II 

116TH CONGRESS 

1ST SESSION S. 2186 

To require entities to provide consumers with the opportunity to prohibit 

the entity from collecting or using certain data concerning the consumer 

and to request deletion of such data. 

IN THE SENATE OF THE UNITED STATES 

JULY 18, 2019 

Mr. MERKLEY introduced the following bill; which was read twice and referred 

to the Committee on Commerce, Science, and Transportation 

A BILL 

To require entities to provide consumers with the opportunity 

to prohibit the entity from collecting or using certain 

data concerning the consumer and to request deletion 

of such data. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Personal 

5 Information Act of 2019’’. 


kjohnson on DSK79L0C42 with BILLS
2 

•S 2186 IS

1 SEC. 2. REQUIREMENTS FOR ENTITIES WITH RESPECT TO 

2 THE COLLECTION OR USE OF CERTAIN DATA 

3 CONCERNING THE CONSUMER. 

4 (a) OPPORTUNITY TO PROHIBIT THE ENTITY FROM

5 COLLECTING OR USING CERTAIN DATA.—A covered enti6 ty shall, prior to collecting covered data concerning an in7 dividual, provide the individual with an opportunity to pro8 hibit the covered entity from collecting such data or selling 

9 or otherwise transferring such data to a third party. 

10 (b) DELETION UPON REQUEST.—Upon a request 

11 from an individual for whom a covered entity has collected 

12 covered data, the covered entity shall, without undue 

13 delay, delete such covered data. 

14 SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMIS15 SION. 

16 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

17 A violation of section 2 shall be treated as a violation of 

18 a rule defining an unfair or a deceptive act or practice 

19 under section 18(a)(1)(B) of the Federal Trade Commis20 sion Act (15 U.S.C. 57a(a)(1)(B)). 

21 (b) POWERS OF COMMISSION.— 

22 (1) IN GENERAL.—The Commission shall en23 force this Act in the same manner, by the same 

24 means, and with the same jurisdiction, powers, and 

25 duties as though all applicable terms and provisions 

26 of the Federal Trade Commission Act (15 U.S.C. 41 


kjohnson on DSK79L0C42 with BILLS
3 

•S 2186 IS

1 et seq.) were incorporated into and made a part of 

2 this Act. 

3 (2) PRIVILEGES AND IMMUNITIES.—Any cov4 ered entity that violates section 2 shall be subject to 

5 the penalties and entitled to the privileges and im6 munities provided in the Federal Trade Commission 

7 Act (15 U.S.C. 41 et seq.). 

8 (3) AUTHORITY PRESERVED.—Nothing in this 

9 Act shall be construed to limit the authority of the 

10 Federal Trade Commission under any other provi11 sion of law. 

12 SEC. 4. ENFORCEMENT BY STATES. 

13 (a) IN GENERAL.—In any case in which the attorney 

14 general of a State has reason to believe that an interest 

15 of the residents of the State has been or is threatened 

16 or adversely affected by the engagement of any covered 

17 entity subject to section 2 in a practice that violates such 

18 section, the attorney general of the State may, as parens 

19 patriae, bring a civil action on behalf of the residents of 

20 the State in an appropriate district court of the United 

21 States— 

22 (1) to enjoin further violation of such section by 

23 such person; 

24 (2) to compel compliance with such section; and 


kjohnson on DSK79L0C42 with BILLS
4 

•S 2186 IS

1 (3) to obtain damages, restitution, or other 

2 compensation on behalf of such residents. 

3 (b) RIGHTS OF FEDERAL TRADE COMMISSION.— 

4 (1) NOTICE TO FEDERAL TRADE COMMIS5 SION.— 

6 (A) IN GENERAL.—Except as provided in 

7 subparagraph (C), the attorney general of a 

8 State shall notify the Commission in writing 

9 that the attorney general intends to bring a 

10 civil action under subsection (a) not later than 

11 10 days before initiating the civil action. 

12 (B) CONTENTS.—The notification required 

13 by subparagraph (A) with respect to a civil ac14 tion shall include a copy of the complaint to be 

15 filed to initiate the civil action. 

16 (C) EXCEPTION.—If it is not feasible for 

17 the attorney general of a State to provide the 

18 notification required by subparagraph (A) be19 fore initiating a civil action under subsection 

20 (a), the attorney general shall notify the Com21 mission immediately upon instituting the civil 

22 action. 

23 (2) INTERVENTION BY FEDERAL TRADE COM24 MISSION.—The Commission may— 


kjohnson on DSK79L0C42 with BILLS
5 

•S 2186 IS

1 (A) intervene in any civil action brought by 

2 the attorney general of a State under sub3 section (a); and 

4 (B) upon intervening— 

5 (i) be heard on all matters arising in 

6 the civil action; and 

7 (ii) file petitions for appeal of a deci8 sion in the civil action. 

9 (c) INVESTIGATORY POWERS.—Nothing in this sec10 tion may be construed to prevent the attorney general of 

11 a State from exercising the powers conferred on the attor12 ney general by the laws of the State to conduct investiga13 tions, to administer oaths or affirmations, or to compel 

14 the attendance of witnesses or the production of documen15 tary or other evidence. 

16 (d) PREEMPTIVE ACTION BY FEDERAL TRADE COM17 MISSION.—If the Commission institutes a civil action or 

18 an administrative action with respect to a violation of sec19 tion (2), the attorney general of a State may not, during 

20 the pendency of such action, bring a civil action under sub21 section (a) against any defendant named in the complaint 

22 of the Commission for the violation with respect to which 

23 the Commission instituted such action. 

24 (e) VENUE; SERVICE OF PROCESS.— 


kjohnson on DSK79L0C42 with BILLS
6 

•S 2186 IS

1 (1) VENUE.—Any action brought under sub2 section (a) may be brought in— 

3 (A) the district court of the United States 

4 that meets applicable requirements relating to 

5 venue under section 1391 of title 28, United 

6 States Code; or 

7 (B) another court of competent jurisdic8 tion. 

9 (2) SERVICE OF PROCESS.—In an action 

10 brought under subsection (a), process may be served 

11 in any district in which the defendant— 

12 (A) is an inhabitant; or 

13 (B) may be found. 

14 (f) ACTIONS BY OTHER STATE OFFICIALS.— 

15 (1) IN GENERAL.—In addition to civil actions 

16 brought by attorneys general under subsection (a), 

17 any other consumer protection officer of a State who 

18 is authorized by the State to do so may bring a civil 

19 action under subsection (a), subject to the same re20 quirements and limitations that apply under this 

21 section to civil actions brought by attorneys general. 

22 (2) SAVINGS PROVISION.—Nothing in this sec23 tion may be construed to prohibit an authorized offi24 cial of a State from initiating or continuing any proVerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186

kjohnson on DSK79L0C42 with BILLS
7 

•S 2186 IS

1 ceeding in a court of the State for a violation of any 

2 civil or criminal law of the State. 

3 SEC. 5. DEFINITIONS. 

4 In this Act: 

5 (1) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (2) COVERED DATA.— 

8 (A) IN GENERAL.—Except as provided in 

9 subparagraph (B), the term ‘‘covered data’’ 

10 means only the following: 

11 (i) Personally identifiable information. 

12 (ii) Unique identifier information. 

13 (iii) Any information that is collected, 

14 used, or stored in connection with person15 ally identifiable information or unique 

16 identifier information in a manner that 

17 may reasonably be used by the party col18 lecting the information to identify a spe19 cific individual. 

20 (B) EXCEPTION.—The term ‘‘covered 

21 data’’ does not include the following: 

22 (i) Personally identifiable information 

23 obtained from public records that is not 

24 merged with covered information gathered 

25 elsewhere. 


kjohnson on DSK79L0C42 with BILLS
8 

•S 2186 IS

1 (ii) Personally identifiable information 

2 that is obtained from a forum— 

3 (I) where the individual volun4 tarily shared the information or au5 thorized the information to be shared; 

6 and 

7 (II) that— 

8 (aa) is widely and publicly 

9 available and was not made pub10 licly available in bad faith; and 

11 (bb) contains no restrictions 

12 on who can access and view such 

13 information. 

14 (iii) Personally identifiable informa15 tion reported in public media. 

16 (iv) Personally identifiable informa17 tion dedicated to contacting an individual 

18 at the individual’s place of work. 

19 (3) COVERED ENTITY.—The term ‘‘covered en20 tity’’ means an entity— 

21 (A) that collects covered data concerning 

22 individuals; 

23 (B) that— 

24 (i) has gross annual revenue in excess 

25 of $25,000,000; 


kjohnson on DSK79L0C42 with BILLS
9 

•S 2186 IS

1 (ii) annually buys, receives, sells, or 

2 shares covered data of 50,000 or more in3 dividuals; or 

4 (iii) derives 50 percent or more of its 

5 annual revenue from selling individuals’ 

6 covered data; and 

7 (C) that is— 

8 (i) a person over which the Commis9 sion has authority pursuant to section 

10 5(a)(2) of the Federal Trade Commission 

11 Act (15 U.S.C. 45(a)(2)); 

12 (ii) a common carrier subject to the 

13 Communications Act of 1934 (47 U.S.C. 

14 151 et seq.), notwithstanding the definition 

15 of the term ‘‘Acts to regulate commerce’’ 

16 in section 4 of the Federal Trade Commis17 sion Act (15 U.S.C. 44) and the exception 

18 provided by section 5(a)(2) of the Federal 

19 Trade Commission Act (15 U.S.C. 

20 45(a)(2)) for such carriers; or 

21 (iii) a nonprofit organization, includ22 ing any organization described in section 

23 501(c) of the Internal Revenue Code of 

24 1986 that is exempt from taxation under 

25 section 501(a) of such Code, notwithVerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186

kjohnson on DSK79L0C42 with BILLS
10 

•S 2186 IS

1 standing the definition of the term ‘‘Acts 

2 to regulate commerce’’ in section 4 of the 

3 Federal Trade Commission Act (15 U.S.C. 

4 44) and the exception provided by section 

5 5(a)(2) of the Federal Trade Commission 

6 Act (15 U.S.C. 45(a)(2)) for such organi7 zations. 

8 (4) DELETE.—The term ‘‘delete’’ means to re9 move personally identifiable information such that 

10 the information is not maintained in retrievable form 

11 and cannot be retrieved in the normal course of 

12 business. 

13 (5) PERSONALLY IDENTIFIABLE INFORMA14 TION.—The term ‘‘personally identifiable informa15 tion’’ means only the following: 

16 (A) Any of the following information about 

17 an individual: 

18 (i) The first name (or initial) and last 

19 name of an individual, whether given at 

20 birth or time of adoption, or resulting from 

21 a lawful change of name. 

22 (ii) The postal address of a physical 

23 place of residence of such individual. 

24 (iii) An e-mail address. 


kjohnson on DSK79L0C42 with BILLS
11 

•S 2186 IS

1 (iv) A telephone number or mobile de2 vice number. 

3 (v) A social security number or other 

4 government issued identification number 

5 issued to such individual. 

6 (vi) The account number of a credit 

7 card issued to such individual. 

8 (vii) Unique identifier information 

9 that alone can be used to identify a spe10 cific individual. 

11 (viii) Biometric data about such indi12 vidual, including fingerprints and retina 

13 scans. 

14 (B) If used, transferred, or stored in con15 nection with one or more of the items of infor16 mation described in subparagraph (A), any of 

17 the following: 

18 (i) A date of birth. 

19 (ii) The number of a certificate of 

20 birth or adoption. 

21 (iii) A place of birth. 

22 (iv) Unique identifier information that 

23 alone cannot be used to identify a specific 

24 individual. 


kjohnson on DSK79L0C42 with BILLS
12 

•S 2186 IS

1 (v) Precise geographic location, at the 

2 same degree of specificity as a global posi3 tioning system or equivalent system, and 

4 not including any general geographic infor5 mation that may be derived from an Inter6 net Protocol address. 

7 (vi) Information about an individual’s 

8 destination, location, and amount of uses 

9 of voice services, regardless of technology 

10 used. 

11 (vii) Any other information concerning 

12 an individual that may reasonably be used 

13 by the party using, collecting, or storing 

14 that information to identify that individual. 

15 (6) THIRD PARTY.—The term ‘‘third party’’ 

16 means, with respect to a covered entity, a person 

17 that— 

18 (A) is— 

19 (i) not related to the covered entity by 

20 common ownership or corporate control; or 

21 (ii) related to the covered entity by 

22 common ownership or corporate control 

23 and an ordinary consumer would not un24 derstand that the covered entity and the 


kjohnson on DSK79L0C42 with BILLS
13 

•S 2186 IS

1 person were related by common ownership 

2 or corporate control; 

3 (B) is not a service provider used by the 

4 covered entity to receive covered data in per5 forming services or functions on behalf of and 

6 under the instruction of the covered entity; and 

7 (C) with respect to the collection of cov8 ered data of an individual, does not have an es9 tablished business relationship with the indi10 vidual and does not identify itself to the indi11 vidual at the time of such collection in a clear 

12 and conspicuous manner that is visible to the 

13 individual. 

Æ 


kjohnson on DSK79L0C42 with BILLS