II 

117TH CONGRESS 

2D SESSION S. 4434 

To protect the privacy of personal reproductive or sexual health information, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 16, 2022 

Ms. HIRONO (for herself, Mr. WYDEN, Mrs. GILLIBRAND, Ms. SMITH, Mr. 

WHITEHOUSE, Mr. BLUMENTHAL, Ms. BALDWIN, Mr. BROWN, Ms. 

DUCKWORTH, Ms. KLOBUCHAR, and Mr. BOOKER) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To protect the privacy of personal reproductive or sexual 

health information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘My Body, My Data 

5 Act of 2022’’. 

6 SEC. 2. MINIMIZATION. 

7 (a) MINIMIZATION OF COLLECTING, RETAINING, 

8 USING, AND DISCLOSING.—A regulated entity may not 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 4434 IS

1 collect, retain, use, or disclose personal reproductive or 

2 sexual health information except— 

3 (1) with the express consent of the individual to 

4 whom such information relates; or 

5 (2) as is strictly necessary to provide a product 

6 or service that the individual to whom such informa7 tion relates has requested from such regulated enti8 ty. 

9 (b) MINIMIZATION OF EMPLOYEE ACCESS.—A regu10 lated entity shall restrict access to personal reproductive 

11 or sexual health information by the employees or service 

12 providers of such regulated entity to such employees or 

13 service providers for which access is necessary to provide 

14 a product or service that the individual to whom such in15 formation relates has requested from such regulated enti16 ty. 

17 SEC. 3. RIGHT OF ACCESS AND DELETION. 

18 (a) RIGHT OF ACCESS.— 

19 (1) IN GENERAL.—A regulated entity shall 

20 make available a reasonable mechanism by which an 

21 individual, upon a verified request, may access— 

22 (A) any personal reproductive or sexual 

23 health information relating to such individual 

24 that is retained by such regulated entity, in25 cluding— 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 4434 IS

1 (i) in the case of such information 

2 that such regulated entity collected from 

3 third parties, how and from which specific 

4 third parties such regulated entity collected 

5 such information; and 

6 (ii) such information that such regu7 lated entity inferred about such individual; 

8 and 

9 (B) a list of the specific third parties to 

10 which such regulated entity has disclosed any 

11 personal reproductive or sexual health informa12 tion relating to such individual. 

13 (2) FORMAT.—A regulated entity shall make 

14 the information described in paragraph (1) available 

15 in both a human-readable format and a structured, 

16 interoperable, and machine-readable format. 

17 (b) RIGHT OF DELETION.—A regulated entity shall 

18 make available a reasonable mechanism by which an indi19 vidual, upon a verified request, may request the deletion 

20 of any personal reproductive or sexual health information 

21 relating to such individual that is retained by such regu22 lated entity, including any such information that such reg23 ulated entity collected from a third party or inferred from 

24 other information retained by such regulated entity. 

25 (c) GENERAL PROVISIONS.— 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 4434 IS

1 (1) REASONABLE MECHANISM DEFINED.—In 

2 this section, the term ‘‘reasonable mechanism’’ 

3 means, with respect to a regulated entity and a right 

4 under this section, a mechanism that— 

5 (A) is equivalent in availability and ease of 

6 use to that of other mechanisms for commu7 nicating or interacting with such regulated enti8 ty; and 

9 (B) includes an online means of exercising 

10 such right. 

11 (2) TIMELINE FOR COMPLYING WITH RE12 QUESTS.—A regulated entity shall comply with a 

13 verified request received under this section without 

14 undue delay but not later than 15 days after the 

15 date on which such regulated entity receives such 

16 verified request. 

17 (3) FEES PROHIBITED.—A regulated entity 

18 may not charge a fee to an individual for a request 

19 made under this section. 

20 (4) RULES OF CONSTRUCTION.—Nothing in 

21 this section shall be construed to require a regulated 

22 entity to— 

23 (A) take an action that would convert in24 formation that is not personal information into 

25 personal information; 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 4434 IS

1 (B) collect or retain personal information 

2 that such regulated entity would otherwise not 

3 collect or retain; or 

4 (C) retain personal information longer 

5 than such regulated entity would otherwise re6 tain such information. 

7 SEC. 4. PRIVACY POLICY. 

8 (a) POLICY REQUIRED.—A regulated entity shall 

9 maintain a privacy policy relating to the practices of such 

10 regulated entity regarding the collecting, retaining, using, 

11 and disclosing of personal reproductive or sexual health 

12 information. 

13 (b) PUBLICATION REQUIRED.—If a regulated entity 

14 has a website, such regulated entity shall prominently pub15 lish the privacy policy required by subsection (a) on such 

16 website. 

17 (c) CONTENTS.—The privacy policy required by sub18 section (a) shall be clear and conspicuous and shall con19 tain, at a minimum, the following: 

20 (1) A description of the practices of the regu21 lated entity regarding the collecting, retaining, 

22 using, and disclosing of personal reproductive or sex23 ual health information. 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 4434 IS

1 (2) A clear and concise statement of the cat2 egories of such information collected, retained, used, 

3 or disclosed by the regulated entity. 

4 (3) A clear and concise statement of the pur5 poses of the regulated entity for the collecting, re6 taining, using, or disclosing of such information. 

7 (4) A list of the specific third parties to which 

8 the regulated entity discloses such information, and 

9 a clear and concise statement of the purposes for 

10 which the regulated entity discloses such informa11 tion, including how the information may be used by 

12 each such third party. 

13 (5) A list of the specific third parties from 

14 which the regulated entity has collected such infor15 mation, and a clear and concise statement of the 

16 purposes for which the regulated entity collects such 

17 information. 

18 (6) A clear and concise statement describing 

19 the extent to which individuals may exercise control 

20 over the collecting, retaining, using, and disclosing 

21 of personal reproductive or sexual health information 

22 by the regulated entity, and the steps an individual 

23 must take to implement such controls. 

24 (7) A clear and concise statement describing 

25 the efforts of the regulated entity to protect personal 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 4434 IS

1 reproductive or sexual health information from un2 authorized disclosure. 

3 SEC. 5. ENFORCEMENT. 

4 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS5 SION.— 

6 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC7 TICES.—A violation of this Act or a regulation pro8 mulgated under this Act shall be treated as a viola9 tion of a regulation under section 18(a)(1)(B) of the 

10 Federal Trade Commission Act (15 U.S.C. 

11 57a(a)(1)(B)) regarding unfair or deceptive acts or 

12 practices. 

13 (2) POWERS OF COMMISSION.—Except as pro14 vided in section 6(7)(A)(ii), the Commission shall 

15 enforce this Act and the regulations promulgated 

16 under this Act in the same manner, by the same 

17 means, and with the same jurisdiction, powers, and 

18 duties as though all applicable terms and provisions 

19 of the Federal Trade Commission Act (15 U.S.C. 41 

20 et seq.) were incorporated into and made a part of 

21 this Act, and any regulated entity that violates this 

22 Act or a regulation promulgated under this Act shall 

23 be subject to the penalties and entitled to the privi24 leges and immunities provided in the Federal Trade 

25 Commission Act. 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 4434 IS

1 (3) RULEMAKING AUTHORITY.—The Commis2 sion may promulgate regulations under section 553 

3 of title 5, United States Code, to implement this 

4 Act. 

5 (b) ENFORCEMENT BY INDIVIDUALS.— 

6 (1) IN GENERAL.—Any individual alleging a 

7 violation of this Act or a regulation promulgated 

8 under this Act may bring a civil action in any court 

9 of competent jurisdiction. 

10 (2) RELIEF.—In a civil action brought under 

11 paragraph (1) in which the plaintiff prevails, the 

12 court may award— 

13 (A) an amount not less than $100 and not 

14 greater than $1,000 per violation per day, or 

15 actual damages, whichever is greater; 

16 (B) punitive damages; 

17 (C) reasonable attorney’s fees and litiga18 tion costs; and 

19 (D) any other relief, including equitable or 

20 declaratory relief, that the court determines ap21 propriate. 

22 (3) INJURY IN FACT.—A violation of this Act, 

23 or a regulation promulgated under this Act, with re24 spect to personal reproductive or sexual health infor25 mation constitutes a concrete and particularized inVerDate Sep 11 2014 02:32 Jun 18, 2022 Jkt 029200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S4434.IS S4434

kjohnson on DSK79L0C42PROD with BILLS
9 

•S 4434 IS

1 jury in fact to the individual to whom such informa2 tion relates. 

3 (4) INVALIDITY OF PRE-DISPUTE ARBITRATION

4 AGREEMENTS AND PRE-DISPUTE JOINT ACTION

5 WAIVERS.— 

6 (A) IN GENERAL.—Notwithstanding any 

7 other provision of law, no pre-dispute arbitra8 tion agreement or pre-dispute joint-action waiv9 er shall be valid or enforceable with respect to 

10 a dispute arising under this Act. 

11 (B) APPLICABILITY.—Any determination 

12 as to whether or how this paragraph applies to 

13 any dispute shall be made by a court, rather 

14 than an arbitrator, without regard to whether 

15 such agreement purports to delegate such deter16 mination to an arbitrator. 

17 (C) DEFINITIONS.—For purposes of this 

18 paragraph: 

19 (i) PRE-DISPUTE ARBITRATION

20 AGREEMENT.—The term ‘‘pre-dispute arbi21 tration agreement’’ means any agreement 

22 to arbitrate a dispute that has not arisen 

23 at the time of the making of the agree24 ment. 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 4434 IS

1 (ii) PRE-DISPUTE JOINT-ACTION

2 WAIVER.—The term ‘‘pre-dispute joint-ac3 tion waiver’’ means an agreement that 

4 would prohibit a party from participating 

5 in a joint, class, or collective action in a ju6 dicial, arbitral, administrative, or other 

7 forum, concerning a dispute that has not 

8 yet arisen at the time of the making of the 

9 agreement. 

10 SEC. 6. DEFINITIONS. 

11 In this Act: 

12 (1) COLLECT.—The term ‘‘collect’’ means, with 

13 respect to personal reproductive or sexual health in14 formation, for a regulated entity to obtain such in15 formation in any manner. 

16 (2) COMMISSION.—The term ‘‘Commission’’ 

17 means the Federal Trade Commission. 

18 (3) DISCLOSE.—The term ‘‘disclose’’ means, 

19 with respect to personal reproductive or sexual 

20 health information, for a regulated entity to release, 

21 transfer, sell, provide access to, license, or divulge 

22 such information in any manner to a third party or 

23 government entity. 

24 (4) EXPRESS CONSENT.— 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 4434 IS

1 (A) IN GENERAL.—The term ‘‘express con2 sent’’ means, with respect to the collecting, re3 taining, using, or disclosing of personal repro4 ductive or sexual health information, informed, 

5 opt-in, voluntary, specific, and unambiguous 

6 written consent (which may include written con7 sent provided by electronic means) to such col8 lecting, retaining, using, or disclosing of such 

9 information. 

10 (B) EXCLUSIONS.—The term ‘‘express 

11 consent’’ does not include any of the following: 

12 (i) Consent secured without first pro13 viding to the individual a clear and con14 spicuous disclosure, apart from any privacy 

15 policy, terms of service, terms of use, gen16 eral release, user agreement, or other simi17 lar document, of all information material 

18 to the provision of consent. 

19 (ii) Hovering over, muting, pausing, 

20 or closing a given piece of content. 

21 (iii) Agreement obtained through the 

22 use of a user interface designed or manipu23 lated with the substantial effect of sub24 verting or impairing user autonomy, deci25 sion making, or choice. 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 4434 IS

1 (5) PERSONAL INFORMATION.—The term ‘‘per2 sonal information’’ means information that identi3 fies, relates to, describes, is reasonably capable of 

4 being associated with, or could reasonably be linked, 

5 directly or indirectly, with a particular individual. 

6 (6) PERSONAL REPRODUCTIVE OR SEXUAL

7 HEALTH INFORMATION.—The term ‘‘personal repro8 ductive or sexual health information’’ means per9 sonal information relating to the past, present, or 

10 future reproductive or sexual health of an individual, 

11 including— 

12 (A) efforts to research or obtain reproduc13 tive or sexual information services or supplies, 

14 including location information that might indi15 cate an attempt to acquire or receive such in16 formation services or supplies; 

17 (B) reproductive or sexual health condi18 tions, status, diseases, or diagnoses, including 

19 pregnancy, menstruation, ovulation, ability to 

20 conceive a pregnancy, whether such individual 

21 is sexually active, and whether such individual 

22 is engaging in unprotected sex; 

23 (C) reproductive- and sexual-health-related 

24 surgeries or procedures, such as termination of 

25 a pregnancy; 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 4434 IS

1 (D) use or purchase of contraceptives, 

2 birth control, or any medication related to re3 productive health, including abortifacients; 

4 (E) bodily functions, vital signs, measure5 ment, or symptoms related to menstruation or 

6 pregnancy, such as basal temperature, cramps, 

7 bodily discharge, or hormone levels; 

8 (F) any information about diagnoses or di9 agnostic testing, treatment, medications, or the 

10 use of any product or service relating to the 

11 matters described in subparagraphs (A) 

12 through (E); and 

13 (G) any information described in subpara14 graphs (A) through (F) that is derived or ex15 trapolated from non-health information (such as 

16 proxy, derivative, inferred, emergent, or algo17 rithmic data). 

18 (7) REGULATED ENTITY.— 

19 (A) IN GENERAL.—The term ‘‘regulated 

20 entity’’ means any entity (to the extent such en21 tity is engaged in activities in or affecting com22 merce (as defined in section 4 of the Federal 

23 Trade Commission Act (15 U.S.C. 44))) that 

24 is— 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 4434 IS

1 (i) a person, partnership, or corpora2 tion subject to the jurisdiction of the Com3 mission under section 5(a)(2) of the Fed4 eral Trade Commission Act (15 U.S.C. 

5 45(a)(2)); or 

6 (ii) notwithstanding section 4, 5(a)(2), 

7 or 6 of the Federal Trade Commission Act 

8 (15 U.S.C. 44; 45(a)(2); 46) or any juris9 dictional limitation of the Commission— 

10 (I) a common carrier subject to 

11 the Communications Act of 1934 (47 

12 U.S.C. 151 et seq.) and all Acts 

13 amendatory thereof and supple14 mentary thereto; or 

15 (II) an organization not orga16 nized to carry on business for its own 

17 profit or that of its members. 

18 (B) EXCLUSIONS.—The term ‘‘regulated 

19 entity’’ does not include— 

20 (i) an entity that is a covered entity, 

21 as defined in section 160.103 of title 45, 

22 Code of Federal Regulations (or any suc23 cessor to such regulation), to the extent 

24 such entity is acting as a covered entity 

25 under the HIPAA privacy regulations (as 


kjohnson on DSK79L0C42PROD with BILLS
15 

•S 4434 IS

1 defined in section 1180(b)(3) of the Social 

2 Security Act (42 U.S.C. 1320d–9(b)(3))); 

3 (ii) an entity that is a business asso4 ciate, as defined in section 160.103 of title 

5 45, Code of Federal Regulations (or any 

6 successor to such regulation), to the extent 

7 such entity is acting as a business asso8 ciate under the HIPAA privacy regulations 

9 (as defined in such section 1180(b)(3)); or 

10 (iii) an entity that is subject to re11 strictions on disclosure of records under 

12 section 543 of the Public Health Service 

13 Act (42 U.S.C. 290dd–2), to the extent 

14 such entity is acting in a capacity subject 

15 to such restrictions. 

16 (8) SERVICE PROVIDER.— 

17 (A) IN GENERAL.—The term ‘‘service pro18 vider’’ means a person who— 

19 (i) collects, retains, uses, or discloses 

20 personal reproductive or sexual health in21 formation for the sole purpose of, and only 

22 to the extent that such person is, con23 ducting business activities on behalf of, for 

24 the benefit of, under instruction of, and 

25 under contractual agreement with a reguVerDate Sep 11 2014 02:32 Jun 18, 2022 Jkt 029200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S4434.IS S4434

kjohnson on DSK79L0C42PROD with BILLS
16 

•S 4434 IS

1 lated entity and not any other individual or 

2 entity; and 

3 (ii) does not divulge personal repro4 ductive or sexual health information to any 

5 individual or entity other than such regu6 lated entity or a contractor to such service 

7 provider bound to information processing 

8 terms no less restrictive than terms to 

9 which such service provider is bound. 

10 (B) LIMITATION OF APPLICATION.—Such 

11 person shall only be considered a service pro12 vider in the course of activities described in 

13 subparagraph (A)(i). 

14 (C) MINIMIZATION BY SERVICE PRO15 VIDERS.—For purposes of compliance with sec16 tion 2 by a service provider of a regulated enti17 ty, a request from an individual to such regu18 lated entity for a product or service, and an ex19 press consent from such individual to such reg20 ulated entity, shall be treated as having also 

21 been provided to such service provider. 

22 (9) THIRD PARTY.—The term ‘‘third party’’ 

23 means, with respect to the disclosing or collecting of 

24 personal reproductive or sexual health information, 

25 any person who is not— 


kjohnson on DSK79L0C42PROD with BILLS
17 

•S 4434 IS

1 (A) the regulated entity that is disclosing 

2 or collecting such information; 

3 (B) the individual to whom such informa4 tion relates; or 

5 (C) a service provider. 

6 SEC. 7. EXCEPTION FOR THE PUBLICATION OF NEWS7 WORTHY INFORMATION. 

8 Nothing in this Act, or a regulation promulgated 

9 under this Act, shall apply with respect to personal repro10 ductive or sexual health information that is collected, re11 tained, used, or disclosed by a regulated entity for the pub12 lication of newsworthy information of legitimate public 

13 concern to the public, or to the collecting, retaining, using, 

14 or disclosing of such information by a regulated entity for 

15 that purpose, if such regulated entity has reasonable safe16 guards and processes that prevent the collecting, retain17 ing, using, or disclosing of personal reproductive or sexual 

18 health information for commercial purposes other than the 

19 publication of newsworthy information of legitimate public 

20 concern. 

21 SEC. 8. RELATIONSHIP TO FEDERAL AND STATE LAWS. 

22 (a) FEDERAL LAW PRESERVATION.—Nothing in this 

23 Act, or a regulation promulgated under this Act, shall be 

24 construed to limit any other provision of Federal law, ex25 cept as specifically provided in this Act. 


kjohnson on DSK79L0C42PROD with BILLS
18 

•S 4434 IS

1 (b) STATE LAW PRESERVATION.— 

2 (1) IN GENERAL.—Nothing in this Act, or a 

3 regulation promulgated under this Act, shall be con4 strued to preempt, displace, or supplant any State 

5 law, except to the extent that a provision of State 

6 law conflicts with a provision of this Act, or a regu7 lation promulgated under this Act, and then only to 

8 the extent of the conflict. 

9 (2) GREATER PROTECTION UNDER STATE

10 LAW.—For purposes of this subsection, a provision 

11 of State law does not conflict with a provision of this 

12 Act, or a regulation promulgated under this Act, if 

13 such provision of State law provides greater privacy 

14 protection than the privacy protection provided by 

15 such provision of this Act or such regulation. 

16 SEC. 9. SAVINGS CLAUSE. 

17 Nothing in this Act shall be construed to limit the 

18 authority of the Commission under any other provision of 

19 law. Nothing in this Act, or a regulation promulgated 

20 under this Act, shall be construed to prohibit a regulated 

21 entity from disclosing personal reproductive or sexual 

22 health information to the Commission as required by law, 

23 in compliance with a court order, or in compliance with 

24 a civil investigative demand or similar process authorized 

25 under law. 


kjohnson on DSK79L0C42PROD with BILLS
19 

•S 4434 IS

1 SEC. 10. SEVERABILITY CLAUSE. 

2 If any provision of this Act, or the application thereof 

3 to any person or circumstance, is held invalid, the remain4 der of this Act, and the application of such provision to 

5 other persons not similarly situated or to other cir6 cumstances, shall not be affected by the invalidation. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS