III 

115TH CONGRESS 

2D SESSION S. RES. 523 

Encouraging companies to apply privacy protections included in the General 

Data Protection Regulation of the European Union to citizens of the 

United States. 

IN THE SENATE OF THE UNITED STATES 

MAY 24, 2018 

Mr. MARKEY (for himself, Mr. DURBIN, Mr. SANDERS, and Mr. 

BLUMENTHAL) submitted the following resolution; which was referred to 

the Committee on Commerce, Science, and Transportation 

RESOLUTION 

Encouraging companies to apply privacy protections included 

in the General Data Protection Regulation of the European Union to citizens of the United States. 

Whereas the European Union has enacted the General Data 

Protection Regulation (referred to in this preamble as the 

‘‘GDPR’’), which provides the 508,000,000 residents of 

the European Union with significant new privacy protections; 

Whereas the GDPR takes effect on May 25, 2018; 

Whereas the rules of the GDPR will apply to many entities 

in the United States that serve users and customers in 

both Europe and the United States; 

Whereas the GDPR requires that— 


pbinns on DSK79D2C42PROD with BILLS
2 

•SRES 523 IS 

(1) data processors have a legal basis for processing 

the data of users; and 

(2) opt-in, freely given, specific, informed, and unambiguous consent from users is a primary legal basis; 

Whereas polling shows that people in the United States are 

increasingly concerned about their privacy and the security of their personal information; 

Whereas recent data breaches and privacy invasions affecting 

millions of people in the United States underscore the 

need for enhanced privacy protection in the United 

States; and 

Whereas people in the United States have a right to privacy, 

and entities that control and process the data of people 

in the United States have an obligation to protect that 

data: Now, therefore, be it 

1 Resolved, That the Senate encourages entities covered 

2 by the General Data Protection Regulation of the Euro3 pean Union (referred to in this resolving clause as the 

4 ‘‘GDPR’’), including edge providers, broadband providers, 

5 and data brokers— 

6 (1) to provide the people of the United States 

7 with the privacy protections included in the GDPR 

8 in a manner consistent with existing laws and rights 

9 in the United States, including the First Amend10 ment; and 

11 (2) to include in the protections described in 

12 paragraph (1)— 

13 (A) the requirement that— 


pbinns on DSK79D2C42PROD with BILLS
3 

•SRES 523 IS 

1 (i) data processors (as described in 

2 the GDPR) have a legal basis for proc3 essing the data of users; 

4 (ii) opt-in, freely given, specific, in5 formed, and unambiguous consent from 

6 users be a primary legal basis for purposes 

7 of clause (i); 

8 (iii) data processors design their sys9 tems in a way that— 

10 (I) minimizes the processing of 

11 data to only what is necessary for the 

12 specific purpose stated to the indi13 vidual; and 

14 (II) by default, protects personal 

15 information from being used for other 

16 purposes; 

17 (iv) entities processing the data of 

18 children institute special protections, par19 ticularly with reference to the use of the 

20 data of children for marketing purposes; 

21 (v) data processors and controllers (as 

22 described in the GDPR) ensure compliance 

23 with relevant privacy rules; and 


pbinns on DSK79D2C42PROD with BILLS
4 

•SRES 523 IS 

1 (vi) data processors implement appro2 priate oversight over third party data proc3 essors; and 

4 (B) the right of an individual— 

5 (i) to revoke consent for data proc6 essing at any time; 

7 (ii) to not be subject to automated de8 cisionmaking, including profiling, without 

9 human intervention if the decisionmaking 

10 has legal or otherwise significant effects on 

11 the individual; 

12 (iii) to know which entities have ac13 cess to the data of the individual and how 

14 that data is being used; 

15 (iv) to correct the data of the indi16 vidual if it is inaccurate or incomplete; and 

17 (v) to obtain and reuse the data of the 

18 individual for the purposes of the indi19 vidual across other services. 

Æ 


pbinns on DSK79D2C42PROD with BILLS