,i  #aaith ,,congress  #b;d ,session    
,h4 ,r4 #hdac  ,,in ,,the ,,house ,,of  
,,representatives  ,april #ba1 #bjbf,mr4
 ,joyce of ,pennsylvania 7for himself1  
,mr4 ,fry1 ,mr4 ,kean1 ,mr4 ,obernolte1 
,mr4 ,langworthy1 ,mr4 ,goldman of      
,texas1 ,mr4 ,griffith1 ,mr4 ,balderson1
 and ,mrs4 ,fedorchak7 introduced the   
following bill2 which was referred to   
the ,committee on ,energy and ,commerce1
 and in addition to the ,committee on   
the ,judiciary1 for a period to be      
subsequently determined by the ,speaker1
 in each case for consideration of such 
provisions as fall within the           
jurisdiction of the committee concerned 
,a ,,bill  ,to establish a national     
framework for consumer privacy rights   
and the protection of personal data1 and
 for other purposes4  #a4 ,short title  
7a7 ,short title ,this ,act may be cited
 as the ,securing and ,establishing     
,consumer ,uniform ,rights and          
,enforcement over ,data ,act or the     
,,secure ,data ,act4  7b7 ,table of     

contents ,the table of contents for the 
,act is as follows3  ,sec4 #a4 ,short   
title4 ,sec4 #b4 ,consumer privacy      
rights4 ,sec4 #c4 ,controllers4 ,sec4   
#d4 ,data security4 ,sec4 #e4 ,data     
brokers4 ,sec4 #f4 ,processors4 ,sec4   
#g4 ,deidentified and pseudonymous data4
 ,sec4 #h4 ,codes of conduct4 ,sec4 #i4 
,cross-border data flows4 ,sec4 #aj4    
,study on universal opt-out mechanisms4 
,sec4 #aa4 ,rules of construction4 ,sec4
 #ab4 ,enforcement4 ,sec4 #ac4          
,applicability4 ,sec4 #ad4 ,relationship
 to ,federal laws4 ,sec4 #ae4           
,relationship to ,state laws4 ,sec4 #af4
 ,definitions4 ,sec4 #ag4 ,severability4
 ,sec4 #ah4 ,effective dates4  #b4      
,consumer privacy rights  7a7 ,consumer 
privacy rights ,a consumer has the      
following privacy rights with respect to
 a controller3 7#a7 ,to confirm whether 
a controller is processing the personal 
data of the consumer and have access to 
a copy of such data1 unless the         
confirmation and access would require   

the controller to reveal a trade secret4
  7#b7 ,to correct any inaccuracy in the
 personal data of the consumer1 taking  
into account the nature of the personal 
data and the purpose of processing the  
personal data4  7#c7 ,to delete personal
 data provided by or obtained about the 
consumer4  7#d7 ,if the data is         
available in a digital format and to the
 extent technically feasible1 to obtain 
a copy of the personal data that the    
consumer previously provided to the     
controller in a portable and readily    
usable format that allows the consumer  
to transmit the data to another         
controller without hindrance4  7#e7 ,to 
opt out of the processing of the        
personal data for the following         
purposes3  7,a7 ,targeted advertising4  
7,b7 ,the sale of personal data4  7,c7  
,reliance on profiling to make a        
decision that has a legal or similarly  
significant effect on the consumer4  7b7
 ,consent required for processing       
sensitive data  7#a7 ,in general ,except

 as provided in paragraphs 7#b7 and     
7#c71 a controller may not process the  
sensitive data of a consumer without    
obtaining the consent of the consumer   
before processing4  7#b7 ,applicability 
to a child ,notwithstanding paragraph   
7#a71 a controller shall process the    
sensitive data of a child in accordance 
with the ,children's ,online ,privacy   
,protection ,act of #aiih 7#ae ,u4,s4,c4
 #feja et seq74  7#c7 ,applicability to 
a teen ,notwithstanding paragraph 7#a71 
a controller may not process the        
sensitive data of a teen without        
obtaining the verifiable consent of a   
parent of the teen4  7c7  ,consumer     
privacy rights requests  7#a7  ,request 
for consumer rights  ,a controller shall
 comply with any consumer privacy right 
described in subsection 7a7 once a      
consumer submits a request that         
specifies each consumer privacy right   
the consumer requests to exercise and   
the controller authenticates the        
consumer4  7#b7  ,child and teen        

consumer rights  ,with respect to a     
consumer privacy right described in     
subsection 7a7 for a child or teen1 only
 a parent of the child or teen may      
exercise such consumer privacy right on 
behalf of the child or teen4  7d7       
,controller requirements  7#a7 ,deadline
 for response ,except as provided in    
paragraph 7#b71 without undue delay and 
not later than #de days after the date  
on which a consumer submits a request   
under subsection 7c71 a controller--    
7,a7 shall respond to the consumer and  
comply with each privacy right          
requested2 or  7,b7 shall provide a     
notice to the consumer that-- 7i7 the   
controller declines to take action2     
7ii7 includes a justification for such  
inaction2 and  7iii7 includes           
instructions on how the consumer can    
appeal the decision of such inaction4   
7#b7 ,extension of response period ,the 
controller may extend the period        
described in paragraph 7#a77;,a7 an     
additional #de days when reasonably     

necessary1 taking into consideration the
 complexity and number of requests      
submitted by the consumer1 if the       
controller informs the consumer of the  
extension during such period with the   
reason for such extension4  7#c7 ,fees  
charged  7,a7 ,free of charge ,for each 
consumer privacy right described in     
subsection 7a71 a consumer may submit to
 each controller #b requests under      
subsection 7c7 related to such consumer 
privacy right in a year free of charge4 
7,b7 ,reasonable fee for administrative 
cost ,if a consumer submits more than #b
 such requests or submits a request that
 is technically infeasible or manifestly
 unfounded1 the controller may-- 7i7    
charge the consumer a reasonable fee to 
cover the administrative costs of       
complying with the request if the       
controller has notified the consumer of 
such fee and the consumer has consented 
to pay such fee2 or  7ii7 decline to act
 on the request4  7,c7 ,controller      
documentation required ,the controller  

shall demonstrate1 document1 and provide
 to the ,commission or a ,state attorney
 general1 upon request1 any technically 
infeasible or manifestly unfounded      
nature of any such request4  7#d7       
,authentication ,if a controller is     
unable to authenticate a consumer who   
submits a request under subsection 7c71 
the controller is not required to comply
 with such request and may request that 
the consumer provide additional         
information reasonably necessary to     
authenticate the consumer and the       
request4  7#e7 ,personal data obtained  
from third party ,a controller that     
obtains personal data about a consumer  
from a source other than the consumer is
 considered to be in compliance with the
 request of a consumer under subsection 
7c7 to delete that personal data under  
subsection 7a77#c7 by--  7,a7 retaining 
a record of the deletion request and the
 minimum data necessary for the purpose 
of ensuring the personal data of the    
consumer remains deleted from the       

records of the controller and not using 
the retained data for any other purpose 
under this ,act2 or  7,b7 opting the    
consumer out of the processing of that  
personal data for any purpose other than
 a purpose that is exempt under the     
provisions of this ,act4  7#f7          
,applicability to a child ,with respect 
to a request of a consumer under        
subsection 7c7 for a child1 a controller
 shall be deemed to be in compliance    
with such subsection if the controller  
responds to an equivalent consumer      
privacy right exercised by a parent     
under the ,children's ,online ,privacy  
,protection ,act of #aiih 7#ae ,u4,s4,c4
 #feja et seq74  7e7 ,appeal process    
7#a7 ,establishment of process ,a       
controller shall establish a process for
 a consumer to appeal a determination by
 the controller to not take action under
 subsection 7d77#a77;,b74  7#b7         
,availability ,the appeal process       
established pursuant to paragraph 7#a7  
shall be conspicuously available and    

similar to the process for a request    
submitted under subsection 7c74  7#c7   
,deadline to respond ,not later than #fj
 days after the date on which an appeal 
is received by a controller1 the        
controller--  7,a7 shall inform the     
consumer in writing of any action taken 
or not taken in response to the appeal1 
including a written explanation of each 
reason for a decision2 and  7,b7 if the 
appeal is denied1 shall provide the     
consumer with an online mechanism1 if   
available1 or other method through which
 the consumer may contact the           
,commission or a ,state attorney general
 to submit a complaint4  7f7 ,exercising
 consumer rights  7#a7 ,submission of   
requests ,a controller shall establish  
and describe in a privacy notice one or 
more secure and reliable means for a    
consumer to submit a request to exercise
 consumer privacy rights described under
 subsection 7a74  7#b7 ,considerations  
,in establishing the means pursuant to  
paragraph 7#a71 a controller shall take 

into account the ways in which a        
consumer normally interacts with the    
controller1 the need for secure and     
reliable communication of such requests1
 and the ability of the controller to   
authenticate the consumer making the    
request4  7#c7 ,new accounts not        
required ,a controller may not require a
 consumer to create a new account in    
order to exercise consumer privacy      
rights described under subsection 7a7   
but may require a consumer to use an    
existing account4  #c4 ,controllers  7a7
 ,data minimization ,a controller shall 
limit the collection of personal data to
 what is adequate1 relevant1 and        
reasonably necessary in relation to each
 purpose for which the data is processed
 as disclosed to the consumer4  7b7     
,limitation on secondary uses ,except as
 otherwise provided in this section1 a  
controller may not process personal data
 for any purpose that is not reasonably 
necessary or compatible with the        
disclosed purpose for which the personal

 data is processed as disclosed to the  
consumer1 unless the controller obtains 
the consent of the consumer before any  
such processing4  7c7 ,civil rights ,a  
controller may not process personal data
 in violation of a ,federal law that    
prohibits unlawful discrimination       
against a consumer4  7d7                
,non-,discrimination  ,a controller may 
not discriminate against a consumer for 
exercising any consumer right described 
under section #b1 including by denying  
goods or services1 charging different   
prices or rates for goods or services1  
or providing a different level of       
quality of goods and services to the    
consumer4  7e7 ,consumer loyalty        
programs ,nothing in subsection 7d7 may 
be construed-- 7#a7 to require a        
controller to provide a product or      
service that requires the personal data 
of a consumer that the controller does  
not collect or maintain2 or  7#b7 to    
prohibit a controller from offering a   
different price1 rate1 level1 quality1  

or selection of goods or services to a  
consumer1 including offering goods or   
services for no fee1 if the offer is    
related to the voluntary participation  
of a consumer in a bona fide loyalty1   
rewards1 premium features1 discounts1 or
 club card program4  7f7 ,non-,waiver of
 consumer rights ,beginning on the date 
of the enactment of this ,act1 any      
provision of a contract or agreement of 
any kind that waives or limits a        
consumer right described under section  
#b shall be deemed contrary to public   
policy and shall be void and            
unenforceable4  7g7 ,notice to consumers
 ,before processing the personal data of
 a consumer1 a controller shall provide 
that consumer with a reasonably         
accessible1 clear1 and meaningful       
privacy notice that includes the        
following3 7#a7 ,each category of       
personal data processed by the          
controller4  7#b7 ,each purpose for     
processing personal data4  7#c7 ,how a  
consumer may exercise a consumer right  

described under section #b1 including   
how a consumer may appeal the decision  
of a controller under section #b7;d74   
7#d7 ,each category of personal data the
 controller shares with any other       
controller or any governmental entity4  
7#e7 ,each category of other controllers
 or any governmental entity1 if any1    
with whom the controller shares personal
 data4  7#f7 ,whether any personal data 
processed by the controller is          
transferred to1 processed in1 stored in1
 or sold to a covered nation4  7h7      
,disclosure of sale ,if a controller    
sells personal data of a consumer1 the  
controller shall clearly and            
conspicuously disclose--  7#a7 such     
activity before any collection or sale  
of personal data2 and  7#b7 the manner  
in which a consumer may exercise the    
right to opt out of the sale of such    
personal data under section #b7;a77#e74 
7i7 ,disclosure of targeted advertising 
,if a controller processes personal data
 of a consumer for targeted advertising1

 the controller shall clearly and       
conspicuously disclose-- 7#a7 such      
activity before any collection or use of
 personal data2 and  7#b7 the manner in 
which a consumer may exercise the right 
to opt out of such processing under     
section #b7;a77#e74  7j7 ,automated     
decision making  7#a7 ,profiling ,a     
controller that relies on profiling to  
make a decision that has a legal or     
similarly significant effect on a       
consumer shall clearly and conspicuously
 disclose to such consumer before any   
such decision is made that--  7,a7 the  
decision will be made using automated   
means2 and  7,b7 the manner in which a  
consumer may exercise the right to opt  
out of such profiling4  7#b7 ,reliance  
on profiling ,for purposes of paragraph 
7#a7 and section #b7;a77#e71 a          
controller relies on profiling to make a
 decision that has a legal or similarly 
significant effect on a consumer if such
 decision is made with no human review1 
involvement1 oversight1 or intervention4

  #d4 ,data security  7a7 ,data security
 ,a controller shall establish1         
implement1 and maintain reasonable      
administrative1 technical1 and physical 
data security practices to protect the  
confidentiality1 integrity1 and         
accessibility of personal data and that 
are appropriate to the volume1          
sensitivity1 and nature of such personal
 data4  7b7 ,rebuttable presumption ,a  
controller has a rebuttable presumption 
to an alleged violation of this section 
if-- 7#a7 the controller complies with a
 relevant code of conduct approved under
 section #h7;a77#c7 7or a relevant      
certification described in section      
#h7;f772 or  7#b7 the controller has    
established1 implemented1 and           
maintained-- 7,a7 data security         
practices appropriate to the            
state-of-the-art in administrative1     
technical1 and physical data security   
practices for the protection of the     
confidentiality1 integrity1 and         
accessibility of personal data1         

including such a practice demonstrated  
by adherence to a widely accepted       
technical specification or through a    
third-party attestation2 and  7,b7 a    
comprehensive data security program that
 reasonably conforms to a relevant      
,federal or widely accepted             
international risk management framework 
for identifying and protecting against  
data security risks1 and for detecting1 
responding to1 and recovering from data 
security events4  #e4 ,data brokers  7a7
 ,disclosure ,a data broker shall post  
on a publicly available website or      
mobile application a conspicuous notice 
that-- 7#a7 states that the entity      
maintaining the website or application  
is a data broker2  7#b7 is clear1 not   
misleading1 and readily accessible by   
the public2 and  7#c7 informs a consumer
 how to exercise any consumer right     
described under section #b4  7b7        
,registration ,not later than #ab months
 after the date of the enactment of this
 ,act1 and annually thereafter1 a data  

broker shall register with the          
,commission by filing a registration    
statement and paying a reasonable       
registration fee set by the ,commission 
that includes the following information3
 7#a7 ,the legal name of the data       
broker4  7#b7 ,a contact person and the 
primary physical address1 email address1
 telephone number1 and website address  
for the data broker4  7#c7 ,a           
description of each category of personal
 data sold by the data broker4  7#d7 ,a 
statement of whether the data broker    
implements a purchaser credentialing    
process4  7#e7 ,a description of any    
incident of unauthorized access to      
personal data that the data broker has  
reported to a ,federal or ,state        
governmental entity pursuant to an      
applicable law1 rule1 or regulation     
during the year before the year in which
 the registration is filed1 and if      
known1 the total number of consumers    
affected by each previously reported    
incident of such unauthorized access4   

7#f7 ,a link to the privacy policy      
published in accordance with section    
#c7;g74  7#g7 ,a link to a website      
published by the data broker that       
informs a consumer how to exercise any  
consumer right described under section  
#b4  7c7 ,data broker registry ,not     
later than #ah months after the date of 
the enactment of this ,act1 the         
,commission shall establish and maintain
 on a publicly available website of the 
,commission a searchable1 central       
registry of data brokers registered     
under subsection 7b7 that includes the  
following3  7#a7 ,a search feature that 
allows a person searching the registry  
to identify a data broker4  7#b7 ,for   
each data broker1 a link to the privacy 
policy published in accordance with     
section #c7;g74  7#c7 ,for each data    
broker1 a link to a website published by
 the data broker that informs a consumer
 how to exercise any consumer right     
described under section #b4  #f4        
,processors  7a7 ,adherence to          

controller instructions ,a processor    
shall adhere to the instructions of a   
controller and shall assist the         
controller in meeting the requirements  
of this ,act1 including by taking into  
account the nature of processing and the
 information available to the           
processor--  7#a7 by appropriate        
administrative and technical measures1  
insofar as reasonably practicable1 to   
fulfill the requirements of the         
controller to respond to an assertion of
 any consumer right described under     
section #b2 and  7#b7 by assisting the  
controller in meeting the requirements  
of the controller under section #d4  7b7
 ,contractual obligation ,a contract    
between a controller and a processor    
shall govern the data processing        
procedures of the processor with respect
 to processing performed on behalf of   
the controller4 ,the contract shall     
clearly set forth instructions for      
processing personal data1 the nature and
 purpose of processing1 the type of     

personal data subject to processing1 the
 duration of processing1 and the rights 
and obligations of both parties4  7c7   
,minimum requirements ,at a minimum1 the
 contract between a controller and      
processor shall include requirements    
that the processor does the following3  
7#a7 ,ensures that each person          
processing personal data is subject to a
 duty of confidentiality with respect to
 the data4  7#b7 ,at the direction of   
the controller1 deletes or returns all  
personal data to the controller as      
requested at the end of the provision of
 services1 unless retention of the      
personal data is required by law4  7#c7 
,upon the reasonable request of the     
controller1 makes available to the      
controller all information in the       
possession of the processor necessary to
 demonstrate compliance by the processor
 with the requirements of this ,act4    
7#d7 ,either--  7,a7 allows and         
cooperates with reasonable assessments  
by the controller or a designated       

assessor by the controller2 or  7,b7 the
 processor--  7i7 arranges for a        
qualified and independent assessor to   
conduct an assessment of the policies   
and administrative and technical        
measures of such processor that meet the
 requirements of this ,act using an     
appropriate and accepted control        
standard or framework and assessment    
procedure for such assessment2 and  7ii7
 provides a report of the assessment to 
the controller upon request4  7#e7 ,if a
 processor engages a subcontractor1     
include in any subcontract a requirement
 that the subcontractor meet the        
obligations of the processor with       
respect to the personal data4  7d7 ,rule
 of construction ,nothing in this       
section may be construed to relieve a   
controller or processor from any        
liability imposed on the controller or  
processor by virtue of a role in a      
processing4  7e7 ,applicability  7#a7   
,controller or processor ,the           
determination about whether a person is 

acting as a controller or processor with
 respect to a specific processing of    
personal data is a fact-based           
determination that depends upon the     
context in which personal data is to be 
processed4  7#b7 ,controller ,if a      
processor1 alone or jointly with others1
 begins determining the purpose and     
means of processing personal data1 such 
processor is a controller with respect  
to a specific processing of such        
personal data4  7#c7 ,processor ,a      
processor that follows the instructions 
of a controller with respect to a       
specific processing of personal data    
remains a processor4  #g4 ,deidentified 
and pseudonymous data  7a7 ,in general  
,a controller in possession of          
deidentified data shall--  7#a7 take    
reasonable measures to ensure the data  
cannot be associated with an individual2
  7#b7 publicly commit to maintain and  
use deidentified data without attempting
 to re-identify the data2 and  7#c7     
contractually obligate any recipient of 

the deidentified data to comply with    
each requirement of this ,act4  7b7     
,ongoing compliance ,a controller that  
discloses deidentified or pseudonymous  
data shall exercise reasonable oversight
 to monitor compliance with any         
contractual commitment to which the     
deidentified or pseudonymous data is    
subject and shall take appropriate steps
 to address any breach of such          
contractual commitment4  7c7            
,pseudonymous data ,an assertion of any 
consumer right described under section  
#b does not apply to pseudonymous data  
for a case in which the controller is   
able to demonstrate any information     
necessary to identify the consumer is   
kept separately and is subject to       
appropriate administrative and technical
 measures to ensure that the personal   
data is not attributed to an identified 
or identifiable natural person4  7d7    
,rule of construction relating to       
deidentified or pseudonymous data       
,nothing in this ,act may be construed  

to require a controller or processor    
to--  7#a7 re-identify deidentified data
 or pseudonymous data2 or  7#b7 maintain
 data in identifiable form1 or collect1 
obtain1 retain1 or access any data or   
technology1 in order to be capable of   
associating a consumer request with     
personal data4  7e7 ,rule of            
construction relating to consumer rights
 requests ,nothing in this ,act may be  
construed to require a controller or    
processor to comply with an assertion of
 any consumer right described under     
section #b if-- 7#a7 the controller is  
not reasonably capable of associating   
the request with the personal data or it
 would be unduly burdensome for the     
controller to associate the request with
 the personal data2  7#b7 the controller
 does not use the personal data to      
recognize or respond to the specific    
consumer who is the subject of the      
personal data1 or associate the personal
 data with other personal data about the
 same specific consumer2 and  7#c7 the  

controller does not sell the personal   
data to another controller or otherwise 
voluntarily disclose the personal data  
to any entity other than a processor1   
except as otherwise permitted in this   
section4  #h4 ,codes of conduct  7a7    
,application for approval of code of    
conduct  7#a7 ,in general ,a controller 
or processor 7or a group of controllers 
or processors7 may submit to the        
,secretary an application for approval  
of a code of conduct that meets or      
exceeds the requirements of the         
controller or processor 7or the group of
 controllers or processors7 under this  
,act4  7#b7 ,application requirements   
,an application submitted under         
paragraph 7#a7 shall include the        
following3  7,a7 ,a description of the  
specific requirements of this ,act to   
which the code of conduct proposed in   
the application will apply4  7,b7 ,a    
description of how the code of conduct  
will meet or exceed such requirements4  
7,c7 ,a description of the entities the 

code of conduct is designed to cover4   
7,d7 ,a list of the controllers or      
processors1 to the extent known at the  
time of application1 that intend to     
comply with the code of conduct4  7,e7  
,a description of the independent       
organization that will administer the   
code of conduct with respect to         
controllers or processors1 including an 
explanation of how the independent      
organization is governed4  7,f7 ,a      
description of how the entities         
described in subparagraph 7,c7 will be  
assessed for compliance with the code of
 conduct by the independent organization
 described in subparagraph 7,e74  7,g7  
,a description of how the independent   
organization will refer to the          
,commission or to a ,state attorney     
general any controller or processor that
 does not-- 7i7 meet the requirements of
 this ,act2 or  7ii7 meet or exceed the 
requirements of the ,act in accordance  
with the certification publicly         
disclosed by the controller or processor

 under subsection 7c74  7#c7 ,review by 
,secretary  7,a7 ,initial approval  7i7 
,public comment period ,not later than  
#ij days after the date on which the    
,secretary receives an application      
submitted under paragraph 7#a71 the     
,secretary shall publish the application
 and provide an opportunity for public  
comment on the code of conduct proposed 
in the application4  7ii7 ,approval     
criteria ,the ,secretary1 in            
consultation with the ,commission1 shall
 approve an application submitted under 
paragraph 7#a71 including the           
independent organization that will      
administer the code of conduct1 if the  
controller or processor 7or the group of
 controllers or processors7 that submits
 the application demonstrates that the  
code of conduct proposed in the         
application meets the following         
criteria3 7,i7 ,meets or exceeds the    
relevant requirements of this ,act4     
7,,ii7 ,provides for regular review and 
validation by the independent           

organization to ensure that the         
controller or processor 7or the group of
 controllers or processors7 that        
complies with the code of conduct       
continues to meet or exceed the relevant
 requirements of this ,act4  7,,iii7    
,includes referral to the ,commission   
for enforcement or referral to the      
appropriate ,state attorney general for 
enforcement4  7iii7 ,timeline ,not later
 than #a year after the date on which   
the ,secretary receives an application  
submitted under paragraph 7#a71 the     
,secretary shall issue a public         
determination approving or denying the  
application and providing the reasons   
for such approval or denial4  7,b7      
,approval of modifications  7i7 ,in     
general ,if an independent organization 
that administers a code of conduct      
approved under subparagraph 7,a7 makes  
significant updates to the code of      
conduct--  7,i7 the independent         
organization shall submit to the        
,secretary an application for approval  

of the significant updates made to the  
code of conduct2 and  7,,ii7 not later  
than #ij days after the date on which   
the ,secretary receives an application  
for an updated code of conduct submitted
 under subclause 7,i71 the ,secretary   
shall publish the proposed updated code 
of conduct and provide an opportunity   
for public comment4  7ii7 ,timeline ,not
 later than #ahj days after the date on 
which the ,secretary receives an        
application for an updated code of      
conduct submitted under clause 7i77,i71 
the ,secretary1 considering the approval
 criteria described in subparagraph     
7,a77ii71 shall issue a public          
determination approving or denying the  
application and providing the reasons   
for such approval or denial4  7b7       
,withdrawal of approval  7#a7 ,in       
general ,if the ,secretary has clear and
 convincing evidence that a code of     
conduct approved under subsection       
7a77#c7 no longer meets the relevant    
requirements of this ,act or that       

compliance with the code of conduct is  
insufficiently assessed by the          
independent organization that           
administers the code of conduct1 the    
,secretary shall notify the relevant    
controller or processor 7or the relevant
 group of controllers or processors7 and
 the independent organization of a      
potential withdrawal of approval by the 
,secretary and of the opportunity to    
cure any alleged deficiency under       
paragraph 7#b74  7#b7 ,opportunity to   
cure  7,a7 ,in general ,not later than  
#ahj days after the date on which a     
controller or processor 7or a group of  
controllers or processors7 receives the 
notice described in paragraph 7#a71 the 
controller or processor 7or the group of
 controllers or processors7 and the     
relevant independent organization may-- 
7i7 create a proposed cure to any       
alleged deficiency of the code of       
conduct or the enforcement of the code  
of conduct2 and  7ii7 submit each such  
proposed cure to the ,secretary4  7,b7  

,review of proposed cure ,if the        
,secretary determines within #fj days   
that a proposed cure submitted under    
subparagraph 7,a77ii7 eliminates an     
alleged deficiency of the code of       
conduct or the assessment of compliance 
with the code of conduct1 the ,secretary
 may not withdraw the approval of such  
code of conduct on the basis of such    
deficiency4  7#c7 ,withdrawal of        
approval  7,a7 ,determination ,if the   
,secretary determines that a proposed   
cure submitted under subparagraph       
7,a77ii7 does not eliminate an alleged  
deficiency of the code of conduct or the
 assessment of compliance with the code 
of the conduct1 the ,secretary may      
withdraw approval of such code of       
conduct on the basis of such deficiency4
  7,b7 ,notification ,not later than #aj
 days after the date on which the       
,secretary makes a determination under  
subparagraph 7,a71 the ,secretary shall 
notify the relevant controller or       
processor 7or the relevant group of     

controllers or processors7 and the      
independent organization of the relevant
 withdrawal of approval described in    
subparagraph 7,a74  7,c7 ,effect ,a     
withdrawal of approval described in     
subparagraph 7,a7 shall take effect on  
the date that is #cj days after the date
 on which the ,secretary provides the   
notification required by subparagraph   
7,b74  7,d7 ,publication ,not later than
 #cj days after the date on which the   
,secretary provides notification        
required by subparagraph 7,b71 the      
,secretary shall publish on a publicly  
available website a notice about the    
relevant withdrawal of approval         
described in subparagraph 7,a74  7c7    
,public disclosure ,a controller or     
processor that participates in a code of
 conduct approved under subsection      
7a77#c7 shall certify on a publicly     
available website that the controller or
 processor is in compliance with the    
code of conduct1 including by listing   
the independent organization that       

administers the code of conduct4  7d7   
,rebuttable presumption ,a controller or
 processor that complies with a relevant
 code of conduct approved under         
subsection 7a77#c7 7or a relevant       
certification described in subsection   
7f77 shall be entitled to a rebuttable  
presumption that the controller or      
processor is in compliance with the     
relevant requirements of this ,act to   
which the code of conduct 7or           
certification7 applies4  7e7 ,codes of  
conduct for small businesses  7#a7 ,in  
general ,not later than #b years after  
the date of the enactment of this ,act1 
the ,secretary shall publish codes of   
conduct for businesses that otherwise   
would be persons to whom this ,act      
applies but that do not meet the        
applicability requirements described in 
section #ac7;a77#b74  7#b7 ,procedures  
,in carrying out paragraph 7#a71 the    
,secretary shall--  7,a7 follow the same
 procedures described in subsections 7a7
 and 7b72 and  7,b7 solicit independent 

organizations to administer the codes of
 conduct4  7#c7 ,requirements for code  
of conduct ,a code of conduct published 
under paragraph 7#a7 shall meet the     
following requirements3 7,a7 ,be        
consistent with the requirements of this
 ,act4  7,b7 ,be cost-effective for any 
participant in the code of conduct4     
7,c7 ,be appropriate to the risks1 size1
 and limitations of any such            
participant4  7#d7 ,voluntary           
participation ,participation in a code  
of conduct published under paragraph    
7#a7 shall be voluntary4  7#e7          
,requirements for participation ,a      
participant in a code of conduct        
published under paragraph 7#a7 shall    
publicly self-certify that the          
participant is in compliance with the   
code of conduct1 including by listing   
the independent organization that       
administers the code of conduct4  7f7   
,cross-,border privacy rules system  ,a 
certification by a controller pursuant  
to the ,global ,cross ,border ,privacy  

,rules ,system1 or any successor system1
 or a certification by a processor      
pursuant to the ,global ,cross ,border  
,privacy ,rules ,system ,privacy        
,recognition for ,processors1 or any    
successor system1 shall be treated as   
participation in a code of conduct      
approved under subsection 7a77#c74  #i4 
,cross-border data flows  7a7 ,principal
 advisor ,the ,secretary shall serve as 
the principal advisor to the ,president 
on policy relating to the international 
flow of personal data and the protection
 of personal data in international      
commerce4  7b7 ,duties ,the ,secretary  
shall take any action necessary and     
appropriate to support the international
 flow of personal data and the          
protection of personal data in          
international commerce1 including the   
following3  7#a7 ,assessing the laws1   
regulations1 requirements1 frameworks1  
and practices 7and the implementation   
thereof7 of foreign governments for--   
7,a7 alignment with the consumer rights 

and protections of personal data        
described in this ,act2  7,b7 any impact
 on consumers and businesses in the     
,united ,states1 including with respect 
to economic competitiveness1 innovation1
 and data security2 and  7,c7 any impact
 on the economic and security interests 
of the ,united ,states4  7#b7           
,developing policy and recommendations  
relating to-- 7,a7 identifying the      
benefits of the international flow of   
personal data to consumers and          
businesses1 including economic          
competitiveness1 innovation1 and data   
security2  7,b7 addressing any negative 
impact on consumers and businesses in   
the ,united ,states of laws1            
regulations1 requirements1 frameworks1  
and practices 7and the implementation   
thereof7 of foreign governments that    
limit or restrict the international flow
 of personal data2  7,c7 promoting the  
protection of personal data in a manner 
that maintains the international flow of
 personal data in international         

commerce2 and  7,d7 mitigating the risk 
posed by covered nations to the         
international flow of personal data and 
the protection of personal data in      
international commerce4  7#c7           
,establishing1 maintaining1 and         
promoting frameworks1 certifications1   
principles1 and partnerships to         
facilitate the international flow of    
personal data for commercial purposes   
and the protection of personal data in  
international commerce4  7#d7           
,coordinating with any relevant agency  
as needed4  7c7 ,international          
cooperation  7#a7 ,authority to enter   
agreement ,the ,secretary1 as the       
,secretary determines appropriate1 may  
enter into an agreement with a foreign  
government1 international forum1 or     
foreign political or economic union to  
promote the international flow of       
personal data and the protection of     
personal data in international commerce4
  7#b7 ,requirements for agreement ,any 
agreement entered into pursuant to      

paragraph 7#a7-- 7,a7 may not have      
provisions that conflict with the       
protections for personal data described 
in this ,act2  7,b7 shall be consistent 
with the economic and security interests
 of the ,united ,states2 and  7,c7 not  
later than #fj days after the date on   
which the agreement is entered into1    
shall be submitted to the ,committee on 
,energy and ,commerce of the ,house of  
,representatives and the ,committee on  
,commerce1 ,science1 and ,transportation
 of the ,senate4  7d7 ,rule of          
construction ,nothing in this section   
may be construed to alter the authority 
of any agency with rulemaking and       
enforcement authority under subtitle ,a 
of title ,v of the ,gramm-,leach-,bliley
 ,act 7#ae ,u4,s4,c4 #fhja et seq474    
#aj4 ,study on universal opt-out        
mechanisms  7a7 ,study ,not later than  
#c years after the date of the enactment
 of this ,act1 the ,secretary shall     
publish on a publicly available website 
a report that--  7#a7 is developed      

through a process of public             
consultation2  7#b7 reviews commercially
 available technologies1 including a web
 browser setting or extension or a      
global setting on an electronic device1 
that allow a consumer to opt out of the 
processing of the personal data of the  
consumer by a controller2  7#c7         
considers the feasibility of a universal
 opt-out mechanism in a manner that     
makes use of commercially available     
technologies and accounts for beneficial
 uses of personal data2 and  7#d7 limits
 such review and consideration in       
accordance with the scope of this ,act4 
7b7 ,commercially available technologies
 ,the commercially available            
technologies reviewed pursuant to the   
study required by subsection 7a7 shall  
meet the following requirements3 7#a7   
,shall require a consumer to make an    
affirmative1 freely given1 and          
unambiguous choice to indicate the      
intent of the consumer to opt out of any
 processing of the personal data of the 

consumer by a controller4  7#b7 ,shall  
be consumer-friendly and easy to use by 
the average consumer4  7#c7 ,may not    
unduly burden lawful data processing by 
a controller or processor1 including    
with respect to beneficial uses of      
personal data4  #aa4 ,rules of          
construction  7a7 ,in general ,nothing  
in this ,act may be construed to        
restrict the ability of a controller or 
processor to do any of the following3   
7#a7 ,cooperate with a law enforcement  
agency with respect to conduct or       
activity that the controller or         
processor reasonably and in good faith  
believes may violate a ,federal1 ,state1
 or local law1 rule1 or regulation4     
7#b7 ,investigate1 establish1 exercise1 
prepare for1 or defend a legal claim4   
7#c7 ,provide a product or service      
specifically requested by a consumer or 
a parent of a consumer 7if the consumer 
is a child or teen74  7#d7 ,perform a   
contract to which a consumer or a parent
 of a consumer 7if the consumer is a    

child or teen7 is a party1 including by 
fulfilling the terms of a written       
warranty4  7#e7 ,take immediate steps to
 protect an interest that is essential  
to the life or physical safety of a     
consumer or of another individual4  7#f7
 ,prevent1 detect1 protect against1 or  
respond to a security incident1         
including a data security incident1     
identity theft1 fraud1 harassment1      
malicious or deceptive activity1 or any 
other similar illegal activity4  7#g7   
,preserve the integrity or security of  
systems4  7#h7 ,investigate1 report1 or 
prosecute a person responsible for any  
such security incident4  7#i7 ,engage in
 public or peer-reviewed scientific or  
statistical research in the public      
interest that adheres to any applicable 
,federal or ,state ethics or privacy law
 and is approved1 monitored1 and        
governed by an institutional review     
board 7or similar independent oversight 
entity7 that considers the following3   
7,a7 ,if the deletion of the personal   

data of a consumer is likely to provide 
substantial benefits that do not        
exclusively accrue to the controller4   
7,b7 ,if the controller has implemented 
reasonable safeguards to mitigate       
privacy and data security risks to a    
consumer associated with research1      
including any risks associated with     
re-identification of the personal data  
of the consumer4  7,c7 ,if the expected 
benefits of the research outweigh such  
privacy and data security risks4  7b7   
,personal data ,nothing in this ,act may
 be construed to restrict the ability of
 a controller or processor to collect1  
use1 or retain the personal data of a   
consumer to do any of the following3    
7#a7 ,conduct internal research to      
develop1 improve1 or repair a product1  
service1 or technology4  7#b7           
,effectuate a product recall4  7#c7     
,identify and repair any technical error
 that impairs the functionality of a    
product1 service1 or technology4  7#d7  
,perform an internal operation that--   

7,a7 is reasonably aligned with the     
expectations of a consumer2  7,b7 is    
reasonably anticipated based on the     
relationship of a consumer with the     
controller2 or  7,c7 is otherwise       
compatible with processing data to-- 7i7
 provide a product or service           
specifically requested by a consumer or 
a parent of a consumer 7if the consumer 
is a child or teen72 or  7ii7 perform a 
contract to which a consumer or a parent
 of a consumer 7if the consumer is a    
child or teen7 is a party4  7c7         
,privileged communication ,nothing in   
this ,act may be construed to prevent a 
controller or processor from providing  
the personal data of a consumer to a    
person covered by an evidentiary        
privilege under ,federal or ,state law  
as part of a privileged communication4  
7d7 ,protected disclosure ,a controller 
or processor that discloses the personal
 data of a consumer to another          
controller or processor in compliance   
with the requirements of this ,act does 

not violate this ,act if the controller 
or processor that receives and processes
 such personal data violates this ,act  
if1 at the time of disclosing the       
personal data1 the disclosing controller
 or processor did not have knowledge    
that the receiving controller or        
processor intended to commit such a     
violation4  7e7 ,protected rights       
,nothing in this ,act may be construed  
as a requirement imposed on a controller
 or processor that adversely affects the
 privacy or any other right or freedom  
of any person1 including the right to   
freedom of speech under the             
,constitution of the ,united ,states1 or
 that applies to the processing of      
personal data by a person in the course 
of a purely personal or household       
activity4  #ab4 ,enforcement  7a7       
,enforcement by ,commission  7#a7       
,unfair or deceptive acts or practices  
,a violation of this ,act shall be      
treated as a violation of a regulation  
under section #ah7;a77#a77;,b7 of the   

,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #eg;a7a77#a77;,b77 regarding  
unfair or deceptive acts or practices4  
7#b7 ,powers of ,commission ,except as  
provided in paragraphs 7#c7 and 7#d71   
the ,commission shall enforce this ,act 
in the same manner1 by the same means1  
and with the same jurisdiction1 powers1 
and duties as though all applicable     
terms and provisions of the ,federal    
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 were incorporated into and 
made a part of this ,act1 and any person
 who violates this ,act shall be subject
 to the penalties and entitled to the   
privileges and immunities provided in   
the ,federal ,trade ,commission ,act4   
7#c7 ,common carriers ,notwithstanding  
section #d1 #e7;a77#b71 or #f of the    
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #dd2 #de7;a77#b72 #df7 or any 
jurisdictional limitation of the        
,federal ,trade ,commission1 the        
,federal ,trade ,commission shall also  
enforce this ,act1 in the same manner   

provided in paragraphs 7#a7 and 7#b71   
with respect to common carriers subject 
to the ,communications ,act of #aicd    
7#dg ,u4,s4,c4 #aea et seq474  7#d7     
,civil rights violations  7,a7          
,exception ,notwithstanding paragraphs  
7#a71 7#b71 and 7#c71 the ,commission   
may not enforce any violation of section
 #c7;c7 of this ,act4  7,b7             
,transmission by ,commission ,if the    
,commission receives information        
alleging that a controller is in        
violation of section #c7;c71 the        
,commission shall transmit such         
information1 as allowable under ,federal
 law1 to any agency with authority to   
initiate an enforcement action or       
proceeding relating to the alleged      
violation described in the information4 
7b7 ,actions by ,states  7#a7 ,in       
general ,in any case in which the       
attorney general of a ,state has reason 
to believe that an interest of the      
residents of such ,state has been or is 
threatened or adversely affected by an  

act or practice in violation of this    
,act1 the attorney general1 as parens   
patriae1 may bring a civil action on    
behalf of the residents of the ,state in
 an appropriate district court of the   
,united ,states to--  7,a7 enjoin such  
act or practice2  7,b7 enforce          
compliance with this ,act2  7,c7 obtain 
damages1 restitution1 or other          
compensation on behalf of residents of  
the ,state2 or  7,d7 obtain such other  
legal and equitable relief as the court 
may consider to be appropriate4  7#b7   
,notice ,before filing an action under  
this subsection1 the attorney general of
 the ,state involved shall provide to   
the ,commission a written notice of such
 action and a copy of the complaint for 
such action4 ,if the attorney general   
determines that it is not feasible to   
provide the notice described in this    
paragraph before the filing of the      
action1 the attorney general shall      
provide written notice of the action and
 a copy of the complaint to the         

,commission immediately upon the filing 
of the action4  7#c7 ,authority of      
,commission  7,a7 ,in general ,on       
receiving notice under paragraph 7#b7 of
 an action under this subsection1 the   
,commission shall have the right--  7i7 
to intervene in the action2  7ii7 upon  
so intervening1 to be heard on all      
matters arising therein2 and  7iii7 to  
file petitions for appeal4  7,b7        
,limitation on ,state action while      
,federal action is pending ,if the      
,commission or the ,attorney ,general of
 the ,united ,states has instituted a   
civil action for violation of this ,act 
7referred to in this subparagraph as the
 ,federal action71 no ,state attorney   
general may bring an action under this  
subsection during the pendency of the   
,federal action against any defendant   
named in the complaint in the ,federal  
action for any violation of this ,act   
alleged in such complaint4  7#d7 ,rule  
of construction ,for purposes of        
bringing a civil action under this      

subsection1 nothing in this ,act may be 
construed to prevent an attorney general
 of a ,state from exercising the powers 
conferred on the attorney general by the
 laws of such ,state to conduct         
investigations1 administer oaths and    
affirmations1 or compel the attendance  
of witnesses or the production of       
documentary and other evidence4  7c7    
,right ,to cure  7#a7 ,in general       
,neither the ,commission nor a ,state   
attorney general may initiate any action
 for a violation of this ,act until--   
7,a7 the ,commission or the attorney    
general has provided written notice to a
 controller or processor alleged to be  
in violation of this ,act of the alleged
 violation that identifies the specific 
provision of this ,act alleged to have  
been violated2 and  7,b7 not fewer than 
#de days have passed since the date on  
which such written notice has been      
provided4  7#b7  ,effect of cure  ,there
 shall be no violation of this ,act with
 respect to an allegation made under    

paragraph 7#a77;,a7 if1 during the      
period of time described in paragraph   
7#a77;,b71 the controller or processor  
alleged to be in violation of this ,act 
cures the alleged violation of this ,act
 and provides the ,commission or the    
,state attorney general with a written  
statement that such violation has been  
cured and that no such further violation
 shall occur4  7#c7  ,failure to cure   
,the ,commission or the ,state attorney 
general may initiate an action pursuant 
to subsection 7a7 or 7b7 7as the case   
may be7 to remedy an allegation made    
under paragraph 7#a77;,a7 if the        
controller or processor alleged to be in
 violation of this ,act--  7,a7 fails to
 cure the alleged violation pursuant to 
paragraph 7#b72 or  7,b7 after curing   
the alleged violation pursuant to       
paragraph 7#b71 continues to violate    
this ,act4  #ac4 ,applicability  7a7 ,in
 general ,this ,act shall apply to any  
person that is subject to the ,federal  
,trade ,commission ,act 7#ae ,u4,s4,c4  

#da et seq47 or is a common carrier     
subject to title ,,ii of the            
,communications ,act of #aicd 7#dg      
,u4,s4,c4 #bja et seq47 and-- 7#a7 with 
respect to the business of the person-- 
7,a7 conducts business in the ,united   
,states or offers for use or sale to a  
resident of the ,united ,states a       
product or service2 or  7,b7 processes  
or engages in the sale of personal data 
of a resident of the ,united ,states2   
and  7#b7 with respect to personal data 
and annual gross revenue in the course  
of such business-- 7,a7 collects and    
processes personal data of more than    
#bjj1jjj consumers annually 7excluding  
personal data controlled or processed   
solely for the purpose of completing a  
payment transaction7 and has an annual  
gross revenue of #be1jjj1jjj or more 7as
 adjusted on ,january #a each year by   
the percentage increase 7if any71 during
 the preceding #ab-month period1 in the 
,consumer ,price ,index for ,all ,urban 
,consumers published by the ,bureau of  

,labor ,statistics72 or  7,b7 collects  
and processes personal data of #ajj1jjj 
or more consumers annually 7excluding   
personal data controlled or processed   
solely for the purpose of completing a  
payment transaction7 and derives #be    
percent or more of the annual gross     
revenue of the person from the sale of  
such personal data4  7b7 ,exemptions    
,this ,act does not apply to the        
following3  7#a7 ,a ,federal1 ,state1 or
 local governmental entity4  7#b7 ,an   
entity that collects1 processes1        
retains1 or transfers personal data on  
behalf of such ,federal or ,state       
governmental entity1 to the extent that 
such entity is acting as a processor to 
the governmental entity4  7#c7 ,a       
financial institution subject to title  
,v of the ,gramm-,leach-,bliley ,act    
7#ae ,u4,s4,c4 #fhja et seq474  7#d7 ,a 
covered entity or business associate    
subject to parts #afj and #afd of title 
#de1 ,code of ,federal ,regulations4    
7#e7 ,a nonprofit organization4  7#f7 ,a

 nonprofit organization with the primary
 mission of preventing1 investigating1  
or deterring fraud1 training anti-fraud 
professionals1 or educating the public  
about fraud1 including insurance fraud1 
securities fraud1 and financial fraud4  
7#g7 ,an institution of higher          
education4  7#h7 ,the ,national ,center 
for ,missing and ,exploited ,children4  
7#i7 ,an entity created by a ,federal or
 ,state statute to pay for claims       
arising from the liquidation of an      
insurance company4  7#aj7 ,a futures    
association registered pursuant to      
section #ag of the ,commodity ,exchange 
,act 7#g ,u4,s4,c4 #ba74  7#aa7 ,a      
national securities association         
registered pursuant to section #ae;,a of
 the ,securities ,exchange ,act of #aicd
 7#ae ,u4,s4,c4 #gho-#c74  7#ab7 ,data  
processed or maintained--  7,a7 by an   
individual applying to1 employed by1 or 
acting as an agent or independent       
contractor of a controller or processor 
for such application1 employment1 or    

action2  7,b7 for inclusion in the      
emergency contact information relating  
an individual2 or  7,c7 that is         
necessary for the administration of     
benefits for an individual4  7#ac7 ,the 
following information3  7,a7 ,health    
information protected under and         
collected or used for public health     
activities and purposes in accordance   
with ,,hipaa4  7,b7 ,health records4    
7,c7 ,records relating to the identity1 
diagnosis1 prognosis1 or treatment of a 
patient under section #edc of the       
,public ,health ,service ,act 7#db      
,u4,s4,c4 #bij;dd-#b74  7,d7 ,data1     
information1 or identifiable private    
information 7as such term is defined in 
section #df4ajb of title #de1 ,code of  
,federal ,regulations7 obtained pursuant
 to any of the following3  7i7 ,part #df
 of title #de1 ,code of ,federal        
,regulations4  7ii7 ,the ,guideline for 
,good ,clinical ,practice ,e#f7,r#c7    
issued by ,the ,international ,council  
for ,harmonisation of ,technical        

,requirements for ,pharmaceuticals for  
,human ,use4  7iii7 ,part #ej or part   
#ef of title #ba1 ,code of ,federal     
,regulations4  7,e7 ,information        
reported pursuant to the ,health ,care  
,quality ,improvement ,act of #aihf 7#db
 ,u4,s4,c4 #aaaja et seq474  7,f7       
,identifiable patient safety work       
product and nonidentifiable patient     
safety work product 7as such terms are  
defined in section #iba of the ,public  
,health ,service ,act 7#db ,u4,s4,c4    
#bii;b-#ba77 protected under ,part ,c of
 title ,,ix of the ,public ,health      
,service ,act 7#db ,u4,s4,c4 #bii;b-#ba 
et seq474  7,g7 ,information derived    
from any of the health care related     
information listed in this paragraph    
that is de-identified in accordance with
 section #afd4ead7;e7 of title #de1     
,code of ,federal ,regulations4  7,h7   
,information that is included in a      
limited data set in accordance with the 
standards and specifications under      
section #afd4ead7;e7 of title #de1 ,code

 of ,federal ,regulations4  7,i7        
,personal data that--  7i7 may impact   
the creditworthiness1 credit standing1  
credit capacity1 character1 general     
reputation1 personal characteristics1 or
 mode of living of a consumer2 and  7ii7
 is collected or disclosed by a consumer
 reporting agency 7as such term is      
defined in section #fjc7;f7 of the ,fair
 ,credit ,reporting ,act 7#ae ,u4,s4,c4 
#afha;a7f777 or a furnisher1 to the     
extent that the consumer reporting      
agency or furnisher is engaged in       
activities subject to the ,fair ,credit 
,reporting ,act4  7,j7 ,personal        
information 7as such term is defined in 
section #bgbe of title #ah1 ,united     
,states ,code7 collected1 processed1    
sold1 or disclosed under section #bgba  
of title #ah1 ,united ,states ,code4    
7,k7 ,personally identifiable           
information and personally identifiable 
data regulated in accordance with       
section #ddd of the ,general ,education 
,provisions ,act 7commonly known as the 

,family ,educational ,rights and        
,privacy ,act of #aigd7 7#bj ,u4,s4,c4  
#abcb;g74  7,l7 ,personal data          
collected1 processed1 sold1 or disclosed
 as a result of an activity authorized  
under the ,farm ,credit ,act of #aiga   
7#ab ,u4,s4,c4 #bjja et seq474  7,m7    
,nonpublic personal information 7as such
 term is defined in section #eji of the 
,gramm-,leach-,bliley ,act 7#ae         
,u4,s4,c4 #fhji774  7,n7 ,any           
information that originates from1 is    
intermingled with1 or is treated in the 
same manner as information described in 
subparagraphs 7,a7 through 7,m7 that is 
maintained by the following3 7i7 ,a     
covered entity or business associate4   
7ii7 ,a program or a qualified service  
organization 7as such terms are defined 
in section #b4aa of title #db1 ,code of 
,federal ,regulations74  #ad4           
,relationship to ,federal laws  7a7 ,in 
general ,nothing in this ,act may be    
construed to relieve or change an       
obligation that a controller or         

processor may have under any of the     
following3  7#a7 ,the ,children's       
,online ,privacy ,protection ,act of    
#aiih 7#ae ,u4,s4,c4 #feja et seq74     
7#b7 ,title ,v of the                   
,gramm-,leach-,bliley ,act 7#ae         
,u4,s4,c4 #fhja et seq474  7#c7 ,part ,c
 of title ,,xi of the ,social ,security 
,act 7#db ,u4,s4,c4 #acbj;d et seq474   
7#d7 ,subtitle ,d of the ,,hitech ,act  
7#db ,u4,s4,c4 #agiba et seq474  7#e7   
,any regulations promulgated under      
section #bfd7;c7 of ,,hipaa 7#db        
,u4,s4,c4 #acbj;d-#b note74  7#f7 ,the  
requirements regarding the              
confidentiality of substance use        
disorder information under section #edc 
of the ,public ,health ,service ,act    
7#db ,u4,s4,c4 #bij;dd-#b7 or any       
regulation promulgated under such       
section4  7#g7 ,the ,fair ,credit       
,reporting ,act 7#ae ,u4,s4,c4 #afha et 
seq474  7#h7 ,section #ddd of the       
,general ,education ,provisions ,act    
7commonly known as the ,family          

,educational ,rights and ,privacy ,act  
of #aigd7 7#bj ,u4,s4,c4 #abcb;g7 and   
part #ii of title #cd1 ,code of ,federal
 ,regulations 7or any successor         
regulation71 to the extent a controller 
or processor is an educational agency or
 institution 7as such term is defined in
 #ii4c of such title 7or any successor  
regulation774  7#i7 ,the regulations    
related to the protection of human      
subjects under part #df of title #de1   
,code of ,federal ,regulations4  7#aj7  
,the ,health ,care ,quality ,improvement
 ,act of #aihf 7#db ,u4,s4,c4 #aaaja et 
seq474  7#aa7 ,part ,c of title ,,ix of 
the ,public ,health ,service ,act 7#db  
,u4,s4,c4 #bii;b-#ba et seq474  7#ab7   
,chapter #abc of title #ah1 ,united     
,states ,code4  7b7 ,relationship to    
,communications ,act of #aicd  7#a7 ,in 
general ,except as provided in paragraph
 7#b71 the ,communications ,act of #aicd
 7#dg ,u4,s4,c4 #aea et seq471 and any  
regulation promulgated by the ,federal  
,communications ,commission pursuant to 

such ,act1 shall not apply to a         
controller or processor with respect to 
the collection1 use1 processing1        
transferring1 or security of personal   
data4  7#b7 ,exception ,paragraph 7#a7  
does not apply to the extent a          
regulation or order pertains solely to  
emergency services4  7c7 ,repeal        
,section #bgaj of title #ah1 ,united    
,states ,code1 is repealed4  #ae4       
,relationship to ,state laws ,no ,state 
or political subdivision of a ,state may
 prescribe1 maintain1 or enforce any    
law1 rule1 regulation1 requirement1     
standard1 or other provision having the 
force and effect of law1 if such law1   
rule1 regulation1 requirement1 standard1
 or other provision relates to the      
provisions of this ,act4  #af4          
,definitions ,in this ,act3 7#a7        
,affiliate  7,a7 ,in general ,the term  
affiliate means a legal entity that     
controls1 is controlled by1 or is under 
common control with another legal entity
 or shares common branding with another 

legal entity4  7,b7 ,control2 controlled
 ,in subparagraph 7,a71 the terms       
control and controlled mean-- 7i7       
ownership of1 or the power to vote1 more
 than #ej percent of the outstanding    
shares of any class of voting security  
of a company2  7ii7 control in any      
manner over the election of a majority  
of the directors or of individuals      
exercising similar functions2 or  7iii7 
the power to exercise controlling       
influence over the management of a      
company4  7#b7 ,agency ,the term agency 
has the meaning given that term in      
section #eea of title #e1 ,united       
,states ,code4  7#c7 ,authenticate ,the 
term authenticate means to verify       
through commercially reasonable means   
that the consumer1 entitled to exercise 
the consumer rights described under     
section #b1 is the same consumer that   
exercises such a consumer right with    
respect to the relevant personal data4  
7#d7 ,biometric data ,the term biometric
 data-- 7,a7 means data generated by    

automatic measurements of the biological
 characteristics of an individual1 such 
as a fingerprint1 voiceprint1 eye       
retinas1 irises1 or other unique        
biological patterns or characteristics  
that is used to identify a specific     
individual2 and  7,b7 does not include a
 physical or digital photograph1 a video
 or audio recording 7or data generated  
therefrom71 or information collected1   
used1 or stored for health care         
treatment1 payment1 or operations       
pursuant to ,,hipaa4  7#e7 ,business    
associate2 covered entity2 healthcare   
provider2 protected health information  
,the terms business associate1 covered  
entity1 healthcare provider1 and        
protected health information have the   
meanings given those terms in for       
purposes of regulations promulgated     
pursuant to section #bfd7;c7 of the     
,health ,insurance ,portability and     
,accountability ,act 7#db ,u4,s4,c4     
#acbj;d-#b note74  7#f7 ,child ,the term
 child means an individual who is under 

the age of #ac4  7#g7 ,commission ,the  
term ,commission means the ,federal     
,trade ,commission4  7#h7 ,consent ,the 
term consent-- 7,a7 means a clear       
affirmative act that signifies the      
freely given1 specific1 informed1 and   
unambiguous agreement by a consumer to  
process personal data relating to the   
consumer2 and  7,b7 includes a written  
statement1 including a statement written
 by electronic means1 or any other      
unambiguous affirmative action4  7#i7   
,consumer ,the term consumer means--    
7,a7 an individual that acts in an      
individual or household capacity2 and   
7,b7 does not include an individual that
 acts in a commercial or employment     
context4  7#aj7 ,controller ,the term   
controller means a person that1 alone or
 jointly with others1 determines the    
purpose and means of processing personal
 data4  7#aa7 ,covered nation ,the term 
covered nation has the meaning given    
that term in section #dhgb7;f7 of title 
#aj1 ,united ,states ,code4  7#ab7 ,data

 broker  7,a7 ,in general ,the term data
 broker means a controller that meets   
the following-- 7i7 ,the controller     
collects and processes personal data    
concerning a consumer who is not3  7,i7 
a customer or a client of the           
controller2 or  7,,ii7 a user1 reader1  
or subscriber of a product or service   
provided by the controller2 and  7ii7   
,the controller derives #ej percent or  
more of annual gross revenue from the   
sale of such personal data4  7,b7       
,limitation ,the term data broker does  
not include a person acting as a        
processor4  7#ac7 ,decision that has a  
legal or similarly significant effect   
,the term decision that has a legal or  
similarly significant effect means a    
decision made by a controller about a   
consumer to deny one of the following to
 the consumer3 7,a7 ,a healthcare       
service 7as defined in part #cah4b of   
title #af1 ,code of ,federal            
,regulations74  7,b7 ,a rental or lease 
of housing4  7,c7 ,an employment        

opportunity4  7#ad7 ,deidentified data  
,the term deidentified data means data  
that cannot reasonably be linked to an  
identified or identifiable individual or
 a device linked to an individual4      
7#ae7 ,health record ,the term health   
record means a record1 other than for   
financial or billing purposes1 relating 
to an individual1 kept by a health care 
provider as a result of the professional
 relationship established between the   
health care provider and the individual4
  7#af7 ,,hipaa ,the term ,,hipaa means 
,health ,insurance ,portability and     
,accountability ,act of #aiif 7#db      
,u4,s4,c4 #acbj;d et seq474  7#ag7      
,identified or identifiable natural     
person ,the term identified or          
identifiable natural person means a     
person who can be readily identified1   
directly or indirectly4  7#ah7          
,institution of higher education ,the   
term institution of higher education has
 the meaning given that term in section 
#aja of ,higher ,education ,act of #aife

 7#bj ,u4,s4,c4 #ajja74  7#ai7          
,nonprofit organization ,the term       
nonprofit organization means an         
organization that is described in       
section #eja7;c77#c7 of the ,internal   
,revenue ,code of #aihf and exempt from 
taxation under section #eja7;a7 of such 
,code4  7#bj7 ,parent ,the term parent1 
with respect to a child or teen1 means  
an adult with the legal right to make   
decisions on behalf of the child or     
teen1 including-- 7,a7 a natural parent2
  7,b7 an adoptive parent2  7,c7 a legal
 guardian2 and  7,d7 an individual with 
legal custody over the child or teen4   
7#ba7 ,personal data ,the term personal 
data--  7,a7 means any information that 
is linked or reasonably linkable to an  
identified or identifiable natural      
person2 and  7,b7 does not include      
deidentified data or publicly available 
information4  7#bb7 ,precise geolocation
 data ,the term precise geolocation     
data-- 7,a7 means information derived   
from technology1 including global       

positioning system level latitude and   
longitude coordinates or other          
mechanisms1 that directly identifies the
 specific location of a natural person  
with precision and accuracy within a    
radius of #a1gej feet2 and  7,b7 does   
not include-- 7i7 the content of        
communications2 or  7ii7 any data       
generated by or connected to advanced   
utility metering infrastructure systems 
or equipment for use by a utility4      
7#bc7 ,process or processing ,the term  
process or processing means any         
operation or set of operations          
performed1 whether by manual or         
automated means1 on personal data or on 
sets of personal data1 such as the      
collection1 use1 storage1 disclosure1   
analysis1 deletion1 or modification of  
personal data4  7#bd7 ,processor ,the   
term processor means a person that      
processes personal data on behalf of a  
controller4  7#be7 ,profiling ,the term 
profiling means any form of processing  
that is solely automated and performed  

on personal data to evaluate1 analyze1  
or predict personal aspects of the      
economic situation1 health1 personal    
preference1 interest1 reliability1      
behavior1 location1 or movement of an   
identified or identifiable consumer4    
7#bf7 ,pseudonymous data ,the term      
pseudonymous data means personal data   
that cannot be attributed to a specific 
individual without the use of additional
 information if the additional          
information is kept separately and is   
subject to appropriate administrative   
and technical measures to ensure that   
the personal data is not attributed to  
an identified or identifiable           
individual4  7#bg7 ,publicly available  
information ,the term publicly available
 information means information that is  
lawfully made available through         
,federal1 ,state1 or local government   
records1 or information that a business 
has a reasonable basis to believe is    
lawfully made available to the public   
through widely distributed media1 by the

 consumer1 or by a person to whom the   
consumer has disclosed the information1 
unless the consumer has restricted the  
information to a specific audience4     
7#bh7 ,sale of personal data ,the term  
sale of personal data-- 7,a7 means the  
exchange of personal data for monetary  
consideration by the controller to      
another controller or to a governmental 
entity2 and  7,b7 does not include-- 7i7
 the disclosure of personal data to a   
processor that processes the personal   
data on behalf of the controller2  7ii7 
the disclosure of personal data to      
another controller for the purposes of  
providing a product or service requested
 by the consumer2  7iii7 the disclosure 
or transfer of personal data to an      
affiliate of the controller2  7iv7 the  
disclosure of information that the      
consumer intentionally made available to
 the public2  7v7 the disclosure or     
transfer of personal data to another    
controller as an asset that is part of a
 merger1 acquisition1 bankruptcy1 or    

other transaction in which the new      
controller assumes control of any of the
 assets of the previous controller2 or  
7vi7 the disclosure of personal data in 
the course of reporting1 news-gathering1
 speaking1 or other activities intended 
to inform the public on matters of      
public interest or public concern4      
7#bi7 ,secretary ,the term ,secretary   
means the ,secretary of ,commerce4      
7#cj7 ,sensitive data ,the term         
sensitive data means a category of      
personal data that includes-- 7,a7      
personal data that discloses racial or  
ethnic origin1 religious belief1 mental 
or physical health diagnosis1 sexual    
orientation1 or citizenship or          
immigration status2  7,b7 genetic or    
biometric data that is processed for the
 purpose of uniquely identifying a      
specific individual2  7,c7 personal data
 collected from a child or teen2 and    
7,d7 precise geolocation data4  7#ca7   
,state ,the term ,state means each      
,state of the ,united ,states1 the      

,district of ,columbia1 each            
commonwealth1 territory1 or possession  
of the ,united ,states1 and each        
federally recognized ,indian ,tribe4    
7#cb7 ,targeted advertising ,the term   
targeted advertising-- 7,a7 means to    
display an advertisement to a consumer  
in which the advertisement is selected  
based on personal data obtained from the
 activities of that consumer over time  
and across nonaffiliated websites or    
online applications to predict the      
preferences or interests of that        
consumer2 and  7,b7 does not include--  
7i7 an advertisement based on activities
 within the website or online           
application of a controller2  7ii7 an   
advertisement based on the context of a 
current search query1 visit to a        
website1 or online application of a     
consumer2  7iii7 an advertisement       
directed to a consumer in response to   
the request for information or feedback 
by the consumer2 or  7iv7 processing    
personal data processed solely for      

measuring or reporting advertising or   
content performance1 reach1 or          
frequency1 including independent        
measurement4  7#cc7 ,teen ,the term teen
 means an individual who is the age of  
#ac or over and under the age of #af4   
7#cd7 ,trade secret ,the term trade     
secret has the meaning given that term  
in section #ahci of title #ah1 ,united  
,states ,code4  7#ce7 ,verifiable       
consent ,the term verifiable consent    
means any reasonable effort 7taking into
 consideration available technology7 by 
a controller1 including a request for   
authorization for future processing of  
personal data1 to ensure that the parent
 of a teen--  7,a7 receives direct      
notice of the processing practices of   
the controller with respect to personal 
data2 and  7,b7 before the personal data
 of the teen is collected1 freely and   
unambiguously authorizes--  7i7 the     
processing of the personal data2 and    
7ii7 any subsequent use of the personal 
data4  #ag4 ,severability ,if any       

provision of this ,act or the           
application of this ,act to any person  
or circumstance is held invalid1 the    
remaining provisions of this ,act and   
the application of this ,act to other   
persons or circumstances shall not be   
affected4  #ah4 ,effective dates  7a7   
,in general ,except as provided in      
subsection 7b71 this ,act shall take    
effect #b years after the date of the   
enactment of this ,act4  7b7 ,exceptions
 ,notwithstanding subsection 7a71       
sections #b1 #d1 and #e shall take      
effect #a year after the date of the    
enactment of this ,act4