I 
118TH CONGRESS 
1ST SESSION H. R. 2701 
To provide for individual rights relating to privacy of personal information, 
to establish privacy and security requirements for covered entities relating 
to personal information, and to establish an agency to be known as 
the Digital Privacy Agency to enforce such rights and requirements, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 19, 2023 
Ms. ESHOO (for herself and Ms. LOFGREN) introduced the following bill; 
which was referred to the Committee on Energy and Commerce, and in 
addition to the Committees on the Judiciary, House Administration, and 
Science, Space, and Technology, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To provide for individual rights relating to privacy of per-
sonal information, to establish privacy and security re-
quirements for covered entities relating to personal infor-
mation, and to establish an agency to be known as the 
Digital Privacy Agency to enforce such rights and re-
quirements, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Online Privacy Act of 2023’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Definitions. 
Sec. 3. General provisions. 
Sec. 4. Limitation on disclosing nonredacted government records. 
Sec. 5. Privacy considerations for legislative branch agencies. 
Sec. 6. Criminal prohibition on doxxing. 
TITLE I—INDIVIDUAL RIGHTS 
Sec. 101. Right of access. 
Sec. 102. Right of correction. 
Sec. 103. Right of deletion. 
Sec. 104. Right of portability. 
Sec. 105. Right to human review of automated decisions. 
Sec. 106. Right to individual autonomy. 
Sec. 107. Right to be informed. 
Sec. 108. Right to impermanence. 
Sec. 109. Exemptions, exceptions, fees, timelines, and rules of construction for 
rights under this title. 
TITLE II—REQUIREMENTS FOR COVERED ENTITIES, SERVICE 
PROVIDERS, AND THIRD PARTIES 
Sec. 201. Minimization. 
Sec. 202. Minimization and records of access by employees and contractors. 
Sec. 203. Prohibitions on disclosing of personal information. 
Sec. 204. Disclosing to entities not subject to United States jurisdiction or not 
compliant with this Act. 
Sec. 205. Prohibition on re-identification. 
Sec. 206. Restrictions on collecting, processing, maintaining, and disclosing 
contents of communications. 
Sec. 207. Prohibition on discriminatory processing. 
Sec. 208. Requirements for notice and consent processes and privacy policies. 
Sec. 209. Prohibition on ‘‘dark patterns’’ in notice and consent processes and 
privacy policies. 
Sec. 210. Notice and consent required. 
Sec. 211. Privacy policy. 
Sec. 212. Information security requirements. 
Sec. 213. Notification of data breach or data-sharing abuse. 
TITLE III—DIGITAL PRIVACY AGENCY 
Sec. 301. Establishment; Director and Deputy Director. 
Sec. 302. Agency powers and authorities. 
Sec. 303. Reporting and audit requirements. 
Sec. 304. Relation to other agencies. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
Sec. 305. Personnel. 
Sec. 306. Office of Civil Rights. 
Sec. 307. Complaints of individuals. 
Sec. 308. Advisory boards. 
Sec. 309. Authorization of appropriations. 
TITLE IV—ENFORCEMENT 
Sec. 401. Investigations and administrative discovery. 
Sec. 402. Hearings and adjudication proceedings. 
Sec. 403. Litigation authority. 
Sec. 404. Enforcement by States. 
Sec. 405. Private rights of action. 
Sec. 406. Relief available. 
Sec. 407. Referral for criminal proceedings. 
Sec. 408. Whistleblower enforcement. 
TITLE V—RELATION TO OTHER LAW 
Sec. 501. Effective date. 
Sec. 502. Relation to other Federal law. 
Sec. 503. Relation to State law. 
Sec. 504. Severability. 
TITLE VI—NIST AND NSF ACTIVITIES 
Sec. 601. National Institute of Standards and Technology privacy research and 
development. 
Sec. 602. National privacy awareness and education initiative. 
Sec. 603. National Science Foundation privacy research. 
SEC. 2. DEFINITIONS. 
In this Act: 
(1) AGENCY.—The term ‘‘Agency’’ means the 
Digital Privacy Agency established in section 301. 
(2) AGENCY INVESTIGATOR.—The term ‘‘Agen-
cy investigator’’ means any attorney or investigator 
employed by the Agency who is charged with the 
duty of enforcing or carrying into effect any provi-
sion of this Act or a rule or order prescribed under 
this Act. 
(3) BEHAVIORAL PERSONALIZATION.— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(A) IN GENERAL.—The term ‘‘behavioral 
personalization’’ means the processing of an in-
dividual’s personal information, using an algo-
rithm, model, or other means— 
(i) built using— 
(I) that individual’s personal in-
formation collected over a period of 
time; or 
(II) an aggregate of the informa-
tion of one or more similarly situated 
individuals; and 
(ii) designed to— 
(I) alter, influence, guide, or pre-
dict that individual’s behavior; 
(II) tailor or personalize a prod-
uct or service to that individual; or 
(III) filter, sort, limit, promote, 
display or otherwise differentiate be-
tween specific content or categories of 
content that would otherwise be acces-
sible to that individual. 
(B) EXCLUSIONS.—The term ‘‘behavioral 
personalization’’ does not include the use of his-
torical personal information to merely prevent 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
the display of or provide additional information 
about previously accessed content. 
(4) COLLECT.—The term ‘‘collect’’ includes, 
with respect to personal information or the contents 
of any communication, obtaining such information or 
contents in any manner, except when solely trans-
mitting, routing, providing intermediate storage for, 
or providing connections for such personal informa-
tion or communication through a system or network. 
(5) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(6) CONTENTS.—The term ‘‘contents’’, when 
used with respect to communication, has the mean-
ing given such term in section 2510 of title 18, 
United States Code. 
(7) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means a person who— 
(i) intentionally collects, processes, or 
maintains personal information; and 
(ii) sends or receives such personal in-
formation over the internet or a similar 
communications network. 
(B) EXCLUSION.—The term ‘‘covered enti-
ty’’ does not include a natural person, except to 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
the extent such person is engaged in a commer-
cial activity that is more than de minimis. 
(8) CUSTODIAN.—The term ‘‘custodian’’ means 
the custodian or any deputy custodian designated by 
the Agency. 
(9) DATA BREACH.—The term ‘‘data breach’’ 
means unauthorized access to or acquisition of per-
sonal information or contents of communications 
maintained by such covered entity. 
(10) DATA-SHARING ABUSE.—The term ‘‘data- 
sharing abuse’’ means processing, by a third party, 
of personal information or contents of communica-
tions disclosed by a covered entity to the third party, 
for any purpose other than— 
(A) a purpose specified by the covered en-
tity to the third party at the time such personal 
information or contents of communications was 
disclosed; or 
(B) a purpose to which the individual to 
whom the information relates has consented. 
(11) DE-IDENTIFY.— 
(A) IN GENERAL.—The term ‘‘de-identify’’ 
means, with respect to information, performing 
actions so that such information cannot reason-
ably identify, relate to, describe, reference, be 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
capable of being associated with, or be linked, 
directly or indirectly, to a particular individual 
or device, but only to the extent that the cov-
ered entity that uses such information— 
(i) has performed such actions using 
best practices for the types of data such 
information contains; 
(ii) has implemented technical safe-
guards that prohibit re-identification of the 
individual with whom such information was 
linked; 
(iii) has implemented business proc-
esses that specifically prohibit re-identifica-
tion of the information; 
(iv) has implemented business proc-
esses to prevent inadvertent release of such 
information; and 
(v) makes no attempt to re-identify 
such information. 
(B) DETERMINATION BY THE DIRECTOR.— 
The Director may determine that a method-
ology of de-identifying personal information is 
insufficient for the purposes of this paragraph. 
(12) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Agency. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(13) DISCLOSE.—The term ‘‘disclose’’ means, 
with respect to personal information or contents of 
communication, to sell, release, transfer, share, dis-
seminate, make available, or otherwise cause to be 
communicated, such information or contents to a 
third party. 
(14) DOCUMENTARY
MATERIAL.—The term 
‘‘documentary material’’ includes the original or any 
copy of any book, document, record, report, memo-
randum, paper, communication, tabulation, chart, 
logs, electronic files, or other data or data compila-
tions stored in any medium. 
(15) FEDERAL
AGENCY.—The term ‘‘Federal 
agency’’ has the meaning given to the term ‘‘agen-
cy’’ in section 3371 of title 5, United States Code. 
(16) FEDERAL
PRIVACY
LAWS.—The term 
‘‘Federal privacy laws’’ includes the laws and regula-
tions described in section 502. 
(17) GOVERNMENT ENTITY.—The term ‘‘gov-
ernment entity’’ means— 
(A) a Federal agency; 
(B) a State or political subdivision thereof; 
(C) or any agency, authority, or instru-
mentality of a State or political subdivision 
thereof. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(18) 
INDIVIDUAL.—The 
term 
‘‘individual’’ 
means a natural person residing in the United 
States. 
(19) INDIAN TRIBE.—The term ‘‘Indian Tribe’’ 
has the meaning given such term in section 4(e) of 
the Indian Self-Determination and Education Assist-
ance Act (25 U.S.C. 5304(e)). 
(20) MAINTAIN.—The term ‘‘maintain’’ means, 
with respect to personal information or the contents 
of any communication, to store, secure, or otherwise 
cause the retention of such information or contents, 
or to take actions necessary for storing, securing, or 
otherwise causing the retention of such information 
or contents. 
(21) NONPUBLIC
INFORMATION.—The term 
‘‘nonpublic information’’ means information that has 
not been disclosed in a criminal, civil, or administra-
tive proceeding, in a government investigation, re-
port, or audit, or by the news media or other public 
source of information, and that was not obtained in 
violation of the law. 
(22) PERSONAL INFORMATION.— 
(A) IN GENERAL.—The term ‘‘personal in-
formation’’ means any information maintained 
by a covered entity that, on its own or com-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
bined with other information, is linked or rea-
sonably linkable to a specific individual or a 
specific device, including de-identified personal 
information and the means to behavioral per-
sonalization created for or linked to a specific 
individual. 
(B) EXCLUSIONS.—The term ‘‘personal in-
formation’’ does not include— 
(i) 
publicly 
available 
information 
linked to an individual; or 
(ii) information derived or inferred 
from personal information, if the derived 
or inferred information is not linked or 
reasonably linkable to a specific individual. 
(23) PRIVACY
HARM.—The term ‘‘privacy 
harm’’ means an adverse consequence or a potential 
adverse consequence to an individual, a group of in-
dividuals, or society caused from collecting, proc-
essing, maintaining, or disclosing of personal infor-
mation or contents of communications, including— 
(A) direct or indirect financial loss or eco-
nomic harm; 
(B) physical harm; 
(C) psychological harm, including anxiety, 
embarrassment, fear, and other trauma; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(D) adverse outcomes or decisions with re-
spect to the eligibility of an individual for 
rights, benefits, or privileges in employment (in-
cluding hiring, firing, promotion, demotion, and 
compensation), credit and insurance (including 
denial of an application or obtaining less favor-
able terms), housing, education, professional 
certification, or the provision of health care and 
related services; 
(E) stigmatization or reputational harm; 
(F) price discrimination; 
(G) adverse consequences that affect the 
private life of an individual, including private 
family matters and actions and communications 
within the home of such individual or a similar 
physical, online, or digital location where such 
individual has a reasonable expectation that 
personal information will not be collected, proc-
essed, or maintained; 
(H) the chilling of free expression or action 
of an individual, a group of individuals, or soci-
ety, due to perceived or actual pervasive and ex-
cessive collecting, processing, disclosing, or 
maintaining of personal information or contents 
of communications; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(I) impairing the autonomy of an indi-
vidual, a group of individuals, or society; and 
(J) other adverse consequences or potential 
adverse consequences, consistent with the provi-
sions of this Act, as determined by the Direc-
tor. 
(24) PRIVACY-PRESERVING COMPUTING.— 
(A) IN GENERAL.—The term ‘‘privacy-pre-
serving computing’’ means the collecting, proc-
essing, disclosing, or maintaining of personal 
information that has been encrypted or other-
wise rendered unintelligible using a means that 
cannot be reversed by a covered entity, or a 
covered entity’s service provider, such that— 
(i) if such personal information could 
be rendered intelligible through cooperation 
or sharing of cryptographic secrets by mul-
tiple persons, the covered entity has both 
technical safeguards and business proc-
esses to prevent such cooperation or shar-
ing; 
(ii) if such personal information is 
rendered intelligible within a hardware 
processing unit or other means of per-
forming operations on the information, 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
there are technical safeguards that, during 
the normal course of operation— 
(I) prevent rendering personal in-
formation intelligible anywhere but 
within the hardware processing unit 
or other means of performing oper-
ations; and 
(II) make the exporting or other-
wise observing of such intelligible in-
formation, or the cryptographic secret 
used to protect such information, im-
possible; and 
(iii) if the result of such processing of 
the personal information is also personal 
information, such result must be unintelli-
gible to the covered entity or service pro-
vider and protected by privacy-preserving 
computing. 
(B) INSUFFICIENT METHODOLOGIES.—The 
Director may determine that a methodology of 
privacy-preserving computing is insufficient for 
the purposes of this definition. 
(25) PROCESS.—The term ‘‘process’’ means to 
perform or cause to be performed any operation or 
set of operations on personal information or contents 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
of communication, whether or not by automated 
means. 
(26) PROTECTED CLASS.—The term ‘‘protected 
class’’ means the actual or perceived race, color, eth-
nicity, national origin, religion, sex (including sexual 
orientation and gender identity or expression), famil-
ial status, or disability of an individual or group of 
individuals. 
(27) PUBLICLY
AVAILABLE
INFORMATION.— 
The term ‘‘publicly available information’’— 
(A) means— 
(i) information that is lawfully made 
available from a government entity; 
(ii) information linked to a public in-
dividual or official that is made publicly 
accessible, without restrictions on accessi-
bility other than the general authorization 
to access the services used to make the in-
formation accessible; 
(iii) information of an individual 
that— 
(I) is made publicly accessible by 
such individual, without restrictions 
on accessibility other than the general 
authorization to access the services 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
used to make the information acces-
sible; and 
(II) such individual has the abil-
ity to delete or change without relying 
on a request under section 102 or 
103; and 
(B) does not include— 
(i) biometric information of an indi-
vidual collected by a covered entity without 
the individual’s knowledge; 
(ii) information used for a purpose 
that is not compatible with the purpose for 
which the information is maintained and 
made available in government records; 
(iii) information obtained from gov-
ernment records for the purpose of selling 
such information; or 
(iv) information used to contact or lo-
cate a private individual either physically 
or electronically. 
(28) REASONABLE
MECHANISM.—The term 
‘‘reasonable mechanism’’ means, in the case of a 
mechanism for individuals to exercise a right under 
title I or interact with a covered entity under title 
II, a mechanism that— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(A) is equivalent in availability and ease of 
use to that of other mechanisms for commu-
nicating or interacting with the covered entity; 
and 
(B) includes an online means of exercising 
such right or engaging in such interaction, if 
such individuals communicate or interact with 
such covered entity through an online medium 
or if such covered entity provides information 
processing services through a public or widely 
available application programming interface (or 
similar mechanism). 
(29) SELL AND SALE.— 
(A) IN GENERAL.—The terms ‘‘sell’’ and 
‘‘sale’’ mean the disclosing of personal informa-
tion for monetary consideration or for a thing 
of value by a covered entity to a third party for 
the purposes of processing, maintaining or dis-
closing such personal information at the third 
party’s discretion. 
(B) EXCLUSIONS.—The terms ‘‘sell’’ and 
‘‘sale’’ do not include— 
(i) the disclosing of personal informa-
tion of an individual to a third party with 
which the individual has a direct relation-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
ship for purposes of providing a product or 
service requested by the individual or oth-
erwise in a manner that is consistent with 
an individual’s reasonable expectations 
considering the context in which the indi-
vidual provided the personal information to 
the covered entity; 
(ii) the disclosing or transfer of per-
sonal information to a subsidiary or an af-
filiate of the covered entity; or 
(iii) the disclosing or transfer of per-
sonal information to a third party as an 
asset that is part of a merger, acquisition, 
bankruptcy, or other transaction in which 
the third party assumes control of all or 
part of the covered entity’s assets, unless 
personal information makes up the major-
ity of the value of the assets of which the 
third party assumes control. 
(30) SERVICE PROVIDER.— 
(A) IN GENERAL.—The term ‘‘service pro-
vider’’ means a covered entity that— 
(i) processes, discloses, or maintains 
personal information, where such covered 
entity does not process, disclose, or main-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
tain the personal information other than in 
accordance with the directions and on be-
half of another covered entity; 
(ii) does not directly collect personal 
information from or control the mechanism 
for collecting personal information from an 
individual; 
(iii) does not earn revenue from proc-
essing, maintaining, or disclosing personal 
information disclosed to such covered enti-
ty by another covered entity except by pro-
viding contracted services to such other 
covered entity; 
(iv) does not disclose personal infor-
mation to another covered entity unless 
such personal information was provided by 
such other covered entity or resulted from 
maintaining or processing performed on 
personal information exclusively provided 
by such other covered entity; 
(v) does not offer services that allow 
another covered entity to target specific in-
dividuals using personal information not 
provided by such other covered entity; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(vi) with respect to personal informa-
tion processed or maintained by such cov-
ered entity on behalf of another covered 
entity, assists such other covered entity in 
complying with title I, including providing 
tools for such other covered entity to com-
ply with such requirements if requested; 
and 
(vii) does not link the personal infor-
mation provided by another covered entity 
to personal information from any other 
source. 
(B) TREATMENT.—A covered entity shall 
be treated as a service provider under this Act 
only to the extent that such covered entity is 
acting as a service provider, as defined in sub-
paragraph (A). 
(31) SIGNIFICANT PRIVACY HARM.—The term 
‘‘significant privacy harm’’ means adverse con-
sequences to an individual arising from the col-
lecting, processing, maintaining, or disclosing of per-
sonal information or contents of communications, 
limited to subparagraph (A), (B), or (D) of para-
graph (23). 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(32) SMALL BUSINESS.—The term ‘‘small busi-
ness’’ means a covered entity that— 
(A) does not earn revenue from the sale of 
personal information; 
(B) earns less than half of annual revenues 
from the processing of personal information for 
targeted or personalized advertising; 
(C) has not, in combination with each sub-
sidiary and affiliate of the service, maintained 
personal information of 250,000 or more indi-
viduals for 3 or more of the preceding 12 
months; 
(D) has fewer than 200 employees; and 
(E) received less than $25,000,000 in 
gross revenue in the preceding 12-month pe-
riod. 
(33) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
United States, and each federally recognized Indian 
Tribe. 
(34) STATE
ATTORNEY
GENERAL.—The term 
‘‘State attorney general’’ means, with respect to a 
State, the attorney general or chief law enforcement 
officer of the State, or another official or agency 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
designated by the State to bring civil actions on be-
half of the State or the residents of the State. 
(35) STATE PRIVACY REGULATOR.—The term 
‘‘State privacy regulator’’ means an agency or in-
strumentality of a State that has the primary pur-
pose of administering, implementing, or enforcing a 
privacy law or associated rules or regulations. 
(36) THIRD PARTY.—The term ‘‘third party’’ 
means, with respect to a covered entity, a person— 
(A) to which such covered entity disclosed 
personal information; and 
(B) that is not— 
(i) such covered entity; 
(ii) a subsidiary or corporate affiliate 
of such covered entity; or 
(iii) a service provider of such covered 
entity. 
(37) USERS.—The term ‘‘users’’ means, with 
respect to a product or service, the monthly active 
users, subscribers, or customers (or a reasonable 
proxy or substitute therefor determined by the Di-
rector) of such product or service. 
(38) VIOLATION.—The term ‘‘violation’’ means, 
except where otherwise specified, any act or omission 
that, if proved, would constitute a violation of any 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
provision of this Act or a rule or order issued pursu-
ant to this Act. 
SEC. 3. GENERAL PROVISIONS. 
(a) RULES OF CONSTRUCTION WITH RESPECT TO 
PERSONAL INFORMATION
AND INDIVIDUALS.—In this 
Act— 
(1) any reference to information as being of or 
belonging to an individual shall be construed to 
mean that such information is linked or reasonably 
linkable to such individual as described in section 
2(21)(A); and 
(2) any reference to any communication as 
being of or belonging to an individual shall be con-
strued to mean that such individual is party to such 
communication. 
(b) PROHIBITION ON WAIVERS.— 
(1) IN GENERAL.—The provisions under this 
Act may not be waived. Any agreement purporting 
to waive compliance with or modifying any provision 
of this Act shall be void as contrary to public policy. 
(2) PROHIBITION ON PREDISPUTE ARBITRATION 
AGREEMENTS.—No predispute arbitration agreement 
shall be valid or enforceable with respect to any 
claims under this Act. 
(c) JOURNALISM PROTECTION.— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) IN GENERAL.—Covered entities engaged in 
journalism shall not be subject to the obligations im-
posed under this Act to the extent that those obliga-
tions directly infringe on the journalism rather than 
the business practices of the covered entity, so long 
as the covered entity has technical safeguards and 
business processes that prevent the collecting, proc-
essing, maintaining, or disclosing of such personal 
information for business practices other than jour-
nalism. 
(2) JOURNALISM.—The term ‘‘journalism’’ in-
cludes the collecting, maintaining, processing, and 
disclosing of personal information about a public in-
dividual or official, or that otherwise concerns mat-
ters of public interest, for dissemination to the pub-
lic. 
(d) SMALL BUSINESS COMPLIANCE RAMP.—Upon 
losing its status as a small business, a covered entity shall 
have nine months to comply with provisions of this Act 
that a small business is exempt from complying with. 
(e) PROHIBITION
ON COLLECTING, MAINTAINING, 
PROCESSING, 
OR
DISCLOSING
PERSONAL
INFORMA-
TION.—A covered entity may not collect, maintain, proc-
ess, or disclose personal information using a channel of 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
interstate commerce unless such covered entity is in com-
pliance with all requirements of this Act. 
SEC. 4. LIMITATION ON DISCLOSING NONREDACTED GOV-
ERNMENT RECORDS. 
(a) IN GENERAL.—A government entity may not use 
a channel of interstate commerce to disclose the personal 
information of an individual in a government record with-
out an agreement prohibiting the recipient of such infor-
mation from selling the information without the express 
consent of the individual. 
(b) EXCEPTION.—Notwithstanding subsection (a), 
nothing in this section shall prohibit the disclosure of per-
sonal information using a channel of interstate commerce 
to another government entity without consent of the indi-
vidual. 
SEC. 5. PRIVACY CONSIDERATIONS FOR LEGISLATIVE 
BRANCH AGENCIES. 
(a) GOVERNMENT PUBLISHING OFFICE.— 
(1) PRIVACY RESPONSIBILITIES OF THE DIREC-
TOR.— 
(A) IN GENERAL.—Chapter 3 of title 44, 
United States Code, is amended by inserting at 
the end the following: 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘§ 319. Privacy responsibilities of the Director of the 
Government Publishing Office 
‘‘The Director of the Government Publishing Office 
shall identify and implement appropriate measures to pre-
vent the disclosure of personal information by the Govern-
ment Publishing Office and to minimize the risk of privacy 
harms in its operations.’’. 
(B) CLERICAL AMENDMENT.—The table of 
sections for chapter 3 of title 44, United States 
Code, is amended by inserting after the item re-
lating to section 318 the following: 
‘‘319. Privacy responsibilities of the Director of the Government Publishing Of-
fice.’’. 
(2) PRIVACY
SAFEGUARDS
FOR
PUBLISHED 
DOCUMENTS.—Section 1701 of title 44, United 
States Code, is amended by striking ‘‘the publica-
tion.’’ in the last sentence of the first paragraph and 
inserting ‘‘the publication, and only after conducting 
an appropriate review or implementing other appro-
priate measures to prevent the disclosure of personal 
information and minimize the risks of privacy harms 
in such publication.’’. 
(3) PRIVACY SAFEGUARDS IN THE DEPOSITORY 
LIBRARY
PROGRAM.—Section 1902 of title 44, 
United States Code, is amended by inserting at the 
end the following: ‘‘The Superintendent of Docu-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
ments shall assess the risks of disclosure of personal 
information and related privacy harms in publica-
tions made available to and by depository libraries 
and shall implement appropriate measures to mini-
mize such risks, including to the extent necessary by 
imposing obligations upon depository libraries.’’. 
(b) LIBRARY OF CONGRESS.—The first paragraph 
under the center heading ‘‘LIBRARY OF CONGRESS’’ under 
the center heading ‘‘LEGISLATIVE’’ of the Act entitled 
‘‘An Act Making appropriations for the legislative, execu-
tive, and judicial expenses of the Government for the fiscal 
year ending June thirtieth, eighteen hundred and ninety- 
eight, and for other purposes’’, approved February 19, 
1897 (2 U.S.C. 136), is amended by striking at the end 
‘‘Library.’’ and inserting ‘‘Library, including by identi-
fying and implementing appropriate measures to prevent 
the disclosure of personal information by the Library and 
to minimize the risk of privacy harms in its operations.’’. 
(c) SMITHSONIAN INSTITUTION.—Section 7 of the 
Act entitled ‘‘An Act to establish the ‘Smithsonian Institu-
tion’ for the increase and diffusion of knowledge among 
men’’, approved August 10, 1846 (20 U.S.C. 46), is 
amended by adding at the end the following: ‘‘The Sec-
retary shall assess the risks of disclosure of personal infor-
mation by the institution and related privacy harms and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
shall implement appropriate measures to minimize such 
risks.’’. 
(d) CHIEF
ADMINISTRATIVE
OFFICER
OF
THE 
HOUSE OF REPRESENTATIVES.— 
(1) IN GENERAL.—Subchapter III of chapter 
55 of title 2, United States Code, is amended by in-
serting at the end the following: 
‘‘§ 5549. Privacy responsibilities 
‘‘The Chief Administrative Officer of the House of 
Representatives shall identify and implement appropriate 
measures to prevent the disclosure of personal information 
and to minimize the risk of privacy harms in its areas 
of operational and financial responsibility.’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions for subchapter III of chapter 55 of title 2, 
United States Code, is amended by inserting after 
the item relating to section 5548 the following: 
‘‘5549. Privacy responsibilities.’’. 
SEC. 6. CRIMINAL PROHIBITION ON DOXXING. 
(a) IN GENERAL.—Chapter 41 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘§ 881. Disclosing of personal information with the 
intent to cause harm 
‘‘(a) IN GENERAL.—Whoever uses a channel of inter-
state or foreign commerce to knowingly disclose an indi-
vidual’s personal information with the intent— 
‘‘(1) to threaten, intimidate, or harass any per-
son, incite or facilitate the commission of a crime of 
violence against any person, or place any person in 
reasonable fear of death or serious bodily injury; or 
‘‘(2) that the information will be used to threat-
en, intimidate, or harass any person, incite or facili-
tate the commission of a crime of violence against 
any person, or place any person in reasonable fear 
of death or serious bodily injury, 
shall be fined under this title or imprisoned not more than 
5 years, or both. 
‘‘(b) DEFINITIONS.—In this section: 
‘‘(1) CONTENTS.—The term ‘contents’ when 
used with respect to communication, has the mean-
ing given such term in section 2510 of title 18, 
United States Code. 
‘‘(2) DISCLOSE.—The term ‘disclose’ means, 
with respect to personal information or contents of 
communication, to sell, release, transfer, share, dis-
seminate, make available, or otherwise cause to be 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
communicated such information or contents to a 
third party. 
‘‘(3) GOVERNMENT
ENTITY.—The term ‘gov-
ernment entity’ means— 
‘‘(A) a Federal agency (as such term is de-
fined in section 3371 of title 5, United States 
Code); 
‘‘(B) a State or political subdivision there-
of; or 
‘‘(C) any agency, authority, or instrumen-
tality of a State or political subdivision thereof. 
‘‘(4) INDIVIDUAL.—The term ‘individual’ means 
a natural person residing in the United States. 
‘‘(5) PERSONAL INFORMATION.— 
‘‘(A) IN GENERAL.—The term ‘personal in-
formation’ means any information maintained 
by a person that, on its own or combined with 
other information, is linked or reasonably 
linkable to a specific individual. 
‘‘(B) EXCLUSIONS.—The term ‘personal 
information’ does not include— 
‘‘(i) publicly available information 
linked to an individual; or 
‘‘(ii) information derived or inferred 
from personal information, if the derived 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
or inferred information is not linked or 
reasonably linkable to a specific individual. 
‘‘(6) PUBLICLY
AVAILABLE
INFORMATION.— 
The term ‘publicly available information’— 
‘‘(A) means— 
‘‘(i) information that is lawfully made 
available from a government entity; 
‘‘(ii) information linked to a public in-
dividual or official that is made publicly 
accessible, without restrictions on accessi-
bility other than the general authorization 
to access the services used to make the in-
formation accessible; 
‘‘(iii) information of an individual 
that— 
‘‘(I) is made publicly accessible 
by such individual, without restric-
tions on accessibility other than the 
general authorization to access the 
services used to make the information 
accessible; and 
‘‘(II) such individual has the abil-
ity to delete or change; and 
‘‘(B) does not include— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) biometric information of an indi-
vidual collected by a covered entity without 
the individual’s knowledge; 
‘‘(ii) information used for a purpose 
that is not compatible with the purpose for 
which the information is maintained and 
made available in government records; 
‘‘(iii) information obtained from gov-
ernment records for the purpose of selling 
such information; or 
‘‘(iv) information used to contact or 
locate a private individual either physically 
or electronically. 
‘‘(7) STATE.—The term ‘State’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
United States, and each federally recognized Indian 
Tribe.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
for chapter 41 of title 18, United States Code, is amended 
by inserting after the item relating to section 880 the fol-
lowing: 
‘‘881. Disclosing of personal information with the intent to cause harm.’’. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6211
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
TITLE I—INDIVIDUAL RIGHTS 
SEC. 101. RIGHT OF ACCESS. 
(a) IN GENERAL.—A covered entity shall make avail-
able a reasonable mechanism by which an individual may 
access— 
(1) the categories of personal information and 
contents of communications of such individual that 
is maintained by such covered entity, including, in 
the case of personal information that such covered 
entity did not collect from such individual, how and 
from whom such covered entity obtained such per-
sonal information; 
(2) a list of the third parties, subsidiaries, and 
corporate affiliates, to which such covered entity has 
disclosed and from which such covered entity has, at 
any time on or after the effective date of this Act, 
obtained the personal information of such individual; 
(3) a concise and clear description of the busi-
ness or commercial purposes of such covered enti-
ty— 
(A) for collecting, processing, or maintain-
ing the personal information of such individual; 
and 
(B) for disclosing to a third party the per-
sonal information of such individual; and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(4) a list of automated decision-making proc-
esses that an individual has a right to request 
human review of under section 105 with a concise 
and clear description of the implications and in-
tended effects of each such process. 
(b) EXCEPTION FOR PUBLICLY ACCESSIBLE INFOR-
MATION.—A covered entity that makes available informa-
tion required in subsection (a) shall be considered in com-
pliance with such requirements if the covered entity pro-
vides an individual with instructions on how to access a 
public posting of such information, including in a privacy 
policy, if the instructions are easy and do not require pay-
ment. 
(c) SMALL
BUSINESSES
EXCLUDED.—Subsection 
(a)(3) does not apply to a small business. 
SEC. 102. RIGHT OF CORRECTION. 
(a) DISPUTE BY INDIVIDUAL.—A covered entity shall 
make available a reasonable mechanism by which an indi-
vidual may dispute the accuracy or completeness of per-
sonal information linked to such individual that is main-
tained by such covered entity if such information is proc-
essed in any way, by such covered entity, a third party 
of such covered entity, or a service provider of such cov-
ered entity that may increase reasonably foreseeable sig-
nificant privacy harms. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(b) CORRECTION BY COVERED ENTITY.—A covered 
entity receiving a dispute under subsection (a) shall— 
(1) correct or complete (as the case may be) the 
disputed information and notify such individual that 
the correction or completion has been made; or 
(2) notify such individual that— 
(A) the disputed information is correct or 
complete; 
(B) such covered entity lacks sufficient in-
formation to correct or complete the disputed 
information; or 
(C) such covered entity is denying the re-
quest for correction or completion in reliance on 
an exemption or exception provided by section 
109(g). 
(c) SMALL BUSINESSES EXCLUDED.—This section 
does not apply to a small business. 
SEC. 103. RIGHT OF DELETION. 
(a) REQUEST
BY INDIVIDUAL.—A covered entity 
shall make available a reasonable mechanism by which an 
individual may request the deletion of personal informa-
tion and contents of communications of such individual 
maintained by such covered entity, including any such in-
formation that such covered entity acquired from a third 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
party or inferred from other information maintained by 
such covered entity. 
(b) DELETION BY COVERED ENTITY.—A covered en-
tity receiving a request for deletion under subsection (a) 
shall— 
(1) delete such information and notify such in-
dividual that such information has been deleted; or 
(2) notify such individual that such covered en-
tity is denying the request for deletion in reliance on 
an exemption or exception provided by section 
109(g). 
SEC. 104. RIGHT OF PORTABILITY. 
(a) DETERMINATION OF PORTABLE CATEGORIES.— 
(1) ANNUAL
DETERMINATION.—Not less fre-
quently than once per calendar year, the Director 
shall— 
(A) establish categories of products and 
services offered by covered entities, based on 
similarities in the products and services; 
(B) determine which categories established 
under subparagraph (A) are portable categories; 
and 
(C) publish in the Federal Register a list 
of portable categories determined under sub-
paragraph (B). 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) OPPORTUNITY FOR PUBLIC COMMENT.—Be-
fore publishing the final list under paragraph (1)(C), 
the Director shall— 
(A) publish a draft of such list in the Fed-
eral Register; and 
(B) provide an opportunity for public com-
ment on such draft list. 
(b) EXERCISE OF RIGHT.— 
(1) IN GENERAL.—A covered entity that offers 
a product or service in a portable category and that 
maintains personal information or the contents of 
any communications of an individual shall make 
available to such individual a reasonable mechanism 
by which such individual may— 
(A) download, in a format that is struc-
tured, commonly used, and machine readable— 
(i) any such personal information that 
such individual has provided to such cov-
ered entity, with the option to download 
such information by category that is acces-
sible under section 101; and 
(ii) the contents of any such commu-
nications; and 
(B) using a real-time application program-
ming interface, or similar mechanism, transmit 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
all such personal information (whether or not 
provided to such covered entity by such indi-
vidual) and the contents of any such commu-
nication from such covered entity to another 
covered entity in accordance with subsection 
(c). 
(2) REQUIREMENTS
FOR
APPLICATION
PRO-
GRAMMING INTERFACE.—The application program-
ming interface, or similar mechanism, required by 
paragraph (1)(B) shall— 
(A) be publicly documented; 
(B) allow the option of obtaining any per-
sonal information of an individual that the indi-
vidual has provided to the covered entity, if 
such information is accessible under section 
101; 
(C) include a publicly available, fully func-
tional test version for development purposes; 
and 
(D) be of similar quality to mechanisms 
used internally by the covered entity. 
(c) REQUIREMENTS FOR ACCESS TO AN APPLICATION 
PROGRAMMING INTERFACE.— 
(1) ACCESS.—Except as provided in paragraph 
(2)(A), a covered entity shall provide access to the 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
application programming interface or similar mecha-
nism required by subsection (b)(1)(B) upon the re-
quest of another covered entity if the requesting cov-
ered entity has self-certified, using the procedures 
established by the Director under paragraph (3)(A), 
that such requesting covered entity— 
(A) is a covered entity; 
(B) can have personal information dis-
closed to it under section 204; 
(C) is, at the time of the self-certification, 
in compliance with all applicable requirements 
of this Act (including provisions a small busi-
ness is otherwise exempt from complying with); 
(D) will continue to comply with all re-
quirements of this Act; and 
(E) will only use such application program-
ming interface or similar mechanism at the ex-
press request of an individual. 
(2) DENIAL OF ACCESS.— 
(A) IN GENERAL.—A covered entity may 
deny access to the application programming 
interface or similar mechanism required by sub-
section (b)(1)(B) if such covered entity has an 
objective, reasonable belief that the requesting 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
covered entity has failed to meet the require-
ments for self-certification under paragraph (1). 
(B) REVIEW.—In accordance with the pro-
cedures established under paragraph (3)(B), a 
covered entity the request of which is denied 
under subparagraph (A) may petition the Di-
rector for review of the denial. If the Director 
finds that such denial is unreasonable, the Di-
rector shall impose a penalty, to be established 
in such procedures, on the covered entity that 
denied the request. 
(3) 
CERTIFICATION
AND
REVIEW
PROCE-
DURES.—The Director shall establish— 
(A) procedures for a covered entity to self- 
certify under paragraph (1); and 
(B) procedures for the review of petitions 
under paragraph (2)(B), including penalties for 
unreasonable denials. 
(d) SMALL BUSINESSES EXCLUDED.—This section 
does not apply to a small business. 
(e) PORTABLE CATEGORY DEFINED.—In this sec-
tion, the term ‘‘portable category’’ means a category of 
products and services established by the Director under 
subsection (a)(1)(A)— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) for which the sum obtained by adding the 
number of users or estimated users of each product 
or service in such category is greater than 
10,000,000; and 
(2) that— 
(A) 
has 
an 
estimated 
Herfindahl- 
Hirschman Index of 2,000 or greater; 
(B) has 3 or fewer covered entities offering 
products and services in such category; or 
(C) the Director otherwise determines that 
a category would benefit from encouraging in-
creased competition. 
SEC. 105. RIGHT TO HUMAN REVIEW OF AUTOMATED DECI-
SIONS. 
For any decision by a covered entity based solely on 
automated processing of personal information of an indi-
vidual, if such processing materially increases reasonably 
foreseeable significant privacy harms for such individual, 
such covered entity shall— 
(1) inform such individual of what personal in-
formation is being or may be used for such decision; 
(2) make available a reasonable mechanism by 
which such individual may request human review of 
such decision, upon request or in a publicly acces-
sible location; and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(3) if such individual requests such a review, 
conduct such review within a reasonable amount of 
time after such request. 
SEC. 106. RIGHT TO INDIVIDUAL AUTONOMY. 
(a) IN GENERAL.—A covered entity shall not collect, 
process, maintain, or disclose an individual’s personal in-
formation to— 
(1) create, improve upon, or maintain; 
(2) process with; or 
(3) otherwise link an individual with; 
an algorithm, model, or other means designed for behav-
ioral personalization, without the affirmative express con-
sent of that individual. 
(b) CONSENT.—A covered entity must obtain express 
affirmative consent from an individual before it may pro-
vide a behaviorally personalized version of a product or 
service, and not less than every calendar year thereafter. 
Where consent is denied, a covered entity must provide 
the product or service without behavioral personalization. 
(c) EXCEPTIONS TO PROVIDING PRODUCT OR SERV-
ICE.— 
(1) Where the offering of a substantially similar 
product or service without behavioral personalization 
is infeasible, a covered entity shall provide, to the 
greatest extent feasible, a core aspect or part of the 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
product or service that can be offered without behav-
ioral personalization. 
(2) Where no core aspect or part of the product 
or service can function in a substantially similar 
function without behavioral personalization, a cov-
ered entity may deny providing an individual use of 
such product or service if such individual does not 
consent to behavioral personalization as required in 
subsection (a). 
(d) EXCEPTION TO BEHAVIORAL PROCESSING.—Not-
withstanding subsections (a) and (b), a covered entity may 
process personal information to create or operate behav-
ioral personalization algorithms, models, or other mecha-
nisms for the purpose of increasing the usability of the 
product or service provided by a covered entity that— 
(1) are built using aggregated personal infor-
mation that is representative of all the personal in-
formation the covered entity maintains; and 
(2) have an output that is both uniform across 
the individuals that use the product or service and 
independent of a specific individual’s inherent or be-
havioral characteristics. 
(e) USABILITY.—The term ‘‘usability’’ as used in 
subsection (d) does not include optimizations or other al-
terations to the product or service that are made with the 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
primary purpose of increasing the amount of time an indi-
vidual engages with or uses the product or service, unless 
such increase benefits the individual. 
(f) SMALL BUSINESSES EXCLUDED.—This section 
does not apply to a small business. 
SEC. 107. RIGHT TO BE INFORMED. 
A covered entity that collects personal information of 
an individual with whom such covered entity does not have 
an existing relationship (as of the time of the collecting), 
if such personal information includes contact information, 
shall notify such individual within 30 days, in writing if 
possible and at no charge to the individual, that such cov-
ered entity has collected the personal information of such 
individual. 
SEC. 108. RIGHT TO IMPERMANENCE. 
(a) LIMITATION ON MAINTAINING OF PERSONAL IN-
FORMATION.—A covered entity shall not maintain per-
sonal information for more time than expressly consented 
to by an individual whose personal information is being 
maintained. 
(b) CONSENT.—A covered entity must obtain express 
affirmative consent from an individual before maintaining 
the personal information of such individual for any dura-
tion. Such consent may be obtained for categories of per-
sonal information and shall give an individual options to 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
affirmatively choose granting a covered entity consent for 
various durations, at least including— 
(1) for no longer than needed to complete the 
specific request or transaction (including a reason-
able estimate of such duration by the covered enti-
ty); 
(2) until consent is revoked; and 
(3) one or more additional durations based on 
reasonable expectations and norms for maintaining 
the category of personal information. 
(c) EXCEPTION FOR IMPLIED CONSENT.—Where the 
long-term maintaining of personal information is, on its 
face, obvious and a core feature of the product or service 
at the request of the individual, and the personal informa-
tion is maintained only to provide such product or service, 
subsections (a) and (b) shall not apply. 
SEC. 109. EXEMPTIONS, EXCEPTIONS, FEES, TIMELINES, 
AND RULES OF CONSTRUCTION FOR RIGHTS 
UNDER THIS TITLE. 
(a) EXEMPTIONS FOR PERSONAL INFORMATION FOR 
PARTICULAR PURPOSES.— 
(1) IN
GENERAL.—This title does not apply 
with respect to personal information that is col-
lected, processed, maintained, or disclosed for any of 
the following purposes (or a combination of such 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
purposes), where a covered entity has technical safe-
guards and business processes that limit collecting, 
processing, maintaining, or disclosing of such per-
sonal information to the following purposes: 
(A) Detecting, responding to, or preventing 
security incidents or threats. 
(B) Protecting against malicious, decep-
tive, fraudulent, or illegal activity. 
(C) A good faith response to, or compli-
ance with, a valid subpoena, court order, or 
warrant (including a subpoena and court order 
obtained by an entity that is not a government 
entity) or otherwise providing information as 
required by law. 
(D) Protecting a legally recognized privi-
lege or other legal right. 
(E) Protecting public safety. 
(F) Collecting, processing, or maintaining 
by an employer pursuant to an employer-em-
ployee relationship of records about employees 
or employment status, except— 
(i) where the information would not 
be reasonably expected to be collected in 
the context of an employee’s regular du-
ties; or 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(ii) was disclosed to the employer by 
a third party. 
(G) Preventing prospective abuses of a 
service by an individual whose account has been 
previously terminated. 
(H) Routing a communication through a 
communications network or resolving the loca-
tion of a host or client on a communications 
network. 
(I) Providing transparency in advertising 
or origination of user-generated content. 
(2) RE-IDENTIFICATION.—Where compliance 
with this title would require the re-identification of 
de-identified personal information, and the covered 
entity does not already maintain the information 
necessary for such re-identification, the covered enti-
ty shall be exempt from such compliance, except for 
requirements under section 106. 
(3) DISCLOSING.—A covered entity relying on 
an exemption under paragraph (1) with respect to 
personal information shall disclose in the privacy 
policy maintained by such entity under section 
211— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
was made or the performance of a contract 
entered into before such request was made; 
(ii) was collected specifically for the 
completion of such transaction or the per-
formance of such contract; and 
(iii) would undermine the integrity of 
a legally significant transaction. 
(2) LIMITATIONS
ON
REQUESTS
FOR
ADDI-
TIONAL
INFORMATION
TO
CONFIRM
IDENTITY.—A 
covered entity may not deny a request of an indi-
vidual under paragraph (1)(A) on the basis of the 
refusal of such individual to provide additional per-
sonal information to such covered entity to confirm 
the identity of such individual— 
(A) if the identity of such individual can 
reasonably be confirmed using personal infor-
mation of such individual that such covered en-
tity (as of the time of the request) already 
maintains; or 
(B) if such individual has an existing rela-
tionship (as of the time of the request) with 
such covered entity, such individual has con-
firmed the identity of such individual to such 
covered entity in the same manner as for other 
transactions of a similar sensitivity. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(c) EXEMPTION
FOR SERVICE PROVIDERS.—This 
title does not apply to a service provider. 
(d) EXEMPTION
FOR PRIVACY-PRESERVING COM-
PUTING.—Except for sections 101, 105, and 106, this title 
does not apply to personal information secured using pri-
vacy-preserving computing. 
(e) TIMELINE FOR COMPLYING WITH A REQUEST.— 
Without undue delay but not longer than 30 days after 
the request, a covered entity that receives a request under 
this title must— 
(1) comply with such request; or 
(2) inform such individual of the reason for de-
nying such request, as allowed under subsection (a) 
or (b). 
(f) FEES PROHIBITED.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a covered entity may not charge a fee to 
an individual for a request made under this title. 
(2) UNFOUNDED OR EXCESSIVE REQUESTS.—If 
a request under this title is unfounded or excessive, 
a covered entity may charge a reasonable fee that 
reflects the estimated administrative costs of com-
plying with such request. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(3) AGENCY NOTICE.—If a covered entity plans 
to charge a fee under paragraph (2), it must notify 
the Agency at least 7 days before charging such fee. 
(4) AGENCY REVIEW.—The Director may reject 
any fee that a covered entity plans to charge for a 
request made under this title if the Agency finds— 
(A) such fee to be unreasonable relative to 
reasonable administrative costs of complying 
with a request under this title; or 
(B) such request is not unfounded or ex-
cessive. 
(g) RULES OF CONSTRUCTION.—Nothing in this title 
shall be construed to require a covered entity to— 
(1) take an action that would convert informa-
tion that is not personal information into personal 
information; 
(2) collect or maintain personal information or 
contents of communication that the covered entity 
would otherwise not maintain (including record of an 
individual exercising rights under this title); or 
(3) maintain personal information or contents 
of communication longer than the covered entity 
would otherwise maintain such personal information. 
(h) REGULATIONS.—The Director shall promulgate 
regulations to implement this section. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
TITLE II—REQUIREMENTS FOR 
COVERED ENTITIES, SERVICE 
PROVIDERS, AND THIRD PAR-
TIES 
SEC. 201. MINIMIZATION. 
(a) ARTICULATED BASIS.—A covered entity shall 
have a reasonable, articulated basis for collecting, proc-
essing, maintaining, and disclosing of personal informa-
tion that takes into account the reasonable business needs 
of the covered entity and minimum amount of personal 
information necessary for providing the service, balanced 
with the intrusion on the privacy of, potential privacy 
harms to, and reasonable expectations of individuals to 
whom the personal information relates. 
(b) MINIMIZATION
OF COLLECTING, PROCESSING, 
MAINTAINING, AND DISCLOSING.— 
(1) COLLECTING.—A covered entity may not 
collect more personal information than is reasonably 
needed to provide a product or service that an indi-
vidual has requested. 
(2) PROCESSING.—A covered entity may not 
process personal information for a purpose other 
than the purpose for which such information was 
originally collected from the individual or in the case 
of a service provider, a purpose other than that 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
which is in accordance with the directions of a cov-
ered entity. 
(3) MAINTAINING.—A covered entity may not 
maintain personal information once such information 
is no longer needed for the purpose for which such 
information was originally collected from the indi-
vidual or in the case of a service provider, a purpose 
other than that which is in accordance with the di-
rections of a covered entity. 
(4) DISCLOSING.—A covered entity may not 
disclose personal information for a purpose other 
than the purpose for which such information was 
originally collected from the individual or in the case 
of a service provider, a purpose other than that 
which is in accordance with the directions of a cov-
ered entity. 
(c) ANCILLARY COLLECTING, PROCESSING, MAIN-
TAINING, AND DISCLOSING.—Notwithstanding subsection 
(b), a covered entity may collect, process, disclose, or 
maintain personal information beyond limitations under 
subsection (b) only if such covered entity complies with 
this subsection. 
(1) NO
NOTICE
OR
CONSENT
REQUIRED.—A 
covered entity may collect, process, or maintain per-
sonal information without additional notice or con-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
sent if the purpose for such collecting, processing, or 
maintaining is substantially similar to the type of 
personal information and purpose for which such 
personal information was originally collected and 
such ancillary collecting, processing, or maintaining 
will not result in additional or increased privacy 
harms. 
(2) NOTICE REQUIRED.—A covered entity shall 
provide notice of ancillary collecting, processing, 
maintaining, or disclosing of personal information in 
the case of one, but not more than one, of the fol-
lowing instances: 
(A) Such ancillary collecting, processing, 
maintaining, or disclosing may result in addi-
tional or increased privacy harms (but not in-
creased significant privacy harms), and is sub-
stantially similar to the purpose for which such 
personal information was originally collected. 
(B) Such ancillary collecting, processing, 
maintaining, or disclosing is not substantially 
similar to the purpose for which such personal 
information was originally collected, but will not 
result in additional or increased privacy harms. 
(C) Such ancillary collecting, processing, 
maintaining, or disclosing may result in addi-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
tional or increased privacy harms (but not in-
creased significant privacy harms) and the pur-
pose is not substantially similar to the purpose 
for which such personal information was origi-
nally collected, so long as the personal informa-
tion is secured using privacy-preserving com-
puting. 
(3) NOTICE
AND
CONSENT
REQUIRED.—For 
scenarios not covered under paragraph (1) or (2), 
and notwithstanding sections 208(b)(2) and (3), a 
covered entity shall provide notice of and obtain con-
sent for ancillary collecting, processing, maintaining, 
or disclosing of personal information. 
(d) SUBSTITUTION.—In cases in which personal in-
formation can be replaced with artificial personal informa-
tion, personal information that has been de-identified, or 
the random personal information of one or more individ-
uals without substantially reducing the utility of the data 
or requiring an unreasonable amount of effort, such a re-
placement shall take place. 
SEC. 202. MINIMIZATION AND RECORDS OF ACCESS BY EM-
PLOYEES AND CONTRACTORS. 
(a) MINIMIZATION.—A covered entity shall restrict 
access to personal information and contents of commu-
nications by the employees or contractors of such covered 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
entity based on an articulated balance between the poten-
tial for privacy harm, reasonable expectations of individ-
uals to whom the personal information relates, and reason-
able business needs. 
(b) RECORDS OF ACCESS.— 
(1) IN GENERAL.—A covered entity shall main-
tain records identifying each instance in which an 
employee or a contractor of such covered entity ac-
cesses personal information or contents of commu-
nications if disclosing such personal information or 
contents of communication, or a data breach or 
data-sharing abuse involving such personal informa-
tion or contents of communication, may foreseeably 
result in increased privacy harms. 
(2) INFORMATION REQUIRED.—The records re-
quired by paragraph (1) shall include the following: 
(A) A unique identifier for the employee or 
contractor accessing personal information or 
contents of communications. 
(B) The date and time of access. 
(C) The fields of information accessed. 
(D) The individuals whose personal infor-
mation was accessed or the contents of whose 
communications were accessed. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(3) SMALL BUSINESSES EXCLUDED.—This sub-
section does not apply to a small business. 
SEC. 203. PROHIBITIONS ON DISCLOSING OF PERSONAL IN-
FORMATION. 
(a) CONSENT FOR DISCLOSING REQUIRED.— 
(1) IN GENERAL.—A covered entity may not in-
tentionally disclose personal information unless the 
covered entity obtains consent of the individual 
whose personal information is being disclosed for 
each category of third party to which such personal 
information will be disclosed. Such covered entity 
must also provide such individual with notice of— 
(A) each category of third party; 
(B) the personal information to be dis-
closed; and 
(C) a concise and clear description of the 
business or commercial purpose for disclosing 
such personal information. 
(2) ADDITIONAL REQUIREMENTS FOR SALE OF 
PERSONAL INFORMATION.— 
(A) IN GENERAL.—A covered entity may 
not intentionally sell personal information un-
less the covered entity— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(i) obtains the consent required by 
paragraph (1) for disclosing such personal 
information; and 
(ii) provides the individual to whom 
such personal information relates with the 
identity of the specific third party to which 
such personal information will be disclosed. 
(B) 
DISCLOSING
SERVICES.—Subpara-
graph (A) shall not apply to a covered entity in 
a case in which an individual is directing the 
covered entity to disclose the personal informa-
tion of such individual for the sole purpose of 
procuring goods or services, or offers for goods 
or services, for such individual, if there is a rea-
sonable mechanism for the individual to with-
draw consent. 
(3) REQUIREMENT TO INCLUDE ORIGINAL PUR-
POSE OF COLLECTING.—A covered entity may not 
intentionally disclose personal information without 
including the purpose for which the personal infor-
mation was originally collected. 
(4) 
EXCEPTION
FOR
PRIVACY-PRESERVING 
COMPUTING.—Notwithstanding paragraph (1), con-
sent is not required for disclosing (not including sell-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
ing) personal information secured using privacy-pre-
serving computing. 
(5) EXCEPTION FOR DE-IDENTIFIED PERSONAL 
INFORMATION.—Notwithstanding 
paragraph 
(1), 
consent is not required for disclosing (not including 
selling) de-identified personal information where the 
disclosed personal information is limited to the nar-
rowest possible scope likely to yield the intended 
benefit and contractual obligations are in place that 
prohibit— 
(A) re-identification of the disclosed per-
sonal information; and 
(B) the processing of additional personal 
information in combination with the disclosed 
personal information that would allow for the 
re-identification of the disclosed personal infor-
mation. 
(b) DISCLOSING FOR ADVERTISING OR MARKETING 
PURPOSES.— 
(1) IN GENERAL.—A covered entity may not in-
tentionally disclose for advertising or marketing pur-
poses a unique identifier or any other personal infor-
mation that would allow information disclosed to be 
linked to information relating to the same individual 
or device disclosed in the past. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) TREATMENT OF CERTAIN TYPES OF INFOR-
MATION.—Disclosing personal information or con-
tents of communication for advertising or marketing 
purposes may not be treated as violating paragraph 
(1) by reason of including any or all of the following: 
(A) Internet Protocol addresses truncated 
to no more than the first 24 bits for Internet 
Protocol version 4 and the first 48 bits for 
Internet Protocol version 6, or for a successor 
protocol truncated to limit the precision of the 
identifier to a network address of the internet 
access provider. 
(B) Geolocation information truncated to 
allow no more than the equivalent of two dec-
imal degrees of precision at the equator or 
prime meridian, or an equivalent precision in 
another geolocation standard. 
(C) A general description of a device, 
browser, or operating system, or any combina-
tion thereof. 
(D) An identifier that is unique to a disclo-
sure. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 204. DISCLOSING TO ENTITIES NOT SUBJECT TO 
UNITED STATES JURISDICTION OR NOT COM-
PLIANT WITH THIS ACT. 
(a) PROHIBITION.—A covered entity may not inten-
tionally disclose personal information to any entity that— 
(1) is not subject to the jurisdiction of the 
United States; or 
(2) is not in compliance with all requirements 
of this Act. 
(b) EXCEPTION.—Notwithstanding subsection (a), a 
covered entity may disclose personal information where 
that personal information is limited to an identifier cre-
ated primarily for the purpose of sending or receiving elec-
tronic communications and the sole purpose of disclosing 
is to send or receive an electronic communication at the 
request of the individual whose personal information is 
being disclosed. 
(c) SAFE HARBORS
FOR DISCLOSING.—Notwith-
standing subsection (a), a covered entity may disclose per-
sonal information to another covered entity (the receiving 
covered entity) that is not subject to the jurisdiction of 
the United States if either— 
(1) the receiving covered entity has entered into 
an agreement, as described in subsection (e), with 
the Agency, and— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(D) an auditing and compliance program 
to ensure the receiving covered entity’s contin-
ued compliance with this Act and contract 
terms; 
(E) filed with the Agency the terms of said 
contract, proof of its actual knowledge of the 
receiving covered entity’s compliance with this 
Act and contract terms, and documents detail-
ing its auditing and compliance program for ap-
proval and publication by the Agency; and 
(F) entered into an agreement with the 
Agency where the covered entity agrees to ac-
cept, respond to, or comply with a court order, 
Agency order, or request by an individual re-
garding actions taken by the receiving covered 
entity with respect to covered information it has 
disclosed. 
(d) LIABILITY FOR VIOLATION BY RECEIVING COV-
ERED ENTITY; FAILURE TO REPORT.—For the purposes 
of subsection (c)(2), the covered entity shall be jointly lia-
ble for a violation of this Act by the receiving covered enti-
ty regarding the personal information the covered entity 
disclosed, except where the covered entity was the first to 
notify the Agency of the violation, in which case, it shall 
be severally liable. Where the covered entity should reason-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
ably have known of a violation of this Act by the receiving 
covered entity and fails to disclose the violation to the 
Agency, each day of continuance of the failure to report 
such violation shall be treated as a separate violation. 
(e) AGENCY AGREEMENTS.—Upon the request of a 
covered entity not subject to the jurisdiction of the United 
States, the Agency shall enter into an agreement with the 
covered entity that includes, but is not limited to, the fol-
lowing conditions: 
(1) The principal place of business for the cov-
ered entity must be in a country that allows for the 
domestication of a United States court decision for 
civil fines payable to a government entity and in-
junctive relief. Where a foreign court refuses to en-
force a United States court decision under this Act, 
the agreement, and all other agreements with cov-
ered entities with a principal place of business in the 
same jurisdiction, shall be void. 
(2) The covered entity agrees to comply with 
this Act. 
(3) The covered entity agrees to be subject to 
this Act with choice of venue being a United States 
court. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(4) The covered entity agrees to comply with 
Agency investigative requests or orders, and United 
States court orders or decisions under this Act. 
(5) The covered entity consents to United 
States Federal court personal jurisdiction for the 
sole purpose of enforcing this Act. 
(6) Where enforcement of the decision requires 
the use of a foreign court, the covered entity agrees 
to pay reasonable attorney fees necessary to enforce 
the judgment. 
(7) A default judgment, failure to comply with 
Agency investigative requests or orders, or failure to 
comply with United States court orders or decisions 
shall result in the immediate termination of the 
agreement. 
(f) RULE OF CONSTRUCTION AGAINST DATA LOCAL-
IZATION.—Nothing in this section shall be construed to 
require the localization of processing or maintaining per-
sonal information by a covered entity to within the United 
States, or limit internal disclosing of personal information 
within a covered entity or to subsidiary or corporate affil-
iate of such covered entity, regardless of the country in 
which the covered entity will process, disclose, or maintain 
that personal information. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 205. PROHIBITION ON RE-IDENTIFICATION. 
(a) IN GENERAL.—Except as required under title I, 
a covered entity shall not use personal information col-
lected from an individual, acquired from a third party, or 
acquired from publicly available information to re-identify 
an individual from de-identified information. 
(b) THIRD-PARTY PROHIBITION.—A covered entity 
that discloses de-identified information to a third party 
shall prohibit such third party from re-identifying an indi-
vidual using such de-identified information. 
(c) EXCEPTION.—Subsection (a) shall not apply to 
qualified research entities, as determined by the Director, 
conducting research not for commercial purposes. 
SEC. 206. RESTRICTIONS ON COLLECTING, PROCESSING, 
MAINTAINING, AND DISCLOSING CONTENTS 
OF COMMUNICATIONS. 
(a) IN GENERAL.—A covered entity may not collect, 
process, maintain, or disclose the contents of any commu-
nication, regardless of whether the sender or intended re-
cipient of the communication is an individual, other per-
son, or an electronic device, for any purpose other than— 
(1) transmitting or displaying the communica-
tion to any intended recipient or the original sender, 
or maintaining such communications for such pur-
poses; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) detecting, responding to, or preventing secu-
rity incidents or threats; 
(3) providing services to assist in the drafting 
or creation of the content of a communication; 
(4) processing expressly requested by the sender 
or intended recipient, if the sender or intended re-
cipient can terminate such processing using a rea-
sonable mechanism; 
(5) disclosing otherwise required by law; 
(6) filtering a communication where primary 
purpose of the communication is the commercial ad-
vertisement or promotion of a commercial product or 
service of a covered entity; or 
(7) detecting or enforcing an abuse or violation 
of the terms of service of the covered entity that 
would result in either a temporary or permanent ban 
from using the service. 
(b) INTENDED RECIPIENT.—A covered entity is not 
considered an intended recipient of a communication, or 
any communication used in the creation of the content of 
said communication, where— 
(1) at least one intended recipient is a natural 
person other than an employee or contractor of the 
covered entity; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) at least one intended recipient is a person 
other than the covered entity; or 
(3) a purpose of the covered entity’s service is 
to maintain, at the direction of the sender, the con-
tent of said communication for more than a transi-
tory period. 
(c) SENDER.—The sender of a communication is the 
person for whom the communication, and its content, is 
disclosed at the direction of and on behalf of. 
(1) Where the sender is a natural person, they 
shall be the sender of the entire content of the com-
munication, regardless of the original author of any 
portion of the content. 
(2) Otherwise, a sender shall be the sender of 
only the content it was an original author of, or con-
tent it received as an intended recipient. 
(d) EXCEPTION FOR PUBLICLY AVAILABLE COMMU-
NICATIONS.—Subsection (a) shall not apply where the con-
tents of communication are made publicly accessible by the 
sender without restrictions on accessibility other than the 
general authorization to access the services used to make 
the information accessible. 
(e) ENCRYPTION PROTECTION.—A covered entity 
shall not— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) 
prohibit 
or 
prevent 
a 
person 
from 
encrypting or otherwise rendering unintelligible the 
content of a communication using a means that pre-
vents the covered entity from being able to decrypt 
or otherwise render intelligible said content; and 
(2) require or cause a person to disclose or cir-
cumvent the means described in paragraph (1) to 
the covered entity that would allow it to render the 
content intelligible. 
(f) SERVICE PROVIDERS SAFE HARBOR.—A service 
provider shall not be held liable for a violation of this sec-
tion if such service provider is acting at the direction of 
and on behalf of a covered entity and has a reasonable 
belief that the covered entity’s directions are in compliance 
with this section. 
SEC. 207. PROHIBITION ON DISCRIMINATORY PROCESSING. 
(a) DISCRIMINATION
IN
ECONOMIC
OPPORTUNI-
TIES.—A covered entity shall not process personal infor-
mation or contents of communication for advertising, mar-
keting, soliciting, offering, selling, leasing, licensing, rent-
ing, or otherwise commercially contracting for employ-
ment, finance, health care, credit, insurance, housing, or 
education opportunities in a manner that discriminates 
against or otherwise makes opportunities unavailable on 
the basis of an individual’s protected class status. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(b) PUBLIC ACCOMMODATIONS.—A covered entity 
shall not process personal information in a manner that 
segregates, discriminates in, or otherwise makes unavail-
able the goods, services, facilities, privileges, advantages, 
or accommodations of any place of public accommodation 
on the basis of the protected class status of an individual 
or a group of individuals. 
(c) REGULATIONS.—The Director shall promulgate 
regulations to implement this section. 
SEC. 208. REQUIREMENTS FOR NOTICE AND CONSENT 
PROCESSES AND PRIVACY POLICIES. 
(a) MINIMUM THRESHOLD.—The Director shall es-
tablish minimum thresholds that covered entities must 
meet for the percentage of individuals who understand a 
notice or consent process or privacy policy required by this 
Act. In establishing such minimum thresholds, the Direc-
tor shall— 
(1) vary required thresholds on types and scale 
of reasonably foreseeable privacy harms; and 
(2) take into account expectations of individ-
uals, potential privacy harms, and individuals’ 
awareness of privacy harms. 
(b) CONSENT REVOCATION.—A covered entity shall 
make available a reasonable mechanism by which an indi-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
vidual may revoke consent for any consent given under 
this Act. 
(c) SAFE HARBOR.— 
(1) APPROVAL
PROCEDURES.—The Director 
shall develop procedures for analyzing and approving 
data submitted by a covered entity to establish that 
a notice and consent process or privacy policy of 
such covered entity meets the threshold established 
under subsection (a). 
(2) PRESUMPTION.—If a covered entity submits 
testing data to and receives an approval from the 
Director under paragraph (1) establishing that a no-
tice or consent process or privacy policy of such cov-
ered entity meets the threshold established under 
subsection (a), such notice or consent process or pri-
vacy policy shall be presumed to have met such 
threshold. Such presumption may be rebutted by 
clear and convincing evidence. 
(3) PUBLIC AVAILABILITY OF APPROVED PROC-
ESSES
AND
POLICIES
AND
ASSOCIATED
TESTING 
DATA.—The Director shall make publicly available 
online the notice and consent processes and privacy 
policies and associated testing data that the Director 
approves under paragraph (1). 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(4) SMALL BUSINESS ADOPTION OF NOTICE OR 
CONSENT
PROCESS
OF
ANOTHER
COVERED
ENTI-
TY.— 
(A) IN
GENERAL.—If a small business 
adopts a notice or consent process of another 
covered entity that collects, processes, main-
tains, or discloses personal information in sub-
stantially the same way as such small business, 
if the process of such other covered entity has 
been approved under paragraph (1), the process 
of such small business shall receive the pre-
sumption under paragraph (2). 
(B) ABILITY TO FREELY USE APPROVED 
PROCESS.—A covered entity whose notice or 
consent process is approved under paragraph 
(1) shall permit a small business to freely use 
such process, or a derivative thereof, as de-
scribed in subparagraph (A). 
(C) NO PUBLISHED PROCESS.—In the case 
of a small business for which there is no ap-
proved notice or consent process published 
under paragraph (3) of a covered entity that 
collects, processes, maintains, or discloses per-
sonal information in substantially the same way 
as such small business, any requirement under 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
this title for a notice or consent process to be 
objectively shown to meet the threshold estab-
lished by the Director under subsection (a) 
shall not apply to such small business. Nothing 
in the preceding sentence exempts a small busi-
ness from the requirement to use such notice or 
consent process or that such process be concise 
and clear. 
(D) INAPPLICABILITY
TO
PRIVACY
POL-
ICY.—Paragraph (4) does not apply with re-
spect to a privacy policy. 
(5) MINOR CHANGES.—A covered entity may 
make minor changes in a notice or consent process 
or privacy policy approved under paragraph (1) and 
retain the presumption under paragraph (2) for such 
process or policy without retesting or resubmission 
of testing data to the Director. 
SEC. 209. PROHIBITION ON ‘‘DARK PATTERNS’’ IN NOTICE 
AND CONSENT PROCESSES AND PRIVACY 
POLICIES. 
In providing notice, obtaining consent, or maintaining 
a privacy policy as required by this title, a covered entity 
may not intentionally take any action that substantially 
impairs, obscures, or subverts the ability of an individual 
to— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) understand the contents of such notice or 
such privacy policy; 
(2) understand the process for granting such 
consent; 
(3) make a decision regarding whether to grant 
or withdraw such consent; or 
(4) act on any such decision. 
SEC. 210. NOTICE AND CONSENT REQUIRED. 
(a) NOTICE.—A covered entity shall provide an indi-
vidual with notice of the personal information such covered 
entity collects, processes, maintains, and discloses through 
a process that is concise and clear and can be objectively 
shown to meet the threshold established by the Director 
under section 208(a). 
(b) CONSENT.— 
(1) EXPRESS CONSENT REQUIRED.—Except as 
provided in paragraphs (2) and (3), a covered entity 
may not collect from an individual personal informa-
tion that creates or increases the risk of foreseeable 
privacy harms, or process or maintain any such per-
sonal information collected from an individual, un-
less such entity obtains the express consent of such 
individual to the collecting, processing, or maintain-
ing (or any combination thereof) of such information 
through a process that is concise and clear and can 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
be objectively shown to meet the threshold estab-
lished by the Director under section 208(a). 
(2) EXCEPTION FOR IMPLIED CONSENT.—Not-
withstanding paragraph (1), express consent is not 
required for collecting, processing, or maintaining 
personal information if the collecting, processing, or 
maintaining is, on its face, obvious and necessary to 
provide a service at the request of the individual and 
the personal information is collected, processed, or 
maintained only for such request. Nothing in this 
paragraph shall be construed to exempt the covered 
entity from the requirement of subsection (a) to pro-
vide notice to such individual with respect to such 
collecting, processing, or maintaining. 
(3) 
EXEMPTION
FOR
PRIVACY-PRESERVING 
COMPUTING.—Notwithstanding paragraph (1), ex-
cept with regard to consent for purposes of section 
106, express consent is not required for collecting, 
processing, or maintaining personal information se-
cured using privacy-preserving computing. Nothing 
in this paragraph shall be construed to exempt the 
covered entity from the requirement of subsection 
(a) to provide notice to such individual with respect 
to such collecting, processing, or maintaining. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(c) SERVICE PROVIDERS EXCLUDED.—This section 
does not apply to a service provider if such service provider 
has a reasonable belief that a covered entity for which it 
processes, maintains, or discloses personal information is 
in compliance with this section. 
SEC. 211. PRIVACY POLICY. 
(a) POLICY REQUIRED.—A covered entity shall main-
tain a privacy policy relating to the practices of such entity 
regarding the collecting, processing, maintaining, and dis-
closing of personal information. 
(b) CONTENTS.—The privacy policy required by sub-
section (a) shall contain the following: 
(1) A general description of the practices of the 
covered entity regarding the collecting, processing, 
maintaining, and disclosing of personal information. 
(2) A description of how individuals may exer-
cise the rights provided by title I. 
(3) A clear and concise summary of the fol-
lowing: 
(A) The categories of personal information 
collected or otherwise obtained by the covered 
entity. 
(B) The business or commercial purposes 
of the covered entity for collecting, processing, 
maintaining, or disclosing personal information. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(C) The categories and a list of third par-
ties to which the covered entity discloses per-
sonal information. 
(4) A description of the personal information 
that the covered entity maintains that the covered 
entity does not collect from individuals and how the 
covered entity obtains such personal information. 
(5) A list of the third parties to which the cov-
ered entity has disclosed personal information. 
(6) A list of the third parties from which the 
covered entity has obtained personal information at 
any time on or after the effective date of this Act. 
(7) The articulated basis for the collecting, 
processing, disclosing, and maintaining of personal 
information, as required under section 201(a). 
(c) EXEMPTION FOR PERSONAL INFORMATION FOR 
PARTICULAR PURPOSES.—The privacy policy required by 
subsection (a) is not required to contain information relat-
ing to personal information that is collected, processed, 
maintained, or disclosed exclusively for any of the pur-
poses described in paragraph (1) of section 109(a) (or a 
combination of such purposes), except as provided in para-
graph (2) of such section. 
(d) AVAILABILITY OF PRIVACY POLICY.— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) FORM AND MANNER.—The privacy policy 
required by subsection (a) shall be— 
(A) clear and in plain language; and 
(B) made publicly available in a prominent 
location on an ongoing basis. 
(2) TIMING.—The privacy policy required by 
subsection (a) shall be made available as required by 
paragraph (1) before the covered entity collects per-
sonal information after the effective date of this Act. 
(e) SMALL BUSINESSES EXCLUDED.—Subsections 
(b)(7) and (d) do not apply to a small business. 
(f) SERVICE PROVIDERS EXCLUDED.—This section 
does not apply to a service provider if such service provider 
has a reasonable belief that a covered entity for which it 
processes, maintains, or discloses personal information is 
in compliance with this section. 
SEC. 212. INFORMATION SECURITY REQUIREMENTS. 
(a) IN GENERAL.—A covered entity shall establish 
and implement reasonable information security policies, 
practices, and procedures for the protection of personal 
information collected, processed, maintained, or disclosed 
by such covered entity, taking into consideration— 
(1) the nature, scope, and complexity of the ac-
tivities engaged in by such covered entity; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) the sensitivity of any personal information 
at issue; 
(3) the current state of the art in administra-
tive, technical, and physical safeguards for pro-
tecting such information; and 
(4) the cost of implementing such administra-
tive, technical, and physical safeguards. 
(b) SPECIFIC POLICIES, PRACTICES, AND PROCE-
DURES.—The policies, practices, and procedures required 
by subsection (a) shall include the following: 
(1) A written security policy with respect to col-
lecting, processing, maintaining, and disclosing of 
personal information. Such policy shall be made pub-
licly available in a prominent location on an ongoing 
basis, except that the publicly available version is 
not required to contain information that would com-
promise a purpose described in section 109(a)(1). 
(2) A process for identifying and assessing rea-
sonably foreseeable security vulnerabilities in the 
system or systems used by such covered entity that 
contain personal information, which shall include 
regular monitoring for vulnerabilities or data 
breaches involving such system or systems. 
(3) A process for taking action designed to 
mitigate against vulnerabilities identified in the 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
process required by paragraph (2), which may in-
clude implementing any changes to security practices 
and the architecture, installation, or implementation 
of network or operating software, or for regularly 
testing or otherwise monitoring the effectiveness of 
the existing safeguards. 
(4) A process for determining if personal infor-
mation is no longer needed and disposing of personal 
information by shredding, permanently erasing, or 
otherwise modifying the medium on which such per-
sonal information is maintained to make such per-
sonal information permanently unreadable or indeci-
pherable. 
(5) A process for overseeing persons who have 
access to personal information, including through 
network-connected devices. 
(6) A process for employee training and super-
vision for implementation of the policies, practices, 
and procedures required by this section. 
(7) A written plan or protocol for internal and 
public response in the event of a data breach or 
data-sharing abuse. 
(c) REGULATIONS.—The Director, in consultation 
with the Cybersecurity and Infrastructure Security Agen-
cy and the National Institute of Standards and Tech-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
nology, shall promulgate regulations to implement this 
section. 
(d) SMALL BUSINESSES ASSISTANCE.—The Director, 
in consultation with the Cybersecurity and Infrastructure 
Security Agency, the National Institute of Standards and 
Technology, the Small Business Administration, the Mi-
nority Business Development Agency, and small busi-
nesses, shall develop policy templates, toolkits, tip sheets, 
configuration guidelines for commonly used hardware and 
software, interactive tools, and other materials to assist 
small businesses with complying with this section. 
SEC. 213. NOTIFICATION OF DATA BREACH OR DATA-SHAR-
ING ABUSE. 
(a) NOTIFICATION OF AGENCY.— 
(1) IN GENERAL.—In the case of a data breach 
or data-sharing abuse with respect to personal infor-
mation maintained by a covered entity, such covered 
entity shall, without undue delay and, if feasible, not 
later than 72 hours after becoming aware of such 
data breach or data-sharing abuse, notify the Direc-
tor of such data breach or data-sharing abuse, un-
less such data breach or data-sharing abuse is un-
likely to create or increase foreseeable privacy 
harms. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) REASONS FOR DELAY.—If the notification 
required by paragraph (1) is made more than 72 
hours after the covered entity becomes aware of the 
data breach or data-sharing abuse, such notification 
shall be accompanied by a statement of the reasons 
for the delay. 
(b) NOTIFICATION OF OTHER COVERED ENTITY.— 
In the case of a data breach or data-sharing abuse with 
respect to personal information maintained by a covered 
entity that such covered entity obtained from another cov-
ered entity, the covered entity experiencing such data 
breach or data-sharing abuse shall, without undue delay 
and, if feasible, not later than 72 hours after becoming 
aware of such data breach or data-sharing abuse, notify 
such other covered entity of such data breach or data- 
sharing abuse, unless such data breach or data-sharing 
abuse is unlikely to create or increase foreseeable privacy 
harms. A covered entity receiving notice under this sub-
section of a data breach or data-sharing abuse shall notify 
any other covered entity from which the covered entity re-
ceiving notice obtained personal information involved in 
such data breach or data-sharing abuse, in the same man-
ner as required under the preceding sentence for the cov-
ered entity experiencing such data breach or data-sharing 
abuse. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(c) NOTIFICATION OF INDIVIDUALS.— 
(1) IN GENERAL.—In the case of a data breach 
or data-sharing abuse with respect to personal infor-
mation maintained by a covered entity (or a data 
breach or data-sharing abuse about which a covered 
entity is notified under subsection (b)), if such cov-
ered entity has a relationship with an individual 
whose personal information was involved or poten-
tially involved in such data breach or data-sharing 
abuse, such covered entity shall notify such indi-
vidual of such data breach or data-sharing abuse not 
later than 14 days after becoming aware of such 
data breach or data-sharing abuse (or, in the case 
of a data breach or data-sharing abuse about which 
a covered entity is notified under subsection (b), not 
later than 14 days after being so notified), if such 
data breach or data-sharing abuse creates or in-
creases foreseeable privacy harms. 
(2) MEDIUM OF NOTIFICATION.—A covered en-
tity shall notify an individual as required by para-
graph (1) through— 
(A) the same medium through which such 
individual routinely interacts with such covered 
entity; and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) one additional medium of notification, 
if such covered entity has the personal informa-
tion necessary to make a notification through 
such an additional medium without causing ex-
cessive financial burden for such covered entity. 
(d) RULE OF CONSTRUCTION.—This section shall not 
apply to a covered entity if a person uses personal infor-
mation obtained from a data breach or data-sharing abuse 
not involving such covered entity. 
TITLE III—DIGITAL PRIVACY 
AGENCY 
SEC. 301. ESTABLISHMENT; DIRECTOR AND DEPUTY DIREC-
TOR. 
(a) AGENCY ESTABLISHED.—There is established an 
independent agency in the executive branch to be known 
as the ‘‘Digital Privacy Agency’’, which shall implement 
and enforce this Act. 
(b) DIRECTOR.— 
(1) IN GENERAL.—There is established the po-
sition of the Director, who shall serve as the head 
of the Agency. 
(2) APPOINTMENT.—Subject to paragraph (3), 
the Director shall be appointed by the President, by 
and with the advice and consent of the Senate. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(3) 
QUALIFICATION.—The 
President 
shall 
nominate the Director who, by reason of professional 
background and experience, is especially qualified to 
lead the Agency based on their knowledge and exper-
tise in— 
(A) privacy; 
(B) information security; 
(C) technology; and 
(D) civil rights and civil liberties. 
(4) TERM.— 
(A) IN
GENERAL.—The Director shall 
serve for a term of 6 years. 
(B) EXPIRATION OF TERM.—An individual 
may serve as Director after the expiration of 
the term for which appointed, until a successor 
has been appointed and qualified. 
(5) COMPENSATION.— 
(A) IN GENERAL.—The Director shall be 
compensated at the rate prescribed for level II 
of the Executive Schedule under section 5313 
of title 5, United States Code. 
(B) CONFORMING
AMENDMENT.—Section 
5313 of title 5, United States Code, is amended 
by inserting after the item relating to the 
‘‘Chief Executive Officer, United States Inter-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
national Development Finance Corporation.’’ 
the following new item: ‘‘Director of the Digital 
Privacy Agency.’’. 
(c) DEPUTY DIRECTOR.—There is established the po-
sition of Deputy Director, who shall— 
(1) be appointed by the Director; and 
(2) serve as acting Director in the absence or 
unavailability of the Director, notwithstanding sec-
tion 3345 of title 5, United States Code. 
(d) SERVICE RESTRICTION.—No Director or Deputy 
Director may hold any office, position, or employment in 
any covered entity during the period of service of such per-
son as Director or Deputy Director. 
(e) OFFICES.—The Director shall establish a prin-
cipal office and field offices of the Agency in locations that 
have high levels of activity by covered entities, as deter-
mined by the Director. 
SEC. 302. AGENCY POWERS AND AUTHORITIES. 
(a) POWERS OF THE AGENCY.—The Director is au-
thorized to establish the general policies of the Agency 
with respect to all executive and administrative functions, 
including— 
(1) establishing of rules for conducting the gen-
eral business of the Agency, in a manner not incon-
sistent with this Act; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) binding the Agency and enter into con-
tracts; 
(3) directing the establishment and continued 
operation of divisions or other offices within the 
Agency, in order to carry out the responsibilities of 
the Agency under this Act, and to satisfy the re-
quirements of other applicable law; 
(4) coordinating and overseeing the operation of 
all administrative, enforcement, and research activi-
ties of the Agency; 
(5) adopting and using a seal; 
(6) determining the character of and the neces-
sity for the obligations and expenditures of the 
Agency; 
(7) appointing and supervising of personnel em-
ployed by the Agency; 
(8) distributing business among personnel ap-
pointed and supervised by the Director and among 
administrative units of the Agency; 
(9) using and expending of funds; 
(10) implementing this Act through rules, or-
ders, guidance, interpretations, statements of policy, 
investigations, and enforcement actions; and 
(11) performing such other functions as may be 
authorized or required by law. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(b) DELEGATION
OF AUTHORITY.—The Director 
may delegate to any duly authorized employee, representa-
tive, or agent any power vested in the Director or the 
Agency by law, except that the Director may not delegate 
the power to appoint the Deputy Director under section 
301(c). 
(c) AUTONOMY
OF
AGENCY
REGARDING
REC-
OMMENDATIONS AND TESTIMONY.—No officer or agency 
of the United States shall have any authority to require 
the Director or any other officer of the Agency to submit 
legislative recommendations, or testimony or comments on 
legislation, to any officer or agency of the United States 
for approval, comments, or review prior to the submission 
of such recommendations, testimony, or comments to the 
Congress, if such recommendations, testimony, or com-
ments to the Congress include a statement indicating that 
the views expressed therein are those of the Director or 
such officer, and do not necessarily reflect the views of 
the President. 
(d) RULEMAKING AUTHORITY.— 
(1) IN GENERAL.—The Director may prescribe 
rules and issue orders and guidance, as may be nec-
essary or appropriate to enable the Agency to imple-
ment, administer, and carry out the purposes and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
objectives of this Act, and to prevent evasions there-
of. 
(2) REGULATIONS.—The Agency may issue reg-
ulations after notice and comment in accordance 
with section 553 of title 5, United States Code, as 
may be necessary to implement, administer, and 
carry out this Act. 
(e) CONSULTATIONS.—In implementing or enforcing 
this Act, the Director may consult with— 
(1) Federal agencies that have— 
(A) jurisdiction over Federal privacy laws; 
and 
(B) expertise in privacy or information se-
curity; 
(2) State attorneys general, State privacy regu-
lators, and other State agencies that have expertise 
in privacy or information security; 
(3) international and intergovernmental bodies 
that conduct activities relating to the privacy or in-
formation security; 
(4) agencies of other countries that are similar 
to the Agency or have expertise in privacy or infor-
mation security; 
(5) privacy and information security experts in 
academia, government, civil society, or industry; and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(6) advisory boards of the Agency established 
under section 308, as appropriate. 
SEC. 303. REPORTING AND AUDIT REQUIREMENTS. 
(a) REPORTS REQUIRED.— 
(1) IN
GENERAL.—Not later than 6 months 
after the date of the enactment of this Act, and 
every 6 months thereafter, the Director shall submit 
a report to the President and to the Committee on 
Energy and Commerce, the Committee on the Judi-
ciary, and the Committee on Appropriations of the 
House of Representatives and the Committee on 
Commerce, Science, and Transportation, the Com-
mittee on the Judiciary, and the Committee on Ap-
propriations of the Senate, and shall publish such 
report on the website of the Agency. 
(2) CONTENTS.—Each report required by sub-
section (a) shall include— 
(A) a discussion of the significant problems 
faced by individuals with respect to the privacy 
or security of personal information; 
(B) a justification of the budget request of 
the Agency for the preceding year, unless a jus-
tification for such year was included in the pre-
ceding report submitted under such subsection; 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(C) a list of the significant rules and or-
ders adopted by the Agency, as well as other 
significant initiatives conducted by the Agency, 
during the preceding 6-month period and the 
plan of the Agency for rules, orders, or other 
initiatives to be undertaken during the upcom-
ing 6-month period; 
(D) an analysis of complaints about the 
privacy or security of personal information that 
the Agency has received and collected in the 
database described in section 307(a) during the 
preceding 6-month period; 
(E) a list, with a brief statement of the 
issues, of the public enforcement actions to 
which the Agency was a party during the pre-
ceding 6-month period; and 
(F) an assessment of significant actions by 
State attorneys general or State privacy regu-
lators relating to this Act or the rules pre-
scribed under this Act during the preceding 6- 
month period. 
(b) ANNUAL AUDITS.—The Director shall order an 
annual independent audit of the operations and budget of 
the Agency. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 304. RELATION TO OTHER AGENCIES. 
(a) COORDINATION.— 
(1) IN GENERAL.—With respect to covered enti-
ties and service providers, to the extent that Federal 
law authorizes the Agency and another Federal 
agency to enforce a Federal privacy law, the other 
Federal agency shall coordinate with the Agency to 
promote consistent enforcement of this Act and the 
other Federal privacy law. 
(2) REFERRAL.—Any Federal agency author-
ized to enforce Federal privacy laws may recommend 
in writing to the Agency that the Agency initiate an 
enforcement proceeding, as the Agency is authorized 
by that Federal privacy law or by this Act. 
(b) TRANSFERS FROM THE COMMISSION.— 
(1) TRANSFERS OF AUTHORITY.— 
(A) TRANSFER OF RULEMAKING AND CER-
TAIN
OTHER
AUTHORITIES
UNDER
FEDERAL 
PRIVACY
LAWS.—The Agency shall have all 
powers and duties under the Federal privacy 
laws to prescribe rules, issue guidelines, or to 
conduct studies or issue reports mandated by 
such laws, that were vested in the Commission 
on the effective date of this Act. The authority 
of the Commission under Federal privacy laws 
to prescribe rules, issue guidelines, or conduct 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
a study or issue a report mandated under such 
law shall be transferred to the Agency on the 
effective date of this Act. 
(B) TRANSFER
OF
ENFORCEMENT
AU-
THORITY.—The Agency may enforce a rule pre-
scribed by the Commission under— 
(i) Federal privacy laws; or 
(ii) the Federal Trade Commission 
Act (15 U.S.C. 41 et seq.) related to un-
fair or deceptive acts or practices relating 
to privacy, information security, identity 
theft, data abuses, and related matters. 
(2) TRANSFER OF PRIVACY EMPLOYEES.—Any 
employee of the Commission employed in a division, 
bureau, office, or other subdivision of the Commis-
sion with the primary responsibility of admin-
istering, investigating, or enforcing Federal privacy 
laws or applications of the Federal Trade Commis-
sion Act (15 U.S.C. 41 et seq.) related to unfair or 
deceptive acts or practices relating to privacy, infor-
mation security, identity theft, data abuses, and re-
lated matters shall be transferred to the Agency. 
Such employee shall be provided with compensation 
and benefits not less than the equivalent of com-
pensation and benefits provided to such employee on 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
the date of enactment of this Act or compensation 
and benefits provided to an employee of the Agency 
in comparable position with comparable experience. 
(c) PRESERVATION
OF AUTHORITIES
OF OTHER 
AGENCIES.—Except as described in this section, no provi-
sion of this Act shall be construed as modifying, limiting, 
or otherwise affecting the operation of any provision of 
Federal law, or otherwise affecting the authority of any 
Federal agency under a Federal privacy law or any other 
law, including the ability of such Federal agency to pro-
mulgate regulations and enforce Federal privacy laws. 
SEC. 305. PERSONNEL. 
(a) PERSONNEL.— 
(1) APPOINTMENT GENERALLY.—The Director 
may fix the number of, and appoint and direct, all 
employees of the Agency, in accordance with the ap-
plicable provisions of title 5, United States Code. 
The Director may appoint personnel without regard 
to the provisions of title 5, United States Code, gov-
erning appointments in the competitive service, so 
long as the Director sets requirements, conducts re-
cruitment, and determines appointments in a fair, 
transparent, and equitable manner. 
(2) EMPLOYEES OF THE AGENCY.—The Direc-
tor is authorized to employ privacy experts, tech-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
nologists, computer scientists, user experience de-
signers and researchers, data scientists, ethicists, at-
torneys, investigators, economists, civil rights ex-
perts, and other employees as the Director considers 
necessary to conduct the business of the Agency. 
Unless otherwise provided expressly by law, any indi-
vidual appointed under this section shall be an em-
ployee, as defined in section 2105 of title 5, United 
States Code, and subject to the provisions of such 
title and other laws generally applicable to the em-
ployees of an executive agency. 
(3) EMPLOYEE COMPENSATION.—The Director 
may fix and adjust the pay and benefits of personnel 
as the Director considers desirable, competitive, 
transparent, and equitable, without regard to the 
provisions of chapter 51 and subchapter III of chap-
ter 53 of title 5, United States Code, relating to 
classification and General Schedule pay rates, re-
spectively. 
(4) LABOR-MANAGEMENT
RELATIONS.—Chap-
ter 71 of title 5, United States Code, shall apply to 
the Agency and the employees of the Agency. 
(b) ADDITIONAL ROLES.— 
(1) CHIEF INFORMATION OFFICER.— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(A) DESIGNATION OF AN AGENCY CIO.— 
Subchapter II of chapter 113 of subtitle III of 
title 40, United States Code, is amended— 
(i) in section 11315(c) by adding 
‘‘and of the Digital Privacy Agency’’ before 
the em dash immediately preceding para-
graph (1); and 
(ii) in section 11319(a)(1) by adding 
‘‘and the Digital Privacy Agency’’ before 
the period. 
(B) RESPONSIBILITY.—The Chief Informa-
tion Officer of the Digital Privacy Agency, as 
designated by subparagraph (A), shall ensure 
the Digital Privacy Agency uses technology effi-
ciency to implement, administer, and enforce 
this Act and the rules and orders issued pursu-
ant to this Act. 
(2) INSPECTOR GENERAL.—Section 12 of the 
Inspector General Act of 1978 (5 U.S.C. App.) is 
amended— 
(A) in paragraph (1), by inserting ‘‘the Di-
rector of the Digital Privacy Agency;’’ after 
‘‘the President of the Export-Import Bank;’’; 
and 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) in paragraph (2), by inserting ‘‘the 
Digital Privacy Agency,’’ after ‘‘the Export-Im-
port Bank,’’. 
(3) OMBUD.—The Director shall appoint an 
ombud who shall— 
(A) act as a liaison between the Agency 
and any affected person with respect to any 
problem that such person may have in dealing 
with the Agency that results from the regu-
latory activities of the Agency; and 
(B) assure that safeguards exist to encour-
age complainants to come forward and preserve 
confidentiality. 
(c) AUTHORITY TO ACCEPT FEDERAL DETAILEES.— 
The Director may accept officers or employees of the 
United States or members of the Armed Forces on a detail 
from an element of the Federal Government on a nonreim-
bursable basis, as jointly agreed to by the heads of the 
receiving and detailing elements, for a period not to exceed 
3 years. 
SEC. 306. OFFICE OF CIVIL RIGHTS. 
The Director shall establish an Office of Civil Rights 
within the Agency that shall have following responsibil-
ities: 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) Providing oversight and enforcement of this 
Act, rules and orders issued pursuant to this Act, 
and Federal privacy laws to ensure that collecting, 
processing, maintaining, and disclosing of personal 
information is fair, equitable, and non-discrimina-
tory in treatment and effect, including through the 
implementation and enforcement of section 207. 
(2) Developing, establishing, and promoting 
practices that affirmatively further equal oppor-
tunity to and expand access to employment (includ-
ing hiring, firing, promotion, demotion, and com-
pensation), credit and insurance (including denial of 
an application or obtaining less favorable terms), 
housing, education, professional certification, or the 
provision of health care and related services. 
(3) Coordinating the Agency’s civil rights ef-
forts with other Federal agencies and State regu-
lators, as appropriate, to promote consistent, effi-
cient, and effective enforcement of Federal civil 
rights laws. 
(4) Working with civil rights advocates, privacy 
experts, and other experts (including members of the 
advisory boards established under section 308) on 
the promotion of compliance with the civil rights 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
provisions under this Act, rules and orders issued 
pursuant this Act, and Federal privacy laws. 
(5) Liaising with communities and consumers 
impacted by practices regulated by this Act and the 
Agency, to ensure that their needs and views are ap-
propriately taken into account. 
(6) Providing annual reports to Congress on the 
efforts of the Agency to fulfill its civil rights man-
date. 
(7) Such additional powers and duties as the 
Director may determine are appropriate. 
SEC. 307. COMPLAINTS OF INDIVIDUALS. 
(a) IN GENERAL.—The Director shall establish a unit 
within the Agency the functions of which shall include es-
tablishing a single, toll-free telephone number, a website, 
and a database or utilizing an existing database to facili-
tate the centralized collection of, monitoring of, and re-
sponse to complaints of individuals regarding the privacy 
or security of personal information. The Director shall co-
ordinate with other Federal agencies with jurisdiction over 
Federal privacy laws to route complaints to such agencies, 
where appropriate. 
(b) ROUTING COMPLAINTS TO STATES.—To the ex-
tent practicable, State agencies (including State privacy 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
100 
regulators) may receive appropriate complaints from the 
systems established under subsection (a), if— 
(1) the State agency system has the functional 
capacity to receive calls or electronic reports routed 
by the Agency systems; 
(2) the State agency has satisfied any condi-
tions of participation in the system that the Agency 
may establish, including treatment of personal infor-
mation and sharing of information on complaint res-
olution or related compliance procedures and re-
sources; and 
(3) participation by the State agency includes 
measures necessary to provide for protection of per-
sonal information that conform to the standards for 
protection of the confidentiality of personal informa-
tion and for data integrity and security that apply 
to Federal agencies. 
(c) DATA SHARING REQUIRED.—To facilitate inclu-
sion in the reports required by section 303 of the matters 
regarding complaints of individuals required by subsection 
(a)(2)(D) of such section to be included in such reports, 
investigation and enforcement activities, and monitoring 
of the privacy and security of personal information, the 
Agency shall share information about complaints of indi-
viduals with Federal and State agencies (including State 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
101 
privacy regulators) that have jurisdiction over the privacy 
or security of personal information and State attorneys 
general, subject to the standards applicable to Federal 
agencies for the protection of the confidentiality of per-
sonal information and for information security and integ-
rity. Other Federal agencies that have jurisdiction over the 
privacy or security of personal information shall share 
data relating to complaints of individuals regarding the 
privacy or security of personal information with the Agen-
cy, subject to the standards applicable to Federal agencies 
for the protection of confidentiality of personal informa-
tion and for information security and integrity. 
(d) PUBLISHING OF COMPLAINTS.— 
(1) CONSENT REQUIRED.—In collecting a com-
plaint from an individual, the Agency shall request 
consent for publishing the complaint without any in-
formation identifying the individual. 
(2) PUBLIC
DATABASE.—The Agency shall 
make publicly available on its website a database of 
each complaint for which it has received consent to 
publish the complaint from an individual who pro-
vided the complaint to the Agency. 
(3) REDACTING
INFORMATION.—When nec-
essary, the Agency may redact information from a 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
102 
published complaint to protect the privacy of the in-
dividual. 
SEC. 308. ADVISORY BOARDS. 
(a) ESTABLISHMENT.—The Director shall establish 
the following advisory boards to advise and consult with 
the Agency in the exercise of its functions under this Act, 
and to provide information on emerging practices relating 
to the treatment of personal information by covered enti-
ties: 
(1) The User Advisory Board, which shall be 
composed of experts in consumer protection, privacy, 
civil rights, and ethics. 
(2) The Research Advisory Board, which shall 
be composed of individuals with academic and re-
search expertise in privacy, cybersecurity, computer 
science, innovation, design, ethics, economics, law, 
and public policy. 
(3) The Startup Advisory Board, which shall be 
composed of representatives of small businesses and 
investors in small businesses. 
(4) The Product Advisory Board, which shall be 
composed of technologists, computer scientists, de-
signers, product managers, attorneys, and other rep-
resentatives of covered entities. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
103 
(b) APPOINTMENTS.—The Director shall appoint 
members to the advisory boards established under sub-
section (a) without regard to party affiliation. 
(c) MEETINGS.—Each advisory board established 
under subsection (a) shall meet from time to time at the 
call of the Director, but, at a minimum, shall meet at least 
twice in each calendar year. 
(d) COMPENSATION AND TRAVEL EXPENSES.—Mem-
bers of the advisory boards established under subsection 
(a) who are not full-time employees of the United States 
shall— 
(1) be entitled to receive compensation at a rate 
fixed by the Director while attending meetings of the 
advisory board, including travel time; and 
(2) receive travel expenses, including per diem 
in lieu of subsistence, in accordance with applicable 
provisions under subchapter I of chapter 57 of title 
5, United States Code. 
SEC. 309. AUTHORIZATION OF APPROPRIATIONS. 
There are authorized to be appropriated to the Direc-
tor to carry out this Act $550,000,000 for each of the 
fiscal years 2024, 2025, 2026, 2027, and 2028. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
104 
TITLE IV—ENFORCEMENT 
SEC. 401. INVESTIGATIONS AND ADMINISTRATIVE DIS-
COVERY. 
(a) JOINT INVESTIGATIONS.—The Agency or, where 
appropriate, an Agency investigator, may conduct inves-
tigations and make requests for information, as authorized 
under this Act, on a joint basis with another Federal agen-
cy, a State attorney general, or a State privacy regulator. 
(b) SUBPOENAS.— 
(1) IN GENERAL.—The Agency or an Agency 
investigator may issue subpoenas for the attendance 
and testimony of witnesses and the production of 
relevant papers, books, documents, or other material 
in connection with hearings under this Act. 
(2) FAILURE TO OBEY.—In the case of contu-
macy or refusal to obey a subpoena issued pursuant 
to this subsection and served upon any person, the 
district court of the United States for any district in 
which such person is found, resides, or transacts 
business, upon application by the Agency or an 
Agency investigator and after notice to such person, 
may issue an order requiring such person to appear 
and give testimony or to appear and produce docu-
ments or other material. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
105 
(3) CONTEMPT.—Any failure to obey an order 
of the court under paragraph (2) may be punished 
by the court as a contempt thereof. 
(c) DEMANDS.— 
(1) IN GENERAL.—Whenever the Agency has 
reason to believe that any person may be in posses-
sion, custody, or control of any documentary mate-
rial or tangible things, or may have any information, 
relevant to a violation, the Agency may, before the 
institution of any proceedings under this Act, issue 
in writing, and cause to be served upon such person, 
a civil investigative demand requiring such person 
to— 
(A) produce such documentary material for 
inspection and copying or reproduction in the 
form or medium requested by the Agency; 
(B) submit such tangible things; 
(C) file written reports or answers to ques-
tions; 
(D) give oral testimony concerning docu-
mentary material, tangible things, or other in-
formation; or 
(E) furnish any combination of such mate-
rial, answers, or testimony. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
106 
(2) REQUIREMENTS.—Each civil investigative 
demand shall state the nature of the conduct consti-
tuting the alleged violation which is under investiga-
tion and the provision of law applicable to such vio-
lation. 
(3) PRODUCTION OF DOCUMENTS.—Each civil 
investigative demand for the production of documen-
tary material shall— 
(A) describe each class of documentary 
material to be produced under the demand with 
such definiteness and certainty as to permit 
such material to be fairly identified; 
(B) prescribe a return date or dates which 
will provide a reasonable period of time within 
which the material so demanded may be assem-
bled and made available for inspection and 
copying or reproduction; and 
(C) identify the custodian to whom such 
material shall be made available. 
(4) PRODUCTION OF THINGS.—Each civil inves-
tigative demand for the submission of tangible 
things shall— 
(A) describe each class of tangible things 
to be submitted under the demand with such 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
107 
definiteness and certainty as to permit such 
things to be fairly identified; 
(B) prescribe a return date or dates which 
will provide a reasonable period of time within 
which the things so demanded may be assem-
bled and submitted; and 
(C) identify the custodian to whom such 
things shall be submitted. 
(5) DEMAND FOR WRITTEN REPORTS OR AN-
SWERS.—Each civil investigative demand for written 
reports or answers to questions shall— 
(A) propound with definiteness and cer-
tainty the reports to be produced or the ques-
tions to be answered; 
(B) prescribe a date or dates at which time 
written reports or answers to questions shall be 
submitted; and 
(C) identify the custodian to whom such 
reports or answers shall be submitted. 
(6) ORAL TESTIMONY.—Each civil investigative 
demand for the giving of oral testimony shall— 
(A) prescribe a date, time, and place at 
which oral testimony shall be commenced; and 
(B) identify an Agency investigator who 
shall conduct the investigation and the custo-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
108 
dian to whom the transcript of such investiga-
tion shall be submitted. 
(7) SERVICE.—Any civil investigative demand 
issued, and any enforcement petition filed, under 
this section may be served— 
(A) by any Agency investigator at any 
place within the territorial jurisdiction of any 
court of the United States; and 
(B) upon any person who is not found 
within the territorial jurisdiction of any court of 
the United States— 
(i) in such manner as the Federal 
Rules of Civil Procedure prescribe for serv-
ice in a foreign nation; and 
(ii) to the extent that the courts of 
the United States have authority to assert 
jurisdiction over such person, consistent 
with due process, the United States Dis-
trict Court for the District of Columbia 
shall have the same jurisdiction to take 
any action respecting compliance with this 
section by such person that such district 
court would have if such person were per-
sonally within the jurisdiction of such dis-
trict court. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
109 
(8) METHOD OF SERVICE.—Service of any civil 
investigative demand or any enforcement petition 
filed under this section may be made upon a person 
by— 
(A) delivering a duly executed copy of such 
demand or petition to the individual or to any 
partner, executive officer, managing agent, or 
general agent of such person, or to any agent 
of such person authorized by appointment or by 
law to receive service of process on behalf of 
such person; 
(B) delivering a duly executed copy of such 
demand or petition to the principal office or 
place of business of the person to be served; or 
(C) depositing a duly executed copy in the 
United States mails, by registered or certified 
mail, return receipt requested, duly addressed 
to such person at the principal office or place 
of business of such person. 
(9) PROOF OF SERVICE.— 
(A) IN GENERAL.—A verified return by the 
individual serving any civil investigative demand 
or any enforcement petition filed under this sec-
tion setting forth the manner of such service 
shall be proof of such service. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
110 
(B) RETURN
RECEIPTS.—In the case of 
service by registered or certified mail, such re-
turn shall be accompanied by the return post 
office receipt of delivery of such demand or en-
forcement petition. 
(10) PRODUCTION
OF
DOCUMENTARY
MATE-
RIAL.—The production of documentary material in 
response to a civil investigative demand shall be 
made under a sworn certificate, in such form as the 
demand designates, by the person, if a natural per-
son, to whom the demand is directed or, if not a 
natural person, by any person having knowledge of 
the facts and circumstances relating to such produc-
tion, to the effect that all of the documentary mate-
rial required by the demand and in the possession, 
custody, or control of the person to whom the de-
mand is directed has been produced and made avail-
able to the custodian. 
(11) SUBMISSION OF TANGIBLE THINGS.—The 
submission of tangible things in response to a civil 
investigative demand shall be made under a sworn 
certificate, in such form as the demand designates, 
by the person to whom the demand is directed or, 
if not a natural person, by any person having knowl-
edge of the facts and circumstances relating to such 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
111 
production, to the effect that all of the tangible 
things required by the demand and in the posses-
sion, custody, or control of the person to whom the 
demand is directed have been submitted to the cus-
todian. 
(12) SEPARATE ANSWERS.—Each reporting re-
quirement or question in a civil investigative demand 
shall be answered separately and fully in writing 
under oath, unless it is objected to, in which event 
the reasons for the objection shall be stated in lieu 
of an answer, and it shall be submitted under a 
sworn certificate, in such form as the demand des-
ignates, by the person, if a natural person, to whom 
the demand is directed or, if not a natural person, 
by any person responsible for answering each report-
ing requirement or question, to the effect that all in-
formation required by the demand and in the posses-
sion, custody, control, or knowledge of the person to 
whom the demand is directed has been submitted. 
(13) TESTIMONY.— 
(A) IN GENERAL.— 
(i) OATH
AND
RECORDATION.—The 
examination of any person pursuant to a 
demand for oral testimony served under 
this subsection shall be taken before an of-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
112 
ficer authorized to administer oaths and 
affirmations by the laws of the United 
States or of the place at which the exam-
ination is held. The officer before whom 
oral testimony is to be taken shall put the 
witness on oath or affirmation and shall 
personally, or by any individual acting 
under the direction of and in the presence 
of the officer, record the testimony of the 
witness. 
(ii) TRANSCRIPTION.—The testimony 
shall be taken stenographically and tran-
scribed. 
(B) PARTIES PRESENT.—Any Agency in-
vestigator before whom oral testimony is to be 
taken shall exclude from the place where the 
testimony is to be taken all other persons, ex-
cept the person giving the testimony, the attor-
ney for that person, the officer before whom the 
testimony is to be taken, an investigator or rep-
resentative of an agency with which the Agency 
is engaged in a joint investigation, and any ste-
nographer taking such testimony. 
(C) LOCATION.—The oral testimony of any 
person taken pursuant to a civil investigative 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
113 
demand shall be taken in the judicial district of 
the United States in which such person resides, 
is found, or transacts business, or in such other 
place as may be agreed upon by the Agency in-
vestigator before whom the oral testimony of 
such person is to be taken and such person. 
(D) ATTORNEY REPRESENTATION.— 
(i) IN
GENERAL.—Any person com-
pelled to appear under a civil investigative 
demand for oral testimony pursuant to this 
subsection may be accompanied, rep-
resented, and advised by an attorney. 
(ii) AUTHORITY.—The attorney may 
advise a person described in clause (i), in 
confidence, either upon the request of such 
person or upon the initiative of the attor-
ney, with respect to any question asked of 
such person. 
(iii) 
OBJECTIONS.—A 
person 
de-
scribed in clause (i), or the attorney for 
that person, may object on the record to 
any question, in whole or in part, and such 
person shall briefly state for the record the 
reason for the objection. An objection may 
properly be made, received, and entered 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
114 
upon the record when it is claimed that 
such person is entitled to refuse to answer 
the question on grounds of any constitu-
tional or other legal right or privilege, in-
cluding the privilege against self-incrimina-
tion, but such person shall not otherwise 
object to or refuse to answer any question, 
and such person or attorney shall not oth-
erwise interrupt the oral examination. 
(iv) REFUSAL TO ANSWER.—If a per-
son described in clause (i) refuses to an-
swer any question— 
(I) the Agency may petition the 
district court of the United States 
pursuant to this section for an order 
compelling such person to answer 
such question; and 
(II) if the refusal is on grounds 
of the privilege against self-incrimina-
tion, the testimony of such person 
may be compelled in accordance with 
the provisions of section 6004 of title 
18, United States Code. 
(E) TRANSCRIPTS.—For purposes of this 
subsection— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
115 
(i) after the testimony of any witness 
is fully transcribed, the Agency investi-
gator shall afford the witness (who may be 
accompanied by an attorney) a reasonable 
opportunity to examine the transcript; 
(ii) the transcript shall be read to or 
by the witness, unless such examination 
and reading are waived by the witness; 
(iii) any changes in form or substance 
which the witness desires to make shall be 
entered and identified upon the transcript 
by the Agency investigator, with a state-
ment of the reasons given by the witness 
for making such changes; 
(iv) the transcript shall be signed by 
the witness, unless the witness in writing 
waives the signing, is ill, cannot be found, 
or refuses to sign; and 
(v) if the transcript is not signed by 
the witness during the 30-day period fol-
lowing the date on which the witness is 
first afforded a reasonable opportunity to 
examine the transcript, the Agency investi-
gator shall sign the transcript and state on 
the record the fact of the waiver, illness, 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
116 
absence of the witness, or the refusal to 
sign, together with any reasons given for 
the failure to sign. 
(F) CERTIFICATION BY INVESTIGATOR.— 
The Agency investigator shall certify on the 
transcript that the witness was duly sworn by 
such Agency investigator and that the tran-
script is a true record of the testimony given by 
the witness, and the Agency investigator shall 
promptly deliver the transcript or send it by 
registered or certified mail to the custodian. 
(G) COPY OF TRANSCRIPT.—The Agency 
investigator shall furnish a copy of the tran-
script (upon payment of reasonable charges for 
the transcript) to the witness only, except that 
the Agency may for good cause limit such wit-
ness to inspection of the official transcript of 
the testimony of such witness. 
(H) WITNESS FEES.—Any witness appear-
ing for the taking of oral testimony pursuant to 
a civil investigative demand shall be entitled to 
the same fees and mileage which are paid to 
witnesses in the district courts of the United 
States. 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
117 
(d) CONFIDENTIAL TREATMENT OF DEMAND MATE-
RIAL.— 
(1) IN GENERAL.—Documentary materials and 
tangible things received as a result of a civil inves-
tigative demand shall be subject to requirements and 
procedures regarding confidentiality, in accordance 
with rules established by the Agency. 
(2) DISCLOSURE TO CONGRESS.—No rule es-
tablished by the Agency regarding the confidentiality 
of materials submitted to, or otherwise obtained by, 
the Agency shall be intended to prevent disclosure to 
either House of Congress or to an appropriate com-
mittee of the Congress, except that the Agency is 
permitted to adopt rules allowing prior notice to any 
party that owns or otherwise provided the material 
to the Agency and had designated such material as 
confidential. 
(e) PETITION FOR ENFORCEMENT.— 
(1) IN GENERAL.—Whenever any person fails 
to comply with any civil investigative demand duly 
served upon such person under this section, or when-
ever satisfactory copying or reproduction of material 
requested pursuant to the demand cannot be accom-
plished and such person refuses to surrender such 
material, the Agency, through such officers or attor-
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
118 
neys as it may designate, may file, in the district 
court of the United States for any judicial district 
in which such person resides, is found, or transacts 
business, and serve upon such person, a petition for 
an order of such court for the enforcement of this 
section. 
(2) SERVICE OF PROCESS.—All process of any 
court to which application may be made as provided 
in this subsection may be served in any judicial dis-
trict. 
(f) PETITION FOR ORDER MODIFYING OR SETTING 
ASIDE DEMAND.— 
(1) IN GENERAL.—Not later than 20 days after 
the service of any civil investigative demand upon 
any person under subsection (c), or at any time be-
fore the return date specified in the demand, which-
ever period is shorter, or within such period exceed-
ing 20 days after service or in excess of such return 
date as may be prescribed in writing, subsequent to 
service, by any Agency investigator named in the de-
mand, such person may file with the Agency a peti-
tion for an order by the Agency modifying or setting 
aside the demand. 
(2) COMPLIANCE
DURING
PENDENCY.—The 
time permitted for compliance with the demand in 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
119 
whole or in part, as determined proper and ordered 
by the Agency, shall not run during the pendency of 
a petition under paragraph (1) at the Agency, except 
that such person shall comply with any portions of 
the demand not sought to be modified or set aside. 
(3) SPECIFIC
GROUNDS.—A petition under 
paragraph (1) shall specify each ground upon which 
the petitioner relies in seeking relief, and may be 
based upon any failure of the demand to comply 
with the provisions of this section, or upon any con-
stitutional or other legal right or privilege of such 
person. 
(g) CUSTODIAL CONTROL.—At any time during 
which any custodian is in custody or control of any docu-
mentary material, tangible things, reports, answers to 
questions, or transcripts of oral testimony given by any 
person in compliance with any civil investigative demand, 
such person may file, in the district court of the United 
States for the judicial district within which the office of 
such custodian is situated, and serve upon such custodian, 
a petition for an order of such court requiring the per-
formance by such custodian of any duty imposed upon 
such custodian by this section or rule promulgated by the 
Agency. 
(h) JURISDICTION OF COURT.— 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
120 
(1) IN
GENERAL.—Whenever any petition is 
filed in any district court of the United States under 
this section, such court shall have jurisdiction to 
hear and determine the matter so presented, and to 
enter such order or orders as may be required to 
carry out the provisions of this section. 
(2) APPEAL.—Any final order entered as de-
scribed in paragraph (1) shall be subject to appeal 
pursuant to section 1291 of title 28, United States 
Code. 
SEC. 402. HEARINGS AND ADJUDICATION PROCEEDINGS. 
(a) IN GENERAL.—The Agency is authorized to con-
duct hearings and adjudication proceedings with respect 
to any person in the manner prescribed by chapter 5 of 
title 5, United States Code, in order to ensure or enforce 
compliance with this Act and the rules prescribed under 
this Act. 
(b) SPECIAL RULES FOR CEASE-AND-DESIST PRO-
CEEDINGS.— 
(1) ORDERS AUTHORIZED.— 
(A) IN GENERAL.—If, in the opinion of the 
Agency, a person is engaging or has engaged in 
an act or omission that violates any provision of 
this Act or a rule or order prescribed under this 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
121 
Act, the Agency may issue and serve upon the 
person a notice of charges in respect thereof. 
(B) CONTENT
OF
NOTICE.—The notice 
under subparagraph (A) shall contain a state-
ment of the facts constituting the alleged viola-
tion, and shall fix a time and place at which a 
hearing will be held to determine whether an 
order to cease and desist should issue against 
the person, such hearing to be held not earlier 
than 30 days nor later than 60 days after the 
date of service of such notice, unless an earlier 
or a later date is set by the Agency, at the re-
quest of any person so served. 
(C) CONSENT.—Unless a person served 
under subparagraph (B) appears at the hearing 
personally or by a duly authorized representa-
tive, the person shall be deemed to have con-
sented to the issuance of the cease-and-desist 
order. 
(D) PROCEDURE.—In the event of consent 
under subparagraph (C), or if, upon the record 
made at any such hearing, the Agency finds 
that any violation specified in the notice of 
charges has been established, the Agency may 
issue and serve upon the person an order to 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
122 
cease and desist from the violation. Such order 
may, by provisions which may be mandatory or 
otherwise, require the person to cease and de-
sist from the subject act or omission, and to 
take affirmative action to correct the conditions 
resulting from any such violation. 
(2) EFFECTIVENESS OF ORDER.—A cease-and- 
desist order shall become effective at the expiration 
of 30 days after the date of service of the order 
under paragraph (1)(D) (except in the case of a 
cease-and-desist order issued upon consent, which 
shall become effective at the time specified therein), 
and shall remain effective and enforceable as pro-
vided therein, except to such extent as the order is 
stayed, modified, terminated, or set aside by action 
of the Agency or a reviewing court. 
(3) DECISION AND APPEAL.—Any hearing pro-
vided for in this subsection shall be held in the Fed-
eral judicial district or in the territory in which the 
residence or principal office or place of business of 
the person is located unless the person consents to 
another place, and shall be conducted in accordance 
with the provisions of chapter 5 of title 5, United 
States Code. After such hearing, and not later than 
90 days after the Agency has notified each party to 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB
123 
the proceeding that the case has been submitted to 
the Agency for final decision, the Agency shall 
render its decision (which shall include findings of 
fact upon which its decision is predicated) and shall 
issue and serve upon each such party an order or or-
ders consistent with the provisions of this section. 
Judicial review of any such order shall be exclusively 
as provided in this subsection. Unless a petition for 
review is timely filed in a court of appeals of the 
United States, as provided in paragraph (4), and 
thereafter until the record in the proceeding has 
been filed as provided in paragraph (4), the Agency 
may at any time, upon such notice and in such man-
ner as the Agency shall determine proper, modify, 
terminate, or set aside any such order. Upon filing 
of the record as provided, the Agency may modify, 
terminate, or set aside any such order with permis-
sion of the court. 
(4) APPEAL
TO
COURT
OF
APPEALS.—Any 
party to any proceeding under this subsection may 
obtain a review of any order served pursuant to this 
subsection (other than an order issued with the con-
sent of the party) by filing in the court of appeals 
of the United States for the circuit in which the resi-
dence or principal office or place of business of the 
VerDate Sep 11 2014 
02:53 Apr 27, 2023
Jkt 039200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6201
E:\BILLS\H2701.IH
H2701
pbinns on DSKJLVW7X2PROD with $$_JOB