,i #aahth ,,congress #ast ,session ,h4 ,r4 #cjde ,,in ,,the ,,house ,,of ,,representatives ,may #b1 #bjbc ,mr4 ,cloud introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to affirm user ownership of their data1 prohibit entities from requiring the transfer or monetization of private data in exchange for services1 prohibit the collection of third-party contact information without written consent1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,you ,own the ,data ,act or ,,yoda4 #b4 ,findings ,congress finds the following3 7#a7 ,governments exist to protect individual rights to life1 liberty1 and property4 7#b7 ,the protection of civil liberties1 including the rights to private property and privacy from unwarranted searches and seizures1 is one of the hallmarks of a free society4 7#c7 ,it is appropriate for ,congress to enact laws to protect individuals from data collection by third parties4 7#d7 ,data is the property of the user1 as the user creates the data4 7#e7 ,a user maintains ownership of the data of such user1 even when such data is sold or leased with the consent of such user4 7#f7 ,technology should empower the individual and the productivity of the individual4 7#g7 ,individuals should have reasonable access to and use of popularly available consumer technologies without abdicating the rights of such individuals to privacy and anonymity4 #c4 ,prohibition on sharing user contacts without written consent and clarifying user access to data 7a7 ,prohibition on access to user contacts ,it shall be unlawful for a covered entity to ask a user to share the contacts or information about the contacts of the user unless the user and the contacts of the user consent to such use in writing4 7b7 ,access to1 and correction1 deletion1 and portability of1 covered data 7#a7 ,in general ,subject to paragraphs 7#b7 and 7#c71 a covered entity shall provide a user1 immediately or as quickly as possible and in no case later than #ij days after receiving a verified request from the user1 with the ability to reasonably-- 7,a7 access-- 7i7 if applicable1 a list of each third party and service provider to whom the covered entity has transferred or shared the covered data of the user2 7ii7 the covered data of the user1 or an accurate representation of the covered data of the user1 including data aggregation that is a readable summary1 that is held or has been processed by the covered entity or any service provider of the covered entity2 and 7iii7 if a covered entity transfers covered data1 a description of the covered data that was transferred and the purpose for which the third party requested the data2 7,b7 request that the covered entity-- 7i7 correct material inaccuracies or materially incomplete information with respect to the covered data of the user that is maintained by the covered entity2 7ii7 delete or de-identify covered data of the user that is or has been maintained by the covered entity2 7iii7 notify any service provider or third party to which the covered entity transferred such covered data of the corrected information2 and 7iv7 provide contact information to the user of any service provider or third party that the covered data of the user was transferred to so that the user may make requests described in this subparagraph2 and 7,c7 to the extent that is technically feasible1 provide covered data of the user that is or has been generated and submitted to the covered entity by the user and maintained by the covered entity in a portable1 structured1 and machine-readable format that is not subject to licensing restrictions4 7#b7 ,frequency and cost of access ,a covered entity shall-- 7,a7 provide a user with the opportunity to exercise the rights described in paragraph 7#a7 not less than twice in any #ab-month period2 and 7,b7 fulfill the responsibilities described in paragraph 7#a7 free of charge4 7#c7 ,prohibition on retaliation ,a covered entity shall provide the same quality of goods or services1 at the same price or rate1 regardless of whether a user took an action described under paragraph 7#a74 7#d7 ,retention of data ,a covered entity that collects data on a user's browsing history or biometric data and information shall delete the data within #fj days after the date on which the data was collected4 7c7 ,data minimization and contextuality 7#a7 ,collection and use of information ,a commercial data operator shall limit the collection and sharing of information by the operator with third parties to what is reasonably necessary to provide a service or conduct an activity that a consumer has requested or is reasonably necessary for fraud prevention4 7#b7 ,retention of information ,a commercial data operator that collects the personal information of a consumer shall limit the use and retention of that information to what is reasonably necessary to provide a service or conduct an activity that a consumer has requested or a related operational purpose4 ,any data collected or retained by a commercial data operator solely for security or fraud prevention may not be used for operational purposes4 7#c7 ,monetization ,monetization of personal information shall not be considered reasonably necessary to provide a service or conduct an activity that a consumer has requested or reasonably necessary for security or fraud prevention4 7d7 ,consumer choice and control 7#a7 ,commercial data operator ,a commercial data operator shall provide a prominently and conspicuously displayed icon a user may click to opt out of data collection on every unique website1 mobile application1 or computer application4 7#b7 ,covered entities ,within #b years after the date of the enactment of this ,act1 a covered entity shall take reasonable steps1 taking account of available technology1 to provide users the ability to directly delete the covered data collected by the covered entity4 7e7 ,default settings ,a covered entity may require1 through terms of service or otherwise1 that a user must consent to the transfer of covered data in order to use the service of the covered entity4 7f7 ,policies regarding data from minors ,a covered entity may not collect1 retain1 or transfer the covered data of a user to a third party without affirmative consent from the parent or guardian of the user if the user is below the age of #ah years old1 where technically feasible4 7g7 ,prohibition on tracking cookies without user consent ,a commercial data operator-- 7#a7 unless authorized by the user1 may not track cookies1 including on mobile applications2 and 7#b7 shall provide the same services to users who do not authorize tracking cookies4 7h7 ,transparency 7#a7 ,privacy notice ,a covered entity shall provide users with a clear1 comprehensible1 accurate1 and continuously available privacy notice that-- 7,a7 describes in detail the information collected by the operator1 how that information would be used1 and whether the information would be sold or shared with any third party2 and 7,b7 is #a1jjj words or less4 7#b7 ,report on use of information required ,if a user allows a commercial data operator to sell the covered data of the user1 the commercial data operator shall provide the user with an annual report regarding the types of third parties with whom data has been shared4 ,the report shall include a description of what information has been shared1 for what purpose information is shared1 and a list of each third party that receives data4 7i7 ,data security and breach notification ,a covered entity shall notify each user in a timely manner of any data breach with respect to the information of the user and provide any remedy to compensate the user for the breach of their information1 including a credit protection service1 fraud alert1 and credit monitoring through credit reporting agencies4 7j7 ,enforcement 7#a7 ,enforcement by the ,federal ,trade ,commission 7,a7 ,unfair or deceptive acts or practices ,a violation of this section shall be treated as a violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7,b7 ,powers of ,commission ,the ,commission shall enforce this section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates this section shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7#b7 ,effect on other laws ,nothing in this section shall be construed in any way to limit the authority of the ,commission under any other provision of law or to limit the application of any ,federal or ,state law4 7#c7 ,enforcement by ,state attorneys general 7,a7 ,in general ,if the chief law enforcement officer of a ,state1 or an official or agency designated by a ,state1 has reason to believe that any person has violated or is violating this section1 the attorney general1 official1 or agency of the ,state1 in addition to any authority it may have to bring an action in ,state court under its consumer protection law1 may bring a civil action in any appropriate ,united ,states district court or in any other court of competent jurisdiction1 including a ,state court1 to-- 7i7 enjoin further such violation by such person2 7ii7 enforce compliance with this section2 7iii7 obtain civil penalties2 and 7iv7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state4 7,b7 ,notice and intervention by the ,federal ,trade ,commission ,the attorney general of a ,state shall provide prior written notice of any action under subparagraph 7,a7 to the ,commission and provide the ,commission with a copy of the complaint in the action1 except in any case in which such prior notice is not feasible1 in which case the attorney general shall serve such notice immediately upon instituting such action4 ,the ,commission shall have the right-- 7i7 to intervene in the action2 7ii7 upon so intervening1 to be heard on all matters arising therein2 and 7iii7 to file petitions for appeal4 7,c7 ,limitation on ,state action while ,federal action is pending ,if the ,commission has instituted a civil action for violation of this section1 no ,state attorney general1 or official or agency of a ,state1 may bring an action under this paragraph during the pendency of that action against any defendant named in the complaint of the ,commission for any violation of this section alleged in the complaint4 7#d7 ,private right of action 7,a7 ,in general ,any individual alleging a violation of this section or a regulation promulgated under this section may bring a civil action in any ,federal or ,state court of competent jurisdiction against a covered entity that has global annual gross revenues of at least #ej1jjj1jjj4 7,b7 ,relief ,in a civil action brought under subparagraph 7,a7 in which the plaintiff prevails1 the court may award-- 7i7 #ajj to #gej per violation2 7ii7 reasonable attorney's fees and litigation costs2 and 7iii7 any other relief1 including equitable or declaratory relief1 that the court determines appropriate4 7k7 ,definitions ,in this section3 7#a7 ,commercial data operator ,the term commercial data operator means an entity acting in its capacity as a consumer online services provider or data broker that-- 7,a7 generates a material amount of revenue from the use1 collection1 processing1 sale1 or sharing of data generated by a user2 and 7,b7 has more than #ajj1jjj1jjj unique monthly visitors or users in the ,united ,states for a majority of months during the previous #a-year period4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,consent ,the term consent means an affirmative act by an individual that clearly communicates the informed authorization of the individual for an act or practice4 7#d7 ,core function ,the term core function does not mean targeted advertising or marketing4 7#e7 ,covered data ,the term covered data means individually1 identifiable information about a user collected online1 including any of the following3 7,a7 ,location information that would identify the physical address of an individual4 7,b7 ,telephone number4 7,c7 ,email address4 7,d7 ,social security number or other unique1 government-issued identifiers4 7,e7 ,nonpublic personal information 7as defined in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji774 7,f7 ,content of a personal wire communication1 oral communication1 or electronic communication such as email or direct messaging with respect to any entity that is not the intended recipient of the communication4 7,g7 ,call detail records4 7,h7 ,web browsing history1 application usage history1 and the functional equivalent of either that is not aggregated data4 7,i7 ,biometric data and information1 such as facial and voice recognition data4 7#f7 ,covered entity ,the term covered entity means a commercial data broker or large online operator that collects covered data from a user through an online platform4 7#g7 ,data broker ,the term data broker means a covered entity whose principal source of revenue is derived from processing or transferring the covered data of individuals with whom the entity does not have a direct relationship on behalf of a third party for use by the third party4 7#h7 ,de-identify ,the term de-identify means to separate information from the user or ,,ip address the information is associated with4 7#i7 ,delete ,the term delete means to remove or destroy information so that the information is not maintained in human or machine-readable form and cannot be retrieved or used in such form in the normal course of business4 7#aj7 ,large online operator ,the term large online operator means any person that-- 7,a7 provides an online service2 and 7,b7 has more than #ajj1jjj1jjj authenticated users of an online service in any #cj-;day period4 7#aa7 ,monetization ,the term monetization means the process of collecting1 using1 and storing data solely for economic benefit4 7#ab7 ,user ,the term user means an individual residing in the ,united ,states who uses a website that collects data and information from the user4