Title: Protecting Personal Information Act of 2019
Policy area: Commerce

Summary:
Protecting Personal Information Act of 2019  This bill requires covered entities to provide consumers with the opportunity to prohibit the collection, sale, or transfer of specified personally identifiable information about the consumer and requires the covered entity to, upon request by the consumer, delete any such personally identifiable information that has been collected or stored by the covered entity.   This bill applies to (1) business corporations, (2) nonprofits, and (3) common carriers that (1) have annual revenue greater than $25 million, (2) have access to personally identifiably information of 50,000 or more individuals, or (3) derive at least 50% of their revenue from selling such information.  These requirements may be enforced by the Federal Trade Commission or by a state attorney general bringing a lawsuit on behalf of the state's residents.

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 2186 Introduced in Senate (IS)]

<DOC>






116th CONGRESS
  1st Session
                                S. 2186

   To require entities to provide consumers with the opportunity to 
 prohibit the entity from collecting or using certain data concerning 
           the consumer and to request deletion of such data.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             July 18, 2019

  Mr. Merkley introduced the following bill; which was read twice and 
   referred to the Committee on Commerce, Science, and Transportation

_______________________________________________________________________

                                 A BILL


 
   To require entities to provide consumers with the opportunity to 
 prohibit the entity from collecting or using certain data concerning 
           the consumer and to request deletion of such data.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Protecting Personal Information Act 
of 2019''.

SEC. 2. REQUIREMENTS FOR ENTITIES WITH RESPECT TO THE COLLECTION OR USE 
              OF CERTAIN DATA CONCERNING THE CONSUMER.

    (a) Opportunity To Prohibit the Entity From Collecting or Using 
Certain Data.--A covered entity shall, prior to collecting covered data 
concerning an individual, provide the individual with an opportunity to 
prohibit the covered entity from collecting such data or selling or 
otherwise transferring such data to a third party.
    (b) Deletion Upon Request.--Upon a request from an individual for 
whom a covered entity has collected covered data, the covered entity 
shall, without undue delay, delete such covered data.

SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMISSION.

    (a) Unfair or Deceptive Acts or Practices.--A violation of section 
2 shall be treated as a violation of a rule defining an unfair or a 
deceptive act or practice under section 18(a)(1)(B) of the Federal 
Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
    (b) Powers of Commission.--
            (1) In general.--The Commission shall enforce this Act in 
        the same manner, by the same means, and with the same 
        jurisdiction, powers, and duties as though all applicable terms 
        and provisions of the Federal Trade Commission Act (15 U.S.C. 
        41 et seq.) were incorporated into and made a part of this Act.
            (2) Privileges and immunities.--Any covered entity that 
        violates section 2 shall be subject to the penalties and 
        entitled to the privileges and immunities provided in the 
        Federal Trade Commission Act (15 U.S.C. 41 et seq.).
            (3) Authority preserved.--Nothing in this Act shall be 
        construed to limit the authority of the Federal Trade 
        Commission under any other provision of law.

SEC. 4. ENFORCEMENT BY STATES.

    (a) In General.--In any case in which the attorney general of a 
State has reason to believe that an interest of the residents of the 
State has been or is threatened or adversely affected by the engagement 
of any covered entity subject to section 2 in a practice that violates 
such section, the attorney general of the State may, as parens patriae, 
bring a civil action on behalf of the residents of the State in an 
appropriate district court of the United States--
            (1) to enjoin further violation of such section by such 
        person;
            (2) to compel compliance with such section; and
            (3) to obtain damages, restitution, or other compensation 
        on behalf of such residents.
    (b) Rights of Federal Trade Commission.--
            (1) Notice to federal trade commission.--
                    (A) In general.--Except as provided in subparagraph 
                (C), the attorney general of a State shall notify the 
                Commission in writing that the attorney general intends 
                to bring a civil action under subsection (a) not later 
                than 10 days before initiating the civil action.
                    (B) Contents.--The notification required by 
                subparagraph (A) with respect to a civil action shall 
                include a copy of the complaint to be filed to initiate 
                the civil action.
                    (C) Exception.--If it is not feasible for the 
                attorney general of a State to provide the notification 
                required by subparagraph (A) before initiating a civil 
                action under subsection (a), the attorney general shall 
                notify the Commission immediately upon instituting the 
                civil action.
            (2) Intervention by federal trade commission.--The 
        Commission may--
                    (A) intervene in any civil action brought by the 
                attorney general of a State under subsection (a); and
                    (B) upon intervening--
                            (i) be heard on all matters arising in the 
                        civil action; and
                            (ii) file petitions for appeal of a 
                        decision in the civil action.
    (c) Investigatory Powers.--Nothing in this section may be construed 
to prevent the attorney general of a State from exercising the powers 
conferred on the attorney general by the laws of the State to conduct 
investigations, to administer oaths or affirmations, or to compel the 
attendance of witnesses or the production of documentary or other 
evidence.
    (d) Preemptive Action by Federal Trade Commission.--If the 
Commission institutes a civil action or an administrative action with 
respect to a violation of section (2), the attorney general of a State 
may not, during the pendency of such action, bring a civil action under 
subsection (a) against any defendant named in the complaint of the 
Commission for the violation with respect to which the Commission 
instituted such action.
    (e) Venue; Service of Process.--
            (1) Venue.--Any action brought under subsection (a) may be 
        brought in--
                    (A) the district court of the United States that 
                meets applicable requirements relating to venue under 
                section 1391 of title 28, United States Code; or
                    (B) another court of competent jurisdiction.
            (2) Service of process.--In an action brought under 
        subsection (a), process may be served in any district in which 
        the defendant--
                    (A) is an inhabitant; or
                    (B) may be found.
    (f) Actions by Other State Officials.--
            (1) In general.--In addition to civil actions brought by 
        attorneys general under subsection (a), any other consumer 
        protection officer of a State who is authorized by the State to 
        do so may bring a civil action under subsection (a), subject to 
        the same requirements and limitations that apply under this 
        section to civil actions brought by attorneys general.
            (2) Savings provision.--Nothing in this section may be 
        construed to prohibit an authorized official of a State from 
        initiating or continuing any proceeding in a court of the State 
        for a violation of any civil or criminal law of the State.

SEC. 5. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Covered data.--
                    (A) In general.--Except as provided in subparagraph 
                (B), the term ``covered data'' means only the 
                following:
                            (i) Personally identifiable information.
                            (ii) Unique identifier information.
                            (iii) Any information that is collected, 
                        used, or stored in connection with personally 
                        identifiable information or unique identifier 
                        information in a manner that may reasonably be 
                        used by the party collecting the information to 
                        identify a specific individual.
                    (B) Exception.--The term ``covered data'' does not 
                include the following:
                            (i) Personally identifiable information 
                        obtained from public records that is not merged 
                        with covered information gathered elsewhere.
                            (ii) Personally identifiable information 
                        that is obtained from a forum--
                                    (I) where the individual 
                                voluntarily shared the information or 
                                authorized the information to be 
                                shared; and
                                    (II) that--
                                            (aa) is widely and publicly 
                                        available and was not made 
                                        publicly available in bad 
                                        faith; and
                                            (bb) contains no 
                                        restrictions on who can access 
                                        and view such information.
                            (iii) Personally identifiable information 
                        reported in public media.
                            (iv) Personally identifiable information 
                        dedicated to contacting an individual at the 
                        individual's place of work.
            (3) Covered entity.--The term ``covered entity'' means an 
        entity--
                    (A) that collects covered data concerning 
                individuals;
                    (B) that--
                            (i) has gross annual revenue in excess of 
                        $25,000,000;
                            (ii) annually buys, receives, sells, or 
                        shares covered data of 50,000 or more 
                        individuals; or
                            (iii) derives 50 percent or more of its 
                        annual revenue from selling individuals' 
                        covered data; and
                    (C) that is--
                            (i) a person over which the Commission has 
                        authority pursuant to section 5(a)(2) of the 
                        Federal Trade Commission Act (15 U.S.C. 
                        45(a)(2));
                            (ii) a common carrier subject to the 
                        Communications Act of 1934 (47 U.S.C. 151 et 
                        seq.), notwithstanding the definition of the 
                        term ``Acts to regulate commerce'' in section 4 
                        of the Federal Trade Commission Act (15 U.S.C. 
                        44) and the exception provided by section 
                        5(a)(2) of the Federal Trade Commission Act (15 
                        U.S.C. 45(a)(2)) for such carriers; or
                            (iii) a nonprofit organization, including 
                        any organization described in section 501(c) of 
                        the Internal Revenue Code of 1986 that is 
                        exempt from taxation under section 501(a) of 
                        such Code, notwithstanding the definition of 
                        the term ``Acts to regulate commerce'' in 
                        section 4 of the Federal Trade Commission Act 
                        (15 U.S.C. 44) and the exception provided by 
                        section 5(a)(2) of the Federal Trade Commission 
                        Act (15 U.S.C. 45(a)(2)) for such 
                        organizations.
            (4) Delete.--The term ``delete'' means to remove personally 
        identifiable information such that the information is not 
        maintained in retrievable form and cannot be retrieved in the 
        normal course of business.
            (5) Personally identifiable information.--The term 
        ``personally identifiable information'' means only the 
        following:
                    (A) Any of the following information about an 
                individual:
                            (i) The first name (or initial) and last 
                        name of an individual, whether given at birth 
                        or time of adoption, or resulting from a lawful 
                        change of name.
                            (ii) The postal address of a physical place 
                        of residence of such individual.
                            (iii) An e-mail address.
                            (iv) A telephone number or mobile device 
                        number.
                            (v) A social security number or other 
                        government issued identification number issued 
                        to such individual.
                            (vi) The account number of a credit card 
                        issued to such individual.
                            (vii) Unique identifier information that 
                        alone can be used to identify a specific 
                        individual.
                            (viii) Biometric data about such 
                        individual, including fingerprints and retina 
                        scans.
                    (B) If used, transferred, or stored in connection 
                with one or more of the items of information described 
                in subparagraph (A), any of the following:
                            (i) A date of birth.
                            (ii) The number of a certificate of birth 
                        or adoption.
                            (iii) A place of birth.
                            (iv) Unique identifier information that 
                        alone cannot be used to identify a specific 
                        individual.
                            (v) Precise geographic location, at the 
                        same degree of specificity as a global 
                        positioning system or equivalent system, and 
                        not including any general geographic 
                        information that may be derived from an 
                        Internet Protocol address.
                            (vi) Information about an individual's 
                        destination, location, and amount of uses of 
                        voice services, regardless of technology used.
                            (vii) Any other information concerning an 
                        individual that may reasonably be used by the 
                        party using, collecting, or storing that 
                        information to identify that individual.
            (6) Third party.--The term ``third party'' means, with 
        respect to a covered entity, a person that--
                    (A) is--
                            (i) not related to the covered entity by 
                        common ownership or corporate control; or
                            (ii) related to the covered entity by 
                        common ownership or corporate control and an 
                        ordinary consumer would not understand that the 
                        covered entity and the person were related by 
                        common ownership or corporate control;
                    (B) is not a service provider used by the covered 
                entity to receive covered data in performing services 
                or functions on behalf of and under the instruction of 
                the covered entity; and
                    (C) with respect to the collection of covered data 
                of an individual, does not have an established business 
                relationship with the individual and does not identify 
                itself to the individual at the time of such collection 
                in a clear and conspicuous manner that is visible to 
                the individual.
                                 <all>