ADD Act

To impose privacy requirements on providers of internet services similar to the requirements imposed on Federal agencies under the Privacy Act of 1974. 1. Short title This Act may be cited as the American Data Dissemination Act of 2019 ADD Act 2. Definitions (a) In general In this Act— (1) the term agency (2) the term appropriate committees of Congress (A) the Committee on Commerce, Science, and Transportation of the Senate; and (B) the Committee on Energy and Commerce of the House of Representatives; (3) the term collect (A) receiving information from the individual, either actively or passively; or (B) observing the behavior of the individual; (4) the term Commission (5) the term covered provider (A) provides a service that uses the internet; and (B) in providing the service under subparagraph (A), collects records; (6) the term disclose (7) the term maintain (8) the term Privacy Act of 1974 (9) the term process (10) subject to subsection (b), the term record (A) is maintained by a covered provider, including the education, financial transactions, medical history, and criminal or employment history of the individual; and (B) contains any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any— (i) name, social security number, date of birth, official driver's license or identification number issued by a State, alien registration number, government passport number, or employer or taxpayer identification number; (ii) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; (iii) unique electronic identification number, address, or routing code; (iv) telecommunication identifying information or access device (as those terms are defined in section 1029(e) of title 18, United States Code); or (v) user-generated content; and (11) the term sell (b) Modification of definition If the Commission promulgates regulations under section 4(a), the Commission may modify, at any time, the definition of the term record 3. Recommended privacy requirements for providers of internet services (a) In general Not later than 180 days after the date of enactment of this Act, the Commission shall submit to the appropriate committees of Congress detailed recommendations for privacy requirements that Congress could impose on covered providers that would be substantially similar, to the extent practicable, to the requirements applicable to agencies under the Privacy Act of 1974. (b) Subjects for recommendations The recommendations under subsection (a) shall address the issues described in section 4. 4. Regulations imposing privacy requirements on providers of internet services (a) Regulations (1) Proposed regulations Not earlier than 1 year after the date on which the Commission submits detailed recommendations for privacy requirements under section 3(a), and not later than 15 months after that date, the Commission shall publish and submit to the appropriate committees of Congress proposed regulations to impose privacy requirements on covered providers that are substantially similar, to the extent practicable, to the requirements applicable to agencies under the Privacy Act of 1974. (2) Final regulations If a law imposing privacy requirements on covered providers that are substantially similar, to the extent practicable, to the requirements applicable to agencies under the Privacy Act of 1974 is not enacted by the date that is 2 years after the date of enactment of this Act, the Commission shall, not later than 27 months after that date of enactment, promulgate final regulations that impose such privacy requirements. (b) Contents In promulgating regulations under subsection (a), the Commission— (1) shall— (A) establish criteria for exempting certain small, newly formed covered providers from the requirements under the regulations, taking into account factors including— (i) the period of time during which the covered provider has been operating as a covered provider; (ii) the annual revenue of the covered provider; and (iii) the number of individuals about whom the covered provider collects records; (B) restrict disclosure of records maintained by covered providers; (C) provide that— (i) an individual may request access to a record (or a portion thereof) maintained by a covered provider that relates to the individual; and (ii) upon a request under clause (i), the covered provider shall— (I) provide the individual with access to the record (or the relevant portion thereof); or (II) if the covered provider so elects, delete the record (or the relevant portion thereof), subject to the requirements to keep and provide an accounting under subparagraph (G); (D) provide that if an individual demonstrates that a record relating to the individual is not accurate, relevant, timely, or complete (as those terms are defined by the Commission)— (i) the individual may request that the covered provider amend the record; and (ii) upon a request under clause (i), the covered provider shall amend the record; (E) establish a process modeled on the process established under section 611(a) of the Fair Credit Reporting Act ( 15 U.S.C. 1681i(a) (i) through which an individual and a covered provider may resolve a dispute under subparagraph (D) of this paragraph regarding the assertion that a record relating to the individual is not accurate, relevant, timely, or complete; and (ii) that does not require the individual to incur any expense; (F) in accordance with accepted standards and in consultation with the Secretary of Commerce, establish a code of fair information practices (G) require a covered provider, in a manner substantially similar, to the extent practicable, to the requirements applicable to agencies under section 552a(c) of title 5, United States Code, to— (i) keep an accounting of certain disclosures of records for a reasonable period of time, as determined by the Commission; and (ii) make available to an individual, upon request, the accounting made under clause (i) of disclosures of records relating to the individual, unless the period of time described in that clause has expired; and (H) to the extent practicable, incorporate the exceptions under paragraphs (1) through (12) of section 552a(b) of title 5, United States Code; and (2) may promulgate regulations not described in paragraph (1) that are modeled on section 552a of title 5, United States Code, and the regulations promulgated under that section. (c) Application with other Federal laws (1) Exemption for persons subject to other Federal privacy laws To the extent that a person is subject to a Federal privacy law described in paragraph (2) of this subsection, the regulations promulgated under subsection (a) shall not apply to the person with respect to any information or records governed by that Federal privacy law. (2) Other Federal privacy laws described The Federal privacy laws described in this paragraph are as follows: (A) The regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 (i) a person described in section 1172(a) of the Social Security Act ( 42 U.S.C. 1320d–1(a) (ii) transactions referred to in section 1173(a)(1) of the Social Security Act ( 42 U.S.C. 1320d–2(a)(1) (B) Section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g Family Educational Rights and Privacy Act of 1974 (C) Section 552a of title 5, United States Code. (3) Conflicts (A) Children's Online Privacy Protection Act In the case of a conflict between the regulations promulgated under subsection (a) of this section and the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6501 (B) Gramm-Leach-Bliley Act In the case of a conflict between the regulations promulgated under subsection (a) of this section and title V of the Gramm-Leach-Bliley Act of 1999 ( 15 U.S.C. 6801 5. Enforcement (a) Unfair or deceptive acts or practices A violation of a regulation promulgated under section 4(a) shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (b) Powers of Commission (1) In general Except as provided in paragraph (3), if the Commission promulgates regulations under section 4(a), the Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 (2) Privileges and immunities Except as provided in paragraph (3), any person who violates a regulation promulgated under section 4(a) shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 (3) Common carriers Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act ( 15 U.S.C. 44 47 U.S.C. 151 (4) Authority preserved Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law. 6. Effect on State laws This Act, including any regulations promulgated under section 4(a), shall supersede any provision of the law of a State relating to a covered provider that is subject to such a regulation, to the extent that the provision relates to the maintenance of— (1) records covered by this Act; or (2) any other personally identifiable information or personal identification information.

Summary: American Data Dissemination Act of 2019 or the ADD Act This bill requires the Federal Trade Commission to recommend legislative action and propose regulations to impose privacy requirements on providers of internet services. Such regulations shall restrict a provider from disclosing a user's records, provide a user with the right to access and correct records maintained by a provider, establish practices for the collection and maintenance of records, and exempt certain small providers from the regulations' requirements.