(F) Whether the information security prac-
tices of the data collection organization meet 
the security requirements of section 105 in 
order to prevent unauthorized disclosure or re-
lease of personally identifiable information. 
(c) COMMISSION FACILITATION.—The Commission 
shall take actions (including conducting industry-wide 
workshops) to facilitate the development of harmonized, 
universal wording or logo-based graphics in order to con-
vey the contents of privacy policy statements required 
under this section. 
SEC. 103. CONSUMER OPPORTUNITY TO LIMIT SALE OR DIS-
CLOSURE OF INFORMATION. 
(a) PRECLUSION OF SALE OR DISCLOSURE.— 
(1) REQUIREMENT.—A data collection organi-
zation shall provide to the consumer, without charge, 
the opportunity to preclude any sale or disclosure for 
consideration of the consumer’s personally identifi-
able information, provided in a particular data col-
lection, that may be used for a purpose other than 
a transaction with the consumer, to any data collec-
tion organization that is not an information-sharing 
affiliate of the data collection organization providing 
such opportunity.
(2) DURATION.—A preclusion on sale or disclo-
sure for consideration of information established by 
a consumer under this subsection shall remain in ef-
fect for 5 years or until the consumer indicates oth-
erwise, whichever occurs sooner. A data collection 
organization may not seek reconsideration of a con-
sumer’s preclusion of such sale or disclosure until at 
least 1 year after such preclusion has been imposed 
by the consumer. 
(b) PERMISSION FOR SALE OR DISCLOSURE.—A data 
collection organization may provide the consumer an op-
portunity to permit the sale or disclosure described in sub-
section (a)(1) in exchange for a benefit to the consumer. 
(c) ACCESSIBILITY.—The opportunity to preclude (or 
if offered, to permit) the sale or disclosure for consider-
ation of information under this section must be both easy 
to access and use, and the notice of the opportunity to 
preclude must be clear and conspicuous. 
SEC. 104. CONSUMER OPPORTUNITY TO LIMIT OTHER IN-
FORMATION PRACTICES. 
If a data collection organization provides to a con-
sumer the opportunity to limit other practices of the data 
collection organization with respect to a particular collec-
tion or use of personally identifiable information regarding 
the consumer, other than that required by section 103—
(1) a notice and description of such opportunity 
must appear in the privacy statement; 
(2) such opportunity must be easy to access 
and to use; and 
(3) any limitation exercised by the consumer 
pursuant to such opportunity shall remain in effect, 
unless— 
(A) the limitation is withdrawn by the con-
sumer; or 
(B) the data collection organization pro-
vides the consumer at least 30 days notice be-
fore materially changing the limitation or termi-
nating its compliance with the limitation. 
SEC. 105. INFORMATION SECURITY OBLIGATIONS. 
(a) INFORMATION SECURITY POLICY.— 
(1) IMPLEMENTATION.—A data collection orga-
nization shall prepare, revise as necessary, and im-
plement an information security policy that is appli-
cable to the information security practices and treat-
ment of personally identifiable information main-
tained by the data collection organization, that is de-
signed to prevent the unauthorized disclosure or re-
lease of such information. 
(2) MANAGEMENT APPROVAL.—An information 
security policy created pursuant to paragraph (1)
shall be considered and approved by the senior man-
agement officials of the data collection organization. 
(3) CONTENTS.—An information security policy 
required under paragraph (1) shall include— 
(A) a process for taking corrective action 
pursuant to subsection (b); and 
(B) identifying an officer of the data col-
lection organization as the point of contact with 
responsibility for information security issues for 
the organization. 
(b) CORRECTIVE ACTIONS.— 
(1) INFORMATION SECURITY ADVISORIES AND 
ACTION.—Except as provided in paragraph (2), upon 
the issuance of an information security advisory (as 
such term is defined in subsection (d)), a data col-
lection organization shall, within a reasonable period 
of time after the issuance of such advisory and pur-
suant to its information security policy, take appro-
priate action reasonably necessary to mitigate 
against any vulnerability identified in such advisory, 
including implementing any changes to its security 
practices and the architecture, installation, or imple-
mentation of its network or operating software (in-
cluding corrective patches) in response to such advi-
sory.
(2) EXCEPTIONS.—A data collection organiza-
tion shall not be required to take the action specified 
in an information security advisory under paragraph 
(1) if such organization can, in good faith, show 
that— 
(A) the corrective action required would 
cause harm to, or weaken, the organization’s 
existing information security for personally 
identifiable information or the procedures or 
systems of the organization; 
(B) the organization takes, or has taken, 
other appropriate steps or corrective action to 
mitigate the vulnerabilities and exposure risks 
identified in the information security advisory; 
or 
(C) the specified corrective action is not 
necessary. 
(c) EFFECT OF RELEASE OF PERSONALLY IDENTIFI-
ABLE INFORMATION.—If the security of a data collection 
organization has been compromised, resulting in the unau-
thorized release of a consumer’s personally identifiable in-
formation, the data collection organization shall be pre-
sumed to be in violation of this section if such organization 
has failed to respond to an information security advisory 
in accordance with subsection (b)(1).
(d) DEFINITION.—As used in this section, the term 
‘‘information security advisory’’ means an information se-
curity advisory issued by the Federal Computer Incident 
Response Center of the Department of Homeland Secu-
rity, or its successor agency. 
SEC. 106. SELF-REGULATORY PROGRAMS. 
(a) SELF-REGULATORY PROGRAM.— 
(1) PRESUMPTION OF COMPLIANCE.—The Com-
mission shall presume that a data collection organi-
zation is in compliance with the provisions of sec-
tions 101 through 105 if that organization— 
(A) participates in a self-regulatory pro-
gram approved under subsection (b); and 
(B) has been determined by a self-regu-
latory program to be in compliance with the 
guidelines, procedures, requirements, and re-
strictions of the program (including a remedial 
process under subsection (c)(7)). 
(2) EFFECT OF WILLFUL NONCOMPLIANCE.—A 
data collection organization that participates in a 
self-regulatory program under this section shall not 
be liable for a civil penalty arising out of a violation 
of any provision of sections 101 through 105 unless 
such violation results from willful noncompliance