Information Transparency & Personal Data Control Act

I ★ 117TH CONGRESS 1ST SESSION H. R. 1816 To require the Federal Trade Commission to promulgate regulations related to sensitive personal information, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MARCH 11, 2021 Ms. DELBENE (for herself, Mr. KILMER, Ms. STRICKLAND, Ms. HOULAHAN, Mr. BLUMENAUER, Mr. HIMES, Mr. CRIST, Mr. LARSON of Connecticut, Ms. WILD, Mr. PERLMUTTER, Mr. CARTWRIGHT, Mr. HORSFORD, Mr. CASE, Mr. RYAN, Ms. SLOTKIN, Ms. SCHRIER, Mr. BEYER, Mr. LARSEN of Washington, and Mr. COSTA) introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To require the Federal Trade Commission to promulgate regulations related to sensitive personal information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Information Trans- 4 parency & Personal Data Control Act’’. 5 SEC. 2. SENSE OF CONGRESS. 6 It is the Sense of Congress that— 7 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 2 HR 1816 IH1S (1) the United States must develop a balanced, 1 high-standard digital privacy framework that com- 2 plements global standards; 3 (2) a key element of this framework is a strong 4 national standard that combats anti-consumer prac- 5 tices; 6 (3) it is critical that the Federal Government 7 provide guidance on the collection, processing, disclo- 8 sure, transmission and storage of sensitive data; 9 (4) it is important to provide the Nation with 10 fair and thoughtful digital consumer rights with re- 11 spect to such data; 12 (5) it is important to ensure that enforcement 13 authorities have the resources needed to protect con- 14 sumers from unlawful and deceptive acts of practices 15 in the data privacy and security space; and 16 (6) individuals have a right to— 17 (A) exercise control over the personal data 18 companies collect from them and how they use 19 it; 20 (B) easily understandable and accessible 21 information about privacy and security prac- 22 tices; 23 (C) expect that companies will collect, use, 24 and disclose personal data in ways that are con- 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 3 HR 1816 IH1S sistent with the context in which consumers 1 provide the data; 2 (D) secure and responsible handling of 3 sensitive personal information; 4 (E) access and correct persona data in us- 5 able formats, in a manner that is appropriate to 6 the sensitivity of the data and the risk of ad- 7 verse consequences to consumers if the data is 8 inaccurate; and 9 (F) reasonable limits on the personal data 10 that companies collect and retain. 11 SEC. 3. REQUIREMENTS FOR SENSITIVE PERSONAL INFOR- 12 MATION. 13 (a) REGULATIONS.—Not later than 18 months after 14 the date of enactment of this Act, the Federal Trade Com- 15 mission shall promulgate regulations under section 553 of 16 title 5, United States Code, to require, except as provided 17 in subsection (b), controllers, processors, and third parties 18 to make available to the public involving the collection, 19 transmission, storage, processing, sale, sharing of sensitive 20 personal information, or other use of sensitive personal in- 21 formation from persons operating in or persons located in 22 the United States when the sensitive personal information 23 is collected, transmitted, stored, processed, sold or shared 24 to meet the following requirements: 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 4 HR 1816 IH1S (1) AFFIRMATIVE, EXPRESS, AND OPT-IN CON- 1 SENT.— 2 (A) Any controller shall provide users 3 whose personal information is collected, trans- 4 mitted, stored, process, sold, or otherwise 5 shared with notice through a privacy and data 6 use policy of a specific request to collect, trans- 7 mit, sell, share or otherwise disclose their sen- 8 sitive personal information and require that 9 users provide affirmative, express consent to 10 any functionality that involves the sale, sharing, 11 or other disclosure of sensitive personal infor- 12 mation, including sharing sensitive personal in- 13 formation with third parties, if the sensitive 14 personal information is to be used by the third 15 party for purposes other than the purposes out- 16 lined in the notice. 17 (B) The documented instruction from a 18 controller to a processor or third party shall ad- 19 here to the limits of the consent granted in sub- 20 paragraph (A), and processors and third parties 21 shall not use or disclose the sensitive personal 22 information for any other purposes or in any 23 way that exceeds the limits of the consent 24 granted in subparagraph (A). 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 5 HR 1816 IH1S (C) Controllers and processors shall not be 1 liable for the failure of another processor or 2 third party to adhere to the limits of an opt-in 3 consent granted under subparagraph (A). 4 (2) PRIVACY AND DATA USE POLICY.—Control- 5 lers, processors, and third parties shall publicly 6 maintain an up-to-date, transparent privacy, secu- 7 rity, and data use policy that meets general require- 8 ments, including that such policy, presented in the 9 context where it applies— 10 (A) is concise, intelligible, and uses plain 11 language; 12 (B) is clear and conspicuous consistent 13 with the guidelines of the Federal Trade Com- 14 mission; 15 (C) uses visualizations, where appropriate 16 to make complex information understandable by 17 the ordinary user; and 18 (D) is provided free of charge. 19 (3) ADDITIONAL REQUIREMENTS FOR PRIVACY 20 AND DATA USE POLICY.—The privacy, security, and 21 data use policy required under paragraph (2) shall 22 include the following: 23 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 6 HR 1816 IH1S (A) Identity and contact information of the 1 entity collecting or processing the sensitive per- 2 sonal information. 3 (B) The purpose or use for collecting, stor- 4 ing, processing, selling, sharing, or otherwise 5 using the sensitive personal information. 6 (C) Categories of third parties with whom 7 the sensitive personal information will be shared 8 and for what general purposes. 9 (D) The process by which individuals may 10 withdraw consent to the collecting, storing, 11 processing, selling, sharing, or other use of the 12 sensitive personal information, including shar- 13 ing with third parties. 14 (E) How a user, controller, or processor 15 can view or obtain the sensitive personal infor- 16 mation that they have received or provided to a 17 controller or processor, including whether it can 18 be exported to other web-based platforms. 19 (F) The categories of sensitive personal in- 20 formation that is collected by the controller or 21 processor and shared with processors or third 22 parties. 23 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 7 HR 1816 IH1S (G) How sensitive personal information is 1 protected from unauthorized access or acquisi- 2 tion. 3 (4) OPT-OUT CONSENT.— 4 (A) For any collection, transmission, stor- 5 age, processing, selling, sharing, or other use of 6 non-sensitive personal information, including 7 sharing with third parties, controllers shall pro- 8 vide users with the ability to opt out at any 9 time. 10 (B) Controllers shall honor an opt out re- 11 quest from a user under subparagraph (A) to 12 the extent of its role in any collection, trans- 13 mission, storage, processing, selling, sharing, or 14 other use of non-sensitive personal information 15 and shall communicate an opt-out request to 16 the relevant processor or third party with which 17 the controller has shared information regarding 18 that user. 19 (C) Processors or third parties receiving an 20 opt out pursuant to subparagraph (A) and (B) 21 shall comply with such opt out to the extent of 22 their role in any collection, transmission, stor- 23 age, processing, selling, sharing, or other use of 24 non-sensitive personal information. 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 8 HR 1816 IH1S (D) Any controller that communicates an 1 opt out from a user as required by subpara- 2 graph (B) shall not be liable for the failure of 3 a service provider or third party to comply with 4 such opt out. 5 (5) RELATIONSHIP BETWEEN CONTROLLER 6 AND PROCESSOR.— 7 (A) Processing by a processor must be gov- 8 erned by a contract between the controller and 9 the processor that is binding on both parties 10 and that sets the processor to processes the 11 personal data only on documented instructions 12 from the controller. 13 (B) Processors shall share sensitive per- 14 sonal information with a subcontractor only for 15 purposes of providing services and only after 16 first providing the controller with an oppor- 17 tunity to object. 18 (C) In no event may any contract or docu- 19 mented instructions relieve a controller or a 20 processor from the obligations and liabilities im- 21 posed on them by this Act. 22 (6) PRIVACY AUDITS.— 23 (A) IN GENERAL.—Except as provided in 24 subparagraphs (C) and (D), at least once every 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 9 HR 1816 IH1S 2 years, each controller, processor, or third 1 party that has collected, transmitted, stored, 2 processed, selling, shared, or otherwise used 3 sensitive personal information shall— 4 (i) obtain a privacy audit from a 5 qualified, objective, independent third- 6 party; and 7 (ii) shall make publicly available 8 whether or not the privacy audit found the 9 controller, processor, or third party compli- 10 ant. 11 (B) AUDIT REQUIREMENTS.—Each such 12 audit shall— 13 (i) set forth the privacy, security, and 14 data use controls that the controller, proc- 15 essor, or third party has implemented and 16 maintained during the reporting period; 17 (ii) describe whether such controls are 18 appropriate to the size and complexity of 19 the controller, processor, or third party, 20 the nature and scope of the activities of 21 the controller, processor, or third party, 22 and the nature of the sensitive personal in- 23 formation or behavioral data collected by 24 the controller, processor, or third party; 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 10 HR 1816 IH1S (iii) certify whether the privacy and 1 security controls operate with sufficient ef- 2 fectiveness to provide reasonable assurance 3 to protect the privacy and security of sen- 4 sitive personal information or behavioral 5 data, including with respect to data shared 6 with third parties, and that the controls 7 have so operated throughout the reporting 8 period; 9 (iv) be prepared and completed within 10 60 days after a substantial change to the 11 controller’s privacy and data use policy de- 12 scribed in paragraph (2); and 13 (v) be provided— 14 (I) to the Federal Trade Com- 15 mission; and 16 (II) to any attorney general of a 17 State, or other authorized State offi- 18 cer, within 10 days of receiving writ- 19 ten request by the such attorney gen- 20 eral, or other authorized State officer 21 where such officer has presented to 22 the controller, processor, or third 23 party allegations that a violation of 24 this Act or any regulation issued 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 11 HR 1816 IH1S under this Act has been committed by 1 the controller, processor, or third 2 party. 3 (C) SMALL BUSINESS AUDIT EXEMP- 4 TION.—The audit requirements described in 5 this paragraph shall not apply to controllers 6 who collect, store, process, sell, share, or other- 7 wise use sensitive personal information relating 8 to 250,000 or fewer individuals per year. 9 (D) NON-SENSITIVE PERSONAL INFORMA- 10 TION EXEMPTION.—The audit requirements set 11 forth above shall not apply to controllers, proc- 12 essors or third parties who do not collect, store, 13 process, sell, share, or otherwise use sensitive 14 personal information. 15 (E) RULES THAT DO NOT INCENTIVIZE 16 SELLING INFORMATION.—The Commission shall 17 promulgate rules regarding qualifications and 18 requirements of third-party auditors such as a 19 duty to conduct an independent assessment that 20 does not incentivize the auditor to sell under 21 the guise of a potential violation by the con- 22 troller products or services when there is not a 23 violation of the Act. 24 (b) EXEMPTIONS.— 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD with BILLS 12 HR 1816 IH1S (1) NECESSARY OPERATIONS AND SECURITY 1 PURPOSES.—Subsection (a) shall not apply to the 2 processing, transmission, collecting, storing, sharing, 3 selling of sensitive and non-sensitive personal infor- 4 mation for the following purposes: 5 (A) Preventing or detecting fraud, identity 6 theft, unauthorized transactions, theft, shop- 7 lifting, or criminal activity including financial 8 crimes and money laundering. 9 (B) The use of such information to identify 10 errors that impair functionality or otherwise en- 11 hancing or maintaining the availability of the 12 services or information systems of the controller 13 for authorized access and use. 14 (C) Protecting the vital interests of the 15 consumer or another natural person. 16 (D) Responding in good faith to valid legal 17 process or providing information as otherwise 18 required or authorized by law. 19 (E) Monitoring or enforcing agreements 20 between the Controller, processor, or third 21 party and an individual, including but not lim- 22 ited to, terms of service, terms of use, user 23 agreements, or agreements concerning moni- 24 toring criminal activity. 25 VerDate Sep 11 2014 21:30 May 17, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H1816.IH H1816 pamtmann on DSKBC07HB2PROD wi [Text truncated for display. Full text available on Congress.gov.]