promulgate regulations under section 553 of title 5, 
United States Code, that require covered entities to imple-
ment, practice, and maintain certain data procedures and 
processes that meet the following requirements: 
(1) MINIMUM
DATA
PROCESSING
REQUIRE-
MENTS.—Except as provided in subsection (b), re-
quire covered entities to meet all of the following re-
quirements regarding the means by and purposes for 
which covered data is collected, processed, stored, 
and disclosed: 
(A) REASONABLE.—Except as provided in 
paragraph (3), covered data collection, proc-
essing, storage, and disclosure practices must 
meet a reasonable interest of the covered entity, 
including— 
(i) business, educational, and adminis-
trative operations that are relevant and ap-
propriate to the context of the relationship 
between the covered entity and the indi-
vidual linked to the covered data; 
(ii) relevant and appropriate product 
and service development and enhancement; 
(iii) preventing and detecting abuse, 
fraud, and other criminal activity; 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(iv) reasonable communications and 
marketing practices that follow best prac-
tices, rules, and ethical standards; 
(v) engaging in scientific, medical, or 
statistical research that follows commonly 
accepted ethical standards; or 
(vi) any other purpose for which the 
Commission considers to be reasonable. 
(B) EQUITABLE.—Covered data collection, 
processing, storage, and disclosure practices 
may not be for purposes that result in discrimi-
nation against a protected characteristic, in-
cluding— 
(i) discriminatory targeted advertising 
practices; 
(ii) price, service, or employment op-
portunity discrimination; or 
(iii) any other practice the Commis-
sion considers likely to result in unfair dis-
crimination against a protected char-
acteristic. 
(C) FORTHRIGHT.—Covered data collec-
tion, processing, storage, and disclosure prac-
tices may not be accomplished with means or 
for purposes that are deceptive, including— 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(i) the use of inconspicuous recording 
or tracking devices and methods; 
(ii) the disclosure of covered data that 
a reasonable individual believes to be the 
content of a private communication with 
another party or parties; 
(iii) notices, interfaces, or other rep-
resentations likely to mislead consumers; 
or 
(iv) any other practice that the Com-
mission considers likely to mislead individ-
uals regarding the purposes for and means 
by which covered data is collected, proc-
essed, stored, or disclosed. 
(2) REQUIREMENTS FOR OPT-OUT CONSENT.— 
Except as provided in subsection (b), require covered 
entities to provide individuals with conspicuous ac-
cess to a method that is in easily understandable 
language, concise, accurate, clear, to opt out of any 
collection, processing, storage, or disclosure of cov-
ered data linked to the individual. 
(3) REQUIREMENTS
FOR
AFFIRMATIVE
CON-
SENT.—Except as provided in subsection (b), require 
covered entities to provide individuals with a notice 
that is concise, in easily understandable language, 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
accurate, clear, timely, and conspicuous to express 
affirmative, opt-in consent— 
(A) before the covered entity collects or 
discloses sensitive data linked to the individual; 
or 
(B) before the covered entity collects, proc-
esses, stores, or discloses data for purposes 
which are outside the context of the relationship 
of the covered entity with the individual linked 
to the data, including— 
(i) the use of covered data beyond 
what is necessary to provide, improve, or 
market a good or service that the indi-
vidual requests; 
(ii) the processing or disclosure of 
covered data differs in material ways from 
the purposes described in the privacy pol-
icy that was in effect when the data was 
collected; and 
(iii) any other purpose that Commis-
sion considers outside of context. 
(4) DATA MINIMIZATION REQUIREMENTS.—Ex-
cept as provided in subsection (b), require covered 
entities to— 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(A) take reasonable measures to limit the 
collection, processing, storage, and disclosure of 
covered data to the amount that is necessary to 
carry out the purposes for which the data is col-
lected; and 
(B) store covered data only as long as is 
reasonably necessary to carry out the purposes 
for which the data was collected. 
(b) EXEMPTIONS.—Subsection (a) shall not apply if 
the limitations on the collection, processing, storage, or 
disclosure of covered data would— 
(1) inhibit detection or prevention of a security 
risk or incident; 
(2) risk the health, safety, or property of the 
covered entity or individual; or 
(3) prevent compliance with an applicable law 
(including regulations) or legal process. 
SEC. 5. INDIVIDUAL CONTROL OVER DATA USE. 
(a) REGULATIONS.—Not later than 1 year after the 
date of the enactment of this Act, the Commission shall 
promulgate regulations under section 553 of title 5, 
United States Code, to require covered entities to provide 
conspicuous, understandable, clear, and free of charge 
method to— 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(1) upon the request of an individual, provide 
the individual with access to, or an accurate rep-
resentation of, covered data linked to the individual 
or the individual’s device stored by the covered enti-
ty; 
(2) upon the request of an individual, provide 
the individual with a means to dispute and resolve 
the accuracy or completeness of the covered data 
linked to the individual or the individual’s device 
stored by the entity; 
(3) upon the request of an individual, delete 
any covered data that the covered entity stores 
linked to the individual or the individual’s device; 
and 
(4) when technically feasible, upon the request 
of an individual, allow the individual to transmit or 
transfer covered data linked to the individual or the 
individual’s device that is maintained by the entity 
to the individual in a format that is standardized 
and interoperable. 
(b) PSEUDONYMOUS DATA.—If the covered data that 
an individual has requested processed under subsection (a) 
is pseudonymous data, a covered entity may decline the 
request if processing the request is not technically feasible. 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(c) TIMELINESS OF REQUESTS.—In fulfilling any re-
quests made by the individual under subsection (a) the 
covered entity shall act in as timely a manner as is reason-
ably possible. 
(d) ACCESS TO SAME SERVICE.—A covered entity 
shall not discriminate against an individual because of any 
action the individual took under their rights described in 
subsection (a), including— 
(1) denying goods or services to the individual; 
(2) charging, or advertising, different prices or 
rates for goods or services; or 
(3) providing different quality of goods or serv-
ices. 
(e) CONSIDERATION.—The Commission shall allow a 
covered entity, by contract, to provide relevant obligations 
to the individual under subsection (a) on behalf of a third 
party service provider that collects, processes, stores, or 
discloses covered data only on behalf of the covered entity. 
SEC. 6. INFORMATION SECURITY STANDARDS. 
(a) REQUIRED DATA SECURITY PRACTICES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require covered enti-
ties to establish and implement policies and proce-
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
dures regarding information security practices for 
the treatment and protection of covered data taking 
into consideration— 
(A) the level of identifiability of the cov-
ered data and the associated privacy risk; 
(B) the sensitivity of the covered data col-
lected, processed, and stored and the associated 
privacy risk; 
(C) the currently available and widely ac-
cepted technological, administrative, and phys-
ical means to protect personal data under the 
control of the covered entity; 
(D) the cost associated with implementing, 
maintaining, and regularly reviewing the safe-
guards; and 
(E) the impact of these requirements on 
small and medium-sized businesses. 
(2) LIMITATIONS.—In promulgating the regula-
tions required under this section, the Commission 
shall consider a covered entity who is in compliance 
with existing information security laws that the 
Commission determines are sufficiently rigorous to 
be in compliance with this section with respect to 
particular types of covered data to the extent those 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
types of covered data are covered by such law, in-
cluding the following: 
(A) Title V of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6801 et seq.). 
(B) The Health Information Technology 
for Economic and Clinical Health Act (42 
U.S.C. 17931). 
(C) The Health Insurance Portability and 
Accountability Act of 1996 Security Rule (45 
CFR 160.103 and part 164). 
(D) Any other existing law requiring a cov-
ered entity to implement and maintain informa-
tion security practices and procedures that the 
Commission determines to be sufficiently rig-
orous. 
SEC. 7. PRIVACY PROTECTION OFFICERS. 
(a) APPOINTMENT OF A PRIVACY PROTECTION OFFI-
CER.—Each covered entity with annual revenue in excess 
of $25,000,000 the prior year shall designate at least 1 
appropriately qualified employee as a privacy protection 
officer who shall— 
(1) educate employees about compliance re-
quirements; 
(2) train employees involved in data processing; 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
(3) conduct regular, comprehensive audits to 
ensure compliance and make records of the audits 
available to enforcement authorities upon request; 
(4) maintain updated, clear, and understand-
able records of all data security practices undertaken 
by the covered entity; 
(5) serve as the point of contact between the 
covered entity and enforcement authorities; and 
(6) advocate for policies and practices within 
the covered entity that promote individual privacy. 
(b) PROTECTIONS.—The privacy protection officer 
shall not be dismissed or otherwise penalized by the cov-
ered entity for performing any of the tasks assigned to 
the person under this section. 
SEC. 8. RESEARCH INTO PRIVACY ENHANCING TECH-
NOLOGY. 
Section 4(a) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7403(a)) is amended— 
(1) by striking the subsection heading and in-
serting the following: 
‘‘(a) NETWORK SECURITY AND INFORMATION PRI-
VACY RESEARCH GRANTS.—’’; and 
(2) in paragraph (1), by striking subparagraph 
(D) and inserting the following: 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(D) privacy and confidentiality, includ-
ing— 
‘‘(i) cryptography; 
‘‘(ii) anonymization; 
‘‘(iii) pseudonymization; 
‘‘(iv) filtering tools; 
‘‘(v) anti-spying and anti-tracking 
tools; and 
‘‘(vi) any other technology that the 
Director determines will enhance individual 
privacy;’’. 
SEC. 9. ENFORCEMENT. 
(a) ENFORCEMENT BY THE COMMISSION.— 
(1) IN
GENERAL.—Except as otherwise pro-
vided, this Act and the regulations prescribed under 
this Act shall be enforced by the Commission under 
the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.). 
(2) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this Act or a regulation pre-
scribed under this Act shall be treated as a violation 
of a rule defining an unfair or deceptive act or prac-
tice prescribed under section 18(a)(1)(B) of the Fed-
eral 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
VerDate Sep 11 2014 
22:55 Nov 28, 2020
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H8749.IH
H8749
pbinns on DSKJLVW7X2PROD with BILLS