II 

117TH CONGRESS 

1ST SESSION S. 2499 

To establish data privacy and data security protections for consumers in 

the United States. 

IN THE SENATE OF THE UNITED STATES 

JULY 28, 2021 

Mr. WICKER (for himself and Mrs. BLACKBURN) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To establish data privacy and data security protections for 

consumers in the United States. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Setting an American Framework to Ensure Data Access, 

6 Transparency, and Accountability Act’’ or the ‘‘SAFE 

7 DATA Act’’. 

8 (b) TABLE OF CONTENTS.—The table of contents for 

9 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Definitions. 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•S 2499 IS

Sec. 3. Effective date. 

TITLE I—INDIVIDUAL CONSUMER DATA RIGHTS 

Sec. 101. Consumer loyalty. 

Sec. 102. Transparency. 

Sec. 103. Individual control. 

Sec. 104. Rights to consent. 

Sec. 105. Minimizing data collection, processing, and retention. 

Sec. 106. Service providers and third parties. 

Sec. 107. Privacy impact assessments. 

Sec. 108. Scope of coverage. 

TITLE II—DATA TRANSPARENCY, INTEGRITY, AND SECURITY 

Sec. 201. Civil rights, algorithm bias, detection, and mitigation. 

Sec. 202. Data brokers. 

Sec. 203. Protection of covered data. 

TITLE III—CORPORATE ACCOUNTABILITY 

Sec. 301. Designation of data privacy officer and data security officer. 

Sec. 302. Internal controls. 

Sec. 303. Whistleblower protections. 

TITLE IV—ENFORCEMENT AUTHORITY AND NEW PROGRAMS 

Sec. 401. Enforcement by the Federal Trade Commission. 

Sec. 402. Enforcement by State attorneys general. 

Sec. 403. Approved certification programs. 

Sec. 404. Relationship between Federal and State law. 

Sec. 405. Constitutional avoidance. 

Sec. 406. Severability. 

1 SEC. 2. DEFINITIONS. 

2 In this Act: 

3 (1) AFFIRMATIVE EXPRESS CONSENT.—The 

4 term ‘‘affirmative express consent’’ means, upon 

5 being presented with a clear and conspicuous de6 scription of an act or practice for which consent is 

7 sought, an affirmative act by the individual clearly 

8 communicating the individual’s authorization for the 

9 act or practice. 

10 (2) ALGORITHM.—The term ‘‘algorithm’’ means 

11 a computational process derived from machine learnVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
3 

•S 2499 IS

1 ing, statistics, or other data processing or artificial 

2 intelligence techniques, that processes covered data 

3 for the purpose of making a decision or facilitating 

4 human decision-making. 

5 (3) COLLECTION.—The term ‘‘collection’’ 

6 means buying, renting, gathering, obtaining, receiv7 ing, or accessing any covered data of an individual 

8 by any means. 

9 (4) COMMISSION.—The term ‘‘Commission’’ 

10 means the Federal Trade Commission. 

11 (5) COMMON BRANDING.—The term ‘‘common 

12 branding’’ means a shared name, servicemark, or 

13 trademark. 

14 (6) COVERED DATA.— 

15 (A) IN GENERAL.—The term ‘‘covered 

16 data’’ means information that identifies or is 

17 linked or reasonably linkable to an individual or 

18 a device that is linked or reasonably linkable to 

19 an individual. 

20 (B) LINKED OR REASONABLY LINKABLE.— 

21 For purposes of subparagraph (A), information 

22 held by a covered entity is linked or reasonably 

23 linkable to an individual or a device if, as a 

24 practical matter, it can be used on its own or 

25 in combination with other information held by, 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•S 2499 IS

1 or readily accessible to, the covered entity to 

2 identify such individual or such device. 

3 (C) EXCLUSIONS.—Such term does not in4 clude— 

5 (i) aggregated data; 

6 (ii) de-identified data; 

7 (iii) employee data; or 

8 (iv) publicly available information. 

9 (D) AGGREGATED DATA.—For purposes of 

10 subparagraph (C), the term ‘‘aggregated data’’ 

11 means information that relates to a group or 

12 category of individuals or devices that does not 

13 identify and is not linked or reasonably linkable 

14 to any individual or device. 

15 (E) DE-IDENTIFIED DATA.—For purposes 

16 of subparagraph (C), the term ‘‘de-identified 

17 data’’ means information held by a covered en18 tity that— 

19 (i) does not identify, and is not linked 

20 or reasonably linkable to, an individual or 

21 device; 

22 (ii) does not contain any persistent 

23 identifier or other information that could 

24 readily be used to reidentify the individual 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•S 2499 IS

1 to whom, or the device to which, the identi2 fier or information pertains; 

3 (iii) is subject to a public commitment 

4 by the covered entity— 

5 (I) to refrain from attempting to 

6 use such information to identify any 

7 individual or device; and 

8 (II) to adopt technical and orga9 nizational measures to ensure that 

10 such information is not linked to any 

11 individual or device; and 

12 (iv) is not disclosed by the covered en13 tity to any other party unless the disclo14 sure is subject to a contractually or other 

15 legally binding requirement that— 

16 (I) the recipient of the informa17 tion shall not use the information to 

18 identify any individual or device; and 

19 (II) all onward disclosures of the 

20 information shall be subject to the re21 quirement described in subclause (I). 

22 (F) EMPLOYEE DATA.—For purposes of 

23 subparagraph (C), the term ‘‘employee data’’ 

24 means— 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•S 2499 IS

1 (i) information relating to an indi2 vidual collected by a covered entity in the 

3 course of the individual acting as a job ap4 plicant to, or employee (regardless of 

5 whether such employee is paid or unpaid, 

6 or employed on a temporary basis), owner, 

7 director, officer, staff member, trainee, 

8 vendor, visitor, volunteer, intern, or con9 tractor of, the entity, provided that such 

10 information is collected, processed, or 

11 transferred by the covered entity solely for 

12 purposes related to the individual’s status 

13 as a current or former job applicant to, or 

14 an employee, owner, director, officer, staff 

15 member, trainee, vendor, visitor, volunteer, 

16 intern, or contractor of, that covered enti17 ty; 

18 (ii) business contact information of an 

19 individual, including the individual’s name, 

20 position or title, business telephone num21 ber, business address, business email ad22 dress, qualifications, and other similar in23 formation, that is provided to a covered en24 tity by an individual who is acting in a 

25 professional capacity, provided that such 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•S 2499 IS

1 information is collected, processed, or 

2 transferred solely for purposes related to 

3 such individual’s professional activities; 

4 (iii) emergency contact information 

5 collected by a covered entity that relates to 

6 an individual who is acting in a role de7 scribed in clause (i) with respect to the 

8 covered entity, provided that such informa9 tion is collected, processed, or transferred 

10 solely for the purpose of having an emer11 gency contact on file for the individual; or 

12 (iv) information relating to an indi13 vidual (or a relative or beneficiary of such 

14 individual) that is necessary for the cov15 ered entity to collect, process, or transfer 

16 for the purpose of administering benefits 

17 to which such individual (or relative or 

18 beneficiary of such individual) is entitled 

19 on the basis of the individual acting in a 

20 role described in clause (i) with respect to 

21 the entity, provided that such information 

22 is collected, processed, or transferred solely 

23 for the purpose of administering such ben24 efits. 


pamtmann on DSKBC07HB2PROD with BILLS
8 

•S 2499 IS

1 (G) PUBLICLY AVAILABLE INFORMA2 TION.— 

3 (i) IN GENERAL.—For the purposes of 

4 subparagraph (C), the term ‘‘publicly 

5 available information’’ means any informa6 tion that a covered entity has a reasonable 

7 basis to believe— 

8 (I) has been lawfully made avail9 able to the general public from Fed10 eral, State, or local government 

11 records; 

12 (II) is widely available to the 

13 general public, including information 

14 from— 

15 (aa) a telephone book or on16 line directory; 

17 (bb) television, internet, or 

18 radio content or programming; or 

19 (cc) the news media or a 

20 website that is lawfully available 

21 to the general public on an unre22 stricted basis (for purposes of 

23 this subclause a website is not re24 stricted solely because there is a 

25 fee or log-in requirement associVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
9 

•S 2499 IS

1 ated with accessing the website); 

2 or 

3 (III) is a disclosure to the gen4 eral public that is required to be made 

5 by Federal, State, or local law. 

6 (ii) EXCLUSIONS.—Such term does 

7 not include an obscene visual depiction (as 

8 defined for purposes of section 1460 of 

9 title 18, United States Code). 

10 (7) COVERED ENTITY.—The term ‘‘covered en11 tity’’ means any person that— 

12 (A) is subject to the Federal Trade Com13 mission Act (15 U.S.C. 41 et seq.) or is— 

14 (i) a common carrier described in sec15 tion 5(a)(2) of such Act (15 U.S.C. 

16 45(a)(2)); or 

17 (ii) an organization not organized to 

18 carry on business for their own profit or 

19 that of their members; 

20 (B) collects, processes, or transfers covered 

21 data; and 

22 (C) determines the purposes and means of 

23 such collection, processing, or transfer. 

24 (8) DATA BROKER.— 


pamtmann on DSKBC07HB2PROD with BILLS
10 

•S 2499 IS

1 (A) IN GENERAL.—The term ‘‘data 

2 broker’’ means a covered entity whose principal 

3 source of revenue is derived from processing or 

4 transferring the covered data of individuals with 

5 whom the entity does not have a direct relation6 ship on behalf of third parties for such third 

7 parties’ use. 

8 (B) EXCLUSION.—Such term does not in9 clude a service provider. 

10 (9) DELETE.—The term ‘‘delete’’ means to re11 move or destroy information such that it is not 

12 maintained in human or machine readable form and 

13 cannot be retrieved or utilized in such form in the 

14 normal course of business. 

15 (10) EXECUTIVE AGENCY.—The term ‘‘Execu16 tive agency’’ has the meaning set forth in section 

17 105 of title 5, United States Code. 

18 (11) INDIVIDUAL.—The term ‘‘individual’’ 

19 means a natural person residing in the United 

20 States. 

21 (12) LARGE DATA HOLDER.—The term ‘‘large 

22 data holder’’ means a covered entity that in the 

23 most recent calendar year— 

24 (A) processed or transferred the covered 

25 data of more than 8,000,000 individuals; or 


pamtmann on DSKBC07HB2PROD with BILLS
11 

•S 2499 IS

1 (B) processed or transferred the sensitive 

2 covered data of more than 300,000 individuals 

3 or devices that are linked or reasonably linkable 

4 to an individual (excluding any instance where 

5 the covered entity processes the log-in informa6 tion of an individual or device to allow the indi7 vidual or device to log in to an account adminis8 tered by the covered entity). 

9 (13) MATERIAL.—The term ‘‘material’’ means, 

10 with respect to an act, practice, or representation of 

11 a covered entity (including a representation made by 

12 the covered entity in a privacy policy or similar dis13 closure to individuals), that such act, practice, or 

14 representation is likely to affect an individual’s deci15 sion or conduct regarding a product or service. 

16 (14) PROCESS.—The term ‘‘process’’ means 

17 any operation or set of operations performed on cov18 ered data including analysis, organization, struc19 turing, retaining, using, or otherwise handling cov20 ered data. 

21 (15) PROCESSING PURPOSE.—The term ‘‘proc22 essing purpose’’ means a reason for which a covered 

23 entity processes covered data. 

24 (16) RESEARCH.—The term ‘‘research’’ means 

25 the scientific analysis of information, including covVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
12 

•S 2499 IS

1 ered data, by a covered entity or those with whom 

2 the covered entity is cooperating or others acting at 

3 the direction or on behalf of the covered entity, that 

4 is conducted for the primary purpose of advancing 

5 scientific knowledge and may be for the commercial 

6 benefit of the covered entity. 

7 (17) SENSITIVE COVERED DATA.— 

8 (A) IN GENERAL.—The term ‘‘sensitive 

9 covered data’’ means any of the following forms 

10 of covered data of an individual: 

11 (i) A unique, government-issued iden12 tifier, such as a Social Security number, 

13 passport number, or driver’s license num14 ber, that is not required to be displayed to 

15 the public. 

16 (ii) Any covered data that describes or 

17 reveals the diagnosis or treatment of the 

18 past, present, or future physical health, 

19 mental health, or disability of an indi20 vidual. 

21 (iii) A financial account number, debit 

22 card number, credit card number, or any 

23 required security or access code, password, 

24 or credentials allowing access to any such 

25 account. 


pamtmann on DSKBC07HB2PROD with BILLS
13 

•S 2499 IS

1 (iv) Covered data that is biometric in2 formation. 

3 (v) Precise geolocation information. 

4 (vi) A persistent identifier. 

5 (vii) The contents of an individual’s 

6 private communications, such as emails, 

7 texts, direct messages, or mail, or the iden8 tity of the parties subject to such commu9 nications, unless the covered entity is the 

10 intended recipient of the communication. 

11 (viii) Account log-in credentials such 

12 as a user name or email address, in com13 bination with a password or security ques14 tion and answer that would permit access 

15 to an online account. 

16 (ix) Covered data revealing an individ17 ual’s racial or ethnic origin, or religion in 

18 a manner inconsistent with the individual’s 

19 reasonable expectation regarding the proc20 essing or transfer of such information. 

21 (x) Covered data revealing the sexual 

22 orientation or sexual behavior of an indi23 vidual in a manner inconsistent with the 

24 individual’s reasonable expectation regardVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
14 

•S 2499 IS

1 ing the processing or transfer of such in2 formation. 

3 (xi) Covered data about the online ac4 tivities of an individual that addresses or 

5 reveals a category of covered data de6 scribed in another clause of this subpara7 graph. 

8 (xii) Covered data that is calendar in9 formation, address book information, 

10 phone or text logs, photos, or videos main11 tained for private use on an individual’s 

12 device. 

13 (xiii) Any covered data collected or 

14 processed by a covered entity for the pur15 pose of identifying covered data described 

16 in another clause of this subparagraph. 

17 (xiv) Any other category of covered 

18 data designated by the Commission pursu19 ant to a rulemaking under section 553 of 

20 title 5, United States Code. 

21 (B) BIOMETRIC INFORMATION.—For pur22 poses of subparagraph (A), the term ‘‘biometric 

23 information’’— 

24 (i) means the physiological or biologi25 cal characteristics of an individual, includVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
15 

•S 2499 IS

1 ing deoxyribonucleic acid, that are used, 

2 singly or in combination with each other or 

3 with other identifying data, to establish the 

4 identity of an individual; and 

5 (ii) includes— 

6 (I) imagery of the iris, retina, 

7 fingerprint, face, hand, palm, vein 

8 patterns, and voice recordings, from 

9 which an identifier template, such as 

10 a faceprint, a minutiae template, or a 

11 voiceprint, can be extracted; and 

12 (II) keystroke patterns or 

13 rhythms, gait patterns or rhythms, 

14 and sleep, health, or exercise data 

15 that contain identifying information. 

16 (C) PERSISTENT IDENTIFIER.—For pur17 poses of subparagraph (A), the term ‘‘persistent 

18 identifier’’ means a technologically derived iden19 tifier that identifies an individual, or is linked 

20 or reasonably linkable to an individual over 

21 time and across services and platforms, which 

22 may include a customer number held in a cook23 ie, a static Internet Protocol address, a proc24 essor or device serial number, or another unique 

25 device identifier. 


pamtmann on DSKBC07HB2PROD with BILLS
16 

•S 2499 IS

1 (D) PRECISE GEOLOCATION INFORMA2 TION.—For purposes of subparagraph (A), the 

3 term ‘‘precise geolocation information’’ means 

4 technologically derived information capable of 

5 determining the past or present actual physical 

6 location of an individual or an individual’s de7 vice at a specific point in time to within 1,750 

8 feet. 

9 (18) SERVICE PROVIDER.—The term ‘‘service 

10 provider’’ means, with respect to a set of covered 

11 data, a covered entity that processes or transfers 

12 such covered data for the purpose of performing 1 

13 or more services or functions on behalf of, and at 

14 the direction of, a covered entity that— 

15 (A) is not related to the covered entity pro16 viding the service or function by common own17 ership or corporate control; and 

18 (B) does not share common branding with 

19 the covered entity providing the service or func20 tion. 

21 (19) SERVICE PROVIDER DATA.—The term 

22 ‘‘service provider data’’ means covered data that is 

23 collected by the service provider on behalf of a cov24 ered entity or transferred to the service provider by 

25 a covered entity for the purpose of allowing the servVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
17 

•S 2499 IS

1 ice provider to perform a service or function on be2 half of, and at the direction of, such covered entity. 

3 (20) THIRD PARTY.—The term ‘‘third party’’ 

4 means, with respect to a set of covered data, a cov5 ered entity— 

6 (A) that is not a service provider with re7 spect to such covered data; and 

8 (B) that received such covered data from 

9 another covered entity— 

10 (i) that is not related to the covered 

11 entity by common ownership or corporate 

12 control; and 

13 (ii) that does not share common 

14 branding with the covered entity. 

15 (21) THIRD PARTY DATA.—The term ‘‘third 

16 party data’’ means, with respect to a third party, 

17 covered data that has been transferred to the third 

18 party by a covered entity. 

19 (22) TRANSFER.—The term ‘‘transfer’’ means 

20 to disclose, release, share, disseminate, make avail21 able, or license in writing, electronically, or by any 

22 other means for consideration of any kind or for a 

23 commercial purpose. 


pamtmann on DSKBC07HB2PROD with BILLS
18 

•S 2499 IS

1 SEC. 3. EFFECTIVE DATE. 

2 Except as otherwise provided in this Act, this Act 

3 shall take effect 18 months after the date of enactment 

4 of this Act. 

5 TITLE I—INDIVIDUAL 

6 CONSUMER DATA RIGHTS 

7 SEC. 101. CONSUMER LOYALTY. 

8 (a) PROHIBITION ON THE DENIAL OF PRODUCTS OR

9 SERVICES.— 

10 (1) IN GENERAL.—Subject to paragraph (2), a 

11 covered entity shall not deny products or services to 

12 an individual because the individual exercises a right 

13 established under subparagraph (A), (B), or (D) of 

14 section 103(a)(1). 

15 (2) RULES OF APPLICATION.—A covered enti16 ty— 

17 (A) shall not be in violation of paragraph 

18 (1) with respect to a product or service and an 

19 individual if the exercise of a right described in 

20 such paragraph by the individual precludes the 

21 covered entity from providing such product or 

22 service to such individual; and 

23 (B) may offer different types of pricing 

24 and functionalities with respect to a product or 

25 service based on an individual’s exercise of a 

26 right described in such paragraph. 


pamtmann on DSKBC07HB2PROD with BILLS
19 

•S 2499 IS

1 (b) NO WAIVER OF INDIVIDUAL CONTROLS.—The 

2 rights and obligations created under section 103 may not 

3 be waived in an agreement between a covered entity and 

4 an individual. 

5 SEC. 102. TRANSPARENCY. 

6 (a) IN GENERAL.—A covered entity that processes 

7 covered data shall, with respect to such data, publish a 

8 privacy policy that is— 

9 (1) disclosed, in a clear and conspicuous man10 ner, to an individual prior to or at the point of the 

11 collection of covered data from the individual; and 

12 (2) made available, in a clear and conspicuous 

13 manner, to the public. 

14 (b) CONTENT OF PRIVACY POLICY.—The privacy pol15 icy required under subsection (a) shall include the fol16 lowing: 

17 (1) The identity and the contact information of 

18 the covered entity (including the covered entity’s 

19 points of contact for privacy and data security in20 quiries) and the identity of any affiliate to which 

21 covered data may be transferred by the covered enti22 ty. 

23 (2) The categories of covered data the covered 

24 entity collects. 


pamtmann on DSKBC07HB2PROD with BILLS
20 

•S 2499 IS

1 (3) The processing purposes for each category 

2 of covered data the covered entity collects. 

3 (4) Whether the covered entity transfers cov4 ered data, the categories of recipients to whom the 

5 covered entity transfers covered data, and the pur6 poses of the transfers. 

7 (5) A general description of the covered entity’s 

8 data retention practices for covered data and the 

9 purposes for such retention. 

10 (6) How individuals can exercise their rights 

11 under section 103. 

12 (7) A general description of the covered entity’s 

13 data security practices. 

14 (8) The effective date of the privacy policy. 

15 (c) LANGUAGES.—A privacy policy required under 

16 subsection (a) shall be made available in all of the lan17 guages in which the covered entity provides a product or 

18 service that is subject to the policy, or carries out activities 

19 related to such product or service. 

20 (d) MATERIAL CHANGES.—If a covered entity makes 

21 a material change to its privacy policy, it shall notify the 

22 individuals affected before further processing or transfer23 ring of previously collected covered data and, except as 

24 provided in section 108, provide an opportunity to with25 draw consent to further processing or transferring of the 


pamtmann on DSKBC07HB2PROD with BILLS
21 

•S 2499 IS

1 covered data under the changed policy. The covered entity 

2 shall provide direct notification, where possible, regarding 

3 a material change to the privacy policy to affected individ4 uals, taking into account available technology and the na5 ture of the relationship. 

6 (e) APPLICATION TO INDIRECT TRANSFERS.—Where 

7 the ownership of an individual’s device is transferred di8 rectly from one individual to another individual, a covered 

9 entity may satisfy its obligation to disclose a privacy policy 

10 prior to or at the point of collection of covered data by 

11 making the privacy policy available under subsection 

12 (a)(2). 

13 SEC. 103. INDIVIDUAL CONTROL. 

14 (a) ACCESS TO, AND CORRECTION, DELETION, AND

15 PORTABILITY OF, COVERED DATA.— 

16 (1) IN GENERAL.—Subject to paragraphs (2) 

17 and (3) and section 108, a covered entity shall pro18 vide an individual, immediately or as quickly as pos19 sible and in no case later than 90 days after receiv20 ing a verified request from the individual, with the 

21 right to reasonably— 

22 (A) access— 

23 (i) the covered data of the individual, 

24 or an accurate representation of the cov25 ered data of the individual, that is or has 


pamtmann on DSKBC07HB2PROD with BILLS
22 

•S 2499 IS

1 been processed by the covered entity or any 

2 service provider on behalf of the covered 

3 entity; 

4 (ii) if applicable, a list of categories of 

5 third parties and service providers to whom 

6 the covered entity has transferred the cov7 ered data of the individual; and 

8 (iii) if a covered entity transfers cov9 ered data, a description of the purpose for 

10 which the covered entity transferred the 

11 covered data of the individual to a service 

12 provider or third party; 

13 (B) request that the covered entity— 

14 (i) correct inaccuracies or incomplete 

15 information with respect to the covered 

16 data of the individual that is maintained 

17 by the covered entity; and 

18 (ii) notify any service provider or 

19 third party to which the covered entity 

20 transferred such covered data of the cor21 rected information; 

22 (C) request that the covered entity— 

23 (i) either delete or deidentify covered 

24 data of the individual that is or has been 

25 maintained by the covered entity; and 


pamtmann on DSKBC07HB2PROD with BILLS
23 

•S 2499 IS

1 (ii) notify any service provider or 

2 third party to which the covered entity 

3 transferred such covered data of the indi4 vidual’s request under clause (i), unless the 

5 transfer of such data to the third party 

6 was made at the direction of the indi7 vidual; and 

8 (D) to the extent that is technically fea9 sible, provide covered data of the individual that 

10 is or has been generated and submitted to the 

11 covered entity by the individual and maintained 

12 by the covered entity in a portable, structured, 

13 and machine-readable format that is not subject 

14 to licensing restrictions. 

15 (2) FREQUENCY AND COST OF ACCESS.—A cov16 ered entity shall— 

17 (A) provide an individual with the oppor18 tunity to exercise the rights described in para19 graph (1) not less than twice in any 12-month 

20 period; and 

21 (B) with respect to the first 2 times that 

22 an individual exercises the rights described in 

23 paragraph (1) in any 12-month period, allow 

24 the individual to exercise such rights free of 

25 charge. 


pamtmann on DSKBC07HB2PROD with BILLS
24 

•S 2499 IS

1 (3) EXCEPTIONS.—A covered entity— 

2 (A) shall not comply with a request to ex3 ercise the rights described in paragraph (1) if 

4 the covered entity cannot verify— 

5 (i) that the individual making the re6 quest is the individual to whom the covered 

7 data that is the subject of the request re8 lates; or 

9 (ii) the individual’s assertion under 

10 paragraph (1)(B) that such information is 

11 inaccurate or incomplete; 

12 (B) may decline to comply with a request 

13 that would— 

14 (i) require the covered entity to retain 

15 any covered data for the sole purpose of 

16 fulfilling the request; 

17 (ii) be impossible or demonstrably im18 practicable to comply with; 

19 (iii) require the covered entity to com20 bine, relink, or otherwise reidentify covered 

21 data that has been deidentified; 

22 (iv) result in the release of trade se23 crets, or other proprietary or confidential 

24 data or business practices; 


pamtmann on DSKBC07HB2PROD with BILLS
25 

•S 2499 IS

1 (v) interfere with law enforcement, ju2 dicial proceedings, investigations, or rea3 sonable efforts to guard against, detect, or 

4 investigate malicious or unlawful activity, 

5 or enforce contracts; 

6 (vi) require disproportionate effort, 

7 taking into consideration available tech8 nology, or would not be reasonably feasible 

9 on technical grounds; 

10 (vii) compromise the privacy, security, 

11 or other rights of the covered data of an12 other individual; 

13 (viii) be excessive or abusive to an14 other individual; or 

15 (ix) violate Federal or State law or 

16 the rights and freedoms of another indi17 vidual, including under the Constitution of 

18 the United States; and 

19 (C) may delete covered data instead of pro20 viding access and correction rights under sub21 paragraphs (A) and (B) of paragraph (1) if 

22 such covered data— 

23 (i) is not sensitive covered data; and 


pamtmann on DSKBC07HB2PROD with BILLS
26 

•S 2499 IS

1 (ii) is used only for the purposes of 

2 contacting individuals with respect to mar3 keting communications. 

4 (b) REGULATIONS.—Not later than 1 year after the 

5 date of enactment of this Act, the Commission shall pro6 mulgate regulations under section 553 of title 5, United 

7 States Code, establishing processes by which covered enti8 ties may verify requests to exercise rights described in sub9 section (a)(1). 

10 SEC. 104. RIGHTS TO CONSENT. 

11 (a) CONSENT.—Except as provided in section 108, a 

12 covered entity shall not, without the prior, affirmative ex13 press consent of an individual— 

14 (1) transfer sensitive covered data of the indi15 vidual to a third party; or 

16 (2) process sensitive covered data of the indi17 vidual. 

18 (b) REQUIREMENTS FOR AFFIRMATIVE EXPRESS

19 CONSENT.—In obtaining the affirmative express consent 

20 of an individual to process the sensitive covered data of 

21 the individual as required under subsection (a)(2), a cov22 ered entity shall provide the individual with notice that 

23 shall— 


pamtmann on DSKBC07HB2PROD with BILLS
27 

•S 2499 IS

1 (1) include a clear description of the processing 

2 purpose for which the sensitive covered data will be 

3 processed; 

4 (2) clearly identify any processing purpose that 

5 is necessary to fulfill a request made by the indi6 vidual; 

7 (3) include a prominent heading that would en8 able a reasonable individual to easily identify the 

9 processing purpose for which consent is sought; and 

10 (4) clearly explain the individual’s right to pro11 vide or withhold consent. 

12 (c) REQUIREMENTS RELATED TO MINORS.—A cov13 ered entity shall not transfer the covered data of an indi14 vidual to a third-party without affirmative express consent 

15 from the individual or the individual’s parent or guardian 

16 if the covered entity has actual knowledge that the indi17 vidual is between 13 and 16 years of age. 

18 (d) RIGHT TO OPT OUT.—Except as provided in sec19 tion 108, a covered entity shall provide an individual with 

20 the ability to opt out of the collection, processing, or trans21 fer of such individual’s covered data before such collection, 

22 processing, or transfer occurs. 

23 (e) PROHIBITION ON INFERRED CONSENT.—A cov24 ered entity shall not infer that an individual has provided 

25 affirmative express consent to a processing purpose from 


pamtmann on DSKBC07HB2PROD with BILLS
28 

•S 2499 IS

1 the inaction of the individual or the individual’s continued 

2 use of a service or product provided by the covered entity. 

3 (f) WITHDRAWAL OF CONSENT.—A covered entity 

4 shall provide an individual with a clear and conspicuous 

5 means to withdraw affirmative express consent. 

6 (g) RULEMAKING.—The Commission may promul7 gate regulations under section 553 of title 5, United 

8 States Code, to establish clear and conspicuous procedures 

9 for allowing individuals to provide or withdraw affirmative 

10 express consent for the collection of sensitive covered data. 

11 SEC. 105. MINIMIZING DATA COLLECTION, PROCESSING, 

12 AND RETENTION. 

13 (a) IN GENERAL.—Except as provided in section 108, 

14 a covered entity shall not collect, process, or transfer cov15 ered data beyond— 

16 (1) what is reasonably necessary, proportionate, 

17 and limited to provide or improve a product, service, 

18 or a communication about a product or service, in19 cluding what is reasonably necessary, proportionate, 

20 and limited to provide a product or service specifi21 cally requested by an individual or reasonably antici22 pated within the context of the covered entity’s on23 going relationship with an individual; 

24 (2) what is reasonably necessary, proportionate, 

25 or limited to otherwise process or transfer covered 


pamtmann on DSKBC07HB2PROD with BILLS
29 

•S 2499 IS

1 data in a manner that is described in the privacy 

2 policy that the covered entity is required to publish 

3 under section 102(a); or 

4 (3) what is expressly permitted by this Act or 

5 any other applicable Federal law. 

6 (b) BEST PRACTICES.—Not later than 1 year after 

7 the date of enactment of this Act, the Commission shall 

8 issue guidelines recommending best practices for covered 

9 entities to minimize the collection, processing, and trans10 fer of covered data in accordance with this section. 

11 (c) RULE OF CONSTRUCTION.—Notwithstanding sec12 tion 404 of this Act, nothing in this section supersedes 

13 any other provision of this Act or other applicable Federal 

14 law. 

15 SEC. 106. SERVICE PROVIDERS AND THIRD PARTIES. 

16 (a) SERVICE PROVIDERS.—A service provider— 

17 (1) shall not process service provider data for 

18 any processing purpose that is not performed on be19 half of, and at the direction of, the covered entity 

20 that transferred the data to the service provider; 

21 (2) shall not transfer service provider data to a 

22 third party for any purpose other than a purpose 

23 performed on behalf of, or at the direction of, the 

24 covered entity that transferred the data to the serv25 ice provider; 


pamtmann on DSKBC07HB2PROD with BILLS
30 

•S 2499 IS

1 (3) at the direction of the covered entity that 

2 transferred service provider data to the service pro3 vider, shall delete or deidentify such data— 

4 (A) as soon as practicable after the service 

5 provider has completed providing the service or 

6 function for which the data was transferred to 

7 the service provider; or 

8 (B) as soon as practicable after the end of 

9 the period during which the service provider is 

10 to provide services with respect to such data, as 

11 agreed to by the service provider and the cov12 ered entity that transferred the data; 

13 (4) is exempt from the requirements of section 

14 103 with respect to service provider data, but shall, 

15 to the extent practicable— 

16 (A) assist the covered entity from which it 

17 received the service provider data in fulfilling 

18 requests to exercise rights under section 103(a); 

19 and 

20 (B) upon receiving notice from a covered 

21 entity of a verified request made under section 

22 103(a)(1) to delete, deidentify, or correct serv23 ice provider data held by the service provider, 

24 delete, deidentify, or correct such data; and 


pamtmann on DSKBC07HB2PROD with BILLS
31 

•S 2499 IS

1 (5) is exempt from the requirements of sections 

2 104 and 105. 

3 (b) THIRD PARTIES.—A third party— 

4 (1) shall not process third party data for a 

5 processing purpose inconsistent with the reasonable 

6 expectation of the individual to whom such data re7 lates; 

8 (2) for purposes of paragraph (1), may reason9 ably rely on representations made by the covered en10 tity that transferred third party data regarding the 

11 reasonable expectations of individuals to whom such 

12 data relates, provided that the third party conducts 

13 reasonable due diligence on the representations of 

14 the covered entity and finds those representations to 

15 be credible; and 

16 (3) is exempt from the requirements of sections 

17 104 and 105. 

18 (c) BANKRUPTCY.—In the event that a covered entity 

19 enters into a bankruptcy proceeding which would lead to 

20 the disclosure of covered data to a third party, the covered 

21 entity shall in a reasonable time prior to the disclosure— 

22 (1) provide notice of the proposed disclosure of 

23 covered data, including the name of the third party 

24 and its policies and practices with respect to the cov25 ered data, to all affected individuals; and 


pamtmann on DSKBC07HB2PROD with BILLS
32 

•S 2499 IS

1 (2) provide each affected individual with the op2 portunity to withdraw any previous affirmative ex3 press consent related to the covered data of the indi4 vidual or request the deletion or deidentification of 

5 the covered data of the individual. 

6 (d) ADDITIONAL OBLIGATIONS ON COVERED ENTI7 TIES.— 

8 (1) IN GENERAL.—A covered entity shall exer9 cise reasonable due diligence to ensure compliance 

10 with this section before— 

11 (A) selecting a service provider; or 

12 (B) deciding to transfer covered data to a 

13 third party. 

14 (2) GUIDANCE.—Not later than 2 years after 

15 the effective date of this Act, the Commission shall 

16 publish guidance regarding compliance with this sub17 section. Such guidance shall, to the extent prac18 ticable, minimize unreasonable burdens on small19 and medium-sized covered entities. 

20 SEC. 107. PRIVACY IMPACT ASSESSMENTS. 

21 (a) PRIVACY IMPACT ASSESSMENTS OF NEW OR MA22 TERIAL CHANGES TO PROCESSING OF COVERED DATA.— 

23 (1) IN GENERAL.—Not later than 1 year after 

24 the date of enactment of this Act (or, if later, not 

25 later than 1 year after a covered entity first meets 


pamtmann on DSKBC07HB2PROD with BILLS
33 

•S 2499 IS

1 the definition of a large data holder (as defined in 

2 section 2)), each covered entity that is a large data 

3 holder shall conduct a privacy impact assessment of 

4 each of its processing activities involving covered 

5 data that present a heightened risk of harm to indi6 viduals, and each such assessment shall weigh the 

7 benefits of the covered entity’s covered data collec8 tion, processing, and transfer practices against the 

9 potential adverse consequences to individual privacy 

10 of such practices. 

11 (2) ASSESSMENT REQUIREMENTS.—A privacy 

12 impact assessment required under paragraph (1)— 

13 (A) shall be reasonable and appropriate in 

14 scope given— 

15 (i) the nature of the covered data col16 lected, processed, or transferred by the 

17 covered entity; 

18 (ii) the volume of the covered data 

19 collected, processed, or transferred by the 

20 covered entity; 

21 (iii) the size of the covered entity; and 

22 (iv) the potential risks posed to the 

23 privacy of individuals by the collection, 

24 processing, or transfer of covered data by 

25 the covered entity; 


pamtmann on DSKBC07HB2PROD with BILLS
34 

•S 2499 IS

1 (B) shall be documented in written form 

2 and maintained by the covered entity unless 

3 rendered out of date by a subsequent assess4 ment conducted under subsection (b); and 

5 (C) shall be approved by the data privacy 

6 officer of the covered entity. 

7 (b) ONGOING PRIVACY IMPACT ASSESSMENTS.— 

8 (1) IN GENERAL.—A covered entity that is a 

9 large data holder shall, not less frequently than once 

10 every 2 years after the covered entity conducted the 

11 privacy impact assessment required under subsection 

12 (a), conduct a privacy impact assessment of the col13 lection, processing, and transfer of covered data by 

14 the covered entity to assess the extent to which— 

15 (A) the ongoing practices of the covered 

16 entity are consistent with the covered entity’s 

17 published privacy policies; 

18 (B) any customizable privacy settings in19 cluded in a service or product offered by the 

20 covered entity are adequately accessible to indi21 viduals who use the service or product and are 

22 effective in meeting the privacy preferences of 

23 such individuals; 


pamtmann on DSKBC07HB2PROD with BILLS
35 

•S 2499 IS

1 (C) the practices and privacy settings de2 scribed in subparagraphs (A) and (B), respec3 tively— 

4 (i) meet the expectations of a reason5 able individual; and 

6 (ii) provide an individual with ade7 quate control over the individual’s covered 

8 data; 

9 (D) the covered entity could enhance the 

10 privacy and security of covered data through 

11 technical or operational safeguards such as 

12 encryption, deidentification, and other privacy13 enhancing technologies; and 

14 (E) the processing of covered data is com15 patible with the stated purposes for which it 

16 was collected. 

17 (2) APPROVAL BY DATA PRIVACY OFFICER.— 

18 The data privacy officer of a covered entity shall ap19 prove the findings of an assessment conducted by 

20 the covered entity under this subsection. 

21 SEC. 108. SCOPE OF COVERAGE. 

22 (a) GENERAL EXCEPTIONS.—Notwithstanding any 

23 provision of this title other than subsections (a) through 

24 (c) of section 102, a covered entity may collect, process 

25 or transfer covered data for any of the following purposes, 


pamtmann on DSKBC07HB2PROD with BILLS
36 

•S 2499 IS

1 provided that the collection, processing, or transfer is rea2 sonably necessary, proportionate, and limited to such pur3 pose: 

4 (1) To initiate or complete a transaction or to 

5 fulfill an order or provide a service specifically re6 quested by an individual, including associated rou7 tine administrative activities such as billing, ship8 ping, financial reporting, and accounting. 

9 (2) To perform internal system maintenance, 

10 diagnostics, product or service management, inven11 tory management, and network management. 

12 (3) To prevent, detect, or respond to a security 

13 incident or trespassing, provide a secure environ14 ment, or maintain the safety and security of a prod15 uct, service, network, or individual. 

16 (4) To protect against malicious, deceptive, 

17 fraudulent, or illegal activity. 

18 (5) To comply with a legal obligation or the es19 tablishment, exercise, analysis, or defense of legal 

20 claims or rights, or as required or specifically au21 thorized by law. 

22 (6) To comply with a civil, criminal, or regu23 latory inquiry, investigation, subpoena, or summons 

24 by an Executive agency. 


pamtmann on DSKBC07HB2PROD with BILLS
37 

•S 2499 IS

1 (7) To cooperate with an Executive agency or 

2 a law enforcement official acting under the authority 

3 of an Executive or State agency concerning conduct 

4 or activity that the Executive agency or law enforce5 ment official reasonably and in good faith believes 

6 may violate Federal, State, or local law, or pose a 

7 threat to public safety or national security. 

8 (8) To address risks to the safety of an indi9 vidual or group of individuals, or to ensure customer 

10 safety, including by authenticating individuals in 

11 order to provide access to large venues open to the 

12 public. 

13 (9) To effectuate a product recall pursuant to 

14 Federal or State law. 

15 (10) To conduct public or peer-reviewed sci16 entific, historical, or statistical research that— 

17 (A) is in the public interest; 

18 (B) adheres to all applicable ethics and 

19 privacy laws; and 

20 (C) is approved, monitored, and governed 

21 by an institutional review board or other over22 sight entity that meets standards promulgated 

23 by the Commission pursuant to section 553 of 

24 title 5, United States Code. 


pamtmann on DSKBC07HB2PROD with BILLS
38 

•S 2499 IS

1 (11) To transfer covered data to a service pro2 vider. 

3 (12) For a purpose identified by the Commis4 sion pursuant to a regulation promulgated under 

5 subsection (b). 

6 (b) ADDITIONAL PURPOSES.—The Commission may 

7 promulgate regulations under section 553 of title 5, 

8 United States Code, identifying additional purposes for 

9 which a covered entity may collect, process or transfer cov10 ered data. 

11 (c) SMALL BUSINESS EXCEPTION.—Sections 103, 

12 105, and 301 shall not apply in the case of a covered enti13 ty that can establish that, for the 3 preceding calendar 

14 years (or for the period during which the covered entity 

15 has been in existence if such period is less than 3 years)— 

16 (1) the covered entity’s average annual gross 

17 revenues did not exceed $50,000,000; 

18 (2) on average, the covered entity annually 

19 processed the covered data of less than 1,000,000 

20 individuals; 

21 (3) the covered entity never employed more 

22 than 500 individuals at any one time; and 

23 (4) the covered entity derived less than 50 per24 cent of its revenues from transferring covered data. 


pamtmann on DSKBC07HB2PROD with BILLS
39 

•S 2499 IS

1 TITLE II—DATA TRANSPARENCY, 

2 INTEGRITY, AND SECURITY 

3 SEC. 201. CIVIL RIGHTS, ALGORITHM BIAS, DETECTION, 

4 AND MITIGATION. 

5 (a) CIVIL RIGHTS PROTECTIONS.—A covered entity, 

6 service provider, or third party may not collect, process, 

7 or transfer covered data in violation of Federal civil rights 

8 laws. 

9 (b) FTC ENFORCEMENT ASSISTANCE.— 

10 (1) IN GENERAL.—Whenever the Commission 

11 obtains information that a covered entity may have 

12 processed or transferred covered data in violation of 

13 Federal civil rights laws, the Commission shall 

14 transmit such information (excluding any such infor15 mation that is a trade secret as defined by section 

16 1839 of title 18, United States Code) to the appro17 priate Executive agency or State agency with au18 thority to initiate proceedings relating to such viola19 tion. 

20 (2) ANNUAL REPORT.—Beginning in 2022, the 

21 Commission shall submit an annual report to Con22 gress that includes— 

23 (A) a summary of the types of information 

24 the Commission transmitted to Executive agenVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00039 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
40 

•S 2499 IS

1 cies or State agencies during the preceding year 

2 pursuant to this subsection; and 

3 (B) a summary of how such information 

4 relates to Federal civil rights laws. 

5 (3) COOPERATION WITH OTHER AGENCIES.— 

6 The Commission may implement this subsection by 

7 executing agreements or memoranda of under8 standing with the appropriate Executive agencies. 

9 (4) RELATIONSHIP TO OTHER LAWS.—Notwith10 standing section 404, nothing in this subsection 

11 shall supersede any other provision of law. 

12 (c) ALGORITHM TRANSPARENCY REPORTS.— 

13 (1) STUDY AND REPORT.— 

14 (A) STUDY.—The Commission shall con15 duct a study, using the Commission’s authority 

16 under section 6(b) of the Federal Trade Com17 mission Act (15 U.S.C. 46(b)), examining the 

18 use of algorithms to process covered data in a 

19 manner that may violate Federal anti-discrimi20 nation laws. 

21 (B) REPORT.—Not later than 3 years after 

22 the date of enactment of this Act, the Commis23 sion shall publish a report containing the re24 sults of the study required under subparagraph 

25 (A). 


pamtmann on DSKBC07HB2PROD with BILLS
41 

•S 2499 IS

1 (C) GUIDANCE.—The Commission shall 

2 use the results of the study described in sub3 paragraph (A) to develop guidance to assist 

4 covered entities in avoiding the use of algo5 rithms to process covered data in a manner 

6 that violates Federal civil rights laws. 

7 (2) UPDATED REPORT.—Not later than 5 years 

8 after the publication of the report required under 

9 paragraph (1), the Commission shall publish an up10 dated report. 

11 SEC. 202. DATA BROKERS. 

12 (a) IN GENERAL.—Not later than January 31 of 

13 each calendar year that follows a calendar year during 

14 which a covered entity acted as a data broker, such cov15 ered entity shall register with the Commission pursuant 

16 to the requirements of this section. 

17 (b) REGISTRATION REQUIREMENTS.—In registering 

18 with the Commission as required under subsection (a), a 

19 data broker shall do the following: 

20 (1) Pay to the Commission a registration fee of 

21 $100. 

22 (2) Provide the Commission with the following 

23 information: 

24 (A) The name and primary physical, email, 

25 and internet addresses of the data broker. 


pamtmann on DSKBC07HB2PROD with BILLS
42 

•S 2499 IS

1 (B) Any additional information or expla2 nation the data broker chooses to provide con3 cerning its data collection and processing prac4 tices. 

5 (c) PENALTIES.—A data broker that fails to register 

6 as required under subsection (a) shall be liable for— 

7 (1) a civil penalty of $50 for each day it fails 

8 to register, not to exceed a total of $10,000 for each 

9 year; and 

10 (2) an amount equal to the fees due under this 

11 section for each year that it failed to register as re12 quired under subsection (a). 

13 (d) PUBLICATION OF REGISTRATION INFORMA14 TION.—The Commission shall publish on the internet 

15 website of the Commission the registration information 

16 provided by data brokers under this section. 

17 SEC. 203. PROTECTION OF COVERED DATA. 

18 (a) IN GENERAL.—A covered entity shall establish, 

19 implement, and maintain reasonable administrative, tech20 nical, and physical data security policies and practices to 

21 protect against risks to the confidentiality, security, and 

22 integrity of covered data. 

23 (b) DATA SECURITY REQUIREMENTS.—The data se24 curity policies and practices required under subsection (a) 

25 shall be— 


pamtmann on DSKBC07HB2PROD with BILLS
43 

•S 2499 IS

1 (1) appropriate to the size and complexity of 

2 the covered entity, the nature and scope of the cov3 ered entity’s collection or processing of covered data, 

4 the volume and nature of the covered data at issue, 

5 and the cost of available tools to improve security 

6 and reduce vulnerabilities; and 

7 (2) designed to— 

8 (A) identify and assess vulnerabilities to 

9 covered data; 

10 (B) take reasonable preventative and cor11 rective action to address known vulnerabilities 

12 to covered data; and 

13 (C) detect, respond to, and recover from 

14 cybersecurity incidents related to covered data. 

15 (c) RULEMAKING AND GUIDANCE.— 

16 (1) RULEMAKING AUTHORITY AND SCOPE.— 

17 (A) IN GENERAL.—The Commission may, 

18 pursuant to a proceeding in accordance with 

19 section 553 of title 5, United States Code, issue 

20 regulations to identify processes for receiving 

21 and assessing information regarding 

22 vulnerabilities to covered data that are reported 

23 to the covered entity. 

24 (B) CONSULTATION WITH NIST.—In pro25 mulgating regulations under this paragraph, the 


pamtmann on DSKBC07HB2PROD with BILLS
44 

•S 2499 IS

1 Commission shall consult with, and take into 

2 consideration guidance from, the National Insti3 tute for Standards and Technology. 

4 (2) GUIDANCE.—Not later than 1 year after 

5 the date of enactment of this Act, the Commission 

6 shall issue guidance to covered entities on how to— 

7 (A) identify and assess vulnerabilities to 

8 covered data, including— 

9 (i) the potential for unauthorized ac10 cess to covered data; 

11 (ii) vulnerabilities in the covered enti12 ty’s collection or processing of covered 

13 data; 

14 (iii) the management of access rights; 

15 and 

16 (iv) the use of service providers to 

17 process covered data; 

18 (B) take reasonable preventative and cor19 rective action to address vulnerabilities to cov20 ered data; and 

21 (C) detect, respond to, and recover from 

22 cybersecurity incidents and events. 

23 (d) APPLICABILITY OF OTHER INFORMATION SECU24 RITY LAWS.—A covered entity that is required to comply 

25 with title V of the Gramm-Leach-Bliley Act (15 U.S.C. 


pamtmann on DSKBC07HB2PROD with BILLS
45 

•S 2499 IS

1 6801 et seq.) or the Health Information Technology for 

2 Economic and Clinical Health Act (42 U.S.C. 17931 et 

3 seq.), and is in compliance with the information security 

4 requirements of such Act, shall be deemed to be in compli5 ance with the requirements of this section with respect to 

6 covered data that is subject to the requirements of such 

7 Act. 

8 TITLE III—CORPORATE 

9 ACCOUNTABILITY 

10 SEC. 301. DESIGNATION OF DATA PRIVACY OFFICER AND 

11 DATA SECURITY OFFICER. 

12 (a) IN GENERAL.—A covered entity shall designate— 

13 (1) 1 or more qualified employees or contrac14 tors as a data privacy officer; and 

15 (2) 1 or more qualified employees or contrac16 tors (in addition to any employee or contractor des17 ignated under paragraph (1)) as a data security offi18 cer. 

19 (b) RESPONSIBILITIES OF DATA PRIVACY OFFICERS

20 AND DATA SECURITY OFFICERS.—An employee or con21 tractor who is designated by a covered entity as a data 

22 privacy officer or a data security officer shall be respon23 sible for, at a minimum, coordinating the covered entity’s 

24 policies and practices regarding— 


pamtmann on DSKBC07HB2PROD with BILLS
46 

•S 2499 IS

1 (1) in the case of a data privacy officer, compli2 ance with the privacy requirements with respect to 

3 covered data under this Act; and 

4 (2) in the case of a data security officer, the se5 curity requirements with respect to covered data 

6 under this Act. 

7 SEC. 302. INTERNAL CONTROLS. 

8 A covered entity shall maintain internal controls and 

9 reporting structures to ensure that appropriate senior 

10 management officials of the covered entity are involved in 

11 assessing risks and making decisions that implicate com12 pliance with this Act. 

13 SEC. 303. WHISTLEBLOWER PROTECTIONS. 

14 (a) DEFINITIONS.—For purposes of this section: 

15 (1) WHISTLEBLOWER.—The term ‘‘whistle16 blower’’ means any employee or contractor of a cov17 ered entity who voluntarily provides to the Commis18 sion original information relating to non-compliance 

19 with, or any violation or alleged violation of, this Act 

20 or any regulation promulgated under this Act. 

21 (2) ORIGINAL INFORMATION.—The term ‘‘origi22 nal information’’ means information that is provided 

23 to the Commission by an individual and— 

24 (A) is derived from the independent knowl25 edge or analysis of an individual; 


pamtmann on DSKBC07HB2PROD with BILLS
47 

•S 2499 IS

1 (B) is not known to the Commission from 

2 any other source at the time the individual pro3 vides the information; and 

4 (C) is not exclusively derived from an alle5 gation made in a judicial or an administrative 

6 action, in a governmental report, a hearing, an 

7 audit, or an investigation, or from news media, 

8 unless the individual is a source of the allega9 tion. 

10 (b) EFFECT OF WHISTLEBLOWER RETALIATIONS ON

11 PENALTIES.—In seeking penalties under section 401 for 

12 a violation of this Act or a regulation promulgated under 

13 this Act by a covered entity, the Commission shall consider 

14 whether the covered entity retaliated against an individual 

15 who was a whistleblower with respect to original informa16 tion that led to the successful resolution of an administra17 tive or judicial action brought by the Commission or the 

18 Attorney General of the United States on behalf of the 

19 Commission under this Act against such covered entity. 


pamtmann on DSKBC07HB2PROD with BILLS
48 

•S 2499 IS

1 TITLE IV—ENFORCEMENT AU2 THORITY AND NEW PRO3 GRAMS 

4 SEC. 401. ENFORCEMENT BY THE FEDERAL TRADE COM5 MISSION. 

6 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

7 A violation of this Act or a regulation promulgated under 

8 this Act shall be treated as a violation of a rule defining 

9 an unfair or deceptive act or practice prescribed under sec10 tion 18(a)(1)(B) of the Federal Trade Commission Act 

11 (15 U.S.C. 57a(a)(1)(B)). 

12 (b) POWERS OF COMMISSION.— 

13 (1) IN GENERAL.—Except as provided in sub14 sections (c) and (d), the Commission shall enforce 

15 this Act and the regulations promulgated under this 

16 Act in the same manner, by the same means, and 

17 with the same jurisdiction, powers, and duties as 

18 though all applicable terms and provisions of the 

19 Federal Trade Commission Act (15 U.S.C. 41 et 

20 seq.) were incorporated into and made a part of this 

21 Act. 

22 (2) PRIVILEGES AND IMMUNITIES.—Any person 

23 who violates this Act or a regulation promulgated 

24 under this Act shall be subject to the penalties and 

25 entitled to the privileges and immunities provided in 


pamtmann on DSKBC07HB2PROD with BILLS
49 

•S 2499 IS

1 the Federal Trade Commission Act (15 U.S.C. 41 et 

2 seq.). 

3 (3) LIMITING CERTAIN ACTIONS UNRELATED

4 TO THIS ACT; AUTHORITY PRESERVED.—The Com5 mission shall not bring any action to enforce the 

6 prohibition in section 5 of the Federal Trade Com7 mission Act (15 U.S.C. 45) on unfair or deceptive 

8 acts or practices with respect to the privacy or secu9 rity of covered data, unless such alleged act of prac10 tice violates this Act. 

11 (c) COMMON CARRIERS AND NONPROFIT ORGANIZA12 TIONS.—Notwithstanding section 4, 5(a)(2), or 6 of the 

13 Federal Trade Commission Act (15 U.S.C. 44, 45(a)(2), 

14 46) or any jurisdictional limitation of the Commission, the 

15 Commission shall also enforce this Act and the regulations 

16 promulgated under this Act, in the same manner provided 

17 in subsections (a) and (b) of this subsection, with respect 

18 to— 

19 (1) common carriers subject to the Communica20 tions Act of 1934 (47 U.S.C. 151 et seq.) and all 

21 Acts amendatory thereof and supplementary thereto; 

22 and 

23 (2) organizations not organized to carry on 

24 business for their own profit or that of their mem25 bers. 


pamtmann on DSKBC07HB2PROD with BILLS
50 

•S 2499 IS

1 (d) DATA PRIVACY AND SECURITY FUND.— 

2 (1) ESTABLISHMENT OF VICTIMS RELIEF

3 FUND.—There is established in the Treasury of the 

4 United States a separate fund to be known as the 

5 ‘‘Data Privacy and Security Victims Relief Fund’’ 

6 (referred to in this paragraph as the ‘‘Victims Relief 

7 Fund’’). 

8 (2) DEPOSITS.— 

9 (A) DEPOSITS FROM THE COMMISSION.— 

10 The Commission shall deposit into the Victims 

11 Relief Fund the amount of any civil penalty ob12 tained against any covered entity in any action 

13 the Commission commences to enforce this Act 

14 or a regulation promulgated under this Act. 

15 (B) DEPOSITS FROM THE ATTORNEY GEN16 ERAL.—The Attorney General of the United 

17 States shall deposit into the Victims Relief 

18 Fund the amount of any civil penalty obtained 

19 against any covered entity in any action the At20 torney General commences on behalf of the 

21 Commission to enforce this Act or a regulation 

22 promulgated under this Act. 

23 (3) USE OF FUND AMOUNTS.—Amounts in the 

24 Victims Relief Fund shall be available to the Com25 mission, without fiscal year limitation, to provide reVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00050 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
51 

•S 2499 IS

1 dress, payments or compensation, or other monetary 

2 relief to individuals harmed by an act or practice for 

3 which civil penalties have been imposed under this 

4 Act. To the extent that individuals cannot be located 

5 or such redress, payments or compensation, or other 

6 monetary relief are otherwise not practicable, the 

7 Commission may use such funds for the purpose of 

8 consumer or business education relating to data pri9 vacy and security or for the purpose of engaging in 

10 technological research that the Commission con11 siders necessary to enforce this Act. 

12 (4) AMOUNTS NOT SUBJECT TO APPORTION13 MENT.—Notwithstanding any other provision of law, 

14 amounts in the Victims Relief Fund shall not be 

15 subject to apportionment for purposes of chapter 15 

16 of title 31, United States Code, or under any other 

17 authority. 

18 (e) AUTHORIZATION OF APPROPRIATIONS.—There is 

19 authorized to be appropriated to the Commission 

20 $100,000,000 to carry out this Act. 

21 SEC. 402. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

22 (a) CIVIL ACTION.—In any case in which the attor23 ney general of a State has reason to believe that an inter24 est of the residents of that State has been or is adversely 

25 affected by the engagement of any covered entity in an 


pamtmann on DSKBC07HB2PROD with BILLS
52 

•S 2499 IS

1 act or practice that violates this Act or a regulation pro2 mulgated under this Act, the attorney general of the State, 

3 as parens patriae, may bring a civil action on behalf of 

4 the residents of the State in an appropriate district court 

5 of the United States to— 

6 (1) enjoin that act or practice; 

7 (2) enforce compliance with this Act or the reg8 ulation; 

9 (3) obtain damages, civil penalties, restitution, 

10 or other compensation on behalf of the residents of 

11 the State; or 

12 (4) obtain such other relief as the court may 

13 consider to be appropriate. 

14 (b) RIGHTS OF THE COMMISSION.— 

15 (1) IN GENERAL.—Except where not feasible, 

16 the attorney general of a State shall notify the Com17 mission in writing prior to initiating a civil action 

18 under subsection (a). Such notice shall include a 

19 copy of the complaint to be filed to initiate such ac20 tion. Upon receiving such notice, the Commission 

21 may intervene in such action and, upon inter22 vening— 

23 (A) be heard on all matters arising in such 

24 action; and 


pamtmann on DSKBC07HB2PROD with BILLS
53 

•S 2499 IS

1 (B) file petitions for appeal of a decision in 

2 such action. 

3 (2) NOTIFICATION TIMELINE.—Where it is not 

4 feasible for the attorney general of a State to pro5 vide the notification required by paragraph (2) be6 fore initiating a civil action under paragraph (1), the 

7 attorney general shall notify the Commission imme8 diately after initiating the civil action. 

9 (c) CONSOLIDATION OF ACTIONS BROUGHT BY TWO

10 OR MORE STATE ATTORNEYS GENERAL.—Whenever a 

11 civil action under subsection (a) is pending and another 

12 civil action or actions are commenced pursuant to such 

13 subsection in a different Federal district court or courts 

14 that involve 1 or more common questions of fact, a defend15 ant in such action or actions my request that such action 

16 or actions be transferred for the purposes of consolidated 

17 pretrial proceedings and trial to the United States District 

18 Court for the District of Columbia; provided however, that 

19 no such action shall be transferred if pretrial proceedings 

20 in that action have been concluded before a subsequent 

21 action is filed by the attorney general of the State. 

22 (d) ACTIONS BY COMMISSION.—In any case in which 

23 a civil action is instituted by or on behalf of the Commis24 sion for violation of this Act or a regulation promulgated 

25 under this Act, no attorney general of a State may, during 


pamtmann on DSKBC07HB2PROD with BILLS
54 

•S 2499 IS

1 the pendency of such action, institute a civil action against 

2 any defendant named in the complaint in the action insti3 tuted by or on behalf of the Commission for violation of 

4 this Act or a regulation promulgated under this Act that 

5 is alleged in such complaint. 

6 (e) INVESTIGATORY POWERS.—Nothing in this sec7 tion shall be construed to prevent the attorney general of 

8 a State or another authorized official of a State from exer9 cising the powers conferred on the attorney general or the 

10 State official by the laws of the State to conduct investiga11 tions, to administer oaths or affirmations, or to compel 

12 the attendance of witnesses or the production of documen13 tary or other evidence. 

14 (f) VENUE; SERVICE OF PROCESS.— 

15 (1) VENUE.—Any action brought under sub16 section (a) may be brought in the district court of 

17 the United States that meets applicable require18 ments relating to venue under section 1391 of title 

19 28, United States Code. 

20 (2) SERVICE OF PROCESS.—In an action 

21 brought under subsection (a), process may be served 

22 in any district in which the defendant— 

23 (A) is an inhabitant; or 

24 (B) may be found. 


pamtmann on DSKBC07HB2PROD with BILLS
55 

•S 2499 IS

1 (g) ACTIONS BY OTHER STATE OFFICIALS.—Any 

2 State official who is authorized by the State attorney gen3 eral to be the exclusive authority in that State to enforce 

4 this Act may bring a civil action under subsection (a), sub5 ject to the same requirements and limitations that apply 

6 under this section to civil actions brought under such sub7 section by State attorneys general. 

8 SEC. 403. APPROVED CERTIFICATION PROGRAMS. 

9 (a) IN GENERAL.—The Commission shall establish a 

10 program in which the Commission shall approve voluntary 

11 consensus standards or certification programs that cov12 ered entities may use to comply with 1 or more provisions 

13 in this Act. 

14 (b) EFFECT OF APPROVAL.—A covered entity in com15 pliance with a voluntary consensus standard approved by 

16 the Commission shall be deemed to be in compliance with 

17 the provisions of this Act. 

18 (c) TIME FOR APPROVAL.—The Commission shall 

19 issue a decision regarding the approval of a proposed vol20 untary consensus standard not later than 180 days after 

21 a request for approval is submitted. 

22 (d) EFFECT OF NON-COMPLIANCE.—A covered entity 

23 that claims compliance with an approved voluntary con24 sensus standard and is found not to be in compliance with 


pamtmann on DSKBC07HB2PROD with BILLS
56 

•S 2499 IS

1 such program by the Commission or in any judicial pro2 ceeding shall be considered to be in violation of this Act. 

3 (e) RULEMAKING.—Not later than 120 days after the 

4 date of enactment of this Act, the Commission shall pro5 mulgate regulations under section 553 of title 5, United 

6 States Code, establishing a process for review of requests 

7 for approval of proposed voluntary consensus standards 

8 under this section. 

9 (f) REQUIREMENTS.—To be eligible for approval by 

10 the Commission, a voluntary consensus standard shall 

11 meet the requirements for voluntary consensus standards 

12 set forth in Office of Management and Budget Circular 

13 A–119, or other equivalent guidance document, ensuring 

14 that they are the result of due process procedures and ap15 propriately balance the interests of all the stakeholders, 

16 including individuals, businesses, organizations, and other 

17 entities making lawful uses of the covered data covered 

18 by the standard, and— 

19 (1) specify clear and enforceable requirements 

20 for covered entities participating in the program that 

21 provide an overall level of data privacy or data secu22 rity protection that is equivalent to or greater than 

23 that provided in the relevant provisions in this Act; 

24 (2) require each participating covered entity to 

25 post in a prominent place a clear and conspicuous 


pamtmann on DSKBC07HB2PROD with BILLS
57 

•S 2499 IS

1 public attestation of compliance and a link to the 

2 website described in paragraph (4); 

3 (3) include a process for an independent assess4 ment of a participating covered entity’s compliance 

5 with the voluntary consensus standard or certifi6 cation program prior to certification and at reason7 able intervals thereafter; 

8 (4) create a website describing the voluntary 

9 consensus standard or certification program’s goals 

10 and requirements, listing participating covered enti11 ties, and providing a method for individuals to ask 

12 questions and file complaints about the program or 

13 any participating covered entity; 

14 (5) take meaningful action for non-compliance 

15 with the relevant provisions of this Act by any par16 ticipating covered entity, which shall depend on the 

17 severity of the non-compliance and may include— 

18 (A) removing the covered entity from the 

19 program; 

20 (B) referring the covered entity to the 

21 Commission or other appropriate Federal or 

22 State agencies for enforcement; 

23 (C) publicly reporting the disciplinary ac24 tion taken with respect to the covered entity; 


pamtmann on DSKBC07HB2PROD with BILLS
58 

•S 2499 IS

1 (D) providing redress to individuals 

2 harmed by the non-compliance; 

3 (E) making voluntary payments to the 

4 United States Treasury; and 

5 (F) taking any other action or actions to 

6 ensure the compliance of the covered entity with 

7 respect to the relevant provisions of this Act; 

8 and 

9 (6) issue annual reports to the Commission and 

10 to the public detailing the activities of the program 

11 and its effectiveness during the preceding year in en12 suring compliance with the relevant provisions of 

13 this Act by participating covered entities and taking 

14 meaningful disciplinary action for non-compliance 

15 with such provisions by such entities. 

16 SEC. 404. RELATIONSHIP BETWEEN FEDERAL AND STATE 

17 LAW. 

18 (a) RELATIONSHIP TO STATE LAW.—No State or po19 litical subdivision of a State may adopt, maintain, enforce, 

20 or continue in effect any law, regulation, rule, require21 ment, or standard related to the data privacy or data secu22 rity and associated activities of covered entities. 

23 (b) SAVINGS PROVISION.—Subsection (a) may not be 

24 construed to preempt State laws that directly establish reVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00058 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
59 

•S 2499 IS

1 quirements for the notification of consumers in the event 

2 of a data breach. 

3 (c) RELATIONSHIP TO OTHER FEDERAL LAWS.— 

4 (1) IN GENERAL.—Except as provided in para5 graphs (2) and (3), the requirements of this Act 

6 shall supersede any other Federal law or regulation 

7 relating to the privacy or security of covered data or 

8 associated activities of covered entities. 

9 (2) SAVINGS PROVISION.—This Act may not be 

10 construed to modify, limit, or supersede the oper11 ation of the following: 

12 (A) The Children’s Online Privacy Protec13 tion Act (15 U.S.C. 6501 et seq.). 

14 (B) The Communications Assistance for 

15 Law Enforcement Act (47 U.S.C. 1001 et seq.). 

16 (C) Section 227 of the Communications 

17 Act of 1934 (47 U.S.C. 227). 

18 (D) Title V of the Gramm-Leach-Bliley 

19 Act (15 U.S.C. 6801 et seq.). 

20 (E) The Fair Credit Reporting Act (15 

21 U.S.C. 1681 et seq.). 

22 (F) The Health Insurance Portability and 

23 Accountability Act (Public Law 104–191). 

24 (G) The Electronic Communications Pri25 vacy Act (18 U.S.C. 2510 et seq.). 


pamtmann on DSKBC07HB2PROD with BILLS
60 

•S 2499 IS

1 (H) Section 444 of the General Education 

2 Provisions Act (20 U.S.C. 1232g) (commonly 

3 referred to as the ‘‘Family Educational Rights 

4 and Privacy Act of 1974’’). 

5 (I) The Driver’s Privacy Protection Act of 

6 1994 (18 U.S.C. 2721 et seq.). 

7 (J) The Federal Aviation Act of 1958 (49 

8 U.S.C. App. 1301 et seq.). 

9 (K) The Health Information Technology 

10 for Economic and Clinical Health Act (42 

11 U.S.C. 17931 et seq.). 

12 (3) COMPLIANCE WITH SAVED FEDERAL

13 LAWS.—To the extent that the data collection, proc14 essing, or transfer activities of a covered entity are 

15 subject to a law listed in paragraph (2), such activi16 ties of such entity shall not be subject to the re17 quirements of this Act. 

18 (4) NONAPPLICATION OF FCC LAWS AND REGU19 LATIONS TO COVERED ENTITIES.—Notwithstanding 

20 any other provision of law, neither any provision of 

21 the Communications Act of 1934 (47 U.S.C. 151 et 

22 seq.) and all Acts amendatory thereof and supple23 mentary thereto nor any regulation promulgated by 

24 the Federal Communications Commission under 

25 such Acts shall apply to any covered entity with reVerDate Sep 11 2014 18:48 Aug 02, 2021 Jkt 019200 PO 00000 Frm 00060 Fmt 6652 Sfmt 6201 E:\BILLS\S2499.IS S2499

pamtmann on DSKBC07HB2PROD with BILLS
61 

•S 2499 IS

1 spect to the collection, use, processing, transferring, 

2 or security of individual information, except to the 

3 extent that such provision or regulation pertains 

4 solely to ‘‘911’’ lines or other emergency line of a 

5 hospital, medical provider or service office, health 

6 care facility, poison control center, fire protection 

7 agency, or law enforcement agency. 

8 SEC. 405. CONSTITUTIONAL AVOIDANCE. 

9 The provisions of this Act shall be construed, to the 

10 greatest extent possible, to avoid conflicting with the Con11 stitution of the United States, including the protections 

12 of free speech and freedom of the press established under 

13 the First Amendment to the Constitution of the United 

14 States. 

15 SEC. 406. SEVERABILITY. 

16 If any provision of this Act, or an amendment made 

17 by this Act, is determined to be unenforceable or invalid, 

18 the remaining provisions of this Act and the amendments 

19 made by this Act shall not be affected. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS