Data Protection Act of 2021

II 117TH CONGRESS 1ST SESSION S. 2134 To establish the Data Protection Agency. IN THE SENATE OF THE UNITED STATES JUNE 17, 2021 Mrs. GILLIBRAND (for herself and Mr. BROWN) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To establish the Data Protection Agency. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Data Protection Act 4 of 2021’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) AGENCY.—The term ‘‘Agency’’ means the 8 Data Protection Agency established under section 3. 9 (2) ANONYMIZED DATA.—The term 10 ‘‘anonymized data’’ means information— 11 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 2 •S 2134 IS (A) that does not identify an individual; 1 and 2 (B) with respect to which there is no rea- 3 sonable basis to believe that the information 4 can be used on its own or in combination with 5 other reasonably available information to iden- 6 tify an individual. 7 (3) AUTOMATED DECISION SYSTEM.—The term 8 ‘‘automated decision system’’ means a computational 9 process, including one derived from machine learn- 10 ing, statistics, or other data processing or artificial 11 intelligence techniques, that makes a decision, or fa- 12 cilitates human decision making. 13 (4) BIOMETRIC INFORMATION.—The term ‘‘bio- 14 metric information’’— 15 (A) means information regarding the phys- 16 iological or biological characteristics of an indi- 17 vidual that may be used, singly or in combina- 18 tion with each other or with other identifying 19 data, to establish the identity of an individual; 20 (B) includes— 21 (i) genetic data; 22 (ii) imagery of the iris, retina, finger- 23 print, face, hand, palm, vein patterns, and 24 voice recordings, from which an identifier 25 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 3 •S 2134 IS template, such as a faceprint, a minutiae 1 template, or a voiceprint, can be extracted; 2 (iii) keystroke patterns or rhythms, 3 gait patterns or rhythms, and sleep, 4 health, or exercise data that contain identi- 5 fying information; and 6 (iv) any mathematical code, profile, or 7 algorithmic model derived from informa- 8 tion regarding the physiological or biologi- 9 cal characteristics of an individual; 10 (C) does not include information captured 11 from a patient in a health care setting for a 12 medical purpose or information collected, used, 13 or stored for health care treatment, payment, or 14 operations under the Health Insurance Port- 15 ability and Accountability Act of 1996 (Public 16 Law 104–191); and 17 (D) does not include an X-ray, roentgen 18 process, computed tomography, MRI, PET 19 scan, mammography, or other image or film of 20 the human anatomy used to diagnose, prognose, 21 or treat an illness or other medical condition or 22 to further validate scientific testing or screen- 23 ing. 24 (5) COLLECT.—The term ‘‘collect’’— 25 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 4 •S 2134 IS (A) means buying, renting, gathering, ob- 1 taining, receiving, or accessing any personal 2 data by any means; and 3 (B) includes— 4 (i) receiving personal data from an in- 5 dividual or device; and 6 (ii) creating, deriving, or inferring 7 personal data by analyzing data about an 8 individual or about groups of individuals 9 similar to the individual. 10 (6) DATA AGGREGATOR.—The term ‘‘data 11 aggregator’’— 12 (A) means any person that collects, uses, 13 or shares, in or affecting interstate commerce, 14 an amount of personal data that is not de mini- 15 mis, as well as entities related to that person by 16 common ownership or corporate control; and 17 (B) does not include an individual who col- 18 lects, uses, or shares personal data solely for 19 non-commercial reasons. 20 (7) DEVICE.—The term ‘‘device’’ means any 21 physical object that— 22 (A) is capable of connecting to the internet 23 or other communication network; or 24 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 5 •S 2134 IS (B) has computer processing capabilities 1 that can collect, send, receive, or store data. 2 (8) DIRECTOR.—The term ‘‘Director’’ means 3 the Director of the Data Protection Agency. 4 (9) ELECTRONIC DATA.—The term ‘‘electronic 5 data’’ means any information that is in an electronic 6 or digital format or any electronic or digital ref- 7 erence that contains information about an individual 8 or device. 9 (10) FEDERAL PRIVACY LAW.—The term ‘‘Fed- 10 eral privacy law’’ means the provisions of this Act, 11 any other rule or order prescribed by the Agency 12 under this Act, and the following laws (including any 13 amendments made to such laws): 14 (A) Title V of the Gramm-Leach-Bliley Act 15 (Public Law 106–102; 113 Stat. 1338). 16 (B) The Fair Credit Reporting Act (15 17 U.S.C. 1681 et seq.). 18 (C) The Telemarketing and Consumer 19 Fraud and Abuse Prevention Act (15 U.S.C. 20 6101 et seq.). 21 (D) The Fair and Accurate Credit Trans- 22 actions Act of 2003 (Public Law 108–159; 117 23 Stat. 1952). 24 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 6 •S 2134 IS (E) The CAN-SPAM Act of 2003 (15 1 U.S.C. 7701 et seq.). 2 (F) Sections 222, 227, 338(l), 631, and 3 705 of the Communications Act of 1934 (47 4 U.S.C. 222, 227, 338(l), 551, 705). 5 (G) The Children’s Online Privacy Protec- 6 tion Act of 1998 (15 U.S.C. 6501 et seq.). 7 (H) The Right to Financial Privacy Act of 8 1978 (12 U.S.C. 3401 et seq.). 9 (I) The Identity Theft Assumption and 10 Deterrence Act of 1998 (Public Law 105–318; 11 117 Stat. 3007). 12 (J) The General Education Provisions Act 13 (20 U.S.C. 1221 et seq.) (commonly known as 14 the ‘‘Family Educational Rights and Privacy 15 Act of 1974’’). 16 (K) Section 552a of title 5, United States 17 Code. 18 (L) The E-Government Act of 2002 (Pub- 19 lic Law 107–347; 116 Stat. 2899). 20 (M) The Computer Security Act of 1987 21 (40 U.S.C. 1441 note). 22 (N) The Employee Polygraph Protection 23 Act of 1988 (29 U.S.C. 2001 et seq.). 24 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 7 •S 2134 IS (O) The Communications Assistance for 1 Law Enforcement Act (Public Law 103–414; 2 108 Stat. 4279). 3 (P) Sections 1028A, 1030, 1801, 2710, 4 and 2721 and chapter 119, of title 18, United 5 States Code. 6 (Q) The Genetic Information Non- 7 discrimination Act of 2008 (Public Law 110– 8 233; 122 Stat. 881). 9 (R) The Taxpayer Browsing Protection 10 Act (Public Law 105–35; 111 Stat. 1104). 11 (S) The Privacy Protection Act of 1980 12 (42 U.S.C. 2000aa et seq.). 13 (T) The Cable Communications Policy Act 14 of 1984 (Public Law 98–549; 98 Stat. 2779). 15 (U) The Do-Not-Call Implementation Act 16 (Public Law 108–10; 117 Stat. 557). 17 (V) The Wireless Communications and 18 Public Safety Act of 1999 (Public Law 106–81; 19 113 Stat. 1286). 20 (W) Title XXX of the Public Health Serv- 21 ice Act (42 U.S.C. 300jj et seq.). 22 (11) HIGH-RISK DATA PRACTICE.—The term 23 ‘‘high-risk data practice’’ means an action by a data 24 aggregator that involves— 25 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 8 •S 2134 IS (A) the use of an automated decision sys- 1 tem; 2 (B) the processing of data in a manner 3 that involves an individual’s protected class, fa- 4 milial status, lawful source of income, financial 5 status such as the individual’s income or as- 6 sets), veteran status, criminal convictions or ar- 7 rests, citizenship, past, present, or future phys- 8 ical or mental health or condition, psychological 9 states, or any other factor used as a proxy for 10 identifying any of these characteristics; 11 (C) a systematic processing of publicly ac- 12 cessible data on a large scale; 13 (D) processing involving the use of new 14 technologies, or combinations of technologies, 15 that causes or materially contributes to privacy 16 harm; 17 (E) decisions about an individual’s access 18 to a product, service, opportunity, or benefit 19 which is based to any extent on automated deci- 20 sion system processing; 21 (F) any profiling of individuals on a large 22 scale; 23 (G) any processing of biometric informa- 24 tion for the purpose of uniquely identifying an 25 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 9 •S 2134 IS individual, with the exception of one-to-one bio- 1 metric authentication; 2 (H) combining, comparing, or matching 3 personal data obtained from multiple sources; 4 (I) processing which involves an individ- 5 ual’s precise geolocation; 6 (J) the processing of personal data of chil- 7 dren and teens under 17 or other vulnerable in- 8 dividuals such as the elderly, people with dis- 9 abilities, and other groups known to be suscep- 10 tible for exploitation for marketing purposes, 11 profiling, or automated processing; or 12 (K) consumer scoring or other business 13 practices that pertain to the eligibility of an in- 14 dividual, and related terms, rights, benefits, and 15 privileges, for employment (including hiring, fir- 16 ing, promotion, demotion, and compensation), 17 credit, insurance, housing, education, profes- 18 sional certification, or the provision of health 19 care and related services. 20 (12) HIGH-RISK DATA PRACTICE IMPACT EVAL- 21 UATION.—The term ‘‘high-risk data practice impact 22 evaluation’’ means a study conducted after deploy- 23 ment of a high-risk data practice that includes, at 24 a minimum— 25 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 10 •S 2134 IS (A) an evaluation of a high-risk data prac- 1 tice’s accuracy, disparate impacts on the basis 2 of protected class, and privacy harms; 3 (B) an evaluation of the effectiveness of 4 measures taken to minimize risks as outlined in 5 any prior high-risk data practice risk assess- 6 ments; and 7 (C) recommended measures to further min- 8 imize risks to accuracy, disparate impacts on 9 the basis of protected class, and privacy harms. 10 (13) HIGH-RISK DATA PRACTICE RISK ASSESS- 11 MENT.—The term ‘‘high-risk data practice risk as- 12 sessment’’ means a study evaluating a high-risk data 13 practice and the high-risk data practice’s develop- 14 ment process, including the design and training data 15 of the high-risk data practice, if applicable, for likeli- 16 hood and severity of risks to accuracy, bias, dis- 17 crimination, and privacy harms that includes, at a 18 minimum— 19 (A) a detailed description of the high-risk 20 data practice, including— 21 (i) its design and methodologies; 22 (ii) training data characteristics; 23 (iii) data; and 24 (iv) purpose; 25 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 11 •S 2134 IS (B) an assessment of the relative benefits 1 and costs of the high-risk data practice in light 2 of its purpose, potential unintended con- 3 sequences, and taking into account relevant fac- 4 tors, including— 5 (i) data minimization practices; 6 (ii) the duration and methods for 7 which personal data and the results of the 8 high-risk data practice are stored; 9 (iii) what information about the high- 10 risk data practice is available to individ- 11 uals; 12 (iv) the extent to which individuals 13 have access to the results of the high-risk 14 data practice and may correct or object to 15 its results; and 16 (v) the recipients of the results of the 17 high-risk data practice; 18 (C) an assessment of the risks of privacy 19 harm posed by the high-risk data practice and 20 the risks that the high-risk data practice may 21 result in or contribute to inaccurate, biased, or 22 discriminatory decisions impacting individuals 23 or groups of individuals; and 24 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 12 •S 2134 IS (D) the decision to accept, reject, or miti- 1 gate and minimize risks and the measures a 2 data aggregator will employ including to mini- 3 mize the risks described in subparagraph(C), 4 including technological and physical safeguards. 5 (14) INDIVIDUAL.—The term ‘‘individual’’ 6 means a natural person. 7 (15) PERSON.—The term ‘‘person’’ means an 8 individual, a local, State, or Federal governmental 9 entity, a partnership, a company, a corporation, an 10 association (incorporated or unincorporated), a 11 trust, an estate, a cooperative organization, another 12 entity, or any other organization or group of such 13 entities acting in concert. 14 (16) PERSONAL DATA.—The term ‘‘personal 15 data’’ means electronic data that, alone or in com- 16 bination with other data— 17 (A) identifies, relates to, describes, is capa- 18 ble of being associated with, or could reasonably 19 be linked, directly or indirectly, with a par- 20 ticular individual, household, or device; or 21 (B) could be used to determine that an in- 22 dividual or household is part of a protected 23 class. 24 VerDate Sep 11 2014 04:52 Jul 03, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2134.IS S2134 pbinns on DSKJLVW7X2PROD with BILLS 13 •S 2134 IS (17) PRECISE GEOLOCATION.—The term ‘‘pre- 1 cise geolocation’’ means any data that is derived 2 from a device and that is used or intended to be 3 used to locate an individual within a geographic area 4 that is equal to or less than the area of a circle with 5 a radius of one thousand, eight hundred and fifty 6 (1,850) feet. 7 (18) PRIVACY HARM.—The term ‘‘privacy 8 harm’’ means an adverse consequence, or a potential 9 adverse consequence, to an individual, a group of in- 10 dividuals, or society caused, in whole or in part, by 11 the collection, processing, or sharing of personal 12 data, including— 13 (A) direct or indirect financial loss or eco- 14 nomic harm, including financial loss or eco- 15 nomic harm arising from fraudulent activities 16 or data secu [Text truncated for display. Full text available on Congress.gov.]