What This Bill Does
The Data Care Act establishes rules that online service providers must follow when collecting and using information about their users. These rules require providers to protect user data from theft, be honest about how they use that data, and share data responsibly with other companies.
Who It Affects
- Online service providers (companies that collect information about users on the internet)
- People who use online services
- Companies that receive user data from online service providers
- The Federal Trade Commission
- State attorneys general
- Nonprofit organizations that operate online services
- Common carriers that provide online services
Key Provisions
- Online service providers must protect user information from unauthorized access and quickly tell users if sensitive information is stolen (Sec. 3(b)(1))
- Online service providers cannot use user information in ways that help the company but hurt the user, especially if the use would cause serious harm or be offensive to a reasonable person (Sec. 3(b)(2))
- Online service providers cannot sell or share user information unless the other company agrees to follow the same data protection rules (Sec. 3(b)(3))
- The Federal Trade Commission can create exceptions for certain types of online providers if the privacy risks are small enough (Sec. 3(e))
- The Federal Trade Commission can expand breach notification rules to cover more types of user information beyond sensitive data (Sec. 3(d))
What Changes
If this becomes law, online service providers must adopt three new duties when handling user information: a duty of care to protect data, a duty of loyalty to not use data against users, and a duty of confidentiality to control who receives that data. Violations can be treated as deceptive business practices. State attorneys general gain the power to sue companies that violate these duties on behalf of their residents and collect money damages.
Important Definitions
- End user: A person who uses an online service or logs into it over the internet
- Individual identifying data: Any information collected online that can be connected to a specific person or their device
- Online service provider: A company that does business on the internet and collects information about users
- Sensitive data: High-risk information including social security numbers, financial account numbers, biometric data like fingerprints, health information, and nonpublic personal messages
Effective Date
The law takes effect on the date it is signed. The specific data protection rules in Section 3 apply 180 days after the law is signed.
II
118TH CONGRESS
1ST SESSION
S. 744
To establish duties for online service providers with respect to end user
data that such providers collect and use.
IN THE SENATE OF THE UNITED STATES
MARCH 9, 2023
Mr. SCHATZ (for himself, Ms. CORTEZ MASTO, Mr. MERKLEY, Ms. WARREN,
Mr. BENNET, Mr. MURPHY, Ms. HIRONO, Ms. KLOBUCHAR, Ms. BALD-
WIN, Mr. KING, Ms. HASSAN, Mr. SANDERS, Mr. MARKEY, Mr. BOOKER,
Ms. DUCKWORTH, Ms. SMITH, Mr. LUJA´N, Mr. HEINRICH, and Mr. DUR-
BIN) introduced the following bill; which was read twice and referred to
the Committee on Commerce, Science, and Transportation
A BILL
To establish duties for online service providers with respect
to end user data that such providers collect and use.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Data Care Act of
4
2023’’.
5
SEC. 2. DEFINITIONS.
6
In this Act:
7
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
2
•S 744 IS
(1) COMMISSION.—The term ‘‘Commission’’
1
means the Federal Trade Commission.
2
(2) END USER.—The term ‘‘end user’’ means
3
an individual who engages with an online service
4
provider or logs into or uses services provided by the
5
online service provider over the internet or any other
6
digital network.
7
(3) INDIVIDUAL IDENTIFYING DATA.—The term
8
‘‘individual identifying data’’ means any data that
9
is—
10
(A) collected over the internet or any other
11
digital network; and
12
(B) linked, or reasonably linkable, to—
13
(i) a specific end user; or
14
(ii) a computing device that is associ-
15
ated with or routinely used by an end user.
16
(4) ONLINE
SERVICE
PROVIDER.—The term
17
‘‘online service provider’’ means an entity that—
18
(A) is engaged in interstate commerce over
19
the internet or any other digital network; and
20
(B) in the course of business, collects indi-
21
vidual identifying data about end users, includ-
22
ing in a manner that is incidental to the busi-
23
ness conducted.
24
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
3
•S 744 IS
(5) SENSITIVE
DATA.—The term ‘‘sensitive
1
data’’ means any data that includes—
2
(A) a social security number;
3
(B) personal information (as defined in
4
section 1302 of the Children’s Online Privacy
5
Protection Act of 1998 (15 U.S.C. 6501)) col-
6
lected from a child (as defined in such section
7
1302);
8
(C) a driver’s license number, passport
9
number, military identification number, or any
10
other similar number issued on a government
11
document used to verify identity;
12
(D) a financial account number, credit or
13
debit card number, or any required security
14
code, access code, or password that is necessary
15
to permit access to a financial account of an in-
16
dividual;
17
(E) unique biometric data such as a finger
18
print, voice print, a retina or iris image, or any
19
other unique physical representation;
20
(F) information sufficient to access an ac-
21
count of an individual, such as user name and
22
password or email address and password;
23
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
4
•S 744 IS
(G) the first and last name of an indi-
1
vidual, or first initial and last name, or other
2
unique identifier in combination with—
3
(i) the month, day, and year of birth
4
of the individual;
5
(ii) the maiden name of the mother of
6
the individual; or
7
(iii) the past or present precise
8
geolocation of the individual;
9
(H) information that relates to—
10
(i) the past, present, or future phys-
11
ical or mental health or condition of an in-
12
dividual; or
13
(ii) the provision of health care to an
14
individual; and
15
(I) the nonpublic communications or other
16
nonpublic user-created content of an individual.
17
SEC. 3. PROVIDER DUTIES.
18
(a) IN GENERAL.—An online service provider shall
19
fulfill the duties of care, loyalty, and confidentiality under
20
paragraphs (1), (2), and (3), respectively, of subsection
21
(b).
22
(b) DUTIES.—
23
(1) DUTY OF CARE.—An online service provider
24
shall—
25
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
5
•S 744 IS
(A) reasonably secure individual identifying
1
data from unauthorized access; and
2
(B) subject to subsection (d), promptly in-
3
form an end user of any breach of the duty de-
4
scribed in subparagraph (A) of this paragraph
5
with respect to sensitive data of that end user.
6
(2) DUTY OF LOYALTY.—An online service pro-
7
vider may not use individual identifying data, or
8
data derived from individual identifying data, in any
9
way that—
10
(A) will benefit the online service provider
11
to the detriment of an end user; and
12
(B)(i) will result in reasonably foreseeable
13
and material physical or financial harm to an
14
end user; or
15
(ii) would be unexpected and highly offen-
16
sive to a reasonable end user.
17
(3) DUTY
OF
CONFIDENTIALITY.—An online
18
service provider—
19
(A) may not disclose or sell individual
20
identifying data to, or share individual identi-
21
fying data with, any other person except as con-
22
sistent with the duties of care and loyalty under
23
paragraphs (1) and (2), respectively;
24
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
6
•S 744 IS
(B) may not disclose or sell individual
1
identifying data to, or share individual identi-
2
fying data with, any other person unless that
3
person enters into a contract with the online
4
service provider that imposes on the person the
5
same duties of care, loyalty, and confidentiality
6
toward the applicable end user as are imposed
7
on the online service provider under this sub-
8
section; and
9
(C) shall take reasonable steps to ensure
10
that the practices of any person to whom the
11
online service provider discloses or sells, or with
12
whom the online service provider shares, indi-
13
vidual identifying data fulfill the duties of care,
14
loyalty, and confidentiality assumed by the per-
15
son under the contract described in subpara-
16
graph (B), including by auditing, on a regular
17
basis, the data security and data information
18
practices of any such person.
19
(c) APPLICATION OF DUTIES TO THIRD PARTIES.—
20
If an online service provider transfers or otherwise pro-
21
vides access to individual identifying data to another per-
22
son, the requirements of paragraphs (1), (2), and (3) of
23
subsection (b) shall apply to such person with respect to
24
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
7
•S 744 IS
such data in the same manner that such requirements
1
apply to the online service provider.
2
(d) EXPANSION OF DUTY TO INFORM REGARDING
3
BREACHES.—The Commission may promulgate regula-
4
tions under section 553 of title 5, United States Code,
5
to apply the breach notification requirement under sub-
6
section (b)(1)(B) with respect to specific categories of in-
7
dividual identifying data other than sensitive data, as the
8
Commission determines necessary.
9
(e) EXCEPTIONS.—
10
(1) REGULATIONS.—The Commission may pro-
11
mulgate regulations under section 553 of title 5,
12
United States Code, to exempt categories of online
13
service providers or persons described in subsection
14
(c) from the requirement under subsection (a) or
15
subsection (c) (as applicable).
16
(2) CONSIDERATIONS.—In promulgating regu-
17
lations under paragraph (1), the Commission shall
18
consider, among other factors—
19
(A) the privacy risks posed by the use of
20
individual identifying data by an online service
21
provider or person described in subsection (c)
22
based on—
23
(i) the size of the provider or person;
24
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
8
•S 744 IS
(ii) the complexity of the offerings of
1
the provider;
2
(iii) the nature and scope of the ac-
3
tivities of the provider or person; and
4
(iv) the sensitivity of the consumer in-
5
formation handled by the provider or per-
6
son; and
7
(B) the costs and benefits of applying the
8
requirement under subsection (a) or subsection
9
(c) (as applicable) to online service providers or
10
persons with particular combinations of charac-
11
teristics considered under subparagraph (A) of
12
this paragraph.
13
SEC. 4. ENFORCEMENT.
14
(a) ENFORCEMENT BY COMMISSION.—
15
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
16
TICES.—A violation of section 3 by an online service
17
provider or a person described in section 3(c) shall
18
be treated as a violation of a rule defining an unfair
19
or deceptive act or practice prescribed under section
20
18(a)(1)(B) of the Federal Trade Commission Act
21
(15 U.S.C. 57a(a)(1)(B)).
22
(2) POWERS OF COMMISSION.—
23
(A) IN GENERAL.—Except as provided in
24
subparagraph (C), the Commission shall enforce
25
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
9
•S 744 IS
this Act in the same manner, by the same
1
means, and with the same jurisdiction, powers,
2
and duties as though all applicable terms and
3
provisions of the Federal Trade Commission
4
Act (15 U.S.C. 41 et seq.) were incorporated
5
into and made a part of this Act.
6
(B) PRIVILEGES
AND
IMMUNITIES.—Ex-
7
cept as provided in subparagraph (C), any per-
8
son who violates section 3 shall be subject to
9
the penalties and entitled to the privileges and
10
immunities provided in the Federal Trade Com-
11
mission Act (15 U.S.C. 41 et seq.).
12
(C) NONPROFIT ORGANIZATIONS AND COM-
13
MON CARRIERS.—Notwithstanding section 4 or
14
5(a)(2) of the Federal Trade Commission Act
15
(15 U.S.C. 44, 45(a)(2)) or any jurisdictional
16
limitation of the Commission, the Commission
17
shall also enforce this Act, in the same manner
18
provided in subparagraphs (A) and (B) of this
19
paragraph, with respect to—
20
(i) organizations not organized to
21
carry on business for their own profit or
22
that of their members; and
23
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
10
•S 744 IS
(ii) common carriers subject to the
1
Communications Act of 1934 (47 U.S.C.
2
151 et seq.).
3
(3) RULEMAKING
AUTHORITY.—The Commis-
4
sion shall promulgate regulations under this Act in
5
accordance with section 553 of title 5, United States
6
Code.
7
(b) ENFORCEMENT BY STATES.—
8
(1) AUTHORIZATION.—Subject to paragraph
9
(3), in any case in which the attorney general of a
10
State has reason to believe that an interest of the
11
residents of the State has been or is threatened or
12
adversely affected by the engagement of an online
13
service provider or a person described in section 3(c)
14
in a practice that violates section 3, the attorney
15
general of the State may, as parens patriae, bring
16
a civil action against the online service provider or
17
person on behalf of the residents of the State in an
18
appropriate district court of the United States to ob-
19
tain appropriate relief, including civil penalties in
20
the amount determined under paragraph (2).
21
(2) CIVIL PENALTIES.—An online service pro-
22
vider or person described in section 3(c) that is
23
found, in an action brought under paragraph (1), to
24
have knowingly or repeatedly violated section 3 shall,
25
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
11
•S 744 IS
in addition to any other penalty otherwise applicable
1
to a violation of section 3, be liable for a civil pen-
2
alty equal to the amount calculated by multiplying—
3
(A) the greater of—
4
(i) the number of days during which
5
the online service provider or person was
6
not in compliance with that section; or
7
(ii) the number of end users who were
8
harmed as a result of the violation, by
9
(B) an amount not to exceed the maximum
10
civil penalty for which a person, partnership, or
11
corporation
may
be
liable
under
section
12
5(m)(1)(A) of the Federal Trade Commission
13
Act (15 U.S.C. 45(m)(1)(A)) (including any ad-
14
justments for inflation).
15
(3) RIGHTS
OF
FEDERAL
TRADE
COMMIS-
16
SION.—
17
(A) NOTICE TO FEDERAL TRADE COMMIS-
18
SION.—
19
(i) IN GENERAL.—Except as provided
20
in clause (iii), the attorney general of a
21
State shall notify the Commission in writ-
22
ing that the attorney general intends to
23
bring a civil action under paragraph (1)
24
before initiating the civil action.
25
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
12
•S 744 IS
(ii) CONTENTS.—The notification re-
1
quired under clause (i) with respect to a
2
civil action shall include a copy of the com-
3
plaint to be filed to initiate the civil action.
4
(iii) EXCEPTION.—If it is not feasible
5
for the attorney general of a State to pro-
6
vide the notification required under clause
7
(i) before initiating a civil action under
8
paragraph (1), the attorney general shall
9
notify the Commission immediately upon
10
instituting the civil action.
11
(B) INTERVENTION
BY
FEDERAL
TRADE
12
COMMISSION.—The Commission may—
13
(i) intervene in any civil action
14
brought by the attorney general of a State
15
under paragraph (1); and
16
(ii) upon intervening—
17
(I) be heard on all matters aris-
18
ing in the civil action; and
19
(II) file petitions for appeal of a
20
decision in the civil action.
21
(4) INVESTIGATORY POWERS.—Nothing in this
22
subsection may be construed to prevent the attorney
23
general of a State from exercising the powers con-
24
VerDate Sep 11 2014
01:11 Mar 18, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\S744.IS
S744
kjohnson on DSK79L0C42PROD with BILLS
13
•S 744 IS
ferred on the attorney general by the laws of the
1
State to—
2
(A) conduct investigations;
3
(B) administer oaths or affirmations; or
4
(C) compel the attendance of witnesses or
5
the production of documentary or other evi-
6
dence.
7
(5) PREEMPTIVE ACTION BY FEDERAL TRADE
8
COMMISSION.—If the Commission institutes a civil
9
action or an administrative action with respect to
[Text truncated for display. Full text available on Congress.gov.]