124 
(A) IN GENERAL.—The amount of a civil 
penalty under this subsection may not exceed, 
for each violation, the product of— 
(i) the maximum civil penalty for 
which a person, partnership, or corporation 
may be liable under section 5(m)(1)(A) of 
the Federal Trade Commission Act (15 
U.S.C. 45(m)(1)(A)) for a violation of a 
rule under such Act respecting unfair or 
deceptive acts or practices, as adjusted 
under the Federal Civil Penalties Inflation 
Adjustment Act of 1990 (28 U.S.C. 2461 
note); and 
(ii) the number of individuals the per-
sonal information of which is affected by 
the violation. 
(B) CONTINUING
VIOLATIONS.—In the 
case of a violation through continuing failure to 
comply with a provision of this Act or a rule or 
order prescribed under this Act, each day of 
continuance of such failure shall be treated as 
a separate violation for purposes of subpara-
graph (A). 
(3) MITIGATING FACTORS.—In determining the 
amount of any penalty assessed under paragraph 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
125 
(2), the court or the Agency shall take into account 
the appropriateness of the penalty with respect to— 
(A) the size of financial resources and good 
faith of the person charged; 
(B) the gravity of the violation; 
(C) the severity of the privacy harms (in-
cluding both actual and potential harms) to in-
dividuals; 
(D) any disparate impact of the privacy 
harms (including both actual and potential 
harms) on protected classes; 
(E) the history of previous violations; and 
(F) such other matters as justice may re-
quire. 
(4) AUTHORITY
TO
MODIFY
OR
REMIT
PEN-
ALTY.—The Agency or attorney general of a State 
may compromise, modify, or remit any penalty which 
may be assessed or has already been assessed under 
paragraph (2). The amount of such penalty, when fi-
nally determined, shall be exclusive of any sums 
owed by the person to the United States in connec-
tion with the costs of the proceeding, and may be 
deducted from any sums owing by the United States 
to the person charged. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
126 
(5) NOTICE AND HEARING.—No civil penalty 
may be assessed under this subsection with respect 
to a violation of any provision of this Act or a rule 
or order prescribed under this Act, unless— 
(A) the Agency or attorney general of a 
State gives notice and an opportunity for a 
hearing to the person accused of the violation; 
or 
(B) the appropriate court has ordered such 
assessment and entered judgment in favor of 
the Agency or attorney general of a State. 
SEC. 409. REFERRAL FOR CRIMINAL PROCEEDINGS. 
If the Agency obtains evidence that any person, do-
mestic or foreign, has engaged in conduct that may con-
stitute a violation of Federal criminal law, the Agency 
shall transmit such evidence to the Attorney General of 
the United States, who may institute criminal proceedings 
under appropriate law. Nothing in this section affects any 
other authority of the Agency to disclose information. 
SEC. 410. WHISTLEBLOWER ENFORCEMENT. 
(a) IN GENERAL.—Any person who becomes aware, 
based on non-public information, that a covered entity has 
violated this Act may file a civil action for civil penalties, 
if prior to filing such action, the person files with the Di-
rector a written request for the Director to commence the 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
127 
action. The request shall include a clear and concise state-
ment of the grounds for believing a cause of action exists. 
The person shall make the non-public information avail-
able to the Director upon request: 
(1) If the Director files suit within 90 days 
from receipt of the written request to commence the 
action, no other action may be brought unless the 
action brought by the Director is dismissed without 
prejudice. 
(2) If the Director does not file suit within 90 
days from receipt of the written request to com-
mence the action, the person requesting the action 
may proceed to file a civil action. 
(3) The time period within which a civil action 
shall be commenced shall be tolled from the date of 
receipt by the Director of the written request to ei-
ther the date that the civil action is dismissed with-
out prejudice, or for 150 days, whichever is later, 
but only for a civil action brought by the person who 
requested the Director to commence the action. 
(b) ALLOCATION OF CIVIL PENALTIES.—If a judg-
ment is entered against the defendant or defendants in 
an action brought pursuant to this section, or the matter 
is settled, amounts received as civil penalties or pursuant 
to a settlement of the action shall be allocated as follows: 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00127
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
128 
(1) If the action was brought by the Director 
upon a request made by a person pursuant to (a), 
the person who made the request shall be entitled to 
15 percent of the civil penalties. 
(2) If the action was brought by the person who 
made the request pursuant to (a), that person shall 
receive an amount the court determines is reason-
able for collecting the civil penalties on behalf of the 
government. The amount shall be not less than 25 
percent and not more than 50 percent of the pro-
ceeds of the action and shall be paid out of the pro-
ceeds. 
TITLE V—RELATION TO OTHER 
LAW 
SEC. 501. RELATION TO OTHER FEDERAL LAW. 
Nothing in this Act shall be construed to— 
(1) modify, limit, or supersede the operation of 
any privacy or security provision in— 
(A) section 552a of title 5, United States 
Code (commonly known as the ‘‘Privacy Act of 
1974’’); 
(B) the Right to Financial Privacy Act of 
1978 (12 U.S.C. 3401 et seq.); 
(C) the Fair Credit Reporting Act (15 
U.S.C. 1681 et seq.); 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00128
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
129 
(D) the Fair Debt Collection Practices Act 
(15 U.S.C. 1692 et seq.); 
(E) the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6501 et seq.); 
(F) title V of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6801 et seq.); 
(G) chapter 119, 123, or 206 of title 18, 
United States Code; 
(H) section 444 of the General Education 
Provisions Act (20 U.S.C. 1232g) (commonly 
referred to as the ‘‘Family Educational Rights 
and Privacy Act of 1974’’); 
(I) section 445 of the General Education 
Provisions Act (20 U.S.C. 1232h); 
(J) the Privacy Protection Act of 1980 (42 
U.S.C. 2000aa et seq.); 
(K) the regulations promulgated under sec-
tion 264(c) of the Health Insurance Portability 
and Accountability Act of 1996 (42 U.S.C. 
1320d–2 note), as those regulations relate to— 
(i) a person described in section 
1172(a) of the Social Security Act (42 
U.S.C. 1320d–1(a)); or 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00129
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
130 
(ii) transactions referred to in section 
1173(a)(1) of the Social Security Act (42 
U.S.C. 1320d–2(a)(1)); 
(L) the Communications Assist-
ance for Law Enforcement Act (47 
U.S.C. 1001 et seq.); 
(M) section 222, 227, 338, or 631 of the 
Communications Act of 1934 (47 U.S.C. 222, 
227, 338, or 551); 
(N) the E-Government Act of 2002 (44 
U.S.C. 101 et seq.); 
(O) the Paperwork Reduction Act of 1995 
(44 U.S.C. 3501 et seq.); 
(P) Federal Information Security Manage-
ment Act of 2002 (44 U.S.C. 3541 et seq.); 
(Q) the Currency and Foreign Trans-
actions Reporting Act of 1970, as amended 
(commonly known as the Bank Secrecy Act) 
(12 U.S.C. 1829b and 1951–1959, 31 U.S.C. 
5311–5314 and 5316–5332), including the 
International Money Laundering Abatement 
and Financial Anti-Terrorism Act of 2001, title 
III of Public Law 107–56, as amended; 
(R) the National Security Act of 1947 (50 
U.S.C. 3001 et seq.); 
VerDate Sep 11 2014 
22:27 Nov 14, 2019
Jkt 099200
PO 00000
Frm 00130
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
131 
(S) the Foreign Intelligence Surveillance 
Act of 1978, as amended (50 U.S.C. 1801 et 
seq.); 
(T) the Civil Rights Act of 1964 (Public 
Law 88–352, 78 Stat. 241); 
(U) the Americans with Disabilities Act 
(42 U.S.C. 12101 et seq.); 
(V) the Fair Housing Act (42 U.S.C. 3601 
et seq.); 
(W) the Dodd-Frank Wall Street Reform 
and Consumer Protection Act (Public Law 
111–203, 124 Stat. 1376–2223); 
(X) the Equal Credit Opportunity Act (15 
U.S.C. 1691 et seq.); 
(Y) the Age Discrimination in Employment 
Act (29 U.S.C. 621 et seq.); 
(Z) 
the 
Genetic 
Information 
Non-
discrimination Act (Public Law 110–233, 122 
Stat. 881); or 
(AA) any other privacy or security provi-
sion of Federal law; or 
(2) limit the authority of the Federal Commu-
nications Commission to promulgate regulations and 
enforce any privacy law not in contradiction with 
this Act. 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6201
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS
132 
SEC. 502. SEVERABILITY. 
If any provision of this Act, or the application there-
of, is held unconstitutional or otherwise invalid, the valid-
ity of the remainder of the Act and the application of such 
provision shall not be affected thereby. 
Æ 
VerDate Sep 11 2014 
00:42 Nov 13, 2019
Jkt 099200
PO 00000
Frm 00132
Fmt 6652
Sfmt 6301
E:\BILLS\H4978.IH
H4978
pamtmann on DSKBC07HB2PROD with BILLS