I 

112TH CONGRESS 

1ST SESSION H. R. 1528 

To protect and enhance consumer privacy, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 13, 2011 

Mr. STEARNS (for himself, Mr. MATHESON, Mr. BILBRAY, and Mr. MANZULLO) introduced the following bill; which was referred to the Committee on Energy and Commerce 

A BILL 

To protect and enhance consumer privacy, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Consumer Privacy Pro5 tection Act of 2011’’. 

6 SEC. 3. DEFINITIONS. 

7 In this Act, the following definitions apply: 

8 (1) AFFILIATE.—The term ‘‘affiliate’’ means 

9 any company that controls, is controlled by, or is 

10 under common control with another company. 

mstockstill on DSKH9S0YB1PROD with BILLS

2 

•HR 1528 IH

1 (2) COMMISSION.—The term ‘‘Commission’’ 

2 means the Federal Trade Commission. 

3 (3) CONSUMER.—The term ‘‘consumer’’ means 

4 an individual acting in the individual’s personal, 

5 family, or household capacity. 

6 (4) COVERED ENTITY.—(A) The term ‘‘covered 

7 entity’’ means an entity (or an agent or affiliate of 

8 the entity) that collects (by any means, through any 

9 medium), sells, discloses for consideration, or uses 

10 personally identifiable information of more than 

11 5,000 consumers during any consecutive 12-month 

12 period, and includes a non-profit organization, in13 cluding any organization described in section 501(c) 

14 of the Internal Revenue Code of 1986 that is exempt 

15 from taxation under section 501(a) of such Code, 

16 notwithstanding the definition of the term ‘‘Acts to 

17 regulate commerce’’ in section 4 of the Federal 

18 Trade Commission Act (15 U.S.C. 44) and the ex19 ception provided by section 5(a)(2) of such Act (15 

20 U.S.C. 45(a)(2)) for such organizations. 

21 (B) Such term does not include— 

22 (i) a governmental agency; 

23 (ii) a provider of professional services, or 

24 any affiliate thereof, to the extent that such 

25 provider is obligated by rules of professional 

mstockstill on DSKH9S0YB1PROD with BILLS

3 

•HR 1528 IH

1 ethics, or by applicable law or regulation, not to 

2 voluntarily disclose confidential client informa3 tion without the consent of the client; or 

4 (iii) a data processing outsourcing entity. 

5 (5) DATA PROCESSING OUTSOURCING ENTI6 TY.—The term ‘‘data processing outsourcing entity’’ 

7 means, with respect to a covered entity, a non-affili8 ated entity that— 

9 (A) provides information technology proc10 essing, Web hosting, or telecommunications 

11 services to the covered entity; 

12 (B) is contractually obligated to comply 

13 with security controls specified by the covered 

14 entity; and 

15 (C) has no right to use the covered entity’s 

16 personally identifiable information other than 

17 for performing data processing outsourcing 

18 services for the covered entity or as required by 

19 contract or law. 

20 (6) DISPLAY.—The term ‘‘display’’ means in21 tentionally communicating or otherwise making 

22 available (on the Internet or in any other manner) 

23 to another person. 

24 (7) INFORMATION-SHARING AFFILIATE.—The 

25 term ‘‘information-sharing affiliate’’ means any affilmstockstill on DSKH9S0YB1PROD with BILLS

4 

•HR 1528 IH

1 iate that is under common control with a covered en2 tity, or is contractually obligated to comply with the 

3 practices enumerated under the privacy policy state4 ment of the covered entity required under section 5. 

5 (8) PERSONALLY IDENTIFIABLE INFORMA6 TION.—(A) The term ‘‘personally identifiable infor7 mation’’, with respect to a covered entity means in8 dividually identifiable information relating to a living 

9 individual who can be identified from that informa10 tion, and includes: 

11 (i) the combination of a first name (or 

12 initial) and last name of an individual, 

13 whether given at birth or time of adoption, 

14 or resulting from a lawful change of name; 

15 (ii) the postal address of a physical 

16 place of residence of such individual; 

17 (iii) an e-mail address of such indi18 vidual; 

19 (iv) a telephone number or mobile de20 vice number dedicated to contacting such 

21 individual at any place other than the indi22 vidual’s place of work; 

23 (v) a social security number or other 

24 Federal or State government issued identimstockstill on DSKH9S0YB1PROD with BILLS

5 

•HR 1528 IH

1 fication number issued to such individual; 

2 or 

3 (vi) the complete account number of a 

4 credit or debit card issued to such indi5 vidual. 

6 (B) Such term also includes, when disclosed in 

7 connection with one or more of the items of informa8 tion described in subparagraph (A)— 

9 (i) a birth date, the number of a certificate 

10 of birth or adoption, or a place of birth; or 

11 (ii) an electronic address, including an IP 

12 address. 

13 (C) Such term does not include— 

14 (i) anonymous or aggregate data, or any 

15 other information that does not identify a 

16 unique living individual; 

17 (ii) information about a consumer inferred 

18 from data maintained about a consumer; or 

19 (iii) information about a consumer that is 

20 publicly available or obtained from a public 

21 record. 

22 (9) PROCESS.—The term ‘‘process’’, with re23 spect to personally identifiable information, means 

24 any value-added activity performed on data by auto25 mated means. 

mstockstill on DSKH9S0YB1PROD with BILLS

6 

•HR 1528 IH

1 (10) PUBLICLY AVAILABLE.—The term ‘‘pub2 licly available’’, with respect to information, means 

3 information that is lawfully made available to the 

4 general public. 

5 (11) PUBLIC RECORD.—The term ‘‘public 

6 record’’ means any item, collection, or grouping of 

7 information about an individual that is maintained 

8 by a Federal, State, or local government entity and 

9 that is made available to the public. 

10 (12) PURCHASE.—The term ‘‘purchase’’ means 

11 providing, directly or indirectly, anything of value in 

12 exchange for a good or service. 

13 (13) STATE.—The term ‘‘State’’ includes the 

14 several States, the District of Columbia, the Com15 monwealth of Puerto Rico, the Commonwealth of the 

16 Northern Mariana Islands, American Samoa, Guam, 

17 the Virgin Islands, the Freely Associated States, and 

18 any other territory or possession of the United 

19 States. 

20 (14) TRANSACTION.—The term ‘‘transaction’’ 

21 means an interaction between a consumer and a cov22 ered entity resulting in— 

23 (A) any use of information that is nec24 essary to complete the interaction in the course 

25 of which information is collected, or to maintain 

mstockstill on DSKH9S0YB1PROD with BILLS

7 

•HR 1528 IH

1 the provisioning of a good or service requested 

2 by the consumer, including use— 

3 (i) to approve, guarantee, process, ad4 minister, complete, enforce, provide, or 

5 market a product, service, account, benefit, 

6 transaction, or payment method that is re7 quested or approved by the consumer; 

8 (ii) to deliver goods, services, funds, 

9 or other consideration to, or on behalf of, 

10 the consumer; 

11 (iii) to protect the health and safety 

12 of the consumer; and 

13 (iv) related to website analytics meth14 ods or measurements for improving or en15 hancing products or services. 

16 (B) any disclosure of information that is 

17 necessary for the consumer to enforce any right 

18 of the consumer; 

19 (C) any disclosure of information that is 

20 required by law or by a court order; 

21 (D) any use of information to verify per22 sonally identifiable information by the con23 sumer, evaluate, detect, or reduce the risk of 

24 fraud or other criminal activity, or other risk25 management activities; and 

mstockstill on DSKH9S0YB1PROD with BILLS

8 

•HR 1528 IH

1 (E) the collection or use of personally iden2 tifiable information for the marketing or adver3 tising of a covered entity’s products or services 

4 to its own customers or potential customers. 

5 SEC. 4. PRIVACY NOTICES TO CONSUMERS. 

6 (a) NOTICE REQUIRED.—A covered entity shall pro7 vide to a consumer a notice containing the information 

8 required under subsection (b) as follows: 

9 (1) The covered entity shall provide the notice 

10 before any personally identifiable information that is 

11 collected from a consumer is used by the covered en12 tity for a purpose unrelated to a transaction. 

13 (2) Upon a material change in the covered enti14 ty’s privacy policy under section 5(a), the covered 

15 entity shall provide the notice, not later than the 

16 first time after such change in policy that the cov17 ered entity seeks to sell, disclose for consideration, 

18 or use personally identifiable information to the ex19 tent practicable, to each consumer from whom the 

20 covered entity has collected such information. 

21 (b) FORM AND CONTENTS OF NOTICE.—A notice re22 quired under subsection (a) shall be provided in a clear 

23 and conspicuous manner, be prominently displayed or ex24 plicitly stated to the consumer, and contain the following 

25 information: 

mstockstill on DSKH9S0YB1PROD with BILLS

9 

•HR 1528 IH

1 (1) A statement that the personally identifiable 

2 information collected by the covered entity may be 

3 used or disclosed for purposes or transactions unre4 lated to that for which it was collected, as described 

5 in the covered entity’s privacy statement. 

6 (2) A description, appropriate to the applicable 

7 medium, of the manner in which the consumer may 

8 obtain a privacy policy statement that meets the re9 quirements of section 5, which may include pro10 viding the consumer with an Internet website, a 

11 hyperlink to such a website, or a toll-free telephone 

12 number from which such a statement may be ob13 tained. If the notice required under subsection (a) is 

14 provided to the consumer by means of an Internet 

15 website, one manner in which the consumer may ob16 tain the privacy policy statement must be by means 

17 of an Internet website. 

18 (3) If the notice is required under subsection 

19 (a)(2), a statement that there has been a material 

20 change in the covered entity’s privacy policy. 

21 SEC. 5. PRIVACY POLICY STATEMENTS. 

22 (a) PRIVACY POLICY.—A covered entity shall estab23 lish a privacy policy with respect to the collection, sale, 

24 disclosure for consideration, dissemination, use, and secu25 rity of the personally identifiable information of conmstockstill on DSKH9S0YB1PROD with BILLS

10 

•HR 1528 IH

1 sumers, the principal elements of which shall be embodied 

2 in a privacy policy statement (or statements) that meets 

3 the requirements of subsection (b). 

4 (b) STATEMENT.—The statement (or statements) re5 quired under subsection (a) shall meet the following re6 quirements: 

7 (1) The statement must be brief, concise, clear, 

8 and conspicuous and written in plain language. 

9 (2) The statement must be available to all con10 sumers of the covered entity (regardless of the 

11 means by which a consumer conducts a transaction 

12 with the covered entity)— 

13 (A) at no charge to the consumer; and 

14 (B) at the time the covered entity first col15 lects personally identifiable information about 

16 the consumer that may be used for a purpose 

17 unrelated to a transaction with the consumer 

18 and subsequently. 

19 (3) The statement must disclose only the fol20 lowing: 

21 (A) The identity of each covered entity, or 

22 a description of each class or type of covered 

23 entity, that may collect or use the information. 

24 (B) The types of information that may be 

25 collected or used. 

mstockstill on DSKH9S0YB1PROD with BILLS

11 

•HR 1528 IH

1 (C) How the information may be used. 

2 (D) Whether the consumer is required to 

3 provide the information in order to do business 

4 with the covered entity. 

5 (E) The extent to which the information is 

6 subject to sale or disclosure for consideration to 

7 a covered entity that is not an information8 sharing affiliate of the covered entity providing 

9 the statement, including— 

10 (i) a clear and prominent statement of 

11 the fact that the information is subject to 

12 such sale or disclosure for consideration; 

13 (ii) a description of each class or type 

14 of covered entity to which the information 

15 may be sold or disclosed for consideration; 

16 (iii) to the extent practicable, the pur17 pose for which the information may be 

18 used; and 

19 (iv) the types of information that may 

20 be sold or disclosed for consideration. 

21 (F) Whether the information security prac22 tices of the covered entity meet the security re23 quirements of section 8 in order to prevent un24 authorized disclosure or release of personally 

25 identifiable information. 

mstockstill on DSKH9S0YB1PROD with BILLS

12 

•HR 1528 IH

1 (c) COMMISSION FACILITATION.—The Commission 

2 may take actions (including conducting industry-wide 

3 workshops) to facilitate the development of harmonized, 

4 universal wording or logo-based graphics in order to con5 vey the contents of privacy policy statements required 

6 under this section. 

7 SEC. 6. CONSUMER OPPORTUNITY TO LIMIT SALE OR DIS8 CLOSURE OF INFORMATION. 

9 (a) PRECLUSION OF SALE OR DISCLOSURE.— 

10 (1) REQUIREMENT.—A covered entity shall pro11 vide to the consumer, without charge, the oppor12 tunity to preclude any sale or disclosure for consid13 eration of the consumer’s personally identifiable in14 formation, provided in a particular data collection, 

15 that may be used for a purpose other than a trans16 action with the consumer, to any covered entity that 

17 is not an information-sharing affiliate of the covered 

18 entity providing such opportunity. 

19 (2) DURATION.—A preclusion on sale or disclo20 sure for consideration of information established by 

21 a consumer under this subsection shall remain in ef22 fect for 5 years or until the consumer indicates oth23 erwise, whichever occurs sooner. A covered entity 

24 may not seek reconsideration of a consumer’s pre25 clusion of such sale or disclosure until at least 1 

mstockstill on DSKH9S0YB1PROD with BILLS

13 

•HR 1528 IH

1 year after such preclusion has been imposed by the 

2 consumer. 

3 (b) PERMISSION FOR SALE OR DISCLOSURE.—A cov4 ered entity may provide the consumer an opportunity to 

5 permit the sale or disclosure described in subsection (a)(1) 

6 in exchange for a benefit to the consumer. 

7 (c) ACCESSIBILITY.—The opportunity to preclude (or 

8 if offered, to permit) the sale or disclosure for consider9 ation of information under this section must be both easy 

10 to access and use, and the notice of the opportunity to 

11 preclude must be clear and conspicuous. 

12 SEC. 7. CONSUMER OPPORTUNITY TO LIMIT OTHER INFOR13 MATION PRACTICES. 

14 If a covered entity provides to a consumer the oppor15 tunity to limit other practices of the covered entity with 

16 respect to a particular collection or use of personally iden17 tifiable information regarding the consumer, other than 

18 that required by section 6— 

19 (1) a notice and description of such opportunity 

20 must appear in the privacy statement; 

21 (2) such opportunity must be easy to access 

22 and to use; and 

23 (3) any limitation exercised by the consumer 

24 pursuant to such opportunity shall remain in effect, 

25 unless— 

mstockstill on DSKH9S0YB1PROD with BILLS

14 

•HR 1528 IH

1 (A) the limitation is withdrawn by the con2 sumer; or 

3 (B) the covered entity provides the con4 sumer at least 30 days notice before materially 

5 changing the limitation or terminating its com6 pliance with the limitation. 

7 SEC. 8. INFORMATION SECURITY OBLIGATIONS. 

8 (a) IMPLEMENTATION.—A covered entity shall pre9 pare, revise as necessary, and implement an information 

10 security policy that is applicable to the information secu11 rity practices and treatment of personally identifiable in12 formation maintained by the covered entity, that is de13 signed to prevent the unauthorized disclosure or release 

14 of such information. 

15 (b) MANAGEMENT APPROVAL.—An information secu16 rity policy created pursuant to paragraph (1) shall be con17 sidered and approved by the senior management officials 

18 of the covered entity. 

19 (c) CONTENTS.—An information security policy re20 quired under paragraph (1) shall include— 

21 (1) a process for taking corrective action to pre22 vent or mitigate unauthorized disclosure of informa23 tion; and 

mstockstill on DSKH9S0YB1PROD with BILLS

15 

•HR 1528 IH

1 (2) identifying an officer of the covered entity 

2 as the point of contact with responsibility for infor3 mation security issues for the covered entity. 

4 SEC. 9. SELF-REGULATORY PROGRAMS. 

5 (a) SELF-REGULATORY PROGRAM.— 

6 (1) PRESUMPTION OF COMPLIANCE.—The Com7 mission shall presume that a covered entity is in 

8 compliance with the provisions of sections 4 through 

9 8 if that covered entity— 

10 (A) participates in a self-regulatory pro11 gram approved under subsection (b); and 

12 (B) is subject to enforcement under a self13 regulatory program’s guidelines, procedures, re14 quirements, and restrictions (including a reme15 dial process under subsection (c)(7)). 

16 (2) EFFECT OF WILLFUL NONCOMPLIANCE.—A 

17 covered entity that participates in a self-regulatory 

18 program under this section shall not be liable for a 

19 civil penalty arising out of a violation of any provi20 sion of sections 4 through 8 unless such violation re21 sults from willful noncompliance with the guidelines, 

22 procedures, requirements, or restrictions of the pro23 gram. 

24 (b) APPROVAL BY COMMISSION.— 

mstockstill on DSKH9S0YB1PROD with BILLS

16 

•HR 1528 IH

1 (1) APPROVAL.—The Commission shall, within 

2 90 days after submission of an application for ap3 proval of a self-regulatory program under this sec4 tion (or of a material change in a program pre5 viously approved by the Commission), approve such 

6 program (or change) if the Commission finds that 

7 the program (or change) complies with the require8 ments of subsection (c). 

9 (2) FORM OF APPLICATION.—The Commission 

10 shall accept an application for approval under para11 graph (1) in any reasonable form the applicant may 

12 submit. 

13 (3) DURATION UNTIL RENEWAL.—A self-regu14 latory program approved by the Commission under 

15 paragraph (1) shall be approved for a period of 5 

16 years. 

17 (4) REVOCATION OF APPROVAL.—The Commis18 sion may, after notice and opportunity for a hearing, 

19 revoke approval granted under paragraph (1), if the 

20 Commission finds that a self-regulatory program 

21 fails to meet the requirements of subsection (c). 

22 (5) JUDICIAL REVIEW.—Any order by the Com23 mission denying approval of a self-regulatory pro24 gram shall be subject to judicial review, as provided 

25 in section 706 of title 5, United States Code. 

mstockstill on DSKH9S0YB1PROD with BILLS

17 

•HR 1528 IH

1 (c) REQUIREMENTS OF SELF-REGULATORY PRO2 GRAM.—A self-regulatory program complies with the re3 quirements of this subsection if the program provides each 

4 of the following: 

5 (1) Guidelines and procedures requiring a pro6 gram participant to provide substantially equivalent 

7 or greater protections for consumers and their per8 sonally identifiable information as are provided 

9 under sections 4 through 8. 

10 (2) Procedures and requirements to provide 

11 for— 

12 (A) an initial review of a participant’s pri13 vacy statement and privacy policy, and subse14 quent review whenever such statement or policy 

15 is substantively changed; 

16 (B) a participant’s self-review and self-cer17 tification of its privacy policy and practices to 

18 ensure compliance with the guidelines, proce19 dures, requirements, and restrictions of the pro20 gram established under this subsection; 

21 (C) a participant’s subsequent periodic 

22 self-reviews and self-certifications, which shall 

23 occur at least annually, of the its privacy policy 

24 and practices to ensure continued compliance 

mstockstill on DSKH9S0YB1PROD with BILLS

18 

•HR 1528 IH

1 with such guidelines, procedures, requirements, 

2 and restrictions; 

3 (D) submission of self-reviews and self-cer4 tifications under this paragraph to any adminis5 trator of the program; and 

6 (E) random review of participants, which 

7 may concentrate on selected compliance issues, 

8 if the self-regulatory program conducts— 

9 (i) random compliance tests with re10 spect to each participant not less fre11 quently than every 3 years; 

12 (ii) a full compliance test of a par13 ticular participant in any case where non14 compliance with any of the selected compli15 ance issues has been identified; and 

16 (iii) full compliance tests of partici17 pants with a high number of complaints 

18 against them. 

19 (3) Procedures and requirements that ensure 

20 that a program participant provides a process for re21 solving disputes with consumers relating to the pri22 vacy policy and practices of the participant. Such 

23 dispute resolution process— 

24 (A) must be available without charge to a 

25 consumer; 

mstockstill on DSKH9S0YB1PROD with BILLS

19 

•HR 1528 IH

1 (B) must be available at a cost to the par2 ticipant that is reasonable and does not discour3 age participation by the participant in such 

4 process; 

5 (C) must ensure that consumers are in6 formed of how to utilize the process; 

7 (D) may include, as one choice among oth8 ers, binding arbitration; and 

9 (E)(i) must be completed within 60 days 

10 after submission of the dispute by the con11 sumer; or 

12 (ii) must be completed within 90 days after 

13 submission of the dispute by the consumer, if 

14 the participant— 

15 (I) determines that additional time is 

16 required to obtain information to make an 

17 informed decision with respect to the dis18 pute; and 

19 (II) notifies the consumer and the 

20 self-regulatory program that such addi21 tional time is required. 

22 (4) Provisions for the use by participants in the 

23 program of a means (including the use of a seal) to 

24 represent the participant’s participation in the pro25 gram. 

mstockstill on DSKH9S0YB1PROD with BILLS

20 

•HR 1528 IH

1 (5) With respect to any nonvoluntary suspen2 sion or termination of participation in the program 

3 because of the participant’s failure to comply with 

4 the program, procedures or requirements to provide 

5 for the following: 

6 (A) Publication of notice and the reasons 

7 for any such suspension or termination, except 

8 that no personally identifiable information re9 lated to such suspension or termination may be 

10 published. 

11 (B) Notice to the Commission of any such 

12 termination. 

13 (6) Requirements and restrictions that assure 

14 independence with respect to program eligibility, 

15 compliance, and dispute resolution mechanisms and 

16 decisions from improper interference by management 

17 or ownership of the self-regulatory program partici18 pant. 

19 (7) A process for a noncompliant participant to 

20 take timely remedial action in order to come back 

21 into compliance with the program before suspension 

22 or termination of participation in the program. 

23 (d) CONSUMER DISPUTE RESOLUTION.— 

24 (1) SELF-REGULATORY DISPUTE PROCESS.—If 

25 a consumer has a dispute with a participant in a 

mstockstill on DSKH9S0YB1PROD with BILLS

21 

•HR 1528 IH

1 self-regulatory program under this section or under 

2 section 5 of the Federal Trade Commission Act (15 

3 U.S.C. 45) to the extent that such dispute pertains 

4 to the entity’s privacy policy or practices required 

5 for participation in the self-regulatory program, the 

6 consumer shall initially seek resolution through the 

7 participant’s dispute resolution process (established 

8 in accordance with subsection (c)(3)). The Commis9 sion shall promptly refer to the participant involved 

10 any dispute submitted to the Commission for which 

11 resolution has not been initially sought through such 

12 process. 

13 (2) RESOLUTION BY COMMISSION.—A consumer 

14 may submit to the Commission for resolution a dis15 pute with a participant in a self-regulatory program 

16 under this section, if the following requirements are 

17 met: 

18 (A) The dispute was initially submitted 

19 under paragraph (1) for resolution through the 

20 participant’s dispute resolution process. 

21 (B) The dispute submitted under para22 graph (1) is not resolved— 

23 (i) within 60 days after submission of 

24 the dispute by the consumer; or 

mstockstill on DSKH9S0YB1PROD with BILLS

22 

•HR 1528 IH

1 (ii) to the satisfaction of the con2 sumer. 

3 (C) Notice of the facts of the dispute is 

4 submitted to the Commission not later than 30 

5 days after the date on which the consumer is 

6 notified of the resolution through the partici7 pant’s dispute resolution process. 

8 (D) The consumer has not voluntarily ac9 cepted a resolution of the dispute under para10 graph (1). 

11 (E) The dispute was not resolved through 

12 binding arbitration. 

13 (3) LIMITATION.—Nothing in this Act shall 

14 prevent the Commission from investigating compli15 ance with this Act by a participant in a self-regu16 latory covered entity based upon a complaint from 

17 an individual or covered entity other than a con18 sumer with a dispute with such participant, or on its 

19 own initiative, except that prior to instituting any 

20 such investigation the Commission shall afford the 

21 self-regulatory covered entity a reasonable oppor22 tunity to invoke its own remedial procedures and as23 sure compliance by the participant. 

24 (4) CLEAR AND CONVINCING EVIDENCE.—The 

25 presumption established by paragraph (1) of submstockstill on DSKH9S0YB1PROD with BILLS

23 

•HR 1528 IH

1 section (a) may be overcome by clear and convincing 

2 evidence of non-compliance. 

3 (e) NONRELEASE OF CERTAIN INFORMATION.—The 

4 Commission may not compel a participant in a self-regu5 latory program approved under subsection (b) (or an ad6 ministrator of such a program) to provide proprietary in7 formation or personally identifiable information of con8 sumers to the Commission unless the Commission provides 

9 assurances that such information will not be released to 

10 the public. 

11 (f) MISREPRESENTATION OF SELF-REGULATORY

12 PROGRAM PARTICIPATION.—It is unlawful for a covered 

13 entity to misrepresent that it is a participant in a self14 regulatory program (including through any mechanism 

15 provided under subsection (c)(4)) when such covered enti16 ty is not, in fact, such a participant. 

17 (g) EXEMPTED ENTITY PARTICIPATION.—An entity 

18 that is not a covered entity and that voluntarily partici19 pates in a self-regulatory program under this section shall 

20 enjoy the rights and benefits provided under this section 

21 in any action or investigation under section 5 of the Fed22 eral Trade Commission Act (15 U.S.C. 45) to the extent 

23 that such action or investigation pertains to the entity’s 

24 privacy policy or practices required for participation in the 

25 self-regulatory program. 

mstockstill on DSKH9S0YB1PROD with BILLS

24 

•HR 1528 IH

1 SEC. 10. ENFORCEMENT. 

2 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—A 

3 violation of any provision of this Act by a covered entity 

4 is an unfair or deceptive act or practice unlawful under 

5 section 5(a)(1) of the Federal Trade Commission Act (15 

6 U.S.C. 45(a)(1)), except that the amount of any civil pen7 alty under such Act shall be doubled for a violation of this 

8 Act, but may not exceed $500,000 for all related violations 

9 by a single violator (without respect to the number of con10 sumers affected or the duration of the related violations). 

11 (b) GUIDELINES AND OPINIONS.—In order to assist 

12 in compliance with this Act, the Federal Trade Commis13 sion may promulgate regulations and interpretive rules 

14 under section 18 of the Federal Trade Commission Act 

15 (15 U.S.C. 57a), with respect to specific types of acts or 

16 practices that would, or would not, comply with this Act. 

17 SEC. 11. NO PRIVATE RIGHT OF ACTION. 

18 This Act may not be considered or construed to pro19 vide any private right of action. No private civil action 

20 relating to any act or practice governed under this Act 

21 may be commenced or maintained in any State court or 

22 under State law (including a pendent State claim to an 

23 action under Federal law). 

24 SEC. 12. EFFECT ON OTHER LAWS. 

25 (a) QUALIFIED EXEMPTION FOR COMPLIANCE WITH

26 OTHER FEDERAL PRIVACY LAWS.—To the extent that 

mstockstill on DSKH9S0YB1PROD with BILLS

25 

•HR 1528 IH

1 personally identifiable information protected under this 

2 Act is also protected under a provision of Federal privacy 

3 law described in subsection (c), a covered entity that com4 plies with the relevant provision of such other Federal pri5 vacy law shall be deemed to have complied with the cor6 responding provision of this Act. 

7 (b) PROTECTION OF OTHER FEDERAL PRIVACY

8 LAWS.—Nothing in this Act may be construed to modify, 

9 limit, supersede, or interfere with the operation of the 

10 Federal privacy laws described in subsection (c) or the 

11 provision of information permitted or required, expressly 

12 or by implication, by such laws, with respect to Federal 

13 rights and practices. 

14 (c) OTHER FEDERAL PRIVACY LAWS DESCRIBED.— 

15 The provisions of law to which subsections (a) and (b) 

16 apply are the following: 

17 (1) Section 552a of title 5, United States Code 

18 (commonly known as the Privacy Act of 1974). 

19 (2) The Right to Financial Privacy Act of 1978 

20 (12 U.S.C. 3401 et seq.). 

21 (3) The Fair Credit Reporting Act (15 U.S.C. 

22 1681 et seq.). 

23 (4) The Fair Debt Collection Practices Act (15 

24 U.S.C. 1692 et seq.). 

mstockstill on DSKH9S0YB1PROD with BILLS

26 

•HR 1528 IH

1 (5) The Children’s Online Privacy Protection 

2 Act of 1998 (15 U.S.C. 6501 et seq.). 

3 (6) Title V of the Gramm-Leach-Bliley Act of 

4 1999 (15 U.S.C. 6801 et seq.). 

5 (7) The Electronic Communications Privacy Act 

6 of 1986 (Public Law 99–508). 

7 (8) The Driver’s Privacy Protection Act of 

8 1994 (18 U.S.C. 2721 et seq.). 

9 (9) The Family Educational Rights and Privacy 

10 Act of 1974 (20 U.S.C. 1221 note, 1232g). 

11 (10) Section 445 of the General Education Pro12 visions Act (20 U.S.C. 1232h). 

13 (11) The Privacy Protection Act of 1980 (42 

14 U.S.C. 2000aa et seq.). 

15 (12) Section 222 of the Communications Act of 

16 1934 (47 U.S.C. 222) relating to the Customer Pro17 prietary Network Information. 

18 (13) The Cable Communications Policy Act of 

19 1984 (47 U.S.C. 521 et seq.). 

20 (14) The Communications Assistance for Law 

21 Enforcement Act (47 U.S.C. 1001 et seq.). 

22 (15) The Video Privacy Protection Act of 1988 

23 (Public Law 100–618). 

24 (16) The Telephone Consumer Protection Act 

25 of 1991 (Public Law 102–243). 

mstockstill on DSKH9S0YB1PROD with BILLS

27 

•HR 1528 IH

1 (17) The Health Insurance Portability and Ac2 countability Act of 1996 (Public Law 104–191), as 

3 it relates to an entity described in section 1172(a) 

4 of the Social Security Act (42 U.S.C. 1320d–1(a)) 

5 or to activities regulated under section 1173 of such 

6 Act (42 U.S.C. 1320d–2). 

7 (18) The CAN–SPAM Act of 2003 (15 U.S.C. 

8 7701 et seq.). 

9 (d) PREEMPTION OF STATE PRIVACY LAWS.—This 

10 Act preempts any statutory law, common law, rule, or reg11 ulation of a State, or a political subdivision of a State, 

12 to the extent such law, rule, or regulation relates to or 

13 affects the collection, use, sale, disclosure, retention, or 

14 dissemination of personally identifiable information in 

15 commerce. No State, or political subdivision of a State, 

16 may take any action to enforce this Act. 

17 SEC. 13. EFFECTIVE DATE. 

18 This Act shall apply with respect to personally identi19 fiable information collected on or after the date that is 

20 1 year after the date of enactment of this Act. 

Æ 

mstockstill on DSKH9S0YB1PROD with BILLS