Data Care Act of 2021

II 117TH CONGRESS 1ST SESSION S. 919 To establish duties for online service providers with respect to end user data that such providers collect and use. IN THE SENATE OF THE UNITED STATES MARCH 23, 2021 Mr. SCHATZ (for himself, Ms. CORTEZ MASTO, Mr. SANDERS, Mr. MERKLEY, Ms. HASSAN, Ms. BALDWIN, Mr. BOOKER, Mr. MURPHY, Mr. DURBIN, Ms. KLOBUCHAR, Mr. BENNET, Ms. DUCKWORTH, Mrs. MURRAY, Mr. MARKEY, Mr. VAN HOLLEN, Mr. HEINRICH, Ms. SMITH, and Mr. MANCHIN) introduced the following bill; which was read twice and re- ferred to the Committee on Commerce, Science, and Transportation A BILL To establish duties for online service providers with respect to end user data that such providers collect and use. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Data Care Act of 4 2021’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 2 •S 919 IS (1) COMMISSION.—The term ‘‘Commission’’ 1 means the Federal Trade Commission. 2 (2) END USER.—The term ‘‘end user’’ means 3 an individual who engages with an online service 4 provider or logs into or uses services provided by the 5 online service provider over the internet or any other 6 digital network. 7 (3) INDIVIDUAL IDENTIFYING DATA.—The term 8 ‘‘individual identifying data’’ means any data that 9 is— 10 (A) collected over the internet or any other 11 digital network; and 12 (B) linked, or reasonably linkable, to— 13 (i) a specific end user; or 14 (ii) a computing device that is associ- 15 ated with or routinely used by an end user. 16 (4) ONLINE SERVICE PROVIDER.—The term 17 ‘‘online service provider’’ means an entity that— 18 (A) is engaged in interstate commerce over 19 the internet or any other digital network; and 20 (B) in the course of business, collects indi- 21 vidual identifying data about end users, includ- 22 ing in a manner that is incidental to the busi- 23 ness conducted. 24 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 3 •S 919 IS (5) SENSITIVE DATA.—The term ‘‘sensitive 1 data’’ means any data that includes— 2 (A) a social security number; 3 (B) personal information (as defined in 4 section 1302 of the Children’s Online Privacy 5 Protection Act of 1998 (15 U.S.C. 6501)) col- 6 lected from a child (as defined in such section 7 1302); 8 (C) a driver’s license number, passport 9 number, military identification number, or any 10 other similar number issued on a government 11 document used to verify identity; 12 (D) a financial account number, credit or 13 debit card number, or any required security 14 code, access code, or password that is necessary 15 to permit access to a financial account of an in- 16 dividual; 17 (E) unique biometric data such as a finger 18 print, voice print, a retina or iris image, or any 19 other unique physical representation; 20 (F) information sufficient to access an ac- 21 count of an individual, such as user name and 22 password or email address and password; 23 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 4 •S 919 IS (G) the first and last name of an indi- 1 vidual, or first initial and last name, or other 2 unique identifier in combination with— 3 (i) the month, day, and year of birth 4 of the individual; 5 (ii) the maiden name of the mother of 6 the individual; or 7 (iii) the past or present precise 8 geolocation of the individual; 9 (H) information that relates to— 10 (i) the past, present, or future phys- 11 ical or mental health or condition of an in- 12 dividual; or 13 (ii) the provision of health care to an 14 individual; and 15 (I) the nonpublic communications or other 16 nonpublic user-created content of an individual. 17 SEC. 3. PROVIDER DUTIES. 18 (a) IN GENERAL.—An online service provider shall 19 fulfill the duties of care, loyalty, and confidentiality under 20 paragraphs (1), (2), and (3), respectively, of subsection 21 (b). 22 (b) DUTIES.— 23 (1) DUTY OF CARE.—An online service provider 24 shall— 25 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 5 •S 919 IS (A) reasonably secure individual identifying 1 data from unauthorized access; and 2 (B) subject to subsection (d), promptly in- 3 form an end user of any breach of the duty de- 4 scribed in subparagraph (A) of this paragraph 5 with respect to sensitive data of that end user. 6 (2) DUTY OF LOYALTY.—An online service pro- 7 vider may not use individual identifying data, or 8 data derived from individual identifying data, in any 9 way that— 10 (A) will benefit the online service provider 11 to the detriment of an end user; and 12 (B)(i) will result in reasonably foreseeable 13 and material physical or financial harm to an 14 end user; or 15 (ii) would be unexpected and highly offen- 16 sive to a reasonable end user. 17 (3) DUTY OF CONFIDENTIALITY.—An online 18 service provider— 19 (A) may not disclose or sell individual 20 identifying data to, or share individual identi- 21 fying data with, any other person except as con- 22 sistent with the duties of care and loyalty under 23 paragraphs (1) and (2), respectively; 24 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 6 •S 919 IS (B) may not disclose or sell individual 1 identifying data to, or share individual identi- 2 fying data with, any other person unless that 3 person enters into a contract with the online 4 service provider that imposes on the person the 5 same duties of care, loyalty, and confidentiality 6 toward the applicable end user as are imposed 7 on the online service provider under this sub- 8 section; and 9 (C) shall take reasonable steps to ensure 10 that the practices of any person to whom the 11 online service provider discloses or sells, or with 12 whom the online service provider shares, indi- 13 vidual identifying data fulfill the duties of care, 14 loyalty, and confidentiality assumed by the per- 15 son under the contract described in subpara- 16 graph (B), including by auditing, on a regular 17 basis, the data security and data information 18 practices of any such person. 19 (c) APPLICATION OF DUTIES TO THIRD PARTIES.— 20 If an online service provider transfers or otherwise pro- 21 vides access to individual identifying data to another per- 22 son, the requirements of paragraphs (1), (2), and (3) of 23 subsection (b) shall apply to such person with respect to 24 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 7 •S 919 IS such data in the same manner that such requirements 1 apply to the online service provider. 2 (d) EXPANSION OF DUTY TO INFORM REGARDING 3 BREACHES.—The Commission may promulgate regula- 4 tions under section 553 of title 5, United States Code, 5 to apply the breach notification requirement under sub- 6 section (b)(1)(B) with respect to specific categories of in- 7 dividual identifying data other than sensitive data, as the 8 Commission determines necessary. 9 (e) EXCEPTIONS.— 10 (1) REGULATIONS.—The Commission may pro- 11 mulgate regulations under section 553 of title 5, 12 United States Code, to exempt categories of online 13 service providers or persons described in subsection 14 (c) from the requirement under subsection (a) or 15 subsection (c) (as applicable). 16 (2) CONSIDERATIONS.—In promulgating regu- 17 lations under paragraph (1), the Commission shall 18 consider, among other factors— 19 (A) the privacy risks posed by the use of 20 individual identifying data by an online service 21 provider or person described in subsection (c) 22 based on— 23 (i) the size of the provider or person; 24 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 8 •S 919 IS (ii) the complexity of the offerings of 1 the provider; 2 (iii) the nature and scope of the ac- 3 tivities of the provider or person; and 4 (iv) the sensitivity of the consumer in- 5 formation handled by the provider or per- 6 son; and 7 (B) the costs and benefits of applying the 8 requirement under subsection (a) or subsection 9 (c) (as applicable) to online service providers or 10 persons with particular combinations of charac- 11 teristics considered under subparagraph (A) of 12 this paragraph. 13 SEC. 4. ENFORCEMENT. 14 (a) ENFORCEMENT BY COMMISSION.— 15 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC- 16 TICES.—A violation of section 3 by an online service 17 provider or a person described in section 3(c) shall 18 be treated as a violation of a rule defining an unfair 19 or deceptive act or practice prescribed under section 20 18(a)(1)(B) of the Federal Trade Commission Act 21 (15 U.S.C. 57a(a)(1)(B)). 22 (2) POWERS OF COMMISSION.— 23 (A) IN GENERAL.—Except as provided in 24 subparagraph (C), the Commission shall enforce 25 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 9 •S 919 IS this Act in the same manner, by the same 1 means, and with the same jurisdiction, powers, 2 and duties as though all applicable terms and 3 provisions of the Federal Trade Commission 4 Act (15 U.S.C. 41 et seq.) were incorporated 5 into and made a part of this Act. 6 (B) PRIVILEGES AND IMMUNITIES.—Ex- 7 cept as provided in subparagraph (C), any per- 8 son who violates section 3 shall be subject to 9 the penalties and entitled to the privileges and 10 immunities provided in the Federal Trade Com- 11 mission Act (15 U.S.C. 41 et seq.). 12 (C) NONPROFIT ORGANIZATIONS AND COM- 13 MON CARRIERS.—Notwithstanding section 4 or 14 5(a)(2) of the Federal Trade Commission Act 15 (15 U.S.C. 44, 45(a)(2)) or any jurisdictional 16 limitation of the Commission, the Commission 17 shall also enforce this Act, in the same manner 18 provided in subparagraphs (A) and (B) of this 19 paragraph, with respect to— 20 (i) organizations not organized to 21 carry on business for their own profit or 22 that of their members; and 23 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 10 •S 919 IS (ii) common carriers subject to the 1 Communications Act of 1934 (47 U.S.C. 2 151 et seq.). 3 (3) RULEMAKING AUTHORITY.—The Commis- 4 sion shall promulgate regulations under this Act in 5 accordance with section 553 of title 5, United States 6 Code. 7 (b) ENFORCEMENT BY STATES.— 8 (1) AUTHORIZATION.—Subject to paragraph 9 (3), in any case in which the attorney general of a 10 State has reason to believe that an interest of the 11 residents of the State has been or is threatened or 12 adversely affected by the engagement of an online 13 service provider or a person described in section 3(c) 14 in a practice that violates section 3, the attorney 15 general of the State may, as parens patriae, bring 16 a civil action against the online service provider or 17 person on behalf of the residents of the State in an 18 appropriate district court of the United States to ob- 19 tain appropriate relief, including civil penalties in 20 the amount determined under paragraph (2). 21 (2) CIVIL PENALTIES.—An online service pro- 22 vider or person described in section 3(c) that is 23 found, in an action brought under paragraph (1), to 24 have knowingly or repeatedly violated section 3 shall, 25 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 11 •S 919 IS in addition to any other penalty otherwise applicable 1 to a violation of section 3, be liable for a civil pen- 2 alty equal to the amount calculated by multiplying— 3 (A) the greater of— 4 (i) the number of days during which 5 the online service provider or person was 6 not in compliance with that section; or 7 (ii) the number of end users who were 8 harmed as a result of the violation, by 9 (B) an amount not to exceed the maximum 10 civil penalty for which a person, partnership, or 11 corporation may be liable under section 12 5(m)(1)(A) of the Federal Trade Commission 13 Act (15 U.S.C. 45(m)(1)(A)) (including any ad- 14 justments for inflation). 15 (3) RIGHTS OF FEDERAL TRADE COMMIS- 16 SION.— 17 (A) NOTICE TO FEDERAL TRADE COMMIS- 18 SION.— 19 (i) IN GENERAL.—Except as provided 20 in clause (iii), the attorney general of a 21 State shall notify the Commission in writ- 22 ing that the attorney general intends to 23 bring a civil action under paragraph (1) 24 before initiating the civil action. 25 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 12 •S 919 IS (ii) CONTENTS.—The notification re- 1 quired under clause (i) with respect to a 2 civil action shall include a copy of the com- 3 plaint to be filed to initiate the civil action. 4 (iii) EXCEPTION.—If it is not feasible 5 for the attorney general of a State to pro- 6 vide the notification required under clause 7 (i) before initiating a civil action under 8 paragraph (1), the attorney general shall 9 notify the Commission immediately upon 10 instituting the civil action. 11 (B) INTERVENTION BY FEDERAL TRADE 12 COMMISSION.—The Commission may— 13 (i) intervene in any civil action 14 brought by the attorney general of a State 15 under paragraph (1); and 16 (ii) upon intervening— 17 (I) be heard on all matters aris- 18 ing in the civil action; and 19 (II) file petitions for appeal of a 20 decision in the civil action. 21 (4) INVESTIGATORY POWERS.—Nothing in this 22 subsection may be construed to prevent the attorney 23 general of a State from exercising the powers con- 24 VerDate Sep 11 2014 01:06 Apr 13, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S919.IS S919 kjohnson on DSK79L0C42PROD with BILLS 13 •S 919 IS ferred on the attorney general by the laws of the 1 State to— 2 (A) conduct investigations; 3 (B) administer oaths or affirmations; or 4 (C) compel the attendance of witnesses or 5 the production of documentary or other evi- 6 dence. 7 (5) PREEMPTIVE ACTION BY FEDERAL TRADE 8 COMMISSION.—If the Commission institutes a civil 9 action or an administrative action with respect to a [Text truncated for display. Full text available on Congress.gov.]