II 

108TH CONGRESS 

2D SESSION S. 2312 

To regulate the transmission of personally identifiable information to foreign 

affiliates and subcontractors. 

IN THE SENATE OF THE UNITED STATES 

APRIL 8, 2004 

Mrs. CLINTON (for herself and Mr. DAYTON) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To regulate the transmission of personally identifiable 

information to foreign affiliates and subcontractors. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘SAFE-ID Act’’ or the 

5 ‘‘SAFE-ID Act’’. 

6 SEC. 2. DEFINITIONS. 

7 As used in this Act, the following definitions shall 

8 apply: 
2 

•S 2312 IS 

1 (1) BUSINESS ENTERPRISE.—The term ‘‘busi2 ness enterprise’’ means any organization, associa3 tion, or venture established to make a profit. 

4 (2) COUNTRY WITH ADEQUATE PRIVACY PRO5 TECTION.—The term ‘‘country with adequate pri6 vacy protection’’ means a country that has been cer7 tified by the Federal Trade Commission as having a 

8 legal system that provides adequate privacy protec9 tion for personally identifiable information. 

10 (3) HEALTH CARE BUSINESS.—The term 

11 ‘‘health care business’’ means any business enter12 prise or private, nonprofit organization that collects 

13 or retains personally identifiable information about 

14 consumers in relation to medical care, including— 

15 (A) hospitals; 

16 (B) health maintenance organizations; 

17 (C) medical partnerships; 

18 (D) emergency medical transportation 

19 companies; 

20 (E) medical transcription companies; 

21 (F) banks that collect or process medical 

22 billing information; and 

23 (G) subcontractors, or potential sub24 contractors, of the entities described in sub25 paragraphs (A) through (F). 
3 

•S 2312 IS 

1 (4) PERSONALLY IDENTIFIABLE INFORMA2 TION.—The term ‘‘personally identifiable informa3 tion’’ includes, but is not limited to, information 

4 such as— 

5 (A) name; 

6 (B) postal address; 

7 (C) financial information; 

8 (D) medical records; 

9 (E) date of birth; 

10 (F) phone number; 

11 (G) e-mail address; 

12 (H) social security number; 

13 (I) mother’s maiden name; 

14 (J) password; 

15 (K) state identification information; and 

16 (L) driver’s license number. 

17 SEC. 3. TRANSMISSION OF INFORMATION. 

18 (a) IN GENERAL.—A business enterprise may trans19 mit personally identifiable information regarding a citizen 

20 of the United States to any foreign affiliate or subcon21 tractor located in a country that is a country with ade22 quate privacy protection. 

23 (b) CONSENT REQUIRED.—A business enterprise 

24 may not transmit personally identifiable information re25 garding a citizen of the United States to any foreign affil-
4 

•S 2312 IS 

1 iate or subcontractor located in a country that is a country 

2 without adequate privacy protection unless— 

3 (1) the business enterprise discloses to the cit4 izen that the country to which the information will 

5 be transmitted does not have adequate privacy pro6 tection; 

7 (2) the business enterprise obtains consent from 

8 the citizen, before a consumer relationship is estab9 lished or before the effective date of this Act, to 

10 transmit such information to such foreign affiliate or 

11 subcontractor; and 

12 (3) the consent referred to in paragraph (2) is 

13 renewed by the citizen within 1 year before such in14 formation is transmitted. 

15 (c) LIABILITY.—A business enterprise shall be liable 

16 for any damages arising from the improper storage, dupli17 cation, sharing, or other misuse of personally identifiable 

18 information by the business enterprise or by any of its 

19 foreign affiliates or subcontractors that received such in20 formation from the business enterprise. 

21 (d) RULEMAKING.—The Chairman of the Federal 

22 Trade Commission shall promulgate regulations through 

23 which the Chairman may enforce the provisions of this 

24 section and impose a fine for a violation of this section. 
5 

•S 2312 IS 

1 SEC. 4. HEALTH CARE INFORMATION. 

2 (a) IN GENERAL.—A health care business shall be 

3 liable for any damages arising from the improper storage, 

4 duplication, sharing, or other misuse of personally identifi5 able information by the business enterprise or by any of 

6 its foreign affiliates or subcontractors that received such 

7 information from the business enterprise. 

8 (b) NO OPT OUT PROVISION.—A health care busi9 ness may not terminate an existing relationship with a 

10 consumer of health care services to avoid the consent re11 quirement under section 3(b). 

12 (c) RULEMAKING.—The Secretary of Health and 

13 Human Services shall promulgate regulations through 

14 which the Secretary may enforce the provisions of this sec15 tion and impose a fine for the violation of this section. 

16 SEC. 5. CERTIFICATION. 

17 (a) IN GENERAL.—Not later than 6 months after the 

18 date of enactment of this Act, the Federal Trade Commis19 sion shall— 

20 (1) certify those countries that have legal sys21 tems that provide adequate privacy protection for 

22 personally identifiable information; and 

23 (2) make the list of countries certified under 

24 paragraph (1) available to the general public. 

25 (b) CERTIFICATION CRITERIA.—In determining 

26 whether a country should be certified under this section, 
6 

•S 2312 IS 

1 the Federal Trade Commission shall consider the ade2 quacy of the country’s infrastructure for detecting, evalu3 ating, and responding to privacy violations. 

4 (c) EUROPEAN UNION DATA PROTECTION DIREC5 TIVE.—A country that has comprehensive privacy laws 

6 that meet the requirements of the European Union Data 

7 Protection Directive shall be certified under this section 

8 unless the Federal Trade Commission determines that 

9 such laws are not commonly enforced within such country. 

10 SEC. 6. EFFECTIVE DATE. 

11 This Act shall take effect on the expiration of the 

12 date which is 90 days after the date of enactment of this 

13 Act. 

Æ