To amend the Communications Act of 1934 to require vendors of multichannel services to protect the privacy of their customers, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Video Programming Consumer Privacy 
Protection Act of 2003''.

SEC. 2. FINDINGS.

    The Congress finds the following:
            (1) The personal privacy of Americans in the digital age is 
        of increasing concern to consumers and public policy must 
        strive to keep up with changes in technology.
            (2) The cable television industry has long provided video 
        programming to millions of consumers over cable systems capable 
        of collecting personal information about a subscriber's viewing 
        habits.
            (3) Congress recognized the growing threat to personal 
        privacy posed by the emerging cable system-based technology and 
        in 1984 enacted privacy protections contained in section 631 of 
        the Communications Act of 1934 (47 U.S.C. 551), to safeguard 
        the personal privacy of American consumers when they utilize 
        any service over a cable system.
            (4) Under these rules, cable television operators utilizing 
        their cable facilities to offer television programming, pay-
        per-view services, or telecommunications services, such as 
        broadband access to the Internet, must protect the personal 
        privacy of subscribers and are prohibited from disclosing 
        personal data without the prior written or electronic consent 
        of subscribers.
            (5) In addition, the Video Privacy Protection Act (18 
        U.S.C. 2710) prohibits a video rental or sales outlet from 
        disclosing personal information regarding what video tapes a 
        consumer rents or buys without the informed, written consent of 
        the consumer.
            (6) Since these personal privacy protections were enacted 
        by Congress, other technology has arrived that provides 
        services to consumers that are similar to those provided by 
        cable operators and video rental outlets.
            (7) For example, direct broadcast satellite providers 
        (``DBS providers''), such as DirecTV and Echostar, now boast 20 
        million subscribers nationwide and these satellite-based 
        services compete with cable operators on the array of services 
        that cable operators typically offer.
            (8) In addition, over 1 million consumers now subscribe to 
        fast-growing digital video recording services, such as those 
        provided by companies such as Tivo and Replay TV, which, like 
        cable operators and DBS providers, possess the ability to 
        gather information from consumers about a consumer's use of the 
        system, including an individual consumer's television viewing 
        habits.
            (9) While DBS providers and providers of digital video 
        recording services offer consumers services similar to those 
        offered by cable operators over cable systems, competitors 
        utilizing these technologies do not currently have to comply 
        with the privacy protections in section 631 because such 
        provisions apply only to cable operators.
            (10) Consistent with the policy endorsed by Congress in 
        enacting the Telecommunications Act of 1996 of regulating 
        entities based upon the service which is provided rather than 
        the technology used to deliver that service, the public 
        interest compels that privacy protections for consumers should 
        be consistently applied irrespective of who the provider is, or 
        what technology they employ to deliver services to consumers.
            (11) While DBS providers and providers of digital video 
        recording services have not announced plans to or record the 
        personal viewing habits or gather other personal data from a 
        consumer's use of their services, the public interest would be 
        served by requiring comparable privacy protections for American 
        consumers.

SEC. 3. PRIVACY REQUIREMENTS.

    Title VII of the Communications Act of 1934 is amended by adding at 
the end the following new section:

``SEC. 715. PRIVACY REQUIREMENTS FOR VENDORS OF MULTICHANNEL SERVICES.

    ``(a) Definitions.--For purposes of this section:
            ``(1) Multichannel services vendor.--The term `multichannel 
        services vendor' means--
                    ``(A) a multichannel video programming distributor, 
                as such term is defined in section 602; and
                    ``(B) a person that has access to information 
                concerning the video programming that a customer views, 
                displays, or records through the provision of video 
                programming, recording services, navigation devices, 
                software, or programming guides, interactive 
                communications equipment, or other equipment used by 
                consumers to access multichannel video programming or 
                other services offered over multichannel service 
                systems or the Internet;
        except that such term does not include a cable operator to the 
        extent that the cable operator is subject to section 631.
            ``(2) Multichannel services.--The term `multichannel 
        services' means a video programming service or other service 
        provided to consumers, including services that enable consumers 
        to navigate, record, or replay video services, except that such 
        term does not include cable service to the extent that the 
        cable operator providing such service is subject to section 
        631.
            ``(3) Personally identifiable information.--The term 
        `personally identifiable information' does not include any 
        record of aggregate data which does not identify particular 
        persons.
            ``(4) Other service.--The term `other service' includes any 
        wire or radio communications service provided using any of the 
        facilities of a multichannel services vendor that are used in 
        the provision of multichannel services.
    ``(b) Notice Obligation.--At the time of entering into an agreement 
to provide any multichannel service or other service to a subscriber 
and at least once a year thereafter, a multichannel service vendor 
shall provide notice in the form of a separate, written statement to 
such subscriber which clearly and conspicuously informs the subscriber 
of--
            ``(A) the nature of personally identifiable information 
        collected or to be collected with respect to the subscriber and 
the nature of the use of such information;
            ``(B) the nature, frequency, and purpose of any disclosure 
        which may be made of such information, including an 
        identification of the types of persons to whom the disclosure 
        may be made;
            ``(C) the period during which such information will be 
        maintained by the multichannel service vendor;
            ``(D) the times and place at which the subscriber may have 
        access to such information in accordance with subsection (e); 
        and
            ``(E) the limitations provided by this section with respect 
        to the collection and disclosure of information by a 
        multichannel service vendor and the right of the subscriber 
        under subsections (g) and (i) to enforce such limitations.
In the case of subscribers who have entered into such an agreement 
before the effective date of this section, such notice shall be 
provided within 180 days of such date and at least once a year 
thereafter.
    ``(c) Restrictions on Use.--
            ``(1) Use prohibited without consent.--Except as provided 
        in paragraph (2), a multichannel service vendor shall not use 
        its provision of multichannel services to collect personally 
        identifiable information concerning any subscriber without the 
        prior written or electronic consent of the subscriber 
        concerned.
            ``(2) Exceptions.--A multichannel service vendor may use 
        its provision of multichannel services to collect such 
        information in order to--
                    ``(A) obtain information necessary to render a 
                multichannel service or other service provided by the 
                multichannel service vendor to the subscriber; or
                    ``(B) detect unauthorized reception of multichannel 
                service.
    ``(d) Restrictions on Disclosure.--
            ``(1) Disclosure prohibited without consent.--Except as 
        provided in paragraph (2), a multichannel service vendor shall 
        not disclose personally identifiable information concerning any 
        subscriber without the prior written or electronic consent of 
        the subscriber concerned and shall take such actions as are 
        necessary to prevent unauthorized access to such information by 
        a person other than the subscriber or multichannel service 
        vendor.
            ``(2) Exceptions.--A multichannel service vendor may 
        disclose such information if the disclosure is--
                    ``(A) necessary to render, or conduct a legitimate 
                business activity related to, a multichannel service or 
                other service provided by the multichannel service 
                vendor to the subscriber;
                    ``(B) subject to subsection (i), made pursuant to a 
                court order authorizing such disclosure, if the 
                subscriber is notified of such order by the person to 
                whom the order is directed;
                    ``(C) a disclosure of the names and addresses of 
                subscribers to any multichannel service or other 
                service, if--
                            ``(i) the multichannel service vendor has 
                        provided the subscriber the opportunity to 
                        prohibit or limit such disclosure; and
                            ``(ii) the disclosure does not reveal, 
                        directly or indirectly, the--
                                    ``(I) extent of any viewing or 
                                other use by the subscriber of a 
                                multichannel services or other service 
                                provided by the multichannel service 
                                vendor; or
                                    ``(II) the nature of any 
                                transaction made by the subscriber of 
                                the multichannel service vendor; or
                    ``(D) to a government entity as authorized under 
                chapter 119, 121, or 206 of title 18, United States 
                Code, except that such disclosure shall not include 
                records revealing multichannel service subscriber 
                selection of video programming from a multichannel 
                service vendor.
    ``(e) Access by Subscriber to Information.--A multichannel service 
subscriber shall be provided access to all personally identifiable 
information regarding that subscriber which is collected and maintained 
by a multichannel service vendor. Such information shall be made 
available to the subscriber at reasonable times and at a convenient 
place designated by such multichannel service vendor. A multichannel 
service subscriber shall be provided reasonable opportunity to correct 
any error in such information.
    ``(f) Destruction of Information.--A multichannel service vendor 
shall destroy personally identifiable information if the information is 
no longer necessary for the purpose for which it was collected and 
there are no pending requests or orders for access to such information 
under subsection (e) or pursuant to a court order.
    ``(g) Remedies.--
            ``(1) Civil actions.--Any person aggrieved by any act of a 
        multichannel service vendor in violation of this section may 
        bring a civil action in a United States district court.
            ``(2) Actual and punitive damages; fees and costs.--The 
        court may award--
                    ``(A) actual damages but not less than liquidated 
                damages computed at the rate of $100 a day for each day 
                of violation or $1,000, whichever is higher;
                    ``(B) punitive damages; and
                    ``(C) reasonable attorneys' fees and other 
                litigation costs reasonably incurred.
            ``(3) Remedies not exclusive.--The remedy provided by this 
        section shall be in addition to any other lawful remedy 
        available to a multichannel service subscriber.
    ``(h) Preservation of State Authority.--Nothing in this title shall 
be construed to prohibit any State from enacting or enforcing laws 
consistent with this section for the protection of subscriber privacy.
    ``(i) Basis for Court Orders.--Except as provided in subsection 
(d)(2)(D), a governmental entity may obtain personally identifiable 
information concerning a multichannel service subscriber pursuant to a 
court order only if, in the court proceeding relevant to such court 
order--
            ``(1) such entity offers clear and convincing evidence that 
        the subject of the information is reasonably suspected of 
        engaging in criminal activity and that the information sought 
        would be material evidence in the case; and
            ``(2) the subject of the information is afforded the 
        opportunity to appear and contest such entity's claim.''.

Summary: Video Programming Consumer Privacy Protection Act of 2003 - Amends the Communications Act of 1934 to require a multichannel service vendor (vendor), at the time of entering into a service agreement with a subscriber and at least once a year thereafter, to provide written notice to such subscriber concerning: (1) the nature of personally identifiable information (information) collected with respect to the subscriber, (2) the nature of any disclosure of such information. (3) the period during which such information will be maintained by the vendor. (4) the time and place at which the subscriber may have access to such information. And (5) limitations with regard to the vendor collection and disclosure of such information and the right of the subscriber to enforce such limitations. Prohibits any vendor from collecting or disclosing such information without the prior written or electronic consent of the subscriber, with certain business-related exceptions. Requires a vendor to provide subscriber access to all collected information, and to destroy information no longer necessary. Provides civil remedies for violations, including actual and punitive damages.