I 
108TH CONGRESS 
2D SESSION 
H. R. 4366 
To prohibit the transfer of personal information to any person outside the 
United States, without notice and consent, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 13, 2004 
Mr. MARKEY introduced the following bill; which was referred to the 
Committee on Energy and Commerce 
A BILL 
To prohibit the transfer of personal information to any per-
son outside the United States, without notice and con-
sent, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Personal Data 
Offshoring Protection Act of 2004’’. 
SEC. 2. DEFINITIONS. 
As used in this Act, the following definitions apply: 
(1) BUSINESS ENTERPRISE.—The term ‘‘busi-
ness enterprise’’ means any organization, associa-
tion, or venture established to make a profit, or any
private, nonprofit organization that collects or re-
tains personally identifiable information. 
(2) COUNTRY WITH ADEQUATE PRIVACY PRO-
TECTION.—The term ‘‘country with adequate pri-
vacy protection’’ means a country that has been cer-
tified by the Federal Trade Commission as having a 
legal system that provides adequate privacy protec-
tion for personally identifiable information. 
(3) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ includes information such as— 
(A) name; 
(B) postal address; 
(C) financial information; 
(D) medical records; 
(E) date of birth; 
(F) phone number; 
(G) e-mail address; 
(H) social security number; 
(I) mother’s maiden name; 
(J) password; 
(K) state identification information; 
(L) driver’s license number; 
(M) personal tax information; and
(N) any consumer transactional or experi-
ential information relating to the person. 
(4) 
TRANSMIT.—The 
term 
‘‘transmit’’ 
or 
‘‘transmission’’ means the use of any instrumentality 
of interstate commerce, including the mails or any 
electronic means, to transfer information or to pro-
vide access to such information via the Internet or 
any comparable telecommunications system. 
SEC. 3. PROTECTION OF PERSONALLY IDENTIFIABLE IN-
FORMATION FROM UNAUTHORIZED TRANS-
MISSION. 
(a) IN GENERAL.—A business enterprise may trans-
mit personally identifiable information regarding a citizen 
of the United States to any foreign affiliate or subcon-
tractor located in a country that is a country with ade-
quate privacy protection, provided that the citizen has 
been provided prior notice that such information may be 
transmitted to such a foreign affiliate or subcontractor 
and has not objected to such transmission. 
(b) ‘‘OPT-IN’’ CONSENT REQUIRED FOR COUNTRIES 
WITHOUT ADEQUATE PRIVACY PROTECTION.—A business 
enterprise may not transmit personally identifiable infor-
mation regarding a citizen of the United States to any 
foreign affiliate or subcontractor located in a country that 
is a country without adequate privacy protection unless—
(1) the business enterprise discloses to the cit-
izen that the country to which the information will 
be transmitted does not have adequate privacy pro-
tection; 
(2) the business enterprise obtains consent from 
the citizen, before a consumer relationship is estab-
lished or before the effective date of this Act, to 
transmit such information to such foreign affiliate or 
subcontractor; and 
(3) the consent referred to in paragraph (2) is 
renewed by the citizen within 1 year before such in-
formation is transmitted. 
(c) PROHIBITION ON REFUSAL TO PROVIDE SERV-
ICES.—A business enterprise shall not deny the provision 
of any good or service to, nor change the terms of or 
refuse to enter into a business relationship with any per-
son based upon that person’s exercise of the consent rights 
provided for in this Act or in any other applicable law. 
SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION. 
(a) UNFAIR AND DECEPTIVE ACT OR PRACTICE.— 
A violation of this Act shall be treated as a violation of 
a rule defining an unfair or deceptive act or practice pre-
scribed under section 18(a)(1)(B) of the Federal Trade 
Commission Act (15 U.S.C. 57a(a)(1)(B)).
(b) 
ENFORCEMENT
AUTHORITY.—The 
Federal 
Trade Commission shall enforce this Act in the same man-
ner, by the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms and pro-
visions of the Federal Trade Commission Act (15 U.S.C. 
41 et seq.) were incorporated into and made a part of this 
Act. 
SEC. 5. CIVIL REMEDIES. 
(a) PRIVATE RIGHT OF ACTION.—A person or entity 
may, if otherwise permitted by the laws or rules of court 
of a State, bring in an appropriate court of that State— 
(1) an action based on a violation of this Act 
or the regulations prescribed pursuant to this Act to 
enjoin such violation; 
(2) an action to recover for actual monetary 
loss from such a violation, or to receive $10,000 in 
damages for each such violation, whichever is great-
er, or 
(3) both such actions. 
If the court finds that the defendant willfully or knowingly 
violated this subsection or the regulations prescribed 
under this subsection, the court may, in its discretion, in-
crease the amount of the award to an amount equal to 
not more than 3 times the amount available under para-
graph (2).
(b) ACTIONS BY STATES.— 
(1) AUTHORITY OF STATES.—Whenever the at-
torney general of a State, or an official or agency 
designated by a State, has reason to believe that any 
person has engaged or is engaging in a violation of 
this Act or the regulations prescribed pursuant to 
this Act, the State may bring a civil action on behalf 
of its residents to enjoin such violation, an action to 
recover for actual monetary loss or receive $10,000 
in damages for each violation, or both such actions. 
If the court finds the defendant willfully or know-
ingly violated this Act or regulations prescribed pur-
suant to this Act, the court may, in its discretion, 
increase the amount of the award to an amount 
equal to not more than 3 times the amount available 
under the preceding sentence. 
(2) EXCLUSIVE
JURISDICTION
OF
FEDERAL 
COURTS.—The district courts of the United States, 
the United States courts of any territory, and the 
District Court of the United States for the District 
of Columbia shall have exclusive jurisdiction over all 
civil actions brought under this subsection. Upon 
proper application, such courts shall also have juris-
diction to issue writs of mandamus, or orders afford-
ing like relief, commanding the defendant to comply
with the provisions of this Act or regulations pre-
scribed pursuant to this Act, including the require-
ment that the defendant take such action as is nec-
essary to remove the danger of such violation. Upon 
a proper showing, a permanent or temporary injunc-
tion or restraining order shall be granted without 
bond. 
(3) NOTICE TO AN INTERVENTION OF FEDERAL 
TRADE COMMISSION.—The State bringing a civil ac-
tion under this section shall serve prior written no-
tice of any such civil action upon the Federal Trade 
Commission and provide the Commission with a 
copy of its complaint, except in any case where such 
prior notice is not feasible, in which case the State 
shall serve such notice immediately upon instituting 
such action. The Commission shall have the right— 
(A) to intervene in the action; 
(B) upon so intervening, to be heard on all 
matters arising therein; and 
(C) to file petitions for appeal. 
(4) VENUE; SERVICE OF PROCESS.—Any civil 
action brought under this subsection in a district 
court of the United States may be brought in the 
district wherein the defendant is found or is an in-
habitant or transacts business or wherein the viola-
tion occurred or is occurring, and process in such 
cases may be served in any district in which the de-
fendant is an inhabitant or where the defendant may 
be found. 
(5) INVESTIGATORY POWERS.—For purposes of 
bringing any civil action under this subsection, noth-
ing in this Act shall prevent the attorney general of 
a State, or an official or agency designated by a 
State, from exercising the powers conferred on the 
attorney general or such official by the laws of such 
State to conduct investigations or to administer 
oaths or affirmations or to compel the attendance of 
witnesses or the production of documentary and 
other evidence. 
(6) EFFECT ON STATE COURT PROCEEDINGS.— 
Nothing contained in this section shall be construed 
to prohibit an authorized State official from pro-
ceeding in State court on the basis of an alleged vio-
lation of any general civil or criminal statute of such 
State. 
(7) LIMITATION.—Whenever the Federal Trade 
Commission has instituted a civil action for violation 
of this Act or the regulations prescribed pursuant to 
this Act, no State may, during the pendency of such 
action instituted by the Commission, subsequently
institute a civil action against any defendant named 
in the Commission’s complaint for any violation as 
alleged in the Commission’s complaint. 
SEC. 6. CERTIFICATION OF COUNTRIES WITH ADEQUATE 
PRIVACY PROTECTION. 
(a) IN GENERAL.—Not later than 6 months after the 
date of enactment of this Act, the Federal Trade Commis-
sion, after providing notice and opportunity for public 
comment, shall— 
(1) certify those countries that have legal sys-
tems that provide adequate privacy protection for 
personally identifiable information; and 
(2) make the list of countries certified under 
paragraph (1) available to the general public. 
(b) CERTIFICATION CRITERIA.— 
(1) IN GENERAL.—In determining whether a 
country should be certified under this section, the 
Federal Trade Commission shall consider the ade-
quacy of the country’s infrastructure for detecting, 
evaluating, and responding to privacy violations. 
(2) PRESUMPTION.—The Commission shall pre-
sume that a country’s privacy protections are inad-
equate if they are any less protective of personally 
identifiable information than those afforded under 
Federal law or under the laws of any State, or if the
Commission determines that such country’s laws are 
not adequately enforced. 
(c) EUROPEAN UNION DATE PROTECTION DIREC-
TIVE.—A country that has comprehensive privacy laws 
that meet the requirements of the European Union Data 
Protection Directive shall be certified under this section 
unless the Federal Trade Commission determines that 
such laws are not commonly enforced within such country. 
SEC. 7. EFFECTIVE DATE. 
Section 6 of this Act shall take effect on the date 
of enactment of this Act. Sections 2 through 5 of this Act 
shall take effect 60 days after the the completion of the 
certification required by section 6. 
Æ