(10)(A) To conduct a public or peer-reviewed sci-
entific, historical, or statistical research project 
that— 
(i) is in the public interest; and 
(ii) adheres to all relevant laws and regula-
tions governing such research, including regula-
tions for the protection of human subjects, or is 
excluded from criteria of the institutional review 
board. 
(B) Not later than 18 months after the date of 
enactment of this Act, the Commission should issue 
guidelines to help covered entities ensure the privacy 
of affected users and the security of covered data, par-
ticularly as data is being transferred to and stored by 
researchers. Such guidelines should consider risks as 
they pertain to projects using covered data with spe-
cial considerations for projects that are exempt under 
part 46 of title 45, Code of Federal Regulations (or 
any successor regulation) or are excluded from the 
criteria for institutional review board review. 
(11) To deliver a communication that is not an 
advertisement to an individual, if the communication 
is reasonably anticipated by the individual within the 
context of the individual’s interactions with the cov-
ered entity. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(12) To deliver a communication at the direction 
of an individual between such individual and one or 
more individuals or entities. 
(13) To transfer assets to a third party in the 
context of a merger, acquisition, bankruptcy, or simi-
lar transaction when the third party assumes control, 
in whole or in part, of the covered entity’s assets, only 
if the covered entity, in a reasonable time prior to 
such transfer, provides each affected individual 
with— 
(A) a notice describing such transfer, in-
cluding the name of the entity or entities receiv-
ing the individual’s covered data and their pri-
vacy policies as described in section 202; and 
(B) a reasonable opportunity to withdraw 
any previously given consents in accordance 
with the requirements of affirmative express con-
sent under this Act related to the individual’s 
covered data and a reasonable opportunity to re-
quest the deletion of the individual’s covered 
data, as described in section 203. 
(14) To ensure the data security and integrity of 
covered data, as described in section 208. 
(15) With respect to covered data previously col-
lected in accordance with this Act, a service provider 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
acting at the direction of a government entity, or a 
service provided to a government entity by a covered 
entity, and only insofar as authorized by statute, to 
prevent, detect, protect against or respond to a public 
safety incident, including trespass, natural disaster, 
or national security incident. This paragraph does 
not permit, however, the transfer of covered data for 
payment or other valuable consideration to a govern-
ment entity. 
(16) With respect to covered data collected in ac-
cordance with this Act, notwithstanding this excep-
tion, to process such data as necessary to provide first 
party advertising or marketing of products or services 
provided by the covered entity for individuals who are 
not-covered minors. 
(17) With respect to covered data previously col-
lected in accordance with this Act, notwithstanding 
this exception and provided such collection, proc-
essing, and transferring otherwise complies with the 
requirements of this Act, including section 204(c), to 
provide targeted advertising. 
(c) GUIDANCE.—The Commission shall issue guidance 
regarding what is reasonably necessary and proportionate 
to comply with this section. Such guidance shall take into 
consideration— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(1) the size of, and the nature, scope, and com-
plexity of the activities engaged in by, the covered en-
tity, including whether the covered entity is a large 
data holder, nonprofit organization, covered entity 
meeting the requirements of section 209, third party, 
or third-party collecting entity; 
(2) the sensitivity of covered data collected, proc-
essed, or transferred by the covered entity; 
(3) the volume of covered data collected, proc-
essed, or transferred by the covered entity; and 
(4) the number of individuals and devices to 
which the covered data collected, processed, or trans-
ferred by the covered entity relates. 
(d) DECEPTIVE MARKETING OF A PRODUCT OR SERV-
ICE.—A covered entity or service provider may not engage 
in deceptive advertising or marketing with respect to a 
product or service offered to an individual. 
(e) JOURNALISM.—Nothing in this Act shall be con-
strued to limit or diminish First Amendment freedoms 
guaranteed under the Constitution. 
SEC. 102. LOYALTY DUTIES. 
Notwithstanding section 101 and unless an exception 
applies, with respect to covered data, a covered entity or 
service provider may not— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(1) collect, process, or transfer a Social Security 
number, except when necessary to facilitate an exten-
sion of credit, authentication, fraud and identity 
fraud detection and prevention, the payment or collec-
tion of taxes, the enforcement of a contract between 
parties, or the prevention, investigation, or prosecu-
tion of fraud or illegal activity, or as otherwise re-
quired by Federal, State, or local law; 
(2) collect or process sensitive covered data, ex-
cept where such collection or processing is strictly nec-
essary to provide or maintain a specific product or 
service requested by the individual to whom the cov-
ered data pertains, or is strictly necessary to effect a 
purpose enumerated in paragraphs (1) through (12) 
and (14) through (15) of section 101(b); 
(3) transfer an individual’s sensitive covered 
data to a third party, unless— 
(A) the transfer is made pursuant to the af-
firmative express consent of the individual; 
(B) the transfer is necessary to comply with 
a legal obligation imposed by Federal, State, 
Tribal, or local law, or to establish, exercise, or 
defend legal claims; 
(C) the transfer is necessary to prevent an 
individual from imminent injury where the cov-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS