I 

108TH CONGRESS 

2D SESSION H. R. 4366 

To prohibit the transfer of personal information to any person outside the 

United States, without notice and consent, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MAY 13, 2004 

Mr. MARKEY introduced the following bill; which was referred to the 

Committee on Energy and Commerce 

A BILL 

To prohibit the transfer of personal information to any person outside the United States, without notice and consent, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Personal Data 

5 Offshoring Protection Act of 2004’’. 

6 SEC. 2. DEFINITIONS. 

7 As used in this Act, the following definitions apply: 

8 (1) BUSINESS ENTERPRISE.—The term ‘‘busi9 ness enterprise’’ means any organization, associa10 tion, or venture established to make a profit, or any 
2 

•HR 4366 IH 

1 private, nonprofit organization that collects or re2 tains personally identifiable information. 

3 (2) COUNTRY WITH ADEQUATE PRIVACY PRO4 TECTION.—The term ‘‘country with adequate pri5 vacy protection’’ means a country that has been cer6 tified by the Federal Trade Commission as having a 

7 legal system that provides adequate privacy protec8 tion for personally identifiable information. 

9 (3) PERSONALLY IDENTIFIABLE INFORMA10 TION.—The term ‘‘personally identifiable informa11 tion’’ includes information such as— 

12 (A) name; 

13 (B) postal address; 

14 (C) financial information; 

15 (D) medical records; 

16 (E) date of birth; 

17 (F) phone number; 

18 (G) e-mail address; 

19 (H) social security number; 

20 (I) mother’s maiden name; 

21 (J) password; 

22 (K) state identification information; 

23 (L) driver’s license number; 

24 (M) personal tax information; and 
3 

•HR 4366 IH 

1 (N) any consumer transactional or experi2 ential information relating to the person. 

3 (4) TRANSMIT.—The term ‘‘transmit’’ or 

4 ‘‘transmission’’ means the use of any instrumentality 

5 of interstate commerce, including the mails or any 

6 electronic means, to transfer information or to pro7 vide access to such information via the Internet or 

8 any comparable telecommunications system. 

9 SEC. 3. PROTECTION OF PERSONALLY IDENTIFIABLE IN10 FORMATION FROM UNAUTHORIZED TRANS11 MISSION. 

12 (a) IN GENERAL.—A business enterprise may trans13 mit personally identifiable information regarding a citizen 

14 of the United States to any foreign affiliate or subcon15 tractor located in a country that is a country with ade16 quate privacy protection, provided that the citizen has 

17 been provided prior notice that such information may be 

18 transmitted to such a foreign affiliate or subcontractor 

19 and has not objected to such transmission. 

20 (b) ‘‘OPT-IN’’ CONSENT REQUIRED FOR COUNTRIES

21 WITHOUT ADEQUATE PRIVACY PROTECTION.—A business 

22 enterprise may not transmit personally identifiable infor23 mation regarding a citizen of the United States to any 

24 foreign affiliate or subcontractor located in a country that 

25 is a country without adequate privacy protection unless— 
4 

•HR 4366 IH 

1 (1) the business enterprise discloses to the cit2 izen that the country to which the information will 

3 be transmitted does not have adequate privacy pro4 tection; 

5 (2) the business enterprise obtains consent from 

6 the citizen, before a consumer relationship is estab7 lished or before the effective date of this Act, to 

8 transmit such information to such foreign affiliate or 

9 subcontractor; and 

10 (3) the consent referred to in paragraph (2) is 

11 renewed by the citizen within 1 year before such in12 formation is transmitted. 

13 (c) PROHIBITION ON REFUSAL TO PROVIDE SERV14 ICES.—A business enterprise shall not deny the provision 

15 of any good or service to, nor change the terms of or 

16 refuse to enter into a business relationship with any per17 son based upon that person’s exercise of the consent rights 

18 provided for in this Act or in any other applicable law. 

19 SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMIS20 SION. 

21 (a) UNFAIR AND DECEPTIVE ACT OR PRACTICE.— 

22 A violation of this Act shall be treated as a violation of 

23 a rule defining an unfair or deceptive act or practice pre24 scribed under section 18(a)(1)(B) of the Federal Trade 

25 Commission Act (15 U.S.C. 57a(a)(1)(B)). 
5 

•HR 4366 IH 

1 (b) ENFORCEMENT AUTHORITY.—The Federal 

2 Trade Commission shall enforce this Act in the same man3 ner, by the same means, and with the same jurisdiction, 

4 powers, and duties as though all applicable terms and pro5 visions of the Federal Trade Commission Act (15 U.S.C. 

6 41 et seq.) were incorporated into and made a part of this 

7 Act. 

8 SEC. 5. CIVIL REMEDIES. 

9 (a) PRIVATE RIGHT OF ACTION.—A person or entity 

10 may, if otherwise permitted by the laws or rules of court 

11 of a State, bring in an appropriate court of that State— 

12 (1) an action based on a violation of this Act 

13 or the regulations prescribed pursuant to this Act to 

14 enjoin such violation; 

15 (2) an action to recover for actual monetary 

16 loss from such a violation, or to receive $10,000 in 

17 damages for each such violation, whichever is great18 er, or 

19 (3) both such actions. 

20 If the court finds that the defendant willfully or knowingly 

21 violated this subsection or the regulations prescribed 

22 under this subsection, the court may, in its discretion, in23 crease the amount of the award to an amount equal to 

24 not more than 3 times the amount available under para25 graph (2). 
6 

•HR 4366 IH 

1 (b) ACTIONS BY STATES.— 

2 (1) AUTHORITY OF STATES.—Whenever the at3 torney general of a State, or an official or agency 

4 designated by a State, has reason to believe that any 

5 person has engaged or is engaging in a violation of 

6 this Act or the regulations prescribed pursuant to 

7 this Act, the State may bring a civil action on behalf 

8 of its residents to enjoin such violation, an action to 

9 recover for actual monetary loss or receive $10,000 

10 in damages for each violation, or both such actions. 

11 If the court finds the defendant willfully or know12 ingly violated this Act or regulations prescribed pur13 suant to this Act, the court may, in its discretion, 

14 increase the amount of the award to an amount 

15 equal to not more than 3 times the amount available 

16 under the preceding sentence. 

17 (2) EXCLUSIVE JURISDICTION OF FEDERAL

18 COURTS.—The district courts of the United States, 

19 the United States courts of any territory, and the 

20 District Court of the United States for the District 

21 of Columbia shall have exclusive jurisdiction over all 

22 civil actions brought under this subsection. Upon 

23 proper application, such courts shall also have juris24 diction to issue writs of mandamus, or orders afford25 ing like relief, commanding the defendant to comply 
7 

•HR 4366 IH 

1 with the provisions of this Act or regulations pre2 scribed pursuant to this Act, including the require3 ment that the defendant take such action as is nec4 essary to remove the danger of such violation. Upon 

5 a proper showing, a permanent or temporary injunc6 tion or restraining order shall be granted without 

7 bond. 

8 (3) NOTICE TO AN INTERVENTION OF FEDERAL

9 TRADE COMMISSION.—The State bringing a civil ac10 tion under this section shall serve prior written no11 tice of any such civil action upon the Federal Trade 

12 Commission and provide the Commission with a 

13 copy of its complaint, except in any case where such 

14 prior notice is not feasible, in which case the State 

15 shall serve such notice immediately upon instituting 

16 such action. The Commission shall have the right— 

17 (A) to intervene in the action; 

18 (B) upon so intervening, to be heard on all 

19 matters arising therein; and 

20 (C) to file petitions for appeal. 

21 (4) VENUE; SERVICE OF PROCESS.—Any civil 

22 action brought under this subsection in a district 

23 court of the United States may be brought in the 

24 district wherein the defendant is found or is an in25 habitant or transacts business or wherein the viola-
8 

•HR 4366 IH 

1 tion occurred or is occurring, and process in such 

2 cases may be served in any district in which the de3 fendant is an inhabitant or where the defendant may 

4 be found. 

5 (5) INVESTIGATORY POWERS.—For purposes of 

6 bringing any civil action under this subsection, noth7 ing in this Act shall prevent the attorney general of 

8 a State, or an official or agency designated by a 

9 State, from exercising the powers conferred on the 

10 attorney general or such official by the laws of such 

11 State to conduct investigations or to administer 

12 oaths or affirmations or to compel the attendance of 

13 witnesses or the production of documentary and 

14 other evidence. 

15 (6) EFFECT ON STATE COURT PROCEEDINGS.— 

16 Nothing contained in this section shall be construed 

17 to prohibit an authorized State official from pro18 ceeding in State court on the basis of an alleged vio19 lation of any general civil or criminal statute of such 

20 State. 

21 (7) LIMITATION.—Whenever the Federal Trade 

22 Commission has instituted a civil action for violation 

23 of this Act or the regulations prescribed pursuant to 

24 this Act, no State may, during the pendency of such 

25 action instituted by the Commission, subsequently 
9 

•HR 4366 IH 

1 institute a civil action against any defendant named 

2 in the Commission’s complaint for any violation as 

3 alleged in the Commission’s complaint. 

4 SEC. 6. CERTIFICATION OF COUNTRIES WITH ADEQUATE 

5 PRIVACY PROTECTION. 

6 (a) IN GENERAL.—Not later than 6 months after the 

7 date of enactment of this Act, the Federal Trade Commis8 sion, after providing notice and opportunity for public 

9 comment, shall— 

10 (1) certify those countries that have legal sys11 tems that provide adequate privacy protection for 

12 personally identifiable information; and 

13 (2) make the list of countries certified under 

14 paragraph (1) available to the general public. 

15 (b) CERTIFICATION CRITERIA.— 

16 (1) IN GENERAL.—In determining whether a 

17 country should be certified under this section, the 

18 Federal Trade Commission shall consider the ade19 quacy of the country’s infrastructure for detecting, 

20 evaluating, and responding to privacy violations. 

21 (2) PRESUMPTION.—The Commission shall pre22 sume that a country’s privacy protections are inad23 equate if they are any less protective of personally 

24 identifiable information than those afforded under 

25 Federal law or under the laws of any State, or if the 
10 

•HR 4366 IH 

1 Commission determines that such country’s laws are 

2 not adequately enforced. 

3 (c) EUROPEAN UNION DATE PROTECTION DIREC4 TIVE.—A country that has comprehensive privacy laws 

5 that meet the requirements of the European Union Data 

6 Protection Directive shall be certified under this section 

7 unless the Federal Trade Commission determines that 

8 such laws are not commonly enforced within such country. 

9 SEC. 7. EFFECTIVE DATE. 

10 Section 6 of this Act shall take effect on the date 

11 of enactment of this Act. Sections 2 through 5 of this Act 

12 shall take effect 60 days after the the completion of the 

13 certification required by section 6. 

Æ