II 

117TH CONGRESS 

1ST SESSION S. 2290 

To provide for requirements for data brokers with respect to the acquisition, 

use, and protection of brokered personal information and to require 

that data brokers annually register with the Federal Trade Commission. 

IN THE SENATE OF THE UNITED STATES 

JUNE 24, 2021 

Mr. PETERS (for himself, Ms. LUMMIS, and Mrs. CAPITO) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To provide for requirements for data brokers with respect 

to the acquisition, use, and protection of brokered personal information and to require that data brokers annually register with the Federal Trade Commission. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Broker List Act 

5 of 2021’’. 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 2290 IS

1 SEC. 2. REQUIREMENTS FOR DATA BROKERS. 

2 (a) REQUIREMENTS WITH RESPECT TO THE ACQUI3 SITION AND USE OF BROKERED PERSONAL INFORMA4 TION.—A data broker shall not— 

5 (1) acquire brokered personal information 

6 through fraudulent means; 

7 (2) acquire or use brokered personal informa8 tion for the purpose of— 

9 (A) stalking or harassing another person; 

10 (B) committing fraud, including identity 

11 theft, financial fraud, or e-mail fraud; or 

12 (C) engaging in unlawful discrimination, 

13 including unlawful discrimination in decisions 

14 regarding employment, housing, and credit eli15 gibility; or 

16 (3) sell or transfer brokered personal informa17 tion to a third party if the data broker knows or rea18 sonably should know that the third party intends to 

19 engage in any conduct prohibited by this Act. 

20 (b) DUTY TO PROTECT BROKERED PERSONAL IN21 FORMATION.— 

22 (1) IN GENERAL.—A data broker shall develop, 

23 implement, and maintain a comprehensive informa24 tion security program in order to protect from secu25 rity breaches or other inadvertent or improper disVerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290

kjohnson on DSK79L0C42PROD with BILLS
3 

•S 2290 IS

1 closure the brokered personal information acquired 

2 by the data broker. 

3 (2) NOTIFICATION OF CHANGE OF OWNER4 SHIP.—If a data broker is purchased or otherwise 

5 acquired by another entity, such other entity shall 

6 provide notification of such purchase or acquisition 

7 to any consumer with respect to which— 

8 (A) the data broker collected, processed, 

9 analyzed, stored or used brokered personal in10 formation; and 

11 (B) such other entity plans to continue to 

12 collect, process, analyze, store or use such infor13 mation. 

14 (3) PROGRAM REQUIREMENTS.—The com15 prehensive information security program required 

16 under paragraph (1) shall— 

17 (A) be written in one or more readily ac18 cessible parts; and 

19 (B) contain administrative, technical, and 

20 physical safeguards that are appropriate to— 

21 (i) the size, scope, and type of busi22 ness of the data broker; 

23 (ii) the amount of resources available 

24 to the data broker; 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 2290 IS

1 (iii) the amount of stored data of the 

2 data broker; 

3 (iv) the nature and sensitivity of the 

4 brokered personal information stored by 

5 the data broker; and 

6 (v) the need for security and confiden7 tiality of brokered personal information. 

8 (c) ANNUAL REGISTRATION.— 

9 (1) IN GENERAL.—Annually, on or before Janu10 ary 31, a data broker shall— 

11 (A) register with the Commission; and 

12 (B) provide the following information with 

13 such registration: 

14 (i) The name and primary physical, e15 mail, and internet addresses of the data 

16 broker. 

17 (ii) If the data broker permits a con18 sumer to opt out of the data broker’s col19 lection of brokered personal information, 

20 opt out of its databases, or opt out of cer21 tain sales of data— 

22 (I) the method for requesting an 

23 opt-out; 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 2290 IS

1 (II) if the opt-out applies to only 

2 certain activities or sales, which ones; 

3 and 

4 (III) whether the data broker 

5 permits a consumer to authorize a 

6 third party to perform the opt-out on 

7 the consumer’s behalf. 

8 (iii) A statement specifying the data 

9 collection, databases, or sales activities 

10 from which a consumer may not opt out, 

11 and why an opportunity to opt out is not 

12 available. 

13 (iv) A statement specifying the types 

14 of information being collected, as deter15 mined by the Commission, to the extent 

16 practicable. 

17 (v) A statement as to whether the 

18 data broker implements a purchaser 

19 credentialing process and, if so, a descrip20 tion of that process. 

21 (vi) The number of security breaches 

22 that the data broker experienced during 

23 the previous year, and if known, the total 

24 number of consumers whose personal inforVerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290

kjohnson on DSK79L0C42PROD with BILLS
6 

•S 2290 IS

1 mation was accessed, downloaded, viewed, 

2 or otherwise affected in a breach. 

3 (vii) Where the data broker has actual 

4 knowledge that it possesses the brokered 

5 personal information of minors, a separate 

6 statement detailing the data collection 

7 practices, databases, sales activities, and 

8 opt-out policies that are applicable to the 

9 brokered personal information of minors. 

10 (viii) Any additional information or 

11 explanation concerning its data collection 

12 practices. 

13 (2) EXCEPTION.—The requirements under 

14 paragraph (1) shall not apply to a data broker that 

15 is already required to comply with such requirements 

16 with respect to another Federal agency. 

17 (3) PUBLIC AVAILABILITY.—The Commission 

18 shall make the information described in paragraph 

19 (1) available on the internet website of the Commis20 sion, except as necessary to protect the integrity of 

21 ongoing investigations or to protect the privacy of 

22 consumers, or if it is in the interest of public safety 

23 or welfare. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 2290 IS

1 SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMIS2 SION. 

3 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

4 A violation of section 2 shall be treated as a violation of 

5 a rule defining an unfair or a deceptive act or practice 

6 under section 18(a)(1)(B) of the Federal Trade Commis7 sion Act (15 U.S.C. 57a(a)(1)(B)). The Commission shall 

8 begin enforcement of such violations by not later than 1 

9 year after the date of the enactment of this Act. 

10 (b) POWERS OF COMMISSION.— 

11 (1) IN GENERAL.—The Commission shall en12 force this Act in the same manner, by the same 

13 means, and with the same jurisdiction, powers, and 

14 duties as though all applicable terms and provisions 

15 of the Federal Trade Commission Act (15 U.S.C. 41 

16 et seq.) were incorporated into and made a part of 

17 this Act. 

18 (2) PRIVILEGES AND IMMUNITIES.—Any data 

19 broker who violates section 2 shall be subject to the 

20 penalties and entitled to the privileges and immuni21 ties provided in the Federal Trade Commission Act 

22 (15 U.S.C. 41 et seq.). 

23 (3) CIVIL PENALTY.—A data broker that fails 

24 to register as required under section 2(c) shall be 

25 liable for a civil penalty in an amount determined by 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 2290 IS

1 the Commission through the rulemaking authority 

2 under subsection (c). 

3 (4) AUTHORITY PRESERVED.—Nothing in this 

4 Act shall be construed to limit the authority of the 

5 Federal Trade Commission under any other provi6 sion of law. 

7 (c) RULEMAKING AUTHORITY FOR THE COMMIS8 SION.—The Commission shall have authority under sec9 tion 553 of title 5, United States Code, to promulgate reg10 ulations the Commission determines to be necessary to 

11 carry out the provisions of this Act. 

12 SEC. 4. FTC ANNUAL REVIEW AND REPORT. 

13 (a) ANNUAL REVIEW.—The Commission shall con14 duct an annual review of the implementation of the provi15 sions of this Act. Such study shall include an analysis of— 

16 (1) compliance by data brokers with the re17 quirements under section 2; 

18 (2) enforcement actions taken by the Commis19 sion with respect to violations of such requirements; 

20 and 

21 (3) other areas determined appropriate by the 

22 Commission. 

23 (b) ANNUAL REPORT.—Not later than 1 year after 

24 the date of the enactment of this Act, and annually there25 after the Commission shall submit to Congress a report 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 2290 IS

1 on the review conducted under subsection (a), together 

2 with recommendations for such legislation and administra3 tive action as the Commission determines appropriate. 

4 SEC. 5. DEFINITIONS. 

5 In this section: 

6 (1) BROKERED PERSONAL INFORMATION.—The 

7 term ‘‘brokered personal information’’ means any 

8 personal information that is categorized or organized 

9 for sale, license, or trade, or is otherwise disclosed 

10 for compensation, to a third party. 

11 (2) BUSINESS.— 

12 (A) IN GENERAL.—The term ‘‘business’’ 

13 means a commercial entity, including a sole 

14 proprietorship, partnership, corporation, asso15 ciation, limited liability company, or other 

16 group, however organized and whether or not 

17 organized to operate at a profit, including a fi18 nancial institution organized, chartered, or 

19 holding a license or authorization certificate 

20 under the laws of a State, the United States, or 

21 any other country, or the parent, affiliate, or 

22 subsidiary of a financial institution. 

23 (B) EXCLUSION.—The term ‘‘business’’ 

24 does not include a State, a State agency, any 

25 political subdivision of a State, or a vendor actVerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290

kjohnson on DSK79L0C42PROD with BILLS
10 

•S 2290 IS

1 ing solely on behalf of, and at the direction of, 

2 a State. 

3 (3) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (4) CONSUMER.—The term ‘‘consumer’’ means 

6 an individual residing in the United States acting in 

7 a personal, family, or household capacity. 

8 (5) DATA BROKER.— 

9 (A) IN GENERAL.—The term ‘‘data 

10 broker’’ means a business that knowingly col11 lects or obtains the personal information of a 

12 consumer with whom the business does not have 

13 a direct relationship and then sells, licenses, 

14 trades, provides for consideration, or is other15 wise compensated for disclosing that informa16 tion to a third party. 

17 (B) DIRECT RELATIONSHIP.—For pur18 poses of subparagraph (A), a direct relationship 

19 with a business exists if the consumer— 

20 (i) is a current customer; 

21 (ii) obtained a good or service from 

22 the business within the prior 18 months; or 

23 (iii) made an inquiry about the prod24 ucts or services of the business within the 

25 prior 90 days. 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 2290 IS

1 (C) EXCLUSION.—The following activities 

2 conducted by a business, and the collection and 

3 sale or licensing of brokered personal informa4 tion incidental to conducting these activities, do 

5 not qualify the business as a data broker: 

6 (i) Providing 411 directory assistance 

7 or directory information services, including 

8 name, address, and telephone number, on 

9 behalf of or as a function of a tele10 communications carrier. 

11 (ii) Providing a consumer’s publicly 

12 available information if the information is 

13 being used by the recipient as it relates to 

14 that consumer’s business or profession. 

15 (iii) Providing publicly available infor16 mation via real-time or near-real-time alert 

17 services for health or safety purposes. 

18 (iv) Providing or using information in 

19 a manner that is regulated under another 

20 Federal or State law, including the Fair 

21 Credit Reporting Act, the Gramm-Leach22 Bliley Act, or the Health Insurance Port23 ability and Accountability Act. 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 2290 IS

1 (v) Providing data to a third party at 

2 the direction of the consumer and with the 

3 consumer’s affirmative express consent. 

4 (vi) Providing or using information 

5 for assessing, verifying, or authenticating a 

6 person’s identity, or for investigating or 

7 preventing actual or potential fraud. 

8 (D) EXCLUSION FROM SALE.—For pur9 poses of this paragraph, the term ‘‘sells’’ does 

10 not include a one-time or occasional sale of as11 sets of a business as part of a transfer of con12 trol of those assets that is not part of the ordi13 nary conduct of the business. 

14 (6) DATA BROKER SECURITY BREACH.— 

15 (A) IN GENERAL.—The term ‘‘data broker 

16 security breach’’ means an unauthorized acqui17 sition or a reasonable belief of an unauthorized 

18 acquisition of more than one element of bro19 kered personal information maintained by a 

20 data broker when the brokered personal infor21 mation is not encrypted, redacted, or protected 

22 by another method that renders the information 

23 unreadable or unusable by an unauthorized per24 son or entity. 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 2290 IS

1 (B) EXCLUSION.—The term ‘‘data broker 

2 security breach’’ does not include good faith but 

3 unauthorized acquisition of brokered personal 

4 information by an employee or agent of the 

5 data broker for a legitimate purpose of the data 

6 broker, provided that the brokered personal in7 formation is not used for a purpose unrelated 

8 to the data broker’s business or subject to fur9 ther unauthorized disclosure. 

10 (C) APPLICATION.—In determining wheth11 er brokered personal information has been ac12 quired or is reasonably believed to have been ac13 quired without valid authorization, a data 

14 broker may consider the following factors, 

15 among others: 

16 (i) Indications that the brokered per17 sonal information is in the physical posses18 sion and control of a person or entity with19 out valid authorization, such as a lost or 

20 stolen computer or other device containing 

21 brokered personal information. 

22 (ii) Indications that the brokered per23 sonal information has been downloaded or 

24 copied. 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 2290 IS

1 (iii) Indications that the brokered per2 sonal information was used by an unau3 thorized person or entity, such as fraudu4 lent accounts opened or instances of iden5 tity theft reported. 

6 (iv) That the brokered personal infor7 mation has been made public. 

8 (7) PERSONAL INFORMATION.—The term ‘‘per9 sonal information’’ means information which is re10 lated to any identified or identifiable person. 

11 (8) STATE.—The term ‘‘State’’ means any 

12 State of the United States, the District of Columbia, 

13 the Commonwealth of Puerto Rico, Guam, American 

14 Samoa, the Commonwealth of Northern Mariana Is15 lands, and the United States Virgin Islands. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS