I 

★

117TH CONGRESS 

1ST SESSION H. R. 1816 

To require the Federal Trade Commission to promulgate regulations related 

to sensitive personal information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 11, 2021 

Ms. DELBENE (for herself, Mr. KILMER, Ms. STRICKLAND, Ms. HOULAHAN, 

Mr. BLUMENAUER, Mr. HIMES, Mr. CRIST, Mr. LARSON of Connecticut, 

Ms. WILD, Mr. PERLMUTTER, Mr. CARTWRIGHT, Mr. HORSFORD, Mr. 

CASE, Mr. RYAN, Ms. SLOTKIN, Ms. SCHRIER, Mr. BEYER, Mr. LARSEN

of Washington, and Mr. COSTA) introduced the following bill; which was 

referred to the Committee on Energy and Commerce 

A BILL 

To require the Federal Trade Commission to promulgate 

regulations related to sensitive personal information, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Information Trans5 parency & Personal Data Control Act’’. 

6 SEC. 2. SENSE OF CONGRESS. 

7 It is the Sense of Congress that— 


pamtmann on DSKBC07HB2PROD with BILLS
2 

HR 1816 IH1S 

1 (1) the United States must develop a balanced, 

2 high-standard digital privacy framework that com3 plements global standards; 

4 (2) a key element of this framework is a strong 

5 national standard that combats anti-consumer prac6 tices; 

7 (3) it is critical that the Federal Government 

8 provide guidance on the collection, processing, disclo9 sure, transmission and storage of sensitive data; 

10 (4) it is important to provide the Nation with 

11 fair and thoughtful digital consumer rights with re12 spect to such data; 

13 (5) it is important to ensure that enforcement 

14 authorities have the resources needed to protect con15 sumers from unlawful and deceptive acts of practices 

16 in the data privacy and security space; and 

17 (6) individuals have a right to— 

18 (A) exercise control over the personal data 

19 companies collect from them and how they use 

20 it; 

21 (B) easily understandable and accessible 

22 information about privacy and security prac23 tices; 

24 (C) expect that companies will collect, use, 

25 and disclose personal data in ways that are conVerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816

pamtmann on DSKBC07HB2PROD with BILLS
3 

HR 1816 IH1S 

1 sistent with the context in which consumers 

2 provide the data; 

3 (D) secure and responsible handling of 

4 sensitive personal information; 

5 (E) access and correct persona data in us6 able formats, in a manner that is appropriate to 

7 the sensitivity of the data and the risk of ad8 verse consequences to consumers if the data is 

9 inaccurate; and 

10 (F) reasonable limits on the personal data 

11 that companies collect and retain. 

12 SEC. 3. REQUIREMENTS FOR SENSITIVE PERSONAL INFOR13 MATION. 

14 (a) REGULATIONS.—Not later than 18 months after 

15 the date of enactment of this Act, the Federal Trade Com16 mission shall promulgate regulations under section 553 of 

17 title 5, United States Code, to require, except as provided 

18 in subsection (b), controllers, processors, and third parties 

19 to make available to the public involving the collection, 

20 transmission, storage, processing, sale, sharing of sensitive 

21 personal information, or other use of sensitive personal in22 formation from persons operating in or persons located in 

23 the United States when the sensitive personal information 

24 is collected, transmitted, stored, processed, sold or shared 

25 to meet the following requirements: 


pamtmann on DSKBC07HB2PROD with BILLS
4 

HR 1816 IH1S 

1 (1) AFFIRMATIVE, EXPRESS, AND OPT-IN CON2 SENT.— 

3 (A) Any controller shall provide users 

4 whose personal information is collected, trans5 mitted, stored, process, sold, or otherwise 

6 shared with notice through a privacy and data 

7 use policy of a specific request to collect, trans8 mit, sell, share or otherwise disclose their sen9 sitive personal information and require that 

10 users provide affirmative, express consent to 

11 any functionality that involves the sale, sharing, 

12 or other disclosure of sensitive personal infor13 mation, including sharing sensitive personal in14 formation with third parties, if the sensitive 

15 personal information is to be used by the third 

16 party for purposes other than the purposes out17 lined in the notice. 

18 (B) The documented instruction from a 

19 controller to a processor or third party shall ad20 here to the limits of the consent granted in sub21 paragraph (A), and processors and third parties 

22 shall not use or disclose the sensitive personal 

23 information for any other purposes or in any 

24 way that exceeds the limits of the consent 

25 granted in subparagraph (A). 


pamtmann on DSKBC07HB2PROD with BILLS
5 

HR 1816 IH1S 

1 (C) Controllers and processors shall not be 

2 liable for the failure of another processor or 

3 third party to adhere to the limits of an opt-in 

4 consent granted under subparagraph (A). 

5 (2) PRIVACY AND DATA USE POLICY.—Control6 lers, processors, and third parties shall publicly 

7 maintain an up-to-date, transparent privacy, secu8 rity, and data use policy that meets general require9 ments, including that such policy, presented in the 

10 context where it applies— 

11 (A) is concise, intelligible, and uses plain 

12 language; 

13 (B) is clear and conspicuous consistent 

14 with the guidelines of the Federal Trade Com15 mission; 

16 (C) uses visualizations, where appropriate 

17 to make complex information understandable by 

18 the ordinary user; and 

19 (D) is provided free of charge. 

20 (3) ADDITIONAL REQUIREMENTS FOR PRIVACY

21 AND DATA USE POLICY.—The privacy, security, and 

22 data use policy required under paragraph (2) shall 

23 include the following: 


pamtmann on DSKBC07HB2PROD with BILLS
6 

HR 1816 IH1S 

1 (A) Identity and contact information of the 

2 entity collecting or processing the sensitive per3 sonal information. 

4 (B) The purpose or use for collecting, stor5 ing, processing, selling, sharing, or otherwise 

6 using the sensitive personal information. 

7 (C) Categories of third parties with whom 

8 the sensitive personal information will be shared 

9 and for what general purposes. 

10 (D) The process by which individuals may 

11 withdraw consent to the collecting, storing, 

12 processing, selling, sharing, or other use of the 

13 sensitive personal information, including shar14 ing with third parties. 

15 (E) How a user, controller, or processor 

16 can view or obtain the sensitive personal infor17 mation that they have received or provided to a 

18 controller or processor, including whether it can 

19 be exported to other web-based platforms. 

20 (F) The categories of sensitive personal in21 formation that is collected by the controller or 

22 processor and shared with processors or third 

23 parties. 


pamtmann on DSKBC07HB2PROD with BILLS
7 

HR 1816 IH1S 

1 (G) How sensitive personal information is 

2 protected from unauthorized access or acquisi3 tion. 

4 (4) OPT-OUT CONSENT.— 

5 (A) For any collection, transmission, stor6 age, processing, selling, sharing, or other use of 

7 non-sensitive personal information, including 

8 sharing with third parties, controllers shall pro9 vide users with the ability to opt out at any 

10 time. 

11 (B) Controllers shall honor an opt out re12 quest from a user under subparagraph (A) to 

13 the extent of its role in any collection, trans14 mission, storage, processing, selling, sharing, or 

15 other use of non-sensitive personal information 

16 and shall communicate an opt-out request to 

17 the relevant processor or third party with which 

18 the controller has shared information regarding 

19 that user. 

20 (C) Processors or third parties receiving an 

21 opt out pursuant to subparagraph (A) and (B) 

22 shall comply with such opt out to the extent of 

23 their role in any collection, transmission, stor24 age, processing, selling, sharing, or other use of 

25 non-sensitive personal information. 


pamtmann on DSKBC07HB2PROD with BILLS
8 

HR 1816 IH1S 

1 (D) Any controller that communicates an 

2 opt out from a user as required by subpara3 graph (B) shall not be liable for the failure of 

4 a service provider or third party to comply with 

5 such opt out. 

6 (5) RELATIONSHIP BETWEEN CONTROLLER

7 AND PROCESSOR.— 

8 (A) Processing by a processor must be gov9 erned by a contract between the controller and 

10 the processor that is binding on both parties 

11 and that sets the processor to processes the 

12 personal data only on documented instructions 

13 from the controller. 

14 (B) Processors shall share sensitive per15 sonal information with a subcontractor only for 

16 purposes of providing services and only after 

17 first providing the controller with an oppor18 tunity to object. 

19 (C) In no event may any contract or docu20 mented instructions relieve a controller or a 

21 processor from the obligations and liabilities im22 posed on them by this Act. 

23 (6) PRIVACY AUDITS.— 

24 (A) IN GENERAL.—Except as provided in 

25 subparagraphs (C) and (D), at least once every 


pamtmann on DSKBC07HB2PROD with BILLS
9 

HR 1816 IH1S 

1 2 years, each controller, processor, or third 

2 party that has collected, transmitted, stored, 

3 processed, selling, shared, or otherwise used 

4 sensitive personal information shall— 

5 (i) obtain a privacy audit from a 

6 qualified, objective, independent third7 party; and 

8 (ii) shall make publicly available 

9 whether or not the privacy audit found the 

10 controller, processor, or third party compli11 ant. 

12 (B) AUDIT REQUIREMENTS.—Each such 

13 audit shall— 

14 (i) set forth the privacy, security, and 

15 data use controls that the controller, proc16 essor, or third party has implemented and 

17 maintained during the reporting period; 

18 (ii) describe whether such controls are 

19 appropriate to the size and complexity of 

20 the controller, processor, or third party, 

21 the nature and scope of the activities of 

22 the controller, processor, or third party, 

23 and the nature of the sensitive personal in24 formation or behavioral data collected by 

25 the controller, processor, or third party; 


pamtmann on DSKBC07HB2PROD with BILLS
10 

HR 1816 IH1S 

1 (iii) certify whether the privacy and 

2 security controls operate with sufficient ef3 fectiveness to provide reasonable assurance 

4 to protect the privacy and security of sen5 sitive personal information or behavioral 

6 data, including with respect to data shared 

7 with third parties, and that the controls 

8 have so operated throughout the reporting 

9 period; 

10 (iv) be prepared and completed within 

11 60 days after a substantial change to the 

12 controller’s privacy and data use policy de13 scribed in paragraph (2); and 

14 (v) be provided— 

15 (I) to the Federal Trade Com16 mission; and 

17 (II) to any attorney general of a 

18 State, or other authorized State offi19 cer, within 10 days of receiving writ20 ten request by the such attorney gen21 eral, or other authorized State officer 

22 where such officer has presented to 

23 the controller, processor, or third 

24 party allegations that a violation of 

25 this Act or any regulation issued 


pamtmann on DSKBC07HB2PROD with BILLS
11 

HR 1816 IH1S 

1 under this Act has been committed by 

2 the controller, processor, or third 

3 party. 

4 (C) SMALL BUSINESS AUDIT EXEMP5 TION.—The audit requirements described in 

6 this paragraph shall not apply to controllers 

7 who collect, store, process, sell, share, or other8 wise use sensitive personal information relating 

9 to 250,000 or fewer individuals per year. 

10 (D) NON-SENSITIVE PERSONAL INFORMA11 TION EXEMPTION.—The audit requirements set 

12 forth above shall not apply to controllers, proc13 essors or third parties who do not collect, store, 

14 process, sell, share, or otherwise use sensitive 

15 personal information. 

16 (E) RULES THAT DO NOT INCENTIVIZE

17 SELLING INFORMATION.—The Commission shall 

18 promulgate rules regarding qualifications and 

19 requirements of third-party auditors such as a 

20 duty to conduct an independent assessment that 

21 does not incentivize the auditor to sell under 

22 the guise of a potential violation by the con23 troller products or services when there is not a 

24 violation of the Act. 

25 (b) EXEMPTIONS.— 


pamtmann on DSKBC07HB2PROD with BILLS
12 

HR 1816 IH1S 

1 (1) NECESSARY OPERATIONS AND SECURITY

2 PURPOSES.—Subsection (a) shall not apply to the 

3 processing, transmission, collecting, storing, sharing, 

4 selling of sensitive and non-sensitive personal infor5 mation for the following purposes: 

6 (A) Preventing or detecting fraud, identity 

7 theft, unauthorized transactions, theft, shop8 lifting, or criminal activity including financial 

9 crimes and money laundering. 

10 (B) The use of such information to identify 

11 errors that impair functionality or otherwise en12 hancing or maintaining the availability of the 

13 services or information systems of the controller 

14 for authorized access and use. 

15 (C) Protecting the vital interests of the 

16 consumer or another natural person. 

17 (D) Responding in good faith to valid legal 

18 process or providing information as otherwise 

19 required or authorized by law. 

20 (E) Monitoring or enforcing agreements 

21 between the Controller, processor, or third 

22 party and an individual, including but not lim23 ited to, terms of service, terms of use, user 

24 agreements, or agreements concerning moni25 toring criminal activity. 


pamtmann on DSKBC07HB2PROD with BILLS
13 

HR 1816 IH1S 

1 (F) Protecting the property, services, or 

2 information systems of the controller, processor, 

3 or third party against unauthorized access or 

4 use. 

5 (G) Advancing a substantial public inter6 est, including archival purposes, scientific or 

7 historical research, and public health, if such 

8 processing does not create a significant risk of 

9 harm to consumers. 

10 (H) Uses authorized by the Fair Credit 

11 Reporting Act or used by a commercial credit 

12 reporting agency. 

13 (I) Completing the transaction for which 

14 the personal information was collected, provide 

15 a good or service requested by the consumer 

16 that is reasonably anticipated within the con17 text of a business’ ongoing relationship with the 

18 consumer, bill or collect for such good or service 

19 or otherwise perform a contract between the 

20 controller and a consumer. 

21 (J) Complying with other Federal, State, 

22 and local law. 

23 (K) Conducting product recalls and serv24 icing warranties. 


pamtmann on DSKBC07HB2PROD with BILLS
14 

HR 1816 IH1S 

1 (2) REASONABLE EXPECTATION OF USERS.— 

2 The regulations promulgated pursuant to subsection 

3 (a) with respect to the requirement to provide opt4 in consent shall not apply to the processing, trans5 mission, storage, selling, sharing, or collection of 

6 sensitive personal information in which such proc7 essing does not deviate from purposes consistent 

8 with a controller’s relationship with users as under9 stood by the reasonable use, including but not lim10 ited to— 

11 (A) carrying out the term of a contract or 

12 service agreement, including elements of a cus13 tomer loyalty program, with a user; 

14 (B) accepting and processing a payment 

15 from a user; 

16 (C) completing a transaction with a user 

17 such as through delivering a good or service 

18 even if such delivery is made by a processor or 

19 third party; 

20 (D) marking goods or services to a user as 

21 long as the user is provided with the ability to 

22 opt out of such marketing; 

23 (E) taking steps to continue or extend an 

24 existing business relationship with a user, or in25 viting a new user to participate in a customer 


pamtmann on DSKBC07HB2PROD with BILLS
15 

HR 1816 IH1S 

1 promotion, benefit or loyalty program, as long 

2 as the user is provided with the ability to opt 

3 out; 

4 (F) conduct internal research to improve, 

5 repair, or develop products, services, or tech6 nology; or 

7 (G) municipal governments. 

8 SEC. 4. APPLICATION AND ENFORCEMENT BY THE FED9 ERAL TRADE COMMISSION. 

10 (a) COMMON CARRIERS.—Notwithstanding the limi11 tations in the Federal Trade Commission Act (15 U.S.C. 

12 41 et seq.) on Commission authority with respect to com13 mon carriers, this Act applies, according to its terms, to 

14 common carriers subject to the Communications Act of 

15 (47 U.S.C. 151 et seq.) and all Acts amendatory thereof 

16 and supplementary thereto. The Federal Trade Commis17 sion shall be the only Federal agency with authority to 

18 enforce such common carriers’ privacy practices. 

19 (b) ENFORCEMENT.— 

20 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC21 TICES.—A violation of this Act or a regulation pro22 mulgated under this Act shall be treated as a viola23 tion section 18(a)(1)(B) of the Federal Trade Com24 mission Act (15 U.S.C. 57(a)(1)(B)) regarding un25 fair or deceptive acts or practices. 


pamtmann on DSKBC07HB2PROD with BILLS
16 

HR 1816 IH1S 

1 (2) POWERS OF COMMISSION.—Except as pro2 vided in subsection (a), the Federal Trade Commis3 sion shall enforce this Act and the regulations pro4 mulgated under this Act in the same manner, by the 

5 same means, and with the same jurisdiction, powers, 

6 and duties as though all applicable terms and provi7 sions of the Federal Trade Commission Act (15 

8 U.S.C. 41 et seq.) were incorporated into and made 

9 a part of this Act. Any person who violates this Act 

10 or a regulation promulgated under this Act shall be 

11 subject to the penalties and entitled to the privileges 

12 and immunities provided in the Federal Trade Com13 mission Act. 

14 (c) CONSTRUCTION.—Nothing in this Act shall be 

15 construed to limit the authority of the Federal Trade 

16 Commission under any other provision of law. 

17 (d) OPPORTUNITY TO COMPLY.—The Commission 

18 shall notify a controller of alleged violations and provide 

19 them with 30 days to cure a non-wilful violations of this 

20 Act before the Commission shall commence and enforce21 ment action. 

22 SEC. 5. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

23 (a) RIGHT OF ACTION.—Except as provided in sub24 section (e), the attorney general of a State, alleging a vio25 lation of this Act or any regulation issued under this Act 


pamtmann on DSKBC07HB2PROD with BILLS
17 

HR 1816 IH1S 

1 that affects or may affect such State or its residents may 

2 bring an action on behalf of the residents of the State in 

3 any United States district court for the district in which 

4 the defendant is found, resides, or transacts business, or 

5 wherever venue is proper under section 1391 of title 28, 

6 United States Code, to obtain appropriate injunctive relief. 

7 (b) NOTICE TO COMMISSION REQUIRED.—A State 

8 shall provide prior written notice to the Federal Trade 

9 Commission of any civil action under subsection (a) to10 gether with a copy of its complaint, except that if it is 

11 not feasible for the State to provide such prior notice, the 

12 State shall provide such notice immediately upon insti13 tuting such action. 

14 (c) INTERVENTION BY THE COMMISSION.—The Com15 mission may intervene in such civil action and upon inter16 vening— 

17 (1) be heard on all matters arising in such civil 

18 action; and 

19 (2) file petitions for appeal of a decision in such 

20 civil action. 

21 (d) CONSTRUCTION.—Nothing in this section shall be 

22 construed— 

23 (1) to prevent the attorney general of a State, 

24 or other authorized State officer, from exercising the 

25 powers conferred on the attorney general, or other 


pamtmann on DSKBC07HB2PROD with BILLS
18 

HR 1816 IH1S 

1 authorized State officer, by the laws of such State; 

2 or 

3 (2) to prohibit the attorney general of a State, 

4 or other authorized State officer, from proceeding in 

5 State or Federal court on the basis of an alleged vio6 lation of any civil or criminal statute of that State. 

7 (e) LIMITATION.— 

8 (1) NO SEPARATE ACTION.—An action may not 

9 be brought under subsection (a) if the same alleged 

10 violation is the subject of a pending action by the 

11 Commission or the United States. 

12 (2) EXCLUSIVE PERIOD TO ACT BY COMMIS13 SION.—An action— 

14 (A) may not be brought under subsection 

15 (a) until the expiration of the 60-day period 

16 that begins on the date on which a violation is 

17 discovered by the Commission or the date on 

18 which the Commission is notified of the viola19 tion; and 

20 (B) may only be brought under subsection 

21 (a) if the Commission does not bring an action 

22 related to the violation during such period. 

23 (f) OPPORTUNITY TO COMPLY.—Prior to bringing 

24 any action under this section, the state attorney general 

25 shall notify a controller of alleged violations and provide 


pamtmann on DSKBC07HB2PROD with BILLS
19 

HR 1816 IH1S 

1 them with 30 days to cure a non-wilful violations of this 

2 Act before commencing an enforcement action. 

3 SEC. 6. PRIVACY AND DATA SECURITY EMPLOYEES AND 

4 FUNDING FOR THE COMMISSION. 

5 (a) EMPLOYMENT AUTHORITY.—The Commission 

6 shall hire 500 new full-time employees to focus on privacy 

7 and data security, 50 of which shall have technology exper8 tise. 

9 (b) ADDITIONAL FUNDING FOR PRIVACY AND DATA

10 SECURITY.—There is authorized to be appropriated to the 

11 Commission $350,000,000 for issues related to privacy 

12 and data security. 

13 SEC. 7. DEFINITIONS. 

14 In this Act the following definitions apply: 

15 (1) CALL DETAIL RECORD.—The term ‘‘call de16 tail record’’— 

17 (A) means session-identifying information 

18 (including an originating or terminating tele19 phone number, an International Mobile Sub20 scriber Identity number, or an International 

21 Mobile Station Equipment Identity number), a 

22 telephone calling card number, or the time or 

23 duration of a call; 

24 (B) does not include— 


pamtmann on DSKBC07HB2PROD with BILLS
20 

HR 1816 IH1S 

1 (i) the contents (as defined in section 

2 (8) of title 18, United States Code) of any 

3 communication; 

4 (ii) the name, address, or financial in5 formation of a subscriber or customer; 

6 (iii) cell site location or global posi7 tioning system information; or 

8 (iv) business customers. 

9 (2) CLEAR AND PROMINENT.—The term ‘‘clear 

10 and prominent’’ means in any communication me11 dium, the required disclosure is— 

12 (A) of a type, size, and location sufficiently 

13 noticeable for an ordinary consumer to read 

14 and comprehend the communication; 

15 (B) provided in a manner such that an or16 dinary consumer is able to read and com17 prehend the communication; 

18 (C) is presented in an understandable lan19 guage and syntax; 

20 (D) includes nothing contrary to, incon21 sistent with, or that mitigates any statement 

22 contained within the disclosure or within any 

23 document linked to or referenced therein; and 

24 (E) includes an option that is compliant 

25 with applicable obligations of the controller 


pamtmann on DSKBC07HB2PROD with BILLS
21 

HR 1816 IH1S 

1 under title III of the Americans with Disabil2 ities Act of 1990 (42 U.S.C. 12181 et seq.). 

3 (3) COLLECTION.—The term ‘‘collection’’ 

4 means buying, renting, gathering, obtaining, receiv5 ing, or accessing any sensitive data of an individual 

6 by any means. 

7 (4) COMMISSION.—The term ‘‘Commission’’ 

8 means the Federal Trade Commission. 

9 (5) CONTROLLER.—The term ‘‘controller’’ 

10 means a person that, on its own or jointly with other 

11 entities, determines the purposes and means of proc12 essing sensitive personal information. 

13 (6) DE-IDENTIFIED DATA.—The term ‘‘de-iden14 tified data’’ means information held that— 

15 (A) does not identify, and is not linked or 

16 reasonably linkable to, and individual or device; 

17 (B) does not contain a persistent identifier 

18 or other information that could readily be used 

19 to de-identify the individual to whom, or the de20 vice to which, the identifier or information per21 tains; 

22 (C) is subject to a public commitment by 

23 the entity; 

24 (D) to refrain from attempting to use such 

25 information to identify any individual or device; 


pamtmann on DSKBC07HB2PROD with BILLS
22 

HR 1816 IH1S 

1 (E) to adopt technical and organizational 

2 measures to ensure that such information is not 

3 linked to any individual or device; and 

4 (F) is not disclosed by the covered entity 

5 to any other party unless the disclosure is sub6 ject to a contractually or other legally binding 

7 requirement. 

8 (7) EMPLOYEE DATA.—The term ‘‘employee 

9 data’’ means— 

10 (A) information relating to an individual 

11 collected in the course of the individual acting 

12 as a job applicant to, or employee (regardless of 

13 whether such employee is paid of unpaid, or 

14 employed on a temporary basis), owner, direc15 tor, officer, staff member, trainee, vendor, vis16 itor, volunteer, intern, or contractor; 

17 (B) business contact information of an in18 dividual, including the individual’s name, posi19 tion or title, business telephone number, busi20 ness address, business email address, qualifica21 tions, and other similar information that is pro22 vided by an individual who is acting in a profes23 sional capacity, provided that such information 

24 is collected, processed, or transferred solely for 


pamtmann on DSKBC07HB2PROD with BILLS
23 

HR 1816 IH1S 

1 purposes related to such individuals’ profes2 sional activities; or 

3 (C) emergency contact information col4 lected by a covered entity that relates to an in5 dividual who is acting in a role described in 

6 subparagraph (A). 

7 (8) PROCESSOR.—The term ‘‘processor’’ means 

8 a person that processes data on behalf of a con9 troller or another processor according to and for the 

10 purposes set forth in the documented instructions. If 

11 a person processes data on its own behalf or for its 

12 own purposes, then that person is not a processor 

13 with respect to that data but is instead a controller. 

14 Determining whether a person is acting as a con15 troller or processor with respect to a specific proc16 essing of data is a fact-based determination that de17 pends upon the controller’s documented instructions 

18 and the context in which personal data is to be proc19 essed. A processor shall only remain a processor to 

20 the extent that it continues to process data for the 

21 sole purposes set forth in the documented instruc22 tions of the controller and adheres to those instruc23 tions and the limitations in the controller’s privacy 

24 policy as communicated to the processor with respect 

25 to a specific processing of personal information. 


pamtmann on DSKBC07HB2PROD with BILLS
24 

HR 1816 IH1S 

1 (9) SENSITIVE PERSONAL INFORMATION.— 

2 (A) The term ‘‘sensitive personal informa3 tion’’ means information relating to an identi4 fied or identifiable individual that is— 

5 (i) financial account numbers; 

6 (ii) health information; 

7 (iii) genetic data; 

8 (iv) any information pertaining to 

9 children under 13 years of age; 

10 (v) Social Security numbers; 

11 (vi) unique government-issued identi12 fiers; 

13 (vii) authentication credentials for a 

14 financial account, such as a username and 

15 password; 

16 (viii) precise geolocation information; 

17 (ix) content of a personal wire com18 munication, oral communication, or elec19 tronic communication such as e-mail or di20 rect messaging with respect to any entity 

21 that is not the intended recipient of the 

22 communication; 

23 (x) call detail records for calls con24 ducted in a personal and not a business ca25 pacity; 


pamtmann on DSKBC07HB2PROD with BILLS
25 

HR 1816 IH1S 

1 (xi) biometric information; 

2 (xii) sexual orientation, gender iden3 tity, or intersex status; 

4 (xiii) citizenship or immigration sta5 tus; 

6 (xiv) mental or physical health diag7 nosis; 

8 (xv) religious beliefs; or 

9 (xvi) web browsing history, application 

10 usage history, and the functional equiva11 lent of either that is data described in this 

12 subparagraph that is not aggregated data. 

13 (B) The term ‘‘sensitive personal informa14 tion’’ does not include— 

15 (i) de-identified information (or the 

16 measurement, analysis or process utilized 

17 to transforming personal data so that it is 

18 not directly relatable to an identified or 

19 identifiable consumer); 

20 (ii) information related to employ21 ment, including any employee data; 

22 (iii) personal information reflecting a 

23 written or verbal communication or a 

24 transaction between a controller and the 

25 user, where the user is a natural person 


pamtmann on DSKBC07HB2PROD with BILLS
26 

HR 1816 IH1S 

1 who is acting as an employee, owner, direc2 tor, officer, or contractor of a company, 

3 partnership, sole proprietorship, non-profit, 

4 or government agency and whose commu5 nications or transaction with the controller 

6 occur solely within the context of the con7 troller conducting due diligence regarding, 

8 or providing or receiving a product or serv9 ice to or from such company, partnership, 

10 sole proprietorship, non-profit, or govern11 ment agency; or 

12 (iv) publicly available information. 

13 (10) STATE.—The term ‘‘State’’ means each 

14 State of the United States, the District of Columbia, 

15 and each commonwealth, territory, or possession of 

16 the United States. 

17 (11) THIRD PARTY.—The term ‘‘third party’’ 

18 means an individual or entity that uses or receives 

19 sensitive personal information obtained by or on be20 half of a controller, other than— 

21 (A) a service provider of a controller to 

22 whom the controller discloses the consumer’s 

23 sensitive personal information for an oper24 ational purpose subject to section 3(a)(1)(B) of 

25 this Act; and 


pamtmann on DSKBC07HB2PROD with BILLS
27 

HR 1816 IH1S 

1 (B) any entity that uses sensitive personal 

2 information only as reasonably necessary— 

3 (i) to comply with applicable law, reg4 ulation, or legal process; 

5 (ii) to enforce the terms of use of a 

6 controller; 

7 (iii) to detect, prevent, or mitigate 

8 fraud or security vulnerabilities; or 

9 (iv) does not determine the purposes 

10 and means of processing sensitive personal 

11 information. 

12 (12) TRANSFER.—The term ‘‘transfer’’ means 

13 to disclose, release, share, disseminate, make avail14 able, or license in writing, electronically or by any 

15 other means, for consideration of any kind for a 

16 commercial purpose. 

17 SEC. 8. RULES OF CONSTRUCTION. 

18 (a) FEDERAL ACQUISITION.—Nothing in this Act 

19 may be construed to preclude the acquisition by the Fed20 eral Government of— 

21 (1) the contents of a wire or electronic commu22 nication pursuant to other lawful authorities, includ23 ing the authorities under chapter 119 of title 18, 

24 United States Code (commonly known as the ‘‘Wire25 tap Act’’), the Foreign Intelligence Surveillance Act 


pamtmann on DSKBC07HB2PROD with BILLS
28 

HR 1816 IH1S 

1 of 1978 (50 U.S.C. 1801 et seq.), or any other pro2 vision of Federal law not specifically amended by 

3 this Act; or 

4 (2) records or other information relating to a 

5 subscriber or customer of any electronic communica6 tion service or remote computing service (not includ7 ing the content of such communications) pursuant to 

8 the Foreign Intelligence Surveillance Act of 1978 

9 (50 U.S.C. 1801 et seq.), chapter 119 of title 18, 

10 United States Code (commonly known as the ‘‘Wire11 tap Act’’), or any other provision of Federal law not 

12 specifically amended by this Act. 

13 (b) EFFECT ON OTHER LAWS.—Nothing in this Act 

14 shall be construed to limit or substitute for the require15 ments under title V of the Gramm-Leach-Bliley Act (15 

16 U.S.C. 6801 et seq.), section 264(c) of the Health Insur17 ance Portability and Accountability Act of 1996 (Public 

18 Law 104–191), section 444 of the General Education Pro19 visions Act (commonly known as the Family Educational 

20 Rights and Privacy Act of 1974) (20 U.S.C. 1232g), the 

21 Fair Credit Reporting Act (15 U.S.C. 1681 et seq.). 

22 SEC. 9. NATIONAL STANDARD. 

23 (a) RELATIONSHIP TO STATE LAW.—No State or po24 litical subdivision of a State may adopt, maintain, enforce, 

25 or continue in effect any law, regulation, rule, requireVerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816

pamtmann on DSKBC07HB2PROD with BILLS
29 

HR 1816 IH1S 

1 ment, or standard related to the data privacy or associated 

2 activities of covered entities. 

3 (b) NONPREEMPTION.—Subsection (a) shall not be 

4 construed to— 

5 (1) preempt State laws that directly establish 

6 requirements for the notification of consumers in the 

7 event of a data breach; 

8 (2) preempt State laws that directly establish 

9 requirements regarding biometric laws; 

10 (3) preempt State laws regarding wiretapping 

11 laws; or 

12 (4) preempt State laws like the Public Records 

13 Act. 

14 SEC. 10. EFFECTIVE DATE. 

15 This Act shall take effect 180 days after the date of 

16 the enactment of this Act. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS