I 

116TH CONGRESS 

2D SESSION H. R. 8749 

To provide for digital accountability and transparency. 

IN THE HOUSE OF REPRESENTATIVES 

NOVEMBER 12, 2020 

Mr. VELA introduced the following bill; which was referred to the Committee 

on Energy and Commerce, and in addition to the Committee on Science, 

Space, and Technology, for a period to be subsequently determined by the 

Speaker, in each case for consideration of such provisions as fall within 

the jurisdiction of the committee concerned 

A BILL 

To provide for digital accountability and transparency. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Digital Accountability 

5 and Transparency to Advance Privacy Act’’ or the ‘‘DATA 

6 Privacy Act’’. 

7 SEC. 2. DEFINITIONS. 

8 (a) IN GENERAL.—In this Act: 

9 (1) COLLECT.—The term ‘‘collect’’ means tak10 ing any operation or set of operations to obtain covVerDate Sep 11 2014 22:55 Nov 28, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H8749.IH H8749

pbinns on DSKJLVW7X2PROD with BILLS
2 

•HR 8749 IH

1 ered data, including by automated means, including 

2 purchasing, leasing, assembling, recording, gath3 ering, acquiring, or procuring. 

4 (2) COMMISSION.—The term ‘‘Commission’’ 

5 means the Federal Trade Commission. 

6 (3) COVERED DATA.—The term ‘‘covered 

7 data’’— 

8 (A) means any information that is— 

9 (i) collected, processed, stored, or dis10 closed by a covered entity; 

11 (ii) collected over the internet or other 

12 digital network; and 

13 (iii)(I) linked to an individual or de14 vice associated with an individual; or 

15 (II) practicably linkable to an indi16 vidual or device associated with an indi17 vidual, including by combination with sepa18 rate information, by the covered entity or 

19 any potential recipient of the data; and 

20 (B) does not include data that is— 

21 (i) collected, processed, stored, or dis22 closed solely for the purpose of employ23 ment of an individual; and 


pbinns on DSKJLVW7X2PROD with BILLS
3 

•HR 8749 IH

1 (ii) lawfully made available to the 

2 public from Federal, State, or local govern3 ment records. 

4 (4) COVERED ENTITY.—The term ‘‘covered en5 tity’’— 

6 (A) means any entity that collects, proc7 esses, stores, or discloses covered data; and 

8 (B) does not include any entity that col9 lects, processes, stores, or discloses covered data 

10 relating to fewer than 3,000 individuals and de11 vices during any 12-month period. 

12 (5) DISCLOSE.—The term ‘‘disclose’’ means 

13 taking any action with respect to covered data, in14 cluding by automated means, to sell, share, provide, 

15 or otherwise transfer covered data to another entity, 

16 person, or the general public. 

17 (6) PRIVACY RISK.—The term ‘‘privacy risk’’ 

18 means potential harm to an individual resulting 

19 from the collection, processing, storage, or disclosure 

20 of covered data, including— 

21 (A) direct or indirect financial loss; 

22 (B) stigmatization or reputational harm; 

23 (C) anxiety, embarrassment, fear, and 

24 other severe emotional trauma; 

25 (D) loss of economic opportunity; or 


pbinns on DSKJLVW7X2PROD with BILLS
4 

•HR 8749 IH

1 (E) physical harm. 

2 (7) PROCESS.—The term ‘‘process’’ means any 

3 operation or set of operations that is performed on 

4 covered data or on sets of covered data, including by 

5 automated means, including organizing, combining, 

6 adapting, altering, using, or transforming. 

7 (8) PROTECTED CHARACTERISTIC.—The term 

8 ‘‘protected characteristic’’ means an individual’s 

9 race, sex, gender, sexual orientation, nationality, re10 ligious belief, or political affiliation. 

11 (9) PSEUDONYMOUS DATA.—The term ‘‘pseu12 donymous data’’ means covered data that may only 

13 be linked to the identity of an individual or the iden14 tity of a device associated with an individual if com15 bined with separate information. 

16 (10) REASONABLE INTEREST.—The term ‘‘rea17 sonable interest’’ means— 

18 (A) a compelling business, operational, ad19 ministrative, legal, or educational justification 

20 for the collection, processing, storage, or disclo21 sure of covered data exists; 

22 (B) the use of covered data is within the 

23 context of the relationship between the covered 

24 entity and the individual linked to the covered 

25 data; and 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•HR 8749 IH

1 (C) the interest does not subject the indi2 vidual to an unreasonable privacy risk. 

3 (11) SENSITIVE DATA.—The term ‘‘sensitive 

4 data’’ means any covered data relating to— 

5 (A) the health, biologic, physiologic, bio6 metric, sexual life, or genetic information of an 

7 individual; or 

8 (B) the precise geolocation information of 

9 a device associated with an individual. 

10 (12) STORE.—The term ‘‘store’’ means any op11 eration or set of operations to continue possession of 

12 covered data, including by automated means. 

13 (13) THIRD PARTY SERVICE PROVIDER.—The 

14 term ‘‘third party service provider’’ means any cov15 ered entity that collects, processes, stores, or dis16 closes covered data at the direction of, and for the 

17 sole benefit of, another covered entity under a con18 tract. 

19 (b) MODIFIED DEFINITION BY RULEMAKING.—If the 

20 Commission determines that a term defined in paragraph 

21 (9) or (11) is not sufficient to protect an individual’s data 

22 privacy, the Commission may promulgate regulations 

23 under section 553 of title 5, United States Code, to modify 

24 the definition as the Commission considers appropriate. 


pbinns on DSKJLVW7X2PROD with BILLS
6 

•HR 8749 IH

1 SEC. 3. REQUIRED PRIVACY NOTICE. 

2 (a) PRIVACY NOTICE.—Each covered entity shall post 

3 in an accessible location a notice that is concise, in con4 text, in easily understandable language, accurate, clear, 

5 timely, updated, uses visualizations where appropriate, 

6 conspicuous, and free of charge regarding the covered en7 tity’s privacy practices. 

8 (b) CONTENTS OF NOTICE.—The notice required by 

9 subsection (a) shall include— 

10 (1) a description of the covered data that the 

11 entity collects, processes, stores, and discloses, in12 cluding the sources that provided the covered data if 

13 the covered entity did not collect the covered data; 

14 (2) the purposes for and means by which the 

15 entity collects, processes, and stores the covered 

16 data; 

17 (3) the persons and entities to whom, and pur18 poses for which, the covered entity discloses the cov19 ered data; and 

20 (4) a conspicuous, clear, and understandable 

21 means for individuals to access the methods nec22 essary to exercise their rights under sections 4 and 

23 5. 

24 SEC. 4. REQUIRED DATA PRACTICES. 

25 (a) REGULATIONS.—Not later than 1 year after the 

26 date of the enactment of this Act, the Commission shall 


pbinns on DSKJLVW7X2PROD with BILLS
7 

•HR 8749 IH

1 promulgate regulations under section 553 of title 5, 

2 United States Code, that require covered entities to imple3 ment, practice, and maintain certain data procedures and 

4 processes that meet the following requirements: 

5 (1) MINIMUM DATA PROCESSING REQUIRE6 MENTS.—Except as provided in subsection (b), re7 quire covered entities to meet all of the following re8 quirements regarding the means by and purposes for 

9 which covered data is collected, processed, stored, 

10 and disclosed: 

11 (A) REASONABLE.—Except as provided in 

12 paragraph (3), covered data collection, proc13 essing, storage, and disclosure practices must 

14 meet a reasonable interest of the covered entity, 

15 including— 

16 (i) business, educational, and adminis17 trative operations that are relevant and ap18 propriate to the context of the relationship 

19 between the covered entity and the indi20 vidual linked to the covered data; 

21 (ii) relevant and appropriate product 

22 and service development and enhancement; 

23 (iii) preventing and detecting abuse, 

24 fraud, and other criminal activity; 


pbinns on DSKJLVW7X2PROD with BILLS
8 

•HR 8749 IH

1 (iv) reasonable communications and 

2 marketing practices that follow best prac3 tices, rules, and ethical standards; 

4 (v) engaging in scientific, medical, or 

5 statistical research that follows commonly 

6 accepted ethical standards; or 

7 (vi) any other purpose for which the 

8 Commission considers to be reasonable. 

9 (B) EQUITABLE.—Covered data collection, 

10 processing, storage, and disclosure practices 

11 may not be for purposes that result in discrimi12 nation against a protected characteristic, in13 cluding— 

14 (i) discriminatory targeted advertising 

15 practices; 

16 (ii) price, service, or employment op17 portunity discrimination; or 

18 (iii) any other practice the Commis19 sion considers likely to result in unfair dis20 crimination against a protected char21 acteristic. 

22 (C) FORTHRIGHT.—Covered data collec23 tion, processing, storage, and disclosure prac24 tices may not be accomplished with means or 

25 for purposes that are deceptive, including— 


pbinns on DSKJLVW7X2PROD with BILLS
9 

•HR 8749 IH

1 (i) the use of inconspicuous recording 

2 or tracking devices and methods; 

3 (ii) the disclosure of covered data that 

4 a reasonable individual believes to be the 

5 content of a private communication with 

6 another party or parties; 

7 (iii) notices, interfaces, or other rep8 resentations likely to mislead consumers; 

9 or 

10 (iv) any other practice that the Com11 mission considers likely to mislead individ12 uals regarding the purposes for and means 

13 by which covered data is collected, proc14 essed, stored, or disclosed. 

15 (2) REQUIREMENTS FOR OPT-OUT CONSENT.— 

16 Except as provided in subsection (b), require covered 

17 entities to provide individuals with conspicuous ac18 cess to a method that is in easily understandable 

19 language, concise, accurate, clear, to opt out of any 

20 collection, processing, storage, or disclosure of cov21 ered data linked to the individual. 

22 (3) REQUIREMENTS FOR AFFIRMATIVE CON23 SENT.—Except as provided in subsection (b), require 

24 covered entities to provide individuals with a notice 

25 that is concise, in easily understandable language, 


pbinns on DSKJLVW7X2PROD with BILLS
10 

•HR 8749 IH

1 accurate, clear, timely, and conspicuous to express 

2 affirmative, opt-in consent— 

3 (A) before the covered entity collects or 

4 discloses sensitive data linked to the individual; 

5 or 

6 (B) before the covered entity collects, proc7 esses, stores, or discloses data for purposes 

8 which are outside the context of the relationship 

9 of the covered entity with the individual linked 

10 to the data, including— 

11 (i) the use of covered data beyond 

12 what is necessary to provide, improve, or 

13 market a good or service that the indi14 vidual requests; 

15 (ii) the processing or disclosure of 

16 covered data differs in material ways from 

17 the purposes described in the privacy pol18 icy that was in effect when the data was 

19 collected; and 

20 (iii) any other purpose that Commis21 sion considers outside of context. 

22 (4) DATA MINIMIZATION REQUIREMENTS.—Ex23 cept as provided in subsection (b), require covered 

24 entities to— 


pbinns on DSKJLVW7X2PROD with BILLS
11 

•HR 8749 IH

1 (A) take reasonable measures to limit the 

2 collection, processing, storage, and disclosure of 

3 covered data to the amount that is necessary to 

4 carry out the purposes for which the data is col5 lected; and 

6 (B) store covered data only as long as is 

7 reasonably necessary to carry out the purposes 

8 for which the data was collected. 

9 (b) EXEMPTIONS.—Subsection (a) shall not apply if 

10 the limitations on the collection, processing, storage, or 

11 disclosure of covered data would— 

12 (1) inhibit detection or prevention of a security 

13 risk or incident; 

14 (2) risk the health, safety, or property of the 

15 covered entity or individual; or 

16 (3) prevent compliance with an applicable law 

17 (including regulations) or legal process. 

18 SEC. 5. INDIVIDUAL CONTROL OVER DATA USE. 

19 (a) REGULATIONS.—Not later than 1 year after the 

20 date of the enactment of this Act, the Commission shall 

21 promulgate regulations under section 553 of title 5, 

22 United States Code, to require covered entities to provide 

23 conspicuous, understandable, clear, and free of charge 

24 method to— 


pbinns on DSKJLVW7X2PROD with BILLS
12 

•HR 8749 IH

1 (1) upon the request of an individual, provide 

2 the individual with access to, or an accurate rep3 resentation of, covered data linked to the individual 

4 or the individual’s device stored by the covered enti5 ty; 

6 (2) upon the request of an individual, provide 

7 the individual with a means to dispute and resolve 

8 the accuracy or completeness of the covered data 

9 linked to the individual or the individual’s device 

10 stored by the entity; 

11 (3) upon the request of an individual, delete 

12 any covered data that the covered entity stores 

13 linked to the individual or the individual’s device; 

14 and 

15 (4) when technically feasible, upon the request 

16 of an individual, allow the individual to transmit or 

17 transfer covered data linked to the individual or the 

18 individual’s device that is maintained by the entity 

19 to the individual in a format that is standardized 

20 and interoperable. 

21 (b) PSEUDONYMOUS DATA.—If the covered data that 

22 an individual has requested processed under subsection (a) 

23 is pseudonymous data, a covered entity may decline the 

24 request if processing the request is not technically feasible. 


pbinns on DSKJLVW7X2PROD with BILLS
13 

•HR 8749 IH

1 (c) TIMELINESS OF REQUESTS.—In fulfilling any re2 quests made by the individual under subsection (a) the 

3 covered entity shall act in as timely a manner as is reason4 ably possible. 

5 (d) ACCESS TO SAME SERVICE.—A covered entity 

6 shall not discriminate against an individual because of any 

7 action the individual took under their rights described in 

8 subsection (a), including— 

9 (1) denying goods or services to the individual; 

10 (2) charging, or advertising, different prices or 

11 rates for goods or services; or 

12 (3) providing different quality of goods or serv13 ices. 

14 (e) CONSIDERATION.—The Commission shall allow a 

15 covered entity, by contract, to provide relevant obligations 

16 to the individual under subsection (a) on behalf of a third 

17 party service provider that collects, processes, stores, or 

18 discloses covered data only on behalf of the covered entity. 

19 SEC. 6. INFORMATION SECURITY STANDARDS. 

20 (a) REQUIRED DATA SECURITY PRACTICES.— 

21 (1) REGULATIONS.—Not later than 1 year after 

22 the date of enactment of this Act, the Commission 

23 shall promulgate regulations under section 553 of 

24 title 5, United States Code, to require covered enti25 ties to establish and implement policies and proceVerDate Sep 11 2014 22:55 Nov 28, 2020 Jkt 019200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\H8749.IH H8749

pbinns on DSKJLVW7X2PROD with BILLS
14 

•HR 8749 IH

1 dures regarding information security practices for 

2 the treatment and protection of covered data taking 

3 into consideration— 

4 (A) the level of identifiability of the cov5 ered data and the associated privacy risk; 

6 (B) the sensitivity of the covered data col7 lected, processed, and stored and the associated 

8 privacy risk; 

9 (C) the currently available and widely ac10 cepted technological, administrative, and phys11 ical means to protect personal data under the 

12 control of the covered entity; 

13 (D) the cost associated with implementing, 

14 maintaining, and regularly reviewing the safe15 guards; and 

16 (E) the impact of these requirements on 

17 small and medium-sized businesses. 

18 (2) LIMITATIONS.—In promulgating the regula19 tions required under this section, the Commission 

20 shall consider a covered entity who is in compliance 

21 with existing information security laws that the 

22 Commission determines are sufficiently rigorous to 

23 be in compliance with this section with respect to 

24 particular types of covered data to the extent those 


pbinns on DSKJLVW7X2PROD with BILLS
15 

•HR 8749 IH

1 types of covered data are covered by such law, in2 cluding the following: 

3 (A) Title V of the Gramm-Leach-Bliley Act 

4 (15 U.S.C. 6801 et seq.). 

5 (B) The Health Information Technology 

6 for Economic and Clinical Health Act (42 

7 U.S.C. 17931). 

8 (C) The Health Insurance Portability and 

9 Accountability Act of 1996 Security Rule (45 

10 CFR 160.103 and part 164). 

11 (D) Any other existing law requiring a cov12 ered entity to implement and maintain informa13 tion security practices and procedures that the 

14 Commission determines to be sufficiently rig15 orous. 

16 SEC. 7. PRIVACY PROTECTION OFFICERS. 

17 (a) APPOINTMENT OF A PRIVACY PROTECTION OFFI18 CER.—Each covered entity with annual revenue in excess 

19 of $25,000,000 the prior year shall designate at least 1 

20 appropriately qualified employee as a privacy protection 

21 officer who shall— 

22 (1) educate employees about compliance re23 quirements; 

24 (2) train employees involved in data processing; 


pbinns on DSKJLVW7X2PROD with BILLS
16 

•HR 8749 IH

1 (3) conduct regular, comprehensive audits to 

2 ensure compliance and make records of the audits 

3 available to enforcement authorities upon request; 

4 (4) maintain updated, clear, and understand5 able records of all data security practices undertaken 

6 by the covered entity; 

7 (5) serve as the point of contact between the 

8 covered entity and enforcement authorities; and 

9 (6) advocate for policies and practices within 

10 the covered entity that promote individual privacy. 

11 (b) PROTECTIONS.—The privacy protection officer 

12 shall not be dismissed or otherwise penalized by the cov13 ered entity for performing any of the tasks assigned to 

14 the person under this section. 

15 SEC. 8. RESEARCH INTO PRIVACY ENHANCING TECH16 NOLOGY. 

17 Section 4(a) of the Cyber Security Research and De18 velopment Act (15 U.S.C. 7403(a)) is amended— 

19 (1) by striking the subsection heading and in20 serting the following: 

21 ‘‘(a) NETWORK SECURITY AND INFORMATION PRI22 VACY RESEARCH GRANTS.—’’; and 

23 (2) in paragraph (1), by striking subparagraph 

24 (D) and inserting the following: 


pbinns on DSKJLVW7X2PROD with BILLS
17 

•HR 8749 IH

1 ‘‘(D) privacy and confidentiality, includ2 ing— 

3 ‘‘(i) cryptography; 

4 ‘‘(ii) anonymization; 

5 ‘‘(iii) pseudonymization; 

6 ‘‘(iv) filtering tools; 

7 ‘‘(v) anti-spying and anti-tracking 

8 tools; and 

9 ‘‘(vi) any other technology that the 

10 Director determines will enhance individual 

11 privacy;’’. 

12 SEC. 9. ENFORCEMENT. 

13 (a) ENFORCEMENT BY THE COMMISSION.— 

14 (1) IN GENERAL.—Except as otherwise pro15 vided, this Act and the regulations prescribed under 

16 this Act shall be enforced by the Commission under 

17 the Federal Trade Commission Act (15 U.S.C. 41 et 

18 seq.). 

19 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC20 TICES.—A violation of this Act or a regulation pre21 scribed under this Act shall be treated as a violation 

22 of a rule defining an unfair or deceptive act or prac23 tice prescribed under section 18(a)(1)(B) of the Fed24 eral Trade Commission Act (15 U.S.C. 

25 57a(a)(1)(B)). 


pbinns on DSKJLVW7X2PROD with BILLS
18 

•HR 8749 IH

1 (3) ACTIONS BY THE COMMISSION.—Subject to 

2 paragraph (4), the Commission shall prevent any 

3 person from violating this Act or a regulation pre4 scribed under this Act in the same manner, by the 

5 same means, and with the same jurisdiction, powers, 

6 and duties as though all applicable terms and provi7 sions of the Federal Trade Commission Act (15 

8 U.S.C. 41 et seq.) were incorporated into and made 

9 a part of this Act, and any person who violates this 

10 Act or such regulation shall be subject to the pen11 alties and entitled to the privileges and immunities 

12 provided in the Federal Trade Commission Act (15 

13 U.S.C. 41 et seq.). 

14 (4) COMMON CARRIERS.—Notwithstanding sec15 tion 4, 5(a)(2), or 6 of the Federal Trade Commis16 sion Act (15 U.S.C. 44, 45(a)(2), and 46) or any ju17 risdictional limitation of the Commission, the Com18 mission shall also enforce this Act, in the same man19 ner provided in paragraphs (1), (2), and (3) with re20 spect to common carriers subject to the Communica21 tions Act of 1934 (47 U.S.C. 151 et seq.) and Acts 

22 amendatory thereof and supplementary thereto. 

23 (b) ENFORCEMENT BY STATE ATTORNEYS GEN24 ERAL.— 

25 (1) IN GENERAL.— 


pbinns on DSKJLVW7X2PROD with BILLS
19 

•HR 8749 IH

1 (A) CIVIL ACTIONS.—In any case in which 

2 the attorney general of a State has reason to 

3 believe that an interest of the residents of that 

4 State has been or is threatened or adversely af5 fected by the engagement of any person in a 

6 practice that violates this Act or a regulation 

7 prescribed under this Act, the State, as parens 

8 patriae, may bring a civil action on behalf of 

9 the residents of the State in a district court of 

10 the United States of appropriate jurisdiction 

11 to— 

12 (i) enjoin that practice; 

13 (ii) enforce compliance with this Act 

14 or such regulation; 

15 (iii) obtain damages, restitution, or 

16 other compensation on behalf of residents 

17 of the State; 

18 (iv) impose a civil penalty in an 

19 amount that is not greater than the prod20 uct of the number of individuals whose in21 formation was affected by a violation and 

22 $40,000; or 

23 (v) obtain such other relief as the 

24 court may consider to be appropriate. 


pbinns on DSKJLVW7X2PROD with BILLS
20 

•HR 8749 IH

1 (B) ADJUSTMENT FOR INFLATION.—Be2 ginning on the date that the Consumer Price 

3 Index is first published by the Bureau of Labor 

4 Statistics that is after 1 year after the date of 

5 enactment of this Act, and each year thereafter, 

6 the amounts specified in subparagraph (A)(iv) 

7 shall be increased by the percentage increase in 

8 the Consumer Price Index published on that 

9 date from the Consumer Price Index published 

10 the previous year. 

11 (C) NOTICE.— 

12 (i) IN GENERAL.—Before filing an ac13 tion under subparagraph (A), the attorney 

14 general of the State involved shall provide 

15 to the Commission— 

16 (I) written notice of that action; 

17 and 

18 (II) a copy of the complaint for 

19 that action. 

20 (ii) EXEMPTION.— 

21 (I) IN GENERAL.—Clause (i) 

22 shall not apply with respect to the fil23 ing of an action by an attorney gen24 eral of a State under this paragraph 

25 if the attorney general determines 


pbinns on DSKJLVW7X2PROD with BILLS
21 

•HR 8749 IH

1 that it is not feasible to provide the 

2 notice described in that clause before 

3 the filing of the action. 

4 (II) NOTIFICATION.—In an ac5 tion described in subclause (I), the at6 torney general of a State shall provide 

7 notice and a copy of the complaint to 

8 the Commission at the same time as 

9 the attorney general files the action. 

10 (c) RIGHTS OF THE COMMISSION.— 

11 (1) INTERVENTION BY THE COMMISSION.—The 

12 Commission may intervene in any civil action 

13 brought by the attorney general of a State under 

14 subsection (b) and upon intervening— 

15 (A) be heard on all matters arising in the 

16 civil action; and 

17 (B) file petitions for appeal of a decision in 

18 the civil action. 

19 (2) POWERS.—Nothing in this subsection may 

20 be construed to prevent the attorney general of a 

21 State from exercising the powers conferred on the 

22 attorney general by the laws of the State to conduct 

23 investigations, to administer oaths or affirmations, 

24 or to compel the attendance of witnesses or the pro25 duction of documentary or other evidence. 


pbinns on DSKJLVW7X2PROD with BILLS
22 

•HR 8749 IH

1 (3) ACTION BY THE COMMISSION.—If the Com2 mission institutes a civil action for violation of this 

3 title or a regulation promulgated under this title, no 

4 attorney general of a State may bring a civil action 

5 under subsection (b) against any defendant named 

6 in the complaint of the Commission for violation of 

7 this Act or a regulation promulgated under this Act 

8 that is alleged in the complaint. 

9 (d) VENUE AND SERVICE OF PROCESS.— 

10 (1) VENUE.—Any action brought under sub11 section (b) may be brought in— 

12 (A) the district court of the United States 

13 that meets applicable requirements relating to 

14 venue under section 1391 of title 28, United 

15 States Code; or 

16 (B) another court of competent jurisdic17 tion. 

18 (2) SERVICE OF PROCESS.—In an action 

19 brought under subsection (b), process may be served 

20 in any district in which the defendant— 

21 (A) is an inhabitant; or 

22 (B) may be found. 

23 (e) ACTION OF OTHER STATE OFFICIALS.— 

24 (1) IN GENERAL.—In addition to civil actions 

25 brought by attorneys general under subsection (b), 


pbinns on DSKJLVW7X2PROD with BILLS
23 

•HR 8749 IH

1 any other officer of a State who is authorized by the 

2 State to do so may bring a civil action under sub3 section (b), subject to the same requirements and 

4 limitations that apply under this subsection to civil 

5 actions brought by attorneys general. 

6 (2) SAVINGS PROVISION.—Nothing in this sub7 section may be construed to prohibit an authorized 

8 official of a State from initiating or continuing any 

9 proceeding in a court of the State for a violation of 

10 any civil or criminal law of the State. 

11 (f) PRESERVATION OF AUTHORITY.—Nothing in this 

12 Act shall be construed to limit the authority of the Federal 

13 Trade Commission under any other provision of law. 

14 SEC. 10. ADDITIONAL ENFORCEMENT RESOURCES. 

15 (a) IN GENERAL.—Notwithstanding any other provi16 sion of law the Commission may, without regard to the 

17 civil service laws (including regulations), appoint not more 

18 than 300 additional personnel for the purposes of enforc19 ing privacy and data security laws and regulations. 

20 (b) AUTHORIZATION OF APPROPRIATIONS.—There is 

21 authorized to be appropriated to the Commission such 

22 sums as may be necessary to carry out this section. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS