Title: Drone Aircraft Privacy and Transparency Act of 2017
Policy area: Transportation and Public Works

Summary:
Drone Aircraft Privacy and Transparency Act of 2017
This bill amends the FAA Modernization and Reform Act of 2012 to direct the Department of Transportation (DOT) to establish procedures to ensure that the integration of unmanned aircraft (drone) systems into the national airspace system is done in compliance with privacy principles. Such procedures shall not apply to a drone system operated for news-gathering activities protected by the First Amendment to the Constitution.
DOT may not approve, issue, or award any certificate, license, or other grant of authority to operate a drone system in the national airspace system unless the pertinent application includes a data collection statement that provides reasonable assurance that the applicant will operate the drone in accordance with privacy principles. The same requirement shall apply to any drone system to be operated by a law enforcement agency, except that the application shall include a data minimization statement, instead of a data collection statement, that provides the same assurance.
The Federal Aviation Administration (FAA) shall make any approved grant of authority, each such statement, and information about the drone's owner, operator, and technical capability available in a searchable format on the public FAA website.
A governmental entity may not use a drone system, or request information collected by another entity through a drone system, for protective activities or for law enforcement or intelligence purposes except pursuant to a warrant or as permitted under the Foreign Intelligence Surveillance Act of 1978, except when: (1) a law enforcement entity reasonably believes there is an imminent danger of death or serious physical injury, or (2) the Department of Homeland Security determines that credible intelligence indicates there is a high risk of an imminent terrorist attack by a specific individual or organization.
It shall be unlawful to operate a drone system in a manner that is not in accordance with the terms of a data collection statement or that violates the rule implementing the procedures required by this bill. Any such violation shall be treated as an unfair or deceptive act or practice under the Federal Trade Commission Act. This bill provides for enforcement by the Federal Trade Commission, by a civil action brought by a state, or by a private action.
The FAA shall revoke the certificate, license, or other grant of authority of a drone system operated in a violation of this bill.

[Congressional Bills 115th Congress]
[From the U.S. Government Publishing Office]
[S. 631 Introduced in Senate (IS)]

<DOC>






115th CONGRESS
  1st Session
                                 S. 631

   To amend the FAA Modernization and Reform Act of 2012 to provide 
guidance and limitations regarding the integration of unmanned aircraft 
      systems into United States airspace, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             March 15, 2017

  Mr. Markey introduced the following bill; which was read twice and 
   referred to the Committee on Commerce, Science, and Transportation

_______________________________________________________________________

                                 A BILL


 
   To amend the FAA Modernization and Reform Act of 2012 to provide 
guidance and limitations regarding the integration of unmanned aircraft 
      systems into United States airspace, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Drone Aircraft Privacy and 
Transparency Act of 2017''.

SEC. 2. FINDINGS.

    Congress finds the following:
            (1) On February 14, 2012, President Obama signed the FAA 
        Modernization and Reform Act of 2012 (Public Law 112-95; 49 
        U.S.C. 40101 note) into law, and sections 331 through 336 of 
        such Act require the Federal Aviation Administration to fully 
        integrate government, commercial, and recreational unmanned 
        aircraft systems, commonly known as ``drones'', into United 
        States airspace by October 2015.
            (2) As the technology advances and the cost decreases--
        unmanned aircraft systems are already orders of magnitude less 
        expensive to purchase and operate than piloted aircraft--the 
        market for Federal, State, and local government and commercial 
        unmanned aircraft systems is rapidly growing.
            (3) It has been estimated there could be as many as 
        2,700,000 commercial unmanned aircraft systems sold annually in 
        the United States by 2020.
            (4) There will no doubt be many beneficial applications for 
        unmanned aircraft systems, including delivering goods, serving 
        as early warning systems, performing search and rescue 
        missions, and providing critical aid to those in need.
            (5) However, there also is the potential for unmanned 
        aircraft system technology to enable invasive and pervasive 
        surveillance without adequate privacy protections, and 
        currently, no explicit privacy protections or public 
        transparency measures with respect to such system technology 
        are built into the law.
            (6) Federal standards for informing the public and 
        protecting individual privacy with respect to unmanned aircraft 
        systems are needed.

SEC. 3. GUIDANCE AND LIMITATIONS REGARDING UNMANNED AIRCRAFT SYSTEMS.

    (a) In General.--Subtitle B of title III of the FAA Modernization 
and Reform Act of 2012 (Public Law 112-95; 49 U.S.C. 40101 note) is 
amended by adding at the end the following new sections:

``SEC. 337. RULEMAKING.

    ``(a) In General.--The Secretary of Transportation shall establish 
procedures to ensure that the integration of unmanned aircraft systems 
into the national airspace system is done in compliance with the 
privacy principles.
    ``(b) Exception.--The procedures established under subsection (a) 
shall not apply with respect to unmanned aircraft systems operated for 
news-gathering activities protected by the First Amendment to the 
Constitution of the United States.

``SEC. 338. DATA COLLECTION STATEMENTS AND DATA MINIMIZATION 
              STATEMENTS.

    ``(a) In General.--Beginning on the date of the enactment of this 
section, the Secretary of Transportation may not approve, issue, or 
award any certificate, license, or other grant of authority to operate 
an unmanned aircraft system in the national airspace system unless the 
application for such certificate, license, or other grant of authority 
includes--
            ``(1) a data collection statement in accordance with the 
        requirements of subsection (b) that provides reasonable 
        assurance that the applicant will operate the unmanned aircraft 
        system in accordance with the privacy principles; and
            ``(2) in the case of such an unmanned aircraft system that 
        is to be operated by a law enforcement agency or a law 
        enforcement agency contractor or subcontractor, a data 
        minimization statement in accordance with the requirements of 
        subsection (c) that provides reasonable assurance that the 
        applicant will operate the unmanned aircraft system in 
        accordance with the privacy principles.
    ``(b) Data Collection Statement.--A data collection statement under 
subsection (a), with respect to an unmanned aircraft system, shall 
include information identifying--
            ``(1) the individuals or entities that will have the power 
        to use the unmanned aircraft system;
            ``(2) the specific locations in which the unmanned aircraft 
        system will operate;
            ``(3) the maximum period for which the unmanned aircraft 
        system will operate in each flight;
            ``(4) whether the unmanned aircraft system will collect 
        information or data about individuals or groups of individuals, 
        and if so--
                    ``(A) the circumstances under which the system will 
                be used; and
                    ``(B) the specific kinds of information or data the 
                system will collect about individuals or groups of 
                individuals and how such information or data, as well 
                as conclusions drawn from such information or data, 
                will be used, disclosed, and otherwise handled, 
                including--
                            ``(i) how the collection or retention of 
                        such information or data that is unrelated to 
                        the specified use will be minimized;
                            ``(ii) whether such information or data 
                        might be sold, leased, or otherwise provided to 
                        third parties, and if so, under what 
                        circumstances it might be so sold or leased;
                            ``(iii) the period for which such 
                        information or data will be retained; and
                            ``(iv) when and how such information or 
                        data, including information or data no longer 
                        relevant to the specified use, will be 
                        destroyed;
            ``(5) the possible impact the operation of the unmanned 
        aircraft system may have upon the privacy of individuals;
            ``(6) the specific steps that will be taken to mitigate any 
        possible impact identified under paragraph (5), including steps 
        to protect against unauthorized disclosure of any information 
        or data described in paragraph (4), such as the use of 
        encryption methods and other security features that will be 
        used;
            ``(7) a telephone number or electronic mail address that an 
        individual with complaints about the operation of the unmanned 
        aircraft system may use to report such complaints and to 
        request confirmation that personally identifiable data relating 
        to such individual has been collected;
            ``(8) in a case in which personally identifiable data 
        relating to an individual has been collected, a reasonable 
        process for the individual to request to obtain such data in a 
        timely and an intelligible manner;
            ``(9) in a case in which a request described in paragraph 
        (8) is denied, a process by which the individual may obtain the 
        reasons for the denial and challenge the denial; and
            ``(10) in a case in which personally identifiable data 
        relating to an individual has been collected, a process by 
        which the individual may challenge the accuracy of such data 
        and, if the challenge is successful, have such data erased or 
        amended.
    ``(c) Data Minimization Statement.--A data minimization statement 
described in this subsection, with respect to an unmanned aircraft 
system operated by a law enforcement agency, contractor, or 
subcontractor described in subsection (a)(2), shall detail the 
applicable--
            ``(1) policies adopted by the agency, contractor, or 
        subcontractor, as the case may be, that--
                    ``(A) minimize the collection by the unmanned 
                aircraft system of information and data unrelated to 
                the investigation of a crime under a warrant;
                    ``(B) require the destruction of such information 
                and data, as well as of information and data collected 
                by the unmanned aircraft system that is no longer 
                relevant to the investigation of a crime under a 
                warrant or to an ongoing criminal proceeding; and
                    ``(C) establish procedures for the method of such 
                destruction; and
            ``(2) audit and oversight procedures adopted by the agency, 
        contractor, or subcontractor, as the case may be, that will 
        ensure that the agency, contractor, or subcontractor, as the 
        case may be, uses the unmanned aircraft system in accordance 
        with the parameters outlined in the data collection statement 
        and the statement required by this subsection.
    ``(d) Exception.--The procedures established under subsections (a), 
(b), and (c) shall not apply with respect to unmanned aircraft systems 
operated for news-gathering activities protected by the First Amendment 
to the Constitution of the United States.

``SEC. 339. DISCLOSURE OF APPROVED CERTIFICATES, LICENSES, AND OTHER 
              GRANTS OF AUTHORITY.

    ``(a) In General.--The Administrator of the Federal Aviation 
Administration shall make available on the public Internet website of 
the Federal Aviation Administration in a searchable format--
            ``(1) the name of each person or agency authorized to 
        conduct civil or public unmanned aircraft system operations;
            ``(2) the name of the owner of each unmanned aircraft 
        system described in paragraph (1);
            ``(3) the expiration date of the authorization described in 
        paragraph (1);
            ``(4) the contact information for each person identified 
        under paragraph (1) or (2), including a telephone number and 
        electronic mail address, subject to applicable privacy laws;
            ``(5) the tail number or other specific identification 
        number of each unmanned aircraft system authorized to conduct 
        operations, with a link to the owner of the unmanned aircraft 
        system;
            ``(6) the approved certificate, license, or other grant of 
        authority for each unmanned aircraft system awarded a 
        certificate, license, or other grant of authority to operate in 
        the national airspace system, including any such certificate, 
        license, or other grant of authority awarded prior to the date 
        of the enactment of this section;
            ``(7) information detailing where, when, and for what 
        purpose each unmanned aircraft system will be operated;
            ``(8) information detailing any data security breach that 
        occurs with regard to information collected by an unmanned 
        aircraft system;
            ``(9) a description of the technical capability of each 
        unmanned aircraft system, including whether the system has 
        cameras, thermal imaging capabilities, mobile phone 
        interception capabilities, facial recognition capabilities, and 
        license plate readers; and
            ``(10) in the case of a certificate, license, or other 
        grant of authority awarded on or after the date of the 
        enactment of this section to operate an unmanned aircraft 
        system in the national airspace system, the data collection 
        statement described in section 339(b) and, if applicable, the 
        data minimization statement described in section 339(c) 
        required with respect to such unmanned aircraft system.
    ``(b) Deadline.--The Administrator shall complete the requirements 
under subsection (a) with regard to each unmanned aircraft system--
            ``(1) in the case of a certificate, license, or other grant 
        of authority awarded before the date of the enactment of this 
        section, not later than 90 days after such date of enactment; 
        and
            ``(2) in the case of a certificate, license, or other grant 
        of authority awarded on or after the date of the enactment of 
        this section, as soon as is practicable after the date of 
        approval of such certificate, license, or other grant of 
        authority.

``SEC. 340. WARRANTS REQUIRED FOR GENERALIZED SURVEILLANCE.

    ``(a) In General.--A governmental entity (as defined in section 
2711 of title 18, United States Code) may not use an unmanned aircraft 
system or request information or data collected by another person using 
an unmanned aircraft system for protective activities, or for law 
enforcement or intelligence purposes, except pursuant to a warrant 
issued using the procedures described in the Federal Rules of Criminal 
Procedure (or, in the case of a State court, issued using State warrant 
procedures) by a court of competent jurisdiction, or as permitted under 
the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et 
seq.).
    ``(b) Exceptions.--
            ``(1) In general.--Subsection (a) shall not apply in a case 
        in which a governmental entity is using an unmanned aircraft 
        system in exigent circumstances (as defined in paragraph (2)).
            ``(2) Exigent circumstances defined.--Exigent circumstances 
        exist when--
                    ``(A) a law enforcement entity reasonably believes 
                there is an imminent danger of death or serious 
                physical injury; or
                    ``(B) a law enforcement entity reasonably believes 
                there is a high risk of an imminent terrorist attack by 
                a specific individual or organization and the Secretary 
                of Homeland Security has determined that credible 
                intelligence indicates there is such a risk.
            ``(3) Required documentation.--In the case of a person 
        operating an unmanned aircraft system under an exception under 
        paragraph (1), documentation justifying the exception shall be 
        submitted to the Secretary of Transportation not later than 7 
        days after the date of the relevant unmanned aircraft system 
        flight.
            ``(4) Information or data unrelated to exigent 
        circumstances.--A person operating an unmanned aircraft system 
        under an exception under paragraph (1) shall minimize the 
        collection by the unmanned aircraft system of information and 
        data unrelated to the reason for the exception. If the unmanned 
        aircraft system incidentally collects any such information or 
        data while being operated under that exception, the person 
        operating the unmanned aircraft system shall destroy the 
        information and data.
    ``(c) Prohibition on Information Sharing.--A person may not 
intentionally divulge information collected in accordance with this 
section with any other person, except as authorized by law.
    ``(d) Prohibition on Use as Evidence.--If information has been 
collected by means of use of an unmanned aircraft system, no part of 
the contents of that information and no evidence derived from that 
information may be received in evidence in any trial, hearing, or other 
proceeding in or before any court, grand jury, department, officer, 
agency, regulatory body, legislative committee, or other authority of 
the United States, a State, or a political subdivision thereof unless 
that information is collected in accordance with this section.
    ``(e) Injunction.--A person injured by an act in violation of this 
section may bring in an appropriate State court or an appropriate 
district court of the United States an action to enjoin such 
violation.''.
    (b) Definitions.--Section 331 of the FAA Modernization and Reform 
Act of 2012 (Public Law 112-95; 49 U.S.C. 40101 note) is amended--
            (1) by redesignating paragraphs (4) through (9) as 
        paragraphs (7) through (13);
            (2) by redesignating paragraph (3) as paragraph (4);
            (3) by inserting after paragraph (2) the following:
            ``(3) Law enforcement.--The term `law enforcement' means--
                    ``(A) any entity of the United States or of a 
                State, or political subdivision thereof, that is 
                empowered by law to conduct investigations of or to 
                make arrests for offenses; and
                    ``(B) any entity or individual authorized by law to 
                prosecute or participate in the prosecution of such 
                offenses.''; and
            (4) by inserting after paragraph (4), as redesignated by 
        paragraph (2), the following:
            ``(5) Privacy principles.--The term `privacy principles' 
        means the principles described in Part Two of the Organization 
        for Economic Co-operation and Development guidelines titled 
        `Annex to the Recommendation of the Council of 23rd September 
        1980: Guidelines Governing The Protection Of Privacy And 
        Transborder Flows Of Personal Data', adopted by the 
        Organization for Economic Co-operation and Development on 
        September 23, 1980.
            ``(6) Privacy protections.--The term `privacy protections' 
        means protections that relate to the use, collection, and 
        disclosure of information and data about individuals and groups 
        of individuals.''.

SEC. 4. ENFORCEMENT.

    (a) Prohibited Conduct.--
            (1) In general.--It shall be unlawful for a person to 
        operate an unmanned aircraft system in a manner that is not in 
        accordance with the terms of a data collection statement 
        submitted under section 338(a)(1) of the FAA Modernization and 
        Reform Act of 2012, as added by section 3, or in a manner that 
        violates any portion of the final rule required under section 
        332(b)(1) of such Act insofar as such portion relates to the 
        procedures described in section 337 of such Act.
            (2) Regulations.--The Commission may promulgate regulations 
        in accordance with section 553 of title 5, United States Code, 
        to carry out paragraph (1) with respect to persons, 
        partnerships, and corporations described in subsection (b)(3).
    (b) Enforcement by Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        subsection (a) or the regulations promulgated under such 
        subsection shall be treated as a violation of a regulation 
        under section 18(a)(1)(B) of the Federal Trade Commission Act 
        (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or 
        practices.
            (2) Powers of commission.--The Commission shall enforce 
        subsection (a) and the regulations promulgated under such 
        subsection in the same manner, by the same means, and with the 
        same powers and duties as though all applicable terms and 
        provisions of the Federal Trade Commission Act (15 U.S.C. 41 et 
        seq.) were incorporated into and made a part of this Act, and 
        any violator shall be subject to the penalties and entitled to 
        the privileges and immunities provided in the Federal Trade 
        Commission Act.
            (3) Applicability.--Paragraphs (1) and (2) shall apply--
                    (A) with respect to persons, partnerships, and 
                corporations over which the Commission has jurisdiction 
                under section 5(a)(2) of the Federal Trade Commission 
                Act (15 U.S.C. 45(a)(2)) (except to the extent such 
                person, partnership, or corporation is a law 
                enforcement contractor or subcontractor); and
                    (B) notwithstanding such section, with respect to 
                air carriers and foreign air carriers.
    (c) Actions by States.--
            (1) Civil actions.--In any case in which the attorney 
        general of a State, or an official or agency of a State, has 
        reason to believe that an interest of the residents of that 
        State has been or is threatened or adversely affected by an act 
        or practice in violation of subsection (a) or a regulation 
        promulgated under such subsection, or by the operation of an 
        unmanned aircraft system in violation of the terms of a data 
        minimization statement submitted under section 338(a)(2) of the 
        FAA Modernization and Reform Act of 2012, as added by section 
        3, the State may bring a civil action on behalf of the 
        residents of the State in an appropriate State court or an 
        appropriate district court of the United States to--
                    (A) enjoin the violation;
                    (B) enforce compliance with such subsection, 
                regulation, or statement;
                    (C) obtain damages, restitution, or other 
                compensation on behalf of residents of the State; or
                    (D) obtain such other legal and equitable relief as 
                the court may consider to be appropriate.
            (2) Notice.--Before filing an action under this subsection 
        against a person, partnership, or corporation over which the 
        Commission has jurisdiction under section 5(a)(2) of the 
        Federal Trade Commission Act (15 U.S.C. 45(a)(2)) (except to 
        the extent such person, partnership, or corporation is a law 
        enforcement contractor or subcontractor) or an air carrier or 
        foreign air carrier, the attorney general, official, or agency 
        of the State involved shall provide to the Commission a written 
        notice of that action and a copy of the complaint for that 
        action. If the attorney general, official, or agency determines 
        that it is not feasible to provide the notice described in this 
        paragraph before the filing of the action, the attorney 
        general, official, or agency shall provide written notice of 
        the action and a copy of the complaint to the Commission 
        immediately upon the filing of the action.
            (3) Authority of the commission.--
                    (A) In general.--On receiving notice under 
                paragraph (2) of an action under this subsection, the 
                Commission shall have the right--
                            (i) to intervene in the action;
                            (ii) upon so intervening, to be heard on 
                        all matters arising therein; and
                            (iii) to file petitions for appeal.
                    (B) Limitation on state action while federal action 
                is pending.--If the Commission or the Attorney General 
                of the United States has instituted a civil action for 
                violation of subsection (a) or a regulation promulgated 
                under such subsection (referred to in this subparagraph 
                as the ``Federal action''), no State attorney general, 
                official, or agency may bring an action under this 
                subsection during the pendency of the Federal action 
                against any defendant named in the complaint in the 
                Federal action for any violation as alleged in that 
                complaint.
            (4) Rule of construction.--For purposes of bringing a civil 
        action under this subsection, nothing in this Act or any 
        amendment made by this Act shall be construed to prevent an 
        attorney general, official, or agency of a State from 
        exercising the powers conferred on the attorney general, 
        official, or agency by the laws of that State to conduct 
        investigations, administer oaths and affirmations, or compel 
        the attendance of witnesses or the production of documentary 
        and other evidence.
    (d) Private Right of Action.--
            (1) In general.--A person injured by an act in violation of 
        subsection (a) or the regulations promulgated under such 
        subsection, or by the operation of an unmanned aircraft system 
        in violation of the terms of a data minimization statement 
        submitted under section 338(a)(2) of the FAA Modernization and 
        Reform Act of 2012, as added by section 3, may bring in an 
        appropriate State court or an appropriate district court of the 
        United States--
                    (A) an action to enjoin such violation;
                    (B) an action to recover damages for actual 
                monetary loss from such violation, or to receive up to 
                $1,000 in damages for each such violation, whichever is 
                greater; or
                    (C) both such actions.
            (2) Intentional violations.--If the defendant committed a 
        violation described in paragraph (1), and intended to do so, 
        the court may increase the amount of the award to an amount 
        equal to not more than 3 times the amount available under 
        paragraph (1)(B).
            (3) Costs.--The court shall award to a prevailing plaintiff 
        in an action under this subsection the costs of such action and 
        reasonable attorney's fees, as determined by the court.
            (4) Limitation.--An action may be commenced under this 
        subsection not later than 2 years after the date on which the 
        person first discovered or had a reasonable opportunity to 
        discover the violation.
            (5) Nonexclusive remedy.--The remedy provided by this 
        subsection shall be in addition to any other remedies available 
        to the person.
    (e) Suits Against Governmental Entities.--Notwithstanding the 
Federal Trade Commission Act (15 U.S.C. 41 et seq.), a suit under 
subsection (c) or (d) may be maintained against a governmental entity.
    (f) License Revocation.--The Federal Aviation Administration shall 
revoke the certificate, license, or other grant of authority to operate 
an unmanned aircraft system if such system is operated in a manner 
that--
            (1) is not in accordance with the terms of--
                    (A) a data collection statement submitted under 
                subsection (a)(1) of section 338 of the FAA 
                Modernization and Reform Act of 2012, as added by 
                section 3; or
                    (B) a data minimization statement submitted under 
                subsection (a)(2) of such section; or
            (2) violates any portion of the final rule required under 
        section 332(b)(1) of such Act insofar as such portion relates 
        to the procedures described in section 337 of such Act, as 
        added by section 3.
    (g) Violations.--Each day on which each unmanned aircraft system is 
operated in violation of subsection (a), or the regulations promulgated 
under such subsection, or the terms of a data minimization statement 
submitted under section 338(a)(2) of the FAA Modernization and Reform 
Act of 2012, as added by section 3, shall be treated as a separate 
violation.
    (h) Definitions.--In this section:
            (1) Air carrier; foreign air carrier.--The terms ``air 
        carrier'' and ``foreign air carrier'' have the meanings given 
        those terms in section 40102 of title 49, United States Code.
            (2) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (3) Law enforcement.--The term ``law enforcement'' has the 
        meaning given such term in section 331 of the FAA Modernization 
        and Reform Act of 2012, as amended by section 3.
            (4) State.--The term ``State'' means each of the several 
        States, the District of Columbia, each commonwealth, territory, 
        or possession of the United States, and each federally 
        recognized Indian tribe.
            (5) Unmanned aircraft system.--The term ``unmanned aircraft 
        system'' has the meaning given such term in section 331 of the 
        FAA Modernization and Reform Act of 2012 (49 U.S.C. 40101 
        note).

SEC. 5. MODEL AIRCRAFT PROVISION.

    Nothing in this Act may be construed to apply to model aircraft (as 
defined in section 336(c) of the FAA Modernization and Reform Act of 
2012 (Public Law 112-95; 49 U.S.C. 40101 note)).
                                 <all>