Electronic Privacy Bill of Rights Act of 1998

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Electronic Privacy Bill of Rights 
Act of 1998''.

           TITLE I--INTERNET PRIVACY PROTECTION FOR CHILDREN

SEC. 101. REGULATION OF UNFAIR AND DECEPTIVE ACTS AND PRACTICES IN 
              CONNECTION WITH THE COLLECTION AND USE OF PERSONAL 
              INFORMATION FROM AND ABOUT CHILDREN ON THE INTERNET.

    (a) Regulations.--
            (1) In general.--It shall be unlawful for any operator of a 
        website or online service that is directed to children, or any 
        operator that has actual knowledge that it is collecting 
        personal information from a child, to collect personal 
        information from a child under the age of 13 in violation of 
        the regulations prescribed under paragraph (2).
            (2) Contents.--Not later than one year after the date of 
        enactment of this Act, the Commission shall prescribe 
        regulations to prevent the improper collection of information 
        from children under the age of 13. Such regulations shall--
                    (A) require that any website or online service that 
                is directed to children that collects personal 
                information from children--
                            (i) provide clear, prominent, 
                        understandable notice of the information 
                        collection, use, and disclosure practices of 
                        the operator through the website or online 
                        service;
                            (ii) obtain verifiable parental consent for 
                        the collection, use, or disclosure of personal 
                        information from children who are under the age 
                        of 13; and
                            (iii) provide a parent--
                                    (I) access to the personal 
                                information of the child of that parent 
                                collected by that website or online 
                                service; and
                                    (II) the opportunity to refuse to 
                                permit any further use or future 
                                collection of personal information 
                                referred to in subclause (I) and notice 
                                of that opportunity; and
                    (B) require that the operator of the website or 
                online service concerned to establish and maintain 
                reasonable procedures to ensure the confidentiality, 
                security, accuracy, and integrity of personal 
                information collected from children through the website 
                or online service.
    (b) Enforcement.--
            (1) Treatment of regulations.--A regulation prescribed 
        under subsection (a) shall be treated as a rule defining an 
        unfair or deceptive act or practice under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Enforcement.--Subject to section 103, a violation of a 
        regulation prescribed under subsection (a) shall be treated as 
        a violation of a rule defining an unfair or deceptive act or 
        practice prescribed under section 18(a)(1)(B) of the Federal 
        Trade Commission Act.

SEC. 102. SAFE HARBORS.

    (a) In General.--In prescribing regulations under section 101, the 
Federal Trade Commission shall provide incentives for efforts of self-
regulation by commercial website operators to implement the protections 
described in subsection (a) of that section.
    (b) Safe Harbors.--The incentives referred to in subsection (a) 
shall include provisions for ensuring that a person will be deemed to 
be in compliance with the requirements of the regulations under section 
101 if that person applies guidelines that--
            (1) are issued by appropriate representatives of the 
        computer industry; and
            (2) are approved by the Federal Trade Commission upon 
        making a determination that the guidelines meet the 
        requirements of the regulations issued under section 101.

SEC. 103. ADMINISTRATION AND APPLICABILITY OF ACT.

    (a) In General.--Except as otherwise provided, this title shall be 
enforced by the Federal Trade Commission under the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.).
    (b) Provisions.--Compliance with the requirements imposed under 
this title shall be enforced under--
            (1) section 8 of the Federal Deposit Insurance Act (12 
        U.S.C. 1818), in the case of--
                    (A) national banks, and Federal branches and 
                Federal agencies of foreign banks, by the Office of the 
                Comptroller of the Currency;
                    (B) member banks of the Federal Reserve System 
                (other than national banks), branches and agencies of 
                foreign banks (other than Federal branches, Federal 
                agencies, and insured State branches of foreign banks), 
                commercial lending companies owned or controlled by 
                foreign banks, and organizations operating under 
                section 25 or 25(a) of the Federal Reserve Act (12 
                U.S.C. 601 et seq. and 611 et seq.), by the Board; and
                    (C) banks insured by the Federal Deposit Insurance 
                Corporation (other than members of the Federal Reserve 
                System) and insured State branches of foreign banks, by 
                the Board of Directors of the Federal Deposit Insurance 
                Corporation;
            (2) section 8 of the Federal Deposit Insurance Act (12 
        U.S.C. 1818), by the Director of the Office of Thrift 
        Supervision, in the case of a savings association the deposits 
        of which are insured by the Federal Deposit Insurance 
        Corporation;
            (3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.), 
        by the National Credit Union Administration Board with respect 
        to any Federal credit union;
            (4) part A of subtitle VII of title 49, by the Secretary of 
        Transportation with respect to any air carrier or foreign air 
        carrier subject to that part;
            (5) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et 
        seq.) (except as provided in section 406 of that Act (7 U.S.C. 
        226, 227)), by the Secretary of Agriculture with respect to any 
        activities subject to that Act; and
            (6) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by 
        the Farm Credit Administration with respect to any Federal land 
        bank, Federal land bank association, Federal intermediate 
        credit bank, or production credit association.
    (c) Exercise of Certain Powers.--For the purpose of the exercise by 
any agency referred to in subsection (b) of its powers under any Act 
referred to in that subsection, a violation of any requirement imposed 
under this title shall be deemed to be a violation of a requirement 
imposed under that Act. In addition to its powers under any provision 
of law specifically referred to in subsection (a), each of the agencies 
referred to in that subsection may exercise, for the purpose of 
enforcing compliance with any requirement imposed under this title, any 
other authority conferred on it by law.
    (d) Actions by the Commission.--The Federal Trade Commission shall 
prevent any person from violating a rule of the Federal Trade 
Commission under section 101 in the same manner, by the same means, and 
with the same jurisdiction, powers, and duties as though all applicable 
terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 
et seq.) were incorporated into and made a part of this title. Any 
entity that violates such rule shall be subject to the penalties and 
entitled to the privileges and immunities provided in the Federal Trade 
Commission Act in the same manner, by the same means, and with the same 
jurisdiction, power, and duties as though all applicable terms and 
provisions of the Federal Trade Commission Act were incorporated into 
and made a part of this title.
    (e) Effect on Other Laws.--Nothing contained in the Act shall be 
construed to limit the authority of the Federal Trade Commission under 
any other provisions of law.

SEC. 104. REVIEW.

    (a) In General.--Not later than 5 years after the effective date of 
the regulations initially issued under section 101, the Federal Trade 
Commission shall--
            (1) review the implementation of this title, including the 
        effect of the implementation of this title on practices 
        relating to the disclosure of information relating to children; 
        and
            (2) prepare and submit to Congress a report the results of 
        the review under paragraph (1).

SEC. 105. DEFINITIONS.

    In this title:
            (1) Child.--The terms ``child'' and ``children'' means an 
        individual or individuals, respectively, under the age of 16.
            (2) Operator.--The term ``operator'' means any person 
        operating a website on the World Wide Webs for commercial 
        purposes, or operating any online service, and includes any 
        person offering products or services for sale though that 
        website or online service, involving commerce--
                    (A) among the several States or with 1 or more 
                foreign nations;
                    (B) in any territory of the United States or in the 
                District of Columbia, or between any such territory--
                            (i) and another such territory; or
                            (ii) and any State or foreign nation; or
                    (C) between the District of Columbia and any State, 
                territory, or foreign nation.
        Such term does not include any non-profit entity that would 
        otherwise be exempt from coverage under section 5 of the 
        Federal Trade Commission Act (15 U.S.C. 45).
            (3) Disclosure.--The term ``disclosure'' means, with 
        respect to personal information--
                    (A) the release of information in identifiable form 
                by a person to any other person for any purpose; or
                    (B) making publicly available information in 
                identifiable form by any means including by a public 
                posting, through the use of a computer on or through--
                            (i) a home page of a website;
                            (ii) a pen pal service;
                            (iii) an electronic mail service;
                            (iv) a message board; or
                            (v) a chat room.
            (4) Parent.--The term ``parent'' means a legal guardian, 
        including a biological or adoptive parent.
            (5) Personal information.--The term ``personal 
        information'' means individually, identifiable information 
        about an individual, including--
                    (A) a first and last name;
                    (B) a home or other physical address;
                    (C) an e-mail address;
                    (D) a telephone number;
                    (E) a Social Security number; or
                    (F) any other information that would facilitate or 
                enable the physical or online locating and contacting 
                of a specific individual, including information that is 
                associated with an identifier described in this 
                paragraph in such manner as to become identifiable to a 
                specific individual.
            (6) Verifiable parental consent.--The term ``verifiable 
        parental consent'' means any reasonable effort (taking into 
        consideration available technology) to ensure that a parent of 
        a child authorizes the disclosure of personal information and 
        subsequent use of that information before that information is 
        collected from that child.
            (7) Website directed to children.--The term ``website 
        directed to children''--
                    (A) means a commercial website that is--
                            (i) targeted to children;
                            (ii) directed to children by reason of the 
                        subject matter, visual content, age of models, 
                        language, characters, tone, message, or any 
                        other similar characteristic of the website; or
                            (iii) used by a commercial website operator 
                        to knowingly collect information from children; 
                        and
                    (B) includes any commercial website any portion of 
                which is directed to children, as specified in 
                subparagraph (A).

   TITLE II--EXAMINATIONS OF INTERNET PRIVACY PROTECTIONS FOR ADULTS

SEC. 201. FEDERAL TRADE COMMISSION EXAMINATION.

    (a) Proceeding Required.--Within 6 months after the date of 
enactment of this Act, the Federal Trade Commission shall commence a 
proceeding--
            (1) to determine whether consumers are able, and, if not, 
        the methods by which consumers may be enabled--
                    (A) to have knowledge that consumer information is 
                being collected about them through their utilization of 
                various telecommunications services and systems;
                    (B) to receive conspicuous notice that such 
                information could be used, or is intended to be used, 
                without authorization by the entity collecting the data 
                for reasons unrelated to the original communications, 
                or that such information could be sold (or is intended 
                to be sold) to other companies or entities;
                    (C) to give notice to indicate the particular 
                privacy preferences of the consumer with respect to the 
                practices described in subparagraphs (A) and (B);
                    (D) to exercise control over the collection of 
                personal information and to stop the unauthorized use, 
                reuse, disclosure, or sale of that information;
            (2) to solicit and review comment from the public and the 
        National Telecommunication and Information Administration on 
        the changes proposed pursuant to paragraph (3); and
            (3) to prepare recommendations to the Congress for any 
        legislative changes required to correct such defects.
    (b) Schedule for Federal Trade Commission Responses.--The Federal 
Trade Commission shall, within 1 year after the date of enactment of 
this Act--
            (1) complete any rulemaking required to revise Commission 
        regulations to correct any defects in such regulations 
        identified pursuant to subsection (a); and
            (2) submit to Congress a report containing the 
        recommendations required by subsection (a)(5).

SEC. 202. FEDERAL COMMUNICATIONS COMMISSION EXAMINATION.

    (a) Proceeding Required.--Within 6 months after the date of 
enactment of this Act, the Federal Communications Commission shall 
commence a proceeding--
            (1) to examine the impact of interconnected communications 
        networks of telephone, cable, satellite, wireless devices, and 
        other technologies on the privacy rights and remedies of the 
        consumers of those technologies, as described in paragraphs (1) 
        and (2) of section 101(a);
            (2) to determine whether consumers are able, and, if not, 
        the methods by which consumers may be enabled to exercise such 
        rights and remedies;
            (3) to determine whether common carriers have taken 
        adequate steps to secure the communications infrastructure and 
        its components against unauthorized interception of 
        communications and other personal information;
            (4) to propose changes in the Commission's regulations to 
        ensure that the effect on consumer privacy rights is considered 
        in the introduction of new telecommunications services and that 
        the protection of such privacy rights and network security is 
        incorporated as necessary in the design of such services or the 
        rules regulating such services;
            (5) to propose changes in the Commission's regulations as 
        necessary to correct any defects identified pursuant to this 
        section in such rights, remedies, and security;
            (6) to solicit and review comment from the public and the 
        National Telecommunication and Information Administration on 
        the changes proposed pursuant to paragraph (5); and
            (7) to prepare recommendations to the Congress for any 
        legislative changes required to correct such defects.
    (b) Schedule for Federal Communications Commission Responses.--The 
Federal Communications Commission shall, within 1 year after the date 
of enactment of this Act--
            (1) complete any rulemaking required to revise Commission 
        regulations to correct defects in such regulations identified 
        pursuant to subsection (a); and
            (2) submit to the Congress a report containing the 
        recommendations required by subsection (a)(6).

Summary: TABLE OF CONTENTS: 
     Title I:  Internet Privacy Protection for Children 
     Title II:  Examinations of Internet Privacy Protections for 
          Adults 
Electronic Privacy Bill of Rights Act of 1998 - 
Title I:  Internet Privacy Protection for Children
 - Makes it unlawful for any operator of a website or online service directed to children to collect personal information from a child under 13 in violation of mandated regulations.  Treats violations as unfair or deceptive acts or practices under the Federal Trade Commission Act. 
(Sec. 102) Requires that the regulations provide incentives for self-regulation, including deeming compliance if a person applies guidelines issued by computer industry representatives and approved by the Federal Trade Commission. 
Title II:  Examinations of Internet Privacy Protections for Adults
 - Directs the Commission to report to the Congress and make related rule changes regarding:  (1) whether consumers are able and, if not, how consumers may be enabled, to know that information is being collected about them through their use of telecommunications systems and to exercise control over the collection, use, reuse, disclosure, or sale of the information; (2) the impact of interconnected communications technologies on consumer privacy rights and remedies.