I 
116TH CONGRESS 
2D SESSION 
H. R. 8749 
To provide for digital accountability and transparency. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 12, 2020 
Mr. VELA introduced the following bill; which was referred to the Committee 
on Energy and Commerce, and in addition to the Committee on Science, 
Space, and Technology, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To provide for digital accountability and transparency. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Digital Accountability 
and Transparency to Advance Privacy Act’’ or the ‘‘DATA 
Privacy Act’’. 
SEC. 2. DEFINITIONS. 
(a) IN GENERAL.—In this Act: 
(1) COLLECT.—The term ‘‘collect’’ means tak-
ing any operation or set of operations to obtain cov-
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
ered data, including by automated means, including 
purchasing, leasing, assembling, recording, gath-
ering, acquiring, or procuring. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) 
COVERED
DATA.—The 
term 
‘‘covered 
data’’— 
(A) means any information that is— 
(i) collected, processed, stored, or dis-
closed by a covered entity; 
(ii) collected over the internet or other 
digital network; and 
(iii)(I) linked to an individual or de-
vice associated with an individual; or 
(II) practicably linkable to an indi-
vidual or device associated with an indi-
vidual, including by combination with sepa-
rate information, by the covered entity or 
any potential recipient of the data; and 
(B) does not include data that is— 
(i) collected, processed, stored, or dis-
closed solely for the purpose of employ-
ment of an individual; and 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(ii) lawfully made available to the 
public from Federal, State, or local govern-
ment records. 
(4) COVERED ENTITY.—The term ‘‘covered en-
tity’’— 
(A) means any entity that collects, proc-
esses, stores, or discloses covered data; and 
(B) does not include any entity that col-
lects, processes, stores, or discloses covered data 
relating to fewer than 3,000 individuals and de-
vices during any 12-month period. 
(5) DISCLOSE.—The term ‘‘disclose’’ means 
taking any action with respect to covered data, in-
cluding by automated means, to sell, share, provide, 
or otherwise transfer covered data to another entity, 
person, or the general public. 
(6) PRIVACY RISK.—The term ‘‘privacy risk’’ 
means potential harm to an individual resulting 
from the collection, processing, storage, or disclosure 
of covered data, including— 
(A) direct or indirect financial loss; 
(B) stigmatization or reputational harm; 
(C) anxiety, embarrassment, fear, and 
other severe emotional trauma; 
(D) loss of economic opportunity; or 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(E) physical harm. 
(7) PROCESS.—The term ‘‘process’’ means any 
operation or set of operations that is performed on 
covered data or on sets of covered data, including by 
automated means, including organizing, combining, 
adapting, altering, using, or transforming. 
(8) PROTECTED
CHARACTERISTIC.—The term 
‘‘protected characteristic’’ means an individual’s 
race, sex, gender, sexual orientation, nationality, re-
ligious belief, or political affiliation. 
(9) PSEUDONYMOUS DATA.—The term ‘‘pseu-
donymous data’’ means covered data that may only 
be linked to the identity of an individual or the iden-
tity of a device associated with an individual if com-
bined with separate information. 
(10) REASONABLE INTEREST.—The term ‘‘rea-
sonable interest’’ means— 
(A) a compelling business, operational, ad-
ministrative, legal, or educational justification 
for the collection, processing, storage, or disclo-
sure of covered data exists; 
(B) the use of covered data is within the 
context of the relationship between the covered 
entity and the individual linked to the covered 
data; and 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(C) the interest does not subject the indi-
vidual to an unreasonable privacy risk. 
(11) SENSITIVE
DATA.—The term ‘‘sensitive 
data’’ means any covered data relating to— 
(A) the health, biologic, physiologic, bio-
metric, sexual life, or genetic information of an 
individual; or 
(B) the precise geolocation information of 
a device associated with an individual. 
(12) STORE.—The term ‘‘store’’ means any op-
eration or set of operations to continue possession of 
covered data, including by automated means. 
(13) THIRD PARTY SERVICE PROVIDER.—The 
term ‘‘third party service provider’’ means any cov-
ered entity that collects, processes, stores, or dis-
closes covered data at the direction of, and for the 
sole benefit of, another covered entity under a con-
tract. 
(b) MODIFIED DEFINITION BY RULEMAKING.—If the 
Commission determines that a term defined in paragraph 
(9) or (11) is not sufficient to protect an individual’s data 
privacy, the Commission may promulgate regulations 
under section 553 of title 5, United States Code, to modify 
the definition as the Commission considers appropriate. 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 3. REQUIRED PRIVACY NOTICE. 
(a) PRIVACY NOTICE.—Each covered entity shall post 
in an accessible location a notice that is concise, in con-
text, in easily understandable language, accurate, clear, 
timely, updated, uses visualizations where appropriate, 
conspicuous, and free of charge regarding the covered en-
tity’s privacy practices. 
(b) CONTENTS OF NOTICE.—The notice required by 
subsection (a) shall include— 
(1) a description of the covered data that the 
entity collects, processes, stores, and discloses, in-
cluding the sources that provided the covered data if 
the covered entity did not collect the covered data; 
(2) the purposes for and means by which the 
entity collects, processes, and stores the covered 
data; 
(3) the persons and entities to whom, and pur-
poses for which, the covered entity discloses the cov-
ered data; and 
(4) a conspicuous, clear, and understandable 
means for individuals to access the methods nec-
essary to exercise their rights under sections 4 and 
5. 
SEC. 4. REQUIRED DATA PRACTICES. 
(a) REGULATIONS.—Not later than 1 year after the 
date of the enactment of this Act, the Commission shall 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS