,i #aaith ,,congress #b;d ,session ,h4 ,r4 #hjad ,,in ,,the ,,house ,,of ,,representatives ,march #ai1 #bjbf ,ms4 ,lofgren introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce1 and in addition to the ,committees on the ,judiciary1 and ,science1 ,space1 and ,technology1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to provide for individual rights relating to privacy of personal information1 to establish privacy and security requirements for covered entities relating to personal information1 and to establish an agency to be known as the ,digital ,privacy ,agency to enforce such rights and requirements1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,online ,privacy ,act of #bjbf4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,general provisions4 ,sec4 #d4 ,limitation on disclosing nonredacted government records4 ,sec4 #e4 ,criminal prohibition on doxxing4 ,title ,i--,individual ,rights ,sec4 #aja4 ,right of access4 ,sec4 #ajb4 ,right of correction4 ,sec4 #ajc4 ,right of deletion4 ,sec4 #ajd4 ,right of portability4 ,sec4 #aje4 ,right to human review of automated decisions4 ,sec4 #ajf4 ,right to individual autonomy4 ,sec4 #ajg4 ,right to be informed4 ,sec4 #ajh4 ,right to impermanence4 ,sec4 #aji4 ,exemptions1 exceptions1 fees1 timelines1 and rules of construction for rights under this title4 ,title ,,ii--,requirements for ,covered ,entities1 ,service ,providers1 and ,third ,parties ,sec4 #bja4 ,minimization4 ,sec4 #bjb4 ,minimization and records of access by employees and contractors4 ,sec4 #bjc4 ,prohibitions on disclosing of personal information4 ,sec4 #bjd4 ,disclosing to entities not subject to ,united ,states jurisdiction or not compliant with this ,act4 ,sec4 #bje4 ,prohibition on re-identification4 ,sec4 #bjf4 ,restrictions on collecting1 processing1 maintaining1 and disclosing contents of communications4 ,sec4 #bjg4 ,prohibition on discriminatory processing4 ,sec4 #bjh4 ,requirements for notice and consent processes and privacy policies4 ,sec4 #bji4 ,prohibition on dark patterns in notice and consent processes and privacy policies4 ,sec4 #baj4 ,notice and consent required4 ,sec4 #baa4 ,privacy policy4 ,sec4 #bab4 ,information security requirements4 ,sec4 #bac4 ,notification of data breach or data-sharing abuse4 ,title ,,iii--,digital ,privacy ,agency ,sec4 #cja4 ,establishment2 ,director and ,deputy ,director4 ,sec4 #cjb4 ,agency powers and authorities4 ,sec4 #cjc4 ,reporting and audit requirements4 ,sec4 #cjd4 ,relation to other agencies4 ,sec4 #cje4 ,personnel4 ,sec4 #cjf4 ,office of ,civil ,rights4 ,sec4 #cjg4 ,complaints of individuals4 ,sec4 #cjh4 ,advisory boards4 ,sec4 #cji4 ,authorization of appropriations4 ,title ,,iv--,enforcement ,sec4 #dja4 ,investigations and administrative discovery4 ,sec4 #djb4 ,hearings and adjudication proceedings4 ,sec4 #djc4 ,litigation authority4 ,sec4 #djd4 ,enforcement by ,states4 ,sec4 #dje4 ,private rights of action4 ,sec4 #djf4 ,relief available4 ,sec4 #djg4 ,referral for criminal proceedings4 ,sec4 #djh4 ,whistleblower enforcement4 ,title ,v--,relation to ,other ,law ,sec4 #eja4 ,effective date4 ,sec4 #ejb4 ,relation to other ,federal law4 ,sec4 #ejc4 ,relation to ,state law4 ,sec4 #ejd4 ,severability4 ,title ,,vi--,,nist and ,,nsf ,activities ,sec4 #fja4 ,national ,institute of ,standards and ,technology privacy research and development4 ,sec4 #fjb4 ,national privacy awareness and education initiative4 ,sec4 #fjc4 ,national ,science ,foundation privacy research4 #b4 ,definitions ,in this ,act3 7#a7 ,behavioral personalization 7,a7 ,in general ,the term behavioral personalization means the processing of the personal information of an individual1 using an algorithm1 model1 or other means-- 7i7 built using-- 7,i7 that individual's personal information collected over a period of time2 or 7,,ii7 an aggregate of the information of one or more similarly situated individuals2 and 7ii7 designed to-- 7,i7 alter1 influence1 guide1 or predict that individual's behavior2 7,,ii7 tailor or personalize a product or service to that individual2 or 7,,iii7 filter1 sort1 limit1 promote1 display or otherwise differentiate between specific content or categories of content that would otherwise be accessible to that individual4 7,b7 ,exclusions ,the term behavioral personalization does not include the use of historical personal information to merely prevent the display of or provide additional information about previously accessed content4 7#b7 ,collect ,the term collect includes1 with respect to personal information or the contents of any communication1 obtaining such information or contents in any manner1 except when solely transmitting1 routing1 providing intermediate storage for1 or providing connections for such personal information or communication through a system or network4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,contents ,the term contents1 when used with respect to communication1 has the meaning given such term in section #beaj of title #ah1 ,united ,states ,code4 7#e7 ,covered entity 7,a7 ,in general ,the term covered entity means a person who-- 7i7 intentionally collects1 processes1 or maintains personal information2 and 7ii7 sends or receives such personal information over the internet or a similar communications network4 7,b7 ,exclusion ,the term covered entity does not include a natural person1 except to the extent such person is engaged in a commercial activity that is more than de minimis4 7,c7 ,de minimis defined ,in this paragraph1 the term de minimis means incidental commercial activity by a natural person that-- 7i7 generates not more than #e1jjj in gross revenue in a #ab-month period2 or 7ii7 involves the personal information of fewer than #e1jjj individuals in such period4 7#f7 ,custodian ,the term custodian means the custodian or any deputy custodian designated by the ,director of the ,digital ,privacy ,agency4 7#g7 ,data breach ,the term data breach means unauthorized access to or acquisition of personal information or contents of communications maintained by such covered entity4 7#h7 ,data-sharing abuse ,the term data-sharing abuse means processing1 by a third party1 of personal information or contents of communications disclosed by a covered entity to the third party1 for any purpose other than-- 7,a7 a purpose specified by the covered entity to the third party at the time such personal information or contents of communications was disclosed2 or 7,b7 a purpose to which the individual to whom the information relates has consented4 7#i7 ,de-identify 7,a7 ,in general ,the term de-identify means1 with respect to information1 performing actions so that such information cannot reasonably identify1 relate to1 describe1 reference1 be capable of being associated with1 or be linked1 directly or indirectly1 to a particular individual or device1 but only to the extent that the covered entity that uses such information-- 7i7 has performed such actions using best practices for the types of data such information contains2 7ii7 has implemented technical safeguards that prohibit re-identification of the individual with whom such information was linked2 7iii7 has implemented business processes that specifically prohibit re-identification of the information2 7iv7 has implemented business processes to prevent inadvertent release of such information2 and 7v7 makes no attempt to re-identify such information4 7,b7 ,determination by the director ,the ,director may determine that a methodology of de-identifying personal information is insufficient for the purposes of this paragraph4 7#aj7 ,digital ,privacy ,agency ,the term ,digital ,privacy ,agency means the ,digital ,privacy ,agency established under section #cja4 7#aa7 ,digital ,privacy ,agency investigator ,the term ,digital ,privacy agency investigator means any attorney or investigator employed by the ,digital ,privacy ,agency who is charged with the enforcement of or carrying out of any provision of this ,act or a rule or order prescribed under this ,act4 7#ab7 ,director ,the term ,director means the ,director of the ,digital ,privacy ,agency4 7#ac7 ,disclose ,the term disclose means1 with respect to personal information or contents of communication1 to sell1 release1 transfer1 share1 disseminate1 make available1 or otherwise cause to be communicated1 such information or contents to a third party4 7#ad7 ,documentary material ,the term documentary material includes the original or any copy of any book1 document1 record1 report1 memorandum1 paper1 communication1 tabulation1 chart1 logs1 electronic files1 or other data or data compilations stored in any medium4 7#ae7 ,federal agency ,the term ,federal agency has the meaning given that term in section #ccga of title #e1 ,united ,states ,code4 7#af7 ,federal privacy laws ,the term ,federal privacy laws includes the laws and regulations described in section #ejb4 7#ag7 ,government entity ,the term government entity means-- 7,a7 a ,federal agency2 7,b7 a ,state or political subdivision thereof2 or 7,c7 any agency1 authority1 or instrumentality of a ,state or political subdivision thereof4 7#ah7 ,individual ,the term individual means a natural person residing in the ,united ,states4 7#ai7 ,indian ,tribe ,the term ,indian ,tribe has the meaning given such term in section #d7;e7 of the ,indian ,self-,determination and ,education ,assistance ,act 7#be ,u4,s4,c4 #ecjd7;e774 7#bj7 ,maintain ,the term maintain means1 with respect to personal information or the contents of any communication1 to store1 secure1 or otherwise cause the retention of such information or contents1 or to take actions necessary for storing1 securing1 or otherwise causing the retention of such information or contents4 7#ba7 ,nonpublic information ,the term nonpublic information means information that has not been disclosed in a criminal1 civil1 or administrative proceeding1 in a government investigation1 report1 or audit1 or by the news media or other public source of information1 and that was not obtained in violation of the law4 7#bb7 ,personal information 7,a7 ,in general ,the term personal information means any information maintained by a covered entity that1 on its own or combined with other information1 is linked or reasonably linkable to a specific individual or a specific device1 including de-identified personal information and the means to behavioral personalization created for or linked to a specific individual4 7,b7 ,exclusions ,the term personal information does not include-- 7i7 publicly available information linked to an individual if that information was not unlawfully made public2 or 7ii7 information derived or inferred from personal information1 if the derived or inferred information is not linked or reasonably linkable to a specific individual4 7#bc7 ,privacy harm ,the term privacy harm means an adverse consequence or a potential adverse consequence to an individual1 a group of individuals1 or society caused from collecting1 processing1 maintaining1 or disclosing of personal information or contents of communications1 including-- 7,a7 direct or indirect financial loss or economic harm2 7,b7 physical harm2 7,c7 psychological harm1 including anxiety1 embarrassment1 fear1 and other trauma2 7,d7 adverse outcomes or decisions with respect to the eligibility of an individual for rights1 benefits1 or privileges in employment 7including hiring1 firing1 promotion1 demotion1 and compensation71 credit and insurance 7including denial of an application or obtaining less favorable terms71 housing1 education1 professional certification1 or the provision of health care and related services2 7,e7 stigmatization or reputational harm2 7,f7 price discrimination2 7,g7 adverse consequences that affect the private life of an individual1 including private family matters and actions and communications within the home of such individual or a similar physical1 online1 or digital location where such individual has a reasonable expectation that personal information will not be collected1 processed1 or maintained2 7,h7 the chilling of free expression or action of an individual1 a group of individuals1 or society1 due to perceived or actual pervasive and excessive collecting1 processing1 disclosing1 or maintaining of personal information or contents of communications2 7,i7 impairing the autonomy of an individual1 a group of individuals1 or society2 and 7,j7 other adverse consequences or potential adverse consequences1 consistent with the provisions of this ,act1 as determined by the ,director4 7#bd7 ,privacy-preserving computing 7,a7 ,in general ,the term privacy-preserving computing means the collecting1 processing1 disclosing1 or maintaining of personal information that has been encrypted or otherwise rendered unintelligible using a means that cannot be reversed by a covered entity1 or a covered entity's service provider1 such that-- 7i7 if such personal information could be rendered intelligible through cooperation or sharing of cryptographic secrets by multiple persons1 the covered entity has both technical safeguards and business processes to prevent such cooperation or sharing2 7ii7 if such personal information is rendered intelligible within a hardware processing unit or other means of performing operations on the information1 there are technical safeguards that1 during the normal course of operation-- 7,i7 prevent rendering personal information intelligible anywhere but within the hardware processing unit or other means of performing operations2 and 7,,ii7 make the exporting or otherwise observing of such intelligible information1 or the cryptographic secret used to protect such information1 impossible2 and 7iii7 if the result of such processing of the personal information is also personal information1 such result must be unintelligible to the covered entity or service provider and protected by privacy-preserving computing4 7,b7 ,insufficient methodologies ,the ,director may determine that a methodology of privacy-preserving computing is insufficient for the purposes of this definition4 7#be7 ,process ,the term process means to perform or cause to be performed any operation or set of operations on personal information or contents of communication1 whether or not by automated means4 7#bf7 ,protected class ,the term protected class means the actual or perceived race1 color1 ethnicity1 national origin1 religion1 sex 7including sexual orientation and gender identity or expression71 familial status1 or disability of an individual or group of individuals4 7#bg7 ,publicly available information ,the term publicly available information-- 7,a7 means-- 7i7 information that is lawfully made available from a government entity2 7ii7 information linked to a public individual or official that is made publicly accessible1 without restrictions on accessibility other than the general authorization to access the services used to make the information accessible2 or 7iii7 information of an individual that-- 7,i7 is made publicly accessible by such individual1 without restrictions on accessibility other than the general authorization to access the services used to make the information accessible2 and 7,,ii7 such individual has the ability to delete or change without relying on a request under section #ajb or #ajc2 and 7,b7 does not include-- 7i7 biometric information of an individual collected by a covered entity without the individual's knowledge2 7ii7 information used for a purpose that is not compatible with the purpose for which the information is maintained and made available in government records2 7iii7 information obtained from government records for the purpose of selling such information2 or 7iv7 information used to contact or locate a private individual either physically or electronically4 7#bh7 ,reasonable mechanism ,the term reasonable mechanism means1 in the case of a mechanism for individuals to exercise a right under title ,i or interact with a covered entity under title ,,ii1 a mechanism that-- 7,a7 is equivalent in availability and ease of use to that of other mechanisms for communicating or interacting with the covered entity2 and 7,b7 includes an online means of exercising such right or engaging in such interaction1 if such individuals communicate or interact with such covered entity through an online medium or if such covered entity provides information processing services through a public or widely available application programming interface 7or similar mechanism74 7#bi7 ,sell and sale 7,a7 ,in general ,the terms sell and sale mean the disclosing of personal information for monetary consideration or for a thing of value by a covered entity to a third party for the purposes of processing1 maintaining or disclosing such personal information at the third party's discretion4 7,b7 ,exclusions ,the terms sell and sale do not include-- 7i7 the disclosing of personal information of an individual to a third party with which the individual has a direct relationship for purposes of providing a product or service requested by the individual or otherwise in a manner that is consistent with an individual's reasonable expectations considering the context in which the individual provided the personal information to the covered entity2 7ii7 the disclosing or transfer of personal information to a subsidiary or an affiliate of the covered entity2 or 7iii7 the disclosing or transfer of personal information to a third party as an asset that is part of a merger1 acquisition1 bankruptcy1 or other transaction in which the third party assumes control of all or part of the covered entity's assets1 unless personal information makes up the majority of the value of the assets of which the third party assumes control4 7#cj7 ,service provider 7,a7 ,in general ,the term service provider means a covered entity that-- 7i7 processes1 discloses1 or maintains personal information1 where such covered entity does not process1 disclose1 or maintain the personal information other than in accordance with the directions and on behalf of another covered entity2 7ii7 does not directly collect personal information from or control the mechanism for collecting personal information from an individual2 7iii7 does not earn revenue from processing1 maintaining1 or disclosing personal information disclosed to such covered entity by another covered entity except by providing contracted services to such other covered entity2 7iv7 does not disclose personal information to another covered entity unless such personal information was provided by such other covered entity or resulted from maintaining or processing performed on personal information exclusively provided by such other covered entity2 7v7 does not offer services that allow another covered entity to target specific individuals using personal information not provided by such other covered entity2 7vi7 with respect to personal information processed or maintained by such covered entity on behalf of another covered entity1 assists such other covered entity in complying with title ,i1 including providing tools for such other covered entity to comply with such requirements if requested2 and 7vii7 does not link the personal information provided by another covered entity to personal information from any other source4 7,b7 ,treatment ,a covered entity shall be treated as a service provider under this ,act only to the extent that such covered entity is acting as a service provider1 as defined in subparagraph 7,a74 7#ca7 ,significant privacy harm ,the term significant privacy harm means adverse consequences to an individual arising from the collecting1 processing1 maintaining1 or disclosing of personal information or contents of communications1 limited to subparagraph 7,a71 7,b71 or 7,d7 of paragraph 7#bc74 7#cb7 ,small business ,the term small business means a covered entity that-- 7,a7 does not earn revenue from the sale of personal information2 7,b7 earns less than half of annual revenues from the processing of personal information for targeted or personalized advertising2 7,c7 has not1 in combination with each subsidiary and affiliate of the service1 maintained personal information of #bej1jjj or more individuals for #c or more of the preceding #ab months2 7,d7 has fewer than #bjj employees2 and 7,e7 received less than #be1jjj1jjj in gross revenue in the preceding #ab-month period4 7#cc7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each federally recognized ,indian ,tribe4 7#cd7 ,state attorney general ,the term ,state attorney general means1 with respect to a ,state1 the attorney general or chief law enforcement officer of the ,state1 or another official or agency designated by the ,state to bring civil actions on behalf of the ,state or the residents of the ,state4 7#ce7 ,state privacy regulator ,the term ,state privacy regulator means an agency or instrumentality of a ,state that has the primary purpose of administering1 implementing1 or enforcing a privacy law or associated rules or regulations4 7#cf7 ,third party ,the term third party means1 with respect to a covered entity1 a person-- 7,a7 to which such covered entity disclosed personal information2 and 7,b7 that is not-- 7i7 such covered entity2 7ii7 a subsidiary or corporate affiliate of such covered entity2 or 7iii7 a service provider of such covered entity4 7#cg7 ,users ,the term users means1 with respect to a product or service1 the monthly active users1 subscribers1 or customers 7or a reasonable proxy or substitute therefor determined by the ,director7 of such product or service4 7#ch7 ,violation ,the term violation means1 except where otherwise specified1 any act or omission that1 if proved1 would constitute a violation of any provision of this ,act or a rule or order issued pursuant to this ,act4 #c4 ,general provisions 7a7 ,rules of construction with respect to personal information and individuals ,in this ,act-- 7#a7 any reference to information as being of or belonging to an individual shall be construed to mean that such information is linked or reasonably linkable to such individual as described in section #b7ba77;,a72 and 7#b7 any reference to any communication as being of or belonging to an individual shall be construed to mean that such individual is party to such communication4 7b7 ,prohibition on waivers 7#a7 ,in general ,the provisions under this ,act may not be waived4 ,any agreement purporting to waive compliance with or modifying any provision of this ,act shall be void as contrary to public policy4 7#b7 ,prohibition on predispute arbitration agreements ,no predispute arbitration agreement shall be valid or enforceable with respect to any claims under this ,act4 7c7 ,journalism protection 7#a7 ,in general ,covered entities engaged in journalism shall not be subject to the obligations imposed under this ,act to the extent that those obligations directly infringe on the journalism rather than the business practices of the covered entity1 so long as the covered entity has technical safeguards and business processes that prevent the collecting1 processing1 maintaining1 or disclosing of such personal information for business practices other than journalism4 7#b7 ,journalism ,the term journalism includes the collecting1 maintaining1 processing1 and disclosing of personal information about a public individual or official1 or that otherwise concerns matters of public interest1 for dissemination to the public4 7d7 ,small business compliance ramp ,upon losing its status as a small business1 a covered entity shall have nine months to comply with provisions of this ,act that a small business is exempt from complying with4 7e7 ,prohibition on collecting1 maintaining1 processing1 or disclosing personal information ,a covered entity may not collect1 maintain1 process1 or disclose personal information using a channel of interstate commerce unless such covered entity is in compliance with all requirements of this ,act4 #d4 ,limitation on disclosing nonredacted government records 7a7 ,in general ,a government entity may not use a channel of interstate commerce to disclose the personal information of an individual in a government record without an agreement prohibiting the recipient of such information from selling the information without the express consent of the individual4 7b7 ,exception ,notwithstanding subsection 7a71 this section does not prohibit the disclosure of personal information using a channel of interstate commerce to another government entity without consent of the individual4 #e4 ,criminal prohibition on doxxing 7a7 ,in general ,chapter #da of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #hha4 ,disclosing of personal information with the intent to cause harm 7a7 ,in general ,whoever uses a channel of interstate or foreign commerce to knowingly disclose an individual's personal information with the intent-- 7#a7 to threaten1 intimidate1 or harass any person1 incite or facilitate the commission of a crime of violence against any person1 or place any person in reasonable fear of death or serious bodily injury2 or 7#b7 that the information will be used to threaten1 intimidate1 or harass any person1 incite or facilitate the commission of a crime of violence against any person1 or place any person in reasonable fear of death or serious bodily injury1 shall be fined under this title or imprisoned not more than #e years1 or both4 7b7 ,digital ,privacy ,agency 7#a7 ,support functions ,the ,director of the ,digital ,privacy ,agency may-- 7,a7 receive complaints and refer credible complaints to the ,attorney ,general2 7,b7 coordinate with appropriate law enforcement agencies to support investigations2 and 7,c7 provide technical assistance upon the request of the ,attorney ,general4 7#b7 ,rule of construction ,nothing in this section shall be construed to authorize the ,digital ,privacy ,agency to prosecute an offense under this section4 7c7 ,definitions ,in this section3 7#a7 ,contents ,the term contents when used with respect to communication1 has the meaning given such term in section #beaj of this title4 7#b7 ,disclose ,the term disclose means1 with respect to personal information or contents of communication1 to sell1 release1 transfer1 share1 disseminate1 make available1 or otherwise cause to be communicated such information or contents to a third party4 7#c7 ,government entity ,the term government entity means-- 7,a7 a ,federal agency 7as that term is defined in section #ccga of title #e72 7,b7 a ,state or political subdivision thereof2 or 7,c7 any agency1 authority1 or instrumentality of a ,state or political subdivision thereof4 7#d7 ,individual ,the term individual means a natural person residing in the ,united ,states4 7#e7 ,personal information 7,a7 ,in general ,the term personal information means any information maintained by a person that1 on its own or combined with other information1 is linked or reasonably linkable to a specific individual4 7,b7 ,exclusions ,the term personal information does not include-- 7i7 publicly available information linked to an individual2 or 7ii7 information derived or inferred from personal information1 if the derived or inferred information is not linked or reasonably linkable to a specific individual4 7#f7 ,publicly available information ,the term publicly available information-- 7,a7 means-- 7i7 information that is lawfully made available from a government entity2 7ii7 information linked to a public individual or official that is made publicly accessible1 without restrictions on accessibility other than the general authorization to access the services used to make the information accessible2 or 7iii7 information of an individual that-- 7,i7 is made publicly accessible by such individual1 without restrictions on accessibility other than the general authorization to access the services used to make the information accessible2 and 7,,ii7 such individual has the ability to delete or change2 and 7,b7 does not include-- 7i7 biometric information of an individual collected by a covered entity without the individual's knowledge2 7ii7 information used for a purpose that is not compatible with the purpose for which the information is maintained and made available in government records2 7iii7 information obtained from government records for the purpose of selling such information2 or 7iv7 information used to contact or locate a private individual either physically or electronically4 7#g7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each federally recognized ,indian ,tribe4 4 7b7 ,clerical amendment ,the table of sections for chapter #da of title #ah1 ,united ,states ,code1 is amended by inserting after the item relating to section #hhj the following3 #hha4 ,disclosing of personal information with the intent to cause harm4 4 ,i ,individual ,rights #aja4 ,right of access 7a7 ,in general ,a covered entity shall make available a reasonable mechanism by which an individual may access-- 7#a7 the categories of personal information and contents of communications of such individual that is maintained by such covered entity1 including1 in the case of personal information that such covered entity did not collect from such individual1 how and from whom such covered entity obtained such personal information2 7#b7 a list of the third parties1 subsidiaries1 and corporate affiliates1 to which such covered entity has disclosed and from which such covered entity has1 at any time on or after the effective date of this ,act1 obtained the personal information of such individual2 7#c7 a concise and clear description of the business or commercial purposes of such covered entity-- 7,a7 for collecting1 processing1 or maintaining the personal information of such individual2 and 7,b7 for disclosing to a third party the personal information of such individual2 and 7#d7 a list of automated decision-making processes that an individual has a right to request human review of under section #aje with a concise and clear description of the implications and intended effects of each such process4 7b7 ,exception for publicly accessible information ,a covered entity that makes available information required in subsection 7a7 shall be considered in compliance with such requirements if the covered entity provides an individual with instructions on how to access a public posting of such information1 including in a privacy policy1 if the instructions are easy and do not require payment4 7c7 ,small businesses excluded ,subsection 7a77#c7 does not apply to a small business4 #ajb4 ,right of correction 7a7 ,dispute by individual ,a covered entity shall make available a reasonable mechanism by which an individual may dispute the accuracy or completeness of personal information linked to such individual that is maintained by such covered entity if such information is processed in any way1 by such covered entity1 a third party of such covered entity1 or a service provider of such covered entity that may increase reasonably foreseeable significant privacy harms4 7b7 ,correction by covered entity ,a covered entity receiving a dispute under subsection 7a7 shall-- 7#a7 correct or complete 7as the case may be7 the disputed information and notify such individual that the correction or completion has been made2 or 7#b7 notify such individual that-- 7,a7 the disputed information is correct or complete2 7,b7 such covered entity lacks sufficient information to correct or complete the disputed information2 or 7,c7 such covered entity is denying the request for correction or completion in reliance on an exemption or exception provided by section #aji7;g74 7c7 ,small businesses excluded ,this section does not apply to a small business4 #ajc4 ,right of deletion 7a7 ,request by individual ,a covered entity shall make available a reasonable mechanism by which an individual may request the deletion of personal information and contents of communications of such individual maintained by such covered entity1 including any such information that such covered entity acquired from a third party or inferred from other information maintained by such covered entity4 7b7 ,deletion by covered entity ,a covered entity receiving a request for deletion under subsection 7a7 shall-- 7#a7 delete such information and notify such individual that such information has been deleted2 or 7#b7 notify such individual that such covered entity is denying the request for deletion in reliance on an exemption or exception provided by section #aji7;g74 #ajd4 ,right of portability 7a7 ,determination of portable categories 7#a7 ,annual determination ,not less frequently than once per calendar year1 the ,director shall-- 7,a7 establish categories of products and services offered by covered entities1 based on similarities in the products and services2 7,b7 determine which categories established under subparagraph 7,a7 are portable categories2 and 7,c7 publish in the ,federal ,register a list of portable categories determined under subparagraph 7,b74 7#b7 ,opportunity for public comment ,before publishing the final list under paragraph 7#a77;,c71 the ,director shall-- 7,a7 publish a draft of such list in the ,federal ,register2 and 7,b7 provide an opportunity for public comment on such draft list4 7b7 ,exercise of right 7#a7 ,in general ,a covered entity that offers a product or service in a portable category and that maintains personal information or the contents of any communications of an individual shall make available to such individual a reasonable mechanism by which such individual may-- 7,a7 download1 in a format that is structured1 commonly used1 and machine readable-- 7i7 any such personal information that such individual has provided to such covered entity1 with the option to download such information by category that is accessible under section #aja2 and 7ii7 the contents of any such communications2 and 7,b7 using a real-time application programming interface1 or similar mechanism1 transmit all such personal information 7whether or not provided to such covered entity by such individual7 and the contents of any such communication from such covered entity to another covered entity in accordance with subsection 7c74 7#b7 ,requirements for application programming interface ,the application programming interface1 or similar mechanism1 required by paragraph 7#a77;,b7 shall-- 7,a7 be publicly documented2 7,b7 allow the option of obtaining any personal information of an individual that the individual has provided to the covered entity1 if such information is accessible under section #aja2 7,c7 include a publicly available1 fully functional test version for development purposes2 and 7,d7 be of similar quality to mechanisms used internally by the covered entity4 7c7 ,requirements for access to an application programming interface 7#a7 ,access ,except as provided in paragraph 7#b77;,a71 a covered entity shall provide access to the application programming interface or similar mechanism required by subsection 7b77#a77;,b7 upon the request of another covered entity if the requesting covered entity has self-certified1 using the procedures established by the ,director under paragraph 7#c77;,a71 that such requesting covered entity-- 7,a7 is a covered entity2 7,b7 can have personal information disclosed to it under section #bjd2 7,c7 is1 at the time of the self-certification1 in compliance with all applicable requirements of this ,act 7including provisions a small business is otherwise exempt from complying with72 7,d7 will continue to comply with all requirements of this ,act2 and 7,e7 will only use such application programming interface or similar mechanism at the express request of an individual4 7#b7 ,denial of access 7,a7 ,in general ,a covered entity may deny access to the application programming interface or similar mechanism required by subsection 7b77#a77;,b7 if such covered entity has an objective1 reasonable belief that the requesting covered entity has failed to meet the requirements for self-certification under paragraph 7#a74 7,b7 ,review ,in accordance with the procedures established under paragraph 7#c77;,b71 a covered entity the request of which is denied under subparagraph 7,a7 may petition the ,director for review of the denial4 ,if the ,director finds that such denial is unreasonable1 the ,director shall impose a penalty1 to be established in such procedures1 on the covered entity that denied the request4 7#c7 ,certification and review procedures ,the ,director shall establish-- 7,a7 procedures for a covered entity to self-certify under paragraph 7#a72 and 7,b7 procedures for the review of petitions under paragraph 7#b77;,b71 including penalties for unreasonable denials4 7d7 ,small businesses excluded ,this section does not apply to a small business4 7e7 ,portable category defined ,in this section1 the term portable category means a category of products and services established by the ,director under subsection 7a77#a77;,a7-- 7#a7 for which the sum obtained by adding the number of users or estimated users of each product or service in such category is greater than #aj1jjj1jjj2 and 7#b7 that-- 7,a7 has an estimated ,herfindahl-,hirschman ,index of #b1jjj or greater2 7,b7 has #c or fewer covered entities offering products and services in such category2 or 7,c7 the ,director otherwise determines that a category would benefit from encouraging increased competition4 #aje4 ,right to human review of automated decisions ,for any decision by a covered entity based solely on automated processing of personal information of an individual1 if such processing materially increases reasonably foreseeable significant privacy harms for such individual1 such covered entity shall-- 7#a7 inform such individual of what personal information is being or may be used for such decision2 7#b7 make available a reasonable mechanism by which such individual may request human review of such decision1 upon request or in a publicly accessible location2 and 7#c7 if such individual requests such a review1 conduct such review within a reasonable amount of time after such request4 #ajf4 ,right to individual autonomy 7a7 ,in general ,a covered entity may not1 without the affirmative express consent of an individual1 collect1 process1 maintain1 or disclose the personal information of the individual to create1 improve upon1 maintain1 process1 or otherwise link the individual with an algorithm1 model1 or other means designed for behavioral personalization4 7b7 ,consent 7#a7 ,consent required ,a covered entity shall obtain express affirmative consent from an individual before the entity provides a behaviorally personalized version of a product or service1 and not less than every calendar year thereafter4 7#b7 ,denial of consent ,for a case in which consent is denied1 the covered entity shall provide the product or service without behavioral personalization1 except as provided in subsection 7c74 7c7 ,exceptions to providing product or service 7#a7 ,infeasibility ,for a case in which the offering of a substantially similar product or service without behavioral personalization is infeasible1 a covered entity shall provide1 to the greatest extent feasible1 a core aspect or part of the product or service that can be offered without behavioral personalization4 7#b7 ,denial for inability to function ,for a case in which a core aspect or part of the product or service is not able to function in a substantially similar function without behavioral personalization1 a covered entity may deny providing an individual use of such product or service if such individual does not consent to behavioral personalization as required in subsection 7a74 7d7 ,exception to behavioral processing ,notwithstanding subsections 7a7 and 7b71 a covered entity may process personal information to create or operate behavioral personalization algorithms1 models1 or other mechanisms for the purpose of increasing the usability of the product or service provided by a covered entity that-- 7#a7 are built using aggregated personal information that is representative of all the personal information the covered entity maintains2 and 7#b7 have an output that is both uniform across the individuals that use the product or service and independent of a specific individual's inherent or behavioral characteristics4 7e7 ,usability ,the term usability as used in subsection 7d7 does not include optimizations or other alterations to the product or service that are made with the primary purpose of increasing the amount of time an individual engages with or uses the product or service1 unless such increase benefits the individual4 7f7 ,small businesses excluded ,this section does not apply to a small business4 #ajg4 ,right to be informed ,a covered entity that collects personal information of an individual with whom such covered entity does not have an existing relationship 7as of the time of the collecting71 if such personal information includes contact information1 shall notify such individual within #cj days after receipt of such information1 in writing if possible and at no charge to the individual1 that such covered entity has collected the personal information of such individual4 #ajh4 ,right to impermanence 7a7 ,limitation on maintaining of personal information ,a covered entity may not maintain personal information for more time than expressly consented to by an individual whose personal information is being maintained4 7b7 ,consent ,a covered entity shall obtain express affirmative consent from an individual before maintaining the personal information of such individual for any duration4 ,such consent may be obtained for categories of personal information and shall give an individual options to affirmatively choose granting a covered entity consent for various durations1 at least including-- 7#a7 for no longer than needed to complete the specific request or transaction 7including a reasonable estimate of such duration by the covered entity72 7#b7 until consent is revoked2 and 7#c7 one or more additional durations based on reasonable expectations and norms for maintaining the category of personal information4 7c7 ,exception for implied consent ,where the long-term maintaining of personal information is1 on its face1 obvious and a core feature of the product or service at the request of the individual1 and the personal information is maintained only to provide such product or service1 subsections 7a7 and 7b7 shall not apply4 #aji4 ,additional rights and exceptions 7a7 ,in general ,the ,director may1 by rule and subject to notice and comment1 establish procedural requirements and narrowly tailored exceptions governing the exercise of rights under this title1 limited to the following3 7#a7 ,identity verification and authentication procedures4 7#b7 ,standardized formats and reasonable mechanisms for submitting and fulfilling requests4 7#c7 ,reasonable limits to prevent fraud1 abuse1 or excessive and duplicative requests4 7#d7 ,timelines and recordkeeping requirements consistent with this title4 7#e7 ,narrowly tailored exceptions necessary to prevent a legitimate risk to the privacy1 security1 or safety of another individual1 or to protect free expression1 consistent with section #aaj7;b74 7b7 ,limitations ,the ,director may not create any new substantive right or broadly waive compliance with this title4 #aaj4 ,exemptions1 exceptions1 fees1 timelines1 and rules of construction for rights under this title 7a7 ,exemptions for personal information for particular purposes 7#a7 ,in general ,this title does not apply with respect to personal information that is collected1 processed1 maintained1 or disclosed for any of the following purposes 7or a combination of such purposes71 where a covered entity has technical safeguards and business processes that limit collecting1 processing1 maintaining1 or disclosing of such personal information to the following purposes3 7,a7 ,detecting1 responding to1 or preventing security incidents or threats4 7,b7 ,protecting against malicious1 deceptive1 fraudulent1 or illegal activity4 7,c7 ,a good faith response to1 or compliance with1 a valid subpoena1 court order1 or warrant 7including a subpoena and court order obtained by an entity that is not a government entity7 or otherwise providing information as required by law4 7,d7 ,protecting a legally recognized privilege or other legal right4 7,e7 ,protecting public safety4 7,f7 ,collecting1 processing1 or maintaining by an employer pursuant to an employer-employee relationship of records about employees or employment status1 except-- 7i7 where the information would not be reasonably expected to be collected in the context of an employee's regular duties2 or 7ii7 was disclosed to the employer by a third party4 7,g7 ,preventing prospective abuses of a service by an individual whose account has been previously terminated4 7,h7 ,routing a communication through a communications network or resolving the location of a host or client on a communications network4 7,i7 ,providing transparency in advertising or origination of user-generated content4 7#b7 ,re-identification ,where compliance with this title would require the re-identification of de-identified personal information1 and the covered entity does not already maintain the information necessary for such re-identification1 the covered entity shall be exempt from such compliance1 except for requirements under section #ajf4 7#c7 ,disclosing ,a covered entity relying on an exemption under paragraph 7#a7 with respect to personal information shall disclose in the privacy policy maintained by such entity under section #baa-- 7,a7 the reason for which such information is collected1 processed1 maintained1 or disclosed2 and 7,b7 a description of the rights provided by this title that are not available with respect to such personal information by reason of such exemption4 7b7 ,exceptions for particular requests 7#a7 ,in general ,a covered entity may deny the request of an individual under this title if-- 7,a7 such covered entity cannot confirm the identity of such individual2 7,b7 such covered entity determines that granting the request of such individual would create a legitimate risk to the privacy1 security1 safety1 or other rights of another individual2 7,c7 such covered entity determines that granting the request of such individual would create a legitimate risk to free expression2 or 7,d7 the personal information requested to be corrected under section #ajb or deleted under section #ajc-- 7i7 is necessary to the completion of a transaction initiated before such request was made or the performance of a contract entered into before such request was made2 7ii7 was collected specifically for the completion of such transaction or the performance of such contract2 and 7iii7 would undermine the integrity of a legally significant transaction4 7#b7 ,limitations on requests for additional information to confirm identity ,a covered entity may not deny a request of an individual under paragraph 7#a77;,a7 on the basis of the refusal of such individual to provide additional personal information to such covered entity to confirm the identity of such individual-- 7,a7 if the identity of such individual can reasonably be confirmed using personal information of such individual that such covered entity 7as of the time of the request7 already maintains2 or 7,b7 if such individual has an existing relationship 7as of the time of the request7 with such covered entity1 such individual has confirmed the identity of such individual to such covered entity in the same manner as for other transactions of a similar sensitivity4 7c7 ,exemption for service providers ,this title does not apply to a service provider4 7d7 ,exemption for privacy-,preserving computing ,except for sections #aja1 #aje1 and #ajf1 this title does not apply to personal information secured using privacy-preserving computing4 7e7 ,timeline for complying with a request ,without undue delay but not longer than #cj days after the request1 a covered entity that receives a request under this title must-- 7#a7 comply with such request2 or 7#b7 inform such individual of the reason for denying such request1 as allowed under subsection 7a7 or 7b74 7f7 ,fees prohibited 7#a7 ,in general ,except as provided in paragraph 7#b71 a covered entity may not charge a fee to an individual for a request made under this title4 7#b7 ,unfounded or excessive requests ,if a request under this title is unfounded or excessive1 a covered entity may charge a reasonable fee that reflects the estimated administrative costs of complying with such request4 7#c7 ,agency notice ,if a covered entity plans to charge a fee under paragraph 7#b71 it must notify the ,digital ,privacy ,agency at least #g days before charging such fee4 7#d7 ,agency review ,the ,director may reject any fee that a covered entity plans to charge for a request made under this title if the ,director finds-- 7,a7 such fee to be unreasonable relative to reasonable administrative costs of complying with a request under this title2 or 7,b7 such request is not unfounded or excessive4 7g7 ,rules of construction ,nothing in this title shall be construed to require a covered entity to-- 7#a7 take an action that would convert information that is not personal information into personal information2 7#b7 collect or maintain personal information or contents of communication that the covered entity would otherwise not maintain 7including a record of an individual exercising rights under this title72 or 7#c7 maintain personal information or contents of communication longer than the covered entity would otherwise maintain such personal information4 ,,ii ,requirements for ,covered ,entities1 ,service ,providers1 and ,third ,parties #bja4 ,minimization 7a7 ,articulated basis ,a covered entity shall have a reasonable1 articulated basis for collecting1 processing1 maintaining1 and disclosing of personal information that takes into account the reasonable business needs of the covered entity and minimum amount of personal information necessary for providing the service1 balanced with the intrusion on the privacy of1 potential privacy harms to1 and reasonable expectations of individuals to whom the personal information relates4 7b7 ,minimization of collecting1 processing1 maintaining1 and disclosing 7#a7 ,collecting ,a covered entity may not collect more personal information than is reasonably needed to provide a product or service that an individual has requested4 7#b7 ,processing ,a covered entity may not process personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider1 a purpose other than that which is in accordance with the directions of a covered entity4 7#c7 ,maintaining ,a covered entity may not maintain personal information once such information is no longer needed for the purpose for which such information was originally collected from the individual or in the case of a service provider1 a purpose other than that which is in accordance with the directions of a covered entity4 7#d7 ,disclosing ,a covered entity may not disclose personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider1 a purpose other than that which is in accordance with the directions of a covered entity4 7c7 ,ancillary collecting1 processing1 maintaining1 and disclosing ,notwithstanding subsection 7b71 a covered entity may collect1 process1 disclose1 or maintain personal information beyond limitations under subsection 7b7 only if such covered entity complies with this subsection4 7#a7 ,no notice or consent required ,a covered entity may collect1 process1 or maintain personal information without additional notice or consent if the purpose for such collecting1 processing1 or maintaining is substantially similar to the type of personal information and purpose for which such personal information was originally collected and such ancillary collecting1 processing1 or maintaining will not result in additional or increased privacy harms4 7#b7 ,notice required ,a covered entity shall provide notice of ancillary collecting1 processing1 maintaining1 or disclosing of personal information in the case of one1 but not more than one1 of the following instances3 7,a7 ,such ancillary collecting1 processing1 maintaining1 or disclosing may result in additional or increased privacy harms 7but not increased significant privacy harms71 and is substantially similar to the purpose for which such personal information was originally collected4 7,b7 ,such ancillary collecting1 processing1 maintaining1 or disclosing is not substantially similar to the purpose for which such personal information was originally collected1 but will not result in additional or increased privacy harms4 7,c7 ,such ancillary collecting1 processing1 maintaining1 or disclosing may result in additional or increased privacy harms 7but not increased significant privacy harms71 and the purpose is not substantially similar to the purpose for which such personal information was originally collected1 so long as the personal information is secured using privacy-preserving computing4 7#c7 ,notice and consent required ,for scenarios not covered under paragraph 7#a7 or 7#b71 and notwithstanding sections #bjh7;b77#b7 and 7#c71 a covered entity shall provide notice of and obtain consent for ancillary collecting1 processing1 maintaining1 or disclosing of personal information4 7d7 ,substitution ,in cases in which personal information can be replaced with artificial personal information1 personal information that has been de-identified1 or the random personal information of one or more individuals without substantially reducing the utility of the data or requiring an unreasonable amount of effort1 such a replacement shall take place4 #bjb4 ,minimization and records of access by employees and contractors 7a7 ,minimization ,a covered entity shall restrict access to personal information and contents of communications by the employees or contractors of such covered entity based on an articulated balance between the potential for privacy harm1 reasonable expectations of individuals to whom the personal information relates1 and reasonable business needs4 7b7 ,records of access 7#a7 ,in general ,a covered entity shall maintain records identifying each instance in which an employee or a contractor of such covered entity accesses personal information or contents of communications if disclosing such personal information or contents of communication1 or a data breach or data-sharing abuse involving such personal information or contents of communication1 may foreseeably result in increased privacy harms4 7#b7 ,information required ,the records required by paragraph 7#a7 shall include the following3 7,a7 ,a unique identifier for the employee or contractor accessing personal information or contents of communications4 7,b7 ,the date and time of access4 7,c7 ,the fields of information accessed4 7,d7 ,the individuals whose personal information was accessed or the contents of whose communications were accessed4 7#c7 ,small businesses excluded ,this subsection does not apply to a small business4 #bjc4 ,prohibitions on disclosing of personal information 7a7 ,consent for disclosing required 7#a7 ,in general ,a covered entity may not intentionally disclose personal information unless the covered entity obtains consent of the individual whose personal information is being disclosed for each category of third party to which such personal information will be disclosed4 ,such covered entity must also provide such individual with notice of-- 7,a7 each category of third party2 7,b7 the personal information to be disclosed2 and 7,c7 a concise and clear description of the business or commercial purpose for disclosing such personal information4 7#b7 ,additional requirements for sale of personal information 7,a7 ,in general ,a covered entity may not intentionally sell personal information unless the covered entity-- 7i7 obtains the consent required by paragraph 7#a7 for disclosing such personal information2 and 7ii7 provides the individual to whom such personal information relates with the identity of the specific third party to which such personal information will be disclosed4 7,b7 ,disclosing services ,subparagraph 7,a7 shall not apply to a covered entity in a case in which an individual is directing the covered entity to disclose the personal information of such individual for the sole purpose of procuring goods or services1 or offers for goods or services1 for such individual1 if there is a reasonable mechanism for the individual to withdraw consent4 7#c7 ,requirement to include original purpose of collecting ,a covered entity may not intentionally disclose personal information without including the purpose for which the personal information was originally collected4 7#d7 ,exception for privacy-preserving computing ,notwithstanding paragraph 7#a71 consent is not required for disclosing 7not including selling7 personal information secured using privacy-preserving computing4 7#e7 ,exception for de-identified personal information ,notwithstanding paragraph 7#a71 consent is not required for disclosing 7not including selling7 de-identified personal information where the disclosed personal information is limited to the narrowest possible scope likely to yield the intended benefit and contractual obligations are in place that prohibit-- 7,a7 re-identification of the disclosed personal information2 and 7,b7 the processing of additional personal information in combination with the disclosed personal information that would allow for the re-identification of the disclosed personal information4 7b7 ,disclosing for advertising or marketing purposes 7#a7 ,in general ,a covered entity may not intentionally disclose for advertising or marketing purposes a unique identifier or any other personal information that would allow information disclosed to be linked to information relating to the same individual or device disclosed in the past4 7#b7 ,treatment of certain types of information ,disclosing personal information or contents of communication for advertising or marketing purposes may not be treated as violating paragraph 7#a7 by reason of including any or all of the following3 7,a7 ,internet ,protocol addresses truncated to no more than the first #bd bits for ,internet ,protocol version #d and the first #dh bits for ,internet ,protocol version #f1 or for a successor protocol truncated to limit the precision of the identifier to a network address of the internet access provider4 7,b7 ,geolocation information truncated to allow no more than the equivalent of two decimal degrees of precision at the equator or prime meridian1 or an equivalent precision in another geolocation standard4 7,c7 ,a general description of a device1 browser1 or operating system1 or any combination thereof4 7,d7 ,an identifier that is unique to a disclosure4 #bjd4 ,disclosing to entities not subject to ,united ,states jurisdiction or not compliant with this ,act 7a7 ,prohibition ,a covered entity may not intentionally disclose personal information to any entity that-- 7#a7 is not subject to the jurisdiction of the ,united ,states2 or 7#b7 is not in compliance with all requirements of this ,act4 7b7 ,exception ,notwithstanding subsection 7a71 a covered entity may disclose personal information where that personal information is limited to an identifier created primarily for the purpose of sending or receiving electronic communications and the sole purpose of disclosing is to send or receive an electronic communication at the request of the individual whose personal information is being disclosed4 7c7 ,safe harbors for disclosing ,notwithstanding subsection 7a71 a covered entity may disclose personal information to another covered entity 7the receiving covered entity7 that is not subject to the jurisdiction of the ,united ,states if either-- 7#a7 the receiving covered entity has entered into an agreement1 as described in subsection 7e71 with the ,digital ,privacy ,agency1 and-- 7,a7 the covered entity has a reasonable belief that the receiving covered entity is sufficiently solvent to compensate victims or pay fines for violations of this ,act2 7,b7 a contract between the covered entity and receiving covered entity requires that the receiving covered entity complies with this ,act1 and the covered entity has reason to believe the receiving covered entity is compliant with this ,act2 and 7,c7 a contract between the covered entity and the receiving covered entity prohibits the receiving covered entity from using the disclosed personal information for any purpose other than provided in the contract2 or 7#b7 the covered entity has-- 7,a7 entered into an agreement with the receiving covered entity that-- 7i7 requires the receiving covered entity to comply with this ,act2 7ii7 prohibits the receiving covered entity from using the disclosed personal information for any purpose other than provided in the contract2 7iii7 requires the receiving covered entity to indemnify the covered entity against violations of this ,act committed by the receiving covered entity for any amount the covered entity is unable to pay of a judgment for such violation2 7iv7 grants the covered entity the authority to audit1 including physical access to electronic devices and data1 the receiving covered entity's compliance with this ,act and the contract2 and 7v7 requires the receiving covered entity to assist the covered entity in responding to and complying with any court orders1 ,digital ,privacy ,agency orders1 or the exercising of an individual's rights under this ,act2 7,b7 actual knowledge that the receiving covered entity is in compliance with this ,act and not using personal information contrary to their agreement2 7,c7 actual knowledge that the receiving covered entity is sufficiently solvent to compensate victims or pay fines for violations of this ,act2 7,d7 an auditing and compliance program to ensure the receiving covered entity's continued compliance with this ,act and contract terms2 7,e7 filed with the ,digital ,privacy ,agency the terms of said contract1 proof of its actual knowledge of the receiving covered entity's compliance with this ,act and contract terms1 and documents detailing its auditing and compliance program for approval and publication by the ,digital ,privacy ,agency2 and 7,f7 entered into an agreement with the ,digital ,privacy ,agency where the covered entity agrees to accept1 respond to1 or comply with a court order1 ,digital ,privacy ,agency order1 or request by an individual regarding actions taken by the receiving covered entity with respect to covered information it has disclosed4 7d7 ,liability for violation by receiving covered entity2 failure ,to report ,for the purposes of subsection 7c77#b71 the covered entity shall be jointly liable for a violation of this ,act by the receiving covered entity regarding the personal information the covered entity disclosed1 except where the covered entity was the first to notify the ,digital ,privacy ,agency of the violation1 in which case1 it shall be severally liable4 ,where the covered entity should reasonably have known of a violation of this ,act by the receiving covered entity and fails to disclose the violation to the ,digital ,privacy ,agency1 each day of continuance of the failure to report such violation shall be treated as a separate violation4 7e7 ,agency agreements ,upon the request of a covered entity not subject to the jurisdiction of the ,united ,states1 the ,digital ,privacy ,agency shall enter into an agreement with the covered entity that includes1 but is not limited to1 the following conditions3 7#a7 ,the principal place of business for the covered entity must be in a country that allows for the domestication of a ,united ,states court decision for civil fines payable to a government entity and injunctive relief4 ,where a foreign court refuses to enforce a ,united ,states court decision under this ,act1 the agreement1 and all other agreements with covered entities with a principal place of business in the same jurisdiction1 shall be void4 7#b7 ,the covered entity agrees to comply with this ,act4 7#c7 ,the covered entity agrees to be subject to this ,act with choice of venue being a ,united ,states court4 7#d7 ,the covered entity agrees to comply with ,digital ,privacy ,agency investigative requests or orders1 and ,united ,states court orders or decisions under this ,act4 7#e7 ,the covered entity consents to ,united ,states ,federal court personal jurisdiction for the sole purpose of enforcing this ,act4 7#f7 ,where enforcement of the decision requires the use of a foreign court1 the covered entity agrees to pay reasonable attorney fees necessary to enforce the judgment4 7#g7 ,a default judgment1 failure to comply with ,digital ,privacy ,agency investigative requests or orders1 or failure to comply with ,united ,states court orders or decisions shall result in the immediate termination of the agreement4 7f7 ,rule of construction against data localization ,nothing in this section shall be construed to require the localization of processing or maintaining personal information by a covered entity to within the ,united ,states1 or limit internal disclosing of personal information within a covered entity or to subsidiary or corporate affiliate of such covered entity1 regardless of the country in which the covered entity will process1 disclose1 or maintain that personal information4 #bje4 ,prohibition on re-identification 7a7 ,in general ,except as required under title ,i1 a covered entity shall not use personal information collected from an individual1 acquired from a third party1 or acquired from publicly available information to re-identify an individual from de-identified information4 7b7 ,third-,party prohibition ,a covered entity that discloses de-identified information to a third party shall prohibit such third party from re-identifying an individual using such de-identified information4 7c7 ,exception ,subsection 7a7 shall not apply to qualified research entities1 as determined by the ,director1 conducting research not for commercial purposes4 #bjf4 ,restrictions on collecting1 processing1 maintaining1 and disclosing contents of communications 7a7 ,in general ,a covered entity may not collect1 process1 maintain1 or disclose the contents of any communication1 regardless of whether the sender or intended recipient of the communication is an individual1 other person1 or an electronic device1 for any purpose other than-- 7#a7 transmitting or displaying the communication to any intended recipient or the original sender1 or maintaining such communications for such purposes2 7#b7 detecting1 responding to1 or preventing security incidents or threats2 7#c7 providing services to assist in the drafting or creation of the content of a communication2 7#d7 processing expressly requested by the sender or intended recipient1 if the sender or intended recipient can terminate such processing using a reasonable mechanism2 7#e7 disclosing otherwise required by law2 7#f7 filtering a communication where the primary purpose of the communication is the commercial advertisement or promotion of a commercial product or service of a covered entity2 or 7#g7 detecting or enforcing an abuse or violation of the terms of service of the covered entity that would result in either a temporary or permanent ban from using the service4 7b7 ,intended recipient ,a covered entity is not considered an intended recipient of a communication1 or any communication used in the creation of the content of said communication1 where-- 7#a7 at least one intended recipient is a natural person other than an employee or contractor of the covered entity2 7#b7 at least one intended recipient is a person other than the covered entity2 or 7#c7 a purpose of the covered entity's service is to maintain1 at the direction of the sender1 the content of said communication for more than a transitory period4 7c7 ,sender ,the sender of a communication is the person for whom the communication1 and its content1 is disclosed at the direction of and on behalf of4 7#a7 ,where the sender is a natural person1 they shall be the sender of the entire content of the communication1 regardless of the original author of any portion of the content4 7#b7 ,otherwise1 a sender shall be the sender of only the content it was an original author of1 or content it received as an intended recipient4 7d7 ,exception for publicly available communications ,subsection 7a7 shall not apply where the contents of communication are made publicly accessible by the sender without restrictions on accessibility other than the general authorization to access the services used to make the information accessible4 7e7 ,encryption protection ,a covered entity shall not-- 7#a7 prohibit or prevent a person from encrypting or otherwise rendering unintelligible the content of a communication using a means that prevents the covered entity from being able to decrypt or otherwise render intelligible said content2 and 7#b7 require or cause a person to disclose or circumvent the means described in paragraph 7#a7 to the covered entity that would allow it to render the content intelligible4 7f7 ,service providers safe harbor ,a service provider shall not be held liable for a violation of this section if such service provider is acting at the direction of and on behalf of a covered entity and has a reasonable belief that the covered entity's directions are in compliance with this section4 #bjg4 ,prohibition on discriminatory processing 7a7 ,discrimination in economic opportunities ,a covered entity may not process personal information or contents of communication for advertising1 marketing1 soliciting1 offering1 selling1 leasing1 licensing1 renting1 or otherwise commercially contracting for employment1 finance1 health care1 credit1 insurance1 housing1 or education opportunities in a manner that discriminates against or otherwise makes opportunities unavailable on the basis of the protected class status of an individual4 7b7 ,public accommodations ,a covered entity may not process personal information in a manner that segregates1 discriminates in1 or otherwise makes unavailable the goods1 services1 facilities1 privileges1 advantages1 or accommodations of any place of public accommodation on the basis of the protected class status of an individual or a group of individuals4 7c7 ,disparate impact authority ,not later than #f months after the date of the enactment of this ,act1 the ,director shall issue additional requirements related to a disparate impact standard that-- 7#a7 describes other circumstances in which an individual or group of individuals may be harmed by an action of a covered entity through the processing of personal information or contents of communication of the protected class status of that individual in a manner not described in subsection 7a7 or 7b72 7#b7 prohibits such action2 and 7#c7 provides for enforcement under this ,act or through regulation4 7d7 ,regulations ,not later than one year after the date of the enactment of this ,act1 the ,director shall promulgate regulations to implement this section and may define any term used under this section1 including discriminates against and otherwise makes opportunities unavailable4 #bjh4 ,requirements for notice and consent processes and privacy policies 7a7 ,minimum threshold ,the ,director shall establish minimum thresholds that covered entities must meet for the percentage of individuals who understand a notice or consent process or privacy policy required by this ,act4 ,in establishing such minimum thresholds1 the ,director shall-- 7#a7 vary required thresholds on types and scale of reasonably foreseeable privacy harms2 and 7#b7 take into account expectations of individuals1 potential privacy harms1 and individuals' awareness of privacy harms4 7b7 ,consent revocation ,a covered entity shall make available a reasonable mechanism by which an individual may revoke consent for any consent given under this ,act4 7c7 ,safe harbor 7#a7 ,approval procedures ,the ,director shall develop procedures for analyzing and approving data submitted by a covered entity to establish that a notice and consent process or privacy policy of such covered entity meets the threshold established under subsection 7a74 7#b7 ,presumption ,if a covered entity submits testing data to and receives an approval from the ,director under paragraph 7#a7 establishing that a notice or consent process or privacy policy of such covered entity meets the threshold established under subsection 7a71 such notice or consent process or privacy policy shall be presumed to have met such threshold4 ,such presumption may be rebutted by clear and convincing evidence4 7#c7 ,public availability of ,approved processes and policies and associated testing data ,the ,director shall make publicly available online the notice and consent processes and privacy policies and associated testing data that the ,director approves under paragraph 7#a74 7#d7 ,small business adoption of notice or consent process of another covered entity 7,a7 ,in general ,if a small business adopts a notice or consent process of another covered entity that collects1 processes1 maintains1 or discloses personal information in substantially the same way as such small business1 if the process of such other covered entity has been approved under paragraph 7#a71 the process of such small business shall receive the presumption under paragraph 7#b74 7,b7 ,ability to freely use ,approved process ,a covered entity whose notice or consent process is approved under paragraph 7#a7 shall permit a small business to freely use such process1 or a derivative thereof1 as described in subparagraph 7,a74 7,c7 ,no published process ,in the case of a small business for which there is no approved notice or consent process published under paragraph 7#c7 of a covered entity that collects1 processes1 maintains1 or discloses personal information in substantially the same way as such small business1 any requirement under this title for a notice or consent process to be objectively shown to meet the threshold established by the ,director under subsection 7a7 shall not apply to such small business4 ,nothing in the preceding sentence exempts a small business from the requirement to use such notice or consent process or that such process be concise and clear4 7,d7 ,inapplicability to privacy policy ,paragraph 7#d7 does not apply with respect to a privacy policy4 7#e7 ,minor changes ,a covered entity may make minor changes in a notice or consent process or privacy policy approved under paragraph 7#a7 and retain the presumption under paragraph 7#b7 for such process or policy without retesting or resubmission of testing data to the ,director4 #bji4 ,prohibition on dark patterns in notice and consent processes and privacy policies ,in providing notice1 obtaining consent1 or maintaining a privacy policy as required by this title1 a covered entity may not intentionally take any action that substantially impairs1 obscures1 or subverts the ability of an individual to-- 7#a7 understand the contents of such notice or such privacy policy2 7#b7 understand the process for granting such consent2 7#c7 make a decision regarding whether to grant or withdraw such consent2 or 7#d7 act on any such decision4 #baj4 ,notice and consent required 7a7 ,notice ,a covered entity shall provide an individual with notice of the personal information such covered entity collects1 processes1 maintains1 and discloses through a process that is concise and clear and can be objectively shown to meet the threshold established by the ,director under section #bjh7;a74 7b7 ,consent 7#a7 ,express consent required ,except as provided in paragraphs 7#b7 and 7#c71 a covered entity may not collect from an individual personal information that creates or increases the risk of foreseeable privacy harms1 or process or maintain any such personal information collected from an individual1 unless such entity obtains the express consent of such individual to the collecting1 processing1 or maintaining 7or any combination thereof7 of such information through a process that is concise and clear and can be objectively shown to meet the threshold established by the ,director under section #bjh7;a74 7#b7 ,exception for implied consent ,notwithstanding paragraph 7#a71 express consent is not required for collecting1 processing1 or maintaining personal information if the collecting1 processing1 or maintaining is1 on its face1 obvious and necessary to provide a service at the request of the individual and the personal information is collected1 processed1 or maintained only for such request4 ,nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection 7a7 to provide notice to such individual with respect to such collecting1 processing1 or maintaining4 7#c7 ,exemption for privacy-preserving computing ,notwithstanding paragraph 7#a71 except with regard to consent for purposes of section #ajf1 express consent is not required for collecting1 processing1 or maintaining personal information secured using privacy-preserving computing4 ,nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection 7a7 to provide notice to such individual with respect to such collecting1 processing1 or maintaining4 7c7 ,service providers excluded ,this section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes1 maintains1 or discloses personal information is in compliance with this section4 #baa4 ,privacy policy 7a7 ,policy required ,a covered entity shall maintain a privacy policy relating to the practices of such entity regarding the collecting1 processing1 maintaining1 and disclosing of personal information4 7b7 ,contents ,the privacy policy required by subsection 7a7 shall contain the following3 7#a7 ,a general description of the practices of the covered entity regarding the collecting1 processing1 maintaining1 and disclosing of personal information4 7#b7 ,a description of how individuals may exercise the rights provided by title ,i4 7#c7 ,a clear and concise summary of the following3 7,a7 ,the categories of personal information collected or otherwise obtained by the covered entity4 7,b7 ,the business or commercial purposes of the covered entity for collecting1 processing1 maintaining1 or disclosing personal information4 7,c7 ,the categories and a list of third parties to which the covered entity discloses personal information4 7#d7 ,a description of the personal information that the covered entity maintains that the covered entity does not collect from individuals and how the covered entity obtains such personal information4 7#e7 ,a list of the third parties to which the covered entity has disclosed personal information4 7#f7 ,a list of the third parties from which the covered entity has obtained personal information at any time on or after the effective date of this ,act4 7#g7 ,the articulated basis for the collecting1 processing1 disclosing1 and maintaining of personal information1 as required under section #bja7;a74 7c7 ,exemption for personal information for particular purposes ,the privacy policy required by subsection 7a7 is not required to contain information relating to personal information that is collected1 processed1 maintained1 or disclosed exclusively for any of the purposes described in paragraph 7#a7 of section #aji7;a7 7or a combination of such purposes71 except as provided in paragraph 7#b7 of such section4 7d7 ,availability of privacy policy 7#a7 ,form and manner ,the privacy policy required by subsection 7a7 shall be-- 7,a7 clear and in plain language2 and 7,b7 made publicly available in a prominent location on an ongoing basis4 7#b7 ,timing ,the privacy policy required by subsection 7a7 shall be made available as required by paragraph 7#a7 before the covered entity collects personal information after the effective date of this ,act4 7e7 ,small businesses excluded ,subsections 7b77#g7 and 7d7 do not apply to a small business4 7f7 ,service providers excluded ,this section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes1 maintains1 or discloses personal information is in compliance with this section4 #bab4 ,information security requirements 7a7 ,in general ,a covered entity shall establish and implement reasonable information security policies1 practices1 and procedures for the protection of personal information collected1 processed1 maintained1 or disclosed by such covered entity1 taking into consideration-- 7#a7 the nature1 scope1 and complexity of the activities engaged in by such covered entity2 7#b7 the sensitivity of any personal information at issue2 7#c7 the current state of the art in administrative1 technical1 and physical safeguards for protecting such information2 and 7#d7 the cost of implementing such administrative1 technical1 and physical safeguards4 7b7 ,specific policies1 practices1 and procedures ,the policies1 practices1 and procedures required by subsection 7a7 shall include the following3 7#a7 ,a written security policy with respect to collecting1 processing1 maintaining1 and disclosing of personal information4 ,such policy shall be made publicly available in a prominent location on an ongoing basis1 except that the publicly available version is not required to contain information that would compromise a purpose described in section #aji7;a77#a74 7#b7 ,a process for identifying and assessing reasonably foreseeable security vulnerabilities in the system or systems used by such covered entity that contain personal information1 which shall include regular monitoring for vulnerabilities or data breaches involving such system or systems4 7#c7 ,a process for taking action designed to mitigate against vulnerabilities identified in the process required by paragraph 7#b71 which may include implementing any changes to security practices and the architecture1 installation1 or implementation of network or operating software1 or for regularly testing or otherwise monitoring the effectiveness of the existing safeguards4 7#d7 ,a process for determining if personal information is no longer needed and disposing of personal information by shredding1 permanently erasing1 or otherwise modifying the medium on which such personal information is maintained to make such personal information permanently unreadable or indecipherable4 7#e7 ,a process for overseeing persons who have access to personal information1 including through network-connected devices4 7#f7 ,a process for employee training and supervision for implementation of the policies1 practices1 and procedures required by this section4 7#g7 ,a written plan or protocol for internal and public response in the event of a data breach or data-sharing abuse4 7c7 ,regulations ,the ,director1 in consultation with the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,institute of ,standards and ,technology1 shall promulgate regulations to implement this section4 7d7 ,small businesses assistance ,the ,director1 in consultation with the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,institute of ,standards and ,technology1 the ,small ,business ,administration1 the ,minority ,business ,development ,agency1 and small businesses1 shall develop policy templates1 toolkits1 tip sheets1 configuration guidelines for commonly used hardware and software1 interactive tools1 and other materials to assist small businesses with complying with this section4 #bac4 ,notification of data breach or data-sharing abuse 7a7 ,notification of agency 7#a7 ,in general ,in the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity1 such covered entity shall1 without undue delay and1 if feasible1 not later than #gb hours after becoming aware of such data breach or data-sharing abuse1 notify the ,director of such data breach or data-sharing abuse1 unless such data breach or data-sharing abuse is unlikely to create or increase foreseeable privacy harms4 7#b7 ,reasons for delay ,if the notification required by paragraph 7#a7 is made more than #gb hours after the covered entity becomes aware of the data breach or data-sharing abuse1 such notification shall be accompanied by a statement of the reasons for the delay4 7b7 ,notification of other covered entity ,in the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity that such covered entity obtained from another covered entity1 the covered entity experiencing such data breach or data-sharing abuse shall1 without undue delay and1 if feasible1 not later than #gb hours after becoming aware of such data breach or data-sharing abuse1 notify such other covered entity of such data breach or data-sharing abuse1 unless such data breach or data-sharing abuse is unlikely to create or increase foreseeable privacy harms4 ,a covered entity receiving notice under this subsection of a data breach or data-sharing abuse shall notify any other covered entity from which the covered entity receiving notice obtained personal information involved in such data breach or data-sharing abuse1 in the same manner as required under the preceding sentence for the covered entity experiencing such data breach or data-sharing abuse4 7c7 ,notification of individuals 7#a7 ,in general ,in the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity 7or a data breach or data-sharing abuse about which a covered entity is notified under subsection 7b771 if such covered entity has a relationship with an individual whose personal information was involved or potentially involved in such data breach or data-sharing abuse1 such covered entity shall notify such individual of such data breach or data-sharing abuse not later than #ad days after becoming aware of such data breach or data-sharing abuse 7or1 in the case of a data breach or data-sharing abuse about which a covered entity is notified under subsection 7b71 not later than #ad days after being so notified71 if such data breach or data-sharing abuse creates or increases foreseeable privacy harms4 7#b7 ,medium of notification ,a covered entity shall notify an individual as required by paragraph 7#a7 through-- 7,a7 the same medium through which such individual routinely interacts with such covered entity2 and 7,b7 one additional medium of notification1 if such covered entity has the personal information necessary to make a notification through such an additional medium without causing excessive financial burden for such covered entity4 7d7 ,rule of construction ,this section shall not apply to a covered entity if a person uses personal information obtained from a data breach or data-sharing abuse not involving such covered entity4 ,,iii ,digital ,privacy ,agency #cja4 ,establishment2 ,director and ,deputy ,director 7a7 ,agency established ,there is established an independent agency in the executive branch to be known as the ,digital ,privacy ,agency1 which shall implement and enforce this ,act4 7b7 ,director 7#a7 ,in general ,there is established the position of the ,director1 who shall serve as the head of the ,digital ,privacy ,agency4 7#b7 ,appointment ,subject to paragraph 7#c71 the ,director shall be appointed by the ,president1 by and with the advice and consent of the ,senate4 7#c7 ,qualification ,the ,director shall have a professional background1 experience1 knowledge1 and expertise in the following3 7,a7 ,privacy4 7,b7 ,information security4 7,c7 ,technology4 7,d7 ,civil rights and civil liberties4 7#d7 ,term 7,a7 ,in general ,the ,director shall serve for a term of #f years4 7,b7 ,expiration of term ,an individual may serve as ,director after the expiration of the term for which appointed1 until a successor has been appointed and qualified4 7#e7 ,compensation 7,a7 ,in general ,the ,director shall be compensated at the rate prescribed for level ,,ii of the ,executive ,schedule under section #ecac of title #e1 ,united ,states ,code4 7,b7 ,conforming amendment ,section #ecac of title #e1 ,united ,states ,code1 is amended by inserting after the item relating to the ,chief ,executive ,officer1 ,united ,states ,international ,development ,finance ,corporation4 the following new item3 ,director of the ,digital ,privacy ,agency44 7c7 ,deputy director ,there is established the position of ,deputy ,director1 who shall be appointed by the ,director4 7d7 ,vacancy of office of ,director 7#a7 ,in general ,sections #ccde through #ccdi;d of title #e1 ,united ,states ,code 7commonly known as the ,federal ,vacancies ,reform ,act of #aiih71 shall not apply to the office of the ,director of the ,digital ,privacy ,agency4 7#b7 ,line of succession ,the ,deputy ,director shall serve as acting ,director if the ,director dies1 resigns1 or is otherwise unable to perform the functions and duties of the office4 ,the ,director shall establish a line of succession among senior officers of the ,digital ,privacy ,agency in the event the position of ,deputy ,director is vacant to perform the functions and duties of the ,director temporarily in an acting capacity4 7e7 ,service restriction ,no ,director or ,deputy ,director may hold any office1 position1 or employment in any covered entity during the period of service of such person as ,director or ,deputy ,director4 7f7 ,offices ,the ,director shall establish a principal office and field offices of the ,digital ,privacy ,agency in locations that have high levels of activity by covered entities1 as determined by the ,director4 #cjb4 ,agency powers and authorities 7a7 ,powers of the ,digital ,privacy ,agency ,the ,director is authorized to establish the general policies of the ,digital ,privacy ,agency with respect to all executive and administrative functions1 including-- 7#a7 establishing of rules for conducting the general business of the ,digital ,privacy ,agency1 in a manner not inconsistent with this ,act2 7#b7 binding the ,digital ,privacy ,agency and entering into contracts2 7#c7 directing the establishment and continued operation of divisions or other offices within the ,digital ,privacy ,agency1 in order to carry out the responsibilities of the ,digital ,privacy ,agency under this ,act1 and to satisfy the requirements of other applicable law2 7#d7 coordinating and overseeing the operation of all administrative1 enforcement1 and research activities of the ,digital ,privacy ,agency2 7#e7 adopting and using a seal2 7#f7 determining the character of and the necessity for the obligations and expenditures of the ,digital ,privacy ,agency2 7#g7 appointing and supervising of personnel employed by the ,digital ,privacy ,agency2 7#h7 distributing business among personnel appointed and supervised by the ,director and among administrative units of the ,digital ,privacy ,agency2 7#i7 using and expending of funds2 7#aj7 implementing this ,act through rules1 orders1 guidance1 interpretations1 statements of policy1 investigations1 and enforcement actions2 and 7#aa7 performing such other functions as may be authorized or required by law4 7b7 ,delegation of authority ,the ,director may not delegate the power to appoint the ,deputy ,director under section #cja7;c74 7c7 ,autonomy of agency regarding recommendations and testimony ,no officer or agency of the ,united ,states may require the ,director or any other officer of the ,digital ,privacy ,agency to submit legislative recommendations1 or testimony or comments on legislation1 to any officer or agency of the ,united ,states for approval1 comments1 or review prior to the submission of such recommendations1 testimony1 or comments to the ,congress1 if such recommendations1 testimony1 or comments to the ,congress include a statement indicating that the views expressed therein are those of the ,director or such officer1 and do not necessarily reflect the views of the ,president4 7d7 ,rulemaking authority 7#a7 ,in general ,the ,director may prescribe such rules and regulations as may be necessary and appropriate1 and in the public interest1 to implement1 administer1 and carry out this ,act1 and to prevent evasions thereof4 7#b7 ,regulations ,the ,digital ,privacy ,agency may issue regulations after notice and comment in accordance with section #eec of title #e1 ,united ,states ,code1 as may be necessary to implement1 administer1 and carry out this ,act4 7e7 ,consultations ,in implementing or enforcing this ,act1 the ,director may consult with-- 7#a7 ,federal agencies that have-- 7,a7 jurisdiction over ,federal privacy laws2 and 7,b7 expertise in privacy or information security2 7#b7 ,state attorneys general1 ,state privacy regulators1 and other ,state agencies that have expertise in privacy or information security2 7#c7 international and intergovernmental bodies that conduct activities relating to the privacy or information security2 7#d7 agencies of other countries that are similar to the ,digital ,privacy ,agency or have expertise in privacy or information security2 7#e7 privacy and information security experts in academia1 government1 civil society1 or industry2 and 7#f7 advisory boards of the ,digital ,privacy ,agency established under section #cjh1 as appropriate4 7f7 ,agency deference ,in any action for judicial review of regulations or orders of the ,digital ,privacy ,agency1 the reviewing court shall defer to the reasonable interpretation by the ,digital ,privacy ,agency of this ,act4 #cjc4 ,reporting and audit requirements 7a7 ,reports required 7#a7 ,in general ,not later than #f months after the date of the enactment of this ,act1 and every #f months thereafter1 the ,director shall submit a report to the ,president and to the ,committee on ,energy and ,commerce1 the ,committee on the ,judiciary1 and the ,committee on ,appropriations of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation1 the ,committee on the ,judiciary1 and the ,committee on ,appropriations of the ,senate1 and shall publish such report on the website of the ,digital ,privacy ,agency4 7#b7 ,contents ,each report required by subsection 7a7 shall include-- 7,a7 a discussion of the significant problems faced by individuals with respect to the privacy or security of personal information2 7,b7 a justification of the budget request of the ,digital ,privacy ,agency for the preceding year1 unless a justification for such year was included in the preceding report submitted under such subsection2 7,c7 a list of the significant rules and orders adopted by the ,digital ,privacy ,agency1 as well as other significant initiatives conducted by the ,digital ,privacy ,agency1 during the preceding #f-month period and the plan of the ,digital ,privacy ,agency for rules1 orders1 or other initiatives to be undertaken during the upcoming #f-month period2 7,d7 an analysis of complaints about the privacy or security of personal information that the ,digital ,privacy ,agency has received and collected in the database described in section #cjg7;a7 during the preceding #f-month period2 7,e7 a list1 with a brief statement of the issues1 of the public enforcement actions to which the ,digital ,privacy ,agency was a party during the preceding #f-month period2 and 7,f7 an assessment of significant actions by ,state attorneys general or ,state privacy regulators relating to this ,act or the rules prescribed under this ,act during the preceding #f-month period4 7b7 ,annual audits ,the ,director shall order an annual independent audit of the operations and budget of the ,digital ,privacy ,agency4 #cjd4 ,relation to other agencies 7a7 ,coordination 7#a7 ,in general ,with respect to covered entities and service providers1 to the extent that ,federal law authorizes the ,digital ,privacy ,agency and another ,federal agency to enforce a ,federal privacy law1 the head of the other ,federal agency shall coordinate with the ,director of the ,digital ,privacy ,agency to promote consistent enforcement of this ,act and the other ,federal privacy law4 7#b7 ,referral ,any ,federal agency authorized to enforce ,federal privacy laws may recommend in writing to the ,digital ,privacy ,agency that the ,digital ,privacy ,agency initiate an enforcement proceeding1 as the ,digital ,privacy ,agency is authorized by that ,federal privacy law or by this ,act4 7b7 ,transfers from the commission 7#a7 ,transfers of authority 7,a7 ,transfer of rulemaking and certain other authorities under ,federal privacy laws ,the ,digital ,privacy ,agency shall have all powers and duties under the ,federal privacy laws to prescribe rules1 issue guidelines1 or to conduct studies or issue reports mandated by such laws1 that were vested in the ,commission on the effective date of this ,act4 ,the authority of the ,commission under ,federal privacy laws to prescribe rules1 issue guidelines1 or conduct a study or issue a report mandated under such law shall be transferred to the ,digital ,privacy ,agency on the effective date of this ,act4 7,b7 ,transfer of enforcement authority ,the ,digital ,privacy ,agency may enforce a rule prescribed by the ,commission under-- 7i7 ,federal privacy laws2 or 7ii7 the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 related to unfair or deceptive acts or practices relating to privacy1 information security1 identity theft1 data abuses1 and related matters4 7#b7 ,transfer of privacy employees ,any employee of the ,commission employed in a division1 bureau1 office1 or other subdivision of the ,commission with the primary responsibility of administering1 investigating1 or enforcing ,federal privacy laws or applications of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 related to unfair or deceptive acts or practices relating to privacy1 information security1 identity theft1 data abuses1 and related matters shall be transferred to the ,digital ,privacy ,agency4 ,such employee shall be provided with compensation and benefits not less than the equivalent of compensation and benefits provided to such employee on the date of enactment of this ,act or compensation and benefits provided to an employee of the ,digital ,privacy ,agency in comparable position with comparable experience4 7c7 ,preservation of authorities of other agencies ,except as described in this section1 no provision of this ,act shall be construed as modifying1 limiting1 or otherwise affecting the operation of any provision of ,federal law1 or otherwise affecting the authority of any ,federal agency under a ,federal privacy law or any other law1 including the ability of such ,federal agency to promulgate regulations and enforce ,federal privacy laws4 #cje4 ,personnel 7a7 ,personnel 7#a7 ,appointment generally ,the ,director may fix the number of1 and appoint and direct1 all employees of the ,digital ,privacy ,agency1 in accordance with the applicable provisions of title #e1 ,united ,states ,code4 ,the ,director may appoint personnel without regard to the provisions of title #e1 ,united ,states ,code1 governing appointments in the competitive service1 so long as the ,director sets requirements1 conducts recruitment1 and determines appointments in a fair1 transparent1 and equitable manner4 7#b7 ,employees of the agency ,the ,director is authorized to employ privacy experts1 technologists1 computer scientists1 user experience designers and researchers1 data scientists1 ethicists1 attorneys1 investigators1 economists1 civil rights experts1 and other employees as the ,director considers necessary to conduct the business of the ,digital ,privacy ,agency4 ,unless otherwise provided expressly by law1 any individual appointed under this section shall be an employee1 as defined in section #baje of title #e1 ,united ,states ,code1 and subject to the provisions of such title and other laws generally applicable to the employees of an executive agency4 7#c7 ,employee compensation ,the ,director may fix and adjust the pay and benefits of personnel as the ,director considers desirable1 competitive1 transparent1 and equitable1 without regard to the provisions of chapter #ea and subchapter ,,iii of chapter #ec of title #e1 ,united ,states ,code1 relating to classification and ,general ,schedule pay rates1 respectively4 7#d7 ,labor-management relations ,chapter #ga of title #e1 ,united ,states ,code1 shall apply to the ,digital ,privacy ,agency and the employees of the ,digital ,privacy ,agency4 7b7 ,additional roles 7#a7 ,chief information officer 7,a7 ,designation of an agency ,,cio ,subchapter ,,ii of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7i7 in section #aacae7;c7 by adding and of the ,digital ,privacy ,agency before the em dash immediately preceding paragraph 7#a72 and 7ii7 in section #aacai7;a77#a7 by adding and the ,digital ,privacy ,agency before the period4 7,b7 ,responsibility ,the ,chief ,information ,officer of the ,digital ,privacy ,agency1 as designated by subparagraph 7,a71 shall ensure the ,digital ,privacy ,agency uses technology efficiency to implement1 administer1 and enforce this ,act and the rules and orders issued pursuant to this ,act4 7#b7 ,inspector general ,section #dja of title #e1 ,united ,states ,code1 is amended-- 7,a7 in paragraph 7#a71 by inserting the ,digital ,privacy ,agency1 after the ,export-,import ,bank of the ,united ,states12 and 7,b7 in paragraph 7#c71 by inserting the ,director of the ,digital ,privacy ,agency2 after the ,president of the ,export-,import ,bank of the ,united ,states24 7#c7 ,ombud ,the ,director shall appoint an ombud who shall-- 7,a7 act as a liaison between the ,digital ,privacy ,agency and any affected person with respect to any problem that such person may have in dealing with the ,digital ,privacy ,agency that results from the regulatory activities of the ,digital ,privacy ,agency2 and 7,b7 ensure that safeguards exist to encourage complainants to come forward and preserve confidentiality4 7c7 ,authority ,to accept ,federal detailees ,the ,director may accept officers or employees of the ,united ,states or members of the ,armed ,forces on a detail from an element of the ,federal ,government on a nonreimbursable basis1 as jointly agreed to by the heads of the receiving and detailing elements1 for a period not to exceed #c years4 #cjf4 ,office of ,civil ,rights ,the ,director shall establish an ,office of ,civil ,rights within the ,digital ,privacy ,agency that shall have following responsibilities3 7#a7 ,providing oversight and enforcement of this ,act1 rules and orders issued pursuant to this ,act1 and ,federal privacy laws to ensure that collecting1 processing1 maintaining1 and disclosing of personal information is fair1 equitable1 and non-discriminatory in treatment and effect1 including through the implementation and enforcement of section #bjg4 7#b7 ,developing1 establishing1 and promoting practices that affirmatively further equal opportunity to and expand access to employment 7including hiring1 firing1 promotion1 demotion1 and compensation71 credit and insurance 7including denial of an application or obtaining less favorable terms71 housing1 education1 professional certification1 or the provision of health care and related services4 7#c7 ,coordinating the ,digital ,privacy ,agency's civil rights efforts with other ,federal agencies and ,state regulators1 as appropriate1 to promote consistent1 efficient1 and effective enforcement of ,federal civil rights laws4 7#d7 ,working with civil rights advocates1 privacy experts1 and other experts 7including members of the advisory boards established under section #cjh7 on the promotion of compliance with the civil rights provisions under this ,act1 rules and orders issued pursuant this ,act1 and ,federal privacy laws4 7#e7 ,liaising with communities and consumers impacted by practices regulated by this ,act and the ,digital ,privacy ,agency1 to ensure that their needs and views are appropriately taken into account4 7#f7 ,providing annual reports to ,congress on the efforts of the ,digital ,privacy ,agency to fulfill its civil rights mandate4 7#g7 ,such additional powers and duties as the ,director may determine are appropriate4 #cjg4 ,complaints of individuals 7a7 ,in general ,the ,director shall establish a unit within the ,digital ,privacy ,agency the functions of which shall include establishing a single1 toll-free telephone number1 a website1 and a database or utilizing an existing database to facilitate the centralized collection of1 monitoring of1 and response to complaints of individuals regarding the privacy or security of personal information4 ,the ,director shall coordinate with other ,federal agencies with jurisdiction over ,federal privacy laws to route complaints to such agencies1 where appropriate4 7b7 ,routing complaints to states ,to the extent practicable1 ,state agencies 7including ,state privacy regulators7 may receive appropriate complaints from the systems established under subsection 7a71 if-- 7#a7 the ,state agency system has the functional capacity to receive calls or electronic reports routed by the ,digital ,privacy ,agency systems2 7#b7 the ,state agency has satisfied any conditions of participation in the system that the ,digital ,privacy ,agency may establish1 including treatment of personal information and sharing of information on complaint resolution or related compliance procedures and resources2 and 7#c7 participation by the ,state agency includes measures necessary to provide for protection of personal information that conform to the standards for protection of the confidentiality of personal information and for data integrity and security that apply to ,federal agencies4 7c7 ,data sharing required ,to facilitate inclusion in the reports required by section #cjc of the matters regarding complaints of individuals required by subsection 7a77#b77;,d7 of such section to be included in such reports1 investigation and enforcement activities1 and monitoring of the privacy and security of personal information1 the ,digital ,privacy ,agency shall share information about complaints of individuals with ,federal and ,state agencies 7including ,state privacy regulators7 that have jurisdiction over the privacy or security of personal information and ,state attorneys general1 subject to the standards applicable to ,federal agencies for the protection of the confidentiality of personal information and for information security and integrity4 ,other ,federal agencies that have jurisdiction over the privacy or security of personal information shall share data relating to complaints of individuals regarding the privacy or security of personal information with the ,digital ,privacy ,agency1 subject to the standards applicable to ,federal agencies for the protection of confidentiality of personal information and for information security and integrity4 7d7 ,publishing of complaints 7#a7 ,consent required ,in collecting a complaint from an individual1 the ,digital ,privacy ,agency shall request consent for publishing the complaint without any information identifying the individual4 7#b7 ,public database ,the ,digital ,privacy ,agency shall make publicly available on its website a database of each complaint for which it has received consent to publish the complaint from an individual who provided the complaint to the ,digital ,privacy ,agency4 7#c7 ,redacting information ,when necessary1 the ,digital ,privacy ,agency may redact information from a published complaint to protect the privacy of the individual4 #cjh4 ,advisory boards 7a7 ,establishment ,the ,director shall establish the following advisory boards to advise and consult with the ,digital ,privacy ,agency in the exercise of its functions under this ,act1 and to provide information on emerging practices relating to the treatment of personal information by covered entities3 7#a7 ,the ,user ,advisory ,board1 which shall be composed of experts in consumer protection1 privacy1 civil rights1 and ethics4 7#b7 ,the ,research ,advisory ,board1 which shall be composed of individuals with academic and research expertise in privacy1 cybersecurity1 computer science1 innovation1 design1 ethics1 economics1 law1 and public policy4 7#c7 ,the ,startup ,advisory ,board1 which shall be composed of representatives of small businesses and investors in small businesses4 7#d7 ,the ,product ,advisory ,board1 which shall be composed of technologists1 computer scientists1 designers1 product managers1 attorneys1 and other representatives of covered entities4 7b7 ,appointments ,the ,director shall appoint members to the advisory boards established under subsection 7a7 without regard to party affiliation4 7c7 ,meetings ,each advisory board established under subsection 7a7 shall meet from time to time at the call of the ,director1 but1 at a minimum1 shall meet at least twice in each calendar year4 7d7 ,compensation and travel expenses ,members of the advisory boards established under subsection 7a7 who are not full-time employees of the ,united ,states shall-- 7#a7 be entitled to receive compensation at a rate fixed by the ,director while attending meetings of the advisory board1 including travel time2 and 7#b7 receive travel expenses1 including per diem in lieu of subsistence1 in accordance with applicable provisions under subchapter ,i of chapter #eg of title #e1 ,united ,states ,code4 #cji4 ,authorization of appropriations ,there are authorized to be appropriated to the ,director to carry out this ,act #eej1jjj1jjj for each of the fiscal years #bjbf1 #bjbg1 #bjbh1 #bjbi1 and #bjcj4 ,,iv ,enforcement #dja4 ,investigations and administrative discovery 7a7 ,joint investigations ,the ,digital ,privacy ,agency or1 where appropriate1 a ,digital ,privacy ,agency investigator1 may conduct investigations and make requests for information1 as authorized under this ,act1 on a joint basis with another ,federal agency1 a ,state attorney general1 or a ,state privacy regulator4 7b7 ,subpoenas 7#a7 ,in general ,the ,digital ,privacy ,agency or a ,digital ,privacy ,agency investigator may issue subpoenas for the attendance and testimony of witnesses and the production of relevant papers1 books1 documents1 or other material in connection with hearings under this ,act4 7#b7 ,failure to obey ,in the case of contumacy or refusal to obey a subpoena issued pursuant to this subsection and served upon any person1 the district court of the ,united ,states for any district in which such person is found1 resides1 or transacts business1 upon application by the ,digital ,privacy ,agency or a ,digital ,privacy ,agency investigator and after notice to such person1 may issue an order requiring such person to appear and give testimony or to appear and produce documents or other material4 7#c7 ,contempt ,any failure to obey an order of the court under paragraph 7#b7 may be punished by the court as a contempt thereof4 7c7 ,demands 7#a7 ,in general ,whenever the ,digital ,privacy ,agency has reason to believe that any person may be in possession1 custody1 or control of any documentary material or tangible things1 or may have any information1 relevant to a violation1 the ,digital ,privacy ,agency may1 before the institution of any proceedings under this ,act1 issue in writing1 and cause to be served upon such person1 a civil investigative demand requiring such person to-- 7,a7 produce such documentary material for inspection and copying or reproduction in the form or medium requested by the ,digital ,privacy ,agency2 7,b7 submit such tangible things2 7,c7 file written reports or answers to questions2 7,d7 give oral testimony concerning documentary material1 tangible things1 or other information2 or 7,e7 furnish any combination of such material1 answers1 or testimony4 7#b7 ,requirements ,each civil investigative demand shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation4 7#c7 ,production of documents ,each civil investigative demand for the production of documentary material shall-- 7,a7 describe each class of documentary material to be produced under the demand with such definiteness and certainty as to permit such material to be fairly identified2 7,b7 prescribe a return date or dates which will provide a reasonable period of time within which the material so demanded may be assembled and made available for inspection and copying or reproduction2 and 7,c7 identify the custodian to whom such material shall be made available4 7#d7 ,production of things ,each civil investigative demand for the submission of tangible things shall-- 7,a7 describe each class of tangible things to be submitted under the demand with such definiteness and certainty as to permit such things to be fairly identified2 7,b7 prescribe a return date or dates which will provide a reasonable period of time within which the things so demanded may be assembled and submitted2 and 7,c7 identify the custodian to whom such things shall be submitted4 7#e7 ,demand for written reports or answers ,each civil investigative demand for written reports or answers to questions shall-- 7,a7 propound with definiteness and certainty the reports to be produced or the questions to be answered2 7,b7 prescribe a date or dates at which time written reports or answers to questions shall be submitted2 and 7,c7 identify the custodian to whom such reports or answers shall be submitted4 7#f7 ,oral testimony ,each civil investigative demand for the giving of oral testimony shall-- 7,a7 prescribe a date1 time1 and place at which oral testimony shall be commenced2 and 7,b7 identify a ,digital ,privacy ,agency investigator who shall conduct the investigation and the custodian to whom the transcript of such investigation shall be submitted4 7#g7 ,service ,any civil investigative demand issued1 and any enforcement petition filed1 under this section may be served-- 7,a7 by any ,digital ,privacy ,agency investigator at any place within the territorial jurisdiction of any court of the ,united ,states2 and 7,b7 upon any person who is not found within the territorial jurisdiction of any court of the ,united ,states-- 7i7 in such manner as the ,federal ,rules of ,civil ,procedure prescribe for service in a foreign nation2 and 7ii7 to the extent that the courts of the ,united ,states have authority to assert jurisdiction over such person1 consistent with due process1 the ,united ,states ,district ,court for the ,district of ,columbia shall have the same jurisdiction to take any action respecting compliance with this section by such person that such district court would have if such person were personally within the jurisdiction of such district court4 7#h7 ,method of service ,service of any civil investigative demand or any enforcement petition filed under this section may be made upon a person by-- 7,a7 delivering a duly executed copy of such demand or petition to the individual or to any partner1 executive officer1 managing agent1 or general agent of such person1 or to any agent of such person authorized by appointment or by law to receive service of process on behalf of such person2 7,b7 delivering a duly executed copy of such demand or petition to the principal office or place of business of the person to be served2 or 7,c7 depositing a duly executed copy in the ,united ,states mails1 by registered or certified mail1 return receipt requested1 duly addressed to such person at the principal office or place of business of such person4 7#i7 ,proof of service 7,a7 ,in general ,a verified return by the individual serving any civil investigative demand or any enforcement petition filed under this section setting forth the manner of such service shall be proof of such service4 7,b7 ,return receipts ,in the case of service by registered or certified mail1 such return shall be accompanied by the return post office receipt of delivery of such demand or enforcement petition4 7#aj7 ,production of documentary material ,the production of documentary material in response to a civil investigative demand shall be made under a sworn certificate1 in such form as the demand designates1 by the person1 if a natural person1 to whom the demand is directed or1 if not a natural person1 by any person having knowledge of the facts and circumstances relating to such production1 to the effect that all of the documentary material required by the demand and in the possession1 custody1 or control of the person to whom the demand is directed has been produced and made available to the custodian4 7#aa7 ,submission of tangible things ,the submission of tangible things in response to a civil investigative demand shall be made under a sworn certificate1 in such form as the demand designates1 by the person to whom the demand is directed or1 if not a natural person1 by any person having knowledge of the facts and circumstances relating to such production1 to the effect that all of the tangible things required by the demand and in the possession1 custody1 or control of the person to whom the demand is directed have been submitted to the custodian4 7#ab7 ,separate answers ,each reporting requirement or question in a civil investigative demand shall be answered separately and fully in writing under oath1 unless it is objected to1 in which event the reasons for the objection shall be stated in lieu of an answer1 and it shall be submitted under a sworn certificate1 in such form as the demand designates1 by the person1 if a natural person1 to whom the demand is directed or1 if not a natural person1 by any person responsible for answering each reporting requirement or question1 to the effect that all information required by the demand and in the possession1 custody1 control1 or knowledge of the person to whom the demand is directed has been submitted4 7#ac7 ,testimony 7,a7 ,in general 7i7 ,oath and recordation ,the examination of any person pursuant to a demand for oral testimony served under this subsection shall be taken before an officer authorized to administer oaths and affirmations by the laws of the ,united ,states or of the place at which the examination is held4 ,the officer before whom oral testimony is to be taken shall put the witness on oath or affirmation and shall personally1 or by any individual acting under the direction of and in the presence of the officer1 record the testimony of the witness4 7ii7 ,transcription ,the testimony shall be taken stenographically and transcribed4 7,b7 ,parties present ,any ,digital ,privacy ,agency investigator before whom oral testimony is to be taken shall exclude from the place where the testimony is to be taken all other persons1 except the person giving the testimony1 the attorney for that person1 the officer before whom the testimony is to be taken1 an investigator or representative of an agency with which the ,digital ,privacy ,agency is engaged in a joint investigation1 and any stenographer taking such testimony4 7,c7 ,location ,the oral testimony of any person taken pursuant to a civil investigative demand shall be taken in the judicial district of the ,united ,states in which such person resides1 is found1 or transacts business1 or in such other place as may be agreed upon by the ,digital ,privacy ,agency investigator before whom the oral testimony of such person is to be taken and such person4 7,d7 ,attorney representation 7i7 ,in general ,any person compelled to appear under a civil investigative demand for oral testimony pursuant to this subsection may be accompanied1 represented1 and advised by an attorney4 7ii7 ,authority ,the attorney may advise a person described in clause 7i71 in confidence1 either upon the request of such person or upon the initiative of the attorney1 with respect to any question asked of such person4 7iii7 ,objections ,a person described in clause 7i71 or the attorney for that person1 may object on the record to any question1 in whole or in part1 and such person shall briefly state for the record the reason for the objection4 ,an objection may properly be made1 received1 and entered upon the record when it is claimed that such person is entitled to refuse to answer the question on grounds of any constitutional or other legal right or privilege1 including the privilege against self-incrimination1 but such person shall not otherwise object to or refuse to answer any question1 and such person or attorney shall not otherwise interrupt the oral examination4 7iv7 ,refusal to answer ,if a person described in clause 7i7 refuses to answer any question-- 7,i7 the ,digital ,privacy ,agency may petition the district court of the ,united ,states pursuant to this section for an order compelling such person to answer such question2 and 7,,ii7 if the refusal is on grounds of the privilege against self-incrimination1 the testimony of such person may be compelled in accordance with the provisions of section #fjjd of title #ah1 ,united ,states ,code4 7,e7 ,transcripts ,for purposes of this subsection-- 7i7 after the testimony of any witness is fully transcribed1 the ,digital ,privacy ,agency investigator shall afford the witness 7who may be accompanied by an attorney7 a reasonable opportunity to examine the transcript2 7ii7 the transcript shall be read to or by the witness1 unless such examination and reading are waived by the witness2 7iii7 any changes in form or substance which the witness desires to make shall be entered and identified upon the transcript by the ,digital ,privacy ,agency investigator1 with a statement of the reasons given by the witness for making such changes2 7iv7 the transcript shall be signed by the witness1 unless the witness in writing waives the signing1 is ill1 cannot be found1 or refuses to sign2 and 7v7 if the transcript is not signed by the witness during the #cj-;day period following the date on which the witness is first afforded a reasonable opportunity to examine the transcript1 the ,digital ,privacy ,agency investigator shall sign the transcript and state on the record the fact of the waiver1 illness1 absence of the witness1 or the refusal to sign1 together with any reasons given for the failure to sign4 7,f7 ,certification by investigator ,the ,digital ,privacy ,agency investigator shall certify on the transcript that the witness was duly sworn by such ,digital ,privacy ,agency investigator and that the transcript is a true record of the testimony given by the witness1 and the ,digital ,privacy ,agency investigator shall promptly deliver the transcript or send it by registered or certified mail to the custodian4 7,g7 ,copy of transcript ,the ,digital ,privacy ,agency investigator shall furnish a copy of the transcript 7upon payment of reasonable charges for the transcript7 to the witness only1 except that the ,digital ,privacy ,agency may for good cause limit such witness to inspection of the official transcript of the testimony of such witness4 7,h7 ,witness fees ,any witness appearing for the taking of oral testimony pursuant to a civil investigative demand shall be entitled to the same fees and mileage which are paid to witnesses in the district courts of the ,united ,states4 7d7 ,confidential treatment of demand material 7#a7 ,in general ,documentary materials and tangible things received as a result of a civil investigative demand shall be subject to requirements and procedures regarding confidentiality1 in accordance with rules established by the ,digital ,privacy ,agency4 7#b7 ,disclosure to congress ,no rule established by the ,digital ,privacy ,agency regarding the confidentiality of materials submitted to1 or otherwise obtained by1 the ,digital ,privacy ,agency shall be intended to prevent disclosure to either ,house of ,congress or to an appropriate committee of the ,congress1 except that the ,digital ,privacy ,agency is permitted to adopt rules allowing prior notice to any party that owns or otherwise provided the material to the ,digital ,privacy ,agency and had designated such material as confidential4 7e7 ,petition for enforcement 7#a7 ,in general ,whenever any person fails to comply with any civil investigative demand duly served upon such person under this section1 or whenever satisfactory copying or reproduction of material requested pursuant to the demand cannot be accomplished and such person refuses to surrender such material1 the ,digital ,privacy ,agency1 through such officers or attorneys as it may designate1 may file1 in the district court of the ,united ,states for any judicial district in which such person resides1 is found1 or transacts business1 and serve upon such person1 a petition for an order of such court for the enforcement of this section4 7#b7 ,service of process ,all process of any court to which application may be made as provided in this subsection may be served in any judicial district4 7f7 ,petition for order modifying or setting aside demand 7#a7 ,in general ,not later than #bj days after the service of any civil investigative demand upon any person under subsection 7c71 or at any time before the return date specified in the demand1 whichever period is shorter1 or within such period exceeding #bj days after service or in excess of such return date as may be prescribed in writing1 subsequent to service1 by any ,digital ,privacy ,agency investigator named in the demand1 such person may file with the ,digital ,privacy ,agency a petition for an order by the ,digital ,privacy ,agency modifying or setting aside the demand4 7#b7 ,compliance during pendency ,the time permitted for compliance with the demand in whole or in part1 as determined proper and ordered by the ,digital ,privacy ,agency1 shall not run during the pendency of a petition under paragraph 7#a7 at the ,digital ,privacy ,agency1 except that such person shall comply with any portions of the demand not sought to be modified or set aside4 7#c7 ,specific grounds ,a petition under paragraph 7#a7 shall specify each ground upon which the petitioner relies in seeking relief1 and may be based upon any failure of the demand to comply with the provisions of this section1 or upon any constitutional or other legal right or privilege of such person4 7g7 ,custodial control ,at any time during which any custodian is in custody or control of any documentary material1 tangible things1 reports1 answers to questions1 or transcripts of oral testimony given by any person in compliance with any civil investigative demand1 such person may file1 in the district court of the ,united ,states for the judicial district within which the office of such custodian is situated1 and serve upon such custodian1 a petition for an order of such court requiring the performance by such custodian of any duty imposed upon such custodian by this section or rule promulgated by the ,digital ,privacy ,agency4 7h7 ,jurisdiction of court 7#a7 ,in general ,whenever any petition is filed in any district court of the ,united ,states under this section1 such court shall have jurisdiction to hear and determine the matter so presented1 and to enter such order or orders as may be required to carry out the provisions of this section4 7#b7 ,appeal ,any final order entered as described in paragraph 7#a7 shall be subject to appeal pursuant to section #abia of title #bh1 ,united ,states ,code4 #djb4 ,hearings and adjudication proceedings 7a7 ,in general ,except as provided in subsection 7b71 the ,digital ,privacy ,agency is authorized to conduct hearings and adjudication proceedings with respect to any person in the manner prescribed by subchapter ,,ii of chapter #e of title #e1 ,united ,states ,code1 in order to ensure or enforce compliance with this ,act and the rules prescribed under this ,act4 7b7 ,special rules for cease-and-,desist proceedings 7#a7 ,orders authorized 7,a7 ,in general ,if1 in the opinion of the ,digital ,privacy ,agency1 a person is engaging or has engaged in an act or omission that violates any provision of this ,act or a rule or order prescribed under this ,act1 the ,digital ,privacy ,agency may issue and serve upon the person a notice of charges in respect thereof4 7,b7 ,content of notice ,the notice under subparagraph 7,a7 shall contain a statement of the facts constituting the alleged violation1 and shall fix a time and place at which a hearing will be held to determine whether an order to cease and desist should issue against the person1 such hearing to be held not earlier than #cj days nor later than #fj days after the date of service of such notice1 unless an earlier or a later date is set by the ,digital ,privacy ,agency1 at the request of any person so served4 7,c7 ,consent ,unless a person served under subparagraph 7,a7 appears at the hearing personally or by a duly authorized representative1 the person shall be deemed to have consented to the issuance of the cease-and-desist order4 7,d7 ,procedure ,in the event of consent under subparagraph 7,c71 or if1 upon the record made at any such hearing1 the ,digital ,privacy ,agency finds that any violation specified in the notice of charges has been established1 the ,digital ,privacy ,agency may issue an order to cease and desist from the violation4 ,such order may1 by provisions which may be mandatory or otherwise1 require the person to cease and desist from the subject act or omission1 and to take affirmative action to correct the conditions resulting from any such violation4 7#b7 ,effectiveness of order ,a cease-and-desist order shall become effective at the expiration of #cj days after the date of service of the order under paragraph 7#a77;,d7 7except in the case of a cease-and-desist order issued upon consent1 which shall become effective #ahj days after the date of service of the notice of charges under paragraph 7#a77;,a771 and shall remain effective and enforceable as provided therein1 except to such extent as the order is stayed1 modified1 terminated1 or set aside by action of the ,digital ,privacy ,agency or a reviewing court4 7#c7 ,decision and ,appeal ,any hearing provided for in this subsection shall be held in the ,federal judicial district or in the territory in which the residence or principal office or place of business of the person is located unless the person consents to another place1 and shall be conducted in accordance with the provisions of subchapter ,,ii of chapter #e of title #e1 ,united ,states ,code4 ,after such hearing1 and not later than #ij days after the ,digital ,privacy ,agency has served the notice under paragraph 7#a77;,a71 the ,digital ,privacy ,agency shall render its decision 7which shall include findings of fact upon which its decision is predicated7 and shall issue and serve upon each such party an order or orders consistent with the provisions of this section4 ,judicial review of any such order shall be exclusively as provided in this subsection4 ,unless a petition for review is timely filed in a court of appeals of the ,united ,states1 as provided in paragraph 7#d71 and thereafter until the record in the proceeding has been filed as provided in paragraph 7#d71 the ,digital ,privacy ,agency may at any time1 upon such notice and in such manner as the ,digital ,privacy ,agency shall determine proper1 modify1 terminate1 or set aside any such order4 ,upon filing of the record as provided1 the ,digital ,privacy ,agency may modify1 terminate1 or set aside any such order with permission of the court4 7#d7 ,appeal to court of ,appeals ,any party to any proceeding under this subsection may obtain a review of any order served pursuant to this subsection 7other than an order issued with the consent of the party7 by filing in the court of appeals of the ,united ,states for the circuit in which the residence or principal office or place of business of the party is located1 or in the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit1 within #cj days after the date of service of such order1 a written petition praying that the order of the ,digital ,privacy ,agency be modified1 terminated1 or set aside4 ,a copy of such petition shall be forthwith transmitted by the clerk of the court to the ,digital ,privacy ,agency1 and thereupon the ,digital ,privacy ,agency shall file in the court the record in the proceeding1 as provided in section #baab of title #bh1 ,united ,states ,code4 ,upon the filing of such petition1 such court shall have jurisdiction1 which upon the filing of the record shall be exclusive1 to affirm1 modify1 terminate1 or set aside1 in whole or in part1 the order of the ,digital ,privacy ,agency4 ,review of such proceedings shall be had as provided in chapter #g of title #e1 ,united ,states ,code4 7#e7 ,no stay ,the commencement of proceedings for judicial review under paragraph 7#d7 shall not1 unless specifically ordered by the court1 operate as a stay of any order issued by the ,digital ,privacy ,agency4 7c7 ,special rules for temporary cease-and-,desist proceedings 7#a7 ,in general ,whenever the ,digital ,privacy ,agency determines that the violation specified in the notice of charges served upon a person pursuant to subsection 7b71 or the continuation thereof1 is likely to cause the person to be insolvent or otherwise prejudice the interests of individuals before the completion of the proceedings conducted pursuant to subsection 7b71 the ,digital ,privacy ,agency may issue a temporary order requiring the person to cease and desist from any such violation and to take affirmative action to prevent or remedy such insolvency or other condition pending completion of such proceedings4 ,such order may include any requirement authorized under this title4 ,such order shall become effective upon service upon the person and1 unless set aside1 limited1 or suspended by a court in proceedings authorized by paragraph 7#b71 shall remain effective and enforceable pending the completion of the administrative proceedings pursuant to such notice and until such time as the ,digital ,privacy ,agency shall dismiss the charges specified in such notice1 or if a cease-and-desist order is issued against the person1 until the effective date of such order4 7#b7 ,appeal ,not later than #aj days after a person has been served with a temporary cease-and-desist order1 the person may apply to the ,united ,states district court for the judicial district in which the residence or principal office or place of business of the person is located1 or the ,united ,states ,district ,court for the ,district of ,columbia1 for an injunction setting aside1 limiting1 or suspending the enforcement1 operation1 or effectiveness of such order pending the completion of the administrative proceedings pursuant to the notice of charges served upon the person under subsection 7b71 and such court shall have jurisdiction to issue such injunction4 7d7 ,special rules for enforcement of orders ,the ,digital ,privacy ,agency may in its discretion apply to the ,united ,states district court within the jurisdiction of which the residence or principal office or place of business of a person is located1 for the enforcement of any effective and outstanding order issued under this section against such person1 and such court shall have jurisdiction and power to order and require compliance with such order4 #djc4 ,litigation authority 7a7 ,in general ,if a person violates any provision of this ,act or a rule or order prescribed under this ,act1 the ,digital ,privacy ,agency may commence a civil action against such person in a court of competent jurisdiction to impose a civil penalty or to seek all appropriate legal and equitable relief1 including a permanent or temporary injunction4 7b7 ,compromise of actions ,the ,digital ,privacy ,agency may compromise or settle any action1 suit1 or other court proceeding to which the ,digital ,privacy ,agency is a party if such compromise is approved by the court4 7c7 ,notice to the attorney general of the ,united ,states 7#a7 ,in general ,when commencing a civil action under this ,act or regulations or rules or orders issued pursuant to this ,act1 the ,digital ,privacy ,agency shall notify the ,attorney ,general4 7#b7 ,notice and coordination 7,a7 ,notice of other actions ,in addition to any notice required under paragraph 7#a71 the ,digital ,privacy ,agency shall notify the ,attorney ,general concerning any action1 suit1 or other court proceeding to which the ,digital ,privacy ,agency is a party4 7,b7 ,coordination ,in order to avoid conflicts and promote consistency regarding litigation of matters under ,federal law1 the ,attorney ,general and the ,digital ,privacy ,agency shall consult regarding the coordination of investigations and proceedings1 including by negotiating an agreement for coordination not later than #ahj days after the effective date of this ,act4 ,the agreement under this subparagraph shall include provisions to ensure that parallel investigations and proceedings involving this ,act and the rules prescribed under this ,act are conducted in a manner that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7,c7 ,rule of construction ,nothing in this paragraph shall be construed to limit the authority of the ,digital ,privacy ,agency under this ,act1 including the authority to interpret this ,act4 7d7 ,appearance before the ,supreme ,court ,the ,digital ,privacy ,agency may represent itself in its own name before the ,supreme ,court of the ,united ,states1 if the ,digital ,privacy ,agency makes a written request to the ,attorney ,general within the #aj-;day period which begins on the date of entry of the judgment which would permit any party to file a petition for writ of certiorari1 and the ,attorney ,general concurs with such request or fails to take action within #fj days of the request of the ,digital ,privacy ,agency4 7e7 ,forum ,any civil action brought under this ,act or regulations or rules or orders issued pursuant to this ,act may be brought in an appropriate district court of the ,united ,states or an appropriate ,state court4 7f7 ,time for bringing action ,except as otherwise permitted by law or equity1 no action may be brought under this ,act more than #c years after the date of discovery of the violation to which the action relates4 #djd4 ,enforcement by ,states 7a7 ,civil action ,in any case in which a ,state attorney general or a ,state privacy regulator has reason to believe that an interest of the residents of a ,state has been or is adversely affected by any person who violates any provision of this ,act or a rule or order prescribed under this ,act1 the ,state attorney general or ,state privacy regulator1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in an appropriate ,state court or an appropriate district court of the ,united ,states to-- 7#a7 enjoin further violation of such provision by the defendant2 7#b7 compel compliance with such provision2 or 7#c7 obtain relief under section #djf4 7b7 ,rights of agency ,before initiating a civil action under subsection 7a71 the ,state attorney general or ,state privacy regulator1 as the case may be1 shall notify the ,digital ,privacy ,agency in writing of such civil action4 ,upon receiving notice with respect to a civil action1 the ,digital ,privacy ,agency may-- 7#a7 intervene in such action2 and 7#b7 upon intervening-- 7,a7 be heard on all matters arising in such civil action2 and 7,b7 file petitions for appeal of a decision in such action4 7c7 ,preemptive action by agency ,if the ,digital ,privacy ,agency institutes a civil action for violation of any provision of this ,act or a rule or order prescribed under this ,act1 no ,state attorney general or ,state privacy regulator may bring a civil action against any defendant named in the complaint of the ,digital ,privacy ,agency for a violation of such provision that is alleged in such complaint4 #dje4 ,private rights of action 7a7 ,injunctive relief ,a person who is aggrieved by a violation of this ,act may bring a civil action for declaratory or injunctive relief in any court of competent jurisdiction4 7b7 ,civil action for damages ,except for claims under rule #bc of the ,federal ,rules of ,civil ,procedure or a similar judicial procedure authorizing an action to be brought by #a or more representatives1 a person who is aggrieved by a violation of this ,act may bring a civil action for damages in any court of competent jurisdiction4 7c7 ,nonprofit collective representation ,an individual shall have the right to appoint a nonprofit organization 7as described in section #eja7;c77#c7 of the ,internal ,revenue ,code of #aihf and exempt from taxation under section #eja7;a7 of such ,code7 which has been properly constituted in accordance with the law1 has statutory objectives which are in the public interest1 and is active in the field of the protection of individual rights and freedoms with regard to the protection of privacy and information security to lodge the complaint on behalf of such individual to exercise the rights referred to in this ,act on behalf of such individual4 7#a7 ,a nonprofit may represent a class of aggrieved individuals4 7#b7 ,a prevailing nonprofit shall receive reasonable compensation for expenses1 including attorneys' fees4 7#c7 ,individuals shall receive an equally divided share of the total damages4 7d7 ,state ,appointment ,a ,state may provide that any body1 organization1 or association referred to in subsection 7c71 independent of an individual's appointment1 has the right to lodge1 in that ,state1 a complaint with the ,digital ,privacy ,agency and to exercise the rights referred to in this ,act if it considers that the rights of an individual under this ,act have been infringed4 #djf4 ,relief available 7a7 ,civil actions and adjudication proceedings 7#a7 ,jurisdiction ,in any civil action or any adjudication proceeding brought by the ,digital ,privacy ,agency1 a ,state attorney general1 or ,state privacy regulator under any provision of this ,act or a rule or order prescribed under this ,act1 the court or the ,digital ,privacy ,agency 7as the case may be7 shall have jurisdiction to grant any appropriate legal or equitable relief with respect to a violation of such provision4 7#b7 ,relief ,relief under this section may include-- 7,a7 rescission or reformation of contracts2 7,b7 refund of moneys2 7,c7 restitution2 7,d7 disgorgement or compensation for unjust enrichment2 7,e7 payment of damages or other monetary relief2 7,f7 public notification regarding the violation1 including the costs of notification2 7,g7 limits on the activities or functions of the person2 and 7,h7 civil money penalties1 as provided in subsection 7c74 7#c7 ,no exemplary or punitive damages ,nothing in this subsection shall be construed as authorizing the imposition of exemplary or punitive damages4 7b7 ,recovery of costs ,in any civil action brought by the ,digital ,privacy ,agency1 ,state attorney general1 or ,state privacy regulator under any provision of this ,act or a rule or order prescribed under this ,act1 the ,digital ,privacy ,agency1 ,state attorney general1 or ,state privacy regulator may recover its costs in connection with prosecuting such action if the ,digital ,privacy ,agency or ,state attorney general is the prevailing party in the action4 7c7 ,civil money penalty in court and administrative actions 7#a7 ,in general ,any person who violates1 through any act or omission1 any provision of this ,act or a rule or order issued pursuant to this ,act shall forfeit and pay a civil penalty under this subsection4 7#b7 ,penalty amount 7,a7 ,in general ,the amount of a civil penalty under this subsection may not exceed1 for each violation1 the product of-- 7i7 the maximum civil penalty for which a person1 partnership1 or corporation may be liable under section #e7m77#a77;,a7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m77#a77;,a77 for a violation of a rule under such ,act respecting unfair or deceptive acts or practices1 as adjusted under the ,federal ,civil ,penalties ,inflation ,adjustment ,act of #aiij 7#bh ,u4,s4,c4 #bdfa note72 and 7ii7 the number of individuals whose personal information is affected by the violation4 7,b7 ,continuing violations ,in the case of a violation through continuing failure to comply with a provision of this ,act or a rule or order prescribed under this ,act1 each day of continuance of such failure shall be treated as a separate violation for purposes of subparagraph 7,a74 7#c7 ,mitigating factors ,in determining the amount of any penalty assessed under paragraph 7#b71 the court or the ,digital ,privacy ,agency shall take into account the appropriateness of the penalty with respect to-- 7,a7 the size of financial resources and good faith of the person charged2 7,b7 the gravity of the violation2 7,c7 the severity of the privacy harms 7including both actual and potential harms7 to individuals2 7,d7 any disparate impact of the privacy harms 7including both actual and potential harms7 on protected classes2 7,e7 the history of previous violations2 and 7,f7 such other matters as justice may require4 7#d7 ,authority to modify or remit penalty ,the ,digital ,privacy ,agency1 ,state attorney general1 or ,state privacy regulator may compromise1 modify1 or remit any penalty which may be assessed or has already been assessed under paragraph 7#b74 ,the amount of such penalty1 when finally determined1 shall be exclusive of any sums owed by the person to the ,united ,states in connection with the costs of the proceeding1 and may be deducted from any sums owing by the ,united ,states to the person charged4 7#e7 ,notice and hearing ,no civil penalty may be assessed under this subsection with respect to a violation of any provision of this ,act or a rule or order issued pursuant to this ,act1 unless-- 7,a7 the ,digital ,privacy ,agency1 ,state attorney general1 or ,state privacy regulator gives notice and an opportunity for a hearing to the person accused of the violation2 or 7,b7 the appropriate court has ordered such assessment and entered judgment in favor of the ,digital ,privacy ,agency1 ,state attorney general1 or ,state privacy regulator4 #djg4 ,referral for criminal proceedings ,if the ,digital ,privacy ,agency obtains evidence that any person1 domestic or foreign1 has engaged in conduct that may constitute a violation of ,federal criminal law1 the ,digital ,privacy ,agency shall transmit such evidence to the ,attorney ,general of the ,united ,states1 who may institute criminal proceedings under appropriate law4 ,nothing in this section affects any other authority of the ,digital ,privacy ,agency to disclose information4 #djh4 ,whistleblower enforcement 7a7 ,in general ,any person who becomes aware1 based on nonpublic information1 that a covered entity has violated this ,act may file a civil action for civil penalties1 if prior to filing such action1 the person files with the ,director a written request for the ,director to commence the action4 ,the request shall include a clear and concise statement of the grounds for believing a cause of action exists4 ,the person shall make the nonpublic information available to the ,director upon request3 7#a7 ,if the ,director files suit within #ij days from receipt of the written request to commence the action1 no other action may be brought unless the action brought by the ,director is dismissed without prejudice4 7#b7 ,if the ,director does not file suit within #ij days from receipt of the written request to commence the action1 the person requesting the action may proceed to file a civil action4 7#c7 ,the time period within which a civil action shall be commenced shall be tolled from the date of receipt by the ,director of the written request to either the date that the civil action is dismissed without prejudice1 or for #aej days1 whichever is later1 but only for a civil action brought by the person who requested the ,director to commence the action4 7b7 ,allocation of civil penalties ,if a judgment is entered against the defendant or defendants in an action brought pursuant to this section1 or the matter is settled1 amounts received as civil penalties or pursuant to a settlement of the action shall be allocated as follows3 7#a7 ,if the action was brought by the ,director upon a request made by a person pursuant to subsection 7a71 the person who made the request shall be entitled to #ae percent of the civil penalties4 7#b7 ,if the action was brought by the person who made the request pursuant to subsection 7a71 that person shall receive an amount the court determines is reasonable for collecting the civil penalties on behalf of the government4 ,the amount shall be not less than #be percent and not more than #ej percent of the proceeds of the action and shall be paid out of the proceeds4 ,v ,relation to ,other ,law #eja4 ,effective date 7a7 ,in general ,this ,act shall apply beginning on the date that is #a year after the date of the enactment of this ,act4 7b7 ,authority ,to promulgate regulations and take certain other actions ,nothing in subsection 7a7 affects the authority of the ,digital ,privacy ,agency to take an action expressly required by a provision of this ,act to be taken before the effective date described in such subsection4 #ejb4 ,relation to other ,federal law ,nothing in this ,act shall be construed to modify1 limit1 or supersede the operation of any privacy or security provision in the following3 7#a7 ,section #eeb;a of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd74 7#b7 ,the ,right to ,financial ,privacy ,act of #aigh 7#ab ,u4,s4,c4 #cdja et seq474 7#c7 ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq474 7#d7 ,the ,fair ,debt ,collection ,practices ,act 7#ae ,u4,s4,c4 #afib et seq474 7#e7 ,the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq474 7#f7 ,title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7#g7 ,chapter #aai1 #abc1 or #bjf of title #ah1 ,united ,states ,code4 7#h7 ,section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly known as the ,family ,educational ,rights and ,privacy ,act of #aigd74 7#i7 ,section #dde of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;h74 7#aj7 ,the ,privacy ,protection ,act of #aihj 7#db ,u4,s4,c4 #bjjj;aa et seq474 7#aa7 ,the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 as those regulations relate to-- 7,a7 a person described in section #aagb7;a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#a7;a772 or 7,b7 transactions referred to in section #aagc7;a77#a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#b7;a77#a774 7#ab7 ,the ,communications ,assistance for ,law ,enforcement ,act 7#dg ,u4,s4,c4 #ajja et seq474 7#ac7 ,section #bbb1 #bbg1 #cch1 or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb1 #bbg1 #cch1 or #eea74 7#ad7 ,the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #aja et seq474 7#ae7 ,the ,paperwork ,reduction ,act of #aiie 7#dd ,u4,s4,c4 #ceja et seq474 7#af7 ,the ,federal ,information ,security ,management ,act of #bjjb 7#dd ,u4,s4,c4 #ceda et seq474 7#ag7 ,the ,currency and ,foreign ,transactions ,reporting ,act of #aigj1 as amended 7commonly known as the ,bank ,secrecy ,act7 7#ab ,u4,s4,c4 #ahbi;b and #aiea-aiei1 #ca ,u4,s4,c4 #ecaa-ecad and #ecaf-eccb71 including the ,international ,money ,laundering ,abatement and ,financial ,anti-,terrorism ,act of #bjja1 title ,,iii of ,public ,law #ajg-ef1 as amended4 7#ah7 ,the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjja et seq474 7#ai7 ,the ,foreign ,intelligence ,surveillance ,act of #aigh1 as amended 7#ej ,u4,s4,c4 #ahja et seq474 7#bj7 ,the ,civil ,rights ,act of #aifd 7,public ,law #hh-ceb1 #gh ,stat4 #bda74 7#ba7 ,the ,americans with ,disabilities ,act 7#db ,u4,s4,c4 #abaja et seq474 7#bb7 ,the ,fair ,housing ,act 7#db ,u4,s4,c4 #cfja et seq474 7#bc7 ,the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #edha et seq474 7#bd7 ,the ,equal ,credit ,opportunity ,act 7#ae ,u4,s4,c4 #afia et seq474 7#be7 ,the ,age ,discrimination in ,employment ,act 7#bi ,u4,s4,c4 #fba et seq474 7#bf7 ,the ,genetic ,information ,nondiscrimination ,act 7,public ,law #aaj-bcc1 #abb ,stat4 #hha74 7#bg7 ,subpart ,a of part #df of title #de1 ,code of ,federal ,regulations 7commonly known as the ,common ,rule74 7#bh7 ,the ,driver's ,privacy ,protection ,act of #aiid 7#ah ,u4,s4,c4 #bgba et seq474 7#bi7 ,the ,video ,privacy ,protection ,act 7#ah ,u4,s4,c4 #bgaj et seq474 7#cj7 ,chapters #fa1 #fh1 #ge1 and #gf of the ,internal ,revenue ,code of #aihf4 7#ca7 ,section #aajf of the ,social ,security ,act 7#db ,u4,s4,c4 #acjf74 7#cb7 ,the ,stored ,communications ,act 7#ah ,u4,s4,c4 #bgja et seq474 7#cc7 ,any other privacy or information security provision of ,federal law4 #ejc4 ,relation to ,state law ,this ,act1 and any amendment1 standard1 rule1 requirement1 assessment1 or regulation promulgated under this ,act1 does not annul1 alter1 affect1 or exempt any person subject to the provisions of this ,act from complying with the laws of any ,state or political subdivision of a ,state with respect to privacy or consumer protection1 except to the extent that those laws are inconsistent with any provisions of this ,act1 and then only to the extent of the inconsistency4 ,for purposes of this section1 a law of a ,state or political subdivision of a ,state is not inconsistent with this ,act if the protection such law affords any consumer is greater than the protection provided by this ,act4 #ejd4 ,severability ,if any provision of this ,act or the amendments made by this ,act1 or the application thereof1 is held unconstitutional or otherwise invalid1 the validity of the remainder of the ,act1 the amendments1 and the application of such provision shall not be affected thereby4 ,,vi ,,nist and ,,nsf ,activities #fja4 ,national ,institute of ,standards and ,technology privacy research and development ,section #b of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7 is amended by adding at the end the following3 7f7 ,privacy risk management research ,in carrying out the activities under subsection 7c77#ai71 the ,director1 in consultation and collaboration with the ,director of the ,digital ,privacy ,agency1 shall1 to the extent practicable and appropriate carry out the following3 7#a7 ,develop1 and periodically update1 in collaboration with appropriate ,federal agencies1 industry1 ,state1 local1 and ,tribal governments1 civil society1 other nonprofit organizations1 and the ,information ,security and ,privacy ,advisory ,board1 a privacy risk management framework that covers risks associated with data processing and that-- 7,a7 identifies voluntary1 consensus-based technical standards1 guidelines1 best practices1 methodologies1 procedures1 and processes for-- 7i7 developing privacy-enhanced information systems and networks1 including emerging technologies2 and 7ii7 assessing and mitigating privacy risks to help organizations protect individuals' privacy in information systems and networks2 7,b7 establishes common definitions and characterizations for aspects of privacy risk management2 7,c7 provides case studies and risk profiles of framework implementation2 7,d7 provides guidance to enable organizations to use the framework to meet privacy requirements from ,federal1 ,state1 local1 and ,tribal governments and international policymakers2 7,e7 incorporates voluntary1 consensus-based technical standards and best practices2 7,f7 facilitates use by regulators and markets with the aim of reducing barriers to trade2 and 7,g7 does not prescribe or otherwise require the use of specific information or communications technology products or services4 7#b7 ,carry out research associated with mitigating privacy risks associated with information systems and networks1 including to inform periodic updates to the privacy risk management framework developed pursuant to paragraph 7#a74 7#c7 ,in consultation with the ,director of the ,digital ,privacy ,agency1 the ,federal ,trade ,commission1 and other related sector-specific risk management agencies1 support the development of guidance and risk profiles to help organizations utilize the privacy risk management framework developed pursuant to paragraph 7#a71 to the extent practicable1 to adopt privacy requirements and regulations established by the ,federal ,government1 ,states1 and international policymakers4 7#d7 ,support activities to improve the efficacy and applicability of privacy-preserving computing1 de-identification techniques and processes1 and other technological means of mitigating individuals' privacy risks by enhancing predictability1 manageability1 disassociability1 and confidentiality4 7#e7 ,support and strategically engage in the development of voluntary1 consensus-based technical standards for privacy-enhanced systems and networks1 including international technical standards1 through open1 transparent1 and consensus-based processes4 7#f7 ,conduct such other activities as determined necessary by the ,director to help public and private sector organizations mitigate the privacy risks associated with information systems and networks4 4 #fjb4 ,national privacy awareness and education initiative 7a7 ,in general ,the ,director of the ,national ,institute of ,standards and ,technology1 in consultation and collaboration with the ,director of the ,digital ,privacy ,agency1 relevant ,federal agencies1 ,state1 local1 and ,tribal governments1 industry1 educational institutions1 civil society1 and other nonprofit organizations1 as appropriate1 shall carry out privacy-related education and public awareness activities1 including relating to the following3 7#a7 ,the widespread dissemination of privacy-related technical standards and best practices identified by the ,director4 7#b7 ,efforts to make privacy-related technical standards and best practices usable by individuals1 small- to medium-sized businesses1 educational institutions1 and ,state1 local1 and ,tribal governments4 7#c7 ,activities to increase the awareness of privacy risks1 individual privacy rights1 and responsibilities4 7#d7 ,supporting the development of technical standards and best practices to describe privacy-related tasks1 knowledge1 skills1 competencies1 and work roles to guide career development1 education1 and training activities in industry1 academia1 nonprofit organizations1 and the ,federal ,government1 including support for credentialing4 7b7 ,considerations ,in carrying out subsection 7a71 the ,director of the ,national ,institute of ,standards and ,technology1 in consultation with appropriate ,federal agencies1 shall leverage1 to the extent practicable1 the national cybersecurity awareness and education program under section #cjc of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gddc74 7c7 ,biennial briefings ,not later than one year after the date of the enactment of this ,act and biennially thereafter1 the ,director of the ,national ,institute of ,standards and ,technology shall brief the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives on the activities carried out pursuant to subsection 7a74 7d7 ,authorization of appropriations ,there is authorized to be appropriated to carry out this section #c1jjj1jjj for each of fiscal years #bjbf through #bjcj4 #fjc4 ,national ,science ,foundation privacy research ,the ,director of the ,national ,science ,foundation1 in consultation and collaboration with the ,director of the ,digital ,privacy ,agency1 shall make awards on a competitive basis to institutions of higher education or non-profit organizations 7or consortia of such institutions or organizations7 to support multidisciplinary and transdisciplinary socio-technical research to design1 prototype1 and translate to practice privacy-preserving technologies and increase understanding of the human1 social1 behavioral1 and economic dimensions of such technologies1 including research on the following3 7#a7 ,public understanding1 expectations1 and perspectives on privacy4 7#b7 ,consumer privacy rights1 including right to access1 correction1 deletion1 data portability1 individual autonomy1 impermanence1 and to be informed4 7#c7 ,privacy governance and transparency1 including notice and consent processes and the efficacy of privacy policies4 7#d7 ,empowering consumers for data ownership and control4 7#e7 ,privacy by design4 7#f7 ,privacy-preserving automated decision-making systems and human review of automated decision-making systems4 7#g7 ,ensuring privacy in consumer surveillance systems4 7#h7 ,user interfaces1 including design elements that deliberately obscure1 mislead1 coerce1 or deceive consumers4 7#i7 ,privacy implications of emerging technologies4 7#aj7 ,incentives to implement privacy protections4