(c) REQUIREMENTS
OF SELF-REGULATORY PRO-
GRAM.—A self-regulatory program complies with the re-
quirements of this subsection if the program provides each 
of the following: 
(1) Guidelines and procedures requiring a pro-
gram participant to provide substantially equivalent 
or greater protections for consumers and their per-
sonally identifiable information as are provided 
under sections 4 through 8. 
(2) Procedures and requirements to provide 
for— 
(A) an initial review of a participant’s pri-
vacy statement and privacy policy, and subse-
quent review whenever such statement or policy 
is substantively changed; 
(B) a participant’s self-review and self-cer-
tification of its privacy policy and practices to 
ensure compliance with the guidelines, proce-
dures, requirements, and restrictions of the pro-
gram established under this subsection; 
(C) a participant’s subsequent periodic 
self-reviews and self-certifications, which shall 
occur at least annually, of the its privacy policy 
and practices to ensure continued compliance 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
with such guidelines, procedures, requirements, 
and restrictions; 
(D) submission of self-reviews and self-cer-
tifications under this paragraph to any adminis-
trator of the program; and 
(E) random review of participants, which 
may concentrate on selected compliance issues, 
if the self-regulatory program conducts— 
(i) random compliance tests with re-
spect to each participant not less fre-
quently than every 3 years; 
(ii) a full compliance test of a par-
ticular participant in any case where non- 
compliance with any of the selected compli-
ance issues has been identified; and 
(iii) full compliance tests of partici-
pants with a high number of complaints 
against them. 
(3) Procedures and requirements that ensure 
that a program participant provides a process for re-
solving disputes with consumers relating to the pri-
vacy policy and practices of the participant. Such 
dispute resolution process— 
(A) must be available without charge to a 
consumer; 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(B) must be available at a cost to the par-
ticipant that is reasonable and does not discour-
age participation by the participant in such 
process; 
(C) must ensure that consumers are in-
formed of how to utilize the process; 
(D) may include, as one choice among oth-
ers, binding arbitration; and 
(E)(i) must be completed within 60 days 
after submission of the dispute by the con-
sumer; or 
(ii) must be completed within 90 days after 
submission of the dispute by the consumer, if 
the participant— 
(I) determines that additional time is 
required to obtain information to make an 
informed decision with respect to the dis-
pute; and 
(II) notifies the consumer and the 
self-regulatory program that such addi-
tional time is required. 
(4) Provisions for the use by participants in the 
program of a means (including the use of a seal) to 
represent the participant’s participation in the pro-
gram. 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(5) With respect to any nonvoluntary suspen-
sion or termination of participation in the program 
because of the participant’s failure to comply with 
the program, procedures or requirements to provide 
for the following: 
(A) Publication of notice and the reasons 
for any such suspension or termination, except 
that no personally identifiable information re-
lated to such suspension or termination may be 
published. 
(B) Notice to the Commission of any such 
termination. 
(6) Requirements and restrictions that assure 
independence with respect to program eligibility, 
compliance, and dispute resolution mechanisms and 
decisions from improper interference by management 
or ownership of the self-regulatory program partici-
pant. 
(7) A process for a noncompliant participant to 
take timely remedial action in order to come back 
into compliance with the program before suspension 
or termination of participation in the program. 
(d) CONSUMER DISPUTE RESOLUTION.— 
(1) SELF-REGULATORY DISPUTE PROCESS.—If 
a consumer has a dispute with a participant in a 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
self-regulatory program under this section or under 
section 5 of the Federal Trade Commission Act (15 
U.S.C. 45) to the extent that such dispute pertains 
to the entity’s privacy policy or practices required 
for participation in the self-regulatory program, the 
consumer shall initially seek resolution through the 
participant’s dispute resolution process (established 
in accordance with subsection (c)(3)). The Commis-
sion shall promptly refer to the participant involved 
any dispute submitted to the Commission for which 
resolution has not been initially sought through such 
process. 
(2) RESOLUTION BY COMMISSION.—A consumer 
may submit to the Commission for resolution a dis-
pute with a participant in a self-regulatory program 
under this section, if the following requirements are 
met: 
(A) The dispute was initially submitted 
under paragraph (1) for resolution through the 
participant’s dispute resolution process. 
(B) The dispute submitted under para-
graph (1) is not resolved— 
(i) within 60 days after submission of 
the dispute by the consumer; or 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(ii) to the satisfaction of the con-
sumer. 
(C) Notice of the facts of the dispute is 
submitted to the Commission not later than 30 
days after the date on which the consumer is 
notified of the resolution through the partici-
pant’s dispute resolution process. 
(D) The consumer has not voluntarily ac-
cepted a resolution of the dispute under para-
graph (1). 
(E) The dispute was not resolved through 
binding arbitration. 
(3) LIMITATION.—Nothing in this Act shall 
prevent the Commission from investigating compli-
ance with this Act by a participant in a self-regu-
latory covered entity based upon a complaint from 
an individual or covered entity other than a con-
sumer with a dispute with such participant, or on its 
own initiative, except that prior to instituting any 
such investigation the Commission shall afford the 
self-regulatory covered entity a reasonable oppor-
tunity to invoke its own remedial procedures and as-
sure compliance by the participant. 
(4) CLEAR AND CONVINCING EVIDENCE.—The 
presumption established by paragraph (1) of sub-
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
section (a) may be overcome by clear and convincing 
evidence of non-compliance. 
(e) NONRELEASE OF CERTAIN INFORMATION.—The 
Commission may not compel a participant in a self-regu-
latory program approved under subsection (b) (or an ad-
ministrator of such a program) to provide proprietary in-
formation or personally identifiable information of con-
sumers to the Commission unless the Commission provides 
assurances that such information will not be released to 
the public. 
(f) MISREPRESENTATION
OF
SELF-REGULATORY 
PROGRAM PARTICIPATION.—It is unlawful for a covered 
entity to misrepresent that it is a participant in a self- 
regulatory program (including through any mechanism 
provided under subsection (c)(4)) when such covered enti-
ty is not, in fact, such a participant. 
(g) EXEMPTED ENTITY PARTICIPATION.—An entity 
that is not a covered entity and that voluntarily partici-
pates in a self-regulatory program under this section shall 
enjoy the rights and benefits provided under this section 
in any action or investigation under section 5 of the Fed-
eral Trade Commission Act (15 U.S.C. 45) to the extent 
that such action or investigation pertains to the entity’s 
privacy policy or practices required for participation in the 
self-regulatory program. 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
SEC. 10. ENFORCEMENT. 
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—A 
violation of any provision of this Act by a covered entity 
is an unfair or deceptive act or practice unlawful under 
section 5(a)(1) of the Federal Trade Commission Act (15 
U.S.C. 45(a)(1)), except that the amount of any civil pen-
alty under such Act shall be doubled for a violation of this 
Act, but may not exceed $500,000 for all related violations 
by a single violator (without respect to the number of con-
sumers affected or the duration of the related violations). 
(b) GUIDELINES AND OPINIONS.—In order to assist 
in compliance with this Act, the Federal Trade Commis-
sion may promulgate regulations and interpretive rules 
under section 18 of the Federal Trade Commission Act 
(15 U.S.C. 57a), with respect to specific types of acts or 
practices that would, or would not, comply with this Act. 
SEC. 11. NO PRIVATE RIGHT OF ACTION. 
This Act may not be considered or construed to pro-
vide any private right of action. No private civil action 
relating to any act or practice governed under this Act 
may be commenced or maintained in any State court or 
under State law (including a pendent State claim to an 
action under Federal law). 
SEC. 12. EFFECT ON OTHER LAWS. 
(a) QUALIFIED EXEMPTION FOR COMPLIANCE WITH 
OTHER FEDERAL PRIVACY LAWS.—To the extent that 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
personally identifiable information protected under this 
Act is also protected under a provision of Federal privacy 
law described in subsection (c), a covered entity that com-
plies with the relevant provision of such other Federal pri-
vacy law shall be deemed to have complied with the cor-
responding provision of this Act. 
(b) PROTECTION
OF OTHER FEDERAL PRIVACY 
LAWS.—Nothing in this Act may be construed to modify, 
limit, supersede, or interfere with the operation of the 
Federal privacy laws described in subsection (c) or the 
provision of information permitted or required, expressly 
or by implication, by such laws, with respect to Federal 
rights and practices. 
(c) OTHER FEDERAL PRIVACY LAWS DESCRIBED.— 
The provisions of law to which subsections (a) and (b) 
apply are the following: 
(1) Section 552a of title 5, United States Code 
(commonly known as the Privacy Act of 1974). 
(2) The Right to Financial Privacy Act of 1978 
(12 U.S.C. 3401 et seq.). 
(3) The Fair Credit Reporting Act (15 U.S.C. 
1681 et seq.). 
(4) The Fair Debt Collection Practices Act (15 
U.S.C. 1692 et seq.). 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(5) The Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6501 et seq.). 
(6) Title V of the Gramm-Leach-Bliley Act of 
1999 (15 U.S.C. 6801 et seq.). 
(7) The Electronic Communications Privacy Act 
of 1986 (Public Law 99–508). 
(8) The Driver’s Privacy Protection Act of 
1994 (18 U.S.C. 2721 et seq.). 
(9) The Family Educational Rights and Privacy 
Act of 1974 (20 U.S.C. 1221 note, 1232g). 
(10) Section 445 of the General Education Pro-
visions Act (20 U.S.C. 1232h). 
(11) The Privacy Protection Act of 1980 (42 
U.S.C. 2000aa et seq.). 
(12) Section 222 of the Communications Act of 
1934 (47 U.S.C. 222) relating to the Customer Pro-
prietary Network Information. 
(13) The Cable Communications Policy Act of 
1984 (47 U.S.C. 521 et seq.). 
(14) The Communications Assistance for Law 
Enforcement Act (47 U.S.C. 1001 et seq.). 
(15) The Video Privacy Protection Act of 1988 
(Public Law 100–618). 
(16) The Telephone Consumer Protection Act 
of 1991 (Public Law 102–243). 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS
(17) The Health Insurance Portability and Ac-
countability Act of 1996 (Public Law 104–191), as 
it relates to an entity described in section 1172(a) 
of the Social Security Act (42 U.S.C. 1320d–1(a)) 
or to activities regulated under section 1173 of such 
Act (42 U.S.C. 1320d–2). 
(18) The CAN–SPAM Act of 2003 (15 U.S.C. 
7701 et seq.). 
(d) PREEMPTION OF STATE PRIVACY LAWS.—This 
Act preempts any statutory law, common law, rule, or reg-
ulation of a State, or a political subdivision of a State, 
to the extent such law, rule, or regulation relates to or 
affects the collection, use, sale, disclosure, retention, or 
dissemination of personally identifiable information in 
commerce. No State, or political subdivision of a State, 
may take any action to enforce this Act. 
SEC. 13. EFFECTIVE DATE. 
This Act shall apply with respect to personally identi-
fiable information collected on or after the date that is 
1 year after the date of enactment of this Act. 
Æ 
VerDate Mar 15 2010 
20:12 Apr 18, 2011
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6301
E:\BILLS\H1528.IH
H1528
mstockstill on DSKH9S0YB1PROD with BILLS