II 

116TH CONGRESS 

1ST SESSION S. 1951 

To require the Securities and Exchange Commission to promulgate regulations 

relating to the disclosure of certain commercial data, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 25, 2019 

Mr. WARNER (for himself and Mr. HAWLEY) introduced the following bill; 

which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To require the Securities and Exchange Commission to promulgate regulations relating to the disclosure of certain 

commercial data, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Designing Accounting 

5 Safeguards To Help Broaden Oversight and Regulations 

6 on Data’’. 

7 SEC. 2. DEFINITIONS. 

8 In this Act: 


pbinns on DSK79D2C42PROD with BILLS
2 

•S 1951 IS

1 (1) COMMERCIAL DATA OPERATOR.—The term 

2 ‘‘commercial data operator’’ means an entity acting 

3 in its capacity as a consumer online services provider 

4 or data broker that— 

5 (A) generates a material amount of rev6 enue from the use, collection, processing, sale, 

7 or sharing of the user data; and 

8 (B) has more than 100,000,000 unique 

9 monthly visitors or users in the United States 

10 for a majority of months during the previous 1- 

11 year period. 

12 (2) COMMISSION.—The term ‘‘Commission’’ 

13 means the Securities and Exchange Commission. 

14 (3) ISSUER.—The term ‘‘issuer’’ has the mean15 ing given the term in section 3(a) of the Securities 

16 and Exchange Act of 1934 (15 U.S.C. 78c(a)). 

17 (4) USER.—The term ‘‘user’’ means an indi18 vidual consumer who uses an online service designed 

19 for consumer use by a commercial data operator. 

20 (5) USER DATA.—The term ‘‘user data’’ means 

21 any information that identifies, relates to, describes, 

22 is capable of being associated with, or could reason23 ably be linked with an individual user, whether di24 rectly submitted to the commercial data operator by 


pbinns on DSK79D2C42PROD with BILLS
3 

•S 1951 IS

1 the user or derived from the observed activity of the 

2 user by the commercial data operator. 

3 SEC. 3. COMMERCIAL DATA OPERATORS. 

4 (a) REQUIREMENTS.— 

5 (1) IN GENERAL.—A commercial data operator 

6 shall— 

7 (A) on a routine basis, and not less fre8 quently than once every 90 days— 

9 (i) provide each user of the commer10 cial data operator with an assessment of 

11 the economic value that the commercial 

12 data operator places on the data of that 

13 user; and 

14 (ii) in a clear and conspicuous man15 ner, in accordance with paragraph (3), 

16 identify to each user of the commercial 

17 data operator— 

18 (I) the types of data collected 

19 from users of the commercial data op20 erator, whether by the commercial 

21 data operator or another person pur22 suant to an agreement with the com23 mercial data operator; and 

24 (II) the ways that the data of a 

25 user of the commercial data operator 


pbinns on DSK79D2C42PROD with BILLS
4 

•S 1951 IS

1 is used if the use is not directly or ex2 clusively related to the online service 

3 that the commercial data operator 

4 provides to the user; and 

5 (B) except as provided in paragraph (2), 

6 provide a user of the commercial data operator 

7 with the ability to delete all data, in the aggre8 gate and for an individual field, that the com9 mercial data operator possesses, or maintains 

10 control or access to with respect to the user, 

11 through— 

12 (i) a single setting; or 

13 (ii) another clear and conspicuous 

14 mechanism by which the user may make 

15 such a deletion. 

16 (2) DELETION EXCEPTIONS.— 

17 (A) IN GENERAL.—A commercial data op18 erator shall comply with a user directive to de19 lete, in whole or in part, the data of the user 

20 except— 

21 (i) in cases where there is a legal obli22 gation of the commercial data operator to 

23 maintain the data; 

24 (ii) for the establishment, exercise, or 

25 defense of legal claims; or 


pbinns on DSK79D2C42PROD with BILLS
5 

•S 1951 IS

1 (iii) if the data is necessary to detect 

2 security incidents, protect against mali3 cious, deceptive, fraudulent, or illegal activ4 ity, or assist in the prosecution of those re5 sponsible for such activity. 

6 (B) RETENTION.—A commercial data op7 erator may not retain any more user data than 

8 is necessary to carry out an activity described 

9 in clauses (i) through (iii) of subparagraph (A). 

10 (3) AVAILABILITY.—A commercial data oper11 ator shall ensure that all disclosures required under 

12 subsection (a) are available to a user of the commer13 cial data operator— 

14 (A) on and after the date on which the 

15 commercial data operator makes the identifica16 tion; and 

17 (B) through any normal mechanism by 

18 which a user may interact with the online serv19 ice provided by the commercial data operator. 

20 (4) UNFAIR AND DECEPTIVE ACTS OR PRAC21 TICES.— 

22 (A) UNFAIR OR DECEPTIVE ACTS OR PRAC23 TICES.—A violation of this subsection shall be 

24 treated as a violation of a rule defining an un25 fair or deceptive act or practice prescribed 


pbinns on DSK79D2C42PROD with BILLS
6 

•S 1951 IS

1 under section 18(a)(1)(B) of the Federal Trade 

2 Commission Act (15 U.S.C. 57a(a)(1)(B)). 

3 (B) POWERS OF FEDERAL TRADE COMMIS4 SION.— 

5 (i) IN GENERAL.—The Federal Trade 

6 Commission shall enforce this subsection in 

7 the same manner, by the same means, and 

8 with the same jurisdiction, powers, and du9 ties as though all applicable terms and pro10 visions of the Federal Trade Commission 

11 Act (15 U.S.C. 41 et seq.) were incor12 porated into and made a part of this sub13 section. 

14 (ii) PRIVILEGES AND IMMUNITIES.— 

15 Any person who violates this subsection 

16 shall be subject to the penalties and enti17 tled to the privileges and immunities pro18 vided in the Federal Trade Commission 

19 Act (15 U.S.C. 41 et seq.). 

20 (b) REGULATIONS.—Not later than 1 year after the 

21 date of enactment of this Act, the Federal Trade Commis22 sion shall promulgate regulations carrying out subsection 

23 (a). 


pbinns on DSK79D2C42PROD with BILLS
7 

•S 1951 IS

1 SEC. 4. SEC DISCLOSURES. 

2 (a) IN GENERAL.—Section 13 of the Securities Ex3 change Act of 1934 (15 U.S.C. 78m) is amended by add4 ing at the end the following: 

5 ‘‘(s) DISCLOSURE RELATING TO AGGREGATE VALUE

6 OF USER DATA HELD BY COMMERCIAL DATA OPERA7 TORS.— 

8 ‘‘(1) DEFINITIONS.—In this subsection: 

9 ‘‘(A) COMMERCIAL DATA OPERATOR.—The 

10 term ‘commercial data operator’ means an enti11 ty acting in its capacity as a consumer online 

12 services provider or data broker that— 

13 ‘‘(i) generates a material amount of 

14 revenue directly from the use, collection, 

15 processing, sale, or sharing of the user 

16 data; and 

17 ‘‘(ii) has more than 100,000,000 

18 unique monthly visitors or users in the 

19 United States for a majority of months 

20 during the previous 1-year period; 

21 ‘‘(B) USER.—The term ‘user’ means an in22 dividual consumer who uses an online service 

23 designed for consumer use by a commercial 

24 data operator. 

25 ‘‘(C) USER DATA.—The term ‘user data’ 

26 means any information that identifies, relates 


pbinns on DSK79D2C42PROD with BILLS
8 

•S 1951 IS

1 to, describes, is capable of being associated 

2 with, or could reasonably be linked with an in3 dividual user, whether directly submitted to the 

4 commercial data operator by the user or derived 

5 from the observed activity of the user by the 

6 commercial data operator. 

7 ‘‘(2) DISCLOSURE.—Each issuer that is, or is a 

8 consolidated subsidiary of, a commercial data oper9 ator and is required to file an annual or quarterly 

10 report under subsection (a) shall disclose in that re11 port the aggregate value, if material, of— 

12 ‘‘(A) user data that the commercial data 

13 operator holds; 

14 ‘‘(B) contracts with third parties for the 

15 collection of user data through the online serv16 ice provided by the commercial data operator; 

17 and 

18 ‘‘(C) any other item that the Commission 

19 determines, by rule, is necessary or useful for 

20 the protection of investors and in the public in21 terest. 

22 ‘‘(3) VALUATION METHODOLOGY.— 

23 ‘‘(A) IN GENERAL.—The Commission, in 

24 consultation with appropriate standards set25 tings organizations, shall develop a method or 


pbinns on DSK79D2C42PROD with BILLS
9 

•S 1951 IS

1 methods for calculating the value of user data 

2 required to be disclosed under paragraph (2). 

3 ‘‘(B) CONSIDERATIONS.—In developing the 

4 method under subparagraph (A), the Commis5 sion shall promote comparability in calculating 

6 the value of data across commercial data opera7 tors that utilize user data in a similar manner 

8 while taking into account the potential need to 

9 develop distinct methods for calculating the 

10 value of data for different uses, sectors, and 

11 business models.’’. 

12 (b) QUALITATIVE DISCLOSURE.—Not later than 1 

13 year after the date of enactment of this subsection, the 

14 Commission shall amend section 229.306 of title 17, Code 

15 of Federal Regulations, to require a commercial data oper16 ator that is an issuer subject to section 13 or 15(d) of 

17 the Securities Exchange Act of 1934 (15 U.S.C. 78m, 

18 78o(d)) to provide quantitative and qualitative disclosures 

19 about the value of user data held, including— 

20 (1) technical and legal measures in place to 

21 protect user data held by the commercial data oper22 ator; 

23 (2) an assessment of financial and legal risks 

24 associated with storing the type and quantity of user 

25 data held by the commercial data operator; 


pbinns on DSK79D2C42PROD with BILLS
10 

•S 1951 IS

1 (3) each source of user data held by the com2 mercial data operator, whether by sale, a direct con3 sumer relationship, an indirect consumer relation4 ship, or other means; 

5 (4) each discrete revenue generating operation 

6 of the commercial data operator and any subsidiary 

7 or affiliate that relies on user data; 

8 (5) the entry into any contract valued at more 

9 than $10,000,000 with a third party for the collec10 tion, licensing, or sharing by the third party pursu11 ant to an agreement with the commercial data oper12 ator; 

13 (6) the amount of revenue derived from obtain14 ing, collecting, processing, selling, using or sharing 

15 user data during the reporting period; 

16 (7) how changes in the measurement of aggre17 gate fair value of user data affect the reported per18 formance and cash flows of the issuer; and 

19 (8) any acquisition of user data in the pre20 ceding reporting period valued at more than 

21 $100,000,000. 

22 (c) REPORT.— 

23 (1) IN GENERAL.—Not later than 3 years after 

24 the date of enactment of this Act, the Commission 

25 shall submit to the Committee on Banking, Housing, 


pbinns on DSK79D2C42PROD with BILLS
11 

•S 1951 IS

1 and Urban Affairs of the Senate and the Committee 

2 on Financial Services of the House of Representa3 tives a report on— 

4 (A) the nature, timing, and extent of the 

5 disclosure practices of commercial data opera6 tors; 

7 (B) an assessment of the valuation meth8 odologies and practices employed by commercial 

9 data operators in developing and submitting 

10 disclosures to the public; 

11 (C) an evaluation of the methods of deliv12 ery and presentation of the disclosures required 

13 by this Act, and the amendments made by this 

14 Act; and 

15 (D) recommendations for the improvement 

16 of the methods described in paragraph (3), in17 cluding developing standards to enhance com18 parability and utility for investors. 

19 (2) RULEMAKING.—Not later than 180 days 

20 after the date on which the report required under 

21 paragraph (1) is submitted, the Commission shall 

22 promulgate a proposed regulation implementing the 

23 recommendations described in paragraph (1)(D). 

Æ 


pbinns on DSK79D2C42PROD with BILLS