I
106TH CONGRESS
1ST SESSION
H. R. 2644
To prohibit Federal, State, and local agencies and private entities from
transferring, selling, or disclosing personal data with respect to an indi-
vidual to other agencies or entities without the express consent of the
individual except in limited circumstances, and to require such agencies
and entities to provide individuals with personal data maintained with
respect to such individuals.
IN THE HOUSE OF REPRESENTATIVES
JULY 29, 1999
Mr. HINCHEY (for himself, Mr. KLECZKA, and Mr. GEORGE MILLER of Cali-
fornia) introduced the following bill; which was referred to the Committee
on Government Reform
A BILL
To prohibit Federal, State, and local agencies and private
entities from transferring, selling, or disclosing personal
data with respect to an individual to other agencies or
entities without the express consent of the individual
except in limited circumstances, and to require such
agencies and entities to provide individuals with personal
data maintained with respect to such individuals.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Personal Data Privacy
Act of 1999’’.
SEC. 2. LIMITATIONS ON TRANSFER, SALE, OR DISCLOSURE
OF PERSONAL DATA.
(a) LIMITATION ON TRANSFER, SALE, OR DISCLO-
SURE OF PERSONAL DATA.—Except as provided in sub-
section (b), no Government agency or private entity may
transfer, sell, or disclose any personal data with respect
to an individual to another Government agency or private
entity without the express consent of such individual. The
preceding sentence shall apply with respect to each trans-
fer, sale, or disclosure of personal data by a Government
agency or private entity.
(b) EXCEPTIONS.—Subsection (a) shall not apply
with respect to the transfer, sale, or disclosure of data by
a Government agency for a national security purpose, law
enforcement purpose, or purpose relating to the Federal
or State regulation of an industry.
SEC. 3. REQUIREMENT TO PROVIDE ACCESS TO PERSONAL
DATA UPON REQUEST OF INDIVIDUAL; RE-
PORTS ON DATA COLLECTED.
(a) ACCESS
TO PERSONAL DATA REQUIRED.—A
Government agency or private entity, shall, upon the re-
quest of an individual with respect to whom the agency
or entity maintains personal data, provide such individual
with access to such personal data not later than five busi-
ness days after the individual makes the request.
(b) REPORTS.—Each year a Government agency or
private entity shall provide, to each individual regarding
whom the agency or entity has collected or maintained
personal data during the preceding 12-month period, a re-
port including the personal data collected with respect to
the individual during such period. A Government agency
or private entity shall provide such report to an individual
regardless of whether the agency or entity has provided
the data to the individual pursuant to the requirement in
subsection (a).
SEC. 4. DEFINITIONS.
For purposes of this Act:
(1) The term ‘‘personal data’’ means any data
that contains individually identifiable information
with respect to an individual, including (but not lim-
ited to) the following:
(A) The name of the individual.
(B) The address of the individual.
(C) The Social Security number of the in-
dividual.
(D) Any information relating to the med-
ical records of the individual.
(E) The passport number or driver’s-li-
cense number of the individual.
(F) Any student identification or taxpayer
identification numbers with respect to the indi-
vidual.
(G) Any school records of the individual.
(H) The Internet address of the individual.
(I) Any information relating to a credit
card account of the individual.
(J) Any other information regarding an ac-
count with information that is individually iden-
tifiable with respect to the individual.
(2) The term ‘‘Government agency’’ means any
Federal, State, or local agency.
(3) The term ‘‘private entity’’ means any busi-
ness, corporation, joint venture, affiliate, or sub-
sidiary thereof.
SEC. 5. PRIVATE RIGHT OF ACTION FOR VIOLATIONS.
Whenever a Government agency or private entity fails
to comply with the provisions of this Act, the individual
with respect to whom the personal data relates may bring
a civil action against such agency or entity, and the dis-
trict courts of the United States shall have jurisdiction
in the matters under the provisions in this Act.
SEC. 6. EFFECTIVE DATE.
This Act shall take effect on the date that is 60 days
after the date of the enactment of this Act.
Æ