,,ii  #aaith ,,congress  #b;d ,session  
,s4 #didf  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,july #ac1     
#bjbf,ms4 ,warren 7for herself1 ,mr4    
,sanders1 ,mr4 ,whitehouse1 and ,mr4    
,wyden7 introduced the following bill2  
which was read twice and referred to the
 ,committee on ,commerce1 ,science1 and 
,transportation  ,a ,,bill  ,to prohibit
 data brokers from selling and          
transferring certain sensitive data4    
#a4 ,short title ,this ,act may be cited
 as the ,health and ,location ,data     
,protection ,act of #bjbf4  #b4 ,unfair 
and deceptive acts and practices        
relating to health and location data    
7a7 ,prohibition on sale by data brokers
 ,it shall be unlawful for a data broker
 to sell1 resell1 license1 trade1       
transfer1 share1 or otherwise provide or
 make available any of the following    
forms of data1 whether declared or      
inferred1 of an individual3 7#a7        
,location data4  7#b7 ,health data4     
7#c7 ,other categories of data          

identified by the ,commission that      
address or reveal a category of data    
described in paragraphs 7#a7 and 7#b74  
7b7 ,prohibition on sale to data brokers
 ,it shall be unlawful for any person to
 sell1 resell1 license1 trade1 transfer1
 share1 or otherwise provide or make    
available to a data broker any of the   
following forms of data1 whether        
declared or inferred1 of an individual3 
7#a7 ,location data4  7#b7 ,health data4
  7#c7 ,other categories of data        
identified by the ,commission that      
address or reveal a category of data    
described in paragraphs 7#a7 and 7#b74  
7c7 ,exceptions  7#a7 ,actions that are 
,,hipaa-compliant  7,a7 ,in general     
,nothing in this ,act shall be construed
 to prohibit any action taken with      
respect to the health information of an 
individual by a data broker acting in   
its capacity as a business associate or 
covered entity1 that is permissible     
under the ,federal regulations          
concerning standards for privacy of     

individually identifiable health        
information promulgated under section   
#bfd7;c7 of the ,health ,insurance      
,portability and ,accountability ,act of
 #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 
7,b7 ,application of terms ,in paragraph
 7#a71 the terms business associate1    
covered entity1 and health information  
shall have the meaning given those terms
 in the ,federal regulations specified  
in such paragraph4  7#b7 ,publication of
 newsworthy information of legitimate   
public concern ,nothing in this ,act    
shall be construed to prohibit the      
publication of newsworthy information of
 legitimate public concern4  7#c7       
,disclosure pursuant to valid           
authorization ,nothing in this ,act     
shall be construed to prohibit a        
disclosure of the data of an individual 
for which the individual provides valid 
authorization4 ,for purposes of this    
paragraph1 the term valid authorization 
has the meaning given such term in      
section #afd4ejh of title #de1 ,code of 

,federal ,regulations 7or a successor   
regulation71 subject to such adaptations
 as the ,commission shall deem necessary
 to apply such term to the disclosure of
 both location data and health data4    
7d7 ,effective date ,the prohibition    
under subsection 7a7 shall take effect  
on the earlier of-- 7#a7 the date the   
,commission issues the final rule under 
subsection 7e72 or  7#b7 #ahj days after
 the date of enactment of this ,act4    
7e7 ,rulemaking  7#a7 ,final rule       
,pursuant to section #eec of title #e1  
,united ,states ,code1 the ,commission  
shall promulgate regulations to carry   
out the provisions of this ,act4 ,the   
,commission shall issue a final rule by 
not later than #ahj days after the date 
of enactment of this ,act4  7#b7        
,additional guidance ,pursuant to       
section #eec of title #e1 ,united       
,states ,code1 the ,commission may      
promulgate further regulations to carry 
out the provisions of this ,act1        
including further guidance regarding the

 types of data described in subsection  
7a74  #c4 ,enforcement  7a7 ,enforcement
 by the ,federal ,trade ,commission     
7#a7 ,unfair or deceptive acts or       
practices ,a violation of section #b    
shall be treated as a violation of a    
rule defining an unfair or a deceptive  
act or practice under section           
#ah7;a77#a77;,b7 of the ,federal ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b774  7#b7 ,powers of    
,commission  7,a7 ,in general ,except as
 provided in subparagraphs 7,d7 and     
7,e71 the ,commission shall enforce     
section #b in the same manner1 by the   
same means1 and with the same           
jurisdiction1 powers1 and duties as     
though all applicable terms and         
provisions of the ,federal ,trade       
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq47 were incorporated into and made a 
part of this ,act4  7,b7 ,privileges and
 immunities ,any person who violates    
section #b shall be subject to the      
penalties and entitled to the privileges

 and immunities provided in the ,federal
 ,trade ,commission ,act 7#ae ,u4,s4,c4 
#da et seq474  7,c7 ,authority preserved
 ,nothing in this ,act shall be         
construed to limit the authority of the 
,federal ,trade ,commission under any   
other provision of law4  7,d7 ,nonprofit
 organizations ,notwithstanding section 
#d of the ,federal ,trade ,commission   
,act 7#ae ,u4,s4,c4 #dd7 or any         
jurisdictional limitation of the        
,commission1 the ,commission shall also 
enforce this ,act1 in the same manner   
provided in subparagraphs 7,a7 and 7,b71
 with respect to organizations not      
organized to carry on business for their
 own profit or that of their members4   
7,e7 ,independent litigation authority  
,in any case in which the ,commission   
has reason to believe that a person is  
violating or has violated section #b1   
the ,commission may bring a civil action
 in an appropriate district court of the
 ,united ,states to-- 7i7 enjoin any    
further such violation by such person2  

7ii7 enforce compliance with this ,act1 
including through deletion of the       
relevant information2  7iii7 obtain a   
permanent1 temporary1 or preliminary    
injunction2  7iv7 obtain civil          
penalties2  7v7 obtain damages 7whether 
actual1 punitive1 or otherwise71        
restitution1 disgorgement of unjust     
enrichment1 or other compensation on    
behalf of aggrieved persons2 or  7vi7   
obtain any other appropriate equitable  
relief4  7b7 ,enforcement by ,states    
7#a7 ,in general ,in any case in which  
the attorney general of a ,state has    
reason to believe that an interest of   
the residents of the ,state has been or 
is threatened or adversely affected by  
the engagement of any person subject to 
section #b in a practice that violates  
such section1 the attorney general of   
the ,state may1 as parens patriae1 bring
 a civil action on behalf of the        
residents of the ,state in an           
appropriate district court of the       
,united ,states to-- 7,a7 enjoin any    

further such violation by such person2  
7,b7 enforce compliance with this ,act1 
including through deletion of the       
relevant information2  7,c7 obtain a    
permanent1 temporary1 or preliminary    
injunction2  7,d7 obtain civil          
penalties2  7,e7 obtain damages 7whether
 actual1 punitive1 or otherwise71       
restitution1 disgorgement of unjust     
enrichment1 or other compensation on    
behalf of aggrieved persons2 or  7,f7   
obtain any other appropriate equitable  
relief4  7#b7 ,notice ,before filing an 
action under paragraph 7#a71 the        
attorney general1 official1 or agency of
 the ,state involved shall provide to   
the ,commission a written notice of such
 action and a copy of the complaint for 
such action4 ,if the attorney general1  
official1 or agency determines that it  
is not feasible to provide the notice   
described in this paragraph before the  
filing of the action1 the attorney      
general1 official1 or agency shall      
provide written notice of the action and

 a copy of the complaint to the         
,commission immediately upon the filing 
of the action4  7#c7 ,limitation on     
,state action while ,federal action is  
pending ,if the ,commission has         
instituted a civil action for a         
violation of section #b1 no ,state      
attorney general1 or official or agency 
of a ,state1 may bring an action under  
this paragraph during the pendency of   
that action against any defendant named 
in the complaint of the ,commission for 
any violation of section #b alleged in  
the complaint4  7#d7 ,relationship with 
,state-law claims ,if the attorney      
general of a ,state has authority to    
bring an action under ,state law        
directed at acts or practices that also 
violate section #b1 the attorney general
 may assert the ,state-law claim and a  
claim under section #b in the same civil
 action4  7#e7 ,investigatory powers    
,nothing in this subsection may be      
construed to prevent the attorney       
general of a ,state from exercising the 

powers conferred on the attorney general
 by the laws of the ,state to conduct   
investigations1 to administer oaths or  
affirmations1 or to compel the          
attendance of witnesses or the          
production of documentary or other      
evidence4  7c7 ,private enforcement ,any
 person whose interest has been or is   
threatened or adversely affected by the 
engagement of any person subject to     
section #b in a practice that violates  
such section may bring a civil action in
 an appropriate district court of the   
,united ,states to-- 7#a7 enjoin any    
further such violation by such person2  
7#b7 enforce compliance with this ,act1 
including through deletion of the       
relevant information2  7#c7 obtain a    
permanent1 temporary1 or preliminary    
injunction2  7#d7 obtain damages        
7whether actual1 punitive1 or           
otherwise71 restitution1 or other       
compensation2  7#e7 obtain reasonable   
attorney's fees1 including litigation   
expenses1 and costs2 or  7#f7 obtain any

 other appropriate equitable relief4    
7d7 ,civil penalties ,in addition to any
 other penalties as may be prescribed by
 law1 a violation of this ,act shall    
carry a civil penalty not to exceed #ae 
percent of the revenues earned by the   
person's ultimate parent entity during  
the preceding #ab-month period4  7e7    
,exclusive jurisdiction  7#a7 ,district 
courts ,for any action brought under    
this ,act1 the following district courts
 shall have exclusive jurisdiction3 7,a7
 ,for actions brought by the            
,commission1 the ,united ,states        
,district ,court for the ,district of   
,columbia4  7,b7 ,for actions brought by
 a ,state attorney general1 the district
 court of the ,united ,states for the   
judicial district in which the capital  
of the ,state is located4  7,c7 ,for    
private actions brought by persons-- 7i7
 the ,united ,states ,district ,court   
for the ,district of ,columbia2 or  7ii7
 the district court of the ,united      
,states for the judicial district in    

which the violation took place or in    
which any defendant resides or does     
business4  7#b7 ,court of appeals ,the  
,united ,states ,court of ,appeals for  
the ,district of ,columbia ,circuit     
shall have exclusive jurisdiction of    
appeals from all decisions under        
paragraph 7#a74  7f7 ,statute of        
limitations ,a proceeding for a         
violation of this ,act may be commenced 
not later than #f years after the date  
upon which the plaintiff obtains actual 
knowledge of the facts giving rise to   
such violation4  7g7 ,preemption ,the   
provisions of this ,act preempt only the
 provisions of ,state or local law that 
require disclosure prohibited by this   
,act4  #d4 ,definitions ,in this ,act3  
7#a7 ,artificial intelligence ,the term 
artificial intelligence has the meaning 
given such term in section #ejjb of the 
,national ,artificial ,intelligence     
,initiative ,act of #bjbj 7#ae ,u4,s4,c4
 #idja74  7#b7 ,artificial intelligence 
system ,the term artificial intelligence

 system means any data system1 software1
 hardware1 application1 tool1 or utility
 that operates1 in whole or in part1    
using artificial intelligence4  7#c7    
,commission ,the term ,commission means 
the ,federal ,trade ,commission4  7#d7  
,data  7,a7 ,in general ,not later than 
#ahj days after the date of enactment of
 this ,act1 the ,commission shall adopt 
rules in accordance with section #eec of
 title #e1 ,united ,states ,code1 to    
define the term data for the purpose of 
implementing and enforcing this ,act4   
7,b7 ,requirement ,the term data shall  
include information that is linked1 or  
reasonably linkable1 to-- 7i7 specific  
individuals2 or  7ii7 specific groups of
 individuals who share the same place of
 residence or internet protocol address4
  7#e7 ,data broker  7,a7 ,in general   
,the term data broker means an entity   
that1 for valuable consideration1 sells1
 licenses1 rents1 trades1 transfers1    
releases1 discloses1 provides access to1
 or otherwise makes available data of   

individuals that the entity did not     
collect directly from such individuals  
to another entity4  7,b7 ,exclusion ,the
 term data broker does not include an   
entity to the extent such entity-- 7i7  
is transmitting data of an individual1  
including communications of such an     
individual1 at the request or direction 
of such individual2  7ii7 is providing1 
maintaining1 or offering a product or   
service with respect to which personally
 identifiable sensitive data1 or access 
to such data1 is not the product or     
service2  7iii7 is reporting or         
publishing news or information that     
concerns local1 national1 or            
international events or other matters of
 public interest2 or  7iv7 is reporting1
 publishing1 or otherwise making        
available news or information that is   
available to the general public-- 7,i7  
including information from-- 7aa7 a     
book1 magazine1 telephone book1 or      
online directory2  7bb7 a motion        
picture2  7cc7 a television1 internet1  

or radio program2  7dd7 the news media2 
or  7ee7 an internet site that is       
available to the general public on an   
unrestricted basis2 and  7,,ii7 not     
including an obscene visual depiction   
7as such term is used in section #adfj  
of title #ah1 ,united ,states ,code74   
7#f7 ,health data ,the term health data 
means data that reveal or describe--    
7,a7 the search for1 attempt to obtain1 
inquiry regarding1 or receipt of any    
health information1 services1 or        
supplies1 including through prompts or  
other information entered into an       
artificial intelligence system2  7,b7   
any past1 present1 or future disability1
 physical health condition1 mental      
health condition1 or health condition of
 an individual1 including1 but not      
limited to1 pregnancy and miscarriage2  
or  7,c7 any treatment or diagnosis of a
 disability or condition described in   
subparagraph 7,b74  7#g7 ,location data 
,the term location data means data      
capable of determining the past or      

present physical location of an         
individual or an individual's device4   
7#h7 ,state ,the term ,state means each 
of the several ,states1 the ,district of
 ,columbia1 each commonwealth1          
territory1 or possession of the ,united 
,states1 and each federally recognized  
,indian ,tribe4  7#i7 ,ultimate parent  
entity ,the term ultimate parent entity 
has the meaning given the term in       
section #hja4a of title #af1 ,code of   
,federal ,regulations 7or any successor 
regulation74  #e4 ,funding ,in addition 
to amounts otherwise available1 there is
 appropriated to the ,commission for    
fiscal year #bjbg1 out of any money in  
the ,treasury not otherwise             
appropriated1 #a1jjj1jjj1jjj1 to remain 
available until ,september #cj1 #bjce1  
for carrying out the work of the        
,commission4