,,ii #aahth ,,congress #ast ,session ,s4 #baba ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #bb1 #bjbc,mr4 ,cassidy 7for himself and ,mr4 ,ossoff7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish a centralized system to allow individuals to request the simultaneous deletion of their personal information across all data brokers1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,elimination and ,limiting ,extensive ,tracking and ,exchange ,act or the ,,delete ,act4 #b4 ,data deletion requirements 7a7 ,data broker annual registration 7#a7 ,in general 7,a7 ,regulations ,not later than #a year after the date of enactment of this section1 the ,commission shall promulgate regulations to require any data broker to-- 7i7 not later than #ah months after the date of enactment of this section1 and annually thereafter1 register with the ,commission2 and 7ii7 subject to subparagraph 7,b71 provide the following information with such registration3 7,i7 ,the name and primary physical1 email1 and uniform resource locator 7,,url7 addresses of the data broker4 7,,ii7 ,if the data broker permits an individual to opt out of the data broker's collection or use of personal information1 certain sales of such information1 or its databases-- 7aa7 the method for requesting an opt-out2 7bb7 any limitations on the type of data collection1 uses1 or sales for which an individual may opt-out2 and 7cc7 whether the data broker permits an individual to authorize a third party to perform the opt-out on the individual's behalf4 7,,iii7 ,a response to a standardized form 7as issued by the ,commission7 specifying the types of information the data broker collects or obtains and the sources from which the data broker obtains data4 7,,iv7 ,a statement as to whether the data broker implements a credentialing process and1 if so1 a description of that process4 7,v7 ,any additional information or explanation the data broker chooses to provide concerning its data collection practices4 7,,vi7 ,any other information determined appropriate by the ,commission4 7,b7 ,construction ,nothing in this paragraph shall be construed as requiring a data broker to disclose any information that is a trade secret or confidential information described in section #eeb7;b77#d7 of title #e1 ,united ,states ,code4 7#b7 ,public availability 7,a7 ,in general ,the ,commission shall make the information described in paragraph 7#a77;,a7 publicly available in a downloadable and machine-readable format1 except in the event that the ,commission-- 7i7 determines that the risk of making such information available is not in the interest of public safety or welfare2 and 7ii7 provides a justification for such determination4 7,b7 ,disclaimer ,the ,commission shall include on the website of the ,commission a disclaimer that-- 7i7 the ,commission cannot confirm the accuracy of the responses provided by the data brokers in the registration described in paragraph 7#a77;,a72 and 7ii7 individuals may contact such data brokers at their own risk4 7b7 ,centralized data deletion system 7#a7 ,establishment 7,a7 ,in general ,not later than #a year after the date of enactment of this section1 the ,commission shall promulgate regulations to establish a centralized system that-- 7i7 implements and maintains reasonable security procedures and practices 7including administrative1 physical1 and technical safeguards7 appropriate to the nature of the information and the purposes for which the personal information will be used1 to protect individuals' personal information from unauthorized use1 disclosure1 access1 destruction1 or modification2 7ii7 allows an individual1 through a single submission1 to request that every data broker who is registered under subsection 7a7 and who maintains any persistent identifiers 7as described in subparagraph 7,b77iii77-- 7,i7 delete any personal information related to such individual held by such data broker or affiliated legal entity of the data broker2 and 7,,ii7 unless otherwise specified by the individual1 discontinue any present or future collection of personal information related to such individual2 and 7iii7 allows a registered data broker1 prior to the collection of any personal information that is tied to a persistent identifier for which a registry exists1 to submit a query to the centralized system to confirm that the persistent identifier is not subject to a deletion request described in clause 7ii74 7,b7 ,requirements ,the centralized system established in subparagraph 7,a7 shall meet the following requirements3 7i7 ,the centralized system shall allow an individual to request the deletion of all personal information related to such individual and the discontinuation of any collection of such personal information related to such individual through a single deletion request4 7ii7 ,the centralized system shall provide a standardized form to allow an individual to make such request4 7iii7 ,such standardized form shall include the individual's email1 phone number1 physical address1 and any other persistent identifier determined by the ,commission to aid in the deletion request4 7iv7 ,the centralized system shall automatically salt and hash all submitted information and allow the ,commission to maintain independent hashed registries of each type of information obtained through such form4 7v7 ,the centralized system shall only permit data brokers who are registered with the ,commission to submit hashed queries to the independent hashed registries described in clause 7iv74 7vi7 ,with respect to the independent hashed registries described in clause 7iv71 the salt shall be different for each such registry and shall be made available to all registered data brokers for the purposes of submitting hashed queries1 as described in clause 7v74 7vii7 ,the centralized system shall allow an individual to make such request using an internet website operated by the ,commission4 7viii7 ,the centralized system shall not charge the individual to make such request4 7,c7 ,transition 7i7 ,in general ,not later than #h months after the effective date of the regulations promulgated under subparagraph 7,a71 each data broker shall-- 7,i7 not less than once every #ca days1 access the hashed registries maintained by the ,commission as described in subparagraph 7,b77iv72 and 7,,ii7 process any deletion request associated with a match between such hashed registries and the records of the data broker4 7ii7 ,,ftc guidance ,not later than #f months after the effective date of the regulations promulgated under subparagraph 7,a71 the ,commission shall publish guidance on the process and standards to which a data broker must adhere in carrying out clause 7i74 7#b7 ,deletion 7,a7 ,information deletion 7i7 ,in general ,subject to clause 7ii71 not later than #ca days after accessing the hashed registries described in paragraph 7#a77;,b77iv71 a data broker and any associated legal entity shall delete all personal information in its possession related to the individual making the request and discontinue the collection of personal information related to such individual4 ,immediately following the deletion1 the data broker shall send an affirmative representation to the ,commission with the number of records deleted pursuant to each match with a value in the hashed registries4 7ii7 ,exclusions ,in carrying out clause 7i71 a data broker may retain1 where required1 the following information3 7,i7 ,any personal information that is processed or maintained solely as part of human subjects research conducted in compliance with any legal requirements for the protection of human subjects4 7,,ii7 ,any personal information necessary to comply with a warrant1 subpoena1 court order1 rule1 or other applicable law4 7,,iii7 ,any information necessary for an activity described in subsection 7f77#c77;,b71 provided that the retained information is used solely for any such activity4 7iii7 ,use of information ,any personal information excluded under clause 7ii7 may only be used for the purpose described in the applicable subclause of clause 7ii71 and may not be used for any other purpose1 including marketing purposes4 7,b7 ,annual report ,each data broker registered under subsection 7a7 shall submit to the ,commission1 on an annual basis1 a report on the completion rate with respect to the completion of deletion requests under subparagraph 7,a74 7,c7 ,audit 7i7 ,in general ,not later than #c years after the date of enactment of this section1 and every #c years thereafter1 each data broker registered under subsection 7a7 shall undergo an independent third party audit to determine compliance with this subsection4 7ii7 ,audit report ,not later than #f months after the completion of any audit under clause 7i71 each such data broker shall submit to the ,commission any report produced as a result of the audit1 along with any related materials4 7iii7 ,maintain records ,each such data broker shall maintain the materials described in clause 7ii7 for a period of not less than #f years4 7#c7 ,annual fee 7,a7 ,in general ,subject to subparagraph 7,b71 each data broker registered under subsection 7a7 and who maintains any persistent identifiers 7as described in paragraph 7#a77;,b77iii77 shall pay to the ,commission1 on an annual basis1 a subscription fee determined by the ,commission to access the database4 7,b7 ,limit ,the amount of the subscription fee under subparagraph 7,a7 may not exceed #a percent of the expected annual cost of operating the centralized system and hashed registries described in paragraph 7#a71 as determined by the ,commission4 7,c7 ,availability ,any amounts collected by the ,commission pursuant to this paragraph shall be available without further appropriation to the ,commission for the exclusive purpose of enforcing and administering this ,act1 including the implementation and maintenance of such centralized system and hashed registries and the promotion of public awareness of the centralized system4 7c7 ,enforcement by the commission 7#a7 ,unfair or deceptive acts or practices ,a violation of subsection 7a7 or 7b7 or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the commission 7,a7 ,in general ,the ,commission shall enforce this section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates subsection 7a7 or 7b7 or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this section shall be construed to limit the authority of the ,commission under any other provision of law4 7,d7 ,rulemaking ,the ,commission shall promulgate in accordance with section #eec of title #e1 ,united ,states ,code1 such rules as may be necessary to carry out this section4 7d7 ,study and report 7#a7 ,study ,the ,commission shall conduct a study on the implementation and enforcement of this section4 ,such study shall include-- 7,a7 an analysis of the effectiveness of the centralized system established in subsection 7b77#a77;,a72 7,b7 the number deletion requests submitted annually using such centralized system2 7,c7 an analysis of the progress of coordinating the operation and enforcement of such requests with similar systems established and maintained by the various ,states2 and 7,d7 any other area determined appropriate by the ,commission4 7#b7 ,report ,not later than #c years after the date of enactment of this section1 and annually thereafter for each of the next #d years1 the ,commission shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report containing-- 7,a7 the results of the study conducted under paragraph 7#a72 7,b7 a summary of any enforcement actions taken pursuant to this ,act2 and 7,c7 recommendations for such legislation and administrative action as the ,commission determines appropriate4 7e7 ,preemption 7#a7 ,in general ,the provisions of this ,act shall preempt any ,state privacy law only to the extent that such ,state law is inconsistent with the provisions of this ,act4 7#b7 ,greater protection under state law ,for purposes of paragraph 7#a71 a ,state privacy law is not inconsistent with the provisions of this ,act if the protection such law affords any person is greater than the protection provided under this ,act1 as determined by the ,commission4 7f7 ,definitions ,in this section3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,credentialing process ,the term credentialing process means the practice of taking reasonable steps to confirm-- 7,a7 the identity of the entity with whom the data broker has a direct relationship2 7,b7 that any data disclosed to the entity by such data broker will be used for the described purpose of such disclosure2 and 7,c7 that such data will not be used for unlawful purposes4 7#c7 ,data broker 7,a7 ,in general ,the term data broker means an entity that knowingly collects or obtains the personal information of an individual with whom the entity does not have a direct relationship and then-- 7i7 uses the personal information to perform a service for a third party2 or 7ii7 sells1 licenses1 trades1 provides for consideration1 or is otherwise compensated for disclosing personal information to a third party4 7,b7 ,exclusion ,the term data broker does not include an entity who solely uses1 sells1 licenses1 trades1 provides for consideration1 or is otherwise compensated for disclosing personal information for one or more of the following activities3 7i7 ,providing #daa directory assistance or directory information services1 including name1 address1 and telephone number1 on behalf of or as a function of a telecommunications carrier4 7ii7 ,providing an individual's publicly available information if the information is being used by the recipient as it relates to that individual's business or profession4 7iii7 ,providing personal information to a third party at the express direction of the individual for a clearly disclosed single-use purpose4 7iv7 ,providing or using personal information for assessing1 verifying1 or authenticating an individual's identity1 or for investigating or preventing actual or potential fraud4 7v7 ,gathering1 preparing1 collecting1 photographing1 recording1 writing1 editing1 reporting1 or publishing news or information that concerns local1 national1 or international events or other matters of public interest 7as determined by the ,commission7 for dissemination to the public4 7vi7 ,acting as a consumer reporting agency 7as defined in section #fjc7;f7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7f7774 7,c7 ,exclusion from sale 7i7 ,in general ,for purposes of this paragraph1 the term sells does not include a one-time or occasional sale of assets of an entity as part of a transfer of control of those assets that is not part of the ordinary conduct of the entity4 7ii7 ,notice required ,to meet the exclusion criteria described in clause 7i71 an entity must provide notice to the ,commission1 in the manner determined appropriate by the ,commission1 of any such one-time or occasional sale of assets4 7#d7 ,delete ,the term delete means to remove or destroy information such that the information is not maintained in human- or machine-readable form and cannot be retrieved or utilized in such form in the normal course of business4 7#e7 ,direct relationship 7,a7 ,in general ,the term direct relationship means a relationship between an individual and an entity where the individual-- 7i7 is a current customer2 7ii7 has obtained a good or service from the entity within the prior #ah months2 or 7iii7 has made an inquiry about the products or services of the entity within the prior #ij days4 7,b7 ,exclusion ,the term direct relationship does not include a relationship-- 7i7 between an individual and a data broker where the individual's only connection to the data broker is based on the individual's request-- 7,i7 for the data broker to delete the personal information of the individual2 or 7,,ii7 to opt-out of the data broker's collection or use of personal information1 certain sales of such information1 or its databases2 or 7ii7 required under any ,state or ,federal law related to the use of personal information4 7#f7 ,hash ,the term hash means to input data to a cryptographic1 one-way1 collision resistant function that maps a bit string of arbitrary length to a fixed-length bit string to produce a cryptographically secure value4 7#g7 ,hashed ,the term hashed means the type of value produced by hashing data4 7#h7 ,human subjects research ,the term human subjects research means research that-- 7,a7 an investigator 7whether professional or student7 conducts on a living individual2 and 7,b7 either-- 7i7 obtains information or biospecimens through intervention or interaction with the individual1 and uses1 studies1 or analyzes the information or biospecimens2 or 7ii7 obtains1 uses1 studies1 analyzes1 or generates personal information or identifiable biospecimens4 7#i7 ,personal information 7,a7 ,in general ,the term personal information means any information held by a data broker1 regardless of how the information is collected1 inferred1 created1 or obtained1 that is linked or reasonably linkable by the data broker to a particular individual or consumer device1 including the following information3 7i7 ,financial information1 including any bank account number1 credit card number1 debit card number1 or insurance policy number4 7ii7 ,a name1 alias1 home or other physical address1 online identifier1 ,internet ,protocol address1 email address1 phone number1 account name1 ,state identification card number1 driver's license number1 passport number1 or an identifying number on a government-issued identification4 7iii7 ,geolocation information4 7iv7 ,biometric information4 7v7 ,the contents of1 attachments to1 or parties to information1 including with respect to email1 text messages1 picture messages1 voicemails1 audio conversations1 or video conversations4 7vi7 ,web browsing history1 including any search query4 7vii7 ,genetic sequencing information4 7viii7 ,a device identifier1 online identifier1 persistent identifier1 or digital fingerprinting information4 7ix7 ,any inference drawn from any of the information described in this paragraph that is used to create a profile about an individual that reflects such individual's preferences1 characteristics1 psychological trends1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 or aptitudes4 7x7 ,any other information determined appropriate by the ,commission4 7,b7 ,linked or reasonably linkable ,for purposes of subparagraph 7,a71 information is linked or reasonably linkable to a particular individual or consumer device if the information can be used on its own or in combination with other information held by or readily accessible to a data broker to identify a particular individual or consumer device4 7#aj7 ,process ,the term process means to perform or direct the performance of an operation on personal information1 including the collection1 transmission1 use1 disclosure1 analysis1 prediction1 or modification of such personal information1 whether or not by automated means4 7#aa7 ,salt ,the term salt means to add a random string of data to the input of a hash function4 7#ab7 ,uniform resource locator2 url ,the term uniform resource locator or ,,url means a short string containing an address that refers to an object on the web4