II 

118TH CONGRESS 

2D SESSION S. 5170 

To establish the Data Protection Agency. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 25, 2024 

Mrs. GILLIBRAND introduced the following bill; which was read twice and 

referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To establish the Data Protection Agency. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Protection Act 

5 of 2024’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 

8 (1) AGENCY.—The term ‘‘Agency’’ means the 

9 Data Protection Agency established under section 3. 

10 (2) ANONYMIZED DATA.—The term 

11 ‘‘anonymized data’’ means information— 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•S 5170 IS

1 (A) that does not identify an individual; 

2 and 

3 (B) with respect to which there is no rea4 sonable basis to believe that the information 

5 can be used on its own or in combination with 

6 other reasonably available information to iden7 tify an individual. 

8 (3) AUTOMATED DECISION SYSTEM.—The term 

9 ‘‘automated decision system’’ means a computational 

10 process, including one derived from machine learn11 ing, statistics, or other data processing or artificial 

12 intelligence techniques, that automates, analyzes, 

13 aids, or augments decisions. 

14 (4) BIOMETRIC INFORMATION.—The term ‘‘bio15 metric information’’— 

16 (A) means information regarding the phys17 iological or biological characteristics of an indi18 vidual that may be used, singly or in combina19 tion with each other or with other identifying 

20 data, to establish the identity of an individual; 

21 (B) includes— 

22 (i) genetic data; 

23 (ii) imagery of the iris, retina, finger24 print, face, hand, palm, vein patterns, and 

25 voice recordings, from which an identifier 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•S 5170 IS

1 template, such as a faceprint, a minutiae 

2 template, or a voiceprint, can be extracted; 

3 (iii) keystroke patterns or rhythms, 

4 gait patterns or rhythms, and sleep, 

5 health, or exercise data that contain identi6 fying information; and 

7 (iv) any mathematical code, profile, or 

8 algorithmic model derived from informa9 tion regarding the physiological or biologi10 cal characteristics of an individual; 

11 (C) does not include information captured 

12 from a patient in a health care setting for a 

13 medical purpose or information collected, used, 

14 or stored for health care treatment, payment, or 

15 operations under the Health Insurance Port16 ability and Accountability Act of 1996 (Public 

17 Law 104–191); and 

18 (D) does not include an X-ray, roentgen 

19 process, computed tomography, MRI, PET 

20 scan, mammography, or other image or film of 

21 the human anatomy used to diagnose, prognose, 

22 or treat an illness or other medical condition or 

23 to further validate scientific testing or screen24 ing. 

25 (5) COLLECT.—The term ‘‘collect’’— 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•S 5170 IS

1 (A) means buying, renting, gathering, ob2 taining, receiving, or accessing any personal 

3 data by any means; and 

4 (B) includes— 

5 (i) receiving personal data from an in6 dividual or device; and 

7 (ii) creating, deriving, or inferring 

8 personal data by analyzing data about an 

9 individual or about groups of individuals 

10 similar to the individual. 

11 (6) DATA AGGREGATOR.—The term ‘‘data 

12 aggregator’’— 

13 (A) means any person that collects, uses, 

14 or shares, in or affecting interstate commerce, 

15 an amount of personal data that is not de mini16 mis, as well as entities related to that person by 

17 common ownership or corporate control; and 

18 (B) does not include an individual who col19 lects, uses, or shares personal data solely for 

20 non-commercial reasons. 

21 (7) DEVICE.—The term ‘‘device’’ means any 

22 physical object that— 

23 (A) is capable of connecting to the internet 

24 or other communication network; or 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•S 5170 IS

1 (B) has computer processing capabilities 

2 that can collect, send, receive, or store data. 

3 (8) DIRECTOR.—The term ‘‘Director’’ means 

4 the Director of the Data Protection Agency. 

5 (9) ELECTRONIC DATA.—The term ‘‘electronic 

6 data’’ means any information that is in an electronic 

7 or digital format or any electronic or digital ref8 erence that contains information about an individual 

9 or device. 

10 (10) FEDERAL PRIVACY LAW.—The term ‘‘Fed11 eral privacy law’’ means the provisions of this Act, 

12 any other rule or order prescribed by the Agency 

13 under this Act, and the following laws (including any 

14 amendments made to such laws): 

15 (A) Title V of the Gramm-Leach-Bliley Act 

16 (Public Law 106–102; 113 Stat. 1338). 

17 (B) The Fair Credit Reporting Act (15 

18 U.S.C. 1681 et seq.). 

19 (C) The Telemarketing and Consumer 

20 Fraud and Abuse Prevention Act (15 U.S.C. 

21 6101 et seq.). 

22 (D) The Fair and Accurate Credit Trans23 actions Act of 2003 (Public Law 108–159; 117 

24 Stat. 1952). 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•S 5170 IS

1 (E) The CAN–SPAM Act of 2003 (15 

2 U.S.C. 7701 et seq.). 

3 (F) Sections 222, 227, 338(l), 631, and 

4 705 of the Communications Act of 1934 (47 

5 U.S.C. 222, 227, 338(l), 551, 705). 

6 (G) The Children’s Online Privacy Protec7 tion Act of 1998 (15 U.S.C. 6501 et seq.). 

8 (H) The Right to Financial Privacy Act of 

9 1978 (12 U.S.C. 3401 et seq.). 

10 (I) The Identity Theft Assumption and 

11 Deterrence Act of 1998 (Public Law 105–318; 

12 117 Stat. 3007). 

13 (J) The General Education Provisions Act 

14 (20 U.S.C. 1221 et seq.) (commonly known as 

15 the ‘‘Family Educational Rights and Privacy 

16 Act of 1974’’). 

17 (K) Section 552a of title 5, United States 

18 Code. 

19 (L) The E-Government Act of 2002 (Pub20 lic Law 107–347; 116 Stat. 2899). 

21 (M) The Computer Security Act of 1987 

22 (40 U.S.C. 1441 note). 

23 (N) The Employee Polygraph Protection 

24 Act of 1988 (29 U.S.C. 2001 et seq.). 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•S 5170 IS

1 (O) The Communications Assistance for 

2 Law Enforcement Act (Public Law 103–414; 

3 108 Stat. 4279). 

4 (P) Sections 1028A, 1030, 1801, 2710, 

5 and 2721 and chapter 119, of title 18, United 

6 States Code. 

7 (Q) The Genetic Information Non8 discrimination Act of 2008 (Public Law 110– 

9 233; 122 Stat. 881). 

10 (R) The Taxpayer Browsing Protection 

11 Act (Public Law 105–35; 111 Stat. 1104). 

12 (S) The Privacy Protection Act of 1980 

13 (42 U.S.C. 2000aa et seq.). 

14 (T) The Cable Communications Policy Act 

15 of 1984 (Public Law 98–549; 98 Stat. 2779). 

16 (U) The Do-Not-Call Implementation Act 

17 (Public Law 108–10; 117 Stat. 557). 

18 (V) The Wireless Communications and 

19 Public Safety Act of 1999 (Public Law 106–81; 

20 113 Stat. 1286). 

21 (W) Title XXX of the Public Health Serv22 ice Act (42 U.S.C. 300jj et seq.). 

23 (11) HIGH-RISK DATA PRACTICE.—The term 

24 ‘‘high-risk data practice’’ means an action by a data 

25 aggregator that involves— 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•S 5170 IS

1 (A) the use of an automated decision sys2 tem; 

3 (B) the processing of data in a manner 

4 that involves an individual’s protected class, fa5 milial status, lawful source of income, financial 

6 status such as the individual’s income or as7 sets), veteran status, criminal convictions or ar8 rests, citizenship, past, present, or future phys9 ical or mental health or condition, psychological 

10 states, or any other factor used as a proxy for 

11 identifying any of these characteristics; 

12 (C) a systematic processing of publicly ac13 cessible data on a large scale; 

14 (D) processing involving the use of new 

15 technologies, or combinations of technologies, 

16 that causes or materially contributes to privacy 

17 harm; 

18 (E) decisions about an individual’s access 

19 to a product, service, opportunity, or benefit 

20 which is based to any extent on automated deci21 sion system processing; 

22 (F) any profiling of individuals on a large 

23 scale; 

24 (G) any processing of biometric informa25 tion for the purpose of uniquely identifying an 


ssavage on LAPJG3WLY3PROD with BILLS
9 

•S 5170 IS

1 individual, with the exception of one-to-one bio2 metric authentication; 

3 (H) combining, comparing, or matching 

4 personal data obtained from multiple sources; 

5 (I) processing which involves an individ6 ual’s precise geolocation; 

7 (J) the processing of personal data of chil8 dren and teens under 17 or other vulnerable in9 dividuals such as the elderly, people with dis10 abilities, and other groups known to be suscep11 tible for exploitation for marketing purposes, 

12 profiling, or automated processing; or 

13 (K) consumer scoring or other business 

14 practices that pertain to the eligibility of an in15 dividual, and related terms, rights, benefits, and 

16 privileges, for employment (including hiring, fir17 ing, promotion, demotion, and compensation), 

18 credit, insurance, housing, education, profes19 sional certification, or the provision of health 

20 care and related services. 

21 (12) HIGH-RISK DATA PRACTICE IMPACT EVAL22 UATION.—The term ‘‘high-risk data practice impact 

23 evaluation’’ means a study conducted after deploy24 ment of a high-risk data practice that includes, at 

25 a minimum— 


ssavage on LAPJG3WLY3PROD with BILLS
10 

•S 5170 IS

1 (A) an evaluation of a high-risk data prac2 tice’s accuracy, disparate impacts on the basis 

3 of protected class, and privacy harms; 

4 (B) an evaluation of the effectiveness of 

5 measures taken to minimize risks as outlined in 

6 any prior high-risk data practice risk assess7 ments; and 

8 (C) recommended measures to further min9 imize risks to accuracy, disparate impacts on 

10 the basis of protected class, and privacy harms. 

11 (13) HIGH-RISK DATA PRACTICE RISK ASSESS12 MENT.—The term ‘‘high-risk data practice risk as13 sessment’’ means a study evaluating a high-risk data 

14 practice and the high-risk data practice’s develop15 ment process, including the design and training data 

16 of the high-risk data practice, if applicable, for likeli17 hood and severity of risks to accuracy, bias, dis18 crimination, and privacy harms that includes, at a 

19 minimum— 

20 (A) a detailed description of the high-risk 

21 data practice, including— 

22 (i) its design and methodologies; 

23 (ii) training data characteristics; 

24 (iii) data; and 

25 (iv) purpose; 


ssavage on LAPJG3WLY3PROD with BILLS
11 

•S 5170 IS

1 (B) an assessment of the relative benefits 

2 and costs of the high-risk data practice in light 

3 of its purpose, potential unintended con4 sequences, and taking into account relevant fac5 tors, including— 

6 (i) data minimization practices; 

7 (ii) the duration and methods for 

8 which personal data and the results of the 

9 high-risk data practice are stored; 

10 (iii) what information about the high11 risk data practice is available to individ12 uals; 

13 (iv) the extent to which individuals 

14 have access to the results of the high-risk 

15 data practice and may correct or object to 

16 its results; and 

17 (v) the recipients of the results of the 

18 high-risk data practice; 

19 (C) an assessment of the risks of privacy 

20 harm posed by the high-risk data practice and 

21 the risks that the high-risk data practice may 

22 result in or contribute to inaccurate, biased, or 

23 discriminatory decisions impacting individuals 

24 or groups of individuals; 


ssavage on LAPJG3WLY3PROD with BILLS
12 

•S 5170 IS

1 (D) the decision to accept, reject, or miti2 gate and minimize risks and the measures a 

3 data aggregator will employ including to mini4 mize the risks described in subparagraph (C), 

5 including technological and physical safeguards; 

6 (E) an assessment of the environmental 

7 footprint on the development and use system in 

8 terms of carbon emissions; and 

9 (F) any potential or permitted use of the 

10 outputs of the high-risk data for other decisions 

11 or purposes such as advertising targeting. 

12 (14) INDIVIDUAL.—The term ‘‘individual’’ 

13 means a natural person. 

14 (15) PERSON.—The term ‘‘person’’ means an 

15 individual, a local, State, or Federal governmental 

16 entity, a partnership, a company, a corporation, an 

17 association (incorporated or unincorporated), a 

18 trust, an estate, a cooperative organization, another 

19 entity, or any other organization or group of such 

20 entities acting in concert. 

21 (16) PERSONAL DATA.—The term ‘‘personal 

22 data’’ means electronic data that, alone or in com23 bination with other data— 

24 (A) identifies, relates to, describes, is capa25 ble of being associated with, or could reasonably 


ssavage on LAPJG3WLY3PROD with BILLS
13 

•S 5170 IS

1 be linked, directly or indirectly, with a par2 ticular individual, household, or device; or 

3 (B) could be used to determine that an in4 dividual or household is part of a protected 

5 class. 

6 (17) PRECISE GEOLOCATION.—The term ‘‘pre7 cise geolocation’’ means any data that is derived 

8 from a device and that is used or intended to be 

9 used to locate an individual within a geographic area 

10 that is equal to or less than the area of a circle with 

11 a radius of one thousand, eight hundred and fifty 

12 (1,850) feet. 

13 (18) PRIVACY HARM.—The term ‘‘privacy 

14 harm’’ means an adverse consequence, or a potential 

15 adverse consequence, to an individual, a group of in16 dividuals, or society caused, in whole or in part, by 

17 the collection, processing, or sharing of personal 

18 data, including— 

19 (A) direct or indirect financial loss or eco20 nomic harm, including financial loss or eco21 nomic harm arising from fraudulent activities 

22 or data security breaches; 

23 (B) physical harm, harassment, or a threat 

24 to an individual or property; 


ssavage on LAPJG3WLY3PROD with BILLS
14 

•S 5170 IS

1 (C) psychological harm, including anxiety, 

2 embarrassment, fear, other trauma, stigmatiza3 tion, reputational harm, or the revealing or ex4 posing of an individual, or a characteristic of an 

5 individual, in an unexpected way; 

6 (D) an adverse outcome or decision, in7 cluding relating to the eligibility of an indi8 vidual for the rights, benefits, or privileges in 

9 credit and insurance (including the denial of an 

10 application or obtaining less favorable terms), 

11 housing, education, professional certification, 

12 employment (including hiring, firing, promotion, 

13 demotion, and compensation), or the provision 

14 of health care and related services; 

15 (E) discrimination, including both differen16 tial treatment on the basis of a protected class 

17 and disparate impact on a protected class; 

18 (F) the chilling of free expression or action 

19 of an individual, or society generally, due to 

20 perceived or actual pervasive and excessive col21 lection, processing, or sharing of personal data; 

22 (G) the use of information technology to 

23 covertly influence an individual’s decision-mak24 ing, by targeting and exploiting decision-making 

25 vulnerabilities; and 


ssavage on LAPJG3WLY3PROD with BILLS
15 

•S 5170 IS

1 (H) any other adverse consequence, or po2 tential adverse consequence, prohibited by or 

3 defined by Federal privacy laws; provisions of 

4 Federal civil rights laws related to the proc5 essing of personal information; provisions of 

6 Federal consumer protection laws related to the 

7 processing of personal information; the First 

8 Amendment; and other constitutional rights 

9 protecting privacy. 

10 (19) PROCESS.—The term ‘‘process’’ means to 

11 perform an operation or set of operations on per12 sonal data, either manually or by automated means, 

13 including collecting, recording, organizing, struc14 turing, storing, adapting or altering, retrieving, con15 sulting, using, disclosing by transmission, sorting, 

16 classifying, disseminating or otherwise making avail17 able, aligning or combining, restricting, erasing or 

18 destroying. 

19 (20) PROFILE.—The term ‘‘profile’’ means the 

20 use of an automated decision system to process data 

21 (including personal data and other data) to derive, 

22 infer, predict or evaluate information about an indi23 vidual or group, such as the processing of data to 

24 analyze or predict an individual’s identity, at25 tributes, interests or behavior. 


ssavage on LAPJG3WLY3PROD with BILLS
16 

•S 5170 IS

1 (21) PROTECTED CLASS.—The term ‘‘protected 

2 class’’ means the actual or perceived race, color, eth3 nicity, national origin, religion, sex, gender, gender 

4 identity or expression, sexual orientation, familial 

5 status, biometric information, genetic information, 

6 or disability of an individual or a group of individ7 uals. 

8 (22) SERVICE PROVIDER.—The term ‘‘service 

9 provider’’ means a data aggregator that collects, 

10 uses, or shares personal data only on behalf of an11 other data aggregator in order to carry out a per12 missible purpose, and only to the extent of such ac13 tivity. 

14 (23) SHARE.—The term ‘‘share’’ means dis15 seminating, making available, transferring, or other16 wise communicating orally, in writing, or by elec17 tronic or other means, personal data. 

18 SEC. 3. ESTABLISHMENT OF THE DATA PROTECTION AGEN19 CY. 

20 (a) AGENCY ESTABLISHED.—There is established in 

21 the Executive branch an independent agency to be known 

22 as the ‘‘Data Protection Agency’’, which shall regulate 

23 high-risk data practices and the collection, processing, and 

24 sharing of personal data. 

25 (b) DIRECTOR AND DEPUTY DIRECTOR.— 


ssavage on LAPJG3WLY3PROD with BILLS
17 

•S 5170 IS

1 (1) IN GENERAL.—There is established a posi2 tion of the Director of the Data Protection Agency 

3 (referred to in this Act as the ‘‘Director’’), who shall 

4 serve as the head of the Agency. 

5 (2) APPOINTMENT.—Subject to paragraph (3), 

6 the Director shall be appointed by the President, by 

7 and with the advice and consent of the Senate. 

8 (3) QUALIFICATION.—The President shall 

9 nominate the Director from among members of the 

10 public at large who are well qualified for service at 

11 the Agency based on their knowledge and expertise 

12 in— 

13 (A) technology; 

14 (B) protection of personal data; 

15 (C) civil rights and liberties; 

16 (D) law; and 

17 (E) social sciences. 

18 (4) COMPENSATION.— 

19 (A) IN GENERAL.—The Director shall be 

20 compensated at the rate prescribed for level II 

21 of the Executive Schedule under section 5313 

22 of title 5, United States Code. 

23 (B) CONFORMING AMENDMENT.—Section 

24 5313 of title 5, United States Code, is amended 

25 by inserting after the item relating to the FedVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
18 

•S 5170 IS

1 eral Transit Administrator, the following new 

2 item: ‘‘Director of the Data Protection Agen3 cy.’’. 

4 (5) DEPUTY DIRECTOR.—There is established 

5 the position of Deputy Director, who shall— 

6 (A) be appointed by the Director; and 

7 (B) serve as the acting Director in the ab8 sence or unavailability of the Director. 

9 (6) ACTING DIRECTOR.—In the event of the 

10 death, resignation, sickness, or absence of the Direc11 tor, the President shall designate the Deputy Direc12 tor to serve as acting Director until the return of 

13 the Director, or the appointment of a successor pur14 suant to subsection (b). 

15 (c) TERM.— 

16 (1) IN GENERAL.—The Director shall serve for 

17 a term of 5 years. 

18 (2) EXPIRATION OF TERM.—An individual may 

19 serve as Director after the expiration of the term for 

20 which appointed until a successor has been ap21 pointed and qualified. 

22 (3) REMOVAL.—The President may remove the 

23 Director at will. 

24 (4) VACANCY.—A vacancy in the position of Di25 rector that occurs before the expiration of the term 


ssavage on LAPJG3WLY3PROD with BILLS
19 

•S 5170 IS

1 for which a Director was appointed shall be filled in 

2 the manner established under paragraph (2), and 

3 the Director appointed to fill such vacancy shall be 

4 appointed only for the remainder of such term. 

5 (d) SERVICE RESTRICTION.—No Director or Deputy 

6 Director may engage in any other employment during the 

7 period of service of such person as Director or Deputy Di8 rector. 

9 (e) OFFICES.—The principal office of the Agency 

10 shall be in the District of Columbia. The Director may 

11 establish regional offices of the Agency. 

12 (f) APPLICABILITY OF OTHER LAWS.—Except as 

13 otherwise provided expressly by law, all Federal laws deal14 ing with public or Federal contracts, property, works, offi15 cers, employees, budgets, or funds, including the provi16 sions of chapter 5 and 7 of title 5, United States Codes, 

17 shall apply to the exercise of the powers of the Agency. 

18 SEC. 4. EXECUTIVE AND ADMINISTRATIVE POWERS. 

19 (a) POWERS OF THE AGENCY.—The Director is au20 thorized to establish the general powers of the Agency with 

21 respect to all executive and administrative functions, in22 cluding— 

23 (1) the establishment of rules for conducting 

24 the general business of the Agency, in a manner not 

25 inconsistent with this Act; 


ssavage on LAPJG3WLY3PROD with BILLS
20 

•S 5170 IS

1 (2) to bind the Agency and enter into contracts; 

2 (3) directing the establishment and mainte3 nance of divisions or other offices within the Agency, 

4 in order to carry out the responsibilities under this 

5 Act and Federal privacy law, and to satisfy the re6 quirements of applicable law; 

7 (4) to coordinate and oversee the operation of 

8 all administrative, enforcement, and research activi9 ties of the Agency; 

10 (5) to adopt and use a seal; 

11 (6) to determine the character of and necessity 

12 for the obligations by the Agency; 

13 (7) the appointment and supervision of per14 sonnel employed by the Agency; 

15 (8) the distribution of business among per16 sonnel appointed and supervised by the Agency; 

17 (9) the use and expenditure of funds; 

18 (10) implementing this Act and Federal privacy 

19 laws through rules, orders, guidance, interpretations, 

20 statements of policy, examinations, and enforcement 

21 actions; and 

22 (11) performing such other functions as may be 

23 authorized or required by law. 


ssavage on LAPJG3WLY3PROD with BILLS
21 

•S 5170 IS

1 (b) DELEGATION OF AUTHORITY.—The Director 

2 may delegate to any duly authorized employee, representa3 tive, or agent any power vested in the Agency by law. 

4 (c) OFFICE RESPONSIBILITIES.—Notwithstanding 

5 subsections (a) and (b), section 3(a), and any other provi6 sion of law, with respect to the specific functional units 

7 and offices described in section 5(b), the Director— 

8 (1) shall ensure that such functional units and 

9 offices perform the functions, duties, and coordina10 tion assigned to them under the applicable provision 

11 of section 5; and 

12 (2) may not reorganize or rename such units or 

13 offices in a manner not provided for under the appli14 cable provisions of section 5. 

15 (d) AUTONOMY OF AGENCY.—No officer or agency 

16 of the United States shall have any authority to require 

17 the Director or any other officer of the Agency to submit 

18 legislative recommendations, or testimony or comments on 

19 legislation, to any officer or agency of the United States 

20 for approval, comments, or review prior to the submission 

21 of such recommendations, testimony, or comments to the 

22 Congress, if such recommendations, testimony, or com23 ments to the Congress include a statement indicating that 

24 the views expressed therein are those of the Director or 


ssavage on LAPJG3WLY3PROD with BILLS
22 

•S 5170 IS

1 such officer, and do not necessarily reflect the views of 

2 the President. 

3 SEC. 5. ADMINISTRATION. 

4 (a) PERSONNEL.— 

5 (1) APPOINTMENT.— 

6 (A) IN GENERAL.—The Director may fix 

7 the number of, and appoint and direct, all em8 ployees of the Agency, in accordance with the 

9 applicable provisions of title 5, United States 

10 Code. 

11 (B) EMPLOYEES OF THE AGENCY.—The 

12 Director may employ attorneys, compliance ex13 aminers, compliance supervision analysts, 

14 economists, technologists, data scientists, de15 signers, ethicists, privacy experts, statisticians, 

16 and other employees as may be deemed nec17 essary to conduct the business of the Agency. 

18 Unless otherwise provided expressly by law, any 

19 individual appointed under this section shall be 

20 an employee, as defined in section 2105 of title 

21 5, United States Code, and subject to the provi22 sions of such title and other laws generally ap23 plicable to the employees of an Executive agen24 cy. 

25 (C) WAIVER AUTHORITY.— 


ssavage on LAPJG3WLY3PROD with BILLS
23 

•S 5170 IS

1 (i) IN GENERAL.—In making any ap2 pointment under subparagraph (A), the 

3 Director may waive the requirements of 

4 chapter 33 of title 5, United States Code, 

5 and the regulations implementing such 

6 chapter, to the extent necessary to appoint 

7 employees on terms and conditions that 

8 are consistent with those set forth in sec9 tion 11(1) of the Federal Reserve Act (12 

10 U.S.C. 248(1)), while providing for— 

11 (I) fair, credible, and transparent 

12 methods of establishing qualification 

13 requirements for, recruitment for, and 

14 appointments to positions; 

15 (II) fair and open competition 

16 and equitable treatment in the consid17 eration and selection of individuals to 

18 positions; and 

19 (III) fair, credible, and trans20 parent methods of assigning, reas21 signing, detailing, transferring, and 

22 promoting employees. 

23 (ii) VETERANS PREFERENCES.—In 

24 implementing this subparagraph, the Di25 rector shall comply with the provisions of 


ssavage on LAPJG3WLY3PROD with BILLS
24 

•S 5170 IS

1 section 2302(b)(11) of title 5, United 

2 States Code, regarding veterans’ pref3 erence requirements, in a manner con4 sistent with that in which such provisions 

5 are applied under chapter 33 of that title. 

6 The authority under this subparagraph to 

7 waive the requirements of that chapter 33 

8 shall expire 5 years after the date of enact9 ment of this Act. 

10 (D) DUTY TO PROVIDE ADEQUATE STAFF11 ING.—The Director shall ensure that the spe12 cific functional units and offices established 

13 under section 5, as well as other units and of14 fices with supervisory, rulemaking, and enforce15 ment duties, are provided with sufficient staff 

16 to carry out the functions, duties, and coordina17 tion of those units and offices. 

18 (E) LIMITATION ON POLITICAL AP19 POINTEES.— 

20 (i) IN GENERAL.—In appointing em21 ployees of the Agency who are political ap22 pointees, the Director shall ensure that the 

23 number and duties of such political ap24 pointees are as similar as possible to those 

25 of other Federal regulatory agencies. 


ssavage on LAPJG3WLY3PROD with BILLS
25 

•S 5170 IS

1 (ii) POLITICAL APPOINTEES DE2 FINED.—For purposes of this subpara3 graph, the term ‘‘political appointee’’ 

4 means an employee who holds— 

5 (I) a position which has been ex6 cepted from the competitive service by 

7 reason of its confidential, policy-deter8 mining, policymaking, or policy-advo9 cating character; 

10 (II) a position in the Senior Ex11 ecutive Service as a noncareer ap12 pointee (as such term is defined in 

13 section 3132(a) of title 5, United 

14 States Code); or 

15 (III) a position under the Execu16 tive Schedule (subchapter II of chap17 ter 53 of title 5, United States Code). 

18 (2) COMPENSATION.—Notwithstanding any oth19 erwise applicable provision of title 5, United States 

20 Code, concerning compensation, including the provi21 sions of chapter 51 and chapter 53, the following 

22 provisions shall apply with respect to employees of 

23 the Agency: 


ssavage on LAPJG3WLY3PROD with BILLS
26 

•S 5170 IS

1 (A) The rates of basic pay for all employ2 ees of the Agency may be set and adjusted by 

3 the Director. 

4 (B) The Director shall at all times provide 

5 compensation (including benefits) to each class 

6 of employees that, at a minimum, are com7 parable to the compensation and benefits then 

8 being provided by the Board of Governors of 

9 the Federal Reserve System or the Bureau of 

10 Consumer Financial Protection for the cor11 responding class of employees. 

12 (C) All such employees shall be com13 pensated (including benefits) on terms and con14 ditions that are consistent with the terms and 

15 conditions set forth in section 11(l) of the Fed16 eral Reserve Act (12 U.S.C. 248(l)). 

17 (3) LABOR-MANAGEMENT RELATIONS.—Chap18 ter 71 of title 5, United States Code, shall apply to 

19 the Agency and the employees of the Agency. 

20 (b) SPECIFIC FUNCTIONAL UNITS.— 

21 (1) OFFICE OF CIVIL RIGHTS.—The Director 

22 shall establish an office whose powers and duties 

23 shall include— 

24 (A) providing oversight and enforcement of 

25 this Act, rules and orders promulgated under 


ssavage on LAPJG3WLY3PROD with BILLS
27 

•S 5170 IS

1 this Act, and Federal privacy laws to ensure 

2 that the collection, processing, and sharing of 

3 personal data is fair, equitable, and non-dis4 criminatory in treatment and effect; 

5 (B) developing, establishing, and pro6 moting data processing practices that affirma7 tively further equal opportunity to and expand 

8 access to housing, employment, credit, insur9 ance, education, healthcare, and other aspects 

10 of interstate commerce; 

11 (C) coordinating the Agency’s civil rights 

12 efforts with other Federal agencies and State 

13 regulators, as appropriate, to promote con14 sistent, efficient, and effective enforcement of 

15 Federal civil rights laws; 

16 (D) working with civil rights advocates, 

17 privacy organizations, and data aggregators on 

18 the promotion of compliance with the civil 

19 rights provisions under this Act, rules and or20 ders promulgated under this Act, and Federal 

21 privacy laws; 

22 (E) liaising with communities and con23 sumers impacted by practices regulated by this 

24 Act and the Agency, to ensure that their needs 

25 and views are appropriately taken into account; 


ssavage on LAPJG3WLY3PROD with BILLS
28 

•S 5170 IS

1 (F) providing annual reports to Congress 

2 on the efforts of the Agency to fulfill its civil 

3 rights mandate; and 

4 (G) such additional powers and duties as 

5 the Director may determine are appropriate. 

6 (2) RESEARCH.—The Director shall establish a 

7 unit whose functions shall include researching, ana8 lyzing, assessing, and reporting on— 

9 (A) the collection and processing of per10 sonal data, including automated decision sys11 tems; 

12 (B) the collection and processing of per13 sonal data by government agencies, including 

14 contracts between government agencies and 

15 data aggregators; and 

16 (C) unfair, deceptive, or discriminatory 

17 outcomes that result or are likely to result from 

18 the use of automated decision systems, includ19 ing disparate treatment or disparate impact on 

20 the basis of protected class or proxies for pro21 tected class. 

22 (3) COLLECTING AND TRACKING COM23 PLAINTS.— 

24 (A) IN GENERAL.— 


ssavage on LAPJG3WLY3PROD with BILLS
29 

•S 5170 IS

1 (i) ESTABLISHMENT OF UNIT.—The 

2 Director shall establish a unit, the func3 tions of which shall include identifying and 

4 facilitating the development of best prac5 tices for consumers to file a complaint, and 

6 establishing a single toll-free telephone 

7 number, a publicly available website, and a 

8 publicly available database, or utilizing an 

9 existing publicly available database, to fa10 cilitate the centralized collection of, moni11 toring of, and response to complaints re12 garding the collection, processing, and 

13 sharing of personal data. 

14 (ii) WEBSITE REQUIREMENTS.—The 

15 Director shall ensure that— 

16 (I) the landing page of the main 

17 website of the Agency contains a clear 

18 and conspicuous hyperlink to the com19 plaint database described in clause (i) 

20 and shall ensure that such database is 

21 user-friendly and in plain writing, as 

22 that term is defined in section 3 of 

23 the Plain Writing Act of 2010 (5 

24 U.S.C. 301 note); and 


ssavage on LAPJG3WLY3PROD with BILLS
30 

•S 5170 IS

1 (II) that all information on the 

2 website or the database that explains 

3 how a complaint with the Agency, as 

4 well as reports of the Agency with re5 spect to information contained in that 

6 database, shall be provided in each of 

7 the 5 most commonly spoken lan8 guages, other than English, in the 

9 United States, as determined by the 

10 Bureau of the Census on an ongoing 

11 basis, and in formats accessible to in12 dividuals with hearing or vision im13 pairments. 

14 (B) PUBLIC AVAILABILITY OF INFORMA15 TION.— 

16 (i) IN GENERAL.—The Director 

17 shall— 

18 (I) make all complaints available 

19 to the public on a website of the 

20 Agency; 

21 (II) place a clear and con22 spicuous hyperlink on the landing 

23 page of the main website of the Agen24 cy to the website described under sub25 clause (I); and 


ssavage on LAPJG3WLY3PROD with BILLS
31 

•S 5170 IS

1 (III) ensure that such website— 

2 (aa) is searchable and sort3 able by an data aggregator; and 

4 (bb) is user-friendly and 

5 written in plain language. 

6 (ii) REMOVAL OF PERSONAL DATA.— 

7 In making the information described under 

8 clause (i) available to the public, the Direc9 tor shall remove all personal data. 

10 (c) AGENCY OMBUDSMAN.— 

11 (1) ESTABLISHMENT REQUIRED.—The Director 

12 shall appoint an ombudsman. 

13 (2) DUTIES OF OMBUDSMAN.—The ombudsman 

14 appointed in accordance with paragraph (1) shall— 

15 (A) act as a liaison between the Agency 

16 and any affected person with respect to any 

17 problem that such person may have in dealing 

18 with the Agency, resulting from the regulatory 

19 activities of the Agency; and 

20 (B) assure that safeguards exist to encour21 age complainants to come forward and preserve 

22 confidentiality. 

23 SEC. 6. COORDINATION. 

24 The Agency shall coordinate with the Consumer Fi25 nancial Protection Bureau, the Federal Communications 


ssavage on LAPJG3WLY3PROD with BILLS
32 

•S 5170 IS

1 Commission, the Federal Trade Commission, the Depart2 ment of Commerce, the Department of Health and 

3 Human Services, the Department of Housing and Urban 

4 Development, the Department of Education, the Equal 

5 Employment Opportunity Commission, the National Secu6 rity Agency, the National Institute of Standards and 

7 Technology, the White House Office of Science and Tech8 nology Policy, the Cybersecurity and Infrastructure Secu9 rity Agency, and other Federal agencies and State regu10 lators, as appropriate, to promote consistent regulatory 

11 treatment of personal data. 

12 SEC. 7. APPEARANCES BEFORE AND REPORTS TO CON13 GRESS. 

14 (a) APPEARANCES BEFORE CONGRESS.—The Direc15 tor of the Agency shall appear before Congress at semi16 annual hearings regarding the reports required under sub17 section (b). 

18 (b) REPORTS REQUIRED.—The Agency shall, concur19 rent with each semi-annual hearing referred to in sub20 section (a), prepare and submit to the President and Con21 gress, a report, beginning with the session following the 

22 designated transfer date, and shall publish such report on 

23 the website of the Agency. 

24 (c) CONTENTS.—The reports required by subsection 

25 (b) shall include— 


ssavage on LAPJG3WLY3PROD with BILLS
33 

•S 5170 IS

1 (1) a discussion of the significant problems 

2 faced by persons in exercising their rights under this 

3 Act and Federal privacy laws; 

4 (2) a justification of the budget request of the 

5 previous year; 

6 (3) a list of the significant rules and orders 

7 adopted by the Agency, as well as other significant 

8 initiatives conducted by the Agency, during the pre9 ceding year and the plan of the Agency for rules, or10 ders, or other initiatives to be undertaken during the 

11 upcoming period; 

12 (4) an analysis of complaints about practices 

13 relating to the collection, processing, or sharing of 

14 personal data that the Agency has received and col15 lected in its central database on complaints during 

16 the preceding year; 

17 (5) a list, with a brief statement of the issues, 

18 of the public supervisory and enforcement actions to 

19 which the Agency was a party during the preceding 

20 year; 

21 (6) the actions taken regarding rules, orders, 

22 and supervisory actions with respect to data 

23 aggregators; 


ssavage on LAPJG3WLY3PROD with BILLS
34 

•S 5170 IS

1 (7) an assessment of significant actions by 

2 State attorneys general or State regulators relating 

3 to this Act or other Federal privacy laws; 

4 (8) an analysis of the efforts of the Agency to 

5 fulfill the civil rights mandate of the Agency; and 

6 (9) an analysis of the efforts of the Agency to 

7 increase workforce and contracting diversity. 

8 SEC. 8. FUNDING; PENALTIES AND FINES. 

9 (a) FUNDING.— 

10 (1) ASSESSMENTS, FEES, CHARGES.— 

11 (A) GENERAL AUTHORITY.—The Director 

12 may collect an assessment, fee, or other charge 

13 from a data aggregator that has annual gross 

14 revenues that exceed $25,000,000 or annually 

15 collects, uses, or shares, alone or in combina16 tion, the personal data of 50,000 or more indi17 viduals, households, or devices. 

18 (B) DETERMINATION OF AMOUNT.—In es19 tablishing the amount of any assessment, fee, 

20 or charge collected from a data aggregator 

21 under this section, the Director may take into 

22 account any factor that the Director determines 

23 is appropriate. 

24 (2) AUTHORITY OF DIRECTOR.—The Director 

25 shall have sole authority to determine the manner in 


ssavage on LAPJG3WLY3PROD with BILLS
35 

•S 5170 IS

1 which the obligations of the Agency shall be incurred 

2 and its disbursements and expenses allowed and 

3 paid, in accordance with this section, except as pro4 vided in chapter 71 of title 5, United States Code 

5 (with respect to compensation). 

6 (b) DATA PROTECTION AGENCY FUND.— 

7 (1) SEPARATE FUND IN FEDERAL RESERVE ES8 TABLISHED.—There is established in the Federal 

9 Reserve a separate fund, to be known as the ‘‘Data 

10 Protection Agency Fund’’ (referred to in this section 

11 as the ‘‘Agency Fund’’). The Agency Fund shall be 

12 maintained and established at a Federal reserve 

13 bank, in accordance with such requirements as the 

14 Board of Governors may impose. 

15 (2) FUND RECEIPTS.—All amounts transferred 

16 to the Agency under subsection (a) shall be depos17 ited into the Agency Fund. 

18 (3) INVESTMENT AUTHORITY.— 

19 (A) AMOUNTS IN AGENCY FUND MAY BE

20 INVESTED.—The Agency may request the 

21 Board of Governors to direct the investment of 

22 the portion of the Agency Fund that is not, in 

23 the judgment of the Agency, required to meet 

24 the current needs of the Agency. 


ssavage on LAPJG3WLY3PROD with BILLS
36 

•S 5170 IS

1 (B) ELIGIBLE INVESTMENTS.—Invest2 ments authorized by this paragraph shall be 

3 made in obligations of the United States or ob4 ligations that are guaranteed as to principal 

5 and interest by the United States, with matu6 rities suitable to the needs of the Agency Fund, 

7 as determined by the Agency. 

8 (C) INTEREST AND PROCEEDS CRED9 ITED.—The interest on, and the proceeds from 

10 the sale or redemption of, any obligations held 

11 in the Agency Fund shall be credited to the 

12 Agency Fund. 

13 (c) USE OF FUNDS.— 

14 (1) IN GENERAL.—Funds obtained by, trans15 ferred to, or credited to the Agency Fund shall be 

16 immediately available to the Agency and under the 

17 control of the Director, and shall remain available 

18 until expended, to pay the expenses of the Agency in 

19 carrying out its duties and responsibilities. The com20 pensation of the Director and other employees of the 

21 Agency and all other expenses thereof may be paid 

22 from, obtained by, transferred to, or credited to the 

23 Agency Fund under this section. 

24 (2) FUNDS THAT ARE NOT GOVERNMENT

25 FUNDS.—Funds obtained by or transferred to the 


ssavage on LAPJG3WLY3PROD with BILLS
37 

•S 5170 IS

1 Agency Fund shall not be construed to be Govern2 ment funds or appropriated monies. 

3 (3) AMOUNTS NOT SUBJECT TO APPORTION4 MENT.—Notwithstanding any other provision of law, 

5 amounts in the Agency Fund and in the Civil Pen6 alty Fund established under subsection (d) shall not 

7 be subject to apportionment for purposes of chapter 

8 15 of title 31, United States Code, or under any 

9 other authority. 

10 (d) PENALTIES AND FINES.— 

11 (1) ESTABLISHMENT OF VICTIMS RELIEF FUND

12 .—There is established in the Federal Reserve a sep13 arate fund, to be known as the ‘‘Data Protection 

14 Civil Penalty Fund’’ (referred to in this section as 

15 the ‘‘Civil Penalty Fund’’). The Civil Penalty Fund 

16 shall be maintained and established at a Federal re17 serve bank, in accordance with such requirements as 

18 the Board of Governors may impose. If the Agency 

19 obtains a civil penalty against any person in any ju20 dicial or administrative action under Federal laws, 

21 the Agency shall deposit into the Civil Penalty Fund, 

22 the amount of the penalty collected. 

23 (2) PAYMENT TO VICTIMS.—Amounts in the 

24 Civil Penalty Fund shall be available to the Agency, 

25 without fiscal year limitation, for payments to the 


ssavage on LAPJG3WLY3PROD with BILLS
38 

•S 5170 IS

1 victims of activities for which civil penalties have 

2 been imposed under this Act and for other violations 

3 of other Federal privacy laws. If individual victims 

4 can be identified through reasonable effort, and the 

5 distributions are sufficiently large to make individual 

6 distributions economically viable, penalties should be 

7 distributed directly to individual victims. To the ex8 tent that individuals cannot be located or such re9 dress, payments or compensation, or other monetary 

10 relief are otherwise not practicable or economically 

11 viable, the Agency may— 

12 (A) use such funds for the purpose of con13 sumer or business education relating to data 

14 protection or for the purpose of engaging in 

15 technological research that the Agency con16 siders necessary to enforce this Act and Federal 

17 privacy laws; and 

18 (B) utilize a cy-pres approach to distribute 

19 funds in order to advance data protection and 

20 privacy in the United States. The Agency may 

21 identify recipients, including charitable and civil 

22 society organizations, whose interests reason23 able approximate those of the victims of the ac24 tivities for which civil penalties have been imVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
39 

•S 5170 IS

1 posed and distribute funds from the Civil Pen2 alty Fund to those recipients. 

3 SEC. 9. PURPOSE, OBJECTIVES, AND FUNCTIONS. 

4 (a) PURPOSE.—The Agency shall seek to protect indi5 viduals’ privacy, prevent and remediate privacy harms, 

6 prevent, remediate, and reduce discrimination on the basis 

7 of protected class through the processing of personal infor8 mation, including both differential treatment on the basis 

9 of a protected class and disparate impact on a protected 

10 class, and limit the collection, processing, and sharing of 

11 personal data; and is authorized to exercise its authorities 

12 under this Act for such purposes. 

13 (b) OBJECTIVES.—The Agency is authorized to exer14 cise its authorities under this Act to— 

15 (1) protect individuals from violations of this 

16 Act, other Federal privacy laws, or rules and orders 

17 issued under this Act; 

18 (2) promote and affirmatively further equal op19 portunity in all aspects of economic life as it relates 

20 to the fair and non-discriminatory processing of per21 sonal information; 

22 (3) oversee the use of high-risk data practices; 

23 (4) promote the minimization of collection of 

24 personal data for commercial purposes; 

25 (5) prevent and remediate privacy harms; and 


ssavage on LAPJG3WLY3PROD with BILLS
40 

•S 5170 IS

1 (6) ensure that Federal privacy law is enforced 

2 consistently and in order to protect individuals’ pri3 vacy. 

4 (c) FUNCTIONS.—The primary functions of the Agen5 cy are— 

6 (1) providing leadership and coordination to the 

7 efforts of all Federal departments and agencies to 

8 enforce all Federal statutes, Executive orders, regu9 lations and policies which involve privacy or data 

10 protection; 

11 (2) maximizing effort, promoting efficiency, and 

12 eliminating conflict, competition, duplication, and in13 consistency among the operations, functions, and ju14 risdictions of Federal departments and agencies re15 sponsible for privacy or data protection, and data 

16 protection rights and standards; 

17 (3) providing active leadership, guidance, edu18 cation, and appropriate assistance to private sector 

19 businesses, organizations, groups, institutions, and 

20 individuals regarding privacy and data protection 

21 rights and standards; 

22 (4) requiring and overseeing ex-ante high-risk 

23 data practice risk assessments and ex-post high-risk 

24 data practice impact evaluations to advance fair and 

25 just data practices, including making the assessVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00040 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
41 

•S 5170 IS

1 ments available to the public as practical under the 

2 law; 

3 (5) protecting individuals and groups of individ4 uals from privacy harms; 

5 (6) examining the social, ethical, economic, and 

6 civil rights impacts of data collection and processing 

7 practices and proposing remedies; 

8 (7) protecting civil rights, combating unlawful 

9 discrimination, and affirmatively furthering equal 

10 opportunity as they relate to the processing of per11 sonal information; 

12 (8) ensuring that high-risk data privacy prac13 tices are fair, just, non-deceptive, and do not dis14 criminate against a protected class; 

15 (9) collecting, researching, and responding to 

16 complaints; 

17 (10) developing model privacy and data protec18 tion standards, guidelines, and policies for use by 

19 the private sector; and 

20 (11) enforcing other privacy statutes and rules 

21 as authorized by Congress. 

22 SEC. 10. RULEMAKING AUTHORITY. 

23 (a) IN GENERAL.—The Agency is authorized to exer24 cise its authorities under this Act to administer, enforce, 


ssavage on LAPJG3WLY3PROD with BILLS
42 

•S 5170 IS

1 and otherwise implement the provisions of this Act and 

2 Federal privacy law. 

3 (b) RULEMAKING, ORDERS, AND GUIDANCE.— 

4 (1) GENERAL AUTHORITY.—The Director may 

5 prescribe rules and issue orders and guidance, as 

6 may be necessary or appropriate to enable the Agen7 cy to administer and carry out the purposes and ob8 jectives of this Act and other Federal privacy laws, 

9 and to prevent evasions of this Act and other Fed10 eral privacy laws. 

11 (2) REGULATIONS.—The Agency shall issue 

12 such regulations, after notice and comment in ac13 cordance with section 553 of title 5, United States 

14 Code, as may be necessary to carry out this Act. 

15 The Agency shall prescribe rules applicable to a data 

16 aggregator or service provider identifying— 

17 (A) high-risk data practices in connection 

18 with the collection, processing, or sharing of 

19 personal data, which may include requirements 

20 for the purpose of auditing, preventing, or re21 stricting such acts or practices; 

22 (B) acts or practices in connection with the 

23 collection, processing, or sharing of personal 

24 data that causes or are likely to cause privacy 

25 harm to individuals or groups of individuals, 


ssavage on LAPJG3WLY3PROD with BILLS
43 

•S 5170 IS

1 which may include requirements for the purpose 

2 of preventing or restricting such acts or prac3 tices; 

4 (C) unlawful, unfair, deceptive, abusive, or 

5 discriminatory acts or practices in connection 

6 with the collection, processing, or sharing of 

7 personal data, which may include requirements 

8 for the purpose of preventing or restricting such 

9 acts or practices, for the purpose of preventing 

10 disparate impacts on the basis of protected 

11 class, or for the purpose of affirmatively fur12 thering equal opportunity; 

13 (D) rights that data aggregators must pro14 vide to individuals, including the right to access 

15 and correct, limit the processing of, and request 

16 deletion of the individual’s personal data; and 

17 (E) obligations on data aggregators, in18 cluding transparency about business practices, 

19 data collection limitations, processing and dis20 closure limitations, purpose specification and 

21 legal basis for processing requirements, ac22 countability requirements, confidentiality and 

23 security requirements, and data accuracy re24 quirements. 


ssavage on LAPJG3WLY3PROD with BILLS
44 

•S 5170 IS

1 (3) NO LIMITATION.—Rules prescribed under 

2 this section shall not limit the authority of the Agen3 cy to administer, enforce, and otherwise implement 

4 the provisions of this Act and Federal privacy law. 

5 (4) STANDARDS FOR RULEMAKING.—In pre6 scribing a rule under this Act or Federal privacy 

7 laws— 

8 (A) the Agency shall consider the impact 

9 of proposed rules on an individual or groups of 

10 individuals; 

11 (B) the Agency may provide that a rule 

12 shall only apply to a subcategory of data 

13 aggregators, as defined by the Agency; and 

14 (C) the Agency shall consult with civil soci15 ety groups and members of the public. 

16 (5) RULE OF CONSTRUCTION.—Nothing in this 

17 paragraph may be construed to require the Agency 

18 to engage in cost-benefit analysis or submit a rule19 making for review to the President or the Office of 

20 Management and Budget. 

21 (6) STANDARD FOR REVIEW.—If this Act is si22 lent or ambiguous, and the Agency has followed the 

23 procedures in section 553 or 554 of title 5, United 

24 States Code, as applicable, a reviewing court shall 


ssavage on LAPJG3WLY3PROD with BILLS
45 

•S 5170 IS

1 defer to the Agency’s reasonable or permissible in2 terpretation of this Act. 

3 (c) MONITORING.—In order to support its rule4 making and other functions, the Agency shall monitor for 

5 risks to individuals or groups of individuals in the collec6 tion, processing, or sharing of personal data. 

7 SEC. 11. SUPERVISION OF DATA AGGREGATORS. 

8 (a) IN GENERAL.—A large data aggregator is a data 

9 aggregator that satisfies one or more of the following 

10 thresholds: 

11 (1) The data aggregator has annual gross reve12 nues that exceed $25,000,000. 

13 (2) The data aggregator annually collects, uses, 

14 or shares, alone or in combination, the personal data 

15 of 50,000 or more individuals, households, or de16 vices. 

17 (b) SUPERVISION.—The Agency may require reports 

18 and conduct examinations on a periodic basis of large data 

19 aggregators described in subsection (a) for purposes of— 

20 (1) assessing compliance with the requirements 

21 of this Act, rules and orders issued by the Agency, 

22 or other Federal privacy laws; 

23 (2) obtaining information about the activities 

24 subject to such laws and the associated compliance 

25 systems or procedures of such entities; 


ssavage on LAPJG3WLY3PROD with BILLS
46 

•S 5170 IS

1 (3) detecting and assessing associated risks to 

2 individuals and groups of individuals; and 

3 (4) requiring and overseeing high-risk data 

4 practice risk impact assessments and high-risk data 

5 practice impact evaluations to advance fair and just 

6 data practices. 

7 (c) PUBLICLY ACCESSIBLE LIST.—The Agency shall 

8 maintain a publicly accessible list of data aggregators that 

9 collect, process, or share personal data of more than 

10 10,000 persons or households, and the permissible pur11 poses for which the data aggregators purport to collect 

12 personal data. 

13 (d) MERGER REVIEW.—The Agency shall conduct a 

14 review and submit to the Federal Trade Commission and 

15 Department of Justice a report on the privacy and data 

16 protection implications of— 

17 (1) any merger involving a data aggregator de18 scribed in subsection (a); or 

19 (2) any merger that proposes the transfer of 

20 personal data of 50,000 or more individuals. 

21 SEC. 12. PROHIBITED ACTS. 

22 It shall be unlawful for— 

23 (1) any data aggregator or service provider to 

24 commit any act or omission in violation of this Act, 


ssavage on LAPJG3WLY3PROD with BILLS
47 

•S 5170 IS

1 Federal privacy law, or any rule or order issued by 

2 the Agency under this Act; 

3 (2) any data aggregator or service provider to 

4 commit any unlawful, unfair, deceptive, abusive, or 

5 discriminatory acts or practices in connection with 

6 the collection, processing, or sharing of personal 

7 data; 

8 (3) any data aggregator or service provider to 

9 fail or refuse as required by this Act or Federal pri10 vacy law, or any rule or order issued by the Agency 

11 thereunder— 

12 (A) to permit access to or copying of 

13 records; 

14 (B) to establish or maintain records; or 

15 (C) to make reports or provide information 

16 to the Agency; 

17 (4) any person to knowingly or recklessly pro18 vide substantial assistance to a data aggregator or 

19 service provider in violation of this Act or Federal 

20 privacy law, or any rule or order issued thereunder, 

21 and notwithstanding any provision of this Act, the 

22 provider of such substantial assistance shall be 

23 deemed to be in violation of this Act or Federal pri24 vacy law to the same extent as the person to whom 

25 substantial assistance is provided; or 


ssavage on LAPJG3WLY3PROD with BILLS
48 

•S 5170 IS

1 (5) any person, data aggregator, or service pro2 vider to re-identify, or attempt to re-identify, an in3 dividual, household, or device from anonymized data, 

4 unless such person, data aggregator, or service pro5 vider is conducting authorized testing to prove per6 sonal data has been anonymized. 

7 SEC. 13. ENFORCEMENT POWERS. 

8 (a) DEFINITIONS.—For purposes of this section, the 

9 following definitions shall apply: 

10 (1) AGENCY INVESTIGATION.—The term 

11 ‘‘Agency investigation’’ means any inquiry conducted 

12 by an Agency investigator for the purpose of 

13 ascertaining whether any person is or has been en14 gaged in any conduct that is a violation, as defined 

15 in this section. 

16 (2) AGENCY INVESTIGATOR.—The term ‘‘Agen17 cy investigator’’ means any attorney or investigator 

18 employed by the Agency who is charged with the 

19 duty of enforcing or carrying into effect this Act any 

20 other Federal privacy law. 

21 (3) CUSTODIAN.—The term ‘‘custodian’’ means 

22 the custodian or any deputy custodian designated by 

23 the Agency. 

24 (4) DOCUMENTARY MATERIAL.—The term 

25 ‘‘documentary material’’ includes the original or any 


ssavage on LAPJG3WLY3PROD with BILLS
49 

•S 5170 IS

1 copy of any book, document, record, report, memo2 randum, paper, communication, tabulation, chart, 

3 logs, electronic files, or other data or data compila4 tions stored in any medium. 

5 (5) VIOLATION.—The term ‘‘violation’’ means 

6 any act or omission that, if proved, would constitute 

7 a violation of any provision of this Act or any other 

8 Federal privacy law. 

9 (b) INVESTIGATIONS AND ADMINISTRATIVE DIS10 COVERY.— 

11 (1) JOINT INVESTIGATIONS.— 

12 (A) IN GENERAL.—The Agency or, where 

13 appropriate, an Agency investigator, may en14 gage in joint investigations and requests for in15 formation, as authorized under this Act. 

16 (B) CIVIL RIGHTS.—The authority under 

17 subparagraph (A) includes matters relating to 

18 protection of individuals’ civil rights under this 

19 Act and joint investigations with, and requests 

20 for information from, the Director of the Bu21 reau of Consumer Financial Protection, the 

22 Federal Trade Commission, the Secretary of 

23 Housing and Urban Development, the Depart24 ment of Education, the Equal Employment Op25 portunity Commission, the Department of 


ssavage on LAPJG3WLY3PROD with BILLS
50 

•S 5170 IS

1 Health and Human Services, or the Attorney 

2 General. 

3 (2) SUBPOENAS.— 

4 (A) IN GENERAL.—The Agency or an 

5 Agency investigator may issue subpoenas for 

6 the attendance and testimony of witnesses and 

7 the production of relevant papers, books, docu8 ments, or other material in connection with 

9 hearings under this Act. 

10 (B) FAILURE TO OBEY.—In the case of 

11 contumacy or refusal to obey a subpoena issued 

12 pursuant to this subparagraph and served upon 

13 any person, the district court of the United 

14 States for any district in which such person is 

15 found, resides, or transacts business, upon ap16 plication by the Agency or an Agency investi17 gator and after notice to such person, may 

18 issue an order requiring such person to appear 

19 and give testimony or to appear and produce 

20 documents or other material. 

21 (C) CONTEMPT.—Any failure to obey an 

22 order of the court under this subparagraph may 

23 be punished by the court as a contempt thereof. 

24 (3) DEMANDS.— 


ssavage on LAPJG3WLY3PROD with BILLS
51 

•S 5170 IS

1 (A) IN GENERAL.—Whenever the Agency 

2 has reason to believe that any person may be in 

3 possession, custody, or control of any documen4 tary material or tangible things, or may have 

5 any information, relevant to a violation, the 

6 Agency may, before the institution of any pro7 ceedings under this Act, issue in writing, and 

8 cause to be served upon such person, a civil in9 vestigative demand requiring such person to— 

10 (i) produce such documentary mate11 rial for inspection and copying or repro12 duction in the form or medium requested 

13 by the Agency; 

14 (ii) submit such tangible things; 

15 (iii) file written reports or answers to 

16 questions; 

17 (iv) give oral testimony concerning 

18 documentary material, tangible things, or 

19 other information; or 

20 (v) furnish any combination of such 

21 material, answers, or testimony. 

22 (B) REQUIREMENTS.—Each civil investiga23 tive demand shall state the nature of the con24 duct constituting the alleged violation which is 


ssavage on LAPJG3WLY3PROD with BILLS
52 

•S 5170 IS

1 under investigation and the provision of law ap2 plicable to such violation. 

3 (C) PRODUCTION OF DOCUMENTS.—Each 

4 civil investigative demand for the production of 

5 documentary material shall— 

6 (i) describe each class of documentary 

7 material to be produced under the demand 

8 with such definiteness and certainty as to 

9 permit such material to be fairly identified; 

10 (ii) prescribe a return date or dates 

11 which will provide a reasonable period of 

12 time within which the material so de13 manded may be assembled and made avail14 able for inspection and copying or repro15 duction; and 

16 (iii) identify the custodian to whom 

17 such material shall be made available. 

18 (D) PRODUCTION OF THINGS.—Each civil 

19 investigative demand for the submission of tan20 gible things shall— 

21 (i) describe each class of tangible 

22 things to be submitted under the demand 

23 with such definiteness and certainty as to 

24 permit such things to be fairly identified; 


ssavage on LAPJG3WLY3PROD with BILLS
53 

•S 5170 IS

1 (ii) prescribe a return date or dates 

2 which will provide a reasonable period of 

3 time within which the things so demanded 

4 may be assembled and submitted; and 

5 (iii) identify the custodian to whom 

6 such things shall be submitted. 

7 (E) DEMAND FOR WRITTEN REPORTS OR

8 ANSWERS.—Each civil investigative demand for 

9 written reports or answers to questions shall— 

10 (i) propound with definiteness and 

11 certainty the reports to be produced or the 

12 questions to be answered; 

13 (ii) prescribe a date or dates at which 

14 time written reports or answers to ques15 tions shall be submitted; and 

16 (iii) identify the custodian to whom 

17 such reports or answers shall be submitted. 

18 (F) ORAL TESTIMONY.—Each civil inves19 tigative demand for the giving of oral testimony 

20 shall— 

21 (i) prescribe a date, time, and place at 

22 which oral testimony shall be commenced; 

23 and 

24 (ii) identify an Agency investigator 

25 who shall conduct the investigation and the 


ssavage on LAPJG3WLY3PROD with BILLS
54 

•S 5170 IS

1 custodian to whom the transcript of such 

2 investigation shall be submitted. 

3 (G) SERVICE.—Any civil investigative de4 mand issued, and any enforcement petition 

5 filed, under this paragraph may be served— 

6 (i) by any Agency investigator at any 

7 place within the territorial jurisdiction of 

8 any court of the United States; and 

9 (ii) upon any person who is not found 

10 within the territorial jurisdiction of any 

11 court of the United States— 

12 (I) in such manner as the Fed13 eral Rules of Civil Procedure prescribe 

14 for service in a foreign nation; and 

15 (II) to the extent that the courts 

16 of the United States have authority to 

17 assert jurisdiction over such person, 

18 consistent with due process, the 

19 United States District Court for the 

20 District of Columbia shall have the 

21 same jurisdiction to take any action 

22 respecting compliance with this sec23 tion by such person that such district 

24 court would have if such person were 


ssavage on LAPJG3WLY3PROD with BILLS
55 

•S 5170 IS

1 personally within the jurisdiction of 

2 such district court. 

3 (H) METHOD OF SERVICE.—Service of any 

4 civil investigative demand or any enforcement 

5 petition filed under this paragraph may be 

6 made upon a person, including any legal entity, 

7 by— 

8 (i) delivering a duly executed copy of 

9 such demand or petition to the individual 

10 or to any partner, executive officer, man11 aging agent, or general agent of such per12 son, or to any agent of such person author13 ized by appointment or by law to receive 

14 service of process on behalf of such person; 

15 (ii) delivering a duly executed copy of 

16 such demand or petition to the principal 

17 office or place of business of the person to 

18 be served; or 

19 (iii) depositing a duly executed copy in 

20 the United States mails, by registered or 

21 certified mail, return receipt requested, 

22 duly addressed to such person at the prin23 cipal office or place of business of such 

24 person. 

25 (I) PROOF OF SERVICE.— 


ssavage on LAPJG3WLY3PROD with BILLS
56 

•S 5170 IS

1 (i) IN GENERAL.—A verified return by 

2 the individual serving any civil investiga3 tive demand or any enforcement petition 

4 filed under this paragraph setting forth the 

5 manner of such service shall be proof of 

6 such service. 

7 (ii) RETURN RECEIPTS.—In the case 

8 of service by registered or certified mail, 

9 such return shall be accompanied by the 

10 return post office receipt of delivery of 

11 such demand or enforcement petition. 

12 (J) PRODUCTION OF DOCUMENTARY MATE13 RIAL.—The production of documentary material 

14 in response to a civil investigative demand shall 

15 be made under a sworn certificate, in such form 

16 as the demand designates, by the person, if a 

17 natural person, to whom the demand is directed 

18 or, if not a natural person, by any person hav19 ing knowledge of the facts and circumstances 

20 relating to such production, to the effect that 

21 all of the documentary material required by the 

22 demand and in the possession, custody, or con23 trol of the person to whom the demand is di24 rected has been produced and made available to 

25 the custodian. 


ssavage on LAPJG3WLY3PROD with BILLS
57 

•S 5170 IS

1 (K) SUBMISSION OF TANGIBLE THINGS.— 

2 The submission of tangible things in response 

3 to a civil investigative demand shall be made 

4 under a sworn certificate, in such form as the 

5 demand designates, by the person to whom the 

6 demand is directed or, if not a natural person, 

7 by any person having knowledge of the facts 

8 and circumstances relating to such production, 

9 to the effect that all of the tangible things re10 quired by the demand and in the possession, 

11 custody, or control of the person to whom the 

12 demand is directed have been submitted to the 

13 custodian. 

14 (L) SEPARATE ANSWERS.—Each reporting 

15 requirement or question in a civil investigative 

16 demand shall be answered separately and fully 

17 in writing under oath, unless it is objected to, 

18 in which event the reasons for the objection 

19 shall be stated in lieu of an answer, and it shall 

20 be submitted under a sworn certificate, in such 

21 form as the demand designates, by the person, 

22 if a natural person, to whom the demand is di23 rected or, if not a natural person, by any per24 son responsible for answering each reporting re25 quirement or question, to the effect that all inVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00057 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
58 

•S 5170 IS

1 formation required by the demand and in the 

2 possession, custody, control, or knowledge of 

3 the person to whom the demand is directed has 

4 been submitted. 

5 (M) TESTIMONY.— 

6 (i) IN GENERAL.— 

7 (I) OATH AND RECORDATION.— 

8 The examination of any person pursu9 ant to a demand for oral testimony 

10 served under this paragraph shall be 

11 taken before an officer authorized to 

12 administer oaths and affirmations by 

13 the laws of the United States or of 

14 the place at which the examination is 

15 held. The officer before whom oral 

16 testimony is to be taken shall put the 

17 witness on oath or affirmation and 

18 shall personally, or by any individual 

19 acting under the direction of and in 

20 the presence of the officer, record the 

21 testimony of the witness. 

22 (II) TRANSCRIPTION.—The testi23 mony shall be taken stenographically 

24 and transcribed. 


ssavage on LAPJG3WLY3PROD with BILLS
59 

•S 5170 IS

1 (III) TRANSMISSION TO CUSTO2 DIAN.—After the testimony is fully 

3 transcribed, the officer investigator 

4 before whom the testimony is taken 

5 shall promptly transmit a copy of the 

6 transcript of the testimony to the cus7 todian. 

8 (ii) PARTIES PRESENT.—Any Agency 

9 investigator before whom oral testimony is 

10 to be taken shall exclude from the place 

11 where the testimony is to be taken all 

12 other persons, except the person giving the 

13 testimony, the attorney for that person, 

14 the officer before whom the testimony is to 

15 be taken, an investigator or representative 

16 of an agency with which the Agency is en17 gaged in a joint investigation, and any ste18 nographer taking such testimony. 

19 (iii) LOCATION.—The oral testimony 

20 of any person taken pursuant to a civil in21 vestigative demand shall be taken in the 

22 judicial district of the United States in 

23 which such person resides, is found, or 

24 transacts business, or in such other place 

25 as may be agreed upon by the Agency inVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00059 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
60 

•S 5170 IS

1 vestigator before whom the oral testimony 

2 of such person is to be taken and such per3 son. 

4 (iv) ATTORNEY REPRESENTATION.— 

5 (I) IN GENERAL.—Any person 

6 compelled to appear under a civil in7 vestigative demand for oral testimony 

8 pursuant to this section may be ac9 companied, represented, and advised 

10 by an attorney. 

11 (II) AUTHORITY.—The attorney 

12 may advise a person described in sub13 clause (I), in confidence, either upon 

14 the request of such person or upon 

15 the initiative of the attorney, with re16 spect to any question asked of such 

17 person. 

18 (III) OBJECTIONS.—A person de19 scribed in subclause (I), or the attor20 ney for that person, may object on the 

21 record to any question, in whole or in 

22 part, and such person shall briefly 

23 state for the record the reason for the 

24 objection. An objection may properly 

25 be made, received, and entered upon 


ssavage on LAPJG3WLY3PROD with BILLS
61 

•S 5170 IS

1 the record when it is claimed that 

2 such person is entitled to refuse to an3 swer the question on grounds of any 

4 constitutional or other legal right or 

5 privilege, including the privilege 

6 against self-incrimination, but such 

7 person shall not otherwise object to or 

8 refuse to answer any question, and 

9 such person or attorney shall not oth10 erwise interrupt the oral examination. 

11 (IV) REFUSAL TO ANSWER.—If a 

12 person described in subclause (I) re13 fuses to answer any question— 

14 (aa) the Agency may peti15 tion the district court of the 

16 United States pursuant to this 

17 section for an order compelling 

18 such person to answer such ques19 tion; and 

20 (bb) if the refusal is on 

21 grounds of the privilege against 

22 self-incrimination, the testimony 

23 of such person may be compelled 

24 in accordance with the provisions 


ssavage on LAPJG3WLY3PROD with BILLS
62 

•S 5170 IS

1 of section 6004 of title 18, 

2 United States Code. 

3 (v) TRANSCRIPTS.—For purposes of 

4 this paragraph— 

5 (I) after the testimony of any 

6 witness is fully transcribed, the Agen7 cy investigator shall afford the witness 

8 (who may be accompanied by an at9 torney) a reasonable opportunity to 

10 examine the transcript; 

11 (II) the transcript shall be read 

12 to or by the witness, unless such ex13 amination and reading are waived by 

14 the witness; 

15 (III) any changes in form or sub16 stance which the witness desires to 

17 make shall be entered and identified 

18 upon the transcript by the Agency in19 vestigator, with a statement of the 

20 reasons given by the witness for mak21 ing such changes; 

22 (IV) the transcript shall be 

23 signed by the witness, unless the wit24 ness in writing waives the signing, is 


ssavage on LAPJG3WLY3PROD with BILLS
63 

•S 5170 IS

1 ill, cannot be found, or refuses to 

2 sign; and 

3 (V) if the transcript is not signed 

4 by the witness during the 30-day pe5 riod following the date on which the 

6 witness is first afforded a reasonable 

7 opportunity to examine the transcript, 

8 the Agency investigator shall sign the 

9 transcript and state on the record the 

10 fact of the waiver, illness, absence of 

11 the witness, or the refusal to sign, to12 gether with any reasons given for the 

13 failure to sign. 

14 (vi) CERTIFICATION BY INVESTI15 GATOR.—The Agency investigator shall 

16 certify on the transcript that the witness 

17 was duly sworn by him or her and that the 

18 transcript is a true record of the testimony 

19 given by the witness, and the Agency in20 vestigator shall promptly deliver the tran21 script or send it by registered or certified 

22 mail to the custodian. 

23 (vii) COPY OF TRANSCRIPT.—The 

24 Agency investigator shall furnish a copy of 

25 the transcript (upon payment of reasonable 


ssavage on LAPJG3WLY3PROD with BILLS
64 

•S 5170 IS

1 charges for the transcript) to the witness 

2 only, except that the Agency may for good 

3 cause limit such witness to inspection of 

4 the official transcript of his testimony. 

5 (viii) WITNESS FEES.—Any witness 

6 appearing for the taking of oral testimony 

7 pursuant to a civil investigative demand 

8 shall be entitled to the same fees and mile9 age which are paid to witnesses in the dis10 trict courts of the United States. 

11 (4) CONFIDENTIAL TREATMENT OF DEMAND

12 MATERIAL.— 

13 (A) IN GENERAL.—Documentary materials 

14 and tangible things received as a result of a 

15 civil investigative demand shall be subject to re16 quirements and procedures regarding confiden17 tiality, in accordance with rules established by 

18 the Agency. 

19 (B) DISCLOSURE TO CONGRESS.—No rule 

20 established by the Agency regarding the con21 fidentiality of materials submitted to, or other22 wise obtained by, the Agency shall be intended 

23 to prevent disclosure to either House of Con24 gress or to an appropriate committee of the 

25 Congress, except that the Agency is permitted 


ssavage on LAPJG3WLY3PROD with BILLS
65 

•S 5170 IS

1 to adopt rules allowing prior notice to any party 

2 that owns or otherwise provided the material to 

3 the Agency and had designated such material 

4 as confidential. 

5 (5) PETITION FOR ENFORCEMENT.— 

6 (A) IN GENERAL.—Whenever any person 

7 fails to comply with any civil investigative de8 mand duly served upon such person under this 

9 section, or whenever satisfactory copying or re10 production of material requested pursuant to 

11 the demand cannot be accomplished and such 

12 person refuses to surrender such material, the 

13 Agency, through such officers or attorneys as it 

14 may designate, may file, in the district court of 

15 the United States for any judicial district in 

16 which such person resides, is found, or trans17 acts business, and serve upon such person, a 

18 petition for an order of such court for the en19 forcement of this paragraph. 

20 (B) SERVICE OF PROCESS.—All process of 

21 any court to which application may be made as 

22 provided in this subparagraph may be served in 

23 any judicial district. 

24 (6) PETITION FOR ORDER MODIFYING OR SET25 TING ASIDE DEMAND.— 


ssavage on LAPJG3WLY3PROD with BILLS
66 

•S 5170 IS

1 (A) IN GENERAL.—Not later than 20 days 

2 after the service of any civil investigative de3 mand upon any person under subparagraph 

4 (B), or at any time before the return date spec5 ified in the demand, whichever period is short6 er, or within such period exceeding 20 days 

7 after service or in excess of such return date as 

8 may be prescribed in writing, subsequent to 

9 service, by any Agency investigator named in 

10 the demand, such person may file with the 

11 Agency a petition for an order by the Agency 

12 modifying or setting aside the demand. 

13 (B) COMPLIANCE DURING PENDENCY.— 

14 The time permitted for compliance with the de15 mand in whole or in part, as determined proper 

16 and ordered by the Agency, shall not run dur17 ing the pendency of a petition under clause (i) 

18 at the Agency, except that such person shall 

19 comply with any portions of the demand not 

20 sought to be modified or set aside. 

21 (C) SPECIFIC GROUNDS.—A petition under 

22 subparagraph (A) shall specify each ground 

23 upon which the petitioner relies in seeking re24 lief, and may be based upon any failure of the 

25 demand to comply with the provisions of this 


ssavage on LAPJG3WLY3PROD with BILLS
67 

•S 5170 IS

1 section, or upon any constitutional or other 

2 legal right or privilege of such person. 

3 (7) CUSTODIAL CONTROL.—At any time during 

4 which any custodian is in custody or control of any 

5 documentary material, tangible things, reports, an6 swers to questions, or transcripts of oral testimony 

7 given by any person in compliance with any civil in8 vestigative demand, such person may file, in the dis9 trict court of the United States for the judicial dis10 trict within which the office of such custodian is sit11 uated, and serve upon such custodian, a petition for 

12 an order of such court requiring the performance by 

13 such custodian of any duty imposed upon him by 

14 this section or rule promulgated by the Agency. 

15 (8) JURISDICTION OF COURT.— 

16 (A) IN GENERAL.—Whenever any petition 

17 is filed in any district court of the United 

18 States under this paragraph, such court shall 

19 have jurisdiction to hear and determine the 

20 matter so presented, and to enter such order or 

21 orders as may be required to carry out the pro22 visions of this section. 

23 (B) APPEAL.—Any final order entered as 

24 described in subparagraph (A) shall be subject 


ssavage on LAPJG3WLY3PROD with BILLS
68 

•S 5170 IS

1 to appeal pursuant to section 1291 of title 28, 

2 United States Code. 

3 (c) HEARINGS AND ADJUDICATORY PROCEEDINGS.— 

4 (1) IN GENERAL.—The Agency is authorized to 

5 conduct hearings and adjudication proceedings with 

6 respect to any person in the manner prescribed by 

7 chapter 5 of title 5, United States Code in order to 

8 ensure or enforce compliance with— 

9 (A) the provisions of this Act and other 

10 Federal privacy laws, including any rules pre11 scribed by the Agency under this Act and other 

12 Federal privacy laws; and 

13 (B) any other Federal privacy law that the 

14 Agency is authorized to enforce, and any rules 

15 or order prescribed thereunder, unless such 

16 Federal privacy law specifically limits the Agen17 cy from conducting a hearing or adjudication 

18 proceeding and only to the extent of such limi19 tation. 

20 (2) SPECIAL RULES FOR CEASE-AND-DESIST

21 PROCEEDINGS.— 

22 (A) ORDERS AUTHORIZED.— 

23 (i) IN GENERAL.—If, in the opinion of 

24 the Agency, any data aggregator is engag25 ing or has engaged in an activity that vioVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00068 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
69 

•S 5170 IS

1 lates a law, rule, or any condition imposed 

2 in writing on the person by the Agency, 

3 the Agency may issue and serve upon the 

4 data aggregator or service provider a no5 tice of charges in respect thereof. 

6 (ii) CONTENT OF NOTICE.—The no7 tice under clause (i) shall contain a state8 ment of the facts constituting the alleged 

9 violation or violations, and shall fix a time 

10 and place at which a hearing will be held 

11 to determine whether an order to cease 

12 and desist should issue against the data 

13 aggregator or service provider, such hear14 ing to be held not earlier than 30 days nor 

15 later than 60 days after the date of service 

16 of such notice, unless an earlier or a later 

17 date is set by the Agency, at the request 

18 of any party so served. 

19 (iii) CONSENT.—Unless the party or 

20 parties served under clause (ii) appear at 

21 the hearing personally or by a duly author22 ized representative, such person shall be 

23 deemed to have consented to the issuance 

24 of the cease-and-desist order. 


ssavage on LAPJG3WLY3PROD with BILLS
70 

•S 5170 IS

1 (iv) PROCEDURE.—In the event of 

2 consent under clause (ii), or if, upon the 

3 record made at any such hearing, the 

4 Agency finds that any violation specified in 

5 the notice of charges has been established, 

6 the Agency may issue and serve upon the 

7 data aggregator or service provider an 

8 order to cease and desist from the violation 

9 or practice. Such order may, by provisions 

10 which may be mandatory or otherwise, re11 quire the data aggregator or service pro12 vider to cease and desist from the subject 

13 activity, and to take affirmative action to 

14 correct the conditions resulting from any 

15 such violation. 

16 (B) EFFECTIVENESS OF ORDER.—A cease17 and-desist order shall become effective at the 

18 expiration of 30 days after the date of service 

19 of an order under subparagraph (A) upon the 

20 data aggregator or service provider concerned 

21 (except in the case of a cease-and-desist order 

22 issued upon consent, which shall become effec23 tive at the time specified therein), and shall re24 main effective and enforceable as provided 

25 therein, except to such extent as the order is 


ssavage on LAPJG3WLY3PROD with BILLS
71 

•S 5170 IS

1 stayed, modified, terminated, or set aside by ac2 tion of the Agency or a reviewing court. 

3 (C) DECISION AND APPEAL.—Any hearing 

4 provided for in this subsection shall be held in 

5 the Federal judicial district or in the territory 

6 in which the residence or principal office or 

7 place of business of the person is located unless 

8 the person consents to another place, and shall 

9 be conducted in accordance with the provisions 

10 of chapter 5 of title 5 of the United States 

11 Code. After such hearing, and within 90 days 

12 after the Agency has notified the parties that 

13 the case has been submitted to the Agency for 

14 final decision, the Agency shall render its deci15 sion (which shall include findings of fact upon 

16 which its decision is predicated) and shall issue 

17 and serve upon each party to the proceeding an 

18 order or orders consistent with the provisions of 

19 this section. Judicial review of any such order 

20 shall be exclusively as provided in this sub21 section. Unless a petition for review is timely 

22 filed in a court of appeals of the United States, 

23 as provided in subparagraph (D), and there24 after until the record in the proceeding has 

25 been filed as provided in subparagraph (D), the 


ssavage on LAPJG3WLY3PROD with BILLS
72 

•S 5170 IS

1 Agency may at any time, upon such notice and 

2 in such manner as the Agency shall determine 

3 proper, modify, terminate, or set aside any such 

4 order. Upon filing of the record as provided, the 

5 Agency may modify, terminate, or set aside any 

6 such order with permission of the court. 

7 (D) APPEAL TO COURT OF APPEALS.—Any 

8 party to any proceeding under this subsection 

9 may obtain a review of any order served pursu10 ant to this subparagraph (other than an order 

11 issued with the consent of the person con12 cerned) by the filing in the court of appeals of 

13 the United States for the circuit in which the 

14 principal office of the covered person is located, 

15 or in the United States Court of Appeals for 

16 the District of Columbia Circuit, within 30 days 

17 after the date of service of such order, a written 

18 petition praying that the order of the Agency be 

19 modified, terminated, or set aside. A copy of 

20 such petition shall be forthwith transmitted by 

21 the clerk of the court to the Agency, and there22 upon the Agency shall file in the court the 

23 record in the proceeding, as provided in section 

24 2112 of title 28 of the United States Code. 

25 Upon the filing of such petition, such court 


ssavage on LAPJG3WLY3PROD with BILLS
73 

•S 5170 IS

1 shall have jurisdiction, which upon the filing of 

2 the record shall except as provided in the last 

3 sentence of subparagraph (C) be exclusive, to 

4 affirm, modify, terminate, or set aside, in whole 

5 or in part, the order of the Agency. Review of 

6 such proceedings shall be had as provided in 

7 chapter 7 of title 5 of the United States Code. 

8 The judgment and decree of the court shall be 

9 final, except that the same shall be subject to 

10 review by the Supreme Court of the United 

11 States, upon certiorari, as provided in section 

12 1254 of title 28 of the United States Code. 

13 (E) NO STAY.—The commencement of pro14 ceedings for judicial review under clause (iv) 

15 shall not, unless specifically ordered by the 

16 court, operate as a stay of any order issued by 

17 the Agency. 

18 (3) SPECIAL RULES FOR TEMPORARY CEASE19 AND-DESIST PROCEEDINGS.— 

20 (A) IN GENERAL.—Whenever the Agency 

21 determines that the violation specified in the 

22 notice of charges served upon a data 

23 aggregator, including a service provider, pursu24 ant to paragraph (2), or the continuation there25 of, is likely to cause the person to be insolvent 


ssavage on LAPJG3WLY3PROD with BILLS
74 

•S 5170 IS

1 or otherwise prejudice the interests of individ2 uals before the completion of the proceedings 

3 conducted pursuant to paragraph (2), the Agen4 cy may issue a temporary order requiring the 

5 data aggregator or service provider to cease and 

6 desist from any such violation or practice and 

7 to take affirmative action to prevent or remedy 

8 such insolvency or other condition pending com9 pletion of such proceedings. Such order may in10 clude any requirement authorized under this 

11 Act. Such order shall become effective upon 

12 service upon the data aggregator or servicer 

13 provider and, unless set aside, limited, or sus14 pended by a court in proceedings authorized by 

15 clause (ii), shall remain effective and enforce16 able pending the completion of the administra17 tive proceedings pursuant to such notice and 

18 until such time as the Agency shall dismiss the 

19 charges specified in such notice, or if a cease20 and-desist order is issued against the person, 

21 until the effective date of such order. 

22 (B) APPEAL.—Not later than 10 days 

23 after the data aggregator or service provider 

24 concerned has been served with a temporary 

25 cease-and-desist order, the data aggregator or 


ssavage on LAPJG3WLY3PROD with BILLS
75 

•S 5170 IS

1 service provider may apply to the United States 

2 district court for the judicial district in which 

3 the residence or principal office or place of busi4 ness of such data aggregator or servicer pro5 vider is located, or the United States District 

6 Court for the District of Columbia, for an in7 junction setting aside, limiting, or suspending 

8 the enforcement, operation, or effectiveness of 

9 such order pending the completion of the ad10 ministrative proceedings pursuant to the notice 

11 of charges served upon the data aggregator or 

12 servicer provider under subparagraph (B), and 

13 such court shall have jurisdiction to issue such 

14 injunction. 

15 (C) INCOMPLETE OR INACCURATE

16 RECORDS.— 

17 (i) TEMPORARY ORDER.—If a notice 

18 of charges served under paragraph (2) 

19 specifies, on the basis of particular facts 

20 and circumstances, that the books and 

21 records of a data aggregator or service 

22 provider are so incomplete or inaccurate 

23 that the Agency is unable to determine the 

24 financial condition of that data aggregator 

25 or service provider or the details or purVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00075 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
76 

•S 5170 IS

1 pose of any transaction or transactions 

2 that may have a material effect on the fi3 nancial condition of that person, the Agen4 cy may issue a temporary order requir5 ing— 

6 (I) the cessation of any activity 

7 or practice which gave rise, whether in 

8 whole or in part, to the incomplete or 

9 inaccurate state of the books or 

10 records; or 

11 (II) affirmative action to restore 

12 such books or records to a complete 

13 and accurate state, until the comple14 tion of the proceedings under para15 graph (2)(A). 

16 (ii) EFFECTIVE PERIOD.—Any tem17 porary order issued under clause (i)— 

18 (I) shall become effective upon 

19 service; and 

20 (II) unless set aside, limited, or 

21 suspended by a court in proceedings 

22 under subparagraph (B), shall remain 

23 in effect and enforceable until the ear24 lier of— 


ssavage on LAPJG3WLY3PROD with BILLS
77 

•S 5170 IS

1 (aa) the completion of the 

2 proceeding initiated under para3 graph (2) in connection with the 

4 notice of charges; or 

5 (bb) the date the Agency de6 termines, by examination or oth7 erwise, that the books and 

8 records of the covered person or 

9 service provider are accurate and 

10 reflect the financial condition 

11 thereof. 

12 (4) SPECIAL RULES FOR ENFORCEMENT OF OR13 DERS.— 

14 (A) IN GENERAL.—The Agency may in its 

15 discretion apply to the United States district 

16 court within the jurisdiction of which the prin17 cipal office or place of business of the person is 

18 located, for the enforcement of any effective 

19 and outstanding notice or order issued under 

20 this section, and such court shall have jurisdic21 tion and power to order and require compliance 

22 herewith. 

23 (B) EXCEPTION.—Except as otherwise 

24 provided in this subparagraph, no court shall 

25 have jurisdiction to affect by injunction or othVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00077 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
78 

•S 5170 IS

1 erwise the issuance or enforcement of any no2 tice or order or to review, modify, suspend, ter3 minate, or set aside any such notice or order. 

4 (5) RULES.—The Agency shall prescribe rules 

5 establishing such procedures as may be necessary to 

6 carry out this paragraph. 

7 (d) LITIGATION AUTHORITY.— 

8 (1) IN GENERAL.—If any person violates this 

9 Act, a rule or order issued under this Act, or a Fed10 eral privacy law, the Agency may commence a civil 

11 action against such person to impose a civil penalty 

12 or to seek all appropriate legal and equitable relief 

13 including a permanent or temporary injunction as 

14 permitted by law. 

15 (2) REPRESENTATION.—The Agency may act in 

16 its own name and through its own attorneys in en17 forcing any provision of this Act, rules thereunder, 

18 or any other law or regulation, or in any action, suit, 

19 or proceeding to which the Agency is a party. 

20 (3) COMPROMISE OF ACTIONS.—The Agency 

21 may compromise or settle any action if such com22 promise is approved by the court. 

23 (4) NOTICE TO THE ATTORNEY GENERAL.— 

24 (A) IN GENERAL.—When commencing a 

25 civil action under this Act or any Federal priVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00078 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
79 

•S 5170 IS

1 vacy law, or any rule thereunder, the Agency 

2 shall notify the Attorney General. 

3 (B) NOTICE AND COORDINATION.— 

4 (i) NOTICE OF OTHER ACTIONS.—In 

5 addition to any notice required under sub6 paragraph (A), the Agency shall notify the 

7 Attorney General concerning any action, 

8 suit, or proceeding to which the Agency is 

9 a party, except an action, suit, or pro10 ceeding that involves a violation of this Act 

11 or a Federal privacy law. 

12 (ii) COORDINATION.—In order to 

13 avoid conflicts and promote consistency re14 garding litigation of matters under Federal 

15 law, the Attorney General and the Agency 

16 shall consult regarding the coordination of 

17 investigations and proceedings, including 

18 by negotiating an agreement for coordina19 tion by not later than 180 days after the 

20 designated transfer date. The agreement 

21 under this subclause shall include provi22 sions to ensure that parallel investigations 

23 and proceedings involving the Federal pri24 vacy laws are conducted in a manner that 

25 avoids conflicts and does not impede the 


ssavage on LAPJG3WLY3PROD with BILLS
80 

•S 5170 IS

1 ability of the Attorney General to pros2 ecute violations of Federal criminal laws. 

3 (iii) RULE OF CONSTRUCTION.—Noth4 ing in this paragraph shall be construed to 

5 limit the authority of the Agency under 

6 this title, including the authority to inter7 pret Federal privacy law. 

8 (5) APPEARANCE BEFORE THE SUPREME

9 COURT.—The Agency may represent itself in its own 

10 name before the Supreme Court of the United 

11 States, if the Agency makes a written request to the 

12 Attorney General within the 10-day period that be13 gins on the date of entry of the judgment that would 

14 permit any party to file a petition for writ of certio15 rari, and the Attorney General concurs with such re16 quest or fails to take action within 60 days of the 

17 request of the Agency. 

18 (6) FORUM.—Any civil action brought under a 

19 Federal privacy law may be brought in a United 

20 States district court or in any court of competent ju21 risdiction of a State in a district in which the de22 fendant is located or resides or is doing business, 

23 and such court shall have jurisdiction to enjoin such 

24 person and to require compliance with any Federal 

25 privacy law. 


ssavage on LAPJG3WLY3PROD with BILLS
81 

•S 5170 IS

1 (7) TIME FOR BRINGING ACTION.—Except as 

2 otherwise permitted by law or equity, no action may 

3 be brought under this Act or other Federal privacy 

4 law more than 5 years after the date of discovery of 

5 the violation to which an action relates. 

6 (e) RELIEF AVAILABLE.— 

7 (1) ADMINISTRATIVE PROCEEDINGS OR COURT

8 ACTIONS.— 

9 (A) JURISDICTION.—The court (or the 

10 Agency, as the case may be) in an action or ad11 judication proceeding brought under this Act or 

12 a Federal privacy law, shall have jurisdiction to 

13 grant any appropriate legal or equitable relief 

14 with respect to a violation of this Act or Fed15 eral privacy law, including a violation of a rule 

16 or order prescribed under this Act or Federal 

17 privacy law. 

18 (B) RELIEF.—Relief under this section 

19 may include, without limitation— 

20 (i) rescission or reformation of con21 tracts; 

22 (ii) refund of moneys or return of real 

23 property; 

24 (iii) restitution; 


ssavage on LAPJG3WLY3PROD with BILLS
82 

•S 5170 IS

1 (iv) disgorgement of any revenue, 

2 data, or technologies, including automated 

3 decision systems, data sets, or algorithms, 

4 attributable to a violation of this Act, Fed5 eral privacy law, or any rule or order 

6 issued by the Agency under this Act; 

7 (v) payment of damages or other mon8 etary relief; 

9 (vi) public notification regarding the 

10 violation, including the costs of notifica11 tion; 

12 (vii) limits on the activities or func13 tions of the person; and 

14 (viii) civil money penalties, as set 

15 forth more fully in paragraph (3). 

16 (C) NO EXEMPLARY OR PUNITIVE DAM17 AGES.—Nothing in this subparagraph shall be 

18 construed as authorizing the imposition of ex19 emplary or punitive damages in an action 

20 brought by the Agency. 

21 (2) RECOVERY OF COSTS.—In any action 

22 brought by the Agency, a State attorney general, or 

23 any State regulator to enforce this Act or any Fed24 eral privacy law, the Agency, the State attorney gen25 eral, or the State regulator may recover its costs in 


ssavage on LAPJG3WLY3PROD with BILLS
83 

•S 5170 IS

1 connection with prosecuting such action if the Agen2 cy, the State attorney general, or the State regulator 

3 is the prevailing party in the action. 

4 (3) CIVIL MONEY PENALTY IN COURT AND AD5 MINISTRATIVE ACTIONS.— 

6 (A) IN GENERAL.—Any person that vio7 lates, through any act or omission, any provi8 sion of this Act or any Federal privacy law shall 

9 forfeit and pay a civil penalty pursuant to this 

10 subparagraph. 

11 (B) PENALTY AMOUNTS.— 

12 (i) FIRST TIER.—For any violation of 

13 a law, rule, or final order or condition im14 posed in writing by the Agency, a civil pen15 alty may not exceed— 

16 (I) $5,000 for each day during 

17 which such violation or failure to pay 

18 continues; or 

19 (II) $15,000 for each day during 

20 which such violation or failure to pay 

21 continues if such violation involves the 

22 personal data of individuals under the 

23 age of 13. 

24 (ii) SECOND TIER.—Notwithstanding 

25 clause (i), for any person that recklessly 


ssavage on LAPJG3WLY3PROD with BILLS
84 

•S 5170 IS

1 engages in a violation of this Act or any 

2 Federal privacy law, a civil penalty may 

3 not exceed— 

4 (I) $25,000 for each day during 

5 which such violation or failure to pay 

6 continues; or 

7 (II) $75,000 for each day during 

8 which such violation or failure to pay 

9 continues if such violation involves the 

10 personal data of individuals under the 

11 age of 13. 

12 (iii) THIRD TIER.—Notwithstanding 

13 clauses (i) and (ii), for any person that 

14 knowingly violates this Act or any Federal 

15 privacy law, a civil penalty may not ex16 ceed— 

17 (I) $1,000,000 for each day dur18 ing which such violation continues; or 

19 (II) $3,000,000 for each day dur20 ing which such violation or failure to 

21 pay continues if such violation in22 volves the personal data of individuals 

23 under the age of 13. 

24 (C) PENALTIES FOR RE-IDENTIFYING

25 DATA.—Any person that re-identifies, or atVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00084 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
85 

•S 5170 IS

1 tempts to re-identify, anonymized data shall be 

2 assessed a third tier civil penalty under sub3 paragraph (B), unless conducting authorized 

4 testing to prove personal data has been 

5 anonymized. 

6 (D) MITIGATING FACTORS.—In deter7 mining the amount of any penalty assessed 

8 under subparagraph (B), the Agency or the 

9 court shall take into account the appropriate10 ness of the penalty with respect to— 

11 (i) the size of financial resources and 

12 good faith of the person charged; 

13 (ii) the gravity of the violation or fail14 ure to pay; 

15 (iii) the severity of the risks or harms 

16 to individuals; 

17 (iv) the history of previous violations; 

18 and 

19 (v) such other matters as justice may 

20 require. 

21 (E) AUTHORITY TO MODIFY OR REMIT

22 PENALTY.—The Agency may compromise, mod23 ify, or remit any penalty which may be assessed 

24 or had already been assessed under subpara25 graph (B). The amount of such penalty, when 


ssavage on LAPJG3WLY3PROD with BILLS
86 

•S 5170 IS

1 finally determined, shall be exclusive of any 

2 sums owed by the person to the United States 

3 in connection with the costs of the proceeding, 

4 and may be deducted from any sums owed by 

5 the United States to the person charged. 

6 (F) NOTICE AND HEARING.—No civil pen7 alty may be assessed under this subsection with 

8 respect to a violation of this Act or any Federal 

9 privacy law, unless— 

10 (i) the Agency gives notice and an op11 portunity for a hearing to the person ac12 cused of the violation; or 

13 (ii) the appropriate court has ordered 

14 such assessment and entered judgment in 

15 favor of the Agency. 

16 (f) REFERRALS FOR CRIMINAL PROCEEDINGS.—If 

17 the Agency obtains evidence that any person, domestic or 

18 foreign, has engaged in conduct that may constitute a vio19 lation of Federal criminal law, the Agency shall transmit 

20 such evidence to the Attorney General of the United 

21 States, who may institute criminal proceedings under ap22 propriate law. Nothing in this section affects any other 

23 authority of the Agency to disclose information. 


ssavage on LAPJG3WLY3PROD with BILLS
87 

•S 5170 IS

1 SEC. 14. TRANSFERS OF FUNCTIONS. 

2 (a) FEDERAL TRADE COMMISSION.—The authority 

3 of the Federal Trade Commission under a Federal privacy 

4 law to prescribe rules, issue guidelines, or conduct a study 

5 or issue a report mandated under such law shall be trans6 ferred to the Agency on the transfer date. Nothing in this 

7 Act shall be construed to require a mandatory transfer 

8 of any employee of the Federal Trade Commission. 

9 (b) AGENCY AUTHORITY.— 

10 (1) IN GENERAL.—The Agency shall have all 

11 powers and duties under the Federal privacy laws to 

12 prescribe rules, issue guidelines, or to conduct stud13 ies or issue reports mandated by such laws, that 

14 were vested in the Federal Trade Commission on the 

15 day before the transfer date. 

16 (2) FEDERAL TRADE COMMISSION ACT.—The 

17 Agency may enforce a rule prescribed under the 

18 Federal Trade Commission Act (15 U.S.C. 41 et 

19 seq.) by the Federal Trade Commission with respect 

20 to the collection, disclosure, processing and misuse 

21 of personal data. 

22 (c) AUTHORITY OF THE FEDERAL TRADE COMMIS23 SION.—No provision of this Act shall be construed as 

24 modifying, limiting, or otherwise affecting the authority 

25 of the Federal Trade Commission, including the authority 

26 with respect to large data collectors described in section 


ssavage on LAPJG3WLY3PROD with BILLS
88 

•S 5170 IS

1 11(a)(1) of this Act, under the Federal Trade Commission 

2 Act (15 U.S.C. 41 et seq.), or any other law, other than 

3 the authority under a Federal privacy law to prescribe 

4 rules, issue official guidelines, or conduct a study or issue 

5 a report mandated under such law. 

6 (d) AUTHORITY OF THE BUREAU OF CONSUMER FI7 NANCIAL PROTECTION.—No provision of this Act shall be 

8 construed as modifying, limiting, or otherwise affecting 

9 the authority of the Bureau of Consumer Financial Pro10 tection under the Dodd-Frank Wall Street Reform and 

11 Consumer Protection Act (12 U.S.C. 5301 et seq.) or any 

12 other law. 

13 SEC. 15. AUTHORIZATION OF APPROPRIATIONS. 

14 There are authorized to be appropriated to the Agen15 cy such sums as may be necessary to carry out this Act. 

16 SEC. 16. RELATION TO FEDERAL AND STATE LAW. 

17 (a) RELATION TO STATE LAW.— 

18 (1) RULE OF CONSTRUCTION.—This Act may 

19 not be construed as annulling, altering, or affecting, 

20 or exempting any person subject to the provisions of 

21 this title from complying with, the statutes, regula22 tions, orders, or interpretations in effect in any 

23 State, except to the extent that any such provision 

24 of law is inconsistent with the provisions of this title, 

25 and then only to the extent of the inconsistency. 


ssavage on LAPJG3WLY3PROD with BILLS
89 

•S 5170 IS

1 (2) GREATER PROTECTION UNDER STATE

2 LAW.—For purposes of this paragraph, a statute, 

3 regulation, order, or interpretation in effect in any 

4 State is not inconsistent with the provisions of this 

5 title if the protection that such statute, regulation, 

6 order, or interpretation affords to individuals is 

7 greater than the protection provided under this Act. 

8 A determination regarding whether a statute, regu9 lation, order, or interpretation in effect in any State 

10 is inconsistent with the provisions of this title may 

11 be made by the Agency on its own motion or in re12 sponse to a nonfrivolous petition initiated by any in13 terested person. 

14 (b) RELATION TO OTHER PROVISIONS OF FEDERAL

15 PRIVACY LAWS THAT RELATE TO STATE LAW.—No pro16 vision of this Act shall be construed as modifying, limiting, 

17 or superseding the operation of any provision of a Federal 

18 privacy law that relates to the application of a law in effect 

19 in any State with respect to such Federal law. 

20 (c) PRESERVATION OF ENFORCEMENT POWERS OF

21 STATES.—The attorney general (or the equivalent thereof) 

22 of any State may bring a civil action in the name of such 

23 State in any district court of the United States in that 

24 State or in State court that is located in that State and 

25 that has jurisdiction over the defendant, to enforce proviVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00089 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
90 

•S 5170 IS

1 sions of this title or rules or orders issued under this Act, 

2 and to secure remedies under provisions of this title or 

3 remedies otherwise provided under other law. A State reg4 ulator may bring a civil action or other appropriate pro5 ceeding to enforce the provisions of this title or rules or 

6 orders issued under this Act with respect to any entity 

7 that is State-chartered, incorporated, licensed, or other8 wise authorized to do business under State law (except as 

9 provided in paragraph (2)), and to secure remedies under 

10 provisions of this title or remedies otherwise provided 

11 under other provisions of law with respect to such an enti12 ty. 

13 (d) PRESERVATION OF STATE AUTHORITY.— 

14 (1) STATE CLAIMS.—No provision of this sec15 tion shall be construed as altering, limiting, or af16 fecting the authority of a State attorney general or 

17 any other regulatory or enforcement agency or au18 thority to bring an action or other regulatory pro19 ceeding arising solely under the law in effect in that 

20 State. 

21 (2) STATE CONSUMER PROTECTION, PRIVACY, 

22 AND DATA REGULATORS.—No provision of this title 

23 shall be construed as altering, limiting, or affecting 

24 the authority of a State consumer protection, data 

25 protection, or privacy agency (or any agency or ofVerDate Sep 11 2014 00:54 Oct 09, 2024 Jkt 059200 PO 00000 Frm 00090 Fmt 6652 Sfmt 6201 E:\BILLS\S5170.IS S5170

ssavage on LAPJG3WLY3PROD with BILLS
91 

•S 5170 IS

1 fice performing like functions) under State law to 

2 adopt rules, initiate enforcement proceedings, or 

3 take any other action with respect to a person regu4 lated by such commission or authority. 

5 SEC. 17. INSPECTOR GENERAL. 

6 Section 12 of the Inspector General Act of 1978 (5 

7 U.S.C. App.) is amended— 

8 (1) in paragraph (1), by inserting ‘‘the Director 

9 of the Data Protection Agency;’’ after ‘‘the Presi10 dent of the Export-Import Bank;’’; and 

11 (2) in paragraph (2), by inserting ‘‘the Data 

12 Protection Agency,’’ after ‘‘the Export-Import 

13 Bank,’’. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS