II

106TH CONGRESS

2D SESSION S. 3180

To provide for the disclosure of the collection of information through computer

software, and for other purposes.

IN THE SENATE OF THE UNITED STATES

OCTOBER 6 (legislative day, SEPTEMBER 22), 2000

Mr. EDWARDS introduced the following bill; which was read twice and referred

to the Committee on Commerce, Science, and Transportation

A BILL

To provide for the disclosure of the collection of information

through computer software, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Spyware Control and

5 Privacy Protection Act of 2000’’.

6 SEC. 2. COLLECTION OF INFORMATION BY COMPUTER

7 SOFTWARE.

8 (a) NOTICE AND CHOICE REQUIRED.—

9 (1) IN GENERAL.—Any computer software

10 made available to the public, whether by sale or
2

•S 3180 IS

1 without charge, that includes a capability to collect

2 information about the user of such computer soft3 ware, the hardware on which such computer soft4 ware is used, or the manner in which such computer

5 software is used, and to disclose to such information

6 to any person other than the user of such computer

7 software, shall include—

8 (A) a clear and conspicuous written notice,

9 on the first electronic page of the instructions

10 for the installation of such computer software,

11 that such computer software includes such ca12 pability;

13 (B) a description of the information sub14 ject to collection and the name and address of

15 each person to whom such computer software

16 will transmit or otherwise communicate such in17 formation; and

18 (C) a clear and conspicuous written elec19 tronic notice, in a manner reasonably calculated

20 to provide the user of such computer software

21 with easily understood instructions on how to

22 disable such capability without affecting the

23 performance or operation of such computer

24 software for the purposes for which such com25 puter software was intended.
3

•S 3180 IS

1 (2) ENABLEMENT OF CAPABILITY.—A capa2 bility of computer software described in paragraph

3 (1) may not be enabled unless the user of such com4 puter software provides affirmative consent, in ad5 vance, to the enablement of the capability.

6 (3) EXCEPTION.—The requirements in para7 graphs (1) and (2) shall not apply to any capability

8 of computer software that is reasonably needed to—

9 (A) determine whether or not the user is a

10 licensed or authorized user of such computer

11 software;

12 (B) provide, upon request of the user,

13 technical support of the use of such computer

14 software by the user; or

15 (C) enable an employer to monitor com16 puter usage by its employees while such employ17 ees are within the scope of employment as au18 thorized by applicable Federal, State, or local

19 law.

20 (4) USE OF INFORMATION COLLECTED

21 THROUGH EXCEPTED CAPABILITY.—Any information

22 collected through a capability described in paragraph

23 (1) for a purpose referred to in paragraph (3) may

24 be utilized only for the purpose for which such infor25 mation is collected under paragraph (3).
4

•S 3180 IS

1 (5) ACCESS TO INFORMATION COLLECTED

2 THROUGH EXCEPTED CAPABILITY.—Any person col3 lecting information about a user of computer soft4 ware through a capability described in paragraph (1)

5 shall—

6 (A) upon request of the user, provide rea7 sonable access by user to information so col8 lected;

9 (B) provide a reasonable opportunity for

10 the user to correct, delete, or supplement such

11 information; and

12 (C) make the correction or supplementary

13 information a part of the information about the

14 user for purposes of any future use of such in15 formation under this subsection.

16 (6) SECURITY OF INFORMATION COLLECTED

17 THROUGH EXCEPTED CAPABILITY.—Any person col18 lecting information through a capability described in

19 paragraph (1) shall establish and maintain reason20 able procedures necessary to protect the security,

21 confidentiality, and integrity of such information.

22 (b) PREINSTALLATION.—In the case of computer

23 software described in subsection (a)(1) that is installed on

24 a computer by someone other than the user of such com25 puter software, whether through preinstallation by the
5

•S 3180 IS

1 provider of such computer or computer software, by instal2 lation by someone before delivery of such computer to the

3 user, or otherwise, the notice and instructions under that

4 subsection shall be provided in electronic form to the user

5 before the first use of such computer software by the user.

6 (c) VIOLATIONS.—A violation of subsection (a) or (b)

7 shall be treated as an unfair or deceptive act or practice

8 proscribed by section 18(a)(1)(B) of the Federal Trade

9 Commission Act (15 U.S.C. 57a(a)(1)(B)).

10 (d) DISCLOSURE TO LAW ENFORCEMENT OR UNDER

11 COURT ORDER.—

12 (1) IN GENERAL.—Notwithstanding any other

13 provision of this section, a computer software pro14 vider that collects information about users of the

15 computer software may disclose information about a

16 user of the computer software—

17 (A) to a law enforcement agency in re18 sponse to a warrant issued under the Federal

19 Rules of Criminal Procedure, an equivalent

20 State warrant, or a court order issued in ac21 cordance with paragraph (3); or

22 (B) in response to a court order in a civil

23 proceeding granted upon a showing of compel24 ling need for the information that cannot be ac25 commodated by any other means if—
6

•S 3180 IS

1 (i) the user to whom the information

2 relates is given reasonable notice by the

3 person seeking the information of the court

4 proceeding at which the order is requested;

5 and

6 (ii) the user is afforded a reasonable

7 opportunity to appear and contest the

8 issuance of the requested order or to nar9 row its scope.

10 (2) SAFEGUARDS AGAINST FURTHER DISCLO11 SURE.—A court that issues an order described in

12 paragraph (1) shall impose appropriate safeguards

13 on the use of the information to protect against its

14 unauthorized disclosure.

15 (3) COURT ORDERS.—A court order authorizing

16 disclosure under paragraph (1)(A) may issue only

17 with prior notice to the user and only if the law en18 forcement agency shows that there is probable cause

19 to believe that the user has engaged, is engaging, or

20 is about to engage in criminal activity and that the

21 records or other information sought are material to

22 the investigation of such activity. In the case of a

23 State government authority, such a court order shall

24 not issue if prohibited by the law of such State. A

25 court issuing an order pursuant to this paragraph,
7

•S 3180 IS

1 on a motion made promptly by the computer soft2 ware provider may quash or modify such order if the

3 information or records requested are unreasonably

4 voluminous in nature or if compliance with such

5 order otherwise would cause an unreasonable burden

6 on the provider.

7 (e) PRIVATE RIGHT OF ACTION.—

8 (1) ACTIONS AUTHORIZED.—A person may, if

9 otherwise permitted by the laws or rules of court of

10 a State, bring in an appropriate Federal court, if

11 such laws or rules prohibit such actions, either or

12 both of the actions as follows:

13 (A) An action based on a violation of sub14 section (a) or (b) to enjoin such violation.

15 (B) An action to recover actual monetary

16 loss for a violation of subsection (a) or (b) in

17 an amount equal to the greater of—

18 (i) the amount of such actual mone19 tary loss; or

20 (ii) $2,500 for such violation, not to

21 exceed a total amount of $500,000.

22 (2) ADDITIONAL REMEDY.—If the court in an

23 action under paragraph (1) finds that the defendant

24 willfully, knowingly, or repeatedly violated subsection

25 (a) or (b), the court may, in its discretion, increase
8

•S 3180 IS

1 the amount of the award under paragraph (1)(B) to

2 an amount not greater than three times the amount

3 available under paragraph (1)(B)(ii).

4 (3) LITIGATION COSTS AND ATTORNEY FEES.—

5 In any action under paragraph (1), the court may,

6 in its discretion, require an undertaking for the pay7 ment of the costs of such action and assess reason8 able costs, including reasonable attorney fees,

9 against the defendant.

10 (4) VENUE.—In addition to any contractual

11 provision otherwise, venue for an action under para12 graph (1) shall lie where the computer software con13 cerned was installed or used or where the person al14 leged to have committed the violation concerned is

15 found.

16 (5) PROTECTION OF TRADE SECRETS.—At the

17 request of any party to an action under paragraph

18 (1), or any other participant in such action, the

19 court may, in its discretion, issue a protective order

20 and conduct proceedings in such action so as to pro21 tect the secrecy and security of the computer, com22 puter network, computer data, computer program,

23 and computer software involved in order to—

24 (A) prevent possible recurrence of the

25 same or a similar act by another person; or
9

•S 3180 IS

1 (B) protect any trade secrets of such party

2 or participant.

3 (f) DEFINITIONS.—In this section:

4 (1) COLLECT.—The term ‘‘collect’’ means the

5 gathering of information about a computer or a user

6 of computer software by any means, whether direct

7 or indirect and whether active or passive.

8 (2) COMPUTER.—The term ‘‘computer’’ means

9 a programmable electronic device that can store, re10 trieve, and process data.

11 (3) COMPUTER SOFTWARE.—(A) Except as pro12 vided in subparagraph (B), the term ‘‘computer soft13 ware’’ means any program designed to cause a com14 puter to perform a desired function or functions.

15 (B) The term does not include a text file, or

16 cookie, placed on a person’s computer system by an

17 Internet service provider, interactive computer serv18 ice, or commercial Internet website to return infor19 mation to the Internet service provider, interactive

20 computer service, commercial Internet website, or

21 third party if the person subsequently uses the

22 Internet service provider or interactive computer

23 service, or accesses the commercial Internet website.
10

•S 3180 IS

1 (4) INFORMATION.—The term ‘‘information’’

2 means information that personally identifies a user

3 of computer software, including the following:

4 (A) A first and last name, whether given

5 at birth or adoption, assumed, or legally

6 changed.

7 (B) A home or other physical address in8 cluding street name and name of a city or town.

9 (C) An electronic mail address.

10 (D) A telephone number.

11 (E) A social security number.

12 (F) A credit card number, any access code

13 associated with the credit card, or both.

14 (G) A birth date, birth certificate number,

15 or place of birth.

16 (H) Any other unique information identi17 fying an individual that a computer software

18 provider, Internet service provider, interactive

19 computer service, or operator of a commercial

20 Internet website collects and combines with in21 formation described in subparagraphs (A)

22 through (G) of this paragraph.

23 (5) PERSON.—The term ‘‘person’’ has the

24 meaning given that term in section 3(32) of the

25 Communications Act of 1934 (47 U.S.C. 153(32)).
11

•S 3180 IS

1 (6) USER.—The term ‘‘user’’ means an indi2 vidual who acquires, through purchase or otherwise,

3 computer software for purposes other than resale.

4 (g) EFFECTIVE DATE.—This section shall take effect

5 180 days after the date of the enactment of this Act.

Æ