Privacy Bill of Rights Act

II 116TH CONGRESS 1ST SESSION S. 1214 To establish and protect individual and collective privacy rights, and for other purposes. IN THE SENATE OF THE UNITED STATES APRIL 11, 2019 Mr. MARKEY introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To establish and protect individual and collective privacy rights, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Privacy Bill of Rights Act’’. 5 (b) TABLE OF CONTENTS.—The table of contents for 6 this Act is as follows: 7 Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Act prohibited. Sec. 4. Right to notice. Sec. 5. Right to control. Sec. 6. Right to access, correction, deletion, and data portability. Sec. 7. Prohibition on re-identifying personal information. VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 1214 IS Sec. 8. Prohibition on take-it-or-leave-it. Sec. 9. Prohibition on financial incentives. Sec. 10. Prohibition on disclosing information to third parties without proper assurances. Sec. 11. Use limitations. Sec. 12. Data minimization. Sec. 13. Right to data security. Sec. 14. Privacy and security officer. Sec. 15. Federal enforcement. Sec. 16. State enforcement. Sec. 17. Private right of action. Sec. 18. Relation to other laws. Sec. 19. Effective date. SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) BREACH OF SECURITY.—The term ‘‘breach 3 of security’’ means any instance in which a person, 4 without authorization or in violation of any author- 5 ization provided to the person, gains access to, uses, 6 or discloses personal information. 7 (2) COMMISSION.—The term ‘‘Commission’’ 8 means the Federal Trade Commission. 9 (3) COVERED ENTITY.—The term ‘‘covered en- 10 tity’’ means any person that collects or otherwise ob- 11 tains personal information. 12 (4) DATA BROKER.—The term ‘‘data broker’’ 13 means a commercial entity that collects, assembles, 14 or maintains personal information concerning an in- 15 dividual who is not a customer or employee of the 16 entity, and who has not established a subscription or 17 account with the entity, in order to sell the informa- 18 tion or provide third-party access to the information. 19 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 1214 IS (5) DE-IDENTIFIED.—The term ‘‘de-identified’’, 1 with respect to information, means information that 2 cannot reasonably identify, relate to, describe, or be 3 capable of being associated with or linked to, directly 4 or indirectly, a particular individual. 5 (6) DISCLOSE.—The term ‘‘disclose’’ means to 6 disclose, release, transfer, share, disseminate, make 7 available, or otherwise communicate orally, in writ- 8 ing, electronically, or by any other means to any 9 third party. 10 (7) MINOR.—The term ‘‘minor’’ means any in- 11 dividual who is under 16 years of age. 12 (8) MOBILE APPLICATION.—The term ‘‘mobile 13 application’’ means a software program that runs on 14 the operating system of a mobile device. 15 (9) OPT-IN APPROVAL.—The term ‘‘opt-in ap- 16 proval’’ means affirmative, express consent of an in- 17 dividual for a covered entity to use, disclose, or per- 18 mit access to the individual’s personal information 19 after the individual has received explicit notification 20 of the request of the covered entity with respect to 21 that information. 22 (10) PERSONAL INFORMATION.— 23 (A) IN GENERAL.—The term ‘‘personal in- 24 formation’’ means information that directly or 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 1214 IS indirectly identifies, relates to, describes, is ca- 1 pable of being associated with, or could reason- 2 ably be linked to, a particular individual. 3 (B) EXAMPLES.—The term ‘‘personal in- 4 formation’’ includes— 5 (i) an identifier such as a real name, 6 alias, signature, date of birth, gender iden- 7 tity, sexual orientation, marital status, 8 physical characteristic or description, post- 9 al address, telephone number, unique per- 10 sonal identifier, military identification 11 number, online identifier, Internet Protocol 12 address, email address, account name, 13 mother’s maiden name, social security 14 number, driver’s license number, passport 15 number, or other similar identifier; 16 (ii) information such as employment, 17 employment history, bank account number, 18 credit card number, debit card number, in- 19 surance policy number, or any other finan- 20 cial information, medical information, men- 21 tal health information, or health insurance 22 information; 23 (iii) commercial information, including 24 a record of personal property, income, as- 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 1214 IS sets, leases, rentals, products or services 1 purchased, obtained, or considered, or 2 other purchasing or consuming history; 3 (iv) biometric information, including a 4 retina or iris scan, fingerprint, voiceprint, 5 or scan of hand or face geometry; 6 (v) internet or other electronic net- 7 work activity information, including brows- 8 ing history, search history, content, includ- 9 ing text, photographs, audio or video re- 10 cordings, or other user generated-content, 11 non-public communications, and informa- 12 tion regarding an individual’s interaction 13 with an internet website, mobile applica- 14 tion, or advertisement; 15 (vi) historical or real-time geolocation 16 data; 17 (vii) audio, electronic, visual, thermal, 18 olfactory, or similar information; 19 (viii) education records, as defined in 20 section 99.3 of title 34, Code of Federal 21 Regulations, or any successor regulation; 22 (ix) political information or informa- 23 tion on criminal convictions or arrests; 24 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 1214 IS (x) any required security code, access 1 code, password, or username necessary to 2 permit access to the account of an indi- 3 vidual; 4 (xi) characteristics of protected class- 5 es under Federal law, including race, color, 6 national origin, religion, sex, age, or dis- 7 ability; or 8 (xii) an inference drawn from any of 9 the information described in this subpara- 10 graph to create a profile about an indi- 11 vidual reflecting the individual’s pref- 12 erences, characteristics, psychological 13 trends, preferences, predispositions, behav- 14 ior, attitudes, intelligence, abilities, or apti- 15 tudes. 16 (C) EXCLUSIONS.— 17 (i) IN GENERAL.—The term ‘‘personal 18 information’’ does not include publicly 19 available information. 20 (ii) PUBLICLY AVAILABLE INFORMA- 21 TION.—For purposes of clause (i), the 22 term ‘‘publicly available information’’— 23 (I) means information that is 24 lawfully made available from Federal, 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 7 •S 1214 IS State, or local government records; 1 and 2 (II) does not include— 3 (aa) biometric information 4 collected by a covered entity 5 about an individual without the 6 individual’s knowledge; 7 (bb) information used for a 8 purpose that is not compatible 9 with the purpose for which the 10 information is maintained and 11 made available in government 12 records; or 13 (cc) information of an indi- 14 vidual that is de-identified. 15 (11) THIRD PARTY.—The term ‘‘third party’’, 16 with respect to personal information of an indi- 17 vidual, means any person that is not— 18 (A) the covered entity that is disclosing the 19 personal information; 20 (B) solely performing an outsourced func- 21 tion of the covered entity diclosing the personal 22 information if— 23 (i) the person is contractually or le- 24 gally prohibited from using, retaining, 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 8 •S 1214 IS sharing, or selling the personal information 1 after the conclusion of the outsourced 2 function; and 3 (ii) the person is complying with the 4 regulations promulgated under this Act; or 5 (C) a person with respect to which the in- 6 dividual gave specific opt-in approval for the 7 covered entity to disclose the personal informa- 8 tion of the individual to the person. 9 SEC. 3. ACT PROHIBITED. 10 (a) IN GENERAL.—It shall be unlawful for a covered 11 entity to violate the privacy of an individual in a manner 12 that violates a regulation promulgated under this Act. 13 (b) REGULATIONS.—In carrying out this Act, the 14 Commission shall— 15 (1) not later than 1 year after the date of en- 16 actment of this Act, promulgate regulations under 17 section 553 of title 5, United States Code, to protect 18 the individual and collective privacy rights set forth 19 in this Act; 20 (2) ensure the regulations promulgated under 21 paragraph (1) take effect not later than 90 days 22 after the date on which the regulations are promul- 23 gated; 24 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 9 •S 1214 IS (3) establish a centralized internet website for 1 the benefit of individuals that provides information 2 to individuals about their rights under this Act in a 3 clear, concise, well-organized, understandably writ- 4 ten, and complete manner; and 5 (4) establish a centralized internet website for 6 the benefit of individuals that lists each data broker 7 in the United States. 8 SEC. 4. RIGHT TO NOTICE. 9 (a) IN GENERAL.—In promulgating regulations 10 under section 3, the Commission shall require a covered 11 entity to— 12 (1) develop and make available to customers a 13 short-form notice about the collection, retention, use, 14 and sharing of the personal information of individ- 15 uals by the covered entity that includes— 16 (A) what personal information is being col- 17 lected, used, or retained; 18 (B) the manner in which the personal in- 19 formation is collected; 20 (C) how and for what purpose the covered 21 entity is collecting, using, retaining, sharing, or 22 selling the personal information; 23 (D) how long the personal information will 24 be held; 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 10 •S 1214 IS (E) which third parties the covered entity 1 shares personal information with or leases or 2 sells personal information to, not including— 3 (i) a governmental entity with which 4 the covered entity shares personal informa- 5 tion pursuant to a court order or law that 6 prohibits the covered entity from revealing 7 that instance of sharing to the individual 8 to whom the personal information pertains; 9 (ii) a third party if the personal infor- 10 mation is— 11 (I) made available to and readily 12 accessible by the general public with 13 the consent of the individual to whom 14 the personal information pertains; and 15 (II) shared with, or leased or sold 16 to, the third party through a mecha- 17 nism available to any member of the 18 general public; or 19 (iii) a third party with which the cov- 20 ered entity shares, or to which the covered 21 entity leases or sells, personal information 22 of an individual that the covered entity did 23 not obtain from the individual, if revealing 24 that instance of sharing, leasing, or selling 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 11 •S 1214 IS personal information would expose another 1 individual to likely harm; 2 (F) in the case of the sharing, leasing, or 3 selling of personal information described in sub- 4 paragraph (E) that is not excluded under clause 5 (i), (ii), or (iii) of that subparagraph, what per- 6 sonal information is shared with or leased or 7 sold to third parties and for what purpose; 8 (G) how an individual can access, correct, 9 and delete the personal information of the indi- 10 vidual that the covered entity retains as re- 11 quired under section 6; 12 (H) the practices of the covered entity for 13 collecting personal information of an individual, 14 including offline practices, when the individual 15 is not directly interacting with the covered enti- 16 ty; 17 (I) the practices of the covered entity for 18 using personal information in automated deci- 19 sionmaking; and 20 (J) the right of an individual to provide 21 opt-in approval and revoke approval consistent 22 with section 5; 23 (2) ensure that the short-form notice developed 24 under paragraph (1)— 25 VerDate Sep 11 2014 21:02 Apr 24, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 12 •S 1214 IS (A) is clear, concise, well-organized, under- 1 standably written, and complete; 2 (B) does not contain unrelated, confusing, 3 or contradictory materials; and 4 (C) is in a format that is— 5 (i) prominent and easily accessible; 6 (ii) of reasonable length; and 7 (iii) clearly distinguishable from other 8 matters; 9 (3) not later than 15 days after making a mate- 10 rial change to the privacy practices or policies of the 11 covered entity, update the short-form notice devel- 12 oped under paragraph (1); 13 (4) make the short-form notice required under 14 paragraph (1) persistently and conspicuously avail- 15 able— 16 (A) on the website or mobile application of 17 the covered entity, if the covered entity main- 18 tains a website or mobile application; and 19 (B) at the physical place of business or 20 any other offline equivalent maintained by the 21 covered entity; and 22 (5) ensure that the short-form notice required 23 under paragraph (1) is made available to an indi- 24 vidual— 25 VerDate Sep 11 2014 18:24 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S1214.IS S1214 pamtmann on DSKBFK8HB2PROD with BILLS 13 •S 1214 IS (A)(i) at the point of sale of a product or 1 service of, subscription to a service of, or estab- 2 lishment of an account with, the covered entit [Text truncated for display. Full text available on Congress.gov.]