makes unavailable the equal enjoyment of goods or 
services on the basis of race, color, religion, national 
origin, sex, or disability. 
(2) EXCEPTIONS.—This subsection shall not 
apply to— 
(A) the collection, processing, or transfer of 
covered data for the purpose of— 
(i) a covered entity’s or a service pro-
vider’s self-testing to prevent or mitigate 
unlawful discrimination; or 
(ii) diversifying an applicant, partici-
pant, or customer pool; or 
(B) any private club or group not open to 
the public, as described in section 201(e) of the 
Civil Rights Act of 1964 (42 U.S.C. 2000a(e)). 
(b) FTC ENFORCEMENT ASSISTANCE.— 
(1) IN GENERAL.—Whenever the Commission ob-
tains information that a covered entity or service pro-
vider may have collected, processed, or transferred 
covered data in violation of subsection (a), the Com-
mission shall transmit such information as allowable 
under Federal law to any Executive agency with au-
thority to initiate enforcement actions or proceedings 
relating to such violation. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(2) ANNUAL REPORT.—Not later than 3 years 
after the date of enactment of this Act, and annually 
thereafter, the Commission shall submit to Congress a 
report that includes a summary of— 
(A) the types of information the Commis-
sion transmitted to Executive agencies under 
paragraph (1) during the previous 1-year period; 
and 
(B) how such information relates to Federal 
civil rights laws. 
(3) TECHNICAL
ASSISTANCE.—In transmitting 
information under paragraph (1), the Commission 
may consult and coordinate with, and provide tech-
nical and investigative assistance, as appropriate, to 
such Executive agency. 
(4) COOPERATION WITH OTHER AGENCIES.—The 
Commission may implement this subsection by exe-
cuting agreements or memoranda of understanding 
with the appropriate Executive agencies. 
(c) COVERED
ALGORITHM
IMPACT
AND
EVALUA-
TION.— 
(1) COVERED
ALGORITHM
IMPACT
ASSESS-
MENT.— 
(A) 
IMPACT
ASSESSMENT.—Notwith-
standing any other provision of law, not later 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
than 2 years after the date of enactment of this 
Act, and annually thereafter, a large data holder 
that uses a covered algorithm in a manner that 
poses a consequential risk of harm to an indi-
vidual or group of individuals, and uses such 
covered algorithm solely or in part, to collect, 
process, or transfer covered data shall conduct an 
impact assessment of such algorithm in accord-
ance with subparagraph (B). 
(B) IMPACT ASSESSMENT SCOPE.—The im-
pact assessment required under subparagraph 
(A) shall provide the following: 
(i) A detailed description of the design 
process and methodologies of the covered al-
gorithm. 
(ii) A statement of the purpose and 
proposed uses of the covered algorithm. 
(iii) A detailed description of the data 
used by the covered algorithm, including the 
specific categories of data that will be proc-
essed as input and any data used to train 
the model that the covered algorithm relies 
on, if applicable. 
(iv) A description of the outputs pro-
duced by the covered algorithm. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(v) An assessment of the necessity and 
proportionality of the covered algorithm in 
relation to its stated purpose. 
(vi) A detailed description of steps the 
large data holder has taken or will take to 
mitigate potential harms from the covered 
algorithm to an individual or group of in-
dividuals, including related to— 
(I) covered minors; 
(II) making or facilitating adver-
tising for, or determining access to, or 
restrictions on the use of housing, edu-
cation, employment, healthcare, insur-
ance, or credit opportunities; 
(III) determining access to, or re-
strictions on the use of, any place of 
public accommodation, particularly as 
such harms relate to the protected char-
acteristics of individuals, including 
race, color, religion, national origin, 
sex, or disability; 
(IV) disparate impact on the basis 
of individuals’ race, color, religion, na-
tional origin, sex, or disability status; 
or 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(V) disparate impact on the basis 
of individuals’ political party registra-
tion status. 
(2) ALGORITHM DESIGN EVALUATION.—Notwith-
standing any other provision of law, not later than 
2 years after the date of enactment of this Act, a cov-
ered entity or service provider that knowingly devel-
ops a covered algorithm that is designed to, solely or 
in part, to collect, process, or transfer covered data in 
furtherance of a consequential decision shall prior to 
deploying the covered algorithm in interstate com-
merce evaluate the design, structure, and inputs of the 
covered algorithm, including any training data used 
to develop the covered algorithm, to reduce the risk of 
the potential harms identified under paragraph 
(1)(B). 
(3) OTHER CONSIDERATIONS.— 
(A) FOCUS.—In complying with para-
graphs (1) and (2), a covered entity and a serv-
ice provider may focus the impact assessment or 
evaluation on any covered algorithm, or portions 
of a covered algorithm, that will be put to use 
and may reasonably contribute to the risk of the 
potential harms identified under paragraph 
(1)(B). 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(B) AVAILABILITY.— 
(i) IN GENERAL.—A covered entity and 
a service provider— 
(I) shall, not later than 30 days 
after completing an impact assessment 
or evaluation, submit the impact as-
sessment or evaluation conducted under 
paragraph (1) or (2) to the Commis-
sion; 
(II) shall, upon request, make 
such impact assessment and evaluation 
available to Congress; and 
(III) may make a summary of 
such impact assessment and evaluation 
publicly available in a place that is 
easily accessible to individuals. 
(ii) TRADE SECRETS.—Covered entities 
and service providers may redact and seg-
regate any trade secret (as defined in sec-
tion 1839 of title 18, United States Code) or 
other confidential or proprietary informa-
tion from public disclosure under this sub-
paragraph and the Commission shall abide 
by its obligations under section 6(f) of the 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
Federal Trade Commission Act (15 U.S.C. 
46(f)) in regard to such information. 
(C) ENFORCEMENT.—The Commission may 
not use any information obtained solely and ex-
clusively through a covered entity or a service 
provider’s disclosure of information to the Com-
mission in compliance with this section for any 
purpose other than enforcing this Act with the 
exception of enforcing consent orders, including 
the study and report provisions in paragraph 
(6). This subparagraph does not preclude the 
Commission from providing this information to 
Congress in response to a subpoena. 
(4) GUIDANCE.—Not later than 2 years after the 
date of enactment of this Act, the Commission shall, 
in consultation with the Secretary of Commerce, or 
their respective designees, publish guidance regarding 
compliance with this section. 
(5) RULEMAKING AND EXEMPTION.—The Com-
mission shall have authority under section 553 of title 
5, United States Code, to promulgate regulations as 
necessary to establish processes by which a large data 
holder— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(A) shall submit an impact assessment to 
the Commission under paragraph (3)(B)(i)(I); 
and 
(B) may exclude from this subsection any 
covered algorithm that presents low or minimal 
consequential risk of harm to an individual or 
group of individuals. 
(6) STUDY AND REPORT.— 
(A) STUDY.—The Commission, in consulta-
tion with the Secretary of Commerce or the Sec-
retary’s designee, shall conduct a study, to re-
view any impact assessment or evaluation sub-
mitted under this subsection. Such study shall 
include an examination of— 
(i) best practices for the assessment 
and evaluation of covered algorithms; and 
(ii) methods to reduce the risk of harm 
to individuals that may be related to the 
use of covered algorithms. 
(B) REPORT.— 
(i) INITIAL REPORT.—Not later than 3 
years after the date of enactment of this Act, 
the Commission, in consultation with the 
Secretary of Commerce or the Secretary’s 
designee, shall submit to Congress a report 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
containing the results of the study con-
ducted under subparagraph (A), together 
with recommendations for such legislation 
and administrative action as the Commis-
sion determines appropriate. 
(ii) ADDITIONAL REPORTS.—Not later 
than 3 years after submission of the initial 
report under clause (i), and as the Commis-
sion determines necessary thereafter, the 
Commission shall submit to Congress an 
updated version of such report. 
SEC. 208. DATA SECURITY AND PROTECTION OF COVERED 
DATA. 
(a) ESTABLISHMENT
OF
DATA
SECURITY
PRAC-
TICES.— 
(1) IN GENERAL.—A covered entity or service 
provider shall establish, implement, and maintain 
reasonable administrative, technical, and physical 
data security practices and procedures to protect and 
secure covered data against unauthorized access and 
acquisition. 
(2) CONSIDERATIONS.—The reasonable adminis-
trative, technical, and physical data security prac-
tices required under paragraph (1) shall be appro-
priate to— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(A) the size and complexity of the covered 
entity or service provider; 
(B) the nature and scope of the covered enti-
ty or the service provider’s collecting, processing, 
or transferring of covered data; 
(C) the volume and nature of the covered 
data collected, processed, or transferred by the 
covered entity or service provider; 
(D) the sensitivity of the covered data col-
lected, processed, or transferred; 
(E) the current state of the art (and limita-
tions thereof) in administrative, technical, and 
physical safeguards for protecting such covered 
data; and 
(F) the cost of available tools to improve se-
curity and reduce vulnerabilities to unauthorized 
access and acquisition of such covered data in re-
lation to the risks and nature of the covered 
data. 
(b) SPECIFIC REQUIREMENTS.—The data security 
practices of the covered entity and of the service provider 
required under subsection (a) shall include, for each respec-
tive entity’s own system or systems, at a minimum, the fol-
lowing practices: 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(1) ASSESS VULNERABILITIES.—Identifying and 
assessing any material internal and external risk to, 
and vulnerability in, the security of each system 
maintained by the covered entity that collects, proc-
esses, or transfers covered data, or service provider 
that collects, processes, or transfers covered data on 
behalf of the covered entity, including unauthorized 
access to or risks to such covered data, human 
vulnerabilities, access rights, and the use of service 
providers. With respect to large data holders, such ac-
tivities shall include a plan to receive and reasonably 
respond to unsolicited reports of vulnerabilities by 
any entity or individual and by performing a reason-
able investigation of such reports. 
(2) PREVENTIVE
AND
CORRECTIVE
ACTION.— 
Taking preventive and corrective action designed to 
mitigate reasonably foreseeable risks or vulnerabilities 
to covered data identified by the covered entity or 
service provider, consistent with the nature of such 
risk or vulnerability and the entity’s role in col-
lecting, processing, or transferring the data. Such ac-
tion may include implementing administrative, tech-
nical, or physical safeguards or changes to data secu-
rity practices or the architecture, installation, or im-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
plementation of network or operating software, among 
other actions. 
(3) EVALUATION OF PREVENTIVE AND CORREC-
TIVE
ACTION.—Evaluating and making reasonable 
adjustments to the action described in paragraph (2) 
in light of any material changes in technology, inter-
nal or external threats to covered data, and the cov-
ered entity or service provider’s own changing busi-
ness arrangements or operations. 
(4) INFORMATION RETENTION AND DISPOSAL.— 
Disposing of covered data in accordance with a reten-
tion schedule that shall require the deletion of covered 
data when such data is required to be deleted by law 
or is no longer necessary for the purpose for which the 
data was collected, processed, or transferred, unless an 
individual has provided affirmative express consent to 
such retention. Such disposal shall include destroying, 
permanently erasing, or otherwise modifying the cov-
ered data to make such data permanently unreadable 
or indecipherable and unrecoverable to ensure ongoing 
compliance with this section. Service providers shall 
establish practices to delete or return covered data to 
a covered entity as requested at the end of the provi-
sion of services unless retention of the covered data is 
required by law, consistent with section 302(a)(6). 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(5) TRAINING.—Training each employee with ac-
cess to covered data on how to safeguard covered data 
and updating such training as necessary. 
(6) DESIGNATION.—Designating an officer, em-
ployee, or employees to maintain and implement such 
practices. 
(7) INCIDENT RESPONSE.—Implementing proce-
dures to detect, respond to, or recover from security 
incidents, including breaches. 
(c) REGULATIONS.—The Commission may promulgate, 
in accordance with section 553 of title 5, United States 
Code, technology-neutral regulations to establish processes 
for complying with this section. The Commission shall con-
sult with the National Institute of Standards and Tech-
nology in establishing such processes. 
SEC. 209. SMALL BUSINESS PROTECTIONS. 
(a) ESTABLISHMENT OF EXEMPTION.—Any covered 
entity or service provider that can establish that it met the 
requirements described in subsection (b) for the period of 
the 3 preceding calendar years (or for the period during 
which the covered entity or service provider has been in ex-
istence if such period is less than 3 years) shall— 
(1) be exempt from compliance with section 
203(a)(4), paragraphs (1) through (3) and (5) 
through (7) of section 208(b), and section 301(c); and 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(2) at the covered entity’s sole discretion, have 
the option of complying with section 203(a)(2) by, 
after receiving a verified request from an individual 
to correct covered data of the individual under such 
section, deleting such covered data in its entirety in-
stead of making the requested correction. 
(b) EXEMPTION REQUIREMENTS.—The requirements of 
this subsection are, with respect to a covered entity or a 
service provider, the following: 
(1) The covered entity or service provider’s aver-
age annual gross revenues during the period did not 
exceed $41,000,000. 
(2) The covered entity or service provider, on av-
erage, did not annually collect or process the covered 
data of more than 200,000 individuals during the pe-
riod beyond the purpose of initiating, rendering, bill-
ing for, finalizing, completing, or otherwise collecting 
payment for a requested service or product, so long as 
all covered data for such purpose was deleted or de- 
identified within 90 days, except when necessary to 
investigate fraud or as consistent with a covered enti-
ty’s return policy. 
(3) The covered entity or service provider did not 
derive more than 50 percent of its revenue from trans-
ferring covered data during any year (or part of a 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
year if the covered entity has been in existence for less 
than 1 year) that occurs during the period. 
(c) REVENUE DEFINED.—For purposes of this section, 
the term ‘‘revenue’’ as it relates to any covered entity or 
service provider that is not organized to carry on business 
for its own profit or that of its members, means the gross 
receipts the covered entity or service provider received in 
whatever form from all sources without subtracting any 
costs or expenses, and includes contributions, gifts, grants, 
dues or other assessments, income from investments, or pro-
ceeds from the sale of real or personal property. 
SEC. 210. UNIFIED OPT-OUT MECHANISMS. 
(a) IN GENERAL.—For the rights established under 
subsection (b) of section 204, subsection (c) of section 204 
(except as provided for under section 101(b)(16)), and sec-
tion 206(b)(3)(C), following public notice and opportunity 
to comment and not later than 18 months after the date 
of enactment of this Act, the Commission shall establish or 
recognize one or more acceptable privacy protective, central-
ized mechanisms, including global privacy signals such as 
browser or device privacy settings, other tools offered by cov-
ered entities or service providers, and registries of identi-
fiers, for individuals to exercise all such rights through a 
single interface for a covered entity or service provider to 
utilize to allow an individual to make such opt out designa-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
tions with respect to covered data related to such indi-
vidual. 
(b) REQUIREMENTS.—Any such centralized opt-out 
mechanism shall— 
(1) require covered entities or service providers 
acting on behalf of covered entities to inform individ-
uals about the centralized opt-out choice; 
(2) not be required to be the default setting, but 
may be the default setting provided that in all cases 
the mechanism clearly represents the individual’s af-
firmative, freely given, and unambiguous choice to 
opt out; 
(3) be consumer-friendly, clearly described, and 
easy-to-use by a reasonable individual; 
(4) permit the covered entity or service provider 
acting on behalf of a covered entity to have an au-
thentication process the covered entity or service pro-
vider acting on behalf of a covered entity may use to 
determine if the mechanism represents a legitimate 
request to opt out; 
(5) be provided in any covered language in 
which the covered entity provides products or services 
subject to the opt-out; and 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(6) be provided in a manner that is reasonably 
accessible to and usable by individuals with disabil-
ities. 
TITLE III—CORPORATE 
ACCOUNTABILITY 
SEC. 301. EXECUTIVE RESPONSIBILITY. 
(a) IN GENERAL.—Beginning 1 year after the date of 
enactment of this Act, an executive officer of a large data 
holder shall annually certify, in good faith, to the Commis-
sion, in a manner specified by the Commission by regula-
tion under section 553 of title 5, United States Code, that 
the entity maintains— 
(1) internal controls reasonably designed to com-
ply with this Act; and 
(2) internal reporting structures to ensure that 
such certifying executive officer is involved in and re-
sponsible for the decisions that impact the compliance 
by the large data holder with this Act. 
(b) REQUIREMENTS.—A certification submitted under 
subsection (a) shall be based on a review of the effectiveness 
of the internal controls and reporting structures of the large 
data holder that is conducted by the certifying executive of-
ficer not more than 90 days before the submission of the 
certification. A certification submitted under subsection (a) 
is made in good faith if the certifying officer had, after a 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
reasonable investigation, reasonable ground to believe and 
did believe, at the time that certification was submitted, 
that the statements therein were true and that there was 
no omission to state a material fact required to be stated 
therein or necessary to make the statements therein not mis-
leading. 
(c) DESIGNATION OF PRIVACY AND DATA SECURITY 
OFFICER.— 
(1) IN GENERAL.—A covered entity or service 
provider that have more than 15 employees, shall des-
ignate— 
(A) 1 or more qualified employees as pri-
vacy officers; and 
(B) 1 or more qualified employees (in addi-
tion to any employee designated under subpara-
graph (A)) as data security officers. 
(2) REQUIREMENTS
FOR
OFFICERS.—An em-
ployee who is designated by a covered entity or a 
service provider as a privacy officer or a data secu-
rity officer pursuant to paragraph (1) shall, at a 
minimum— 
(A) implement a data privacy program and 
data security program to safeguard the privacy 
and security of covered data in compliance with 
the requirements of this Act; and 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(B) facilitate the covered entity or service 
provider’s ongoing compliance with this Act. 
(3) ADDITIONAL
REQUIREMENTS
FOR
LARGE 
DATA HOLDERS.—A large data holder shall designate 
at least 1 of the officers described in paragraph (1) 
to report directly to the highest official at the large 
data holder as a privacy protection officer who shall, 
in addition to the requirements in paragraph (2), ei-
ther directly or through a supervised designee or des-
ignees— 
(A) establish processes to periodically review 
and update the privacy and security policies, 
practices, and procedures of the large data hold-
er, as necessary; 
(B) conduct biennial and comprehensive au-
dits to ensure the policies, practices, and proce-
dures of the large data holder ensure the large 
data holder is in compliance with this Act and 
ensure such audits are accessible to the Commis-
sion upon request; 
(C) develop a program to educate and train 
employees about compliance requirements of this 
Act; 
(D) maintain updated, accurate, clear, and 
understandable records of all material privacy 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
and data security practices undertaken by the 
large data holder; and 
(E) serve as the point of contact between the 
large data holder and enforcement authorities. 
(d) LARGE DATA HOLDER PRIVACY IMPACT ASSESS-
MENTS.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act or 1 year after the 
date on which a covered entity first meets the defini-
tion of large data holder, whichever is earlier, and bi-
ennially thereafter, each covered entity that is a large 
data holder shall conduct a privacy impact assess-
ment that weighs the benefits of the large data hold-
er’s covered data collecting, processing, and transfer 
practices against the potential adverse consequences of 
such practices, including substantial privacy risks, to 
individual privacy. 
(2) ASSESSMENT
REQUIREMENTS.—A privacy 
impact assessment required under paragraph (1) shall 
be— 
(A) reasonable and appropriate in scope 
given— 
(i) the nature of the covered data col-
lected, processed, and transferred by the 
large data holder; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(ii) the volume of the covered data col-
lected, processed, and transferred by the 
large data holder; and 
(iii) the potential material risks posed 
to the privacy of individuals by the col-
lecting, processing, and transfer of covered 
data by the large data holder; 
(B) documented in written form and main-
tained by the large data holder unless rendered 
out of date by a subsequent assessment conducted 
under paragraph (1); and 
(C) approved by the privacy protection offi-
cer designated in subsection (c)(3) of the large 
data holder, as applicable. 
(3) ADDITIONAL FACTORS TO INCLUDE IN AS-
SESSMENT.—In assessing the privacy risks, including 
substantial privacy risks, the large data holder must 
include reviews of the means by which technologies, 
including blockchain and distributed ledger tech-
nologies and other emerging technologies, are used to 
secure covered data. 
(e) OTHER PRIVACY IMPACT ASSESSMENTS.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act and biennially there-
after, each covered entity that is not large data holder 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
100 
and does not meet the requirements for covered enti-
ties under section 209 shall conduct a privacy impact 
assessment. Such assessment shall weigh the benefits 
of the covered entity’s covered data collecting, proc-
essing, and transfer practices that may cause a sub-
stantial privacy risk against the potential material 
adverse consequences of such practices to individual 
privacy. 
(2) ASSESSMENT
REQUIREMENTS.—A privacy 
impact assessment required under paragraph (1) shall 
be— 
(A) reasonable and appropriate in scope 
given— 
(i) the nature of the covered data col-
lected, processed, and transferred by the cov-
ered entity; 
(ii) the volume of the covered data col-
lected, processed, and transferred by the cov-
ered entity; and 
(iii) the potential risks posed to the 
privacy of individuals by the collecting, 
processing, and transfer of covered data by 
the covered entity; and 
(B) documented in written form and main-
tained by the covered entity unless rendered out 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
101 
of date by a subsequent assessment conducted 
under paragraph (1). 
(3) ADDITIONAL FACTORS TO INCLUDE IN AS-
SESSMENT.—In assessing the privacy risks, including 
substantial privacy risks, the covered entity may in-
clude reviews of the means by which technologies, in-
cluding blockchain and distributed ledger technologies 
and other emerging technologies, are used to secure 
covered data. 
SEC. 302. SERVICE PROVIDERS AND THIRD PARTIES. 
(a) SERVICE PROVIDERS.—A service provider— 
(1) shall adhere to the instructions of a covered 
entity and only collect, process, and transfer service 
provider data to the extent necessary and propor-
tionate to provide a service requested by the covered 
entity, as set out in the contract required by sub-
section (b), and this paragraph does not require a 
service provider to collect, process, or transfer covered 
data if the service provider would not otherwise do so; 
(2) may not collect, process, or transfer service 
provider data if the service provider has actual 
knowledge that a covered entity violated this Act with 
respect to such data; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
103 
tity with notice and pursuant to a written contract 
that requires such other service provider to satisfy the 
obligations of the service provider with respect to such 
service provider data, including that the other service 
provider be treated as a service provider under this 
Act; 
(5) shall, upon the reasonable request of the cov-
ered entity, make available to the covered entity infor-
mation necessary to demonstrate the compliance of 
the service provider with the requirements of this Act, 
which may include making available a report of an 
independent assessment arranged by the service pro-
vider on terms agreed to by the service provider and 
the covered entity, providing information necessary to 
enable the covered entity to conduct and document a 
privacy impact assessment required by subsection (d) 
or (e) of section 301, and making available the report 
required under section 207(c)(2); 
(6) shall, at the covered entity’s direction, delete 
or return all covered data to the covered entity as re-
quested at the end of the provision of services, unless 
retention of the covered data is required by law; 
(7) shall develop, implement, and maintain rea-
sonable administrative, technical, and physical safe-
guards that are designed to protect the security and 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
104 
confidentiality of covered data the service provider 
processes consistent with section 208; and 
(8) shall allow and cooperate with, reasonable 
assessments by the covered entity or the covered enti-
ty’s designated assessor; alternatively, the service pro-
vider may arrange for a qualified and independent 
assessor to conduct an assessment of the service pro-
vider’s policies and technical and organizational 
measures in support of the obligations under this Act 
using an appropriate and accepted control standard 
or framework and assessment procedure for such as-
sessments. The service provider shall provide a report 
of such assessment to the covered entity upon request. 
(b) CONTRACTS BETWEEN COVERED ENTITIES AND 
SERVICE PROVIDERS.— 
(1) REQUIREMENTS.—A person or entity may 
only act as a service provider pursuant to a written 
contract between the covered entity and the service 
provider, or a written contract between one service 
provider and a second service provider as described 
under subsection (a)(4), if the contract— 
(A) sets forth the data processing procedures 
of the service provider with respect to collection, 
processing, or transfer performed on behalf of the 
covered entity or service provider; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
105 
(B) clearly sets forth— 
(i) instructions for collecting, proc-
essing, or transferring data; 
(ii) the nature and purpose of col-
lecting, processing, or transferring; 
(iii) the type of data subject to col-
lecting, processing, or transferring; 
(iv) the duration of processing; and 
(v) the rights and obligations of both 
parties, including a method by which the 
service provider shall notify the covered en-
tity of material changes to its privacy prac-
tices; 
(C) does not relieve a covered entity or a 
service provider of any requirement or liability 
imposed on such covered entity or service pro-
vider under this Act; and 
(D) prohibits— 
(i) collecting, processing, or transfer-
ring covered data in contravention to sub-
section (a); and 
(ii) combining service provider data 
with covered data which the service provider 
receives from or on behalf of another person 
or persons or collects from the interaction of 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
106 
the service provider with an individual, 
provided that such combining is not nec-
essary to effectuate a purpose described in 
paragraphs (1) through (15) of section 
101(b) and is otherwise permitted under the 
contract required by this subsection. 
(2) CONTRACT
TERMS.—Each service provider 
shall retain copies of previous contracts entered into 
in compliance with this subsection with each covered 
entity to which it provides requested products or serv-
ices. 
(c) RELATIONSHIP BETWEEN COVERED ENTITIES AND 
SERVICE PROVIDERS.— 
(1) Determining whether a person is acting as a 
covered entity or service provider with respect to a 
specific processing of covered data is a fact-based de-
termination that depends upon the context in which 
such data is processed. 
(2) A person that is not limited in its processing 
of covered data pursuant to the instructions of a cov-
ered entity, or that fails to adhere to such instruc-
tions, is a covered entity and not a service provider 
with respect to a specific processing of covered data. 
A service provider that continues to adhere to the in-
structions of a covered entity with respect to a specific 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
107 
processing of covered data remains a service provider. 
If a service provider begins, alone or jointly with oth-
ers, determining the purposes and means of the proc-
essing of covered data, it is a covered entity and not 
a service provider with respect to the processing of 
such data. 
(3) A covered entity that transfers covered data 
to a service provider or a service provider that trans-
fers covered data to a covered entity or another service 
provider, in compliance with the requirements of this 
Act, is not liable for a violation of this Act by the 
service provider or covered entity to whom such cov-
ered data was transferred, if at the time of transfer-
ring such covered data, the covered entity or service 
provider did not have actual knowledge that the serv-
ice provider or covered entity would violate this Act. 
(4) A covered entity or service provider that re-
ceives covered data in compliance with the require-
ments of this Act is not in violation of this Act as 
a result of a violation by a covered entity or service 
provider from which such data was received. 
(d) THIRD PARTIES.—A third party— 
(1) shall not process third party data for a proc-
essing purpose other than, in the case of sensitive cov-
ered data, the processing purpose for which the indi-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
108 
vidual gave affirmative express consent or to effect a 
purpose enumerated in paragraph (1), (3), or (5) of 
section 101(b) and, in the case of non-sensitive data, 
the processing purpose for which the covered entity 
made a disclosure pursuant to section 202(b)(4); and 
(2) for purposes of paragraph (1), may reason-
ably rely on representations made by the covered enti-
ty that transferred the third party data if the third 
party conducts reasonable due diligence on the rep-
resentations of the covered entity and finds those rep-
resentations to be credible. 
(e) ADDITIONAL OBLIGATIONS
ON COVERED ENTI-
TIES.— 
(1) IN GENERAL.—A covered entity or service 
provider shall exercise reasonable due diligence in— 
(A) selecting a service provider; and 
(B) deciding to transfer covered data to a 
third party. 
(2) GUIDANCE.—Not later than 2 years after the 
date of enactment of this Act, the Commission shall 
publish guidance regarding compliance with this sub-
section, taking into consideration the burdens on large 
data holders, covered entities who are not large data 
holders, and covered entities meeting the requirements 
of section 209. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
109 
(f) RULE OF CONSTRUCTION.—Solely for the purposes 
of this section, the requirements for service providers to con-
tract with, assist, and follow the instructions of covered en-
tities shall be read to include requirements to contract with, 
assist, and follow the instructions of a government entity 
if the service provider is providing a service to a govern-
ment entity. 
SEC. 303. TECHNICAL COMPLIANCE PROGRAMS. 
(a) IN GENERAL.—Not later than 3 years after the 
date of enactment of this Act, the Commission shall promul-
gate regulations under section 553 of title 5, United States 
Code, to establish a process for the proposal and approval 
of technical compliance programs under this section used 
by a covered entity to collect, process, or transfer covered 
data. 
(b) SCOPE OF PROGRAMS.—The technical compliance 
programs established under this section shall, with respect 
to a technology, product, service, or method used by a cov-
ered entity to collect, process, or transfer covered data— 
(1) establish publicly available guidelines for 
compliance with this Act; and 
(2) meet or exceed the requirements of this Act. 
(c) APPROVAL PROCESS.— 
(1) IN
GENERAL.—Any request for approval, 
amendment, or repeal of a technical compliance pro-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS