II 

116TH CONGRESS 

1ST SESSION S. 142 

To impose privacy requirements on providers of internet services similar 

to the requirements imposed on Federal agencies under the Privacy 

Act of 1974. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 16, 2019 

Mr. RUBIO introduced the following bill; which was read twice and referred 

to the Committee on Commerce, Science, and Transportation 

A BILL 

To impose privacy requirements on providers of internet services similar to the requirements imposed on Federal 

agencies under the Privacy Act of 1974. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘American Data Dis5 semination Act of 2019’’ or the ‘‘ADD Act’’. 

6 SEC. 2. DEFINITIONS. 

7 (a) IN GENERAL.—In this Act— 


pamtmann on DSKBFK8HB2PROD with BILLS
2 

•S 142 IS

1 (1) the term ‘‘agency’’ has the meaning given 

2 the term in section 552a of title 5, United States 

3 Code; 

4 (2) the term ‘‘appropriate committees of Con5 gress’’ means— 

6 (A) the Committee on Commerce, Science, 

7 and Transportation of the Senate; and 

8 (B) the Committee on Energy and Com9 merce of the House of Representatives; 

10 (3) the term ‘‘collect’’ means to buy, rent, gath11 er, obtain, receive, or access information about an 

12 individual by any means, including by— 

13 (A) receiving information from the indi14 vidual, either actively or passively; or 

15 (B) observing the behavior of the indi16 vidual; 

17 (4) the term ‘‘Commission’’ means the Federal 

18 Trade Commission; 

19 (5) the term ‘‘covered provider’’ means a person 

20 that— 

21 (A) provides a service that uses the inter22 net; and 

23 (B) in providing the service under subpara24 graph (A), collects records; 


pamtmann on DSKBFK8HB2PROD with BILLS
3 

•S 142 IS

1 (6) the term ‘‘disclose’’ means to release, dis2 seminate, make available, transfer, or otherwise 

3 communicate orally, in writing, or by electronic or 

4 other means; 

5 (7) the term ‘‘maintain’’ includes maintain, col6 lect, use, disclose, or process; 

7 (8) the term ‘‘Privacy Act of 1974’’ means sec8 tion 552a of title 5, United States Code; 

9 (9) the term ‘‘process’’ means to perform an 

10 operation or set of operations on information or on 

11 sets of information, whether or not by automated 

12 means; 

13 (10) subject to subsection (b), the term 

14 ‘‘record’’ means any item, collection, or grouping of 

15 information about an individual that— 

16 (A) is maintained by a covered provider, 

17 including the education, financial transactions, 

18 medical history, and criminal or employment 

19 history of the individual; and 

20 (B) contains any name or number that 

21 may be used, alone or in conjunction with any 

22 other information, to identify a specific indi23 vidual, including any— 

24 (i) name, social security number, date 

25 of birth, official driver’s license or identiVerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142

pamtmann on DSKBFK8HB2PROD with BILLS
4 

•S 142 IS

1 fication number issued by a State, alien 

2 registration number, government passport 

3 number, or employer or taxpayer identi4 fication number; 

5 (ii) unique biometric data, such as fin6 gerprint, voice print, retina or iris image, 

7 or other unique physical representation; 

8 (iii) unique electronic identification 

9 number, address, or routing code; 

10 (iv) telecommunication identifying in11 formation or access device (as those terms 

12 are defined in section 1029(e) of title 18, 

13 United States Code); or 

14 (v) user-generated content; and 

15 (11) the term ‘‘sell’’ means to disclose informa16 tion about an individual to another person for mone17 tary or other valuable consideration. 

18 (b) MODIFICATION OF DEFINITION.—If the Commis19 sion promulgates regulations under section 4(a), the Com20 mission may modify, at any time, the definition of the 

21 term ‘‘record’’ under subsection (a) of this section as nec22 essary to conform to new Federal laws or regulations. 


pamtmann on DSKBFK8HB2PROD with BILLS
5 

•S 142 IS

1 SEC. 3. RECOMMENDED PRIVACY REQUIREMENTS FOR 

2 PROVIDERS OF INTERNET SERVICES. 

3 (a) IN GENERAL.—Not later than 180 days after the 

4 date of enactment of this Act, the Commission shall sub5 mit to the appropriate committees of Congress detailed 

6 recommendations for privacy requirements that Congress 

7 could impose on covered providers that would be substan8 tially similar, to the extent practicable, to the require9 ments applicable to agencies under the Privacy Act of 

10 1974. 

11 (b) SUBJECTS FOR RECOMMENDATIONS.—The rec12 ommendations under subsection (a) shall address the 

13 issues described in section 4. 

14 SEC. 4. REGULATIONS IMPOSING PRIVACY REQUIREMENTS 

15 ON PROVIDERS OF INTERNET SERVICES. 

16 (a) REGULATIONS.— 

17 (1) PROPOSED REGULATIONS.—Not earlier 

18 than 1 year after the date on which the Commission 

19 submits detailed recommendations for privacy re20 quirements under section 3(a), and not later than 15 

21 months after that date, the Commission shall pub22 lish and submit to the appropriate committees of 

23 Congress proposed regulations to impose privacy re24 quirements on covered providers that are substan25 tially similar, to the extent practicable, to the reVerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142

pamtmann on DSKBFK8HB2PROD with BILLS
6 

•S 142 IS

1 quirements applicable to agencies under the Privacy 

2 Act of 1974. 

3 (2) FINAL REGULATIONS.—If a law imposing 

4 privacy requirements on covered providers that are 

5 substantially similar, to the extent practicable, to the 

6 requirements applicable to agencies under the Pri7 vacy Act of 1974 is not enacted by the date that is 

8 2 years after the date of enactment of this Act, the 

9 Commission shall, not later than 27 months after 

10 that date of enactment, promulgate final regulations 

11 that impose such privacy requirements. 

12 (b) CONTENTS.—In promulgating regulations under 

13 subsection (a), the Commission— 

14 (1) shall— 

15 (A) establish criteria for exempting certain 

16 small, newly formed covered providers from the 

17 requirements under the regulations, taking into 

18 account factors including— 

19 (i) the period of time during which 

20 the covered provider has been operating as 

21 a covered provider; 

22 (ii) the annual revenue of the covered 

23 provider; and 

24 (iii) the number of individuals about 

25 whom the covered provider collects records; 


pamtmann on DSKBFK8HB2PROD with BILLS
7 

•S 142 IS

1 (B) restrict disclosure of records main2 tained by covered providers; 

3 (C) provide that— 

4 (i) an individual may request access to 

5 a record (or a portion thereof) maintained 

6 by a covered provider that relates to the 

7 individual; and 

8 (ii) upon a request under clause (i), 

9 the covered provider shall— 

10 (I) provide the individual with ac11 cess to the record (or the relevant 

12 portion thereof); or 

13 (II) if the covered provider so 

14 elects, delete the record (or the rel15 evant portion thereof), subject to the 

16 requirements to keep and provide an 

17 accounting under subparagraph (G); 

18 (D) provide that if an individual dem19 onstrates that a record relating to the indi20 vidual is not accurate, relevant, timely, or com21 plete (as those terms are defined by the Com22 mission)— 

23 (i) the individual may request that the 

24 covered provider amend the record; and 


pamtmann on DSKBFK8HB2PROD with BILLS
8 

•S 142 IS

1 (ii) upon a request under clause (i), 

2 the covered provider shall amend the 

3 record; 

4 (E) establish a process modeled on the 

5 process established under section 611(a) of the 

6 Fair Credit Reporting Act (15 U.S.C. 

7 1681i(a))— 

8 (i) through which an individual and a 

9 covered provider may resolve a dispute 

10 under subparagraph (D) of this paragraph 

11 regarding the assertion that a record relat12 ing to the individual is not accurate, rel13 evant, timely, or complete; and 

14 (ii) that does not require the indi15 vidual to incur any expense; 

16 (F) in accordance with accepted standards 

17 and in consultation with the Secretary of Com18 merce, establish a code of ‘‘fair information 

19 practices’’, for the secure collection, mainte20 nance, and dissemination of records, with which 

21 a covered provider must comply; 

22 (G) require a covered provider, in a man23 ner substantially similar, to the extent prac24 ticable, to the requirements applicable to agenVerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142

pamtmann on DSKBFK8HB2PROD with BILLS
9 

•S 142 IS

1 cies under section 552a(c) of title 5, United 

2 States Code, to— 

3 (i) keep an accounting of certain dis4 closures of records for a reasonable period 

5 of time, as determined by the Commission; 

6 and 

7 (ii) make available to an individual, 

8 upon request, the accounting made under 

9 clause (i) of disclosures of records relating 

10 to the individual, unless the period of time 

11 described in that clause has expired; and 

12 (H) to the extent practicable, incorporate 

13 the exceptions under paragraphs (1) through 

14 (12) of section 552a(b) of title 5, United States 

15 Code; and 

16 (2) may promulgate regulations not described 

17 in paragraph (1) that are modeled on section 552a 

18 of title 5, United States Code, and the regulations 

19 promulgated under that section. 

20 (c) APPLICATION WITH OTHER FEDERAL LAWS.— 

21 (1) EXEMPTION FOR PERSONS SUBJECT TO

22 OTHER FEDERAL PRIVACY LAWS.—To the extent 

23 that a person is subject to a Federal privacy law de24 scribed in paragraph (2) of this subsection, the regu25 lations promulgated under subsection (a) shall not 


pamtmann on DSKBFK8HB2PROD with BILLS
10 

•S 142 IS

1 apply to the person with respect to any information 

2 or records governed by that Federal privacy law. 

3 (2) OTHER FEDERAL PRIVACY LAWS DE4 SCRIBED.—The Federal privacy laws described in 

5 this paragraph are as follows: 

6 (A) The regulations promulgated under 

7 section 264(c) of the Health Insurance Port8 ability and Accountability Act of 1996 (42 

9 U.S.C. 1320d–2 note), as those regulations re10 late to— 

11 (i) a person described in section 

12 1172(a) of the Social Security Act (42 

13 U.S.C. 1320d–1(a)); or 

14 (ii) transactions referred to in section 

15 1173(a)(1) of the Social Security Act (42 

16 U.S.C. 1320d–2(a)(1)). 

17 (B) Section 444 of the General Education 

18 Provisions Act (20 U.S.C. 1232g) (commonly 

19 referred to as the ‘‘Family Educational Rights 

20 and Privacy Act of 1974’’). 

21 (C) Section 552a of title 5, United States 

22 Code. 

23 (3) CONFLICTS.— 

24 (A) CHILDREN’S ONLINE PRIVACY PROTEC25 TION ACT.—In the case of a conflict between 


pamtmann on DSKBFK8HB2PROD with BILLS
11 

•S 142 IS

1 the regulations promulgated under subsection 

2 (a) of this section and the Children’s Online 

3 Privacy Protection Act of 1998 (15 U.S.C. 

4 6501 et seq.) (and any regulations promulgated 

5 under that Act), the Commission shall deter6 mine which provision of law shall apply. 

7 (B) GRAMM-LEACH-BLILEY ACT.—In the 

8 case of a conflict between the regulations pro9 mulgated under subsection (a) of this section 

10 and title V of the Gramm-Leach-Bliley Act of 

11 1999 (15 U.S.C. 6801 et seq.) (and any regula12 tions promulgated under that Act), the Com13 mission shall determine which provision of law 

14 shall apply. 

15 SEC. 5. ENFORCEMENT. 

16 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

17 A violation of a regulation promulgated under section 4(a) 

18 shall be treated as a violation of a rule defining an unfair 

19 or deceptive act or practice prescribed under section 

20 18(a)(1)(B) of the Federal Trade Commission Act (15 

21 U.S.C. 57a(a)(1)(B)). 

22 (b) POWERS OF COMMISSION.— 

23 (1) IN GENERAL.—Except as provided in para24 graph (3), if the Commission promulgates regula25 tions under section 4(a), the Commission shall enVerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142

pamtmann on DSKBFK8HB2PROD with BILLS
12 

•S 142 IS

1 force this Act in the same manner, by the same 

2 means, and with the same jurisdiction, powers, and 

3 duties as though all applicable terms and provisions 

4 of the Federal Trade Commission Act (15 U.S.C. 41 

5 et seq.) were incorporated into and made a part of 

6 this Act. 

7 (2) PRIVILEGES AND IMMUNITIES.—Except as 

8 provided in paragraph (3), any person who violates 

9 a regulation promulgated under section 4(a) shall be 

10 subject to the penalties and entitled to the privileges 

11 and immunities provided in the Federal Trade Com12 mission Act (15 U.S.C. 41 et seq.). 

13 (3) COMMON CARRIERS.—Notwithstanding sec14 tion 4, 5(a)(2), or 6 of the Federal Trade Commis15 sion Act (15 U.S.C. 44, 45(a)(2), 46) or any juris16 dictional limitation of the Commission, if the Com17 mission promulgates regulations under section 4(a), 

18 the Commission shall also enforce this Act, in the 

19 same manner provided in paragraphs (1) and (2) of 

20 this subsection, with respect to common carriers 

21 subject to the Communications Act of 1934 (47 

22 U.S.C. 151 et seq.) and Acts amendatory thereof 

23 and supplementary thereto. 


pamtmann on DSKBFK8HB2PROD with BILLS
13 

•S 142 IS

1 (4) AUTHORITY PRESERVED.—Nothing in this 

2 Act shall be construed to limit the authority of the 

3 Commission under any other provision of law. 

4 SEC. 6. EFFECT ON STATE LAWS. 

5 This Act, including any regulations promulgated 

6 under section 4(a), shall supersede any provision of the 

7 law of a State relating to a covered provider that is subject 

8 to such a regulation, to the extent that the provision re9 lates to the maintenance of— 

10 (1) records covered by this Act; or 

11 (2) any other personally identifiable information 

12 or personal identification information. 

Æ 


pamtmann on DSKBFK8HB2PROD with BILLS