entities2 7,g7 documentation about the data or other input information used to develop1 test1 maintain1 or update the automated decision system or augmented critical decision process including-- 7i7 how and when the covered entity sourced such data or other input information2 and 7ii7 why such data or other input information was used and what alternatives were explored2 7,h7 documentation of whether and how the covered entity implements any transparency or explainability measures1 including-- 7i7 which categories of third-party decision recipients receive a copy of or have access to the results of any decision or judgment that results from such system or process2 and 7ii7 any mechanism by which a consumer may contest1 correct1 or appeal a decision or opt out of such system or process1 including the corresponding website for such mechanism1 where applicable2 7,i7 any likely material negative impact on consumers identified by the covered entity and a description of the steps taken to remediate or mitigate such impact2 7,j7 a list of any impact assessment requirements that were attempted but were not possible to comply with because they were infeasible1 as well as the corresponding rationale for not being able to comply with such requirements2 and 7,k7 any additional capabilities1 tools1 standards1 datasets1 security protocols1 improvements to stakeholder engagement1 or other resources identified by an impact assessment as necessary or beneficial to improve the performance of impact assessment or the development and deployment of any automated decision system or augmented critical decision process that the covered entity determines appropriate to share with the ,commission2 7#b7 include1 in addition to the information required under paragraph 7#a71 any relevant additional information from section #d7;a7 the covered entity wishes to share with the ,commission2 7#c7 follow any format or structure requirements specified by the ,commission2 and 7#d7 include additional criteria that are essential for the purpose of consumer protection1 as determined by the ,commission4 #f4 ,reporting2 publicly accessible repository 7a7 ,annual report ,not later than #a year after the effective date described in section #c7;b77#c71 and annually thereafter1 the ,commission shall publish publicly on the website of the ,commission a report describing and summarizing the information from the summary reports submitted under subparagraph 7,d71 7,e71 or 7,f7 of section #c7;b77#a7 that-- 7#a7 is accessible and machine readable in accordance with the #bast ,century ,integrated ,digital ,experience ,act 7#dd ,u4,s4,c4 #ceja note72 and 7#b7 describes broad trends1 aggregated statistics1 and anonymized lessons learned about performing impact assessments of automated decision systems or augmented critical decision processes1 for the purposes of updating guidance related to impact assessments and summary reporting1 oversight1 and making recommendations to other regulatory agencies4 7b7 ,publicly accessible repository 7#a7 ,in general 7,a7 ,establishment 7i7 ,development ,not later than #ahj days after the ,commission promulgates the regulations required under section #c7;b77#a71 the ,commission shall develop a publicly accessible repository designed to publish a limited subset of the information about each automated decision system and augmented critical decision process for which the ,commission received a summary report under subparagraph 7,d71 7,e71 or 7,f7 of section #c7;b77#a7 in order to facilitate consumer protection4 7ii7 ,publication ,not later than #ahj days after the effective date described in section #c7;b77#c71 the ,commission shall make the repository publicly accessible4 7iii7 ,updates ,the ,commission shall update the repository on a quarterly basis4 7,b7 ,purpose ,the purposes of the repository established under subparagraph 7,a7 are-- 7i7 to inform consumers about the use of automated decision systems and augmented critical decision processes2 7ii7 to allow researchers and advocates to study the use of automated decision systems and augmented critical decision processes2 and 7iii7 to ensure compliance with the requirements of this ,act4 7,c7 ,considerations ,in establishing the repository under subparagraph 7,a71 the ,commission shall consider-- 7i7 how to provide consumers with pertinent information regarding augmented critical decision processes while minimizing any potential commercial risk to any covered entity of providing such information2 7ii7 what information1 if any1 to include regarding the specific automated decision systems deployed in the augmented critical decision processes2 7iii7 how to document information1 when applicable1 about how to contest or seek recourse for a critical decision in a manner that is readily accessible by the consumer2 and 7iv7 how to streamline the submission of summary reports under subparagraph 7,d71 7,e71 or 7,f7 of section #c7;b77#a7 to allow the ,commission to efficiently populate information into the repository to minimize or eliminate any burden on the ,commission4 7,d7 ,requirements ,the ,commission shall design the repository established under subparagraph 7,a7 to-- 7i7 be publicly available and easily discoverable on the website of the ,commission2 7ii7 allow users to sort and search the repository by multiple characteristics 7such as by covered entity1 date reported1 or category of critical decision7 simultaneously2 7iii7 allow users to make a copy of or download the information obtained from the repository1 including any subsets of information obtained by sorting or searching as described in clause 7ii71 in accordance with current guidance from the ,office of ,management and ,budget1 such as the ,open1 ,public1 ,electronic1 and ,necessary ,government ,data ,act 7#dd ,u4,s4,c4 #aja note72 7iv7 be in accordance with user experience and accessibility best practices such as those described in the #bast ,century ,integrated ,digital ,experience ,act 7#dd ,u4,s4,c4 #ceja note72 7v7 include a limited subset of information from the summary reports1 as applicable1 under subparagraph 7,d71 7,e71 or 7,f7 of section #c7;b77#a7 that includes-- 7,i7 the identity of the covered entity that submitted such summary report1 including any link to the website of the covered entity2 7,,ii7 the specific critical decision that the augmented critical decision process makes1 along with the category of the critical decision2 7,,iii7 any publicly stated prohibited applications of the automated decision system or augmented critical decision process1 including whether such prohibition is enforced through any terms of use1 licensing agreement1 or other legal agreement between entities2 7,,iv7 to the extent possible1 the sources of any data used to develop1 test1 maintain1 or update the automated decision system or augmented critical decision process2 7,v7 to the extent possible1 the type of technical and business metrics used to assess the performance of the augmented critical decision process when deployed2 and 7,,vi7 the link to any web page with instructions or other information related to a mechanism by which a consumer may contest1 correct1 or appeal a decision or opt out of the automated decision system or augmented critical decision process2 and 7vi7 include information about design1 use1 and maintenance of the repository1 including-- 7,i7 how frequently the repository is updated2 7,,ii7 the date of the most recent such update2 7,,iii7 the types of information from the summary reports submitted under subparagraph 7,d71 7,e71 or 7,f7 of section #c7;b77#a7 that are and are not included in the repository2 and 7,,iv7 any other information about the design1 use1 and maintenance the ,commission determines is-- 7aa7 relevant to consumers and researchers2 or 7bb7 essential for consumer education and recourse4 7#b7 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission such sums as are necessary to carry out this subsection4 #g4 ,guidance and technical assistance2 other requirements 7a7 ,guidance and technical assistance from the ,commission 7#a7 ,in general ,the ,commission shall publish guidance on how to meet the requirements of sections #d and #e1 including resources such as documentation templates and guides for meaningful consultation1 that is developed by the ,commission after consultation with the ,director of the ,national ,institute of ,standards and ,technology1 the ,director of the ,national ,artificial ,intelligence ,initiative1 the ,director of the ,office of ,science and ,technology ,policy1 and other relevant stakeholders1 including standards bodies1 private industry1 academia1 technology experts1 and advocates for civil rights1 consumers1 and impacted communities4 7#b7 ,assistance in determining covered entity status ,in addition to the guidance required under paragraph 7#a71 the ,commission shall-- 7,a7 issue guidance and training materials to assist persons1 partnerships1 and corporations in evaluating whether they are a covered entity2 and 7,b7 regularly update such guidance and training materials in accordance with any feedback or questions from covered entities1 experts1 or other relevant stakeholders4 7b7 ,other requirements 7#a7 ,publication ,nothing in this ,act shall be construed to limit a covered entity from publicizing any documentation of the impact assessment maintained under section #c7;b77#a77;,b71 including information beyond what is required to be submitted in a summary report under subparagraph 7,d7 or 7,e7 of section #c7;b77#a71 unless such publication would violate the privacy of any consumer4 7#b7 ,periodic review of regulations ,the ,commission shall review the regulations promulgated under section #c7;b7 not less than once every #e years and update such regulations as appropriate4 7#c7 ,review by ,,nist and ,,ostp ,the ,commission shall make available1 in a private and secure manner1 to the ,director of the ,national ,institute of ,standards and ,technology1 the ,director of the ,office of ,science and ,technology ,policy1 and the head of any ,federal agency with relevant regulatory jurisdiction over an augmented critical decision process any summary report submitted under subparagraph 7,d71 7,e71 or 7,f7 of section #c7;b77#a7 for review in order to develop future standards or regulations4 #h4 ,resources and authorities 7a7 ,bureau of ,technology 7#a7 ,establishment 7,a7 ,in general ,there is established within the ,commission the ,bureau of ,technology 7in this subsection referred to as the ,bureau74 7,b7 ,duties ,the ,bureau shall engage in activities that include3 7i7 ,aiding or advising the ,commission with respect to the technological aspects of the functions of the ,commission1 including-- 7,i7 preparing1 conducting1 facilitating1 managing1 or otherwise enabling studies1 workshops1 audits1 community participation opportunities1 or other similar activities2 and 7,,ii7 any other assistance deemed appropriate by the ,commission or ,chair4 7ii7 ,aiding or advising the ,commission with respect to the enforcement of this ,act4 7iii7 ,providing technical assistance to any enforcement bureau within the ,commission with respect to the investigation and trial of cases4 7#b7 ,chief ,technologist ,the ,bureau shall be headed by a ,chief ,technologist4 7#c7 ,staff 7,a7 ,appointments 7i7 ,in general ,subject to subparagraph 7,b71 the ,chair may1 without regard to the civil service laws 7including regulations71 appoint personnel with experience in fields such as management1 technology1 digital and product design1 user experience1 information security1 civil rights1 technology policy1 privacy policy1 humanities and social sciences1 product management1 software engineering1 machine learning1 statistics1 or other related fields to enable the ,bureau to perform its duties4 7ii7 ,minimum appointments ,not later than #b years after the date of enactment of this ,act1 the ,chair shall appoint not less than #ej personnel4 7,b7 ,excepted service ,the personnel appointed in accordance with subparagraph 7,a7 may be appointed to positions described in section #bac4cajb7r7 of title #e1 ,code of ,federal ,regulations4 7#d7 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission such sums as are necessary to carry out this subsection4 7b7 ,additional personnel in the ,bureau of ,consumer ,protection 7#a7 ,additional personnel ,notwithstanding any other provision of law1 the ,chair may1 without regard to the civil service laws 7including regulations71 appoint #be additional personnel to the ,division of ,enforcement of the ,bureau of ,consumer ,protection4 7#b7 ,authorization of appropriations ,there are authorized to be appropriated to the ,commission such sums as are necessary to carry out this subsection4 7c7 ,establishment of agreements of cooperation ,the ,commission shall negotiate agreements of cooperation1 as needed1 with any relevant ,federal agency with respect to information sharing and enforcement actions taken regarding the development or deployment of an automated decision system to make a critical decision or of an augmented critical decision process4 ,such agreements shall include procedures for determining which agency shall file an action and providing notice to the non-filing agency1 where feasible1 prior to initiating a civil action to enforce any ,federal law within such agencies' jurisdictions regarding the development or deployment of an automated decision system to make a critical decision or of an augmented critical decision process by a covered entity4 #i4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7,d7 ,rulemaking ,the ,commission shall promulgate in accordance with section #eec of title #e1 ,united ,states ,code1 such additional rules as may be necessary to carry out this ,act4 7b7 ,enforcement by ,states 7#a7 ,in general ,if the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is being threatened or adversely affected by a practice that violates this ,act or a regulation promulgated thereunder1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief4 7#b7 ,rights of ,commission 7,a7 ,notice to ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state1 before initiating a civil action under paragraph 7#a71 shall provide written notification to the ,commission that the attorney general intends to bring such civil action4 7ii7 ,contents ,the notification required under clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required under clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which-- 7i7 the defendant is an inhabitant1 may be found1 or transacts business2 or 7ii7 venue is proper under section #acia of title #bh1 ,united ,states ,code4 7#e7 ,actions by other ,state officials 7,a7 ,in general ,in addition to a civil action brought by an attorney general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #aj4 ,coordination ,in carrying out this ,act1 the ,commission shall coordinate with any appropriate ,federal agency or ,state regulator to promote consistent regulatory treatment of automated decision systems and augmented critical decision processes4 #aa4 ,no preemption ,nothing in this ,act may be construed to preempt any ,state1 tribal1 city1 or local law1 regulation1 or ordinance4