To prohibit the transfer of personal information to any person outside the United States, without notice and consent, and for other purposes.

Summary: Personal Data Offshoring Protection Act of 2004 - Requires business enterprises to give U.S. citizens notice before transmitting personally identifiable information about such citizens to foreign affiliates or subcontractors located in countries with adequate privacy protections. Prohibits such transmittal where adequate privacy protections are lacking, unless: (1) the business enterprise discloses the lack of protections and obtains the citizen's prior consent for transmittal; and (2) such consent is renewed by the citizen within one year before the transmittal.

Prohibits business entities from denying goods and services or modifying business terms for any person based on that person's exercise of consent rights provided by this Act or other law.

Requires violations of this Act to be treated as unfair or deceptive acts or practices under the Federal Trade Commission Act.

Creates a private right of action in State court for violations of this Act. Authorizes States, on behalf of their residents, to bring civil actions in Federal court for such violations. Requires prior notice to the Federal Trade Commission (FTC) of State actions and authorizes the FTC's intervention and appeal.

Directs the FTC to certify those countries that have legal systems providing adequate privacy protections. Creates a presumption of inadequacy for foreign laws that are less protective of privacy than Federal law or the law of any State, or where the FTC determines that enforcement is lacking. Requires certification of countries whose laws meet the requirements of the European Union Data Protection Directive, unless such laws are not adequately enforced.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Personal Data Offshoring Protection 
Act of 2004''.

SEC. 2. DEFINITIONS.

     As used in this Act, the following definitions apply:
            (1) Business enterprise.--The term ``business enterprise'' 
        means any organization, association, or venture established to 
        make a profit, or any private, nonprofit organization that 
        collects or retains personally identifiable information.
            (2) Country with adequate privacy protection.--The term 
        ``country with adequate privacy protection'' means a country 
        that has been certified by the Federal Trade Commission as 
        having a legal system that provides adequate privacy protection 
        for personally identifiable information.
            (3) Personally identifiable information.--The term 
        ``personally identifiable information'' includes information 
        such as--
                    (A) name;
                    (B) postal address;
                    (C) financial information;
                    (D) medical records;
                    (E) date of birth;
                    (F) phone number;
                    (G) e-mail address;
                    (H) social security number;
                    (I) mother's maiden name;
                    (J) password;
                    (K) state identification information;
                    (L) driver's license number;
                    (M) personal tax information; and
                    (N) any consumer transactional or experiential 
                information relating to the person.
            (4) Transmit.--The term ``transmit'' or ``transmission'' 
        means the use of any instrumentality of interstate commerce, 
        including the mails or any electronic means, to transfer 
        information or to provide access to such information via the 
        Internet or any comparable telecommunications system.

SEC. 3. PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION FROM 
              UNAUTHORIZED TRANSMISSION.

    (a) In General.--A business enterprise may transmit personally 
identifiable information regarding a citizen of the United States to 
any foreign affiliate or subcontractor located in a country that is a 
country with adequate privacy protection, provided that the citizen has 
been provided prior notice that such information may be transmitted to 
such a foreign affiliate or subcontractor and has not objected to such 
transmission.
    (b) ``Opt-In'' Consent Required for Countries Without Adequate 
Privacy Protection.--A business enterprise may not transmit personally 
identifiable information regarding a citizen of the United States to 
any foreign affiliate or subcontractor located in a country that is a 
country without adequate privacy protection unless--
            (1) the business enterprise discloses to the citizen that 
        the country to which the information will be transmitted does 
        not have adequate privacy protection;
            (2) the business enterprise obtains consent from the 
        citizen, before a consumer relationship is established or 
        before the effective date of this Act, to transmit such 
        information to such foreign affiliate or subcontractor; and
            (3) the consent referred to in paragraph (2) is renewed by 
        the citizen within 1 year before such information is 
        transmitted.
    (c) Prohibition on Refusal to Provide Services.--A business 
enterprise shall not deny the provision of any good or service to, nor 
change the terms of or refuse to enter into a business relationship 
with any person based upon that person's exercise of the consent rights 
provided for in this Act or in any other applicable law.

SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMISSION.

    (a) Unfair and Deceptive Act or Practice.--A violation of this Act 
shall be treated as a violation of a rule defining an unfair or 
deceptive act or practice prescribed under section 18(a)(1)(B) of the 
Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
    (b) Enforcement Authority.--The Federal Trade Commission shall 
enforce this Act in the same manner, by the same means, and with the 
same jurisdiction, powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.) were incorporated into and made a part of this Act.

SEC. 5. CIVIL REMEDIES.

    (a) Private Right of Action.--A person or entity may, if otherwise 
permitted by the laws or rules of court of a State, bring in an 
appropriate court of that State--
            (1) an action based on a violation of this Act or the 
        regulations prescribed pursuant to this Act to enjoin such 
        violation;
            (2) an action to recover for actual monetary loss from such 
        a violation, or to receive $10,000 in damages for each such 
        violation, whichever is greater, or
            (3) both such actions.
If the court finds that the defendant willfully or knowingly violated 
this subsection or the regulations prescribed under this subsection, 
the court may, in its discretion, increase the amount of the award to 
an amount equal to not more than 3 times the amount available under 
paragraph (2).
    (b) Actions by States.--
            (1) Authority of states.--Whenever the attorney general of 
        a State, or an official or agency designated by a State, has 
        reason to believe that any person has engaged or is engaging in 
        a violation of this Act or the regulations prescribed pursuant 
        to this Act, the State may bring a civil action on behalf of 
        its residents to enjoin such violation, an action to recover 
        for actual monetary loss or receive $10,000 in damages for each 
        violation, or both such actions. If the court finds the 
        defendant willfully or knowingly violated this Act or 
        regulations prescribed pursuant to this Act, the court may, in 
        its discretion, increase the amount of the award to an amount 
        equal to not more than 3 times the amount available under the 
        preceding sentence.
            (2) Exclusive jurisdiction of federal courts.--The district 
        courts of the United States, the United States courts of any 
        territory, and the District Court of the United States for the 
        District of Columbia shall have exclusive jurisdiction over all 
        civil actions brought under this subsection. Upon proper 
        application, such courts shall also have jurisdiction to issue 
        writs of mandamus, or orders affording like relief, commanding 
        the defendant to comply with the provisions of this Act or 
        regulations prescribed pursuant to this Act, including the 
        requirement that the defendant take such action as is necessary 
        to remove the danger of such violation. Upon a proper showing, 
        a permanent or temporary injunction or restraining order shall 
        be granted without bond.
            (3) Notice to an intervention of federal trade 
        commission.--The State bringing a civil action under this 
        section shall serve prior written notice of any such civil 
        action upon the Federal Trade Commission and provide the 
        Commission with a copy of its complaint, except in any case 
        where such prior notice is not feasible, in which case the 
        State shall serve such notice immediately upon instituting such 
        action. The Commission shall have the right--
                    (A) to intervene in the action;
                    (B) upon so intervening, to be heard on all matters 
                arising therein; and
                    (C) to file petitions for appeal.
            (4) Venue; service of process.--Any civil action brought 
        under this subsection in a district court of the United States 
        may be brought in the district wherein the defendant is found 
        or is an inhabitant or transacts business or wherein the 
        violation occurred or is occurring, and process in such cases 
        may be served in any district in which the defendant is an 
        inhabitant or where the defendant may be found.
            (5) Investigatory powers.--For purposes of bringing any 
        civil action under this subsection, nothing in this Act shall 
        prevent the attorney general of a State, or an official or 
        agency designated by a State, from exercising the powers 
        conferred on the attorney general or such official by the laws 
        of such State to conduct investigations or to administer oaths 
        or affirmations or to compel the attendance of witnesses or the 
        production of documentary and other evidence.
            (6) Effect on state court proceedings.--Nothing contained 
        in this section shall be construed to prohibit an authorized 
        State official from proceeding in State court on the basis of 
        an alleged violation of any general civil or criminal statute 
        of such State.
            (7) Limitation.--Whenever the Federal Trade Commission has 
        instituted a civil action for violation of this Act or the 
        regulations prescribed pursuant to this Act, no State may, 
        during the pendency of such action instituted by the 
        Commission, subsequently institute a civil action against any 
        defendant named in the Commission's complaint for any violation 
        as alleged in the Commission's complaint.

SEC. 6. CERTIFICATION OF COUNTRIES WITH ADEQUATE PRIVACY PROTECTION.

    (a) In General.--Not later than 6 months after the date of 
enactment of this Act, the Federal Trade Commission, after providing 
notice and opportunity for public comment, shall--
            (1) certify those countries that have legal systems that 
        provide adequate privacy protection for personally identifiable 
        information; and
            (2) make the list of countries certified under paragraph 
        (1) available to the general public.
    (b) Certification Criteria.--
            (1) In general.--In determining whether a country should be 
        certified under this section, the Federal Trade Commission 
        shall consider the adequacy of the country's infrastructure for 
        detecting, evaluating, and responding to privacy violations.
            (2) Presumption.--The Commission shall presume that a 
        country's privacy protections are inadequate if they are any 
        less protective of personally identifiable information than 
        those afforded under Federal law or under the laws of any 
        State, or if the Commission determines that such country's laws 
        are not adequately enforced.
    (c) European Union Date Protection Directive.--A country that has 
comprehensive privacy laws that meet the requirements of the European 
Union Data Protection Directive shall be certified under this section 
unless the Federal Trade Commission determines that such laws are not 
commonly enforced within such country.

SEC. 7. EFFECTIVE DATE.

    Section 6 of this Act shall take effect on the date of enactment of 
this Act. Sections 2 through 5 of this Act shall take effect 60 days 
after the the completion of the certification required by section 6.