(2) A description of the manner in which the
consumer may obtain a privacy policy statement that
meets the requirements of section 102, which may
include providing the consumer with an Internet
website, a hyperlink to such a website, or a toll-free
telephone number from which such a statement may
be obtained.
(3) If the notice is required under subsection
(a)(2), a statement that there has been a material
change in the organization’s privacy policy.
SEC. 102. PRIVACY POLICY STATEMENTS.
(a) PRIVACY POLICY.—A data collection organization
shall establish a privacy policy with respect to the collec-
tion, sale, disclosure for consideration, or use of the per-
sonally identifiable information of consumers, the prin-
cipal elements of which shall be embodied in a privacy pol-
icy statement (or statements) that meets the requirements
of subsection (b).
(b) STATEMENT.—The statement (or statements) re-
quired under subsection (a) shall meet the following re-
quirements:
(1) The statement must be clear and con-
spicuous and written in plain language.
(2) The statement must be accessible to all con-
sumers of the data collection organization (regard-
less of the means by which a consumer conducts a
transaction with the organization)—
(A) at no charge to the consumer; and
(B) at the time the data collection organi-
zation first collects personally identifiable infor-
mation about the consumer that may be used
for a purpose unrelated to a transaction with
the consumer and subsequently.
(3) With respect to personally identifiable infor-
mation that may be used for a purpose unrelated to
a transaction with the consumer and that is subject
to being collected, sold, disclosed for consideration,
or used under the statement, the statement must
disclose only the following:
(A) The identity of each data collection or-
ganization, or a description of each class or
type of data collection organization, that may
collect or use the information.
(B) The types of information that may be
collected, sold, disclosed for consideration, or
used.
(C) How the information may be used.
(D) Whether the consumer is required to
provide the information in order to do business
with the data collection organization.
(E) The extent to which the information is
subject to sale or disclosure for consideration to
a data collection organization that is not an in-
formation-sharing affiliate of the data collection
organization providing the statement, including
the following:
(i) A clear and prominent statement
of the fact that the information is subject
to such sale or disclosure for consideration.
(ii) A description of each class or type
of data collection organization to which the
information may be sold or disclosed for
consideration.
(iii) The purpose for which the infor-
mation may be used.
(F) Whether the information security prac-
tices of the data collection organization meet
the security requirements of section 105 in
order to prevent unauthorized disclosure or re-
lease of personally identifiable information.
(c) COMMISSION FACILITATION.—The Commission
shall take actions (including conducting industry-wide
workshops) to facilitate the development of harmonized,
universal wording or logo-based graphics in order to con-
vey the contents of privacy policy statements required
under this section.
SEC. 103. CONSUMER OPPORTUNITY TO LIMIT SALE OR DIS-
CLOSURE OF INFORMATION.
(a) PRECLUSION OF SALE OR DISCLOSURE.—
(1) REQUIREMENT.—A data collection organi-
zation shall provide to the consumer, without charge,
the opportunity to preclude any sale or disclosure for
consideration of the consumer’s personally identifi-
able information, that may be used for a purpose
unrelated to a transaction with the consumer, to any
data collection organization that is not an informa-
tion-sharing partner of the data collection organiza-
tion providing such opportunity.
(2) DURATION.—A preclusion on sale or disclo-
sure for consideration of information established by
a consumer under this subsection shall remain in ef-
fect for 5 years or until the consumer indicates oth-
erwise, whichever occurs sooner. A data collection
organization may not seek reconsideration of a con-
sumer’s preclusion of such sale or disclosure until at
least 1 year after such preclusion has been imposed
by the consumer.
(b) PERMISSION FOR SALE OR DISCLOSURE.—A data
collection organization may provide the consumer an op-
portunity to permit the sale or disclosure described in sub-
section (a)(1) in exchange for a benefit to the consumer.
(c) ACCESSIBILITY.—The opportunity to preclude (or
if offered, to permit) the sale or disclosure for consider-
ation of information under this section must be both easy
to access and use.
SEC. 104. CONSUMER OPPORTUNITY TO LIMIT OTHER IN-
FORMATION PRACTICES.
If a data collection organization provides to a con-
sumer the opportunity to limit other practices of the data
collection organization with respect to collection or use of
personally identifiable information regarding the con-
sumer, other than that required by section 103—
(1) that opportunity must be easy to access and
to use; and
(2) any limitation exercised by the consumer
pursuant to the opportunity shall remain in effect,
unless—
(A) the limitation is withdrawn by the con-
sumer; or
(B) the data collection organization pro-
vides the consumer at least 30 days notice be-
fore terminating its compliance with the limita-
tion.
SEC. 105. INFORMATION SECURITY OBLIGATIONS.
(a) INFORMATION SECURITY POLICY.—
(1) IMPLEMENTATION.—A data collection orga-
nization shall prepare, revise as necessary, and im-
plement an information security policy that is appli-
cable to the information security practices and treat-
ment of personally identifiable information main-
tained by the data collection organization, in order
to prevent the unauthorized disclosure or release of
such information.
(2) MANAGEMENT APPROVAL.—An information
security policy created pursuant to paragraph (1)
shall be considered and approved by the senior man-
agement officials of the data collection organization.
(3) CONTENTS.—An information security policy
required under paragraph (1) shall include—
(A) a process for taking corrective action
pursuant to subsection (b); and
(B) identifying an officer of the data col-
lection organization as the point of contact with
responsibility for information security issues for
the organization.
(b) CORRECTIVE ACTIONS.—
(1) NOTIFICATION
AND
ACTION.—Except as
provided in paragraph (2), upon the joint issuance
of an information security notification by a Federal
Government agency and the CERT Coordination
Center, a data collection organization shall take ap-
propriate action, within a reasonable period of time
after being informed and pursuant to its information
security policy, to implement any necessary changes
to its security practices and the architecture, instal-
lation, or implementation of its network or operating
software (including corrective patches) in response
to such a notification.
(2) EXCEPTIONS.—A data collection organiza-
tion shall not be required to take the action specified
in a notification under paragraph (1) if—
(A) the corrective action required would
cause harm to, or weaken, the organization’s
existing information security for personally
identifiable information or the procedures or
systems of the organization;
(B) the organization takes, or has taken,
other appropriate steps or corrective action to
mitigate the vulnerabilities and exposure risks
identified in the notification; or
(C) the specified corrective action is not
necessary.
(3) 
CERT 
COORDINATION
CENTER
DE-
SCRIBED.—For purposes of this section, the CERT
Coordination Center is the Computer Emergency
Response Team Coordination Center of the Software
Engineering Institute operated by Carnegie Mellon
University in Pittsburgh, Pennsylvania, or if such
center is unavailable, an equivalent center des-
ignated by the Commission.
(c) EFFECT OF RELEASE OF PERSONALLY IDENTIFI-
ABLE INFORMATION.—If the security of a data collection
organization has been compromised, resulting in the unau-
thorized release of a consumer’s personally identifiable in-
formation, the Commission shall treat the failure of the
data collection organization to comply with its own secu-
rity policy or respond to a Federal agency information se-
curity notification in accordance with subsection (b)(1) as
one factor in determining whether that data collection or-
ganization has violated this section.
SEC. 106. SELF-REGULATORY PROGRAMS.
(a) SELF-REGULATORY PROGRAM.—
(1) PRESUMPTION OF COMPLIANCE.—The Com-
mission shall presume that a data collection organi-
zation is in compliance with the provisions of sec-
tions 101 through 105 if that organization—
(A) participates in a self-regulatory pro-
gram approved under subsection (b); and
(B) complies with the guidelines, proce-
dures, requirements, and restrictions of the pro-
gram (including a remedial process under sub-
section (c)(7)).
(2) EFFECT OF WILLFUL NONCOMPLIANCE.—A
data collection organization that participates in a
self-regulatory program under this section shall not
be liable for a civil penalty arising out of a violation
of any provision of sections 101 through 105 unless
such violation results from willful noncompliance
with the guidelines, procedures, requirements, or re-
strictions of the program.
(b) APPROVAL BY COMMISSION.—
(1) APPROVAL.—The Commission shall, within
90 days after submission of an application for ap-
proval of a self-regulatory program under this sec-
tion (or of a material change in a program pre-
viously approved by the Commission), approve such
program (or change) if the Commission finds that
the program (or change) complies with the require-
ments of subsection (c).
(2) FORM OF APPLICATION.—The Commission
shall accept an application for approval under para-
graph (1) in any reasonable form the applicant may
submit.
(3) DURATION UNTIL RENEWAL.—A self-regu-
latory program approved by the Commission under
paragraph (1) shall be approved for a period of 8
years.
(4) REVOCATION OF APPROVAL.—The Commis-
sion may, after notice and opportunity for a hearing,
revoke approval granted under paragraph (1), if the
Commission finds that a self-regulatory program
fails to meet the requirements of subsection (c).
(c) REQUIREMENTS
OF SELF-REGULATORY PRO-
GRAM.—A self-regulatory program complies with the re-
quirements of this subsection if the program provides each
of the following:
(1) Guidelines and procedures requiring a pro-
gram participant to provide equivalent or greater
protections for consumers and their personally iden-
tifiable information as are provided under sections
101 through 105.
(2) Procedures and requirements to provide
for—
(A) an initial self-review and self-certifi-
cation of a participant’s privacy policy and
practices to ensure compliance with the guide-
lines, procedures, requirements, and restrictions
of the program established under this sub-
section;
(B) subsequent periodic self-reviews and
self-certifications, which shall occur at least an-
nually, of the participant’s privacy policy and
practices to ensure continued compliance with
such guidelines, procedures, requirements, and
restrictions;
(C) submission of self-reviews and self-cer-
tifications under this paragraph to any adminis-
trator of the program;
(D) random compliance testing of partici-
pants, and compliance testing of participants
with a high number of complaints against them,
to determine the tested participant’s compliance
with the program; and
(E) regular compliance testing of a partici-
pant, which shall take place not less frequently
than every 4 years, with respect to the privacy
policy and practices of the participant, to en-
sure that the self-reviews and self-certifications
of the participant are accurate and comply with
the program.
(3) Procedures and requirements that ensure
that a program participant provides a process for re-
solving disputes with consumers relating to the pri-
vacy policy and practices of the participant. Such
dispute resolution process—
(A) must be available without charge to a
consumer;
(B) must be available at a cost to the par-
ticipant that is reasonable and does not discour-
age participation by the participant in such
process;
(C) must ensure that consumers are in-
formed of how to utilize the process;
(D) may include, as one choice among oth-
ers, binding arbitration; and
(E)
(i) must be completed within 30 days
after submission of the dispute by the con-
sumer; or
(ii) must be completed within 60 days
after submission of the dispute by the con-
sumer, if the participant—
(I) determines that additional
time is required to obtain information
to make an informed decision with re-
spect to the dispute; and
(II) notifies the consumer that
such additional time is required.
(4) Provisions for the use by participants in the
program of a means (including the use of a seal) to
represent the participant’s participation in the pro-
gram.
(5) With respect to any nonvoluntary suspen-
sion or termination of participation in the program
because of the participant’s failure to comply with
the program, procedures or requirements to provide
for the following:
(A) Publication of notice and the reasons
for any such suspension or termination, except
that no personally identifiable information re-
lated to such suspension or termination may be
published.
(B) Notice to the Commission of any such
termination.
(6) Requirements and restrictions that assure
independence with respect to program eligibility,
compliance, and dispute resolution mechanisms and
decisions from improper interference by management
or ownership of the self-regulatory program partici-
pant.
(7) A process for a noncompliant participant to
take timely remedial action in order to come back
into compliance with the program before suspension
or termination of participation in the program.
(d) CONSUMER DISPUTE RESOLUTION.—
(1) SELF-REGULATORY DISPUTE PROCESS.—If
a consumer has a dispute with a participant in a
self-regulatory program under this section, the con-
sumer shall initially seek resolution through the par-
ticipant’s dispute resolution process (established in
accordance with subsection (c)(3)). The Commission
shall promptly refer to the participant involved any
dispute submitted to the Commission for which reso-
lution has not been initially sought through such
process.
(2) RESOLUTION BY COMMISSION.—A consumer
may submit to the Commission for resolution a dis-
pute with a participant in a self-regulatory program
under this section, if the following requirements are
met:
(A) The dispute was initially submitted
under paragraph (1) for resolution through the
participant’s dispute resolution process.
(B) The dispute submitted under para-
graph (1) is not resolved—
(i) within 30 days after submission of
the dispute by the consumer; or
(ii) to the satisfaction of the con-
sumer.
(C) Notice of the facts of the dispute is
submitted to the Commission not later than 30
days after the date on which the consumer is
notified of the resolution through the partici-
pant’s dispute resolution process.
(D) The consumer has not voluntarily ac-
cepted a resolution of the dispute under para-
graph (1).
(E) The dispute was not resolved through
binding arbitration.
(e) NONRELEASE OF CERTAIN INFORMATION.—The
Commission may not compel a participant in a self-regu-
latory program approved under subsection (b) (or an ad-
ministrator of such a program) to provide proprietary in-
formation or personally identifiable information of con-
sumers to the Commission unless the Commission provides
assurances that such information will not be released to
the public.
(f) MISREPRESENTATION
OF
SELF-REGULATORY
PROGRAM PARTICIPATION.—It is unlawful for a data col-
lection organization to misrepresent that it is a participant
in a self-regulatory program (including through any mech-
anism provided under subsection (c)(4)) when such orga-
nization is not, in fact, such a participant.
(g) EXEMPTED ENTITY PARTICIPATION.—An entity
that is not a data collection organization and that volun-
tarily participates in a self-regulatory program under this
section shall enjoy the rights and benefits provided under
this section.
SEC. 107. ENFORCEMENT.
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—A
violation of any provision of this title is an unfair or decep-
tive act or practice unlawful under section 5(a)(1) of the
Federal Trade Commission Act (15 U.S.C. 45(a)(1)), ex-
cept that the amount of any civil penalty under such Act
shall be doubled for a violation of this title, but may not
exceed $500,000 for all related violations by a single viola-
tor (without respect to the number of consumers affected
or the duration of the related violations).
(b) GUIDELINES AND OPINIONS.—In order to assist
in compliance with this title, the Federal Trade Commis-
sion may issue generally applicable guidelines and, upon
request, advisory opinions with respect specific types of
acts or practices that would, or would not, comply with
this title, but may not prescribe regulations to carry out
this title.
SEC. 108. NO PRIVATE RIGHT OF ACTION.
This title may not be considered or construed to pro-
vide any private right of action. No private civil action
relating to any act or practice governed under this title
may be commenced or maintained in any State court or
under State law (including a pendent State claim to an
action under Federal law).
SEC. 109. EFFECT ON OTHER LAWS.
(a) QUALIFIED EXEMPTION FOR COMPLIANCE WITH
OTHER FEDERAL PRIVACY LAWS.—To the extent that
personally identifiable information protected under this
title is also protected under a provision of Federal privacy
law described in subsection (c), a data collection organiza-
tion that complies with the relevant provision of such other
Federal privacy law shall be deemed to have complied with
the corresponding provision of this title.
(b) PROTECTION
OF OTHER FEDERAL PRIVACY
LAWS.—Nothing in this title may be construed to modify,
limit, or supersede the operation of the Federal privacy
laws described in subsection (c) or the provision of infor-
mation permitted or required, expressly or by implication,
by such laws, with respect to Federal rights and practices.
(c) OTHER FEDERAL PRIVACY LAWS DESCRIBED.—
The provisions of law to which subsections (a) and (b)
apply are the following:
(1) Section 552a of title 5, United States Code
(commonly known as the Privacy Act of 1974).
(2) The Right to Financial Privacy Act of 1978
(12 U.S.C. 3401 et seq.).
(3) The Fair Credit Reporting Act (15 U.S.C.
1681 et seq.).
(4) The Fair Debt Collection Practices Act (15
U.S.C. 1692 et seq.).
(5) The Children’s Online Privacy Protection
Act of 1998 (15 U.S.C. 6501 et seq.).
(6) Title V of the Gramm-Leach-Bliley Act of
1999 (15 U.S.C. 6801 et seq.).
(7) The Electronic Communications Privacy Act
of 1986 (Public Law 99–508).
(8) The Driver’s Privacy Protection Act of
1994 (18 U.S.C. 2721 et seq.).
(9) The Family Educational Rights and Privacy
Act of 1974 (20 U.S.C. 1221 note, 1232g).
(10) Section 445 of the General Education Pro-
visions Act (20 U.S.C. 1232h).
(11) The Privacy Protection Act of 1980 (42
U.S.C. 2000aa et seq.).
(12) Section 222 of the Communications Act of
1934 (47 U.S.C. 222) relating to the Customer Pro-
prietary Network Information.
(13) The Cable Communications Policy Act of
1984 (47 U.S.C. 521 et seq.).
(14) The Communications Assistance for Law
Enforcement Act (47 U.S.C. 1001 et seq.).
(15) The Video Privacy Protection Act of 1988
(Public Law 100–618).
(16) The Telephone Consumer Protection Act
of 1991 (Public Law 102–243).
(17) The Health Insurance Portability and Ac-
countability Act of 1996 (Public Law 104–191), as
it relates to an entity described in section 1172(a)
of the Social Security Act (42 U.S.C. 1320d–1(a))
or to activities regulated under section 1173 of such
Act (42 U.S.C. 1320d–2).
(d) PREEMPTION OF STATE PRIVACY LAWS.—This
title preempts any statutory law, common law, rule, or
regulation of a State, or a political subdivision of a State,
to the extent such law, rule, or regulation relates to or
affects the collection, use, sale, disclosure, or dissemina-
tion of personally identifiable information in commerce.
No State, or political subdivision of a State, may take any
action to enforce this title.
SEC. 110. EFFECTIVE DATE.
This title shall apply with respect to personally identi-
fiable information collected on or after the date that is
1 year after the date of enactment of this Act.
TITLE II—IDENTITY THEFT
PREVENTION AND REMEDIES
SEC. 201. FACILITATING ELECTRONIC IDENTITY THEFT AF-
FIDAVITS.
The Commission shall take such action as necessary
to permit (including by electronic means) consumers that
have a reasonable belief that they are a victim of identity
theft—
(1) to enter required consumer information in
the commission-developed document entitled ‘‘Iden-
tity Theft Affidavit’’; and
(2) to submit completed forms and other sup-
plemental information to the Commission and other
entities.
SEC. 202. PROMOTING USE OF COMMON IDENTITY THEFT
AFFIDAVIT.
The Commission shall take such action as necessary
to solicit the acceptance and acknowledgement of stand-
ardized Identity Theft Affidavit by entities that receive
disputes regarding the unauthorized use of accounts of
such entities from consumers that have reason to believe
that they are a victim of identity theft.
SEC. 203. TIMELY RESOLUTION OF IDENTITY THEFT DIS-
PUTES.
The Commission shall require entities that receive
disputes regarding the unauthorized use of accounts of
such entities from consumers that have reason to believe
that they are a victim of identity theft to conduct any nec-
essary investigation and decide an outcome of a claim
within 90 days from the date on which all necessary infor-
mation to investigate the claim has been submitted to the
entity.
SEC. 
204. 
IMPROVEMENTS 
TO 
CONSUMER 
CLEARING-
HOUSE.
The Commission shall utilize the Identity Theft
Clearinghouse to permit consumers that have a reasonable
belief that they are victim of identity theft to submit any
information relevant to such identity theft to the Clearing-
house (including by means of an Identity Theft Affidavit),
so that such information may be transmitted by the Clear-
inghouse to appropriate entities for necessary protective
action and to mitigate losses resulting from such identity
theft.
SEC. 205. IMPROVED IDENTITY THEFT DATA.
(a) IN GENERAL.—The Commission shall—
(1) establish a process to contact, not less than
annually, public and private entities that receive and
process complaints from consumers that have a rea-
sonable belief that they are a victim of identity theft;
and
(2) obtain accurate data on the incidences and
nature of complaints from such entitles.
(b) INCLUSION
IN DATABASE.—Such information
shall be made part of the Commission’s Identity Theft
Clearinghouse database.
SEC. 206. CHANGE OF ADDRESS PROTECTIONS.
The Commission shall require appropriate entities to
take reasonable steps to verify the accuracy of a con-
sumer’s address, including by confirming a consumer’s
change of address by sending a confirmation of such
change to the old and the new address of the consumer.
SEC. 207. EFFECTIVE DATE.
This title shall take effect 180 days after the date
of enactment of this Act.
TITLE III—INTERNATIONAL
PROVISIONS
SEC. 301. STUDY BY COMPTROLLER GENERAL.
The Comptroller General of the United States shall
conduct a study and issue a report analyzing the impact
on the interstate and foreign commerce of the United
States of information privacy laws, regulations, or agree-
ments enacted, promulgated, or adopted by other nations,
including regional or international agreements between
nations, and whether the enforcement mechanisms or pro-
cedures of those laws, regulations, or agreements result
in discriminatory treatment of United States entities. The
first report under this section shall be issued not later
than 120 days after the date of enactment of this Act and
subsequent reports shall be issued every 3 years there-
after.
SEC. 302. REMEDIATION OF DISCRIMINATORY IMPACT BY
SECRETARY OF COMMERCE.
If the Comptroller General of the United States finds,
in the study and report under subsection (a), that such
information privacy laws, regulations, or agreements sub-
stantially impede interstate and foreign commerce of the
United States and that the enforcement mechanisms or
procedures of the information privacy laws, regulations,
or agreements described in such subsection result in dis-
criminatory treatment of United States entities, the Sec-
retary of Commerce shall, to the extent permitted by law
take all steps necessary to mitigate against such discrimi-
natory impact within 180 days after the report making
such findings is issued.
SEC. 303. EFFECT OF NONREMEDIATION.
(a) RECOMMENDATIONS.—If by the end of the 180-
day period described in section 302, the Secretary of Com-
merce has not attained complete relief from the discrimi-
natory impact described in such subsection, the Secretary
shall report to the Congress and the President rec-
ommendations on action to relieve any such remaining dis-
criminatory impact.
(b) FEDERAL AGENCY ACTION AFTER CONSIDER-
ATION BY CONGRESS.—During the period after the Sec-
retary reports recommendations under subsection (b) for
mitigation of discriminatory impact and before the Con-
gress acts with respect to such recommendations, no offi-
cer or employee of any Federal agency may take or con-
tinue any action to enjoin, or impose any penalty on, a
United States entity, or a citizen or legal resident of the
United States, for the purpose of fulfilling an international
obligation of the United States under an international pri-
vacy agreement (other than such an obligation under a
ratified treaty) that resulted in such discriminatory im-
pact.
SEC. 304. HARMONIZATION OF INTERNATIONAL PRIVACY
LAWS, REGULATIONS, AND AGREEMENTS.
Beginning on the date of enactment of this Act, the
Secretary of Commerce shall provide notice of the provi-
sions of this Act to other nations, individually, or as mem-
bers of international organizations or unions that have en-
acted, promulgated, or adopted information privacy laws,
regulations, or agreements, and shall seek recognition of
this Act by such nations, organizations, or unions. The
Secretary shall seek the harmonization of this Act with
such information privacy laws, regulations, or agreements,
to the extent such harmonization is necessary for the ad-
vancement of transnational commerce, including electronic
commerce.
TITLE IV—GENERAL
PROVISIONS
SEC. 401. DEFINITIONS.
In this Act:
(1) The term ‘‘Commission’’ means the Federal
Trade Commission.
(2) The term ‘‘consumer’’ means an individual
acting in the individual’s personal, family, or house-
hold capacity.
(3)(A) The term ‘‘data collection organization’’
means an entity (or an agent or affiliate of the enti-
ty) that collects (by any means, through any me-
dium), sells, discloses for consideration, or uses per-
sonally identifiable information of the consumer.
(B) Such term does not include—
(i) a governmental agency; or
(ii) a not-for-profit entity, to the extent
that personally identifiable information is not
used for a commercial purpose; or
(iii) an entity that—
(I) has annual gross revenue under
$1,000,000 (based on the value of such
amount in fiscal year 2000, adjusted for
current dollars);
(II) has fewer than 25 employees;
(III) collects or uses personally identi-
fiable information from fewer than 1,000
consumers for a purpose unrelated to a
transaction with the consumer;
(IV) does not process personally iden-
tifiable information of consumers; and
(V) does not sell or disclose for con-
sideration such information to another per-
son.
(4)(A) The term ‘‘personally identifiable infor-
mation’’, with respect to a data collection organiza-
tion means individually identifiable information re-
lating to a living individual who can be identified
from that information.
(B) Such term includes—
(i) first and last name, whether given at
birth or adoption, assumed, or legally changed;
(ii) home or other physical address includ-
ing street name and name of a city or town;
(iii) electronic mail address;
(iv) telephone number;
(v) social security number; or
(vi) any other unique identifying informa-
tion that a data collector and processor collects
and combines with any information described in
the preceding subparagraphs of this paragraph.
(C) Such term does not include—
(i) anonymous or aggregate data, or any
other information that does not identify a
unique living individual;
(ii) information about a consumer inferred
from data maintained about a consumer; or
(iii) information about a consumer ob-
tained from a public record.
(5) The term ‘‘affiliate’’ means any company
that controls, is controlled by, or is under common
control with another company.
(6) The term ‘‘information-sharing partner’’
means, with respect to a data collection organiza-
tion, an entity that is contractually obligated to com-
ply with the practices enumerated under the privacy
policy statement of the organization required under
section 102.
(7) The term ‘‘process’’, with respect to person-
ally identifiable information, means any value-added
activity performed on data by automated means.
(8) The term ‘‘transaction’’ means an inter-
action between a consumer and a data collection or-
ganization resulting in—
(A) any use of information that is nec-
essary to complete the interaction in the course
of which information is collected, or to maintain
the provisioning of a good or service requested
by the consumer, including use—
(i) to approve, guarantee, process, ad-
minister, complete, enforce, provide, or
market a product, service, account, benefit,
transaction, or payment method that is re-
quested or approved by the consumer; or
(ii) to deliver goods, services, funds,
or other consideration to, or on behalf of,
the consumer;
(B) any disclosure of information that is
necessary for the consumer to enforce any right
of the consumer;
(C) any disclosure of information that is
required by law or by a court order; and
(D) any use of information to evaluate, de-
tect, or reduce the risk of fraud or other crimi-
nal activity, or other risk-management activi-
ties.
(9) The term ‘‘display’’ means intentionally
communicating or otherwise making available (on
the Internet or in any other manner) to another per-
son.
(10) The term ‘‘public record’’ means any item,
collection, or grouping of information about an indi-
vidual that is maintained by a Federal, State, or
local government entity and that is made available
to the public.
(11) The term ‘‘purchase’’ means providing, di-
rectly or indirectly, anything of value in exchange
for a benefit.
(12) The term ‘‘State’’ includes the several
States, the District of Columbia, the Commonwealth
of Puerto Rico, the Commonwealth of the Northern
Mariana Islands, American Samoa, Guam, the Vir-
gin Islands, the Freely Associated States, and any
other territory or possession of the United States.
Æ