110 
gram may be submitted to the Commission by any 
person, including a covered entity, a representative of 
a covered entity, an association of covered entities, or 
a public interest group or organization. Within 90 
days after the request is made, the Commission shall 
publish the request and provide an opportunity for 
public comment on the proposal. 
(2) EXPEDITED RESPONSE TO REQUESTS.—Be-
ginning 1 year after the date of enactment of this Act, 
the Commission shall act upon a request for the pro-
posal and approval of a technical compliance pro-
gram not later than 1 year after the filing of the re-
quest, and shall set forth publicly in writing the con-
clusions of the Commission with regard to such re-
quest. 
(d) RIGHT TO APPEAL.—Final action by the Commis-
sion on a request for approval, amendment, or repeal of 
a technical compliance program, or the failure to act within 
the 1-year period after a request for approval, amendment, 
or repeal of a technical compliance program is made under 
subsection (c), may be appealed to a Federal district court 
of the United States of appropriate jurisdiction as provided 
for in section 702 of title 5, United States Code. 
(e) EFFECT ON ENFORCEMENT.— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
111 
(1) IN GENERAL.—Prior to commencing an in-
vestigation or enforcement action against any covered 
entity under this Act, the Commission and State at-
torney general shall consider the covered entity’s his-
tory of compliance with any technical compliance 
program approved under this section and any action 
taken by the covered entity to remedy noncompliance 
with such program. If such enforcement action de-
scribed in section 403 is brought, the covered entity’s 
history of compliance with any technical compliance 
program approved under this section and any action 
taken by the covered entity to remedy noncompliance 
with such program shall be taken into consideration 
when determining liability or a penalty. The covered 
entity’s history of compliance with any technical 
compliance program shall not affect any burden of 
proof or the weight given to evidence in an enforce-
ment or judicial proceeding. 
(2) COMMISSION
AUTHORITY.—Approval of a 
technical compliance program shall not limit the au-
thority of the Commission, including the Commis-
sion’s authority to commence an investigation or en-
forcement action against any covered entity under 
this Act or any other Act. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
112 
(3) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall provide any individual, class of indi-
viduals, or person with any right to seek discovery of 
any non-public Commission deliberation or activity 
or impose any pleading requirement on the Commis-
sion if the Commission brings an enforcement action 
of any kind. 
SEC. 304. COMMISSION APPROVED COMPLIANCE GUIDE-
LINES. 
(a) APPLICATION FOR COMPLIANCE GUIDELINE AP-
PROVAL.— 
(1) IN GENERAL.—A covered entity that is not a 
third-party collecting entity and meets the require-
ments of section 209, or a group of such covered enti-
ties, may apply to the Commission for approval of 1 
or more sets of compliance guidelines governing the 
collection, processing, and transfer of covered data by 
the covered entity or group of covered entities. 
(2) APPLICATION REQUIREMENTS.—Such appli-
cation shall include— 
(A) a description of how the proposed guide-
lines will meet or exceed the requirements of this 
Act; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
113 
(B) a description of the entities or activities 
the proposed set of compliance guidelines is de-
signed to cover; 
(C) a list of the covered entities that meet 
the requirements of section 209 and are not 
third-party collecting entities, if any are known 
at the time of application, that intend to adhere 
to the compliance guidelines; and 
(D) a description of how such covered enti-
ties will be independently assessed for adherence 
to such compliance guidelines, including the 
independent organization not associated with 
any of the covered entities that may participate 
in guidelines that will administer such guide-
lines. 
(3) COMMISSION REVIEW.— 
(A) INITIAL APPROVAL.— 
(i) PUBLIC COMMENT PERIOD.—Within 
90 days after the receipt of proposed guide-
lines submitted pursuant to paragraph (2), 
the Commission shall publish the applica-
tion and provide an opportunity for public 
comment on such compliance guidelines. 
(ii) APPROVAL.—The Commission shall 
approve an application regarding proposed 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
114 
guidelines under paragraph (2) if the appli-
cant demonstrates that the compliance 
guidelines— 
(I) meet or exceed requirements of 
this Act; 
(II) provide for the regular review 
and validation by an independent or-
ganization not associated with any of 
the covered entities that may partici-
pate in the guidelines and that is ap-
proved by the Commission to conduct 
such reviews of the compliance guide-
lines of the covered entity or entities to 
ensure that the covered entity or enti-
ties continue to meet or exceed the re-
quirements of this Act; and 
(III) include a means of enforce-
ment if a covered entity does not meet 
or exceed the requirements in the 
guidelines, which may include referral 
to the Commission for enforcement con-
sistent with section 401 or referral to 
the appropriate State attorney general 
for enforcement consistent with section 
402. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
115 
(iii) TIMELINE.—Within 1 year after 
receiving an application regarding proposed 
guidelines under paragraph (2), the Com-
mission shall issue a determination approv-
ing or denying the application and pro-
viding its reasons for approving or denying 
such application. 
(B) APPROVAL OF MODIFICATIONS.— 
(i) IN GENERAL.—If the independent 
organization administering a set of guide-
lines makes material changes to guidelines 
previously approved by the Commission, the 
independent organization shall submit the 
updated guidelines to the Commission for 
approval. As soon as feasible, the Commis-
sion shall publish the updated guidelines 
and provide an opportunity for public com-
ment. 
(ii) TIMELINE.—The Commission shall 
approve or deny any material change to the 
guidelines within 1 year after receipt of the 
submission for approval. 
(b) WITHDRAWAL OF APPROVAL.—If at any time the 
Commission determines that the guidelines previously ap-
proved no longer meet the requirements of this Act or a reg-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
116 
ulation promulgated under this Act or that compliance with 
the approved guidelines is insufficiently enforced by the 
independent organization administering the guidelines, the 
Commission shall notify the covered entities or group of 
such entities and the independent organization of the deter-
mination of the Commission to withdraw approval of such 
guidelines and the basis for doing so. Within180 days after 
receipt of such notice, the covered entity or group of such 
entities and the independent organization may cure any al-
leged deficiency with the guidelines or the enforcement of 
such guidelines and submit each proposed cure to the Com-
mission. If the Commission determines that such cures 
eliminate the alleged deficiency in the guidelines, then the 
Commission may not withdraw approval of such guidelines 
on the basis of such determination. 
(c) DEEMED COMPLIANCE.—A covered entity that is 
eligible to participate under subsection (a)(1) and partici-
pates in guidelines approved under this section shall be 
deemed in compliance with the relevant provisions of this 
Act if such covered entity is in compliance with such guide-
lines. 
SEC. 305. DIGITAL CONTENT FORGERIES. 
(a) REPORTS.—Not later than 1 year after the date 
of enactment of this Act, and annually thereafter, the Sec-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
118 
TITLE 
IV—ENFORCEMENT, 
AP-
PLICABILITY, AND MISCELLA-
NEOUS 
SEC. 401. ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION. 
(a) BUREAU OF PRIVACY.— 
(1) IN GENERAL.—The Commission shall estab-
lish within the Commission a new bureau to be 
known as the ‘‘Bureau of Privacy’’, which shall be of 
similar structure, size, organization, and authority as 
the existing bureaus within the Commission related to 
consumer protection and competition. 
(2) MISSION.—The mission of the Bureau estab-
lished under paragraph (1) shall be to assist the Com-
mission in carrying out the duties of the Commission 
under this Act and related duties under other provi-
sions of law. 
(3) TIMELINE.—The Bureau required to be estab-
lished under paragraph (1) shall be established, 
staffed, and fully operational not later than 1 year 
after the date of enactment of this Act. 
(b) OFFICE OF BUSINESS MENTORSHIP.—The Director 
of the Bureau established under subsection (a)(1) shall es-
tablish within the Bureau an office to be known as the ‘‘Of-
fice of Business Mentorship’’ to provide guidance and edu-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
119 
cation to covered entities and service providers regarding 
compliance with this Act. Covered entities or service pro-
viders may request advice from the Commission or the Of-
fice with respect to a course of action that the covered entity 
or service provider proposes to pursue and that may relate 
to the requirements of this Act. 
(c) ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this Act or a regulation pro-
mulgated under this Act shall be treated as a viola-
tion of a rule defining an unfair or deceptive act or 
practice prescribed under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
(2) POWERS OF THE COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
paragraphs (3), (4), and (5), the Commission 
shall enforce this Act and the regulations pro-
mulgated under this Act in the same manner, by 
the same means, and with the same jurisdiction, 
powers, and duties as though all applicable 
terms and provisions of the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.) were incor-
porated into and made a part of this Act. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
120 
(B) PRIVILEGES
AND
IMMUNITIES.—Any 
person who violates this Act or a regulation pro-
mulgated under this Act shall be subject to the 
penalties and entitled to the privileges and im-
munities provided in the Federal Trade Commis-
sion Act (15 U.S.C. 41 et seq.). 
(3) LIMITING CERTAIN ACTIONS UNRELATED TO 
THIS ACT.—If the Commission brings a civil action 
alleging that an act or practice violates this Act or 
a regulation promulgated under this Act, the Com-
mission may not seek a cease and desist order against 
the same defendant under section 5(b) of the Federal 
Trade Commission Act (15 U.S.C. 45(b)) to stop that 
same act or practice on the grounds that such act or 
practice constitutes an unfair or deceptive act or 
practice. 
(4) COMMON CARRIERS AND NONPROFIT ORGANI-
ZATIONS.—Notwithstanding any jurisdictional limi-
tation of the Commission with respect to consumer 
protection or privacy, the Commission shall enforce 
this Act and the regulations promulgated under this 
Act, in the same manner provided in paragraphs (1), 
(2), (3), and (5), with respect to common carriers 
subject to the Communications Act of 1934 (47 U.S.C. 
151 et seq.) and all Acts amendatory thereof and sup-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
121 
plementary thereto and organizations not organized 
to carry on business for their own profit or that of 
their members. 
(5) PRIVACY
AND
SECURITY
VICTIMS
RELIEF 
FUND.— 
(A) ESTABLISHMENT.—There is established 
in the Treasury of the United States a separate 
fund to be known as the ‘‘Privacy and Security 
Victims Relief Fund’’ in this paragraph referred 
to as the ‘‘Victims Relief Fund’’). 
(B) DEPOSITS.—Notwithstanding section 
3302 of title 31, United States Code, in any ju-
dicial or administrative action to enforce this 
Act or a regulation promulgated under this Act, 
the amount of any civil penalty obtained against 
a covered entity or service provider, or any other 
monetary relief ordered to be paid by a covered 
entity or service provider to provide redress, 
payment, compensation, or other relief to indi-
viduals that cannot be located or the payment of 
which would otherwise not be practicable, shall 
be deposited into the Victims Relief Fund. 
(C) USE OF FUNDS.— 
(i) USE BY COMMISSION.—Amounts in 
the Victims Relief Fund shall be available 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
122 
to the Commission, without fiscal year limi-
tation, to provide redress, payment, com-
pensation, or other monetary relief to indi-
viduals affected by an act or practice for 
which relief has been obtained under this 
Act. 
(ii) OTHER
PERMISSIBLE
USES.—To 
the extent that the individuals described in 
clause (i) cannot be located or such redress, 
payments, compensation, or other monetary 
relief are otherwise not practicable, the 
Commission may use such funds for the 
purpose of— 
(I) funding the activities of the 
Office of Business Mentorship estab-
lished under subsection (b); or 
(II) engaging in technological re-
search that the Commission considers 
necessary to enforce or administer this 
Act. 
SEC. 402. ENFORCEMENT BY STATES. 
(a) CIVIL ACTION.—In any case in which the attorney 
general or State Privacy Authority of a State has reason 
to believe that an interest of the residents of that State has 
been, may be, or is adversely affected by a violation of this 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS