that identifies or is linked or reasonably 
linkable to an individual; and 
(C) contractually obligates any person or 
entity that receives the information from the cov-
ered entity or service provider— 
(i) to comply with all of the provisions 
of this paragraph with respect to the infor-
mation; and 
(ii) to require that such contractual ob-
ligations be included contractually in all 
subsequent instances for which the data 
may be received. 
(13) DERIVED DATA.—The term ‘‘derived data’’ 
means covered data that is created by the derivation 
of information, data, assumptions, correlations, infer-
ences, predictions, or conclusions from facts, evidence, 
or another source of information or data about an in-
dividual or an individual’s device. 
(14) DEVICE.—The term ‘‘device’’ means any 
electronic equipment capable of collecting, processing, 
or transferring covered data that is used by one or 
more individuals. 
(15) EMPLOYEE.—The term ‘‘employee’’ means 
an individual who is an employee, director, officer, 
staff member individual working as an independent 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
contractor that is not a service provider, trainee, vol-
unteer, or intern of an employer, regardless of whether 
such individual is paid, unpaid, or employed on a 
temporary basis. 
(16) EXECUTIVE AGENCY.—The ‘‘Executive agen-
cy’’ has the meaning given such term in section 105 
of title 5, United States Code. 
(17) FIRST
PARTY
ADVERTISING
OR
MAR-
KETING.—The term ‘‘first party advertising or mar-
keting’’ means advertising or marketing conducted by 
a first party either through direct communications 
with a user such as direct mail, email, or text mes-
sage communications, or advertising or marketing 
conducted entirely within the first-party context, such 
as in a physical location operated by the first party, 
or on a web site or app operated by the first party. 
(18) GENETIC INFORMATION.—The term ‘‘genetic 
information’’ means any covered data, regardless of 
its format, that concerns an individual’s genetic char-
acteristics, including— 
(A) raw sequence data that results from the 
sequencing of the complete, or a portion of the, 
extracted deoxyribonucleic acid (DNA) of an in-
dividual; or 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(B) genotypic and phenotypic information 
that results from analyzing raw sequence data 
described in subparagraph (A). 
(19) INDIVIDUAL.—The term ‘‘individual’’ means 
a natural person residing in the United States. 
(20) KNOWLEDGE.— 
(A) IN GENERAL.—The term ‘‘knowledge’’ 
means— 
(i) with respect to a covered entity that 
is a covered high-impact social media com-
pany, the entity knew or should have known 
the individual was a covered minor; 
(ii) with respect to a covered entity or 
service provider that is a large data holder, 
and otherwise is not a covered high-impact 
social media company, that the covered en-
tity knew or acted in willful disregard of 
the fact that the individual was a covered 
minor; and 
(iii) with respect to a covered entity or 
service provider that does not meet the re-
quirements of clause (i) or (ii), actual 
knowledge. 
(B) COVERED HIGH-IMPACT SOCIAL MEDIA 
COMPANY.—For purposes of this paragraph, the 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
term ‘‘covered high-impact social media com-
pany’’ means a covered entity that provides any 
internet-accessible platform where— 
(i) 
such 
covered 
entity 
generates 
$3,000,000,000 or more in annual revenue; 
(ii) such platform has 300,000,000 or 
more monthly active users for not fewer 
than 3 of the preceding 12 months on the 
online product or service of such covered en-
tity; and 
(iii) such platform constitutes an on-
line product or service that is primarily 
used by users to access or share, user-gen-
erated content. 
(21) LARGE DATA HOLDER.— 
(A) IN
GENERAL.—The term ‘‘large data 
holder’’ means a covered entity or service pro-
vider that, in the most recent calendar year— 
(i) had annual gross revenues of 
$250,000,000 or more; and 
(ii) collected, processed, or trans-
ferred— 
(I) the covered data of more than 
5,000,000 individuals or devices that 
identify or are linked or reasonably 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
linkable to 1 or more individuals, ex-
cluding covered data collected and 
processed solely for the purpose of ini-
tiating, rendering, billing for, final-
izing, completing, or otherwise col-
lecting payment for a requested prod-
uct or service; and 
(II) the sensitive covered data of 
more than 200,000 individuals or de-
vices that identify or are linked or rea-
sonably linkable to 1 or more individ-
uals. 
(B) EXCLUSIONS.—The term ‘‘large data 
holder’’ does not include any instance in which 
the covered entity or service provider would qual-
ify as a large data holder solely on the basis of 
collecting or processing— 
(i) personal email addresses; 
(ii) personal telephone numbers; or 
(iii) log-in information of an indi-
vidual or device to allow the individual or 
device to log in to an account administered 
by the covered entity or service provider. 
(C) REVENUE.—For purposes of deter-
mining whether any covered entity or service 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
provider is a large data holder, the term ‘‘rev-
enue’’, with respect to any covered entity or serv-
ice provider that is not organized to carry on 
business for its own profit or that of its mem-
bers— 
(i) means the gross receipts the covered 
entity or service provider received, in what-
ever form, from all sources, without sub-
tracting any costs or expenses; and 
(ii) 
includes 
contributions, 
gifts, 
grants, dues or other assessments, income 
from investments, and proceeds from the 
sale of real or personal property. 
(22) MARKET RESEARCH.—The term ‘‘market re-
search’’ means the collection, processing, or transfer of 
covered data as reasonably necessary and propor-
tionate to investigate the market for or marketing of 
products, services, or ideas, where the covered data is 
not— 
(A) integrated into any product or service; 
(B) otherwise used to contact any indi-
vidual or individual’s device; or 
(C) used to advertise or market to any indi-
vidual or individual’s device. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(23) MATERIAL.—The term ‘‘material’’ means, 
with respect to an act, practice, or representation of 
a covered entity (including a representation made by 
the covered entity in a privacy policy or similar dis-
closure to individuals) involving the collection, proc-
essing, or transfer of covered data, that such act, 
practice, or representation is likely to affect a reason-
able individual’s decision or conduct regarding a 
product or service. 
(24) PRECISE GEOLOCATION INFORMATION.— 
(A) 
IN
GENERAL.—The 
term 
‘‘precise 
geolocation information’’ means information that 
is derived from a device or technology that re-
veals the past or present physical location of an 
individual or device that identifies or is linked 
or reasonably linkable to 1 or more individuals, 
with sufficient precision to identify street level 
location information of an individual or device 
or the location of an individual or device within 
a range of 1,850 feet or less. 
(B) 
EXCLUSION.—The 
term 
‘‘precise 
geolocation 
information’’ 
does 
not 
include 
geolocation information identifiable or derived 
solely from the visual content of a legally ob-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
tained image, including the location of the device 
that captured such image. 
(25) PROCESS.—The term ‘‘process’’ means to 
conduct or direct any operation or set of operations 
performed on covered data, including analyzing, orga-
nizing, structuring, retaining, storing, using, or oth-
erwise handling covered data. 
(26) PROCESSING
PURPOSE.—The term ‘‘proc-
essing purpose’’ means a reason for which a covered 
entity or service provider collects, processes, or trans-
fers covered data that is specific and granular enough 
for a reasonable individual to understand the mate-
rial facts of how and why the covered entity or service 
provider collects, processes, or transfers the covered 
data. 
(27) PUBLICLY AVAILABLE INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘publicly 
available information’’ means any information 
that a covered entity or service provider has a 
reasonable basis to believe has been lawfully 
made available to the general public from— 
(i) Federal, State, or local government 
records, if the covered entity collects, proc-
esses, and transfers such information in ac-
cordance with any restrictions or terms of 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
use placed on the information by the rel-
evant government entity; 
(ii) widely distributed media; 
(iii) a website or online service made 
available to all members of the public, for 
free or for a fee, including where all mem-
bers of the public, for free or for a fee, can 
log in to the website or online service; 
(iv) a disclosure that has been made to 
the general public as required by Federal, 
State, or local law; or 
(v) the visual observation of the phys-
ical presence of an individual or a device in 
a public place, not including data collected 
by a device in the individual’s possession. 
(B) CLARIFICATIONS; LIMITATIONS.— 
(i) AVAILABLE TO ALL MEMBERS OF 
THE PUBLIC.—For purposes of this para-
graph, information from a website or online 
service is not available to all members of the 
public if the individual who made the infor-
mation available via the website or online 
service has restricted the information to a 
specific audience. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(ii) OTHER
LIMITATIONS.—The term 
‘‘publicly available information’’ does not 
include— 
(I) any obscene visual depiction 
(as defined in section 1460 of title 18, 
United States Code); 
(II) any inference made exclu-
sively 
from 
multiple 
independent 
sources of publicly available informa-
tion that reveals sensitive covered data 
with respect to an individual; 
(III) biometric information; 
(IV) publicly available informa-
tion that has been combined with cov-
ered data; 
(V) genetic information, unless 
otherwise made available by the indi-
vidual to whom the information per-
tains as described in clause (ii) or (iii) 
of subparagraph (A); or 
(VI) intimate images known to be 
nonconsensual. 
(28) SENSITIVE COVERED DATA.— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(A) IN GENERAL.—The term ‘‘sensitive cov-
ered data’’ means the following types of covered 
data: 
(i) A government-issued identifier, 
such as a Social Security number, passport 
number, or driver’s license number, that is 
not required by law to be displayed in pub-
lic. 
(ii) Any information that describes or 
reveals the past, present, or future physical 
health, mental health, disability, diagnosis, 
or healthcare condition or treatment of an 
individual. 
(iii) A financial account number, debit 
card number, credit card number, or infor-
mation that describes or reveals the income 
level or bank account balances of an indi-
vidual, except that the last four digits of a 
debit or credit card number shall not be 
deemed sensitive covered data. 
(iv) Biometric information. 
(v) Genetic information. 
(vi) Precise geolocation information. 
(vii) An individual’s private commu-
nications such as voicemails, emails, texts, 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
direct messages, or mail, or information 
identifying the parties to such communica-
tions, voice communications, video commu-
nications, and any information that per-
tains to the transmission of such commu-
nications, 
including 
telephone 
numbers 
called, telephone numbers from which calls 
were placed, the time calls were made, call 
duration, and location information of the 
parties to the call, unless the covered entity 
or a service provider acting on behalf of the 
covered entity is the sender or an intended 
recipient of the communication. Commu-
nications are not private for purposes of 
this clause if such communications are 
made from or to a device provided by an 
employer to an employee insofar as such 
employer provides conspicuous notice that 
such employer may access such communica-
tions. 
(viii) Account or device log-in creden-
tials, or security or access codes for an ac-
count or device. 
(ix) Information identifying the sexual 
behavior of an individual in a manner in-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
consistent with the individual’s reasonable 
expectation regarding the collection, proc-
essing, or transfer of such information. 
(x) Calendar information, address book 
information, phone or text logs, photos, 
audio recordings, or videos, maintained for 
private use by an individual, regardless of 
whether such information is stored on the 
individual’s device or is accessible from that 
device and is backed up in a separate loca-
tion. Such information is not sensitive for 
purposes of this paragraph if such informa-
tion is sent from or to a device provided by 
an employer to an employee insofar as such 
employer provides conspicuous notice that it 
may access such information. 
(xi) A photograph, film, video record-
ing, or other similar medium that shows the 
naked or undergarment-clad private area of 
an individual. 
(xii) Information revealing the video 
content requested or selected by an indi-
vidual collected by a covered entity that is 
not a provider of a service described in sec-
tion 102(4). This clause does not include 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
covered data used solely for transfers for 
independent video measurement. 
(xiii) Information about an individual 
when the covered entity or service provider 
has knowledge that the individual is a cov-
ered minor. 
(xiv) An individual’s race, color, eth-
nicity, religion, or union membership. 
(xv) Information identifying an indi-
vidual’s online activities over time and 
across third party websites or online serv-
ices. 
(xvi) Any other covered data collected, 
processed, or transferred for the purpose of 
identifying the types of covered data listed 
in clauses (i) through (xv). 
(B) RULEMAKING.—The Commission may 
commence a rulemaking pursuant to section 553 
of title 5, United States Code, to include in the 
definition of ‘‘sensitive covered data’’ any other 
type of covered data that may require a similar 
level of protection as the types of covered data 
listed in clauses (i) through (xvi) of subpara-
graph (A) as a result of any new method of col-
lecting, processing, or transferring covered data. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(29) SERVICE PROVIDER.— 
(A) IN GENERAL.—The term ‘‘service pro-
vider’’ means a person or entity that— 
(i) collects, processes, or transfers cov-
ered data on behalf of, and at the direction 
of, a covered entity or a Federal, State, 
Tribal, territorial, or local government enti-
ty; and 
(ii) receives covered data from or on 
behalf of a covered entity or a Federal, 
State, Tribal, territorial, or local govern-
ment entity. 
(B) TREATMENT WITH RESPECT TO SERV-
ICE PROVIDER DATA.—A service provider that re-
ceives service provider data from another service 
provider as permitted under this Act shall be 
treated as a service provider under this Act with 
respect to such data. 
(30) SERVICE PROVIDER DATA.—The term ‘‘serv-
ice provider data’’ means covered data that is col-
lected or processed by or has been transferred to a 
service provider by or on behalf of a covered entity, 
a Federal, State, Tribal, territorial, or local govern-
ment entity, or another service provider for the pur-
pose of allowing the service provider to whom such 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
covered data is transferred to perform a service or 
function on behalf of, and at the direction of, such 
covered entity or Federal, State, Tribal, territorial, or 
local government entity. 
(31) STATE.—The term ‘‘State’’ means any of 
the 50 States, the District of Columbia, the Common-
wealth of Puerto Rico, the Virgin Islands of the 
United States, Guam, American Samoa, or the Com-
monwealth of the Northern Mariana Islands. 
(32) STATE
PRIVACY
AUTHORITY.—The term 
‘‘State privacy authority’’ means— 
(A) the chief consumer protection officer of 
a State; or 
(B) a State consumer protection agency 
with expertise in data protection, including the 
California Privacy Protection Agency. 
(33) SUBSTANTIAL
PRIVACY
RISK.—The term 
‘‘substantial privacy risk’’ means the collection, proc-
essing, or transfer of covered data in a manner that 
may result in any reasonably foreseeable substantial 
physical injury, economic injury, highly offensive in-
trusion into the privacy expectations of a reasonable 
individual under the circumstances, or discrimina-
tion on the basis of race, color, religion, national ori-
gin, sex, or disability. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(34) TARGETED ADVERTISING.—The term ‘‘tar-
geted advertising’’— 
(A) means presenting to an individual or 
device identified by a unique identifier, or 
groups of individuals or devices identified by 
unique identifiers, an online advertisement that 
is selected based on known or predicted pref-
erences, characteristics, or interests associated 
with the individual or a device identified by a 
unique identifier; and 
(B) does not include— 
(i) advertising or marketing to an in-
dividual or an individual’s device in re-
sponse to the individual’s specific request 
for information or feedback; 
(ii) contextual advertising, which is 
when an advertisement is displayed based 
on the content in which the advertisement 
appears and does not vary based on who is 
viewing the advertisement; or 
(iii) processing covered data solely for 
measuring or reporting advertising or con-
tent, performance, reach, or frequency, in-
cluding independent measurement. 
(35) THIRD PARTY.—The term ‘‘third party’’— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(A) means any person or entity, including 
a covered entity, that— 
(i) collects, processes, or transfers cov-
ered data that the person or entity did not 
collect directly from the individual linked or 
linkable to such covered data; and 
(ii) is not a service provider with re-
spect to such data; and 
(B) does not include a person or entity that 
collects covered data from another entity if the 2 
entities are related by common ownership or cor-
porate control, but only if a reasonable con-
sumer’s reasonable expectation would be that 
such entities share information. 
(36) THIRD-PARTY COLLECTING ENTITY.— 
(A) IN GENERAL.—The term ‘‘third-party 
collecting entity’’— 
(i) means a covered entity whose prin-
cipal source of revenue is derived from proc-
essing or transferring covered data that the 
covered entity did not collect directly from 
the individuals linked or linkable to the cov-
ered data; and 
(ii) does not include a covered entity 
insofar as such entity processes employee 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
data collected by and received from a third 
party concerning any individual who is an 
employee of the third party for the sole pur-
pose of such third party providing benefits 
to the employee. 
(B) PRINCIPAL SOURCE OF REVENUE DE-
FINED.—For purposes of this paragraph, the 
term ‘‘principal source of revenue’’ means, for 
the prior 12-month period, either— 
(i) more than 50 percent of all revenue 
of the covered entity; or 
(ii) obtaining revenue from processing 
or transferring the covered data of more 
than 5,000,000 individuals that the covered 
entity did not collect directly from the indi-
viduals linked or linkable to the covered 
data. 
(C) NON-APPLICATION
TO
SERVICE
PRO-
VIDERS.—An entity may not be considered to be 
a third-party collecting entity for purposes of 
this Act if the entity is acting as a service pro-
vider. 
(37) THIRD
PARTY
DATA.—The term ‘‘third 
party data’’ means covered data that has been trans-
ferred to a third party. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(38) TRANSFER.—The term ‘‘transfer’’ means to 
disclose, release, disseminate, make available, license, 
rent, or share covered data orally, in writing, elec-
tronically, or by any other means. 
(39) UNIQUE
PERSISTENT
IDENTIFIER.—The 
term ‘‘unique identifier’’— 
(A) means an identifier to the extent that 
such identifier is reasonably linkable to an indi-
vidual or device that identifies or is linked or 
reasonably linkable to 1 or more individuals, in-
cluding a device identifier, Internet Protocol ad-
dress, cookie, beacon, pixel tag, mobile ad identi-
fier, or similar technology, customer number, 
unique pseudonym, user alias, telephone number, 
or other form of persistent or probabilistic iden-
tifier that is linked or reasonably linkable to an 
individual or device; and 
(B) does not include an identifier assigned 
by a covered entity for the specific purpose of 
giving effect to an individual’s exercise of affirm-
ative express consent or opt-outs of the collection, 
processing, and transfer of covered data pursu-
ant to section 204 or otherwise limiting the col-
lection, processing, or transfer of such informa-
tion. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(40) WIDELY
DISTRIBUTED
MEDIA.—The term 
‘‘widely distributed media’’ means information that 
is available to the general public, including informa-
tion from a telephone book or online directory, a tele-
vision, internet, or radio program, the news media, or 
an internet site that is available to the general public 
on an unrestricted basis, but does not include an ob-
scene visual depiction (as defined in section 1460 of 
title 18, United States Code). 
TITLE I—DUTY OF LOYALTY 
SEC. 101. DATA MINIMIZATION. 
(a) IN GENERAL.—A covered entity may not collect, 
process, or transfer covered data unless the collection, proc-
essing, or transfer is limited to what is reasonably necessary 
and proportionate to— 
(1) provide or maintain a specific product or 
service requested by the individual to whom the data 
pertains; or 
(2) effect a purpose permitted under subsection 
(b). 
(b) PERMISSIBLE PURPOSES.—A covered entity may 
collect, process, or transfer covered data for any of the fol-
lowing purposes if the collection, processing, or transfer is 
limited to what is reasonably necessary and proportionate 
to such purpose: 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(1) To initiate, manage, or complete a trans-
action or fulfill an order for specific products or serv-
ices requested by an individual, including any associ-
ated routine administrative, operational, and ac-
count-servicing activity such as billing, shipping, de-
livery, storage, and accounting. 
(2) With respect to covered data previously col-
lected in accordance with this Act, notwithstanding 
this exception— 
(A) to process such data as necessary to per-
form system maintenance or diagnostics; 
(B) to develop, maintain, repair, or enhance 
a product or service for which such data was col-
lected; 
(C) to conduct internal research or ana-
lytics to improve a product or service for which 
such data was collected; 
(D) to perform inventory management or 
reasonable network management; 
(E) to protect against spam; or 
(F) to debug or repair errors that impair 
the functionality of a service or product for 
which such data was collected. 
(3) To authenticate users of a product or service. 
(4) To fulfill a product or service warranty. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(5) To prevent, detect, protect against, or re-
spond to a security incident. For purposes of this 
paragraph, security is defined as network security 
and physical security and life safety, including an 
intrusion or trespass, medical alerts, fire alarms, and 
access control security. 
(6) To prevent, detect, protect against, or re-
spond to fraud, harassment, or illegal activity. For 
purposes of this paragraph, the term ‘‘illegal activity’’ 
means a violation of a Federal, State, or local law 
punishable as a felony or misdemeanor that can di-
rectly harm. 
(7) To comply with a legal obligation imposed 
by Federal, Tribal, local, or State law, or to inves-
tigate, establish, prepare for, exercise, or defend legal 
claims involving the covered entity or service pro-
vider. 
(8) To prevent an individual, or group of indi-
viduals, from suffering harm where the covered entity 
or service provider believes in good faith that the in-
dividual, or group of individuals, is at risk of death, 
serious physical injury, or other serious health risk. 
(9) To effectuate a product recall pursuant to 
Federal or State law. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
States Code, as necessary to establish processes by which 
covered entities are to comply with the provisions of this 
section. Such regulations shall take into consideration— 
(1) the size of, and the nature, scope, and com-
plexity of the activities engaged in by the covered en-
tity, including whether the covered entity is a large 
data holder, nonprofit organization, covered entity 
meeting the requirements of section 209, third party, 
or third-party collecting entity; 
(2) the sensitivity of covered data collected, proc-
essed, or transferred by the covered entity; 
(3) the volume of covered data collected, proc-
essed, or transferred by the covered entity; 
(4) the number of individuals and devices to 
which the covered data collected, processed, or trans-
ferred by the covered entity relates; and 
(5) after consulting the National Institute of 
Standards and Technology, standards for ensuring 
the deletion of covered data under this Act where ap-
propriate. 
(h) ACCESSIBILITY.—A covered entity shall facilitate 
the ability of individuals to make requests under subsection 
(a) in any covered language in which the covered entity 
provides a product or service. The mechanisms by which 
a covered entity enables individuals to make requests under 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS