II 

116TH CONGRESS 

1ST SESSION S. 583 

To provide for digital accountability and transparency. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 27, 2019 

Ms. CORTEZ MASTO introduced the following bill; which was read twice and 

referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To provide for digital accountability and transparency. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Digital Accountability 

5 and Transparency to Advance Privacy Act’’ or the ‘‘DATA 

6 Privacy Act’’. 

7 SEC. 2. DEFINITIONS. 

8 (a) IN GENERAL.—In this Act: 

9 (1) COLLECT.—The term ‘‘collect’’ means tak10 ing any operation or set of operations to obtain cov11 ered data, including by automated means, including 


pbinns on DSK79D2C42PROD with BILLS
2 

•S 583 IS

1 purchasing, leasing, assembling, recording, gath2 ering, acquiring, or procuring. 

3 (2) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (3) COVERED DATA.—The term ‘‘covered 

6 data’’— 

7 (A) means any information that is— 

8 (i) collected, processed, stored, or dis9 closed by a covered entity; 

10 (ii) collected over the internet or other 

11 digital network; and 

12 (iii)(I) linked to an individual or de13 vice associated with an individual; or 

14 (II) practicably linkable to an indi15 vidual or device associated with an indi16 vidual, including by combination with sepa17 rate information, by the covered entity or 

18 any potential recipient of the data; and 

19 (B) does not include data that is— 

20 (i) collected, processed, stored, or dis21 closed solely for the purpose of employ22 ment of an individual; and 

23 (ii) lawfully made available to the 

24 public from Federal, State, or local govern25 ment records. 


pbinns on DSK79D2C42PROD with BILLS
3 

•S 583 IS

1 (4) COVERED ENTITY.—The term ‘‘covered en2 tity’’— 

3 (A) means any entity that collects, proc4 esses, stores, or discloses covered data; and 

5 (B) does not include any entity that col6 lects, processes, stores, or discloses covered data 

7 relating to fewer than 3,000 individuals and de8 vices during any 12-month period. 

9 (5) DISCLOSE.—The term ‘‘disclose’’ means 

10 taking any action with respect to covered data, in11 cluding by automated means, to sell, share, provide, 

12 or otherwise transfer covered data to another entity, 

13 person, or the general public. 

14 (6) PRIVACY RISK.—The term ‘‘privacy risk’’ 

15 means potential harm to an individual resulting 

16 from the collection, processing, storage, or disclosure 

17 of covered data, including— 

18 (A) direct or indirect financial loss; 

19 (B) stigmatization or reputational harm; 

20 (C) anxiety, embarrassment, fear, and 

21 other severe emotional trauma; 

22 (D) loss of economic opportunity; or 

23 (E) physical harm. 

24 (7) PROCESS.—The term ‘‘process’’ means any 

25 operation or set of operations that is performed on 


pbinns on DSK79D2C42PROD with BILLS
4 

•S 583 IS

1 covered data or on sets of covered data, including by 

2 automated means, including organizing, combining, 

3 adapting, altering, using, or transforming. 

4 (8) PROTECTED CHARACTERISTIC.—The term 

5 ‘‘protected characteristic’’ means an individual’s 

6 race, sex, gender, sexual orientation, nationality, re7 ligious belief, or political affiliation. 

8 (9) PSEUDONYMOUS DATA.—The term ‘‘pseu9 donymous data’’ means covered data that may only 

10 be linked to the identity of an individual or the iden11 tity of a device associated with an individual if com12 bined with separate information. 

13 (10) REASONABLE INTEREST.—The term ‘‘rea14 sonable interest’’ means— 

15 (A) a compelling business, operational, ad16 ministrative, legal, or educational justification 

17 for the collection, processing, storage, or disclo18 sure of covered data exists; 

19 (B) the use of covered data is within the 

20 context of the relationship between the covered 

21 entity and the individual linked to the covered 

22 data; and 

23 (C) the interest does not subject the indi24 vidual to an unreasonable privacy risk. 


pbinns on DSK79D2C42PROD with BILLS
5 

•S 583 IS

1 (11) SENSITIVE DATA.—The term ‘‘sensitive 

2 data’’ means any covered data relating to— 

3 (A) the health, biologic, physiologic, bio4 metric, sexual life, or genetic information of an 

5 individual; or 

6 (B) the precise geolocation information of 

7 a device associated with an individual. 

8 (12) STORE.—The term ‘‘store’’ means any op9 eration or set of operations to continue possession of 

10 covered data, including by automated means. 

11 (13) THIRD PARTY SERVICE PROVIDER.—The 

12 term ‘‘third party service provider’’ means any cov13 ered entity that collects, processes, stores, or dis14 closes covered data at the direction of, and for the 

15 sole benefit of, another covered entity under a con16 tract. 

17 (b) MODIFIED DEFINITION BY RULEMAKING.—If the 

18 Commission determines that a term defined in paragraph 

19 (9) or (11) is not sufficient to protect an individual’s data 

20 privacy, the Commission may promulgated regulations 

21 under section 553 of title 5, United States Code, to modify 

22 the definition as the Commission considers appropriate. 

23 SEC. 3. REQUIRED PRIVACY NOTICE. 

24 (a) PRIVACY NOTICE.—Each covered entity shall post 

25 in an accessible location a notice that is concise, in conVerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583

pbinns on DSK79D2C42PROD with BILLS
6 

•S 583 IS

1 text, in easily understandable language, accurate, clear, 

2 timely, updated, uses visualizations where appropriate, 

3 conspicuous, and free of charge regarding the covered en4 tity’s privacy practices. 

5 (b) CONTENTS OF NOTICE.—The notice required by 

6 subsection (a) shall include— 

7 (1) a description of the covered data that the 

8 entity collects, processes, stores, and discloses, in9 cluding the sources that provided the covered data if 

10 the covered entity did not collect the covered data; 

11 (2) the purposes for and means by which the 

12 entity collects, processes, and stores the covered 

13 data; 

14 (3) the persons and entities to whom, and pur15 poses for which, the covered entity discloses the cov16 ered data; and 

17 (4) a conspicuous, clear, and understandable 

18 means for individuals to access the methods nec19 essary to exercise their rights under sections 4 and 

20 5. 

21 SEC. 4. REQUIRED DATA PRACTICES. 

22 (a) REGULATIONS.—Not later than 1 year after the 

23 date of the enactment of this Act, the Commission shall 

24 promulgate regulations under section 553 of title 5, 

25 United States Code, that require covered entities to impleVerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583

pbinns on DSK79D2C42PROD with BILLS
7 

•S 583 IS

1 ment, practice, and maintain certain data procedures and 

2 processes that meet the following requirements: 

3 (1) MINIMUM DATA PROCESSING REQUIRE4 MENTS.—Except as provided in subsection (b), re5 quire covered entities to meet all of the following re6 quirements regarding the means by and purposes for 

7 which covered data is collected, processed, stored, 

8 and disclosed: 

9 (A) REASONABLE.—Except as provided in 

10 paragraph (3), covered data collection, proc11 essing, storage, and disclosure practices must 

12 meet a reasonable interest of the covered entity, 

13 including— 

14 (i) business, educational, and adminis15 trative operations that are relevant and ap16 propriate to the context of the relationship 

17 between the covered entity and the indi18 vidual linked to the covered data; 

19 (ii) relevant and appropriate product 

20 and service development and enhancement; 

21 (iii) preventing and detecting abuse, 

22 fraud, and other criminal activity; 

23 (iv) reasonable communications and 

24 marketing practices that follow best prac25 tices, rules, and ethical standards; 


pbinns on DSK79D2C42PROD with BILLS
8 

•S 583 IS

1 (v) engaging in scientific, medical, or 

2 statistical research that follows commonly 

3 accepted ethical standards; or 

4 (vi) any other purpose for which the 

5 Commission considers to be reasonable. 

6 (B) EQUITABLE.—Covered data collection, 

7 processing, storage, and disclosure practices 

8 may not be for purposes that result in discrimi9 nation against a protected characteristic, in10 cluding— 

11 (i) discriminatory targeted advertising 

12 practices; 

13 (ii) price, service, or employment op14 portunity discrimination; or 

15 (iii) any other practice the Commis16 sion considers likely to result in unfair dis17 crimination against a protected char18 acteristic. 

19 (C) FORTHRIGHT.—Covered data collec20 tion, processing, storage, and disclosure prac21 tices may not be accomplished with means or 

22 for purposes that are deceptive, including— 

23 (i) the use of inconspicuous recording 

24 or tracking devices and methods; 


pbinns on DSK79D2C42PROD with BILLS
9 

•S 583 IS

1 (ii) the disclosure of covered data that 

2 a reasonable individual believes to be the 

3 content of a private communication with 

4 another party or parties; 

5 (iii) notices, interfaces, or other rep6 resentations likely to mislead consumers; 

7 or 

8 (iv) any other practice that the Com9 mission considers likely to mislead individ10 uals regarding the purposes for and means 

11 by which covered data is collected, proc12 essed, stored, or disclosed. 

13 (2) REQUIREMENTS FOR OPT-OUT CONSENT.— 

14 Except as provided in subsection (b), require covered 

15 entities to provide individuals with conspicuous ac16 cess to a method that is in easily understandable 

17 language, concise, accurate, clear, to opt out of any 

18 collection, processing, storage, or disclosure of cov19 ered data linked to the individual. 

20 (3) REQUIREMENTS FOR AFFIRMATIVE CON21 SENT.—Except as provided in subsection (b), require 

22 covered entities to provide individuals with a notice 

23 that is concise, in easily understandable language, 

24 accurate, clear, timely, and conspicuous to express 

25 affirmative, opt-in consent— 


pbinns on DSK79D2C42PROD with BILLS
10 

•S 583 IS

1 (A) before the covered entity collects or 

2 discloses sensitive data linked to the individual; 

3 or 

4 (B) before the covered entity collects, proc5 esses, stores, or discloses data for purposes 

6 which are outside the context of the relationship 

7 of the covered entity with the individual linked 

8 to the data, including— 

9 (i) the use of covered data beyond 

10 what is necessary to provide, improve, or 

11 market a good or service that the indi12 vidual requests; 

13 (ii) the processing or disclosure of 

14 covered data differs in material ways from 

15 the purposes described in the privacy pol16 icy that was in effect when the data was 

17 collected; and 

18 (iii) any other purpose that Commis19 sion considers outside of context. 

20 (4) DATA MINIMIZATION REQUIREMENTS.—Ex21 cept as provided in subsection (b), require covered 

22 entities to— 

23 (A) take reasonable measures to limit the 

24 collection, processing, storage, and disclosure of 

25 covered data to the amount that is necessary to 


pbinns on DSK79D2C42PROD with BILLS
11 

•S 583 IS

1 carry out the purposes for which the data is col2 lected; and 

3 (B) store covered data only as long as is 

4 reasonably necessary to carry out the purposes 

5 for which the data was collected. 

6 (b) EXEMPTIONS.—Subsection (a) shall not apply if 

7 the limitations on the collection, processing, storage, or 

8 disclosure of covered data would— 

9 (1) inhibit detection or prevention of a security 

10 risk or incident; 

11 (2) risk the health, safety, or property of the 

12 covered entity or individual; or 

13 (3) prevent compliance with an applicable law 

14 (including regulations) or legal process. 

15 SEC. 5. INDIVIDUAL CONTROL OVER DATA USE. 

16 (a) REGULATIONS.—Not later than 1 year after the 

17 date of the enactment of this Act, the Commission shall 

18 promulgate regulations under section 553 of title 5, 

19 United States Code, to require covered entities to provide 

20 conspicuous, understandable, clear, and free of charge 

21 method to— 

22 (1) upon the request of an individual, provide 

23 the individual with access to, or an accurate rep24 resentation of, covered data linked to with the indiVerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583

pbinns on DSK79D2C42PROD with BILLS
12 

•S 583 IS

1 vidual or the individual’s device stored by the cov2 ered entity; 

3 (2) upon the request of an individual, provide 

4 the individual with a means to dispute and resolve 

5 the accuracy or completeness of the covered data 

6 linked to the individual or the individual’s device 

7 stored by the entity; 

8 (3) upon the request of an individual, delete 

9 any covered data that the covered entity stores 

10 linked to the individual or the individual’s device; 

11 and 

12 (4) when technically feasible, upon the request 

13 of an individual, allow the individual to transmit or 

14 transfer covered data linked to the individual or the 

15 individual’s device that is maintained by the entity 

16 to the individual in a format that is standardized 

17 and interoperable. 

18 (b) PSEUDONYMOUS DATA.—If the covered data that 

19 an individual has requested processed under subsection (a) 

20 is pseudonymous data, a covered entity may decline the 

21 request if processing the request is not technically feasible. 

22 (c) TIMELINESS OF REQUESTS.—In fulfilling any re23 quests made by the individual under subsection (a) the 

24 covered entity shall act in as timely a manner as is reason25 ably possible. 


pbinns on DSK79D2C42PROD with BILLS
13 

•S 583 IS

1 (d) ACCESS TO SAME SERVICE.—A covered entity 

2 shall not discriminate against an individual because of any 

3 action the individual took under their rights described in 

4 subsection (a), including— 

5 (1) denying goods or services to the individual; 

6 (2) charging, or advertising, different prices or 

7 rates for goods or services; or 

8 (3) providing different quality of goods or serv9 ices. 

10 (e) CONSIDERATION.—The Commission shall allow a 

11 covered entity, by contract, to provide relevant obligations 

12 to the individual under subsection (a) on behalf of a third 

13 party service provider that collects, processes, stores, or 

14 discloses covered data only on behalf of the covered entity. 

15 SEC. 6. INFORMATION SECURITY STANDARDS. 

16 (a) REQUIRED DATA SECURITY PRACTICES.— 

17 (1) REGULATIONS.—Not later than 1 year after 

18 the date of enactment of this Act, the Commission 

19 shall promulgate regulations under section 553 of 

20 title 5, United States Code, to require covered enti21 ties to establish and implement policies and proce22 dures regarding information security practices for 

23 the treatment and protection of covered data taking 

24 into consideration— 


pbinns on DSK79D2C42PROD with BILLS
14 

•S 583 IS

1 (A) the level of identifiability of the cov2 ered data and the associated privacy risk; 

3 (B) the sensitivity of the covered data col4 lected, processed, and stored and the associated 

5 privacy risk; 

6 (C) the currently available and widely ac7 cepted technological, administrative, and phys8 ical means to protect personal data under the 

9 control of the covered entity; 

10 (D) the cost associated with implementing, 

11 maintaining, and regularly reviewing the safe12 guards; and 

13 (E) the impact of these requirements on 

14 small and medium-sized businesses. 

15 (2) LIMITATIONS.—In promulgating the regula16 tions required under this section, the Commission 

17 shall consider a covered entity who is in compliance 

18 with existing information security laws that the 

19 Commission determines are sufficiently rigorous to 

20 be in compliance with this section with respect to 

21 particular types of covered data to the extent those 

22 types of covered data are covered by such law, in23 cluding the following: 

24 (A) Title V of the Gramm-Leach-Bliley Act 

25 (15 U.S.C. 6801 et seq.). 


pbinns on DSK79D2C42PROD with BILLS
15 

•S 583 IS

1 (B) The Health Information Technology 

2 for Economic and Clinical Health Act (42 

3 U.S.C. 17931). 

4 (C) The Health Insurance Portability and 

5 Accountability Act of 1996 Security Rule (45 

6 CFR 160.103 and part 164). 

7 (D) Any other existing law requiring a cov8 ered entity to implement and maintain informa9 tion security practices and procedures that the 

10 Commission determines to be sufficiently rig11 orous. 

12 SEC. 7. PRIVACY PROTECTION OFFICERS. 

13 (a) APPOINTMENT OF A PRIVACY PROTECTION OFFI14 CER.—Each covered entity with annual revenue in excess 

15 of $25,000,000 the prior year shall designate at least 1 

16 appropriately qualified employee as a privacy protection 

17 officer who shall— 

18 (1) educate employees about compliance re19 quirements; 

20 (2) train employees involved in data processing; 

21 (3) conduct regular, comprehensive audits to 

22 ensure compliance and make records of the audits 

23 available to enforcement authorities upon request; 


pbinns on DSK79D2C42PROD with BILLS
16 

•S 583 IS

1 (4) maintain updated, clear, and understand2 able records of all data security practices undertaken 

3 by the covered entity; 

4 (5) serve as the point of contact between the 

5 covered entity and enforcement authorities; and 

6 (6) advocate for policies and practices within 

7 the covered entity that promote individual privacy. 

8 (b) PROTECTIONS.—The privacy protection officer 

9 shall not be dismissed or otherwise penalized by the cov10 ered entity for performing any of the tasks assigned to 

11 the person under this section. 

12 SEC. 8. RESEARCH INTO PRIVACY ENHANCING TECH13 NOLOGY. 

14 Section 4(a) of the Cyber Security Research and De15 velopment Act (15 U.S.C. 7403(a)) is amended— 

16 (1) by striking the subsection heading and in17 serting the following: 

18 ‘‘(a) NETWORK SECURITY AND INFORMATION PRI19 VACY RESEARCH GRANTS.—’’; and 

20 (2) in paragraph (1), by striking subparagraph 

21 (D) and inserting the following: 

22 ‘‘(D) privacy and confidentiality, includ23 ing— 

24 ‘‘(i) cryptography; 

25 ‘‘(ii) anonymization; 


pbinns on DSK79D2C42PROD with BILLS
17 

•S 583 IS

1 ‘‘(iii) pseudonymization; 

2 ‘‘(iv) filtering tools; 

3 ‘‘(v) anti-spying and anti-tracking 

4 tools; and 

5 ‘‘(vi) any other technology that the 

6 Director determines will enhance individual 

7 privacy;’’. 

8 SEC. 9. ENFORCEMENT. 

9 (a) ENFORCEMENT BY THE COMMISSION.— 

10 (1) IN GENERAL.—Except as otherwise pro11 vided, this Act and the regulations prescribed under 

12 this Act shall be enforced by the Commission under 

13 the Federal Trade Commission Act (15 U.S.C. 41 et 

14 seq.). 

15 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC16 TICES.—A violation of this Act or a regulation pre17 scribed under this Act shall be treated as a violation 

18 of a rule defining an unfair or deceptive act or prac19 tice prescribed under section 18(a)(1)(B) of the Fed20 eral Trade Commission Act (15 U.S.C. 

21 57a(a)(1)(B)). 

22 (3) ACTIONS BY THE COMMISSION.—Subject to 

23 paragraph (4), the Commission shall prevent any 

24 person from violating this Act or a regulation pre25 scribed under this Act in the same manner, by the 


pbinns on DSK79D2C42PROD with BILLS
18 

•S 583 IS

1 same means, and with the same jurisdiction, powers, 

2 and duties as though all applicable terms and provi3 sions of the Federal Trade Commission Act (15 

4 U.S.C. 41 et seq.) were incorporated into and made 

5 a part of this Act, and any person who violates this 

6 Act or such regulation shall be subject to the pen7 alties and entitled to the privileges and immunities 

8 provided in the Federal Trade Commission Act (15 

9 U.S.C. 41 et seq.). 

10 (4) COMMON CARRIERS.—Notwithstanding sec11 tion 4, 5(a)(2), or 6 of the Federal Trade Commis12 sion Act (15 U.S.C. 44, 45(a)(2), and 46) or any ju13 risdictional limitation of the Commission, the Com14 mission shall also enforce this Act, in the same man15 ner provided in paragraphs (1), (2), and (3) with re16 spect to common carriers subject to the Communica17 tions Act of 1934 (47 U.S.C. 151 et seq.) and Acts 

18 amendatory thereof and supplementary thereto. 

19 (b) ENFORCEMENT BY STATE ATTORNEYS GEN20 ERAL.— 

21 (1) IN GENERAL.— 

22 (A) CIVIL ACTIONS.—In any case in which 

23 the attorney general of a State has reason to 

24 believe that an interest of the residents of that 

25 State has been or is threatened or adversely afVerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583

pbinns on DSK79D2C42PROD with BILLS
19 

•S 583 IS

1 fected by the engagement of any person in a 

2 practice that violates this Act or a regulation 

3 prescribed under this Act, the State, as parens 

4 patriae, may bring a civil action on behalf of 

5 the residents of the State in a district court of 

6 the United States of appropriate jurisdiction 

7 to— 

8 (i) enjoin that practice; 

9 (ii) enforce compliance with this Act 

10 or such regulation; 

11 (iii) obtain damages, restitution, or 

12 other compensation on behalf of residents 

13 of the State; 

14 (iv) impose a civil penalty in an 

15 amount that is not greater than the prod16 uct of the number of individuals whose in17 formation was affected by a violation and 

18 $40,000; or 

19 (v) obtain such other relief as the 

20 court may consider to be appropriate. 

21 (B) ADJUSTMENT FOR INFLATION.—Be22 ginning on the date that the Consumer Price 

23 Index is first published by the Bureau of Labor 

24 Statistics that is after 1 year after the date of 

25 enactment of this Act, and each year thereafter, 


pbinns on DSK79D2C42PROD with BILLS
20 

•S 583 IS

1 the amounts specified in subparagraph (A)(iv) 

2 shall be increased by the percentage increase in 

3 the Consumer Price Index published on that 

4 date from the Consumer Price Index published 

5 the previous year. 

6 (C) NOTICE.— 

7 (i) IN GENERAL.—Before filing an ac8 tion under subparagraph (A), the attorney 

9 general of the State involved shall provide 

10 to the Commission— 

11 (I) written notice of that action; 

12 and 

13 (II) a copy of the complaint for 

14 that action. 

15 (ii) EXEMPTION.— 

16 (I) IN GENERAL.—Clause (i) 

17 shall not apply with respect to the fil18 ing of an action by an attorney gen19 eral of a State under this paragraph 

20 if the attorney general determines 

21 that it is not feasible to provide the 

22 notice described in that clause before 

23 the filing of the action. 

24 (II) NOTIFICATION.—In an ac25 tion described in subclause (I), the atVerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583

pbinns on DSK79D2C42PROD with BILLS
21 

•S 583 IS

1 torney general of a State shall provide 

2 notice and a copy of the complaint to 

3 the Commission at the same time as 

4 the attorney general files the action. 

5 (c) RIGHTS OF THE COMMISSION.— 

6 (1) INTERVENTION BY THE COMMISSION.—The 

7 Commission may intervene in any civil action 

8 brought by the attorney general of a State under 

9 subsection (b) and upon intervening— 

10 (A) be heard on all matters arising in the 

11 civil action; and 

12 (B) file petitions for appeal of a decision in 

13 the civil action. 

14 (2) POWERS.—Nothing in this subsection may 

15 be construed to prevent the attorney general of a 

16 State from exercising the powers conferred on the 

17 attorney general by the laws of the State to conduct 

18 investigations, to administer oaths or affirmations, 

19 or to compel the attendance of witnesses or the pro20 duction of documentary or other evidence. 

21 (3) ACTION BY THE COMMISSION.—If the Com22 mission institutes a civil action for violation of this 

23 title or a regulation promulgated under this title, no 

24 attorney general of a State may bring a civil action 

25 under subsection (b) against any defendant named 


pbinns on DSK79D2C42PROD with BILLS
22 

•S 583 IS

1 in the complaint of the Commission for violation of 

2 this Act or a regulation promulgated under this Act 

3 that is alleged in the complaint. 

4 (d) VENUE AND SERVICE OF PROCESS.— 

5 (1) VENUE.—Any action brought under sub6 section (b) may be brought in— 

7 (A) the district court of the United States 

8 that meets applicable requirements relating to 

9 venue under section 1391 of title 28, United 

10 States Code; or 

11 (B) another court of competent jurisdic12 tion. 

13 (2) SERVICE OF PROCESS.—In an action 

14 brought under subsection (b), process may be served 

15 in any district in which the defendant— 

16 (A) is an inhabitant; or 

17 (B) may be found. 

18 (e) ACTION OF OTHER STATE OFFICIALS.— 

19 (1) IN GENERAL.—In addition to civil actions 

20 brought by attorneys general under subsection (b), 

21 any other officer of a State who is authorized by the 

22 State to do so may bring a civil action under sub23 section (b), subject to the same requirements and 

24 limitations that apply under this subsection to civil 

25 actions brought by attorneys general. 


pbinns on DSK79D2C42PROD with BILLS
23 

•S 583 IS

1 (2) SAVINGS PROVISION.—Nothing in this sub2 section may be construed to prohibit an authorized 

3 official of a State from initiating or continuing any 

4 proceeding in a court of the State for a violation of 

5 any civil or criminal law of the State. 

6 (f) PRESERVATION OF AUTHORITY.—Nothing in this 

7 Act shall be construed to limit the authority of the Federal 

8 Trade Commission under any other provision of law. 

9 SEC. 10. ADDITIONAL ENFORCEMENT RESOURCES. 

10 (a) IN GENERAL.—Notwithstanding any other provi11 sion of law the Commission may, without regard to the 

12 civil service laws (including regulations), appoint not more 

13 than 300 additional personnel for the purposes of enforc14 ing privacy and data security laws and regulations. 

15 (b) AUTHORIZATION OF APPROPRIATIONS.—There is 

16 authorized to be appropriated to the Commission such 

17 sums as may be necessary to carry out this section. 

Æ 


pbinns on DSK79D2C42PROD with BILLS