I 
115TH CONGRESS 
1ST SESSION H. R. 4543 
To establish a regulatory framework for the comprehensive protection of 
personal data for individuals under the aegis of the Federal Trade 
Commission, to amend the Children’s Online Privacy Protection Act 
of 1998 to improve provisions relating to collection, use, and disclosure 
of personal information of children, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 4, 2017 
Mr. SIRES introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To establish a regulatory framework for the comprehensive 
protection of personal data for individuals under the 
aegis of the Federal Trade Commission, to amend the 
Children’s Online Privacy Protection Act of 1998 to im-
prove provisions relating to collection, use, and disclosure 
of personal information of children, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
Sec. 1. Table of contents. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
TITLE I—COMMERCIAL PRIVACY 
Sec. 101. Short title. 
Sec. 102. Findings. 
Sec. 103. Definitions. 
Subtitle A—Right to Security and Accountability 
Sec. 111. Security. 
Sec. 112. Accountability. 
Sec. 113. Privacy by design. 
Subtitle B—Right to Notice and Individual Participation 
Sec. 121. Transparent notice of practices and purposes. 
Sec. 122. Individual participation. 
Subtitle C—Rights Relating to Data Minimization, Constraints on 
Distribution, and Data Integrity 
Sec. 131. Data minimization. 
Sec. 132. Constraints on distribution of information. 
Sec. 133. Data integrity. 
Subtitle D—Right to Notice of Breaches of Security 
Sec. 141. Definitions. 
Sec. 142. Notice to individuals. 
Sec. 143. Notice to law enforcement. 
Subtitle E—Enforcement 
Sec. 151. General application. 
Sec. 152. Enforcement by the Federal Trade Commission. 
Sec. 153. Enforcement by Attorney General. 
Sec. 154. Enforcement by States. 
Sec. 155. Civil penalties. 
Sec. 156. Effect on other laws. 
Sec. 157. No private right of action. 
Subtitle F—Co-Regulatory Safe Harbor Programs 
Sec. 161. Establishment of safe harbor programs. 
Sec. 162. Participation in safe harbor program. 
Subtitle G—Application With Other Federal Laws 
Sec. 171. Application with other Federal laws. 
Subtitle H—Development of Commercial Data Privacy Policy in the 
Department of Commerce 
Sec. 181. Direction to develop commercial data privacy policy. 
TITLE II—ONLINE PRIVACY OF CHILDREN 
Sec. 201. Short title. 
Sec. 202. Findings. 
Sec. 203. Definitions. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
Sec. 204. Online collection, use, and disclosure of personal information of chil-
dren. 
Sec. 205. Targeted marketing to children or minors. 
Sec. 206. Digital Marketing Bill of Rights for Teens and Fair Information 
Practices Principles. 
Sec. 207. Online collection of geolocation information of children and minors. 
Sec. 208. Removal of content. 
Sec. 209. Enforcement and applicability. 
Sec. 210. Rule for treatment of users of websites, services, and applications di-
rected to children or minors. 
Sec. 211. Effective dates. 
TITLE I—COMMERCIAL PRIVACY 
SEC. 101. SHORT TITLE. 
This title may be cited as the ‘‘Commercial Privacy 
Bill of Rights Act of 2017’’. 
SEC. 102. FINDINGS. 
The Congress finds the following: 
(1) Personal privacy is worthy of protection 
through appropriate legislation. 
(2) Trust in the treatment of personally identi-
fiable information collected on and off the Internet 
is essential for businesses to succeed. 
(3) Persons interacting with others engaged in 
interstate commerce have a significant interest in 
their personal information, as well as a right to con-
trol how that information is collected, used, stored, 
or transferred. 
(4) Persons engaged in interstate commerce 
and collecting personally identifiable information on 
individuals have a responsibility to treat that infor-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
mation with respect and in accordance with common 
standards. 
(5) On the day before the date of enactment of 
this Act, the laws of the Federal Government and 
State and local governments provided inadequate 
privacy protection for individuals engaging in and 
interacting with persons engaged in interstate com-
merce. 
(6) As of the day before the date of enactment 
of this Act, with the exception of Federal Trade 
Commission enforcement of laws against unfair and 
deceptive practices, the Federal Government has es-
chewed general commercial privacy laws in favor of 
industry self-regulation, which has led to several 
self-policing schemes, some of which are enforceable, 
and some of which provide insufficient privacy pro-
tection to individuals. 
(7) As of the day before the date of enactment 
of this Act, many collectors of personally identifiable 
information have yet to provide baseline fair infor-
mation practice protections for individuals. 
(8) The ease of gathering and compiling per-
sonal information on the Internet and off, both 
overtly and surreptitiously, is becoming increasingly 
efficient and effortless due to advances in technology 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
which have provided information gatherers the abil-
ity to compile seamlessly highly detailed personal 
histories of individuals. 
(9) Personal information requires greater pri-
vacy protection than is available on the day before 
the date of enactment of this Act. Vast amounts of 
personal information, including sensitive informa-
tion, about individuals are collected on and off the 
Internet, often combined and sold or otherwise 
transferred to third parties, for purposes unknown 
to an individual to whom the personally identifiable 
information pertains. 
(10) Toward the close of the 20th century, as 
individuals’ personal information was increasingly 
collected, profiled, and shared for commercial pur-
poses, and as technology advanced to facilitate these 
practices, Congress enacted numerous statutes to 
protect privacy. 
(11) Those statutes apply to the Government, 
telephones, cable television, e-mail, video tape rent-
als, and the Internet (but only with respect to chil-
dren and law enforcement requests). 
(12) As in those instances, the Federal Govern-
ment has a substantial interest in creating a level 
playing field of protection across all collectors of per-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
sonally identifiable information, both in the United 
States and abroad. 
(13) Enhancing individual privacy protection in 
a balanced way that establishes clear, consistent 
rules, both domestically and internationally, will 
stimulate commerce by instilling greater consumer 
confidence at home and greater confidence abroad as 
more and more entities digitize personally identifi-
able information, whether collected, stored, or used 
online or offline. 
SEC. 103. DEFINITIONS. 
(a) IN GENERAL.—Subject to subsection (b), in this 
title: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means any person to whom this title applies 
under section 151. 
(3) COVERED INFORMATION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘covered informa-
tion’’ means only the following: 
(i) Personally identifiable information. 
(ii) Unique identifier information. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(iii) Any information that is collected, 
used, or stored in connection with person-
ally identifiable information or unique 
identifier information in a manner that 
may reasonably be used by the party col-
lecting the information to identify a spe-
cific individual. 
(B) EXCEPTION.—The term ‘‘covered in-
formation’’ does not include the following: 
(i) Personally identifiable information 
obtained from public records that is not 
merged with covered information gathered 
elsewhere. 
(ii) Personally identifiable information 
that is obtained from a forum— 
(I) where the individual volun-
tarily shared the information or au-
thorized the information to be shared; 
and 
(II) that— 
(aa) is widely and publicly 
available and was not made pub-
licly available in bad faith; and 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(bb) contains no restrictions 
on who can access and view such 
information. 
(iii) Personally identifiable informa-
tion reported in public media. 
(iv) Personally identifiable informa-
tion dedicated to contacting an individual 
at the individual’s place of work. 
(4) ESTABLISHED BUSINESS RELATIONSHIP.— 
The term ‘‘established business relationship’’ means, 
with respect to a covered entity and a person, a rela-
tionship formed with or without the exchange of con-
sideration, involving the establishment of an account 
by the person with the covered entity for the receipt 
of products or services offered by the covered entity. 
(5) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means only the following: 
(A) Any of the following information about 
an individual: 
(i) The first name (or initial) and last 
name of an individual, whether given at 
birth or time of adoption, or resulting from 
a lawful change of name. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(ii) The postal address of a physical 
place of residence of such individual. 
(iii) An e-mail address. 
(iv) A telephone number or mobile de-
vice number. 
(v) A Social Security number or other 
Government issued identification number 
issued to such individual. 
(vi) The account number of a credit 
card issued to such individual. 
(vii) Unique identifier information 
that alone can be used to identify a spe-
cific individual. 
(viii) Biometric data about such indi-
vidual, including fingerprints and retina 
scans. 
(B) If used, transferred, or stored in con-
nection with one or more of the items of infor-
mation described in subparagraph (A), any of 
the following: 
(i) A date of birth. 
(ii) The number of a certificate of 
birth or adoption. 
(iii) A place of birth. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(iv) Unique identifier information that 
alone cannot be used to identify a specific 
individual. 
(v) Precise geographic location, at the 
same degree of specificity as a global posi-
tioning system or equivalent system, and 
not including any general geographic infor-
mation that may be derived from an Inter-
net Protocol address. 
(vi) Information about an individual’s 
quantity, technical configuration, type, des-
tination, location, and amount of uses of 
voice services, regardless of technology 
used. 
(vii) Any other information concerning 
an individual that may reasonably be used 
by the party using, collecting, or storing 
that information to identify that individual. 
(6) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means— 
(A) personally identifiable information 
which, if lost, compromised, or disclosed with-
out authorization either alone or with other in-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
formation, carries a significant risk of economic 
or physical harm; or 
(B) information related to— 
(i) a particular medical condition or a 
health record; or 
(ii) the religious affiliation of an indi-
vidual. 
(7) THIRD PARTY.— 
(A) IN GENERAL.—The term ‘‘third party’’ 
means, with respect to a covered entity, a per-
son that— 
(i) is— 
(I) not related to the covered en-
tity by common ownership or cor-
porate control; or 
(II) related to the covered entity 
by common ownership or corporate 
control and an ordinary consumer 
would not understand that the covered 
entity and the person were related by 
common ownership or corporate con-
trol; 
(ii) is not a service provider used by 
the covered entity to receive personally 
identifiable information or sensitive person-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS