I 
112TH CONGRESS 
1ST SESSION 
H. R. 611 
To foster transparency about the commercial use of personal information, 
provide consumers with meaningful choice about the collection, use, and 
disclosure of such information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 10, 2011 
Mr. RUSH introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To foster transparency about the commercial use of personal 
information, provide consumers with meaningful choice 
about the collection, use, and disclosure of such informa-
tion, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Building Effective Strategies To Promote Responsibility 
Accountability Choice Transparency Innovation Consumer 
Expectations and Safeguards Act’’ or the ‘‘BEST PRAC-
TICES Act’’. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2 Definitions. 
TITLE I—TRANSPARENCY, NOTICE, AND INDIVIDUAL CHOICE 
Sec. 101. Information to be made available. 
Sec. 102. Provision of notice or notices. 
Sec. 103. Opt-out consent required for collection and use of covered information 
by a covered entity. 
Sec. 104. Express affirmative consent. 
Sec. 105. Material changes to privacy practices. 
Sec. 106. Exceptions. 
TITLE II—ACCURACY, ACCESS, AND DISPUTE RESOLUTION 
Sec. 201. Accuracy. 
Sec. 202. Access and dispute resolution. 
TITLE III—DATA SECURITY, DATA MINIMIZATION, AND 
ACCOUNTABILITY 
Sec. 301. Data security. 
Sec. 302. Accountability. 
Sec. 303. Data minimization obligations. 
TITLE IV—SAFE HARBOR AND SELF-REGULATORY CHOICE 
PROGRAM 
Sec. 401. Safe harbor. 
Sec. 402. Approval by the Federal Trade Commission. 
Sec. 403. Requirements of self-regulatory program. 
Sec. 404. Rulemaking. 
TITLE V—EXEMPTIONS 
Sec. 501. Use of aggregate or deidentified information. 
Sec. 502. Activities covered by other Federal privacy laws. 
TITLE VI—APPLICATION AND ENFORCEMENT 
Sec. 601. General application. 
Sec. 602. Enforcement by the Federal Trade Commission. 
Sec. 603. Enforcement by State attorneys general. 
Sec. 604. Private right of action. 
Sec. 605. Effect on other laws. 
TITLE VII—MISCELLANEOUS PROVISIONS 
Sec. 701. Review. 
Sec. 702. Consumer and business education campaign. 
Sec. 703. Effective date. 
Sec. 704. Severability. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
SEC. 2. DEFINITIONS. 
As used in this Act, the following definitions apply: 
(1) AGGREGATE INFORMATION.—The term ‘‘ag-
gregate information’’ means data that relates to a 
group or category of services or individuals, from 
which all information identifying an individual has 
been removed. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means a person engaged in interstate com-
merce that collects or stores data containing covered 
information or sensitive information. Such term does 
not include— 
(A) the Federal Government or any instru-
mentality of the Federal Government, nor the 
government of any State or political subdivision 
of a State; or 
(B) any person that can demonstrate that 
such person— 
(i) stores covered information from or 
about fewer than 15,000 individuals; 
(ii) collects covered information from 
or about fewer than 10,000 individuals 
during any 12-month period; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(iii) does not collect or store sensitive 
information; and 
(iv) does not use covered information 
to study, monitor, or analyze the behavior 
of individuals as the person’s primary busi-
ness. 
(4) COVERED INFORMATION.— 
(A) IN GENERAL.—The term ‘‘covered in-
formation’’ means, with respect to an indi-
vidual, any of the following: 
(i) the first name or initial and last 
name; 
(ii) a postal address; 
(iii) an email address; 
(iv) a telephone or fax number; 
(v) a tax identification number, pass-
port number, driver’s license number, or 
any other unique government-issued identi-
fication number; 
(vi) a financial account number, or 
credit card or debit card number, or any 
required security code, access code, or 
password that is necessary to permit ac-
cess to an individual’s financial account; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(vii) any unique persistent identifier, 
such as a customer number, unique pseu-
donym or user alias, IP address, or other 
unique identifier, where such identifier is 
used to collect, store or identify informa-
tion about a specific individual or to create 
or maintain a preference profile; or 
(viii) any other information that is 
collected, stored, used, or disclosed in con-
nection with any covered information de-
scribed in clauses (i) through (vii). 
(B) EXCLUSION.—Such term shall not in-
clude— 
(i) the title, business address, business 
email address, business telephone number, 
or business fax number associated with an 
individual’s status as an employee of an or-
ganization, or an individual’s name when 
collected, stored, used, or disclosed in con-
nection with such employment status; or 
(ii) any information collected from or 
about an employee by an employer, pro-
spective employer, or former employer that 
directly relates to the employee-employer 
relationship. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(5) OPERATIONAL PURPOSE.— 
(A) IN GENERAL.—The term ‘‘operational 
purpose’’ means a purpose reasonably necessary 
to facilitate, improve, or safeguard the logistical 
or technical ability of a covered entity to pro-
vide goods or services, manage its operations, 
comply with legal obligations, or protect against 
risks and threats, including— 
(i) providing, operating, or improving 
a product or service used, requested, or au-
thorized by an individual, including the on-
going provision of customer service and 
support; 
(ii) analyzing data related to use of 
the product or service for purposes of im-
proving the covered entity’s products, serv-
ices, or operations; 
(iii) basic business functions such as 
accounting, inventory and supply chain 
management, quality assurance, and inter-
nal auditing; 
(iv) protecting or defending the rights 
or property, including intellectual property, 
of the covered entity against actual or po-
tential security threats, fraud, theft, unau-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
thorized transactions, or other illegal ac-
tivities; 
(v) preventing imminent danger to the 
personal safety of an individual or group of 
individuals; 
(vi) complying with a Federal, State, 
or local law, rule, or other applicable legal 
requirement, including disclosures pursu-
ant to a court order, subpoena, summons, 
or other properly executed compulsory 
process; and 
(vii) any other category of operational 
use specified by the Commission by regula-
tion that is consistent with the purposes of 
this Act. 
(B) EXCLUSION.—Such term shall not in-
clude— 
(i) the use of covered information for 
marketing or advertising purposes, or any 
use of or disclosure of covered information 
to a third party for such purposes; or 
(ii) the use of covered information for 
a purpose that an individual acting reason-
ably under the circumstances would not ex-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
pect based on the product or service used, 
requested, or authorized by the individual. 
(6) PREFERENCE PROFILE.—The term ‘‘pref-
erence profile’’ means a list of preferences, cat-
egories of information, or interests— 
(A) associated with an individual or with 
an individual’s computer or other device; 
(B) inferred from the actual behavior of 
the individual, the actual use of the individual’s 
computer or other device, or information sup-
plied directly by the individual or other user of 
a computer or other device; and 
(C) compiled and maintained for the pur-
pose of marketing or purposes related to mar-
keting, advertising, or sales. 
(7) PUBLICLY AVAILABLE INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘publicly 
available information’’ means any covered infor-
mation or sensitive information that a covered 
entity has a reasonable basis to believe is law-
fully made available to the general public 
from— 
(i) Federal, State, or local government 
records; 
(ii) widely distributed media; or 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(iii) disclosures to the general public 
that are required to be made by Federal, 
State, or local law. 
(B) CONSTRUCTION.—A covered entity has 
a reasonable basis to believe that information is 
lawfully made available to the general public if 
the covered entity has taken steps to deter-
mine— 
(i) that the information is of a type 
that is available to the general public; and 
(ii) whether an individual can direct 
that the information not be made available 
to the general public and, if so, that the 
individual has not done so. 
(8) SENSITIVE INFORMATION.— 
(A) DEFINITION.—The term ‘‘sensitive in-
formation’’ means— 
(i) any information that is associated 
with covered information of an individual 
and relates directly to that individual’s— 
(I) medical history, physical or 
mental health, or the provision of 
health care to the individual; 
(II) race or ethnicity; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(III) religious beliefs and affili-
ation; 
(IV) sexual orientation or sexual 
behavior; 
(V) income, assets, liabilities, or 
financial records, and other financial 
information associated with a finan-
cial account, including balances and 
other financial information, except 
when financial account information is 
provided by the individual and is used 
only to process an authorized credit or 
debit to the account; or 
(VI) precise geolocation informa-
tion and any information about the 
individual’s activities and relationships 
associated with such geolocation; or 
(ii) an individual’s— 
(I) unique biometric data, includ-
ing a fingerprint or retina scan; or 
(II) Social Security number. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by regulations 
promulgated under section 553 of title 5, 
United States Code, modify the scope or appli-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
cation of the definition of ‘‘sensitive informa-
tion’’ for purposes of this Act. In promulgating 
such regulations, the Commission shall con-
sider— 
(i) the purposes of the collection of 
the information and the context of the use 
of the information; 
(ii) how easily the information can be 
used to identify a specific individual; 
(iii) the nature and extent of author-
ized access to the information; 
(iv) an individual’s reasonable expec-
tations under the circumstances; and 
(v) adverse effects that may be experi-
enced by an individual if the information is 
disclosed to an unauthorized person. 
(C) PRECISE GEOLOCATION INFORMATION 
DEFINED
BY
RULEMAKING.—The Commission 
shall, by regulations promulgated under section 
553 of title 5, United States Code, define the 
term ‘‘precise geolocation information’’ for pur-
poses of subparagraph (A)(i)(VI). 
(9) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means an entity that collects, maintains, 
processes, stores, or otherwise handles covered infor-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
mation or sensitive information on behalf of a cov-
ered entity, including, for the purposes of serving as 
a data processing center, distributing the informa-
tion, providing customer support, maintaining the 
covered entity’s records, information technology 
management, Web site or other hosting service, 
fraud 
detection, 
authentication, 
and 
other 
verification services, or performing other administra-
tive support functions for the covered entity. 
(10) THIRD PARTY.— 
(A) IN GENERAL.—The term ‘‘third party’’ 
means, with respect to any covered entity, a 
person that— 
(i) is not related to the covered entity 
by common ownership or corporate control; 
or 
(ii) is a business unit or corporate en-
tity that holds itself out to the public as 
separate from the covered entity, such that 
an individual acting reasonably under the 
circumstances would not expect it to be re-
lated to the covered entity or to have ac-
cess to covered information the individual 
provides to that covered entity. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(B) COLLECTION
OF
INFORMATION
BY 
MULTIPLE SOURCES.—For the purpose of this 
definition, where multiple persons collect cov-
ered information or sensitive information from 
or about visitors to an online or mobile service, 
including a Web site, all such persons other 
than the operator or publisher of the online or 
mobile service or Web site shall be considered 
third parties unless— 
(i) the person meets the requirements 
of the service provider exception in section 
106(1); or 
(ii) the person otherwise does not sat-
isfy the requirements for a third party pur-
suant to the regulations implemented pur-
suant to subparagraph (C). 
(C) RULEMAKING.—Not later than 18 
months after the date of the enactment of this 
Act, the Commission shall promulgate regula-
tions under section 553 of title 5, United States 
Code, to clarify or modify the definition of third 
party for purposes of this Act. In promulgating 
such regulations, the Commission shall con-
sider— 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(i) the brand or brands associated 
with a covered entity; 
(ii) the scope and nature of the busi-
nesses engaged in by a covered entity and 
a third party, including the nature of the 
products or services offered by the covered 
entity and third party; and 
(iii) the relationship between a cov-
ered entity and a third party, taking into 
account such factors as ownership and con-
trol. 
TITLE 
I—TRANSPARENCY, 
NO-
TICE, 
AND 
INDIVIDUAL 
CHOICE 
SEC. 101. INFORMATION TO BE MADE AVAILABLE. 
A covered entity shall, in accordance with the regula-
tions issued under section 102, make available to individ-
uals whose covered information or sensitive information it 
collects or maintains the following information about its 
information privacy practices and an individual’s options 
with regard to such practices: 
(1) The identity of the covered entity. 
(2) A description of any covered information or 
sensitive information collected or stored by the cov-
ered entity. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(3) The specific purposes for which the covered 
entity collects and uses the covered information or 
sensitive information, including disclosure as to 
whether and how the covered entity customizes prod-
ucts or services or changes the prices of products or 
services based, in whole or in part, on covered infor-
mation or sensitive information about individual cus-
tomers or users. 
(4) The specific purposes for which covered in-
formation or sensitive information may be disclosed 
to a third party and the categories of third parties 
who may receive such information for each such pur-
pose. 
(5) The choice and means the covered entity of-
fers individuals for limiting the collection, use, and 
disclosure of covered information or sensitive infor-
mation, in accordance with sections 103 and 104. 
(6) A description of the information for which 
an individual may request access and the means to 
request such access, in accordance with section 202. 
(7) How the covered entity may merge, link, or 
combine covered information or sensitive information 
collected from the individual with other information 
about the individual that the covered entity may ac-
quire from third parties. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(8) The retention schedule for covered informa-
tion and sensitive information in days, months, or 
years, or a statement that the covered entity will re-
tain such information indefinitely or permanently. 
(9) Whether or not an individual has the right 
to direct the covered entity to delete information col-
lected from or about the individual. 
(10) A reasonable means by which an individual 
may contact the covered entity with any inquiries or 
complaints regarding the covered entity’s practices— 
(A) concerning the collection, use, disclo-
sure, or handling of the individual’s covered in-
formation or sensitive information in accord-
ance with section 302(a); or 
(B) to assure the accuracy of the individ-
ual’s covered information or sensitive informa-
tion in accordance with section 201(a). 
(11) The process by which the covered entity 
notifies individuals of material changes to its policies 
and practices. 
(12) A hyperlink to or a listing of the Commis-
sion’s online consumer complaint form or the toll- 
free number for the Commission’s Consumer Re-
sponse Center. 
(13) The effective date of the privacy notice. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
SEC. 102. PROVISION OF NOTICE OR NOTICES. 
(a) IN GENERAL.—It shall be unlawful for a covered 
entity to collect, use, or disclose covered information or 
sensitive information unless it provides the information set 
forth in section 101 in concise, meaningful, timely, promi-
nent, and easy-to-understand notice or notices, in accord-
ance with the regulations issued by the Commission under 
subsection (b). 
(b) RULEMAKING.—Not later than 18 months after 
the date of the enactment of this Act, the Commission 
shall promulgate regulations under section 553 of title 5, 
United States Code, to implement this section. In promul-
gating such regulations, the Commission— 
(1) shall determine the means and timing of the 
notices required under this section, taking into ac-
count the different media, devices, or methods 
through which the covered entity collects covered in-
formation or sensitive information; 
(2) shall have the authority to allow for, or re-
quire, the provision of short notices or limited disclo-
sures that do not include all of the information set 
forth in section 101, if the Commission by regula-
tion— 
(A) requires the information to be other-
wise clearly and conspicuously disclosed or 
available to individuals; and 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(B) determines that the provision of such 
short notices or limited disclosures will accom-
plish the purposes of this Act to enhance trans-
parency and provide individuals with meaning-
ful choice regarding the collection, use, and dis-
closure of their covered information or sensitive 
information; 
(3) shall consider— 
(A) whether the notice or notices provide 
individuals with timely, effective, and meaning-
ful notice that will enable an individual to un-
derstand relevant information and make in-
formed choices; 
(B) whether providing notice to individuals 
prior to or contemporaneously with the collec-
tion of covered information is practical or rea-
sonable under the circumstances; 
(C) the costs of implementing the pre-
scribed notice or notices; 
(D) the different media and context 
through which covered information is collected; 
(E) whether it is reasonable and appro-
priate under the circumstances for a third party 
or a service provider to be responsible for pro-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
viding notice and obtaining consent as required 
by this title in lieu of a covered entity; and 
(F) the risk to consumers and commerce of 
over-notification; and 
(4) may issue model notices. 
(c) EXCLUSION FROM NOTICE REQUIREMENTS.— 
(1) TRADE SECRET INFORMATION.—Nothing in 
this section shall require a covered entity to reveal 
confidential, trade secret, or proprietary information. 
(2) IN-PERSON TRANSACTIONS.—Notice under 
this section shall not be required for in-person collec-
tion of covered information if— 
(A) the covered information is collected for 
an operational purpose; or 
(B) the covered entity only is collecting the 
name, address, email address, telephone or fax 
number of an individual and does not— 
(i) share the covered information with 
third parties; or 
(ii) use the covered information to ac-
quire additional information about the in-
dividual from third parties. 
(d) RETENTION.—A covered entity shall retain copies 
of the notice or notices issued pursuant to this section for 
a period of 6 years after the date on which such notice 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
was issued or the date when it was last in effect, whichever 
is later, unless the Commission determines pursuant to the 
rulemaking required under subsection (b) that such reten-
tion is not practical under the circumstances. 
SEC. 103. OPT-OUT CONSENT REQUIRED FOR COLLECTION 
AND USE OF COVERED INFORMATION BY A 
COVERED ENTITY. 
(a) IN GENERAL.—Except as provided in subsections 
(e) and (f) and section 106, it shall be unlawful for a cov-
ered entity to collect or use covered information about an 
individual without the consent of that individual, as set 
forth in this section. A covered entity shall be considered 
to have the consent of an individual for the collection and 
use of covered information about the individual if— 
(1) the covered entity has provided to the indi-
vidual notice required under section 102 and its im-
plementing regulations; 
(2) the covered entity provides the individual 
with a reasonable means to exercise an opt-out right 
and decline consent for such collection and use; and 
(3) the individual either affirmatively grants 
consent for such collection and use or does not de-
cline consent at the time notice is presented or made 
available to the individual. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(b) DURATION OF INDIVIDUAL’S OPT-OUT.—An indi-
vidual’s direction to opt out under this section is effective 
permanently, unless otherwise directed by the individual. 
(c) SUBSEQUENT OPT-OUT.—A covered entity shall 
provide an individual with a reasonable means to decline 
consent or revoke previously granted consent at any time. 
(d) MORE DETAILED OPTIONS.—A covered entity 
may comply with this section by enabling an individual 
to decline consent for specific uses of his or her covered 
information, provided the individual has been given the op-
portunity to decline consent for the collection and use of 
covered information for all purposes, other than for an 
operational purpose excepted by subsection (e), for which 
covered information may be collected and used by the cov-
ered entity. 
(e) EXCEPTION
FOR OPERATIONAL PURPOSES.— 
This section shall not apply to the collection or use of cov-
ered information for an operational purpose. 
(f) COLLECTION AND USE AS A CONDITION OF SERV-
ICE.—Nothing in this section shall prohibit a covered enti-
ty from requiring, as a condition of an individual’s receipt 
of a service or other benefit, including the receipt of an 
enhanced or premium version of a product or service oth-
erwise available, the reasonable collection and use of cov-
ered information about the individual, provided that— 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(1) the covered entity has a direct relationship 
with the individual; 
(2) the covered information is not shared with 
any third party except with the express affirmative 
consent as set forth in section 104; 
(3) the covered entity provides a clear, promi-
nent, and specific statement describing the specific 
purpose or purposes for which covered information 
may be used pursuant to section 101; 
(4) the individual provides consent by acknowl-
edging the specific uses set forth in the clear and 
prominent statement required under paragraph (3) 
as part of receiving the service or other benefit from 
the covered entity; and 
(5) the individual is able to later withdraw con-
sent for the use by canceling the service or otherwise 
indicating that he or she no longer wishes to receive 
the service or other benefit. 
SEC. 104. EXPRESS AFFIRMATIVE CONSENT. 
(a) DISCLOSURE
OF COVERED INFORMATION
TO 
THIRD PARTIES.— 
(1) DISCLOSURE PROHIBITED.—Except as pro-
vided in section 106 and subject to title IV of this 
Act, it shall be unlawful for a covered entity to dis-
close covered information about an individual to a 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
third party unless the covered entity has received ex-
press affirmative consent from the individual prior 
to the disclosure. 
(2) EXCEPTION FOR JOINT MARKETING.—Ex-
press affirmative consent shall not be required for 
any disclosure related to the performance of joint 
marketing, if the covered entity and the third party 
enter into a contractual agreement prohibiting the 
third party from disclosing or using the covered in-
formation except as necessary to carry out the joint 
marketing relationship. 
(b) COLLECTION, USE, OR DISCLOSURE OF SEN-
SITIVE INFORMATION.—Except as provided in section 
106, a covered entity may not collect, use, or disclose sen-
sitive information from or about an individual for any pur-
pose unless the covered entity obtains the express affirma-
tive consent of the individual. 
(c) COMPREHENSIVE ONLINE DATA COLLECTION.— 
A covered entity may not use hardware or software to 
monitor all or substantially all of the individual’s Internet 
browsing or other significant class of Internet or computer 
activity and collect, use, or disclose information concerning 
such activity, except— 
(1) with the express affirmative consent of the 
individual; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(2) for the purpose of making such information 
accessible to the individual or for use by the indi-
vidual; or 
(3) as provided in section 106. 
(d) LIMITATION.—A third party that receives covered 
information or sensitive information from a covered entity 
pursuant to this section shall only use such information 
for the specific purposes authorized by the individual when 
the individual granted express affirmative consent for the 
disclosure of the information to a third party. 
(e) REVOCATION
OF CONSENT.—A covered entity 
that has obtained the express affirmative consent of an 
individual pursuant to this section and section 105 shall 
provide the individual with a reasonable means, without 
charge, to withdraw consent at any time thereafter. 
SEC. 105. MATERIAL CHANGES TO PRIVACY PRACTICES. 
(a) RETROACTIVE APPLICATION.—A covered entity 
shall provide the notice required by section 102 and obtain 
the express affirmative consent of the individual prior to 
making a material change in privacy practices governing 
previously collected covered information or sensitive infor-
mation from that individual. 
(b) PROSPECTIVE APPLICATION.—A covered entity 
shall not make material changes to its privacy practices 
governing the collection, use, or disclosure of covered in-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
formation or sensitive information that has not been pre-
viously collected unless, 30 days before the effective date 
of the material change— 
(1) the covered entity provides individuals with 
notice of the material change in accordance with sec-
tion 102; and 
(2) if required by sections 103 and 104, obtains 
the individual’s consent to the material change or al-
lows the individual to terminate the individual’s rela-
tionship with the covered entity. 
SEC. 106. EXCEPTIONS. 
The consent requirements of sections 103 and 104 
shall not apply to the following: 
(1) SERVICE PROVIDERS.— 
(A) When a covered entity discloses cov-
ered information or sensitive information to a 
service provider performing services or func-
tions on behalf of and under the instruction of 
the covered entity, provided— 
(i) the covered entity obtained the re-
quired consent for the initial collection of 
such information and provided notice as 
required by section 102; 
(ii) the covered entity enters into a 
contractual agreement that prohibits the 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
service provider from using or disclosing 
the information other than to carry out the 
purposes for which the information was 
disclosed; and 
(iii) in such cases, the covered entity 
remains responsible and liable for the pro-
tection of covered information and sensitive 
information that has been transferred to a 
service provider for processing. 
(B) When a service provider subsequently 
discloses the information to another service pro-
vider in order to perform the same services or 
functions described in paragraph (1) on behalf 
of the covered entity. 
(2) FRAUD
DETECTION.—Collection, use, or 
disclosure necessary to protect or defend the rights 
or property, including intellectual property, of the 
covered entity against actual or potential security 
threats, fraud, theft, unauthorized transactions, or 
other illegal activities. 
(3) IMMINENT
DANGER.—Collection, use, or 
disclosure necessary to prevent imminent danger to 
the personal safety of an individual or group of indi-
viduals. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(4) COMPLIANCE WITH LAW.—Collection, use, 
or disclosure required in order to comply with a Fed-
eral, State, or local law, rule, or other applicable 
legal requirement, including disclosures pursuant to 
subpoena, summons, or other properly executed com-
pulsory process. 
(5) PUBLICLY AVAILABLE INFORMATION.—Col-
lection, use, or disclosure of publicly available infor-
mation, except that a covered entity may not use 
publicly available information about an individual for 
marketing purposes if the individual has opted out 
of the use by such covered entity of covered informa-
tion or sensitive information for marketing purposes. 
TITLE II—ACCURACY, ACCESS, 
AND DISPUTE RESOLUTION 
SEC. 201. ACCURACY. 
(a) REASONABLE PROCEDURES.—Each covered enti-
ty shall establish reasonable procedures to assure the ac-
curacy of the covered information or sensitive information 
it collects, assembles, or maintains. Not later than 18 
months after the date of the enactment of this Act, the 
Commission shall promulgate regulations under section 
553 of title 5, United States Code, to implement this sec-
tion. In promulgating such regulations, the Commission 
shall consider— 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(1) the costs and benefits of ensuring the accu-
racy of the information; 
(2) the sensitivity of the information; 
(3) the purposes for which the information will 
be used; and 
(4) the harms from misuse of the information. 
(b) LIMITED EXCEPTION FOR FRAUD DATABASES.— 
The requirement in subsection (a) shall not prevent the 
collection or maintenance of information that may be inac-
curate with respect to a particular individual when that 
information is being collected or maintained solely— 
(1) for the purpose of indicating whether there 
may be a discrepancy or irregularity in the covered 
information or sensitive information that is associ-
ated with an individual; and 
(2) to help identify, or authenticate the identity 
of, an individual, or to protect against or investigate 
fraud or other unlawful conduct. 
(c) LIMITED EXCEPTION FOR PUBLICLY AVAILABLE 
INFORMATION.—Subject to section 202, a covered entity 
shall not be required to verify the accuracy of publicly 
available information if the covered entity has reasonable 
procedures to ensure that the publicly available informa-
tion assembled or maintained by the covered entity accu-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
rately reflects the information available to the general 
public. 
SEC. 202. ACCESS AND DISPUTE RESOLUTION. 
(a) ACCESS
AND CORRECTION.—A covered entity 
shall, upon request, provide an individual with reasonable 
access to, and the ability to dispute the accuracy or com-
pleteness of, covered information or sensitive information 
about that individual if such information may be used for 
purposes that could result in an adverse decision against 
the individual, including the denial of a right, benefit, or 
privilege. 
(b) ACCESS TO PERSONAL PROFILES.— 
(1) IN GENERAL.—Subject to title IV, a covered 
entity shall, upon request, provide an individual with 
reasonable access to any personal profile about that 
individual that the entity stores in a manner that 
makes it accessible in the normal course of business. 
(2) SPECIAL
RULE
FOR
PREFERENCE
PRO-
FILES.—With respect to a preference profile, the ob-
ligation to provide access and correction under this 
section is met if the covered entity provides the abil-
ity to review and change the preference information 
associated with a unique persistent identifier. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(3) PARTICIPATION IN CHOICE PROGRAM.—This 
subsection shall not apply to a covered entity that 
participates in a Choice Program under title IV. 
(c) NOTICE IN LIEU OF ACCESS.—Subject to sub-
section (b), in those instances in which covered informa-
tion or sensitive information is used only for purposes that 
could not reasonably result in an adverse decision against 
an individual, including the denial of a right, benefit, or 
privilege, a covered entity shall, upon request by an indi-
vidual, provide the individual with a general notice or rep-
resentative sample of the type or types of information the 
covered entity typically collects or stores for such pur-
poses. 
(d) EXCEPTIONS.— 
(1) A covered entity may decline to provide an 
individual with access to covered information or sen-
sitive information if the covered entity reasonably 
believes— 
(A) the individual requesting access cannot 
reasonably verify his or her identity as the per-
son to which the information relates; 
(B) access by the individual to the infor-
mation is limited by law or legally recognized 
privilege; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(C) the information is used for a legitimate 
governmental or fraud prevention purpose that 
would be compromised by such access; 
(D) such request for access is frivolous or 
vexatious; 
(E) the privacy or other rights of persons 
other than the individual would be violated; or 
(F) proprietary or confidential information, 
technology, or business processes would be re-
vealed as a result. 
(2) Where an exception described in paragraph 
(1) applies only to a portion of the covered informa-
tion or sensitive information maintained by the cov-
ered entity, the covered entity shall provide access 
required under subsections (a) and (b) to the infor-
mation to which the exception does not apply. 
(3) A covered entity may decline an individual’s 
request to correct or amend covered information or 
sensitive information pertaining to that individual 
where— 
(A) a reason for denying access to the in-
formation under paragraph (1) would also apply 
to the request to correct or amend the informa-
tion; or 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(B) doing so would be incompatible with a 
legal obligation, such as a requirement to retain 
certain information. 
(e) FEES.—A covered entity may charge a reasonable 
fee, as determined by the Commission, for providing ac-
cess in accordance with subsection (a) or (b). 
(f) TIME LIMIT.—A covered entity shall respond to 
any access, correction, or amendment request within 30 
days after the receipt of the request. Such response shall 
consist of one or more of the following: 
(1) The requested information in accordance 
with subsection (a) or (b). 
(2) The general notice in accordance with sub-
section (c). 
(3) Instructions for accessing, correcting, or 
amending the requested information through an 
automated mechanism. 
(4) A confirmation that the requested correc-
tions or amendments have been made. 
(5) A notification that the covered entity is de-
clining to correct or amend information pursuant to 
one of the exceptions described in subsection (d). 
Such notification shall include the reason or reasons 
for not making the suggested correction or amend-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
ment, unless one or more of such exceptions would 
also apply to the disclosure of the reason or reasons. 
(6) A request to resubmit the access request 
and an explanation of why the original access re-
quest was deficient in cases where— 
(A) the scope or nature of the request is 
unclear or the entity needs more information in 
order to respond to the request; 
(B) the entity charges a fee as permitted 
under subsection (e), and the fee has not been 
paid; or 
(C) the entity provides interested members 
of the public other reasonable and accessible in-
structions for submitting an access request and 
such instructions were not followed. 
(7) A notification that additional time is needed 
where— 
(A) the entity cannot reasonably provide a 
full response within 30 days after the receipt of 
the access; and 
(B) the time extension needed for a full re-
sponse is no greater than an additional 30 days. 
(g) RULE OF CONSTRUCTION.—Nothing in this Act 
creates an obligation on a covered entity to provide an in-
dividual with the right to delete information. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(h) ADDITIONAL REQUIREMENTS WHERE CORREC-
TION OR AMENDMENT IS DECLINED.—If the covered enti-
ty declines to correct or amend the information described 
in subsection (a), the covered entity shall— 
(1) note that the information is disputed, in-
cluding the individual’s statement disputing such in-
formation, and take reasonable steps to verify such 
information under the procedures outlined in section 
201 if such information can be independently 
verified; and 
(2) where the information was obtained from a 
third party or is publicly available information, in-
form the individual of the source of the information, 
and if reasonably available, where a request for cor-
rection may be directed, and, if the individual pro-
vides proof that the information is incorrect, correct 
the inaccuracy in the covered entity’s records. 
(i) OTHER LIMITATIONS.—The obligations under this 
section do not, by themselves, create any obligation on the 
covered entity to retain, maintain, reorganize, or restruc-
ture covered information or sensitive information. 
(j) DATA RETENTION EXCEPTION.—Covered infor-
mation or sensitive information retained by the covered 
entity for under 30 days, or such other period of time as 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
the Commission may determine, shall not be subject to 
this section. 
(k) RULEMAKING.—Not later than 18 months after 
the date of the enactment of this Act, the Commission 
shall promulgate regulations under section 553 of title 5, 
United States Code, to implement this section. In addi-
tion, the Commission shall promulgate regulations, as nec-
essary, on the application of the exceptions and limitations 
in subsection (d), including any additional circumstances 
in which a covered entity may limit access to information 
under such subsection that the Commission determines to 
be appropriate. 
TITLE 
III—DATA 
SECURITY, 
DATA MINIMIZATION, AND AC-
COUNTABILITY 
SEC. 301. DATA SECURITY. 
(a) IN GENERAL.—Each covered entity and service 
provider shall establish, implement, and maintain reason-
able and appropriate administrative, technical, and phys-
ical safeguards to— 
(1) ensure the security, integrity, and confiden-
tiality of the covered information or sensitive infor-
mation it collects, assembles, or maintains; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(2) protect against any anticipated threats, rea-
sonably foreseeable vulnerabilities, or hazards to the 
security or integrity of such information; and 
(3) protect against unauthorized access to or 
use of such information and loss, misuse, alteration, 
or destruction of such information. 
(b) FACTORS FOR APPROPRIATE SAFEGUARDS.—Not 
later than 18 months after the date of the enactment of 
this Act, the Commission shall promulgate regulations 
under section 553 of title 5, United States Code, to imple-
ment this section. In promulgating such regulations, the 
Commission shall consider— 
(1) the size and complexity of an entity; 
(2) the nature and scope of the activities of an 
entity; 
(3) the sensitivity of the information; 
(4) the current state of the art in administra-
tive, technical, and physical safeguards for pro-
tecting information; and 
(5) the cost of implementing such safeguards. 
SEC. 302. ACCOUNTABILITY. 
(a) COMPLAINTS TO THE COVERED ENTITY.—A cov-
ered entity shall provide a process for individuals to make 
complaints concerning the covered entity’s policies and 
procedures required by this Act. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(b) PRIVACY RISK ASSESSMENT.—A covered entity 
shall conduct an assessment of the risks to individuals 
raised by the collection, use, and disclosure of covered in-
formation or sensitive information prior to the implemen-
tation of commercial projects, marketing initiatives, busi-
ness models, applications, and other products or services 
in which the covered entity intends to collect, or believes 
there is a reasonable likelihood it will collect, covered in-
formation or sensitive information from or about more 
than 1,000,000 individuals. 
(c) PERIODIC EVALUATION OF PRACTICES.—A cov-
ered entity shall conduct periodic assessments to evalu-
ate— 
(1) whether the covered information or sensitive 
information the covered entity has collected is and 
remains necessary for the purposes disclosed at the 
time of collection pursuant to subsections (c) and (d) 
of section 101; and 
(2) whether the covered entity’s ongoing collec-
tion practices are and remain necessary for a legiti-
mate business purpose. 
SEC. 303. DATA MINIMIZATION OBLIGATIONS. 
A covered entity that uses covered information or 
sensitive information for any purpose shall retain such 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
data only as long as necessary to fulfill a legitimate busi-
ness purpose or comply with a legal requirement. 
TITLE IV—SAFE HARBOR AND 
SELF-REGULATORY 
CHOICE 
PROGRAM 
SEC. 401. SAFE HARBOR. 
A covered entity that participates in, and is in compli-
ance with, 1 or more self-regulatory programs approved 
by the Commission under section 402 (in this title referred 
to as a ‘‘Choice Program’’I´) shall not be subject to— 
(1) the requirements for express affirmative 
consent required under subsection 104(a) for the 
specified uses of covered information addressed by 
the Choice Program as described in section 
403(1)(A); 
(2) the requirement of access to information 
under section 202(b); or 
(3) liability in a private right of action brought 
under section 604. 
SEC. 402. APPROVAL BY THE FEDERAL TRADE COMMIS-
SION. 
(a) INITIAL APPROVAL.—Not later than 270 days 
after the submission of an application for approval of a 
Choice Program under this section, the Commission shall 
approve or decline to approve such program. The Commis-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
sion shall only approve such program if the Commission 
finds, after notice and comment, that the program com-
plies with the requirements of section 403. 
(b) APPROVAL OF MODIFICATIONS.—The Commis-
sion shall approve or decline to approve any material 
change in a Choice Program previously approved by the 
Commission within 120 days after submission of an appli-
cation for approval by such program. The Commission 
shall only approve such material change if the Commission 
finds, after notice and comment, that the proposed change 
complies with the requirements of section 403. 
(c) DURATION.—A Choice Program approved by the 
Commission under this section shall be approved for a pe-
riod of 5 years. 
(d) APPEALS.—Final action by the Commission on 
a request for approval, or the failure to act within 270 
days on a request for approval, submitted under this sec-
tion may be appealed to a district court of the United 
States of appropriate jurisdiction as provided for in sec-
tion 706 of title 5, United States Code. 
SEC. 403. REQUIREMENTS OF SELF-REGULATORY PRO-
GRAM. 
To be approved as a Choice Program under this sec-
tion, a program shall— 
(1) provide individuals with— 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(A) a clear and conspicuous opt-out mech-
anism that, when selected by the individual, 
prohibits all covered entities participating in the 
Choice Program from disclosing covered infor-
mation to a third party for 1 or more specified 
uses, and may offer individuals a preference 
management tool that will enable an individual 
to make more detailed choices about the trans-
fer of covered information to a third party; and 
(B) a clear and conspicuous mechanism to 
set communication preferences, online behav-
ioral advertising preferences, and such other 
preferences as the Choice Program may deter-
mine, subject to the approval of the Commis-
sion, that when selected by the individual, ap-
plies the individual’s selected preferences to all 
covered entities participating in the Choice Pro-
gram; and 
(2) establish— 
(A) procedures for reviewing applications 
by covered entities to participate in the Choice 
Program; 
(B) procedures for periodic assessment of 
its procedures and for conducting periodic ran-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
dom compliance testing of covered entities par-
ticipating in such Choice Program; 
(C) consequences for failure to comply with 
program requirements, such as public notice of 
the covered entity’s noncompliance, suspension, 
or expulsion from the program, or referral to 
the Commission for enforcement; and 
(D) guidelines and procedures requiring a 
participating covered entity to provide equiva-
lent or greater protections for individuals and 
their covered information and sensitive informa-
tion as are provided under titles I and II. 
SEC. 404. RULEMAKING. 
Not later than 18 months after the date of enactment 
of this Act, the Commission shall promulgate regulations 
under section 553 of title 5, United States Code, to imple-
ment this section and to provide compliance guidance for 
entities seeking to be approved under this title, including 
regulations— 
(1) establishing criteria for the submission of 
the application, including evidence of how the Choice 
Program will comply with the requirements of sec-
tion 403; 
(2) establishing criteria for opt-out mechanisms 
and communication preferences, online behavioral 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
advertising preferences, or other preferences meeting 
the requirements of this title; 
(3) establishing consequences for failure to 
comply with the requirements of section 403, such 
as public notice of the Choice Program’s noncompli-
ance and suspension or revocation of the Commis-
sion’s approval of such Program as described in sec-
tion 402; 
(4) allowing for and promoting continued evo-
lution and innovation in privacy protection, mean-
ingful consumer control, simplified approaches to 
disclosure, and transparency; 
(5) providing additional incentives for self-regu-
lation by covered entities to implement the protec-
tions afforded individuals under titles I and II of 
this Act; and 
(6) providing that a covered entity will be con-
sidered to be in compliance with the requirements of 
titles I and II of this Act and the regulations issued 
under such titles if that covered entity complies with 
guidelines or requirements of a Choice Program ap-
proved under section 402. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
TITLE V—EXEMPTIONS 
SEC. 501. USE OF AGGREGATE OR DEIDENTIFIED INFORMA-
TION. 
(a) GENERAL EXCLUSION.—Subject to subsections 
(b) and (c), nothing in this Act shall preclude a covered 
entity from collecting, using, or disclosing— 
(1) aggregate information; or 
(2) covered information or sensitive information 
from which identifying information has been ob-
scured or removed using reasonable and appropriate 
methods such that the remaining information does 
not identify, and there is no reasonable basis to be-
lieve that the information can be used to identify— 
(A) the specific individual to whom such 
covered information relates; or 
(B) a computer or device owned or used by 
a specific individual. 
(b) REASONABLE PROCEDURES FOR DISCLOSURE.— 
If a covered entity discloses the information described in 
paragraphs (1) and (2) of subsection (a) to a third party, 
the covered entity shall take reasonable steps to protect 
such information, including, in the case of the information 
described in such paragraph (2), not disclosing the algo-
rithm or other mechanism used to obscure or remove the 
identifying information, and obtaining satisfactory written 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
assurance that the third party will not attempt to recon-
struct the identifying information. 
(c) PROHIBITION ON RECONSTRUCTING OR REVEAL-
ING IDENTIFYING INFORMATION.— 
(1) IN GENERAL.—It shall be unlawful for any 
person to reconstruct or reveal the identifying infor-
mation that has been removed or obscured (as de-
scribed in subsection (a)(2)). 
(2) RULEMAKING.—Not later than 18 months 
after the date of the enactment of this Act, the 
Commission shall promulgate regulations under sec-
tion 553 of title 5, United States Code, to establish 
exemptions to this subsection. In promulgating such 
regulations, the Commission shall consider— 
(A) the purposes for which such identifying 
information may need to be reconstructed or re-
vealed; 
(B) the size and sensitivity of the data set; 
and 
(C) public policy issues such as health, 
safety, and national security. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
SEC. 502. ACTIVITIES COVERED BY OTHER FEDERAL PRI-
VACY LAWS. 
Except as provided expressly in this Act, this Act 
shall have no effect on activities covered by any of the 
following: 
(1) Title V of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801 et seq.). 
(2) The Fair Credit Reporting Act (15 U.S.C. 
1681 et seq.). 
(3) The Health Insurance Portability and Ac-
countability Act of 1996 (Public Law 104–191). 
(4) Part C of title XI of the Social Security Act 
(42 U.S.C. 1320d et seq.). 
(5) Section 222 or 631 of the Communications 
Act of 1934 (47 U.S.C. 222; 551). 
(6) The Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6501 et seq.). 
(7) The CAN–SPAM Act of 2003 (15 U.S.C. 
7701 et seq.). 
(8) Chapter 119, 121, or 206 of title 18, 
United States Code. 
TITLE VI—APPLICATION AND 
ENFORCEMENT 
SEC. 601. GENERAL APPLICATION. 
The requirements of this Act shall only apply to those 
persons over which the Commission has authority pursu-
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
ant to section 5(a)(2) of the Federal Trade Commission 
Act (15 U.S.C. 45(a)(2)). Notwithstanding any provision 
of such Act or any other provision of law, common carriers 
subject to the Communications Act of 1934 (47 U.S.C. 
151 et seq.) and any amendment thereto shall be subject 
to the jurisdiction of the Commission for purposes of this 
Act. 
SEC. 602. ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A violation of titles I, II, or III shall be treated as an 
unfair and deceptive act or practice in violation of a regu-
lation under section 18(a)(1)(B) of the Federal Trade 
Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding un-
fair or deceptive acts or practices. 
(b) POWERS
OF COMMISSION.—The Commission 
shall enforce this Act in the same manner, by the same 
means, and with the same jurisdiction, powers, and duties 
as though all applicable terms and provisions of the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.) were 
incorporated into and made a part of this Act. Any person 
who violates this Act or the regulations issued under this 
Act shall be subject to the penalties and entitled to the 
privileges and immunities provided in that Act. 
(c) RULEMAKING AUTHORITY.— 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(1) RULEMAKING.—The Commission may, in 
accordance with section 553 of title 5, United States 
Code, issue such regulations it determines to be nec-
essary to carry out this Act. 
(2) AUTHORITY TO GRANT EXCEPTIONS.—The 
regulations prescribed under paragraph (1) may in-
clude such additional exceptions to titles I, II, III, 
IV, and V of this Act as the Commission considers 
consistent with the purposes of this Act. 
(3) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
SEC. 603. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) CIVIL ACTION.—In any case in which the attor-
ney general of a State, or an official or agency of a State, 
has reason to believe that an interest of the residents of 
that State has been or is threatened or adversely affected 
by any person who violates this Act, the attorney general, 
official, or agency of the State, as parens patriae, may 
bring a civil action on behalf of the residents of the State 
in an appropriate district court of the United States— 
(1) to enjoin further violation of this Act by the 
defendant; 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
(2) to compel compliance with this Act; or 
(3) for violations of titles I, II, or III of this 
Act, to obtain civil penalties in the amount deter-
mined under subsection (b). 
(b) CIVIL PENALTIES.— 
(1) CALCULATION.—For purposes of calculating 
the civil penalties that may be obtained under sub-
section (a)(3)— 
(A) with regard to a violation of title I, the 
amount determined under this paragraph is the 
amount calculated by multiplying the number of 
days that a covered entity is not in compliance 
with such title, or the number of individuals for 
whom the covered entity failed to obtain con-
sent as required by such title, whichever is 
greater, by an amount not to exceed $11,000; 
and 
(B) with regard to a violation of title II or 
III, the amount determined under this para-
graph is the amount calculated by multiplying 
the number of days that a covered entity is not 
in compliance with such title or titles by an 
amount not to exceed $11,000. 
(2) ADJUSTMENT FOR INFLATION.—Beginning 
on the date that the Consumer Price Index for All 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS
Urban Consumers is first published by the Bureau 
of Labor Statistics that is after 1 year after the date 
of enactment of this Act, and each year thereafter, 
the amounts specified in subparagraphs (A) and (B) 
of paragraph (1) shall be increased by the percent-
age increase in the Consumer Price Index published 
on that date from the Consumer Price Index pub-
lished the previous year. 
(3) MAXIMUM
TOTAL
LIABILITY.—Notwith-
standing the number of actions which may be 
brought against a person under this section the 
maximum civil penalty for which any person may be 
liable under this section shall not exceed— 
(A) $5,000,000 for any related series of 
violations of title I; and 
(B) $5,000,000 for any related series of 
violations of title II and title III. 
(4) EFFECT OF PARTICIPATION IN CHOICE PRO-
GRAM.—If a covered entity participates in a Choice 
Program established under title IV and cures the al-
leged violation of title I or II in a reasonable period 
of time after receiving notice of the alleged violation, 
such conduct shall be taken into consideration by a 
State or a court in determining the amount of civil 
penalties under this subsection. 
VerDate Mar 15 2010 
02:57 Feb 12, 2011
Jkt 099200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H611.IH
H611
smartinez on DSKB9S0YB1PROD with BILLS