I 
116TH CONGRESS 
1ST SESSION H. R. 4978 
To provide for individual rights relating to privacy of personal information, 
to establish privacy and security requirements for covered entities relating 
to personal information, and to establish an agency to be known as 
the United States Digital Privacy Agency to enforce such rights and 
requirements, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 5, 2019 
Ms. ESHOO (for herself and Ms. LOFGREN) introduced the following bill; 
which was referred to the Committee on Energy and Commerce, and in 
addition to the Committee on the Judiciary, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To provide for individual rights relating to privacy of per-
sonal information, to establish privacy and security re-
quirements for covered entities relating to personal infor-
mation, and to establish an agency to be known as the 
United States Digital Privacy Agency to enforce such 
rights and requirements, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Online Privacy Act of 2019’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Definitions. 
Sec. 3. Prohibition on waivers. 
Sec. 4. Effective date. 
Sec. 5. Journalism protection. 
Sec. 6. Small business compliance ramp. 
Sec. 7. Criminal prohibition on disclosing personal information. 
Sec. 8. Limitation on disclosing nonredacted government records. 
TITLE I—INDIVIDUAL RIGHTS 
Sec. 101. Right of access. 
Sec. 102. Right of correction. 
Sec. 103. Right of deletion. 
Sec. 104. Right of portability. 
Sec. 105. Right to human review of automated decisions. 
Sec. 106. Right to individual autonomy. 
Sec. 107. Right to be informed. 
Sec. 108. Right to impermanence. 
Sec. 109. Exemptions, exceptions, fees, timelines, and rules of construction for 
rights under this title. 
TITLE II—REQUIREMENTS FOR COVERED ENTITIES, SERVICE 
PROVIDERS, AND THIRD PARTIES 
Sec. 201. Minimization and articulated basis for collection, processing, and 
maintenance. 
Sec. 202. Minimization and records of access by employees and contractors. 
Sec. 203. Prohibition on the collection or maintenance of personal information. 
Sec. 204. Prohibitions on the disclosure of personal information. 
Sec. 205. Disclosure to entities not subject to United States jurisdiction or not 
compliant with this Act. 
Sec. 206. Prohibition on reidentification. 
Sec. 207. Restrictions on collection, processing, and disclosure of contents of 
communications. 
Sec. 208. Prohibition on discriminatory processing. 
Sec. 209. Restrictions on genetic information. 
Sec. 210. Requirements for notice and consent processes and privacy policies. 
Sec. 211. Prohibition on deceptive notice and consent processes and privacy 
policies. 
Sec. 212. Notice and consent required. 
Sec. 213. Privacy policy. 
Sec. 214. Information security requirements. 
Sec. 215. Notification of data breach or data sharing abuse. 
TITLE III—UNITED STATES DIGITAL PRIVACY AGENCY 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
Sec. 301. Establishment. 
Sec. 302. Executive and administrative powers. 
Sec. 303. Rulemaking authority. 
Sec. 304. Personnel. 
Sec. 305. Complaints of individuals. 
Sec. 306. User advisory board. 
Sec. 307. Academic and research advisory board. 
Sec. 308. Small business and investor advisory board. 
Sec. 309. Consultation. 
Sec. 310. Reports. 
Sec. 311. Grants for developing open-source machine learning training data. 
Sec. 312. Annual audits. 
Sec. 313. Inspector General. 
Sec. 314. Authorization of appropriations. 
TITLE IV—ENFORCEMENT 
Sec. 401. Definitions. 
Sec. 402. Investigations and administrative discovery. 
Sec. 403. Hearings and adjudication proceedings. 
Sec. 404. Litigation authority. 
Sec. 405. Coordination with other Federal agencies. 
Sec. 406. Enforcement by States. 
Sec. 407. Private rights of action. 
Sec. 408. Relief available. 
Sec. 409. Referral for criminal proceedings. 
Sec. 410. Whistleblower enforcement. 
TITLE V—RELATION TO OTHER LAW 
Sec. 501. Relation to other Federal law. 
Sec. 502. Severability. 
SEC. 2. DEFINITIONS. 
In this Act: 
(1) AGENCY.—The term ‘‘Agency’’ means the 
United States Digital Privacy Agency established by 
section 301. 
(2) BEHAVIORAL PERSONALIZATION.— 
(A) IN GENERAL.—The term ‘‘behavioral 
personalization’’ means the processing of an in-
dividual’s personal information, using an algo-
rithm, model, or other means built using that 
individual’s personal information collected over 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
a period of time, or an aggregate of the per-
sonal information of one or more similarly situ-
ated individuals and designed to— 
(i) alter, influence, guide, or predict 
an individual’s behavior; 
(ii) tailor or personalize a product or 
service; or 
(iii) filter, sort, limit, promote, display 
or otherwise differentiate between specific 
content or categories of content that would 
otherwise be accessible to the individual. 
(B) EXCLUSIONS.—The term ‘‘behavioral 
personalization’’ does not include the use of his-
torical personal information to merely prevent 
the display of or provide additional information 
about previously accessed content. 
(3) COLLECT.—The term ‘‘collect’’ includes, 
with respect to personal information or contents of 
communication, obtaining such information in any 
manner, except when solely transmitting, routing, 
providing intermediate storage for, or providing con-
nections for personal information through a system 
or network. 
(4) CONTENTS.—The term ‘‘contents’’, when 
used with respect to communication, has the mean-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
ing given such term in section 2510 of title 18, 
United States Code. 
(5) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means a person who— 
(i) intentionally collects, processes, or 
maintains personal information; and 
(ii) sends or receives such personal in-
formation over the internet or a similar 
communications network. 
(B) EXCLUSION.—The term ‘‘covered enti-
ty’’ does not include a natural person, except to 
the extent such person is engaged in a commer-
cial activity that is more than de minimis. 
(6) DATA BREACH.—The term ‘‘data breach’’ 
means unauthorized access to or acquisition of per-
sonal information or contents of communications 
maintained by such covered entity. 
(7) DATA SHARING ABUSE.—The term ‘‘data 
sharing abuse’’ means processing, by a third party, 
of personal information or contents of communica-
tions disclosed by a covered entity to the third party, 
for any purpose other than— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(A) a purpose specified by the covered en-
tity to the third party at the time of disclosure; 
or 
(B) a purpose to which the individual to 
whom the information relates has consented. 
(8) DE-Identified.— 
(A) IN
GENERAL.—The term ‘‘de-identi-
fied’’ means information that cannot reasonably 
identify, relate to, describe, reference, be capa-
ble of being associated with, or be linked, di-
rectly or indirectly, to a particular individual or 
device, provided that a business that uses de- 
identified information— 
(i) has de-identified the personal in-
formation using best practices for the 
types of data the information contains; 
(ii) has implemented technical safe-
guards that prohibit re-identification of the 
individual with whom the information was 
linked; 
(iii) has implemented business proc-
esses that specifically prohibit re-identifica-
tion of the information; 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(iv) has implemented business proc-
esses to prevent inadvertent release of de- 
identified information; and 
(v) makes no attempt to re-identify 
the information. 
(B) The Director may determine that a 
methodology of de-identifying personal informa-
tion is insufficient for the purposes of this defi-
nition. 
(9) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Agency. 
(10) DISCLOSE.—The term ‘‘disclose’’ means, 
with respect to personal information or contents of 
communication, to sell, release, transfer, share, dis-
seminate, make available, or otherwise cause to be 
communicated such information to a third party. 
(11) 
INDIVIDUAL.—The 
term 
‘‘individual’’ 
means a natural person residing in the United 
States. 
(12) MAINTAIN.—The term ‘‘maintain’’ means, 
with respect to personal information or contents of 
communication, to store, secure, or otherwise cause 
the retaining of such information, or taking actions 
necessary for such purposes. 
(13) PERSONAL INFORMATION.— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(A) IN GENERAL.—The term ‘‘personal in-
formation’’ means any information maintained 
by a covered entity that is linked or reasonably 
linkable to a specific individual or a specific de-
vice, including de-identified personal informa-
tion and the means to behavioral personaliza-
tion created for or linked to a specific indi-
vidual. 
(B) EXCLUSIONS.—The term ‘‘personal in-
formation’’ does not include— 
(i) publicly available information re-
lated to an individual; or 
(ii) information derived or inferred 
from personal information, if the derived 
or inferred information is not linked or 
reasonably linkable to a specific individual. 
(14) PRIVACY
HARM.—The term ‘‘privacy 
harm’’ means adverse consequences or potential ad-
verse consequences to an individual or society arising 
from the collection, processing, maintenance, or dis-
closure of personal information, including— 
(A) direct or indirect financial loss or eco-
nomic harm; 
(B) physical harm; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(C) psychological harm, including anxiety, 
embarrassment, fear, and other demonstrable 
mental trauma; 
(D) adverse outcomes or decisions with re-
spect to the eligibility of an individual for 
rights, benefits, or privileges in employment (in-
cluding hiring, firing, promotion, demotion, and 
compensation), credit and insurance (including 
denial of an application or obtaining less favor-
able terms), housing, education, professional 
certification, or the provision of health care and 
related services; 
(E) stigmatization or reputational harm; 
(F) price discrimination; 
(G) other adverse consequences that affect 
the private life of an individual, including pri-
vate family matters and actions and commu-
nications within the home of such individual or 
a similar physical, online, or digital location 
where such individual has a reasonable expecta-
tion that personal information will not be col-
lected, processed, or retained; 
(H) chilling of free expression or action of 
an individual, group of individuals, or society 
generally, due to perceived or actual pervasive 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
and excessive collection, processing, disclosure, 
or maintenance of personal information by a 
covered entity; 
(I) impairing the autonomy of an indi-
vidual, group of individuals, or society gen-
erally; and 
(J) other adverse consequences or potential 
adverse consequences, consistent with the provi-
sions of this Act, as determined by the Direc-
tor. 
(15) PRIVACY PRESERVING COMPUTING.— 
(A) IN GENERAL.—The term ‘‘privacy pre-
serving computing’’ means— 
(i) the collecting, processing, dis-
closing, or maintaining of personal infor-
mation that has been encrypted or other-
wise rendered unintelligible using a means 
that cannot be reversed by a covered enti-
ty, or a covered entity’s service provider, 
such that— 
(I) if such personal information 
could be rendered intelligible through 
cooperation 
or 
sharing 
of 
cryp-
tographic secrets by multiple persons, 
the covered entity has both technical 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
tected by privacy preserving com-
puting. 
(B) INSUFFICIENT METHODOLOGIES.—The 
Director may determine that a methodology of 
privacy preserving computing is insufficient for 
the purposes of this definition. 
(16) PROCESS.—The term ‘‘process’’ means to 
perform or cause to be performed any operation or 
set of operations on personal information or contents 
of communication, whether or not by automated 
means. 
(17) PROTECTED CLASS.—The term ‘‘protected 
class’’ means the actual or perceived race, color, eth-
nicity, national origin, religion, sex (including sexual 
orientation and gender identity), familial status, or 
disability of an individual or group of individuals. 
(18) PUBLICLY
AVAILABLE
INFORMATION.— 
The term ‘‘publicly available information’’ means— 
(A) information that is lawfully made 
available from Federal, State, or local govern-
ment records; 
(B) information about a public individual 
or official that is made publicly accessible, with-
out restrictions on accessibility other than the 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
general authorization to access the services used 
to make the information accessible; 
(C) information made publicly accessible 
by the individual to whom it pertains, without 
restrictions on accessibility other than the gen-
eral authorization to access the services used to 
make the information accessible, and that such 
individual has the ability to delete or change 
without relying on a request under section 102 
or 103 of this Act; and 
(D) does not include— 
(i) biometric information collected by 
a covered entity relating to an individual 
without the individual’s knowledge; 
(ii) information used for a purpose 
that is not compatible with the purpose for 
which the information is maintained and 
made available in government records; 
(iii) information obtained from gov-
ernment records for the purpose of selling 
such information; or 
(iv) information used to contact or lo-
cate a private individual either physically 
or electronically. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(19) REASONABLE
MECHANISM.—The term 
‘‘reasonable mechanism’’ means, in the case of a 
mechanism for individuals to exercise a right under 
title I or interact with a covered entity under title 
II, that such mechanism— 
(A) is equivalent in availability and ease of 
use to that of other mechanisms for commu-
nicating or interacting with the covered entity; 
and 
(B) includes an online means of exercising 
such right or engaging in such interaction, if 
such individuals communicate or interact with 
such covered entity through an online medium 
or if such covered entity provides information 
processing services through a public or widely 
available application programming interface (or 
similar mechanism). 
(20) SELL AND SALE.— 
(A) IN GENERAL.—The terms ‘‘sell’’ and 
‘‘sale’’ means the disclosure of personal infor-
mation for monetary consideration by a covered 
entity to a third party for the purposes of proc-
essing, maintaining or disclosing such personal 
information at the third party’s discretion. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(B) EXCLUSIONS.—The terms ‘‘sell’’ and 
‘‘sale’’ do not include— 
(i) the disclosure of personal data to 
a third party with which the individual has 
a direct relationship for purposes of pro-
viding a product or service requested by 
the individual or otherwise in a manner 
that is consistent with an individual’s rea-
sonable expectations considering the con-
text in which the individual provided the 
personal information to the covered entity; 
(ii) the disclosure or transfer of per-
sonal information to a subsidiary or an af-
filiate of the covered entity; or 
(iii) the disclosure or transfer of per-
sonal information to a third party as an 
asset that is part of a merger, acquisition, 
bankruptcy, or other transaction in which 
the third party assumes control of all or 
part of the covered entity’s assets, unless 
such assets are limited to personal infor-
mation unless personal information makes 
up the majority of the value of such assets. 
(21) SERVICE PROVIDER.— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(A) IN GENERAL.—The term ‘‘service pro-
vider’’ means a covered entity who— 
(i) processes, discloses, or maintains 
personal information, where such person 
does not process, disclose, or maintain the 
personal information other than in accord-
ance with the directions and on behalf of 
another covered entity; 
(ii) does not directly collect personal 
information from or control the mechanism 
for collecting personal information from an 
individual; 
(iii) does not earn revenue from proc-
essing, maintaining, or disclosing personal 
information disclosed to the service pro-
vider by a covered entity except by pro-
viding contracted services to another cov-
ered entity; 
(iv) does not disclose personal infor-
mation to another covered entity unless it 
was provided by that covered entity or re-
sulted from maintaining or processing per-
formed on personal information exclusively 
provide by that covered entity; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(v) does not offer services that allow 
another covered entity to target specific in-
dividuals using personal information not 
provided by that covered entity; 
(vi) assists a covered entity on behalf 
of which it processes personal information 
to comply with title I, with respect to per-
sonal information processed or maintained 
by the service provider on behalf of the 
covered entity, including providing tools for 
such covered entities requirements under 
title I if requested; and 
(vii) does not link the personal infor-
mation provided by another covered entity 
to personal information from any other 
source. 
(B) Any such person, and the personal in-
formation they disclose, process, or maintain, 
shall be treated as a service provider under this 
Act only to the extent that such person com-
plies with the requirements under (A). 
(22) SIGNIFICANT PRIVACY HARM.—The term 
‘‘significant privacy harm’’ means adverse con-
sequences to an individual arising from the collec-
tion, processing, maintenance, or disclosure of per-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
sonal information, limited to subparagraph (A), (B), 
or (D) of paragraph (14). 
(23) SMALL BUSINESS.—The term ‘‘small busi-
ness’’ means a covered entity that— 
(A) does not earn revenue from the sale of 
personal information; 
(B) earns less than half of annual revenues 
from the processing of personal information for 
targeted or personalized advertising; 
(C) has not, at any time during the pre-
ceding 6-month period, maintained personal in-
formation of 250,000 or more individuals; 
(D) has fewer than 200 employees; and 
(E) received less than $25,000,000 in 
gross revenue in the preceding 12-month pe-
riod. 
(24) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
United States, and each federally recognized Indian 
Tribe. 
(25) THIRD PARTY.—The term ‘‘third party’’ 
means, with respect to a covered entity, a person— 
(A) to whom such covered entity disclosed 
personal information; and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(B) is not— 
(i) such covered entity; 
(ii) a subsidiary or corporate affiliate 
of such covered entity; or 
(iii) a service provider of such covered 
entity. 
SEC. 3. PROHIBITION ON WAIVERS. 
(a) IN GENERAL.—The provisions under this Act 
may not be waived. Any agreement purporting to waive 
compliance with or modify any provision of this Act shall 
be void as contrary to public policy. 
(b) PROHIBITION
ON PREDISPUTE ARBITRATION 
AGREEMENTS.—No predispute arbitration agreement 
shall be valid or enforceable with respect to any claims 
under this Act. 
SEC. 4. EFFECTIVE DATE. 
(a) IN GENERAL.—This Act shall apply beginning on 
the date that is 1 year after the date of the enactment 
of this Act. 
(b) AUTHORITY TO PROMULGATE REGULATIONS AND 
TAKE CERTAIN OTHER ACTIONS.—Nothing in subsection 
(a) affects the authority to take an action expressly re-
quired by a provision of this Act to be taken before the 
effective date described in such subsection. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 5. JOURNALISM PROTECTION. 
(a) IN GENERAL.—Covered entities engaged in jour-
nalism shall not be subject to the obligations imposed 
under this Act to the extent that those obligations directly 
infringe on the journalism rather than the business prac-
tices of the covered entity, so long as, the covered entity 
has technical safeguards and business processes that pre-
vent the collection, processing, maintaining, or disclosure 
of such personal information for business practices other 
than journalism. 
(b) JOURNALISM.—The term ‘‘journalism’’ includes 
the collecting, maintaining, processing, and disclosing of 
personal information about a public individual or official, 
or that otherwise concerns matters of public interest, for 
dissemination to the public. 
SEC. 6. SMALL BUSINESS COMPLIANCE RAMP. 
Upon losing its status as a small business, a covered 
entity shall have nine months to comply with provisions 
of this Act that a small business is exempt from complying 
with. 
SEC. 7. CRIMINAL PROHIBITION ON DISCLOSING PER-
SONAL INFORMATION. 
Chapter 41 of title 18, United States Code, is amend-
ed by adding at the end the following: 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
‘‘§ 881. Disclosure of personal information with the 
intent to cause harm 
‘‘Whoever uses a channel of interstate or foreign com-
merce to knowingly disclose an individual’s personal infor-
mation— 
‘‘(1) with the intent to threaten, intimidate, or 
harass any person, incite or facilitate the commis-
sion of a crime of violence against any person, or 
place any person in reasonable fear of death or seri-
ous bodily injury; or 
‘‘(2) with the intent that the information will be 
used to threaten, intimidate, or harass any person, 
incite or facilitate the commission of a crime of vio-
lence against any person, or place any person in rea-
sonable fear of death or serious bodily injury, 
shall be fined under this title or imprisoned not more than 
5 years, or both.’’. 
SEC. 8. LIMITATION ON DISCLOSING NONREDACTED GOV-
ERNMENT RECORDS. 
(a) IN GENERAL.—A Federal or State government 
entity may not use a channel of interstate commerce to 
disclose the personal information of an individual in a gov-
ernment record without an agreement prohibiting the re-
cipient of such information from selling the information 
without the express consent of the individual for each dis-
closure. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(b) EXCEPTION.—Notwithstanding subsection (a), 
nothing in this section shall prohibit the disclosure of per-
sonal information using a channel of interstate commerce 
to another government entity without consent of the indi-
vidual. 
TITLE I—INDIVIDUAL RIGHTS 
SEC. 101. RIGHT OF ACCESS. 
(a) IN GENERAL.—A covered entity shall make avail-
able a reasonable mechanism by which an individual may 
access— 
(1) the categories of personal information and 
contents of communications of such individual that 
is maintained by such covered entity, including, in 
the case of personal information that such covered 
entity did not collect from such individual, how and 
from whom such covered entity obtained such per-
sonal information; 
(2) a list of the third parties, subsidiaries, and 
corporate affiliates, to which such covered entity has 
disclosed and from which such covered entity has, at 
any time on or after the effective date specified in 
section 4(a), obtained the personal information of 
such individual; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(3) a concise and clear description of the busi-
ness or commercial purposes of such covered enti-
ty— 
(A) for collecting, processing, or maintain-
ing the personal information of such individual; 
and 
(B) for disclosing to a third party the per-
sonal information of such individual; and 
(4) a list of automated decision-making proc-
esses that an individual has a right to request 
human review of under section 105 with a concise 
and clear description of the implications and in-
tended effects of such process. 
(b) EXCEPTION FOR PUBLICLY ACCESSIBLY INFOR-
MATION.—A covered entity that makes available informa-
tion required in subsection (a) shall be considered in com-
pliance with such requirements if the covered entity pro-
vides an individual instructions on how to access a public 
posting of such information, including in a privacy policy, 
if the instructions are easy and do not require payment. 
(c) SMALL
BUSINESSES
EXCLUDED.—Subsection 
(a)(3) does not apply to a small business. 
SEC. 102. RIGHT OF CORRECTION. 
(a) DISPUTE BY INDIVIDUAL.—A covered entity shall 
make available a reasonable mechanism by which an indi-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(c) SMALL BUSINESSES EXCLUDED.—This section 
does not apply to a small business. 
SEC. 103. RIGHT OF DELETION. 
(a) REQUEST
BY INDIVIDUAL.—A covered entity 
shall make available a reasonable mechanism by which an 
individual may request the deletion of personal informa-
tion and contents of communications of such individual 
maintained by such covered entity, including any such in-
formation that such covered entity acquired from a third 
party or inferred from other information maintained by 
such covered entity. 
(b) DELETION BY COVERED ENTITY.—A covered en-
tity receiving a request for deletion under subsection (a) 
shall— 
(1) delete such information and notify such in-
dividual that such information has been deleted; or 
(2) notify such individual that such covered en-
tity is denying the request for deletion in reliance on 
an exemption or exception provided by section 
109(g) (with the notification containing an identi-
fication of the specific exemption or exception relied 
upon). 
SEC. 104. RIGHT OF PORTABILITY. 
(a) DETERMINATION OF PORTABLE CATEGORIES.— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(1) ANNUAL
DETERMINATION.—Not less fre-
quently than once per year, the Director shall— 
(A) establish categories of products and 
services offered by covered entities, based on 
similarities in the products and services; 
(B) determine which categories established 
under subparagraph (A) are portable categories; 
and 
(C) publish in the Federal Register a list 
of portable categories determined under sub-
paragraph (B). 
(2) OPPORTUNITY FOR PUBLIC COMMENT.—Be-
fore publishing the final list under paragraph (1)(C), 
the Director shall— 
(A) publish a draft of such list in the Fed-
eral Register; and 
(B) provide for an opportunity for public 
comment on such draft list. 
(b) EXERCISE OF RIGHT.— 
(1) IN GENERAL.—A covered entity that offers 
a product or service in a portable category shall 
make available to an individual whose personal infor-
mation or contents of communications such entity 
maintains a reasonable mechanism by which such in-
dividual may— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(A) download, in a format that is struc-
tured, commonly used, and machine-readable— 
(i) any personal information of such 
individual that such individual has pro-
vided to such covered entity, with the op-
tion to download such information by cat-
egory that is accessible under section 101 
of this Act; and 
(ii) any contents of communications; 
and 
(B) using a real-time application program-
ming interface, or similar mechanism, transmit 
all personal information and contents of com-
munications of or related to such individual 
(whether or not provided to such covered entity 
by such individual) from such covered entity to 
another covered entity in accordance with sub-
section (c). 
(2) REQUIREMENTS
FOR
APPLICATION
PRO-
GRAMMING INTERFACE.—The application program-
ming interface, or similar mechanism, required by 
paragraph (1)(B) shall— 
(A) be publicly documented; 
(B) allow the option of data to be obtained 
by category that is accessible under section 101; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(C) include a publicly available, fully func-
tional test version for development purposes; 
and 
(D) be of similar quality to mechanisms 
used internally by the covered entity. 
(c) REQUIREMENTS FOR ACCESS TO APPLICATION 
PROGRAMMING INTERFACE.— 
(1) ACCESS.—A covered entity shall provide ac-
cess to the application programming interface or 
similar mechanism required by subsection (b)(1)(B) 
upon the request of another covered entity if the re-
questing covered entity has self-certified, using the 
procedures established by the Director under para-
graph (3)(A), that such requesting covered entity— 
(A) is a covered entity; 
(B) can have personal information dis-
closed to it under section 205 of this Act; 
(C) is, at the time of the self-certification, 
in compliance with all requirements of this Act 
(including provisions a small business is other-
wise exempt from complying with); 
(D) will continue to comply with all re-
quirements of this Act; and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(E) will only use such application program-
ming interface or similar mechanism at the ex-
press request of an individual. 
(2) DENIAL OF ACCESS.— 
(A) IN GENERAL.—A covered entity may 
deny access to the application programming 
interface or similar mechanism required by sub-
section (b)(1)(B) if such covered entity has an 
objective, reasonable belief that the requesting 
covered entity has failed to meet the require-
ments for self-certification under paragraph (1). 
(B) REVIEW.—In accordance with the pro-
cedures established under paragraph (3)(B), a 
covered entity the request of which is denied 
under subparagraph (A) may petition the Di-
rector for review of the denial. If the Director 
finds that such denial is unreasonable, the Di-
rector may impose a penalty, to be established 
in such procedures, on the covered entity that 
denied the request. 
(3) 
CERTIFICATION
AND
REVIEW
PROCE-
DURES.—The Director shall establish— 
(A) procedures for a covered entity to self- 
certify under paragraph (1); and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(B) procedures for the review of petitions 
under paragraph (2)(B), including penalties for 
unreasonable denials. 
(d) SMALL BUSINESSES EXCLUDED.—This section 
does not apply to a small business. 
(e) DEFINITIONS.—In this section: 
(1) PORTABLE CATEGORY.—The term ‘‘portable 
category’’ means a category of products and services 
established by the Director under subsection 
(a)(1)(A)— 
(A) for which the sum obtained by adding 
the number of users or estimated users of each 
product or service in such category is greater 
than 10,000,000; and 
(B) that— 
(i) has an estimated Herfindahl- 
Hirschman Index of 2,000 or greater; 
(ii) the total number of covered enti-
ties offering products and services in such 
category is 3 or less; or 
(iii) the Director otherwise determines 
that a category would benefit from encour-
aging increased competition. 
(2) USERS.—The term ‘‘users’’ means, with re-
spect to a product or service, the monthly active 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
users, subscribers, or customers (or a reasonable 
proxy or substitute therefor determined by the Di-
rector) of such product or service. 
SEC. 105. RIGHT TO HUMAN REVIEW OF AUTOMATED DECI-
SIONS. 
For any decision by a covered entity based solely on 
automated processing of personal information of an indi-
vidual, if such processing increases reasonably foreseeable 
significant privacy harms for such individual, such covered 
entity shall— 
(1) inform such individual of what personal in-
formation is or may be used for such decision; 
(2) make available a reasonable mechanism by 
which such individual may request human review of 
such decision; and 
(3) if such individual requests such a review, 
conduct such review within a reasonable amount of 
time after such request. 
SEC. 106. RIGHT TO INDIVIDUAL AUTONOMY. 
(a) IN GENERAL.—A covered entity shall not collect, 
process, maintain, or disclose an individual’s personal in-
formation to: 
(1) create, improve upon, or maintain; 
(2) process with; or 
(3) otherwise link an individual with; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(d) EXCEPTION TO BEHAVIORAL PROCESSING.—Not-
withstanding subsections (a) and (b), a covered entity may 
create or process using behavioral personalization algo-
rithms, models, or other mechanisms for the purpose of 
increasing the usability of the product or service provided 
by a covered entity that— 
(1) are built using aggregated personal infor-
mation that is representative of all the personal in-
formation the covered entity maintains; and 
(2) have an output that is both uniform across 
the individuals that use the product or service and 
independent of a specific individual’s inherent or be-
havioral characteristics. 
(e) USABILITY.—The term ‘‘usability’’ as used in 
subsection (d) does not include optimizations or other al-
terations to the product or service that are made with the 
primary purpose of increasing the amount of time an indi-
vidual engages with or uses the product or service, unless 
such increase benefits the individual 
(f) SMALL BUSINESSES EXCLUDED.—This section 
does not apply to a small business. 
SEC. 107. RIGHT TO BE INFORMED. 
A covered entity that collects personal information of 
an individual with whom such covered entity does not have 
an existing relationship (as of the time of the collection), 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
if such personal information includes contact information, 
shall notify such individual within 30 days, in writing if 
possible and at no charge to the individual, that such cov-
ered entity has collected the personal information of such 
individual. 
SEC. 108. RIGHT TO IMPERMANENCE. 
(a) LIMITATION ON MAINTENANCE OF PERSONAL IN-
FORMATION.—A covered entity shall not maintain per-
sonal information for more time than expressly consented 
to by an individual whose personal information is being 
maintained. 
(b) CONSENT.—A covered entity must obtain express 
affirmative consent from an individual before maintaining 
the personal information of such individual for any dura-
tion. Such consent may be obtained for categories of per-
sonal information and shall give an individual options to 
affirmatively choose granting a covered entity consent for 
various durations, at least including— 
(1) for no longer than needed to complete the 
specific request or transaction (including a reason-
able estimate of such duration by the covered enti-
ty); 
(2) until consent is revoked; and 
(3) one or more additional durations based on 
reasonable expectations and norms for the mainte-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
nance of the category of personal information being 
maintained. 
(c) EXCEPTION FOR IMPLIED CONSENT.—Where the 
long-term maintenance of personal information is, on its 
face, obvious and a core feature of the product or service 
at the request of the individual, and the personal informa-
tion is maintained only to provide such product or service, 
subsections (a) and (b) shall not apply. 
SEC. 109. EXEMPTIONS, EXCEPTIONS, FEES, TIMELINES, 
AND RULES OF CONSTRUCTION FOR RIGHTS 
UNDER THIS TITLE. 
(a) EXEMPTIONS FOR PERSONAL INFORMATION FOR 
PARTICULAR PURPOSES.— 
(1) IN
GENERAL.—This title does not apply 
with respect to personal information that is col-
lected, processed, maintained, or disclosed for any of 
the following purposes (or a combination of such 
purposes), where a covered entity has technical safe-
guards and business processes that limit the collec-
tion, processing, maintaining, or disclosure of such 
personal information to the following purposes: 
(A) Detecting, responding to, or preventing 
security incidents or threats. 
(B) Protecting against malicious, decep-
tive, fraudulent, or illegal activity. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(C) Complying with specific law enforce-
ment requests or court orders. 
(D) Protecting a legally recognized privi-
lege or other legal right. 
(E) Protecting public safety. 
(F) Collection, processing, or maintenance 
by an employer pursuant to an employer-em-
ployee relationship of records about employees 
or employment status, except— 
(i) where the information would not 
be reasonably expected to be collected in 
the context of an employee’s regular du-
ties; or 
(ii) was disclosed to the employer by 
a third party. 
(G) Preventing prospective abuses of a 
service by an individual whose account has been 
previously terminated. 
(H) Routing a communication through a 
communications network or resolving the loca-
tion of a host or client on a communications 
network. 
(I) Providing transparency in advertising 
or origination of user generated content. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(2) 
REIDENTIFICATION.—Where 
compliance 
with this title would require the reidentification of 
de-identified personal information, and the covered 
entity does not already maintain the information 
necessary for such reidentification, the covered enti-
ty shall be exempt from such compliance, except for 
with section 106. 
(3) DISCLOSURE.—A covered entity relying on 
an exemption under paragraph (1) with respect to 
personal information shall disclose in the privacy 
policy maintained by such entity under section 
213— 
(A) the reason for which such information 
is collected, processed, maintained, or disclosed; 
and 
(B) a description of the rights provided by 
this title that are not available with respect to 
such personal information by reason of such ex-
emption. 
(b) EXCEPTIONS FOR PARTICULAR REQUESTS.— 
(1) IN GENERAL.—A covered entity may deny 
the request of an individual under this title if— 
(A) such covered entity cannot confirm the 
identity of such individual; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(B) such covered entity determines that 
granting the request of such individual would 
create a legitimate risk to the privacy, security, 
safety, or other rights of another individual; 
(C) such covered entity determines that 
granting the request of such individual would 
create a legitimate risk to free expression; or 
(D) the personal information requested to 
be corrected under section 102 or deleted under 
section 103— 
(i) is necessary to the completion of a 
transaction initiated before such request 
was made or the performance of a contract 
entered into before such request was made; 
(ii) was collected specifically for the 
completion of such transaction or the per-
formance of such contract; and 
(iii) would undermine the integrity of 
a legally significant transaction. 
(2) LIMITATIONS
ON
REQUESTS
FOR
ADDI-
TIONAL
INFORMATION
TO
CONFIRM
IDENTITY.—A 
covered entity may not deny a request of an indi-
vidual under paragraph (1)(A) on the basis of the 
refusal of such individual to provide additional per-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
sonal information to such covered entity to confirm 
the identity of such individual— 
(A) if the identity of such individual can 
reasonably be confirmed using personal infor-
mation of such individual that such covered en-
tity (as of the time of the request) already 
maintains; or 
(B) if such individual has an existing rela-
tionship (as of the time of the request) with 
such covered entity, such individual has con-
firmed the identity of such individual to such 
covered entity in the same manner as for other 
transactions of a similar sensitivity. 
(c) EXEMPTION
FOR SERVICE PROVIDERS.—This 
title does not apply to a service provider. 
(d) EXEMPTION FOR PRIVACY PRESERVING COM-
PUTING.—Except for sections 101, 105, 106, and 109, 
this title does not apply to personal information secured 
using privacy preserving computing. 
(e) TIMELINE FOR COMPLYING WITH A REQUEST.— 
Without undue delay but not longer than 30 days after 
the request, a covered that receives a request under this 
title must— 
(1) comply with such request; or 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(2) inform such individual of the reason for de-
nying such request, as allowed under subsections (a) 
or (b) of this section. 
(f) FEES PROHIBITED.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a covered entity may not charge a fee to 
an individual for a request made under this title. 
(2) UNFOUNDED OR EXCESSIVE REQUESTS.—If 
a request under this title is unfounded or excessive, 
a covered entity may charge a reasonable fee that 
reflects the estimated administrative costs of com-
plying with such request. 
(3) AGENCY NOTICE.—If a covered entity plans 
to charge fee under paragraph (2), it must notify 
the Agency at least 7 days before charging such fee. 
(4) AGENCY REVIEW.—The Director may reject 
any fee that a covered entity plans to charge for a 
request made under this title if the Agency finds— 
(A) such fee to be unreasonable relative to 
reasonable administrative costs of complying 
with a request under this title; or 
(B) such request is not unfounded or ex-
cessive. 
(g) RULES OF CONSTRUCTION.—Nothing in this title 
shall be construed to require a covered entity to— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(1) take an action that would convert informa-
tion that is not personal information into personal 
information; 
(2) collect or maintain personal information or 
contents of communication that the covered entity 
would otherwise not maintain; or 
(3) maintain personal information or contents 
of communication longer than the covered entity 
would otherwise maintain such personal information. 
(h) REGULATIONS.—The Director shall promulgate 
regulations to implement this section. 
TITLE II—REQUIREMENTS FOR 
COVERED ENTITIES, SERVICE 
PROVIDERS, AND THIRD PAR-
TIES 
SEC. 201. MINIMIZATION AND ARTICULATED BASIS FOR 
COLLECTION, 
PROCESSING, 
AND 
MAINTE-
NANCE. 
(a) ARTICULATED BASIS.—A covered entity shall 
have a reasonable, articulated basis for the collection, 
processing, disclosure, and maintenance of personal infor-
mation that takes into account the reasonable business 
needs of the covered entity and minimum amount of per-
sonal information necessary for providing the service, bal-
anced with the intrusion on the privacy of, potential pri-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
vacy harms to, and reasonable expectations of individuals 
to whom the personal information relates. 
(b) MINIMIZATION
OF COLLECTION, PROCESSING, 
DISCLOSURE, AND MAINTENANCE.— 
(1) COLLECTION.—A covered entity may not 
collect more personal information than is reasonably 
needed to provide a product or service that an indi-
vidual has requested. 
(2) PROCESSING.—A covered entity may not 
process personal information for a purpose other 
than the purpose for which such information was 
originally collected from the individual or in the case 
of a service provider, a purpose other than that 
which is in accordance with the directions of a cov-
ered entity. 
(3) DISCLOSURE.—A covered entity may not 
disclose personal information for a purpose other 
than the purpose for which such information was 
originally collected from the individual or in the case 
of a service provider, a purpose other than that 
which is in accordance with the directions of a cov-
ered entity. 
(4) MAINTENANCE.—A covered entity may not 
maintain personal information once such information 
is no longer needed for the purpose for which such 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
information was originally collected from the indi-
vidual or in the case of a service provider, a purpose 
other than that which is in accordance with the di-
rections of a covered entity. 
(c) ANCILLARY COLLECTION, PROCESSING, DISCLO-
SURE, AND MAINTENANCE.—Notwithstanding subsection 
(b), a covered entity may engage in collection, processing, 
disclosure, or maintenance of personal information beyond 
limitations under subsection (b) only if such covered entity 
complies with this subsection. 
(1) NO
NOTICE
OR
CONSENT
REQUIRED.—A 
covered entity may engage in collection, processing, 
or maintenance of personal information without ad-
ditional notice or consent if the purpose for such col-
lection, processing, or maintenance is substantially 
similar to the type of personal information and pur-
pose for which such personal information was origi-
nally collected and such ancillary collection, proc-
essing, or maintenance will not result in additional 
or increased privacy harms. 
(2) NOTICE REQUIRED.—A covered entity shall 
provide notice of ancillary collection, processing, dis-
closure or maintenance of personal information in 
the case of one, but not more than one, of the fol-
lowing: 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(A) Such ancillary collection, processing, 
disclosure, or maintenance may result in addi-
tional or increased privacy harms (but not in-
creased significant privacy harms), and is sub-
stantially similar to the purpose for which such 
personal information was originally collected. 
(B) The purpose for such ancillary collec-
tion, processing, disclosure, or maintenance is 
not substantially similar to the purpose for 
which such personal information was originally 
collected, but will not result in additional or in-
creased privacy harms. 
(C) Such ancillary collection, processing, 
disclosure, or maintenance may result in addi-
tional or increased privacy harms (but not in-
creased significant privacy harms) and the pur-
pose is not substantially similar to the purpose 
for which such personal information was origi-
nally collected, so long as, the personal informa-
tion is secured using privacy preserving com-
puting. 
(3) NOTICE
AND
CONSENT
REQUIRED.—For 
scenarios not covered under paragraph (1) or (2), 
and notwithstanding section 212(b)(2) and (3), a 
covered entity shall provide notice of and obtain con-
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
sent for ancillary collection, processing, disclosure or 
maintenance of personal information. 
(d) SUBSTITUTION.—In cases in which personal in-
formation can be replaced with artificial personal informa-
tion, personal information that has been de-identified, or 
the random personal information of a one or more individ-
uals without substantially reducing the utility of the data 
or requiring an unreasonable amount of effort, such a re-
placement shall take place. 
SEC. 202. MINIMIZATION AND RECORDS OF ACCESS BY EM-
PLOYEES AND CONTRACTORS. 
(a) MINIMIZATION.—A covered entity shall restrict 
access to personal information and contents of commu-
nications by the employees or contractors of such covered 
entity based on an articulated balance between the poten-
tial for privacy harm, reasonable expectations of individ-
uals to whom the personal information relates, and reason-
able business needs. 
(b) RECORDS OF ACCESS.— 
(1) IN GENERAL.—A covered entity shall main-
tain records identifying each instance in which an 
employee or a contractor of such covered entity ac-
cesses personal information or contents of commu-
nications if disclosure of, or a data breach or data 
sharing abuse involving, such personal information 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
or contents may foreseeably result in increased pri-
vacy harms. 
(2) INFORMATION REQUIRED.—The records re-
quired by paragraph (1) shall include the following: 
(A) A unique identifier for the employee or 
contractor accessing personal information or 
contents of communications. 
(B) The date and time of access. 
(C) The fields of information accessed. 
(D) The individuals whose personal infor-
mation was accessed or the contents of whose 
communications were accessed. 
(3) SMALL BUSINESSES EXCLUDED.—This sub-
section does not apply to a small business. 
SEC. 203. PROHIBITION ON THE COLLECTION OR MAINTE-
NANCE OF PERSONAL INFORMATION. 
A covered entity may not collect or maintain personal 
information using a channel of interstate commerce unless 
such covered entity is in compliance with all requirements 
of this Act. 
SEC. 204. PROHIBITIONS ON THE DISCLOSURE OF PER-
SONAL INFORMATION. 
(a) CONSENT FOR DISCLOSURE REQUIRED.— 
(1) IN GENERAL.—A covered entity may not in-
tentionally disclose personal information unless the 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
covered entity obtains consent of the individual 
whose personal information is being disclosed for 
each category of third party to which such personal 
information will be disclosed. Such covered entity 
must also provide such individual with notice of— 
(A) each category of third party; 
(B) the personal information to be dis-
closed; and 
(C) a concise and clear description of the 
business or commercial purpose for such disclo-
sure. 
(2) ADDITIONAL REQUIREMENTS FOR SALE OF 
PERSONAL INFORMATION.— 
(A) IN GENERAL.—A covered entity may 
not intentionally sell personal information un-
less the covered entity— 
(i) obtains the consent required by 
paragraph (1) for each individual disclo-
sure of such person information; and 
(ii) and provides the individual to 
whom such personal information relates 
with the identity of the specific third party 
to which such personal information will be 
disclosed. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(B) 
DISCLOSURE
SERVICES.—Subpara-
graph (A) shall not apply to a covered entity in 
a case in which an individual is directing the 
covered entity to disclose the personal informa-
tion of such individual for the sole purpose of 
procuring goods or services, or offers for goods 
or services, for such individual, if there is a rea-
sonable mechanism for the individual to with-
draw consent. 
(3) REQUIREMENT TO INCLUDE ORIGINAL PUR-
POSE OF COLLECTION.—A covered entity may not 
intentionally disclose personal information without 
including the purpose for which the personal infor-
mation was originally collected. 
(4) EXCEPTION
FOR
PRIVACY
PRESERVING 
COMPUTING.—Notwithstanding paragraph (1), con-
sent is not required for a disclosure (not including 
sale) of personal information secured using privacy 
preserving computing. 
(5) EXCEPTION FOR DE-IDENTIFIED PERSONAL 
INFORMATION.—Notwithstanding 
paragraph 
(1), 
consent is not required for a disclosure (not includ-
ing sale) of de-identified personal information where 
the disclosed personal information is limited to the 
narrowest possible scope likely to yield the intended 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
benefit and contractual obligations are in place that 
prohibit— 
(A) re-identification of the disclosed per-
sonal information; and 
(B) the processing of additional personal 
information in combination with the disclosed 
personal information that would allow for the 
reidentification of the disclosed personal infor-
mation. 
(b) DISCLOSURE FOR ADVERTISING OR MARKETING 
PURPOSES.— 
(1) IN GENERAL.—A covered entity may not in-
tentionally disclose for advertising or marketing pur-
poses a unique identifier or any other personal infor-
mation that would allow the disclosure of such infor-
mation to be linked to past or future disclosures of 
information relating to the same individual or device. 
(2) TREATMENT OF CERTAIN TYPES OF INFOR-
MATION.—A disclosure for advertising or marketing 
purposes may not be treated as violating subpara-
graph (1) by reason of including any or all of the 
following: 
(A) Internet Protocol addresses truncated 
to no more than the first 24 bits for Internet 
Protocol version 4 and the first 48 bits for 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
Internet Protocol version 6, or for a successor 
protocol truncated to limit the precision of the 
identifier to a network address of the internet 
access provider. 
(B) Geolocation information truncated to 
allow no more than the equivalent of two dec-
imal degrees of precision at the equator or 
prime meridian, or an equivalent precision in 
another geolocation standard. 
(C) A general description of a device, 
browser, or operating system, or any combina-
tion thereof. 
(D) An identifier that is unique for each 
disclosure. 
SEC. 205. DISCLOSURE TO ENTITIES NOT SUBJECT TO 
UNITED STATES JURISDICTION OR NOT COM-
PLIANT WITH THIS ACT. 
(a) PROHIBITION.—A covered entity may not inten-
tionally disclose personal information to any entity that— 
(1) is not subject to the jurisdiction of the 
United States; or 
(2) is not in compliance with all requirements 
of this Act. 
(b) EXCEPTION.—Notwithstanding subsection (a), a 
covered entity may disclose personal information where 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
that personal information is limited to an identifier cre-
ated primarily for the purpose of sending or receiving elec-
tronic communications and the sole purpose of the disclo-
sure is to send or receive an electronic communication at 
the request of the individual whose personal information 
is being disclosed. 
(c) DISCLOSURE SAFE HARBORS.—Notwithstanding 
subsection (a), a covered entity may disclose personal in-
formation to another covered entity (the receiving covered 
entity) that is not subject to the jurisdiction of the United 
States if either— 
(1) the receiving covered entity has entered into 
an agreement, as described in subsection (e), with 
the Agency, and— 
(A) the covered entity has a reasonable be-
lief that the receiving covered entity is suffi-
ciently solvent to compensate victims or pay 
fines for violations of this Act; 
(B) a contract between the covered entity 
and receiving covered entity requires that the 
receiving covered entity complies with this Act, 
and the covered entity has reason to believe the 
receiving covered entity is compliant with this 
Act; and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(C) a contract between the covered entity 
and the receiving covered entity prohibits the 
receiving covered entity from using the dis-
closed personal information for any purpose 
other than provided in the contract; or 
(2) the covered entity has— 
(A) entered into an agreement with the re-
ceiving covered entity that— 
(i) requires the receiving covered enti-
ty to comply with this Act; 
(ii) prohibits the receiving covered en-
tity from using the disclosed personal in-
formation for any purpose other than pro-
vided in the contract; 
(iii) requires the receiving covered en-
tity to indemnify the covered entity against 
violations of this Act committed by the re-
ceiving covered entity for any amount the 
covered entity is unable to pay of a judg-
ment for such violation; 
(iv) grants the covered entity the au-
thority to audit, including physical access 
to electronic devices and data, the receiving 
covered entity’s compliance with this Act 
and the contract; and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(v) requires the receiving covered enti-
ty to assist the covered entity in respond-
ing to and complying with any court or-
ders, Agency orders, or the exercising of 
an individual’s rights under this Act; 
(B) actual knowledge that the receiving 
covered entity is in compliance with this Act 
and not using personal information contrary to 
their agreement; 
(C) actual knowledge that the receiving 
covered entity is sufficiently solvent to com-
pensate victims or pay fines for violations of 
this Act; 
(D) an auditing and compliance program 
to ensure the receiving covered entity’s contin-
ued compliance with this Act and contract 
terms; 
(E) filed with the Agency the terms of said 
contract, proof of its actual knowledge of the 
receiving covered entity’s compliance with this 
Act and contract terms, and documents detail-
ing its auditing and compliance program for ap-
proval and publication by the Agency; and 
(F) the covered entity has entered into an 
agreement with the Agency where it agrees to 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
accept, respond to, or comply with a court 
order, agency order, or request by an individual 
regarding actions taken by the receiving covered 
entity with respect to the data it has disclosed. 
(d) For the purposes of subsection (c)(2), the covered 
entity shall be jointly liable for a violation of this Act by 
the receiving covered entity regarding the data the covered 
entity disclosed, except where the covered entity was the 
first to notify the Agency of the violation, in which case, 
it shall be severally liable. Where the covered entity should 
reasonably have known of a violation of this Act by the 
receiving covered entity and fails to disclose the violation 
to the Agency, each day of continuance of the failure to 
report such violation shall be treated as a separate viola-
tion. 
(e) AGENCY AGREEMENTS.—Upon the request of a 
covered entity not subject to the jurisdiction of the United 
States, the Agency shall enter into an agreement with the 
covered entity that includes, but is not limited to, the fol-
lowing conditions: 
(1) The principle place of business for the cov-
ered entity must be in a country that allows for the 
domestication of a United States court decision for 
civil fines payable to a government entity and in-
junctive relief. Where a foreign court refuses to en-
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
force a United States court decision under this Act, 
the agreement, and all other agreements with cov-
ered entities with a principle place of business in the 
same jurisdiction, shall be void. 
(2) The covered entity agrees to comply with 
this Act. 
(3) The covered entity agrees to be subject to 
this Act with choice of venue being a United States 
court. 
(4) The covered entity agrees to comply with 
Agency investigative requests or orders, and United 
States court orders or decisions under this Act. 
(5) The covered entity consents to United 
States Federal court personal jurisdiction for the 
sole purpose of enforcing this Act. 
(6) Where enforcement of the decision requires 
the use of a foreign court, the covered entity agrees 
to pay reasonable attorney fees necessary to enforce 
the judgment. 
(7) A default judgment, failure to comply with 
Agency investigative requests or orders, or failure to 
comply with United States court orders or decisions 
shall result in the immediate termination of the 
agreement. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(f) RULE OF CONSTRUCTION AGAINST DATA LOCAL-
IZATION.—Nothing in this section shall be construed to 
require the localization of processing or maintaining per-
sonal information by a covered entity to within the United 
State, or limit internal disclosure of personal information 
within a covered entity or to subsidiary or corporate affil-
iate of such covered entity, regardless of the country in 
which the covered entity will process, disclose, or maintain 
that personal information. 
SEC. 206. PROHIBITION ON REIDENTIFICATION. 
(a) IN GENERAL.—Except as required under title I, 
a covered entity shall not use personal information col-
lected from an individual, acquired from a third party, or 
acquired from a publicly available information to reiden-
tify an individual from de-identified information. 
(b) THIRD-PARTY PROHIBITION.—A covered entity 
that discloses de-identified information to a third party 
shall prohibit such third party from reidentifying an indi-
vidual using such de-identified information. 
(c) EXCEPTION.—Subsection (a) shall not apply to 
qualified research entities, as determined by the Director, 
conducting research not for commercial purposes. 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 207. RESTRICTIONS ON COLLECTION, PROCESSING, 
AND DISCLOSURE OF CONTENTS OF COMMU-
NICATIONS. 
(a) IN GENERAL.—A covered entity may not collect, 
process, maintain, or disclose the contents of any commu-
nication, regardless of whether the sender or intended re-
cipient of the communication is an individual, other per-
son, or an electronic device, for any purpose other than— 
(1) transmission or display of the communica-
tion to any intended recipient or the original sender, 
or maintenance of such communications for such 
purposes; 
(2) detecting, responding to, or preventing secu-
rity incidents or threats; 
(3) providing services to assist in the drafting 
or creation of the content of a communication; 
(4) processing expressly requested by the sender 
or intended recipient, if the sender or intended re-
cipient can terminate such processing using a rea-
sonable mechanism; 
(5) a disclosure otherwise required by law; 
(6) the filtering of a communication where pri-
mary purpose of the communication is the commer-
cial advertisement or promotion of a commercial 
product or service; or 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(7) detecting or enforcing an abuse or violation 
of the service’s terms of service that would result in 
either a temporary or permanent ban from using the 
service. 
(b) INTENDED RECIPIENT.—A covered entity is not 
considered an intended recipient of a communication, or 
any communication used in the creation of the content of 
said communication, where— 
(1) at least one intended recipient is a natural 
person other than an employee or contractor of the 
covered entity; 
(2) at least one intended recipient is a person 
other than the covered entity; or 
(3) a purpose of the covered entity’s service is 
to maintain, at the direction of the sender, the con-
tent of said communication for more than a transi-
tory period. 
(c) SENDER.—The sender of a communication is the 
person for whom the communication, and its content, is 
disclosed at the direction of and on behalf of. 
(1) Where the sender is a natural person, they 
shall be the sender of the entire content of the com-
munication, regardless of the original author of any 
portion of the content. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(2) Otherwise, a sender shall be the sender of 
only the content it was an original author of, or con-
tent it received as an intended recipient. 
(d) EXCEPTION FOR PUBLICLY AVAILABLE COMMU-
NICATIONS.—Subsection (a) shall not apply where the con-
tents of communication that are made publicly accessible 
by the sender without restrictions on accessibility other 
than the general authorization to access the services used 
to make the information accessible. 
(e) ENCRYPTION PROTECTION.—A covered entity 
shall not— 
(1) 
prohibit 
or 
prevent 
a 
person 
from 
encrypting or otherwise rendering unintelligible the 
content of a communication using a means that pre-
vents the covered entity from being able to decrypt 
or otherwise render intelligible said content; and 
(2) require or cause a person to disclose or cir-
cumvent the means described in paragraph (1) to 
the covered entity that would allow it to render the 
content intelligible. 
(f) SERVICE PROVIDERS SAFE HARBOR.—A service 
provider shall not be held liable for a violation of this sec-
tion if such service provider is acting at the direction of 
and on behalf of a covered entity and has a reasonable 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
belief that the covered entity’s directions are in compliance 
with this section. 
SEC. 208. PROHIBITION ON DISCRIMINATORY PROCESSING. 
(a) DISCRIMINATION
IN
ECONOMIC
OPPORTUNI-
TIES.—A covered entity shall not process personal infor-
mation or contents of communication for advertising, mar-
keting, soliciting, offering, selling, leasing, licensing, rent-
ing, or otherwise commercially contracting for employ-
ment, finance, healthcare, credit, insurance, housing, or 
education opportunities in a manner that discriminates 
against or otherwise makes opportunities unavailable on 
the basis of an individual’s protected class status. 
(b) PUBLIC ACCOMMODATIONS.—A covered entity 
shall not process personal information in a manner that 
segregates, discriminates in, or otherwise makes unavail-
able the goods, services, facilities, privileges, advantages, 
or accommodations of any place of public accommodation 
on the basis of a person’s or a group’s protected class sta-
tus. 
(c) The Director shall promulgate regulations to im-
plement this section. 
SEC. 209. RESTRICTIONS ON GENETIC INFORMATION. 
(a) IN GENERAL.—A covered entity may not collect, 
process, maintain, or disclose genetic information for any 
purpose other than— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(1) providing medical treatment or testing to 
the individual whose genetic information is being col-
lected, processed, maintained, or disclosed; 
(2) research and services related to medical, 
historical, or population uses of genetic information, 
if, in the case of disclosure of genetic information— 
(A) such genetic information is only dis-
closed to qualified research entities, as deter-
mined by the Director; 
(B) additional personal information dis-
closed with such genetic information is limited 
to the narrowest possible scope likely to yield 
the intended benefit; and 
(C) the covered entity limits, through con-
tractual obligations, additional types of personal 
information that can be processed with the dis-
closed genetic information and personal infor-
mation. 
(3) a purpose specified by the Director by regu-
lation, taking into account the potential privacy 
harms and potential benefits of such collection, proc-
essing, maintenance, or disclosure; or 
(4) to comply with a Federal criminal investiga-
tion request or order. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(b) GENETIC INFORMATION DEFINED.—In this sec-
tion, the term ‘‘genetic information’’ has the meaning 
given such term in section 201 of the Genetic Information 
Nondiscrimination Act of 2008 (42 U.S.C. 2000ff). 
(c) SERVICE PROVIDERS SAFE HARBOR.—A service 
provider shall not be held liable for a violation of this sec-
tion if such service provider is acting at the direction of 
and on behalf of a covered entity and has a reasonable 
belief that is the covered entity’s directions are in compli-
ance with this section. 
SEC. 210. REQUIREMENTS FOR NOTICE AND CONSENT 
PROCESSES AND PRIVACY POLICIES. 
(a) MINIMUM THRESHOLD.—The Director shall es-
tablish a minimum threshold that a covered entity must 
meet for the percentage of individuals who read and un-
derstand a notice or consent process or privacy policy re-
quired by this Act. In establishing such minimum thresh-
olds, the Director shall take into account expectations of 
individuals, potential privacy harms, and individuals’ 
awareness of privacy harms. 
(b) CONSENT REVOCATION.—A covered entity shall 
make available a reasonable mechanism by which an indi-
vidual may revoke consent for any consent given under 
this Act. 
(c) SAFE HARBOR.— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(1) APPROVAL
PROCEDURES.—The Director 
shall develop procedures for analyzing and approving 
data submitted by a covered entity to establish that 
a notice and consent process or privacy policy of 
such covered entity meets the threshold established 
under subsection (a). 
(2) PRESUMPTION.—If a covered entity submits 
testing data to and receives an approval from the 
Director under paragraph (1) establishing that a no-
tice or consent process or privacy policy of such cov-
ered entity meets the threshold established under 
subsection (a), such notice or consent process or pri-
vacy policy shall be presumed to have met such 
threshold. Such presumption may be rebutted by 
clear and convincing evidence. 
(3) PUBLIC AVAILABILITY OF APPROVED PROC-
ESSES
AND
POLICIES
AND
ASSOCIATED
TESTING 
DATA.—The Director shall make publicly available 
online the notice and consent processes and privacy 
policies and associated testing data that the Director 
approves under paragraph (1). 
(4) SMALL BUSINESS ADOPTION OF NOTICE OR 
CONSENT
PROCESS
OF
ANOTHER
COVERED
ENTI-
TY.— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(A) IN
GENERAL.—If a small business 
adopts a notice or consent process of another 
covered entity that collects, processes, main-
tains, or discloses personal information in sub-
stantially the same way as such small business, 
if the process of such other covered entity has 
been approved under paragraph (1), the process 
of such small business shall receive the pre-
sumption under paragraph (2). 
(B) ABILITY TO FREELY USE APPROVED 
PROCESS.—A covered entity whose notice or 
consent process is approved under paragraph 
(1) shall permit a small business to freely use 
such process, or a derivative thereof, as de-
scribed in subparagraph (A). 
(C) NO PUBLISHED PROCESS.—In the case 
of a small business for which there is no ap-
proved notice or consent process published 
under paragraph (3) of a covered entity that 
collects, processes, maintains, or discloses per-
sonal information in substantially the same way 
as such small business, any requirement under 
this title for a notice or consent process to be 
objectively shown to meet the threshold estab-
lished by the Director under subsection (a) 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
shall not apply to such small business. Nothing 
in the preceding sentence exempts a small busi-
ness from the requirement to use such notice or 
consent process or that such process be concise 
and clear. 
(D) INAPPLICABILITY
TO
PRIVACY
POL-
ICY.—Paragraph (4) does not apply with re-
spect to a privacy policy. 
(5) MINOR CHANGES.—A covered entity may 
make minor changes in a notice or consent process 
or privacy policy approved under paragraph (1) and 
retain the presumption under paragraph (2) for such 
process or policy without retesting or resubmission 
of testing data to the Director. 
SEC. 211. PROHIBITION ON DECEPTIVE NOTICE AND CON-
SENT PROCESSES AND PRIVACY POLICIES. 
In providing notice, obtaining consent, or maintaining 
a privacy policy as required by this title, a covered entity 
may not intentionally take any action that substantially 
impairs, obscures, or subverts the ability of an individual 
to— 
(1) understand the contents of such notice or 
such privacy policy; 
(2) understand the process for granting such 
consent; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(3) make a decision regarding whether to grant 
or withdraw such consent; or 
(4) act on any such decision. 
SEC. 212. NOTICE AND CONSENT REQUIRED. 
(a) NOTICE.—A covered entity shall provide an indi-
vidual with notice of the personal information such covered 
entity collects, processes, maintains, and discloses through 
a process that is concise and clear and can be objectively 
shown to meet the threshold established by the Director 
under section 210(a). 
(b) CONSENT.— 
(1) EXPRESS CONSENT REQUIRED.—Except as 
provided in paragraphs (2) and (3), a covered entity 
may not collect from an individual personal informa-
tion that creates or increases the risk of foreseeable 
privacy harms, or process or maintain any such per-
sonal information collected from an individual, un-
less such entity obtains the express consent of such 
individual to the collection, processing, or mainte-
nance (or any combination thereof) of such informa-
tion through a process that is concise and clear and 
can be objectively shown to meet the threshold es-
tablished by the Director under section 210(a). 
(2) EXCEPTION FOR IMPLIED CONSENT.—Not-
withstanding paragraph (1), express consent is not 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
required for collection, processing, or maintenance of 
personal information if the collection, processing, or 
maintenance is, on its face, obvious and necessary to 
provide a service at the request of the individual and 
the personal information is collected, processed, or 
maintained only for such request. Nothing in this 
paragraph shall be construed to exempt the covered 
entity from the requirement of subsection (a) to pro-
vide notice to such individual with respect to such 
collection, processing, or maintenance. 
(3) EXEMPTION
FOR
PRIVACY
PRESERVING 
COMPUTING.—Notwithstanding paragraph (1), ex-
cept with regard to consent for purposes of section 
106, express consent is not required for collection, 
processing, or maintenance of personal information 
secured using privacy preserving computing. Nothing 
in this paragraph shall be construed to exempt the 
covered entity from the requirement of subsection 
(a) to provide notice to such individual with respect 
to such collection, processing, or maintenance. 
(c) SERVICE PROVIDERS EXCLUDED.—This section 
does not apply to a service provider if such service provider 
has a reasonable belief that a covered entity for which it 
processes, maintains, or discloses personal information is 
in compliance with this section. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 213. PRIVACY POLICY. 
(a) POLICY REQUIRED.—A covered entity shall main-
tain a privacy policy relating to the practices of such entity 
regarding the collection, processing, maintenance, and dis-
closure of personal information. 
(b) CONTENTS.—The privacy policy required by sub-
section (a) shall contain the following: 
(1) A general description of the practices of the 
covered entity regarding the collection, processing, 
maintenance, and disclosure of personal information. 
(2) A description of how individuals may exer-
cise the rights provided by title I. 
(3) A clear and concise summary of the fol-
lowing: 
(A) The categories of personal information 
collected or otherwise obtained by the covered 
entity. 
(B) The business or commercial purposes 
of the covered entity for collecting, processing, 
maintaining, or disclosing personal information. 
(C) The categories and a list of third par-
ties to which the covered entity discloses per-
sonal information. 
(4) A description of the personal information 
that the covered entity maintains that the covered 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
entity does not collect from individuals and how the 
covered entity obtains such personal information. 
(5) A list of the third parties to which the cov-
ered entity has disclosed personal information. 
(6) A list of the third parties from which the 
covered entity has obtained personal information at 
any time on or after the effective date specified in 
section 4(a). 
(7) The articulated basis for the collection, 
processing, disclosure and maintenance of personal 
information, as required under section 201(a). 
(c) EXEMPTION FOR PERSONAL INFORMATION FOR 
PARTICULAR PURPOSES.—The privacy policy required by 
subsection (a) is not required to contain information relat-
ing to personal information that is collected, processed, 
maintained, or disclosed exclusively for any of the pur-
poses described in paragraph (1) of section 109(a) (or a 
combination of such purposes), except as provided in para-
graph (2) of such section. 
(d) AVAILABILITY OF PRIVACY POLICY.— 
(1) FORM AND MANNER.—The privacy policy 
required by subsection (a) shall be— 
(A) clear and in plain language; and 
(B) made publicly available in a prominent 
location on an ongoing basis. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(2) TIMING.—The privacy policy required by 
subsection (a) shall be made available as required by 
paragraph (1) before any collection of personal in-
formation by the covered entity that occurs after the 
effective date specified in section 4(a). 
(e) SMALL BUSINESSES EXCLUDED.—Subsections 
(b)(7) and (d) do not apply to a small business. 
(f) SERVICE PROVIDERS EXCLUDED.—This section 
does not apply to a service provider if such service provider 
has a reasonable belief that a covered entity for which it 
processes, maintains, or discloses personal information is 
in compliance with this section. 
SEC. 214. INFORMATION SECURITY REQUIREMENTS. 
(a) IN GENERAL.—A covered entity shall establish 
and implement reasonable information security policies, 
practices, and procedures for the protection of personal 
information collected, processed, maintained, or disclosed 
by such covered entity, taking into consideration— 
(1) the nature, scope, and complexity of the ac-
tivities engaged in by such covered entity; 
(2) the sensitivity of any personal information 
at issue; 
(3) the current state of the art in administra-
tive, technical, and physical safeguards for pro-
tecting such information; and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(4) the cost of implementing such administra-
tive, technical, and physical safeguards. 
(b) POINT OF CONTACT.—A covered entity shall iden-
tify an officer or other individual as the point of contact 
with responsibility for the management of information se-
curity. 
(c) SPECIFIC POLICIES, PRACTICES, AND PROCE-
DURES.—The policies, practices, and procedures required 
by subsection (a) shall include the following: 
(1) A written security policy with respect to the 
collection, processing, maintenance, and disclosure of 
personal information. Such policy shall be made pub-
licly available in a prominent location on an ongoing 
basis, except that the publicly available version is 
not required to contain information that would com-
promise a purpose described in paragraph (1) of sec-
tion 109(a). 
(2) A process for identifying and assessing rea-
sonably foreseeable security vulnerabilities in the 
system or systems used by such covered entity that 
contain personal information, which shall include 
regular monitoring for vulnerabilities or data 
breaches involving such system or systems. 
(3) A process for taking action designed to 
mitigate against vulnerabilities identified in the 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
process required by paragraph (2), which may in-
clude implementing any changes to security practices 
and the architecture, installation, or implementation 
of network or operating software, or for regularly 
testing or otherwise monitoring the effectiveness of 
the existing safeguards. 
(4) A process for determining if personal infor-
mation is no longer needed and disposing of personal 
information by shredding, permanently erasing, or 
otherwise modifying the medium on which such per-
sonal information is maintained to make such per-
sonal information permanently unreadable or indeci-
pherable. 
(5) A process for overseeing persons who have 
access to personal information, including through 
network-connected devices. 
(6) A process for employee training and super-
vision for implementation of the policies, practices, 
and procedures required by this section. 
(7) A written plan or protocol for internal and 
public response in the event of a data breach or data 
sharing abuse. 
(d) REGULATIONS.—The Director, in consultation 
with the National Institute of Standards and Technology, 
shall promulgate regulations to implement this section. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(e) SMALL BUSINESSES ASSISTANCE.—The Director, 
in consultation with the National Institute of Standards 
and Technology, the Small Business Association, and 
small businesses, shall develop policy templates, toolkits, 
tip sheets, configuration guidelines for commonly used 
hardware and software, interactive tools, and other mate-
rials to assist small businesses with complying with this 
section. 
SEC. 215. NOTIFICATION OF DATA BREACH OR DATA SHAR-
ING ABUSE. 
(a) NOTIFICATION OF AGENCY.— 
(1) IN GENERAL.—In the case of a data breach 
or data sharing abuse with respect to personal infor-
mation maintained by a covered entity, such covered 
entity shall, without undue delay and, if feasible, not 
later than 72 hours after becoming aware of such 
data breach or data sharing abuse, notify the Direc-
tor of such data breach or data sharing abuse, un-
less such data breach or data sharing abuse is un-
likely to create or increase foreseeable privacy 
harms. 
(2) REASONS FOR DELAY.—If the notification 
required by paragraph (1) is made more than 72 
hours after the covered entity becomes aware of the 
data breach or data sharing abuse, such notification 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
shall be accompanied by a statement of the reasons 
for the delay. 
(b) NOTIFICATION OF OTHER COVERED ENTITY.— 
In the case of a data breach or data sharing abuse with 
respect to personal information maintained by a covered 
entity that such covered entity obtained from another cov-
ered entity, the covered entity experiencing such data 
breach or data sharing abuse shall, without undue delay 
and, if feasible, not later than 72 hours after becoming 
aware of such data breach or data sharing abuse, notify 
such other covered entity of such data breach or data 
sharing abuse, unless such data breach or data sharing 
abuse is unlikely to create or increase foreseeable privacy 
harms. A covered entity receiving notice under this sub-
section of a data breach or data sharing abuse shall notify 
any other covered entity from which the covered entity re-
ceiving notice obtained personal information involved in 
such data breach or data sharing abuse, in the same man-
ner as required under the preceding sentence for the cov-
ered entity experiencing such data breach or data sharing 
abuse. 
(c) NOTIFICATION OF INDIVIDUALS.— 
(1) IN GENERAL.—In the case of a data breach 
or data sharing abuse with respect to personal infor-
mation maintained by a covered entity (or a data 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
breach or data sharing abuse about which a covered 
entity is notified under subsection (b)), if such cov-
ered entity has a relationship with an individual 
whose personal information was involved or poten-
tially involved in such data breach or data sharing 
abuse, such covered entity shall notify such indi-
vidual of such data breach or data sharing abuse not 
later than 14 days after becoming aware of such 
data breach or data sharing abuse (or, in the case 
of a data breach or data sharing abuse about which 
a covered entity is notified under subsection (b), not 
later than 14 days after being so notified), if such 
data breach or data sharing abuse creates or in-
creases foreseeable privacy harms. 
(2) MEDIUM OF NOTIFICATION.—A covered en-
tity shall notify an individual as required by para-
graph (1) through— 
(A) the same medium through which such 
individual routinely interacts with such covered 
entity; and 
(B) one additional medium of notification, 
if such covered entity has the personal informa-
tion necessary to make a notification through 
such an additional medium without causing ex-
cessive financial burden for such covered entity. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(d) RULE OF CONSTRUCTION.—This section shall not 
apply to a covered entity if a person uses personal infor-
mation obtained from a data breach or data sharing abuse 
not involving such covered entity. 
TITLE III—UNITED STATES 
DIGITAL PRIVACY AGENCY 
SEC. 301. ESTABLISHMENT. 
(a) AGENCY ESTABLISHED.—There is established an 
independent agency in the executive branch to be known 
as the ‘‘United States Digital Privacy Agency’’, which 
shall implement and enforce this Act. 
(b) DIRECTOR AND DEPUTY DIRECTOR.— 
(1) IN GENERAL.—There is established the po-
sition of the Director, who shall serve as the head 
of the Agency. 
(2) APPOINTMENT.—Subject to paragraph (3), 
the Director shall be appointed by the President, by 
and with the advice and consent of the Senate. 
(3) 
QUALIFICATION.—The 
President 
shall 
nominate the Director from among individuals who 
are citizens of the United States. 
(4) DEPUTY DIRECTOR.—There is established 
the position of Deputy Director, who shall— 
(A) be appointed by the Director; and 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(B) serve as acting Director in the absence 
or unavailability of the Director. 
(c) TERM.— 
(1) IN GENERAL.—The Director shall serve for 
a term of 5 years. 
(2) EXPIRATION OF TERM.—An individual may 
serve as Director after the expiration of the term for 
which appointed, until a successor has been ap-
pointed and qualified. 
(3) REMOVAL FOR CAUSE.—The President may 
remove the Director for inefficiency, neglect of duty, 
or malfeasance in office. 
(d) SERVICE RESTRICTION.—No Director or Deputy 
Director may hold any office, position, or employment in 
any covered entity during the period of service of such per-
son as Director or Deputy Director. 
(e) OFFICES.—The Director shall establish a prin-
cipal office and field offices of the Agency in locations that 
have high levels of activity by covered entities, as deter-
mined by the Director. 
(f) COMPENSATION.— 
(1) IN GENERAL.—The Director shall be com-
pensated at the rate prescribed for level II of the 
Executive Schedule under section 5313 of title 5, 
United States Code. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(2) CONFORMING AMENDMENT.—Section 5313 
of title 5, United States Code, is amended by insert-
ing after the item relating to ‘‘Federal Transit Ad-
ministrator.’’ the following new item: ‘‘Director of 
the United States Digital Privacy Agency.’’. 
SEC. 302. EXECUTIVE AND ADMINISTRATIVE POWERS. 
(a) POWERS OF THE AGENCY.—The Director is au-
thorized to establish the general policies of the Agency 
with respect to all executive and administrative functions, 
including— 
(1) the establishment of rules for conducting 
the general business of the Agency, in a manner not 
inconsistent with this Act; 
(2) to bind the Agency and enter into contracts; 
(3) directing the establishment and mainte-
nance of divisions or other offices within the Agency, 
in order to carry out the responsibilities of the Agen-
cy under this Act, and to satisfy the requirements of 
other applicable law; 
(4) to coordinate and oversee the operation of 
all administrative, enforcement, and research activi-
ties of the Agency; 
(5) to adopt and use a seal; 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(6) to determine the character of and the neces-
sity for the obligations and expenditures of the 
Agency; 
(7) the appointment and supervision of per-
sonnel employed by the Agency; 
(8) the distribution of business among per-
sonnel appointed and supervised by the Director and 
among administrative units of the Agency; 
(9) the use and expenditure of funds; 
(10) implementing this Act through rules, or-
ders, guidance, interpretations, statements of policy, 
investigations, and enforcement actions; and 
(11) performing such other functions as may be 
authorized or required by law. 
(b) DELEGATION
OF AUTHORITY.—The Director 
may delegate to any duly authorized employee, representa-
tive, or agent any power vested in the Director or the 
Agency by law, except that the Director may not delegate 
the power to appoint the Deputy Director under section 
301(b)(4)(A). 
(c) AUTONOMY
OF
AGENCY
REGARDING
REC-
OMMENDATIONS AND TESTIMONY.—No officer or agency 
of the United States shall have any authority to require 
the Director or any other officer of the Agency to submit 
legislative recommendations, or testimony or comments on 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
legislation, to any officer or agency of the United States 
for approval, comments, or review prior to the submission 
of such recommendations, testimony, or comments to the 
Congress, if such recommendations, testimony, or com-
ments to the Congress include a statement indicating that 
the views expressed therein are those of the Director or 
such officer, and do not necessarily reflect the views of 
the President. 
SEC. 303. RULEMAKING AUTHORITY. 
The Director may prescribe rules and issue orders 
and guidance, as may be necessary or appropriate to en-
able the Agency to administer and carry out the purposes 
and objectives of this Act, and to prevent evasions thereof. 
SEC. 304. PERSONNEL. 
(a) APPOINTMENT.— 
(1) IN GENERAL.—The Director may fix the 
number of, and appoint and direct, all employees of 
the Agency, in accordance with the applicable provi-
sions of title 5, United States Code. 
(2) EMPLOYEES OF THE AGENCY.—The Direc-
tor is authorized to employ technologists, designers, 
attorneys, investigators, economists, and other em-
ployees as the Director considers necessary to con-
duct the business of the Agency. 
(b) AGENCY OMBUDSMAN.— 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
(1) ESTABLISHMENT REQUIRED.—The Director 
shall appoint an ombudsman. 
(2) DUTIES OF OMBUDSMAN.—The ombudsman 
appointed in accordance with paragraph (1) shall— 
(A) act as a liaison between the Agency 
and any affected person with respect to any 
problem that such person may have in dealing 
with the Agency, resulting from the regulatory 
activities of the Agency; and 
(B) assure that safeguards exist to encour-
age complainants to come forward and preserve 
confidentiality. 
SEC. 305. COMPLAINTS OF INDIVIDUALS. 
(a) IN GENERAL.—The Director shall establish a unit 
within the Agency the functions of which shall include es-
tablishing a single, toll-free telephone number, a website, 
and a database or utilizing an existing database to facili-
tate the centralized collection of, monitoring of, and re-
sponse to complaints of individuals regarding the privacy 
or security of personal information. The Director shall co-
ordinate with other Federal agencies with jurisdiction over 
the privacy or security of personal information to route 
complaints to such agencies, where appropriate. 
(b) ROUTING COMPLAINTS TO STATES.—To the ex-
tent practicable, State agencies may receive appropriate 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS