II 

117TH CONGRESS 

1ST SESSION S. 2134 

To establish the Data Protection Agency. 

IN THE SENATE OF THE UNITED STATES 

JUNE 17, 2021 

Mrs. GILLIBRAND (for herself and Mr. BROWN) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To establish the Data Protection Agency. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Protection Act 

5 of 2021’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 

8 (1) AGENCY.—The term ‘‘Agency’’ means the 

9 Data Protection Agency established under section 3. 

10 (2) ANONYMIZED DATA.—The term 

11 ‘‘anonymized data’’ means information— 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•S 2134 IS

1 (A) that does not identify an individual; 

2 and 

3 (B) with respect to which there is no rea4 sonable basis to believe that the information 

5 can be used on its own or in combination with 

6 other reasonably available information to iden7 tify an individual. 

8 (3) AUTOMATED DECISION SYSTEM.—The term 

9 ‘‘automated decision system’’ means a computational 

10 process, including one derived from machine learn11 ing, statistics, or other data processing or artificial 

12 intelligence techniques, that makes a decision, or fa13 cilitates human decision making. 

14 (4) BIOMETRIC INFORMATION.—The term ‘‘bio15 metric information’’— 

16 (A) means information regarding the phys17 iological or biological characteristics of an indi18 vidual that may be used, singly or in combina19 tion with each other or with other identifying 

20 data, to establish the identity of an individual; 

21 (B) includes— 

22 (i) genetic data; 

23 (ii) imagery of the iris, retina, finger24 print, face, hand, palm, vein patterns, and 

25 voice recordings, from which an identifier 


pbinns on DSKJLVW7X2PROD with BILLS
3 

•S 2134 IS

1 template, such as a faceprint, a minutiae 

2 template, or a voiceprint, can be extracted; 

3 (iii) keystroke patterns or rhythms, 

4 gait patterns or rhythms, and sleep, 

5 health, or exercise data that contain identi6 fying information; and 

7 (iv) any mathematical code, profile, or 

8 algorithmic model derived from informa9 tion regarding the physiological or biologi10 cal characteristics of an individual; 

11 (C) does not include information captured 

12 from a patient in a health care setting for a 

13 medical purpose or information collected, used, 

14 or stored for health care treatment, payment, or 

15 operations under the Health Insurance Port16 ability and Accountability Act of 1996 (Public 

17 Law 104–191); and 

18 (D) does not include an X-ray, roentgen 

19 process, computed tomography, MRI, PET 

20 scan, mammography, or other image or film of 

21 the human anatomy used to diagnose, prognose, 

22 or treat an illness or other medical condition or 

23 to further validate scientific testing or screen24 ing. 

25 (5) COLLECT.—The term ‘‘collect’’— 


pbinns on DSKJLVW7X2PROD with BILLS
4 

•S 2134 IS

1 (A) means buying, renting, gathering, ob2 taining, receiving, or accessing any personal 

3 data by any means; and 

4 (B) includes— 

5 (i) receiving personal data from an in6 dividual or device; and 

7 (ii) creating, deriving, or inferring 

8 personal data by analyzing data about an 

9 individual or about groups of individuals 

10 similar to the individual. 

11 (6) DATA AGGREGATOR.—The term ‘‘data 

12 aggregator’’— 

13 (A) means any person that collects, uses, 

14 or shares, in or affecting interstate commerce, 

15 an amount of personal data that is not de mini16 mis, as well as entities related to that person by 

17 common ownership or corporate control; and 

18 (B) does not include an individual who col19 lects, uses, or shares personal data solely for 

20 non-commercial reasons. 

21 (7) DEVICE.—The term ‘‘device’’ means any 

22 physical object that— 

23 (A) is capable of connecting to the internet 

24 or other communication network; or 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•S 2134 IS

1 (B) has computer processing capabilities 

2 that can collect, send, receive, or store data. 

3 (8) DIRECTOR.—The term ‘‘Director’’ means 

4 the Director of the Data Protection Agency. 

5 (9) ELECTRONIC DATA.—The term ‘‘electronic 

6 data’’ means any information that is in an electronic 

7 or digital format or any electronic or digital ref8 erence that contains information about an individual 

9 or device. 

10 (10) FEDERAL PRIVACY LAW.—The term ‘‘Fed11 eral privacy law’’ means the provisions of this Act, 

12 any other rule or order prescribed by the Agency 

13 under this Act, and the following laws (including any 

14 amendments made to such laws): 

15 (A) Title V of the Gramm-Leach-Bliley Act 

16 (Public Law 106–102; 113 Stat. 1338). 

17 (B) The Fair Credit Reporting Act (15 

18 U.S.C. 1681 et seq.). 

19 (C) The Telemarketing and Consumer 

20 Fraud and Abuse Prevention Act (15 U.S.C. 

21 6101 et seq.). 

22 (D) The Fair and Accurate Credit Trans23 actions Act of 2003 (Public Law 108–159; 117 

24 Stat. 1952). 


pbinns on DSKJLVW7X2PROD with BILLS
6 

•S 2134 IS

1 (E) The CAN-SPAM Act of 2003 (15 

2 U.S.C. 7701 et seq.). 

3 (F) Sections 222, 227, 338(l), 631, and 

4 705 of the Communications Act of 1934 (47 

5 U.S.C. 222, 227, 338(l), 551, 705). 

6 (G) The Children’s Online Privacy Protec7 tion Act of 1998 (15 U.S.C. 6501 et seq.). 

8 (H) The Right to Financial Privacy Act of 

9 1978 (12 U.S.C. 3401 et seq.). 

10 (I) The Identity Theft Assumption and 

11 Deterrence Act of 1998 (Public Law 105–318; 

12 117 Stat. 3007). 

13 (J) The General Education Provisions Act 

14 (20 U.S.C. 1221 et seq.) (commonly known as 

15 the ‘‘Family Educational Rights and Privacy 

16 Act of 1974’’). 

17 (K) Section 552a of title 5, United States 

18 Code. 

19 (L) The E-Government Act of 2002 (Pub20 lic Law 107–347; 116 Stat. 2899). 

21 (M) The Computer Security Act of 1987 

22 (40 U.S.C. 1441 note). 

23 (N) The Employee Polygraph Protection 

24 Act of 1988 (29 U.S.C. 2001 et seq.). 


pbinns on DSKJLVW7X2PROD with BILLS
7 

•S 2134 IS

1 (O) The Communications Assistance for 

2 Law Enforcement Act (Public Law 103–414; 

3 108 Stat. 4279). 

4 (P) Sections 1028A, 1030, 1801, 2710, 

5 and 2721 and chapter 119, of title 18, United 

6 States Code. 

7 (Q) The Genetic Information Non8 discrimination Act of 2008 (Public Law 110– 

9 233; 122 Stat. 881). 

10 (R) The Taxpayer Browsing Protection 

11 Act (Public Law 105–35; 111 Stat. 1104). 

12 (S) The Privacy Protection Act of 1980 

13 (42 U.S.C. 2000aa et seq.). 

14 (T) The Cable Communications Policy Act 

15 of 1984 (Public Law 98–549; 98 Stat. 2779). 

16 (U) The Do-Not-Call Implementation Act 

17 (Public Law 108–10; 117 Stat. 557). 

18 (V) The Wireless Communications and 

19 Public Safety Act of 1999 (Public Law 106–81; 

20 113 Stat. 1286). 

21 (W) Title XXX of the Public Health Serv22 ice Act (42 U.S.C. 300jj et seq.). 

23 (11) HIGH-RISK DATA PRACTICE.—The term 

24 ‘‘high-risk data practice’’ means an action by a data 

25 aggregator that involves— 


pbinns on DSKJLVW7X2PROD with BILLS
8 

•S 2134 IS

1 (A) the use of an automated decision sys2 tem; 

3 (B) the processing of data in a manner 

4 that involves an individual’s protected class, fa5 milial status, lawful source of income, financial 

6 status such as the individual’s income or as7 sets), veteran status, criminal convictions or ar8 rests, citizenship, past, present, or future phys9 ical or mental health or condition, psychological 

10 states, or any other factor used as a proxy for 

11 identifying any of these characteristics; 

12 (C) a systematic processing of publicly ac13 cessible data on a large scale; 

14 (D) processing involving the use of new 

15 technologies, or combinations of technologies, 

16 that causes or materially contributes to privacy 

17 harm; 

18 (E) decisions about an individual’s access 

19 to a product, service, opportunity, or benefit 

20 which is based to any extent on automated deci21 sion system processing; 

22 (F) any profiling of individuals on a large 

23 scale; 

24 (G) any processing of biometric informa25 tion for the purpose of uniquely identifying an 


pbinns on DSKJLVW7X2PROD with BILLS
9 

•S 2134 IS

1 individual, with the exception of one-to-one bio2 metric authentication; 

3 (H) combining, comparing, or matching 

4 personal data obtained from multiple sources; 

5 (I) processing which involves an individ6 ual’s precise geolocation; 

7 (J) the processing of personal data of chil8 dren and teens under 17 or other vulnerable in9 dividuals such as the elderly, people with dis10 abilities, and other groups known to be suscep11 tible for exploitation for marketing purposes, 

12 profiling, or automated processing; or 

13 (K) consumer scoring or other business 

14 practices that pertain to the eligibility of an in15 dividual, and related terms, rights, benefits, and 

16 privileges, for employment (including hiring, fir17 ing, promotion, demotion, and compensation), 

18 credit, insurance, housing, education, profes19 sional certification, or the provision of health 

20 care and related services. 

21 (12) HIGH-RISK DATA PRACTICE IMPACT EVAL22 UATION.—The term ‘‘high-risk data practice impact 

23 evaluation’’ means a study conducted after deploy24 ment of a high-risk data practice that includes, at 

25 a minimum— 


pbinns on DSKJLVW7X2PROD with BILLS
10 

•S 2134 IS

1 (A) an evaluation of a high-risk data prac2 tice’s accuracy, disparate impacts on the basis 

3 of protected class, and privacy harms; 

4 (B) an evaluation of the effectiveness of 

5 measures taken to minimize risks as outlined in 

6 any prior high-risk data practice risk assess7 ments; and 

8 (C) recommended measures to further min9 imize risks to accuracy, disparate impacts on 

10 the basis of protected class, and privacy harms. 

11 (13) HIGH-RISK DATA PRACTICE RISK ASSESS12 MENT.—The term ‘‘high-risk data practice risk as13 sessment’’ means a study evaluating a high-risk data 

14 practice and the high-risk data practice’s develop15 ment process, including the design and training data 

16 of the high-risk data practice, if applicable, for likeli17 hood and severity of risks to accuracy, bias, dis18 crimination, and privacy harms that includes, at a 

19 minimum— 

20 (A) a detailed description of the high-risk 

21 data practice, including— 

22 (i) its design and methodologies; 

23 (ii) training data characteristics; 

24 (iii) data; and 

25 (iv) purpose; 


pbinns on DSKJLVW7X2PROD with BILLS
11 

•S 2134 IS

1 (B) an assessment of the relative benefits 

2 and costs of the high-risk data practice in light 

3 of its purpose, potential unintended con4 sequences, and taking into account relevant fac5 tors, including— 

6 (i) data minimization practices; 

7 (ii) the duration and methods for 

8 which personal data and the results of the 

9 high-risk data practice are stored; 

10 (iii) what information about the high11 risk data practice is available to individ12 uals; 

13 (iv) the extent to which individuals 

14 have access to the results of the high-risk 

15 data practice and may correct or object to 

16 its results; and 

17 (v) the recipients of the results of the 

18 high-risk data practice; 

19 (C) an assessment of the risks of privacy 

20 harm posed by the high-risk data practice and 

21 the risks that the high-risk data practice may 

22 result in or contribute to inaccurate, biased, or 

23 discriminatory decisions impacting individuals 

24 or groups of individuals; and 


pbinns on DSKJLVW7X2PROD with BILLS
12 

•S 2134 IS

1 (D) the decision to accept, reject, or miti2 gate and minimize risks and the measures a 

3 data aggregator will employ including to mini4 mize the risks described in subparagraph(C), 

5 including technological and physical safeguards. 

6 (14) INDIVIDUAL.—The term ‘‘individual’’ 

7 means a natural person. 

8 (15) PERSON.—The term ‘‘person’’ means an 

9 individual, a local, State, or Federal governmental 

10 entity, a partnership, a company, a corporation, an 

11 association (incorporated or unincorporated), a 

12 trust, an estate, a cooperative organization, another 

13 entity, or any other organization or group of such 

14 entities acting in concert. 

15 (16) PERSONAL DATA.—The term ‘‘personal 

16 data’’ means electronic data that, alone or in com17 bination with other data— 

18 (A) identifies, relates to, describes, is capa19 ble of being associated with, or could reasonably 

20 be linked, directly or indirectly, with a par21 ticular individual, household, or device; or 

22 (B) could be used to determine that an in23 dividual or household is part of a protected 

24 class. 


pbinns on DSKJLVW7X2PROD with BILLS
13 

•S 2134 IS

1 (17) PRECISE GEOLOCATION.—The term ‘‘pre2 cise geolocation’’ means any data that is derived 

3 from a device and that is used or intended to be 

4 used to locate an individual within a geographic area 

5 that is equal to or less than the area of a circle with 

6 a radius of one thousand, eight hundred and fifty 

7 (1,850) feet. 

8 (18) PRIVACY HARM.—The term ‘‘privacy 

9 harm’’ means an adverse consequence, or a potential 

10 adverse consequence, to an individual, a group of in11 dividuals, or society caused, in whole or in part, by 

12 the collection, processing, or sharing of personal 

13 data, including— 

14 (A) direct or indirect financial loss or eco15 nomic harm, including financial loss or eco16 nomic harm arising from fraudulent activities 

17 or data security breaches; 

18 (B) physical harm, harassment, or a threat 

19 to an individual or property; 

20 (C) psychological harm, including anxiety, 

21 embarrassment, fear, other trauma, stigmatiza22 tion, reputational harm, or the revealing or ex23 posing of an individual, or a characteristic of an 

24 individual, in an unexpected way; 


pbinns on DSKJLVW7X2PROD with BILLS
14 

•S 2134 IS

1 (D) an adverse outcome or decision, in2 cluding relating to the eligibility of an indi3 vidual for the rights, benefits, or privileges in 

4 credit and insurance (including the denial of an 

5 application or obtaining less favorable terms), 

6 housing, education, professional certification, 

7 employment (including hiring, firing, promotion, 

8 demotion, and compensation), or the provision 

9 of health care and related services; 

10 (E) discrimination, including both differen11 tial treatment on the basis of a protected class 

12 and disparate impact on a protected class; 

13 (F) the chilling of free expression or action 

14 of an individual, or society generally, due to 

15 perceived or actual pervasive and excessive col16 lection, processing, or sharing of personal data; 

17 (G) the use of information technology to 

18 covertly influence an individual’s decision-mak19 ing, by targeting and exploiting decision-making 

20 vulnerabilities; and 

21 (H) any other adverse consequence, or po22 tential adverse consequence, prohibited by or 

23 defined by Federal privacy laws; provisions of 

24 Federal civil rights laws related to the proc25 essing of personal information; provisions of 


pbinns on DSKJLVW7X2PROD with BILLS
15 

•S 2134 IS

1 Federal consumer protection laws related to the 

2 processing of personal information; the First 

3 Amendment; and other constitutional rights 

4 protecting privacy. 

5 (19) PROCESS.—The term ‘‘process’’ means to 

6 perform an operation or set of operations on per7 sonal data, either manually or by automated means, 

8 including collecting, recording, organizing, struc9 turing, storing, adapting or altering, retrieving, con10 sulting, using, disclosing by transmission, sorting, 

11 classifying, disseminating or otherwise making avail12 able, aligning or combining, restricting, erasing or 

13 destroying. 

14 (20) PROFILE.—The term ‘‘profile’’ means the 

15 use of an automated decision system to process data 

16 (including personal data and other data) to derive, 

17 infer, predict or evaluate information about an indi18 vidual or group, such as the processing of data to 

19 analyze or predict an individual’s identity, at20 tributes, interests or behavior. 

21 (21) PROTECTED CLASS.—The term ‘‘protected 

22 class’’ means the actual or perceived race, color, eth23 nicity, national origin, religion, sex, gender, gender 

24 identity or expression, sexual orientation, familial 

25 status, biometric information, genetic information, 


pbinns on DSKJLVW7X2PROD with BILLS
16 

•S 2134 IS

1 or disability of an individual or a group of individ2 uals. 

3 (22) SERVICE PROVIDER.—The term ‘‘service 

4 provider’’ means a data aggregator that collects, 

5 uses, or shares personal data only on behalf of an6 other data aggregator in order to carry out a per7 missible purpose, and only to the extent of such ac8 tivity. 

9 (23) SHARE.—The term ‘‘share’’ means dis10 seminating, making available, transferring, or other11 wise communicating orally, in writing, or by elec12 tronic or other means, personal data. 

13 SEC. 3. ESTABLISHMENT OF THE DATA PROTECTION AGEN14 CY. 

15 (a) AGENCY ESTABLISHED.—There is established in 

16 the Executive branch an independent agency to be known 

17 as the ‘‘Data Protection Agency’’, which shall regulate 

18 high-risk data practices and the collection, processing, and 

19 sharing of personal data. 

20 (b) DIRECTOR AND DEPUTY DIRECTOR.— 

21 (1) IN GENERAL.—There is established a posi22 tion of the Director of the Data Protection Agency 

23 (referred to in this Act as the ‘‘Director’’), who shall 

24 serve as the head of the Agency. 


pbinns on DSKJLVW7X2PROD with BILLS
17 

•S 2134 IS

1 (2) APPOINTMENT.—Subject to paragraph (3), 

2 the Director shall be appointed by the President, by 

3 and with the advice and consent of the Senate. 

4 (3) QUALIFICATION.—The President shall 

5 nominate the Director from among members of the 

6 public at large who are well qualified for service at 

7 the Agency based on their knowledge and expertise 

8 in— 

9 (A) technology; 

10 (B) protection of personal data; 

11 (C) civil rights and liberties; 

12 (D) law; and 

13 (E) social sciences. 

14 (4) COMPENSATION.— 

15 (A) IN GENERAL.—The Director shall be 

16 compensated at the rate prescribed for level II 

17 of the Executive Schedule under section 5313 

18 of title 5, United States Code. 

19 (B) CONFORMING AMENDMENT.—Section 

20 5313 of title 5, United States Code, is amended 

21 by inserting after the item relating to the Fed22 eral Transit Administrator, the following new 

23 item: ‘‘Director of the Data Protection Agen24 cy.’’. 


pbinns on DSKJLVW7X2PROD with BILLS
18 

•S 2134 IS

1 (5) DEPUTY DIRECTOR.—There is established 

2 the position of Deputy Director, who shall— 

3 (A) be appointed by the Director; and 

4 (B) serve as the acting Director in the ab5 sence or unavailability of the Director. 

6 (6) ACTING DIRECTOR.—In the event of the 

7 death, resignation, sickness, or absence of the Direc8 tor, the President shall designate the Deputy Direc9 tor to serve as acting Director until the return of 

10 the Director, or the appointment of a successor pur11 suant to subsection (b). 

12 (c) TERM.— 

13 (1) IN GENERAL.—The Director shall serve for 

14 a term of 5 years. 

15 (2) EXPIRATION OF TERM.—An individual may 

16 serve as Director after the expiration of the term for 

17 which appointed until a successor has been ap18 pointed and qualified. 

19 (3) REMOVAL.—The President may remove the 

20 Director at will. 

21 (4) VACANCY.—A vacancy in the position of Di22 rector that occurs before the expiration of the term 

23 for which a Director was appointed shall be filled in 

24 the manner established under paragraph (2), and 


pbinns on DSKJLVW7X2PROD with BILLS
19 

•S 2134 IS

1 the Director appointed to fill such vacancy shall be 

2 appointed only for the remainder of such term. 

3 (d) SERVICE RESTRICTION.—No Director or Deputy 

4 Director may engage in any other employment during the 

5 period of service of such person as Director or Deputy Di6 rector. 

7 (e) OFFICES.—The principal office of the Agency 

8 shall be in the District of Columbia. The Director may 

9 establish regional offices of the Agency. 

10 (f) APPLICABILITY OF OTHER LAWS.—Except as 

11 otherwise provided expressly by law, all Federal laws deal12 ing with public or Federal contracts, property, works, offi13 cers, employees, budgets, or funds, including the provi14 sions of chapter 5 and 7 of title 5, United States Codes, 

15 shall apply to the exercise of the powers of the Agency. 

16 SEC. 4. EXECUTIVE AND ADMINISTRATIVE POWERS. 

17 (a) POWERS OF THE AGENCY.—The Director is au18 thorized to establish the general powers of the Agency with 

19 respect to all executive and administrative functions, in20 cluding— 

21 (1) the establishment of rules for conducting 

22 the general business of the Agency, in a manner not 

23 inconsistent with this Act; 

24 (2) to bind the Agency and enter into contracts; 


pbinns on DSKJLVW7X2PROD with BILLS
20 

•S 2134 IS

1 (3) directing the establishment and mainte2 nance of divisions or other offices within the Agency, 

3 in order to carry out the responsibilities under this 

4 Act and Federal privacy law, and to satisfy the re5 quirements of applicable law; 

6 (4) to coordinate and oversee the operation of 

7 all administrative, enforcement, and research activi8 ties of the Agency; 

9 (5) to adopt and use a seal; 

10 (6) to determine the character of and necessity 

11 for the obligations by the Agency; 

12 (7) the appointment and supervision of per13 sonnel employed by the Agency; 

14 (8) the distribution of business among per15 sonnel appointed and supervised by the Agency; 

16 (9) the use and expenditure of funds; 

17 (10) implementing this Act and Federal privacy 

18 laws through rules, orders, guidance, interpretations, 

19 statements of policy, examinations, and enforcement 

20 actions; and 

21 (11) performing such other functions as may be 

22 authorized or required by law. 

23 (b) DELEGATION OF AUTHORITY.—The Director 

24 may delegate to any duly authorized employee, representa25 tive, or agent any power vested in the Agency by law. 


pbinns on DSKJLVW7X2PROD with BILLS
21 

•S 2134 IS

1 (c) OFFICE RESPONSIBILITIES.—Notwithstanding 

2 subsections (a) and (b), section 3(a), and any other provi3 sion of law, with respect to the specific functional units 

4 and offices described in section 5(b), the Director— 

5 (1) shall ensure that such functional units and 

6 offices perform the functions, duties, and coordina7 tion assigned to them under the applicable provision 

8 of section 5; and 

9 (2) may not reorganize or rename such units or 

10 offices in a manner not provided for under the appli11 cable provisions of section 5. 

12 (d) AUTONOMY OF AGENCY.—No officer or agency 

13 of the United States shall have any authority to require 

14 the Director or any other officer of the Agency to submit 

15 legislative recommendations, or testimony or comments on 

16 legislation, to any officer or agency of the United States 

17 for approval, comments, or review prior to the submission 

18 of such recommendations, testimony, or comments to the 

19 Congress, if such recommendations, testimony, or com20 ments to the Congress include a statement indicating that 

21 the views expressed therein are those of the Director or 

22 such officer, and do not necessarily reflect the views of 

23 the President. 

24 SEC. 5. ADMINISTRATION. 

25 (a) PERSONNEL.— 


pbinns on DSKJLVW7X2PROD with BILLS
22 

•S 2134 IS

1 (1) APPOINTMENT.— 

2 (A) IN GENERAL.—The Director may fix 

3 the number of, and appoint and direct, all em4 ployees of the Agency, in accordance with the 

5 applicable provisions of title 5, United States 

6 Code. 

7 (B) EMPLOYEES OF THE AGENCY.—The 

8 Director may employ attorneys, compliance ex9 aminers, compliance supervision analysts, 

10 economists, technologists, data scientists, de11 signers, ethicists, privacy experts, statisticians, 

12 and other employees as may be deemed nec13 essary to conduct the business of the Agency. 

14 Unless otherwise provided expressly by law, any 

15 individual appointed under this section shall be 

16 an employee, as defined in section 2105 of title 

17 5, United States Code, and subject to the provi18 sions of such title and other laws generally ap19 plicable to the employees of an Executive agen20 cy. 

21 (C) WAIVER AUTHORITY.— 

22 (i) IN GENERAL.—In making any ap23 pointment under subparagraph (A), the 

24 Director may waive the requirements of 

25 chapter 33 of title 5, United States Code, 


pbinns on DSKJLVW7X2PROD with BILLS
23 

•S 2134 IS

1 and the regulations implementing such 

2 chapter, to the extent necessary to appoint 

3 employees on terms and conditions that 

4 are consistent with those set forth in sec5 tion 11(1) of the Federal Reserve Act (12 

6 U.S.C. 248(1)), while providing for— 

7 (I) fair, credible, and transparent 

8 methods of establishing qualification 

9 requirements for, recruitment for, and 

10 appointments to positions; 

11 (II) fair and open competition 

12 and equitable treatment in the consid13 eration and selection of individuals to 

14 positions; and 

15 (III) fair, credible, and trans16 parent methods of assigning, reas17 signing, detailing, transferring, and 

18 promoting employees. 

19 (ii) VETERANS PREFERENCES.—In 

20 implementing this subparagraph, the Di21 rector shall comply with the provisions of 

22 section 2302(b)(11) of title 5, United 

23 States Code, regarding veterans’ pref24 erence requirements, in a manner con25 sistent with that in which such provisions 


pbinns on DSKJLVW7X2PROD with BILLS
24 

•S 2134 IS

1 are applied under chapter 33 of that title. 

2 The authority under this subparagraph to 

3 waive the requirements of that chapter 33 

4 shall expire 5 years after the date of enact5 ment of this Act. 

6 (D) DUTY TO PROVIDE ADEQUATE STAFF7 ING.—The Director shall ensure that the spe8 cific functional units and offices established 

9 under section 5, as well as other units and of10 fices with supervisory, rulemaking, and enforce11 ment duties, are provided with sufficient staff 

12 to carry out the functions, duties, and coordina13 tion of those units and offices. 

14 (E) LIMITATION ON POLITICAL AP15 POINTEES.— 

16 (i) IN GENERAL.—In appointing em17 ployees of the Agency who are political ap18 pointees, the Director shall ensure that the 

19 number and duties of such political ap20 pointees are as similar as possible to those 

21 of other Federal regulatory agencies. 

22 (ii) POLITICAL APPOINTEES DE23 FINED.—For purposes of this subpara24 graph, the term ‘‘political appointee’’ 

25 means an employee who holds— 


pbinns on DSKJLVW7X2PROD with BILLS
25 

•S 2134 IS

1 (I) a position which has been ex2 cepted from the competitive service by 

3 reason of its confidential, policy-deter4 mining, policymaking, or policy-advo5 cating character; 

6 (II) a position in the Senior Ex7 ecutive Service as a noncareer ap8 pointee (as such term is defined in 

9 section 3132(a) of title 5, United 

10 States Code); or 

11 (III) a position under the Execu12 tive Schedule (subchapter II of chap13 ter 53 of title 5, United States Code). 

14 (2) COMPENSATION.—Notwithstanding any oth15 erwise applicable provision of title 5, United States 

16 Code, concerning compensation, including the provi17 sions of chapter 51 and chapter 53, the following 

18 provisions shall apply with respect to employees of 

19 the Agency: 

20 (A) The rates of basic pay for all employ21 ees of the Agency may be set and adjusted by 

22 the Director. 

23 (B) The Director shall at all times provide 

24 compensation (including benefits) to each class 

25 of employees that, at a minimum, are comVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
26 

•S 2134 IS

1 parable to the compensation and benefits then 

2 being provided by the Board of Governors of 

3 the Federal Reserve System or the Bureau of 

4 Consumer Financial Protection for the cor5 responding class of employees. 

6 (C) All such employees shall be com7 pensated (including benefits) on terms and con8 ditions that are consistent with the terms and 

9 conditions set forth in section 11(l) of the Fed10 eral Reserve Act (12 U.S.C. 248(l)). 

11 (3) LABOR-MANAGEMENT RELATIONS.—Chap12 ter 71 of title 5, United States Code, shall apply to 

13 the Agency and the employees of the Agency. 

14 (b) SPECIFIC FUNCTIONAL UNITS.— 

15 (1) OFFICE OF CIVIL RIGHTS.—The Director 

16 shall establish an office whose powers and duties 

17 shall include— 

18 (A) providing oversight and enforcement of 

19 this Act, rules and orders promulgated under 

20 this Act, and Federal privacy laws to ensure 

21 that the collection, processing, and sharing of 

22 personal data is fair, equitable, and non-dis23 criminatory in treatment and effect; 

24 (B) developing, establishing, and pro25 moting data processing practices that affirmaVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00026 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
27 

•S 2134 IS

1 tively further equal opportunity to and expand 

2 access to housing, employment, credit, insur3 ance, education, healthcare, and other aspects 

4 of interstate commerce; 

5 (C) coordinating the Agency’s civil rights 

6 efforts with other Federal agencies and State 

7 regulators, as appropriate, to promote con8 sistent, efficient, and effective enforcement of 

9 Federal civil rights laws; 

10 (D) working with civil rights advocates, 

11 privacy organizations, and data aggregators on 

12 the promotion of compliance with the civil 

13 rights provisions under this Act, rules and or14 ders promulgated under this Act, and Federal 

15 privacy laws; 

16 (E) liaising with communities and con17 sumers impacted by practices regulated by this 

18 Act and the Agency, to ensure that their needs 

19 and views are appropriately taken into account; 

20 (F) providing annual reports to Congress 

21 on the efforts of the Agency to fulfill its civil 

22 rights mandate; and 

23 (G) such additional powers and duties as 

24 the Director may determine are appropriate. 


pbinns on DSKJLVW7X2PROD with BILLS
28 

•S 2134 IS

1 (2) RESEARCH.—The Director shall establish a 

2 unit whose functions shall include researching, ana3 lyzing, assessing, and reporting on— 

4 (A) the collection and processing of per5 sonal data, including automated decision sys6 tems; 

7 (B) the collection and processing of per8 sonal data by government agencies, including 

9 contracts between government agencies and 

10 data aggregators; and 

11 (C) unfair, deceptive, or discriminatory 

12 outcomes that result or are likely to result from 

13 the use of automated decision systems, includ14 ing disparate treatment or disparate impact on 

15 the basis of protected class or proxies for pro16 tected class. 

17 (3) COLLECTING AND TRACKING COM18 PLAINTS.— 

19 (A) IN GENERAL.— 

20 (i) ESTABLISHMENT OF UNIT.—The 

21 Director shall establish a unit, the func22 tions of which shall include identifying and 

23 facilitating the development of best prac24 tices for consumers to file a complaint, and 

25 establishing a single toll-free telephone 


pbinns on DSKJLVW7X2PROD with BILLS
29 

•S 2134 IS

1 number, a publicly available website, and a 

2 publicly available database, or utilizing an 

3 existing publicly available database, to fa4 cilitate the centralized collection of, moni5 toring of, and response to complaints re6 garding the collection, processing, and 

7 sharing of personal data. 

8 (ii) WEBSITE REQUIREMENTS.—The 

9 Director shall ensure that— 

10 (I) the landing page of the main 

11 website of the Agency contains a clear 

12 and conspicuous hyperlink to the com13 plaint database described in clause (i) 

14 and shall ensure that such database is 

15 user-friendly and in plain writing, as 

16 that term is defined in section 3 of 

17 the Plain Writing Act of 2010 (5 

18 U.S.C. 301 note); and 

19 (II) that all information on the 

20 website or the database that explains 

21 how a complaint with the Agency, as 

22 well as reports of the Agency with re23 spect to information contained in that 

24 database, shall be provided in each of 

25 the 5 most commonly spoken lanVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
30 

•S 2134 IS

1 guages, other than English, in the 

2 United States, as determined by the 

3 Bureau of the Census on an ongoing 

4 basis, and in formats accessible to in5 dividuals with hearing or vision im6 pairments. 

7 (B) PUBLIC AVAILABILITY OF INFORMA8 TION.— 

9 (i) IN GENERAL.—The Director 

10 shall— 

11 (I) make all complaints available 

12 to the public on a website of the 

13 Agency; 

14 (II) place a clear and con15 spicuous hyperlink on the landing 

16 page of the main website of the Agen17 cy to the website described under sub18 clause (I); and 

19 (III) ensure that such website— 

20 (aa) is searchable and sort21 able by an data aggregator; and 

22 (bb) is user-friendly and 

23 written in plain language. 

24 (ii) REMOVAL OF PERSONAL DATA.— 

25 In making the information described under 


pbinns on DSKJLVW7X2PROD with BILLS
31 

•S 2134 IS

1 clause (i) available to the public, the Direc2 tor shall remove all personal data. 

3 (c) AGENCY OMBUDSMAN.— 

4 (1) ESTABLISHMENT REQUIRED.—The Director 

5 shall appoint an ombudsman. 

6 (2) DUTIES OF OMBUDSMAN.—The ombudsman 

7 appointed in accordance with paragraph (1) shall— 

8 (A) act as a liaison between the Agency 

9 and any affected person with respect to any 

10 problem that such person may have in dealing 

11 with the Agency, resulting from the regulatory 

12 activities of the Agency; and 

13 (B) assure that safeguards exist to encour14 age complainants to come forward and preserve 

15 confidentiality. 

16 SEC. 6. COORDINATION. 

17 The Agency shall coordinate with the Consumer Fi18 nancial Protection Bureau, the Federal Communications 

19 Commission, the Federal Trade Commission, the Depart20 ment of Commerce, the Department of Health and 

21 Human Services, the Department of Housing and Urban 

22 Development, the Department of Education, the Equal 

23 Employment Opportunity Commission, the National Secu24 rity Agency, the National Institute of Standards and 

25 Technology, the White House Office of Science and TechVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
32 

•S 2134 IS

1 nology Policy, the Cybersecurity and Infrastructure Secu2 rity Agency, and other Federal agencies and State regu3 lators, as appropriate, to promote consistent regulatory 

4 treatment of personal data. 

5 SEC. 7. APPEARANCES BEFORE AND REPORTS TO CON6 GRESS. 

7 (a) APPEARANCES BEFORE CONGRESS.—The Direc8 tor of the Agency shall appear before Congress at semi9 annual hearings regarding the reports required under sub10 section (b). 

11 (b) REPORTS REQUIRED.—The Agency shall, concur12 rent with each semi-annual hearing referred to in sub13 section (a), prepare and submit to the President and Con14 gress, a report, beginning with the session following the 

15 designated transfer date, and shall publish such report on 

16 the website of the Agency. 

17 (c) CONTENTS.—The reports required by subsection 

18 (b) shall include— 

19 (1) a discussion of the significant problems 

20 faced by persons in exercising their rights under this 

21 Act and Federal privacy laws; 

22 (2) a justification of the budget request of the 

23 previous year; 

24 (3) a list of the significant rules and orders 

25 adopted by the Agency, as well as other significant 


pbinns on DSKJLVW7X2PROD with BILLS
33 

•S 2134 IS

1 initiatives conducted by the Agency, during the pre2 ceding year and the plan of the Agency for rules, or3 ders, or other initiatives to be undertaken during the 

4 upcoming period; 

5 (4) an analysis of complaints about practices 

6 relating to the collection, processing, or sharing of 

7 personal data that the Agency has received and col8 lected in its central database on complaints during 

9 the preceding year; 

10 (5) a list, with a brief statement of the issues, 

11 of the public supervisory and enforcement actions to 

12 which the Agency was a party during the preceding 

13 year; 

14 (6) the actions taken regarding rules, orders, 

15 and supervisory actions with respect to data 

16 aggregators; 

17 (7) an assessment of significant actions by 

18 State attorneys general or State regulators relating 

19 to this Act or other Federal privacy laws; 

20 (8) an analysis of the efforts of the Agency to 

21 fulfill the civil rights mandate of the Agency; and 

22 (9) an analysis of the efforts of the Agency to 

23 increase workforce and contracting diversity. 

24 SEC. 8. FUNDING; PENALTIES AND FINES. 

25 (a) FUNDING.— 


pbinns on DSKJLVW7X2PROD with BILLS
34 

•S 2134 IS

1 (1) ASSESSMENTS, FEES, CHARGES.— 

2 (A) GENERAL AUTHORITY.—The Director 

3 may collect an assessment, fee, or other charge 

4 from a data aggregator that has annual gross 

5 revenues that exceed $25,000,000 or annually 

6 collects, uses, or shares, alone or in combina7 tion, the personal data of 50,000 or more indi8 viduals, households, or devices. 

9 (B) DETERMINATION OF AMOUNT.—In es10 tablishing the amount of any assessment, fee, 

11 or charge collected from a data aggregator 

12 under this section, the Director may take into 

13 account any factor that the Director determines 

14 is appropriate. 

15 (2) AUTHORITY OF DIRECTOR.—The Director 

16 shall have sole authority to determine the manner in 

17 which the obligations of the Agency shall be incurred 

18 and its disbursements and expenses allowed and 

19 paid, in accordance with this section, except as pro20 vided in chapter 71 of title 5, United States Code 

21 (with respect to compensation). 

22 (b) DATA PROTECTION AGENCY FUND.— 

23 (1) SEPARATE FUND IN FEDERAL RESERVE ES24 TABLISHED.—There is established in the Federal 

25 Reserve a separate fund, to be known as the ‘‘Data 


pbinns on DSKJLVW7X2PROD with BILLS
35 

•S 2134 IS

1 Protection Agency Fund’’ (referred to in this section 

2 as the ‘‘Agency Fund’’). The Agency Fund shall be 

3 maintained and established at a Federal reserve 

4 bank, in accordance with such requirements as the 

5 Board of Governors may impose. 

6 (2) FUND RECEIPTS.—All amounts transferred 

7 to the Agency under subsection (a) shall be depos8 ited into the Agency Fund. 

9 (3) INVESTMENT AUTHORITY.— 

10 (A) AMOUNTS IN AGENCY FUND MAY BE

11 INVESTED.—The Agency may request the 

12 Board of Governors to direct the investment of 

13 the portion of the Agency Fund that is not, in 

14 the judgment of the Agency, required to meet 

15 the current needs of the Agency. 

16 (B) ELIGIBLE INVESTMENTS.—Invest17 ments authorized by this paragraph shall be 

18 made in obligations of the United States or ob19 ligations that are guaranteed as to principal 

20 and interest by the United States, with matu21 rities suitable to the needs of the Agency Fund, 

22 as determined by the Agency. 

23 (C) INTEREST AND PROCEEDS CRED24 ITED.—The interest on, and the proceeds from 

25 the sale or redemption of, any obligations held 


pbinns on DSKJLVW7X2PROD with BILLS
36 

•S 2134 IS

1 in the Agency Fund shall be credited to the 

2 Agency Fund. 

3 (c) USE OF FUNDS.— 

4 (1) IN GENERAL.—Funds obtained by, trans5 ferred to, or credited to the Agency Fund shall be 

6 immediately available to the Agency and under the 

7 control of the Director, and shall remain available 

8 until expended, to pay the expenses of the Agency in 

9 carrying out its duties and responsibilities. The com10 pensation of the Director and other employees of the 

11 Agency and all other expenses thereof may be paid 

12 from, obtained by, transferred to, or credited to the 

13 Agency Fund under this section. 

14 (2) FUNDS THAT ARE NOT GOVERNMENT

15 FUNDS.—Funds obtained by or transferred to the 

16 Agency Fund shall not be construed to be Govern17 ment funds or appropriated monies. 

18 (3) AMOUNTS NOT SUBJECT TO APPORTION19 MENT.—Notwithstanding any other provision of law, 

20 amounts in the Agency Fund and in the Civil Pen21 alty Fund established under subsection (d) shall not 

22 be subject to apportionment for purposes of chapter 

23 15 of title 31, United States Code, or under any 

24 other authority. 

25 (d) PENALTIES AND FINES.— 


pbinns on DSKJLVW7X2PROD with BILLS
37 

•S 2134 IS

1 (1) ESTABLISHMENT OF VICTIMS RELIEF

2 FUND.—There is established in the Federal Reserve 

3 a separate fund, to be known as the ‘‘Data Protec4 tion Civil Penalty Fund’’ (referred to in this section 

5 as the ‘‘Civil Penalty Fund’’). The Civil Penalty 

6 Fund shall be maintained and established at a Fed7 eral reserve bank, in accordance with such require8 ments as the Board of Governors may impose. If the 

9 Agency obtains a civil penalty against any person in 

10 any judicial or administrative action under Federal 

11 laws, the Agency shall deposit into the Civil Penalty 

12 Fund, the amount of the penalty collected. 

13 (2) PAYMENT TO VICTIMS.—Amounts in the 

14 Civil Penalty Fund shall be available to the Agency, 

15 without fiscal year limitation, for payments to the 

16 victims of activities for which civil penalties have 

17 been imposed under this Act and for other violations 

18 of other Federal privacy laws. If individual victims 

19 can be identified through reasonable effort, and the 

20 distributions are sufficiently large to make individual 

21 distributions economically viable, penalties should be 

22 distributed directly to individual victims. To the ex23 tent that individuals cannot be located or such re24 dress, payments or compensation, or other monetary 


pbinns on DSKJLVW7X2PROD with BILLS
38 

•S 2134 IS

1 relief are otherwise not practicable or economically 

2 viable, the Agency may— 

3 (A) use such funds for the purpose of con4 sumer or business education relating to data 

5 protection or for the purpose of engaging in 

6 technological research that the Agency con7 siders necessary to enforce this Act and Federal 

8 privacy laws; and 

9 (B) utilize a cy-pres approach to distribute 

10 funds in order to advance data protection and 

11 privacy in the United States. The Agency may 

12 identify recipients, including charitable and civil 

13 society organizations, whose interests reason14 able approximate those of the victims of the ac15 tivities for which civil penalties have been im16 posed and distribute funds from the Civil Pen17 alty Fund to those recipients. 

18 SEC. 9. PURPOSE, OBJECTIVES, AND FUNCTIONS. 

19 (a) PURPOSE.—The Agency shall seek to protect indi20 viduals’ privacy, prevent and remediate privacy harms, 

21 prevent, remediate, and reduce discrimination on the basis 

22 of protected class through the processing of personal infor23 mation, including both differential treatment on the basis 

24 of a protected class and disparate impact on a protected 

25 class, and limit the collection, processing, and sharing of 


pbinns on DSKJLVW7X2PROD with BILLS
39 

•S 2134 IS

1 personal data; and is authorized to exercise its authorities 

2 under this Act for such purposes. 

3 (b) OBJECTIVES.—The Agency is authorized to exer4 cise its authorities under this Act to— 

5 (1) protect individuals from violations of this 

6 Act, other Federal privacy laws, or rules and orders 

7 issued under this Act; 

8 (2) promote and affirmatively further equal op9 portunity in all aspects of economic life as it relates 

10 to the fair and non-discriminatory processing of per11 sonal information; 

12 (3) oversee the use of high-risk data practices; 

13 (4) promote the minimization of collection of 

14 personal data for commercial purposes; 

15 (5) prevent and remediate privacy harms; and 

16 (6) ensure that Federal privacy law is enforced 

17 consistently and in order to protect individuals’ pri18 vacy. 

19 (c) FUNCTIONS.—The primary functions of the Agen20 cy are— 

21 (1) providing leadership and coordination to the 

22 efforts of all Federal departments and agencies to 

23 enforce all Federal statutes, Executive orders, regu24 lations and policies which involve privacy or data 

25 protection; 


pbinns on DSKJLVW7X2PROD with BILLS
40 

•S 2134 IS

1 (2) maximizing effort, promoting efficiency, and 

2 eliminating conflict, competition, duplication, and in3 consistency among the operations, functions, and ju4 risdictions of Federal departments and agencies re5 sponsible for privacy or data protection, and data 

6 protection rights and standards; 

7 (3) providing active leadership, guidance, edu8 cation, and appropriate assistance to private sector 

9 businesses, organizations, groups, institutions, and 

10 individuals regarding privacy and data protection 

11 rights and standards; 

12 (4) requiring and overseeing ex-ante high-risk 

13 data practice risk assessments and ex-post high-risk 

14 data practice impact evaluations to advance fair and 

15 just data practices; 

16 (5) protecting individuals and groups of individ17 uals from privacy harms; 

18 (6) examining the social, ethical, economic, and 

19 civil rights impacts of data collection and processing 

20 practices and proposing remedies; 

21 (7) protecting civil rights, combating unlawful 

22 discrimination, and affirmatively furthering equal 

23 opportunity as they relate to the processing of per24 sonal information; 


pbinns on DSKJLVW7X2PROD with BILLS
41 

•S 2134 IS

1 (8) ensuring that high-risk data privacy prac2 tices are fair, just, non-deceptive, and do not dis3 criminate against a protected class; 

4 (9) collecting, researching, and responding to 

5 complaints; 

6 (10) developing model privacy and data protec7 tion standards, guidelines, and policies for use by 

8 the private sector; and 

9 (11) enforcing other privacy statutes and rules 

10 as authorized by Congress. 

11 SEC. 10. RULEMAKING AUTHORITY. 

12 (a) IN GENERAL.—The Agency is authorized to exer13 cise its authorities under this Act to administer, enforce, 

14 and otherwise implement the provisions of this Act and 

15 Federal privacy law. 

16 (b) RULEMAKING, ORDERS, AND GUIDANCE.— 

17 (1) GENERAL AUTHORITY.—The Director may 

18 prescribe rules and issue orders and guidance, as 

19 may be necessary or appropriate to enable the Agen20 cy to administer and carry out the purposes and ob21 jectives of this Act and other Federal privacy laws, 

22 and to prevent evasions of this Act and other Fed23 eral privacy laws. 

24 (2) REGULATIONS.—The Agency shall issue 

25 such regulations, after notice and comment in acVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00041 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
42 

•S 2134 IS

1 cordance with section 553 of title 5, United States 

2 Code, as may be necessary to carry out this Act. 

3 The Agency shall prescribe rules applicable to a data 

4 aggregator or service provider identifying— 

5 (A) high-risk data practices in connection 

6 with the collection, processing, or sharing of 

7 personal data, which may include requirements 

8 for the purpose of auditing, preventing, or re9 stricting such acts or practices; 

10 (B) acts or practices in connection with the 

11 collection, processing, or sharing of personal 

12 data that causes or are likely to cause privacy 

13 harm to individuals or groups of individuals, 

14 which may include requirements for the purpose 

15 of preventing or restricting such acts or prac16 tices; 

17 (C) unlawful, unfair, deceptive, abusive, or 

18 discriminatory acts or practices in connection 

19 with the collection, processing, or sharing of 

20 personal data, which may include requirements 

21 for the purpose of preventing or restricting such 

22 acts or practices, for the purpose of preventing 

23 disparate impacts on the basis of protected 

24 class, or for the purpose of affirmatively fur25 thering equal opportunity; 


pbinns on DSKJLVW7X2PROD with BILLS
43 

•S 2134 IS

1 (D) rights that data aggregators must pro2 vide to individuals, including the right to access 

3 and correct, limit the processing of, and request 

4 deletion of the individual’s personal data; and 

5 (E) obligations on data aggregators, in6 cluding transparency about business practices, 

7 data collection limitations, processing and dis8 closure limitations, purpose specification and 

9 legal basis for processing requirements, ac10 countability requirements, confidentiality and 

11 security requirements, and data accuracy re12 quirements. 

13 (3) NO LIMITATION.—Rules prescribed under 

14 this section shall not limit the authority of the Agen15 cy to administer, enforce, and otherwise implement 

16 the provisions of this Act and Federal privacy law. 

17 (4) STANDARDS FOR RULEMAKING.—In pre18 scribing a rule under this Act or Federal privacy 

19 laws— 

20 (A) the Agency shall consider the impact 

21 of proposed rules on an individual or groups of 

22 individuals; 

23 (B) the Agency may provide that a rule 

24 shall only apply to a subcategory of data 

25 aggregators, as defined by the Agency; and 


pbinns on DSKJLVW7X2PROD with BILLS
44 

•S 2134 IS

1 (C) the Agency shall consult with civil soci2 ety groups and members of the public. 

3 (5) RULE OF CONSTRUCTION.—Nothing in this 

4 paragraph may be construed to require the Agency 

5 to engage in cost-benefit analysis or submit a rule6 making for review to the President or the Office of 

7 Management and Budget. 

8 (6) STANDARD FOR REVIEW.—If this Act is si9 lent or ambiguous, and the Agency has followed the 

10 procedures in section 553 or 554 of title 5, United 

11 States Code, as applicable, a reviewing court shall 

12 defer to the Agency’s reasonable or permissible in13 terpretation of this Act. 

14 (c) MONITORING.—In order to support its rule15 making and other functions, the Agency shall monitor for 

16 risks to individuals or groups of individuals in the collec17 tion, processing, or sharing of personal data. 

18 SEC. 11. SUPERVISION OF DATA AGGREGATORS. 

19 (a) IN GENERAL.—A large data aggregator is a data 

20 aggregator that satisfies one or more of the following 

21 thresholds: 

22 (1) The data aggregator has annual gross reve23 nues that exceed $25,000,000. 

24 (2) The data aggregator annually collects, uses, 

25 or shares, alone or in combination, the personal data 


pbinns on DSKJLVW7X2PROD with BILLS
45 

•S 2134 IS

1 of 50,000 or more individuals, households, or de2 vices. 

3 (b) SUPERVISION.—The Agency may require reports 

4 and conduct examinations on a periodic basis of large data 

5 aggregators described in subsection (a) for purposes of— 

6 (1) assessing compliance with the requirements 

7 of this Act, rules and orders issued by the Agency, 

8 or other Federal privacy laws; 

9 (2) obtaining information about the activities 

10 subject to such laws and the associated compliance 

11 systems or procedures of such entities; 

12 (3) detecting and assessing associated risks to 

13 individuals and groups of individuals; and 

14 (4) requiring and overseeing high-risk data 

15 practice risk impact assessments and high-risk data 

16 practice impact evaluations to advance fair and just 

17 data practices. 

18 (c) PUBLICLY ACCESSIBLE LIST.—The Agency shall 

19 maintain a publicly accessible list of data aggregators that 

20 collect, process, or share personal data of more than 

21 10,000 persons or households, and the permissible pur22 poses for which the data aggregators purport to collect 

23 personal data. 

24 (d) MERGER REVIEW.—The Agency shall conduct a 

25 review and submit to the Federal Trade Commission and 


pbinns on DSKJLVW7X2PROD with BILLS
46 

•S 2134 IS

1 Department of Justice a report on the privacy and data 

2 protection implications of— 

3 (1) any merger involving a data aggregator de4 scribed in subsection (a); or 

5 (2) any merger that proposes the transfer of 

6 personal data of 50,000 or more individuals. 

7 SEC. 12. PROHIBITED ACTS. 

8 It shall be unlawful for— 

9 (1) any data aggregator or service provider to 

10 commit any act or omission in violation of this Act, 

11 Federal privacy law, or any rule or order issued by 

12 the Agency under this Act; 

13 (2) any data aggregator or service provider to 

14 commit any unlawful, unfair, deceptive, abusive, or 

15 discriminatory acts or practices in connection with 

16 the collection, processing, or sharing of personal 

17 data; 

18 (3) any data aggregator or service provider to 

19 fail or refuse as required by this Act or Federal pri20 vacy law, or any rule or order issued by the Agency 

21 thereunder— 

22 (A) to permit access to or copying of 

23 records; 

24 (B) to establish or maintain records; or 


pbinns on DSKJLVW7X2PROD with BILLS
47 

•S 2134 IS

1 (C) to make reports or provide information 

2 to the Agency; 

3 (4) any person to knowingly or recklessly pro4 vide substantial assistance to a data aggregator or 

5 service provider in violation of this Act or Federal 

6 privacy law, or any rule or order issued thereunder, 

7 and notwithstanding any provision of this Act, the 

8 provider of such substantial assistance shall be 

9 deemed to be in violation of this Act or Federal pri10 vacy law to the same extent as the person to whom 

11 substantial assistance is provided; or 

12 (5) any person, data aggregator, or service pro13 vider to re-identify, or attempt to re-identify, an in14 dividual, household, or device from anonymized data, 

15 unless such person, data aggregator, or service pro16 vider is conducting authorized testing to prove per17 sonal data has been anonymized. 

18 SEC. 13. ENFORCEMENT POWERS. 

19 (a) DEFINITIONS.—For purposes of this section, the 

20 following definitions shall apply: 

21 (1) AGENCY INVESTIGATION.—The term 

22 ‘‘Agency investigation’’ means any inquiry conducted 

23 by an Agency investigator for the purpose of 

24 ascertaining whether any person is or has been enVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00047 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
48 

•S 2134 IS

1 gaged in any conduct that is a violation, as defined 

2 in this section. 

3 (2) AGENCY INVESTIGATOR.—The term ‘‘Agen4 cy investigator’’ means any attorney or investigator 

5 employed by the Agency who is charged with the 

6 duty of enforcing or carrying into effect this Act any 

7 other Federal privacy law. 

8 (3) CUSTODIAN.—The term ‘‘custodian’’ means 

9 the custodian or any deputy custodian designated by 

10 the Agency. 

11 (4) DOCUMENTARY MATERIAL.—The term 

12 ‘‘documentary material’’ includes the original or any 

13 copy of any book, document, record, report, memo14 randum, paper, communication, tabulation, chart, 

15 logs, electronic files, or other data or data compila16 tions stored in any medium. 

17 (5) VIOLATION.—The term ‘‘violation’’ means 

18 any act or omission that, if proved, would constitute 

19 a violation of any provision of this Act or any other 

20 Federal privacy law. 

21 (b) INVESTIGATIONS AND ADMINISTRATIVE DIS22 COVERY.— 

23 (1) JOINT INVESTIGATIONS.— 

24 (A) IN GENERAL.—The Agency or, where 

25 appropriate, an Agency investigator, may enVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00048 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
49 

•S 2134 IS

1 gage in joint investigations and requests for in2 formation, as authorized under this Act. 

3 (B) CIVIL RIGHTS.—The authority under 

4 subparagraph (A) includes matters relating to 

5 protection of individuals’ civil rights under this 

6 Act and joint investigations with, and requests 

7 for information from, the Director of the Bu8 reau of Consumer Financial Protection, the 

9 Federal Trade Commission, the Secretary of 

10 Housing and Urban Development, the Depart11 ment of Education, the Equal Employment Op12 portunity Commission, the Department of 

13 Health and Human Services, or the Attorney 

14 General. 

15 (2) SUBPOENAS.— 

16 (A) IN GENERAL.—The Agency or an 

17 Agency investigator may issue subpoenas for 

18 the attendance and testimony of witnesses and 

19 the production of relevant papers, books, docu20 ments, or other material in connection with 

21 hearings under this Act. 

22 (B) FAILURE TO OBEY.—In the case of 

23 contumacy or refusal to obey a subpoena issued 

24 pursuant to this subparagraph and served upon 

25 any person, the district court of the United 


pbinns on DSKJLVW7X2PROD with BILLS
50 

•S 2134 IS

1 States for any district in which such person is 

2 found, resides, or transacts business, upon ap3 plication by the Agency or an Agency investi4 gator and after notice to such person, may 

5 issue an order requiring such person to appear 

6 and give testimony or to appear and produce 

7 documents or other material. 

8 (C) CONTEMPT.—Any failure to obey an 

9 order of the court under this subparagraph may 

10 be punished by the court as a contempt thereof. 

11 (3) DEMANDS.— 

12 (A) IN GENERAL.—Whenever the Agency 

13 has reason to believe that any person may be in 

14 possession, custody, or control of any documen15 tary material or tangible things, or may have 

16 any information, relevant to a violation, the 

17 Agency may, before the institution of any pro18 ceedings under this Act, issue in writing, and 

19 cause to be served upon such person, a civil in20 vestigative demand requiring such person to— 

21 (i) produce such documentary mate22 rial for inspection and copying or repro23 duction in the form or medium requested 

24 by the Agency; 

25 (ii) submit such tangible things; 


pbinns on DSKJLVW7X2PROD with BILLS
51 

•S 2134 IS

1 (iii) file written reports or answers to 

2 questions; 

3 (iv) give oral testimony concerning 

4 documentary material, tangible things, or 

5 other information; or 

6 (v) furnish any combination of such 

7 material, answers, or testimony. 

8 (B) REQUIREMENTS.—Each civil investiga9 tive demand shall state the nature of the con10 duct constituting the alleged violation which is 

11 under investigation and the provision of law ap12 plicable to such violation. 

13 (C) PRODUCTION OF DOCUMENTS.—Each 

14 civil investigative demand for the production of 

15 documentary material shall— 

16 (i) describe each class of documentary 

17 material to be produced under the demand 

18 with such definiteness and certainty as to 

19 permit such material to be fairly identified; 

20 (ii) prescribe a return date or dates 

21 which will provide a reasonable period of 

22 time within which the material so de23 manded may be assembled and made avail24 able for inspection and copying or repro25 duction; and 


pbinns on DSKJLVW7X2PROD with BILLS
52 

•S 2134 IS

1 (iii) identify the custodian to whom 

2 such material shall be made available. 

3 (D) PRODUCTION OF THINGS.—Each civil 

4 investigative demand for the submission of tan5 gible things shall— 

6 (i) describe each class of tangible 

7 things to be submitted under the demand 

8 with such definiteness and certainty as to 

9 permit such things to be fairly identified; 

10 (ii) prescribe a return date or dates 

11 which will provide a reasonable period of 

12 time within which the things so demanded 

13 may be assembled and submitted; and 

14 (iii) identify the custodian to whom 

15 such things shall be submitted. 

16 (E) DEMAND FOR WRITTEN REPORTS OR

17 ANSWERS.—Each civil investigative demand for 

18 written reports or answers to questions shall— 

19 (i) propound with definiteness and 

20 certainty the reports to be produced or the 

21 questions to be answered; 

22 (ii) prescribe a date or dates at which 

23 time written reports or answers to ques24 tions shall be submitted; and 


pbinns on DSKJLVW7X2PROD with BILLS
53 

•S 2134 IS

1 (iii) identify the custodian to whom 

2 such reports or answers shall be submitted. 

3 (F) ORAL TESTIMONY.—Each civil inves4 tigative demand for the giving of oral testimony 

5 shall— 

6 (i) prescribe a date, time, and place at 

7 which oral testimony shall be commenced; 

8 and 

9 (ii) identify an Agency investigator 

10 who shall conduct the investigation and the 

11 custodian to whom the transcript of such 

12 investigation shall be submitted. 

13 (G) SERVICE.—Any civil investigative de14 mand issued, and any enforcement petition 

15 filed, under this paragraph may be served— 

16 (i) by any Agency investigator at any 

17 place within the territorial jurisdiction of 

18 any court of the United States; and 

19 (ii) upon any person who is not found 

20 within the territorial jurisdiction of any 

21 court of the United States— 

22 (I) in such manner as the Fed23 eral Rules of Civil Procedure prescribe 

24 for service in a foreign nation; and 


pbinns on DSKJLVW7X2PROD with BILLS
54 

•S 2134 IS

1 (II) to the extent that the courts 

2 of the United States have authority to 

3 assert jurisdiction over such person, 

4 consistent with due process, the 

5 United States District Court for the 

6 District of Columbia shall have the 

7 same jurisdiction to take any action 

8 respecting compliance with this sec9 tion by such person that such district 

10 court would have if such person were 

11 personally within the jurisdiction of 

12 such district court. 

13 (H) METHOD OF SERVICE.—Service of any 

14 civil investigative demand or any enforcement 

15 petition filed under this paragraph may be 

16 made upon a person, including any legal entity, 

17 by— 

18 (i) delivering a duly executed copy of 

19 such demand or petition to the individual 

20 or to any partner, executive officer, man21 aging agent, or general agent of such per22 son, or to any agent of such person author23 ized by appointment or by law to receive 

24 service of process on behalf of such person; 


pbinns on DSKJLVW7X2PROD with BILLS
55 

•S 2134 IS

1 (ii) delivering a duly executed copy of 

2 such demand or petition to the principal 

3 office or place of business of the person to 

4 be served; or 

5 (iii) depositing a duly executed copy in 

6 the United States mails, by registered or 

7 certified mail, return receipt requested, 

8 duly addressed to such person at the prin9 cipal office or place of business of such 

10 person. 

11 (I) PROOF OF SERVICE.— 

12 (i) IN GENERAL.—A verified return by 

13 the individual serving any civil investiga14 tive demand or any enforcement petition 

15 filed under this paragraph setting forth the 

16 manner of such service shall be proof of 

17 such service. 

18 (ii) RETURN RECEIPTS.—In the case 

19 of service by registered or certified mail, 

20 such return shall be accompanied by the 

21 return post office receipt of delivery of 

22 such demand or enforcement petition. 

23 (J) PRODUCTION OF DOCUMENTARY MATE24 RIAL.—The production of documentary material 

25 in response to a civil investigative demand shall 


pbinns on DSKJLVW7X2PROD with BILLS
56 

•S 2134 IS

1 be made under a sworn certificate, in such form 

2 as the demand designates, by the person, if a 

3 natural person, to whom the demand is directed 

4 or, if not a natural person, by any person hav5 ing knowledge of the facts and circumstances 

6 relating to such production, to the effect that 

7 all of the documentary material required by the 

8 demand and in the possession, custody, or con9 trol of the person to whom the demand is di10 rected has been produced and made available to 

11 the custodian. 

12 (K) SUBMISSION OF TANGIBLE THINGS.— 

13 The submission of tangible things in response 

14 to a civil investigative demand shall be made 

15 under a sworn certificate, in such form as the 

16 demand designates, by the person to whom the 

17 demand is directed or, if not a natural person, 

18 by any person having knowledge of the facts 

19 and circumstances relating to such production, 

20 to the effect that all of the tangible things re21 quired by the demand and in the possession, 

22 custody, or control of the person to whom the 

23 demand is directed have been submitted to the 

24 custodian. 


pbinns on DSKJLVW7X2PROD with BILLS
57 

•S 2134 IS

1 (L) SEPARATE ANSWERS.—Each reporting 

2 requirement or question in a civil investigative 

3 demand shall be answered separately and fully 

4 in writing under oath, unless it is objected to, 

5 in which event the reasons for the objection 

6 shall be stated in lieu of an answer, and it shall 

7 be submitted under a sworn certificate, in such 

8 form as the demand designates, by the person, 

9 if a natural person, to whom the demand is di10 rected or, if not a natural person, by any per11 son responsible for answering each reporting re12 quirement or question, to the effect that all in13 formation required by the demand and in the 

14 possession, custody, control, or knowledge of 

15 the person to whom the demand is directed has 

16 been submitted. 

17 (M) TESTIMONY.— 

18 (i) IN GENERAL.— 

19 (I) OATH AND RECORDATION.— 

20 The examination of any person pursu21 ant to a demand for oral testimony 

22 served under this paragraph shall be 

23 taken before an officer authorized to 

24 administer oaths and affirmations by 

25 the laws of the United States or of 


pbinns on DSKJLVW7X2PROD with BILLS
58 

•S 2134 IS

1 the place at which the examination is 

2 held. The officer before whom oral 

3 testimony is to be taken shall put the 

4 witness on oath or affirmation and 

5 shall personally, or by any individual 

6 acting under the direction of and in 

7 the presence of the officer, record the 

8 testimony of the witness. 

9 (II) TRANSCRIPTION.—The testi10 mony shall be taken stenographically 

11 and transcribed. 

12 (III) TRANSMISSION TO CUSTO13 DIAN.—After the testimony is fully 

14 transcribed, the officer investigator 

15 before whom the testimony is taken 

16 shall promptly transmit a copy of the 

17 transcript of the testimony to the cus18 todian. 

19 (ii) PARTIES PRESENT.—Any Agency 

20 investigator before whom oral testimony is 

21 to be taken shall exclude from the place 

22 where the testimony is to be taken all 

23 other persons, except the person giving the 

24 testimony, the attorney for that person, 

25 the officer before whom the testimony is to 


pbinns on DSKJLVW7X2PROD with BILLS
59 

•S 2134 IS

1 be taken, an investigator or representative 

2 of an agency with which the Agency is en3 gaged in a joint investigation, and any ste4 nographer taking such testimony. 

5 (iii) LOCATION.—The oral testimony 

6 of any person taken pursuant to a civil in7 vestigative demand shall be taken in the 

8 judicial district of the United States in 

9 which such person resides, is found, or 

10 transacts business, or in such other place 

11 as may be agreed upon by the Agency in12 vestigator before whom the oral testimony 

13 of such person is to be taken and such per14 son. 

15 (iv) ATTORNEY REPRESENTATION.— 

16 (I) IN GENERAL.—Any person 

17 compelled to appear under a civil in18 vestigative demand for oral testimony 

19 pursuant to this section may be ac20 companied, represented, and advised 

21 by an attorney. 

22 (II) AUTHORITY.—The attorney 

23 may advise a person described in sub24 clause (I), in confidence, either upon 

25 the request of such person or upon 


pbinns on DSKJLVW7X2PROD with BILLS
60 

•S 2134 IS

1 the initiative of the attorney, with re2 spect to any question asked of such 

3 person. 

4 (III) OBJECTIONS.—A person de5 scribed in subclause (I), or the attor6 ney for that person, may object on the 

7 record to any question, in whole or in 

8 part, and such person shall briefly 

9 state for the record the reason for the 

10 objection. An objection may properly 

11 be made, received, and entered upon 

12 the record when it is claimed that 

13 such person is entitled to refuse to an14 swer the question on grounds of any 

15 constitutional or other legal right or 

16 privilege, including the privilege 

17 against self-incrimination, but such 

18 person shall not otherwise object to or 

19 refuse to answer any question, and 

20 such person or attorney shall not oth21 erwise interrupt the oral examination. 

22 (IV) REFUSAL TO ANSWER.—If a 

23 person described in subclause (I) re24 fuses to answer any question— 


pbinns on DSKJLVW7X2PROD with BILLS
61 

•S 2134 IS

1 (aa) the Agency may peti2 tion the district court of the 

3 United States pursuant to this 

4 section for an order compelling 

5 such person to answer such ques6 tion; and 

7 (bb) if the refusal is on 

8 grounds of the privilege against 

9 self-incrimination, the testimony 

10 of such person may be compelled 

11 in accordance with the provisions 

12 of section 6004 of title 18, 

13 United States Code. 

14 (v) TRANSCRIPTS.—For purposes of 

15 this paragraph— 

16 (I) after the testimony of any 

17 witness is fully transcribed, the Agen18 cy investigator shall afford the witness 

19 (who may be accompanied by an at20 torney) a reasonable opportunity to 

21 examine the transcript; 

22 (II) the transcript shall be read 

23 to or by the witness, unless such ex24 amination and reading are waived by 

25 the witness; 


pbinns on DSKJLVW7X2PROD with BILLS
62 

•S 2134 IS

1 (III) any changes in form or sub2 stance which the witness desires to 

3 make shall be entered and identified 

4 upon the transcript by the Agency in5 vestigator, with a statement of the 

6 reasons given by the witness for mak7 ing such changes; 

8 (IV) the transcript shall be 

9 signed by the witness, unless the wit10 ness in writing waives the signing, is 

11 ill, cannot be found, or refuses to 

12 sign; and 

13 (V) if the transcript is not signed 

14 by the witness during the 30-day pe15 riod following the date on which the 

16 witness is first afforded a reasonable 

17 opportunity to examine the transcript, 

18 the Agency investigator shall sign the 

19 transcript and state on the record the 

20 fact of the waiver, illness, absence of 

21 the witness, or the refusal to sign, to22 gether with any reasons given for the 

23 failure to sign. 

24 (vi) CERTIFICATION BY INVESTI25 GATOR.—The Agency investigator shall 


pbinns on DSKJLVW7X2PROD with BILLS
63 

•S 2134 IS

1 certify on the transcript that the witness 

2 was duly sworn by him or her and that the 

3 transcript is a true record of the testimony 

4 given by the witness, and the Agency in5 vestigator shall promptly deliver the tran6 script or send it by registered or certified 

7 mail to the custodian. 

8 (vii) COPY OF TRANSCRIPT.—The 

9 Agency investigator shall furnish a copy of 

10 the transcript (upon payment of reasonable 

11 charges for the transcript) to the witness 

12 only, except that the Agency may for good 

13 cause limit such witness to inspection of 

14 the official transcript of his testimony. 

15 (viii) WITNESS FEES.—Any witness 

16 appearing for the taking of oral testimony 

17 pursuant to a civil investigative demand 

18 shall be entitled to the same fees and mile19 age which are paid to witnesses in the dis20 trict courts of the United States. 

21 (4) CONFIDENTIAL TREATMENT OF DEMAND

22 MATERIAL.— 

23 (A) IN GENERAL.—Documentary materials 

24 and tangible things received as a result of a 

25 civil investigative demand shall be subject to reVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00063 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
64 

•S 2134 IS

1 quirements and procedures regarding confiden2 tiality, in accordance with rules established by 

3 the Agency. 

4 (B) DISCLOSURE TO CONGRESS.—No rule 

5 established by the Agency regarding the con6 fidentiality of materials submitted to, or other7 wise obtained by, the Agency shall be intended 

8 to prevent disclosure to either House of Con9 gress or to an appropriate committee of the 

10 Congress, except that the Agency is permitted 

11 to adopt rules allowing prior notice to any party 

12 that owns or otherwise provided the material to 

13 the Agency and had designated such material 

14 as confidential. 

15 (5) PETITION FOR ENFORCEMENT.— 

16 (A) IN GENERAL.—Whenever any person 

17 fails to comply with any civil investigative de18 mand duly served upon such person under this 

19 section, or whenever satisfactory copying or re20 production of material requested pursuant to 

21 the demand cannot be accomplished and such 

22 person refuses to surrender such material, the 

23 Agency, through such officers or attorneys as it 

24 may designate, may file, in the district court of 

25 the United States for any judicial district in 


pbinns on DSKJLVW7X2PROD with BILLS
65 

•S 2134 IS

1 which such person resides, is found, or trans2 acts business, and serve upon such person, a 

3 petition for an order of such court for the en4 forcement of this paragraph. 

5 (B) SERVICE OF PROCESS.—All process of 

6 any court to which application may be made as 

7 provided in this subparagraph may be served in 

8 any judicial district. 

9 (6) PETITION FOR ORDER MODIFYING OR SET10 TING ASIDE DEMAND.— 

11 (A) IN GENERAL.—Not later than 20 days 

12 after the service of any civil investigative de13 mand upon any person under subparagraph 

14 (B), or at any time before the return date spec15 ified in the demand, whichever period is short16 er, or within such period exceeding 20 days 

17 after service or in excess of such return date as 

18 may be prescribed in writing, subsequent to 

19 service, by any Agency investigator named in 

20 the demand, such person may file with the 

21 Agency a petition for an order by the Agency 

22 modifying or setting aside the demand. 

23 (B) COMPLIANCE DURING PENDENCY.— 

24 The time permitted for compliance with the de25 mand in whole or in part, as determined proper 


pbinns on DSKJLVW7X2PROD with BILLS
66 

•S 2134 IS

1 and ordered by the Agency, shall not run dur2 ing the pendency of a petition under clause (i) 

3 at the Agency, except that such person shall 

4 comply with any portions of the demand not 

5 sought to be modified or set aside. 

6 (C) SPECIFIC GROUNDS.—A petition under 

7 subparagraph (A) shall specify each ground 

8 upon which the petitioner relies in seeking re9 lief, and may be based upon any failure of the 

10 demand to comply with the provisions of this 

11 section, or upon any constitutional or other 

12 legal right or privilege of such person. 

13 (7) CUSTODIAL CONTROL.—At any time during 

14 which any custodian is in custody or control of any 

15 documentary material, tangible things, reports, an16 swers to questions, or transcripts of oral testimony 

17 given by any person in compliance with any civil in18 vestigative demand, such person may file, in the dis19 trict court of the United States for the judicial dis20 trict within which the office of such custodian is sit21 uated, and serve upon such custodian, a petition for 

22 an order of such court requiring the performance by 

23 such custodian of any duty imposed upon him by 

24 this section or rule promulgated by the Agency. 

25 (8) JURISDICTION OF COURT.— 


pbinns on DSKJLVW7X2PROD with BILLS
67 

•S 2134 IS

1 (A) IN GENERAL.—Whenever any petition 

2 is filed in any district court of the United 

3 States under this paragraph, such court shall 

4 have jurisdiction to hear and determine the 

5 matter so presented, and to enter such order or 

6 orders as may be required to carry out the pro7 visions of this section. 

8 (B) APPEAL.—Any final order entered as 

9 described in subparagraph (A) shall be subject 

10 to appeal pursuant to section 1291 of title 28, 

11 United States Code. 

12 (c) HEARINGS AND ADJUDICATORY PROCEEDINGS.— 

13 (1) IN GENERAL.—The Agency is authorized to 

14 conduct hearings and adjudication proceedings with 

15 respect to any person in the manner prescribed by 

16 chapter 5 of title 5, United States Code in order to 

17 ensure or enforce compliance with— 

18 (A) the provisions of this Act and other 

19 Federal privacy laws, including any rules pre20 scribed by the Agency under this Act and other 

21 Federal privacy laws; and 

22 (B) any other Federal privacy law that the 

23 Agency is authorized to enforce, and any rules 

24 or order prescribed thereunder, unless such 

25 Federal privacy law specifically limits the AgenVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00067 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
68 

•S 2134 IS

1 cy from conducting a hearing or adjudication 

2 proceeding and only to the extent of such limi3 tation. 

4 (2) SPECIAL RULES FOR CEASE-AND-DESIST

5 PROCEEDINGS.— 

6 (A) ORDERS AUTHORIZED.— 

7 (i) IN GENERAL.—If, in the opinion of 

8 the Agency, any data aggregator is engag9 ing or has engaged in an activity that vio10 lates a law, rule, or any condition imposed 

11 in writing on the person by the Agency, 

12 the Agency may issue and serve upon the 

13 data aggregator or service provider a no14 tice of charges in respect thereof. 

15 (ii) CONTENT OF NOTICE.—The no16 tice under clause (i) shall contain a state17 ment of the facts constituting the alleged 

18 violation or violations, and shall fix a time 

19 and place at which a hearing will be held 

20 to determine whether an order to cease 

21 and desist should issue against the data 

22 aggregator or service provider, such hear23 ing to be held not earlier than 30 days nor 

24 later than 60 days after the date of service 

25 of such notice, unless an earlier or a later 


pbinns on DSKJLVW7X2PROD with BILLS
69 

•S 2134 IS

1 date is set by the Agency, at the request 

2 of any party so served. 

3 (iii) CONSENT.—Unless the party or 

4 parties served under clause (ii) appear at 

5 the hearing personally or by a duly author6 ized representative, such person shall be 

7 deemed to have consented to the issuance 

8 of the cease-and-desist order. 

9 (iv) PROCEDURE.—In the event of 

10 consent under clause (ii), or if, upon the 

11 record made at any such hearing, the 

12 Agency finds that any violation specified in 

13 the notice of charges has been established, 

14 the Agency may issue and serve upon the 

15 data aggregator or service provider an 

16 order to cease and desist from the violation 

17 or practice. Such order may, by provisions 

18 which may be mandatory or otherwise, re19 quire the data aggregator or service pro20 vider to cease and desist from the subject 

21 activity, and to take affirmative action to 

22 correct the conditions resulting from any 

23 such violation. 

24 (B) EFFECTIVENESS OF ORDER.—A cease25 and-desist order shall become effective at the 


pbinns on DSKJLVW7X2PROD with BILLS
70 

•S 2134 IS

1 expiration of 30 days after the date of service 

2 of an order under subparagraph (A) upon the 

3 data aggregator or service provider concerned 

4 (except in the case of a cease-and-desist order 

5 issued upon consent, which shall become effec6 tive at the time specified therein), and shall re7 main effective and enforceable as provided 

8 therein, except to such extent as the order is 

9 stayed, modified, terminated, or set aside by ac10 tion of the Agency or a reviewing court. 

11 (C) DECISION AND APPEAL.—Any hearing 

12 provided for in this subsection shall be held in 

13 the Federal judicial district or in the territory 

14 in which the residence or principal office or 

15 place of business of the person is located unless 

16 the person consents to another place, and shall 

17 be conducted in accordance with the provisions 

18 of chapter 5 of title 5 of the United States 

19 Code. After such hearing, and within 90 days 

20 after the Agency has notified the parties that 

21 the case has been submitted to the Agency for 

22 final decision, the Agency shall render its deci23 sion (which shall include findings of fact upon 

24 which its decision is predicated) and shall issue 

25 and serve upon each party to the proceeding an 


pbinns on DSKJLVW7X2PROD with BILLS
71 

•S 2134 IS

1 order or orders consistent with the provisions of 

2 this section. Judicial review of any such order 

3 shall be exclusively as provided in this sub4 section. Unless a petition for review is timely 

5 filed in a court of appeals of the United States, 

6 as provided in subparagraph (D), and there7 after until the record in the proceeding has 

8 been filed as provided in subparagraph (D), the 

9 Agency may at any time, upon such notice and 

10 in such manner as the Agency shall determine 

11 proper, modify, terminate, or set aside any such 

12 order. Upon filing of the record as provided, the 

13 Agency may modify, terminate, or set aside any 

14 such order with permission of the court. 

15 (D) APPEAL TO COURT OF APPEALS.—Any 

16 party to any proceeding under this subsection 

17 may obtain a review of any order served pursu18 ant to this subparagraph (other than an order 

19 issued with the consent of the person con20 cerned) by the filing in the court of appeals of 

21 the United States for the circuit in which the 

22 principal office of the covered person is located, 

23 or in the United States Court of Appeals for 

24 the District of Columbia Circuit, within 30 days 

25 after the date of service of such order, a written 


pbinns on DSKJLVW7X2PROD with BILLS
72 

•S 2134 IS

1 petition praying that the order of the Agency be 

2 modified, terminated, or set aside. A copy of 

3 such petition shall be forthwith transmitted by 

4 the clerk of the court to the Agency, and there5 upon the Agency shall file in the court the 

6 record in the proceeding, as provided in section 

7 2112 of title 28 of the United States Code. 

8 Upon the filing of such petition, such court 

9 shall have jurisdiction, which upon the filing of 

10 the record shall except as provided in the last 

11 sentence of subparagraph (C) be exclusive, to 

12 affirm, modify, terminate, or set aside, in whole 

13 or in part, the order of the Agency. Review of 

14 such proceedings shall be had as provided in 

15 chapter 7 of title 5 of the United States Code. 

16 The judgment and decree of the court shall be 

17 final, except that the same shall be subject to 

18 review by the Supreme Court of the United 

19 States, upon certiorari, as provided in section 

20 1254 of title 28 of the United States Code. 

21 (E) NO STAY.—The commencement of pro22 ceedings for judicial review under clause (iv) 

23 shall not, unless specifically ordered by the 

24 court, operate as a stay of any order issued by 

25 the Agency. 


pbinns on DSKJLVW7X2PROD with BILLS
73 

•S 2134 IS

1 (3) SPECIAL RULES FOR TEMPORARY CEASE2 AND-DESIST PROCEEDINGS.— 

3 (A) IN GENERAL.—Whenever the Agency 

4 determines that the violation specified in the 

5 notice of charges served upon a data 

6 aggregator, including a service provider, pursu7 ant to paragraph (2), or the continuation there8 of, is likely to cause the person to be insolvent 

9 or otherwise prejudice the interests of individ10 uals before the completion of the proceedings 

11 conducted pursuant to paragraph (2), the Agen12 cy may issue a temporary order requiring the 

13 data aggregator or service provider to cease and 

14 desist from any such violation or practice and 

15 to take affirmative action to prevent or remedy 

16 such insolvency or other condition pending com17 pletion of such proceedings. Such order may in18 clude any requirement authorized under this 

19 Act. Such order shall become effective upon 

20 service upon the data aggregator or servicer 

21 provider and, unless set aside, limited, or sus22 pended by a court in proceedings authorized by 

23 clause (ii), shall remain effective and enforce24 able pending the completion of the administra25 tive proceedings pursuant to such notice and 


pbinns on DSKJLVW7X2PROD with BILLS
74 

•S 2134 IS

1 until such time as the Agency shall dismiss the 

2 charges specified in such notice, or if a cease3 and-desist order is issued against the person, 

4 until the effective date of such order. 

5 (B) APPEAL.—Not later than 10 days 

6 after the data aggregator or service provider 

7 concerned has been served with a temporary 

8 cease-and-desist order, the data aggregator or 

9 service provider may apply to the United States 

10 district court for the judicial district in which 

11 the residence or principal office or place of busi12 ness of such data aggregator or servicer pro13 vider is located, or the United States District 

14 Court for the District of Columbia, for an in15 junction setting aside, limiting, or suspending 

16 the enforcement, operation, or effectiveness of 

17 such order pending the completion of the ad18 ministrative proceedings pursuant to the notice 

19 of charges served upon the data aggregator or 

20 servicer provider under subparagraph (B), and 

21 such court shall have jurisdiction to issue such 

22 injunction. 

23 (C) INCOMPLETE OR INACCURATE

24 RECORDS.— 


pbinns on DSKJLVW7X2PROD with BILLS
75 

•S 2134 IS

1 (i) TEMPORARY ORDER.—If a notice 

2 of charges served under paragraph (2) 

3 specifies, on the basis of particular facts 

4 and circumstances, that the books and 

5 records of a data aggregator or service 

6 provider are so incomplete or inaccurate 

7 that the Agency is unable to determine the 

8 financial condition of that data aggregator 

9 or service provider or the details or pur10 pose of any transaction or transactions 

11 that may have a material effect on the fi12 nancial condition of that person, the Agen13 cy may issue a temporary order requir14 ing— 

15 (I) the cessation of any activity 

16 or practice which gave rise, whether in 

17 whole or in part, to the incomplete or 

18 inaccurate state of the books or 

19 records; or 

20 (II) affirmative action to restore 

21 such books or records to a complete 

22 and accurate state, until the comple23 tion of the proceedings under para24 graph (2)(A). 


pbinns on DSKJLVW7X2PROD with BILLS
76 

•S 2134 IS

1 (ii) EFFECTIVE PERIOD.—Any tem2 porary order issued under clause (i)— 

3 (I) shall become effective upon 

4 service; and 

5 (II) unless set aside, limited, or 

6 suspended by a court in proceedings 

7 under subparagraph (B), shall remain 

8 in effect and enforceable until the ear9 lier of— 

10 (aa) the completion of the 

11 proceeding initiated under para12 graph (2) in connection with the 

13 notice of charges; or 

14 (bb) the date the Agency de15 termines, by examination or oth16 erwise, that the books and 

17 records of the covered person or 

18 service provider are accurate and 

19 reflect the financial condition 

20 thereof. 

21 (4) SPECIAL RULES FOR ENFORCEMENT OF OR22 DERS.— 

23 (A) IN GENERAL.—The Agency may in its 

24 discretion apply to the United States district 

25 court within the jurisdiction of which the prinVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00076 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
77 

•S 2134 IS

1 cipal office or place of business of the person is 

2 located, for the enforcement of any effective 

3 and outstanding notice or order issued under 

4 this section, and such court shall have jurisdic5 tion and power to order and require compliance 

6 herewith. 

7 (B) EXCEPTION.—Except as otherwise 

8 provided in this subparagraph, no court shall 

9 have jurisdiction to affect by injunction or oth10 erwise the issuance or enforcement of any no11 tice or order or to review, modify, suspend, ter12 minate, or set aside any such notice or order. 

13 (5) RULES.—The Agency shall prescribe rules 

14 establishing such procedures as may be necessary to 

15 carry out this paragraph. 

16 (d) LITIGATION AUTHORITY.— 

17 (1) IN GENERAL.—If any person violates this 

18 Act, a rule or order issued under this Act, or a Fed19 eral privacy law, the Agency may commence a civil 

20 action against such person to impose a civil penalty 

21 or to seek all appropriate legal and equitable relief 

22 including a permanent or temporary injunction as 

23 permitted by law. 

24 (2) REPRESENTATION.—The Agency may act in 

25 its own name and through its own attorneys in enVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00077 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
78 

•S 2134 IS

1 forcing any provision of this Act, rules thereunder, 

2 or any other law or regulation, or in any action, suit, 

3 or proceeding to which the Agency is a party. 

4 (3) COMPROMISE OF ACTIONS.—The Agency 

5 may compromise or settle any action if such com6 promise is approved by the court. 

7 (4) NOTICE TO THE ATTORNEY GENERAL.— 

8 (A) IN GENERAL.—When commencing a 

9 civil action under this Act or any Federal pri10 vacy law, or any rule thereunder, the Agency 

11 shall notify the Attorney General. 

12 (B) NOTICE AND COORDINATION.— 

13 (i) NOTICE OF OTHER ACTIONS.—In 

14 addition to any notice required under sub15 paragraph (A), the Agency shall notify the 

16 Attorney General concerning any action, 

17 suit, or proceeding to which the Agency is 

18 a party, except an action, suit, or pro19 ceeding that involves a violation of this Act 

20 or a Federal privacy law. 

21 (ii) COORDINATION.—In order to 

22 avoid conflicts and promote consistency re23 garding litigation of matters under Federal 

24 law, the Attorney General and the Agency 

25 shall consult regarding the coordination of 


pbinns on DSKJLVW7X2PROD with BILLS
79 

•S 2134 IS

1 investigations and proceedings, including 

2 by negotiating an agreement for coordina3 tion by not later than 180 days after the 

4 designated transfer date. The agreement 

5 under this subclause shall include provi6 sions to ensure that parallel investigations 

7 and proceedings involving the Federal pri8 vacy laws are conducted in a manner that 

9 avoids conflicts and does not impede the 

10 ability of the Attorney General to pros11 ecute violations of Federal criminal laws. 

12 (iii) RULE OF CONSTRUCTION.—Noth13 ing in this paragraph shall be construed to 

14 limit the authority of the Agency under 

15 this title, including the authority to inter16 pret Federal privacy law . 

17 (5) APPEARANCE BEFORE THE SUPREME

18 COURT.—The Agency may represent itself in its own 

19 name before the Supreme Court of the United 

20 States, if the Agency makes a written request to the 

21 Attorney General within the 10-day period that be22 gins on the date of entry of the judgment that would 

23 permit any party to file a petition for writ of certio24 rari, and the Attorney General concurs with such reVerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00079 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134

pbinns on DSKJLVW7X2PROD with BILLS
80 

•S 2134 IS

1 quest or fails to take action within 60 days of the 

2 request of the Agency. 

3 (6) FORUM.—Any civil action brought under a 

4 Federal privacy law may be brought in a United 

5 States district court or in any court of competent ju6 risdiction of a State in a district in which the de7 fendant is located or resides or is doing business, 

8 and such court shall have jurisdiction to enjoin such 

9 person and to require compliance with any Federal 

10 privacy law. 

11 (7) TIME FOR BRINGING ACTION.—Except as 

12 otherwise permitted by law or equity, no action may 

13 be brought under this Act or other Federal privacy 

14 law more than 5 years after the date of discovery of 

15 the violation to which an action relates. 

16 (e) RELIEF AVAILABLE.— 

17 (1) ADMINISTRATIVE PROCEEDINGS OR COURT

18 ACTIONS.— 

19 (A) JURISDICTION.—The court (or the 

20 Agency, as the case may be) in an action or ad21 judication proceeding brought under this Act or 

22 a Federal privacy law, shall have jurisdiction to 

23 grant any appropriate legal or equitable relief 

24 with respect to a violation of this Act or Fed25 eral privacy law, including a violation of a rule 


pbinns on DSKJLVW7X2PROD with BILLS
81 

•S 2134 IS

1 or order prescribed under this Act or Federal 

2 privacy law. 

3 (B) RELIEF.—Relief under this section 

4 may include, without limitation— 

5 (i) rescission or reformation of con6 tracts; 

7 (ii) refund of moneys or return of real 

8 property; 

9 (iii) restitution; 

10 (iv) disgorgement of any revenue, 

11 data, or technologies, including automated 

12 decision systems, data sets, or algorithms, 

13 attributable to a violation of this Act, Fed14 eral privacy law, or any rule or order 

15 issued by the Agency under this Act; 

16 (v) payment of damages or other mon17 etary relief; 

18 (vi) public notification regarding the 

19 violation, including the costs of notifica20 tion; 

21 (vii) limits on the activities or func22 tions of the person; and 

23 (viii) civil money penalties, as set 

24 forth more fully in paragraph (3). 


pbinns on DSKJLVW7X2PROD with BILLS
82 

•S 2134 IS

1 (C) NO EXEMPLARY OR PUNITIVE DAM2 AGES.—Nothing in this subparagraph shall be 

3 construed as authorizing the imposition of ex4 emplary or punitive damages in an action 

5 brought by the Agency. 

6 (2) RECOVERY OF COSTS.—In any action 

7 brought by the Agency, a State attorney general, or 

8 any State regulator to enforce this Act or any Fed9 eral privacy law, the Agency, the State attorney gen10 eral, or the State regulator may recover its costs in 

11 connection with prosecuting such action if the Agen12 cy, the State attorney general, or the State regulator 

13 is the prevailing party in the action. 

14 (3) CIVIL MONEY PENALTY IN COURT AND AD15 MINISTRATIVE ACTIONS.— 

16 (A) IN GENERAL.—Any person that vio17 lates, through any act or omission, any provi18 sion of this Act or any Federal privacy law shall 

19 forfeit and pay a civil penalty pursuant to this 

20 subparagraph. 

21 (B) PENALTY AMOUNTS.— 

22 (i) FIRST TIER.—For any violation of 

23 a law, rule, or final order or condition im24 posed in writing by the Agency, a civil pen25 alty may not exceed— 


pbinns on DSKJLVW7X2PROD with BILLS
83 

•S 2134 IS

1 (I) $5,000 for each day during 

2 which such violation or failure to pay 

3 continues; or 

4 (II) $15,000 for each day during 

5 which such violation or failure to pay 

6 continues if such violation involves the 

7 personal data of individuals under the 

8 age of 13. 

9 (ii) SECOND TIER.—Notwithstanding 

10 clause (i), for any person that recklessly 

11 engages in a violation of this Act or any 

12 Federal privacy law, a civil penalty may 

13 not exceed— 

14 (I) $25,000 for each day during 

15 which such violation or failure to pay 

16 continues; or 

17 (II) $75,000 for each day during 

18 which such violation or failure to pay 

19 continues if such violation involves the 

20 personal data of individuals under the 

21 age of 13. 

22 (iii) THIRD TIER.—Notwithstanding 

23 clauses (i) and (ii), for any person that 

24 knowingly violates this Act or any Federal 


pbinns on DSKJLVW7X2PROD with BILLS
84 

•S 2134 IS

1 privacy law, a civil penalty may not ex2 ceed— 

3 (I) $1,000,000 for each day dur4 ing which such violation continues; or 

5 (II) $3,000,000 for each day dur6 ing which such violation or failure to 

7 pay continues if such violation in8 volves the personal data of individuals 

9 under the age of 13. 

10 (C) PENALTIES FOR RE-IDENTIFYING

11 DATA.—Any person that re-identifies, or at12 tempts to re-identify, anonymized data shall be 

13 assessed a third tier civil penalty under sub14 paragraph (B), unless conducting authorized 

15 testing to prove personal data has been 

16 anonymized. 

17 (D) MITIGATING FACTORS.—In deter18 mining the amount of any penalty assessed 

19 under subparagraph (B), the Agency or the 

20 court shall take into account the appropriate21 ness of the penalty with respect to— 

22 (i) the size of financial resources and 

23 good faith of the person charged; 

24 (ii) the gravity of the violation or fail25 ure to pay; 


pbinns on DSKJLVW7X2PROD with BILLS
85 

•S 2134 IS

1 (iii) the severity of the risks or harms 

2 to individuals; 

3 (iv) the history of previous violations; 

4 and 

5 (v) such other matters as justice may 

6 require. 

7 (E) AUTHORITY TO MODIFY OR REMIT

8 PENALTY.—The Agency may compromise, mod9 ify, or remit any penalty which may be assessed 

10 or had already been assessed under subpara11 graph (B). The amount of such penalty, when 

12 finally determined, shall be exclusive of any 

13 sums owed by the person to the United States 

14 in connection with the costs of the proceeding, 

15 and may be deducted from any sums owed by 

16 the United States to the person charged. 

17 (F) NOTICE AND HEARING.—No civil pen18 alty may be assessed under this subsection with 

19 respect to a violation of this Act or any Federal 

20 privacy law, unless— 

21 (i) the Agency gives notice and an op22 portunity for a hearing to the person ac23 cused of the violation; or 


pbinns on DSKJLVW7X2PROD with BILLS
86 

•S 2134 IS

1 (ii) the appropriate court has ordered 

2 such assessment and entered judgment in 

3 favor of the Agency. 

4 (f) REFERRALS FOR CRIMINAL PROCEEDINGS.—If 

5 the Agency obtains evidence that any person, domestic or 

6 foreign, has engaged in conduct that may constitute a vio7 lation of Federal criminal law, the Agency shall transmit 

8 such evidence to the Attorney General of the United 

9 States, who may institute criminal proceedings under ap10 propriate law. Nothing in this section affects any other 

11 authority of the Agency to disclose information. 

12 SEC. 14. TRANSFERS OF FUNCTIONS. 

13 (a) FEDERAL TRADE COMMISSION.—The authority 

14 of the Federal Trade Commission under a Federal privacy 

15 law to prescribe rules, issue guidelines, or conduct a study 

16 or issue a report mandated under such law shall be trans17 ferred to the Agency on the transfer date. Nothing in this 

18 Act shall be construed to require a mandatory transfer 

19 of any employee of the Federal Trade Commission. 

20 (b) AGENCY AUTHORITY.— 

21 (1) IN GENERAL.—The Agency shall have all 

22 powers and duties under the Federal privacy laws to 

23 prescribe rules, issue guidelines, or to conduct stud24 ies or issue reports mandated by such laws, that 


pbinns on DSKJLVW7X2PROD with BILLS
87 

•S 2134 IS

1 were vested in the Federal Trade Commission on the 

2 day before the transfer date. 

3 (2) FEDERAL TRADE COMMISSION ACT.—The 

4 Agency may enforce a rule prescribed under the 

5 Federal Trade Commission Act (15 U.S.C. 41 et 

6 seq.) by the Federal Trade Commission with respect 

7 to the collection, disclosure, processing and misuse 

8 of personal data. 

9 (c) AUTHORITY OF THE FEDERAL TRADE COMMIS10 SION.—No provision of this Act shall be construed as 

11 modifying, limiting, or otherwise affecting the authority 

12 of the Federal Trade Commission, including the authority 

13 with respect to large data collectors described in section 

14 11(a)(1) of this Act, under the Federal Trade Commission 

15 Act (15 U.S.C. 41 et seq.), or any other law, other than 

16 the authority under a Federal privacy law to prescribe 

17 rules, issue official guidelines, or conduct a study or issue 

18 a report mandated under such law. 

19 (d) AUTHORITY OF THE BUREAU OF CONSUMER FI20 NANCIAL PROTECTION.—No provision of this Act shall be 

21 construed as modifying, limiting, or otherwise affecting 

22 the authority of the Bureau of Consumer Financial Pro23 tection under the Dodd-Frank Wall Street Reform and 

24 Consumer Protection Act (12 U.S.C. 5301 et seq.) or any 

25 other law. 


pbinns on DSKJLVW7X2PROD with BILLS
88 

•S 2134 IS

1 SEC. 15. AUTHORIZATION OF APPROPRIATIONS. 

2 There are authorized to be appropriated to the Agen3 cy such sums as may be necessary to carry out this Act. 

4 SEC. 16. RELATION TO FEDERAL AND STATE LAW. 

5 (a) RELATION TO STATE LAW.— 

6 (1) RULE OF CONSTRUCTION.—This Act may 

7 not be construed as annulling, altering, or affecting, 

8 or exempting any person subject to the provisions of 

9 this title from complying with, the statutes, regula10 tions, orders, or interpretations in effect in any 

11 State, except to the extent that any such provision 

12 of law is inconsistent with the provisions of this title, 

13 and then only to the extent of the inconsistency. 

14 (2) GREATER PROTECTION UNDER STATE

15 LAW.—For purposes of this paragraph, a statute, 

16 regulation, order, or interpretation in effect in any 

17 State is not inconsistent with the provisions of this 

18 title if the protection that such statute, regulation, 

19 order, or interpretation affords to individuals is 

20 greater than the protection provided under this Act. 

21 A determination regarding whether a statute, regu22 lation, order, or interpretation in effect in any State 

23 is inconsistent with the provisions of this title may 

24 be made by the Agency on its own motion or in re25 sponse to a nonfrivolous petition initiated by any in26 terested person. 


pbinns on DSKJLVW7X2PROD with BILLS
89 

•S 2134 IS

1 (b) RELATION TO OTHER PROVISIONS OF FEDERAL

2 PRIVACY LAWS THAT RELATE TO STATE LAW.—No pro3 vision of this Act shall be construed as modifying, limiting, 

4 or superseding the operation of any provision of a Federal 

5 privacy law that relates to the application of a law in effect 

6 in any State with respect to such Federal law. 

7 (c) PRESERVATION OF ENFORCEMENT POWERS OF

8 STATES.—The attorney general (or the equivalent thereof) 

9 of any State may bring a civil action in the name of such 

10 State in any district court of the United States in that 

11 State or in State court that is located in that State and 

12 that has jurisdiction over the defendant, to enforce provi13 sions of this title or rules or orders issued under this Act, 

14 and to secure remedies under provisions of this title or 

15 remedies otherwise provided under other law. A State reg16 ulator may bring a civil action or other appropriate pro17 ceeding to enforce the provisions of this title or rules or 

18 orders issued under this Act with respect to any entity 

19 that is State-chartered, incorporated, licensed, or other20 wise authorized to do business under State law (except as 

21 provided in paragraph (2)), and to secure remedies under 

22 provisions of this title or remedies otherwise provided 

23 under other provisions of law with respect to such an enti24 ty. 

25 (d) PRESERVATION OF STATE AUTHORITY.— 


pbinns on DSKJLVW7X2PROD with BILLS
90 

•S 2134 IS

1 (1) STATE CLAIMS.—No provision of this sec2 tion shall be construed as altering, limiting, or af3 fecting the authority of a State attorney general or 

4 any other regulatory or enforcement agency or au5 thority to bring an action or other regulatory pro6 ceeding arising solely under the law in effect in that 

7 State. 

8 (2) STATE CONSUMER PROTECTION, PRIVACY, 

9 AND DATA REGULATORS.—No provision of this title 

10 shall be construed as altering, limiting, or affecting 

11 the authority of a State consumer protection, data 

12 protection, or privacy agency (or any agency or of13 fice performing like functions) under State law to 

14 adopt rules, initiate enforcement proceedings, or 

15 take any other action with respect to a person regu16 lated by such commission or authority. 

17 SEC. 17. INSPECTOR GENERAL. 

18 Section 12 of the Inspector General Act of 1978 (5 

19 U.S.C. App.) is amended— 

20 (1) in paragraph (1), by inserting ‘‘the Director 

21 of the Data Protection Agency;’’ after ‘‘the Presi22 dent of the Export-Import Bank;’’; and 


pbinns on DSKJLVW7X2PROD with BILLS
91 

•S 2134 IS

1 (2) in paragraph (2), by inserting ‘‘the Data 

2 Protection Agency,’’ after ‘‘the Export-Import 

3 Bank,’’. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS