My Body, My Data Act of 2022
Bill: S.4434 | Sponsor: Sen. Hirono, Mazie K. (D-HI)
Policy area: Commerce

Summary:
My Body, My Data Act of 2022
This bill establishes protections, subject to certain limits, for personal reproductive or sexual health information. This includes information relating to past, present, or future surgeries or procedures, such as the termination of a pregnancy.
Specifically, commercial entities, including individuals, nonprofits, and common carriers, may not collect, retain, use, or disclose personal reproductive or sexual health information except (1) with the express written consent of the individual to whom such information relates, or (2) as is strictly necessary to provide a requested product or service.
Commercial entities also must provide individuals with access to, and a reasonable mechanism to delete, any of their reproductive or sexual health information upon request. Further, commercial entities must maintain and publish a privacy policy describing their practices with respect to such information.
The bill's provisions do not apply to entities that are subject to certain existing health-related privacy regulations, such as the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996. Additionally, the provisions do not apply to the disclosure of personal reproductive or sexual health information for the publication of newsworthy information of legitimate public concern.
The bill provides for enforcement by the Federal Trade Commission and by private civil actions.

To protect the privacy of personal reproductive or sexual health 
                  information, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``My Body, My Data Act of 2022''.

SEC. 2. MINIMIZATION.

    (a) Minimization of Collecting, Retaining, Using, and Disclosing.--
A regulated entity may not collect, retain, use, or disclose personal 
reproductive or sexual health information except--
            (1) with the express consent of the individual to whom such 
        information relates; or
            (2) as is strictly necessary to provide a product or 
        service that the individual to whom such information relates 
        has requested from such regulated entity.
    (b) Minimization of Employee Access.--A regulated entity shall 
restrict access to personal reproductive or sexual health information 
by the employees or service providers of such regulated entity to such 
employees or service providers for which access is necessary to provide 
a product or service that the individual to whom such information 
relates has requested from such regulated entity.

SEC. 3. RIGHT OF ACCESS AND DELETION.

    (a) Right of Access.--
            (1) In general.--A regulated entity shall make available a 
        reasonable mechanism by which an individual, upon a verified 
        request, may access--
                    (A) any personal reproductive or sexual health 
                information relating to such individual that is 
                retained by such regulated entity, including--
                            (i) in the case of such information that 
                        such regulated entity collected from third 
                        parties, how and from which specific third 
                        parties such regulated entity collected such 
                        information; and
                            (ii) such information that such regulated 
                        entity inferred about such individual; and
                    (B) a list of the specific third parties to which 
                such regulated entity has disclosed any personal 
                reproductive or sexual health information relating to 
                such individual.
            (2) Format.--A regulated entity shall make the information 
        described in paragraph (1) available in both a human-readable 
        format and a structured, interoperable, and machine-readable 
        format.
    (b) Right of Deletion.--A regulated entity shall make available a 
reasonable mechanism by which an individual, upon a verified request, 
may request the deletion of any personal reproductive or sexual health 
information relating to such individual that is retained by such 
regulated entity, including any such information that such regulated 
entity collected from a third party or inferred from other information 
retained by such regulated entity.
    (c) General Provisions.--
            (1) Reasonable mechanism defined.--In this section, the 
        term ``reasonable mechanism'' means, with respect to a 
        regulated entity and a right under this section, a mechanism 
        that--
                    (A) is equivalent in availability and ease of use 
                to that of other mechanisms for communicating or 
                interacting with such regulated entity; and
                    (B) includes an online means of exercising such 
                right.
            (2) Timeline for complying with requests.--A regulated 
        entity shall comply with a verified request received under this 
        section without undue delay but not later than 15 days after 
        the date on which such regulated entity receives such verified 
        request.
            (3) Fees prohibited.--A regulated entity may not charge a 
        fee to an individual for a request made under this section.
            (4) Rules of construction.--Nothing in this section shall 
        be construed to require a regulated entity to--
                    (A) take an action that would convert information 
                that is not personal information into personal 
                information;
                    (B) collect or retain personal information that 
                such regulated entity would otherwise not collect or 
                retain; or
                    (C) retain personal information longer than such 
                regulated entity would otherwise retain such 
                information.

SEC. 4. PRIVACY POLICY.

    (a) Policy Required.--A regulated entity shall maintain a privacy 
policy relating to the practices of such regulated entity regarding the 
collecting, retaining, using, and disclosing of personal reproductive 
or sexual health information.
    (b) Publication Required.--If a regulated entity has a website, 
such regulated entity shall prominently publish the privacy policy 
required by subsection (a) on such website.
    (c) Contents.--The privacy policy required by subsection (a) shall 
be clear and conspicuous and shall contain, at a minimum, the 
following:
            (1) A description of the practices of the regulated entity 
        regarding the collecting, retaining, using, and disclosing of 
        personal reproductive or sexual health information.
            (2) A clear and concise statement of the categories of such 
        information collected, retained, used, or disclosed by the 
        regulated entity.
            (3) A clear and concise statement of the purposes of the 
        regulated entity for the collecting, retaining, using, or 
        disclosing of such information.
            (4) A list of the specific third parties to which the 
        regulated entity discloses such information, and a clear and 
        concise statement of the purposes for which the regulated 
        entity discloses such information, including how the 
        information may be used by each such third party.
            (5) A list of the specific third parties from which the 
        regulated entity has collected such information, and a clear 
        and concise statement of the purposes for which the regulated 
        entity collects such information.
            (6) A clear and concise statement describing the extent to 
        which individuals may exercise control over the collecting, 
        retaining, using, and disclosing of personal reproductive or 
        sexual health information by the regulated entity, and the 
        steps an individual must take to implement such controls.
            (7) A clear and concise statement describing the efforts of 
        the regulated entity to protect personal reproductive or sexual 
        health information from unauthorized disclosure.

SEC. 5. ENFORCEMENT.

    (a) Enforcement by Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        this Act or a regulation promulgated under this Act shall be 
        treated as a violation of a regulation under section 
        18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
        57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
            (2) Powers of commission.--Except as provided in section 
        6(7)(A)(ii), the Commission shall enforce this Act and the 
        regulations promulgated under this Act in the same manner, by 
        the same means, and with the same jurisdiction, powers, and 
        duties as though all applicable terms and provisions of the 
        Federal Trade Commission Act (15 U.S.C. 41 et seq.) were 
        incorporated into and made a part of this Act, and any 
        regulated entity that violates this Act or a regulation 
        promulgated under this Act shall be subject to the penalties 
        and entitled to the privileges and immunities provided in the 
        Federal Trade Commission Act.
            (3) Rulemaking authority.--The Commission may promulgate 
        regulations under section 553 of title 5, United States Code, 
        to implement this Act.
    (b) Enforcement by Individuals.--
            (1) In general.--Any individual alleging a violation of 
        this Act or a regulation promulgated under this Act may bring a 
        civil action in any court of competent jurisdiction.
            (2) Relief.--In a civil action brought under paragraph (1) 
        in which the plaintiff prevails, the court may award--
                    (A) an amount not less than $100 and not greater 
                than $1,000 per violation per day, or actual damages, 
                whichever is greater;
                    (B) punitive damages;
                    (C) reasonable attorney's fees and litigation 
                costs; and
                    (D) any other relief, including equitable or 
                declaratory relief, that the court determines 
                appropriate.
            (3) Injury in fact.--A violation of this Act, or a 
        regulation promulgated under this Act, with respect to personal 
        reproductive or sexual health information constitutes a 
        concrete and particularized injury in fact to the individual to 
        whom such information relates.
            (4) Invalidity of pre-dispute arbitration agreements and 
        pre-dispute joint action waivers.--
                    (A) In general.--Notwithstanding any other 
                provision of law, no pre-dispute arbitration agreement 
                or pre-dispute joint-action waiver shall be valid or 
                enforceable with respect to a dispute arising under 
                this Act.
                    (B) Applicability.--Any determination as to whether 
                or how this paragraph applies to any dispute shall be 
                made by a court, rather than an arbitrator, without 
                regard to whether such agreement purports to delegate 
                such determination to an arbitrator.
                    (C) Definitions.--For purposes of this paragraph:
                            (i) Pre-dispute arbitration agreement.--The 
                        term ``pre-dispute arbitration agreement'' 
                        means any agreement to arbitrate a dispute that 
                        has not arisen at the time of the making of the 
                        agreement.
                            (ii) Pre-dispute joint-action waiver.--The 
                        term ``pre-dispute joint-action waiver'' means 
                        an agreement that would prohibit a party from 
                        participating in a joint, class, or collective 
                        action in a judicial, arbitral, administrative, 
                        or other forum, concerning a dispute that has 
                        not yet arisen at the time of the making of the 
                        agreement.

SEC. 6. DEFINITIONS.

    In this Act:
            (1) Collect.--The term ``collect'' means, with respect to 
        personal reproductive or sexual health information, for a 
        regulated entity to obtain such information in any manner.
            (2) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (3) Disclose.--The term ``disclose'' means, with respect to 
        personal reproductive or sexual health information, for a 
        regulated entity to release, transfer, sell, provide access to, 
        license, or divulge such information in any manner to a third 
        party or government entity.
            (4) Express consent.--
                    (A) In general.--The term ``express consent'' 
                means, with respect to the collecting, retaining, 
                using, or disclosing of personal reproductive or sexual 
                health information, informed, opt-in, voluntary, 
                specific, and unambiguous written consent (which may 
                include written consent provided by electronic means) 
                to such collecting, retaining, using, or disclosing of 
                such information.
                    (B) Exclusions.--The term ``express consent'' does 
                not include any of the following:
                            (i) Consent secured without first providing 
                        to the individual a clear and conspicuous 
                        disclosure, apart from any privacy policy, 
                        terms of service, terms of use, general 
                        release, user agreement, or other similar 
                        document, of all information material to the 
                        provision of consent.
                            (ii) Hovering over, muting, pausing, or 
                        closing a given piece of content.
                            (iii) Agreement obtained through the use of 
                        a user interface designed or manipulated with 
                        the substantial effect of subverting or 
                        impairing user autonomy, decision making, or 
                        choice.
            (5) Personal information.--The term ``personal 
        information'' means information that identifies, relates to, 
        describes, is reasonably capable of being associated with, or 
        could reasonably be linked, directly or indirectly, with a 
        particular individual.
            (6) Personal reproductive or sexual health information.--
        The term ``personal reproductive or sexual health information'' 
        means personal information relating to the past, present, or 
        future reproductive or sexual health of an individual, 
        including--
                    (A) efforts to research or obtain reproductive or 
                sexual information services or supplies, including 
                location information that might indicate an attempt to 
                acquire or receive such information services or 
                supplies;
                    (B) reproductive or sexual health conditions, 
                status, diseases, or diagnoses, including pregnancy, 
                menstruation, ovulation, ability to conceive a 
                pregnancy, whether such individual is sexually active, 
                and whether such individual is engaging in unprotected 
                sex;
                    (C) reproductive- and sexual-health-related 
                surgeries or procedures, such as termination of a 
                pregnancy;
                    (D) use or purchase of contraceptives, birth 
                control, or any medication related to reproductive 
                health, including abortifacients;
                    (E) bodily functions, vital signs, measurement, or 
                symptoms related to menstruation or pregnancy, such as 
                basal temperature, cramps, bodily discharge, or hormone 
                levels;
                    (F) any information about diagnoses or diagnostic 
                testing, treatment, medications, or the use of any 
                product or service relating to the matters described in 
                subparagraphs (A) through (E); and
                    (G) any information described in subparagraphs (A) 
                through (F) that is derived or extrapolated from non-
                health information (such as proxy, derivative, 
                inferred, emergent, or algorithmic data).
            (7) Regulated entity.--
                    (A) In general.--The term ``regulated entity'' 
                means any entity (to the extent such entity is engaged 
                in activities in or affecting commerce (as defined in 
                section 4 of the Federal Trade Commission Act (15 
                U.S.C. 44))) that is--
                            (i) a person, partnership, or corporation 
                        subject to the jurisdiction of the Commission 
                        under section 5(a)(2) of the Federal Trade 
                        Commission Act (15 U.S.C. 45(a)(2)); or
                            (ii) notwithstanding section 4, 5(a)(2), or 
                        6 of the Federal Trade Commission Act (15 
                        U.S.C. 44; 45(a)(2); 46) or any jurisdictional 
                        limitation of the Commission--
                                    (I) a common carrier subject to the 
                                Communications Act of 1934 (47 U.S.C. 
                                151 et seq.) and all Acts amendatory 
                                thereof and supplementary thereto; or
                                    (II) an organization not organized 
                                to carry on business for its own profit 
                                or that of its members.
                    (B) Exclusions.--The term ``regulated entity'' does 
                not include--
                            (i) an entity that is a covered entity, as 
                        defined in section 160.103 of title 45, Code of 
                        Federal Regulations (or any successor to such 
                        regulation), to the extent such entity is 
                        acting as a covered entity under the HIPAA 
                        privacy regulations (as defined in section 
                        1180(b)(3) of the Social Security Act (42 
                        U.S.C. 1320d-9(b)(3)));
                            (ii) an entity that is a business 
                        associate, as defined in section 160.103 of 
                        title 45, Code of Federal Regulations (or any 
                        successor to such regulation), to the extent 
                        such entity is acting as a business associate 
                        under the HIPAA privacy regulations (as defined 
                        in such section 1180(b)(3)); or
                            (iii) an entity that is subject to 
                        restrictions on disclosure of records under 
                        section 543 of the Public Health Service Act 
                        (42 U.S.C. 290dd-2), to the extent such entity 
                        is acting in a capacity subject to such 
                        restrictions.
            (8) Service provider.--
                    (A) In general.--The term ``service provider'' 
                means a person who--
                            (i) collects, retains, uses, or discloses 
                        personal reproductive or sexual health 
                        information for the sole purpose of, and only 
                        to the extent that such person is, conducting 
                        business activities on behalf of, for the 
                        benefit of, under instruction of, and under 
                        contractual agreement with a regulated entity 
                        and not any other individual or entity; and
                            (ii) does not divulge personal reproductive 
                        or sexual health information to any individual 
                        or entity other than such regulated entity or a 
                        contractor to such service provider bound to 
                        information processing terms no less 
                        restrictive than terms to which such service 
                        provider is bound.
                    (B) Limitation of application.--Such person shall 
                only be considered a service provider in the course of 
                activities described in subparagraph (A)(i).
                    (C) Minimization by service providers.--For 
                purposes of compliance with section 2 by a service 
                provider of a regulated entity, a request from an 
                individual to such regulated entity for a product or 
                service, and an express consent from such individual to 
                such regulated entity, shall be treated as having also 
                been provided to such service provider.
            (9) Third party.--The term ``third party'' means, with 
        respect to the disclosing or collecting of personal 
        reproductive or sexual health information, any person who is 
        not--
                    (A) the regulated entity that is disclosing or 
                collecting such information;
                    (B) the individual to whom such information 
                relates; or
                    (C) a service provider.

SEC. 7. EXCEPTION FOR THE PUBLICATION OF NEWSWORTHY INFORMATION.

    Nothing in this Act, or a regulation promulgated under this Act, 
shall apply with respect to personal reproductive or sexual health 
information that is collected, retained, used, or disclosed by a 
regulated entity for the publication of newsworthy information of 
legitimate public concern to the public, or to the collecting, 
retaining, using, or disclosing of such information by a regulated 
entity for that purpose, if such regulated entity has reasonable 
safeguards and processes that prevent the collecting, retaining, using, 
or disclosing of personal reproductive or sexual health information for 
commercial purposes other than the publication of newsworthy 
information of legitimate public concern.

SEC. 8. RELATIONSHIP TO FEDERAL AND STATE LAWS.

    (a) Federal Law Preservation.--Nothing in this Act, or a regulation 
promulgated under this Act, shall be construed to limit any other 
provision of Federal law, except as specifically provided in this Act.
    (b) State Law Preservation.--
            (1) In general.--Nothing in this Act, or a regulation 
        promulgated under this Act, shall be construed to preempt, 
        displace, or supplant any State law, except to the extent that 
        a provision of State law conflicts with a provision of this 
        Act, or a regulation promulgated under this Act, and then only 
        to the extent of the conflict.
            (2) Greater protection under state law.--For purposes of 
        this subsection, a provision of State law does not conflict 
        with a provision of this Act, or a regulation promulgated under 
        this Act, if such provision of State law provides greater 
        privacy protection than the privacy protection provided by such 
        provision of this Act or such regulation.

SEC. 9. SAVINGS CLAUSE.

    Nothing in this Act shall be construed to limit the authority of 
the Commission under any other provision of law. Nothing in this Act, 
or a regulation promulgated under this Act, shall be construed to 
prohibit a regulated entity from disclosing personal reproductive or 
sexual health information to the Commission as required by law, in 
compliance with a court order, or in compliance with a civil 
investigative demand or similar process authorized under law.

SEC. 10. SEVERABILITY CLAUSE.

    If any provision of this Act, or the application thereof to any 
person or circumstance, is held invalid, the remainder of this Act, and 
the application of such provision to other persons not similarly 
situated or to other circumstances, shall not be affected by the 
invalidation.
                                 <all>