Protecting Personal Information Act of 2019

To require entities to provide consumers with the opportunity to prohibit the entity from collecting or using certain data concerning the consumer and to request deletion of such data. 1. Short title This Act may be cited as the Protecting Personal Information Act of 2019 2. Requirements for entities with respect to the collection or use of certain data concerning the consumer (a) Opportunity To prohibit the entity from collecting or using certain data A covered entity shall, prior to collecting covered data concerning an individual, provide the individual with an opportunity to prohibit the covered entity from collecting such data or selling or otherwise transferring such data to a third party. (b) Deletion upon request Upon a request from an individual for whom a covered entity has collected covered data, the covered entity shall, without undue delay, delete such covered data. 3. Enforcement by the Federal Trade Commission (a) Unfair or deceptive acts or practices A violation of section 2 shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (b) Powers of Commission (1) In general The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act 15 U.S.C. 41 (2) Privileges and immunities Any covered entity that violates section 2 shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 (3) Authority preserved Nothing in this Act shall be construed to limit the authority of the Federal Trade Commission under any other provision of law. 4. Enforcement by States (a) In general In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any covered entity subject to section 2 in a practice that violates such section, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States— (1) to enjoin further violation of such section by such person; (2) to compel compliance with such section; and (3) to obtain damages, restitution, or other compensation on behalf of such residents. (b) Rights of Federal Trade Commission (1) Notice to Federal Trade Commission (A) In general Except as provided in subparagraph (C), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under subsection (a) not later than 10 days before initiating the civil action. (B) Contents The notification required by subparagraph (A) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action. (C) Exception If it is not feasible for the attorney general of a State to provide the notification required by subparagraph (A) before initiating a civil action under subsection (a), the attorney general shall notify the Commission immediately upon instituting the civil action. (2) Intervention by Federal Trade Commission The Commission may— (A) intervene in any civil action brought by the attorney general of a State under subsection (a); and (B) upon intervening— (i) be heard on all matters arising in the civil action; and (ii) file petitions for appeal of a decision in the civil action. (c) Investigatory powers Nothing in this section may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence. (d) Preemptive action by Federal Trade Commission If the Commission institutes a civil action or an administrative action with respect to a violation of section (2), the attorney general of a State may not, during the pendency of such action, bring a civil action under subsection (a) against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action. (e) Venue; service of process (1) Venue Any action brought under subsection (a) may be brought in— (A) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or (B) another court of competent jurisdiction. (2) Service of process In an action brought under subsection (a), process may be served in any district in which the defendant— (A) is an inhabitant; or (B) may be found. (f) Actions by other State officials (1) In general In addition to civil actions brought by attorneys general under subsection (a), any other consumer protection officer of a State who is authorized by the State to do so may bring a civil action under subsection (a), subject to the same requirements and limitations that apply under this section to civil actions brought by attorneys general. (2) Savings provision Nothing in this section may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State. 5. Definitions In this Act: (1) Commission The term Commission (2) Covered data (A) In general Except as provided in subparagraph (B), the term covered data (i) Personally identifiable information. (ii) Unique identifier information. (iii) Any information that is collected, used, or stored in connection with personally identifiable information or unique identifier information in a manner that may reasonably be used by the party collecting the information to identify a specific individual. (B) Exception The term covered data (i) Personally identifiable information obtained from public records that is not merged with covered information gathered elsewhere. (ii) Personally identifiable information that is obtained from a forum— (I) where the individual voluntarily shared the information or authorized the information to be shared; and (II) that— (aa) is widely and publicly available and was not made publicly available in bad faith; and (bb) contains no restrictions on who can access and view such information. (iii) Personally identifiable information reported in public media. (iv) Personally identifiable information dedicated to contacting an individual at the individual's place of work. (3) Covered entity The term covered entity (A) that collects covered data concerning individuals; (B) that— (i) has gross annual revenue in excess of $25,000,000; (ii) annually buys, receives, sells, or shares covered data of 50,000 or more individuals; or (iii) derives 50 percent or more of its annual revenue from selling individuals' covered data; and (C) that is— (i) a person over which the Commission has authority pursuant to section 5(a)(2) of the Federal Trade Commission Act 15 U.S.C. 45(a)(2) (ii) a common carrier subject to the Communications Act of 1934 47 U.S.C. 151 Acts to regulate commerce Federal Trade Commission Act 15 U.S.C. 44 Federal Trade Commission Act 15 U.S.C. 45(a)(2) (iii) a nonprofit organization, including any organization described in section 501(c) Acts to regulate commerce Federal Trade Commission Act 15 U.S.C. 44 Federal Trade Commission Act 15 U.S.C. 45(a)(2) (4) Delete The term delete (5) Personally identifiable information The term personally identifiable information (A) Any of the following information about an individual: (i) The first name (or initial) and last name of an individual, whether given at birth or time of adoption, or resulting from a lawful change of name. (ii) The postal address of a physical place of residence of such individual. (iii) An e-mail address. (iv) A telephone number or mobile device number. (v) A social security number or other government issued identification number issued to such individual. (vi) The account number of a credit card issued to such individual. (vii) Unique identifier information that alone can be used to identify a specific individual. (viii) Biometric data about such individual, including fingerprints and retina scans. (B) If used, transferred, or stored in connection with one or more of the items of information described in subparagraph (A), any of the following: (i) A date of birth. (ii) The number of a certificate of birth or adoption. (iii) A place of birth. (iv) Unique identifier information that alone cannot be used to identify a specific individual. (v) Precise geographic location, at the same degree of specificity as a global positioning system or equivalent system, and not including any general geographic information that may be derived from an Internet Protocol address. (vi) Information about an individual's destination, location, and amount of uses of voice services, regardless of technology used. (vii) Any other information concerning an individual that may reasonably be used by the party using, collecting, or storing that information to identify that individual. (6) Third party The term third party (A) is— (i) not related to the covered entity by common ownership or corporate control; or (ii) related to the covered entity by common ownership or corporate control and an ordinary consumer would not understand that the covered entity and the person were related by common ownership or corporate control; (B) is not a service provider used by the covered entity to receive covered data in performing services or functions on behalf of and under the instruction of the covered entity; and (C) with respect to the collection of covered data of an individual, does not have an established business relationship with the individual and does not identify itself to the individual at the time of such collection in a clear and conspicuous manner that is visible to the individual.

Summary: Protecting Personal Information Act of 2019 This bill requires covered entities to provide consumers with the opportunity to prohibit the collection, sale, or transfer of specified personally identifiable information about the consumer and requires the covered entity to, upon request by the consumer, delete any such personally identifiable information that has been collected or stored by the covered entity. This bill applies to (1) business corporations, (2) nonprofits, and (3) common carriers that (1) have annual revenue greater than $25 million, (2) have access to personally identifiably information of 50,000 or more individuals, or (3) derive at least 50% of their revenue from selling such information. These requirements may be enforced by the Federal Trade Commission or by a state attorney general bringing a lawsuit on behalf of the state's residents.