Data Broker List Act of 2021

II 117TH CONGRESS 1ST SESSION S. 2290 To provide for requirements for data brokers with respect to the acquisition, use, and protection of brokered personal information and to require that data brokers annually register with the Federal Trade Commission. IN THE SENATE OF THE UNITED STATES JUNE 24, 2021 Mr. PETERS (for himself, Ms. LUMMIS, and Mrs. CAPITO) introduced the fol- lowing bill; which was read twice and referred to the Committee on Com- merce, Science, and Transportation A BILL To provide for requirements for data brokers with respect to the acquisition, use, and protection of brokered per- sonal information and to require that data brokers annu- ally register with the Federal Trade Commission. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Data Broker List Act 4 of 2021’’. 5 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 2 •S 2290 IS SEC. 2. REQUIREMENTS FOR DATA BROKERS. 1 (a) REQUIREMENTS WITH RESPECT TO THE ACQUI- 2 SITION AND USE OF BROKERED PERSONAL INFORMA- 3 TION.—A data broker shall not— 4 (1) acquire brokered personal information 5 through fraudulent means; 6 (2) acquire or use brokered personal informa- 7 tion for the purpose of— 8 (A) stalking or harassing another person; 9 (B) committing fraud, including identity 10 theft, financial fraud, or e-mail fraud; or 11 (C) engaging in unlawful discrimination, 12 including unlawful discrimination in decisions 13 regarding employment, housing, and credit eli- 14 gibility; or 15 (3) sell or transfer brokered personal informa- 16 tion to a third party if the data broker knows or rea- 17 sonably should know that the third party intends to 18 engage in any conduct prohibited by this Act. 19 (b) DUTY TO PROTECT BROKERED PERSONAL IN- 20 FORMATION.— 21 (1) IN GENERAL.—A data broker shall develop, 22 implement, and maintain a comprehensive informa- 23 tion security program in order to protect from secu- 24 rity breaches or other inadvertent or improper dis- 25 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 3 •S 2290 IS closure the brokered personal information acquired 1 by the data broker. 2 (2) NOTIFICATION OF CHANGE OF OWNER- 3 SHIP.—If a data broker is purchased or otherwise 4 acquired by another entity, such other entity shall 5 provide notification of such purchase or acquisition 6 to any consumer with respect to which— 7 (A) the data broker collected, processed, 8 analyzed, stored or used brokered personal in- 9 formation; and 10 (B) such other entity plans to continue to 11 collect, process, analyze, store or use such infor- 12 mation. 13 (3) PROGRAM REQUIREMENTS.—The com- 14 prehensive information security program required 15 under paragraph (1) shall— 16 (A) be written in one or more readily ac- 17 cessible parts; and 18 (B) contain administrative, technical, and 19 physical safeguards that are appropriate to— 20 (i) the size, scope, and type of busi- 21 ness of the data broker; 22 (ii) the amount of resources available 23 to the data broker; 24 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 4 •S 2290 IS (iii) the amount of stored data of the 1 data broker; 2 (iv) the nature and sensitivity of the 3 brokered personal information stored by 4 the data broker; and 5 (v) the need for security and confiden- 6 tiality of brokered personal information. 7 (c) ANNUAL REGISTRATION.— 8 (1) IN GENERAL.—Annually, on or before Janu- 9 ary 31, a data broker shall— 10 (A) register with the Commission; and 11 (B) provide the following information with 12 such registration: 13 (i) The name and primary physical, e- 14 mail, and internet addresses of the data 15 broker. 16 (ii) If the data broker permits a con- 17 sumer to opt out of the data broker’s col- 18 lection of brokered personal information, 19 opt out of its databases, or opt out of cer- 20 tain sales of data— 21 (I) the method for requesting an 22 opt-out; 23 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 5 •S 2290 IS (II) if the opt-out applies to only 1 certain activities or sales, which ones; 2 and 3 (III) whether the data broker 4 permits a consumer to authorize a 5 third party to perform the opt-out on 6 the consumer’s behalf. 7 (iii) A statement specifying the data 8 collection, databases, or sales activities 9 from which a consumer may not opt out, 10 and why an opportunity to opt out is not 11 available. 12 (iv) A statement specifying the types 13 of information being collected, as deter- 14 mined by the Commission, to the extent 15 practicable. 16 (v) A statement as to whether the 17 data broker implements a purchaser 18 credentialing process and, if so, a descrip- 19 tion of that process. 20 (vi) The number of security breaches 21 that the data broker experienced during 22 the previous year, and if known, the total 23 number of consumers whose personal infor- 24 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 6 •S 2290 IS mation was accessed, downloaded, viewed, 1 or otherwise affected in a breach. 2 (vii) Where the data broker has actual 3 knowledge that it possesses the brokered 4 personal information of minors, a separate 5 statement detailing the data collection 6 practices, databases, sales activities, and 7 opt-out policies that are applicable to the 8 brokered personal information of minors. 9 (viii) Any additional information or 10 explanation concerning its data collection 11 practices. 12 (2) EXCEPTION.—The requirements under 13 paragraph (1) shall not apply to a data broker that 14 is already required to comply with such requirements 15 with respect to another Federal agency. 16 (3) PUBLIC AVAILABILITY.—The Commission 17 shall make the information described in paragraph 18 (1) available on the internet website of the Commis- 19 sion, except as necessary to protect the integrity of 20 ongoing investigations or to protect the privacy of 21 consumers, or if it is in the interest of public safety 22 or welfare. 23 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 7 •S 2290 IS SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMIS- 1 SION. 2 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 3 A violation of section 2 shall be treated as a violation of 4 a rule defining an unfair or a deceptive act or practice 5 under section 18(a)(1)(B) of the Federal Trade Commis- 6 sion Act (15 U.S.C. 57a(a)(1)(B)). The Commission shall 7 begin enforcement of such violations by not later than 1 8 year after the date of the enactment of this Act. 9 (b) POWERS OF COMMISSION.— 10 (1) IN GENERAL.—The Commission shall en- 11 force this Act in the same manner, by the same 12 means, and with the same jurisdiction, powers, and 13 duties as though all applicable terms and provisions 14 of the Federal Trade Commission Act (15 U.S.C. 41 15 et seq.) were incorporated into and made a part of 16 this Act. 17 (2) PRIVILEGES AND IMMUNITIES.—Any data 18 broker who violates section 2 shall be subject to the 19 penalties and entitled to the privileges and immuni- 20 ties provided in the Federal Trade Commission Act 21 (15 U.S.C. 41 et seq.). 22 (3) CIVIL PENALTY.—A data broker that fails 23 to register as required under section 2(c) shall be 24 liable for a civil penalty in an amount determined by 25 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 8 •S 2290 IS the Commission through the rulemaking authority 1 under subsection (c). 2 (4) AUTHORITY PRESERVED.—Nothing in this 3 Act shall be construed to limit the authority of the 4 Federal Trade Commission under any other provi- 5 sion of law. 6 (c) RULEMAKING AUTHORITY FOR THE COMMIS- 7 SION.—The Commission shall have authority under sec- 8 tion 553 of title 5, United States Code, to promulgate reg- 9 ulations the Commission determines to be necessary to 10 carry out the provisions of this Act. 11 SEC. 4. FTC ANNUAL REVIEW AND REPORT. 12 (a) ANNUAL REVIEW.—The Commission shall con- 13 duct an annual review of the implementation of the provi- 14 sions of this Act. Such study shall include an analysis of— 15 (1) compliance by data brokers with the re- 16 quirements under section 2; 17 (2) enforcement actions taken by the Commis- 18 sion with respect to violations of such requirements; 19 and 20 (3) other areas determined appropriate by the 21 Commission. 22 (b) ANNUAL REPORT.—Not later than 1 year after 23 the date of the enactment of this Act, and annually there- 24 after the Commission shall submit to Congress a report 25 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 9 •S 2290 IS on the review conducted under subsection (a), together 1 with recommendations for such legislation and administra- 2 tive action as the Commission determines appropriate. 3 SEC. 5. DEFINITIONS. 4 In this section: 5 (1) BROKERED PERSONAL INFORMATION.—The 6 term ‘‘brokered personal information’’ means any 7 personal information that is categorized or organized 8 for sale, license, or trade, or is otherwise disclosed 9 for compensation, to a third party. 10 (2) BUSINESS.— 11 (A) IN GENERAL.—The term ‘‘business’’ 12 means a commercial entity, including a sole 13 proprietorship, partnership, corporation, asso- 14 ciation, limited liability company, or other 15 group, however organized and whether or not 16 organized to operate at a profit, including a fi- 17 nancial institution organized, chartered, or 18 holding a license or authorization certificate 19 under the laws of a State, the United States, or 20 any other country, or the parent, affiliate, or 21 subsidiary of a financial institution. 22 (B) EXCLUSION.—The term ‘‘business’’ 23 does not include a State, a State agency, any 24 political subdivision of a State, or a vendor act- 25 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 10 •S 2290 IS ing solely on behalf of, and at the direction of, 1 a State. 2 (3) COMMISSION.—The term ‘‘Commission’’ 3 means the Federal Trade Commission. 4 (4) CONSUMER.—The term ‘‘consumer’’ means 5 an individual residing in the United States acting in 6 a personal, family, or household capacity. 7 (5) DATA BROKER.— 8 (A) IN GENERAL.—The term ‘‘data 9 broker’’ means a business that knowingly col- 10 lects or obtains the personal information of a 11 consumer with whom the business does not have 12 a direct relationship and then sells, licenses, 13 trades, provides for consideration, or is other- 14 wise compensated for disclosing that informa- 15 tion to a third party. 16 (B) DIRECT RELATIONSHIP.—For pur- 17 poses of subparagraph (A), a direct relationship 18 with a business exists if the consumer— 19 (i) is a current customer; 20 (ii) obtained a good or service from 21 the business within the prior 18 months; or 22 (iii) made an inquiry about the prod- 23 ucts or services of the business within the 24 prior 90 days. 25 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 11 •S 2290 IS (C) EXCLUSION.—The following activities 1 conducted by a business, and the collection and 2 sale or licensing of brokered personal informa- 3 tion incidental to conducting these activities, do 4 not qualify the business as a data broker: 5 (i) Providing 411 directory assistance 6 or directory information services, including 7 name, address, and telephone number, on 8 behalf of or as a function of a tele- 9 communications carrier. 10 (ii) Providing a consumer’s publicly 11 available information if the information is 12 being used by the recipient as it relates to 13 that consumer’s business or profession. 14 (iii) Providing publicly available infor- 15 mation via real-time or near-real-time alert 16 services for health or safety purposes. 17 (iv) Providing or using information in 18 a manner that is regulated under another 19 Federal or State law, including the Fair 20 Credit Reporting Act, the Gramm-Leach- 21 Bliley Act, or the Health Insurance Port- 22 ability and Accountability Act. 23 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 12 •S 2290 IS (v) Providing data to a third party at 1 the direction of the consumer and with the 2 consumer’s affirmative express consent. 3 (vi) Providing or using information 4 for assessing, verifying, or authenticating a 5 person’s identity, or for investigating or 6 preventing actual or potential fraud. 7 (D) EXCLUSION FROM SALE.—For pur- 8 poses of this paragraph, the term ‘‘sells’’ does 9 not include a one-time or occasional sale of as- 10 sets of a business as part of a transfer of con- 11 trol of those assets that is not part of the ordi- 12 nary conduct of the business. 13 (6) DATA BROKER SECURITY BREACH.— 14 (A) IN GENERAL.—The term ‘‘data broker 15 security breach’’ means an unauthorized acqui- 16 sition or a reasonable belief of an unauthorized 17 acquisition of more than one element of bro- 18 kered personal information maintained by a 19 data broker when the brokered personal infor- 20 mation is not encrypted, redacted, or protected 21 by another method that renders the information 22 unreadable or unusable by an unauthorized per- 23 son or entity. 24 VerDate Sep 11 2014 04:29 Jul 09, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2290.IS S2290 kjohnson on DSK79L0C42PROD with BILLS 13 •S 2290 IS (B) EXCLUSION.—The term ‘‘data broker 1 security breach’’ does not include good faith but 2 unauthorized acquisition of brokered personal 3 information by an employee or agent of the 4 data broker for a legitimate purpose of the data 5 broker, provided that the brokered personal in- 6 formation is not used for a purpose unrelated 7 to the data broker’s business or subject to fur- 8 ther unauthorized disclosure. 9 (C) APPLICATION.—In determining wheth- 10 er brokered personal information has been ac- 11 quired or is [Text truncated for display. Full text available on Congress.gov.]