,,ii #aaith ,,congress #ast ,session ,s4 #ccjh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #b1 #bjbe,mr4 ,markey 7for himself1 ,mr4 ,booker1 ,mr4 ,merkley1 ,ms4 ,warren1 and ,ms4 ,hirono7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish protections for individual rights with respect to computational algorithms1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,artificial ,intelligence ,civil ,rights ,act of #bjbe4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,,title ,i--,civil rights,sec4 #aja4 ,discrimination4,sec4 #ajb4 ,pre-deployment evaluations and post-deployment impact assessments4,,title ,,ii--,covered algorithm and contract standards,sec4 #bja4 ,covered algorithm standards4,sec4 #bjb4 ,relationships between developers and deployers4,sec4 #bjc4 ,human alternatives and other protections4,sec4 #bjd4 ,prohibition on retaliation2 whistleblower protections4,,title ,,iii--,transparency,sec4 #cja4 ,notice and disclosure4,sec4 #cjb4 ,study on explanations regarding the use of covered algorithms4,sec4 #cjc4 ,consumer awareness4,,title ,,iv--,enforcement,sec4 #dja4 ,enforcement by the ,commission4,sec4 #djb4 ,enforcement by ,states4,sec4 #djc4 ,private right of action4,sec4 #djd4 ,severability4,sec4 #dje4 ,rules of construction4,,title ,v--,federal resources,sec4 #eja4 ,occupational series relating to algorithm auditing4,sec4 #ejb4 ,additional ,federal resources4 #b4 ,definitions ,in this ,act3 7#a7 ,collect2 collection ,the terms collect and collection1 with respect to personal data1 mean buying1 renting1 gathering1 obtaining1 receiving1 accessing1 or otherwise acquiring such data by any means4 7#b7 ,commercial act ,the term commercial act1 with respect to a covered algorithm1 means an act conducted for monetary or other valuable consideration1 including conducting an activity in furtherance of obtaining such consideration4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,consequential action ,the term consequential action means an act that is likely to have a material effect on1 or to materially contribute to1 access to1 security and authentication relating to1 eligibility for1 cost of1 terms of1 or conditions related to any of the following3 7,a7 ,employment1 including hiring1 pay1 independent contracting1 worker management1 promotion1 and termination4 7,b7 ,education and career and technical education1 including assessment1 proctoring1 promotion of academic integrity1 accreditation1 certification1 admissions1 enrollment1 disciplinary actions including suspension1 expulsion1 or referral to law enforcement1 eligibility for graduation1 grade promotion or degree conferral1 academic performance evaluation1 and provision of financial aid and scholarships4 7,c7 ,housing and lodging1 including rental and short-term housing and lodging1 home appraisals1 rental subsidies1 publicly supported housing1 and mortgage lending4 7,d7 ,essential utilities1 including electricity1 heat1 water1 municipal trash or sewage services1 internet and telecommunications service1 and public transportation4 7,e7 ,health care1 including mental health care1 and dental1 vision1 and adoption services1 and other health care-related services1 treatment options1 trials1 and studies4 7,f7 ,credit1 banking1 and other financial services4 7,g7 ,insurance1 including insurance claim determinations4 7,h7 ,actions of the criminal justice system1 law enforcement or intelligence operations1 immigration determinations or enforcement1 border control 7vetting1 screening1 and inspection71 child protective services1 child welfare1 and family services1 including risk and threat assessments1 situational awareness and threat detection1 investigations1 watchlisting1 bail determinations1 sentencing1 administration of parole1 surveillance1 use of unmanned vehicles and machines1 and predictive policing4 7,i7 ,justice and determinations concerning guilt or liability1 including assignment of cases or counsel1 bail determinations1 pre-detention risk assessments1 case intake1 sequencing1 and processing1 awards of actual or punitive damages1 and binding and nonbinding determinations in arbitration1 mediation1 or other alternative dispute resolution4 7,j7 ,elections1 including voting1 requirements for documentation or proof of identity to vote or register to vote 7and determinations about whether an individual meets those requirements71 redistricting1 polling place resources1 reduction or alteration of multilingual or ,english language voting materials1 alteration of the manner in which voting materials are provided or distributed1 reduction1 consolidation1 or relocation of voting locations in elections for ,federal1 ,state1 or local office 7including early1 absentee1 and election-day voting locations71 reduction in days or hours of in-person voting during a period occurring prior to the date of an election for ,federal1 ,state1 or local office during which voters may cast ballots in such election1 election security1 and election administration1 including maintenance processes for voter registration lists that add a new basis for removal from the list of active voters registered to vote in elections for ,federal1 ,state1 or local office1 or that incorporate a new source of information in determining a voter's eligibility to vote in elections for ,federal1 ,state1 or local office4 7,k7 ,government benefits and services1 as well as verification of identity1 citizenship1 and immigration status1 fraud prevention1 and assignment of penalties4 7,l7 ,a public accommodation4 7,m7 ,any other service1 program1 product1 or opportunity which has a comparable legal1 material1 or similarly significant effect on an individual's life as determined by the ,commission through rules promulgated pursuant to section #eec of title #e1 ,united ,states ,code4 7#e7 ,covered algorithm ,the term covered algorithm means-- 7,a7 a computational process derived from machine learning1 natural language processing1 artificial intelligence techniques1 or other computational processing techniques of similar or greater complexity1 that1 with respect to a consequential action-- 7i7 creates or facilitates the creation of a product or information that is used as an integral part of the consequential action2 7ii7 promotes1 recommends1 ranks1 or otherwise affects the display or delivery of information that is used as an integral part of the consequential action2 7iii7 makes a decision2 or 7iv7 facilitates human decision making2 or 7,b7 any other computational process deemed appropriate by the ,commission through rules promulgated pursuant to section #eec of title #e1 ,united ,states ,code4 7#f7 ,covered language ,the term covered language means the #aj languages with the most speakers in the ,united ,states1 according to the most recent data collected by the ,united ,states ,census ,bureau4 7#g7 ,de-identified data ,the term de-identified data means information-- 7,a7 that does not identify and is not linked or reasonably linkable to an individual or a device1 regardless of whether the information is aggregated2 and 7,b7 with respect to which any developer or deployer using such information-- 7i7 takes reasonable technical measures to ensure that the information cannot1 at any point1 be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual2 7ii7 publicly commits in a clear and conspicuous manner-- 7,i7 to process and transfer the information solely in a de-identified form without any reasonable means for re-identification2 and 7,,ii7 to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual2 and 7iii7 contractually obligates any person that receives the information from the developer or deployer-- 7,i7 to comply with all of the provisions of this paragraph with respect to such information2 and 7,,ii7 to require that such contractual obligations be included in all subsequent instances for which the information may be received4 7#h7 ,deployer 7,a7 ,in general ,the term deployer means any person that uses a covered algorithm for a commercial act4 7,b7 ,rule of construction ,the terms deployer and developer shall not be interpreted to be mutually exclusive4 7#i7 ,developer 7,a7 ,in general ,the term developer means any person that designs1 codes1 customizes1 produces1 or substantially modifies an algorithm that is intended or reasonably likely to be used as a covered algorithm-- 7i7 for such person's own use1 or use by a third party1 in connection with a commercial act2 or 7ii7 for use by a government entity4 7,b7 ,assumption of developer responsibilities ,in the event that a deployer uses an algorithm as a covered algorithm1 and no person is considered the developer of the algorithm for purposes of subparagraph 7,a71 the deployer shall be considered the developer of the covered algorithm for the purposes of this ,act4 7,c7 ,rule of construction ,the terms developer and deployer shall not be interpreted to be mutually exclusive4 7#aj7 ,disparate impact 7,a7 ,in general ,the term disparate impact means an unjustified differential effect on an individual or group of individuals on the basis of an actual or perceived protected characteristic4 7,b7 ,unjustified differential effect ,for purposes of subparagraph 7,a71 with respect to the action1 policy1 or practice of a developer or deployer1 a differential effect is unjustified if-- 7i7 the developer or deployer fails to demonstrate that such action1 policy1 or practice causing the differential effect is necessary to achieve a substantial1 legitimate1 and nondiscriminatory interest2 or 7ii7 in the event the developer or deployer demonstrates such interest1 an alternative action1 policy1 or practice could serve such interest with less differential effect4 7,c7 ,application to covered algorithms ,with respect to demonstrating that a covered algorithm causes or contributes to a differential effect1 the covered algorithm is presumed to be not separable for analysis and may be analyzed holistically as a single action1 policy1 or practice1 unless the developer or deployer proves that the covered algorithm is separable by a preponderance of the evidence4 7#aa7 ,harm ,the term harm1 with respect to a consequential action1 means a non-de minimis adverse effect on an individual or group of individuals-- 7,a7 on the basis of a protected characteristic2 7,b7 that involves the use of force1 coercion1 harassment1 intimidation1 or detention2 or 7,c7 that involves the infringement of a right protected under the ,constitution of the ,united ,states4 7#ab7 ,independent auditor 7,a7 ,in general ,the term independent auditor means an individual that conducts a pre-deployment evaluation or impact assessment of a covered algorithm in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment4 7,b7 ,exclusion ,an individual is not an independent auditor of a covered algorithm if such individual-- 7i7 is or was involved in using1 developing1 offering1 licensing1 or deploying the covered algorithm for a commercial act2 7ii7 at any point during the pre-deployment evaluation or impact assessment1 has an employment relationship 7including a contractor relationship1 but not including a contractor relationship for the auditing service described in subparagraph 7,a77 with a developer or deployer that uses1 offers1 or licenses the covered algorithm2 or 7iii7 at any point during the pre-deployment evaluation or impact assessment1 has a direct financial interest1 a reasonably foreseeable future financial interest1 or a material indirect financial interest in a developer or deployer that uses1 offers1 or licenses a covered algorithm1 not including routine payment for the auditing services described in subparagraph 7,a74 7#ac7 ,individual ,the term individual means a natural person in the ,united ,states4 7#ad7 ,personal data 7,a7 ,in general ,the term personal data-- 7i7 means information that identifies or is linked or reasonably linkable1 alone or in combination with other information1 to an individual or an individual's device2 and 7ii7 shall include derived data and unique persistent identifiers4 7,b7 ,exclusion ,the term personal data does not include de-identified data4 7#ae7 ,process ,the term process1 with respect to personal data1 means to conduct or direct any operation or set of operations performed on such data1 including analyzing1 organizing1 structuring1 retaining1 storing1 using1 or otherwise handling such data4 7#af7 ,protected characteristic ,the term protected characteristic means any of the following actual or perceived traits of an individual or group of individuals3 7,a7 ,race4 7,b7 ,color4 7,c7 ,ethnicity4 7,d7 ,national origin1 nationality4 or immigration status4 7,e7 ,religion4 7,f7 ,sex 7including a sex stereotype1 pregnancy1 childbirth1 or a related medical condition1 sexual orientation or gender identity1 and sex characteristics1 including intersex traits74 7,g7 ,disability4 7,h7 ,limited ,english proficiency4 7,i7 ,biometric information4 7,j7 ,familial or marital status4 7,k7 ,source of income4 7,l7 ,income level 7not including the ability to pay for a specific good or service being offered74 7,m7 ,age4 7,n7 ,veteran status4 7,o7 ,genetic information or medical conditions4 7,p7 ,any other classification protected by ,federal law4 7#ag7 ,public accommodation 7,a7 ,in general ,the term public accommodation means-- 7i7 a business that offers goods or services to the general public1 regardless of whether the business is operated for profit or operates from a physical facility2 7ii7 a park1 road1 or pedestrian pathway open to the general public2 7iii7 a means of public transportation2 or 7iv7 a publicly owned or operated facility open to the general public4 7,b7 ,exclusions ,the term public accommodation does not include a private club or establishment described in section #aja7;b77#b74 7#ah7 ,state ,the term ,state means each of the #ej ,states1 the ,district of ,columbia1 ,puerto ,rico1 the ,united ,states ,virgin ,islands1 ,guam1 ,american ,samoa1 and the ,commonwealth of the ,northern ,mariana ,islands4 7#ai7 ,state data protection authority ,the term ,state data protection authority means an independent public authority of a ,state that supervises1 investigates1 and regulates data protection and security law in the ,state1 including handling complaints lodged against persons for violations of ,state and relevant ,federal laws4 7#bj7 ,transfer ,the term transfer1 with respect to personal data1 means to disclose1 release1 disseminate1 make available1 license1 rent1 or share such data orally1 in writing1 electronically1 or by any other means4 ,i ,civil rights #aja4 ,discrimination 7a7 ,in general ,a developer or deployer shall not offer1 license1 promote1 sell1 or use a covered algorithm in a manner that-- 7#a7 causes or contributes to a disparate impact in a manner that prevents2 7#b7 otherwise discriminates in a manner that prevents2 or 7#c7 otherwise makes unavailable1 the equal enjoyment of goods1 services1 or other activities or opportunities1 related to a consequential action1 on the basis of a protected characteristic4 7b7 ,exceptions ,this section shall not apply to-- 7#a7 the offer1 licensing1 or use of a covered algorithm for the sole purpose of-- 7,a7 a developer's or deployer's self-testing 7or auditing by an independent auditor at a developer's or deployer's request7 to identify1 prevent1 or mitigate discrimination1 or otherwise to ensure compliance with obligations1 under ,federal law2 7,b7 expanding an applicant1 participant1 or customer pool to raise the likelihood of increasing diversity or redressing historic discrimination2 or 7,c7 conducting-- 7i7 good faith security research2 or 7ii7 other research1 if conducting the research is not part or all of a commercial act2 or 7#b7 any private club or other establishment not in fact open to the public1 as described in section #bja7;e7 of the ,civil ,rights ,act of #aifd 7#db ,u4,s4,c4 #bjjj;a7e774 #ajb4 ,pre-deployment evaluations and post-deployment impact assessments 7a7 ,pre-,deployment evaluations ,prior to deploying1 licensing1 or offering a covered algorithm 7including deploying a material change to a previously deployed covered algorithm or a material change made prior to deployment7 for a consequential action1 a developer or deployer shall conduct a pre-deployment evaluation in accordance with the following3 7#a7 ,preliminary evaluation 7,a7 ,plausibility of harm 7i7 ,developers ,the developer shall conduct a preliminary evaluation of the plausibility that any expected use of the covered algorithm may result in a harm4 7ii7 ,deployers ,the deployer shall conduct a preliminary evaluation of the plausibility that any intended use of the covered algorithm may result in a harm4 7,b7 ,results ,based on the results of the preliminary evaluation1 the developer or deployer shall-- 7i7 in the event that a harm is not plausible1 record a finding of no plausible harm1 including a description of the developer's expected use or the deployer's intended use of the covered algorithm1 how the preliminary evaluation was conducted1 and an explanation for the finding1 and submit such record to the ,commission2 and 7ii7 in the event that a harm is plausible1 conduct a full pre-deployment evaluation as described in paragraph 7#b74 7,c7 ,previously deployed covered algorithms ,when conducting a preliminary evaluation of a material change to1 or new use of1 a previously deployed covered algorithm1 the developer or deployer may limit the scope of the evaluation to whether use of the covered algorithm may result in a harm as a result of the material change or new use4 7#b7 ,full pre-deployment evaluation 7,a7 ,for developers 7i7 ,independent auditor evaluation ,if a developer determines a harm is plausible during the preliminary evaluation described in paragraph 7#a71 the developer shall engage an independent auditor to conduct a pre-deployment evaluation4 7ii7 ,pre-deployment evaluation requirements ,the evaluation required under clause 7i7 shall include a detailed review and description1 sufficient for an individual having ordinary skill in the art to understand the functioning1 risks1 uses1 benefits1 limitations1 and other pertinent attributes of the covered algorithm1 including-- 7,i7 the covered algorithm's design and methodology1 including the inputs the covered algorithm is designed to use to produce an output and the outputs the covered algorithm is designed to produce2 7,,ii7 how the covered algorithm was created1 trained1 and tested1 including-- 7aa7 any metric used to test the performance of the covered algorithm2 7bb7 defined benchmarks and goals that correspond to such metrics1 including whether there was sufficient representation of demographic groups that are reasonably likely to use or be affected by the covered algorithm in the data used to create or train the algorithm1 and whether there was reasonable testing1 if any1 across such demographic groups2 7cc7 the outputs the covered algorithm actually produces in testing2 7dd7 a description of any consultation with relevant stakeholders1 including any communities that will be impacted by the covered algorithm1 regarding the development of the covered algorithm1 or a disclosure that no such consultation occurred2 7ee7 a description of which protected characteristics1 if any1 were used for testing and evaluation1 and how and why such characteristics were used1 including-- 7,,aa7 whether the testing occurred in comparable contextual conditions to the conditions in which the covered algorithm is expected to be used2 and 7,,bb7 if protected characteristics were not available to conduct such testing1 a description of alternative methods the developer used to conduct the required assessment2 7ff7 any other computational algorithm incorporated into the development of the covered algorithm1 regardless of whether such precursor computational algorithm involves a consequential action2 7gg7 a description of the data and information used to develop1 test1 maintain1 or update the covered algorithm1 including-- 7,,aa7 each type of personal data used1 each source from which the personal data was collected1 and how each type of personal data was inferred and processed2 7,,bb7 the legal authorization for collecting and processing the personal data2 and 7,,cc7 an explanation of how the data 7including personal data7 used is representative1 proportional1 and appropriate to the development and intended uses of the covered algorithm2 and 7hh7 a description of the training process for the covered algorithm which includes the training1 validation1 and test data utilized to confirm the intended outputs2 7,,iii7 the potential for the covered algorithm to produce a harm or to have a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities1 and a description of such potential harm or disparate impact2 7,,iv7 alternative practices and recommendations to prevent or mitigate harm and recommendations for how the developer could monitor for harm after offering1 licensing1 or deploying the covered algorithm2 and 7,v7 any other information the ,commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities1 as prescribed by rules promulgated by the ,commission pursuant to section #eec of title #e1 ,united ,states ,code4 7iii7 ,report ,the independent auditor shall submit to the developer a report on the evaluation conducted under this subparagraph1 including the findings and recommendations of such independent auditor4 7,b7 ,for deployers 7i7 ,independent auditor evaluation ,if a deployer determines a harm is plausible during the preliminary evaluation described in paragraph 7#a71 the deployer shall engage an independent auditor to conduct a pre-deployment evaluation4 7ii7 ,pre-deployment evaluation requirements ,the evaluation required under clause 7i7 shall include a detailed review and description1 sufficient for an individual having ordinary skill in the art to understand the functioning1 risks1 uses1 benefits1 limitations1 and other pertinent attributes of the covered algorithm1 including-- 7,i7 the manner in which the covered algorithm makes or contributes to a consequential action and the purpose for which the covered algorithm will be deployed2 7,,ii7 the necessity and proportionality of the covered algorithm in relation to its planned use1 including the intended benefits and limitations of the covered algorithm and a description of the baseline process being enhanced or replaced by the covered algorithm1 if applicable2 7,,iii7 the inputs that the deployer plans to use to produce an output1 including-- 7aa7 the type of personal data and information used and how the personal data and information will be collected1 inferred1 and processed2 7bb7 the legal authorization for collecting and processing the personal data2 and 7cc7 an explanation of how the data used is representative1 proportional1 and appropriate to the deployment of the covered algorithm2 7,,iv7 the outputs the covered algorithm is expected to produce and the outputs the covered algorithm actually produces in testing2 7,v7 a description of any additional testing or training completed by the deployer for the context in which the covered algorithm will be deployed2 7,,vi7 a description of any consultation with relevant stakeholders1 including any communities that will be impacted by the covered algorithm1 regarding the deployment of the covered algorithm2 7,,vii7 the potential for the covered algorithm to produce a harm or to have a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities in the context in which the covered algorithm will be deployed and a description of such potential harm or disparate impact2 7,,viii7 alternative practices and recommendations to prevent or mitigate harm in the context in which the covered algorithm will be deployed and recommendations for how the deployer could monitor for harm after offering1 licensing1 or deploying the covered algorithm2 and 7,,ix7 any other information the ,commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities as prescribed by rules promulgated by the ,commission pursuant to section #eec of title #e1 ,united ,states ,code4 7iii7 ,report ,the independent auditor shall submit to the deployer a report on the evaluation conducted under this subparagraph1 including the findings and recommendations of such independent auditor4 7b7 ,deployer annual impact assessment ,after the deployment of a covered algorithm1 a deployer shall1 on an annual basis1 conduct an impact assessment in accordance with the following3 7#a7 ,preliminary impact assessment ,the deployer shall conduct a preliminary impact assessment of the covered algorithm to identify any harm that resulted from the covered algorithm during the reporting period and-- 7,a7 if no resulting harm is identified by such assessment1 shall record a finding of no harm1 including a description of the developer's expected use or the deployer's intended use of the covered algorithm1 how the preliminary evaluation was conducted1 and an explanation for such finding1 and submit such finding to the ,commission2 and 7,b7 if a resulting harm is identified by such assessment1 shall conduct a full impact assessment as described in paragraph 7#b74 7#b7 ,full impact assessment ,in the event that the covered algorithm resulted in harm during the reporting period1 the deployer shall engage an independent auditor to conduct a full impact assessment with respect to the reporting period1 including-- 7,a7 an assessment of the harm that resulted or was reasonably likely to have been produced during the reporting period2 7,b7 a description of the extent to which the covered algorithm produced a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities1 including the methodology for such evaluation1 of how the covered algorithm produced or likely produced such disparity2 7,c7 a description of the types of data input into the covered algorithm during the reporting period to produce an output1 including-- 7i7 documentation of how data input into the covered algorithm to produce an output is represented and complete descriptions of each field of data2 and 7ii7 whether and to what extent the data input into the covered algorithm to produce an output was used to train or otherwise modify the covered algorithm2 7,d7 whether and to what extent the covered algorithm produced the outputs it was expected to produce2 7,e7 a detailed description of how the covered algorithm was used to make a consequential action2 7,f7 any action taken to prevent or mitigate harms1 including how relevant staff are informed of1 trained about1 and implement harm mitigation policies and practices1 and recommendations for how the deployer could monitor for and prevent harm after offering1 licensing1 or deploying the covered algorithm2 and 7,g7 any other information the ,commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities as prescribed by rules promulgated by the ,commission pursuant to section #eec of title #e1 ,united ,states ,code4 7#c7 ,reports 7,a7 ,to the deployer ,after the engagement of the independent auditor1 the independent auditor shall submit to the deployer a report on the impact assessment conducted under paragraph 7#b71 including the findings and recommendations of such independent auditor4 7,b7 ,to the developer ,not later than #cj days after the submission of a report on an impact assessment under subparagraph 7,a71 a deployer shall submit to the developer of the covered algorithm a summary of such report1 subject to the trade secret and privacy protections described in subsection 7e77#c74 7c7 ,developer annual review of assessments ,a developer shall1 on an annual basis1 review each impact assessment summary submitted by a deployer of its covered algorithm under subsection 7b77#c77;,b7 for the following purposes3 7#a7 ,to assess how the deployer is using the covered algorithm1 including the methodology for assessing such use4 7#b7 ,to assess the type of data the deployer is inputting into the covered algorithm to produce an output and the types of outputs the covered algorithm is producing4 7#c7 ,to assess whether the deployer is complying with any relevant contractual agreement with the developer and whether any remedial action is necessary4 7#d7 ,to compare the covered algorithm's performance in real-world conditions versus pre-deployment testing1 including the methodology used to evaluate such performance4 7#e7 ,to assess whether the covered algorithm is causing harm or is reasonably likely to be causing harm4 7#f7 ,to assess whether the covered algorithm is causing1 or is reasonably likely to be causing1 a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities1 and1 if so1 how and with respect to which protected characteristic4 7#g7 ,to determine whether the covered algorithm needs modification4 7#h7 ,to determine whether any other action is appropriate to ensure that the covered algorithm remains safe and effective4 7#i7 ,to undertake any other assessment or responsive action the ,commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities1 as prescribed by rules promulgated by the ,commission pursuant to section #eec of title #e1 ,united ,states ,code4 7d7 ,joint developer and deployer obligations ,if a person is both the developer and deployer of a covered algorithm1 the person may conduct combined pre-deployment evaluations and annual assessments1 provided that each combined evaluation or assessment satisfies all requirements for both developers and deployers4 7e7 ,reporting and retention requirements 7#a7 ,reporting ,a developer or deployer that conducts a full pre-deployment evaluation1 full impact assessment1 or developer annual review of assessments shall-- 7,a7 not later than #cj days after completion1 submit the evaluation1 assessment1 or review to the ,commission2 7,b7 upon request1 make the evaluation1 assessment1 or review available to ,congress2 and 7,c7 not later than #cj days after completion-- 7i7 publish a summary of the evaluation1 assessment1 or review on the website of the developer or deployer in a manner that is easily accessible to individuals2 and 7ii7 submit such summary to the ,commission4 7#b7 ,retention ,a developer or deployer shall retain all evaluations1 assessments1 and reviews described in this section for a period of not fewer than #aj years4 7#c7 ,trade secrets and privacy ,a developer or deployer-- 7,a7 may redact and segregate any trade secret 7as defined in section #ahci of title #ah1 ,united ,states ,code7 from public disclosure under this subsection2 and 7,b7 shall redact and segregate personal data from public disclosure under this subsection4 7f7 ,rulemaking 7#a7 ,authority ,the ,commission may1 in accordance with section #eec of title #e1 ,united ,states ,code1 promulgate such rules as may be necessary to carry out this section4 7#b7 ,additional regulations ,not later than #b years after the date of enactment of this ,act1 the ,commission shall-- 7,a7 promulgate rules1 pursuant to section #eec of title #e1 ,united ,states ,code1 specifying-- 7i7 what information and factors a developer or deployer shall consider in making the preliminary evaluation or preliminary impact assessment described in subsections 7a77#a7 and 7b77#a71 respectively2 7ii7 what information a developer or deployer shall include in a summary of an evaluation1 assessment1 or developer review described in subsection 7e77#a77;,c72 and 7iii7 the extent to and process by which a developer may request additional information from a deployer1 including the purposes for which a developer is permitted to use such additional information2 and 7,b7 in promulgating such rules1 consider the need to protect the privacy of personal data1 as well as the need for information sharing by developers and deployers to comply with this section and inform the public4 ,,ii ,covered algorithm and contract standards #bja4 ,covered algorithm standards 7a7 ,covered algorithm use ,a developer or deployer shall do the following3 7#a7 ,take reasonable measures to prevent and mitigate any harm identified by a pre-deployment evaluation described in section #ajb7;a7 or an impact assessment described in section #ajb7;b74 7#b7 ,take reasonable measures to ensure that an independent auditor has all necessary information to complete an accurate and effective pre-deployment evaluation described in section #ajb7;a7 or an impact assessment described in section #ajb7;b74 7#c7 ,with respect to a covered algorithm1 consult stakeholders1 including any communities that will be impacted by the covered algorithm1 regarding the development or deployment of the covered algorithm prior to the deploying1 licensing1 or offering the covered algorithm4 7#d7 ,with respect to a covered algorithm1 certify that1 based on the results of a pre-deployment evaluation described in section #ajb7;a7 or an impact assessment described in section #ajb7;b7-- 7,a7 use of the covered algorithm is not likely to result in harm or disparate impact in the equal enjoyment of goods1 services1 or other activities or opportunities2 7,b7 the benefits from the use of the covered algorithm to individuals affected by the covered algorithm likely outweigh the harms from the use of the covered algorithm to such individuals2 and 7,c7 use of the covered algorithm is not likely to result in a deceptive act or practice4 7#e7 ,ensure that any covered algorithm of the developer or deployer functions-- 7,a7 at a level that would be considered reasonable performance by an individual with ordinary skill in the art2 and 7,b7 in a manner that is consistent with its expected and publicly advertised performance1 purpose1 or use4 7#f7 ,ensure any data used in the design1 development1 deployment1 or use of the covered algorithm is relevant and appropriate to the deployment context and the publicly advertised purpose or use4 7#g7 ,ensure use of the covered algorithm as intended is not likely to result in a violation of this ,act4 7b7 ,deceptive marketing of a product or service ,it shall be unlawful for a developer or deployer to engage in false1 deceptive1 or misleading advertising1 marketing1 or publicizing of a covered algorithm of the developer or deployer4 7c7 ,off-,label use 7#a7 ,developers ,it shall be unlawful for a developer to knowingly offer or license a covered algorithm for any consequential action other than those evaluated in the pre-deployment evaluation described in section #ajb7;a74 7#b7 ,deployers ,it shall be unlawful for a deployer to knowingly use a covered algorithm for any consequential action other than a use evaluated in the pre-deployment evaluation described in section #ajb7;a71 unless the deployer agrees to assume the responsibilities of a developer required by this ,act4 #bjb4 ,relationships between developers and deployers 7a7 ,developer responsibilities ,a developer shall do the following3 7#a7 ,upon the reasonable request of the deployer1 make available to the deployer information necessary to demonstrate the compliance of the deployer with the requirements of this ,act1 including-- 7,a7 making available a report of the pre-deployment evaluation described in section #ajb7;a7 or the annual review of assessments conducted by the developer under section #ajb7;c72 and 7,b7 providing information necessary to enable the deployer to conduct and document a pre-deployment evaluation under section #ajb 7a7 or an impact assessment under section #ajb7;b74 7#b7 ,either-- 7,a7 allow and cooperate with reasonable assessments conducted by the deployer or the deployer's designated independent auditor2 or 7,b7 arrange for an independent auditor to conduct an assessment of the developer's policies and practices in support of the obligations under this ,act using an appropriate and accepted control standard or framework and assessment procedure for such assessments1 and provide a report of such assessment to the deployer upon request4 7b7 ,contracts between developers and deployers 7#a7 ,requirements ,a developer may offer or license a covered algorithm to a deployer pursuant to a written contract between the developer and deployer1 provided that the contract-- 7,a7 clearly sets forth the data processing procedures of the developer with respect to any collection1 processing1 or transfer of data performed on behalf of the deployer2 7,b7 clearly sets forth-- 7i7 instructions for collecting1 processing1 transferring1 or disposing of data by the developer or deployer in the context of the use of the covered algorithm2 7ii7 instructions for deploying the covered algorithm as intended2 7iii7 the nature and purpose of any collection1 processing1 or transferring of data2 7iv7 the type of data subject to such collection1 processing1 or transferring2 7v7 the duration of such processing of data2 and 7vi7 the rights and obligations of both parties1 including a method by which the developer shall notify the deployer of material changes to its covered algorithm2 7,c7 shall not relieve a developer or deployer of any requirement or liability imposed on such developer or deployer under this ,act2 7,d7 prohibits both the developer and deployer from combining data received from or collected on behalf of the other party with data the developer or deployer received from or collected on behalf of another party2 and 7,e7 shall not prohibit a developer or deployer from raising concerns to any relevant enforcement agency with respect to the other party4 7#b7 ,retention of contract ,each developer shall retain for a period of #aj years a copy of each contract entered into with a deployer to which it provides requested products or services4 7c7 ,rule of construction ,for purposes of this section1 any requirement for a developer to contract with1 assist1 and follow the instructions of a deployer shall be read to include a requirement to contract with1 assist1 and follow the instructions of a government entity if the developer is providing a service to a government entity4 #bjc4 ,human alternatives and other protections 7a7 ,right to human alternatives 7#a7 ,rulemaking ,not later than #b years after the date of enactment of this ,act1 the ,commission shall promulgate regulations in accordance with section #eec of title #e1 ,united ,states ,code1 specifying the circumstances and manner in which a deployer shall provide to an individual a means to opt-out of the use of a covered algorithm for a consequential action and to elect to have the consequential action concerning the individual undertaken by a human without the use of a covered algorithm4 7#b7 ,considerations ,in promulgating the regulations under paragraph 7#a71 the ,commission shall consider the following3 7,a7 ,how to ensure that any notice or request from a deployer regarding the right to a human alternative is clear and conspicuous1 in plain language1 easy to execute1 and at no cost to an individual4 7,b7 ,how to ensure that any such notice to individuals is effective1 timely1 and useful4 7,c7 ,the specific types of consequential actions for which a human alternative is appropriate1 considering the magnitude of the action and risk of harm4 7,d7 ,the extent to which a human alternative would be beneficial to individuals and the public interest4 7,e7 ,the extent to which a human alternative can prevent or mitigate harm4 7,f7 ,the risk of harm to individuals beyond the requestor if a human alternative is available or not available4 7,g7 ,the feasibility of providing a human alternative in different circumstances4 7,h7 ,any other considerations the ,commission deems appropriate to balance the need to give an individual control over a consequential action related to such individual with the practical feasibility and effectiveness of granting such control4 7b7 ,individual autonomy ,a developer or deployer may not condition1 effectively condition1 attempt to condition1 or attempt to effectively condition the exercise of any individual right under this ,act or individual choice through-- 7#a7 the use of any false1 fictitious1 fraudulent1 or materially misleading statement or representation2 or 7#b7 the design1 modification1 or manipulation of any user interface with the purpose or substantial effect of obscuring1 subverting1 or impairing a reasonable individual's autonomy1 decision making1 or choice to exercise any such right4 7c7 ,right ,to appeal 7#a7 ,rulemaking ,not later than #b years after the date of enactment of this ,act1 the ,commission shall promulgate regulations in accordance with section #eec of title #e1 ,united ,states ,code1 specifying the circumstances and manner in which a deployer shall provide to an individual a mechanism to appeal to a human a consequential action resulting from the deployer's use of a covered algorithm4 7#b7 ,considerations ,in promulgating the regulations under paragraph 7#a71 the ,commission shall do the following3 7,a7 ,ensure that the appeal mechanism is clear and conspicuous1 in plain language1 easy-to-execute1 and at no cost to individuals4 7,b7 ,ensure that the appeal mechanism is proportionate to the consequential action4 7,c7 ,ensure that the appeal mechanism is reasonably accessible to individuals with disabilities1 timely1 usable1 effective1 and non-discriminatory4 7,d7 ,require1 where appropriate1 a mechanism for individuals to identify and correct any personal data used by the covered algorithm4 7,e7 ,specify training requirements for human reviewers with respect to a consequential action4 7,f7 ,consider any other circumstances1 procedures1 or matters the ,commission deems appropriate to balance the need to give an individual a right to appeal a consequential action related to such individual with the practical feasibility and effectiveness of granting such right4 #bjd4 ,prohibition on retaliation2 whistleblower protections 7a7 ,prohibition on retaliation 7#a7 ,in general ,a developer or deployer may not discriminate or retaliate against an individual 7including by denying or threatening to deny the equal enjoyment of goods1 services1 or other activities or opportunities in relation to a consequential action7 because the individual exercised any right1 refused to waive any such right1 raised a concern about a consequential action under this ,act1 or assisted in any investigation or proceeding under this ,act4 7#b7 ,rules of construction 7,a7 ,differential in service or goods ,nothing in this ,act shall prohibit a developer or deployer from denying service to an individual1 charging an individual a different price or rate1 or providing a different level or quality of goods or services to an individual if the differential in service is necessary and directly related to the value provided to the developer or deployer by the covered algorithm4 7,b7 ,loyalty programs ,nothing in this ,act shall prohibit a developer or deployer from offering loyalty1 rewards1 premium features1 discounts1 or club card programs that provide benefits or rewards based on frequency of patronizing1 or the amount of money spent at1 a business consistent with this ,act4 7b7 ,whistleblower protection ,a developer or deployer may not1 directly or indirectly1 discharge1 demote1 suspend1 threaten1 harass1 or otherwise discriminate or retaliate against an individual for raising a concern1 reporting or attempting to report a violation of this ,act1 or cooperating in any investigation or proceeding under this ,act4 ,,iii ,transparency #cja4 ,notice and disclosure 7a7 ,in general ,each developer or deployer shall make publicly available1 in plain language and in a clear1 conspicuous1 not misleading1 easy-to-read1 and readily accessible manner1 a disclosure that provides a detailed and accurate representation of the developer or deployer's practices regarding the requirements under this ,act4 7b7 ,content of disclosure ,the disclosure required under subsection 7a7 shall include1 at a minimum1 the following3 7#a7 ,the identity and the contact information of-- 7,a7 the developer or deployer to which the disclosure applies 7including the developer or deployer's point of contact and electronic and physical mail address1 as applicable for any inquiry concerning a covered algorithm or individual rights under this ,act72 and 7,b7 any other entity within the same corporate structure as the developer or deployer to which personal data is transferred by the developer or deployer4 7#b7 ,a link to the website containing the developer or deployer's summaries of pre-deployment evaluations1 impact assessments1 and annual review of assessments1 as applicable4 7#c7 ,the categories of personal data the developer or deployer collects or processes in the development or deployment of a covered algorithm and the processing purpose for each such category4 7#d7 ,whether the developer or deployer transfers personal data1 and1 if so1 each third party to which the developer or deployer transfers such data and the purpose for which such data is transferred1 except with respect to a transfer to a governmental entity pursuant to a court order or law that prohibits the developer or deployer from disclosing such transfer4 7#e7 ,a prominent description of how an individual can exercise the rights described in this ,act4 7#f7 ,a general description of the developer or deployer's practices for compliance with the requirements described in sections #ajb and #bja4 7#g7 ,the following disclosure3 ,the audit of this algorithm was conducted to comply with the ,artificial ,intelligence ,civil ,rights ,act of #bjbe1 which seeks to avoid the use of any algorithm that has a disparate impact on certain protected classes of individuals4 ,the audit does not guarantee that this algorithm is safe or in compliance with all applicable laws4 4 7#h7 ,the effective date of the disclosure4 7c7 ,languages ,the disclosure required under subsection 7a7 shall be made available in each covered language in which the developer or deployer operates or provides a good or service4 7d7 ,accessibility ,any disclosure provided under this section shall be made available in a manner that is reasonably accessible to and usable by individuals with disabilities4 7e7 ,material changes 7#a7 ,notification ,if a developer or deployer makes a material change to the disclosure required under subsection 7a71 the developer or deployer shall notify each individual affected by such material change prior to implementing the material change4 7#b7 ,requirements ,each developer or deployer shall take all reasonable measures to provide to each affected individual a direct electronic notification regarding any material change to the disclosure1 in each covered language in which the disclosure is made available1 and taking into account available technology and the nature of the relationship with such individual4 7#c7 ,log of material changes 7,a7 ,retention period ,beginning after the date of enactment of this ,act1 each developer or deployer shall retain a copy of each previous version of the disclosure required under subsection 7a7 for a period of at least #aj years after the last day on which such version was effective and publish each such version on its website4 7,b7 ,log of material changes ,each developer or deployer shall make publicly available1 in a clear1 conspicuous1 and readily accessible manner1 a log describing the date and nature of each material change to its disclosure during the retention period described in subparagraph 7,a71 and such descriptions shall be sufficient for a reasonable individual to understand the material effect of each material change4 7,c7 ,clarification ,the obligations described in this paragraph shall not apply to any previous version of a developer or deployer's disclosure of practices regarding the collection1 processing1 and transfer of personal data1 or any material change to such disclosure1 that precedes the date of enactment of this ,act4 7f7 ,short-,form notice 7#a7 ,in general ,a deployer shall provide a short-form notice regarding a covered algorithm it develops1 offers1 licenses1 or uses in a manner that-- 7,a7 is concise1 clear1 conspicuous1 in plain language1 and not misleading2 7,b7 is readily accessible to individuals with disabilities2 7,c7 is based on what is reasonably anticipated within the context of the relationship between the individual and the deployer2 7,d7 includes an overview of each applicable individual right and disclosure in a manner that draws attention to any practice that may be unexpected to a reasonable individual or that involves a consequential action2 7,e7 is not more than #ejj words in length2 and 7,f7 is available to the public at no cost4 7#b7 ,timing of notice 7,a7 ,existing relationship ,if a deployer has a relationship with an individual1 the deployer shall provide an electronic version of the short-form notice directly to the individual upon the individual's first interaction with the covered algorithm4 7,b7 ,no relationship ,if a deployer does not have a relationship with an individual1 the deployer shall provide the short-form notice in a clear1 conspicuous1 accessible1 and not misleading manner on their website4 7#c7 ,rulemaking ,the ,commission shall promulgate regulations in accordance with section #eec of title #e1 ,united ,states ,code1 specifying the minimum content required to be included in the short-form notice described in paragraph 7#a71 which-- 7,a7 shall not exceed the content requirements described in subsection 7b72 and 7,b7 shall include a template or model for such short-form notice4 7g7 ,reporting mechanism ,each developer or deployer shall make publicly available1 in a clear1 conspicuous1 and readily accessible manner1 a mechanism for an individual impacted by a covered algorithm to report to the developer or deployer potential violations of this ,act4 #cjb4 ,study on explanations regarding the use of covered algorithms 7a7 ,study 7#a7 ,in general ,the ,commission shall conduct a study1 with notice and public comment1 on the feasibility of requiring deployers to provide a clear1 conspicuous1 easy-to-use1 no-cost mechanism that is accessible for individuals with disabilities and allows an individual to receive an explanation as to whether and how a covered algorithm used by the deployer affects or affected an individual4 7#b7 ,requirements ,the study required under paragraph 7#a7 shall include the following3 7,a7 ,an overview of the purposes for which an explanation would be provided to an individual and the extent to which an explanation would feasibly serve such purposes4 7,b7 ,how explanations can be provided in a manner that is clear1 conspicuous1 easy-to-use1 no-cost1 accessible to individuals with disabilities1 effective for individuals with limited ,english language proficiency1 and calibrated to the level of risk based on the covered algorithm4 7,c7 ,an assessment of the feasibility of a requirement for deployers to provide a mechanism for individuals who may be affected or were affected by a covered algorithm to request an explanation that-- 7i7 includes information-- 7,i7 regarding why the covered algorithm produced the result it produced with respect to the individual making the request2 and 7,,ii7 that is truthful1 accurate1 and scientifically valid2 7ii7 identifies at least the most significant factors used to inform the covered algorithm's outputs2 and 7iii7 includes any other information deemed relevant by the ,commission to provide an explanation for an individual who may be affected or was affected by a covered algorithm4 7,d7 ,an assessment of what information a developer must provide a deployer in order to ensure explanations can be provided to individuals upon request4 7,e7 ,the extent to which current technical capabilities of covered algorithms impacts the feasibility of providing explanations4 7,f7 ,how a deployer can take reasonable measures to verify the identity of an individual making a request for an explanation to ensure that the deployer provides an explanation only to the affected individual1 including steps a deployer should take to ensure the safe and secure storage1 collection1 and deletion of personal information4 7,g7 ,recommendations for ,congress on how to implement regulations around mechanisms for explanations4 7#c7 ,consultation ,in conducting the study required under this subsection1 the ,commission shall consult with the ,national ,institute of ,science of ,technology1 the ,national ,telecommunications and ,information ,administration1 the ,office of ,science and ,technology ,policy1 and any other agency deemed relevant by the ,commission4 7b7 ,report ,not later than #ah months after the date of enactment of this ,act1 the ,commission shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that includes the findings of the study conducted under subsection 7a71 together with recommendations for such legislation and administrative action as the ,commission determines appropriate4 #cjc4 ,consumer awareness 7a7 ,notice of consumer rights 7#a7 ,in general ,not later than #ij days after the date of enactment of this ,act1 the ,commission shall publish1 on the internet website of the ,commission1 a web page that describes each provision1 right1 obligation1 and requirement of this ,act 7categorized with respect to individuals1 deployers1 and developers7 and the remedies1 exemptions1 and protections associated with this ,act1 in plain and concise language1 in each covered language1 and in an easy-to-understand1 accessible manner4 7#b7 ,updates ,the ,commission shall update the information published under paragraph 7#a7 as necessitated by any change in law1 regulation1 guidance1 or judicial decision4 ,any such update shall be published in plain and concise language1 in each covered language1 and in an easy-to-understand1 accessible manner4 7b7 ,annual report ,not later than #b years after the date of enactment of this ,act1 and annually thereafter1 the ,commission shall publish on the internet website of the ,commission a report that-- 7#a7 describes and summarizes the information contained in any pre-deployment evaluation1 impact assessment1 and developer review submitted to the ,commission in accordance with this ,act2 7#b7 describes broad trends1 aggregated statistics1 and anonymized information about performing impact assessments of covered algorithms1 for the purposes of updating guidance related to impact assessments and summary reporting1 oversight1 and making recommendations to other regulatory agencies2 and 7#c7 is accessible and machine readable in accordance with the #bast ,century ,integrated ,digital ,experience ,act 7#dd ,u4,s4,c4 #ceja note74 7c7 ,publicly accessible repository 7#a7 ,establishment 7,a7 ,in general ,not later than #ahj days after the ,commission publishes the first annual report under subsection 7b71 the ,commission shall develop a publicly accessible repository to publish each pre-deployment evaluation1 impact assessment1 and developer review submitted to the ,commission in accordance with section #ajb4 7,b7 ,requirements ,the ,commission shall design the repository established under subparagraph 7,a7 to-- 7i7 be publicly available and easily discoverable on the internet website of the ,commission2 7ii7 allow users to sort and search the repository by multiple characteristics 7such as by developer or deployer and date reported7 simultaneously2 7iii7 allow users to make a copy of or download the information obtained from the repository1 including any subsets of information obtained by sorting or searching as described in clause 7ii71 in accordance with current guidance from the ,office of ,management and ,budget1 such as the ,open1 ,public1 ,electronic1 and ,necessary ,government ,data ,act 7#dd ,u4,s4,c4 #aja note72 7iv7 be in accordance with user experience and accessibility best practices1 such as those described in the #bast ,century ,integrated ,digital ,experience ,act 7#dd ,u4,s4,c4 #ceja note72 and 7v7 include information about the design1 use1 and maintenance of the repository1 including any other information determined appropriate by the ,commission4 7#b7 ,publication of additional summaries ,the ,commission shall publish in the repository any pre-deployment evaluation1 impact assessment1 and developer review not later than #cj days after receiving such evaluation1 assessment1 or review1 except if the ,commission has good cause to delay such publication4 7#c7 ,trade secrets and privacy ,the ,commission-- 7,a7 may redact and segregate any trade secret 7as defined in section #ahci of title #ah1 ,united ,states ,code7 from public disclosure under this subsection2 7,b7 shall redact and segregate personal data from public disclosure under this subsection2 and 7,c7 may withhold information as permitted under section #eeb of title #e1 ,united ,states ,code4 ,,iv ,enforcement #dja4 ,enforcement by the ,commission 7a7 ,unfair or deceptive acts or practices ,a violation of title ,i1 ,,ii1 or ,,iii or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7b7 ,powers of the ,commission 7#a7 ,in general ,except as provided in subsection 7c71 the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7#b7 ,privileges and immunities ,any person who violates title ,i1 ,,ii1 or ,,iii or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7#d7 ,rulemaking ,the ,commission may promulgate in accordance with section #eec of title #e1 ,united ,states ,code1 such rules as may be necessary to carry out this ,act4 7c7 ,jurisdiction ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act and the regulations promulgated under this ,act1 in the same manner provided in subsections 7a7 and 7b71 with respect to-- 7#a7 organizations not organized to carry on business for their own profit or that of their members2 7#b7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq47 and all ,acts amendatory thereof and supplementary thereto2 7#c7 a bank1 savings and loan institution described in section #ah7;f77#c7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7f77#c771 or ,federal credit union described in section #ah7;f77#d7 of such ,act2 7#d7 an air carrier or foreign air carrier subject to the ,federal ,aviation ,act of #aieh 7#di ,u4,s4,c4 ,app4 #acja et seq472 or 7#e7 a person1 partnership1 or corporation subject to the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq471 as amended4 #djb4 ,enforcement by ,states 7a7 ,in general ,in any case in which the attorney general of a ,state or a ,state data protection authority has reason to believe that an interest of the residents of the ,state has been or is threatened or adversely affected by the engagement of a person in a practice that violates title ,i1 ,,ii1 or ,,iii1 or a regulation promulgated thereunder1 the attorney general may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate ,federal district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code1 to-- 7#a7 enjoin any such violation by the person2 7#b7 enforce compliance with the requirements of this ,act2 7#c7 obtain a permanent1 temporary1 or preliminary injunction or other appropriate equitable relief2 7#d7 obtain civil penalties in the amount of #ae1jjj per violation1 or #d percent of the defendant's average gross annual revenue over the preceding #c years1 whichever is greater2 7#e7 obtain damages1 restitution1 or other compensation on behalf of the residents of such ,state2 7#f7 obtain reasonable attorneys' fees and litigation costs2 and 7#g7 obtain such other relief as the court may consider to be appropriate4 7b7 ,rights of the ,commission 7#a7 ,notice to the ,commission 7,a7 ,in general ,subject to subparagraph 7,c71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under subsection 7a7 before the filing of the civil action4 7,b7 ,contents ,the notification required under subparagraph 7,a7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7,c7 ,exception ,the notification described in subparagraph 7,a7 shall not be required if the attorney general of the ,state determines that it is not feasible to provide such notice before filing the action4 7#b7 ,intervention by the ,commission ,not later than #ahj days after receiving notice under paragraph 7#a71 the ,commission shall have the right to intervene in the action that is the subject of the notice4 7#c7 ,effect of intervention ,if the ,commission intervenes in an action under subsection 7a71 it shall have the right-- 7,a7 to be heard with respect to any matter that arises in that action2 and 7,b7 file a petition for appeal4 7c7 ,investigatory powers ,nothing in this section may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to-- 7#a7 conduct investigations2 7#b7 administer oaths or affirmations2 or 7#c7 compel the attendance of witnesses or the production of documentary or other evidence4 7d7 ,coordination with relevant agencies 7#a7 ,consultation ,the ,commission may consult with any relevant ,federal agencies as necessary to carry out this ,act4 7#b7 ,memorandum of understanding ,not later than #ahj days after the date of enactment of this ,act1 the ,commission1 in coordination with any relevant ,federal agencies1 shall establish1 through a memorandum of understanding-- 7,a7 procedures for coordinating investigations and enforcement actions2 7,b7 protocols for information sharing and technical assistance2 7,c7 standards for determining the division of enforcement authority between the ,commission and such ,federal agencies2 and 7,d7 processes for referral of complaints between agencies4 #djc4 ,private right of action 7a7 ,enforcement by individuals 7#a7 ,in general ,any individual or class of individuals alleging a violation of title ,i1 ,,ii1 or ,,iii1 or a regulation promulgated thereunder1 may bring a civil action in any court of competent jurisdiction4 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7,a7 treble damages or #ae1jjj per violation1 whichever is greater2 7,b7 nominal damages2 7,c7 punitive damages2 7,d7 reasonable attorney's fees and litigation costs2 and 7,e7 any other relief1 including equitable or declaratory relief1 that the court determines appropriate4 7#c7 ,rights of the ,commission and ,state attorneys general 7,a7 ,in general ,prior to an individual bringing a civil action under paragraph 7#a71 such individual shall notify the ,commission and the attorney general of the ,state where such individual resides1 in writing and including a description of the allegations included in the civil action1 that such individual intends to bring a civil action under such paragraph4 ,not later than #fj days after receiving such notice1 the ,commission and ,state attorney general shall each or jointly make a determination and respond to such individual as to whether they will intervene in such action4 ,the ,commission and ,state attorney general shall have a right to intervene in any civil action under paragraph 7#a71 and upon intervening1 to be heard on all matters arising in such action and file petitions for appeal of a decision in such action4 ,if a ,state attorney general does intervene1 they shall only be heard with respect to the interests of the residents of their ,state4 7,b7 ,retained authority ,subparagraph 7,a7 shall not be construed to limit the authority of the ,commission or any applicable ,state attorney general to1 at a later date1 commence a civil action or intervene by motion if the ,commission or ,state attorney general does not commence a proceeding or civil action within the #fj-;day period described in such subparagraph4 7b7 ,invalidity of pre-,dispute arbitration agreements and pre-,dispute joint action waivers 7#a7 ,in general ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement or pre-dispute joint action waiver shall be valid or enforceable with regard to a dispute arising under this ,act4 7#b7 ,applicability ,any determination as to whether or how this subsection applies to any dispute shall be made by a court1 rather than an arbitrator1 without regard to whether such agreement purports to delegate such determination to an arbitrator4 7#c7 ,definitions ,for purposes of this subsection3 7,a7 ,pre-dispute arbitration agreement ,the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement4 7,b7 ,pre-dispute joint-action waiver ,the term pre-dispute joint-action waiver means an agreement1 whether or not part of a pre-dispute arbitration agreement1 that would prohibit or waive the right of #a of the parties to the agreement to participate in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other related forum1 concerning a dispute that has not yet arisen at the time of the making of the agreement4 #djd4 ,severability ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act1 and the application of such provision to other persons not similarly situated or to other circumstances1 shall not be affected by the invalidation4 #dje4 ,rules of construction 7a7 ,in general ,nothing in this ,act shall be construed to-- 7#a7 waive or otherwise limit any requirement under the ,national ,labor ,relations ,act 7#bi ,u4,s4,c4 #aea et seq47 for an employer 7as such term is defined in section #b of such ,act 7#bi ,u4,s4,c4 #aeb77 to bargain collectively regarding the deployment or effects of a covered algorithm2 7#b7 absolve an employer of any obligation to ensure a covered algorithm and its effects comply with health and safety laws2 7#c7 allow an employer to deploy a covered algorithm that interferes with the rights of employees under any ,federal1 ,state1 or local law2 or 7#d7 absolve any other duty or requirement under any other ,federal1 ,state1 or local law4 7b7 ,otherwise applicable requirements and authority ,no regulation or standard imposed under this ,act may be construed in a manner that would lessen the stringency of the requirements of any applicable ,federal or ,state agency that are otherwise applicable4 ,this ,act does not divest any such agency of any authority derived from any other applicable law4 ,v ,federal resources #eja4 ,occupational series relating to algorithm auditing ,not later than #bgj days after the date of enactment of this ,act1 the ,director of the ,office of ,personnel ,management shall exercise the authority of the ,director under section #eaje of title #e1 ,united ,states ,code1 to establish a new occupational series and associated policies covering ,federal ,government positions in the field of algorithm auditing 7as described in the report of the ,government ,accountability ,office entitled ,artificial ,intelligence3 ,an ,accountability ,framework for ,federal ,agencies and ,other ,entities 7,,gao-#ba-eai,,sp71 dated ,june #cj1 #bjba71 which shall include algorithm auditing practices1 platform auditing1 evaluation and assessment of artificial intelligence systems1 computer security1 independent evaluation and audits of computer systems1 data science1 statistics1 auditing of anticompetitive practices1 and related fields4 #ejb4 ,additional ,federal resources 7a7 ,authorization of appropriations ,there is authorized to be appropriated to the ,commission and other ,federal agencies enumerated in this ,act such sums as may be necessary to carry out this ,act4 7b7 ,commission personnel ,notwithstanding any other provision of law1 the ,commission may hire not more than #ejj additional personnel to accomplish the work of the ,commission with respect to unfair or deceptive acts or practices relating to the development or deployment of covered algorithms in accordance with this ,act4