II 

116TH CONGRESS 

1ST SESSION S. 2342 

To provide for requirements for data brokers with respect to the acquisition, 

use, and protection of brokered personal information and to require 

that data brokers annually register with the Federal Trade Commission. 

IN THE SENATE OF THE UNITED STATES 

JULY 30, 2019 

Mr. PETERS (for himself and Ms. MCSALLY) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To provide for requirements for data brokers with respect 

to the acquisition, use, and protection of brokered personal information and to require that data brokers annually register with the Federal Trade Commission. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Broker List Act 

5 of 2019’’. 


kjohnson on DSK79L0C42 with BILLS
2 

•S 2342 IS

1 SEC. 2. REQUIREMENTS FOR DATA BROKERS. 

2 (a) REQUIREMENTS WITH RESPECT TO THE ACQUI3 SITION AND USE OF BROKERED PERSONAL INFORMA4 TION.—A data broker shall not— 

5 (1) acquire brokered personal information 

6 through fraudulent means; 

7 (2) acquire or use brokered personal informa8 tion for the purpose of— 

9 (A) stalking or harassing another person; 

10 (B) committing fraud, including identity 

11 theft, financial fraud, or e-mail fraud; or 

12 (C) engaging in unlawful discrimination, 

13 including unlawful discrimination in decisions 

14 regarding employment, housing, and credit eli15 gibility; or 

16 (3) sell or transfer brokered personal informa17 tion to a third party if the data broker knows or rea18 sonably should know that the third party intends to 

19 engage in any conduct prohibited by this Act. 

20 (b) DUTY TO PROTECT BROKERED PERSONAL IN21 FORMATION.— 

22 (1) IN GENERAL.—A data broker shall develop, 

23 implement, and maintain a comprehensive informa24 tion security program in order to protect from secu25 rity breaches or other inadvertent or improper disVerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342

kjohnson on DSK79L0C42 with BILLS
3 

•S 2342 IS

1 closure the brokered personal information acquired 

2 by the data broker. 

3 (2) PROGRAM REQUIREMENTS.—The com4 prehensive information security program required 

5 under paragraph (1) shall— 

6 (A) be written in one or more readily ac7 cessible parts; and 

8 (B) contain administrative, technical, and 

9 physical safeguards that are appropriate to— 

10 (i) the size, scope, and type of busi11 ness of the data broker; 

12 (ii) the amount of resources available 

13 to the data broker; 

14 (iii) the amount of stored data of the 

15 data broker; and 

16 (iv) the need for security and con17 fidentiality of brokered personal informa18 tion. 

19 (c) ANNUAL REGISTRATION.— 

20 (1) IN GENERAL.—Annually, on or before Janu21 ary 31, a data broker shall— 

22 (A) register with the Commission; and 

23 (B) provide the following information with 

24 such registration: 


kjohnson on DSK79L0C42 with BILLS
4 

•S 2342 IS

1 (i) The name and primary physical, e2 mail, and internet addresses of the data 

3 broker. 

4 (ii) If the data broker permits a con5 sumer to opt out of the data broker’s col6 lection of brokered personal information, 

7 opt out of its databases, or opt out of cer8 tain sales of data— 

9 (I) the method for requesting an 

10 opt-out; 

11 (II) if the opt-out applies to only 

12 certain activities or sales, which ones; 

13 and 

14 (III) whether the data broker 

15 permits a consumer to authorize a 

16 third party to perform the opt-out on 

17 the consumer’s behalf. 

18 (iii) A statement specifying the data 

19 collection, databases, or sales activities 

20 from which a consumer may not opt out. 

21 (iv) A statement as to whether the 

22 data broker implements a purchaser 

23 credentialing process. 

24 (v) The number of security breaches 

25 that the data broker experienced during 


kjohnson on DSK79L0C42 with BILLS
5 

•S 2342 IS

1 the previous year, and if known, the total 

2 number of consumers whose personal infor3 mation was accessed, downloaded, viewed, 

4 or otherwise affected in a breach. 

5 (vi) Where the data broker has actual 

6 knowledge that it possesses the brokered 

7 personal information of minors, a separate 

8 statement detailing the data collection 

9 practices, databases, sales activities, and 

10 opt-out policies that are applicable to the 

11 brokered personal information of minors. 

12 (vii) Any additional information or ex13 planation the data broker chooses to pro14 vide concerning its data collection prac15 tices. 

16 (2) EXCEPTION.—The requirements under 

17 paragraph (1) shall not apply to a data broker that 

18 is already required to comply with such requirements 

19 with respect to another Federal agency. 

20 (3) PUBLIC AVAILABILITY.—The Commission 

21 shall make the information described in paragraph 

22 (1) available for public inspection, except as nec23 essary to protect the integrity of ongoing investiga24 tions or to protect the privacy of consumers, or if it 

25 is in the interest of public safety or welfare. 


kjohnson on DSK79L0C42 with BILLS
6 

•S 2342 IS

1 SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMIS2 SION. 

3 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

4 A violation of section 2 shall be treated as a violation of 

5 a rule defining an unfair or a deceptive act or practice 

6 under section 18(a)(1)(B) of the Federal Trade Commis7 sion Act (15 U.S.C. 57a(a)(1)(B)). The Commission shall 

8 begin enforcement of such violations by not later than 1 

9 year after the date of the enactment of this Act. 

10 (b) POWERS OF COMMISSION.— 

11 (1) IN GENERAL.—The Commission shall en12 force this section in the same manner, by the same 

13 means, and with the same jurisdiction, powers, and 

14 duties as though all applicable terms and provisions 

15 of the Federal Trade Commission Act (15 U.S.C. 41 

16 et seq.) were incorporated into and made a part of 

17 this section. 

18 (2) PRIVILEGES AND IMMUNITIES.—Any data 

19 broker who violates section 2 shall be subject to the 

20 penalties and entitled to the privileges and immuni21 ties provided in the Federal Trade Commission Act 

22 (15 U.S.C. 41 et seq.). 

23 (3) AUTHORITY PRESERVED.—Nothing in this 

24 section shall be construed to limit the authority of 

25 the Federal Trade Commission under any other pro26 vision of law. 


kjohnson on DSK79L0C42 with BILLS
7 

•S 2342 IS

1 (c) RULEMAKING AUTHORITY FOR THE FEDERAL

2 TRADE COMMISSION.—The Commission shall have au3 thority under section 553 of title 5, United States Code, 

4 to promulgate regulations the Commission determines to 

5 be necessary to carry out the provisions of this Act. 

6 SEC. 4. FTC ANNUAL REVIEW AND REPORT. 

7 (a) ANNUAL REVIEW.—The Commission shall con8 duct an annual review of the implementation of the provi9 sions of this Act. Such study shall include an analysis of— 

10 (1) compliance by data brokers with the re11 quirements under section 2; 

12 (2) enforcement actions taken by the Commis13 sion with respect to violations of such requirements; 

14 and 

15 (3) other areas determined appropriate by the 

16 Commission. 

17 (b) ANNUAL REPORT.—Not later than 1 year after 

18 the date of the enactment of this Act, and annually there19 after the Commission shall submit to Congress a report 

20 on the review conducted under subsection (a), together 

21 with recommendations for such legislation and administra22 tive action as the Commission determines appropriate. 

23 SEC. 5. DEFINITIONS. 

24 In this section: 


kjohnson on DSK79L0C42 with BILLS
8 

•S 2342 IS

1 (1) BROKERED PERSONAL INFORMATION.—The 

2 term ‘‘brokered personal information’’ means any 

3 personal information that is categorized or organized 

4 for sale to a third party. 

5 (2) BUSINESS.— 

6 (A) IN GENERAL.—The term ‘‘business’’ 

7 means a commercial entity, including a sole 

8 proprietorship, partnership, corporation, asso9 ciation, limited liability company, or other 

10 group, however organized and whether or not 

11 organized to operate at a profit, including a fi12 nancial institution organized, chartered, or 

13 holding a license or authorization certificate 

14 under the laws of a State, the United States, or 

15 any other country, or the parent, affiliate, or 

16 subsidiary of a financial institution. 

17 (B) EXCLUSION.—The term ‘‘business’’ 

18 does not include a State, a State agency, any 

19 political subdivision of a State, or a vendor act20 ing solely on behalf of, and at the direction of, 

21 a State. 

22 (3) COMMISSION.—The term ‘‘Commission’’ 

23 means the Federal Trade Commission. 


kjohnson on DSK79L0C42 with BILLS
9 

•S 2342 IS

1 (4) CONSUMER.—The term ‘‘consumer’’ means 

2 an individual residing in the United States acting in 

3 a personal, family, or household capacity. 

4 (5) DATA BROKER.— 

5 (A) IN GENERAL.—The term ‘‘data 

6 broker’’ means a business that collects or ob7 tains a consumer’s personal information and 

8 sells, licenses, trades, or provides for consider9 ation that information to another business with 

10 whom a consumer does not have a direct rela11 tionship. 

12 (B) DIRECT RELATIONSHIP.—For pur13 poses of subparagraph (A), a direct relationship 

14 with a business exists if the consumer— 

15 (i) is a current customer; 

16 (ii) obtained a good or service from 

17 the business within the prior 18 months; or 

18 (iii) made an inquiry about the prod19 ucts or services of the business within the 

20 prior 90 days. 

21 (C) EXCLUSION.—The following activities 

22 conducted by a business, and the collection and 

23 sale or licensing of brokered personal informa24 tion incidental to conducting these activities, do 

25 not qualify the business as a data broker: 


kjohnson on DSK79L0C42 with BILLS
10 

•S 2342 IS

1 (i) Providing 411 directory assistance 

2 or directory information services, including 

3 name, address, and telephone number, on 

4 behalf of or as a function of a tele5 communications carrier. 

6 (ii) Providing a consumer’s publicly 

7 available information if the information is 

8 being used by the recipient as it relates to 

9 that consumer’s business or profession. 

10 (iii) Providing publicly available infor11 mation via real-time or near-real-time alert 

12 services for health or safety purposes. 

13 (iv) Providing or using information in 

14 a manner that is regulated under another 

15 Federal law, including the Fair Credit Re16 porting Act, the Gramm-Leach-Bliley Act, 

17 or the Health Insurance Portability and 

18 Accountability Act. 

19 (v) Providing data to a third party at 

20 the direction of the customer and with the 

21 customer’s consent. 

22 (D) EXCLUSION FROM SALE.—For pur23 poses of this paragraph, the term ‘‘sells’’ does 

24 not include a one-time or occasional sale of as25 sets of a business as part of a transfer of conVerDate Sep 11 2014 21:28 Aug 09, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342

kjohnson on DSK79L0C42 with BILLS
11 

•S 2342 IS

1 trol of those assets that is not part of the ordi2 nary conduct of the business. 

3 (6) DATA BROKER SECURITY BREACH.— 

4 (A) IN GENERAL.—The term ‘‘data broker 

5 security breach’’ means an unauthorized acqui6 sition or a reasonable belief of an unauthorized 

7 acquisition of more than one element of bro8 kered personal information maintained by a 

9 data broker when the brokered personal infor10 mation is not encrypted, redacted, or protected 

11 by another method that renders the information 

12 unreadable or unusable by an unauthorized 

13 data broker. 

14 (B) EXCLUSION.—The term ‘‘data broker 

15 security breach’’ does not include good faith but 

16 unauthorized acquisition of brokered personal 

17 information by an employee or agent of the 

18 data broker for a legitimate purpose of the data 

19 broker, provided that the brokered personal in20 formation is not used for a purpose unrelated 

21 to the data broker’s business or subject to fur22 ther unauthorized disclosure. 

23 (C) APPLICATION.—In determining wheth24 er brokered personal information has been ac25 quired or is reasonably believed to have been acVerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342

kjohnson on DSK79L0C42 with BILLS
12 

•S 2342 IS

1 quired by a data broker without valid authoriza2 tion, a data broker may consider the following 

3 factors, among others: 

4 (i) Indications that the brokered per5 sonal information is in the physical posses6 sion and control of a person without valid 

7 authorization, such as a lost or stolen com8 puter or other device containing brokered 

9 personal information. 

10 (ii) Indications that the brokered per11 sonal information has been downloaded or 

12 copied. 

13 (iii) Indications that the brokered per14 sonal information was used by an unau15 thorized data broker, such as fraudulent 

16 accounts opened or instances of identity 

17 theft reported. 

18 (iv) That the brokered personal infor19 mation has been made public. 

20 (7) PERSONAL INFORMATION.—The term ‘‘per21 sonal information’’ means information which is re22 lated to any identified or identifiable person. 

23 (8) STATE.—The term ‘‘State’’ means any 

24 State of the United States, the District of Columbia, 

25 the Commonwealth of Puerto Rico, Guam, American 


kjohnson on DSK79L0C42 with BILLS
13 

•S 2342 IS

1 Samoa, the Commonwealth of Northern Mariana Is2 lands, and the United States Virgin Islands. 

Æ 


kjohnson on DSK79L0C42 with BILLS