ally identifiable information in performing 
services or functions on behalf of and 
under the instruction of the covered entity; 
and 
(iii) with respect to the collection of 
covered information of an individual, does 
not have an established business relation-
ship with the individual and does not iden-
tify itself to the individual at the time of 
such collection in a clear and conspicuous 
manner that is visible to the individual. 
(B) COMMON BRANDS.—The term ‘‘third 
party’’ may include, with respect to a covered 
entity, a person who operates under a common 
brand with the covered entity. 
(8) UNAUTHORIZED USE.— 
(A) IN GENERAL.—The term ‘‘unauthor-
ized use’’ means the use of covered information 
by a covered entity or its service provider for 
any purpose not authorized by the individual to 
whom such information relates. 
(B) EXCEPTIONS.—Except as provided in 
subparagraph (C), the term ‘‘unauthorized use’’ 
does not include use of covered information re-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
lating to an individual by a covered entity or its 
service provider as follows: 
(i) To process and enforce a trans-
action or deliver a service requested by 
that individual. 
(ii) To operate the covered entity that 
is providing a transaction or delivering a 
service requested by that individual, such 
as inventory management, financial report-
ing and accounting, planning, and product 
or service improvement or forecasting. 
(iii) To prevent or detect fraud or to 
provide for a physically or virtually secure 
environment. 
(iv) To investigate a possible crime. 
(v) That is required by a provision of 
law or legal process. 
(vi) To market or advertise to an indi-
vidual from a covered entity within the 
context of a covered entity’s own Internet 
website, services, or products if the covered 
information used for such marketing or ad-
vertising was— 
(I) collected directly by the cov-
ered entity; or 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(II) shared with the covered enti-
ty— 
(aa) at the affirmative re-
quest of the individual; or 
(bb) by an entity with which 
the individual has an established 
business relationship. 
(vii) Use that is necessary for the im-
provement of transaction or service deliv-
ery through research, testing, analysis, and 
development. 
(viii) Use that is necessary for inter-
nal operations, including the following: 
(I) Collecting customer satisfac-
tion surveys and conducting customer 
research to improve customer service 
information. 
(II) Information collected by an 
Internet website about the visits to 
such website and the click-through 
rates at such website— 
(aa) 
to 
improve 
website 
navigation and performance; or 
(bb) to understand and im-
prove the interaction of an indi-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
vidual with the advertising of a 
covered entity. 
(ix) Use— 
(I) by a covered entity with 
which an individual has an established 
business relationship; 
(II) which the individual could 
have reasonably expected, at the time 
such relationship was established, was 
related to a service provided pursuant 
to such relationship; and 
(III) which does not constitute a 
material change in use or practice 
from what could have reasonably been 
expected. 
(C) SAVINGS.—A use of covered informa-
tion regarding an individual by a covered entity 
or its service provider may only be excluded 
under subparagraph (B) from the definition of 
‘‘unauthorized use’’ under subparagraph (A) if 
the use is reasonable and consistent with the 
practices and purposes described in the notice 
given the individual in accordance with section 
121(a)(1). 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(9) UNIQUE
IDENTIFIER
INFORMATION.—The 
term ‘‘unique identifier information’’ means a 
unique persistent identifier associated with an indi-
vidual or a networked device, including a customer 
number held in a cookie, a user identification, a 
processor serial number, or a device serial number. 
(b) MODIFIED DEFINITION BY RULEMAKING.—If the 
Commission determines that a term defined in any of 
paragraphs (3) through (8) is not reasonably sufficient to 
protect an individual from unfair or deceptive acts or prac-
tices, the Commission may by rule modify such definition 
as the Commission considers appropriate to protect such 
individual from an unfair or deceptive act or practice to 
the extent that the Commission determines will not unrea-
sonably impede interstate commerce. 
Subtitle A—Right to Security and 
Accountability 
SEC. 111. SECURITY. 
(a) RULEMAKING REQUIRED.—Not later than 180 
days after the date of enactment of this Act, the Commis-
sion shall initiate a rulemaking proceeding to require each 
covered entity to carry out security measures to protect 
the covered information it collects and maintains. 
(b) PROPORTION.—The requirements prescribed 
under subsection (a) shall provide for security measures 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
that are proportional to the size, type, nature, and sensi-
tivity of the covered information a covered entity collects. 
(c) CONSISTENCY.—The requirements prescribed 
under subsection (a) shall be consistent with guidance pro-
vided by the Commission and recognized industry prac-
tices for safety and security on the day before the date 
of enactment of this Act. 
(d) TECHNOLOGICAL MEANS.—In a rule prescribed 
under subsection (a), the Commission may not require a 
specific technological means of meeting a requirement. 
SEC. 112. ACCOUNTABILITY. 
Each covered entity shall, in a manner proportional 
to the size, type, and nature of the covered information 
it collects— 
(1) have managerial accountability, proportional 
to the size and structure of the covered entity, for 
the adoption and implementation of policies con-
sistent with this title; 
(2) have a process to respond to non-frivolous 
inquiries from individuals regarding the collection, 
use, transfer, or storage of covered information re-
lating to such individuals; and 
(3) describe the means of compliance of the cov-
ered entity with the requirements of this Act upon 
request from— 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(A) the Commission; or 
(B) an appropriate safe harbor program 
established under section 151. 
SEC. 113. PRIVACY BY DESIGN. 
Each covered entity shall, in a manner proportional 
to the size, type, and nature of the covered information 
that it collects, implement a comprehensive information 
privacy program by— 
(1) incorporating necessary development proc-
esses and practices throughout the product life cycle 
that are designed to safeguard the personally identi-
fiable information that is covered information of in-
dividuals based on— 
(A) the reasonable expectations of such in-
dividuals regarding privacy; and 
(B) the relevant threats that need to be 
guarded against in meeting those expectations; 
and 
(2) maintaining appropriate management proc-
esses and practices throughout the data life cycle 
that are designed to ensure that information systems 
comply with— 
(A) the provisions of this title; 
(B) the privacy policies of a covered entity; 
and 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(C) the privacy preferences of individuals 
that are consistent with the consent choices and 
related mechanisms of individual participation 
as described in section 122. 
Subtitle B—Right to Notice and 
Individual Participation 
SEC. 121. TRANSPARENT NOTICE OF PRACTICES AND PUR-
POSES. 
(a) IN GENERAL.—Not later than 60 days after the 
date of enactment of this Act, the Commission shall ini-
tiate a rulemaking proceeding to require each covered enti-
ty— 
(1) to provide accurate, clear, concise, and 
timely notice to individuals of— 
(A) the practices of the covered entity re-
garding the collection, use, transfer, and stor-
age of covered information; and 
(B) the specific purposes of those prac-
tices; 
(2) to provide accurate, clear, concise, and 
timely notice to individuals before implementing a 
material change in such practices; and 
(3) to maintain the notice required by para-
graph (1) in a form that individuals can readily ac-
cess. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(b) COMPLIANCE AND OTHER CONSIDERATIONS.—In 
the rulemaking required by subsection (a), the Commis-
sion— 
(1) shall consider the types of devices and 
methods individuals will use to access the required 
notice; 
(2) may provide that a covered entity unable to 
provide the required notice when information is col-
lected may comply with the requirement of sub-
section (a)(1) by providing an alternative time and 
means for an individual to receive the required no-
tice promptly; 
(3) may draft guidance for covered entities to 
use in designing their own notice and may include 
a draft model template for covered entities to use in 
designing their own notice; and 
(4) may provide guidance on how to construct 
computer-readable notices or how to use other tech-
nology to deliver the required notice. 
SEC. 122. INDIVIDUAL PARTICIPATION. 
(a) IN GENERAL.—Not later than 180 days after the 
date of enactment of this Act, the Commission shall ini-
tiate a rulemaking proceeding to require each covered enti-
ty— 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(1) to offer individuals a clear and conspicuous 
mechanism for opt-in consent for any use of their 
covered information that would otherwise be unau-
thorized use; 
(2) to offer individuals a robust, clear, and con-
spicuous mechanism for opt-in consent for the use 
by third parties of the individuals’ covered informa-
tion for behavioral advertising or marketing; 
(3) to provide any individual to whom the per-
sonally identifiable information that is covered infor-
mation pertains, and which the covered entity or its 
service provider stores, appropriate and reasonable— 
(A) access to such information; and 
(B) mechanisms to correct such informa-
tion to improve the accuracy of such informa-
tion; and 
(4) in the case that a covered entity enters 
bankruptcy or an individual requests the termination 
of a service provided by the covered entity to the in-
dividual or termination of some other relationship 
with the covered entity, to permit the individual to 
easily request that— 
(A) all of the personally identifiable infor-
mation that is covered information that the cov-
ered entity maintains relating to the individual, 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
except for information the individual authorized 
the sharing of or which the individual shared 
with the covered entity in a forum that is wide-
ly and publicly available, be rendered not per-
sonally identifiable; or 
(B) if rendering such information not per-
sonally identifiable is not possible, to cease the 
unauthorized use or transfer to a third party 
for an unauthorized use of such information or 
to cease use of such information for marketing, 
unless such unauthorized use or transfer is oth-
erwise required by a provision of law. 
(b) UNAUTHORIZED USE TRANSFERS.—In the rule-
making required by subsection (a), the Commission shall 
provide that with respect to transfers of covered informa-
tion to a third party for which an individual provides opt- 
in consent, the third party to which the information is 
transferred may not use such information for any unau-
thorized use other than a use— 
(1) specified pursuant to the purposes stated in 
the required notice under section 121(a); and 
(2) authorized by the individual when the indi-
vidual granted consent for the transfer of the infor-
mation to the third party. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(c) ALTERNATIVE MEANS TO TERMINATE USE OF 
COVERED INFORMATION.—In the rulemaking required by 
subsection (a), the Commission shall allow a covered entity 
to provide individuals an alternative means, in lieu of the 
access, consent, and correction requirements, of prohib-
iting a covered entity from use or transfer of that individ-
ual’s covered information. 
(d) SERVICE PROVIDERS.— 
(1) IN GENERAL.—The use of a service provider 
by a covered entity to receive covered information in 
performing services or functions on behalf of and 
under the instruction of the covered entity does not 
constitute an unauthorized use of such information 
by the covered entity if the covered entity and the 
service provider execute a contract that requires the 
service provider to collect, use, and store the infor-
mation on behalf of the covered entity in a manner 
consistent with— 
(A) the requirements of this title; and 
(B) the policies and practices related to 
such information of the covered entity. 
(2) TRANSFERS BETWEEN SERVICE PROVIDERS 
FOR A COVERED ENTITY.—The disclosure by a serv-
ice provider of covered information pursuant to a 
contract with a covered entity to another service pro-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS