I 
117TH CONGRESS 
1ST SESSION H. R. 5807 
To establish national data privacy standards in the United States, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 1, 2021 
Mr. VELA introduced the following bill; which was referred to the Committee 
on Energy and Commerce, and in addition to the Committee on Science, 
Space, and Technology, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To establish national data privacy standards in the United 
States, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Digital Accountability 
and Transparency to Advance Privacy Act’’ or the ‘‘DATA 
Privacy Act’’. 
SEC. 2. DEFINITIONS. 
(a) IN GENERAL.—In this Act: 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(1) COLLECT.—The term ‘‘collect’’ means tak-
ing any operation or set of operations to obtain cov-
ered data, including by automated means, including 
purchasing, leasing, assembling, recording, gath-
ering, acquiring, or procuring. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) 
COVERED
DATA.—The 
term 
‘‘covered 
data’’— 
(A) means any information that is— 
(i) collected, processed, stored, or dis-
closed by a covered entity; 
(ii) collected over the internet or other 
digital network; and 
(iii)(I) linked to an individual or de-
vice associated with an individual; or 
(II) practicably linkable to an indi-
vidual or device associated with an indi-
vidual, including by combination with sepa-
rate information, by the covered entity or 
any potential recipient of the data; and 
(B) does not include data that is— 
(i) collected, processed, stored, or dis-
closed solely for the purpose of employ-
ment of an individual; or 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(ii) lawfully made available to the 
public from Federal, State, or local govern-
ment records. 
(4) COVERED ENTITY.—The term ‘‘covered en-
tity’’— 
(A) means any entity that collects, proc-
esses, stores, or discloses covered data; and 
(B) does not include any entity that col-
lects, processes, stores, or discloses covered data 
relating to fewer than 50,000 individuals and 
devices during any 12-month period. 
(5) DISCLOSE.—The term ‘‘disclose’’ means 
taking any action with respect to covered data, in-
cluding by automated means, to sell, share, provide, 
or otherwise transfer covered data to another entity, 
person, or the general public. 
(6) PRIVACY
ENHANCING
TECHNOLOGY.—The 
term ‘‘privacy enhancing technology’’— 
(A) means any software solution, technical 
processes, or other technological means of en-
hancing the privacy and confidentiality of an in-
dividual’s covered data in data or sets of data; 
and 
(B) includes anonymization and pseudony-
mization techniques, filtering tools, anti-track-
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
ing technology, differential privacy tools, syn-
thetic data, and secure multi-party computa-
tion. 
(7) PRIVACY RISK.—The term ‘‘privacy risk’’ 
means potential harm to an individual resulting 
from the collection, processing, storage, or disclosure 
of covered data, including— 
(A) direct or indirect financial loss; 
(B) stigmatization or reputational harm; 
(C) anxiety, embarrassment, fear, and 
other severe emotional trauma; 
(D) loss of economic opportunity; or 
(E) physical harm. 
(8) PROCESS.—The term ‘‘process’’ means any 
operation or set of operations that is performed on 
covered data or on sets of covered data, including by 
automated means, including organizing, combining, 
adapting, altering, using, or transforming. 
(9) PROTECTED
CHARACTERISTIC.—The term 
‘‘protected characteristic’’ means an individual’s 
race, sex, gender, sexual orientation, nationality, re-
ligious belief, age, or disability status. 
(10) PSEUDONYMOUS DATA.—The term ‘‘pseu-
donymous data’’ means covered data that may only 
be linked to the identity of an individual or the iden-
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
tity of a device associated with an individual if com-
bined with separate information. 
(11) REASONABLE INTEREST.—The term ‘‘rea-
sonable interest’’ means— 
(A) a compelling business, operational, ad-
ministrative, legal, or educational justification 
for the collection, processing, storage, or disclo-
sure of covered data exists; and 
(B) the interest does not subject the indi-
vidual linked to the covered data to an unrea-
sonable privacy risk. 
(12) SENSITIVE
DATA.—The term ‘‘sensitive 
data’’ means any covered data relating to— 
(A) the health, biologic, physiologic, bio-
metric, sexual life, or genetic information of an 
individual; or 
(B) the precise geolocation information of 
a device associated with an individual. 
(13) STORE.—The term ‘‘store’’ means any op-
eration or set of operations to continue possession of 
covered data, including by automated means. 
(14) THIRD PARTY SERVICE PROVIDER.—The 
term ‘‘third party service provider’’ means any cov-
ered entity that collects, processes, stores, or dis-
closes covered data at the direction of, and for the 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
sole benefit of, another covered entity under a con-
tract. 
(b) MODIFIED DEFINITION BY RULEMAKING.—If the 
Commission determines that a term defined in paragraph 
(10) or (12) is not sufficient to protect an individual’s 
data privacy, the Commission may promulgated regula-
tions under section 553 of title 5, United States Code, 
to modify the definition as the Commission considers ap-
propriate. 
SEC. 3. REQUIRED PRIVACY NOTICE. 
(a) PRIVACY NOTICE.—Each covered entity shall post 
in an accessible location a notice that is concise, in con-
text, in easily understandable language, accurate, clear, 
timely, updated, uses visualizations where appropriate, 
conspicuous, and free of charge regarding the covered en-
tity’s privacy practices. 
(b) CONTENTS OF NOTICE.—The notice required by 
subsection (a) shall include— 
(1) a description of the covered data that the 
entity collects, processes, stores, and discloses, in-
cluding the sources that provided the covered data if 
the covered entity did not collect the covered data 
from the individual; 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(2) the purposes for and means by which the 
entity collects, processes, and stores the covered 
data; 
(3) the persons and entities to whom, and pur-
poses for which, the covered entity discloses the cov-
ered data; and 
(4) a conspicuous, clear, and understandable 
means for individuals to access the methods nec-
essary to exercise their rights under sections 4 and 
5. 
SEC. 4. REQUIRED DATA PRACTICES. 
(a) REGULATIONS.—Not later than 1 year after the 
date of the enactment of this Act, the Commission shall 
promulgate regulations under section 553 of title 5, 
United States Code, that require covered entities to imple-
ment, practice, and maintain certain data procedures and 
processes that meet the following requirements: 
(1) MINIMUM
DATA
PROCESSING
REQUIRE-
MENTS.—Except as provided in subsection (b), re-
quire covered entities to meet all of the following re-
quirements regarding the means by and purposes for 
which covered data is collected, processed, stored, 
and disclosed: 
(A) REASONABLE.— 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(i) IN GENERAL.—Except as provided 
in paragraph (3), covered data collection, 
processing, storage, and disclosure prac-
tices must meet a reasonable interest of 
the covered entity, including— 
(I) business, educational, and ad-
ministrative operations that are rel-
evant and appropriate to the context 
of the relationship between the cov-
ered entity and the individual linked 
to the covered data; 
(II) relevant and appropriate 
product and service development and 
enhancement; 
(III) preventing and detecting 
abuse, fraud, and other criminal activ-
ity; 
(IV) reasonable communications 
and marketing practices that follow 
best practices, rules, and ethical 
standards; 
(V) engaging in scientific, med-
ical, or statistical research that fol-
lows commonly accepted ethical stand-
ards; or 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(VI) any other purpose for which 
the Commission considers to be rea-
sonable. 
(ii) 
CONSIDERATIONS.—In 
promul-
gating regulations in accordance with this 
subparagraph, the Commission shall con-
sider— 
(I) the role of impact assess-
ments in determining the privacy risk 
for high-risk processing; 
(II) the sensitivity of the covered 
data; and 
(III) the impact of such regula-
tions on small business. 
(B) EQUITABLE.— 
(i) IN GENERAL.—Covered data col-
lection, processing, storage, and disclosure 
practices may not be for purposes that re-
sult in discrimination against a protected 
characteristic, including— 
(I) discriminatory targeted adver-
tising practices; 
(II) price, service, or employment 
opportunity discrimination; or 
VerDate Sep 11 2014 
01:11 Nov 06, 2021
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(III) any other practice the Com-
mission considers likely to result in 
discrimination against a protected 
characteristic. 
(ii) 
CONSIDERATIONS.—In 
promul-
gating regulations in accordance with this 
subparagraph, the Commission shall con-
sider— 
(I) established civil rights laws, 
common law, and existing relevant 
consent decrees; 
(II) the existing economic models 
and technology available in the digital 
advertising system; 
(III) the role of algorithms and 
impact assessments; and 
(IV) the impact of such regula-
tions on small businesses. 
(C) FORTHRIGHT.— 
(i) IN GENERAL.—Covered data col-
lection, processing, storage, and disclosure 
practices may not be accomplished with 
means or for purposes that are deceptive, 
including— 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(I) the use of inconspicuous re-
cording or tracking devices and meth-
ods; 
(II) the disclosure of covered 
data that a reasonable individual be-
lieves to be the content of a private 
communication with another party or 
parties; 
(III) notices, interfaces, or other 
representations likely to mislead con-
sumers; or 
(IV) any other practice that the 
Commission considers likely to mis-
lead individuals regarding the pur-
poses for and means by which covered 
data is collected, processed, stored, or 
disclosed. 
(ii) 
CONSIDERATIONS.—In 
promul-
gating regulations in accordance with this 
subparagraph, the Commission shall con-
sider— 
(I) existing relevant consent de-
crees; 
(II) the reasonable expectations 
of consumers; 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(III) research on deceptive prac-
tices; 
(IV) the role of deceptive user 
interfaces; and 
(V) the impact of such regula-
tions on small businesses. 
(2) REQUIREMENTS FOR OPT-OUT CONSENT.— 
Except as provided in subsection (b), require covered 
entities to provide individuals with conspicuous ac-
cess to a method that is in easily understandable 
language, concise, accurate, clear, to opt out of any 
collection, processing, storage, or disclosure of cov-
ered data linked to the individual. 
(3) REQUIREMENTS
FOR
AFFIRMATIVE
CON-
SENT.—Except as provided in subsection (b), require 
covered entities to provide individuals with a notice 
that is concise, in easily understandable language, 
accurate, clear, timely, and conspicuous to express 
affirmative, opt in consent— 
(A) before the covered entity collects or 
discloses sensitive data linked to the individual; 
or 
(B) before the covered entity collects, proc-
esses, stores, or discloses data for purposes 
which are outside the context of the relationship 
VerDate Sep 11 2014 
01:11 Nov 06, 2021
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
of the covered entity with the individual linked 
to the data, including— 
(i) the use of covered data beyond 
what is necessary to provide, improve, or 
market a good or service that the indi-
vidual requests; 
(ii) the processing or disclosure of 
covered data differs in material ways from 
the purposes described in the privacy pol-
icy that was in effect when the data was 
collected; or 
(iii) any other purpose that Commis-
sion considers outside of context. 
(4) DATA MINIMIZATION REQUIREMENTS.—Ex-
cept as provided in subsection (b), require covered 
entities to— 
(A) take reasonable measures to limit the 
collection, processing, storage, and disclosure of 
covered data to the amount that is necessary to 
carry out the purposes for which the data is col-
lected; and 
(B) store covered data only as long as is 
reasonably necessary to carry out the purposes 
for which the data was collected. 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(b) EXEMPTIONS.—Subsection (a) shall not apply if 
the limitations on the collection, processing, storage, or 
disclosure of covered data would— 
(1) inhibit detection or prevention of a security 
risk or incident; 
(2) risk the health, safety, or property of the 
covered entity or individual; or 
(3) prevent compliance with an applicable law 
(including regulations) or legal process. 
SEC. 5. INDIVIDUAL CONTROL OVER DATA USE. 
(a) REGULATIONS.—Not later than 1 year after the 
date of the enactment of this Act, the Commission shall 
promulgate regulations under section 553 of title 5, 
United States Code, to require covered entities to provide 
conspicuous, understandable, clear, and free of charge 
method to— 
(1) upon the request of an individual, provide 
the individual with access to, or an accurate rep-
resentation of, covered data linked to with the indi-
vidual or the individual’s device stored by the cov-
ered entity; 
(2) upon the request of an individual, provide 
the individual with a means to dispute and resolve 
the accuracy or completeness of the covered data 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
linked to the individual or the individual’s device 
stored by the entity; 
(3) upon the request of an individual, delete 
any covered data that the covered entity stores 
linked to the individual or the individual’s device; 
and 
(4) when technically feasible, upon the request 
of an individual, allow the individual to transmit or 
transfer covered data linked to the individual or the 
individual’s device that is maintained by the entity 
to the individual in a format that is standardized 
and interoperable. 
(b) PSEUDONYMOUS DATA.—If the covered data that 
an individual has requested processed under subsection (a) 
is pseudonymous data, a covered entity may decline the 
request if processing the request is not technically feasible. 
(c) TIMELINESS OF REQUESTS.—In fulfilling any re-
quests made by the individual under subsection (a) the 
covered entity shall act in as timely a manner as is reason-
ably possible. 
(d) ACCESS TO SAME SERVICE.—A covered entity 
shall not discriminate against an individual because of any 
action the individual took under their rights described in 
subsection (a), including— 
(1) denying goods or services to the individual; 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(2) charging, or advertising, different prices or 
rates for goods or services; or 
(3) providing different quality of goods or serv-
ices. 
(e) CONSIDERATION.—The Commission shall allow a 
covered entity, by contract, to provide relevant obligations 
to the individual under subsection (a) on behalf of a third 
party service provider that collects, processes, stores, or 
discloses covered data only on behalf of the covered entity. 
SEC. 6. INFORMATION SECURITY STANDARDS. 
(a) REQUIRED DATA SECURITY PRACTICES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require covered enti-
ties to establish and implement policies and proce-
dures regarding information security practices for 
the treatment and protection of covered data taking 
into consideration— 
(A) the level of identifiability of the cov-
ered data and the associated privacy risk; 
(B) the sensitivity of the covered data col-
lected, processed, and stored and the associated 
privacy risk; 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS