II

106TH CONGRESS

2D SESSION S. 2928

To protect the privacy of consumers who use the Internet.

IN THE SENATE OF THE UNITED STATES

JULY 26, 2000

Mr. MCCAIN (for himself, Mr. KERRY, Mr. ABRAHAM, and Mrs. BOXER) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transporation

A BILL

To protect the privacy of consumers who use the Internet.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Consumer Internet

5 Privacy Enhancement Act’’.

6 SEC. 2. COLLECTION OF PERSONALLY IDENTIFIABLE IN7 FORMATION.

8 (a) IN GENERAL.—It is unlawful for a commercial

9 website operator to collect personally identifiable informa10 tion online from a user of that website unless the operator

11 provides—
2

•S 2928 IS

1 (1) notice to the user on the website in accord2 ance with the requirements of subsection (b); and

3 (2) an opportunity to that user to limit the use

4 for marketing purposes, or disclosure to third par5 ties of personally identifiable information collected

6 that is—

7 (A) not related to provision of the products

8 or services provided by the website; or

9 (B) not required to be disclosed by law.

10 (b) NOTICE.—

11 (1) IN GENERAL.—For purposes of subsection

12 (a), notice consists of a statement that informs a

13 user of a website of the following:

14 (A) The identity of the operator of the

15 website and of any third party the operator

16 knowingly permits to collect personally identifi17 able information from users through the

18 website, including the provision of an electronic

19 means of going to a website operated by any

20 such third party.

21 (B) A list of the types of personally identi22 fiable information that may be collected online

23 by the operator and the categories of informa24 tion the operator may collect in connection with

25 the user’s visit to the website.
3

•S 2928 IS

1 (C) A description of how the operator uses

2 such information, including a statement as to

3 whether the information may be sold, distrib4 uted, disclosed, or otherwise made available to

5 third parties for marketing purposes.

6 (D) A description of the categories of po7 tential recipients of any such personally identifi8 able information.

9 (E) Whether the user is required to pro10 vide personally identifiable information in order

11 to use the website and any other consequences

12 of failure to provide that information.

13 (F) A general description of what steps the

14 operator takes to protect the security of person15 ally identifiable information collected online by

16 that operator.

17 (G) A description of the means by which a

18 user may elect not to have the user’s personally

19 identifiable information used by the operator

20 for marketing purposes or sold, distributed, dis21 closed, or otherwise made available to a third

22 party, except for—

23 (i) information related to the provi24 sion of the product or service provided by

25 the website; or
4

•S 2928 IS

1 (ii) information required to be dis2 closed by law.

3 (H) The address or telephone number at

4 which the user may contact the website oper5 ator about its information practices and also an

6 electronic means of contacting the operator.

7 (2) FORM OF NOTICE.—The notice required by

8 subsection (a) shall be clear, conspicuous, and easily

9 understood.

10 (3) OPPORTUNITY TO LIMIT DISCLOSURE.—The

11 opportunity provided to users to limit use and disclo12 sure of personally identifiable information shall be

13 easy to use, easily accessible, and shall be available

14 online.

15 (c) INCONSISTENT STATE LAW.—No State or local

16 government may impose any liability for commercial ac17 tivities or actions by a commercial website operator in

18 interstate or foreign commerce in connection with an ac19 tivity or action described in this Act that is inconsistent

20 with, or more restrictive than, the treatment of that activ21 ity or action under this section.

22 (d) SAFE HARBOR.—A commercial website operator

23 may not be held to have violated any provision of this Act

24 if it complies with self-regulatory guidelines that—
5

•S 2928 IS

1 (1) are issued by seal programs or representa2 tives of the marketing or online industries or by any

3 other person; and

4 (2) are approved by the Commission as con5 taining all the requirements set forth in subsection

6 (b).

7 SEC. 3. ENFORCEMENT.

8 (a) IN GENERAL.—The violation of section 2(a) or

9 (b) shall be treated as a violation of a rule defining an

10 unfair or deceptive act or practice in or affecting com11 merce proscribed by section 18(a)(1)(B) of the Federal

12 Trade Commission Act (15 U.S.C. 57(a)(1)(B)).

13 (b) ENFORCEMENT BY CERTAIN OTHER AGEN14 CIES.—Compliance with section 2(a) or (b) shall be en15 forced under—

16 (1) section 8 of the Federal Deposit Insurance

17 Act (12 U.S.C. 1818), in the case of—

18 (A) national banks, and Federal branches

19 and Federal agencies of foreign banks, by the

20 Office of the Comptroller of the Currency;

21 (B) member banks of the Federal Reserve

22 System (other than national banks), branches

23 and agencies of foreign banks (other than Fed24 eral branches, Federal agencies, and insured

25 State branches of foreign banks), commercial
6

•S 2928 IS

1 lending companies owned or controlled by for2 eign banks, and organizations operating under

3 section 25 or 25(a) of the Federal Reserve Act

4 (12 U.S.C. 601 et seq. and 611 et seq.), by the

5 Board; and

6 (C) banks insured by the Federal Deposit

7 Insurance Corporation (other than members of

8 the Federal Reserve System) and insured State

9 branches of foreign banks, by the Board of Di10 rectors of the Federal Deposit Insurance Cor11 poration;

12 (2) section 8 of the Federal Deposit Insurance

13 Act (12 U.S.C. 1818), by the Director of the Office

14 of Thrift Supervision, in the case of a savings asso15 ciation the deposits of which are insured by the Fed16 eral Deposit Insurance Corporation;

17 (3) the Federal Credit Union Act (12 U.S.C.

18 1751 et seq.) by the National Credit Union Adminis19 tration Board with respect to any Federal credit

20 union;

21 (4) part A of subtitle VII of title 49, United

22 States Code, by the Secretary of Transportation

23 with respect to any air carrier or foreign air carrier

24 subject to that part;
7

•S 2928 IS

1 (5) the Packers and Stockyards Act, 1921 (7

2 U.S.C. 181 et seq.) (except as provided in section

3 406 of that Act (7 U.S.C. 226, 227)), by the Sec4 retary of Agriculture with respect to any activities

5 subject to that Act; and

6 (6) the Farm Credit Act of 1971 (12 U.S.C.

7 2001 et seq.) by the Farm Credit Administration

8 with respect to any Federal land bank, Federal land

9 bank association, Federal intermediate credit bank,

10 or production credit association.

11 (c) EXERCISE OF CERTAIN POWERS.—For the pur12 pose of the exercise by any agency referred to in sub13 section (b) of its powers under any Act referred to in that

14 subsection, a violation of section 2(a) or (b) is deemed to

15 be a violation of a requirement imposed under that Act.

16 In addition to its powers under any provision of law spe17 cifically referred to in subsection (b), each of the agencies

18 referred to in that subsection may exercise, for the pur19 pose of enforcing compliance with any requirement im20 posed under section 2(a) or (b), any other authority con21 ferred on it by law.

22 (d) ACTIONS BY THE COMMISSION.—The Commis23 sion shall prevent any person from violating section 2(a)

24 or (b) in the same manner, by the same means, and with

25 the same jurisdiction, powers, and duties as though all ap-
8

•S 2928 IS

1 plicable terms and provisions of the Federal Trade Com2 mission Act (15 U.S.C. 41 et seq.) were incorporated into

3 and made a part of this Act. Any entity that violates any

4 provision of that title is subject to the penalties and enti5 tled to the privileges and immunities provided in the Fed6 eral Trade Commission Act in the same manner, by the

7 same means, and with the same jurisdiction, power, and

8 duties as though all applicable terms and provisions of the

9 Federal Trade Commission Act were incorporated into and

10 made a part of that title.

11 (e) RELATIONSHIP TO OTHER LAWS.—

12 (1) COMMISSION AUTHORITY.—Nothing con13 tained in this Act shall be construed to limit the au14 thority of the Commission under any other provision

15 of law.

16 (2) COMMUNICATIONS ACT.—Nothing in section

17 2(a) or (b) requires an operator of a website to take

18 any action that is inconsistent with the requirements

19 of section 222 or 631 of the Communications Act of

20 1934 (47 U.S.C. 222 or 551, respectively).

21 (3) OTHER ACTS.—Nothing in this Act is in22 tended to affect any provision of, or any amendment

23 made by—

24 (A) the Children’s Online Privacy Protec25 tion Act of 1998;
9

•S 2928 IS

1 (B) the Gramm-Leach-Bliley Act; or

2 (C) the Health Insurance Portability and

3 Accountability Act of 1996.

4 (f) CIVIL PENALTY.—In addition to any other pen5 alty applicable to a violation of section 2(a), there is here6 by imposed a civil penalty of $22,000 for each such viola7 tion. In the event of a continuing violation, each day on

8 which the violation continues shall be considered as a sepa9 rate violation for purposes of this subsection. The max10 imum penalty under this subsection for a related series

11 of violations is $500,000. For purposes of this subsection,

12 the violation of an order issued by the Commission under

13 this Act shall not be considered to be a violation of section

14 2(a) of this Act.

15 SEC. 4. ACTIONS BY STATES.

16 (a) IN GENERAL.—

17 (1) CIVIL ACTIONS.—In any case in which the

18 attorney general of a State has reason to believe

19 that an interest of the residents of that State has

20 been or is threatened or adversely affected by the

21 engagement of any person in a practice that violates

22 section 2(a) or (b), the State, as parens patriae, may

23 bring a civil action on behalf of the residents of the

24 State in a district court of the United States of ap25 propriate jurisdiction to—
10

•S 2928 IS

1 (A) enjoin that practice;

2 (B) obtain damage, restitution, or other

3 compensation on behalf of residents of the

4 State; or

5 (C) obtain such other relief as the court

6 may consider to be appropriate.

7 (2) NOTICE.—

8 (A) IN GENERAL.—Before filing an action

9 under paragraph (1), the attorney general of

10 the State involved shall provide to the

11 Commission—

12 (i) written notice of that action; and

13 (ii) a copy of the complaint for that

14 action.

15 (B) EXEMPTION.—

16 (i) IN GENERAL.—Subparagraph (A)

17 shall not apply with respect to the filing of

18 an action by an attorney general of a State

19 under this subsection, if the attorney gen20 eral determines that it is not feasible to

21 provide the notice described in that sub22 paragraph before the filing of the action.

23 (ii) NOTIFICATION.—In an action de24 scribed in clause (i), the attorney general

25 of a State shall provide notice and a copy
11

•S 2928 IS

1 of the complaint to the Commission at the

2 same time as the attorney general files the

3 action.

4 (b) INTERVENTION.—

5 (1) IN GENERAL.—On receiving notice under

6 subsection (a)(2), the Commission shall have the

7 right to intervene in the action that is the subject

8 of the notice.

9 (2) EFFECT OF INTERVENTION.—If the Com10 mission intervenes in an action under subsection (a),

11 it shall have the right—

12 (A) to be heard with respect to any matter

13 that arises in that action; and

14 (B) to file a petition for appeal.

15 (3) AMICUS CURIAE.—Upon application to the

16 court, a person whose self-regulatory guidelines have

17 been approved by the Commission and are relied

18 upon as a defense by any defendant to a proceeding

19 under this section may file amicus curiae in that

20 proceeding.

21 (c) CONSTRUCTION.—For purposes of bringing any

22 civil action under subsection (a), nothing in this Act shall

23 be construed to prevent an attorney general of a State

24 from exercising the powers conferred on the attorney gen25 eral by the laws of that State to—
12

•S 2928 IS

1 (1) conduct investigations;

2 (2) administer oaths or affirmations; or

3 (3) compel the attendance of witnesses or the

4 production of documentary and other evidence.

5 (d) ACTIONS BY THE COMMISSION.—In any case in

6 which an action is instituted by or on behalf of the Com7 mission for violation of section 2(a) or (b) no State may,

8 during the pendency of that action, institute an action

9 under subsection (a) against any defendant named in the

10 complaint in that action for violation of that rule.

11 (e) VENUE; SERVICE OF PROCESS.—

12 (1) VENUE.—Any action brought under sub13 section (a) may be brought in the district court of

14 the United States that meets applicable require15 ments relating to venue under section 1391 of title

16 28, United States Code.

17 (2) SERVICE OF PROCESS.—In an action

18 brought under subsection (a), process may be served

19 in any district in which the defendant—

20 (A) is an inhabitant; or

21 (B) may be found.

22 SEC. 5. STUDY OF ONLINE PRIVACY.

23 (a) IN GENERAL.—Within 90 days after the date of

24 enactment of this Act, the Commission shall execute a con25 tract with the National Research Council of the National
13

•S 2928 IS

1 Academy of Sciences for a study of privacy that will exam2 ine causes for concern about privacy in the information

3 age and tools and strategies for responding to those con4 cerns.

5 (b) SCOPE.—The study required by subsection (a)

6 shall—

7 (1) survey the risks to, and benefits associated

8 with the use of, personal information associated with

9 information technology, including actual and poten10 tial issues related to trends in technology;

11 (2) examine the costs and benefits involved in

12 the collection and use of personal information;

13 (3) examine the differences, if any, between the

14 collection and use of personal information by the on15 line industry and the collection and use of personal

16 information by other businesses;

17 (4) examine the costs, risks, and benefits of

18 providing consumer access to information collected

19 online, and examine approaches to providing such

20 access;

21 (5) examine the security of personal informa22 tion collected online;

23 (6) examine such other matters relating to the

24 collection, use, and protection of personal informa-
14

•S 2928 IS

1 tion online as the Council and the Commission con2 sider appropriate; and

3 (7) examine efforts being made by industry to

4 provide notice, choice, access, and security.

5 (c) RECOMMENDATIONS.—Within 12 months after

6 the Commission’s request under subsection (a), the Coun7 cil shall complete the study and submit a report to the

8 Congress, including recommendations for private and pub9 lic sector actions including self-regulation, laws, regula10 tions, or special agreements.

11 (d) AGENCY COOPERATION.—The head of each Fed12 eral department or agency shall, at the request of the

13 Commission or the Council, cooperate as fully as possible

14 with the Council in its activities in carrying out the study.

15 (e) FUNDING.—The Commission is authorized to be

16 obligate not more than $1,000,000 to carry out this sec17 tion from funds appropriated to the Commission.

18 SEC. 6. DEFINITIONS.

19 In this Act:

20 (1) COMMISSION.—The term ‘‘Commission’’

21 means the Federal Trade Commission.

22 (2) COMMERCIAL WEBSITE OPERATOR.—The

23 term ‘‘operator of a commercial website’’—

24 (A) means any person who operates a

25 website located on the Internet or an online
15

•S 2928 IS

1 service and who collects or maintains personal

2 information from or about the users of or visi3 tors to such website or online service, or on

4 whose behalf such information is collected or

5 maintained, where such website or online serv6 ice is operated for commercial purposes, includ7 ing any person offering products or services for

8 sale through that website or online service, in9 volving commerce—

10 (i) among the several States or with 1

11 or more foreign nations;

12 (ii) in any territory of the United

13 States or in the District of Columbia, or

14 between any such territory and—

15 (I) another such territory; or

16 (II) any State or foreign nation;

17 or

18 (iii) between the District of Columbia

19 and any State, territory, or foreign nation;

20 but

21 (B) does not include any nonprofit entity

22 that would otherwise be exempt from coverage

23 under section 5 of the Federal Trade Commis24 sion Act (15 U.S.C. 45).
16

•S 2928 IS

1 (3) COLLECT.—The term ‘‘collect’’ means the

2 gathering of personally identifiable information

3 about a user of an Internet service, online service,

4 or commercial website by or on behalf of the pro5 vider or operator of that service or website by any

6 means, direct or indirect, active or passive,

7 including—

8 (A) an online request for such information

9 by the provider or operator, regardless of how

10 the information is transmitted to the provider

11 or operator;

12 (B) the use of an online service to gather

13 the information; or

14 (C) tracking or use of any identifying code

15 linked to a user of such a service or website, in16 cluding the use of cookies.

17 (4) INTERNET.—The term ‘‘Internet’’ means

18 collectively the myriad of computer and tele19 communications facilities, including equipment and

20 operating software, which comprise the inter21 connected world-wide network of networks that em22 ploy the Transmission Control Protocol/Internet

23 Protocol, or any predecessor or successor protocols

24 to such protocol, to communicate information of all

25 kinds by wire or radio.
17

•S 2928 IS

1 (5) PERSONALLY IDENTIFIABLE INFORMA2 TION.—The term ‘‘personally identifiable informa3 tion’’ means individually identifiable information

4 about an individual collected online, including—

5 (A) a first and last name, whether given at

6 birth or adoption, assumed, or legally changed;

7 (B) a home or other physical address in8 cluding street name and name of a city or town;

9 (C) an e-mail address;

10 (D) a telephone number;

11 (E) a Social Security number; or

12 (F) unique identifying information that an

13 Internet service provider or operator of a com14 mercial website collects and combines with any

15 information described in the preceding subpara16 graphs of this paragraph.

17 (6) ONLINE.—The term ‘‘online’’ refers to any

18 activity regulated by this Act or by section 2710 of

19 title 18, United States Code, that is effected by ac20 tive or passive use of an Internet connection, regard21 less of the medium by or through which that connec22 tion is established.
18

•S 2928 IS

1 (7) THIRD PARTY.—The term ‘‘third party’’,

2 when used in reference to a commercial website op3 erator, means any person other than the operator.

Æ