I

107TH CONGRESS

1ST SESSION H. R. 2135

To protect consumer privacy.

IN THE HOUSE OF REPRESENTATIVES

JUNE 12, 2001

Mr. SAWYER introduced the following bill; which was referred to the

Committee on Energy and Commerce

A BILL

To protect consumer privacy.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Consumer Privacy Pro5 tection Act’’.

6 SEC. 2. FINDINGS AND PURPOSE.

7 (a) FINDINGS.—The Congress finds the following:

8 (1) People in the United States lack important

9 privacy protections.

10 (2) The opportunities for an individual to se11 cure employment, insurance, and credit, to obtain

12 medical care, and to participate in electronic com-
2

•HR 2135 IH

1 merce are endangered by the potential for misuse of

2 certain personal information.

3 (3) Because markets work through trust, pre4 dictability, and stability, privacy protections should

5 help businesses gain the trust of consumers and

6 compliment existing practices.

7 (4) 84 percent of Internet users are concerned

8 about businesses and people they do not know ob9 taining personal information about them.

10 (5) Nearly 80 percent of online consumers have

11 at some time abandoned e-commerce transactions

12 due to privacy concerns, resulting in an estimated

13 loss to companies of $12.4 billion in 2000.

14 (6) In order to protect the privacy of individ15 uals in the Information Age, it is necessary and ap16 propriate for public officials to take steps to safe17 guard this essential freedom.

18 (b) PURPOSE.—The purpose of this Act is to assure

19 that personal information about an individual consumer

20 in the United States is properly protected and that any

21 use of such information by others is consistent with the

22 prior consent of the consumer.

23 SEC. 3. PROTECTION OF PERSONAL INFORMATION.

24 (a) LIMITATIONS ON DISCLOSURE OF PERSONAL IN25 FORMATION.—An information recipient shall not disclose
3

•HR 2135 IH

1 to any other person personal information collected or ob2 tained from or about a consumer, unless—

3 (1) such disclosure is made after the consumer

4 has been provided with a clear and concise descrip5 tion of the extent and circumstances under which

6 such a disclosure may occur;

7 (2) such disclosure does not exceed the scope of

8 the consumer’s prior consent, which shall be—

9 (A) in the case of disclosure of personal in10 formation, granted tacitly or affirmatively by

11 the consumer after receiving the description re12 quired by paragraph (1); or

13 (B) in the case of disclosure of sensitive

14 personal information, granted affirmatively by

15 the consumer after receiving the description re16 quired by paragraph (1); and

17 (3) the consent granted under paragraph (2)

18 has not subsequently been withdrawn by the con19 sumer.

20 (b) LIMITATION ON COLLECTION OF OPTIONAL IN21 FORMATION.—An information recipient may not require

22 a consumer to provide, as a condition of entering into or

23 completing a transaction with the information recipient,

24 personal information that is not necessary to complete the

25 transaction.
4

•HR 2135 IH

1 (c) LIMITATION ON REFUSAL TO TRANSACT.—An in2 formation recipient may not terminate or refuse to enter

3 into a transaction with a consumer because the consumer

4 has not granted, or has withdrawn, the consent required

5 by subsection (a), except when the sole purpose of the

6 transaction is the acquisition of such information for dis7 closure.

8 (d) REASONABLE ACCESS TO PERSONAL INFORMA9 TION.—An information recipient shall provide to a con10 sumer about whom personal information has been ob11 tained reasonable access to the consumer’s personal infor12 mation.

13 SEC. 4. EXCEPTIONS.

14 Section 3 does not apply to the disclosure of personal

15 information—

16 (1) as necessary to effect, administer, or en17 force a transaction requested or authorized by the

18 consumer;

19 (2) to protect the confidentiality or security of

20 personal information;

21 (3) to prevent or investigate fraud, an unau22 thorized transaction, a claim, or other liability;

23 (4) to collect a debt or dishonored item;

24 (5) for the purpose of a securitization or sec25 ondary market sale (including servicing rights);
5

•HR 2135 IH

1 (6) for the purposes of legal process;

2 (7) for law enforcement purposes;

3 (8) for governmental regulatory purposes;

4 (9) as otherwise authorized or required under a

5 Federal law; or

6 (10) if the Federal Trade Commission has

7 made a finding that such a disclosure is consistent

8 with the purposes of this Act and in the public inter9 est.

10 SEC. 5. UNFAIR OR DECEPTIVE ACT OR PRACTICE.

11 (a) VIOLATION OF ACT.—Disclosure of personal in12 formation about a consumer in a manner that violates this

13 Act constitutes an unfair or deceptive act or practice in

14 or affecting commerce (within the meaning of section

15 5(a)(1) of the Federal Trade Commission Act (15 U.S.C.

16 45)).

17 (b) VIOLATION OF RULE.—Violation of a rule made

18 under this Act constitutes violation of a rule defining an

19 unfair or deceptive act or practice made under section

20 18(a)(1)(B) of the Federal Trade Commission Act (15

21 U.S.C. 57a(a)(1)(B)).

22 SEC. 6. SAFE HARBOR.

23 (a) PRACTICES AND PROCEDURES, GUIDELINES.—A

24 person does not commit a violation of this Act if such

25 person—
6

•HR 2135 IH

1 (1) establishes, implements, and follows reason2 able practices and procedures to effectively prevent

3 a violation of this Act;

4 (2) implements and follows a set of guidelines

5 setting forth reasonable practices and procedures to

6 effectively prevent a violation of this Act, if such

7 guidelines are—

8 (A) issued by a self-regulatory organization

9 to which such person is, or could be, subject;

10 and

11 (B) approved under subsection (b), after

12 submission by such organization to the Federal

13 Trade Commission; or

14 (3) implements and follows a set of model

15 guidelines issued by the Commission, after notice

16 and opportunity for comment, setting forth reason17 able practices and procedures to effectively prevent

18 a violation of this Act.

19 (b) APPROVAL OF GUIDELINES.—Not later than 90

20 days after receiving a request by a self-regulatory organi21 zation for approval of guidelines under subsection (a)(2)

22 and after notice and an opportunity for comment, the Fed23 eral Trade Commission shall approve or disapprove such

24 proposed guidelines (setting forth in writing the reasons

25 for any disapproval).
7

•HR 2135 IH

1 SEC. 7. PRIVATE RIGHT OF ACTION.

2 A consumer may bring in an appropriate district

3 court of the United States or, if otherwise permitted by

4 the laws or rules of court of a State, in an appropriate

5 court of that State—

6 (1) a civil action to enjoin a violation of this

7 Act;

8 (2) a civil action to recover—

9 (A) the greater of actual monetary loss or

10 $1,000 in damages for each such violation; and

11 (B) up to $10,000, to be determined in the

12 discretion of the court, if the court finds that

13 the defendant willfully or knowingly violated

14 such rules; or

15 (3) both such actions.

16 SEC. 8. ACTIONS BY STATES.

17 (a) AUTHORITY OF STATES.—Whenever the attorney

18 general of a State, or an official or agency designated by

19 a State, has reason to believe that any person has engaged

20 or is engaging in a pattern or practice of violations of this

21 Act, the State, on behalf of its residents, may bring—

22 (1) a civil action to enjoin such violations; and

23 (2) a civil action to recover—

24 (A) the greater of actual monetary loss of

25 such residents or $1,000 in damages for each

26 such violation; and
8

•HR 2135 IH

1 (B) up to $10,000, to be determined in the

2 discretion of the court, if the court finds that

3 the defendant willfully or knowingly violated

4 such rules; or

5 (3) both such actions.

6 (b) EXCLUSIVE JURISDICTION OF FEDERAL

7 COURTS.—(1) The district courts of the United States

8 shall have exclusive jurisdiction over all civil actions

9 brought under this section.

10 (2) Upon a proper showing in a civil action brought

11 under this section, a permanent or temporary injunction

12 or restraining order shall be granted without bond.

13 (c) RIGHTS OF FEDERAL TRADE COMMISSION.—(1)

14 The State shall serve prior written notice of any civil ac15 tion brought under this section upon the Federal Trade

16 Commission and provide the Commission with a copy of

17 its complaint, except in any case where such prior notice

18 is not feasible, in which case the State shall serve such

19 notice immediately upon instituting such action.

20 (2) The Commission shall have the right—

21 (A) to intervene in the action;

22 (B) upon so intervening, to be heard on all

23 matters arising therein; and

24 (C) to file petitions for appeal.
9

•HR 2135 IH

1 (d) LIMITATION.—Whenever the Federal Trade Com2 mission has commenced a civil action for violation of this

3 Act, no State may, during the pendency of such action

4 commenced by the Commission, subsequently commence

5 a civil action against any defendant named in the Commis6 sion’s complaint for any violation as alleged in the Com7 mission’s complaint.

8 SEC. 9. PREEMPTION.

9 This Act and the rules made under this Act preempt

10 any inconsistent provision of State law.

11 SEC. 10. DEFINITIONS.

12 In this Act:

13 (1) The term ‘‘information recipient’’ means

14 any person who obtains personal information from

15 or about a consumer, through a transaction in or af16 fecting interstate or foreign commerce. Such term

17 does not include—

18 (A) an affiliate, parent entity, or sub19 sidiary of such person; or

20 (B) the consumer about whom such infor21 mation has been obtained.

22 (2) The term ‘‘consumer’’ means an individual

23 who is or was in a consumer relationship with an in24 formation recipient.
10

•HR 2135 IH

1 (3) The term ‘‘personal information’’ means

2 personally identifiable information and sensitive per3 sonal information.

4 (4) The term ‘‘personally identifiable informa5 tion’’ includes, with respect to a consumer—

6 (A) a name;

7 (B) an address;

8 (C) a phone number; and

9 (D) an electronic mail address.

10 (5) The term ‘‘sensitive personal information’’

11 includes, with respect to a consumer—

12 (A) a Social Security identification num13 ber; and

14 (B) financial information.

15 (6) The term ‘‘State’’ includes any common16 wealth, territory, or possession of the United States.

17 (7) The term ‘‘violation of this Act’’ includes

18 violation of a rule made under this Act.

19 SEC. 11. RULEMAKING AUTHORITY.

20 Not later than one year after the date of enactment

21 of this Act, the Federal Trade Commission shall prescribe

22 rules, in accordance with section 553 of title 5, United

23 States Code, to carry out this Act, which shall take effect

24 not later than 180 days after their publication in final

25 form.
11

•HR 2135 IH

1 SEC. 12. EFFECTIVE DATE.

2 This Act (other than section 11) shall take effect on

3 the same date that the rules prescribed under section 11

4 take effect.

Æ