DATA Act

Bill: 118-s-688
Sponsor: full_name: Sen. Scott, Rick [R-FL]
Introduced: 2023-03-07
Policy area: Commerce
Latest action: action_date: 2023-03-07
text: Read twice and referred to the Committee on Commerce, Science, and Transportation.

Summaries:
action_date: 2023-03-07
action_desc: Introduced in Senate
text: <p><strong>Data and Algorithm Transparency Agreement Act or the DATA Act</strong></p> <p>This bill requires certain internet platforms (e.g., large websites and social networks) that use algorithms for suggesting content to obtain express consent from their users before collecting or sharing their personal data. These platforms must notify users of this requirement. The notice must include specified information, including the type of data collected and the names of any third parties with which the data is shared.</p> <p>The bill provides for enforcement by the Federal Trade Commission and a private right of action against a violator of the bill.</p>

tv_txt: II 118th CONGRESS 1st Session S. 688 IN THE SENATE OF THE UNITED STATES March 7, 2023 Mr. Scott of Florida introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To impose notice and consent requirements on internet platforms that use algorithms to manipulate the availability of content on the platform.

1. Short title This Act may be cited as the Data and Algorithm Transparency Agreement Act or the DATA Act . 2. Notice and consent requirements for internet platforms that use algorithms to manipulate the availability of platform content (a) In general Beginning 1 year after the date of enactment of this Act, any covered platform shall comply with the requirements of subsection (c). (b) Definitions In this Act: (1) Covered data The term covered data means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual. (2) Covered platform the term covered platform means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application. (c) Requirements (1) No collection of covered data without consent (A) In general A covered platform shall not collect any covered data of an individual without obtaining the individual's express consent for such data collection. (B) Revocation of consent; right to delete A covered platform shall— (i) allow any individual to revoke or withdraw the individual's prior consent to the covered platform collecting the individual's covered data; and (ii) at the request of an individual, delete any covered data of the individual collected or held by the platform. (2) No sale, sharing, or conveyance of data without consent (A) In general A covered platform shall not sell, share, or otherwise convey to a third party entity any covered data of an individual without obtaining the individual's express consent. (B) Revocation of consent A covered platform shall allow any individual to revoke or withdraw the individual's prior consent to any sale, sharing, or conveyance of the individual's covered data. (3) Notice of requirements (A) In general A covered platform shall provide notice to users of the platform of the requirements described in paragraphs (1) and (2). (B) Manner of notification The notice required under subparagraph (A) shall contain the information described in subparagraph (C) and shall be provided by a covered platform to a user— (i) in plain language and in a conspicuous manner; (ii) in addition to any notice relating to the terms of service of the platform; (iii) each time the user logs in to the platform unless the user affirmatively waives receiving the notice; and (iv) each time the platform modifies its terms of service. (C) Contents of notification A notice required under this paragraph shall include the following: (i) With respect to the collection of covered data by a covered platform— (I) the type of data to be collected; (II) whether the collection of data will continue beyond the user's immediate use of the covered platform; and (III) how the data will be used by the covered platform. (ii) With respect to the sale, sharing, or conveyance of covered data by a covered platform— (I) the specific data that will be sold, shared, or otherwise conveyed to a third party entity; (II) the name of any third party entity to which data will be sold, shared, or otherwise conveyed; and (III) the country of origin of the third party entity to which the data will be sold, shared, or conveyed. 3. Enforcement (a) Enforcement by the Federal Trade Commission (1) Unfair or deceptive acts or practices A violation of this Act or a regulation promulgated under this Act shall be treated as an unfair or deceptive act or practice in violation of a rule promulgated under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ). (2) Powers of the commission (A) In general The Federal Trade Commission shall enforce this Act and any regulation promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ) were incorporated into and made a part of this Act. (B) Privileges and immunities Any covered entity who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ). (b) Private right of action (1) In general An individual alleging a violation of this Act may bring a civil action in any court of competent jurisdiction, State or Federal. (2) Injury in fact A violation of this Act with respect to the requirements to notify and obtain the express consent of the user before the user’s data may be collected, sold, shared, or otherwise conveyed to a third-party entity constitutes a concrete and particularized injury in fact to that individual. (3) Relief In a civil action brought under paragraph (1) in which the plaintiff prevails, the court shall award— (A) the greater of— (i) not less than $5,000; and (ii) actual damages; and (B) reasonable attorney’s fees and litigation costs. (c) Rulemaking The Federal Trade Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.