Online Privacy Act

Bill: 115-hr-3175
Sponsor: full_name: Rep. Ellison, Keith [D-MN-5]
Introduced: 2017-07-11
Policy area: Science, Technology, Communications
Subjects: Administrative law and regulatory procedures

Business records

Computer security and identity theft

Consumer affairs

Federal Communications Commission (FCC)

Internet and video services

Internet, web applications, social media

Right of privacy

Telephone and wireless communication
Latest action: action_date: 2017-07-14
text: Referred to the Subcommittee on Communications and Technology.

Summaries:
action_date: 2017-07-11
action_desc: Introduced in House
text: <p><strong>Online Privacy Act </strong></p> <p>This bill amends the Communications Act of 1934 to direct the Federal Communications Commission (FCC) to promulgate customer privacy regulations that require telecommunications services, broadband Internet access services, and interconnected VoIP (internet phone) services&nbsp;to:</p> <ul> <li>notify a customer about the collection, use, and sharing of customer proprietary information that is individually identifiable customer proprietary network information, personally identifiable information, or the content of communications; </li> <li>obtain opt-in approval from a customer to use and share sensitive customer proprietary information about financial or health information, children, Social Security numbers, precise geolocation, content of communications, call detail information, web browsing or application usage history, or other customary proprietary information that the FCC determines to be sensitive; </li> <li>not refuse to serve a customer who does not consent to the use and sharing of customer proprietary information for commercial purposes under a "take-it-or-leave-it" offer; </li> <li>develop data security practices; and </li> <li>notify customers of security breaches. </li></ul> <p>The FCC must also implement strong protection for de-identified customary proprietary information to prevent re-identifying such information.</p>

tv_txt: I 115th CONGRESS 1st Session H. R. 3175 IN THE HOUSE OF REPRESENTATIVES July 11, 2017 Mr. Ellison (for himself, Ms. Norton , Ms. Maxine Waters of California , Ms. Schakowsky , Ms. Jayapal , Mr. Blumenauer , and Ms. Shea-Porter ) introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To establish privacy protections for customers of broadband Internet access service and other telecommunications services.

1. Short title This Act may be cited as the Online Privacy Act . 2. Privacy of customers of broadband Internet access service and other telecommunications services (a) In general Section 222 of the Communications Act of 1934 ( 47 U.S.C. 222 ) is amended— (1) by redesignating subsection (h) as subsection (i); and (2) by inserting after subsection (g) the following: (h) Privacy of customers of broadband Internet access service and other telecommunications services (1) Definitions In this subsection— (A) the term broadband Internet access service has the meaning given the term in section 8.2 of title 47, Code of Federal Regulations, or any successor regulation; (B) the term customer means— (i) a current or former subscriber to a telecommunications service; or (ii) an applicant for a telecommunications service; (C) the term customer proprietary information means, with respect to information or content that a telecommunications carrier acquires in connection with its provision of telecommunications service— (i) individually identifiable customer proprietary network information; (ii) personally identifiable information; and (iii) content of communications; (D) the term opt-in approval means a method for a telecommunications carrier to obtain customer consent to use, disclose, or permit access to the customer's customer proprietary information that requires that the telecommunications carrier obtain from the customer affirmative, express consent allowing the requested usage, disclosure, or access to the customer proprietary information after the customer is provided appropriate notification of the carrier’s request; (E) the term sensitive customer proprietary information includes— (i) financial information; (ii) health information; (iii) information pertaining to children; (iv) Social Security numbers; (v) precise geolocation information; (vi) content of communications; (vii) call detail information; (viii) web browsing history, application usage history, and the functional equivalents of either; and (ix) any other customary proprietary information that the Commission determines to be sensitive; and (F) the term telecommunications service includes broadband Internet access service and interconnected VoIP service. (2) Regulations In carrying out this section, the Commission shall promulgate regulations to protect the privacy of customers of telecommunications service. (3) Contents In promulgating regulations under paragraph (2), the Commission shall— (A) require a telecommunications carrier to notify a customer about the collection, use, and sharing of his or her customer proprietary information, including by— (i) notifying the customer about the types of customer proprietary information the carrier collects; (ii) specifying how and for what purposes the carrier uses and shares customer proprietary information; and (iii) identifying the types of entities with which the carrier shares customer proprietary information; (B) require a telecommunications carrier to— (i) provide the notification under subparagraph (A) to a customer at the point of sale, before the purchase of service; and (ii) update a customer when the carrier makes a material change to a privacy policy, including any of the policies described in subparagraph (A); (C) require a telecommunications carrier to obtain opt-in approval from a customer to use and share his or her sensitive customer proprietary information; (D) implement strong protection for de-identified customary proprietary information, to prevent re-identifying such information; (E) prohibit a telecommunications carrier from refusing to serve a customer who does not consent to the use and sharing of his or her customer proprietary information for commercial purposes (commonly known as take-it-or-leave-it offers ); and (F) require a telecommunications carrier to— (i) develop reasonable data security practices; and (ii) notify customers if a breach of security has occurred. . (b) Deadline The Federal Communications Commission— (1) not later than 180 days after the date of enactment of this Act, shall promulgate regulations under section 222(h)(2) of the Communications Act of 1934 ( 47 U.S.C. 222(h)(2) ), as added by subsection (a); and (2) shall ensure that the regulations promulgated under paragraph (1) take effect not later than 180 days after the date of promulgation.