,i #aai? ,,congress #b;d ,session ,h4 ,r4 #hjad ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,m>* #ai1 #bjbf ,ms4 ,l(gr5 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce1 & 9 addition to ! ,committees on ! ,judici>y1 & ,sci5ce1 ,space1 & ,te*nology1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,a ,,bill ,to provide = individual rights relat+ to privacy ( p]sonal in=mation1 to e/abli% privacy & security requirem5ts = cov]$ entities relat+ to p]sonal in=mation1 & to e/abli% an ag5cy to be kn[n z ! ,digital ,privacy ,ag5cy to en=ce su* rights & requirem5ts1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,onl9e ,privacy ,act ( #bjbf4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4 ,sec4 #b4 ,def9itions4 ,sec4 #c4 ,g5]al provisions4 ,sec4 #d4 ,limitation on disclos+ nonr$act$ gov]nm5t records4 ,sec4 #e4 ,crim9al prohibition on doxx+4 ,title ,i--,individual ,rights ,sec4 #aja4 ,"r ( access4 ,sec4 #ajb4 ,"r ( correction4 ,sec4 #ajc4 ,"r ( deletion4 ,sec4 #ajd4 ,"r ( portability4 ,sec4 #aje4 ,"r to human review ( automat$ decisions4 ,sec4 #ajf4 ,"r to individual autonomy4 ,sec4 #ajg4 ,"r to be in=m$4 ,sec4 #ajh4 ,"r to imp]man5ce4 ,sec4 #aji4 ,exemptions1 exceptions1 fees1 timel9es1 & rules ( con/ruction = rights "u ?is title4 ,title ,,ii--,requirem5ts = ,cov]$ ,entities1 ,s]vice ,provid]s1 & ,?ird ,p>ties ,sec4 #bja4 ,m9imization4 ,sec4 #bjb4 ,m9imization & records ( access by employees & contractors4 ,sec4 #bjc4 ,prohibitions on disclos+ ( p]sonal in=mation4 ,sec4 #bjd4 ,disclos+ to entities n subject to ,unit$ ,/ates jurisdiction or n compliant ) ?is ,act4 ,sec4 #bje4 ,prohibition on re-id5tification4 ,sec4 #bjf4 ,re/rictions on collect+1 process+1 ma9ta9+1 & disclos+ cont5ts ( communications4 ,sec4 #bjg4 ,prohibition on discrim9atory process+4 ,sec4 #bjh4 ,requirem5ts = notice & cons5t processes & privacy policies4 ,sec4 #bji4 ,prohibition on d>k patt]ns 9 notice & cons5t processes & privacy policies4 ,sec4 #baj4 ,notice & cons5t requir$4 ,sec4 #baa4 ,privacy policy4 ,sec4 #bab4 ,in=mation security requirem5ts4 ,sec4 #bac4 ,notification ( data brea* or data-%>+ abuse4 ,title ,,iii--,digital ,privacy ,ag5cy ,sec4 #cja4 ,e/abli%m5t2 ,director & ,deputy ,director4 ,sec4 #cjb4 ,ag5cy p[]s & au?orities4 ,sec4 #cjc4 ,report+ & audit requirem5ts4 ,sec4 #cjd4 ,relation to o!r ag5cies4 ,sec4 #cje4 ,p]sonnel4 ,sec4 #cjf4 ,(fice ( ,civil ,rights4 ,sec4 #cjg4 ,compla9ts ( individuals4 ,sec4 #cjh4 ,advisory bo>ds4 ,sec4 #cji4 ,au?orization ( appropriations4 ,title ,,iv--,en=cem5t ,sec4 #dja4 ,inve/igations & adm9i/rative discov]y4 ,sec4 #djb4 ,he>+s & adjudication proce$+s4 ,sec4 #djc4 ,litigation au?ority4 ,sec4 #djd4 ,en=cem5t by ,/ates4 ,sec4 #dje4 ,private rights ( action4 ,sec4 #djf4 ,relief available4 ,sec4 #djg4 ,ref]ral = crim9al proce$+s4 ,sec4 #djh4 ,:i/lebl[] en=cem5t4 ,title ,v--,relation to ,o!r ,law ,sec4 #eja4 ,effective date4 ,sec4 #ejb4 ,relation to o!r ,f$]al law4 ,sec4 #ejc4 ,relation to ,/ate law4 ,sec4 #ejd4 ,sev]ability4 ,title ,,vi--,,ni/ & ,,nsf ,activities ,sec4 #fja4 ,national ,in/itute ( ,/&>ds & ,te*nology privacy rese>* & developm5t4 ,sec4 #fjb4 ,national privacy aw>5ess & education initiative4 ,sec4 #fjc4 ,national ,sci5ce ,f\ndation privacy rese>*4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,behavioral p]sonalization 7,a7 ,9 g5]al ,! t]m behavioral p]sonalization means ! process+ ( ! p]sonal in=mation ( an individual1 us+ an algori?m1 model1 or o!r means-- 7i7 built us+-- 7,i7 t individual's p]sonal in=mation collect$ ov] a p]iod ( "t2 or 7,,ii7 an aggregate ( ! in=mation ( "o or m simil>ly situat$ individuals2 & 7ii7 design$ to-- 7,i7 alt]1 influ5ce1 guide1 or pr$ict t individual's behavior2 7,,ii7 tailor or p]sonalize a product or s]vice to t individual2 or 7,,iii7 filt]1 sort1 limit1 promote1 display or o!rwise diff]5tiate betwe5 specific cont5t or categories ( cont5t t w\ld o!rwise be accessible to t individual4 7,b7 ,exclusions ,! t]m behavioral p]sonalization does n include ! use ( hi/orical p]sonal in=mation to m]ely prev5t ! display ( or provide additional in=mation ab\t previ\sly access$ cont5t4 7#b7 ,collect ,! t]m collect includes1 ) respect to p]sonal in=mation or ! cont5ts ( any communication1 obta9+ su* in=mation or cont5ts 9 any mann]1 except :5 solely transmitt+1 r\t+1 provid+ int]m$iate /orage =1 or provid+ connections = su* p]sonal in=mation or communication ?r\gh a sy/em or network4 7#c7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#d7 ,cont5ts ,! t]m cont5ts1 :5 us$ ) respect to communication1 has ! mean+ giv5 su* t]m 9 section #beaj ( title #ah1 ,unit$ ,/ates ,code4 7#e7 ,cov]$ entity 7,a7 ,9 g5]al ,! t]m cov]$ entity means a p]son :o-- 7i7 int5tionally collects1 processes1 or ma9ta9s p]sonal in=mation2 & 7ii7 s5ds or receives su* p]sonal in=mation ov] ! int]net or a simil> communications network4 7,b7 ,exclusion ,! t]m cov]$ entity does n include a natural p]son1 except to ! ext5t su* p]son is engag$ 9 a comm]cial activity t is m ?an de m9imis4 7,c7 ,de m9imis def9$ ,9 ?is p>agraph1 ! t]m de m9imis means incid5tal comm]cial activity by a natural p]son t-- 7i7 g5]ates n m ?an #e1jjj 9 gross rev5ue 9 a #ab-mon? p]iod2 or 7ii7 involves ! p]sonal in=mation ( few] ?an #e1jjj individuals 9 su* p]iod4 7#f7 ,cu/odian ,! t]m cu/odian means ! cu/odian or any deputy cu/odian designat$ by ! ,director ( ! ,digital ,privacy ,ag5cy4 7#g7 ,data brea* ,! t]m data brea* means unau?oriz$ access to or acquisition ( p]sonal in=mation or cont5ts ( communications ma9ta9$ by su* cov]$ entity4 7#h7 ,data-%>+ abuse ,! t]m data-%>+ abuse means process+1 by a ?ird p>ty1 ( p]sonal in=mation or cont5ts ( communications disclos$ by a cov]$ entity to ! ?ird p>ty1 = any purpose o!r ?an-- 7,a7 a purpose specifi$ by ! cov]$ entity to ! ?ird p>ty at ! "t su* p]sonal in=mation or cont5ts ( communications 0 disclos$2 or 7,b7 a purpose to :i* ! individual to :om ! in=mation relates has cons5t$4 7#i7 ,de-id5tify 7,a7 ,9 g5]al ,! t]m de-id5tify means1 ) respect to in=mation1 p]=m+ actions s t su* in=mation _c reasonably id5tify1 relate to1 describe1 ref]5ce1 be capable ( be+ associat$ )1 or be l9k$1 directly or indirectly1 to a p>ticul> individual or device1 b only to ! ext5t t ! cov]$ entity t uses su* in=mation-- 7i7 has p]=m$ su* actions us+ be/ practices = ! types ( data su* in=mation conta9s2 7ii7 has implem5t$ te*nical safegu>ds t prohibit re-id5tification ( ! individual ) :om su* in=mation 0 l9k$2 7iii7 has implem5t$ bus9ess processes t specifically prohibit re-id5tification ( ! in=mation2 7iv7 has implem5t$ bus9ess processes to prev5t inadv]t5t release ( su* in=mation2 & 7v7 makes no attempt to re-id5tify su* in=mation4 7,b7 ,det]m9ation by ! director ,! ,director may det]m9e t a me?odology ( de-id5tify+ p]sonal in=mation is insuffici5t = ! purposes ( ?is p>agraph4 7#aj7 ,digital ,privacy ,ag5cy ,! t]m ,digital ,privacy ,ag5cy means ! ,digital ,privacy ,ag5cy e/abli%$ "u section #cja4 7#aa7 ,digital ,privacy ,ag5cy inve/igator ,! t]m ,digital ,privacy ag5cy inve/igator means any attorney or inve/igator employ$ by ! ,digital ,privacy ,ag5cy :o is *>g$ ) ! en=cem5t ( or c>ry+ out ( any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act4 7#ab7 ,director ,! t]m ,director means ! ,director ( ! ,digital ,privacy ,ag5cy4 7#ac7 ,disclose ,! t]m disclose means1 ) respect to p]sonal in=mation or cont5ts ( communication1 to sell1 release1 transf]1 %>e1 dissem9ate1 make available1 or o!rwise cause to be communicat$1 su* in=mation or cont5ts to a ?ird p>ty4 7#ad7 ,docum5t>y mat]ial ,! t]m docum5t>y mat]ial includes ! orig9al or any copy ( any book1 docum5t1 record1 report1 memor&um1 pap]1 communication1 tabulation1 *>t1 logs1 electronic files1 or o!r data or data compilations /or$ 9 any m$ium4 7#ae7 ,f$]al ag5cy ,! t]m ,f$]al ag5cy has ! mean+ giv5 t t]m 9 section #ccga ( title #e1 ,unit$ ,/ates ,code4 7#af7 ,f$]al privacy laws ,! t]m ,f$]al privacy laws includes ! laws & regulations describ$ 9 section #ejb4 7#ag7 ,gov]nm5t entity ,! t]m gov]nm5t entity means-- 7,a7 a ,f$]al ag5cy2 7,b7 a ,/ate or political subdivision !re(2 or 7,c7 any ag5cy1 au?ority1 or in/rum5tality ( a ,/ate or political subdivision !re(4 7#ah7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7#ai7 ,indian ,tribe ,! t]m ,indian ,tribe has ! mean+ giv5 su* t]m 9 section #d7;e7 ( ! ,indian ,self-,det]m9ation & ,education ,assi/ance ,act 7#be ,u4,s4,c4 #ecjd7;e774 7#bj7 ,ma9ta9 ,! t]m ma9ta9 means1 ) respect to p]sonal in=mation or ! cont5ts ( any communication1 to /ore1 secure1 or o!rwise cause ! ret5tion ( su* in=mation or cont5ts1 or to take actions necess>y = /or+1 secur+1 or o!rwise caus+ ! ret5tion ( su* in=mation or cont5ts4 7#ba7 ,nonpublic in=mation ,! t]m nonpublic in=mation means in=mation t has n be5 disclos$ 9 a crim9al1 civil1 or adm9i/rative proce$+1 9 a gov]nm5t inve/igation1 report1 or audit1 or by ! news m$ia or o!r public s\rce ( in=mation1 & t 0 n obta9$ 9 violation ( ! law4 7#bb7 ,p]sonal in=mation 7,a7 ,9 g5]al ,! t]m p]sonal in=mation means any in=mation ma9ta9$ by a cov]$ entity t1 on its own or comb9$ ) o!r in=mation1 is l9k$ or reasonably l9kable to a specific individual or a specific device1 includ+ de-id5tifi$ p]sonal in=mation & ! means to behavioral p]sonalization creat$ = or l9k$ to a specific individual4 7,b7 ,exclusions ,! t]m p]sonal in=mation does n include-- 7i7 publicly available in=mation l9k$ to an individual if t in=mation 0 n unlawfully made public2 or 7ii7 in=mation d]iv$ or inf]r$ f p]sonal in=mation1 if ! d]iv$ or inf]r$ in=mation is n l9k$ or reasonably l9kable to a specific individual4 7#bc7 ,privacy h>m ,! t]m privacy h>m means an adv]se consequ5ce or a pot5tial adv]se consequ5ce to an individual1 a gr\p ( individuals1 or society caus$ f collect+1 process+1 ma9ta9+1 or disclos+ ( p]sonal in=mation or cont5ts ( communications1 includ+-- 7,a7 direct or indirect f9ancial loss or economic h>m2 7,b7 physical h>m2 7,c7 psy*ological h>m1 includ+ anxiety1 emb>rassm5t1 fe>1 & o!r trauma2 7,d7 adv]se outcomes or decisions ) respect to ! eligibility ( an individual = rights1 b5efits1 or privileges 9 employm5t 7includ+ hir+1 fir+1 promotion1 demotion1 & comp5sation71 cr$it & insurance 7includ+ d5ial ( an application or obta9+ less favorable t]ms71 h\s+1 education1 pr(essional c]tification1 or ! provision ( heal? c>e & relat$ s]vices2 7,e7 /igmatization or reputational h>m2 7,f7 price discrim9ation2 7,g7 adv]se consequ5ces t affect ! private life ( an individual1 includ+ private family matt]s & actions & communications )9 ! home ( su* individual or a simil> physical1 onl9e1 or digital location :]e su* individual has a reasonable expectation t p]sonal in=mation w n be collect$1 process$1 or ma9ta9$2 7,h7 ! *ill+ ( free expression or action ( an individual1 a gr\p ( individuals1 or society1 due to p]ceiv$ or actual p]vasive & excessive collect+1 process+1 disclos+1 or ma9ta9+ ( p]sonal in=mation or cont5ts ( communications2 7,i7 impair+ ! autonomy ( an individual1 a gr\p ( individuals1 or society2 & 7,j7 o!r adv]se consequ5ces or pot5tial adv]se consequ5ces1 consi/5t ) ! provisions ( ?is ,act1 z det]m9$ by ! ,director4 7#bd7 ,privacy-pres]v+ comput+ 7,a7 ,9 g5]al ,! t]m privacy-pres]v+ comput+ means ! collect+1 process+1 disclos+1 or ma9ta9+ ( p]sonal in=mation t has be5 encrypt$ or o!rwise r5d]$ un9telligible us+ a means t _c be rev]s$ by a cov]$ entity1 or a cov]$ entity's s]vice provid]1 su* t-- 7i7 if su* p]sonal in=mation c\ld be r5d]$ intelligible ?r\gh coop]ation or %>+ ( cryptographic secrets by multiple p]sons1 ! cov]$ entity has bo? te*nical safegu>ds & bus9ess processes to prev5t su* coop]ation or %>+2 7ii7 if su* p]sonal in=mation is r5d]$ intelligible )9 a h>dw>e process+ unit or o!r means ( p]=m+ op]ations on ! in=mation1 !re are te*nical safegu>ds t1 dur+ ! normal c\rse ( op]ation-- 7,i7 prev5t r5d]+ p]sonal in=mation intelligible any:]e b )9 ! h>dw>e process+ unit or o!r means ( p]=m+ op]ations2 & 7,,ii7 make ! export+ or o!rwise obs]v+ ( su* intelligible in=mation1 or ! cryptographic secret us$ to protect su* in=mation1 impossible2 & 7iii7 if ! result ( su* process+ ( ! p]sonal in=mation is also p]sonal in=mation1 su* result mu/ be un9telligible to ! cov]$ entity or s]vice provid] & protect$ by privacy-pres]v+ comput+4 7,b7 ,insuffici5t me?odologies ,! ,director may det]m9e t a me?odology ( privacy-pres]v+ comput+ is insuffici5t = ! purposes ( ?is def9ition4 7#be7 ,process ,! t]m process means to p]=m or cause to be p]=m$ any op]ation or set ( op]ations on p]sonal in=mation or cont5ts ( communication1 :e!r or n by automat$ means4 7#bf7 ,protect$ class ,! t]m protect$ class means ! actual or p]ceiv$ race1 color1 e?nicity1 national orig91 religion1 sex 7includ+ sexual ori5tation & g5d] id5tity or expression71 familial /atus1 or disability ( an individual or gr\p ( individuals4 7#bg7 ,publicly available in=mation ,! t]m publicly available in=mation-- 7,a7 means-- 7i7 in=mation t is lawfully made available f a gov]nm5t entity2 7ii7 in=mation l9k$ to a public individual or (ficial t is made publicly accessible1 )\t re/rictions on accessibility o!r ?an ! g5]al au?orization to access ! s]vices us$ to make ! in=mation accessible2 or 7iii7 in=mation ( an individual t-- 7,i7 is made publicly accessible by su* individual1 )\t re/rictions on accessibility o!r ?an ! g5]al au?orization to access ! s]vices us$ to make ! in=mation accessible2 & 7,,ii7 su* individual has ! ability to delete or *ange )\t rely+ on a reque/ "u section #ajb or #ajc2 & 7,b7 does n include-- 7i7 biometric in=mation ( an individual collect$ by a cov]$ entity )\t ! individual's k2 7ii7 in=mation us$ = a purpose t is n compatible ) ! purpose = :i* ! in=mation is ma9ta9$ & made available 9 gov]nm5t records2 7iii7 in=mation obta9$ f gov]nm5t records = ! purpose ( sell+ su* in=mation2 or 7iv7 in=mation us$ to contact or locate a private individual ei!r physically or electronically4 7#bh7 ,reasonable me*anism ,! t]m reasonable me*anism means1 9 ! case ( a me*anism = individuals to ex]cise a "r "u title ,i or int]act ) a cov]$ entity "u title ,,ii1 a me*anism t-- 7,a7 is equival5t 9 availability & ease ( use to t ( o!r me*anisms = communicat+ or int]act+ ) ! cov]$ entity2 & 7,b7 includes an onl9e means ( ex]cis+ su* "r or engag+ 9 su* int]action1 if su* individuals communicate or int]act ) su* cov]$ entity ?r\gh an onl9e m$ium or if su* cov]$ entity provides in=mation process+ s]vices ?r\gh a public or widely available application programm+ int]face 7or simil> me*anism74 7#bi7 ,sell & sale 7,a7 ,9 g5]al ,! t]ms sell & sale mean ! disclos+ ( p]sonal in=mation = monet>y consid]ation or = a ?+ ( value by a cov]$ entity to a ?ird p>ty = ! purposes ( process+1 ma9ta9+ or disclos+ su* p]sonal in=mation at ! ?ird p>ty's discretion4 7,b7 ,exclusions ,! t]ms sell & sale d n include-- 7i7 ! disclos+ ( p]sonal in=mation ( an individual to a ?ird p>ty ) :i* ! individual has a direct relation%ip = purposes ( provid+ a product or s]vice reque/$ by ! individual or o!rwise 9 a mann] t is consi/5t ) an individual's reasonable expectations consid]+ ! context 9 :i* ! individual provid$ ! p]sonal in=mation to ! cov]$ entity2 7ii7 ! disclos+ or transf] ( p]sonal in=mation to a subsidi>y or an affiliate ( ! cov]$ entity2 or 7iii7 ! disclos+ or transf] ( p]sonal in=mation to a ?ird p>ty z an asset t is "p ( a m]g]1 acquisition1 bankruptcy1 or o!r transaction 9 :i* ! ?ird p>ty assumes control ( all or "p ( ! cov]$ entity's assets1 unless p]sonal in=mation makes up ! majority ( ! value ( ! assets ( :i* ! ?ird p>ty assumes control4 7#cj7 ,s]vice provid] 7,a7 ,9 g5]al ,! t]m s]vice provid] means a cov]$ entity t-- 7i7 processes1 discloses1 or ma9ta9s p]sonal in=mation1 :]e su* cov]$ entity does n process1 disclose1 or ma9ta9 ! p]sonal in=mation o!r ?an 9 accordance ) ! directions & on behalf ( ano!r cov]$ entity2 7ii7 does n directly collect p]sonal in=mation f or control ! me*anism = collect+ p]sonal in=mation f an individual2 7iii7 does n e>n rev5ue f process+1 ma9ta9+1 or disclos+ p]sonal in=mation disclos$ to su* cov]$ entity by ano!r cov]$ entity except by provid+ contract$ s]vices to su* o!r cov]$ entity2 7iv7 does n disclose p]sonal in=mation to ano!r cov]$ entity unless su* p]sonal in=mation 0 provid$ by su* o!r cov]$ entity or result$ f ma9ta9+ or process+ p]=m$ on p]sonal in=mation exclusively provid$ by su* o!r cov]$ entity2 7v7 does n (f] s]vices t all[ ano!r cov]$ entity to t>get specific individuals us+ p]sonal in=mation n provid$ by su* o!r cov]$ entity2 7vi7 ) respect to p]sonal in=mation process$ or ma9ta9$ by su* cov]$ entity on behalf ( ano!r cov]$ entity1 assi/s su* o!r cov]$ entity 9 comply+ ) title ,i1 includ+ provid+ tools = su* o!r cov]$ entity to comply ) su* requirem5ts if reque/$2 & 7vii7 does n l9k ! p]sonal in=mation provid$ by ano!r cov]$ entity to p]sonal in=mation f any o!r s\rce4 7,b7 ,treatm5t ,a cov]$ entity %all be treat$ z a s]vice provid] "u ?is ,act only to ! ext5t t su* cov]$ entity is act+ z a s]vice provid]1 z def9$ 9 subp>agraph 7,a74 7#ca7 ,significant privacy h>m ,! t]m significant privacy h>m means adv]se consequ5ces to an individual aris+ f ! collect+1 process+1 ma9ta9+1 or disclos+ ( p]sonal in=mation or cont5ts ( communications1 limit$ to subp>agraph 7,a71 7,b71 or 7,d7 ( p>agraph 7#bc74 7#cb7 ,small bus9ess ,! t]m small bus9ess means a cov]$ entity t-- 7,a7 does n e>n rev5ue f ! sale ( p]sonal in=mation2 7,b7 e>ns less ?an half ( annual rev5ues f ! process+ ( p]sonal in=mation = t>get$ or p]sonaliz$ adv]tis+2 7,c7 has n1 9 comb9ation ) ea* subsidi>y & affiliate ( ! s]vice1 ma9ta9$ p]sonal in=mation ( #bej1jjj or m individuals = #c or m ( ! prec$+ #ab mon?s2 7,d7 has few] ?an #bjj employees2 & 7,e7 receiv$ less ?an #be1jjj1jjj 9 gross rev5ue 9 ! prec$+ #ab-mon? p]iod4 7#cc7 ,/ate ,! t]m ,/ate means ea* ,/ate ( ! ,unit$ ,/ates1 ! ,di/rict ( ,columbia1 ea* commonweal?1 t]ritory1 or possession ( ! ,unit$ ,/ates1 & ea* f$]ally recogniz$ ,indian ,tribe4 7#cd7 ,/ate attorney g5]al ,! t]m ,/ate attorney g5]al means1 ) respect to a ,/ate1 ! attorney g5]al or *ief law en=cem5t (fic] ( ! ,/ate1 or ano!r (ficial or ag5cy designat$ by ! ,/ate to br+ civil actions on behalf ( ! ,/ate or ! resid5ts ( ! ,/ate4 7#ce7 ,/ate privacy regulator ,! t]m ,/ate privacy regulator means an ag5cy or in/rum5tality ( a ,/ate t has ! prim>y purpose ( adm9i/]+1 implem5t+1 or en=c+ a privacy law or associat$ rules or regulations4 7#cf7 ,?ird p>ty ,! t]m ?ird p>ty means1 ) respect to a cov]$ entity1 a p]son-- 7,a7 to :i* su* cov]$ entity disclos$ p]sonal in=mation2 & 7,b7 t is n-- 7i7 su* cov]$ entity2 7ii7 a subsidi>y or corporate affiliate ( su* cov]$ entity2 or 7iii7 a s]vice provid] ( su* cov]$ entity4 7#cg7 ,us]s ,! t]m us]s means1 ) respect to a product or s]vice1 ! mon?ly active us]s1 subscrib]s1 or cu/om]s 7or a reasonable proxy or sub/itute !re= det]m9$ by ! ,director7 ( su* product or s]vice4 7#ch7 ,violation ,! t]m violation means1 except :]e o!rwise specifi$1 any act or omission t1 if prov$1 w\ld con/itute a violation ( any provision ( ?is ,act or a rule or ord] issu$ pursuant to ?is ,act4 #c4 ,g5]al provisions 7a7 ,rules ( con/ruction ) respect to p]sonal in=mation & individuals ,9 ?is ,act-- 7#a7 any ref]5ce to in=mation z be+ ( or belong+ to an individual %all be con/ru$ to mean t su* in=mation is l9k$ or reasonably l9kable to su* individual z describ$ 9 section #b7ba77;,a72 & 7#b7 any ref]5ce to any communication z be+ ( or belong+ to an individual %all be con/ru$ to mean t su* individual is p>ty to su* communication4 7b7 ,prohibition on waiv]s 7#a7 ,9 g5]al ,! provisions "u ?is ,act may n be waiv$4 ,any agreem5t purport+ to waive compliance ) or modify+ any provision ( ?is ,act %all be void z contr>y to public policy4 7#b7 ,prohibition on pr$ispute arbitration agreem5ts ,no pr$ispute arbitration agreem5t %all be valid or en=ceable ) respect to any claims "u ?is ,act4 7c7 ,j\rnalism protection 7#a7 ,9 g5]al ,cov]$ entities engag$ 9 j\rnalism %all n be subject to ! obligations impos$ "u ?is ,act to ! ext5t t ^? obligations directly infr+e on ! j\rnalism r ?an ! bus9ess practices ( ! cov]$ entity1 s long z ! cov]$ entity has te*nical safegu>ds & bus9ess processes t prev5t ! collect+1 process+1 ma9ta9+1 or disclos+ ( su* p]sonal in=mation = bus9ess practices o!r ?an j\rnalism4 7#b7 ,j\rnalism ,! t]m j\rnalism includes ! collect+1 ma9ta9+1 process+1 & disclos+ ( p]sonal in=mation ab\t a public individual or (ficial1 or t o!rwise conc]ns matt]s ( public int]e/1 = dissem9ation to ! public4 7d7 ,small bus9ess compliance ramp ,^u los+ its /atus z a small bus9ess1 a cov]$ entity %all h n9e mon?s to comply ) provisions ( ?is ,act t a small bus9ess is exempt f comply+ )4 7e7 ,prohibition on collect+1 ma9ta9+1 process+1 or disclos+ p]sonal in=mation ,a cov]$ entity may n collect1 ma9ta91 process1 or disclose p]sonal in=mation us+ a *annel ( int]/ate comm]ce unless su* cov]$ entity is 9 compliance ) all requirem5ts ( ?is ,act4 #d4 ,limitation on disclos+ nonr$act$ gov]nm5t records 7a7 ,9 g5]al ,a gov]nm5t entity may n use a *annel ( int]/ate comm]ce to disclose ! p]sonal in=mation ( an individual 9 a gov]nm5t record )\t an agreem5t prohibit+ ! recipi5t ( su* in=mation f sell+ ! in=mation )\t ! express cons5t ( ! individual4 7b7 ,exception ,not)/&+ subsection 7a71 ?is section does n prohibit ! disclosure ( p]sonal in=mation us+ a *annel ( int]/ate comm]ce to ano!r gov]nm5t entity )\t cons5t ( ! individual4 #e4 ,crim9al prohibition on doxx+ 7a7 ,9 g5]al ,*apt] #da ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #hha4 ,disclos+ ( p]sonal in=mation ) ! int5t to cause h>m 7a7 ,9 g5]al ,:oev] uses a *annel ( int]/ate or =eign comm]ce to kn[+ly disclose an individual's p]sonal in=mation ) ! int5t-- 7#a7 to ?reat51 intimidate1 or h>ass any p]son1 incite or facilitate ! commission ( a crime ( viol5ce aga9/ any p]son1 or place any p]son 9 reasonable fe> ( dea? or s]i\s bodily injury2 or 7#b7 t ! in=mation w be us$ to ?reat51 intimidate1 or h>ass any p]son1 incite or facilitate ! commission ( a crime ( viol5ce aga9/ any p]son1 or place any p]son 9 reasonable fe> ( dea? or s]i\s bodily injury1 %all be f9$ "u ?is title or imprison$ n m ?an #e ye>s1 or bo?4 7b7 ,digital ,privacy ,ag5cy 7#a7 ,support functions ,! ,director ( ! ,digital ,privacy ,ag5cy may-- 7,a7 receive compla9ts & ref] cr$ible compla9ts to ! ,attorney ,g5]al2 7,b7 coord9ate ) appropriate law en=cem5t ag5cies to support inve/igations2 & 7,c7 provide te*nical assi/ance ^u ! reque/ ( ! ,attorney ,g5]al4 7#b7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to au?orize ! ,digital ,privacy ,ag5cy to prosecute an (f5se "u ?is section4 7c7 ,def9itions ,9 ?is section3 7#a7 ,cont5ts ,! t]m cont5ts :5 us$ ) respect to communication1 has ! mean+ giv5 su* t]m 9 section #beaj ( ?is title4 7#b7 ,disclose ,! t]m disclose means1 ) respect to p]sonal in=mation or cont5ts ( communication1 to sell1 release1 transf]1 %>e1 dissem9ate1 make available1 or o!rwise cause to be communicat$ su* in=mation or cont5ts to a ?ird p>ty4 7#c7 ,gov]nm5t entity ,! t]m gov]nm5t entity means-- 7,a7 a ,f$]al ag5cy 7z t t]m is def9$ 9 section #ccga ( title #e72 7,b7 a ,/ate or political subdivision !re(2 or 7,c7 any ag5cy1 au?ority1 or in/rum5tality ( a ,/ate or political subdivision !re(4 7#d7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7#e7 ,p]sonal in=mation 7,a7 ,9 g5]al ,! t]m p]sonal in=mation means any in=mation ma9ta9$ by a p]son t1 on its own or comb9$ ) o!r in=mation1 is l9k$ or reasonably l9kable to a specific individual4 7,b7 ,exclusions ,! t]m p]sonal in=mation does n include-- 7i7 publicly available in=mation l9k$ to an individual2 or 7ii7 in=mation d]iv$ or inf]r$ f p]sonal in=mation1 if ! d]iv$ or inf]r$ in=mation is n l9k$ or reasonably l9kable to a specific individual4 7#f7 ,publicly available in=mation ,! t]m publicly available in=mation-- 7,a7 means-- 7i7 in=mation t is lawfully made available f a gov]nm5t entity2 7ii7 in=mation l9k$ to a public individual or (ficial t is made publicly accessible1 )\t re/rictions on accessibility o!r ?an ! g5]al au?orization to access ! s]vices us$ to make ! in=mation accessible2 or 7iii7 in=mation ( an individual t-- 7,i7 is made publicly accessible by su* individual1 )\t re/rictions on accessibility o!r ?an ! g5]al au?orization to access ! s]vices us$ to make ! in=mation accessible2 & 7,,ii7 su* individual has ! ability to delete or *ange2 & 7,b7 does n include-- 7i7 biometric in=mation ( an individual collect$ by a cov]$ entity )\t ! individual's k2 7ii7 in=mation us$ = a purpose t is n compatible ) ! purpose = :i* ! in=mation is ma9ta9$ & made available 9 gov]nm5t records2 7iii7 in=mation obta9$ f gov]nm5t records = ! purpose ( sell+ su* in=mation2 or 7iv7 in=mation us$ to contact or locate a private individual ei!r physically or electronically4 7#g7 ,/ate ,! t]m ,/ate means ea* ,/ate ( ! ,unit$ ,/ates1 ! ,di/rict ( ,columbia1 ea* commonweal?1 t]ritory1 or possession ( ! ,unit$ ,/ates1 & ea* f$]ally recogniz$ ,indian ,tribe4 4 7b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #da ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] ! item relat+ to section #hhj ! foll[+3 #hha4 ,disclos+ ( p]sonal in=mation ) ! int5t to cause h>m4 4 ,i ,individual ,rights #aja4 ,"r ( access 7a7 ,9 g5]al ,a cov]$ entity %all make available a reasonable me*anism by :i* an individual may access-- 7#a7 ! categories ( p]sonal in=mation & cont5ts ( communications ( su* individual t is ma9ta9$ by su* cov]$ entity1 includ+1 9 ! case ( p]sonal in=mation t su* cov]$ entity did n collect f su* individual1 h[ & f :om su* cov]$ entity obta9$ su* p]sonal in=mation2 7#b7 a li/ ( ! ?ird p>ties1 subsidi>ies1 & corporate affiliates1 to :i* su* cov]$ entity has disclos$ & f :i* su* cov]$ entity has1 at any "t on or aft] ! effective date ( ?is ,act1 obta9$ ! p]sonal in=mation ( su* individual2 7#c7 a concise & cle> description ( ! bus9ess or comm]cial purposes ( su* cov]$ entity-- 7,a7 = collect+1 process+1 or ma9ta9+ ! p]sonal in=mation ( su* individual2 & 7,b7 = disclos+ to a ?ird p>ty ! p]sonal in=mation ( su* individual2 & 7#d7 a li/ ( automat$ decision-mak+ processes t an individual has a "r to reque/ human review ( "u section #aje ) a concise & cle> description ( ! implications & int5d$ effects ( ea* su* process4 7b7 ,exception = publicly accessible in=mation ,a cov]$ entity t makes available in=mation requir$ 9 subsection 7a7 %all be consid]$ 9 compliance ) su* requirem5ts if ! cov]$ entity provides an individual ) in/ructions on h[ to access a public po/+ ( su* in=mation1 includ+ 9 a privacy policy1 if ! in/ructions are easy & d n require paym5t4 7c7 ,small bus9esses exclud$ ,subsection 7a77#c7 does n apply to a small bus9ess4 #ajb4 ,"r ( correction 7a7 ,dispute by individual ,a cov]$ entity %all make available a reasonable me*anism by :i* an individual may dispute ! accuracy or complet5ess ( p]sonal in=mation l9k$ to su* individual t is ma9ta9$ by su* cov]$ entity if su* in=mation is process$ 9 any way1 by su* cov]$ entity1 a ?ird p>ty ( su* cov]$ entity1 or a s]vice provid] ( su* cov]$ entity t may increase reasonably =eseeable significant privacy h>ms4 7b7 ,correction by cov]$ entity ,a cov]$ entity receiv+ a dispute "u subsection 7a7 %all-- 7#a7 correct or complete 7z ! case may be7 ! disput$ in=mation & notify su* individual t ! correction or completion has be5 made2 or 7#b7 notify su* individual t-- 7,a7 ! disput$ in=mation is correct or complete2 7,b7 su* cov]$ entity lacks suffici5t in=mation to correct or complete ! disput$ in=mation2 or 7,c7 su* cov]$ entity is d5y+ ! reque/ = correction or completion 9 reliance on an exemption or exception provid$ by section #aji7;g74 7c7 ,small bus9esses exclud$ ,?is section does n apply to a small bus9ess4 #ajc4 ,"r ( deletion 7a7 ,reque/ by individual ,a cov]$ entity %all make available a reasonable me*anism by :i* an individual may reque/ ! deletion ( p]sonal in=mation & cont5ts ( communications ( su* individual ma9ta9$ by su* cov]$ entity1 includ+ any su* in=mation t su* cov]$ entity acquir$ f a ?ird p>ty or inf]r$ f o!r in=mation ma9ta9$ by su* cov]$ entity4 7b7 ,deletion by cov]$ entity ,a cov]$ entity receiv+ a reque/ = deletion "u subsection 7a7 %all-- 7#a7 delete su* in=mation & notify su* individual t su* in=mation has be5 delet$2 or 7#b7 notify su* individual t su* cov]$ entity is d5y+ ! reque/ = deletion 9 reliance on an exemption or exception provid$ by section #aji7;g74 #ajd4 ,"r ( portability 7a7 ,det]m9ation ( portable categories 7#a7 ,annual det]m9ation ,n less frequ5tly ?an once p] cal5d> ye>1 ! ,director %all-- 7,a7 e/abli% categories ( products & s]vices (f]$ by cov]$ entities1 bas$ on simil>ities 9 ! products & s]vices2 7,b7 det]m9e :i* categories e/abli%$ "u subp>agraph 7,a7 are portable categories2 & 7,c7 publi% 9 ! ,f$]al ,regi/] a li/ ( portable categories det]m9$ "u subp>agraph 7,b74 7#b7 ,opportunity = public comm5t ,be=e publi%+ ! f9al li/ "u p>agraph 7#a77;,c71 ! ,director %all-- 7,a7 publi% a draft ( su* li/ 9 ! ,f$]al ,regi/]2 & 7,b7 provide an opportunity = public comm5t on su* draft li/4 7b7 ,ex]cise ( "r 7#a7 ,9 g5]al ,a cov]$ entity t (f]s a product or s]vice 9 a portable category & t ma9ta9s p]sonal in=mation or ! cont5ts ( any communications ( an individual %all make available to su* individual a reasonable me*anism by :i* su* individual may-- 7,a7 d[nload1 9 a =mat t is /ructur$1 commonly us$1 & ma*9e readable-- 7i7 any su* p]sonal in=mation t su* individual has provid$ to su* cov]$ entity1 ) ! option to d[nload su* in=mation by category t is accessible "u section #aja2 & 7ii7 ! cont5ts ( any su* communications2 & 7,b7 us+ a real-"t application programm+ int]face1 or simil> me*anism1 transmit all su* p]sonal in=mation 7:e!r or n provid$ to su* cov]$ entity by su* individual7 & ! cont5ts ( any su* communication f su* cov]$ entity to ano!r cov]$ entity 9 accordance ) subsection 7c74 7#b7 ,requirem5ts = application programm+ int]face ,! application programm+ int]face1 or simil> me*anism1 requir$ by p>agraph 7#a77;,b7 %all-- 7,a7 be publicly docum5t$2 7,b7 all[ ! option ( obta9+ any p]sonal in=mation ( an individual t ! individual has provid$ to ! cov]$ entity1 if su* in=mation is accessible "u section #aja2 7,c7 include a publicly available1 fully functional te/ v]sion = developm5t purposes2 & 7,d7 be ( simil> quality to me*anisms us$ int]nally by ! cov]$ entity4 7c7 ,requirem5ts = access to an application programm+ int]face 7#a7 ,access ,except z provid$ 9 p>agraph 7#b77;,a71 a cov]$ entity %all provide access to ! application programm+ int]face or simil> me*anism requir$ by subsection 7b77#a77;,b7 ^u ! reque/ ( ano!r cov]$ entity if ! reque/+ cov]$ entity has self-c]tifi$1 us+ ! proc$ures e/abli%$ by ! ,director "u p>agraph 7#c77;,a71 t su* reque/+ cov]$ entity-- 7,a7 is a cov]$ entity2 7,b7 c h p]sonal in=mation disclos$ to x "u section #bjd2 7,c7 is1 at ! "t ( ! self-c]tification1 9 compliance ) all applicable requirem5ts ( ?is ,act 7includ+ provisions a small bus9ess is o!rwise exempt f comply+ )72 7,d7 w cont9ue to comply ) all requirem5ts ( ?is ,act2 & 7,e7 w only use su* application programm+ int]face or simil> me*anism at ! express reque/ ( an individual4 7#b7 ,d5ial ( access 7,a7 ,9 g5]al ,a cov]$ entity may d5y access to ! application programm+ int]face or simil> me*anism requir$ by subsection 7b77#a77;,b7 if su* cov]$ entity has an objective1 reasonable belief t ! reque/+ cov]$ entity has fail$ to meet ! requirem5ts = self-c]tification "u p>agraph 7#a74 7,b7 ,review ,9 accordance ) ! proc$ures e/abli%$ "u p>agraph 7#c77;,b71 a cov]$ entity ! reque/ ( :i* is d5i$ "u subp>agraph 7,a7 may petition ! ,director = review ( ! d5ial4 ,if ! ,director f9ds t su* d5ial is unreasonable1 ! ,director %all impose a p5alty1 to be e/abli%$ 9 su* proc$ures1 on ! cov]$ entity t d5i$ ! reque/4 7#c7 ,c]tification & review proc$ures ,! ,director %all e/abli%-- 7,a7 proc$ures = a cov]$ entity to self-c]tify "u p>agraph 7#a72 & 7,b7 proc$ures = ! review ( petitions "u p>agraph 7#b77;,b71 includ+ p5alties = unreasonable d5ials4 7d7 ,small bus9esses exclud$ ,?is section does n apply to a small bus9ess4 7e7 ,portable category def9$ ,9 ?is section1 ! t]m portable category means a category ( products & s]vices e/abli%$ by ! ,director "u subsection 7a77#a77;,a7-- 7#a7 = :i* ! sum obta9$ by add+ ! numb] ( us]s or e/imat$ us]s ( ea* product or s]vice 9 su* category is great] ?an #aj1jjj1jjj2 & 7#b7 t-- 7,a7 has an e/imat$ ,h]f9dahl-,hirs*man ,index ( #b1jjj or great]2 7,b7 has #c or few] cov]$ entities (f]+ products & s]vices 9 su* category2 or 7,c7 ! ,director o!rwise det]m9es t a category w\ld b5efit f enc\rag+ increas$ competition4 #aje4 ,"r to human review ( automat$ decisions ,= any decision by a cov]$ entity bas$ solely on automat$ process+ ( p]sonal in=mation ( an individual1 if su* process+ mat]ially increases reasonably =eseeable significant privacy h>ms = su* individual1 su* cov]$ entity %all-- 7#a7 in=m su* individual ( :at p]sonal in=mation is be+ or may be us$ = su* decision2 7#b7 make available a reasonable me*anism by :i* su* individual may reque/ human review ( su* decision1 ^u reque/ or 9 a publicly accessible location2 & 7#c7 if su* individual reque/s su* a review1 conduct su* review )9 a reasonable am\nt ( "t aft] su* reque/4 #ajf4 ,"r to individual autonomy 7a7 ,9 g5]al ,a cov]$ entity may n1 )\t ! affirmative express cons5t ( an individual1 collect1 process1 ma9ta91 or disclose ! p]sonal in=mation ( ! individual to create1 improve ^u1 ma9ta91 process1 or o!rwise l9k ! individual ) an algori?m1 model1 or o!r means design$ = behavioral p]sonalization4 7b7 ,cons5t 7#a7 ,cons5t requir$ ,a cov]$ entity %all obta9 express affirmative cons5t f an individual be=e ! entity provides a behaviorally p]sonaliz$ v]sion ( a product or s]vice1 & n less ?an e cal5d> ye> !reaft]4 7#b7 ,d5ial ( cons5t ,= a case 9 :i* cons5t is d5i$1 ! cov]$ entity %all provide ! product or s]vice )\t behavioral p]sonalization1 except z provid$ 9 subsection 7c74 7c7 ,exceptions to provid+ product or s]vice 7#a7 ,infeasibility ,= a case 9 :i* ! (f]+ ( a sub/antially simil> product or s]vice )\t behavioral p]sonalization is infeasible1 a cov]$ entity %all provide1 to ! greate/ ext5t feasible1 a core aspect or "p ( ! product or s]vice t c be (f]$ )\t behavioral p]sonalization4 7#b7 ,d5ial = inability to function ,= a case 9 :i* a core aspect or "p ( ! product or s]vice is n able to function 9 a sub/antially simil> function )\t behavioral p]sonalization1 a cov]$ entity may d5y provid+ an individual use ( su* product or s]vice if su* individual does n cons5t to behavioral p]sonalization z requir$ 9 subsection 7a74 7d7 ,exception to behavioral process+ ,not)/&+ subsections 7a7 & 7b71 a cov]$ entity may process p]sonal in=mation to create or op]ate behavioral p]sonalization algori?ms1 models1 or o!r me*anisms = ! purpose ( increas+ ! usability ( ! product or s]vice provid$ by a cov]$ entity t-- 7#a7 are built us+ aggregat$ p]sonal in=mation t is repres5tative ( all ! p]sonal in=mation ! cov]$ entity ma9ta9s2 & 7#b7 h an output t is bo? uni=m across ! individuals t use ! product or s]vice & indep5d5t ( a specific individual's inh]5t or behavioral *>act]i/ics4 7e7 ,usability ,! t]m usability z us$ 9 subsection 7d7 does n include optimizations or o!r alt]ations to ! product or s]vice t are made ) ! prim>y purpose ( increas+ ! am\nt ( "t an individual engages ) or uses ! product or s]vice1 unless su* increase b5efits ! individual4 7f7 ,small bus9esses exclud$ ,?is section does n apply to a small bus9ess4 #ajg4 ,"r to be in=m$ ,a cov]$ entity t collects p]sonal in=mation ( an individual ) :om su* cov]$ entity does n h an exi/+ relation%ip 7z ( ! "t ( ! collect+71 if su* p]sonal in=mation includes contact in=mation1 %all notify su* individual )9 #cj days aft] receipt ( su* in=mation1 9 writ+ if possible & at no *>ge to ! individual1 t su* cov]$ entity has collect$ ! p]sonal in=mation ( su* individual4 #ajh4 ,"r to imp]man5ce 7a7 ,limitation on ma9ta9+ ( p]sonal in=mation ,a cov]$ entity may n ma9ta9 p]sonal in=mation = m "t ?an expressly cons5t$ to by an individual ^: p]sonal in=mation is be+ ma9ta9$4 7b7 ,cons5t ,a cov]$ entity %all obta9 express affirmative cons5t f an individual be=e ma9ta9+ ! p]sonal in=mation ( su* individual = any duration4 ,su* cons5t may be obta9$ = categories ( p]sonal in=mation & %all give an individual options to affirmatively *oose grant+ a cov]$ entity cons5t = v>i\s durations1 at lea/ includ+-- 7#a7 = no long] ?an ne$$ to complete ! specific reque/ or transaction 7includ+ a reasonable e/imate ( su* duration by ! cov]$ entity72 7#b7 until cons5t is revok$2 & 7#c7 "o or m additional durations bas$ on reasonable expectations & norms = ma9ta9+ ! category ( p]sonal in=mation4 7c7 ,exception = impli$ cons5t ,:]e ! long-t]m ma9ta9+ ( p]sonal in=mation is1 on its face1 obvi\s & a core feature ( ! product or s]vice at ! reque/ ( ! individual1 & ! p]sonal in=mation is ma9ta9$ only to provide su* product or s]vice1 subsections 7a7 & 7b7 %all n apply4 #aji4 ,additional rights & exceptions 7a7 ,9 g5]al ,! ,director may1 by rule & subject to notice & comm5t1 e/abli% proc$ural requirem5ts & n>r[ly tailor$ exceptions gov]n+ ! ex]cise ( rights "u ?is title1 limit$ to ! foll[+3 7#a7 ,id5tity v]ification & au!ntication proc$ures4 7#b7 ,/&>diz$ =mats & reasonable me*anisms = submitt+ & fulfill+ reque/s4 7#c7 ,reasonable limits to prev5t fraud1 abuse1 or excessive & duplicative reque/s4 7#d7 ,timel9es & recordkeep+ requirem5ts consi/5t ) ?is title4 7#e7 ,n>r[ly tailor$ exceptions necess>y to prev5t a legitimate risk to ! privacy1 security1 or safety ( ano!r individual1 or to protect free expression1 consi/5t ) section #aaj7;b74 7b7 ,limitations ,! ,director may n create any new sub/antive "r or broadly waive compliance ) ?is title4 #aaj4 ,exemptions1 exceptions1 fees1 timel9es1 & rules ( con/ruction = rights "u ?is title 7a7 ,exemptions = p]sonal in=mation = p>ticul> purposes 7#a7 ,9 g5]al ,?is title does n apply ) respect to p]sonal in=mation t is collect$1 process$1 ma9ta9$1 or disclos$ = any ( ! foll[+ purposes 7or a comb9ation ( su* purposes71 :]e a cov]$ entity has te*nical safegu>ds & bus9ess processes t limit collect+1 process+1 ma9ta9+1 or disclos+ ( su* p]sonal in=mation to ! foll[+ purposes3 7,a7 ,detect+1 respond+ to1 or prev5t+ security incid5ts or ?reats4 7,b7 ,protect+ aga9/ malici\s1 deceptive1 fraudul5t1 or illegal activity4 7,c7 ,a good fai? response to1 or compliance )1 a valid subpo5a1 c\rt ord]1 or w>rant 7includ+ a subpo5a & c\rt ord] obta9$ by an entity t is n a gov]nm5t entity7 or o!rwise provid+ in=mation z requir$ by law4 7,d7 ,protect+ a legally recogniz$ privilege or o!r legal "r4 7,e7 ,protect+ public safety4 7,f7 ,collect+1 process+1 or ma9ta9+ by an employ] pursuant to an employ]-employee relation%ip ( records ab\t employees or employm5t /atus1 except-- 7i7 :]e ! in=mation w\ld n be reasonably expect$ to be collect$ 9 ! context ( an employee's regul> duties2 or 7ii7 0 disclos$ to ! employ] by a ?ird p>ty4 7,g7 ,prev5t+ prospective abuses ( a s]vice by an individual ^: acc\nt has be5 previ\sly t]m9at$4 7,h7 ,r\t+ a communication ?r\gh a communications network or resolv+ ! location ( a ho/ or cli5t on a communications network4 7,i7 ,provid+ transp>5cy 9 adv]tis+ or orig9ation ( us]-g5]at$ cont5t4 7#b7 ,re-id5tification ,:]e compliance ) ?is title w\ld require ! re-id5tification ( de-id5tifi$ p]sonal in=mation1 & ! cov]$ entity does n already ma9ta9 ! in=mation necess>y = su* re-id5tification1 ! cov]$ entity %all be exempt f su* compliance1 except = requirem5ts "u section #ajf4 7#c7 ,disclos+ ,a cov]$ entity rely+ on an exemption "u p>agraph 7#a7 ) respect to p]sonal in=mation %all disclose 9 ! privacy policy ma9ta9$ by su* entity "u section #baa-- 7,a7 ! reason = :i* su* in=mation is collect$1 process$1 ma9ta9$1 or disclos$2 & 7,b7 a description ( ! rights provid$ by ?is title t are n available ) respect to su* p]sonal in=mation by reason ( su* exemption4 7b7 ,exceptions = p>ticul> reque/s 7#a7 ,9 g5]al ,a cov]$ entity may d5y ! reque/ ( an individual "u ?is title if-- 7,a7 su* cov]$ entity _c confirm ! id5tity ( su* individual2 7,b7 su* cov]$ entity det]m9es t grant+ ! reque/ ( su* individual w\ld create a legitimate risk to ! privacy1 security1 safety1 or o!r rights ( ano!r individual2 7,c7 su* cov]$ entity det]m9es t grant+ ! reque/ ( su* individual w\ld create a legitimate risk to free expression2 or 7,d7 ! p]sonal in=mation reque/$ to be correct$ "u section #ajb or delet$ "u section #ajc-- 7i7 is necess>y to ! completion ( a transaction initiat$ be=e su* reque/ 0 made or ! p]=mance ( a contract ent]$ into be=e su* reque/ 0 made2 7ii7 0 collect$ specifically = ! completion ( su* transaction or ! p]=mance ( su* contract2 & 7iii7 w\ld und]m9e ! integrity ( a legally significant transaction4 7#b7 ,limitations on reque/s = additional in=mation to confirm id5tity ,a cov]$ entity may n d5y a reque/ ( an individual "u p>agraph 7#a77;,a7 on ! basis ( ! refusal ( su* individual to provide additional p]sonal in=mation to su* cov]$ entity to confirm ! id5tity ( su* individual-- 7,a7 if ! id5tity ( su* individual c reasonably be confirm$ us+ p]sonal in=mation ( su* individual t su* cov]$ entity 7z ( ! "t ( ! reque/7 already ma9ta9s2 or 7,b7 if su* individual has an exi/+ relation%ip 7z ( ! "t ( ! reque/7 ) su* cov]$ entity1 su* individual has confirm$ ! id5tity ( su* individual to su* cov]$ entity 9 ! same mann] z = o!r transactions ( a simil> s5sitivity4 7c7 ,exemption = s]vice provid]s ,?is title does n apply to a s]vice provid]4 7d7 ,exemption = privacy-,pres]v+ comput+ ,except = sections #aja1 #aje1 & #ajf1 ?is title does n apply to p]sonal in=mation secur$ us+ privacy-pres]v+ comput+4 7e7 ,timel9e = comply+ ) a reque/ ,)\t undue delay b n long] ?an #cj days aft] ! reque/1 a cov]$ entity t receives a reque/ "u ?is title mu/-- 7#a7 comply ) su* reque/2 or 7#b7 in=m su* individual ( ! reason = d5y+ su* reque/1 z all[$ "u subsection 7a7 or 7b74 7f7 ,fees prohibit$ 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 a cov]$ entity may n *>ge a fee to an individual = a reque/ made "u ?is title4 7#b7 ,unf\nd$ or excessive reque/s ,if a reque/ "u ?is title is unf\nd$ or excessive1 a cov]$ entity may *>ge a reasonable fee t reflects ! e/imat$ adm9i/rative co/s ( comply+ ) su* reque/4 7#c7 ,ag5cy notice ,if a cov]$ entity plans to *>ge a fee "u p>agraph 7#b71 x mu/ notify ! ,digital ,privacy ,ag5cy at lea/ #g days be=e *>g+ su* fee4 7#d7 ,ag5cy review ,! ,director may reject any fee t a cov]$ entity plans to *>ge = a reque/ made "u ?is title if ! ,director f9ds-- 7,a7 su* fee to be unreasonable relative to reasonable adm9i/rative co/s ( comply+ ) a reque/ "u ?is title2 or 7,b7 su* reque/ is n unf\nd$ or excessive4 7g7 ,rules ( con/ruction ,no?+ 9 ?is title %all be con/ru$ to require a cov]$ entity to-- 7#a7 take an action t w\ld conv]t in=mation t is n p]sonal in=mation into p]sonal in=mation2 7#b7 collect or ma9ta9 p]sonal in=mation or cont5ts ( communication t ! cov]$ entity w\ld o!rwise n ma9ta9 7includ+ a record ( an individual ex]cis+ rights "u ?is title72 or 7#c7 ma9ta9 p]sonal in=mation or cont5ts ( communication long] ?an ! cov]$ entity w\ld o!rwise ma9ta9 su* p]sonal in=mation4 ,,ii ,requirem5ts = ,cov]$ ,entities1 ,s]vice ,provid]s1 & ,?ird ,p>ties #bja4 ,m9imization 7a7 ,articulat$ basis ,a cov]$ entity %all h a reasonable1 articulat$ basis = collect+1 process+1 ma9ta9+1 & disclos+ ( p]sonal in=mation t takes into acc\nt ! reasonable bus9ess ne$s ( ! cov]$ entity & m9imum am\nt ( p]sonal in=mation necess>y = provid+ ! s]vice1 balanc$ ) ! intrusion on ! privacy (1 pot5tial privacy h>ms to1 & reasonable expectations ( individuals to :om ! p]sonal in=mation relates4 7b7 ,m9imization ( collect+1 process+1 ma9ta9+1 & disclos+ 7#a7 ,collect+ ,a cov]$ entity may n collect m p]sonal in=mation ?an is reasonably ne$$ to provide a product or s]vice t an individual has reque/$4 7#b7 ,process+ ,a cov]$ entity may n process p]sonal in=mation = a purpose o!r ?an ! purpose = :i* su* in=mation 0 orig9ally collect$ f ! individual or 9 ! case ( a s]vice provid]1 a purpose o!r ?an t :i* is 9 accordance ) ! directions ( a cov]$ entity4 7#c7 ,ma9ta9+ ,a cov]$ entity may n ma9ta9 p]sonal in=mation once su* in=mation is no long] ne$$ = ! purpose = :i* su* in=mation 0 orig9ally collect$ f ! individual or 9 ! case ( a s]vice provid]1 a purpose o!r ?an t :i* is 9 accordance ) ! directions ( a cov]$ entity4 7#d7 ,disclos+ ,a cov]$ entity may n disclose p]sonal in=mation = a purpose o!r ?an ! purpose = :i* su* in=mation 0 orig9ally collect$ f ! individual or 9 ! case ( a s]vice provid]1 a purpose o!r ?an t :i* is 9 accordance ) ! directions ( a cov]$ entity4 7c7 ,ancill>y collect+1 process+1 ma9ta9+1 & disclos+ ,not)/&+ subsection 7b71 a cov]$ entity may collect1 process1 disclose1 or ma9ta9 p]sonal in=mation beyond limitations "u subsection 7b7 only if su* cov]$ entity complies ) ?is subsection4 7#a7 ,no notice or cons5t requir$ ,a cov]$ entity may collect1 process1 or ma9ta9 p]sonal in=mation )\t additional notice or cons5t if ! purpose = su* collect+1 process+1 or ma9ta9+ is sub/antially simil> to ! type ( p]sonal in=mation & purpose = :i* su* p]sonal in=mation 0 orig9ally collect$ & su* ancill>y collect+1 process+1 or ma9ta9+ w n result 9 additional or increas$ privacy h>ms4 7#b7 ,notice requir$ ,a cov]$ entity %all provide notice ( ancill>y collect+1 process+1 ma9ta9+1 or disclos+ ( p]sonal in=mation 9 ! case ( "o1 b n m ?an "o1 ( ! foll[+ in/ances3 7,a7 ,su* ancill>y collect+1 process+1 ma9ta9+1 or disclos+ may result 9 additional or increas$ privacy h>ms 7b n increas$ significant privacy h>ms71 & is sub/antially simil> to ! purpose = :i* su* p]sonal in=mation 0 orig9ally collect$4 7,b7 ,su* ancill>y collect+1 process+1 ma9ta9+1 or disclos+ is n sub/antially simil> to ! purpose = :i* su* p]sonal in=mation 0 orig9ally collect$1 b w n result 9 additional or increas$ privacy h>ms4 7,c7 ,su* ancill>y collect+1 process+1 ma9ta9+1 or disclos+ may result 9 additional or increas$ privacy h>ms 7b n increas$ significant privacy h>ms71 & ! purpose is n sub/antially simil> to ! purpose = :i* su* p]sonal in=mation 0 orig9ally collect$1 s long z ! p]sonal in=mation is secur$ us+ privacy-pres]v+ comput+4 7#c7 ,notice & cons5t requir$ ,= sc5>ios n cov]$ "u p>agraph 7#a7 or 7#b71 & not)/&+ sections #bjh7;b77#b7 & 7#c71 a cov]$ entity %all provide notice ( & obta9 cons5t = ancill>y collect+1 process+1 ma9ta9+1 or disclos+ ( p]sonal in=mation4 7d7 ,sub/itution ,9 cases 9 :i* p]sonal in=mation c be replac$ ) artificial p]sonal in=mation1 p]sonal in=mation t has be5 de-id5tifi$1 or ! r&om p]sonal in=mation ( "o or m individuals )\t sub/antially r$uc+ ! utility ( ! data or requir+ an unreasonable am\nt ( ef=t1 su* a replacem5t %all take place4 #bjb4 ,m9imization & records ( access by employees & contractors 7a7 ,m9imization ,a cov]$ entity %all re/rict access to p]sonal in=mation & cont5ts ( communications by ! employees or contractors ( su* cov]$ entity bas$ on an articulat$ balance betwe5 ! pot5tial = privacy h>m1 reasonable expectations ( individuals to :om ! p]sonal in=mation relates1 & reasonable bus9ess ne$s4 7b7 ,records ( access 7#a7 ,9 g5]al ,a cov]$ entity %all ma9ta9 records id5tify+ ea* in/ance 9 :i* an employee or a contractor ( su* cov]$ entity accesses p]sonal in=mation or cont5ts ( communications if disclos+ su* p]sonal in=mation or cont5ts ( communication1 or a data brea* or data-%>+ abuse involv+ su* p]sonal in=mation or cont5ts ( communication1 may =eseeably result 9 increas$ privacy h>ms4 7#b7 ,in=mation requir$ ,! records requir$ by p>agraph 7#a7 %all include ! foll[+3 7,a7 ,a unique id5tifi] = ! employee or contractor access+ p]sonal in=mation or cont5ts ( communications4 7,b7 ,! date & "t ( access4 7,c7 ,! fields ( in=mation access$4 7,d7 ,! individuals ^: p]sonal in=mation 0 access$ or ! cont5ts ( ^: communications 7 access$4 7#c7 ,small bus9esses exclud$ ,?is subsection does n apply to a small bus9ess4 #bjc4 ,prohibitions on disclos+ ( p]sonal in=mation 7a7 ,cons5t = disclos+ requir$ 7#a7 ,9 g5]al ,a cov]$ entity may n int5tionally disclose p]sonal in=mation unless ! cov]$ entity obta9s cons5t ( ! individual ^: p]sonal in=mation is be+ disclos$ = ea* category ( ?ird p>ty to :i* su* p]sonal in=mation w be disclos$4 ,su* cov]$ entity mu/ also provide su* individual ) notice (-- 7,a7 ea* category ( ?ird p>ty2 7,b7 ! p]sonal in=mation to be disclos$2 & 7,c7 a concise & cle> description ( ! bus9ess or comm]cial purpose = disclos+ su* p]sonal in=mation4 7#b7 ,additional requirem5ts = sale ( p]sonal in=mation 7,a7 ,9 g5]al ,a cov]$ entity may n int5tionally sell p]sonal in=mation unless ! cov]$ entity-- 7i7 obta9s ! cons5t requir$ by p>agraph 7#a7 = disclos+ su* p]sonal in=mation2 & 7ii7 provides ! individual to :om su* p]sonal in=mation relates ) ! id5tity ( ! specific ?ird p>ty to :i* su* p]sonal in=mation w be disclos$4 7,b7 ,disclos+ s]vices ,subp>agraph 7,a7 %all n apply to a cov]$ entity 9 a case 9 :i* an individual is direct+ ! cov]$ entity to disclose ! p]sonal in=mation ( su* individual = ! sole purpose ( procur+ goods or s]vices1 or (f]s = goods or s]vices1 = su* individual1 if !re is a reasonable me*anism = ! individual to )draw cons5t4 7#c7 ,requirem5t to include orig9al purpose ( collect+ ,a cov]$ entity may n int5tionally disclose p]sonal in=mation )\t includ+ ! purpose = :i* ! p]sonal in=mation 0 orig9ally collect$4 7#d7 ,exception = privacy-pres]v+ comput+ ,not)/&+ p>agraph 7#a71 cons5t is n requir$ = disclos+ 7n includ+ sell+7 p]sonal in=mation secur$ us+ privacy-pres]v+ comput+4 7#e7 ,exception = de-id5tifi$ p]sonal in=mation ,not)/&+ p>agraph 7#a71 cons5t is n requir$ = disclos+ 7n includ+ sell+7 de-id5tifi$ p]sonal in=mation :]e ! disclos$ p]sonal in=mation is limit$ to ! n>r[e/ possible scope likely to yield ! int5d$ b5efit & contractual obligations are 9 place t prohibit-- 7,a7 re-id5tification ( ! disclos$ p]sonal in=mation2 & 7,b7 ! process+ ( additional p]sonal in=mation 9 comb9ation ) ! disclos$ p]sonal in=mation t w\ld all[ = ! re-id5tification ( ! disclos$ p]sonal in=mation4 7b7 ,disclos+ = adv]tis+ or m>ket+ purposes 7#a7 ,9 g5]al ,a cov]$ entity may n int5tionally disclose = adv]tis+ or m>ket+ purposes a unique id5tifi] or any o!r p]sonal in=mation t w\ld all[ in=mation disclos$ to be l9k$ to in=mation relat+ to ! same individual or device disclos$ 9 ! pa/4 7#b7 ,treatm5t ( c]ta9 types ( in=mation ,disclos+ p]sonal in=mation or cont5ts ( communication = adv]tis+ or m>ket+ purposes may n be treat$ z violat+ p>agraph 7#a7 by reason ( includ+ any or all ( ! foll[+3 7,a7 ,int]net ,protocol addresses truncat$ to no m ?an ! fir/ #bd bits = ,int]net ,protocol v]sion #d & ! fir/ #dh bits = ,int]net ,protocol v]sion #f1 or = a successor protocol truncat$ to limit ! precision ( ! id5tifi] to a network address ( ! int]net access provid]4 7,b7 ,geolocation in=mation truncat$ to all[ no m ?an ! equival5t ( two decimal degrees ( precision at ! equator or prime m]idian1 or an equival5t precision 9 ano!r geolocation /&>d4 7,c7 ,a g5]al description ( a device1 br[s]1 or op]at+ sy/em1 or any comb9ation !re(4 7,d7 ,an id5tifi] t is unique to a disclosure4 #bjd4 ,disclos+ to entities n subject to ,unit$ ,/ates jurisdiction or n compliant ) ?is ,act 7a7 ,prohibition ,a cov]$ entity may n int5tionally disclose p]sonal in=mation to any entity t-- 7#a7 is n subject to ! jurisdiction ( ! ,unit$ ,/ates2 or 7#b7 is n 9 compliance ) all requirem5ts ( ?is ,act4 7b7 ,exception ,not)/&+ subsection 7a71 a cov]$ entity may disclose p]sonal in=mation :]e t p]sonal in=mation is limit$ to an id5tifi] creat$ prim>ily = ! purpose ( s5d+ or receiv+ electronic communications & ! sole purpose ( disclos+ is to s5d or receive an electronic communication at ! reque/ ( ! individual ^: p]sonal in=mation is be+ disclos$4 7c7 ,safe h>bors = disclos+ ,not)/&+ subsection 7a71 a cov]$ entity may disclose p]sonal in=mation to ano!r cov]$ entity 7! receiv+ cov]$ entity7 t is n subject to ! jurisdiction ( ! ,unit$ ,/ates if ei!r-- 7#a7 ! receiv+ cov]$ entity has ent]$ into an agreem5t1 z describ$ 9 subsection 7e71 ) ! ,digital ,privacy ,ag5cy1 &-- 7,a7 ! cov]$ entity has a reasonable belief t ! receiv+ cov]$ entity is suffici5tly solv5t to comp5sate victims or pay f9es = violations ( ?is ,act2 7,b7 a contract betwe5 ! cov]$ entity & receiv+ cov]$ entity requires t ! receiv+ cov]$ entity complies ) ?is ,act1 & ! cov]$ entity has reason to believe ! receiv+ cov]$ entity is compliant ) ?is ,act2 & 7,c7 a contract betwe5 ! cov]$ entity & ! receiv+ cov]$ entity prohibits ! receiv+ cov]$ entity f us+ ! disclos$ p]sonal in=mation = any purpose o!r ?an provid$ 9 ! contract2 or 7#b7 ! cov]$ entity has-- 7,a7 ent]$ into an agreem5t ) ! receiv+ cov]$ entity t-- 7i7 requires ! receiv+ cov]$ entity to comply ) ?is ,act2 7ii7 prohibits ! receiv+ cov]$ entity f us+ ! disclos$ p]sonal in=mation = any purpose o!r ?an provid$ 9 ! contract2 7iii7 requires ! receiv+ cov]$ entity to indemnify ! cov]$ entity aga9/ violations ( ?is ,act committ$ by ! receiv+ cov]$ entity = any am\nt ! cov]$ entity is unable to pay ( a judgm5t = su* violation2 7iv7 grants ! cov]$ entity ! au?ority to audit1 includ+ physical access to electronic devices & data1 ! receiv+ cov]$ entity's compliance ) ?is ,act & ! contract2 & 7v7 requires ! receiv+ cov]$ entity to assi/ ! cov]$ entity 9 respond+ to & comply+ ) any c\rt ord]s1 ,digital ,privacy ,ag5cy ord]s1 or ! ex]cis+ ( an individual's rights "u ?is ,act2 7,b7 actual k t ! receiv+ cov]$ entity is 9 compliance ) ?is ,act & n us+ p]sonal in=mation contr>y to _! agreem5t2 7,c7 actual k t ! receiv+ cov]$ entity is suffici5tly solv5t to comp5sate victims or pay f9es = violations ( ?is ,act2 7,d7 an audit+ & compliance program to ensure ! receiv+ cov]$ entity's cont9u$ compliance ) ?is ,act & contract t]ms2 7,e7 fil$ ) ! ,digital ,privacy ,ag5cy ! t]ms ( said contract1 pro( ( its actual k ( ! receiv+ cov]$ entity's compliance ) ?is ,act & contract t]ms1 & docum5ts detail+ its audit+ & compliance program = approval & publication by ! ,digital ,privacy ,ag5cy2 & 7,f7 ent]$ into an agreem5t ) ! ,digital ,privacy ,ag5cy :]e ! cov]$ entity agrees to accept1 respond to1 or comply ) a c\rt ord]1 ,digital ,privacy ,ag5cy ord]1 or reque/ by an individual reg>d+ actions tak5 by ! receiv+ cov]$ entity ) respect to cov]$ in=mation x has disclos$4 7d7 ,liability = violation by receiv+ cov]$ entity2 failure ,to report ,= ! purposes ( subsection 7c77#b71 ! cov]$ entity %all be jo9tly liable = a violation ( ?is ,act by ! receiv+ cov]$ entity reg>d+ ! p]sonal in=mation ! cov]$ entity disclos$1 except :]e ! cov]$ entity 0 ! fir/ to notify ! ,digital ,privacy ,ag5cy ( ! violation1 9 :i* case1 x %all be sev]ally liable4 ,:]e ! cov]$ entity %\ld reasonably h kn[n ( a violation ( ?is ,act by ! receiv+ cov]$ entity & fails to disclose ! violation to ! ,digital ,privacy ,ag5cy1 ea* day ( cont9uance ( ! failure to report su* violation %all be treat$ z a sep>ate violation4 7e7 ,ag5cy agreem5ts ,^u ! reque/ ( a cov]$ entity n subject to ! jurisdiction ( ! ,unit$ ,/ates1 ! ,digital ,privacy ,ag5cy %all ent] into an agreem5t ) ! cov]$ entity t includes1 b is n limit$ to1 ! foll[+ conditions3 7#a7 ,! pr9cipal place ( bus9ess = ! cov]$ entity mu/ be 9 a c\ntry t all[s = ! dome/ication ( a ,unit$ ,/ates c\rt decision = civil f9es payable to a gov]nm5t entity & injunctive relief4 ,:]e a =eign c\rt refuses to en=ce a ,unit$ ,/ates c\rt decision "u ?is ,act1 ! agreem5t1 & all o!r agreem5ts ) cov]$ entities ) a pr9cipal place ( bus9ess 9 ! same jurisdiction1 %all be void4 7#b7 ,! cov]$ entity agrees to comply ) ?is ,act4 7#c7 ,! cov]$ entity agrees to be subject to ?is ,act ) *oice ( v5ue be+ a ,unit$ ,/ates c\rt4 7#d7 ,! cov]$ entity agrees to comply ) ,digital ,privacy ,ag5cy inve/igative reque/s or ord]s1 & ,unit$ ,/ates c\rt ord]s or decisions "u ?is ,act4 7#e7 ,! cov]$ entity cons5ts to ,unit$ ,/ates ,f$]al c\rt p]sonal jurisdiction = ! sole purpose ( en=c+ ?is ,act4 7#f7 ,:]e en=cem5t ( ! decision requires ! use ( a =eign c\rt1 ! cov]$ entity agrees to pay reasonable attorney fees necess>y to en=ce ! judgm5t4 7#g7 ,a default judgm5t1 failure to comply ) ,digital ,privacy ,ag5cy inve/igative reque/s or ord]s1 or failure to comply ) ,unit$ ,/ates c\rt ord]s or decisions %all result 9 ! imm$iate t]m9ation ( ! agreem5t4 7f7 ,rule ( con/ruction aga9/ data localization ,no?+ 9 ?is section %all be con/ru$ to require ! localization ( process+ or ma9ta9+ p]sonal in=mation by a cov]$ entity to )9 ! ,unit$ ,/ates1 or limit int]nal disclos+ ( p]sonal in=mation )9 a cov]$ entity or to subsidi>y or corporate affiliate ( su* cov]$ entity1 reg>dless ( ! c\ntry 9 :i* ! cov]$ entity w process1 disclose1 or ma9ta9 t p]sonal in=mation4 #bje4 ,prohibition on re-id5tification 7a7 ,9 g5]al ,except z requir$ "u title ,i1 a cov]$ entity %all n use p]sonal in=mation collect$ f an individual1 acquir$ f a ?ird p>ty1 or acquir$ f publicly available in=mation to re-id5tify an individual f de-id5tifi$ in=mation4 7b7 ,?ird-,p>ty prohibition ,a cov]$ entity t discloses de-id5tifi$ in=mation to a ?ird p>ty %all prohibit su* ?ird p>ty f re-id5tify+ an individual us+ su* de-id5tifi$ in=mation4 7c7 ,exception ,subsection 7a7 %all n apply to qualifi$ rese>* entities1 z det]m9$ by ! ,director1 conduct+ rese>* n = comm]cial purposes4 #bjf4 ,re/rictions on collect+1 process+1 ma9ta9+1 & disclos+ cont5ts ( communications 7a7 ,9 g5]al ,a cov]$ entity may n collect1 process1 ma9ta91 or disclose ! cont5ts ( any communication1 reg>dless ( :e!r ! s5d] or int5d$ recipi5t ( ! communication is an individual1 o!r p]son1 or an electronic device1 = any purpose o!r ?an-- 7#a7 transmitt+ or display+ ! communication to any int5d$ recipi5t or ! orig9al s5d]1 or ma9ta9+ su* communications = su* purposes2 7#b7 detect+1 respond+ to1 or prev5t+ security incid5ts or ?reats2 7#c7 provid+ s]vices to assi/ 9 ! draft+ or creation ( ! cont5t ( a communication2 7#d7 process+ expressly reque/$ by ! s5d] or int5d$ recipi5t1 if ! s5d] or int5d$ recipi5t c t]m9ate su* process+ us+ a reasonable me*anism2 7#e7 disclos+ o!rwise requir$ by law2 7#f7 filt]+ a communication :]e ! prim>y purpose ( ! communication is ! comm]cial adv]tisem5t or promotion ( a comm]cial product or s]vice ( a cov]$ entity2 or 7#g7 detect+ or en=c+ an abuse or violation ( ! t]ms ( s]vice ( ! cov]$ entity t w\ld result 9 ei!r a tempor>y or p]man5t ban f us+ ! s]vice4 7b7 ,int5d$ recipi5t ,a cov]$ entity is n consid]$ an int5d$ recipi5t ( a communication1 or any communication us$ 9 ! creation ( ! cont5t ( said communication1 :]e-- 7#a7 at lea/ "o int5d$ recipi5t is a natural p]son o!r ?an an employee or contractor ( ! cov]$ entity2 7#b7 at lea/ "o int5d$ recipi5t is a p]son o!r ?an ! cov]$ entity2 or 7#c7 a purpose ( ! cov]$ entity's s]vice is to ma9ta91 at ! direction ( ! s5d]1 ! cont5t ( said communication = m ?an a transitory p]iod4 7c7 ,s5d] ,! s5d] ( a communication is ! p]son = :om ! communication1 & its cont5t1 is disclos$ at ! direction ( & on behalf (4 7#a7 ,:]e ! s5d] is a natural p]son1 !y %all be ! s5d] ( ! entire cont5t ( ! communication1 reg>dless ( ! orig9al au?or ( any portion ( ! cont5t4 7#b7 ,o!rwise1 a s5d] %all be ! s5d] ( only ! cont5t x 0 an orig9al au?or (1 or cont5t x receiv$ z an int5d$ recipi5t4 7d7 ,exception = publicly available communications ,subsection 7a7 %all n apply :]e ! cont5ts ( communication are made publicly accessible by ! s5d] )\t re/rictions on accessibility o!r ?an ! g5]al au?orization to access ! s]vices us$ to make ! in=mation accessible4 7e7 ,encryption protection ,a cov]$ entity %all n-- 7#a7 prohibit or prev5t a p]son f encrypt+ or o!rwise r5d]+ un9telligible ! cont5t ( a communication us+ a means t prev5ts ! cov]$ entity f be+ able to decrypt or o!rwise r5d] intelligible said cont5t2 & 7#b7 require or cause a p]son to disclose or circumv5t ! means describ$ 9 p>agraph 7#a7 to ! cov]$ entity t w\ld all[ x to r5d] ! cont5t intelligible4 7f7 ,s]vice provid]s safe h>bor ,a s]vice provid] %all n be held liable = a violation ( ?is section if su* s]vice provid] is act+ at ! direction ( & on behalf ( a cov]$ entity & has a reasonable belief t ! cov]$ entity's directions are 9 compliance ) ?is section4 #bjg4 ,prohibition on discrim9atory process+ 7a7 ,discrim9ation 9 economic opportunities ,a cov]$ entity may n process p]sonal in=mation or cont5ts ( communication = adv]tis+1 m>ket+1 solicit+1 (f]+1 sell+1 leas+1 lic5s+1 r5t+1 or o!rwise comm]cially contract+ = employm5t1 f9ance1 heal? c>e1 cr$it1 insurance1 h\s+1 or education opportunities 9 a mann] t discrim9ates aga9/ or o!rwise makes opportunities unavailable on ! basis ( ! protect$ class /atus ( an individual4 7b7 ,public accommodations ,a cov]$ entity may n process p]sonal in=mation 9 a mann] t segregates1 discrim9ates 91 or o!rwise makes unavailable ! goods1 s]vices1 facilities1 privileges1 advantages1 or accommodations ( any place ( public accommodation on ! basis ( ! protect$ class /atus ( an individual or a gr\p ( individuals4 7c7 ,disp>ate impact au?ority ,n lat] ?an #f mon?s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,director %all issue additional requirem5ts relat$ to a disp>ate impact /&>d t-- 7#a7 describes o!r circum/ances 9 :i* an individual or gr\p ( individuals may be h>m$ by an action ( a cov]$ entity ?r\gh ! process+ ( p]sonal in=mation or cont5ts ( communication ( ! protect$ class /atus ( t individual 9 a mann] n describ$ 9 subsection 7a7 or 7b72 7#b7 prohibits su* action2 & 7#c7 provides = en=cem5t "u ?is ,act or ?r\gh regulation4 7d7 ,regulations ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,director %all promulgate regulations to implem5t ?is section & may def9e any t]m us$ "u ?is section1 includ+ discrim9ates aga9/ & o!rwise makes opportunities unavailable4 #bjh4 ,requirem5ts = notice & cons5t processes & privacy policies 7a7 ,m9imum ?re%old ,! ,director %all e/abli% m9imum ?re%olds t cov]$ entities mu/ meet = ! p]c5tage ( individuals :o und]/& a notice or cons5t process or privacy policy requir$ by ?is ,act4 ,9 e/abli%+ su* m9imum ?re%olds1 ! ,director %all-- 7#a7 v>y requir$ ?re%olds on types & scale ( reasonably =eseeable privacy h>ms2 & 7#b7 take into acc\nt expectations ( individuals1 pot5tial privacy h>ms1 & individuals' aw>5ess ( privacy h>ms4 7b7 ,cons5t revocation ,a cov]$ entity %all make available a reasonable me*anism by :i* an individual may revoke cons5t = any cons5t giv5 "u ?is ,act4 7c7 ,safe h>bor 7#a7 ,approval proc$ures ,! ,director %all develop proc$ures = analyz+ & approv+ data submitt$ by a cov]$ entity to e/abli% t a notice & cons5t process or privacy policy ( su* cov]$ entity meets ! ?re%old e/abli%$ "u subsection 7a74 7#b7 ,presumption ,if a cov]$ entity submits te/+ data to & receives an approval f ! ,director "u p>agraph 7#a7 e/abli%+ t a notice or cons5t process or privacy policy ( su* cov]$ entity meets ! ?re%old e/abli%$ "u subsection 7a71 su* notice or cons5t process or privacy policy %all be presum$ to h met su* ?re%old4 ,su* presumption may be rebutt$ by cle> & conv9c+ evid5ce4 7#c7 ,public availability ( ,approv$ processes & policies & associat$ te/+ data ,! ,director %all make publicly available onl9e ! notice & cons5t processes & privacy policies & associat$ te/+ data t ! ,director approves "u p>agraph 7#a74 7#d7 ,small bus9ess adoption ( notice or cons5t process ( ano!r cov]$ entity 7,a7 ,9 g5]al ,if a small bus9ess adopts a notice or cons5t process ( ano!r cov]$ entity t collects1 processes1 ma9ta9s1 or discloses p]sonal in=mation 9 sub/antially ! same way z su* small bus9ess1 if ! process ( su* o!r cov]$ entity has be5 approv$ "u p>agraph 7#a71 ! process ( su* small bus9ess %all receive ! presumption "u p>agraph 7#b74 7,b7 ,ability to freely use ,approv$ process ,a cov]$ entity ^: notice or cons5t process is approv$ "u p>agraph 7#a7 %all p]mit a small bus9ess to freely use su* process1 or a d]ivative !re(1 z describ$ 9 subp>agraph 7,a74 7,c7 ,no publi%$ process ,9 ! case ( a small bus9ess = :i* !re is no approv$ notice or cons5t process publi%$ "u p>agraph 7#c7 ( a cov]$ entity t collects1 processes1 ma9ta9s1 or discloses p]sonal in=mation 9 sub/antially ! same way z su* small bus9ess1 any requirem5t "u ?is title = a notice or cons5t process to be objectively %[n to meet ! ?re%old e/abli%$ by ! ,director "u subsection 7a7 %all n apply to su* small bus9ess4 ,no?+ 9 ! prec$+ s5t5ce exempts a small bus9ess f ! requirem5t to use su* notice or cons5t process or t su* process be concise & cle>4 7,d7 ,inapplicability to privacy policy ,p>agraph 7#d7 does n apply ) respect to a privacy policy4 7#e7 ,m9or *anges ,a cov]$ entity may make m9or *anges 9 a notice or cons5t process or privacy policy approv$ "u p>agraph 7#a7 & reta9 ! presumption "u p>agraph 7#b7 = su* process or policy )\t rete/+ or resubmission ( te/+ data to ! ,director4 #bji4 ,prohibition on d>k patt]ns 9 notice & cons5t processes & privacy policies ,9 provid+ notice1 obta9+ cons5t1 or ma9ta9+ a privacy policy z requir$ by ?is title1 a cov]$ entity may n int5tionally take any action t sub/antially impairs1 obscures1 or subv]ts ! ability ( an individual to-- 7#a7 und]/& ! cont5ts ( su* notice or su* privacy policy2 7#b7 und]/& ! process = grant+ su* cons5t2 7#c7 make a decision reg>d+ :e!r to grant or )draw su* cons5t2 or 7#d7 act on any su* decision4 #baj4 ,notice & cons5t requir$ 7a7 ,notice ,a cov]$ entity %all provide an individual ) notice ( ! p]sonal in=mation su* cov]$ entity collects1 processes1 ma9ta9s1 & discloses ?r\gh a process t is concise & cle> & c be objectively %[n to meet ! ?re%old e/abli%$ by ! ,director "u section #bjh7;a74 7b7 ,cons5t 7#a7 ,express cons5t requir$ ,except z provid$ 9 p>agraphs 7#b7 & 7#c71 a cov]$ entity may n collect f an individual p]sonal in=mation t creates or increases ! risk ( =eseeable privacy h>ms1 or process or ma9ta9 any su* p]sonal in=mation collect$ f an individual1 unless su* entity obta9s ! express cons5t ( su* individual to ! collect+1 process+1 or ma9ta9+ 7or any comb9ation !re(7 ( su* in=mation ?r\gh a process t is concise & cle> & c be objectively %[n to meet ! ?re%old e/abli%$ by ! ,director "u section #bjh7;a74 7#b7 ,exception = impli$ cons5t ,not)/&+ p>agraph 7#a71 express cons5t is n requir$ = collect+1 process+1 or ma9ta9+ p]sonal in=mation if ! collect+1 process+1 or ma9ta9+ is1 on its face1 obvi\s & necess>y to provide a s]vice at ! reque/ ( ! individual & ! p]sonal in=mation is collect$1 process$1 or ma9ta9$ only = su* reque/4 ,no?+ 9 ?is p>agraph %all be con/ru$ to exempt ! cov]$ entity f ! requirem5t ( subsection 7a7 to provide notice to su* individual ) respect to su* collect+1 process+1 or ma9ta9+4 7#c7 ,exemption = privacy-pres]v+ comput+ ,not)/&+ p>agraph 7#a71 except ) reg>d to cons5t = purposes ( section #ajf1 express cons5t is n requir$ = collect+1 process+1 or ma9ta9+ p]sonal in=mation secur$ us+ privacy-pres]v+ comput+4 ,no?+ 9 ?is p>agraph %all be con/ru$ to exempt ! cov]$ entity f ! requirem5t ( subsection 7a7 to provide notice to su* individual ) respect to su* collect+1 process+1 or ma9ta9+4 7c7 ,s]vice provid]s exclud$ ,?is section does n apply to a s]vice provid] if su* s]vice provid] has a reasonable belief t a cov]$ entity = :i* x processes1 ma9ta9s1 or discloses p]sonal in=mation is 9 compliance ) ?is section4 #baa4 ,privacy policy 7a7 ,policy requir$ ,a cov]$ entity %all ma9ta9 a privacy policy relat+ to ! practices ( su* entity reg>d+ ! collect+1 process+1 ma9ta9+1 & disclos+ ( p]sonal in=mation4 7b7 ,cont5ts ,! privacy policy requir$ by subsection 7a7 %all conta9 ! foll[+3 7#a7 ,a g5]al description ( ! practices ( ! cov]$ entity reg>d+ ! collect+1 process+1 ma9ta9+1 & disclos+ ( p]sonal in=mation4 7#b7 ,a description ( h[ individuals may ex]cise ! rights provid$ by title ,i4 7#c7 ,a cle> & concise summ>y ( ! foll[+3 7,a7 ,! categories ( p]sonal in=mation collect$ or o!rwise obta9$ by ! cov]$ entity4 7,b7 ,! bus9ess or comm]cial purposes ( ! cov]$ entity = collect+1 process+1 ma9ta9+1 or disclos+ p]sonal in=mation4 7,c7 ,! categories & a li/ ( ?ird p>ties to :i* ! cov]$ entity discloses p]sonal in=mation4 7#d7 ,a description ( ! p]sonal in=mation t ! cov]$ entity ma9ta9s t ! cov]$ entity does n collect f individuals & h[ ! cov]$ entity obta9s su* p]sonal in=mation4 7#e7 ,a li/ ( ! ?ird p>ties to :i* ! cov]$ entity has disclos$ p]sonal in=mation4 7#f7 ,a li/ ( ! ?ird p>ties f :i* ! cov]$ entity has obta9$ p]sonal in=mation at any "t on or aft] ! effective date ( ?is ,act4 7#g7 ,! articulat$ basis = ! collect+1 process+1 disclos+1 & ma9ta9+ ( p]sonal in=mation1 z requir$ "u section #bja7;a74 7c7 ,exemption = p]sonal in=mation = p>ticul> purposes ,! privacy policy requir$ by subsection 7a7 is n requir$ to conta9 in=mation relat+ to p]sonal in=mation t is collect$1 process$1 ma9ta9$1 or disclos$ exclusively = any ( ! purposes describ$ 9 p>agraph 7#a7 ( section #aji7;a7 7or a comb9ation ( su* purposes71 except z provid$ 9 p>agraph 7#b7 ( su* section4 7d7 ,availability ( privacy policy 7#a7 ,=m & mann] ,! privacy policy requir$ by subsection 7a7 %all be-- 7,a7 cle> & 9 pla9 language2 & 7,b7 made publicly available 9 a prom95t location on an ongo+ basis4 7#b7 ,tim+ ,! privacy policy requir$ by subsection 7a7 %all be made available z requir$ by p>agraph 7#a7 be=e ! cov]$ entity collects p]sonal in=mation aft] ! effective date ( ?is ,act4 7e7 ,small bus9esses exclud$ ,subsections 7b77#g7 & 7d7 d n apply to a small bus9ess4 7f7 ,s]vice provid]s exclud$ ,?is section does n apply to a s]vice provid] if su* s]vice provid] has a reasonable belief t a cov]$ entity = :i* x processes1 ma9ta9s1 or discloses p]sonal in=mation is 9 compliance ) ?is section4 #bab4 ,in=mation security requirem5ts 7a7 ,9 g5]al ,a cov]$ entity %all e/abli% & implem5t reasonable in=mation security policies1 practices1 & proc$ures = ! protection ( p]sonal in=mation collect$1 process$1 ma9ta9$1 or disclos$ by su* cov]$ entity1 tak+ into consid]ation-- 7#a7 ! nature1 scope1 & complexity ( ! activities engag$ 9 by su* cov]$ entity2 7#b7 ! s5sitivity ( any p]sonal in=mation at issue2 7#c7 ! curr5t /ate ( ! art 9 adm9i/rative1 te*nical1 & physical safegu>ds = protect+ su* in=mation2 & 7#d7 ! co/ ( implem5t+ su* adm9i/rative1 te*nical1 & physical safegu>ds4 7b7 ,specific policies1 practices1 & proc$ures ,! policies1 practices1 & proc$ures requir$ by subsection 7a7 %all include ! foll[+3 7#a7 ,a writt5 security policy ) respect to collect+1 process+1 ma9ta9+1 & disclos+ ( p]sonal in=mation4 ,su* policy %all be made publicly available 9 a prom95t location on an ongo+ basis1 except t ! publicly available v]sion is n requir$ to conta9 in=mation t w\ld compromise a purpose describ$ 9 section #aji7;a77#a74 7#b7 ,a process = id5tify+ & assess+ reasonably =eseeable security vuln]abilities 9 ! sy/em or sy/ems us$ by su* cov]$ entity t conta9 p]sonal in=mation1 :i* %all include regul> monitor+ = vuln]abilities or data brea*es involv+ su* sy/em or sy/ems4 7#c7 ,a process = tak+ action design$ to mitigate aga9/ vuln]abilities id5tifi$ 9 ! process requir$ by p>agraph 7#b71 :i* may include implem5t+ any *anges to security practices & ! ar*itecture1 in/allation1 or implem5tation ( network or op]at+ s(tw>e1 or = regul>ly te/+ or o!rwise monitor+ ! effectiv5ess ( ! exi/+ safegu>ds4 7#d7 ,a process = det]m9+ if p]sonal in=mation is no long] ne$$ & dispos+ ( p]sonal in=mation by %r$d+1 p]man5tly eras+1 or o!rwise modify+ ! m$ium on :i* su* p]sonal in=mation is ma9ta9$ to make su* p]sonal in=mation p]man5tly unreadable or indeciph]able4 7#e7 ,a process = ov]see+ p]sons :o h access to p]sonal in=mation1 includ+ ?r\gh network-connect$ devices4 7#f7 ,a process = employee tra9+ & sup]vision = implem5tation ( ! policies1 practices1 & proc$ures requir$ by ?is section4 7#g7 ,a writt5 plan or protocol = int]nal & public response 9 ! ev5t ( a data brea* or data-%>+ abuse4 7c7 ,regulations ,! ,director1 9 consultation ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all promulgate regulations to implem5t ?is section4 7d7 ,small bus9esses assi/ance ,! ,director1 9 consultation ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ! ,small ,bus9ess ,adm9i/ration1 ! ,m9ority ,bus9ess ,developm5t ,ag5cy1 & small bus9esses1 %all develop policy templates1 toolkits1 tip %eets1 configuration guidel9es = commonly us$ h>dw>e & s(tw>e1 int]active tools1 & o!r mat]ials to assi/ small bus9esses ) comply+ ) ?is section4 #bac4 ,notification ( data brea* or data-%>+ abuse 7a7 ,notification ( ag5cy 7#a7 ,9 g5]al ,9 ! case ( a data brea* or data-%>+ abuse ) respect to p]sonal in=mation ma9ta9$ by a cov]$ entity1 su* cov]$ entity %all1 )\t undue delay &1 if feasible1 n lat] ?an #gb h\rs aft] becom+ aw>e ( su* data brea* or data-%>+ abuse1 notify ! ,director ( su* data brea* or data-%>+ abuse1 unless su* data brea* or data-%>+ abuse is unlikely to create or increase =eseeable privacy h>ms4 7#b7 ,reasons = delay ,if ! notification requir$ by p>agraph 7#a7 is made m ?an #gb h\rs aft] ! cov]$ entity becomes aw>e ( ! data brea* or data-%>+ abuse1 su* notification %all be accompani$ by a /atem5t ( ! reasons = ! delay4 7b7 ,notification ( o!r cov]$ entity ,9 ! case ( a data brea* or data-%>+ abuse ) respect to p]sonal in=mation ma9ta9$ by a cov]$ entity t su* cov]$ entity obta9$ f ano!r cov]$ entity1 ! cov]$ entity exp]i5c+ su* data brea* or data-%>+ abuse %all1 )\t undue delay &1 if feasible1 n lat] ?an #gb h\rs aft] becom+ aw>e ( su* data brea* or data-%>+ abuse1 notify su* o!r cov]$ entity ( su* data brea* or data-%>+ abuse1 unless su* data brea* or data-%>+ abuse is unlikely to create or increase =eseeable privacy h>ms4 ,a cov]$ entity receiv+ notice "u ?is subsection ( a data brea* or data-%>+ abuse %all notify any o!r cov]$ entity f :i* ! cov]$ entity receiv+ notice obta9$ p]sonal in=mation involv$ 9 su* data brea* or data-%>+ abuse1 9 ! same mann] z requir$ "u ! prec$+ s5t5ce = ! cov]$ entity exp]i5c+ su* data brea* or data-%>+ abuse4 7c7 ,notification ( individuals 7#a7 ,9 g5]al ,9 ! case ( a data brea* or data-%>+ abuse ) respect to p]sonal in=mation ma9ta9$ by a cov]$ entity 7or a data brea* or data-%>+ abuse ab\t :i* a cov]$ entity is notifi$ "u subsection 7b771 if su* cov]$ entity has a relation%ip ) an individual ^: p]sonal in=mation 0 involv$ or pot5tially involv$ 9 su* data brea* or data-%>+ abuse1 su* cov]$ entity %all notify su* individual ( su* data brea* or data-%>+ abuse n lat] ?an #ad days aft] becom+ aw>e ( su* data brea* or data-%>+ abuse 7or1 9 ! case ( a data brea* or data-%>+ abuse ab\t :i* a cov]$ entity is notifi$ "u subsection 7b71 n lat] ?an #ad days aft] be+ s notifi$71 if su* data brea* or data-%>+ abuse creates or increases =eseeable privacy h>ms4 7#b7 ,m$ium ( notification ,a cov]$ entity %all notify an individual z requir$ by p>agraph 7#a7 ?r\gh-- 7,a7 ! same m$ium ?r\gh :i* su* individual r\t9ely int]acts ) su* cov]$ entity2 & 7,b7 "o additional m$ium ( notification1 if su* cov]$ entity has ! p]sonal in=mation necess>y to make a notification ?r\gh su* an additional m$ium )\t caus+ excessive f9ancial burd5 = su* cov]$ entity4 7d7 ,rule ( con/ruction ,?is section %all n apply to a cov]$ entity if a p]son uses p]sonal in=mation obta9$ f a data brea* or data-%>+ abuse n involv+ su* cov]$ entity4 ,,iii ,digital ,privacy ,ag5cy #cja4 ,e/abli%m5t2 ,director & ,deputy ,director 7a7 ,ag5cy e/abli%$ ,!re is e/abli%$ an indep5d5t ag5cy 9 ! executive bran* to be kn[n z ! ,digital ,privacy ,ag5cy1 :i* %all implem5t & en=ce ?is ,act4 7b7 ,director 7#a7 ,9 g5]al ,!re is e/abli%$ ! position ( ! ,director1 :o %all s]ve z ! head ( ! ,digital ,privacy ,ag5cy4 7#b7 ,appo9tm5t ,subject to p>agraph 7#c71 ! ,director %all be appo9t$ by ! ,presid5t1 by & ) ! advice & cons5t ( ! ,s5ate4 7#c7 ,qualification ,! ,director %all h a pr(essional backgr\nd1 exp]i5ce1 k1 & exp]tise 9 ! foll[+3 7,a7 ,privacy4 7,b7 ,in=mation security4 7,c7 ,te*nology4 7,d7 ,civil rights & civil lib]ties4 7#d7 ,t]m 7,a7 ,9 g5]al ,! ,director %all s]ve = a t]m ( #f ye>s4 7,b7 ,expiration ( t]m ,an individual may s]ve z ,director aft] ! expiration ( ! t]m = :i* appo9t$1 until a successor has be5 appo9t$ & qualifi$4 7#e7 ,comp5sation 7,a7 ,9 g5]al ,! ,director %all be comp5sat$ at ! rate prescrib$ = level ,,ii ( ! ,executive ,s*$ule "u section #ecac ( title #e1 ,unit$ ,/ates ,code4 7,b7 ,con=m+ am5dm5t ,section #ecac ( title #e1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] ! item relat+ to ! ,*ief ,executive ,(fic]1 ,unit$ ,/ates ,int]national ,developm5t ,f9ance ,corporation4 ! foll[+ new item3 ,director ( ! ,digital ,privacy ,ag5cy44 7c7 ,deputy director ,!re is e/abli%$ ! position ( ,deputy ,director1 :o %all be appo9t$ by ! ,director4 7d7 ,vacancy ( (fice ( ,director 7#a7 ,9 g5]al ,sections #ccde ?r\gh #ccdi;d ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,f$]al ,vacancies ,re=m ,act ( #aiih71 %all n apply to ! (fice ( ! ,director ( ! ,digital ,privacy ,ag5cy4 7#b7 ,l9e ( succession ,! ,deputy ,director %all s]ve z act+ ,director if ! ,director dies1 resigns1 or is o!rwise unable to p]=m ! functions & duties ( ! (fice4 ,! ,director %all e/abli% a l9e ( succession among s5ior (fic]s ( ! ,digital ,privacy ,ag5cy 9 ! ev5t ! position ( ,deputy ,director is vacant to p]=m ! functions & duties ( ! ,director tempor>ily 9 an act+ capacity4 7e7 ,s]vice re/riction ,no ,director or ,deputy ,director may hold any (fice1 position1 or employm5t 9 any cov]$ entity dur+ ! p]iod ( s]vice ( su* p]son z ,director or ,deputy ,director4 7f7 ,(fices ,! ,director %all e/abli% a pr9cipal (fice & field (fices ( ! ,digital ,privacy ,ag5cy 9 locations t h high levels ( activity by cov]$ entities1 z det]m9$ by ! ,director4 #cjb4 ,ag5cy p[]s & au?orities 7a7 ,p[]s ( ! ,digital ,privacy ,ag5cy ,! ,director is au?oriz$ to e/abli% ! g5]al policies ( ! ,digital ,privacy ,ag5cy ) respect to all executive & adm9i/rative functions1 includ+-- 7#a7 e/abli%+ ( rules = conduct+ ! g5]al bus9ess ( ! ,digital ,privacy ,ag5cy1 9 a mann] n inconsi/5t ) ?is ,act2 7#b7 b9d+ ! ,digital ,privacy ,ag5cy & ent]+ into contracts2 7#c7 direct+ ! e/abli%m5t & cont9u$ op]ation ( divisions or o!r (fices )9 ! ,digital ,privacy ,ag5cy1 9 ord] to c>ry out ! responsibilities ( ! ,digital ,privacy ,ag5cy "u ?is ,act1 & to satisfy ! requirem5ts ( o!r applicable law2 7#d7 coord9at+ & ov]see+ ! op]ation ( all adm9i/rative1 en=cem5t1 & rese>* activities ( ! ,digital ,privacy ,ag5cy2 7#e7 adopt+ & us+ a seal2 7#f7 det]m9+ ! "* ( & ! necessity = ! obligations & exp5ditures ( ! ,digital ,privacy ,ag5cy2 7#g7 appo9t+ & sup]vis+ ( p]sonnel employ$ by ! ,digital ,privacy ,ag5cy2 7#h7 di/ribut+ bus9ess among p]sonnel appo9t$ & sup]vis$ by ! ,director & among adm9i/rative units ( ! ,digital ,privacy ,ag5cy2 7#i7 us+ & exp5d+ ( funds2 7#aj7 implem5t+ ?is ,act ?r\gh rules1 ord]s1 guidance1 int]pretations1 /atem5ts ( policy1 inve/igations1 & en=cem5t actions2 & 7#aa7 p]=m+ su* o!r functions z may be au?oriz$ or requir$ by law4 7b7 ,delegation ( au?ority ,! ,director may n delegate ! p[] to appo9t ! ,deputy ,director "u section #cja7;c74 7c7 ,autonomy ( ag5cy reg>d+ recomm5dations & te/imony ,no (fic] or ag5cy ( ! ,unit$ ,/ates may require ! ,director or any o!r (fic] ( ! ,digital ,privacy ,ag5cy to submit legislative recomm5dations1 or te/imony or comm5ts on legislation1 to any (fic] or ag5cy ( ! ,unit$ ,/ates = approval1 comm5ts1 or review prior to ! submission ( su* recomm5dations1 te/imony1 or comm5ts to ! ,congress1 if su* recomm5dations1 te/imony1 or comm5ts to ! ,congress include a /atem5t indicat+ t ! views express$ !re9 are ^? ( ! ,director or su* (fic]1 & d n necess>ily reflect ! views ( ! ,presid5t4 7d7 ,rulemak+ au?ority 7#a7 ,9 g5]al ,! ,director may prescribe su* rules & regulations z may be necess>y & appropriate1 & 9 ! public int]e/1 to implem5t1 adm9i/]1 & c>ry out ?is ,act1 & to prev5t evasions !re(4 7#b7 ,regulations ,! ,digital ,privacy ,ag5cy may issue regulations aft] notice & comm5t 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 z may be necess>y to implem5t1 adm9i/]1 & c>ry out ?is ,act4 7e7 ,consultations ,9 implem5t+ or en=c+ ?is ,act1 ! ,director may consult )-- 7#a7 ,f$]al ag5cies t h-- 7,a7 jurisdiction ov] ,f$]al privacy laws2 & 7,b7 exp]tise 9 privacy or in=mation security2 7#b7 ,/ate attorneys g5]al1 ,/ate privacy regulators1 & o!r ,/ate ag5cies t h exp]tise 9 privacy or in=mation security2 7#c7 int]national & int]gov]nm5tal bodies t conduct activities relat+ to ! privacy or in=mation security2 7#d7 ag5cies ( o!r c\ntries t are simil> to ! ,digital ,privacy ,ag5cy or h exp]tise 9 privacy or in=mation security2 7#e7 privacy & in=mation security exp]ts 9 academia1 gov]nm5t1 civil society1 or indu/ry2 & 7#f7 advisory bo>ds ( ! ,digital ,privacy ,ag5cy e/abli%$ "u section #cjh1 z appropriate4 7f7 ,ag5cy def]5ce ,9 any action = judicial review ( regulations or ord]s ( ! ,digital ,privacy ,ag5cy1 ! review+ c\rt %all def] to ! reasonable int]pretation by ! ,digital ,privacy ,ag5cy ( ?is ,act4 #cjc4 ,report+ & audit requirem5ts 7a7 ,reports requir$ 7#a7 ,9 g5]al ,n lat] ?an #f mon?s aft] ! date ( ! enactm5t ( ?is ,act1 & e #f mon?s !reaft]1 ! ,director %all submit a report to ! ,presid5t & to ! ,committee on ,en]gy & ,comm]ce1 ! ,committee on ! ,judici>y1 & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation1 ! ,committee on ! ,judici>y1 & ! ,committee on ,appropriations ( ! ,s5ate1 & %all publi% su* report on ! website ( ! ,digital ,privacy ,ag5cy4 7#b7 ,cont5ts ,ea* report requir$ by subsection 7a7 %all include-- 7,a7 a discussion ( ! significant problems fac$ by individuals ) respect to ! privacy or security ( p]sonal in=mation2 7,b7 a ju/ification ( ! budget reque/ ( ! ,digital ,privacy ,ag5cy = ! prec$+ ye>1 unless a ju/ification = su* ye> 0 includ$ 9 ! prec$+ report submitt$ "u su* subsection2 7,c7 a li/ ( ! significant rules & ord]s adopt$ by ! ,digital ,privacy ,ag5cy1 z well z o!r significant initiatives conduct$ by ! ,digital ,privacy ,ag5cy1 dur+ ! prec$+ #f-mon? p]iod & ! plan ( ! ,digital ,privacy ,ag5cy = rules1 ord]s1 or o!r initiatives to be und]tak5 dur+ ! upcom+ #f-mon? p]iod2 7,d7 an analysis ( compla9ts ab\t ! privacy or security ( p]sonal in=mation t ! ,digital ,privacy ,ag5cy has receiv$ & collect$ 9 ! database describ$ 9 section #cjg7;a7 dur+ ! prec$+ #f-mon? p]iod2 7,e7 a li/1 ) a brief /atem5t ( ! issues1 ( ! public en=cem5t actions to :i* ! ,digital ,privacy ,ag5cy 0 a p>ty dur+ ! prec$+ #f-mon? p]iod2 & 7,f7 an assessm5t ( significant actions by ,/ate attorneys g5]al or ,/ate privacy regulators relat+ to ?is ,act or ! rules prescrib$ "u ?is ,act dur+ ! prec$+ #f-mon? p]iod4 7b7 ,annual audits ,! ,director %all ord] an annual indep5d5t audit ( ! op]ations & budget ( ! ,digital ,privacy ,ag5cy4 #cjd4 ,relation to o!r ag5cies 7a7 ,coord9ation 7#a7 ,9 g5]al ,) respect to cov]$ entities & s]vice provid]s1 to ! ext5t t ,f$]al law au?orizes ! ,digital ,privacy ,ag5cy & ano!r ,f$]al ag5cy to en=ce a ,f$]al privacy law1 ! head ( ! o!r ,f$]al ag5cy %all coord9ate ) ! ,director ( ! ,digital ,privacy ,ag5cy to promote consi/5t en=cem5t ( ?is ,act & ! o!r ,f$]al privacy law4 7#b7 ,ref]ral ,any ,f$]al ag5cy au?oriz$ to en=ce ,f$]al privacy laws may recomm5d 9 writ+ to ! ,digital ,privacy ,ag5cy t ! ,digital ,privacy ,ag5cy initiate an en=cem5t proce$+1 z ! ,digital ,privacy ,ag5cy is au?oriz$ by t ,f$]al privacy law or by ?is ,act4 7b7 ,transf]s f ! commission 7#a7 ,transf]s ( au?ority 7,a7 ,transf] ( rulemak+ & c]ta9 o!r au?orities "u ,f$]al privacy laws ,! ,digital ,privacy ,ag5cy %all h all p[]s & duties "u ! ,f$]al privacy laws to prescribe rules1 issue guidel9es1 or to conduct /udies or issue reports m&at$ by su* laws1 t 7 ve/$ 9 ! ,commission on ! effective date ( ?is ,act4 ,! au?ority ( ! ,commission "u ,f$]al privacy laws to prescribe rules1 issue guidel9es1 or conduct a /udy or issue a report m&at$ "u su* law %all be transf]r$ to ! ,digital ,privacy ,ag5cy on ! effective date ( ?is ,act4 7,b7 ,transf] ( en=cem5t au?ority ,! ,digital ,privacy ,ag5cy may en=ce a rule prescrib$ by ! ,commission "u-- 7i7 ,f$]al privacy laws2 or 7ii7 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 relat$ to unfair or deceptive acts or practices relat+ to privacy1 in=mation security1 id5tity !ft1 data abuses1 & relat$ matt]s4 7#b7 ,transf] ( privacy employees ,any employee ( ! ,commission employ$ 9 a division1 bureau1 (fice1 or o!r subdivision ( ! ,commission ) ! prim>y responsibility ( adm9i/]+1 inve/igat+1 or en=c+ ,f$]al privacy laws or applications ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 relat$ to unfair or deceptive acts or practices relat+ to privacy1 in=mation security1 id5tity !ft1 data abuses1 & relat$ matt]s %all be transf]r$ to ! ,digital ,privacy ,ag5cy4 ,su* employee %all be provid$ ) comp5sation & b5efits n less ?an ! equival5t ( comp5sation & b5efits provid$ to su* employee on ! date ( enactm5t ( ?is ,act or comp5sation & b5efits provid$ to an employee ( ! ,digital ,privacy ,ag5cy 9 comp>able position ) comp>able exp]i5ce4 7c7 ,pres]vation ( au?orities ( o!r ag5cies ,except z describ$ 9 ?is section1 no provision ( ?is ,act %all be con/ru$ z modify+1 limit+1 or o!rwise affect+ ! op]ation ( any provision ( ,f$]al law1 or o!rwise affect+ ! au?ority ( any ,f$]al ag5cy "u a ,f$]al privacy law or any o!r law1 includ+ ! ability ( su* ,f$]al ag5cy to promulgate regulations & en=ce ,f$]al privacy laws4 #cje4 ,p]sonnel 7a7 ,p]sonnel 7#a7 ,appo9tm5t g5]ally ,! ,director may fix ! numb] (1 & appo9t & direct1 all employees ( ! ,digital ,privacy ,ag5cy1 9 accordance ) ! applicable provisions ( title #e1 ,unit$ ,/ates ,code4 ,! ,director may appo9t p]sonnel )\t reg>d to ! provisions ( title #e1 ,unit$ ,/ates ,code1 gov]n+ appo9tm5ts 9 ! competitive s]vice1 s long z ! ,director sets requirem5ts1 conducts recruitm5t1 & det]m9es appo9tm5ts 9 a fair1 transp>5t1 & equitable mann]4 7#b7 ,employees ( ! ag5cy ,! ,director is au?oriz$ to employ privacy exp]ts1 te*nologi/s1 comput] sci5ti/s1 us] exp]i5ce design]s & rese>*]s1 data sci5ti/s1 e?ici/s1 attorneys1 inve/igators1 economi/s1 civil rights exp]ts1 & o!r employees z ! ,director consid]s necess>y to conduct ! bus9ess ( ! ,digital ,privacy ,ag5cy4 ,unless o!rwise provid$ expressly by law1 any individual appo9t$ "u ?is section %all be an employee1 z def9$ 9 section #baje ( title #e1 ,unit$ ,/ates ,code1 & subject to ! provisions ( su* title & o!r laws g5]ally applicable to ! employees ( an executive ag5cy4 7#c7 ,employee comp5sation ,! ,director may fix & adju/ ! pay & b5efits ( p]sonnel z ! ,director consid]s desirable1 competitive1 transp>5t1 & equitable1 )\t reg>d to ! provisions ( *apt] #ea & sub*apt] ,,iii ( *apt] #ec ( title #e1 ,unit$ ,/ates ,code1 relat+ to classification & ,g5]al ,s*$ule pay rates1 respectively4 7#d7 ,labor-managem5t relations ,*apt] #ga ( title #e1 ,unit$ ,/ates ,code1 %all apply to ! ,digital ,privacy ,ag5cy & ! employees ( ! ,digital ,privacy ,ag5cy4 7b7 ,additional roles 7#a7 ,*ief in=mation (fic] 7,a7 ,designation ( an ag5cy ,,cio ,sub*apt] ,,ii ( *apt] #aac ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7i7 9 section #aacae7;c7 by add+ & ( ! ,digital ,privacy ,ag5cy be=e ! em da% imm$iately prec$+ p>agraph 7#a72 & 7ii7 9 section #aacai7;a77#a7 by add+ & ! ,digital ,privacy ,ag5cy be=e ! p]iod4 7,b7 ,responsibility ,! ,*ief ,in=mation ,(fic] ( ! ,digital ,privacy ,ag5cy1 z designat$ by subp>agraph 7,a71 %all ensure ! ,digital ,privacy ,ag5cy uses te*nology effici5cy to implem5t1 adm9i/]1 & en=ce ?is ,act & ! rules & ord]s issu$ pursuant to ?is ,act4 7#b7 ,inspector g5]al ,section #dja ( title #e1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 p>agraph 7#a71 by ins]t+ ! ,digital ,privacy ,ag5cy1 aft] ! ,export-,import ,bank ( ! ,unit$ ,/ates12 & 7,b7 9 p>agraph 7#c71 by ins]t+ ! ,director ( ! ,digital ,privacy ,ag5cy2 aft] ! ,presid5t ( ! ,export-,import ,bank ( ! ,unit$ ,/ates24 7#c7 ,ombud ,! ,director %all appo9t an ombud :o %all-- 7,a7 act z a liaison betwe5 ! ,digital ,privacy ,ag5cy & any affect$ p]son ) respect to any problem t su* p]son may h 9 deal+ ) ! ,digital ,privacy ,ag5cy t results f ! regulatory activities ( ! ,digital ,privacy ,ag5cy2 & 7,b7 ensure t safegu>ds exi/ to enc\rage compla9ants to come =w>d & pres]ve confid5tiality4 7c7 ,au?ority ,to accept ,f$]al detailees ,! ,director may accept (fic]s or employees ( ! ,unit$ ,/ates or memb]s ( ! ,arm$ ,=ces on a detail f an elem5t ( ! ,f$]al ,gov]nm5t on a nonreimbursable basis1 z jo9tly agre$ to by ! heads ( ! receiv+ & detail+ elem5ts1 = a p]iod n to exce$ #c ye>s4 #cjf4 ,(fice ( ,civil ,rights ,! ,director %all e/abli% an ,(fice ( ,civil ,rights )9 ! ,digital ,privacy ,ag5cy t %all h foll[+ responsibilities3 7#a7 ,provid+ ov]sight & en=cem5t ( ?is ,act1 rules & ord]s issu$ pursuant to ?is ,act1 & ,f$]al privacy laws to ensure t collect+1 process+1 ma9ta9+1 & disclos+ ( p]sonal in=mation is fair1 equitable1 & non-discrim9atory 9 treatm5t & effect1 includ+ ?r\gh ! implem5tation & en=cem5t ( section #bjg4 7#b7 ,develop+1 e/abli%+1 & promot+ practices t affirmatively fur!r equal opportunity to & exp& access to employm5t 7includ+ hir+1 fir+1 promotion1 demotion1 & comp5sation71 cr$it & insurance 7includ+ d5ial ( an application or obta9+ less favorable t]ms71 h\s+1 education1 pr(essional c]tification1 or ! provision ( heal? c>e & relat$ s]vices4 7#c7 ,coord9at+ ! ,digital ,privacy ,ag5cy's civil rights ef=ts ) o!r ,f$]al ag5cies & ,/ate regulators1 z appropriate1 to promote consi/5t1 effici5t1 & effective en=cem5t ( ,f$]al civil rights laws4 7#d7 ,work+ ) civil rights advocates1 privacy exp]ts1 & o!r exp]ts 7includ+ memb]s ( ! advisory bo>ds e/abli%$ "u section #cjh7 on ! promotion ( compliance ) ! civil rights provisions "u ?is ,act1 rules & ord]s issu$ pursuant ?is ,act1 & ,f$]al privacy laws4 7#e7 ,liais+ ) communities & consum]s impact$ by practices regulat$ by ?is ,act & ! ,digital ,privacy ,ag5cy1 to ensure t _! ne$s & views are appropriately tak5 into acc\nt4 7#f7 ,provid+ annual reports to ,congress on ! ef=ts ( ! ,digital ,privacy ,ag5cy to fulfill its civil rights m&ate4 7#g7 ,su* additional p[]s & duties z ! ,director may det]m9e are appropriate4 #cjg4 ,compla9ts ( individuals 7a7 ,9 g5]al ,! ,director %all e/abli% a unit )9 ! ,digital ,privacy ,ag5cy ! functions ( :i* %all include e/abli%+ a s+le1 toll-free telephone numb]1 a website1 & a database or utiliz+ an exi/+ database to facilitate ! c5traliz$ collection (1 monitor+ (1 & response to compla9ts ( individuals reg>d+ ! privacy or security ( p]sonal in=mation4 ,! ,director %all coord9ate ) o!r ,f$]al ag5cies ) jurisdiction ov] ,f$]al privacy laws to r\te compla9ts to su* ag5cies1 :]e appropriate4 7b7 ,r\t+ compla9ts to /ates ,to ! ext5t practicable1 ,/ate ag5cies 7includ+ ,/ate privacy regulators7 may receive appropriate compla9ts f ! sy/ems e/abli%$ "u subsection 7a71 if-- 7#a7 ! ,/ate ag5cy sy/em has ! functional capacity to receive calls or electronic reports r\t$ by ! ,digital ,privacy ,ag5cy sy/ems2 7#b7 ! ,/ate ag5cy has satisfi$ any conditions ( p>ticipation 9 ! sy/em t ! ,digital ,privacy ,ag5cy may e/abli%1 includ+ treatm5t ( p]sonal in=mation & %>+ ( in=mation on compla9t resolution or relat$ compliance proc$ures & res\rces2 & 7#c7 p>ticipation by ! ,/ate ag5cy includes measures necess>y to provide = protection ( p]sonal in=mation t con=m to ! /&>ds = protection ( ! confid5tiality ( p]sonal in=mation & = data integrity & security t apply to ,f$]al ag5cies4 7c7 ,data %>+ requir$ ,to facilitate inclusion 9 ! reports requir$ by section #cjc ( ! matt]s reg>d+ compla9ts ( individuals requir$ by subsection 7a77#b77;,d7 ( su* section to be includ$ 9 su* reports1 inve/igation & en=cem5t activities1 & monitor+ ( ! privacy & security ( p]sonal in=mation1 ! ,digital ,privacy ,ag5cy %all %>e in=mation ab\t compla9ts ( individuals ) ,f$]al & ,/ate ag5cies 7includ+ ,/ate privacy regulators7 t h jurisdiction ov] ! privacy or security ( p]sonal in=mation & ,/ate attorneys g5]al1 subject to ! /&>ds applicable to ,f$]al ag5cies = ! protection ( ! confid5tiality ( p]sonal in=mation & = in=mation security & integrity4 ,o!r ,f$]al ag5cies t h jurisdiction ov] ! privacy or security ( p]sonal in=mation %all %>e data relat+ to compla9ts ( individuals reg>d+ ! privacy or security ( p]sonal in=mation ) ! ,digital ,privacy ,ag5cy1 subject to ! /&>ds applicable to ,f$]al ag5cies = ! protection ( confid5tiality ( p]sonal in=mation & = in=mation security & integrity4 7d7 ,publi%+ ( compla9ts 7#a7 ,cons5t requir$ ,9 collect+ a compla9t f an individual1 ! ,digital ,privacy ,ag5cy %all reque/ cons5t = publi%+ ! compla9t )\t any in=mation id5tify+ ! individual4 7#b7 ,public database ,! ,digital ,privacy ,ag5cy %all make publicly available on its website a database ( ea* compla9t = :i* x has receiv$ cons5t to publi% ! compla9t f an individual :o provid$ ! compla9t to ! ,digital ,privacy ,ag5cy4 7#c7 ,r$act+ in=mation ,:5 necess>y1 ! ,digital ,privacy ,ag5cy may r$act in=mation f a publi%$ compla9t to protect ! privacy ( ! individual4 #cjh4 ,advisory bo>ds 7a7 ,e/abli%m5t ,! ,director %all e/abli% ! foll[+ advisory bo>ds to advise & consult ) ! ,digital ,privacy ,ag5cy 9 ! ex]cise ( its functions "u ?is ,act1 & to provide in=mation on em]g+ practices relat+ to ! treatm5t ( p]sonal in=mation by cov]$ entities3 7#a7 ,! ,us] ,advisory ,bo>d1 :i* %all be compos$ ( exp]ts 9 consum] protection1 privacy1 civil rights1 & e?ics4 7#b7 ,! ,rese>* ,advisory ,bo>d1 :i* %all be compos$ ( individuals ) academic & rese>* exp]tise 9 privacy1 cyb]security1 comput] sci5ce1 innovation1 design1 e?ics1 economics1 law1 & public policy4 7#c7 ,! ,/>tup ,advisory ,bo>d1 :i* %all be compos$ ( repres5tatives ( small bus9esses & inve/ors 9 small bus9esses4 7#d7 ,! ,product ,advisory ,bo>d1 :i* %all be compos$ ( te*nologi/s1 comput] sci5ti/s1 design]s1 product manag]s1 attorneys1 & o!r repres5tatives ( cov]$ entities4 7b7 ,appo9tm5ts ,! ,director %all appo9t memb]s to ! advisory bo>ds e/abli%$ "u subsection 7a7 )\t reg>d to p>ty affiliation4 7c7 ,meet+s ,ea* advisory bo>d e/abli%$ "u subsection 7a7 %all meet f "t to "t at ! call ( ! ,director1 b1 at a m9imum1 %all meet at lea/ twice 9 ea* cal5d> ye>4 7d7 ,comp5sation & travel exp5ses ,memb]s ( ! advisory bo>ds e/abli%$ "u subsection 7a7 :o are n full-"t employees ( ! ,unit$ ,/ates %all-- 7#a7 be entitl$ to receive comp5sation at a rate fix$ by ! ,director :ile att5d+ meet+s ( ! advisory bo>d1 includ+ travel "t2 & 7#b7 receive travel exp5ses1 includ+ p] diem 9 lieu ( subsi/5ce1 9 accordance ) applicable provisions "u sub*apt] ,i ( *apt] #eg ( title #e1 ,unit$ ,/ates ,code4 #cji4 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to ! ,director to c>ry out ?is ,act #eej1jjj1jjj = ea* ( ! fiscal ye>s #bjbf1 #bjbg1 #bjbh1 #bjbi1 & #bjcj4 ,,iv ,en=cem5t #dja4 ,inve/igations & adm9i/rative discov]y 7a7 ,jo9t inve/igations ,! ,digital ,privacy ,ag5cy or1 :]e appropriate1 a ,digital ,privacy ,ag5cy inve/igator1 may conduct inve/igations & make reque/s = in=mation1 z au?oriz$ "u ?is ,act1 on a jo9t basis ) ano!r ,f$]al ag5cy1 a ,/ate attorney g5]al1 or a ,/ate privacy regulator4 7b7 ,subpo5as 7#a7 ,9 g5]al ,! ,digital ,privacy ,ag5cy or a ,digital ,privacy ,ag5cy inve/igator may issue subpo5as = ! att5dance & te/imony ( witnesses & ! production ( relevant pap]s1 books1 docum5ts1 or o!r mat]ial 9 connection ) he>+s "u ?is ,act4 7#b7 ,failure to obey ,9 ! case ( contumacy or refusal to obey a subpo5a issu$ pursuant to ?is subsection & s]v$ ^u any p]son1 ! di/rict c\rt ( ! ,unit$ ,/ates = any di/rict 9 :i* su* p]son is f\nd1 resides1 or transacts bus9ess1 ^u application by ! ,digital ,privacy ,ag5cy or a ,digital ,privacy ,ag5cy inve/igator & aft] notice to su* p]son1 may issue an ord] requir+ su* p]son to appe> & give te/imony or to appe> & produce docum5ts or o!r mat]ial4 7#c7 ,contempt ,any failure to obey an ord] ( ! c\rt "u p>agraph 7#b7 may be puni%$ by ! c\rt z a contempt !re(4 7c7 ,dem&s 7#a7 ,9 g5]al ,:5ev] ! ,digital ,privacy ,ag5cy has reason to believe t any p]son may be 9 possession1 cu/ody1 or control ( any docum5t>y mat]ial or tangible ?+s1 or may h any in=mation1 relevant to a violation1 ! ,digital ,privacy ,ag5cy may1 be=e ! in/itution ( any proce$+s "u ?is ,act1 issue 9 writ+1 & cause to be s]v$ ^u su* p]son1 a civil inve/igative dem& requir+ su* p]son to-- 7,a7 produce su* docum5t>y mat]ial = inspection & copy+ or reproduction 9 ! =m or m$ium reque/$ by ! ,digital ,privacy ,ag5cy2 7,b7 submit su* tangible ?+s2 7,c7 file writt5 reports or answ]s to que/ions2 7,d7 give oral te/imony conc]n+ docum5t>y mat]ial1 tangible ?+s1 or o!r in=mation2 or 7,e7 furni% any comb9ation ( su* mat]ial1 answ]s1 or te/imony4 7#b7 ,requirem5ts ,ea* civil inve/igative dem& %all /ate ! nature ( ! conduct con/itut+ ! alleg$ violation :i* is "u inve/igation & ! provision ( law applicable to su* violation4 7#c7 ,production ( docum5ts ,ea* civil inve/igative dem& = ! production ( docum5t>y mat]ial %all-- 7,a7 describe ea* class ( docum5t>y mat]ial to be produc$ "u ! dem& ) su* def9it5ess & c]ta9ty z to p]mit su* mat]ial to be fairly id5tifi$2 7,b7 prescribe a return date or dates :i* w provide a reasonable p]iod ( "t )9 :i* ! mat]ial s dem&$ may be assembl$ & made available = inspection & copy+ or reproduction2 & 7,c7 id5tify ! cu/odian to :om su* mat]ial %all be made available4 7#d7 ,production ( ?+s ,ea* civil inve/igative dem& = ! submission ( tangible ?+s %all-- 7,a7 describe ea* class ( tangible ?+s to be submitt$ "u ! dem& ) su* def9it5ess & c]ta9ty z to p]mit su* ?+s to be fairly id5tifi$2 7,b7 prescribe a return date or dates :i* w provide a reasonable p]iod ( "t )9 :i* ! ?+s s dem&$ may be assembl$ & submitt$2 & 7,c7 id5tify ! cu/odian to :om su* ?+s %all be submitt$4 7#e7 ,dem& = writt5 reports or answ]s ,ea* civil inve/igative dem& = writt5 reports or answ]s to que/ions %all-- 7,a7 prop\nd ) def9it5ess & c]ta9ty ! reports to be produc$ or ! que/ions to be answ]$2 7,b7 prescribe a date or dates at :i* "t writt5 reports or answ]s to que/ions %all be submitt$2 & 7,c7 id5tify ! cu/odian to :om su* reports or answ]s %all be submitt$4 7#f7 ,oral te/imony ,ea* civil inve/igative dem& = ! giv+ ( oral te/imony %all-- 7,a7 prescribe a date1 "t1 & place at :i* oral te/imony %all be comm5c$2 & 7,b7 id5tify a ,digital ,privacy ,ag5cy inve/igator :o %all conduct ! inve/igation & ! cu/odian to :om ! transcript ( su* inve/igation %all be submitt$4 7#g7 ,s]vice ,any civil inve/igative dem& issu$1 & any en=cem5t petition fil$1 "u ?is section may be s]v$-- 7,a7 by any ,digital ,privacy ,ag5cy inve/igator at any place )9 ! t]ritorial jurisdiction ( any c\rt ( ! ,unit$ ,/ates2 & 7,b7 ^u any p]son :o is n f\nd )9 ! t]ritorial jurisdiction ( any c\rt ( ! ,unit$ ,/ates-- 7i7 9 su* mann] z ! ,f$]al ,rules ( ,civil ,proc$ure prescribe = s]vice 9 a =eign nation2 & 7ii7 to ! ext5t t ! c\rts ( ! ,unit$ ,/ates h au?ority to ass]t jurisdiction ov] su* p]son1 consi/5t ) due process1 ! ,unit$ ,/ates ,di/rict ,c\rt = ! ,di/rict ( ,columbia %all h ! same jurisdiction to take any action respect+ compliance ) ?is section by su* p]son t su* di/rict c\rt w\ld h if su* p]son 7 p]sonally )9 ! jurisdiction ( su* di/rict c\rt4 7#h7 ,me?od ( s]vice ,s]vice ( any civil inve/igative dem& or any en=cem5t petition fil$ "u ?is section may be made ^u a p]son by-- 7,a7 deliv]+ a duly execut$ copy ( su* dem& or petition to ! individual or to any p>tn]1 executive (fic]1 manag+ ag5t1 or g5]al ag5t ( su* p]son1 or to any ag5t ( su* p]son au?oriz$ by appo9tm5t or by law to receive s]vice ( process on behalf ( su* p]son2 7,b7 deliv]+ a duly execut$ copy ( su* dem& or petition to ! pr9cipal (fice or place ( bus9ess ( ! p]son to be s]v$2 or 7,c7 deposit+ a duly execut$ copy 9 ! ,unit$ ,/ates mails1 by regi/]$ or c]tifi$ mail1 return receipt reque/$1 duly address$ to su* p]son at ! pr9cipal (fice or place ( bus9ess ( su* p]son4 7#i7 ,pro( ( s]vice 7,a7 ,9 g5]al ,a v]ifi$ return by ! individual s]v+ any civil inve/igative dem& or any en=cem5t petition fil$ "u ?is section sett+ =? ! mann] ( su* s]vice %all be pro( ( su* s]vice4 7,b7 ,return receipts ,9 ! case ( s]vice by regi/]$ or c]tifi$ mail1 su* return %all be accompani$ by ! return po/ (fice receipt ( deliv]y ( su* dem& or en=cem5t petition4 7#aj7 ,production ( docum5t>y mat]ial ,! production ( docum5t>y mat]ial 9 response to a civil inve/igative dem& %all be made "u a sworn c]tificate1 9 su* =m z ! dem& designates1 by ! p]son1 if a natural p]son1 to :om ! dem& is direct$ or1 if n a natural p]son1 by any p]son hav+ k ( ! facts & circum/ances relat+ to su* production1 to ! effect t all ( ! docum5t>y mat]ial requir$ by ! dem& & 9 ! possession1 cu/ody1 or control ( ! p]son to :om ! dem& is direct$ has be5 produc$ & made available to ! cu/odian4 7#aa7 ,submission ( tangible ?+s ,! submission ( tangible ?+s 9 response to a civil inve/igative dem& %all be made "u a sworn c]tificate1 9 su* =m z ! dem& designates1 by ! p]son to :om ! dem& is direct$ or1 if n a natural p]son1 by any p]son hav+ k ( ! facts & circum/ances relat+ to su* production1 to ! effect t all ( ! tangible ?+s requir$ by ! dem& & 9 ! possession1 cu/ody1 or control ( ! p]son to :om ! dem& is direct$ h be5 submitt$ to ! cu/odian4 7#ab7 ,sep>ate answ]s ,ea* report+ requirem5t or "q 9 a civil inve/igative dem& %all be answ]$ sep>ately & fully 9 writ+ "u oa?1 unless x is object$ to1 9 :i* ev5t ! reasons = ! objection %all be /at$ 9 lieu ( an answ]1 & x %all be submitt$ "u a sworn c]tificate1 9 su* =m z ! dem& designates1 by ! p]son1 if a natural p]son1 to :om ! dem& is direct$ or1 if n a natural p]son1 by any p]son responsible = answ]+ ea* report+ requirem5t or "q1 to ! effect t all in=mation requir$ by ! dem& & 9 ! possession1 cu/ody1 control1 or k ( ! p]son to :om ! dem& is direct$ has be5 submitt$4 7#ac7 ,te/imony 7,a7 ,9 g5]al 7i7 ,oa? & recordation ,! exam9ation ( any p]son pursuant to a dem& = oral te/imony s]v$ "u ?is subsection %all be tak5 be=e an (fic] au?oriz$ to adm9i/] oa?s & affirmations by ! laws ( ! ,unit$ ,/ates or ( ! place at :i* ! exam9ation is held4 ,! (fic] be=e :om oral te/imony is to be tak5 %all put ! witness on oa? or affirmation & %all p]sonally1 or by any individual act+ "u ! direction ( & 9 ! pres5ce ( ! (fic]1 record ! te/imony ( ! witness4 7ii7 ,transcription ,! te/imony %all be tak5 /5ographically & transcrib$4 7,b7 ,p>ties pres5t ,any ,digital ,privacy ,ag5cy inve/igator be=e :om oral te/imony is to be tak5 %all exclude f ! place :]e ! te/imony is to be tak5 all o!r p]sons1 except ! p]son giv+ ! te/imony1 ! attorney = t p]son1 ! (fic] be=e :om ! te/imony is to be tak51 an inve/igator or repres5tative ( an ag5cy ) :i* ! ,digital ,privacy ,ag5cy is engag$ 9 a jo9t inve/igation1 & any /5ograph] tak+ su* te/imony4 7,c7 ,location ,! oral te/imony ( any p]son tak5 pursuant to a civil inve/igative dem& %all be tak5 9 ! judicial di/rict ( ! ,unit$ ,/ates 9 :i* su* p]son resides1 is f\nd1 or transacts bus9ess1 or 9 su* o!r place z may be agre$ ^u by ! ,digital ,privacy ,ag5cy inve/igator be=e :om ! oral te/imony ( su* p]son is to be tak5 & su* p]son4 7,d7 ,attorney repres5tation 7i7 ,9 g5]al ,any p]son compell$ to appe> "u a civil inve/igative dem& = oral te/imony pursuant to ?is subsection may be accompani$1 repres5t$1 & advis$ by an attorney4 7ii7 ,au?ority ,! attorney may advise a p]son describ$ 9 clause 7i71 9 confid5ce1 ei!r ^u ! reque/ ( su* p]son or ^u ! initiative ( ! attorney1 ) respect to any "q ask$ ( su* p]son4 7iii7 ,objections ,a p]son describ$ 9 clause 7i71 or ! attorney = t p]son1 may object on ! record to any "q1 9 :ole or 9 "p1 & su* p]son %all briefly /ate = ! record ! reason = ! objection4 ,an objection may prop]ly be made1 receiv$1 & ent]$ ^u ! record :5 x is claim$ t su* p]son is entitl$ to refuse to answ] ! "q on gr\nds ( any con/itutional or o!r legal "r or privilege1 includ+ ! privilege aga9/ self-incrim9ation1 b su* p]son %all n o!rwise object to or refuse to answ] any "q1 & su* p]son or attorney %all n o!rwise int]rupt ! oral exam9ation4 7iv7 ,refusal to answ] ,if a p]son describ$ 9 clause 7i7 refuses to answ] any "q-- 7,i7 ! ,digital ,privacy ,ag5cy may petition ! di/rict c\rt ( ! ,unit$ ,/ates pursuant to ?is section = an ord] compell+ su* p]son to answ] su* "q2 & 7,,ii7 if ! refusal is on gr\nds ( ! privilege aga9/ self-incrim9ation1 ! te/imony ( su* p]son may be compell$ 9 accordance ) ! provisions ( section #fjjd ( title #ah1 ,unit$ ,/ates ,code4 7,e7 ,transcripts ,= purposes ( ?is subsection-- 7i7 aft] ! te/imony ( any witness is fully transcrib$1 ! ,digital ,privacy ,ag5cy inve/igator %all af=d ! witness 7:o may be accompani$ by an attorney7 a reasonable opportunity to exam9e ! transcript2 7ii7 ! transcript %all be read to or by ! witness1 unless su* exam9ation & read+ are waiv$ by ! witness2 7iii7 any *anges 9 =m or sub/ance :i* ! witness desires to make %all be ent]$ & id5tifi$ ^u ! transcript by ! ,digital ,privacy ,ag5cy inve/igator1 ) a /atem5t ( ! reasons giv5 by ! witness = mak+ su* *anges2 7iv7 ! transcript %all be sign$ by ! witness1 unless ! witness 9 writ+ waives ! sign+1 is ill1 _c be f\nd1 or refuses to sign2 & 7v7 if ! transcript is n sign$ by ! witness dur+ ! #cj-;day p]iod foll[+ ! date on :i* ! witness is fir/ af=d$ a reasonable opportunity to exam9e ! transcript1 ! ,digital ,privacy ,ag5cy inve/igator %all sign ! transcript & /ate on ! record ! fact ( ! waiv]1 illness1 abs5ce ( ! witness1 or ! refusal to sign1 toge!r ) any reasons giv5 = ! failure to sign4 7,f7 ,c]tification by inve/igator ,! ,digital ,privacy ,ag5cy inve/igator %all c]tify on ! transcript t ! witness 0 duly sworn by su* ,digital ,privacy ,ag5cy inve/igator & t ! transcript is a true record ( ! te/imony giv5 by ! witness1 & ! ,digital ,privacy ,ag5cy inve/igator %all promptly deliv] ! transcript or s5d x by regi/]$ or c]tifi$ mail to ! cu/odian4 7,g7 ,copy ( transcript ,! ,digital ,privacy ,ag5cy inve/igator %all furni% a copy ( ! transcript 7^u paym5t ( reasonable *>ges = ! transcript7 to ! witness only1 except t ! ,digital ,privacy ,ag5cy may = good cause limit su* witness to inspection ( ! (ficial transcript ( ! te/imony ( su* witness4 7,h7 ,witness fees ,any witness appe>+ = ! tak+ ( oral te/imony pursuant to a civil inve/igative dem& %all be entitl$ to ! same fees & mileage :i* are paid to witnesses 9 ! di/rict c\rts ( ! ,unit$ ,/ates4 7d7 ,confid5tial treatm5t ( dem& mat]ial 7#a7 ,9 g5]al ,docum5t>y mat]ials & tangible ?+s receiv$ z a result ( a civil inve/igative dem& %all be subject to requirem5ts & proc$ures reg>d+ confid5tiality1 9 accordance ) rules e/abli%$ by ! ,digital ,privacy ,ag5cy4 7#b7 ,disclosure to congress ,no rule e/abli%$ by ! ,digital ,privacy ,ag5cy reg>d+ ! confid5tiality ( mat]ials submitt$ to1 or o!rwise obta9$ by1 ! ,digital ,privacy ,ag5cy %all be int5d$ to prev5t disclosure to ei!r ,h\se ( ,congress or to an appropriate committee ( ! ,congress1 except t ! ,digital ,privacy ,ag5cy is p]mitt$ to adopt rules all[+ prior notice to any p>ty t owns or o!rwise provid$ ! mat]ial to ! ,digital ,privacy ,ag5cy & _h designat$ su* mat]ial z confid5tial4 7e7 ,petition = en=cem5t 7#a7 ,9 g5]al ,:5ev] any p]son fails to comply ) any civil inve/igative dem& duly s]v$ ^u su* p]son "u ?is section1 or :5ev] satisfactory copy+ or reproduction ( mat]ial reque/$ pursuant to ! dem& _c be accompli%$ & su* p]son refuses to surr5d] su* mat]ial1 ! ,digital ,privacy ,ag5cy1 ?r\gh su* (fic]s or attorneys z x may designate1 may file1 9 ! di/rict c\rt ( ! ,unit$ ,/ates = any judicial di/rict 9 :i* su* p]son resides1 is f\nd1 or transacts bus9ess1 & s]ve ^u su* p]son1 a petition = an ord] ( su* c\rt = ! en=cem5t ( ?is section4 7#b7 ,s]vice ( process ,all process ( any c\rt to :i* application may be made z provid$ 9 ?is subsection may be s]v$ 9 any judicial di/rict4 7f7 ,petition = ord] modify+ or sett+ aside dem& 7#a7 ,9 g5]al ,n lat] ?an #bj days aft] ! s]vice ( any civil inve/igative dem& ^u any p]son "u subsection 7c71 or at any "t be=e ! return date specifi$ 9 ! dem&1 :i*ev] p]iod is %ort]1 or )9 su* p]iod exce$+ #bj days aft] s]vice or 9 excess ( su* return date z may be prescrib$ 9 writ+1 subsequ5t to s]vice1 by any ,digital ,privacy ,ag5cy inve/igator nam$ 9 ! dem&1 su* p]son may file ) ! ,digital ,privacy ,ag5cy a petition = an ord] by ! ,digital ,privacy ,ag5cy modify+ or sett+ aside ! dem&4 7#b7 ,compliance dur+ p5d5cy ,! "t p]mitt$ = compliance ) ! dem& 9 :ole or 9 "p1 z det]m9$ prop] & ord]$ by ! ,digital ,privacy ,ag5cy1 %all n run dur+ ! p5d5cy ( a petition "u p>agraph 7#a7 at ! ,digital ,privacy ,ag5cy1 except t su* p]son %all comply ) any portions ( ! dem& n s\ght to be modifi$ or set aside4 7#c7 ,specific gr\nds ,a petition "u p>agraph 7#a7 %all specify ea* gr\nd ^u :i* ! petition] relies 9 seek+ relief1 & may be bas$ ^u any failure ( ! dem& to comply ) ! provisions ( ?is section1 or ^u any con/itutional or o!r legal "r or privilege ( su* p]son4 7g7 ,cu/odial control ,at any "t dur+ :i* any cu/odian is 9 cu/ody or control ( any docum5t>y mat]ial1 tangible ?+s1 reports1 answ]s to que/ions1 or transcripts ( oral te/imony giv5 by any p]son 9 compliance ) any civil inve/igative dem&1 su* p]son may file1 9 ! di/rict c\rt ( ! ,unit$ ,/ates = ! judicial di/rict )9 :i* ! (fice ( su* cu/odian is situat$1 & s]ve ^u su* cu/odian1 a petition = an ord] ( su* c\rt requir+ ! p]=mance by su* cu/odian ( any duty impos$ ^u su* cu/odian by ?is section or rule promulgat$ by ! ,digital ,privacy ,ag5cy4 7h7 ,jurisdiction ( c\rt 7#a7 ,9 g5]al ,:5ev] any petition is fil$ 9 any di/rict c\rt ( ! ,unit$ ,/ates "u ?is section1 su* c\rt %all h jurisdiction to he> & det]m9e ! matt] s pres5t$1 & to ent] su* ord] or ord]s z may be requir$ to c>ry out ! provisions ( ?is section4 7#b7 ,appeal ,any f9al ord] ent]$ z describ$ 9 p>agraph 7#a7 %all be subject to appeal pursuant to section #abia ( title #bh1 ,unit$ ,/ates ,code4 #djb4 ,he>+s & adjudication proce$+s 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ! ,digital ,privacy ,ag5cy is au?oriz$ to conduct he>+s & adjudication proce$+s ) respect to any p]son 9 ! mann] prescrib$ by sub*apt] ,,ii ( *apt] #e ( title #e1 ,unit$ ,/ates ,code1 9 ord] to ensure or en=ce compliance ) ?is ,act & ! rules prescrib$ "u ?is ,act4 7b7 ,special rules = cease-&-,desi/ proce$+s 7#a7 ,ord]s au?oriz$ 7,a7 ,9 g5]al ,if1 9 ! op9ion ( ! ,digital ,privacy ,ag5cy1 a p]son is engag+ or has engag$ 9 an act or omission t violates any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 ! ,digital ,privacy ,ag5cy may issue & s]ve ^u ! p]son a notice ( *>ges 9 respect !re(4 7,b7 ,cont5t ( notice ,! notice "u subp>agraph 7,a7 %all conta9 a /atem5t ( ! facts con/itut+ ! alleg$ violation1 & %all fix a "t & place at :i* a he>+ w be held to det]m9e :e!r an ord] to cease & desi/ %\ld issue aga9/ ! p]son1 su* he>+ to be held n e>li] ?an #cj days nor lat] ?an #fj days aft] ! date ( s]vice ( su* notice1 unless an e>li] or a lat] date is set by ! ,digital ,privacy ,ag5cy1 at ! reque/ ( any p]son s s]v$4 7,c7 ,cons5t ,unless a p]son s]v$ "u subp>agraph 7,a7 appe>s at ! he>+ p]sonally or by a duly au?oriz$ repres5tative1 ! p]son %all be deem$ to h cons5t$ to ! issuance ( ! cease-&-desi/ ord]4 7,d7 ,proc$ure ,9 ! ev5t ( cons5t "u subp>agraph 7,c71 or if1 ^u ! record made at any su* he>+1 ! ,digital ,privacy ,ag5cy f9ds t any violation specifi$ 9 ! notice ( *>ges has be5 e/abli%$1 ! ,digital ,privacy ,ag5cy may issue an ord] to cease & desi/ f ! violation4 ,su* ord] may1 by provisions :i* may be m&atory or o!rwise1 require ! p]son to cease & desi/ f ! subject act or omission1 & to take affirmative action to correct ! conditions result+ f any su* violation4 7#b7 ,effectiv5ess ( ord] ,a cease-&-desi/ ord] %all become effective at ! expiration ( #cj days aft] ! date ( s]vice ( ! ord] "u p>agraph 7#a77;,d7 7except 9 ! case ( a cease-&-desi/ ord] issu$ ^u cons5t1 :i* %all become effective #ahj days aft] ! date ( s]vice ( ! notice ( *>ges "u p>agraph 7#a77;,a771 & %all rema9 effective & en=ceable z provid$ !re91 except to su* ext5t z ! ord] is /ay$1 modifi$1 t]m9at$1 or set aside by action ( ! ,digital ,privacy ,ag5cy or a review+ c\rt4 7#c7 ,decision & ,appeal ,any he>+ provid$ = 9 ?is subsection %all be held 9 ! ,f$]al judicial di/rict or 9 ! t]ritory 9 :i* ! resid5ce or pr9cipal (fice or place ( bus9ess ( ! p]son is locat$ unless ! p]son cons5ts to ano!r place1 & %all be conduct$ 9 accordance ) ! provisions ( sub*apt] ,,ii ( *apt] #e ( title #e1 ,unit$ ,/ates ,code4 ,aft] su* he>+1 & n lat] ?an #ij days aft] ! ,digital ,privacy ,ag5cy has s]v$ ! notice "u p>agraph 7#a77;,a71 ! ,digital ,privacy ,ag5cy %all r5d] its decision 7:i* %all include f9d+s ( fact ^u :i* its decision is pr$icat$7 & %all issue & s]ve ^u ea* su* p>ty an ord] or ord]s consi/5t ) ! provisions ( ?is section4 ,judicial review ( any su* ord] %all be exclusively z provid$ 9 ?is subsection4 ,unless a petition = review is timely fil$ 9 a c\rt ( appeals ( ! ,unit$ ,/ates1 z provid$ 9 p>agraph 7#d71 & !reaft] until ! record 9 ! proce$+ has be5 fil$ z provid$ 9 p>agraph 7#d71 ! ,digital ,privacy ,ag5cy may at any "t1 ^u su* notice & 9 su* mann] z ! ,digital ,privacy ,ag5cy %all det]m9e prop]1 modify1 t]m9ate1 or set aside any su* ord]4 ,^u fil+ ( ! record z provid$1 ! ,digital ,privacy ,ag5cy may modify1 t]m9ate1 or set aside any su* ord] ) p]mission ( ! c\rt4 7#d7 ,appeal to c\rt ( ,appeals ,any p>ty to any proce$+ "u ?is subsection may obta9 a review ( any ord] s]v$ pursuant to ?is subsection 7o!r ?an an ord] issu$ ) ! cons5t ( ! p>ty7 by fil+ 9 ! c\rt ( appeals ( ! ,unit$ ,/ates = ! circuit 9 :i* ! resid5ce or pr9cipal (fice or place ( bus9ess ( ! p>ty is locat$1 or 9 ! ,unit$ ,/ates ,c\rt ( ,appeals = ! ,di/rict ( ,columbia ,circuit1 )9 #cj days aft] ! date ( s]vice ( su* ord]1 a writt5 petition pray+ t ! ord] ( ! ,digital ,privacy ,ag5cy be modifi$1 t]m9at$1 or set aside4 ,a copy ( su* petition %all be =?) transmitt$ by ! cl]k ( ! c\rt to ! ,digital ,privacy ,ag5cy1 & !reupon ! ,digital ,privacy ,ag5cy %all file 9 ! c\rt ! record 9 ! proce$+1 z provid$ 9 section #baab ( title #bh1 ,unit$ ,/ates ,code4 ,^u ! fil+ ( su* petition1 su* c\rt %all h jurisdiction1 :i* ^u ! fil+ ( ! record %all be exclusive1 to affirm1 modify1 t]m9ate1 or set aside1 9 :ole or 9 "p1 ! ord] ( ! ,digital ,privacy ,ag5cy4 ,review ( su* proce$+s %all be _h z provid$ 9 *apt] #g ( title #e1 ,unit$ ,/ates ,code4 7#e7 ,no /ay ,! comm5cem5t ( proce$+s = judicial review "u p>agraph 7#d7 %all n1 unless specifically ord]$ by ! c\rt1 op]ate z a /ay ( any ord] issu$ by ! ,digital ,privacy ,ag5cy4 7c7 ,special rules = tempor>y cease-&-,desi/ proce$+s 7#a7 ,9 g5]al ,:5ev] ! ,digital ,privacy ,ag5cy det]m9es t ! violation specifi$ 9 ! notice ( *>ges s]v$ ^u a p]son pursuant to subsection 7b71 or ! cont9uation !re(1 is likely to cause ! p]son to be insolv5t or o!rwise prejudice ! int]e/s ( individuals be=e ! completion ( ! proce$+s conduct$ pursuant to subsection 7b71 ! ,digital ,privacy ,ag5cy may issue a tempor>y ord] requir+ ! p]son to cease & desi/ f any su* violation & to take affirmative action to prev5t or rem$y su* insolv5cy or o!r condition p5d+ completion ( su* proce$+s4 ,su* ord] may include any requirem5t au?oriz$ "u ?is title4 ,su* ord] %all become effective ^u s]vice ^u ! p]son &1 unless set aside1 limit$1 or susp5d$ by a c\rt 9 proce$+s au?oriz$ by p>agraph 7#b71 %all rema9 effective & en=ceable p5d+ ! completion ( ! adm9i/rative proce$+s pursuant to su* notice & until su* "t z ! ,digital ,privacy ,ag5cy %all dismiss ! *>ges specifi$ 9 su* notice1 or if a cease-&-desi/ ord] is issu$ aga9/ ! p]son1 until ! effective date ( su* ord]4 7#b7 ,appeal ,n lat] ?an #aj days aft] a p]son has be5 s]v$ ) a tempor>y cease-&-desi/ ord]1 ! p]son may apply to ! ,unit$ ,/ates di/rict c\rt = ! judicial di/rict 9 :i* ! resid5ce or pr9cipal (fice or place ( bus9ess ( ! p]son is locat$1 or ! ,unit$ ,/ates ,di/rict ,c\rt = ! ,di/rict ( ,columbia1 = an injunction sett+ aside1 limit+1 or susp5d+ ! en=cem5t1 op]ation1 or effectiv5ess ( su* ord] p5d+ ! completion ( ! adm9i/rative proce$+s pursuant to ! notice ( *>ges s]v$ ^u ! p]son "u subsection 7b71 & su* c\rt %all h jurisdiction to issue su* injunction4 7d7 ,special rules = en=cem5t ( ord]s ,! ,digital ,privacy ,ag5cy may 9 its discretion apply to ! ,unit$ ,/ates di/rict c\rt )9 ! jurisdiction ( :i* ! resid5ce or pr9cipal (fice or place ( bus9ess ( a p]son is locat$1 = ! en=cem5t ( any effective & out/&+ ord] issu$ "u ?is section aga9/ su* p]son1 & su* c\rt %all h jurisdiction & p[] to ord] & require compliance ) su* ord]4 #djc4 ,litigation au?ority 7a7 ,9 g5]al ,if a p]son violates any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 ! ,digital ,privacy ,ag5cy may comm5ce a civil action aga9/ su* p]son 9 a c\rt ( compet5t jurisdiction to impose a civil p5alty or to seek all appropriate legal & equitable relief1 includ+ a p]man5t or tempor>y injunction4 7b7 ,compromise ( actions ,! ,digital ,privacy ,ag5cy may compromise or settle any action1 suit1 or o!r c\rt proce$+ to :i* ! ,digital ,privacy ,ag5cy is a p>ty if su* compromise is approv$ by ! c\rt4 7c7 ,notice to ! attorney g5]al ( ! ,unit$ ,/ates 7#a7 ,9 g5]al ,:5 comm5c+ a civil action "u ?is ,act or regulations or rules or ord]s issu$ pursuant to ?is ,act1 ! ,digital ,privacy ,ag5cy %all notify ! ,attorney ,g5]al4 7#b7 ,notice & coord9ation 7,a7 ,notice ( o!r actions ,9 addition to any notice requir$ "u p>agraph 7#a71 ! ,digital ,privacy ,ag5cy %all notify ! ,attorney ,g5]al conc]n+ any action1 suit1 or o!r c\rt proce$+ to :i* ! ,digital ,privacy ,ag5cy is a p>ty4 7,b7 ,coord9ation ,9 ord] to avoid conflicts & promote consi/5cy reg>d+ litigation ( matt]s "u ,f$]al law1 ! ,attorney ,g5]al & ! ,digital ,privacy ,ag5cy %all consult reg>d+ ! coord9ation ( inve/igations & proce$+s1 includ+ by negotiat+ an agreem5t = coord9ation n lat] ?an #ahj days aft] ! effective date ( ?is ,act4 ,! agreem5t "u ?is subp>agraph %all include provisions to ensure t p>allel inve/igations & proce$+s involv+ ?is ,act & ! rules prescrib$ "u ?is ,act are conduct$ 9 a mann] t avoids conflicts & does n imp$e ! ability ( ! ,attorney ,g5]al to prosecute violations ( ,f$]al crim9al laws4 7,c7 ,rule ( con/ruction ,no?+ 9 ?is p>agraph %all be con/ru$ to limit ! au?ority ( ! ,digital ,privacy ,ag5cy "u ?is ,act1 includ+ ! au?ority to int]pret ?is ,act4 7d7 ,appe>ance be=e ! ,supreme ,c\rt ,! ,digital ,privacy ,ag5cy may repres5t itself 9 its own "n be=e ! ,supreme ,c\rt ( ! ,unit$ ,/ates1 if ! ,digital ,privacy ,ag5cy makes a writt5 reque/ to ! ,attorney ,g5]al )9 ! #aj-;day p]iod :i* beg9s on ! date ( entry ( ! judgm5t :i* w\ld p]mit any p>ty to file a petition = writ ( c]tior>i1 & ! ,attorney ,g5]al concurs ) su* reque/ or fails to take action )9 #fj days ( ! reque/ ( ! ,digital ,privacy ,ag5cy4 7e7 ,=um ,any civil action br\ght "u ?is ,act or regulations or rules or ord]s issu$ pursuant to ?is ,act may be br\ght 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates or an appropriate ,/ate c\rt4 7f7 ,"t = br++ action ,except z o!rwise p]mitt$ by law or equity1 no action may be br\ght "u ?is ,act m ?an #c ye>s aft] ! date ( discov]y ( ! violation to :i* ! action relates4 #djd4 ,en=cem5t by ,/ates 7a7 ,civil action ,9 any case 9 :i* a ,/ate attorney g5]al or a ,/ate privacy regulator has reason to believe t an int]e/ ( ! resid5ts ( a ,/ate has be5 or is adv]sely affect$ by any p]son :o violates any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 ! ,/ate attorney g5]al or ,/ate privacy regulator1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate ,/ate c\rt or an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7#a7 enjo9 fur!r violation ( su* provision by ! def5dant2 7#b7 compel compliance ) su* provision2 or 7#c7 obta9 relief "u section #djf4 7b7 ,rights ( ag5cy ,be=e initiat+ a civil action "u subsection 7a71 ! ,/ate attorney g5]al or ,/ate privacy regulator1 z ! case may be1 %all notify ! ,digital ,privacy ,ag5cy 9 writ+ ( su* civil action4 ,^u receiv+ notice ) respect to a civil action1 ! ,digital ,privacy ,ag5cy may-- 7#a7 int]v5e 9 su* action2 & 7#b7 ^u int]v5+-- 7,a7 be he>d on all matt]s aris+ 9 su* civil action2 & 7,b7 file petitions = appeal ( a decision 9 su* action4 7c7 ,preemptive action by ag5cy ,if ! ,digital ,privacy ,ag5cy in/itutes a civil action = violation ( any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 no ,/ate attorney g5]al or ,/ate privacy regulator may br+ a civil action aga9/ any def5dant nam$ 9 ! compla9t ( ! ,digital ,privacy ,ag5cy = a violation ( su* provision t is alleg$ 9 su* compla9t4 #dje4 ,private rights ( action 7a7 ,injunctive relief ,a p]son :o is aggriev$ by a violation ( ?is ,act may br+ a civil action = decl>atory or injunctive relief 9 any c\rt ( compet5t jurisdiction4 7b7 ,civil action = damages ,except = claims "u rule #bc ( ! ,f$]al ,rules ( ,civil ,proc$ure or a simil> judicial proc$ure au?oriz+ an action to be br\ght by #a or m repres5tatives1 a p]son :o is aggriev$ by a violation ( ?is ,act may br+ a civil action = damages 9 any c\rt ( compet5t jurisdiction4 7c7 ,nonpr(it collective repres5tation ,an individual %all h ! "r to appo9t a nonpr(it organization 7z describ$ 9 section #eja7;c77#c7 ( ! ,int]nal ,rev5ue ,code ( #aihf & exempt f taxation "u section #eja7;a7 ( su* ,code7 :i* has be5 prop]ly con/itut$ 9 accordance ) ! law1 has /atutory objectives :i* are 9 ! public int]e/1 & is active 9 ! field ( ! protection ( individual rights & fre$oms ) reg>d to ! protection ( privacy & in=mation security to lodge ! compla9t on behalf ( su* individual to ex]cise ! rights ref]r$ to 9 ?is ,act on behalf ( su* individual4 7#a7 ,a nonpr(it may repres5t a class ( aggriev$ individuals4 7#b7 ,a prevail+ nonpr(it %all receive reasonable comp5sation = exp5ses1 includ+ attorneys' fees4 7#c7 ,individuals %all receive an equally divid$ %>e ( ! total damages4 7d7 ,/ate ,appo9tm5t ,a ,/ate may provide t any body1 organization1 or association ref]r$ to 9 subsection 7c71 indep5d5t ( an individual's appo9tm5t1 has ! "r to lodge1 9 t ,/ate1 a compla9t ) ! ,digital ,privacy ,ag5cy & to ex]cise ! rights ref]r$ to 9 ?is ,act if x consid]s t ! rights ( an individual "u ?is ,act h be5 infr+$4 #djf4 ,relief available 7a7 ,civil actions & adjudication proce$+s 7#a7 ,jurisdiction ,9 any civil action or any adjudication proce$+ br\ght by ! ,digital ,privacy ,ag5cy1 a ,/ate attorney g5]al1 or ,/ate privacy regulator "u any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 ! c\rt or ! ,digital ,privacy ,ag5cy 7z ! case may be7 %all h jurisdiction to grant any appropriate legal or equitable relief ) respect to a violation ( su* provision4 7#b7 ,relief ,relief "u ?is section may include-- 7,a7 rescission or re=mation ( contracts2 7,b7 refund ( moneys2 7,c7 re/itution2 7,d7 disgorgem5t or comp5sation = unju/ enri*m5t2 7,e7 paym5t ( damages or o!r monet>y relief2 7,f7 public notification reg>d+ ! violation1 includ+ ! co/s ( notification2 7,g7 limits on ! activities or functions ( ! p]son2 & 7,h7 civil money p5alties1 z provid$ 9 subsection 7c74 7#c7 ,no exempl>y or punitive damages ,no?+ 9 ?is subsection %all be con/ru$ z au?oriz+ ! imposition ( exempl>y or punitive damages4 7b7 ,recov]y ( co/s ,9 any civil action br\ght by ! ,digital ,privacy ,ag5cy1 ,/ate attorney g5]al1 or ,/ate privacy regulator "u any provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 ! ,digital ,privacy ,ag5cy1 ,/ate attorney g5]al1 or ,/ate privacy regulator may recov] its co/s 9 connection ) prosecut+ su* action if ! ,digital ,privacy ,ag5cy or ,/ate attorney g5]al is ! prevail+ p>ty 9 ! action4 7c7 ,civil money p5alty 9 c\rt & adm9i/rative actions 7#a7 ,9 g5]al ,any p]son :o violates1 ?r\gh any act or omission1 any provision ( ?is ,act or a rule or ord] issu$ pursuant to ?is ,act %all =feit & pay a civil p5alty "u ?is subsection4 7#b7 ,p5alty am\nt 7,a7 ,9 g5]al ,! am\nt ( a civil p5alty "u ?is subsection may n exce$1 = ea* violation1 ! product (-- 7i7 ! maximum civil p5alty = :i* a p]son1 p>tn]%ip1 or corporation may be liable "u section #e7m77#a77;,a7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m77#a77;,a77 = a violation ( a rule "u su* ,act respect+ unfair or deceptive acts or practices1 z adju/$ "u ! ,f$]al ,civil ,p5alties ,inflation ,adju/m5t ,act ( #aiij 7#bh ,u4,s4,c4 #bdfa note72 & 7ii7 ! numb] ( individuals ^: p]sonal in=mation is affect$ by ! violation4 7,b7 ,cont9u+ violations ,9 ! case ( a violation ?r\gh cont9u+ failure to comply ) a provision ( ?is ,act or a rule or ord] prescrib$ "u ?is ,act1 ea* day ( cont9uance ( su* failure %all be treat$ z a sep>ate violation = purposes ( subp>agraph 7,a74 7#c7 ,mitigat+ factors ,9 det]m9+ ! am\nt ( any p5alty assess$ "u p>agraph 7#b71 ! c\rt or ! ,digital ,privacy ,ag5cy %all take into acc\nt ! appropriat5ess ( ! p5alty ) respect to-- 7,a7 ! size ( f9ancial res\rces & good fai? ( ! p]son *>g$2 7,b7 ! gravity ( ! violation2 7,c7 ! sev]ity ( ! privacy h>ms 7includ+ bo? actual & pot5tial h>ms7 to individuals2 7,d7 any disp>ate impact ( ! privacy h>ms 7includ+ bo? actual & pot5tial h>ms7 on protect$ classes2 7,e7 ! hi/ory ( previ\s violations2 & 7,f7 su* o!r matt]s z ju/ice may require4 7#d7 ,au?ority to modify or remit p5alty ,! ,digital ,privacy ,ag5cy1 ,/ate attorney g5]al1 or ,/ate privacy regulator may compromise1 modify1 or remit any p5alty :i* may be assess$ or has already be5 assess$ "u p>agraph 7#b74 ,! am\nt ( su* p5alty1 :5 f9ally det]m9$1 %all be exclusive ( any sums ow$ by ! p]son to ! ,unit$ ,/ates 9 connection ) ! co/s ( ! proce$+1 & may be d$uct$ f any sums ow+ by ! ,unit$ ,/ates to ! p]son *>g$4 7#e7 ,notice & he>+ ,no civil p5alty may be assess$ "u ?is subsection ) respect to a violation ( any provision ( ?is ,act or a rule or ord] issu$ pursuant to ?is ,act1 unless-- 7,a7 ! ,digital ,privacy ,ag5cy1 ,/ate attorney g5]al1 or ,/ate privacy regulator gives notice & an opportunity = a he>+ to ! p]son accus$ ( ! violation2 or 7,b7 ! appropriate c\rt has ord]$ su* assessm5t & ent]$ judgm5t 9 favor ( ! ,digital ,privacy ,ag5cy1 ,/ate attorney g5]al1 or ,/ate privacy regulator4 #djg4 ,ref]ral = crim9al proce$+s ,if ! ,digital ,privacy ,ag5cy obta9s evid5ce t any p]son1 dome/ic or =eign1 has engag$ 9 conduct t may con/itute a violation ( ,f$]al crim9al law1 ! ,digital ,privacy ,ag5cy %all transmit su* evid5ce to ! ,attorney ,g5]al ( ! ,unit$ ,/ates1 :o may in/itute crim9al proce$+s "u appropriate law4 ,no?+ 9 ?is section affects any o!r au?ority ( ! ,digital ,privacy ,ag5cy to disclose in=mation4 #djh4 ,:i/lebl[] en=cem5t 7a7 ,9 g5]al ,any p]son :o becomes aw>e1 bas$ on nonpublic in=mation1 t a cov]$ entity has violat$ ?is ,act may file a civil action = civil p5alties1 if prior to fil+ su* action1 ! p]son files ) ! ,director a writt5 reque/ = ! ,director to comm5ce ! action4 ,! reque/ %all include a cle> & concise /atem5t ( ! gr\nds = believ+ a cause ( action exi/s4 ,! p]son %all make ! nonpublic in=mation available to ! ,director ^u reque/3 7#a7 ,if ! ,director files suit )9 #ij days f receipt ( ! writt5 reque/ to comm5ce ! action1 no o!r action may be br\ght unless ! action br\ght by ! ,director is dismiss$ )\t prejudice4 7#b7 ,if ! ,director does n file suit )9 #ij days f receipt ( ! writt5 reque/ to comm5ce ! action1 ! p]son reque/+ ! action may proce$ to file a civil action4 7#c7 ,! "t p]iod )9 :i* a civil action %all be comm5c$ %all be toll$ f ! date ( receipt by ! ,director ( ! writt5 reque/ to ei!r ! date t ! civil action is dismiss$ )\t prejudice1 or = #aej days1 :i*ev] is lat]1 b only = a civil action br\ght by ! p]son :o reque/$ ! ,director to comm5ce ! action4 7b7 ,allocation ( civil p5alties ,if a judgm5t is ent]$ aga9/ ! def5dant or def5dants 9 an action br\ght pursuant to ?is section1 or ! matt] is settl$1 am\nts receiv$ z civil p5alties or pursuant to a settlem5t ( ! action %all be allocat$ z foll[s3 7#a7 ,if ! action 0 br\ght by ! ,director ^u a reque/ made by a p]son pursuant to subsection 7a71 ! p]son :o made ! reque/ %all be entitl$ to #ae p]c5t ( ! civil p5alties4 7#b7 ,if ! action 0 br\ght by ! p]son :o made ! reque/ pursuant to subsection 7a71 t p]son %all receive an am\nt ! c\rt det]m9es is reasonable = collect+ ! civil p5alties on behalf ( ! gov]nm5t4 ,! am\nt %all be n less ?an #be p]c5t & n m ?an #ej p]c5t ( ! proce$s ( ! action & %all be paid out ( ! proce$s4 ,v ,relation to ,o!r ,law #eja4 ,effective date 7a7 ,9 g5]al ,?is ,act %all apply beg9n+ on ! date t is #a ye> aft] ! date ( ! enactm5t ( ?is ,act4 7b7 ,au?ority ,to promulgate regulations & take c]ta9 o!r actions ,no?+ 9 subsection 7a7 affects ! au?ority ( ! ,digital ,privacy ,ag5cy to take an action expressly requir$ by a provision ( ?is ,act to be tak5 be=e ! effective date describ$ 9 su* subsection4 #ejb4 ,relation to o!r ,f$]al law ,no?+ 9 ?is ,act %all be con/ru$ to modify1 limit1 or sup]s$e ! op]ation ( any privacy or security provision 9 ! foll[+3 7#a7 ,section #eeb;a ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,privacy ,act ( #aigd74 7#b7 ,! ,"r to ,f9ancial ,privacy ,act ( #aigh 7#ab ,u4,s4,c4 #cdja et seq474 7#c7 ,! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq474 7#d7 ,! ,fair ,debt ,collection ,practices ,act 7#ae ,u4,s4,c4 #afib et seq474 7#e7 ,! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq474 7#f7 ,title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7#g7 ,*apt] #aai1 #abc1 or #bjf ( title #ah1 ,unit$ ,/ates ,code4 7#h7 ,section #ddd ( ! ,g5]al ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly kn[n z ! ,family ,educational ,rights & ,privacy ,act ( #aigd74 7#i7 ,section #dde ( ! ,g5]al ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;h74 7#aj7 ,! ,privacy ,protection ,act ( #aihj 7#db ,u4,s4,c4 #bjjj;aa et seq474 7#aa7 ,! regulations promulgat$ "u section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 z ^? regulations relate to-- 7,a7 a p]son describ$ 9 section #aagb7;a7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#a7;a772 or 7,b7 transactions ref]r$ to 9 section #aagc7;a77#a7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#b7;a77#a774 7#ab7 ,! ,communications ,assi/ance = ,law ,en=cem5t ,act 7#dg ,u4,s4,c4 #ajja et seq474 7#ac7 ,section #bbb1 #bbg1 #cch1 or #fca ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb1 #bbg1 #cch1 or #eea74 7#ad7 ,! ,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4 #aja et seq474 7#ae7 ,! ,pap]work ,r$uction ,act ( #aiie 7#dd ,u4,s4,c4 #ceja et seq474 7#af7 ,! ,f$]al ,in=mation ,security ,managem5t ,act ( #bjjb 7#dd ,u4,s4,c4 #ceda et seq474 7#ag7 ,! ,curr5cy & ,=eign ,transactions ,report+ ,act ( #aigj1 z am5d$ 7commonly kn[n z ! ,bank ,secrecy ,act7 7#ab ,u4,s4,c4 #ahbi;b & #aiea-aiei1 #ca ,u4,s4,c4 #ecaa-ecad & #ecaf-eccb71 includ+ ! ,int]national ,money ,laund]+ ,abatem5t & ,f9ancial ,anti-,t]rorism ,act ( #bjja1 title ,,iii ( ,public ,law #ajg-ef1 z am5d$4 7#ah7 ,! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjja et seq474 7#ai7 ,! ,=eign ,intellig5ce ,surveillance ,act ( #aigh1 z am5d$ 7#ej ,u4,s4,c4 #ahja et seq474 7#bj7 ,! ,civil ,rights ,act ( #aifd 7,public ,law #hh-ceb1 #gh ,/at4 #bda74 7#ba7 ,! ,am]icans ) ,disabilities ,act 7#db ,u4,s4,c4 #abaja et seq474 7#bb7 ,! ,fair ,h\s+ ,act 7#db ,u4,s4,c4 #cfja et seq474 7#bc7 ,! ,consum] ,f9ancial ,protection ,act ( #bjaj 7#ab ,u4,s4,c4 #edha et seq474 7#bd7 ,! ,equal ,cr$it ,opportunity ,act 7#ae ,u4,s4,c4 #afia et seq474 7#be7 ,! ,age ,discrim9ation 9 ,employm5t ,act 7#bi ,u4,s4,c4 #fba et seq474 7#bf7 ,! ,g5etic ,in=mation ,nondiscrim9ation ,act 7,public ,law #aaj-bcc1 #abb ,/at4 #hha74 7#bg7 ,subp>t ,a ( "p #df ( title #de1 ,code ( ,f$]al ,regulations 7commonly kn[n z ! ,common ,rule74 7#bh7 ,! ,driv]'s ,privacy ,protection ,act ( #aiid 7#ah ,u4,s4,c4 #bgba et seq474 7#bi7 ,! ,video ,privacy ,protection ,act 7#ah ,u4,s4,c4 #bgaj et seq474 7#cj7 ,*apt]s #fa1 #fh1 #ge1 & #gf ( ! ,int]nal ,rev5ue ,code ( #aihf4 7#ca7 ,section #aajf ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acjf74 7#cb7 ,! ,/or$ ,communications ,act 7#ah ,u4,s4,c4 #bgja et seq474 7#cc7 ,any o!r privacy or in=mation security provision ( ,f$]al law4 #ejc4 ,relation to ,/ate law ,?is ,act1 & any am5dm5t1 /&>d1 rule1 requirem5t1 assessm5t1 or regulation promulgat$ "u ?is ,act1 does n annul1 alt]1 affect1 or exempt any p]son subject to ! provisions ( ?is ,act f comply+ ) ! laws ( any ,/ate or political subdivision ( a ,/ate ) respect to privacy or consum] protection1 except to ! ext5t t ^? laws are inconsi/5t ) any provisions ( ?is ,act1 & !n only to ! ext5t ( ! inconsi/5cy4 ,= purposes ( ?is section1 a law ( a ,/ate or political subdivision ( a ,/ate is n inconsi/5t ) ?is ,act if ! protection su* law af=ds any consum] is great] ?an ! protection provid$ by ?is ,act4 #ejd4 ,sev]ability ,if any provision ( ?is ,act or ! am5dm5ts made by ?is ,act1 or ! application !re(1 is held uncon/itutional or o!rwise invalid1 ! validity ( ! rema9d] ( ! ,act1 ! am5dm5ts1 & ! application ( su* provision %all n be affect$ !reby4 ,,vi ,,ni/ & ,,nsf ,activities #fja4 ,national ,in/itute ( ,/&>ds & ,te*nology privacy rese>* & developm5t ,section #b ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgb7 is am5d$ by add+ at ! end ! foll[+3 7f7 ,privacy risk managem5t rese>* ,9 c>ry+ out ! activities "u subsection 7c77#ai71 ! ,director1 9 consultation & collaboration ) ! ,director ( ! ,digital ,privacy ,ag5cy1 %all1 to ! ext5t practicable & appropriate c>ry out ! foll[+3 7#a7 ,develop1 & p]iodically update1 9 collaboration ) appropriate ,f$]al ag5cies1 indu/ry1 ,/ate1 local1 & ,tribal gov]nm5ts1 civil society1 o!r nonpr(it organizations1 & ! ,in=mation ,security & ,privacy ,advisory ,bo>d1 a privacy risk managem5t framework t cov]s risks associat$ ) data process+ & t-- 7,a7 id5tifies volunt>y1 cons5sus-bas$ te*nical /&>ds1 guidel9es1 be/ practices1 me?odologies1 proc$ures1 & processes =-- 7i7 develop+ privacy-enhanc$ in=mation sy/ems & networks1 includ+ em]g+ te*nologies2 & 7ii7 assess+ & mitigat+ privacy risks to help organizations protect individuals' privacy 9 in=mation sy/ems & networks2 7,b7 e/abli%es common def9itions & *>act]izations = aspects ( privacy risk managem5t2 7,c7 provides case /udies & risk pr(iles ( framework implem5tation2 7,d7 provides guidance to enable organizations to use ! framework to meet privacy requirem5ts f ,f$]al1 ,/ate1 local1 & ,tribal gov]nm5ts & int]national policymak]s2 7,e7 incorporates volunt>y1 cons5sus-bas$ te*nical /&>ds & be/ practices2 7,f7 facilitates use by regulators & m>kets ) ! aim ( r$uc+ b>ri]s to trade2 & 7,g7 does n prescribe or o!rwise require ! use ( specific in=mation or communications te*nology products or s]vices4 7#b7 ,c>ry out rese>* associat$ ) mitigat+ privacy risks associat$ ) in=mation sy/ems & networks1 includ+ to in=m p]iodic updates to ! privacy risk managem5t framework develop$ pursuant to p>agraph 7#a74 7#c7 ,9 consultation ) ! ,director ( ! ,digital ,privacy ,ag5cy1 ! ,f$]al ,trade ,commission1 & o!r relat$ sector-specific risk managem5t ag5cies1 support ! developm5t ( guidance & risk pr(iles to help organizations utilize ! privacy risk managem5t framework develop$ pursuant to p>agraph 7#a71 to ! ext5t practicable1 to adopt privacy requirem5ts & regulations e/abli%$ by ! ,f$]al ,gov]nm5t1 ,/ates1 & int]national policymak]s4 7#d7 ,support activities to improve ! efficacy & applicability ( privacy-pres]v+ comput+1 de-id5tification te*niques & processes1 & o!r te*nological means ( mitigat+ individuals' privacy risks by enhanc+ pr$ictability1 manageability1 disassociability1 & confid5tiality4 7#e7 ,support & /rategically engage 9 ! developm5t ( volunt>y1 cons5sus-bas$ te*nical /&>ds = privacy-enhanc$ sy/ems & networks1 includ+ int]national te*nical /&>ds1 ?r\gh op51 transp>5t1 & cons5sus-bas$ processes4 7#f7 ,conduct su* o!r activities z det]m9$ necess>y by ! ,director to help public & private sector organizations mitigate ! privacy risks associat$ ) in=mation sy/ems & networks4 4 #fjb4 ,national privacy aw>5ess & education initiative 7a7 ,9 g5]al ,! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 9 consultation & collaboration ) ! ,director ( ! ,digital ,privacy ,ag5cy1 relevant ,f$]al ag5cies1 ,/ate1 local1 & ,tribal gov]nm5ts1 indu/ry1 educational in/itutions1 civil society1 & o!r nonpr(it organizations1 z appropriate1 %all c>ry out privacy-relat$ education & public aw>5ess activities1 includ+ relat+ to ! foll[+3 7#a7 ,! widespread dissem9ation ( privacy-relat$ te*nical /&>ds & be/ practices id5tifi$ by ! ,director4 7#b7 ,ef=ts to make privacy-relat$ te*nical /&>ds & be/ practices usable by individuals1 small- to m$ium-siz$ bus9esses1 educational in/itutions1 & ,/ate1 local1 & ,tribal gov]nm5ts4 7#c7 ,activities to increase ! aw>5ess ( privacy risks1 individual privacy rights1 & responsibilities4 7#d7 ,support+ ! developm5t ( te*nical /&>ds & be/ practices to describe privacy-relat$ tasks1 k1 skills1 compet5cies1 & "w roles to guide c>e] developm5t1 education1 & tra9+ activities 9 indu/ry1 academia1 nonpr(it organizations1 & ! ,f$]al ,gov]nm5t1 includ+ support = cr$5tial+4 7b7 ,consid]ations ,9 c>ry+ out subsection 7a71 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 9 consultation ) appropriate ,f$]al ag5cies1 %all lev]age1 to ! ext5t practicable1 ! national cyb]security aw>5ess & education program "u section #cjc ( ! ,cyb]security ,enhancem5t ,act ( #bjad 7#ae ,u4,s4,c4 #gddc74 7c7 ,bi5nial brief+s ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is ,act & bi5nially !reaft]1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all brief ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se ( ,repres5tatives on ! activities c>ri$ out pursuant to subsection 7a74 7d7 ,au?orization ( appropriations ,!re is au?oriz$ to be appropriat$ to c>ry out ?is section #c1jjj1jjj = ea* ( fiscal ye>s #bjbf ?r\gh #bjcj4 #fjc4 ,national ,sci5ce ,f\ndation privacy rese>* ,! ,director ( ! ,national ,sci5ce ,f\ndation1 9 consultation & collaboration ) ! ,director ( ! ,digital ,privacy ,ag5cy1 %all make aw>ds on a competitive basis to in/itutions ( high] education or non-pr(it organizations 7or consortia ( su* in/itutions or organizations7 to support multidiscipl9>y & transdiscipl9>y socio-te*nical rese>* to design1 prototype1 & translate to practice privacy-pres]v+ te*nologies & increase und]/&+ ( ! human1 social1 behavioral1 & economic dim5sions ( su* te*nologies1 includ+ rese>* on ! foll[+3 7#a7 ,public und]/&+1 expectations1 & p]spectives on privacy4 7#b7 ,consum] privacy rights1 includ+ "r to access1 correction1 deletion1 data portability1 individual autonomy1 imp]man5ce1 & to be in=m$4 7#c7 ,privacy gov]nance & transp>5cy1 includ+ notice & cons5t processes & ! efficacy ( privacy policies4 7#d7 ,emp[]+ consum]s = data own]%ip & control4 7#e7 ,privacy by design4 7#f7 ,privacy-pres]v+ automat$ decision-mak+ sy/ems & human review ( automat$ decision-mak+ sy/ems4 7#g7 ,ensur+ privacy 9 consum] surveillance sy/ems4 7#h7 ,us] int]faces1 includ+ design elem5ts t delib]ately obscure1 mislead1 co]ce1 or deceive consum]s4 7#i7 ,privacy implications ( em]g+ te*nologies4 7#aj7 ,inc5tives to implem5t privacy protections4