```

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 2499 Introduced in Senate (IS)]

<DOC>

117th CONGRESS
  1st Session
                                S. 2499

 To establish data privacy and data security protections for consumers 
                         in the United States.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                             July 28, 2021

 Mr. Wicker (for himself and Mrs. Blackburn) introduced the following 
 bill; which was read twice and referred to the Committee on Commerce, 
                      Science, and Transportation

_______________________________________________________________________

                                 A BILL

 
 To establish data privacy and data security protections for consumers 
                         in the United States.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Setting an 
American Framework to Ensure Data Access, Transparency, and 
Accountability Act'' or the ``SAFE DATA Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
Sec. 3. Effective date.
                TITLE I--INDIVIDUAL CONSUMER DATA RIGHTS

Sec. 101. Consumer loyalty.
Sec. 102. Transparency.
Sec. 103. Individual control.
Sec. 104. Rights to consent.
Sec. 105. Minimizing data collection, processing, and retention.
Sec. 106. Service providers and third parties.
Sec. 107. Privacy impact assessments.
Sec. 108. Scope of coverage.
          TITLE II--DATA TRANSPARENCY, INTEGRITY, AND SECURITY

Sec. 201. Civil rights, algorithm bias, detection, and mitigation.
Sec. 202. Data brokers.
Sec. 203. Protection of covered data.
                  TITLE III--CORPORATE ACCOUNTABILITY

Sec. 301. Designation of data privacy officer and data security 
                            officer.
Sec. 302. Internal controls.
Sec. 303. Whistleblower protections.
            TITLE IV--ENFORCEMENT AUTHORITY AND NEW PROGRAMS

Sec. 401. Enforcement by the Federal Trade Commission.
Sec. 402. Enforcement by State attorneys general.
Sec. 403. Approved certification programs.
Sec. 404. Relationship between Federal and State law.
Sec. 405. Constitutional avoidance.
Sec. 406. Severability.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Affirmative express consent.--The term ``affirmative 
        express consent'' means, upon being presented with a clear and 
        conspicuous description of an act or practice for which consent 
        is sought, an affirmative act by the individual clearly 
        communicating the individual's authorization for the act or 
        practice.
            (2) Algorithm.--The term ``algorithm'' means a 
        computational process derived from machine learning, 
        statistics, or other data processing or artificial intelligence 
        techniques, that processes covered data for the purpose of 
        making a decision or facilitating human decision-making.
            (3) Collection.--The term ``collection'' means buying, 
        renting, gathering, obtaining, receiving, or accessing any 
        covered data of an individual by any means.
            (4) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (5) Common branding.--The term ``common branding'' means a 
        shared name, servicemark, or trademark.
            (6) Covered data.--
                    (A) In general.--The term ``covered data'' means 
                information that identifies or is linked or reasonably 
                linkable to an individual or a device that is linked or 
                reasonably linkable to an individual.
                    (B) Linked or reasonably linkable.--For purposes of 
                subparagraph (A), information held by a covered entity 
                is linked or reasonably linkable to an individual or a 
                device if, as a practical matter, it can be used on its 
                own or in combination with other information held by, 
                or readily accessible to, the covered entity to 
                identify such individual or such device.
                    (C) Exclusions.--Such term does not include--
                            (i) aggregated data;
                            (ii) de-identified data;
                            (iii) employee data; or
                            (iv) publicly available information.
                    (D) Aggregated data.--For purposes of subparagraph 
                (C), the term ``aggregated data'' means information 
                that relates to a group or category of individuals or 
                devices that does not identify and is not linked or 
                reasonably linkable to any individual or device.
                    (E) De-identified data.--For purposes of 
                subparagraph (C), the term ``de-identified data'' means 
                information held by a covered entity that--
                            (i) does not identify, and is not linked or 
                        reasonably linkable to, an individual or 
                        device;
                            (ii) does not contain any persistent 
                        identifier or other information that could 
                        readily be used to reidentify the individual to 
                        whom, or the device to which, the identifier or 
                        information pertains;
                            (iii) is subject to a public commitment by 
                        the covered entity--
                                    (I) to refrain from attempting to 
                                use such information to identify any 
                                individual or device; and
                                    (II) to adopt technical and 
                                organizational measures to ensure that 
                                such information is not linked to any 
                                individual or device; and
                            (iv) is not disclosed by the covered entity 
                        to any other party unless the disclosure is 
                        subject to a contractually or other legally 
                        binding requirement that--
                                    (I) the recipient of the 
                                information shall not use the 
                                information to identify any individual 
                                or device; and
                                    (II) all onward disclosures of the 
                                information shall be subject to the 
                                requirement described in subclause (I).
                    (F) Employee data.--For purposes of subparagraph 
                (C), the term ``employee data'' means--
                            (i) information relating to an individual 
                        collected by a covered entity in the course of 
                        the individual acting as a job applicant to, or 
                        employee (regardless of whether such employee 
                        is paid or unpaid, or employed on a temporary 
                        basis), owner, director, officer, staff member, 
                        trainee, vendor, visitor, volunteer, intern, or 
                        contractor of, the entity, provided that such 
                        information is collected, processed, or 
                        transferred by the covered entity solely for 
                        purposes related to the individual's status as 
                        a current or former job applicant to, or an 
                        employee, owner, director, officer, staff 
                        member, trainee, vendor, visitor, volunteer, 
                        intern, or contractor of, that covered entity;
                            (ii) business contact information of an 
                        individual, including the individual's name, 
                        position or title, business telephone number, 
                        business address, business email address, 
                        qualifications, and other similar information, 
                        that is provided to a covered entity by an 
                        individual who is acting in a professional 
                        capacity, provided that such information is 
                        collected, processed, or transferred solely for 
                        purposes related to such individual's 
                        professional activities;
                            (iii) emergency contact information 
                        collected by a covered entity that relates to 
                        an individual who is acting in a role described 
                        in clause (i) with respect to the covered 
                        entity, provided that such information is 
                        collected, processed, or transferred solely for 
                        the purpose of having an emergency contact on 
                        file for the individual; or
                            (iv) information relating to an individual 
                        (or a relative or beneficiary of such 
                        individual) that is necessary for the covered 
                        entity to collect, process, or transfer for the 
                        purpose of administering benefits to which such 
                        individual (or relative or beneficiary of such 
                        individual) is entitled on the basis of the 
                        individual acting in a role described in clause 
                        (i) with respect to the entity, provided that 
                        such information is collected, processed, or 
                        transferred solely for the purpose of 
                        administering such benefits.
                    (G) Publicly available information.--
                            (i) In general.--For the purposes of 
                        subparagraph (C), the term ``publicly available 
                        information'' means any information that a 
                        covered entity has a reasonable basis to 
                        believe--
                                    (I) has been lawfully made 
                                available to the general public from 
                                Federal, State, or local government 
                                records;
                                    (II) is widely available to the 
                                general public, including information 
                                from--
                                            (aa) a telephone book or 
                                        online directory;
                                            (bb) television, internet, 
                                        or radio content or 
                                        programming; or
                                            (cc) the news media or a 
                                        website that is lawfully 
                                        available to the general public 
                                        on an unrestricted basis (for 
                                        purposes of this subclause a 
                                        website is not restricted 
                                        solely because there is a fee 
                                        or log-in requirement 
                                        associated with accessing the 
                                        website); or
                                    (III) is a disclosure to the 
                                general public that is required to be 
                                made by Federal, State, or local law.
                            (ii) Exclusions.--Such term does not 
                        include an obscene visual depiction (as defined 
                        for purposes of section 1460 of title 18, 
                        United States Code).
            (7) Covered entity.--The term ``covered entity'' means any 
        person that--
                    (A) is subject to the Federal Trade Commission Act 
                (15 U.S.C. 41 et seq.) or is--
                            (i) a common carrier described in section 
                        5(a)(2) of such Act (15 U.S.C. 45(a)(2)); or
                            (ii) an organization not organized to carry 
                        on business for their own profit or that of 
                        their members;
                    (B) collects, processes, or transfers covered data; 
                and
                    (C) determines the purposes and means of such 
                collection, processing, or transfer.
            (8) Data broker.--
                    (A) In general.--The term ``data broker'' means a 
                covered entity whose principal source of revenue is 
                derived from processing or transferring the covered 
                data of individuals with whom the entity does not have 
                a direct relationship on behalf of third parties for 
                such third parties' use.
                    (B) Exclusion.--Such term does not include a 
                service provider.
            (9) Delete.--The term ``delete'' means to remove or destroy 
        information such that it is not maintained in human or machine 
        readable form and cannot be retrieved or utilized in such form 
        in the normal course of business.
            (10) Executive agency.--The term ``Executive agency'' has 
        the meaning set forth in section 105 of title 5, United States 
        Code.
            (11) Individual.--The term ``individual'' means a natural 
        person residing in the United States.
            (12) Large data holder.--The term ``large data holder'' 
        means a covered entity that in the most recent calendar year--
                    (A) processed or transferred the covered data of 
                more than 8,000,000 individuals; or
                    (B) processed or transferred the sensitive covered 
                data of more than 300,000 individuals or devices that 
                are linked or reasonably linkable to an individual 
                (excluding any instance where the covered entity 
                processes the log-in information of an individual or 
                device to allow the individual or device to log in to 
                an account administered by the covered entity).
            (13) Material.--The term ``material'' means, with respect 
        to an act, practice, or representation of a covered entity 
        (including a representation made by the covered entity in a 
        privacy policy or similar disclosure to individuals), that such 
        act, practice, or representation is likely to affect an 
        individual's decision or conduct regarding a product or 
        service.
            (14) Process.--The term ``process'' means any operation or 
        set of operations performed on covered data including analysis, 
        organization, structuring, retaining, using, or otherwise 
        handling covered data.
            (15) Processing purpose.--The term ``processing purpose'' 
        means a reason for which a covered entity processes covered 
        data.
            (16) Research.--The term ``research'' means the scientific 
        analysis of information, including covered data, by a covered 
        entity or those with whom the covered entity is cooperating or 
        others acting at the direction or on behalf of the covered 
        entity, that is conducted for the primary purpose of advancing 
        scientific knowledge and may be for the commercial benefit of 
        the covered entity.
            (17) Sensitive covered data.--
                    (A) In general.--The term ``sensitive covered 
                data'' means any of the following forms of covered data 
                of an individual:
                            (i) A unique, government-issued identifier, 
                        such as a Social Security number, passport 
                        number, or driver's license number, that is not 
                        required to be displayed to the public.
                            (ii) Any covered data that describes or 
                        reveals the diagnosis or treatment of the past, 
                        present, or future physical health, mental 
                        health, or disability of an individual.
                            (iii) A financial account number, debit 
                        card number, credit card number, or any 
                        required security or access code, password, or 
                        credentials allowing access to any such 
                        account.
                            (iv) Covered data that is biometric 
                        information.
                            (v) Precise geolocation information.
                            (vi) A persistent identifier.
                            (vii) The contents of an individual's 
                        private communications, such as emails, texts, 
                        direct messages, or mail, or the identity of 
                        the parties subject to such communications, 
                        unless the covered entity is the intended 
                        recipient of the communication.
                            (viii) Account log-in credentials such as a 
                        user name or email address, in combination with 
                        a password or security question and answer that 
                        would permit access to an online account.
                            (ix) Covered data revealing an individual's 
                        racial or ethnic origin, or religion in a 
                        manner inconsistent with the individual's 
                        reasonable expectation regarding the processing 
                        or transfer of such information.
                            (x) Covered data revealing the sexual 
                        orientation or sexual behavior of an individual 
                        in a manner inconsistent with the individual's 
                        reasonable expectation regarding the processing 
                        or transfer of such information.
                            (xi) Covered data about the online 
                        activities of an individual that addresses or 
                        reveals a category of covered data described in 
                        another clause of this subparagraph.
                            (xii) Covered data that is calendar 
                        information, address book information, phone or 
                        text logs, photos, or videos maintained for 
                        private use on an individual's device.
                            (xiii) Any covered data collected or 
                        processed by a covered entity for the purpose 
                        of identifying covered data described in 
                        another clause of this subparagraph.
                            (xiv) Any other category of covered data 
                        designated by the Commission pursuant to a 
                        rulemaking under section 553 of title 5, United 
                        States Code.
                    (B) Biometric information.--For purposes of 
                subparagraph (A), the term ``biometric information''--
                            (i) means the physiological or biological 
                        characteristics of an individual, including 
                        deoxyribonucleic acid, that are used, singly or 
                        in combination with each other or with other 
                        identifying data, to establish the identity of 
                        an individual; and
                            (ii) includes--
                                    (I) imagery of the iris, retina, 
                                fingerprint, face, hand, palm, vein 
                                patterns, and voice recordings, from 
                                which an identifier template, such as a 
                                faceprint, a minutiae template, or a 
                                voiceprint, can be extracted; and
                                    (II) keystroke patterns or rhythms, 
                                gait patterns or rhythms, and sleep, 
                                health, or exercise data that contain 
                                identifying information.
                    (C) Persistent identifier.--For purposes of 
                subparagraph (A), the term ``persistent identifier'' 
                means a technologically derived identifier that 
                identifies an individual, or is linked or reasonably 
                linkable to an individual over time and across services 
                and platforms, which may include a customer number held 
                in a cookie, a static Internet Protocol address, a 
                processor or device serial number, or another unique 
                device identifier.
                    (D) Precise geolocation information.--For purposes 
                of subparagraph (A), the term ``precise geolocation 
                information'' means technologically derived information 
                capable of determining the past or present actual 
                physical location of an individual or an individual's 
                device at a specific point in time to within 1,750 
                feet.
            (18) Service provider.--The term ``service provider'' 
        means, with respect to a set of covered data, a covered entity 
        that processes or transfers such covered data for the purpose 
        of performing 1 or more services or functions on behalf of, and 
        at the direction of, a covered entity that--
                    (A) is not related to the covered entity providing 
                the service or function by common ownership or 
                corporate control; and
                    (B) does not share common branding with the covered 
                entity providing the service or function.
            (19) Service provider data.--The term ``service provider 
        data'' means covered data that is collected by the service 
        provider on behalf of a covered entity or transferred to the 
        service provider by a covered entity for the purpose of 
        allowing the service provider to perform a service or function 
        on behalf of, and at the direction of, such covered entity.
            (20) Third party.--The term ``third party'' means, with 
        respect to a set of covered data, a covered entity--
                    (A) that is not a service provider with respect to 
                such covered data; and
                    (B) that received such covered data from another 
                covered entity--
                            (i) that is not related to the covered 
                        entity by common ownership or corporate 
                        control; and
                            (ii) that does not share common branding 
                        with the covered entity.
            (21) Third party data.--The term ``third party data'' 
        means, with respect to a third party, covered data that has 
        been transferred to the third party by a covered entity.
            (22) Transfer.--The term ``transfer'' means to disclose, 
        release, share, disseminate, make available, or license in 
        writing, electronically, or by any other means for 
        consideration of any kind or for a commercial purpose.

SEC. 3. EFFECTIVE DATE.

    Except as otherwise provided in this Act, this Act shall take 
effect 18 months after the date of enactment of this Act.

                TITLE I--INDIVIDUAL CONSUMER DATA RIGHTS

SEC. 101. CONSUMER LOYALTY.

    (a) Prohibition on the Denial of Products or Services.--
            (1) In general.--Subject to paragraph (2), a covered entity 
        shall not deny products or services to an individual because 
        the individual exercises a right established under subparagraph 
        (A), (B), or (D) of section 103(a)(1).
            (2) Rules of application.--A covered entity--
                    (A) shall not be in violation of paragraph (1) with 
                respect to a product or service and an individual if 
                the exercise of a right described in such paragraph by 
                the individual precludes the covered entity from 
                providing such product or service to such individual; 
                and
                    (B) may offer different types of pricing and 
                functionalities with respect to a product or service 
                based on an individual's exercise of a right described 
                in such paragraph.
    (b) No Waiver of Individual Controls.--The rights and obligations 
created under section 103 may not be waived in an agreement between a 
covered entity and an individual.

SEC. 102. TRANSPARENCY.

    (a) In General.--A covered entity that processes covered data 
shall, with respect to such data, publish a privacy policy that is--
            (1) disclosed, in a clear and conspicuous manner, to an 
        individual prior to or at the point of the collection of 
        covered data from the individual; and
            (2) made available, in a clear and conspicuous manner, to 
        the public.
    (b) Content of Privacy Policy.--The privacy policy required under 
subsection (a) shall include the following:
            (1) The identity and the contact information of the covered 
        entity (including the covered entity's points of contact for 
        privacy and data security inquiries) and the identity of any 
        affiliate to which covered data may be transferred by the 
        covered entity.
            (2) The categories of covered data the covered entity 
        collects.
            (3) The processing purposes for each category of covered 
        data the covered entity collects.
            (4) Whether the covered entity transfers covered data, the 
        categories of recipients to whom the covered entity transfers 
        covered data, and the purposes of the transfers.
            (5) A general description of the covered entity's data 
        retention practices for covered data and the purposes for such 
        retention.
            (6) How individuals can exercise their rights under section 
        103.
            (7) A general description of the covered entity's data 
        security practices.
            (8) The effective date of the privacy policy.
    (c) Languages.--A privacy policy required under subsection (a) 
shall be made available in all of the languages in which the covered 
entity provides a product or service that is subject to the policy, or 
carries out activities related to such product or service.
    (d) Material Changes.--If a covered entity makes a material change 
to its privacy policy, it shall notify the individuals affected before 
further processing or transferring of previously collected covered data 
and, except as provided in section 108, provide an opportunity to 
withdraw consent to further processing or transferring of the covered 
data under the changed policy. The covered entity shall provide direct 
notification, where possible, regarding a material change to the 
privacy policy to affected individuals, taking into account available 
technology and the nature of the relationship.
    (e) Application to Indirect Transfers.--Where the ownership of an 
individual's device is transferred directly from one individual to 
another individual, a covered entity may satisfy its obligation to 
disclose a privacy policy prior to or at the point of collection of 
covered data by making the privacy policy available under subsection 
(a)(2).

SEC. 103. INDIVIDUAL CONTROL.

    (a) Access to, and Correction, Deletion, and Portability of, 
Covered Data.--
            (1) In general.--Subject to paragraphs (2) and (3) and 
        section 108, a covered entity shall provide an individual, 
        immediately or as quickly as possible and in no case later than 
        90 days after receiving a verified request from the individual, 
        with the right to reasonably--
                    (A) access--
                            (i) the covered data of the individual, or 
                        an accurate representation of the covered data 
                        of the individual, that is or has been 
                        processed by the covered entity or any service 
                        provider on behalf of the covered entity;
                            (ii) if applicable, a list of categories of 
                        third parties and service providers to whom the 
                        covered entity has transferred the covered data 
                        of the individual; and
                            (iii) if a covered entity transfers covered 
                        data, a description of the purpose for which 
                        the covered entity transferred the covered data 
                        of the individual to a service provider or 
                        third party;
                    (B) request that the covered entity--
                            (i) correct inaccuracies or incomplete 
                        information with respect to the covered data of 
                        the individual that is maintained by the 
                        covered entity; and
                            (ii) notify any service provider or third 
                        party to which the covered entity transferred 
                        such covered data of the corrected information;
                    (C) request that the covered entity--
                            (i) either delete or deidentify covered 
                        data of the individual that is or has been 
                        maintained by the covered entity; and
                            (ii) notify any service provider or third 
                        party to which the covered entity transferred 
                        such covered data of the individual's request 
                        under clause (i), unless the transfer of such 
                        data to the third party was made at the 
                        direction of the individual; and
                    (D) to the extent that is technically feasible, 
                provide covered data of the individual that is or has 
                been generated and submitted to the covered entity by 
                the individual and maintained by the covered entity in 
                a portable, structured, and machine-readable format 
                that is not subject to licensing restrictions.
            (2) Frequency and cost of access.--A covered entity shall--
                    (A) provide an individual with the opportunity to 
                exercise the rights described in paragraph (1) not less 
                than twice in any 12-month period; and
                    (B) with respect to the first 2 times that an 
                individual exercises the rights described in paragraph 
                (1) in any 12-month period, allow the individual to 
                exercise such rights free of charge.
            (3) Exceptions.--A covered entity--
                    (A) shall not comply with a request to exercise the 
                rights described in paragraph (1) if the covered entity 
                cannot verify--
                            (i) that the individual making the request 
                        is the individual to whom the covered data that 
                        is the subject of the request relates; or
                            (ii) the individual's assertion under 
                        paragraph (1)(B) that such information is 
                        inaccurate or incomplete;
                    (B) may decline to comply with a request that 
                would--
                            (i) require the covered entity to retain 
                        any covered data for the sole purpose of 
                        fulfilling the request;
                            (ii) be impossible or demonstrably 
                        impracticable to comply with;
                            (iii) require the covered entity to 
                        combine, relink, or otherwise reidentify 
                        covered data that has been deidentified;
                            (iv) result in the release of trade 
                        secrets, or other proprietary or confidential 
                        data or business practices;
                            (v) interfere with law enforcement, 
                        judicial proceedings, investigations, or 
                        reasonable efforts to guard against, detect, or 
                        investigate malicious or unlawful activity, or 
                        enforce contracts;
                            (vi) require disproportionate effort, 
                        taking into consideration available technology, 
                        or would not be reasonably feasible on 
                        technical grounds;
                            (vii) compromise the privacy, security, or 
                        other rights of the covered data of another 
                        individual;
                            (viii) be excessive or abusive to another 
                        individual; or
                            (ix) violate Federal or State law or the 
                        rights and freedoms of another individual, 
                        including under the Constitution of the United 
                        States; and
                    (C) may delete covered data instead of providing 
                access and correction rights under subparagraphs (A) 
                and (B) of paragraph (1) if such covered data--
                            (i) is not sensitive covered data; and
                            (ii) is used only for the purposes of 
                        contacting individuals with respect to 
                        marketing communications.
    (b) Regulations.--Not later than 1 year after the date of enactment 
of this Act, the Commission shall promulgate regulations under section 
553 of title 5, United States Code, establishing processes by which 
covered entities may verify requests to exercise rights described in 
subsection (a)(1).

SEC. 104. RIGHTS TO CONSENT.

    (a) Consent.--Except as provided in section 108, a covered entity 
shall not, without the prior, affirmative express consent of an 
individual--
            (1) transfer sensitive covered data of the individual to a 
        third party; or
            (2) process sensitive covered data of the individual.
    (b) Requirements for Affirmative Express Consent.--In obtaining the 
affirmative express consent of an individual to process the sensitive 
covered data of the individual as required under subsection (a)(2), a 
covered entity shall provide the individual with notice that shall--
            (1) include a clear description of the processing purpose 
        for which the sensitive covered data will be processed;
            (2) clearly identify any processing purpose that is 
        necessary to fulfill a request made by the individual;
            (3) include a prominent heading that would enable a 
        reasonable individual to easily identify the processing purpose 
        for which consent is sought; and
            (4) clearly explain the individual's right to provide or 
        withhold consent.
    (c) Requirements Related to Minors.--A covered entity shall not 
transfer the covered data of an individual to a third-party without 
affirmative express consent from the individual or the individual's 
parent or guardian if the covered entity has actual knowledge that the 
individual is between 13 and 16 years of age.
    (d) Right To Opt Out.--Except as provided in section 108, a covered 
entity shall provide an individual with the ability to opt out of the 
collection, processing, or transfer of such individual's covered data 
before such collection, processing, or transfer occurs.
    (e) Prohibition on Inferred Consent.--A covered entity shall not 
infer that an individual has provided affirmative express consent to a 
processing purpose from the inaction of the individual or the 
individual's continued use of a service or product provided by the 
covered entity.
    (f) Withdrawal of Consent.--A covered entity shall provide an 
individual with a clear and conspicuous means to withdraw affirmative 
express consent.
    (g) Rulemaking.--The Commission may promulgate regulations under 
section 553 of title 5, United States Code, to establish clear and 
conspicuous procedures for allowing individuals to provide or withdraw 
affirmative express consent for the collection of sensitive covered 
data.

SEC. 105. MINIMIZING DATA COLLECTION, PROCESSING, AND RETENTION.

    (a) In General.--Except as provided in section 108, a covered 
entity shall not collect, process, or transfer covered data beyond--
            (1) what is reasonably necessary, proportionate, and 
        limited to provide or improve a product, service, or a 
        communication about a product or service, including what is 
        reasonably necessary, proportionate, and limited to provide a 
        product or service specifically requested by an individual or 
        reasonably anticipated within the context of the covered 
        entity's ongoing relationship with an individual;
            (2) what is reasonably necessary, proportionate, or limited 
        to otherwise process or transfer covered data in a manner that 
        is described in the privacy policy that the covered entity is 
        required to publish under section 102(a); or
            (3) what is expressly permitted by this Act or any other 
        applicable Federal law.
    (b) Best Practices.--Not later than 1 year after the date of 
enactment of this Act, the Commission shall issue guidelines 
recommending best practices for covered entities to minimize the 
collection, processing, and transfer of covered data in accordance with 
this section.
    (c) Rule of Construction.--Notwithstanding section 404 of this Act, 
nothing in this section supersedes any other provision of this Act or 
other applicable Federal law.

SEC. 106. SERVICE PROVIDERS AND THIRD PARTIES.

    (a) Service Providers.--A service provider--
            (1) shall not process service provider data for any 
        processing purpose that is not performed on behalf of, and at 
        the direction of, the covered entity that transferred the data 
        to the service provider;
            (2) shall not transfer service provider data to a third 
        party for any purpose other than a purpose performed on behalf 
        of, or at the direction of, the covered entity that transferred 
        the data to the service provider;
            (3) at the direction of the covered entity that transferred 
        service provider data to the service provider, shall delete or 
        deidentify such data--
                    (A) as soon as practicable after the service 
                provider has completed providing the service or 
                function for which the data was transferred to the 
                service provider; or
                    (B) as soon as practicable after the end of the 
                period during which the service provider is to provide 
                services with respect to such data, as agreed to by the 
                service provider and the covered entity that 
                transferred the data;
            (4) is exempt from the requirements of section 103 with 
        respect to service provider data, but shall, to the extent 
        practicable--
                    (A) assist the covered entity from which it 
                received the service provider data in fulfilling 
                requests to exercise rights under section 103(a); and
                    (B) upon receiving notice from a covered entity of 
                a verified request made under section 103(a)(1) to 
                delete, deidentify, or correct service provider data 
                held by the service provider, delete, deidentify, or 
                correct such data; and
            (5) is exempt from the requirements of sections 104 and 
        105.
    (b) Third Parties.--A third party--
            (1) shall not process third party data for a processing 
        purpose inconsistent with the reasonable expectation of the 
        individual to whom such data relates;
            (2) for purposes of paragraph (1), may reasonably rely on 
        representations made by the covered entity that transferred 
        third party data regarding the reasonable expectations of 
        individuals to whom such data relates, provided that the third 
        party conducts reasonable due diligence on the representations 
        of the covered entity and finds those representations to be 
        credible; and
            (3) is exempt from the requirements of sections 104 and 
        105.
    (c) Bankruptcy.--In the event that a covered entity enters into a 
bankruptcy proceeding which would lead to the disclosure of covered 
data to a third party, the covered entity shall in a reasonable time 
prior to the disclosure--
            (1) provide notice of the proposed disclosure of covered 
        data, including the name of the third party and its policies 
        and practices with respect to the covered data, to all affected 
        individuals; and
            (2) provide each affected individual with the opportunity 
        to withdraw any previous affirmative express consent related to 
        the covered data of the individual or request the deletion or 
        deidentification of the covered data of the individual.
    (d) Additional Obligations on Covered Entities.--
            (1) In general.--A covered entity shall exercise reasonable 
        due diligence to ensure compliance with this section before--
                    (A) selecting a service provider; or
                    (B) deciding to transfer covered data to a third 
                party.
            (2) Guidance.--Not later than 2 years after the effective 
        date of this Act, the Commission shall publish guidance 
        regarding compliance with this subsection. Such guidance shall, 
        to the extent practicable, minimize unreasonable burdens on 
        small- and medium-sized covered entities.

SEC. 107. PRIVACY IMPACT ASSESSMENTS.

    (a) Privacy Impact Assessments of New or Material Changes to 
Processing of Covered Data.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act (or, if later, not later than 1 year 
        after a covered entity first meets the definition of a large 
        data holder (as defined in section 2)), each covered entity 
        that is a large data holder shall conduct a privacy impact 
        assessment of each of its processing activities involving 
        covered data that present a heightened risk of harm to 
        individuals, and each such assessment shall weigh the benefits 
        of the covered entity's covered data collection, processing, 
        and transfer practices against the potential adverse 
        consequences to individual privacy of such practices.
            (2) Assessment requirements.--A privacy impact assessment 
        required under paragraph (1)--
                    (A) shall be reasonable and appropriate in scope 
                given--
                            (i) the nature of the covered data 
                        collected, processed, or transferred by the 
                        covered entity;
                            (ii) the volume of the covered data 
                        collected, processed, or transferred by the 
                        covered entity;
                            (iii) the size of the covered entity; and
                            (iv) the potential risks posed to the 
                        privacy of individuals by the collection, 
                        processing, or transfer of covered data by the 
                        covered entity;
                    (B) shall be documented in written form and 
                maintained by the covered entity unless rendered out of 
                date by a subsequent assessment conducted under 
                subsection (b); and
                    (C) shall be approved by the data privacy officer 
                of the covered entity.
    (b) Ongoing Privacy Impact Assessments.--
            (1) In general.--A covered entity that is a large data 
        holder shall, not less frequently than once every 2 years after 
        the covered entity conducted the privacy impact assessment 
        required under subsection (a), conduct a privacy impact 
        assessment of the collection, processing, and transfer of 
        covered data by the covered entity to assess the extent to 
        which--
                    (A) the ongoing practices of the covered entity are 
                consistent with the covered entity's published privacy 
                policies;
                    (B) any customizable privacy settings included in a 
                service or product offered by the covered entity are 
                adequately accessible to individuals who use the 
                service or product and are effective in meeting the 
                privacy preferences of such individuals;
                    (C) the practices and privacy settings described in 
                subparagraphs (A) and (B), respectively--
                            (i) meet the expectations of a reasonable 
                        individual; and
                            (ii) provide an individual with adequate 
                        control over the individual's covered data;
                    (D) the covered entity could enhance the privacy 
                and security of covered data through technical or 
                operational safeguards such as encryption, 
                deidentification, and other privacy-enhancing 
                technologies; and
                    (E) the processing of covered data is compatible 
                with the stated purposes for which it was collected.
            (2) Approval by data privacy officer.--The data privacy 
        officer of a covered entity shall approve the findings of an 
        assessment conducted by the covered entity under this 
        subsection.

SEC. 108. SCOPE OF COVERAGE.

    (a) General Exceptions.--Notwithstanding any provision of this 
title other than subsections (a) through (c) of section 102, a covered 
entity may collect, process or transfer covered data for any of the 
following purposes, provided that the collection, processing, or 
transfer is reasonably necessary, proportionate, and limited to such 
purpose:
            (1) To initiate or complete a transaction or to fulfill an 
        order or provide a service specifically requested by an 
        individual, including associated routine administrative 
        activities such as billing, shipping, financial reporting, and 
        accounting.
            (2) To perform internal system maintenance, diagnostics, 
        product or service management, inventory management, and 
        network management.
            (3) To prevent, detect, or respond to a security incident 
        or trespassing, provide a secure environment, or maintain the 
        safety and security of a product, service, network, or 
        individual.
            (4) To protect against malicious, deceptive, fraudulent, or 
        illegal activity.
            (5) To comply with a legal obligation or the establishment, 
        exercise, analysis, or defense of legal claims or rights, or as 
        required or specifically authorized by law.
            (6) To comply with a civil, criminal, or regulatory 
        inquiry, investigation, subpoena, or summons by an Executive 
        agency.
            (7) To cooperate with an Executive agency or a law 
        enforcement official acting under the authority of an Executive 
        or State agency concerning conduct or activity that the 
        Executive agency or law enforcement official reasonably and in 
        good faith believes may violate Federal, State, or local law, 
        or pose a threat to public safety or national security.
            (8) To address risks to the safety of an individual or 
        group of individuals, or to ensure customer safety, including 
        by authenticating individuals in order to provide access to 
        large venues open to the public.
            (9) To effectuate a product recall pursuant to Federal or 
        State law.
            (10) To conduct public or peer-reviewed scientific, 
        historical, or statistical research that--
                    (A) is in the public interest;
                    (B) adheres to all applicable ethics and privacy 
                laws; and
                    (C) is approved, monitored, and governed by an 
                institutional review board or other oversight entity 
                that meets standards promulgated by the Commission 
                pursuant to section 553 of title 5, United States Code.
            (11) To transfer covered data to a service provider.
            (12) For a purpose identified by the Commission pursuant to 
        a regulation promulgated under subsection (b).
    (b) Additional Purposes.--The Commission may promulgate regulations 
under section 553 of title 5, United States Code, identifying 
additional purposes for which a covered entity may collect, process or 
transfer covered data.
    (c) Small Business Exception.--Sections 103, 105, and 301 shall not 
apply in the case of a covered entity that can establish that, for the 
3 preceding calendar years (or for the period during which the covered 
entity has been in existence if such period is less than 3 years)--
            (1) the covered entity's average annual gross revenues did 
        not exceed $50,000,000;
            (2) on average, the covered entity annually processed the 
        covered data of less than 1,000,000 individuals;
            (3) the covered entity never employed more than 500 
        individuals at any one time; and
            (4) the covered entity derived less than 50 percent of its 
        revenues from transferring covered data.

          TITLE II--DATA TRANSPARENCY, INTEGRITY, AND SECURITY

SEC. 201. CIVIL RIGHTS, ALGORITHM BIAS, DETECTION, AND MITIGATION.

    (a) Civil Rights Protections.--A covered entity, service provider, 
or third party may not collect, process, or transfer covered data in 
violation of Federal civil rights laws.
    (b) FTC Enforcement Assistance.--
            (1) In general.--Whenever the Commission obtains 
        information that a covered entity may have processed or 
        transferred covered data in violation of Federal civil rights 
        laws, the Commission shall transmit such information (excluding 
        any such information that is a trade secret as defined by 
        section 1839 of title 18, United States Code) to the 
        appropriate Executive agency or State agency with authority to 
        initiate proceedings relating to such violation.
            (2) Annual report.--Beginning in 2022, the Commission shall 
        submit an annual report to Congress that includes--
                    (A) a summary of the types of information the 
                Commission transmitted to Executive agencies or State 
                agencies during the preceding year pursuant to this 
                subsection; and
                    (B) a summary of how such information relates to 
                Federal civil rights laws.
            (3) Cooperation with other agencies.--The Commission may 
        implement this subsection by executing agreements or memoranda 
        of understanding with the appropriate Executive agencies.
            (4) Relationship to other laws.--Notwithstanding section 
        404, nothing in this subsection shall supersede any other 
        provision of law.
    (c) Algorithm Transparency Reports.--
            (1) Study and report.--
                    (A) Study.--The Commission shall conduct a study, 
                using the Commission's authority under section 6(b) of 
                the Federal Trade Commission Act (15 U.S.C. 46(b)), 
                examining the use of algorithms to process covered data 
                in a manner that may violate Federal anti-
                discrimination laws.
                    (B) Report.--Not later than 3 years after the date 
                of enactment of this Act, the Commission shall publish 
                a report containing the results of the study required 
                under subparagraph (A).
                    (C) Guidance.--The Commission shall use the results 
                of the study described in subparagraph (A) to develop 
                guidance to assist covered entities in avoiding the use 
                of algorithms to process covered data in a manner that 
                violates Federal civil rights laws.
            (2) Updated report.--Not later than 5 years after the 
        publication of the report required under paragraph (1), the 
        Commission shall publish an updated report.

SEC. 202. DATA BROKERS.

    (a) In General.--Not later than January 31 of each calendar year 
that follows a calendar year during which a covered entity acted as a 
data broker, such covered entity shall register with the Commission 
pursuant to the requirements of this section.
    (b) Registration Requirements.--In registering with the Commission 
as required under subsection (a), a data broker shall do the following:
            (1) Pay to the Commission a registration fee of $100.
            (2) Provide the Commission with the following information:
                    (A) The name and primary physical, email, and 
                internet addresses of the data broker.
                    (B) Any additional information or explanation the 
                data broker chooses to provide concerning its data 
                collection and processing practices.
    (c) Penalties.--A data broker that fails to register as required 
under subsection (a) shall be liable for--
            (1) a civil penalty of $50 for each day it fails to 
        register, not to exceed a total of $10,000 for each year; and
            (2) an amount equal to the fees due under this section for 
        each year that it failed to register as required under 
        subsection (a).
    (d) Publication of Registration Information.--The Commission shall 
publish on the internet website of the Commission the registration 
information provided by data brokers under this section.

SEC. 203. PROTECTION OF COVERED DATA.

    (a) In General.--A covered entity shall establish, implement, and 
maintain reasonable administrative, technical, and physical data 
security policies and practices to protect against risks to the 
confidentiality, security, and integrity of covered data.
    (b) Data Security Requirements.--The data security policies and 
practices required under subsection (a) shall be--
            (1) appropriate to the size and complexity of the covered 
        entity, the nature and scope of the covered entity's collection 
        or processing of covered data, the volume and nature of the 
        covered data at issue, and the cost of available tools to 
        improve security and reduce vulnerabilities; and
            (2) designed to--
                    (A) identify and assess vulnerabilities to covered 
                data;
                    (B) take reasonable preventative and corrective 
                action to address known vulnerabilities to covered 
                data; and
                    (C) detect, respond to, and recover from 
                cybersecurity incidents related to covered data.
    (c) Rulemaking and Guidance.--
            (1) Rulemaking authority and scope.--
                    (A) In general.--The Commission may, pursuant to a 
                proceeding in accordance with section 553 of title 5, 
                United States Code, issue regulations to identify 
                processes for receiving and assessing information 
                regarding vulnerabilities to covered data that are 
                reported to the covered entity.
                    (B) Consultation with nist.--In promulgating 
                regulations under this paragraph, the Commission shall 
                consult with, and take into consideration guidance 
                from, the National Institute for Standards and 
                Technology.
            (2) Guidance.--Not later than 1 year after the date of 
        enactment of this Act, the Commission shall issue guidance to 
        covered entities on how to--
                    (A) identify and assess vulnerabilities to covered 
                data, including--
                            (i) the potential for unauthorized access 
                        to covered data;
                            (ii) vulnerabilities in the covered 
                        entity's collection or processing of covered 
                        data;
                            (iii) the management of access rights; and
                            (iv) the use of service providers to 
                        process covered data;
                    (B) take reasonable preventative and corrective 
                action to address vulnerabilities to covered data; and
                    (C) detect, respond to, and recover from 
                cybersecurity incidents and events.
    (d) Applicability of Other Information Security Laws.--A covered 
entity that is required to comply with title V of the Gramm-Leach-
Bliley Act (15 U.S.C. 6801 et seq.) or the Health Information 
Technology for Economic and Clinical Health Act (42 U.S.C. 17931 et 
seq.), and is in compliance with the information security requirements 
of such Act, shall be deemed to be in compliance with the requirements 
of this section with respect to covered data that is subject to the 
requirements of such Act.

                  TITLE III--CORPORATE ACCOUNTABILITY

SEC. 301. DESIGNATION OF DATA PRIVACY OFFICER AND DATA SECURITY 
              OFFICER.

    (a) In General.--A covered entity shall designate--
            (1) 1 or more qualified employees or contractors as a data 
        privacy officer; and
            (2) 1 or more qualified employees or contractors (in 
        addition to any employee or contractor designated under 
        paragraph (1)) as a data security officer.
    (b) Responsibilities of Data Privacy Officers and Data Security 
Officers.--An employee or contractor who is designated by a covered 
entity as a data privacy officer or a data security officer shall be 
responsible for, at a minimum, coordinating the covered entity's 
policies and practices regarding--
            (1) in the case of a data privacy officer, compliance with 
        the privacy requirements with respect to covered data under 
        this Act; and
            (2) in the case of a data security officer, the security 
        requirements with respect to covered data under this Act.

SEC. 302. INTERNAL CONTROLS.

    A covered entity shall maintain internal controls and reporting 
structures to ensure that appropriate senior management officials of 
the covered entity are involved in assessing risks and making decisions 
that implicate compliance with this Act.

SEC. 303. WHISTLEBLOWER PROTECTIONS.

    (a) Definitions.--For purposes of this section:
            (1) Whistleblower.--The term ``whistleblower'' means any 
        employee or contractor of a covered entity who voluntarily 
        provides to the Commission original information relating to 
        non-compliance with, or any violation or alleged violation of, 
        this Act or any regulation promulgated under this Act.
            (2) Original information.--The term ``original 
        information'' means information that is provided to the 
        Commission by an individual and--
                    (A) is derived from the independent knowledge or 
                analysis of an individual;
                    (B) is not known to the Commission from any other 
                source at the time the individual provides the 
                information; and
                    (C) is not exclusively derived from an allegation 
                made in a judicial or an administrative action, in a 
                governmental report, a hearing, an audit, or an 
                investigation, or from news media, unless the 
                individual is a source of the allegation.
    (b) Effect of Whistleblower Retaliations on Penalties.--In seeking 
penalties under section 401 for a violation of this Act or a regulation 
promulgated under this Act by a covered entity, the Commission shall 
consider whether the covered entity retaliated against an individual 
who was a whistleblower with respect to original information that led 
to the successful resolution of an administrative or judicial action 
brought by the Commission or the Attorney General of the United States 
on behalf of the Commission under this Act against such covered entity.

            TITLE IV--ENFORCEMENT AUTHORITY AND NEW PROGRAMS

SEC. 401. ENFORCEMENT BY THE FEDERAL TRADE COMMISSION.

    (a) Unfair or Deceptive Acts or Practices.--A violation of this Act 
or a regulation promulgated under this Act shall be treated as a 
violation of a rule defining an unfair or deceptive act or practice 
prescribed under section 18(a)(1)(B) of the Federal Trade Commission 
Act (15 U.S.C. 57a(a)(1)(B)).
    (b) Powers of Commission.--
            (1) In general.--Except as provided in subsections (c) and 
        (d), the Commission shall enforce this Act and the regulations 
        promulgated under this Act in the same manner, by the same 
        means, and with the same jurisdiction, powers, and duties as 
        though all applicable terms and provisions of the Federal Trade 
        Commission Act (15 U.S.C. 41 et seq.) were incorporated into 
        and made a part of this Act.
            (2) Privileges and immunities.--Any person who violates 
        this Act or a regulation promulgated under this Act shall be 
        subject to the penalties and entitled to the privileges and 
        immunities provided in the Federal Trade Commission Act (15 
        U.S.C. 41 et seq.).
            (3) Limiting certain actions unrelated to this act; 
        authority preserved.--The Commission shall not bring any action 
        to enforce the prohibition in section 5 of the Federal Trade 
        Commission Act (15 U.S.C. 45) on unfair or deceptive acts or 
        practices with respect to the privacy or security of covered 
        data, unless such alleged act of practice violates this Act.
    (c) Common Carriers and Nonprofit Organizations.--Notwithstanding 
section 4, 5(a)(2), or 6 of the Federal Trade Commission Act (15 U.S.C. 
44, 45(a)(2), 46) or any jurisdictional limitation of the Commission, 
the Commission shall also enforce this Act and the regulations 
promulgated under this Act, in the same manner provided in subsections 
(a) and (b) of this subsection, with respect to--
            (1) common carriers subject to the Communications Act of 
        1934 (47 U.S.C. 151 et seq.) and all Acts amendatory thereof 
        and supplementary thereto; and
            (2) organizations not organized to carry on business for 
        their own profit or that of their members.
    (d) Data Privacy and Security Fund.--
            (1) Establishment of victims relief fund.--There is 
        established in the Treasury of the United States a separate 
        fund to be known as the ``Data Privacy and Security Victims 
        Relief Fund'' (referred to in this paragraph as the ``Victims 
        Relief Fund'').
            (2) Deposits.--
                    (A) Deposits from the commission.--The Commission 
                shall deposit into the Victims Relief Fund the amount 
                of any civil penalty obtained against any covered 
                entity in any action the Commission commences to 
                enforce this Act or a regulation promulgated under this 
                Act.
                    (B) Deposits from the attorney general.--The 
                Attorney General of the United States shall deposit 
                into the Victims Relief Fund the amount of any civil 
                penalty obtained against any covered entity in any 
                action the Attorney General commences on behalf of the 
                Commission to enforce this Act or a regulation 
                promulgated under this Act.
            (3) Use of fund amounts.--Amounts in the Victims Relief 
        Fund shall be available to the Commission, without fiscal year 
        limitation, to provide redress, payments or compensation, or 
        other monetary relief to individuals harmed by an act or 
        practice for which civil penalties have been imposed under this 
        Act. To the extent that individuals cannot be located or such 
        redress, payments or compensation, or other monetary relief are 
        otherwise not practicable, the Commission may use such funds 
        for the purpose of consumer or business education relating to 
        data privacy and security or for the purpose of engaging in 
        technological research that the Commission considers necessary 
        to enforce this Act.
            (4) Amounts not subject to apportionment.--Notwithstanding 
        any other provision of law, amounts in the Victims Relief Fund 
        shall not be subject to apportionment for purposes of chapter 
        15 of title 31, United States Code, or under any other 
        authority.
    (e) Authorization of Appropriations.--There is authorized to be 
appropriated to the Commission $100,000,000 to carry out this Act.

SEC. 402. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

    (a) Civil Action.--In any case in which the attorney general of a 
State has reason to believe that an interest of the residents of that 
State has been or is adversely affected by the engagement of any 
covered entity in an act or practice that violates this Act or a 
regulation promulgated under this Act, the attorney general of the 
State, as parens patriae, may bring a civil action on behalf of the 
residents of the State in an appropriate district court of the United 
States to--
            (1) enjoin that act or practice;
            (2) enforce compliance with this Act or the regulation;
            (3) obtain damages, civil penalties, restitution, or other 
        compensation on behalf of the residents of the State; or
            (4) obtain such other relief as the court may consider to 
        be appropriate.
    (b) Rights of the Commission.--
            (1) In general.--Except where not feasible, the attorney 
        general of a State shall notify the Commission in writing prior 
        to initiating a civil action under subsection (a). Such notice 
        shall include a copy of the complaint to be filed to initiate 
        such action. Upon receiving such notice, the Commission may 
        intervene in such action and, upon intervening--
                    (A) be heard on all matters arising in such action; 
                and
                    (B) file petitions for appeal of a decision in such 
                action.
            (2) Notification timeline.--Where it is not feasible for 
        the attorney general of a State to provide the notification 
        required by paragraph (2) before initiating a civil action 
        under paragraph (1), the attorney general shall notify the 
        Commission immediately after initiating the civil action.
    (c) Consolidation of Actions Brought by Two or More State Attorneys 
General.--Whenever a civil action under subsection (a) is pending and 
another civil action or actions are commenced pursuant to such 
subsection in a different Federal district court or courts that involve 
1 or more common questions of fact, a defendant in such action or 
actions my request that such action or actions be transferred for the 
purposes of consolidated pretrial proceedings and trial to the United 
States District Court for the District of Columbia; provided however, 
that no such action shall be transferred if pretrial proceedings in 
that action have been concluded before a subsequent action is filed by 
the attorney general of the State.
    (d) Actions by Commission.--In any case in which a civil action is 
instituted by or on behalf of the Commission for violation of this Act 
or a regulation promulgated under this Act, no attorney general of a 
State may, during the pendency of such action, institute a civil action 
against any defendant named in the complaint in the action instituted 
by or on behalf of the Commission for violation of this Act or a 
regulation promulgated under this Act that is alleged in such 
complaint.
    (e) Investigatory Powers.--Nothing in this section shall be 
construed to prevent the attorney general of a State or another 
authorized official of a State from exercising the powers conferred on 
the attorney general or the State official by the laws of the State to 
conduct investigations, to administer oaths or affirmations, or to 
compel the attendance of witnesses or the production of documentary or 
other evidence.
    (f) Venue; Service of Process.--
            (1) Venue.--Any action brought under subsection (a) may be 
        brought in the district court of the United States that meets 
        applicable requirements relating to venue under section 1391 of 
        title 28, United States Code.
            (2) Service of process.--In an action brought under 
        subsection (a), process may be served in any district in which 
        the defendant--
                    (A) is an inhabitant; or
                    (B) may be found.
    (g) Actions by Other State Officials.--Any State official who is 
authorized by the State attorney general to be the exclusive authority 
in that State to enforce this Act may bring a civil action under 
subsection (a), subject to the same requirements and limitations that 
apply under this section to civil actions brought under such subsection 
by State attorneys general.

SEC. 403. APPROVED CERTIFICATION PROGRAMS.

    (a) In General.--The Commission shall establish a program in which 
the Commission shall approve voluntary consensus standards or 
certification programs that covered entities may use to comply with 1 
or more provisions in this Act.
    (b) Effect of Approval.--A covered entity in compliance with a 
voluntary consensus standard approved by the Commission shall be deemed 
to be in compliance with the provisions of this Act.
    (c) Time for Approval.--The Commission shall issue a decision 
regarding the approval of a proposed voluntary consensus standard not 
later than 180 days after a request for approval is submitted.
    (d) Effect of Non-Compliance.--A covered entity that claims 
compliance with an approved voluntary consensus standard and is found 
not to be in compliance with such program by the Commission or in any 
judicial proceeding shall be considered to be in violation of this Act.
    (e) Rulemaking.--Not later than 120 days after the date of 
enactment of this Act, the Commission shall promulgate regulations 
under section 553 of title 5, United States Code, establishing a 
process for review of requests for approval of proposed voluntary 
consensus standards under this section.
    (f) Requirements.--To be eligible for approval by the Commission, a 
voluntary consensus standard shall meet the requirements for voluntary 
consensus standards set forth in Office of Management and Budget 
Circular A-119, or other equivalent guidance document, ensuring that 
they are the result of due process procedures and appropriately balance 
the interests of all the stakeholders, including individuals, 
businesses, organizations, and other entities making lawful uses of the 
covered data covered by the standard, and--
            (1) specify clear and enforceable requirements for covered 
        entities participating in the program that provide an overall 
        level of data privacy or data security protection that is 
        equivalent to or greater than that provided in the relevant 
        provisions in this Act;
            (2) require each participating covered entity to post in a 
        prominent place a clear and conspicuous public attestation of 
        compliance and a link to the website described in paragraph 
        (4);
            (3) include a process for an independent assessment of a 
        participating covered entity's compliance with the voluntary 
        consensus standard or certification program prior to 
        certification and at reasonable intervals thereafter;
            (4) create a website describing the voluntary consensus 
        standard or certification program's goals and requirements, 
        listing participating covered entities, and providing a method 
        for individuals to ask questions and file complaints about the 
        program or any participating covered entity;
            (5) take meaningful action for non-compliance with the 
        relevant provisions of this Act by any participating covered 
        entity, which shall depend on the severity of the non-
        compliance and may include--
                    (A) removing the covered entity from the program;
                    (B) referring the covered entity to the Commission 
                or other appropriate Federal or State agencies for 
                enforcement;
                    (C) publicly reporting the disciplinary action 
                taken with respect to the covered entity;
                    (D) providing redress to individuals harmed by the 
                non-compliance;
                    (E) making voluntary payments to the United States 
                Treasury; and
                    (F) taking any other action or actions to ensure 
                the compliance of the covered entity with respect to 
                the relevant provisions of this Act; and
            (6) issue annual reports to the Commission and to the 
        public detailing the activities of the program and its 
        effectiveness during the preceding year in ensuring compliance 
        with the relevant provisions of this Act by participating 
        covered entities and taking meaningful disciplinary action for 
        non-compliance with such provisions by such entities.

SEC. 404. RELATIONSHIP BETWEEN FEDERAL AND STATE LAW.

    (a) Relationship to State Law.--No State or political subdivision 
of a State may adopt, maintain, enforce, or continue in effect any law, 
regulation, rule, requirement, or standard related to the data privacy 
or data security and associated activities of covered entities.
    (b) Savings Provision.--Subsection (a) may not be construed to 
preempt State laws that directly establish requirements for the 
notification of consumers in the event of a data breach.
    (c) Relationship to Other Federal Laws.--
            (1) In general.--Except as provided in paragraphs (2) and 
        (3), the requirements of this Act shall supersede any other 
        Federal law or regulation relating to the privacy or security 
        of covered data or associated activities of covered entities.
            (2) Savings provision.--This Act may not be construed to 
        modify, limit, or supersede the operation of the following:
                    (A) The Children's Online Privacy Protection Act 
                (15 U.S.C. 6501 et seq.).
                    (B) The Communications Assistance for Law 
                Enforcement Act (47 U.S.C. 1001 et seq.).
                    (C) Section 227 of the Communications Act of 1934 
                (47 U.S.C. 227).
                    (D) Title V of the Gramm-Leach-Bliley Act (15 
                U.S.C. 6801 et seq.).
                    (E) The Fair Credit Reporting Act (15 U.S.C. 1681 
                et seq.).
                    (F) The Health Insurance Portability and 
                Accountability Act (Public Law 104-191).
                    (G) The Electronic Communications Privacy Act (18 
                U.S.C. 2510 et seq.).
                    (H) Section 444 of the General Education Provisions 
                Act (20 U.S.C. 1232g) (commonly referred to as the 
                ``Family Educational Rights and Privacy Act of 1974'').
                    (I) The Driver's Privacy Protection Act of 1994 (18 
                U.S.C. 2721 et seq.).
                    (J) The Federal Aviation Act of 1958 (49 U.S.C. 
                App. 1301 et seq.).
                    (K) The Health Information Technology for Economic 
                and Clinical Health Act (42 U.S.C. 17931 et seq.).
            (3) Compliance with saved federal laws.--To the extent that 
        the data collection, processing, or transfer activities of a 
        covered entity are subject to a law listed in paragraph (2), 
        such activities of such entity shall not be subject to the 
        requirements of this Act.
            (4) Nonapplication of fcc laws and regulations to covered 
        entities.--Notwithstanding any other provision of law, neither 
        any provision of the Communications Act of 1934 (47 U.S.C. 151 
        et seq.) and all Acts amendatory thereof and supplementary 
        thereto nor any regulation promulgated by the Federal 
        Communications Commission under such Acts shall apply to any 
        covered entity with respect to the collection, use, processing, 
        transferring, or security of individual information, except to 
        the extent that such provision or regulation pertains solely to 
        ``911'' lines or other emergency line of a hospital, medical 
        provider or service office, health care facility, poison 
        control center, fire protection agency, or law enforcement 
        agency.

SEC. 405. CONSTITUTIONAL AVOIDANCE.

    The provisions of this Act shall be construed, to the greatest 
extent possible, to avoid conflicting with the Constitution of the 
United States, including the protections of free speech and freedom of 
the press established under the First Amendment to the Constitution of 
the United States.

SEC. 406. SEVERABILITY.

    If any provision of this Act, or an amendment made by this Act, is 
determined to be unenforceable or invalid, the remaining provisions of 
this Act and the amendments made by this Act shall not be affected.
                                 <all>
```