ADD Act

II 116TH CONGRESS 1ST SESSION S. 142 To impose privacy requirements on providers of internet services similar to the requirements imposed on Federal agencies under the Privacy Act of 1974. IN THE SENATE OF THE UNITED STATES JANUARY 16, 2019 Mr. RUBIO introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To impose privacy requirements on providers of internet serv- ices similar to the requirements imposed on Federal agencies under the Privacy Act of 1974. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘American Data Dis- 4 semination Act of 2019’’ or the ‘‘ADD Act’’. 5 SEC. 2. DEFINITIONS. 6 (a) IN GENERAL.—In this Act— 7 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 142 IS (1) the term ‘‘agency’’ has the meaning given 1 the term in section 552a of title 5, United States 2 Code; 3 (2) the term ‘‘appropriate committees of Con- 4 gress’’ means— 5 (A) the Committee on Commerce, Science, 6 and Transportation of the Senate; and 7 (B) the Committee on Energy and Com- 8 merce of the House of Representatives; 9 (3) the term ‘‘collect’’ means to buy, rent, gath- 10 er, obtain, receive, or access information about an 11 individual by any means, including by— 12 (A) receiving information from the indi- 13 vidual, either actively or passively; or 14 (B) observing the behavior of the indi- 15 vidual; 16 (4) the term ‘‘Commission’’ means the Federal 17 Trade Commission; 18 (5) the term ‘‘covered provider’’ means a person 19 that— 20 (A) provides a service that uses the inter- 21 net; and 22 (B) in providing the service under subpara- 23 graph (A), collects records; 24 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 142 IS (6) the term ‘‘disclose’’ means to release, dis- 1 seminate, make available, transfer, or otherwise 2 communicate orally, in writing, or by electronic or 3 other means; 4 (7) the term ‘‘maintain’’ includes maintain, col- 5 lect, use, disclose, or process; 6 (8) the term ‘‘Privacy Act of 1974’’ means sec- 7 tion 552a of title 5, United States Code; 8 (9) the term ‘‘process’’ means to perform an 9 operation or set of operations on information or on 10 sets of information, whether or not by automated 11 means; 12 (10) subject to subsection (b), the term 13 ‘‘record’’ means any item, collection, or grouping of 14 information about an individual that— 15 (A) is maintained by a covered provider, 16 including the education, financial transactions, 17 medical history, and criminal or employment 18 history of the individual; and 19 (B) contains any name or number that 20 may be used, alone or in conjunction with any 21 other information, to identify a specific indi- 22 vidual, including any— 23 (i) name, social security number, date 24 of birth, official driver’s license or identi- 25 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 142 IS fication number issued by a State, alien 1 registration number, government passport 2 number, or employer or taxpayer identi- 3 fication number; 4 (ii) unique biometric data, such as fin- 5 gerprint, voice print, retina or iris image, 6 or other unique physical representation; 7 (iii) unique electronic identification 8 number, address, or routing code; 9 (iv) telecommunication identifying in- 10 formation or access device (as those terms 11 are defined in section 1029(e) of title 18, 12 United States Code); or 13 (v) user-generated content; and 14 (11) the term ‘‘sell’’ means to disclose informa- 15 tion about an individual to another person for mone- 16 tary or other valuable consideration. 17 (b) MODIFICATION OF DEFINITION.—If the Commis- 18 sion promulgates regulations under section 4(a), the Com- 19 mission may modify, at any time, the definition of the 20 term ‘‘record’’ under subsection (a) of this section as nec- 21 essary to conform to new Federal laws or regulations. 22 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 142 IS SEC. 3. RECOMMENDED PRIVACY REQUIREMENTS FOR 1 PROVIDERS OF INTERNET SERVICES. 2 (a) IN GENERAL.—Not later than 180 days after the 3 date of enactment of this Act, the Commission shall sub- 4 mit to the appropriate committees of Congress detailed 5 recommendations for privacy requirements that Congress 6 could impose on covered providers that would be substan- 7 tially similar, to the extent practicable, to the require- 8 ments applicable to agencies under the Privacy Act of 9 1974. 10 (b) SUBJECTS FOR RECOMMENDATIONS.—The rec- 11 ommendations under subsection (a) shall address the 12 issues described in section 4. 13 SEC. 4. REGULATIONS IMPOSING PRIVACY REQUIREMENTS 14 ON PROVIDERS OF INTERNET SERVICES. 15 (a) REGULATIONS.— 16 (1) PROPOSED REGULATIONS.—Not earlier 17 than 1 year after the date on which the Commission 18 submits detailed recommendations for privacy re- 19 quirements under section 3(a), and not later than 15 20 months after that date, the Commission shall pub- 21 lish and submit to the appropriate committees of 22 Congress proposed regulations to impose privacy re- 23 quirements on covered providers that are substan- 24 tially similar, to the extent practicable, to the re- 25 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 142 IS quirements applicable to agencies under the Privacy 1 Act of 1974. 2 (2) FINAL REGULATIONS.—If a law imposing 3 privacy requirements on covered providers that are 4 substantially similar, to the extent practicable, to the 5 requirements applicable to agencies under the Pri- 6 vacy Act of 1974 is not enacted by the date that is 7 2 years after the date of enactment of this Act, the 8 Commission shall, not later than 27 months after 9 that date of enactment, promulgate final regulations 10 that impose such privacy requirements. 11 (b) CONTENTS.—In promulgating regulations under 12 subsection (a), the Commission— 13 (1) shall— 14 (A) establish criteria for exempting certain 15 small, newly formed covered providers from the 16 requirements under the regulations, taking into 17 account factors including— 18 (i) the period of time during which 19 the covered provider has been operating as 20 a covered provider; 21 (ii) the annual revenue of the covered 22 provider; and 23 (iii) the number of individuals about 24 whom the covered provider collects records; 25 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 7 •S 142 IS (B) restrict disclosure of records main- 1 tained by covered providers; 2 (C) provide that— 3 (i) an individual may request access to 4 a record (or a portion thereof) maintained 5 by a covered provider that relates to the 6 individual; and 7 (ii) upon a request under clause (i), 8 the covered provider shall— 9 (I) provide the individual with ac- 10 cess to the record (or the relevant 11 portion thereof); or 12 (II) if the covered provider so 13 elects, delete the record (or the rel- 14 evant portion thereof), subject to the 15 requirements to keep and provide an 16 accounting under subparagraph (G); 17 (D) provide that if an individual dem- 18 onstrates that a record relating to the indi- 19 vidual is not accurate, relevant, timely, or com- 20 plete (as those terms are defined by the Com- 21 mission)— 22 (i) the individual may request that the 23 covered provider amend the record; and 24 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 8 •S 142 IS (ii) upon a request under clause (i), 1 the covered provider shall amend the 2 record; 3 (E) establish a process modeled on the 4 process established under section 611(a) of the 5 Fair Credit Reporting Act (15 U.S.C. 6 1681i(a))— 7 (i) through which an individual and a 8 covered provider may resolve a dispute 9 under subparagraph (D) of this paragraph 10 regarding the assertion that a record relat- 11 ing to the individual is not accurate, rel- 12 evant, timely, or complete; and 13 (ii) that does not require the indi- 14 vidual to incur any expense; 15 (F) in accordance with accepted standards 16 and in consultation with the Secretary of Com- 17 merce, establish a code of ‘‘fair information 18 practices’’, for the secure collection, mainte- 19 nance, and dissemination of records, with which 20 a covered provider must comply; 21 (G) require a covered provider, in a man- 22 ner substantially similar, to the extent prac- 23 ticable, to the requirements applicable to agen- 24 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 9 •S 142 IS cies under section 552a(c) of title 5, United 1 States Code, to— 2 (i) keep an accounting of certain dis- 3 closures of records for a reasonable period 4 of time, as determined by the Commission; 5 and 6 (ii) make available to an individual, 7 upon request, the accounting made under 8 clause (i) of disclosures of records relating 9 to the individual, unless the period of time 10 described in that clause has expired; and 11 (H) to the extent practicable, incorporate 12 the exceptions under paragraphs (1) through 13 (12) of section 552a(b) of title 5, United States 14 Code; and 15 (2) may promulgate regulations not described 16 in paragraph (1) that are modeled on section 552a 17 of title 5, United States Code, and the regulations 18 promulgated under that section. 19 (c) APPLICATION WITH OTHER FEDERAL LAWS.— 20 (1) EXEMPTION FOR PERSONS SUBJECT TO 21 OTHER FEDERAL PRIVACY LAWS.—To the extent 22 that a person is subject to a Federal privacy law de- 23 scribed in paragraph (2) of this subsection, the regu- 24 lations promulgated under subsection (a) shall not 25 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 10 •S 142 IS apply to the person with respect to any information 1 or records governed by that Federal privacy law. 2 (2) OTHER FEDERAL PRIVACY LAWS DE- 3 SCRIBED.—The Federal privacy laws described in 4 this paragraph are as follows: 5 (A) The regulations promulgated under 6 section 264(c) of the Health Insurance Port- 7 ability and Accountability Act of 1996 (42 8 U.S.C. 1320d–2 note), as those regulations re- 9 late to— 10 (i) a person described in section 11 1172(a) of the Social Security Act (42 12 U.S.C. 1320d–1(a)); or 13 (ii) transactions referred to in section 14 1173(a)(1) of the Social Security Act (42 15 U.S.C. 1320d–2(a)(1)). 16 (B) Section 444 of the General Education 17 Provisions Act (20 U.S.C. 1232g) (commonly 18 referred to as the ‘‘Family Educational Rights 19 and Privacy Act of 1974’’). 20 (C) Section 552a of title 5, United States 21 Code. 22 (3) CONFLICTS.— 23 (A) CHILDREN’S ONLINE PRIVACY PROTEC- 24 TION ACT.—In the case of a conflict between 25 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 11 •S 142 IS the regulations promulgated under subsection 1 (a) of this section and the Children’s Online 2 Privacy Protection Act of 1998 (15 U.S.C. 3 6501 et seq.) (and any regulations promulgated 4 under that Act), the Commission shall deter- 5 mine which provision of law shall apply. 6 (B) GRAMM-LEACH-BLILEY ACT.—In the 7 case of a conflict between the regulations pro- 8 mulgated under subsection (a) of this section 9 and title V of the Gramm-Leach-Bliley Act of 10 1999 (15 U.S.C. 6801 et seq.) (and any regula- 11 tions promulgated under that Act), the Com- 12 mission shall determine which provision of law 13 shall apply. 14 SEC. 5. ENFORCEMENT. 15 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 16 A violation of a regulation promulgated under section 4(a) 17 shall be treated as a violation of a rule defining an unfair 18 or deceptive act or practice prescribed under section 19 18(a)(1)(B) of the Federal Trade Commission Act (15 20 U.S.C. 57a(a)(1)(B)). 21 (b) POWERS OF COMMISSION.— 22 (1) IN GENERAL.—Except as provided in para- 23 graph (3), if the Commission promulgates regula- 24 tions under section 4(a), the Commission shall en- 25 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 12 •S 142 IS force this Act in the same manner, by the same 1 means, and with the same jurisdiction, powers, and 2 duties as though all applicable terms and provisions 3 of the Federal Trade Commission Act (15 U.S.C. 41 4 et seq.) were incorporated into and made a part of 5 this Act. 6 (2) PRIVILEGES AND IMMUNITIES.—Except as 7 provided in paragraph (3), any person who violates 8 a regulation promulgated under section 4(a) shall be 9 subject to the penalties and entitled to the privileges 10 and immunities provided in the Federal Trade Com- 11 mission Act (15 U.S.C. 41 et seq.). 12 (3) COMMON CARRIERS.—Notwithstanding sec- 13 tion 4, 5(a)(2), or 6 of the Federal Trade Commis- 14 sion Act (15 U.S.C. 44, 45(a)(2), 46) or any juris- 15 dictional limitation of the Commission, if the Com- 16 mission promulgates regulations under section 4(a), 17 the Commission shall also enforce this Act, in the 18 same manner provided in paragraphs (1) and (2) of 19 this subsection, with respect to common carriers 20 subject to the Communications Act of 1934 (47 21 U.S.C. 151 et seq.) and Acts amendatory thereof 22 and supplementary thereto. 23 VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142 pamtmann on DSKBFK8HB2PROD with BILLS 13 •S 142 IS (4) AUTHORITY PRESERVED.—Nothing in this 1 Act shall be construed to limit the authority of the 2 Commission under any other provision of law. 3 SEC. 6. EFFECT ON STATE LAWS. 4 This Act, including any regulations promulgated 5 under section 4(a), shall supersede any provision of the 6 law of a State relating to a covered provider that is subject 7 to such a regulation, to the extent that the provision re- 8 lates to the maintenance of— 9 (1) records covered by this Act; or 10 (2) any other personally identifi [Text truncated for display. Full text available on Congress.gov.]