,,ii #aaith ,,congress #ast ,session ,s4 #bjbi ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #aa1 #bjbe,ms4 ,hirono 7for herself1 ,mr4 ,wyden1 ,mr4 ,blumenthal1 ,ms4 ,blunt ,rochester1 ,ms4 ,cantwell1 ,ms4 ,duckworth1 ,mr4 ,gallego1 ,mrs4 ,gillibrand1 ,mr4 ,heinrich1 ,mr4 ,kaine1 ,ms4 ,klobuchar1 ,mr4 ,merkley1 ,mrs4 ,murray1 ,mr4 ,schiff1 ,mrs4 ,shaheen1 ,ms4 ,smith1 ,mr4 ,welch1 ,mr4 ,whitehouse1 ,ms4 ,baldwin1 and ,ms4 ,alsobrooks7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect the privacy of personal reproductive or sexual health information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,my ,body1 ,my ,data ,act of #bjbe4 #b4 ,minimization 7a7 ,minimization of collecting1 retaining1 using1 and disclosing ,a regulated entity may not collect1 retain1 use1 or disclose personal reproductive or sexual health information1 except as is strictly necessary to provide a product or service that the individual to whom such information relates has requested from such regulated entity4 7b7 ,minimization of employee access ,a regulated entity shall restrict access to personal reproductive or sexual health information by the employees or service providers of such regulated entity to such employees or service providers for which access is necessary to provide a product or service that the individual to whom such information relates has requested from such regulated entity4 #c4 ,right of access1 correction1 and deletion 7a7 ,right of access 7#a7 ,in general ,a regulated entity shall make available a reasonable mechanism by which an individual1 upon a verified request1 may access-- 7,a7 any personal reproductive or sexual health information relating to such individual that is retained by such regulated entity1 including-- 7i7 in the case of such information that such regulated entity collected from third parties1 how and from which specific third parties such regulated entity collected such information2 and 7ii7 such information that such regulated entity inferred about such individual2 and 7,b7 a list of the specific third parties to which such regulated entity has disclosed any personal reproductive or sexual health information relating to such individual4 7#b7 ,format ,a regulated entity shall make the information described in paragraph 7#a7 available in both a human-readable format and a structured1 interoperable1 and machine-readable format4 7b7 ,right of correction ,a regulated entity shall make available a reasonable mechanism by which an individual1 upon a verified request1 may direct the correction of any inaccurate personal reproductive or sexual health information relating to such individual that is retained by such regulated entity or the service providers of such regulated entity1 including any such information that such regulated entity collected from a third party or inferred from other information retained by such regulated entity4 7c7 ,right of deletion ,a regulated entity shall make available a reasonable mechanism by which an individual1 upon a verified request1 may direct the deletion of any personal reproductive or sexual health information relating to such individual that is retained by such regulated entity and the service providers of such regulated entity1 including any such information that such regulated entity collected from a third party or inferred from other information retained by such regulated entity4 7d7 ,general provisions 7#a7 ,reasonable mechanism defined ,in this section1 the term reasonable mechanism means1 with respect to a regulated entity and a right under this section1 a mechanism that-- 7,a7 is provided in the primary manner through which such regulated entity provides the goods or services of such regulated entity2 7,b7 is easy to use and prominently available2 and 7,c7 includes an online means of exercising such right4 7#b7 ,timeline for complying with requests ,a regulated entity shall comply with a verified request received under this section without undue delay and not later than #ae days after the date on which the requesting individual submits the verified request4 7#c7 ,fees prohibited ,a regulated entity may not charge a fee to an individual for a request made under this section4 7#d7 ,rules of construction ,nothing in this section shall be construed to require a regulated entity to-- 7,a7 take an action that would convert information that is not personal information into personal information2 7,b7 collect or retain personal information that such regulated entity would otherwise not collect or retain2 or 7,c7 retain personal information longer than such regulated entity would otherwise retain such information4 #d4 ,privacy policy 7a7 ,policy required ,a regulated entity shall maintain a privacy policy relating to the practices of such regulated entity regarding the collecting1 retaining1 using1 and disclosing of personal reproductive or sexual health information4 7b7 ,publication required ,a regulated entity shall prominently publish the privacy policy required by subsection 7a7 on the website of such regulated entity4 7c7 ,contents ,the privacy policy required by subsection 7a7 shall be clear and conspicuous and shall contain1 at a minimum1 the following3 7#a7 ,a description of the practices of the regulated entity regarding the collecting1 retaining1 using1 and disclosing of personal reproductive or sexual health information4 7#b7 ,a concise statement of the categories of such information collected1 retained1 used1 or disclosed by the regulated entity4 7#c7 ,a concise statement1 for each such category1 of the purposes of such regulated entity for the collecting1 retaining1 using1 or disclosing of such information4 7#d7 ,a list of the specific third parties to which such regulated entity discloses such information1 and a concise statement of the purposes for which such regulated entity discloses such information1 including how such information may be used by each such third party4 7#e7 ,a list of the specific third parties from which such regulated entity has collected such information1 and a concise statement of the purposes for which such regulated entity collects such information4 7#f7 ,a concise statement describing the extent to which individuals may exercise control over the collecting1 retaining1 using1 and disclosing of personal reproductive or sexual health information by such regulated entity1 the steps an individual is required to take to implement such controls1 and direct links to such controls4 7#g7 ,a concise statement describing the efforts of the regulated entity to protect personal reproductive or sexual health information from unauthorized disclosure4 #e4 ,prohibition against retaliation ,a regulated entity may not retaliate against an individual because the individual exercises a right of the individual under this ,act1 including by-- 7#a7 denying goods or services to the individual2 7#b7 charging the individual different prices or rates for goods or services1 including by using discounts or other benefits or imposing penalties2 7#c7 providing a different level or quality of goods or services to the individual2 or 7#d7 suggesting that the individual will receive a different price or rate for goods or services or a different level or quality of goods or services4 #f4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of ,commission 7,a7 ,in general ,except as provided in section #g7f77;,a77ii71 the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any regulated entity that violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7,c7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7,d7 ,rulemaking authority ,the ,commission may promulgate1 in accordance with section #eec of title #e1 ,united ,states ,code1 such regulations as may be necessary to carry out this ,act4 7b7 ,enforcement by individuals 7#a7 ,in general ,any individual alleging a violation of this ,act or a regulation promulgated under this ,act may bring a civil action in any court of competent jurisdiction4 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7,a7 an amount not less than #ajj and not greater than #a1jjj per violation per day1 or actual damages1 whichever is greater2 7,b7 punitive damages2 7,c7 reasonable attorney's fees and litigation costs2 and 7,d7 any other relief1 including equitable or declaratory relief1 that the court determines appropriate4 7#c7 ,injury in fact ,a violation of this ,act1 or a regulation promulgated under this ,act1 with respect to personal reproductive or sexual health information constitutes a concrete and particularized injury in fact to the individual to whom such information relates4 7#d7 ,invalidity of pre-dispute arbitration agreements and pre-dispute joint action waivers 7,a7 ,in general ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement or pre-dispute joint-action waiver shall be valid or enforceable with respect to a dispute arising under this ,act4 7,b7 ,applicability ,any determination as to whether or how this paragraph applies to any dispute shall be made by a court1 rather than an arbitrator1 without regard to whether such agreement purports to delegate such determination to an arbitrator4 7,c7 ,definitions ,for purposes of this paragraph3 7i7 ,pre-dispute arbitration agreement ,the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement4 7ii7 ,pre-dispute joint-action waiver ,the term pre-dispute joint-action waiver means an agreement that would prohibit a party from participating in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other forum1 concerning a dispute that has not arisen at the time of the making of the agreement4 #g4 ,definitions ,in this ,act3 7#a7 ,collect ,the term collect means1 with respect to personal reproductive or sexual health information1 for a regulated entity to obtain such information in any manner4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,disclose ,the term disclose means1 with respect to personal reproductive or sexual health information1 for a regulated entity to release1 transfer1 sell1 provide access to1 license1 or divulge such information in any manner to a third party or government entity4 7#d7 ,personal information ,the term personal information means information that identifies1 relates to1 describes1 is reasonably capable of being associated with1 or could reasonably be linked1 directly or indirectly1 with a particular individual1 household1 or device4 7#e7 ,personal reproductive or sexual health information ,the term personal reproductive or sexual health information means personal information relating to the past1 present1 or future reproductive or sexual health of an individual1 including-- 7,a7 efforts to research or obtain reproductive or sexual health information1 services1 or supplies1 including location information that might indicate an attempt to acquire or receive such information1 services1 or supplies2 7,b7 reproductive or sexual health conditions1 status1 diseases1 or diagnoses1 including pregnancy and pregnancy-related conditions1 menstruation1 ovulation1 ability to conceive a pregnancy1 whether such individual is sexually active1 and whether such individual is engaging in unprotected sex2 7,c7 reproductive- and sexual-health-related surgeries or procedures1 including abortion2 7,d7 use or purchase of contraceptives1 medication abortion1 or any other drug1 device1 or materials related to reproductive health2 7,e7 bodily functions1 vital signs1 measurement1 or symptoms related to menstruation or pregnancy1 such as basal temperature1 cramps1 bodily discharge1 or hormone levels2 7,f7 any information about diagnoses or diagnostic testing1 treatment1 medications1 or the purchase or use of any product or service relating to the matters described in subparagraphs 7,a7 through 7,e72 and 7,g7 any information described in subparagraphs 7,a7 through 7,f7 that is derived or extrapolated from non-health information1 including proxy1 derivative1 inferred1 emergent1 and algorithmic data4 7#f7 ,regulated entity 7,a7 ,in general ,the term regulated entity means any entity 7to the extent such entity is engaged in activities in or affecting commerce 7as defined in section #d of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd777 that is-- 7i7 a person1 partnership1 or corporation subject to the jurisdiction of the ,commission under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 or 7ii7 notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd2 #de7;a77#b72 #df7 or any jurisdictional limitation of the ,commission-- 7,i7 a common carrier subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto2 or 7,,ii7 an organization not organized to carry on business for its own profit or that of its members4 7,b7 ,exclusions ,the term regulated entity does not include-- 7i7 an entity that is a covered entity1 as defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor to such regulation71 to the extent such entity is acting as a covered entity under the ,,hipaa privacy regulations 7as defined in section #aahj7;b77#c7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#i7;b77#c7772 7ii7 an entity that is a business associate1 as defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor to such regulation71 to the extent such entity is acting as a business associate under the ,,hipaa privacy regulations 7as defined in such section #aahj7;b77#c772 or 7iii7 an entity that is subject to restrictions on disclosure of records under section #edc of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bij;dd-#b71 to the extent such entity is acting in a capacity subject to such restrictions4 7#g7 ,service provider 7,a7 ,in general ,the term service provider means a person who-- 7i7 collects1 retains1 uses1 or discloses personal reproductive or sexual health information for the sole purpose of1 and only to the extent that such person is1 conducting business activities on behalf of1 for the benefit of1 under instruction of1 and under contractual agreement with a regulated entity and not any other individual or entity2 and 7ii7 does not divulge personal reproductive or sexual health information to any individual or entity other than such regulated entity or a contractor to such service provider bound to information processing terms no less restrictive than terms to which such service provider is bound4 7,b7 ,limitation of application ,such person shall only be considered a service provider in the course of activities described in subparagraph 7,a77i74 7,c7 ,minimization by service providers ,for purposes of compliance with section #b by a service provider of a regulated entity1 a request from an individual to such regulated entity for a product or service shall be treated as having also been provided to such service provider4 7#h7 ,third party ,the term third party means1 with respect to the disclosing or collecting of personal reproductive or sexual health information1 any person who is not-- 7,a7 the regulated entity that is disclosing or collecting such information2 7,b7 the individual to whom such information relates2 or 7,c7 a service provider4 #h4 ,rule of construction ,nothing in this ,act shall be construed to limit or diminish ,first ,amendment freedoms guaranteed under the ,constitution4 #i4 ,relationship to ,federal and ,state laws 7a7 ,federal law preservation ,nothing in this ,act1 or a regulation promulgated under this ,act1 shall be construed to limit any other provision of ,federal law1 except as specifically provided in this ,act4 7b7 ,state law preservation 7#a7 ,in general ,nothing in this ,act1 or a regulation promulgated under this ,act1 shall be construed to preempt1 displace1 or supplant any ,state law1 except to the extent that a provision of ,state law conflicts with a provision of this ,act1 or a regulation promulgated under this ,act1 and then only to the extent of the conflict4 7#b7 ,greater protection under ,state law ,for purposes of this subsection1 a provision of ,state law does not conflict with a provision of this ,act1 or a regulation promulgated under this ,act1 if such provision of ,state law provides greater privacy protection than the privacy protection provided by such provision of this ,act or such regulation4 #aj4 ,savings clause ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 ,nothing in this ,act1 or a regulation promulgated under this ,act1 shall be construed to prohibit a regulated entity from disclosing personal reproductive or sexual health information to the ,commission as required by law1 in compliance with a court order1 or in compliance with a civil investigative demand or similar process authorized under law4 #aa4 ,severability clause ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act1 and the application of such provision to other persons not similarly situated or to other circumstances1 shall not be affected by the invalidation4