I 

111TH CONGRESS 

2D SESSION H. R. 5777 

To foster transparency about the commercial use of personal information, 

provide consumers with meaningful choice about the collection, use, and 

disclosure of such information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 19, 2010 

Mr. RUSH introduced the following bill; which was referred to the Committee 

on Energy and Commerce 

A BILL 

To foster transparency about the commercial use of personal 

information, provide consumers with meaningful choice 

about the collection, use, and disclosure of such information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Building Effective Strategies To Promote Responsibility 

6 Accountability Choice Transparency Innovation Consumer 

7 Expectations and Safeguards Act’’ or the ‘‘BEST PRAC8 TICES Act’’. 


pwalker on DSK8KYBLC1PROD with BILLS
2 

•HR 5777 IH

1 (b) TABLE OF CONTENTS.—The table of contents for 

2 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2 Definitions. 

TITLE I—TRANSPARENCY, NOTICE, AND INDIVIDUAL CHOICE 

Sec. 101. Information to be made available. 

Sec. 102. Provision of notice or notices. 

Sec. 103. Opt-out consent required for collection and use of covered information 

by a covered entity. 

Sec. 104. Express affirmative consent. 

Sec. 105. Material changes to privacy practices. 

Sec. 106. Exceptions. 

TITLE II—ACCURACY, ACCESS, AND DISPUTE RESOLUTION 

Sec. 201. Accuracy. 

Sec. 202. Access and dispute resolution. 

TITLE III—DATA SECURITY, DATA MINIMIZATION, AND 

ACCOUNTABILITY 

Sec. 301. Data security. 

Sec. 302. Accountability. 

Sec. 303. Data minimization obligations. 

TITLE IV—SAFE HARBOR AND SELF-REGULATORY CHOICE 

PROGRAM 

Sec. 401. Safe harbor. 

Sec. 402. Approval by the Federal Trade Commission. 

Sec. 403. Requirements of self-regulatory program. 

Sec. 404. Rulemaking. 

TITLE V—EXEMPTIONS 

Sec. 501. Use of aggregate or deidentified information. 

Sec. 502. Activities covered by other Federal privacy laws. 

TITLE VI—APPLICATION AND ENFORCEMENT 

Sec. 601. General application. 

Sec. 602. Enforcement by the Federal Trade Commission. 

Sec. 603. Enforcement by State attorneys general. 

Sec. 604. Private right of action. 

Sec. 605. Effect on other laws. 

TITLE VII—MISCELLANEOUS PROVISIONS 

Sec. 701. Review. 

Sec. 702. Consumer and business education campaign. 

Sec. 703. Effective date. 

Sec. 704. Severability. 


pwalker on DSK8KYBLC1PROD with BILLS
3 

•HR 5777 IH

1 SEC. 2. DEFINITIONS. 

2 As used in this Act, the following definitions apply: 

3 (1) AGGREGATE INFORMATION.—The term ‘‘ag4 gregate information’’ means data that relates to a 

5 group or category of services or individuals, from 

6 which all information identifying an individual has 

7 been removed. 

8 (2) COMMISSION.—The term ‘‘Commission’’ 

9 means the Federal Trade Commission. 

10 (3) COVERED ENTITY.—The term ‘‘covered en11 tity’’ means a person engaged in interstate com12 merce that collects or stores data containing covered 

13 information or sensitive information. Such term does 

14 not include— 

15 (A) the Federal Government or any instru16 mentality of the Federal Government, nor the 

17 government of any State or political subdivision 

18 of a State; or 

19 (B) any person that can demonstrate that 

20 such person— 

21 (i) stores covered information from or 

22 about fewer than 15,000 individuals; 

23 (ii) collects covered information from 

24 or about fewer than 10,000 individuals 

25 during any 12-month period; 


pwalker on DSK8KYBLC1PROD with BILLS
4 

•HR 5777 IH

1 (iii) does not collect or store sensitive 

2 information; and 

3 (iv) does not use covered information 

4 to study, monitor, or analyze the behavior 

5 of individuals as the person’s primary busi6 ness. 

7 (4) COVERED INFORMATION.— 

8 (A) IN GENERAL.—The term ‘‘covered in9 formation’’ means, with respect to an indi10 vidual, any of the following: 

11 (i) the first name or initial and last 

12 name; 

13 (ii) a postal address; 

14 (iii) an email address; 

15 (iv) a telephone or fax number; 

16 (v) a tax identification number, pass17 port number, driver’s license number, or 

18 any other unique government-issued identi19 fication number; 

20 (vi) a financial account number, or 

21 credit card or debit card number, or any 

22 required security code, access code, or 

23 password that is necessary to permit ac24 cess to an individual’s financial account; 


pwalker on DSK8KYBLC1PROD with BILLS
5 

•HR 5777 IH

1 (vii) any unique persistent identifier, 

2 such as a customer number, unique pseu3 donym or user alias, IP address, or other 

4 unique identifier, where such identifier is 

5 used to collect, store or identify informa6 tion about a specific individual or to create 

7 or maintain a preference profile; or 

8 (viii) any other information that is 

9 collected, stored, used, or disclosed in con10 nection with any covered information de11 scribed in clauses (i) through (vii). 

12 (B) EXCLUSION.—Such term shall not in13 clude— 

14 (i) the title, business address, business 

15 email address, business telephone number, 

16 or business fax number associated with an 

17 individual’s status as an employee of an or18 ganization, or an individual’s name when 

19 collected, stored, used, or disclosed in con20 nection with such employment status; or 

21 (ii) any information collected from or 

22 about an employee by an employer, pro23 spective employer, or former employer that 

24 directly relates to the employee-employer 

25 relationship. 


pwalker on DSK8KYBLC1PROD with BILLS
6 

•HR 5777 IH

1 (5) OPERATIONAL PURPOSE.— 

2 (A) IN GENERAL.—The term ‘‘operational 

3 purpose’’ means a purpose reasonably necessary 

4 to facilitate, improve, or safeguard the logistical 

5 or technical ability of a covered entity to pro6 vide goods or services, manage its operations, 

7 comply with legal obligations, or protect against 

8 risks and threats, including— 

9 (i) providing, operating, or improving 

10 a product or service used, requested, or au11 thorized by an individual, including the on12 going provision of customer service and 

13 support; 

14 (ii) analyzing data related to use of 

15 the product or service for purposes of im16 proving the covered entity’s products, serv17 ices, or operations; 

18 (iii) basic business functions such as 

19 accounting, inventory and supply chain 

20 management, quality assurance, and inter21 nal auditing; 

22 (iv) protecting or defending the rights 

23 or property, including intellectual property, 

24 of the covered entity against actual or po25 tential security threats, fraud, theft, unauVerDate Mar 15 2010 02:08 Jul 20, 2010 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H5777.IH H5777

pwalker on DSK8KYBLC1PROD with BILLS
7 

•HR 5777 IH

1 thorized transactions, or other illegal ac2 tivities; 

3 (v) preventing imminent danger to the 

4 personal safety of an individual or group of 

5 individuals; 

6 (vi) complying with a Federal, State, 

7 or local law, rule, or other applicable legal 

8 requirement, including disclosures pursu9 ant to a court order, subpoena, summons, 

10 or other properly executed compulsory 

11 process; and 

12 (vii) any other category of operational 

13 use specified by the Commission by regula14 tion that is consistent with the purposes of 

15 this Act. 

16 (B) EXCLUSION.—Such term shall not in17 clude— 

18 (i) the use of covered information for 

19 marketing or advertising purposes, or any 

20 use of or disclosure of covered information 

21 to a third party for such purposes; or 

22 (ii) the use of covered information for 

23 a purpose that an individual acting reason24 ably under the circumstances would not ex25 pect based on the product or service used, 


pwalker on DSK8KYBLC1PROD with BILLS
8 

•HR 5777 IH

1 requested, or authorized by the individual 

2 and, if known to the individual, would like3 ly affect the individual’s conduct or deci4 sions with respect to the covered entity’s 

5 products or services. 

6 (6) PREFERENCE PROFILE.—The term ‘‘pref7 erence profile’’ means a list of preferences, cat8 egories of information, or interests— 

9 (A) associated with an individual or with 

10 an individual’s computer or other device; 

11 (B) inferred from the actual behavior of 

12 the individual, the actual use of the individual’s 

13 computer or other device, or information sup14 plied directly by the individual or other user of 

15 a computer or other device; and 

16 (C) compiled and maintained for the pur17 pose of marketing or purposes related to mar18 keting, advertising, or sales. 

19 (7) PUBLICLY AVAILABLE INFORMATION.— 

20 (A) IN GENERAL.—The term ‘‘publicly 

21 available information’’ means any covered infor22 mation or sensitive information that a covered 

23 entity has a reasonable basis to believe is law24 fully made available to the general public 

25 from— 


pwalker on DSK8KYBLC1PROD with BILLS
9 

•HR 5777 IH

1 (i) Federal, State, or local government 

2 records; 

3 (ii) widely distributed media; or 

4 (iii) disclosures to the general public 

5 that are required to be made by Federal, 

6 State, or local law. 

7 (B) CONSTRUCTION.—A covered entity has 

8 a reasonable basis to believe that information is 

9 lawfully made available to the general public if 

10 the covered entity has taken steps to deter11 mine— 

12 (i) that the information is of a type 

13 that is available to the general public; and 

14 (ii) whether an individual can direct 

15 that the information not be made available 

16 to the general public and, if so, that the 

17 individual has not done so. 

18 (8) SENSITIVE INFORMATION.— 

19 (A) DEFINITION.—The term ‘‘sensitive in20 formation’’ means— 

21 (i) any information that is associated 

22 with covered information of an individual 

23 and relates directly to that individual’s— 


pwalker on DSK8KYBLC1PROD with BILLS
10 

•HR 5777 IH

1 (I) medical history, physical or 

2 mental health, or the provision of 

3 health care to the individual; 

4 (II) race or ethnicity; 

5 (III) religious beliefs and affili6 ation; 

7 (IV) sexual orientation or sexual 

8 behavior; 

9 (V) income, assets, liabilities, or 

10 financial records, and other financial 

11 information associated with a finan12 cial account, including balances and 

13 other financial information, except 

14 when financial account information is 

15 provided by the individual and is used 

16 only to process an authorized credit or 

17 debit to the account; or 

18 (VI) precise geolocation informa19 tion and any information about the 

20 individual’s activities and relationships 

21 associated with such geolocation; or 

22 (ii) an individual’s— 

23 (I) unique biometric data, includ24 ing a fingerprint or retina scan; or 

25 (II) Social Security number. 


pwalker on DSK8KYBLC1PROD with BILLS
11 

•HR 5777 IH

1 (B) MODIFIED DEFINITION BY RULE2 MAKING.—The Commission may, by regulations 

3 promulgated under section 553 of title 5, 

4 United States Code, modify the scope or appli5 cation of the definition of ‘‘sensitive informa6 tion’’ for purposes of this Act. In promulgating 

7 such regulations, the Commission shall con8 sider— 

9 (i) the purposes of the collection of 

10 the information and the context of the use 

11 of the information; 

12 (ii) how easily the information can be 

13 used to identify a specific individual; 

14 (iii) the nature and extent of author15 ized access to the information; 

16 (iv) an individual’s reasonable expec17 tations under the circumstances; and 

18 (v) adverse effects that may be experi19 enced by an individual if the information is 

20 disclosed to an unauthorized person. 

21 (9) SERVICE PROVIDER.—The term ‘‘service 

22 provider’’ means an entity that collects, maintains, 

23 processes, stores, or otherwise handles covered infor24 mation or sensitive information on behalf of a cov25 ered entity, including, for the purposes of serving as 


pwalker on DSK8KYBLC1PROD with BILLS
12 

•HR 5777 IH

1 a data processing center, distributing the informa2 tion, providing customer support, maintaining the 

3 covered entity’s records, information technology 

4 management, website or other hosting service, fraud 

5 detection, authentication, and other verification serv6 ices, or performing other administrative support 

7 functions for the covered entity. 

8 (10) THIRD PARTY.— 

9 (A) IN GENERAL.—The term ‘‘third party’’ 

10 means, with respect to any covered entity, a 

11 person that— 

12 (i) is not related to the covered entity 

13 by common ownership or corporate control; 

14 or 

15 (ii) is a business unit or corporate en16 tity that holds itself out to the public as 

17 separate from the covered entity, such that 

18 an individual acting reasonably under the 

19 circumstances would not expect it to be re20 lated to the covered entity or to have ac21 cess to covered information the individual 

22 provides to that covered entity. 

23 (B) COLLECTION OF INFORMATION BY

24 MULTIPLE SOURCES.—For the purpose of this 

25 definition, where multiple persons collect covVerDate Mar 15 2010 02:08 Jul 20, 2010 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H5777.IH H5777

pwalker on DSK8KYBLC1PROD with BILLS
13 

•HR 5777 IH

1 ered information or sensitive information from 

2 or about visitors to an online or mobile service, 

3 including a website, all such persons other than 

4 the operator or publisher of the online or mobile 

5 service or website shall be considered third par6 ties unless— 

7 (i) the person meets the requirements 

8 of the service provider exception in section 

9 106(1); or 

10 (ii) the person otherwise does not sat11 isfy the requirements for a third party pur12 suant to the regulations implemented pur13 suant to subparagraph (C). 

14 (C) RULEMAKING.—Not later than 18 

15 months after the date of the enactment of this 

16 Act, the Commission shall promulgate regula17 tions under section 553 of title 5, United States 

18 Code, to clarify or modify the definition of third 

19 party for purposes of this Act. In promulgating 

20 such regulations, the Commission shall con21 sider— 

22 (i) the brand or brands associated 

23 with a covered entity; 

24 (ii) the scope and nature of the busi25 nesses engaged in by a covered entity and 


pwalker on DSK8KYBLC1PROD with BILLS
14 

•HR 5777 IH

1 a third party, including the nature of the 

2 products or services offered by the covered 

3 entity and third party; and 

4 (iii) the relationship between a cov5 ered entity and a third party, taking into 

6 account such factors as ownership and con7 trol. 

8 TITLE I—TRANSPARENCY, NO9 TICE, AND INDIVIDUAL 

10 CHOICE 

11 SEC. 101. INFORMATION TO BE MADE AVAILABLE. 

12 A covered entity shall, in accordance with the regula13 tions issued under section 102, make available to individ14 uals whose covered information or sensitive information it 

15 collects or maintains the following information about its 

16 information privacy practices and an individual’s options 

17 with regard to such practices: 

18 (1) The identity of the covered entity. 

19 (2) A description of any covered information or 

20 sensitive information collected or stored by the cov21 ered entity. 

22 (3) The specific purposes for which the covered 

23 entity collects and uses the covered information or 

24 sensitive information, including disclosure as to 

25 whether and how the covered entity customizes prodVerDate Mar 15 2010 02:08 Jul 20, 2010 Jkt 089200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\H5777.IH H5777

pwalker on DSK8KYBLC1PROD with BILLS
15 

•HR 5777 IH

1 ucts or services or changes the prices of products or 

2 services based, in whole or in part, on covered infor3 mation or sensitive information about individual cus4 tomers or users. 

5 (4) The specific purposes for which covered in6 formation or sensitive information may be disclosed 

7 to a third party and the categories of third parties 

8 who may receive such information for each such pur9 pose. 

10 (5) The choice and means the covered entity of11 fers individuals for limiting the collection, use, and 

12 disclosure of covered information or sensitive infor13 mation, in accordance with sections 103 and 104. 

14 (6) A description of the information for which 

15 an individual may request access and the means to 

16 request such access, in accordance with section 202. 

17 (7) How the covered entity may merge, link, or 

18 combine covered information or sensitive information 

19 collected from the individual with other information 

20 about the individual that the covered entity may ac21 quire from third parties. 

22 (8) The retention schedule for covered informa23 tion and sensitive information in days, months, or 

24 years, or a statement that the covered entity will re25 tain such information indefinitely or permanently. 


pwalker on DSK8KYBLC1PROD with BILLS
16 

•HR 5777 IH

1 (9) Whether or not an individual has the right 

2 to direct the covered entity to delete information col3 lected from or about the individual. 

4 (10) A reasonable means by which an individual 

5 may contact the covered entity with any inquiries or 

6 complaints regarding the covered entity’s practices 

7 concerning the collection, use, disclosure, or handling 

8 of the individual’s covered information or sensitive 

9 information in accordance with section 302(a). 

10 (11) The process by which the covered entity 

11 notifies individuals of material changes to its policies 

12 and practices. 

13 (12) A hyperlink to or a listing of the Commis14 sion’s online consumer complaint form or the toll15 free number for the Commission’s Consumer Re16 sponse Center. 

17 (13) The effective date of the privacy notice. 

18 SEC. 102. PROVISION OF NOTICE OR NOTICES. 

19 (a) IN GENERAL.—It shall be unlawful for a covered 

20 entity to collect, use, or disclose covered information or 

21 sensitive information unless it provides the information set 

22 forth in section 101 in concise, meaningful, timely, promi23 nent, and easy-to-understand notice or notices, in accord24 ance with the regulations issued by the Commission under 

25 subsection (b). 


pwalker on DSK8KYBLC1PROD with BILLS
17 

•HR 5777 IH

1 (b) RULEMAKING.—Not later than 18 months after 

2 the date of the enactment of this Act, the Commission 

3 shall promulgate regulations under section 553 of title 5, 

4 United States Code, to implement this section. In promul5 gating such regulations, the Commission— 

6 (1) shall determine the means and timing of the 

7 notices required under this section, taking into ac8 count the different media, devices, or methods 

9 through which the covered entity collects covered in10 formation or sensitive information; 

11 (2) shall have the authority to allow for, or re12 quire, the provision of short notices or limited disclo13 sures that do not include all of the information set 

14 forth in section 101, if the Commission by regula15 tion— 

16 (A) requires the information to be other17 wise clearly and conspicuously disclosed or 

18 available to individuals; and 

19 (B) determines that the provision of such 

20 short notices or limited disclosures will accom21 plish the purposes of this Act to enhance trans22 parency and provide individuals with meaning23 ful choice regarding the collection, use, and dis24 closure of their covered information or sensitive 

25 information; 


pwalker on DSK8KYBLC1PROD with BILLS
18 

•HR 5777 IH

1 (3) shall consider— 

2 (A) whether the notice or notices provide 

3 individuals with timely, effective, and meaning4 ful notice that will enable an individual to un5 derstand relevant information and make in6 formed choices; 

7 (B) whether providing notice to individuals 

8 prior to or contemporaneously with the collec9 tion of covered information is practical or rea10 sonable under the circumstances; 

11 (C) the costs of implementing the pre12 scribed notice or notices; 

13 (D) the different media and context 

14 through which covered information is collected; 

15 (E) whether it is reasonable and appro16 priate under the circumstances for a third party 

17 or a service provider to be responsible for pro18 viding notice and obtaining consent as required 

19 by this title in lieu of a covered entity; and 

20 (F) the risk to consumers and commerce of 

21 over-notification; and 

22 (4) may issue model notices. 

23 (c) EXCLUSION FROM NOTICE REQUIREMENTS.— 


pwalker on DSK8KYBLC1PROD with BILLS
19 

•HR 5777 IH

1 (1) TRADE SECRET INFORMATION.—Nothing in 

2 this section shall require a covered entity to reveal 

3 confidential, trade secret, or proprietary information. 

4 (2) IN-PERSON TRANSACTIONS.—Notice under 

5 this section shall not be required for in-person collec6 tion of covered information if— 

7 (A) the covered information is collected for 

8 an operational purpose; or 

9 (B) the covered entity only is collecting the 

10 name, address, email address, telephone or fax 

11 number of an individual and does not— 

12 (i) share the covered information with 

13 third parties; or 

14 (ii) use the covered information to ac15 quire additional information about the in16 dividual from third parties. 

17 (d) RETENTION.—A covered entity shall retain copies 

18 of the notice or notices issued pursuant to this section for 

19 a period of 6 years after the date on which such notice 

20 was issued or the date when it was last in effect, whichever 

21 is later, unless the Commission determines pursuant to the 

22 rulemaking required under subsection (b) that such reten23 tion is not practical under the circumstances. 


pwalker on DSK8KYBLC1PROD with BILLS
20 

•HR 5777 IH

1 SEC. 103. OPT-OUT CONSENT REQUIRED FOR COLLECTION 

2 AND USE OF COVERED INFORMATION BY A 

3 COVERED ENTITY. 

4 (a) IN GENERAL.—Except as provided in subsections 

5 (e) and (f) and section 106, it shall be unlawful for a cov6 ered entity to collect or use covered information about an 

7 individual without the consent of that individual, as set 

8 forth in this section. A covered entity shall be considered 

9 to have the consent of an individual for the collection and 

10 use of covered information about the individual if— 

11 (1) the covered entity has provided to the indi12 vidual notice required under section 102 and its im13 plementing regulations; 

14 (2) the covered entity provides the individual 

15 with a reasonable means to exercise an opt-out right 

16 and decline consent for such collection and use; and 

17 (3) the individual either affirmatively grants 

18 consent for such collection and use or does not de19 cline consent at the time notice is presented or made 

20 available to the individual. 

21 (b) DURATION OF INDIVIDUAL’S OPT-OUT.—An indi22 vidual’s direction to opt out under this section is effective 

23 permanently, unless otherwise directed by the individual. 

24 (c) SUBSEQUENT OPT-OUT.—A covered entity shall 

25 provide an individual with a reasonable means to decline 

26 consent or revoke previously granted consent at any time. 


pwalker on DSK8KYBLC1PROD with BILLS
21 

•HR 5777 IH

1 (d) MORE DETAILED OPTIONS.—A covered entity 

2 may comply with this section by enabling an individual 

3 to decline consent for specific uses of his or her covered 

4 information, provided the individual has been given the op5 portunity to decline consent for the collection and use of 

6 covered information for all purposes, other than for an 

7 operational purpose excepted by subsection (e), for which 

8 covered information may be collected and used by the cov9 ered entity. 

10 (e) EXCEPTION FOR OPERATIONAL PURPOSES.— 

11 This section shall not apply to the collection or use of cov12 ered information for an operational purpose. 

13 (f) COLLECTION AND USE AS A CONDITION OF SERV14 ICE.—Nothing in this section shall prohibit a covered enti15 ty from requiring, as a condition of an individual’s receipt 

16 of a service or other benefit, including the receipt of an 

17 enhanced or premium version of a product or service oth18 erwise available, the reasonable collection and use of cov19 ered information about the individual, provided that— 

20 (1) the covered entity has a direct relationship 

21 with the individual; 

22 (2) the covered information is not shared with 

23 any third party except with the express affirmative 

24 consent as set forth in section 104; 


pwalker on DSK8KYBLC1PROD with BILLS
22 

•HR 5777 IH

1 (3) the covered entity provides a clear, promi2 nent, and specific statement describing the specific 

3 purpose or purposes for which covered information 

4 may be used pursuant to section 101; 

5 (4) the individual provides consent by acknowl6 edging the specific uses set forth in the clear and 

7 prominent statement required under paragraph (3) 

8 as part of receiving the service or other benefit from 

9 the covered entity; and 

10 (5) the individual is able to later withdraw con11 sent for the use by canceling the service or otherwise 

12 indicating that he or she no longer wishes to receive 

13 the service or other benefit. 

14 SEC. 104. EXPRESS AFFIRMATIVE CONSENT. 

15 (a) DISCLOSURE OF COVERED INFORMATION TO

16 THIRD PARTIES.— 

17 (1) DISCLOSURE PROHIBITED.—Except as pro18 vided in section 106 and subject to title IV of this 

19 Act, it shall be unlawful for a covered entity to dis20 close covered information about an individual to a 

21 third party unless the covered entity has received ex22 press affirmative consent from the individual prior 

23 to the disclosure. 

24 (2) EXCEPTION FOR JOINT MARKETING.—Ex25 press affirmative consent shall not be required for 


pwalker on DSK8KYBLC1PROD with BILLS
23 

•HR 5777 IH

1 any disclosure related to the performance of joint 

2 marketing, if the covered entity and the third party 

3 enter into a contractual agreement prohibiting the 

4 third party from disclosing or using the covered in5 formation except as necessary to carry out the joint 

6 marketing relationship. 

7 (b) COLLECTION, USE, OR DISCLOSURE OF SEN8 SITIVE INFORMATION.—Except as provided in section 

9 106, a covered entity may not collect, use, or disclose sen10 sitive information from or about an individual for any pur11 pose unless the covered entity obtains the express affirma12 tive consent of the individual. 

13 (c) COMPREHENSIVE ONLINE DATA COLLECTION.— 

14 A covered entity may not use hardware or software to 

15 monitor all or substantially all of the individual’s Internet 

16 browsing or other significant class of Internet or computer 

17 activity and collect, use, or disclose information concerning 

18 such activity, except— 

19 (1) with the express affirmative consent of the 

20 individual; 

21 (2) for the purpose of making such information 

22 accessible to the individual or for use by the indi23 vidual; or 

24 (3) as provided in section 106. 


pwalker on DSK8KYBLC1PROD with BILLS
24 

•HR 5777 IH

1 (d) LIMITATION.—A third party that receives covered 

2 information or sensitive information from a covered entity 

3 pursuant to this section shall only use such information 

4 for the specific purposes authorized by the individual when 

5 the individual granted express affirmative consent for the 

6 disclosure of the information to a third party. 

7 (e) REVOCATION OF CONSENT.—A covered entity 

8 that has obtained the express affirmative consent of an 

9 individual pursuant to this section and section 105 shall 

10 provide the individual with a reasonable means, without 

11 charge, to withdraw consent at any time thereafter. 

12 SEC. 105. MATERIAL CHANGES TO PRIVACY PRACTICES. 

13 (a) RETROACTIVE APPLICATION.—A covered entity 

14 shall provide the notice required by section 102 and obtain 

15 the express affirmative consent of the individual prior to 

16 making a material change in privacy practices governing 

17 previously collected covered information or sensitive infor18 mation from that individual. 

19 (b) PROSPECTIVE APPLICATION.—A covered entity 

20 shall not make material changes to its privacy practices 

21 governing the collection, use, or disclosure of covered in22 formation or sensitive information that has not been pre23 viously collected unless, 30 days before the effective date 

24 of the material change— 


pwalker on DSK8KYBLC1PROD with BILLS
25 

•HR 5777 IH

1 (1) the covered entity provides individuals with 

2 notice of the material change in accordance with sec3 tion 102; and 

4 (2) if required by sections 103 and 104, obtains 

5 the individual’s consent to the material change or al6 lows the individual to terminate the individual’s rela7 tionship with the covered entity. 

8 SEC. 106. EXCEPTIONS. 

9 The consent requirements of sections 103 and 104 

10 shall not apply to the following: 

11 (1) SERVICE PROVIDERS.— 

12 (A) When a covered entity discloses cov13 ered information or sensitive information to a 

14 service provider performing services or func15 tions on behalf of and under the instruction of 

16 the covered entity, provided— 

17 (i) the covered entity obtained the re18 quired consent for the initial collection of 

19 such information and provided notice as 

20 required by section 102; 

21 (ii) the covered entity enters into a 

22 contractual agreement that prohibits the 

23 service provider from using or disclosing 

24 the information other than to carry out the 


pwalker on DSK8KYBLC1PROD with BILLS
26 

•HR 5777 IH

1 purposes for which the information was 

2 disclosed; and 

3 (iii) in such cases, the covered entity 

4 remains responsible and liable for the pro5 tection of covered information and sensitive 

6 information that has been transferred to a 

7 service provider for processing. 

8 (B) When a service provider subsequently 

9 discloses the information to another service pro10 vider in order to perform the same services or 

11 functions described in paragraph (1) on behalf 

12 of the covered entity. 

13 (2) FRAUD DETECTION.—Collection, use, or 

14 disclosure necessary to protect or defend the rights 

15 or property, including intellectual property, of the 

16 covered entity against actual or potential security 

17 threats, fraud, theft, unauthorized transactions, or 

18 other illegal activities. 

19 (3) IMMINENT DANGER.—Collection, use, or 

20 disclosure necessary to prevent imminent danger to 

21 the personal safety of an individual or group of indi22 viduals. 

23 (4) COMPLIANCE WITH LAW.—Collection, use, 

24 or disclosure required in order to comply with a Fed25 eral, State, or local law, rule, or other applicable 


pwalker on DSK8KYBLC1PROD with BILLS
27 

•HR 5777 IH

1 legal requirement, including disclosures pursuant to 

2 subpoena, summons, or other properly executed com3 pulsory process. 

4 (5) PUBLICLY AVAILABLE INFORMATION.—Col5 lection, use, or disclosure of publicly available infor6 mation, except that a covered entity may not use 

7 publicly available information about an individual for 

8 marketing purposes if the individual has opted out 

9 of the use by such covered entity of covered informa10 tion or sensitive information for marketing purposes. 

11 TITLE II—ACCURACY, ACCESS, 

12 AND DISPUTE RESOLUTION 

13 SEC. 201. ACCURACY. 

14 (a) REASONABLE PROCEDURES.—Each covered enti15 ty shall establish reasonable procedures to assure the ac16 curacy of the covered information or sensitive information 

17 it collects, assembles, or maintains. Not later than 18 

18 months after the date of the enactment of this Act, the 

19 Commission shall promulgate regulations under section 

20 553 of title 5, United States Code, to implement this sec21 tion. In promulgating such regulations, the Commission 

22 shall consider— 

23 (1) the costs and benefits of ensuring the accu24 racy of the information; 

25 (2) the sensitivity of the information; 


pwalker on DSK8KYBLC1PROD with BILLS
28 

•HR 5777 IH

1 (3) the purposes for which the information will 

2 be used; and 

3 (4) the harms from misuse of the information. 

4 (b) LIMITED EXCEPTION FOR FRAUD DATABASES.— 

5 The requirement in subsection (a) shall not prevent the 

6 collection or maintenance of information that may be inac7 curate with respect to a particular individual when that 

8 information is being collected or maintained solely— 

9 (1) for the purpose of indicating whether there 

10 may be a discrepancy or irregularity in the covered 

11 information or sensitive information that is associ12 ated with an individual; and 

13 (2) to help identify, or authenticate the identity 

14 of, an individual, or to protect against or investigate 

15 fraud or other unlawful conduct. 

16 (c) LIMITED EXCEPTION FOR PUBLICLY AVAILABLE

17 INFORMATION.—Subject to section 202, a covered entity 

18 shall not be required to verify the accuracy of publicly 

19 available information if the covered entity has reasonable 

20 procedures to ensure that the publicly available informa21 tion assembled or maintained by the covered entity accu22 rately reflects the information available to the general 

23 public. 


pwalker on DSK8KYBLC1PROD with BILLS
29 

•HR 5777 IH

1 SEC. 202. ACCESS AND DISPUTE RESOLUTION. 

2 (a) ACCESS AND CORRECTION.—A covered entity 

3 shall, upon request, provide an individual with reasonable 

4 access to, and the ability to dispute the accuracy or com5 pleteness of, covered information or sensitive information 

6 about that individual if such information may be used for 

7 purposes that could result in an adverse decision against 

8 the individual, including the denial of a right, benefit, or 

9 privilege. 

10 (b) ACCESS TO PERSONAL PROFILES.— 

11 (1) IN GENERAL.—Subject to title IV, a covered 

12 entity shall, upon request, provide an individual with 

13 reasonable access to any personal profile about that 

14 individual that the entity stores in a manner that 

15 makes it accessible in the normal course of business. 

16 (2) SPECIAL RULE FOR PREFERENCE PRO17 FILES.—With respect to a preference profile, the ob18 ligation to provide access and correction under this 

19 section is met if the covered entity provides the abil20 ity to review and change the preference information 

21 associated with a unique persistent identifier. 

22 (3) PARTICIPATION IN CHOICE PROGRAM.—This 

23 subsection shall not apply to a covered entity that 

24 participates in a Choice Program under title IV. 

25 (c) NOTICE IN LIEU OF ACCESS.—Subject to sub26 section (b), in those instances in which covered informaVerDate Mar 15 2010 02:08 Jul 20, 2010 Jkt 089200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6201 E:\BILLS\H5777.IH H5777

pwalker on DSK8KYBLC1PROD with BILLS
30 

•HR 5777 IH

1 tion or sensitive information is used only for purposes that 

2 could not reasonably result in an adverse decision against 

3 an individual, including the denial of a right, benefit, or 

4 privilege, a covered entity shall, upon request by an indi5 vidual, provide the individual with a general notice or rep6 resentative sample of the type or types of information the 

7 covered entity typically collects or stores for such pur8 poses. 

9 (d) EXCEPTIONS.— 

10 (1) A covered entity may decline to provide an 

11 individual with access to covered information or sen12 sitive information if the covered entity reasonably 

13 believes— 

14 (A) the individual requesting access cannot 

15 reasonably verify his or her identity as the per16 son to which the information relates; 

17 (B) access by the individual to the infor18 mation is limited by law or legally recognized 

19 privilege; 

20 (C) the information is used for a legitimate 

21 governmental or fraud prevention purpose that 

22 would be compromised by such access; 

23 (D) such request for access is frivolous or 

24 vexatious; 


pwalker on DSK8KYBLC1PROD with BILLS
31 

•HR 5777 IH

1 (E) the privacy or other rights of persons 

2 other than the individual would be violated; or 

3 (F) proprietary or confidential information, 

4 technology, or business processes would be re5 vealed as a result. 

6 (2) Where an exception described in paragraph 

7 (1) applies only to a portion of the covered informa8 tion or sensitive information maintained by the cov9 ered entity, the covered entity shall provide access 

10 required under subsections (a) and (b) to the infor11 mation to which the exception does not apply. 

12 (3) A covered entity may decline an individual’s 

13 request to correct or amend covered information or 

14 sensitive information pertaining to that individual 

15 where— 

16 (A) a reason for denying access to the in17 formation under paragraph (1) would also apply 

18 to the request to correct or amend the informa19 tion; or 

20 (B) doing so would be incompatible with a 

21 legal obligation, such as a requirement to retain 

22 certain information. 

23 (e) FEES.—A covered entity may charge a reasonable 

24 fee, as determined by the Commission, for providing ac25 cess in accordance with subsection (a) or (b). 


pwalker on DSK8KYBLC1PROD with BILLS
32 

•HR 5777 IH

1 (f) TIME LIMIT.—A covered entity shall respond to 

2 any access, correction, or amendment request within 30 

3 days of the receipt of the request. Such response must 

4 consist of one or more of the following: 

5 (1) The requested information in accordance 

6 with subsection (a) or (b). 

7 (2) The general notice in accordance with sub8 section (c). 

9 (3) Instructions for accessing, correcting, or 

10 amending the requested information through an 

11 automated mechanism. 

12 (4) A confirmation that the requested correc13 tions or amendments have been made. 

14 (5) A notification that the covered entity is de15 clining to correct or amend information pursuant to 

16 one of the exceptions described in subsection (d). 

17 Such notification shall include the reason or reasons 

18 for not making the suggested correction or amend19 ment, unless one or more of such exceptions would 

20 also apply to the disclosure of the reason or reasons. 

21 (6) A request to resubmit the access request 

22 and an explanation of why the original access re23 quest was deficient in cases where— 


pwalker on DSK8KYBLC1PROD with BILLS
33 

•HR 5777 IH

1 (A) the scope or nature of the request is 

2 unclear or the entity needs more information in 

3 order to respond to the request; 

4 (B) the entity charges a fee as permitted 

5 under subsection (e), and the fee has not been 

6 paid; or 

7 (C) the entity provides interested members 

8 of the public other reasonable and accessible in9 structions for submitting an access request and 

10 such instructions were not followed. 

11 (7) A notification that additional time is needed 

12 where— 

13 (A) the entity cannot reasonably provide a 

14 full response within 30 days of the receipt of 

15 the access; and 

16 (B) the time extension needed for a full re17 sponse is no greater than an additional 30 days. 

18 (g) RULE OF CONSTRUCTION.—Nothing in this Act 

19 creates an obligation on a covered entity to provide an in20 dividual with the right to delete information. 

21 (h) ADDITIONAL REQUIREMENTS WHERE CORREC22 TION OR AMENDMENT IS DECLINED.—If the covered enti23 ty declines to correct or amend the information described 

24 in subsection (a), the covered entity shall— 


pwalker on DSK8KYBLC1PROD with BILLS
34 

•HR 5777 IH

1 (1) note that the information is disputed, in2 cluding the individual’s statement disputing such in3 formation, and take reasonable steps to verify such 

4 information under the procedures outlined in section 

5 201 if such information can be independently 

6 verified; and 

7 (2) where the information was obtained from a 

8 third party or is publicly available information, in9 form the individual of the source of the information, 

10 and if reasonably available, where a request for cor11 rection may be directed, and, if the individual pro12 vides proof that the information is incorrect, correct 

13 the inaccuracy in the covered entity’s records. 

14 (i) OTHER LIMITATIONS.—The obligations under this 

15 section do not, by themselves, create any obligation on the 

16 covered entity to retain, maintain, reorganize, or restruc17 ture covered information or sensitive information. 

18 (j) DATA RETENTION EXCEPTION.—Covered infor19 mation or sensitive information retained by the covered 

20 entity for under 30 days, or such other period of time as 

21 the Commission may determine, shall not be subject to 

22 this section. 

23 (k) RULEMAKING.—Not later than 18 months after 

24 the date of the enactment of this Act, the Commission 

25 shall promulgate regulations under section 553 of title 5, 


pwalker on DSK8KYBLC1PROD with BILLS
35 

•HR 5777 IH

1 United States Code, to implement this section. In addi2 tion, the Commission shall promulgate regulations, as nec3 essary, on the application of the exceptions and limitations 

4 in subsection (d), including any additional circumstances 

5 in which a covered entity may limit access to information 

6 under such subsection that the Commission determines to 

7 be appropriate. 

8 TITLE III—DATA SECURITY, 

9 DATA MINIMIZATION, AND AC10 COUNTABILITY 

11 SEC. 301. DATA SECURITY. 

12 (a) IN GENERAL.—Each covered entity and service 

13 provider shall establish, implement, and maintain reason14 able and appropriate administrative, technical, and phys15 ical safeguards to— 

16 (1) ensure the security, integrity, and confiden17 tiality of the covered information or sensitive infor18 mation it collects, assembles, or maintains; 

19 (2) protect against any anticipated threats, rea20 sonably foreseeable vulnerabilities, or hazards to the 

21 security or integrity of such information; and 

22 (3) protect against unauthorized access to or 

23 use of such information and loss, misuse, alteration, 

24 or destruction of such information. 


pwalker on DSK8KYBLC1PROD with BILLS
36 

•HR 5777 IH

1 (b) FACTORS FOR APPROPRIATE SAFEGUARDS.—Not 

2 later than 18 months after the date of the enactment of 

3 this Act, the Commission shall promulgate regulations 

4 under section 553 of title 5, United States Code, to imple5 ment this section. In promulgating such regulations, the 

6 Commission shall consider— 

7 (1) the size and complexity of an entity; 

8 (2) the nature and scope of the activities of an 

9 entity; 

10 (3) the sensitivity of the information; 

11 (4) the current state of the art in administra12 tive, technical, and physical safeguards for pro13 tecting information; and 

14 (5) the cost of implementing such safeguards. 

15 SEC. 302. ACCOUNTABILITY. 

16 (a) COMPLAINTS TO THE COVERED ENTITY.—A cov17 ered entity shall provide a process for individuals to make 

18 complaints concerning the covered entity’s policies and 

19 procedures required by this Act. 

20 (b) PRIVACY RISK ASSESSMENT.—A covered entity 

21 shall conduct an assessment of the risks to individuals 

22 raised by the collection, use, and disclosure of covered in23 formation or sensitive information prior to the implemen24 tation of commercial projects, marketing initiatives, busi25 ness models, applications, and other products or services 


pwalker on DSK8KYBLC1PROD with BILLS
37 

•HR 5777 IH

1 in which the covered entity intends to collect, or believes 

2 there is a reasonable likelihood it will collect, covered in3 formation or sensitive information from or about more 

4 than 1,000,000 individuals. 

5 (c) PERIODIC EVALUATION OF PRACTICES.—A cov6 ered entity shall conduct periodic assessments to evalu7 ate— 

8 (1) whether the covered information or sensitive 

9 information the covered entity has collected is and 

10 remains necessary for the purposes disclosed at the 

11 time of collection pursuant to section 101 (c) and 

12 (d); and 

13 (2) whether the covered entity’s ongoing collec14 tion practices are and remain necessary for a legiti15 mate business purpose. 

16 SEC. 303. DATA MINIMIZATION OBLIGATIONS. 

17 A covered entity that uses covered information or 

18 sensitive information for any purpose shall retain such 

19 data only as long as necessary to fulfill a legitimate busi20 ness purpose or comply with a legal requirement. 


pwalker on DSK8KYBLC1PROD with BILLS
38 

•HR 5777 IH

1 TITLE IV—SAFE HARBOR AND 

2 SELF-REGULATORY CHOICE 

3 PROGRAM 

4 SEC. 401. SAFE HARBOR. 

5 A covered entity that participates in, and is in compli6 ance with, 1 or more self-regulatory programs approved 

7 by the Commission under section 402 (in this title referred 

8 to as a ‘‘Choice Program’’) shall not be subject to— 

9 (1) the requirements for express affirmative 

10 consent required under subsection 104(a) for the 

11 specified uses of covered information addressed by 

12 the Choice Program as described in section 

13 403(1)(A); 

14 (2) the requirement of access to information 

15 under section 202(b); or 

16 (3) liability in a private right of action brought 

17 under section 604. 

18 SEC. 402. APPROVAL BY THE FEDERAL TRADE COMMIS19 SION. 

20 (a) INITIAL APPROVAL.—Not later than 270 days 

21 after the submission of an application for approval of a 

22 Choice Program under this section, the Commission shall 

23 approve or decline to approve such program. The Commis24 sion shall only approve such program if the Commission 


pwalker on DSK8KYBLC1PROD with BILLS
39 

•HR 5777 IH

1 finds, after notice and comment, that the program com2 plies with the requirements of section 403. 

3 (b) APPROVAL OF MODIFICATIONS.—The Commis4 sion shall approve or decline to approve any material 

5 change in a Choice Program previously approved by the 

6 Commission within 120 days after submission of an appli7 cation for approval by such program. The Commission 

8 shall only approve such material change if the Commission 

9 finds, after notice and comment, that the proposed change 

10 complies with the requirements of section 403. 

11 (c) DURATION.—A Choice Program approved by the 

12 Commission under this section shall be approved for a pe13 riod of 5 years. 

14 (d) APPEALS.—Final action by the Commission on 

15 a request for approval, or the failure to act within 270 

16 days on a request for approval, submitted under this sec17 tion may be appealed to a district court of the United 

18 States of appropriate jurisdiction as provided for in sec19 tion 706 of title 5, United States Code. 

20 SEC. 403. REQUIREMENTS OF SELF-REGULATORY PRO21 GRAM. 

22 To be approved as a Choice Program under this sec23 tion, a program shall— 

24 (1) provide individuals with— 


pwalker on DSK8KYBLC1PROD with BILLS
40 

•HR 5777 IH

1 (A) a clear and conspicuous opt-out mech2 anism that, when selected by the individual, 

3 prohibits all covered entities participating in the 

4 Choice Program from disclosing covered infor5 mation to a third party for 1 or more specified 

6 uses, and may offer individuals a preference 

7 management tool that will enable an individual 

8 to make more detailed choices about the trans9 fer of covered information to a third party; and 

10 (B) a clear and conspicuous mechanism to 

11 set communication preferences, online behav12 ioral advertising preferences, and such other 

13 preferences as the Choice Program may deter14 mine, subject to the approval of the Commis15 sion, that when selected by the individual, ap16 plies the individual’s selected preferences to all 

17 covered entities participating in the Choice Pro18 gram; and 

19 (2) establish— 

20 (A) guidelines and procedures requiring a 

21 participating covered entity to provide equiva22 lent or greater protections for individuals and 

23 their covered information and sensitive informa24 tion as are provided under titles I and II; 


pwalker on DSK8KYBLC1PROD with BILLS
41 

•HR 5777 IH

1 (B) procedures for reviewing applications 

2 by covered entities to participate in the Choice 

3 Program; 

4 (C) procedures for periodic assessment of 

5 its procedures and for conducting periodic ran6 dom compliance testing of covered entities par7 ticipating in such Choice Program; and 

8 (D) consequences for failure to comply 

9 with program requirements, such as public no10 tice of the covered entity’s noncompliance, sus11 pension, or expulsion from the program, or re12 ferral to the Commission for enforcement. 

13 SEC. 404. RULEMAKING. 

14 Not later than 18 months after the date of enactment 

15 of this Act, the Commission shall promulgate regulations 

16 under section 553 of title 5, United States Code, to imple17 ment this section and to provide compliance guidance for 

18 entities seeking to be approved under this title, including 

19 regulations— 

20 (1) establishing criteria for the submission of 

21 the application, including evidence of how the Choice 

22 Program will comply with the requirements of sec23 tion 403; 

24 (2) establishing criteria for opt-out mechanisms 

25 and communication preferences, online behavioral 


pwalker on DSK8KYBLC1PROD with BILLS
42 

•HR 5777 IH

1 advertising preferences, or other preferences meeting 

2 the requirements of this title; 

3 (3) establishing consequences for failure to 

4 comply with the requirements of section 403, such 

5 as public notice of the Choice Program’s noncompli6 ance and suspension or revocation of the Commis7 sion’s approval of such Program as described in sec8 tion 402; 

9 (4) allowing for and promoting continued evo10 lution and innovation in privacy protection, mean11 ingful consumer control, simplified approaches to 

12 disclosure, and transparency; and 

13 (5) providing additional incentives for self-regu14 lation by covered entities to implement the protec15 tions afforded individuals under titles I and II of 

16 this Act, including provisions for ensuring that a 

17 covered entity will be considered to be in compliance 

18 with the requirements of titles I and II and the reg19 ulations issued under such titles if that covered enti20 ty complies with guidelines or requirements of a 

21 Choice Program approved under section 402. 


pwalker on DSK8KYBLC1PROD with BILLS
43 

•HR 5777 IH

1 TITLE V—EXEMPTIONS 

2 SEC. 501. USE OF AGGREGATE OR DEIDENTIFIED INFORMA3 TION. 

4 (a) GENERAL EXCLUSION.—Subject to subsections 

5 (b) and (c), nothing in this Act shall preclude a covered 

6 entity from collecting, using, or disclosing— 

7 (1) aggregate information; or 

8 (2) covered information or sensitive information 

9 from which identifying information has been ob10 scured or removed using reasonable and appropriate 

11 methods such that the remaining information does 

12 not identify, and there is no reasonable basis to be13 lieve that the information can be used to identify— 

14 (A) the specific individual to whom such 

15 covered information relates; or 

16 (B) a computer or device owned or used by 

17 a specific individual. 

18 (b) REASONABLE PROCEDURES FOR DISCLOSURE.— 

19 If a covered entity discloses the information described in 

20 paragraphs (1) and (2) of subsection (a) to a third party, 

21 the covered entity shall take reasonable steps to protect 

22 such information, including, in the case of the information 

23 described in such paragraph (2), not disclosing the algo24 rithm or other mechanism used to obscure or remove the 

25 identifying information, and obtaining satisfactory written 


pwalker on DSK8KYBLC1PROD with BILLS
44 

•HR 5777 IH

1 assurance that the third party will not attempt to recon2 struct the identifying information. 

3 (c) PROHIBITION ON RECONSTRUCTING OR REVEAL4 ING IDENTIFYING INFORMATION.— 

5 (1) IN GENERAL.—It shall be unlawful for any 

6 person to reconstruct or reveal the identifying infor7 mation that has been removed or obscured (as de8 scribed in subsection (a)(2)) and for which a covered 

9 entity claims or has claimed the benefit of the gen10 eral exemption in subsection (a). 

11 (2) RULEMAKING.—Not later than 18 months 

12 after the date of the enactment of this Act, the 

13 Commission shall promulgate regulations under sec14 tion 553 of title 5, United States Code, to establish 

15 exemptions to this subsection. In promulgating such 

16 regulations, the Commission shall consider— 

17 (A) the purposes for which such identifying 

18 information may need to be reconstructed or re19 vealed; 

20 (B) the size and sensitivity of the data set; 

21 and 

22 (C) public policy issues such as health, 

23 safety, and national security. 


pwalker on DSK8KYBLC1PROD with BILLS
45 

•HR 5777 IH

1 SEC. 502. ACTIVITIES COVERED BY OTHER FEDERAL PRI2 VACY LAWS. 

3 Except as provided expressly in this Act, this Act 

4 shall have no effect on activities covered by any of the 

5 following: 

6 (1) Title V of the Gramm-Leach-Bliley Act (15 

7 U.S.C. 6801 et seq.). 

8 (2) The Fair Credit Reporting Act (15 U.S.C. 

9 1681 et seq.). 

10 (3) The Health Insurance Portability and Ac11 countability Act of 1996 (Public Law 104–191). 

12 (4) Part C of title XI of the Social Security Act 

13 (42 U.S.C. 1320d et seq.). 

14 (5) Sections 222 and 631 of the Communica15 tions Act of 1934 (47 U.S.C. 222 and 47 U.S.C. 

16 551). 

17 (6) The Children’s Online Privacy Protection 

18 Act of 1998 (15 U.S.C. 6501 et seq.). 

19 (7) The CAN–SPAM Act of 2003 (15 U.S.C. 

20 7701 et seq.). 

21 (8) The Electronic Communications Privacy Act 

22 of 1986 (18 U.S.C. 2510 et seq.). 

23 (9) The Video Privacy Protection Act (18 

24 U.S.C. 2710 et seq.). 


pwalker on DSK8KYBLC1PROD with BILLS
46 

•HR 5777 IH

1 TITLE VI—APPLICATION AND 

2 ENFORCEMENT 

3 SEC. 601. GENERAL APPLICATION. 

4 The requirements of this Act shall only apply to those 

5 persons over which the Commission has authority pursu6 ant to section 5(a)(2) of the Federal Trade Commission 

7 Act. Notwithstanding any provision of such Act or any 

8 other provision of law, common carriers subject to the 

9 Communications Act of 1934 (47 U.S.C. 151 et seq.) and 

10 any amendment thereto shall be subject to the jurisdiction 

11 of the Commission for purposes of this Act. 

12 SEC. 602. ENFORCEMENT BY THE FEDERAL TRADE COM13 MISSION. 

14 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

15 A violation of titles I, II, or III shall be treated as an 

16 unfair and deceptive act or practice in violation of a regu17 lation under section 18(a)(1)(B) of the Federal Trade 

18 Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding un19 fair or deceptive acts or practices. 

20 (b) POWERS OF COMMISSION.—The Commission 

21 shall enforce this Act in the same manner, by the same 

22 means, and with the same jurisdiction, powers, and duties 

23 as though all applicable terms and provisions of the Fed24 eral Trade Commission Act (15 U.S.C. 41 et seq.) were 

25 incorporated into and made a part of this Act. Any person 


pwalker on DSK8KYBLC1PROD with BILLS
47 

•HR 5777 IH

1 who violates this Act or the regulations issued under this 

2 Act shall be subject to the penalties and entitled to the 

3 privileges and immunities provided in that Act. 

4 (c) RULEMAKING AUTHORITY.— 

5 (1) RULEMAKING.—The Commission may, in 

6 accordance with section 553 of title 5, United States 

7 Code, issue such regulations it determines to be nec8 essary to carry out this Act. 

9 (2) AUTHORITY TO GRANT EXCEPTIONS.—The 

10 regulations prescribed under paragraph (1) may in11 clude such additional exceptions to titles I, II, III, 

12 IV, and V of this Act as the Commission considers 

13 consistent with the purposes of this Act. 

14 (3) LIMITATION.—In promulgating rules under 

15 this Act, the Commission shall not require the de16 ployment or use of any specific products or tech17 nologies, including any specific computer software or 

18 hardware. 

19 SEC. 603. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

20 (a) CIVIL ACTION.—In any case in which the Attor21 ney General of a State, or an official or agency of a State, 

22 has reason to believe that an interest of the residents of 

23 that State has been or is threatened or adversely affected 

24 by any person who violates this Act, the attorney general, 

25 official, or agency of the State, as parens patriae, may 


pwalker on DSK8KYBLC1PROD with BILLS
48 

•HR 5777 IH

1 bring a civil action on behalf of the residents of the State 

2 in an appropriate district court of the United States— 

3 (1) to enjoin further violation of this Act by the 

4 defendant; 

5 (2) to compel compliance with this Act; or 

6 (3) for violations of titles I, II, or III of this 

7 Act, to obtain civil penalties in the amount deter8 mined under subsection (b). 

9 (b) CIVIL PENALTIES.— 

10 (1) CALCULATION.—For purposes of calculating 

11 the civil penalties that may be obtained under sub12 section (a)(3)— 

13 (A) with regard to a violation of title I, the 

14 amount determined under this paragraph is the 

15 amount calculated by multiplying the number of 

16 days that a covered entity is not in compliance 

17 with such title, or the number of individuals for 

18 whom the covered entity failed to obtain con19 sent as required by such title, whichever is 

20 greater, by an amount not to exceed $11,000; 

21 and 

22 (B) with regard to a violation of title II or 

23 III, the amount determined under this para24 graph is the amount calculated by multiplying 

25 the number of days that a covered entity is not 


pwalker on DSK8KYBLC1PROD with BILLS
49 

•HR 5777 IH

1 in compliance with such title or titles by an 

2 amount not to exceed $11,000. 

3 (2) ADJUSTMENT FOR INFLATION.—Beginning 

4 on the date that the Consumer Price Index for All 

5 Urban Consumers is first published by the Bureau 

6 of Labor Statistics that is after 1 year after the date 

7 of enactment of this Act, and each year thereafter, 

8 the amounts specified in subparagraphs (A) and (B) 

9 of paragraph (1) shall be increased by the percent10 age increase in the Consumer Price Index published 

11 on that date from the Consumer Price Index pub12 lished the previous year. 

13 (3) MAXIMUM TOTAL LIABILITY.—Notwith14 standing the number of actions which may be 

15 brought against a person under this section the 

16 maximum civil penalty for which any person may be 

17 liable under this section shall not exceed— 

18 (A) $5,000,000 for any related series of 

19 violations of title I; and 

20 (B) $5,000,000 for any related series of 

21 violations of title II and title III. 

22 (4) EFFECT OF PARTICIPATION IN CHOICE PRO23 GRAM.—If a covered entity participates in a Choice 

24 Program established under title IV and cures the al25 leged violation of title I or II in a reasonable period 


pwalker on DSK8KYBLC1PROD with BILLS
50 

•HR 5777 IH

1 of time after receiving notice of the alleged violation, 

2 such conduct shall be taken into consideration by a 

3 State or a court in determining the amount of civil 

4 penalties under this subsection. 

5 (c) INTERVENTION BY THE FTC.— 

6 (1) NOTICE AND INTERVENTION.—The State 

7 shall provide prior written notice of any action under 

8 subsection (a) to the Commission and provide the 

9 Commission with a copy of its complaint, except in 

10 any case in which such prior notice is not feasible, 

11 in which case the State shall serve such notice im12 mediately upon instituting such action. The Commis13 sion shall have the right— 

14 (A) to intervene in the action; 

15 (B) upon so intervening, to be heard on all 

16 matters arising therein; and 

17 (C) to file petitions for appeal. 

18 (2) LIMITATION ON STATE ACTION WHILE FED19 ERAL ACTION IS PENDING.—If the Commission has 

20 instituted a civil action for violation of this Act, no 

21 attorney general of a State, or official, or agency of 

22 a State, may bring an action under this section dur23 ing the pendency of that action against any defend24 ant named in the complaint of the Commission for 

25 any violation of this Act alleged in the complaint. 


pwalker on DSK8KYBLC1PROD with BILLS
51 

•HR 5777 IH

1 (d) CONSTRUCTION.—For purposes of bringing any 

2 civil action under subsection (a), nothing in this Act shall 

3 be construed to prevent an attorney general of a State 

4 from exercising the powers conferred on the attorney gen5 eral by the laws of that State to— 

6 (1) conduct investigations; 

7 (2) administer oaths or affirmations; or 

8 (3) compel the attendance of witnesses or the 

9 production of documentary and other evidence. 

10 SEC. 604. PRIVATE RIGHT OF ACTION. 

11 (a) IN GENERAL.—A covered entity, other than a 

12 covered entity that participates in and is in compliance 

13 with a Choice Program established under title IV, who 

14 willfully fails to comply with sections 103 or 104 of this 

15 Act with respect to any individual is liable to that indi16 vidual in a civil action brought in a district court of the 

17 United States of appropriate jurisdiction in an amount 

18 equal to the sum of— 

19 (1) the greater of any actual damages of not 

20 less than $100 and not more than $1,000; 

21 (2) such amount of punitive damages as the 

22 court may allow; and 

23 (3) in the case of any successful action under 

24 this section, the costs of the action together with 


pwalker on DSK8KYBLC1PROD with BILLS
52 

•HR 5777 IH

1 reasonable attorney’s fees as determined by the 

2 court. 

3 (b) LIMITATION.—A civil action under this section 

4 may not be commenced later than 2 years after the date 

5 upon which the claimant first discovered or had a reason6 able opportunity to discover the violation. 

7 SEC. 605. EFFECT ON OTHER LAWS. 

8 (a) PREEMPTION OF STATE LAWS.—This Act super9 sedes any provision of a statute, regulation, or rule of a 

10 State or political subdivision of a State, with respect to 

11 those entities covered by the regulations issued pursuant 

12 to this Act, that expressly requires covered entities to im13 plement requirements with respect to the collection, use, 

14 or disclosure of covered information addressed in this Act. 

15 (b) ADDITIONAL PREEMPTION.— 

16 (1) IN GENERAL.—No person other than a per17 son specified in section 603 or 604 may bring a civil 

18 action under the laws of any State if such action is 

19 premised in whole or in part upon the defendant vio20 lating any provision of this Act. 

21 (2) PROTECTION OF STATE CONSUMER PROTEC22 TION LAWS.—This subsection shall not be construed 

23 to limit the enforcement of any State consumer pro24 tection law by an attorney general or other official 

25 of a State. 


pwalker on DSK8KYBLC1PROD with BILLS
53 

•HR 5777 IH

1 (c) PROTECTION OF CERTAIN STATE LAWS.—This 

2 Act shall not be construed to preempt the applicability 

3 of— 

4 (1) State laws that address the collection, use, 

5 or disclosure of health information or financial infor6 mation; 

7 (2) State laws that address notification require8 ments in the event of a data breach; 

9 (3) State trespass, contract, or tort law; or 

10 (4) other State laws to the extent that those 

11 laws relate to acts of fraud. 

12 (d) PRESERVATION OF FTC AUTHORITY.—Nothing 

13 in this Act may be construed in any way to limit or affect 

14 the Commission’s authority under any provision of law. 

15 (e) RULE OF CONSTRUCTION RELATING TO RE16 QUIRED DISCLOSURES TO GOVERNMENT ENTITIES.— 

17 This Act shall not be construed to expand or limit the 

18 duty or authority of a covered entity, service provider, or 

19 third party to disclose covered information or sensitive in20 formation to a government entity under any provision of 

21 law. 


pwalker on DSK8KYBLC1PROD with BILLS
54 

•HR 5777 IH

1 TITLE VII—MISCELLANEOUS 

2 PROVISIONS 

3 SEC. 701. REVIEW. 

4 Not later than 5 years after the effective date of the 

5 regulations initially issued under this Act, the Commission 

6 shall— 

7 (1) review the implementation of this Act, in8 cluding the effect of the implementation of this Act 

9 on practices relating to the collection, use, and dis10 closure of covered information and sensitive informa11 tion; and 

12 (2) prepare and submit to Congress a report on 

13 the results of the review under paragraph (1). 

14 SEC. 702. CONSUMER AND BUSINESS EDUCATION CAM15 PAIGN. 

16 Beginning on the effective date of this Act as set 

17 forth in section 703, the Commission shall— 

18 (1) conduct a consumer education campaign to 

19 inform individuals of the rights and protections af20 forded by this Act and the steps that individuals can 

21 take to affirmatively consent or decline consent to 

22 the collection, use, and disclosure of information 

23 under this Act and the regulations issued pursuant 

24 to this Act; and 


pwalker on DSK8KYBLC1PROD with BILLS
55 

•HR 5777 IH

1 (2) provide guidance to businesses regarding 

2 their obligations under this Act, including guidance 

3 on how to participate in a Choice Program approved 

4 under title IV. 

5 SEC. 703. EFFECTIVE DATE. 

6 This Act shall take effect 2 years after the date of 

7 the enactment of this Act. The Commission may stay en8 forcement of this Act for such period of time as the Com9 mission determines necessary to allow for the establish10 ment and Commission approval of a Choice Program 

11 under title IV and for covered entities to commence par12 ticipation in such a program. 

13 SEC. 704. SEVERABILITY. 

14 If any provision of this Act, or the application thereof 

15 to any person or circumstance, is held unconstitutional or 

16 otherwise invalid, the validity of the remainder of the Act 

17 and the application of such provision to other persons and 

18 circumstances shall not be affected thereby. 

Æ 


pwalker on DSK8KYBLC1PROD with BILLS