I 

114TH CONGRESS 

2D SESSION H. R. 4517 

To provide for greater transparency in and user control over the treatment 

of data collected by mobile applications and to enhance the security 

of such data. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 10, 2016 

Mr. JOHNSON of Georgia (for himself, Mr. BARTON, Mr. CHABOT, Ms. JACKSON LEE, Mr. CICILLINE, and Mr. COHEN) introduced the following bill; 

which was referred to the Committee on Energy and Commerce 

A BILL 

To provide for greater transparency in and user control 

over the treatment of data collected by mobile applications and to enhance the security of such data. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Application Privacy, 

5 Protection, and Security Act of 2016’’ or the ‘‘APPS Act 

6 of 2016’’. 

7 SEC. 2. TRANSPARENCY, USER CONTROL, AND SECURITY. 

8 (a) CONSENT TO TERMS AND CONDITIONS.— 


SSpencer on DSK4SPTVN1PROD with BILLS
2 

•HR 4517 IH

1 (1) IN GENERAL.—Before a mobile application 

2 collects personal data about a user of the applica3 tion, the developer of the application shall— 

4 (A) provide the user with notice of the 

5 terms and conditions governing the collection, 

6 use, storage, and sharing of the personal data; 

7 and 

8 (B) obtain the consent of the user to such 

9 terms and conditions. 

10 (2) REQUIRED CONTENT.—The notice required 

11 by paragraph (1)(A) shall include the following: 

12 (A) The categories of personal data that 

13 will be collected. 

14 (B) The categories of purposes for which 

15 the personal data will be used. 

16 (C) The categories of third parties with 

17 which the personal data will be shared. 

18 (D) A data retention policy that governs 

19 the length for which the personal data will be 

20 stored and the terms and conditions applicable 

21 to storage, including a description of the rights 

22 of the user under subsection (b) and the proc23 ess by which the user may exercise such rights. 

24 (3) ADDITIONAL SPECIFICATIONS AND FLEXI25 BILITY.—The Commission shall by regulation specify 


SSpencer on DSK4SPTVN1PROD with BILLS
3 

•HR 4517 IH

1 the format, manner, and timing of the notice re2 quired by paragraph (1)(A). In promulgating the 

3 regulations, the Commission shall consider how to 

4 ensure the most effective and efficient communica5 tion to the user regarding the treatment of personal 

6 data. 

7 (4) DIRECT ACCESS TO DATA BY THIRD PAR8 TIES.—For purposes of this Act, if the developer of 

9 a mobile application allows a third party to access 

10 personal data collected by the application, such per11 sonal data shall be considered to be shared with the 

12 third party, whether or not such personal data are 

13 first transmitted to the developer. 

14 (b) WITHDRAWAL OF CONSENT.—The developer of a 

15 mobile application shall— 

16 (1) provide a user of the application with a 

17 means of— 

18 (A) notifying the developer that the user 

19 intends to stop using the application; and 

20 (B) requesting the developer— 

21 (i) to refrain from any further collec22 tion of personal data through the applica23 tion; and 

24 (ii) at the option of the user, either— 


SSpencer on DSK4SPTVN1PROD with BILLS
4 

•HR 4517 IH

1 (I) to the extent practicable, to 

2 delete any personal data collected by 

3 the application that is stored by the 

4 developer; or 

5 (II) to refrain from any further 

6 use or sharing of such data; and 

7 (2) within a reasonable and appropriate time 

8 after receiving a request under paragraph (1)(B), 

9 comply with such request. 

10 (c) SECURITY OF PERSONAL DATA AND DE-IDENTI11 FIED DATA.—The developer of a mobile application shall 

12 take reasonable and appropriate measures to prevent un13 authorized access to personal data and de-identified data 

14 collected by the application. 

15 (d) EXCEPTION.—Nothing in this Act prohibits the 

16 developer of a mobile application from disclosing or pre17 serving personal data or de-identified data as required 

18 by— 

19 (1) other Federal law (including a court order); 

20 or 

21 (2) except as provided in section 6, the law of 

22 a State or a political subdivision of a State (includ23 ing a court order). 


SSpencer on DSK4SPTVN1PROD with BILLS
5 

•HR 4517 IH

1 SEC. 3. APPLICATION AND ENFORCEMENT. 

2 (a) GENERAL APPLICATION.—The requirements of 

3 this Act and the regulations promulgated under this Act 

4 apply, according to their terms, to those persons, partner5 ships, and corporations over which the Commission has 

6 authority pursuant to section 5(a)(2) of the Federal Trade 

7 Commission Act (15 U.S.C. 45(a)(2)). 

8 (b) ENFORCEMENT BY FEDERAL TRADE COMMIS9 SION.— 

10 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC11 TICES.—A violation of this Act or a regulation pro12 mulgated under this Act shall be treated as a viola13 tion of a regulation under section 18(a)(1)(B) of the 

14 Federal Trade Commission Act (15 U.S.C. 

15 57a(a)(1)(B)) regarding unfair or deceptive acts or 

16 practices. 

17 (2) POWERS OF COMMISSION.—The Commis18 sion shall enforce this Act and the regulations pro19 mulgated under this Act in the same manner, by the 

20 same means, and with the same jurisdiction, powers, 

21 and duties as though all applicable terms and provi22 sions of the Federal Trade Commission Act (15 

23 U.S.C. 41 et seq.) were incorporated into and made 

24 a part of this Act. Any person who violates this Act 

25 or a regulation promulgated under this Act shall be 

26 subject to the penalties and entitled to the privileges 


SSpencer on DSK4SPTVN1PROD with BILLS
6 

•HR 4517 IH

1 and immunities provided in the Federal Trade Com2 mission Act. 

3 (c) ACTIONS BY STATES.— 

4 (1) IN GENERAL.—In any case in which the at5 torney general of a State, or an official or agency of 

6 a State, has reason to believe that an interest of the 

7 residents of such State has been or is threatened or 

8 adversely affected by an act or practice in violation 

9 of this Act or a regulation promulgated under this 

10 Act, the State, as parens patriae, may bring a civil 

11 action on behalf of the residents of the State in an 

12 appropriate district court of the United States to— 

13 (A) enjoin such act or practice; 

14 (B) enforce compliance with this Act or 

15 such regulation; 

16 (C) obtain damages, restitution, or other 

17 compensation on behalf of residents of the 

18 State; or 

19 (D) obtain such other legal and equitable 

20 relief as the court may consider to be appro21 priate. 

22 (2) NOTICE.—Before filing an action under this 

23 subsection, the attorney general, official, or agency 

24 of the State involved shall provide to the Commis25 sion a written notice of such action and a copy of 


SSpencer on DSK4SPTVN1PROD with BILLS
7 

•HR 4517 IH

1 the complaint for such action. If the attorney gen2 eral, official, or agency determines that it is not fea3 sible to provide the notice described in this para4 graph before the filing of the action, the attorney 

5 general, official, or agency shall provide written no6 tice of the action and a copy of the complaint to the 

7 Commission immediately upon the filing of the ac8 tion. 

9 (3) AUTHORITY OF COMMISSION.— 

10 (A) IN GENERAL.—On receiving notice 

11 under paragraph (2) of an action under this 

12 subsection, the Commission shall have the 

13 right— 

14 (i) to intervene in the action; 

15 (ii) upon so intervening, to be heard 

16 on all matters arising therein; and 

17 (iii) to file petitions for appeal. 

18 (B) LIMITATION ON STATE ACTION WHILE

19 FEDERAL ACTION IS PENDING.—If the Commis20 sion or the Attorney General of the United 

21 States has instituted a civil action for violation 

22 of this Act or a regulation promulgated under 

23 this Act (referred to in this subparagraph as 

24 the ‘‘Federal action’’), no State attorney gen25 eral, official, or agency may bring an action 


SSpencer on DSK4SPTVN1PROD with BILLS
8 

•HR 4517 IH

1 under this subsection during the pendency of 

2 the Federal action against any defendant 

3 named in the complaint in the Federal action 

4 for any violation of this Act or such regulation 

5 alleged in such complaint. 

6 (4) RULE OF CONSTRUCTION.—For purposes of 

7 bringing a civil action under this subsection, nothing 

8 in this Act shall be construed to prevent an attorney 

9 general, official, or agency of a State from exercising 

10 the powers conferred on the attorney general, offi11 cial, or agency by the laws of such State to conduct 

12 investigations, administer oaths and affirmations, or 

13 compel the attendance of witnesses or the production 

14 of documentary and other evidence. 

15 SEC. 4. REGULATIONS. 

16 Not later than 1 year after the date of the enactment 

17 of this Act, the Commission shall promulgate regulations 

18 in accordance with section 553 of title 5, United States 

19 Code, to implement and enforce this Act. 

20 SEC. 5. SAFE HARBOR. 

21 (a) IN GENERAL.—The developer of a mobile applica22 tion may satisfy the requirements of this Act and the regu23 lations promulgated under this Act by adopting and fol24 lowing a code of conduct for consumer data privacy (inso25 far as such code relates to data collected by a mobile appliVerDate Sep 11 2014 04:00 Feb 11, 2016 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H4517.IH H4517

SSpencer on DSK4SPTVN1PROD with BILLS
9 

•HR 4517 IH

1 cation) that the Commission has approved as meeting the 

2 requirements of the regulations promulgated under section 

3 4. 

4 (b) REGULATIONS.—The Commission shall promul5 gate regulations in accordance with section 553 of title 

6 5, United States Code, to govern the consideration and 

7 approval of codes of conduct under subsection (a). 

8 SEC. 6. RELATIONSHIP TO STATE LAW. 

9 This Act and the regulations promulgated under this 

10 Act supercede a provision of law of a State or a political 

11 subdivision of a State only to the extent that such provi12 sion— 

13 (1) conflicts with this Act or such regulations, 

14 as determined without regard to section 2(d)(2); 

15 (2) specifically relates to the treatment of per16 sonal data or de-identified data; and 

17 (3) provides a level of transparency, user con18 trol, or security in the treatment of personal data or 

19 de-identified data that is less than the level provided 

20 by this Act and such regulations. 

21 SEC. 7. PRESERVATION OF FTC AUTHORITY. 

22 Nothing in this Act may be construed in any way to 

23 limit or affect the authority of the Commission under any 

24 other provision of law. 


SSpencer on DSK4SPTVN1PROD with BILLS
10 

•HR 4517 IH

1 SEC. 8. DEFINITIONS. 

2 In this Act: 

3 (1) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (2) DE-IDENTIFIED DATA.—The term ‘‘de-iden6 tified data’’ means data that cannot reasonably be 

7 used to identify or infer information about, or other8 wise be linked to, a particular individual or mobile 

9 device, as determined with a reasonable level of jus10 tified confidence based on the available methods and 

11 technologies, the nature of the data at issue, and the 

12 purposes for which the data will be used. 

13 (3) DEVELOPER.—The term ‘‘developer’’ shall 

14 have the meaning given such term by the Commis15 sion by regulation. 

16 (4) MOBILE APPLICATION.—The term ‘‘mobile 

17 application’’ means a software program that— 

18 (A) runs on the operating system of a mo19 bile device; and 

20 (B) collects data from a user. 

21 (5) MOBILE DEVICE.—The term ‘‘mobile de22 vice’’ means a smartphone, tablet computer, or simi23 lar portable computing device that transmits data 

24 over a wireless connection. 

25 (6) PERSONAL DATA.—The term ‘‘personal 

26 data’’ shall have the meaning given such term by the 


SSpencer on DSK4SPTVN1PROD with BILLS
11 

•HR 4517 IH

1 Commission by regulation, except that such term 

2 shall not include de-identified data. 

3 (7) STATE.—The term ‘‘State’’ means each of 

4 the several States, the District of Columbia, each 

5 commonwealth, territory, or possession of the United 

6 States, and each federally recognized Indian tribe. 

7 (8) THIRD PARTY.—The term ‘‘third party’’ 

8 means, with respect to the developer of an applica9 tion, an entity that holds itself out to the public as 

10 separate from the developer such that a user of the 

11 application acting reasonably under the cir12 cumstances would not expect the entity to be related 

13 to the developer or to have access to personal data 

14 the user provides to the developer. Such term in15 cludes an affiliate of the developer unless the affili16 ation is reasonably clear to users of the application. 

17 SEC. 9. EFFECTIVE DATE. 

18 This Act shall apply with respect to any collection, 

19 use, storage, or sharing of personal data or de-identified 

20 data that occurs after the date that is 30 days after the 

21 promulgation of final regulations under section 4. 

Æ 


SSpencer on DSK4SPTVN1PROD with BILLS