I 
117TH CONGRESS 
2D SESSION 
H. R. 9161 
To prohibit data brokers from selling and transferring certain sensitive data. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 7, 2022 
Ms. SCANLON (for herself, Ms. ESHOO, Ms. JAYAPAL, Ms. VELA´ZQUEZ, Mr. 
ESPAILLAT, Ms. TLAIB, Ms. JACKSON LEE, and Ms. DEGETTE) intro-
duced the following bill; which was referred to the Committee on Energy 
and Commerce 
A BILL 
To prohibit data brokers from selling and transferring 
certain sensitive data. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Health and Location 
Data Protection Act of 2022’’. 
SEC. 2. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RE-
LATING TO HEALTH AND LOCATION DATA. 
(a) IN GENERAL.—It shall be unlawful for a data 
broker to sell, resell, license, trade, transfer, share, or oth-
erwise provide or make available any of the following 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
forms of data, whether declared or inferred, of an indi-
vidual: 
(1) Location data. 
(2) Health data. 
(3) Other categories of data identified by the 
Commission that address or reveal a category of 
data described in paragraphs (1) and (2). 
(b) EXCEPTIONS.— 
(1) ACTIONS THAT ARE HIPAA-COMPLIANT.— 
(A) IN
GENERAL.—Nothing in this Act 
shall be construed to prohibit any action taken 
with respect to the health information of an in-
dividual by a data broker that is a business as-
sociate or covered entity that is permissible 
under the Federal regulations concerning stand-
ards for privacy of individually identifiable 
health information promulgated under section 
264(c) of the Health Insurance Portability and 
Accountability Act of 1996 (42 U.S.C. 1320d– 
2 note). 
(B) APPLICATION
OF
TERMS.—In para-
graph (1), the terms ‘‘business associate’’, ‘‘cov-
ered entity’’, and ‘‘health information’’ shall 
have the meaning given those terms in the Fed-
eral regulations specified in such paragraph. 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) PUBLICATION OF NEWSWORTHY INFORMA-
TION OF LEGITIMATE PUBLIC CONCERN.—Nothing 
in this Act shall be construed to prohibit the publi-
cation of newsworthy information of legitimate pub-
lic concern. 
(3) DISCLOSURE PURSUANT TO VALID AUTHOR-
IZATION.—Nothing in this Act shall be construed to 
prohibit a disclosure of the data of an individual for 
which the individual provides valid authorization. 
For purposes of this paragraph, the term ‘‘valid au-
thorization’’ has the meaning given such term in sec-
tion 164.508 of title 45, Code of Federal Regula-
tions (or a successor regulation), subject to such ad-
aptations as the Commission shall deem necessary to 
apply such term to the disclosure of both location 
data and health data. 
(c) EFFECTIVE DATE.—The prohibition under sub-
section (a) shall take effect on the earlier of— 
(1) the date the Commission issues the final 
rule under subsection (d); or 
(2) 180 days after the date of enactment of this 
Act. 
(d) RULEMAKING.— 
(1) FINAL RULE.—Pursuant to section 553 of 
title 5, United States Code, the Commission shall 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
promulgate regulations to carry out the provisions of 
this Act. The Commission shall issue a final rule by 
not later than 180 days after the date of enactment 
of this Act. 
(2) ADDITIONAL GUIDANCE.—Pursuant to sec-
tion 553 of title 5, United States Code, the Commis-
sion may promulgate further regulations to carry out 
the provisions of this Act, including further guidance 
regarding the types of data described in subsection 
(a). 
SEC. 3. ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 shall be treated as 
a violation of a rule defining an unfair or a deceptive 
act or practice under section 18(a)(1)(B) of the Fed-
eral 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
(2) POWERS OF COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
subparagraphs (D) and (E), the Commission 
shall enforce section 2 in the same manner, by 
the same means, and with the same jurisdic-
tion, powers, and duties as though all applicable 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
terms and provisions of the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.) were in-
corporated into and made a part of this Act. 
(B) PRIVILEGES
AND
IMMUNITIES.—Any 
person who violates section 2 shall be subject to 
the penalties and entitled to the privileges and 
immunities provided in the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.). 
(C) AUTHORITY PRESERVED.—Nothing in 
this Act shall be construed to limit the author-
ity of the Federal Trade Commission under any 
other provision of law. 
(D) NONPROFIT
ORGANIZATIONS.—Not-
withstanding section 4 of the Federal Trade 
Commission Act (15 U.S.C. 44) or any jurisdic-
tional limitation of the Commission, the Com-
mission shall also enforce this Act, in the same 
manner provided in subparagraphs (A) and (B), 
with respect to organizations not organized to 
carry on business for their own profit or that 
of their members. 
(E) INDEPENDENT
LITIGATION
AUTHOR-
ITY.—In any case in which the Commission has 
reason to believe that a data broker is violating 
or has violated section 2, the Commission may 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
bring a civil action in an appropriate district 
court of the United States to— 
(i) enjoin any further such violation 
by such person; 
(ii) enforce compliance with this Act, 
including through deletion of the relevant 
information; 
(iii) obtain a permanent, temporary, 
or preliminary injunction; 
(iv) obtain civil penalties; 
(v) obtain damages (whether actual, 
punitive, 
or 
otherwise), 
restitution, 
disgorgement of unjust enrichment, or 
other compensation on behalf of aggrieved 
persons; or 
(vi) obtain any other appropriate equi-
table relief. 
(b) ENFORCEMENT BY STATES.— 
(1) IN GENERAL.—In any case in which the at-
torney general of a State has reason to believe that 
an interest of the residents of the State has been or 
is threatened or adversely affected by the engage-
ment of any data broker subject to section 2 in a 
practice that violates such section, the attorney gen-
eral of the State may, as parens patriae, bring a 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
civil action on behalf of the residents of the State in 
an appropriate district court of the United States 
to— 
(A) enjoin any further such violation by 
such person; 
(B) enforce compliance with this Act, in-
cluding through deletion of the relevant infor-
mation; 
(C) obtain a permanent, temporary, or pre-
liminary injunction; 
(D) obtain civil penalties; 
(E) obtain damages (whether actual, puni-
tive, or otherwise), restitution, disgorgement of 
unjust enrichment, or other compensation on 
behalf of aggrieved persons; or 
(F) obtain any other appropriate equitable 
relief. 
(2) NOTICE.—Before filing an action under 
paragraph (1), the attorney general, official, or 
agency of the State involved shall provide to the 
Commission a written notice of such action and a 
copy of the complaint for such action. If the attor-
ney general, official, or agency determines that it is 
not feasible to provide the notice described in this 
paragraph before the filing of the action, the attor-
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
ney general, official, or agency shall provide written 
notice of the action and a copy of the complaint to 
the Commission immediately upon the filing of the 
action. 
(3) LIMITATION ON STATE ACTION WHILE FED-
ERAL ACTION IS PENDING.—If the Commission has 
instituted a civil action for a violation of section 2, 
no State attorney general, or official or agency of a 
State, may bring an action under this paragraph 
during the pendency of that action against any de-
fendant named in the complaint of the Commission 
for any violation of section 2 alleged in the com-
plaint. 
(4) RELATIONSHIP WITH STATE-LAW CLAIMS.— 
If the attorney general of a State has authority to 
bring an action under State law directed at acts or 
practices that also violate section 2, the attorney 
general may assert the State-law claim and a claim 
under section 2 in the same civil action. 
(5) INVESTIGATORY POWERS.—Nothing in this 
subsection may be construed to prevent the attorney 
general of a State from exercising the powers con-
ferred on the attorney general by the laws of the 
State to conduct investigations, to administer oaths 
or affirmations, or to compel the attendance of wit-
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
nesses or the production of documentary or other 
evidence. 
(c) PRIVATE ENFORCEMENT.—Any person whose in-
terest has been or is threatened or adversely affected by 
the engagement of any data broker subject to section 2 
in a practice that violates such section may bring a civil 
action in an appropriate district court of the United States 
to— 
(1) enjoin any further such violation by such 
person; 
(2) enforce compliance with this Act, including 
through deletion of the relevant information; 
(3) obtain a permanent, temporary, or prelimi-
nary injunction; 
(4) obtain damages (whether actual, punitive, 
or otherwise), restitution, or other compensation; 
(5) obtain reasonable attorney’s fees, including 
litigation expenses, and costs; or 
(6) obtain any other appropriate equitable re-
lief. 
(d) CIVIL PENALTIES.—In addition to any other pen-
alties as may be prescribed by law, a violation of this Act 
shall carry a civil penalty not to exceed 15 percent of the 
revenues earned by the person’s ultimate parent entity 
during the preceding 12-month period. 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
(e) EXCLUSIVE JURISDICTION.— 
(1) DISTRICT COURTS.—For any action brought 
under this Act, the following district courts shall 
have exclusive jurisdiction: 
(A) For actions brought by the Commis-
sion, the United States District Court for the 
District of Columbia. 
(B) For actions brought by a State attor-
ney general, the district court of the United 
States for the judicial district in which the cap-
ital of the State is located. 
(C) For private actions brought by per-
sons— 
(i) the United States District Court 
for the District of Columbia; or 
(ii) the district court of the United 
States for the judicial district in which the 
violation took place or in which any de-
fendant resides or does business. 
(2) COURT OF APPEALS.—The United States 
Court of Appeals for the District of Columbia Cir-
cuit shall have exclusive jurisdiction of appeals from 
all decisions under paragraph (1). 
(f) STATUTE OF LIMITATIONS.—A proceeding for a 
violation of this Act may be commenced not later than 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
6 years after the date upon which the plaintiff obtains ac-
tual knowledge of the facts giving rise to such violation. 
(g) PREEMPTION.—The provisions of this Act pre-
empt only the provisions of State or local law that require 
disclosure prohibited by this Act. 
SEC. 4. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) DATA.— 
(A) IN
GENERAL.—Not later than 180 
days after the date of enactment of this Act, 
the Commission shall adopt rules in accordance 
with section 553 of title 5, United States Code, 
to define the term ‘‘data’’ for the purpose of 
implementing and enforcing this Act. 
(B) REQUIREMENT.—The term ‘‘data’’ 
shall include information that is linked, or rea-
sonably linkable, to— 
(i) specific individuals; or 
(ii) specific groups of individuals who 
share the same place of residence or inter-
net protocol address. 
(3) DATA BROKER.—The term ‘‘data broker’’ 
means a person that collects, buys, licenses, or infers 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
data about individuals and then sells, licenses, or 
trades that data. 
(4) HEALTH DATA.—The term ‘‘health data’’ 
means data that reveal or describe— 
(A) the search for, attempt to obtain, or 
receipt of any health services; 
(B) any past, present, or future disability, 
physical health condition, mental health condi-
tion, or health condition of an individual, in-
cluding, but not limited to, pregnancy and mis-
carriage; or 
(C) any treatment or diagnosis of a dis-
ability or condition described in subparagraph 
(B). 
(5) LOCATION
DATA.—The term ‘‘location 
data’’ means data capable of determining the past or 
present physical location of an individual or an indi-
vidual’s device. 
(6) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, each 
commonwealth, territory, or possession of the United 
States, and each federally recognized Indian Tribe. 
(7) ULTIMATE PARENT ENTITY.—The term ‘‘ul-
timate parent entity’’ has the meaning given the 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB
term in section 801.1 of title 16, Code of Federal 
Regulations (or any successor regulation). 
SEC. 5. FUNDING. 
In addition to amounts otherwise available, there is 
appropriated to the Commission for fiscal year 2023, out 
of any money in the Treasury not otherwise appropriated, 
$1,000,000,000, to remain available until September 30, 
2032, for carrying out the work of the Commission. 
Æ 
VerDate Sep 11 2014 
02:13 Oct 21, 2022
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6301
E:\BILLS\H9161.IH
H9161
pbinns on DSKJLVW7X2PROD with $$_JOB