DATA Privacy Act

II 116TH CONGRESS 1ST SESSION S. 583 To provide for digital accountability and transparency. IN THE SENATE OF THE UNITED STATES FEBRUARY 27, 2019 Ms. CORTEZ MASTO introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To provide for digital accountability and transparency. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Digital Accountability 4 and Transparency to Advance Privacy Act’’ or the ‘‘DATA 5 Privacy Act’’. 6 SEC. 2. DEFINITIONS. 7 (a) IN GENERAL.—In this Act: 8 (1) COLLECT.—The term ‘‘collect’’ means tak- 9 ing any operation or set of operations to obtain cov- 10 ered data, including by automated means, including 11 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 2 •S 583 IS purchasing, leasing, assembling, recording, gath- 1 ering, acquiring, or procuring. 2 (2) COMMISSION.—The term ‘‘Commission’’ 3 means the Federal Trade Commission. 4 (3) COVERED DATA.—The term ‘‘covered 5 data’’— 6 (A) means any information that is— 7 (i) collected, processed, stored, or dis- 8 closed by a covered entity; 9 (ii) collected over the internet or other 10 digital network; and 11 (iii)(I) linked to an individual or de- 12 vice associated with an individual; or 13 (II) practicably linkable to an indi- 14 vidual or device associated with an indi- 15 vidual, including by combination with sepa- 16 rate information, by the covered entity or 17 any potential recipient of the data; and 18 (B) does not include data that is— 19 (i) collected, processed, stored, or dis- 20 closed solely for the purpose of employ- 21 ment of an individual; and 22 (ii) lawfully made available to the 23 public from Federal, State, or local govern- 24 ment records. 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 3 •S 583 IS (4) COVERED ENTITY.—The term ‘‘covered en- 1 tity’’— 2 (A) means any entity that collects, proc- 3 esses, stores, or discloses covered data; and 4 (B) does not include any entity that col- 5 lects, processes, stores, or discloses covered data 6 relating to fewer than 3,000 individuals and de- 7 vices during any 12-month period. 8 (5) DISCLOSE.—The term ‘‘disclose’’ means 9 taking any action with respect to covered data, in- 10 cluding by automated means, to sell, share, provide, 11 or otherwise transfer covered data to another entity, 12 person, or the general public. 13 (6) PRIVACY RISK.—The term ‘‘privacy risk’’ 14 means potential harm to an individual resulting 15 from the collection, processing, storage, or disclosure 16 of covered data, including— 17 (A) direct or indirect financial loss; 18 (B) stigmatization or reputational harm; 19 (C) anxiety, embarrassment, fear, and 20 other severe emotional trauma; 21 (D) loss of economic opportunity; or 22 (E) physical harm. 23 (7) PROCESS.—The term ‘‘process’’ means any 24 operation or set of operations that is performed on 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 4 •S 583 IS covered data or on sets of covered data, including by 1 automated means, including organizing, combining, 2 adapting, altering, using, or transforming. 3 (8) PROTECTED CHARACTERISTIC.—The term 4 ‘‘protected characteristic’’ means an individual’s 5 race, sex, gender, sexual orientation, nationality, re- 6 ligious belief, or political affiliation. 7 (9) PSEUDONYMOUS DATA.—The term ‘‘pseu- 8 donymous data’’ means covered data that may only 9 be linked to the identity of an individual or the iden- 10 tity of a device associated with an individual if com- 11 bined with separate information. 12 (10) REASONABLE INTEREST.—The term ‘‘rea- 13 sonable interest’’ means— 14 (A) a compelling business, operational, ad- 15 ministrative, legal, or educational justification 16 for the collection, processing, storage, or disclo- 17 sure of covered data exists; 18 (B) the use of covered data is within the 19 context of the relationship between the covered 20 entity and the individual linked to the covered 21 data; and 22 (C) the interest does not subject the indi- 23 vidual to an unreasonable privacy risk. 24 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 5 •S 583 IS (11) SENSITIVE DATA.—The term ‘‘sensitive 1 data’’ means any covered data relating to— 2 (A) the health, biologic, physiologic, bio- 3 metric, sexual life, or genetic information of an 4 individual; or 5 (B) the precise geolocation information of 6 a device associated with an individual. 7 (12) STORE.—The term ‘‘store’’ means any op- 8 eration or set of operations to continue possession of 9 covered data, including by automated means. 10 (13) THIRD PARTY SERVICE PROVIDER.—The 11 term ‘‘third party service provider’’ means any cov- 12 ered entity that collects, processes, stores, or dis- 13 closes covered data at the direction of, and for the 14 sole benefit of, another covered entity under a con- 15 tract. 16 (b) MODIFIED DEFINITION BY RULEMAKING.—If the 17 Commission determines that a term defined in paragraph 18 (9) or (11) is not sufficient to protect an individual’s data 19 privacy, the Commission may promulgated regulations 20 under section 553 of title 5, United States Code, to modify 21 the definition as the Commission considers appropriate. 22 SEC. 3. REQUIRED PRIVACY NOTICE. 23 (a) PRIVACY NOTICE.—Each covered entity shall post 24 in an accessible location a notice that is concise, in con- 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 6 •S 583 IS text, in easily understandable language, accurate, clear, 1 timely, updated, uses visualizations where appropriate, 2 conspicuous, and free of charge regarding the covered en- 3 tity’s privacy practices. 4 (b) CONTENTS OF NOTICE.—The notice required by 5 subsection (a) shall include— 6 (1) a description of the covered data that the 7 entity collects, processes, stores, and discloses, in- 8 cluding the sources that provided the covered data if 9 the covered entity did not collect the covered data; 10 (2) the purposes for and means by which the 11 entity collects, processes, and stores the covered 12 data; 13 (3) the persons and entities to whom, and pur- 14 poses for which, the covered entity discloses the cov- 15 ered data; and 16 (4) a conspicuous, clear, and understandable 17 means for individuals to access the methods nec- 18 essary to exercise their rights under sections 4 and 19 5. 20 SEC. 4. REQUIRED DATA PRACTICES. 21 (a) REGULATIONS.—Not later than 1 year after the 22 date of the enactment of this Act, the Commission shall 23 promulgate regulations under section 553 of title 5, 24 United States Code, that require covered entities to imple- 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 7 •S 583 IS ment, practice, and maintain certain data procedures and 1 processes that meet the following requirements: 2 (1) MINIMUM DATA PROCESSING REQUIRE- 3 MENTS.—Except as provided in subsection (b), re- 4 quire covered entities to meet all of the following re- 5 quirements regarding the means by and purposes for 6 which covered data is collected, processed, stored, 7 and disclosed: 8 (A) REASONABLE.—Except as provided in 9 paragraph (3), covered data collection, proc- 10 essing, storage, and disclosure practices must 11 meet a reasonable interest of the covered entity, 12 including— 13 (i) business, educational, and adminis- 14 trative operations that are relevant and ap- 15 propriate to the context of the relationship 16 between the covered entity and the indi- 17 vidual linked to the covered data; 18 (ii) relevant and appropriate product 19 and service development and enhancement; 20 (iii) preventing and detecting abuse, 21 fraud, and other criminal activity; 22 (iv) reasonable communications and 23 marketing practices that follow best prac- 24 tices, rules, and ethical standards; 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 8 •S 583 IS (v) engaging in scientific, medical, or 1 statistical research that follows commonly 2 accepted ethical standards; or 3 (vi) any other purpose for which the 4 Commission considers to be reasonable. 5 (B) EQUITABLE.—Covered data collection, 6 processing, storage, and disclosure practices 7 may not be for purposes that result in discrimi- 8 nation against a protected characteristic, in- 9 cluding— 10 (i) discriminatory targeted advertising 11 practices; 12 (ii) price, service, or employment op- 13 portunity discrimination; or 14 (iii) any other practice the Commis- 15 sion considers likely to result in unfair dis- 16 crimination against a protected char- 17 acteristic. 18 (C) FORTHRIGHT.—Covered data collec- 19 tion, processing, storage, and disclosure prac- 20 tices may not be accomplished with means or 21 for purposes that are deceptive, including— 22 (i) the use of inconspicuous recording 23 or tracking devices and methods; 24 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 9 •S 583 IS (ii) the disclosure of covered data that 1 a reasonable individual believes to be the 2 content of a private communication with 3 another party or parties; 4 (iii) notices, interfaces, or other rep- 5 resentations likely to mislead consumers; 6 or 7 (iv) any other practice that the Com- 8 mission considers likely to mislead individ- 9 uals regarding the purposes for and means 10 by which covered data is collected, proc- 11 essed, stored, or disclosed. 12 (2) REQUIREMENTS FOR OPT-OUT CONSENT.— 13 Except as provided in subsection (b), require covered 14 entities to provide individuals with conspicuous ac- 15 cess to a method that is in easily understandable 16 language, concise, accurate, clear, to opt out of any 17 collection, processing, storage, or disclosure of cov- 18 ered data linked to the individual. 19 (3) REQUIREMENTS FOR AFFIRMATIVE CON- 20 SENT.—Except as provided in subsection (b), require 21 covered entities to provide individuals with a notice 22 that is concise, in easily understandable language, 23 accurate, clear, timely, and conspicuous to express 24 affirmative, opt-in consent— 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 10 •S 583 IS (A) before the covered entity collects or 1 discloses sensitive data linked to the individual; 2 or 3 (B) before the covered entity collects, proc- 4 esses, stores, or discloses data for purposes 5 which are outside the context of the relationship 6 of the covered entity with the individual linked 7 to the data, including— 8 (i) the use of covered data beyond 9 what is necessary to provide, improve, or 10 market a good or service that the indi- 11 vidual requests; 12 (ii) the processing or disclosure of 13 covered data differs in material ways from 14 the purposes described in the privacy pol- 15 icy that was in effect when the data was 16 collected; and 17 (iii) any other purpose that Commis- 18 sion considers outside of context. 19 (4) DATA MINIMIZATION REQUIREMENTS.—Ex- 20 cept as provided in subsection (b), require covered 21 entities to— 22 (A) take reasonable measures to limit the 23 collection, processing, storage, and disclosure of 24 covered data to the amount that is necessary to 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 11 •S 583 IS carry out the purposes for which the data is col- 1 lected; and 2 (B) store covered data only as long as is 3 reasonably necessary to carry out the purposes 4 for which the data was collected. 5 (b) EXEMPTIONS.—Subsection (a) shall not apply if 6 the limitations on the collection, processing, storage, or 7 disclosure of covered data would— 8 (1) inhibit detection or prevention of a security 9 risk or incident; 10 (2) risk the health, safety, or property of the 11 covered entity or individual; or 12 (3) prevent compliance with an applicable law 13 (including regulations) or legal process. 14 SEC. 5. INDIVIDUAL CONTROL OVER DATA USE. 15 (a) REGULATIONS.—Not later than 1 year after the 16 date of the enactment of this Act, the Commission shall 17 promulgate regulations under section 553 of title 5, 18 United States Code, to require covered entities to provide 19 conspicuous, understandable, clear, and free of charge 20 method to— 21 (1) upon the request of an individual, provide 22 the individual with access to, or an accurate rep- 23 resentation of, covered data linked to with the indi- 24 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 12 •S 583 IS vidual or the individual’s device stored by the cov- 1 ered entity; 2 (2) upon the request of an individual, provide 3 the individual with a means to dispute and resolve 4 the accuracy or completeness of the covered data 5 linked to the individual or the individual’s device 6 stored by the entity; 7 (3) upon the request of an individual, delete 8 any covered data that the covered entity stores 9 linked to the individual or the individual’s device; 10 and 11 (4) when technically feasible, upon the request 12 of an individual, allow the individual to transmit or 13 transfer covered data linked to the individual or the 14 individual’s device that is maintained by the entity 15 to the individual in a format that is standardized 16 and interoperable. 17 (b) PSEUDONYMOUS DATA.—If the covered data that 18 an individual has requested processed under subsection (a) 19 is pseudonymous data, a covered entity may decline the 20 request if processing the request is not technically feasible. 21 (c) TIMELINESS OF REQUESTS.—In fulfilling any re- 22 quests made by the individual under subsection (a) the 23 covered entity shall act in as timely a manner as is reason- 24 ably possible. 25 VerDate Sep 11 2014 22:13 Mar 12, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S583.IS S583 pbinns on DSK79D2C42PROD with BILLS 13 •S 583 IS (d) A [Text truncated for display. Full text available on Congress.gov.]