I 
112TH CONGRESS 
1ST SESSION H. R. 1528 
To protect and enhance consumer privacy, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 13, 2011 
Mr. STEARNS (for himself, Mr. MATHESON, Mr. BILBRAY, and Mr. MAN-
ZULLO) introduced the following bill; which was referred to the Com-
mittee on Energy and Commerce 
A BILL 
To protect and enhance consumer privacy, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Privacy Pro-
tection Act of 2011’’. 
SEC. 3. DEFINITIONS. 
In this Act, the following definitions apply: 
(1) AFFILIATE.—The term ‘‘affiliate’’ means 
any company that controls, is controlled by, or is 
under common control with another company. 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) CONSUMER.—The term ‘‘consumer’’ means 
an individual acting in the individual’s personal, 
family, or household capacity. 
(4) COVERED ENTITY.—(A) The term ‘‘covered 
entity’’ means an entity (or an agent or affiliate of 
the entity) that collects (by any means, through any 
medium), sells, discloses for consideration, or uses 
personally identifiable information of more than 
5,000 consumers during any consecutive 12-month 
period, and includes a non-profit organization, in-
cluding any organization described in section 501(c) 
of the Internal Revenue Code of 1986 that is exempt 
from taxation under section 501(a) of such Code, 
notwithstanding the definition of the term ‘‘Acts to 
regulate commerce’’ in section 4 of the Federal 
Trade Commission Act (15 U.S.C. 44) and the ex-
ception provided by section 5(a)(2) of such Act (15 
U.S.C. 45(a)(2)) for such organizations. 
(B) Such term does not include— 
(i) a governmental agency; 
(ii) a provider of professional services, or 
any affiliate thereof, to the extent that such 
provider is obligated by rules of professional 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
ethics, or by applicable law or regulation, not to 
voluntarily disclose confidential client informa-
tion without the consent of the client; or 
(iii) a data processing outsourcing entity. 
(5) DATA
PROCESSING
OUTSOURCING
ENTI-
TY.—The term ‘‘data processing outsourcing entity’’ 
means, with respect to a covered entity, a non-affili-
ated entity that— 
(A) provides information technology proc-
essing, Web hosting, or telecommunications 
services to the covered entity; 
(B) is contractually obligated to comply 
with security controls specified by the covered 
entity; and 
(C) has no right to use the covered entity’s 
personally identifiable information other than 
for performing data processing outsourcing 
services for the covered entity or as required by 
contract or law. 
(6) DISPLAY.—The term ‘‘display’’ means in-
tentionally communicating or otherwise making 
available (on the Internet or in any other manner) 
to another person. 
(7) INFORMATION-SHARING
AFFILIATE.—The 
term ‘‘information-sharing affiliate’’ means any affil-
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
iate that is under common control with a covered en-
tity, or is contractually obligated to comply with the 
practices enumerated under the privacy policy state-
ment of the covered entity required under section 5. 
(8) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—(A) The term ‘‘personally identifiable infor-
mation’’, with respect to a covered entity means in-
dividually identifiable information relating to a living 
individual who can be identified from that informa-
tion, and includes: 
(i) the combination of a first name (or 
initial) and last name of an individual, 
whether given at birth or time of adoption, 
or resulting from a lawful change of name; 
(ii) the postal address of a physical 
place of residence of such individual; 
(iii) an e-mail address of such indi-
vidual; 
(iv) a telephone number or mobile de-
vice number dedicated to contacting such 
individual at any place other than the indi-
vidual’s place of work; 
(v) a social security number or other 
Federal or State government issued identi-
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
fication number issued to such individual; 
or 
(vi) the complete account number of a 
credit or debit card issued to such indi-
vidual. 
(B) Such term also includes, when disclosed in 
connection with one or more of the items of informa-
tion described in subparagraph (A)— 
(i) a birth date, the number of a certificate 
of birth or adoption, or a place of birth; or 
(ii) an electronic address, including an IP 
address. 
(C) Such term does not include— 
(i) anonymous or aggregate data, or any 
other information that does not identify a 
unique living individual; 
(ii) information about a consumer inferred 
from data maintained about a consumer; or 
(iii) information about a consumer that is 
publicly available or obtained from a public 
record. 
(9) PROCESS.—The term ‘‘process’’, with re-
spect to personally identifiable information, means 
any value-added activity performed on data by auto-
mated means. 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(10) PUBLICLY AVAILABLE.—The term ‘‘pub-
licly available’’, with respect to information, means 
information that is lawfully made available to the 
general public. 
(11) PUBLIC
RECORD.—The term ‘‘public 
record’’ means any item, collection, or grouping of 
information about an individual that is maintained 
by a Federal, State, or local government entity and 
that is made available to the public. 
(12) PURCHASE.—The term ‘‘purchase’’ means 
providing, directly or indirectly, anything of value in 
exchange for a good or service. 
(13) STATE.—The term ‘‘State’’ includes the 
several States, the District of Columbia, the Com-
monwealth of Puerto Rico, the Commonwealth of the 
Northern Mariana Islands, American Samoa, Guam, 
the Virgin Islands, the Freely Associated States, and 
any other territory or possession of the United 
States. 
(14) TRANSACTION.—The term ‘‘transaction’’ 
means an interaction between a consumer and a cov-
ered entity resulting in— 
(A) any use of information that is nec-
essary to complete the interaction in the course 
of which information is collected, or to maintain 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
the provisioning of a good or service requested 
by the consumer, including use— 
(i) to approve, guarantee, process, ad-
minister, complete, enforce, provide, or 
market a product, service, account, benefit, 
transaction, or payment method that is re-
quested or approved by the consumer; 
(ii) to deliver goods, services, funds, 
or other consideration to, or on behalf of, 
the consumer; 
(iii) to protect the health and safety 
of the consumer; and 
(iv) related to website analytics meth-
ods or measurements for improving or en-
hancing products or services. 
(B) any disclosure of information that is 
necessary for the consumer to enforce any right 
of the consumer; 
(C) any disclosure of information that is 
required by law or by a court order; 
(D) any use of information to verify per-
sonally identifiable information by the con-
sumer, evaluate, detect, or reduce the risk of 
fraud or other criminal activity, or other risk- 
management activities; and 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(E) the collection or use of personally iden-
tifiable information for the marketing or adver-
tising of a covered entity’s products or services 
to its own customers or potential customers. 
SEC. 4. PRIVACY NOTICES TO CONSUMERS. 
(a) NOTICE REQUIRED.—A covered entity shall pro-
vide to a consumer a notice containing the information 
required under subsection (b) as follows: 
(1) The covered entity shall provide the notice 
before any personally identifiable information that is 
collected from a consumer is used by the covered en-
tity for a purpose unrelated to a transaction. 
(2) Upon a material change in the covered enti-
ty’s privacy policy under section 5(a), the covered 
entity shall provide the notice, not later than the 
first time after such change in policy that the cov-
ered entity seeks to sell, disclose for consideration, 
or use personally identifiable information to the ex-
tent practicable, to each consumer from whom the 
covered entity has collected such information. 
(b) FORM AND CONTENTS OF NOTICE.—A notice re-
quired under subsection (a) shall be provided in a clear 
and conspicuous manner, be prominently displayed or ex-
plicitly stated to the consumer, and contain the following 
information: 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(1) A statement that the personally identifiable 
information collected by the covered entity may be 
used or disclosed for purposes or transactions unre-
lated to that for which it was collected, as described 
in the covered entity’s privacy statement. 
(2) A description, appropriate to the applicable 
medium, of the manner in which the consumer may 
obtain a privacy policy statement that meets the re-
quirements of section 5, which may include pro-
viding the consumer with an Internet website, a 
hyperlink to such a website, or a toll-free telephone 
number from which such a statement may be ob-
tained. If the notice required under subsection (a) is 
provided to the consumer by means of an Internet 
website, one manner in which the consumer may ob-
tain the privacy policy statement must be by means 
of an Internet website. 
(3) If the notice is required under subsection 
(a)(2), a statement that there has been a material 
change in the covered entity’s privacy policy. 
SEC. 5. PRIVACY POLICY STATEMENTS. 
(a) PRIVACY POLICY.—A covered entity shall estab-
lish a privacy policy with respect to the collection, sale, 
disclosure for consideration, dissemination, use, and secu-
rity of the personally identifiable information of con-
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
sumers, the principal elements of which shall be embodied 
in a privacy policy statement (or statements) that meets 
the requirements of subsection (b). 
(b) STATEMENT.—The statement (or statements) re-
quired under subsection (a) shall meet the following re-
quirements: 
(1) The statement must be brief, concise, clear, 
and conspicuous and written in plain language. 
(2) The statement must be available to all con-
sumers of the covered entity (regardless of the 
means by which a consumer conducts a transaction 
with the covered entity)— 
(A) at no charge to the consumer; and 
(B) at the time the covered entity first col-
lects personally identifiable information about 
the consumer that may be used for a purpose 
unrelated to a transaction with the consumer 
and subsequently. 
(3) The statement must disclose only the fol-
lowing: 
(A) The identity of each covered entity, or 
a description of each class or type of covered 
entity, that may collect or use the information. 
(B) The types of information that may be 
collected or used. 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(c) COMMISSION FACILITATION.—The Commission 
may take actions (including conducting industry-wide 
workshops) to facilitate the development of harmonized, 
universal wording or logo-based graphics in order to con-
vey the contents of privacy policy statements required 
under this section. 
SEC. 6. CONSUMER OPPORTUNITY TO LIMIT SALE OR DIS-
CLOSURE OF INFORMATION. 
(a) PRECLUSION OF SALE OR DISCLOSURE.— 
(1) REQUIREMENT.—A covered entity shall pro-
vide to the consumer, without charge, the oppor-
tunity to preclude any sale or disclosure for consid-
eration of the consumer’s personally identifiable in-
formation, provided in a particular data collection, 
that may be used for a purpose other than a trans-
action with the consumer, to any covered entity that 
is not an information-sharing affiliate of the covered 
entity providing such opportunity. 
(2) DURATION.—A preclusion on sale or disclo-
sure for consideration of information established by 
a consumer under this subsection shall remain in ef-
fect for 5 years or until the consumer indicates oth-
erwise, whichever occurs sooner. A covered entity 
may not seek reconsideration of a consumer’s pre-
clusion of such sale or disclosure until at least 1 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
year after such preclusion has been imposed by the 
consumer. 
(b) PERMISSION FOR SALE OR DISCLOSURE.—A cov-
ered entity may provide the consumer an opportunity to 
permit the sale or disclosure described in subsection (a)(1) 
in exchange for a benefit to the consumer. 
(c) ACCESSIBILITY.—The opportunity to preclude (or 
if offered, to permit) the sale or disclosure for consider-
ation of information under this section must be both easy 
to access and use, and the notice of the opportunity to 
preclude must be clear and conspicuous. 
SEC. 7. CONSUMER OPPORTUNITY TO LIMIT OTHER INFOR-
MATION PRACTICES. 
If a covered entity provides to a consumer the oppor-
tunity to limit other practices of the covered entity with 
respect to a particular collection or use of personally iden-
tifiable information regarding the consumer, other than 
that required by section 6— 
(1) a notice and description of such opportunity 
must appear in the privacy statement; 
(2) such opportunity must be easy to access 
and to use; and 
(3) any limitation exercised by the consumer 
pursuant to such opportunity shall remain in effect, 
unless— 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(A) the limitation is withdrawn by the con-
sumer; or 
(B) the covered entity provides the con-
sumer at least 30 days notice before materially 
changing the limitation or terminating its com-
pliance with the limitation. 
SEC. 8. INFORMATION SECURITY OBLIGATIONS. 
(a) IMPLEMENTATION.—A covered entity shall pre-
pare, revise as necessary, and implement an information 
security policy that is applicable to the information secu-
rity practices and treatment of personally identifiable in-
formation maintained by the covered entity, that is de-
signed to prevent the unauthorized disclosure or release 
of such information. 
(b) MANAGEMENT APPROVAL.—An information secu-
rity policy created pursuant to paragraph (1) shall be con-
sidered and approved by the senior management officials 
of the covered entity. 
(c) CONTENTS.—An information security policy re-
quired under paragraph (1) shall include— 
(1) a process for taking corrective action to pre-
vent or mitigate unauthorized disclosure of informa-
tion; and 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(2) identifying an officer of the covered entity 
as the point of contact with responsibility for infor-
mation security issues for the covered entity. 
SEC. 9. SELF-REGULATORY PROGRAMS. 
(a) SELF-REGULATORY PROGRAM.— 
(1) PRESUMPTION OF COMPLIANCE.—The Com-
mission shall presume that a covered entity is in 
compliance with the provisions of sections 4 through 
8 if that covered entity— 
(A) participates in a self-regulatory pro-
gram approved under subsection (b); and 
(B) is subject to enforcement under a self- 
regulatory program’s guidelines, procedures, re-
quirements, and restrictions (including a reme-
dial process under subsection (c)(7)). 
(2) EFFECT OF WILLFUL NONCOMPLIANCE.—A 
covered entity that participates in a self-regulatory 
program under this section shall not be liable for a 
civil penalty arising out of a violation of any provi-
sion of sections 4 through 8 unless such violation re-
sults from willful noncompliance with the guidelines, 
procedures, requirements, or restrictions of the pro-
gram. 
(b) APPROVAL BY COMMISSION.— 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(1) APPROVAL.—The Commission shall, within 
90 days after submission of an application for ap-
proval of a self-regulatory program under this sec-
tion (or of a material change in a program pre-
viously approved by the Commission), approve such 
program (or change) if the Commission finds that 
the program (or change) complies with the require-
ments of subsection (c). 
(2) FORM OF APPLICATION.—The Commission 
shall accept an application for approval under para-
graph (1) in any reasonable form the applicant may 
submit. 
(3) DURATION UNTIL RENEWAL.—A self-regu-
latory program approved by the Commission under 
paragraph (1) shall be approved for a period of 5 
years. 
(4) REVOCATION OF APPROVAL.—The Commis-
sion may, after notice and opportunity for a hearing, 
revoke approval granted under paragraph (1), if the 
Commission finds that a self-regulatory program 
fails to meet the requirements of subsection (c). 
(5) JUDICIAL REVIEW.—Any order by the Com-
mission denying approval of a self-regulatory pro-
gram shall be subject to judicial review, as provided 
in section 706 of title 5, United States Code. 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS