II

106TH CONGRESS

1ST SESSION S. 809

To require the Federal Trade Commission to prescribe regulations to protect

the privacy of personal information collected from and about individuals

who are not covered by the Children’s Online Privacy Protection Act

of 1998 on the Internet, to provide greater individual control over the

collection and use of that information, and for other purposes.

IN THE SENATE OF THE UNITED STATES

APRIL 15, 1999

Mr. BURNS (for himself and Mr. WYDEN) introduced the following bill; which

was read twice and referred to the Committee on Commerce, Science, and

Transportation

A BILL

To require the Federal Trade Commission to prescribe regulations to protect the privacy of personal information

collected from and about individuals who are not covered

by the Children’s Online Privacy Protection Act of 1998

on the Internet, to provide greater individual control

over the collection and use of that information, and

for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,
2

S 809 IS

1 SECTION 1. SHORT TITLE.

2 This Act may be cited as the ‘‘Online Privacy Protec3 tion Act of 1999’’.

4 SEC. 2. REGULATION OF UNFAIR AND DECEPTIVE ACTS

5 AND PRACTICES IN CONNECTION WITH THE

6 COLLECTION, USE AND DISCLOSURE OF PER7 SONAL INFORMATION.

8 (a) ACTS PROHIBITED.—

9 (1) IN GENERAL.—It is unlawful for an oper10 ator of a Web site or online service to collect, use

11 or disclose personal information in a manner that

12 violates the regulations prescribed under subsection

13 (b).

14 (2) DISCLOSURE.—Notwithstanding paragraph

15 (1), neither an operator of a Web site or online serv16 ice nor the operator’s agent shall be held to be liable

17 under this Act for any disclosure made in good faith

18 and following reasonable procedures in responding to

19 a request under subsection (b)(1)(B) by an indi20 vidual for disclosure of personal information per21 taining to such individual.

22 (b) REGULATIONS.—

23 (1) IN GENERAL.—Not later than 1 year after

24 the date of the enactment of this Act, the Commis25 sion shall promulgate under section 553 of title 5,

26 United States Code, regulations that—
3

S 809 IS

1 (A) require the operator of any Web site or

2 online service—

3 (i) to provide notice on its Web site,

4 in a clear and conspicuous manner, of the

5 identity of the operator, what personal in6 formation is collected by the operator, how

7 the operator uses such information, and

8 what information may be shared with other

9 companies; and

10 (ii) to provide a meaningful and sim11 ple online process for individuals to con12 sent to or limit the disclosure of personal

13 information for purposes unrelated to

14 those for which such information was ob15 tained or described in the notice under

16 clause (i);

17 (B) require the operator to provide, upon

18 request of an individual under this subpara19 graph who has provided personal information to

20 that Web site or online service, upon proper

21 identification—

22 (i) a description of the specific types

23 of personal information collected by that

24 operator that was sold or transferred to an

25 external company; and
4

S 809 IS

1 (ii) notwithstanding any other provi2 sion of law, a means that is reasonable

3 under the circumstances for the individual

4 to obtain the personal information de5 scribed in paragraph (i) from such indi6 vidual; and

7 (C) require the operator of such Web site

8 or online service to establish and maintain rea9 sonable procedures to protect the confiden10 tiality, security, and integrity of personal infor11 mation it collects or maintains.

12 (2) WHEN PURPOSE LIMITATION NOT RE13 QUIRED.—The regulations shall provide that the

14 purpose limitation required under paragraph

15 (1)(A)(ii) is not required for—

16 (A) transactional information where identi17 fiable information is not removed;

18 (B) personal information where it is used

19 to render or conduct a legitimate business activ20 ity related to the business of the operator (for

21 example, the use of an e-mail address to re22 spond to an e-mail communication); or

23 (C) the collection, use, or dissemination of

24 such information by the operator of such a Web
5

S 809 IS

1 site or online service necessary to the extent

2 permitted under other provisions of law.

3 (3) WHEN ACCESS NOT REQUIRED.—The regu4 lations shall provide that access as required under

5 paragraph (1)(B)(ii) is not required—

6 (A) to transactional information where

7 identifiable information is not removed;

8 (B) to information that is commercially

9 confidential to the operator and is obtained

10 from sources outside of the individual’s contact

11 with the operator’s web site;

12 (C) to information that is solely for inter13 nal company processes and is neither sold,

14 transferred, nor used for activities external to

15 the web site’s operator;

16 (D) to information that is discarded upon

17 the conclusion of the process that generates it;

18 or

19 (E) to information that has no impact

20 upon an individual.

21 (4) TERMINATION OF SERVICE.—The regula22 tions shall permit the operator of a Web site or an

23 online service to terminate service provided to an in24 dividual who has refused, under the regulations pre25 scribed under paragraph (1)(B)(ii), to permit the op-
6

S 809 IS

1 erator’s further use or maintenance in retrievable

2 form, or future collection, of personal information.

3 (c) ENFORCEMENT.—Subject to sections 3 and 5, a

4 violation of a regulation prescribed under subsection (a)

5 shall be treated as a violation of a rule defining an unfair

6 or deceptive act or practice prescribed under section

7 18(a)(1)(B) of the Federal Trade Commission Act (15

8 U.S.C. 57a(a)(1)(B)).

9 (d) NO REQUIREMENT TO COLLECT OR MAINTAIN

10 DATA.—Nothing in this Act shall be interpreted to require

11 an operator to collect or maintain any data that would

12 not otherwise be collected or maintained.

13 SEC. 3. SAFE HARBORS.

14 (a) GUIDELINES.—An operator may satisfy the re15 quirements of regulations issued under section 2(b) by fol16 lowing a set of self-regulatory guidelines, issued by rep17 resentatives of the marketing or online industries, or by

18 other persons, approved under subsection (b).

19 (b) INCENTIVES.—

20 (1) SELF-REGULATORY INCENTIVES.—In pre21 scribing regulations under section 2, the Commission

22 shall provide incentives for self-regulation by opera23 tors to implement the protections afforded under the

24 regulatory requirements described in subsection (b)

25 of that section.
7

S 809 IS

1 (2) DEEMED COMPLIANCE.—Such incentives

2 shall include provisions for ensuring that a person

3 will be deemed to be in compliance with the require4 ments of the regulations under section 2 if that per5 son complies with guidelines that, after notice and

6 comment, are approved by the Commission upon

7 making a determination that the guidelines meet the

8 requirements of the regulations issued under section

9 2.

10 (3) EXPEDITED RESPONSE TO REQUESTS.—The

11 Commission shall act upon requests for safe harbor

12 treatment within 180 days of the filing of the re13 quest, and shall set forth in writing its conclusions

14 with regard to such requests.

15 (c) APPEALS.—Final action by the Commission on a

16 request for approval of guidelines, or the failure to act

17 within 180 days on a request for approval of guidelines,

18 submitted under subsection (b) may be appealed to a dis19 trict court of the United States of appropriate jurisdiction

20 as provided for in section 706 of title 5, United States

21 Code.

22 SEC. 4. ACTIONS BY STATES.

23 (a) IN GENERAL.—

24 (1) CIVIL ACTIONS.—In any case in which the

25 attorney general of a State has reason to believe
8

S 809 IS

1 that an interest of the residents of that State has

2 been or is threatened or adversely affected by the

3 engagement of any person in a practice that violates

4 any regulation of the Commission prescribed under

5 section 2(b) of this Act, the State may bring a civil

6 action on behalf of the residents of the State in a

7 district court of the United States of appropriate ju8 risdiction to—

9 (A) enjoin that practice;

10 (B) enforce compliance with the regulation;

11 (C) obtain damage, restitution, or other

12 compensation on behalf of residents of the

13 State; or

14 (D) obtain such other relief as the court

15 may consider to be appropriate.

16 (2) NOTICE.—

17 (A) IN GENERAL.—Before filing an action

18 under paragraph (1), the attorney general of

19 the State involved shall provide to the

20 Commission—

21 (i) written notice of that action; and

22 (ii) a copy of the complaint for that

23 action.

24 (B) EXEMPTION.—
9

S 809 IS

1 (i) IN GENERAL.—Subparagraph (A)

2 shall not apply with respect to the filing of

3 an action by an attorney general of a State

4 under this subsection, if the attorney gen5 eral determines that it is not feasible to

6 provide the notice described in that sub7 paragraph before the filing of the action.

8 (ii) NOTIFICATION.—In an action de9 scribed in clause (i), the attorney general

10 of a State shall provide notice and a copy

11 of the complaint to the Commission at the

12 same time as the attorney general files the

13 action.

14 (b) INTERVENTION.—

15 (1) IN GENERAL.—On receiving notice under

16 subsection (a)(2), the Commission shall have the

17 right to intervene in the action that is the subject

18 of the notice.

19 (2) EFFECT OF INTERVENTION.—If the Com20 mission intervenes in an action under subsection (a),

21 it shall have the right—

22 (A) to be heard with respect to any matter

23 that arises in that action; and

24 (B) to file a petition for appeal.
10

S 809 IS

1 (3) AMICUS CURIAE.—Upon application to the

2 court, a person whose self-regulatory guidelines have

3 been approved by the Commission and are relied

4 upon as a defense by any defendant to a proceeding

5 under this section may file amicus curiae in that

6 proceeding.

7 (c) CONSTRUCTION.—For purposes of bringing any

8 civil action under subsection (a), nothing in this Act shall

9 be construed to prevent an attorney general of a State

10 from exercising the powers conferred on the attorney gen11 eral by the laws of that State to—

12 (1) conduct investigations;

13 (2) administer oaths or affirmations; or

14 (3) compel the attendance of witnesses or the

15 production of documentary and other evidence.

16 (d) VENUE; SERVICE OF PROCESS.—

17 (1) VENUE.—Any action brought under sub18 section (a) may be brought in the district court of

19 the United States that meets applicable require20 ments relating to venue under section 1391 of title

21 28, United States Code.

22 (2) SERVICE OF PROCESS.—In an action

23 brought under subsection (a), process may be served

24 in any district in which the defendant—

25 (A) is an inhabitant; or
11

S 809 IS

1 (B) may be found.

2 SEC. 6. ADMINISTRATION AND APPLICABILITY OF ACT.

3 (a) IN GENERAL.—Except as otherwise provided, this

4 Act shall be enforced by the Commission under the Fed5 eral Trade Commission Act (15 U.S.C. 41 et seq.).

6 (b) PROVISIONS.—Compliance with the requirements

7 imposed under this Act shall be enforced under—

8 (1) section 8 of the Federal Deposit Insurance

9 Act (12 U.S.C. 1818), in the case of—

10 (A) national banks, and Federal branches

11 and Federal agencies of foreign banks, by the

12 Office of the Comptroller of the Currency;

13 (B) member banks of the Federal Reserve

14 System (other than national banks), branches

15 and agencies of foreign banks (other than Fed16 eral branches, Federal agencies, and insured

17 State branches of foreign banks), commercial

18 lending companies owned or controlled by for19 eign banks, and organizations operating under

20 section 25 or 25(a) of the Federal Reserve Act

21 (12 U.S.C. 601 et seq. and 611 et. seq.), by the

22 Board; and

23 (C) banks insured by the Federal Deposit

24 Insurance Corporation (other than members of

25 the Federal Reserve System) and insured State
12

S 809 IS

1 branches of foreign banks, by the Board of Di2 rectors of the Federal Deposit Insurance Cor3 poration;

4 (2) section 8 of the Federal Deposit Insurance

5 Act (12 U.S.C. 1818), by the Director of the Office

6 of Thrift Supervision, in the case of a savings asso7 ciation the deposits of which are insured by the Fed8 eral Deposit Insurance Corporation;

9 (3) the Federal Credit Union Act (12 U.S.C.

10 1751 et seq.) by the National Credit Union Adminis11 tration Board with respect to any Federal credit

12 union;

13 (4) part A of subtitle VII of title 49, United

14 States Code, by the Secretary of Transportation

15 with respect to any air carrier or foreign air carrier

16 subject to that part;

17 (5) the Packers and Stockyards Act, 1921 (7

18 U.S.C. 181 et seq.) (except as provided in section

19 406 of that Act (7 U.S.C. 226, 227)), by the Sec20 retary of Agriculture with respect to any activities

21 subject to that Act; and

22 (6) the Farm Credit Act of 1971 (12 U.S.C.

23 2001 et seq.) by the Farm Credit Administration

24 with respect to any Federal land bank, Federal land
13

S 809 IS

1 bank association, Federal intermediate credit bank,

2 or production credit association.

3 (c) EXERCISE OF CERTAIN POWERS.—For the pur4 pose of the exercise by any agency referred to in sub5 section (b) of its powers under any other Act referred to

6 in that subsection, a violation of any requirement imposed

7 under this Act shall be deemed to be a violation of a re8 quirement imposed under that other Act. In addition to

9 its powers under any provision of law specifically referred

10 to in subsection (b), each of the agencies referred to in

11 that subsection may exercise, for the purpose of enforcing

12 compliance with any requirement imposed under this Act,

13 any other authority conferred on such agency by law.

14 (d) ACTIONS BY THE COMMISSION.—The Commis15 sion shall prevent any person from violating a rule of the

16 Commission under section 2 in the same manner, by the

17 same means, and with the same jurisdiction, powers, and

18 duties as though all applicable terms and provisions of the

19 Federal Trade Commission Act (15 U.S.C. 41 et seq.)

20 were incorporated into and made a part of this title. Any

21 entity that violates such rule shall be subject to the pen22 alties and entitled to the privileges and immunities pro23 vided in the Federal Trade Commission Act in the same

24 manner, by the same means, and with the same jurisdic25 tion, power, and duties as though all applicable terms and
14

S 809 IS

1 provisions of the Federal Trade Commission Act were in

2 corporated into and made a part of this title.

3 (e) EFFECT ON OTHER LAWS.—Nothing contained in

4 this Act shall be construed to limit the authority of the

5 Commission under any other provisions of law.

6 (f) PREEMPTION.—Except as otherwise provided in

7 this Act, this Act supersedes State law to the extent that

8 it establishes a rule of law applicable to an online privacy

9 action that is inconsistent with State law. Nothing in this

10 Act supersedes State law with respect to prosecution of

11 fraud.

12 SEC. 6. REVIEW.

13 Not later than 5 years after the effective date of the

14 regulations initially issued under section 2, the Commis15 sion shall—

16 (1) review the implementation of this Act, in17 cluding the effect of the implementation of this title

18 on practices relating to the collection and disclosure

19 of information; and

20 (2) prepare and submit to Congress a report on

21 the results of the review under paragraph (1).

22 SEC. 7. EFFECTIVE DATE.

23 Sections 3(a), 5, and 6 of this Act shall take effect

24 on the later of—
15

S 809 IS

1 (1) the date that is 18 months after the date

2 of enactment of this Act; or

3 (2) the date on which the Commission rules on

4 the first application filed for safe harbor treatment

5 under section 3 if the Commission does not rule on

6 the first such application within one year after the

7 date of enactment of this Act, but in no case later

8 than the date that is 30 months after the date of

9 enactment of this Act.

10 SEC. 8. DEFINITIONS.

11 In this Act:

12 (1) INDIVIDUAL.—The term ‘‘individual’’ means

13 a natural person of age 13 and above.

14 (2) OPERATOR.—The term ‘‘operator’’—

15 (A) means any person who operates a Web

16 site located on the Internet or an online service

17 and who collects or maintains personal informa18 tion from or about the users of or visitors to

19 such Web site or online service, or on whose be20 half such information is collected or main21 tained, where such Web site or online service is

22 operated for commercial purposes, including

23 any person offering products or services for sale

24 through that Web site or online service, involv25 ing commerce—
16

S 809 IS

1 (i) among the several States or with 1

2 or more foreign nations;

3 (ii) in any territory of the United

4 States or in the District of Columbia, or

5 between any such territory and—

6 (I) another such territory; or

7 (II) any State or foreign nation;

8 or

9 (iii) between the District of Columbia

10 and any State, territory, or foreign nation;

11 but

12 (B) does not include any nonprofit entity

13 that would otherwise be exempt from coverage

14 under section 5 of the Federal Trade Commis15 sion Act (15 U.S.C. 45).

16 (3) COMMISSION.—The term ‘‘Commission’’

17 means the Federal Trade Commission.

18 (4) DISCLOSURE.—The term ‘‘disclosure’’

19 means, with respect to personal information the re20 lease of personal information collected in identifiable

21 form by an operator for any purpose, except where

22 such information is provided to a person other than

23 the operator who provides support for the internal

24 operations of the Web site and does not disclose or

25 use that information for any other purpose.
17

S 809 IS

1 (5) FEDERAL AGENCY.—The term ‘‘Federal

2 agency’’ means an agency, as that term is defined

3 in section 551(1) of title 5, United States Code.

4 (6) INTERNET.—The term ‘‘Internet’’ means

5 collectively the myriad of computer and tele6 communications facilities, including equipment and

7 operating software, which comprise the inter8 connected world-wide network of networks that em9 ploy the Transmission Control Protocol/Internet

10 Protocol, or any predecessor or successor protocols

11 to such protocol, to communicate information of all

12 kinds by wire or radio.

13 (7) TRANSACTIONAL INFORMATION.—The term

14 ‘‘transactional information’’ means information gen15 erated in connection with the process of requesting,

16 accessing, or otherwise using the Internet.

17 (8) PERSONAL INFORMATION.—The term ‘‘per18 sonal information’’ means information collected on19 line from an individual that identifies that indi20 vidual, including—

21 (A) first and last name;

22 (B) home and other physical address;

23 (C) email address;

24 (D) social security number;

25 (E) telephone number;
18

S 809 IS

1 (F) any other identifier that the Commis2 sion determines identifies an individual; or

3 (G) information that is maintained with, or

4 can be searched or retrieved by means of, data

5 described in subparagraphs (A) through (F).

Æ