124 
party is located, or in the United States Court of 
Appeals for the District of Columbia Circuit, within 
30 days after the date of service of such order, a 
written petition praying that the order of the Agency 
be modified, terminated, or set aside. A copy of such 
petition shall be forthwith transmitted by the clerk 
of the court to the Agency, and thereupon the Agen-
cy shall file in the court the record in the pro-
ceeding, as provided in section 2112 of title 28, 
United States Code. Upon the filing of such petition, 
such court shall have jurisdiction, which upon the 
filing of the record shall, except as provided in the 
last sentence of paragraph (3), be exclusive, to af-
firm, modify, terminate, or set aside, in whole or in 
part, the order of the Agency. Review of such pro-
ceedings shall be had as provided in chapter 7 of 
title 5, United States Code. The judgment and de-
cree of the court shall be final, except that the same 
shall be subject to review by the Supreme Court of 
the United States, upon certiorari, as provided in 
section 1254 of title 28, United States Code. 
(5) NO
STAY.—The commencement of pro-
ceedings for judicial review under paragraph (4) 
shall not, unless specifically ordered by the court, 
operate as a stay of any order issued by the Agency. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
125 
(c) SPECIAL RULES FOR TEMPORARY CEASE-AND- 
DESIST PROCEEDINGS.— 
(1) IN GENERAL.—Whenever the Agency deter-
mines that the violation specified in the notice of 
charges served upon a person pursuant to subsection 
(b), or the continuation thereof, is likely to cause the 
person to be insolvent or otherwise prejudice the in-
terests of individuals before the completion of the 
proceedings conducted pursuant to subsection (b), 
the Agency may issue a temporary order requiring 
the person to cease and desist from any such viola-
tion and to take affirmative action to prevent or 
remedy such insolvency or other condition pending 
completion of such proceedings. Such order may in-
clude any requirement authorized under this title. 
Such order shall become effective upon service upon 
the person and, unless set aside, limited, or sus-
pended by a court in proceedings authorized by 
paragraph (2), shall remain effective and enforceable 
pending the completion of the administrative pro-
ceedings pursuant to such notice and until such time 
as the Agency shall dismiss the charges specified in 
such notice, or if a cease-and-desist order is issued 
against the person, until the effective date of such 
order. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
126 
(2) APPEAL.—Not later than 10 days after a 
person has been served with a temporary cease-and- 
desist order, the person may apply to the United 
States district court for the judicial district in which 
the residence or principal office or place of business 
of the person is located, or the United States Dis-
trict Court for the District of Columbia, for an in-
junction setting aside, limiting, or suspending the 
enforcement, operation, or effectiveness of such 
order pending the completion of the administrative 
proceedings pursuant to the notice of charges served 
upon the person under subsection (b), and such 
court shall have jurisdiction to issue such injunction. 
(d) SPECIAL RULES
FOR ENFORCEMENT
OF OR-
DERS.— 
(1) IN GENERAL.—The Agency may in its dis-
cretion apply to the United States district court 
within the jurisdiction of which the residence or 
principal office or place of business of a person is lo-
cated, for the enforcement of any effective and out-
standing order issued under this section against 
such person, and such court shall have jurisdiction 
and power to order and require compliance with 
such order. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
127 
(2) EXCEPTION.—Except as otherwise provided 
in this section, no court shall have jurisdiction to af-
fect by injunction or otherwise the issuance or en-
forcement of any order or to review, modify, sus-
pend, terminate, or set aside any such order. 
(e) RULES.—The Agency shall prescribe rules estab-
lishing such procedures as may be necessary to carry out 
this section. 
SEC. 403. LITIGATION AUTHORITY. 
(a) IN GENERAL.—If a person violates any provision 
of this Act or a rule or order prescribed under this Act, 
the Agency may commence a civil action against such per-
son to impose a civil penalty or to seek all appropriate 
legal and equitable relief, including a permanent or tem-
porary injunction as permitted by law. 
(b) REPRESENTATION.—Except as provided in sub-
section (e), the Agency may act in its own name and 
through its own attorneys enforcing any provision of this 
Act or rules or orders issued pursuant to this Act or in 
any action, suit, or other court proceeding to which the 
Agency is a party. 
(c) COMPROMISE
OF ACTIONS.—The Agency may 
compromise or settle any action, suit, or other court pro-
ceeding to which the Agency is a party if such compromise 
is approved by the court. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00127
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
128 
(d) NOTICE TO THE ATTORNEY GENERAL OF THE 
UNITED STATES.— 
(1) IN
GENERAL.—When commencing a civil 
action under this Act or regulations or rules or or-
ders issued pursuant to this Act, the Agency shall 
notify the Attorney General. 
(2) NOTICE AND COORDINATION.— 
(A) NOTICE OF OTHER ACTIONS.—In addi-
tion to any notice required under paragraph 
(1), the Agency shall notify the Attorney Gen-
eral concerning any action, suit, or other court 
proceeding to which the Agency is a party. 
(B) COORDINATION.—In order to avoid 
conflicts and promote consistency regarding liti-
gation of matters under Federal law, the Attor-
ney General and the Agency shall consult re-
garding the coordination of investigations and 
proceedings, including by negotiating an agree-
ment for coordination not later than 180 days 
after the effective date of this Act. The agree-
ment under this subparagraph shall include 
provisions to ensure that parallel investigations 
and proceedings involving this Act and the rules 
prescribed under this Act are conducted in a 
manner that avoids conflicts and does not im-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00128
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
129 
pede the ability of the Attorney General to 
prosecute violations of Federal criminal laws. 
(C) RULE OF CONSTRUCTION.—Nothing in 
this paragraph shall be construed to limit the 
authority of the Agency under this Act, includ-
ing the authority to interpret this Act. 
(e) APPEARANCE BEFORE THE SUPREME COURT.— 
The Agency may represent itself in its own name before 
the Supreme Court of the United States, if the Agency 
makes a written request to the Attorney General within 
the 10-day period which begins on the date of entry of 
the judgment which would permit any party to file a peti-
tion for writ of certiorari, and the Attorney General con-
curs with such request or fails to take action within 60 
days of the request of the Agency. 
(f) FORUM.—Any civil action brought under this Act 
or regulations or rules or orders issued pursuant to this 
Act may be brought in an appropriate district court of 
the United States or an appropriate State court. 
(g) TIME FOR BRINGING ACTION.—Except as other-
wise permitted by law or equity, no action may be brought 
under this Act more than 3 years after the date of dis-
covery of the violation to which the action relates. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00129
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
130 
SEC. 404. ENFORCEMENT BY STATES. 
(a) CIVIL ACTION.—In any case in which a State at-
torney general or a State privacy regulator has reason to 
believe that an interest of the residents of a State has been 
or is adversely affected by any person who violates any 
provision of this Act or a rule or order prescribed under 
this Act, the State attorney general or State privacy regu-
lator, as parens patriae, may bring a civil action on behalf 
of the residents of the State in an appropriate State court 
or an appropriate district court of the United States to— 
(1) enjoin further violation of such provision by 
the defendant; 
(2) compel compliance with such provision; or 
(3) obtain relief under section 406. 
(b) RIGHTS OF AGENCY.—Before initiating a civil ac-
tion under subsection (a), the State attorney general or 
State privacy regulator, as the case may be, shall notify 
the Agency in writing of such civil action. Upon receiving 
notice with respect to a civil action, the Agency may— 
(1) intervene in such action; and 
(2) upon intervening— 
(A) be heard on all matters arising in such 
civil action; and 
(B) file petitions for appeal of a decision in 
such action. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00130
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
131 
(c) PREEMPTIVE ACTION BY AGENCY.—If the Agen-
cy institutes a civil action for violation of any provision 
of this Act or a rule or order prescribed under this Act, 
no State attorney general or State privacy regulator may 
bring a civil action against any defendant named in the 
complaint of the Agency for a violation of such provision 
that is alleged in such complaint. 
SEC. 405. PRIVATE RIGHTS OF ACTION. 
(a) INJUNCTIVE RELIEF.—A person who is aggrieved 
by a violation of this Act may bring a civil action for de-
claratory or injunctive relief in any court of competent ju-
risdiction in any State or in an appropriate district court. 
(b) CIVIL ACTION FOR DAMAGES.—Except for claims 
under rule 23 of the Federal Rules of Civil Procedure or 
a similar judicial procedure authorizing an action to be 
brought by 1 or more representatives, a person who is ag-
grieved by a violation of this Act may bring a civil action 
for damages in any court of competent jurisdiction in any 
State or in an appropriate district court. 
(c) NONPROFIT COLLECTIVE REPRESENTATION.— 
An individual shall have the right to appoint a nonprofit 
organization (as described in section 501(c)(3) of the In-
ternal Revenue Code of 1986 and exempt from taxation 
under section 501(a) of such Code) which has been prop-
erly constituted in accordance with the law, has statutory 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
132 
objectives which are in the public interest, and is active 
in the field of the protection of individual rights and free-
doms with regard to the protection of privacy and informa-
tion security to lodge the complaint on behalf of such indi-
vidual to exercise the rights referred to in this Act on be-
half of such individual. 
(1) A nonprofit may represent a class of ag-
grieved individuals. 
(2) A prevailing nonprofit shall receive reason-
able compensation for expenses, including attorneys’ 
fees. 
(3) Individuals shall receive an equally divided 
share of the total damages. 
(d) STATE APPOINTMENT.—A State may provide 
that any body, organization, or association referred to in 
subsection (c), independent of an individual’s appoint-
ment, has the right to lodge, in that State, a complaint 
with the Agency and to exercise the rights referred to in 
this Act if it considers that the rights of an individual 
under this Act have been infringed. 
SEC. 406. RELIEF AVAILABLE. 
(a) CIVIL
ACTIONS
AND
ADJUDICATION
PRO-
CEEDINGS.— 
(1) JURISDICTION.—In any civil action or any 
adjudication proceeding brought by the Agency, a 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00132
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
133 
State attorney general, or State privacy regulator 
under any provision of this Act or a rule or order 
prescribed under this Act, the court or the Agency 
(as the case may be) shall have jurisdiction to grant 
any appropriate legal or equitable relief with respect 
to a violation of such provision. 
(2) RELIEF.—Relief under this section may in-
clude— 
(A) rescission or reformation of contracts; 
(B) refund of moneys; 
(C) restitution; 
(D) disgorgement or compensation for un-
just enrichment; 
(E) payment of damages or other mone-
tary relief; 
(F) public notification regarding the viola-
tion, including the costs of notification; 
(G) limits on the activities or functions of 
the person; and 
(H) civil money penalties, as provided in 
subsection (c). 
(3) NO EXEMPLARY OR PUNITIVE DAMAGES.— 
Nothing in this subsection shall be construed as au-
thorizing the imposition of exemplary or punitive 
damages. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00133
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
134 
(b) RECOVERY
OF
COSTS.—In any civil action 
brought by the Agency, State attorney general, or State 
privacy regulator under any provision of this Act or a rule 
or order prescribed under this Act, the Agency, State at-
torney general, or State privacy regulator may recover its 
costs in connection with prosecuting such action if the 
Agency or State attorney general is the prevailing party 
in the action. 
(c) CIVIL MONEY PENALTY IN COURT AND ADMINIS-
TRATIVE ACTIONS.— 
(1) IN
GENERAL.—Any person who violates, 
through any act or omission, any provision of this 
Act or a rule or order issued pursuant to this Act 
shall forfeit and pay a civil penalty under this sub-
section. 
(2) PENALTY AMOUNT.— 
(A) IN GENERAL.—The amount of a civil 
penalty under this subsection may not exceed, 
for each violation, the product of— 
(i) the maximum civil penalty for 
which a person, partnership, or corporation 
may be liable under section 5(m)(1)(A) of 
the Federal Trade Commission Act (15 
U.S.C. 45(m)(1)(A)) for a violation of a 
rule under such Act respecting unfair or 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00134
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
135 
deceptive acts or practices, as adjusted 
under the Federal Civil Penalties Inflation 
Adjustment Act of 1990 (28 U.S.C. 2461 
note); and 
(ii) the number of individuals whose 
personal information is affected by the vio-
lation. 
(B) CONTINUING
VIOLATIONS.—In the 
case of a violation through continuing failure to 
comply with a provision of this Act or a rule or 
order prescribed under this Act, each day of 
continuance of such failure shall be treated as 
a separate violation for purposes of subpara-
graph (A). 
(3) MITIGATING FACTORS.—In determining the 
amount of any penalty assessed under paragraph 
(2), the court or the Agency shall take into account 
the appropriateness of the penalty with respect to— 
(A) the size of financial resources and good 
faith of the person charged; 
(B) the gravity of the violation; 
(C) the severity of the privacy harms (in-
cluding both actual and potential harms) to in-
dividuals; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00135
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
136 
(D) any disparate impact of the privacy 
harms (including both actual and potential 
harms) on protected classes; 
(E) the history of previous violations; and 
(F) such other matters as justice may re-
quire. 
(4) AUTHORITY
TO
MODIFY
OR
REMIT
PEN-
ALTY.—The Agency, State attorney general, or State 
privacy regulator may compromise, modify, or remit 
any penalty which may be assessed or has already 
been assessed under paragraph (2). The amount of 
such penalty, when finally determined, shall be ex-
clusive of any sums owed by the person to the 
United States in connection with the costs of the 
proceeding, and may be deducted from any sums 
owing by the United States to the person charged. 
(5) NOTICE AND HEARING.—No civil penalty 
may be assessed under this subsection with respect 
to a violation of any provision of this Act or a rule 
or order issued pursuant to this Act, unless— 
(A) the Agency, State attorney general, or 
State privacy regulator gives notice and an op-
portunity for a hearing to the person accused of 
the violation; or 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00136
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
137 
(B) the appropriate court has ordered such 
assessment and entered judgment in favor of 
the Agency, State attorney general, or State 
privacy regulator. 
SEC. 407. REFERRAL FOR CRIMINAL PROCEEDINGS. 
If the Agency obtains evidence that any person, do-
mestic or foreign, has engaged in conduct that may con-
stitute a violation of Federal criminal law, the Agency 
shall transmit such evidence to the Attorney General of 
the United States, who may institute criminal proceedings 
under appropriate law. Nothing in this section affects any 
other authority of the Agency to disclose information. 
SEC. 408. WHISTLEBLOWER ENFORCEMENT. 
(a) IN GENERAL.—Any person who becomes aware, 
based on nonpublic information, that a covered entity has 
violated this Act may file a civil action for civil penalties, 
if prior to filing such action, the person files with the Di-
rector a written request for the Director to commence the 
action. The request shall include a clear and concise state-
ment of the grounds for believing a cause of action exists. 
The person shall make the nonpublic information available 
to the Director upon request: 
(1) If the Director files suit within 90 days 
from receipt of the written request to commence the 
action, no other action may be brought unless the 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00137
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
138 
action brought by the Director is dismissed without 
prejudice. 
(2) If the Director does not file suit within 90 
days from receipt of the written request to com-
mence the action, the person requesting the action 
may proceed to file a civil action. 
(3) The time period within which a civil action 
shall be commenced shall be tolled from the date of 
receipt by the Director of the written request to ei-
ther the date that the civil action is dismissed with-
out prejudice, or for 150 days, whichever is later, 
but only for a civil action brought by the person who 
requested the Director to commence the action. 
(b) ALLOCATION OF CIVIL PENALTIES.—If a judg-
ment is entered against the defendant or defendants in 
an action brought pursuant to this section, or the matter 
is settled, amounts received as civil penalties or pursuant 
to a settlement of the action shall be allocated as follows: 
(1) If the action was brought by the Director 
upon a request made by a person pursuant to sub-
section (a), the person who made the request shall 
be entitled to 15 percent of the civil penalties. 
(2) If the action was brought by the person who 
made the request pursuant to subsection (a), that 
person shall receive an amount the court determines 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00138
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
139 
is reasonable for collecting the civil penalties on be-
half of the government. The amount shall be not less 
than 25 percent and not more than 50 percent of 
the proceeds of the action and shall be paid out of 
the proceeds. 
TITLE V—RELATION TO OTHER 
LAW 
SEC. 501. EFFECTIVE DATE. 
(a) IN GENERAL.—This Act shall apply beginning on 
the date that is 1 year after the date of the enactment 
of this Act. 
(b) AUTHORITY TO PROMULGATE REGULATIONS AND 
TAKE CERTAIN OTHER ACTIONS.—Nothing in subsection 
(a) affects the authority of the Agency to take an action 
expressly required by a provision of this Act to be taken 
before the effective date described in such subsection. 
SEC. 502. RELATION TO OTHER FEDERAL LAW. 
Nothing in this Act shall be construed to modify, 
limit, or supersede the operation of any privacy or security 
provision in the following: 
(1) Section 552a of title 5, United States Code 
(commonly known as the ‘‘Privacy Act of 1974’’). 
(2) The Right to Financial Privacy Act of 1978 
(12 U.S.C. 3401 et seq.). 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00139
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
140 
(3) The Fair Credit Reporting Act (15 U.S.C. 
1681 et seq.). 
(4) The Fair Debt Collection Practices Act (15 
U.S.C. 1692 et seq.). 
(5) The Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6501 et seq.). 
(6) Title V of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801 et seq.). 
(7) Chapter 119, 123, or 206 of title 18, 
United States Code. 
(8) Section 444 of the General Education Pro-
visions Act (20 U.S.C. 1232g) (commonly known as 
the ‘‘Family Educational Rights and Privacy Act of 
1974’’). 
(9) Section 445 of the General Education Pro-
visions Act (20 U.S.C. 1232h). 
(10) The Privacy Protection Act of 1980 (42 
U.S.C. 2000aa et seq.). 
(11) The regulations promulgated under section 
264(c) of the Health Insurance Portability and Ac-
countability Act of 1996 (42 U.S.C. 1320d–2 note), 
as those regulations relate to— 
(A) a person described in section 1172(a) 
of the Social Security Act (42 U.S.C. 1320d– 
1(a)); or 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00140
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
141 
(B) transactions referred to in section 
1173(a)(1) of the Social Security Act (42 
U.S.C. 1320d–2(a)(1)). 
(12) The Communications Assistance for Law 
Enforcement Act (47 U.S.C. 1001 et seq.). 
(13) Section 222, 227, 338, or 631 of the Com-
munications Act of 1934 (47 U.S.C. 222, 227, 338, 
or 551). 
(14) The E-Government Act of 2002 (44 
U.S.C. 101 et seq.). 
(15) The Paperwork Reduction Act of 1995 (44 
U.S.C. 3501 et seq.). 
(16) The Federal Information Security Manage-
ment Act of 2002 (44 U.S.C. 3541 et seq.). 
(17) The Currency and Foreign Transactions 
Reporting Act of 1970, as amended (commonly 
known as the ‘‘Bank Secrecy Act’’) (12 U.S.C. 
1829b and 1951–1959, 31 U.S.C. 5311–5314 and 
5316–5332), including the International Money 
Laundering Abatement and Financial Anti-Ter-
rorism Act of 2001, title III of Public Law 107–56, 
as amended. 
(18) The National Security Act of 1947 (50 
U.S.C. 3001 et seq.). 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00141
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
142 
(19) The Foreign Intelligence Surveillance Act 
of 1978, as amended (50 U.S.C. 1801 et seq.). 
(20) The Civil Rights Act of 1964 (Public Law 
88–352, 78 Stat. 241). 
(21) The Americans with Disabilities Act (42 
U.S.C. 12101 et seq.). 
(22) The Fair Housing Act (42 U.S.C. 3601 et 
seq.). 
(23) The Consumer Financial Protection Act of 
2010 (12 U.S.C. 5481 et seq.). 
(24) The Equal Credit Opportunity Act (15 
U.S.C. 1691 et seq.). 
(25) The Age Discrimination in Employment 
Act (29 U.S.C. 621 et seq.). 
(26) The Genetic Information Nondiscrimina-
tion Act (Public Law 110–233, 122 Stat. 881). 
(27) Subpart A of part 46 of title 45, Code of 
Federal Regulations (commonly known as the ‘‘Com-
mon Rule’’). 
(28) The Driver’s Privacy Protection Act of 
1994 (18 U.S.C. 2721 et seq.). 
(29) The Video Privacy Protection Act (18 
U.S.C. 2710 et seq.). 
(30) Chapters 61, 68, 75, and 76 of the Inter-
nal Revenue Code of 1986. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00142
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
143 
(31) Section 1106 of the Social Security Act 
(42 U.S.C. 1306). 
(32) The Stored Communications Act (18 
U.S.C. 2701 et seq.). 
(33) Any other privacy or information security 
provision of Federal law. 
SEC. 503. RELATION TO STATE LAW. 
This Act, and any amendment, standard, rule, re-
quirement, assessment, or regulation promulgated under 
this Act, does not annul, alter, affect, or exempt any per-
son subject to the provisions of this Act from complying 
with the laws of any State or political subdivision of a 
State with respect to privacy or consumer protection, ex-
cept to the extent that those laws are inconsistent with 
any provisions of this Act, and then only to the extent 
of the inconsistency. For purposes of this section, a law 
of a State or political subdivision of a State is not incon-
sistent with this Act if the protection such law affords any 
consumer is greater than the protection provided by this 
Act. 
SEC. 504. SEVERABILITY. 
If any provision of this Act or the amendments made 
by this Act, or the application thereof, is held unconstitu-
tional or otherwise invalid, the validity of the remainder 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00143
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
144 
of the Act, the amendments, and the application of such 
provision shall not be affected thereby. 
TITLE VI—NIST AND NSF 
ACTIVITIES 
SEC. 601. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY PRIVACY RESEARCH AND DEVELOP-
MENT. 
Section 2 of the National Institute of Standards and 
Technology Act (15 U.S.C. 272) is amended by adding 
at the end the following: 
‘‘(f) PRIVACY RISK MANAGEMENT RESEARCH.—In 
carrying out the activities under subsection (c)(19), the 
Director shall, to the extent practicable and appropriate— 
‘‘(1) develop, and periodically update, in col-
laboration with appropriate Federal agencies, indus-
try, State, local, and Tribal governments, civil soci-
ety, other nonprofit organizations, and the Informa-
tion Security and Privacy Advisory Board, a privacy 
risk management framework that covers risks associ-
ated with data processing and that shall— 
‘‘(A) identify voluntary, consensus-based 
technical standards, guidelines, best practices, 
methodologies, procedures, and processes for— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00144
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
145 
‘‘(i) developing privacy-enhanced in-
formation systems and networks, including 
emerging technologies; and 
‘‘(ii) assessing and mitigating privacy 
risks to help organizations protect individ-
uals’ privacy in information systems and 
networks; 
‘‘(B) establish common definitions and 
characterizations for aspects of privacy risk 
management; 
‘‘(C) provide case studies and risk profiles 
of framework implementation; 
‘‘(D) provide guidance to enable organiza-
tions to use the framework to meet privacy re-
quirements from Federal, State, local, and 
Tribal governments and international policy-
makers; 
‘‘(E) incorporate voluntary, consensus- 
based technical standards and best practices; 
‘‘(F) facilitate use by regulators and mar-
kets with the aim of reducing barriers to trade; 
and 
‘‘(G) not prescribe or otherwise require the 
use of specific information or communications 
technology products or services; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00145
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB