II 

117TH CONGRESS 

2D SESSION S. 4408 

To prohibit data brokers from selling and transferring certain sensitive data. 

IN THE SENATE OF THE UNITED STATES 

JUNE 15, 2022 

Ms. WARREN (for herself, Mr. WYDEN, Mrs. MURRAY, Mr. WHITEHOUSE, and 

Mr. SANDERS) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To prohibit data brokers from selling and transferring 

certain sensitive data. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Health and Location 

5 Data Protection Act of 2022’’. 

6 SEC. 2. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RE7 LATING TO HEALTH AND LOCATION DATA. 

8 (a) IN GENERAL.—It shall be unlawful for a data 

9 broker to sell, resell, license, trade, transfer, share, or oth10 erwise provide or make available any of the following 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 4408 IS

1 forms of data, whether declared or inferred, of an indi2 vidual: 

3 (1) Location data. 

4 (2) Health data. 

5 (3) Other categories of data identified by the 

6 Commission that address or reveal a category of 

7 data described in paragraphs (1) and (2). 

8 (b) EXCEPTIONS.— 

9 (1) ACTIONS THAT ARE HIPAA-COMPLIANT.— 

10 (A) IN GENERAL.—Nothing in this Act 

11 shall be construed to prohibit any action taken 

12 with respect to the health information of an in13 dividual by a data broker that is a business as14 sociate or covered entity that is permissible 

15 under the Federal regulations concerning stand16 ards for privacy of individually identifiable 

17 health information promulgated under section 

18 264(c) of the Health Insurance Portability and 

19 Accountability Act of 1996 (42 U.S.C. 1320d– 

20 2 note). 

21 (B) APPLICATION OF TERMS.—In para22 graph (1), the terms ‘‘business associate’’, ‘‘cov23 ered entity’’, and ‘‘health information’’ shall 

24 have the meaning given those terms in the Fed25 eral regulations specified in such paragraph. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 4408 IS

1 (2) PUBLICATION OF NEWSWORTHY INFORMA2 TION OF LEGITIMATE PUBLIC CONCERN.—Nothing 

3 in this Act shall be construed to prohibit the publi4 cation of newsworthy information of legitimate pub5 lic concern. 

6 (3) DISCLOSURE PURSUANT TO VALID AUTHOR7 IZATION.—Nothing in this Act shall be construed to 

8 prohibit a disclosure of the data of an individual for 

9 which the individual provides valid authorization. 

10 For purposes of this paragraph, the term ‘‘valid au11 thorization’’ has the meaning given such term in sec12 tion 164.508 of title 45, Code of Federal Regula13 tions (or a successor regulation), subject to such ad14 aptations as the Commission shall deem necessary to 

15 apply such term to the disclosure of both location 

16 data and health data. 

17 (c) EFFECTIVE DATE.—The prohibition under sub18 section (a) shall take effect on the earlier of— 

19 (1) the date the Commission issues the final 

20 rule under subsection (d); or 

21 (2) 180 days after the date of enactment of this 

22 Act. 

23 (d) RULEMAKING.— 

24 (1) FINAL RULE.—Pursuant to section 553 of 

25 title 5, United States Code, the Commission shall 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 4408 IS

1 promulgate regulations to carry out the provisions of 

2 this Act. The Commission shall issue a final rule by 

3 not later than 180 days after the date of enactment 

4 of this Act. 

5 (2) ADDITIONAL GUIDANCE.—Pursuant to sec6 tion 553 of title 5, United States Code, the Commis7 sion may promulgate further regulations to carry out 

8 the provisions of this Act, including further guidance 

9 regarding the types of data described in subsection 

10 (a). 

11 SEC. 3. ENFORCEMENT. 

12 (a) ENFORCEMENT BY THE FEDERAL TRADE COM13 MISSION.— 

14 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC15 TICES.—A violation of section 2 shall be treated as 

16 a violation of a rule defining an unfair or a deceptive 

17 act or practice under section 18(a)(1)(B) of the Fed18 eral Trade Commission Act (15 U.S.C. 

19 57a(a)(1)(B)). 

20 (2) POWERS OF COMMISSION.— 

21 (A) IN GENERAL.—Except as provided in 

22 subparagraphs (D) and (E), the Commission 

23 shall enforce section 2 in the same manner, by 

24 the same means, and with the same jurisdic25 tion, powers, and duties as though all applicable 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 4408 IS

1 terms and provisions of the Federal Trade 

2 Commission Act (15 U.S.C. 41 et seq.) were in3 corporated into and made a part of this Act. 

4 (B) PRIVILEGES AND IMMUNITIES.—Any 

5 person who violates section 2 shall be subject to 

6 the penalties and entitled to the privileges and 

7 immunities provided in the Federal Trade Com8 mission Act (15 U.S.C. 41 et seq.). 

9 (C) AUTHORITY PRESERVED.—Nothing in 

10 this Act shall be construed to limit the author11 ity of the Federal Trade Commission under any 

12 other provision of law. 

13 (D) NONPROFIT ORGANIZATIONS.—Not14 withstanding section 4 of the Federal Trade 

15 Commission Act (15 U.S.C. 44) or any jurisdic16 tional limitation of the Commission, the Com17 mission shall also enforce this Act, in the same 

18 manner provided in subparagraphs (A) and (B), 

19 with respect to organizations not organized to 

20 carry on business for their own profit or that 

21 of their members. 

22 (E) INDEPENDENT LITIGATION AUTHOR23 ITY.—In any case in which the Commission has 

24 reason to believe that a data broker is violating 

25 or has violated section 2, the Commission may 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 4408 IS

1 bring a civil action in an appropriate district 

2 court of the United States to— 

3 (i) enjoin any further such violation 

4 by such person; 

5 (ii) enforce compliance with this Act, 

6 including through deletion of the relevant 

7 information; 

8 (iii) obtain a permanent, temporary, 

9 or preliminary injunction; 

10 (iv) obtain civil penalties; 

11 (v) obtain damages (whether actual, 

12 punitive, or otherwise), restitution, 

13 disgorgement of unjust enrichment, or 

14 other compensation on behalf of aggrieved 

15 persons; or 

16 (vi) obtain any other appropriate equi17 table relief. 

18 (b) ENFORCEMENT BY STATES.— 

19 (1) IN GENERAL.—In any case in which the at20 torney general of a State has reason to believe that 

21 an interest of the residents of the State has been or 

22 is threatened or adversely affected by the engage23 ment of any data broker subject to section 2 in a 

24 practice that violates such section, the attorney gen25 eral of the State may, as parens patriae, bring a 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 4408 IS

1 civil action on behalf of the residents of the State in 

2 an appropriate district court of the United States 

3 to— 

4 (A) enjoin any further such violation by 

5 such person; 

6 (B) enforce compliance with this Act, in7 cluding through deletion of the relevant infor8 mation; 

9 (C) obtain a permanent, temporary, or pre10 liminary injunction; 

11 (D) obtain civil penalties; 

12 (E) obtain damages (whether actual, puni13 tive, or otherwise), restitution, disgorgement of 

14 unjust enrichment, or other compensation on 

15 behalf of aggrieved persons; or 

16 (F) obtain any other appropriate equitable 

17 relief. 

18 (2) NOTICE.—Before filing an action under 

19 paragraph (1), the attorney general, official, or 

20 agency of the State involved shall provide to the 

21 Commission a written notice of such action and a 

22 copy of the complaint for such action. If the attor23 ney general, official, or agency determines that it is 

24 not feasible to provide the notice described in this 

25 paragraph before the filing of the action, the attorVerDate Sep 11 2014 05:16 Jun 17, 2022 Jkt 029200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S4408.IS S4408

pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 4408 IS

1 ney general, official, or agency shall provide written 

2 notice of the action and a copy of the complaint to 

3 the Commission immediately upon the filing of the 

4 action. 

5 (3) LIMITATION ON STATE ACTION WHILE FED6 ERAL ACTION IS PENDING.—If the Commission has 

7 instituted a civil action for a violation of section 2, 

8 no State attorney general, or official or agency of a 

9 State, may bring an action under this paragraph 

10 during the pendency of that action against any de11 fendant named in the complaint of the Commission 

12 for any violation of section 2 alleged in the com13 plaint. 

14 (4) RELATIONSHIP WITH STATE-LAW CLAIMS.— 

15 If the attorney general of a State has authority to 

16 bring an action under State law directed at acts or 

17 practices that also violate section 2, the attorney 

18 general may assert the State-law claim and a claim 

19 under section 2 in the same civil action. 

20 (5) INVESTIGATORY POWERS.—Nothing in this 

21 subsection may be construed to prevent the attorney 

22 general of a State from exercising the powers con23 ferred on the attorney general by the laws of the 

24 State to conduct investigations, to administer oaths 

25 or affirmations, or to compel the attendance of witVerDate Sep 11 2014 05:16 Jun 17, 2022 Jkt 029200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S4408.IS S4408

pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 4408 IS

1 nesses or the production of documentary or other 

2 evidence. 

3 (c) PRIVATE ENFORCEMENT.—Any person whose in4 terest has been or is threatened or adversely affected by 

5 the engagement of any data broker subject to section 2 

6 in a practice that violates such section may bring a civil 

7 action in an appropriate district court of the United States 

8 to— 

9 (1) enjoin any further such violation by such 

10 person; 

11 (2) enforce compliance with this Act, including 

12 through deletion of the relevant information; 

13 (3) obtain a permanent, temporary, or prelimi14 nary injunction; 

15 (4) obtain damages (whether actual, punitive, 

16 or otherwise), restitution, or other compensation; 

17 (5) obtain reasonable attorney’s fees, including 

18 litigation expenses, and costs; or 

19 (6) obtain any other appropriate equitable re20 lief. 

21 (d) CIVIL PENALTIES.—In addition to any other pen22 alties as may be prescribed by law, a violation of this Act 

23 shall carry a civil penalty not to exceed 15 percent of the 

24 revenues earned by the person’s ultimate parent entity 

25 during the preceding 12-month period. 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 4408 IS

1 (e) EXCLUSIVE JURISDICTION.— 

2 (1) DISTRICT COURTS.—For any action brought 

3 under this Act, the following district courts shall 

4 have exclusive jurisdiction: 

5 (A) For actions brought by the Commis6 sion, the United States District Court for the 

7 District of Columbia. 

8 (B) For actions brought by a State attor9 ney general, the district court of the United 

10 States for the judicial district in which the cap11 ital of the State is located. 

12 (C) For private actions brought by per13 sons— 

14 (i) the United States District Court 

15 for the District of Columbia; or 

16 (ii) the district court of the United 

17 States for the judicial district in which the 

18 violation took place or in which any de19 fendant resides or does business. 

20 (2) COURT OF APPEALS.—The United States 

21 Court of Appeals for the District of Columbia Cir22 cuit shall have exclusive jurisdiction of appeals from 

23 all decisions under paragraph (1). 

24 (f) STATUTE OF LIMITATIONS.—A proceeding for a 

25 violation of this Act may be commenced not later than 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•S 4408 IS

1 6 years after the date upon which the plaintiff obtains ac2 tual knowledge of the facts giving rise to such violation. 

3 (g) PREEMPTION.—The provisions of this Act pre4 empt only the provisions of State or local law that require 

5 disclosure prohibited by this Act. 

6 SEC. 4. DEFINITIONS. 

7 In this Act: 

8 (1) COMMISSION.—The term ‘‘Commission’’ 

9 means the Federal Trade Commission. 

10 (2) DATA.— 

11 (A) IN GENERAL.—Not later than 180 

12 days after the date of enactment of this Act, 

13 the Commission shall adopt rules in accordance 

14 with section 553 of title 5, United States Code, 

15 to define the term ‘‘data’’ for the purpose of 

16 implementing and enforcing this Act. 

17 (B) REQUIREMENT.—The term ‘‘data’’ 

18 shall include information that is linked, or rea19 sonably linkable, to— 

20 (i) specific individuals; or 

21 (ii) specific groups of individuals who 

22 share the same place of residence or inter23 net protocol address. 

24 (3) DATA BROKER.—The term ‘‘data broker’’ 

25 means a person that collects, buys, licenses, or infers 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•S 4408 IS

1 data about individuals and then sells, licenses, or 

2 trades that data. 

3 (4) HEALTH DATA.—The term ‘‘health data’’ 

4 means data that reveal or describe— 

5 (A) the search for, attempt to obtain, or 

6 receipt of any health services; 

7 (B) any past, present, or future disability, 

8 physical health condition, mental health condi9 tion, or health condition of an individual, in10 cluding, but not limited to, pregnancy and mis11 carriage; or 

12 (C) any treatment or diagnosis of a dis13 ability or condition described in subparagraph 

14 (B). 

15 (5) LOCATION DATA.—The term ‘‘location 

16 data’’ means data capable of determining the past or 

17 present physical location of an individual or an indi18 vidual’s device. 

19 (6) STATE.—The term ‘‘State’’ means each of 

20 the several States, the District of Columbia, each 

21 commonwealth, territory, or possession of the United 

22 States, and each federally recognized Indian Tribe. 

23 (7) ULTIMATE PARENT ENTITY.—The term ‘‘ul24 timate parent entity’’ has the meaning given the 


pbinns on DSKJLVW7X2PROD with $$_JOB
13 

•S 4408 IS

1 term in section 801.1 of title 16, Code of Federal 

2 Regulations (or any successor regulation). 

3 SEC. 5. FUNDING. 

4 In addition to amounts otherwise available, there is 

5 appropriated to the Commission for fiscal year 2023, out 

6 of any money in the Treasury not otherwise appropriated, 

7 $1,000,000,000, to remain available until September 30, 

8 2032, for carrying out the work of the Commission. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB