Protecting Personal Information Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2186 To require entities to provide consumers with the opportunity to prohibit the entity from collecting or using certain data concerning the consumer and to request deletion of such data. IN THE SENATE OF THE UNITED STATES JULY 18, 2019 Mr. MERKLEY introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To require entities to provide consumers with the opportunity to prohibit the entity from collecting or using certain data concerning the consumer and to request deletion of such data. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Protecting Personal 4 Information Act of 2019’’. 5 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 2 •S 2186 IS SEC. 2. REQUIREMENTS FOR ENTITIES WITH RESPECT TO 1 THE COLLECTION OR USE OF CERTAIN DATA 2 CONCERNING THE CONSUMER. 3 (a) OPPORTUNITY TO PROHIBIT THE ENTITY FROM 4 COLLECTING OR USING CERTAIN DATA.—A covered enti- 5 ty shall, prior to collecting covered data concerning an in- 6 dividual, provide the individual with an opportunity to pro- 7 hibit the covered entity from collecting such data or selling 8 or otherwise transferring such data to a third party. 9 (b) DELETION UPON REQUEST.—Upon a request 10 from an individual for whom a covered entity has collected 11 covered data, the covered entity shall, without undue 12 delay, delete such covered data. 13 SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMIS- 14 SION. 15 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 16 A violation of section 2 shall be treated as a violation of 17 a rule defining an unfair or a deceptive act or practice 18 under section 18(a)(1)(B) of the Federal Trade Commis- 19 sion Act (15 U.S.C. 57a(a)(1)(B)). 20 (b) POWERS OF COMMISSION.— 21 (1) IN GENERAL.—The Commission shall en- 22 force this Act in the same manner, by the same 23 means, and with the same jurisdiction, powers, and 24 duties as though all applicable terms and provisions 25 of the Federal Trade Commission Act (15 U.S.C. 41 26 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 3 •S 2186 IS et seq.) were incorporated into and made a part of 1 this Act. 2 (2) PRIVILEGES AND IMMUNITIES.—Any cov- 3 ered entity that violates section 2 shall be subject to 4 the penalties and entitled to the privileges and im- 5 munities provided in the Federal Trade Commission 6 Act (15 U.S.C. 41 et seq.). 7 (3) AUTHORITY PRESERVED.—Nothing in this 8 Act shall be construed to limit the authority of the 9 Federal Trade Commission under any other provi- 10 sion of law. 11 SEC. 4. ENFORCEMENT BY STATES. 12 (a) IN GENERAL.—In any case in which the attorney 13 general of a State has reason to believe that an interest 14 of the residents of the State has been or is threatened 15 or adversely affected by the engagement of any covered 16 entity subject to section 2 in a practice that violates such 17 section, the attorney general of the State may, as parens 18 patriae, bring a civil action on behalf of the residents of 19 the State in an appropriate district court of the United 20 States— 21 (1) to enjoin further violation of such section by 22 such person; 23 (2) to compel compliance with such section; and 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 4 •S 2186 IS (3) to obtain damages, restitution, or other 1 compensation on behalf of such residents. 2 (b) RIGHTS OF FEDERAL TRADE COMMISSION.— 3 (1) NOTICE TO FEDERAL TRADE COMMIS- 4 SION.— 5 (A) IN GENERAL.—Except as provided in 6 subparagraph (C), the attorney general of a 7 State shall notify the Commission in writing 8 that the attorney general intends to bring a 9 civil action under subsection (a) not later than 10 10 days before initiating the civil action. 11 (B) CONTENTS.—The notification required 12 by subparagraph (A) with respect to a civil ac- 13 tion shall include a copy of the complaint to be 14 filed to initiate the civil action. 15 (C) EXCEPTION.—If it is not feasible for 16 the attorney general of a State to provide the 17 notification required by subparagraph (A) be- 18 fore initiating a civil action under subsection 19 (a), the attorney general shall notify the Com- 20 mission immediately upon instituting the civil 21 action. 22 (2) INTERVENTION BY FEDERAL TRADE COM- 23 MISSION.—The Commission may— 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 5 •S 2186 IS (A) intervene in any civil action brought by 1 the attorney general of a State under sub- 2 section (a); and 3 (B) upon intervening— 4 (i) be heard on all matters arising in 5 the civil action; and 6 (ii) file petitions for appeal of a deci- 7 sion in the civil action. 8 (c) INVESTIGATORY POWERS.—Nothing in this sec- 9 tion may be construed to prevent the attorney general of 10 a State from exercising the powers conferred on the attor- 11 ney general by the laws of the State to conduct investiga- 12 tions, to administer oaths or affirmations, or to compel 13 the attendance of witnesses or the production of documen- 14 tary or other evidence. 15 (d) PREEMPTIVE ACTION BY FEDERAL TRADE COM- 16 MISSION.—If the Commission institutes a civil action or 17 an administrative action with respect to a violation of sec- 18 tion (2), the attorney general of a State may not, during 19 the pendency of such action, bring a civil action under sub- 20 section (a) against any defendant named in the complaint 21 of the Commission for the violation with respect to which 22 the Commission instituted such action. 23 (e) VENUE; SERVICE OF PROCESS.— 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 6 •S 2186 IS (1) VENUE.—Any action brought under sub- 1 section (a) may be brought in— 2 (A) the district court of the United States 3 that meets applicable requirements relating to 4 venue under section 1391 of title 28, United 5 States Code; or 6 (B) another court of competent jurisdic- 7 tion. 8 (2) SERVICE OF PROCESS.—In an action 9 brought under subsection (a), process may be served 10 in any district in which the defendant— 11 (A) is an inhabitant; or 12 (B) may be found. 13 (f) ACTIONS BY OTHER STATE OFFICIALS.— 14 (1) IN GENERAL.—In addition to civil actions 15 brought by attorneys general under subsection (a), 16 any other consumer protection officer of a State who 17 is authorized by the State to do so may bring a civil 18 action under subsection (a), subject to the same re- 19 quirements and limitations that apply under this 20 section to civil actions brought by attorneys general. 21 (2) SAVINGS PROVISION.—Nothing in this sec- 22 tion may be construed to prohibit an authorized offi- 23 cial of a State from initiating or continuing any pro- 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 7 •S 2186 IS ceeding in a court of the State for a violation of any 1 civil or criminal law of the State. 2 SEC. 5. DEFINITIONS. 3 In this Act: 4 (1) COMMISSION.—The term ‘‘Commission’’ 5 means the Federal Trade Commission. 6 (2) COVERED DATA.— 7 (A) IN GENERAL.—Except as provided in 8 subparagraph (B), the term ‘‘covered data’’ 9 means only the following: 10 (i) Personally identifiable information. 11 (ii) Unique identifier information. 12 (iii) Any information that is collected, 13 used, or stored in connection with person- 14 ally identifiable information or unique 15 identifier information in a manner that 16 may reasonably be used by the party col- 17 lecting the information to identify a spe- 18 cific individual. 19 (B) EXCEPTION.—The term ‘‘covered 20 data’’ does not include the following: 21 (i) Personally identifiable information 22 obtained from public records that is not 23 merged with covered information gathered 24 elsewhere. 25 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 8 •S 2186 IS (ii) Personally identifiable information 1 that is obtained from a forum— 2 (I) where the individual volun- 3 tarily shared the information or au- 4 thorized the information to be shared; 5 and 6 (II) that— 7 (aa) is widely and publicly 8 available and was not made pub- 9 licly available in bad faith; and 10 (bb) contains no restrictions 11 on who can access and view such 12 information. 13 (iii) Personally identifiable informa- 14 tion reported in public media. 15 (iv) Personally identifiable informa- 16 tion dedicated to contacting an individual 17 at the individual’s place of work. 18 (3) COVERED ENTITY.—The term ‘‘covered en- 19 tity’’ means an entity— 20 (A) that collects covered data concerning 21 individuals; 22 (B) that— 23 (i) has gross annual revenue in excess 24 of $25,000,000; 25 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 9 •S 2186 IS (ii) annually buys, receives, sells, or 1 shares covered data of 50,000 or more in- 2 dividuals; or 3 (iii) derives 50 percent or more of its 4 annual revenue from selling individuals’ 5 covered data; and 6 (C) that is— 7 (i) a person over which the Commis- 8 sion has authority pursuant to section 9 5(a)(2) of the Federal Trade Commission 10 Act (15 U.S.C. 45(a)(2)); 11 (ii) a common carrier subject to the 12 Communications Act of 1934 (47 U.S.C. 13 151 et seq.), notwithstanding the definition 14 of the term ‘‘Acts to regulate commerce’’ 15 in section 4 of the Federal Trade Commis- 16 sion Act (15 U.S.C. 44) and the exception 17 provided by section 5(a)(2) of the Federal 18 Trade Commission Act (15 U.S.C. 19 45(a)(2)) for such carriers; or 20 (iii) a nonprofit organization, includ- 21 ing any organization described in section 22 501(c) of the Internal Revenue Code of 23 1986 that is exempt from taxation under 24 section 501(a) of such Code, notwith- 25 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 10 •S 2186 IS standing the definition of the term ‘‘Acts 1 to regulate commerce’’ in section 4 of the 2 Federal Trade Commission Act (15 U.S.C. 3 44) and the exception provided by section 4 5(a)(2) of the Federal Trade Commission 5 Act (15 U.S.C. 45(a)(2)) for such organi- 6 zations. 7 (4) DELETE.—The term ‘‘delete’’ means to re- 8 move personally identifiable information such that 9 the information is not maintained in retrievable form 10 and cannot be retrieved in the normal course of 11 business. 12 (5) PERSONALLY IDENTIFIABLE INFORMA- 13 TION.—The term ‘‘personally identifiable informa- 14 tion’’ means only the following: 15 (A) Any of the following information about 16 an individual: 17 (i) The first name (or initial) and last 18 name of an individual, whether given at 19 birth or time of adoption, or resulting from 20 a lawful change of name. 21 (ii) The postal address of a physical 22 place of residence of such individual. 23 (iii) An e-mail address. 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 11 •S 2186 IS (iv) A telephone number or mobile de- 1 vice number. 2 (v) A social security number or other 3 government issued identification number 4 issued to such individual. 5 (vi) The account number of a credit 6 card issued to such individual. 7 (vii) Unique identifier information 8 that alone can be used to identify a spe- 9 cific individual. 10 (viii) Biometric data about such indi- 11 vidual, including fingerprints and retina 12 scans. 13 (B) If used, transferred, or stored in con- 14 nection with one or more of the items of infor- 15 mation described in subparagraph (A), any of 16 the following: 17 (i) A date of birth. 18 (ii) The number of a certificate of 19 birth or adoption. 20 (iii) A place of birth. 21 (iv) Unique identifier information that 22 alone cannot be used to identify a specific 23 individual. 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 12 •S 2186 IS (v) Precise geographic location, at the 1 same degree of specificity as a global posi- 2 tioning system or equivalent system, and 3 not including any general geographic infor- 4 mation that may be derived from an Inter- 5 net Protocol address. 6 (vi) Information about an individual’s 7 destination, location, and amount of uses 8 of voice services, regardless of technology 9 used. 10 (vii) Any other information concerning 11 an individual that may reasonably be used 12 by the party using, collecting, or storing 13 that information to identify that individual. 14 (6) THIRD PARTY.—The term ‘‘third party’’ 15 means, with respect to a covered entity, a person 16 that— 17 (A) is— 18 (i) not related to the covered entity by 19 common ownership or corporate control; or 20 (ii) related to the covered entity by 21 common ownership or corporate control 22 and an ordinary consumer would not un- 23 derstand that the covered entity and the 24 VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS 13 •S 2186 IS person were related by common ownership 1 or corporate control; 2 (B) is not a service provider used by the 3 covered entity to receive covered data in per- 4 forming services or functions on behalf of and 5 under the instruction of the covered entity; and 6 (C) with respect to the collection of cov- 7 ered data of an individual, does not have an es- 8 tablished business relationship with the indi- 9 vidual and does not identify itself to the indi- 10 vidual at the time of such collection in a clear 11 and conspicuous manner that is visible to the 12 individual. 13 Æ VerDate Sep 11 2014 03:13 Jul 25, 2019 Jkt 089200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6301 E:\BILLS\S2186.IS S2186 kjohnson on DSK79L0C42 with BILLS