Data Broker List Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2342 To provide for requirements for data brokers with respect to the acquisition, use, and protection of brokered personal information and to require that data brokers annually register with the Federal Trade Commission. IN THE SENATE OF THE UNITED STATES JULY 30, 2019 Mr. PETERS (for himself and Ms. MCSALLY) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To provide for requirements for data brokers with respect to the acquisition, use, and protection of brokered per- sonal information and to require that data brokers annu- ally register with the Federal Trade Commission. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Data Broker List Act 4 of 2019’’. 5 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 2 •S 2342 IS SEC. 2. REQUIREMENTS FOR DATA BROKERS. 1 (a) REQUIREMENTS WITH RESPECT TO THE ACQUI- 2 SITION AND USE OF BROKERED PERSONAL INFORMA- 3 TION.—A data broker shall not— 4 (1) acquire brokered personal information 5 through fraudulent means; 6 (2) acquire or use brokered personal informa- 7 tion for the purpose of— 8 (A) stalking or harassing another person; 9 (B) committing fraud, including identity 10 theft, financial fraud, or e-mail fraud; or 11 (C) engaging in unlawful discrimination, 12 including unlawful discrimination in decisions 13 regarding employment, housing, and credit eli- 14 gibility; or 15 (3) sell or transfer brokered personal informa- 16 tion to a third party if the data broker knows or rea- 17 sonably should know that the third party intends to 18 engage in any conduct prohibited by this Act. 19 (b) DUTY TO PROTECT BROKERED PERSONAL IN- 20 FORMATION.— 21 (1) IN GENERAL.—A data broker shall develop, 22 implement, and maintain a comprehensive informa- 23 tion security program in order to protect from secu- 24 rity breaches or other inadvertent or improper dis- 25 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 3 •S 2342 IS closure the brokered personal information acquired 1 by the data broker. 2 (2) PROGRAM REQUIREMENTS.—The com- 3 prehensive information security program required 4 under paragraph (1) shall— 5 (A) be written in one or more readily ac- 6 cessible parts; and 7 (B) contain administrative, technical, and 8 physical safeguards that are appropriate to— 9 (i) the size, scope, and type of busi- 10 ness of the data broker; 11 (ii) the amount of resources available 12 to the data broker; 13 (iii) the amount of stored data of the 14 data broker; and 15 (iv) the need for security and con- 16 fidentiality of brokered personal informa- 17 tion. 18 (c) ANNUAL REGISTRATION.— 19 (1) IN GENERAL.—Annually, on or before Janu- 20 ary 31, a data broker shall— 21 (A) register with the Commission; and 22 (B) provide the following information with 23 such registration: 24 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 4 •S 2342 IS (i) The name and primary physical, e- 1 mail, and internet addresses of the data 2 broker. 3 (ii) If the data broker permits a con- 4 sumer to opt out of the data broker’s col- 5 lection of brokered personal information, 6 opt out of its databases, or opt out of cer- 7 tain sales of data— 8 (I) the method for requesting an 9 opt-out; 10 (II) if the opt-out applies to only 11 certain activities or sales, which ones; 12 and 13 (III) whether the data broker 14 permits a consumer to authorize a 15 third party to perform the opt-out on 16 the consumer’s behalf. 17 (iii) A statement specifying the data 18 collection, databases, or sales activities 19 from which a consumer may not opt out. 20 (iv) A statement as to whether the 21 data broker implements a purchaser 22 credentialing process. 23 (v) The number of security breaches 24 that the data broker experienced during 25 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 5 •S 2342 IS the previous year, and if known, the total 1 number of consumers whose personal infor- 2 mation was accessed, downloaded, viewed, 3 or otherwise affected in a breach. 4 (vi) Where the data broker has actual 5 knowledge that it possesses the brokered 6 personal information of minors, a separate 7 statement detailing the data collection 8 practices, databases, sales activities, and 9 opt-out policies that are applicable to the 10 brokered personal information of minors. 11 (vii) Any additional information or ex- 12 planation the data broker chooses to pro- 13 vide concerning its data collection prac- 14 tices. 15 (2) EXCEPTION.—The requirements under 16 paragraph (1) shall not apply to a data broker that 17 is already required to comply with such requirements 18 with respect to another Federal agency. 19 (3) PUBLIC AVAILABILITY.—The Commission 20 shall make the information described in paragraph 21 (1) available for public inspection, except as nec- 22 essary to protect the integrity of ongoing investiga- 23 tions or to protect the privacy of consumers, or if it 24 is in the interest of public safety or welfare. 25 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 6 •S 2342 IS SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMIS- 1 SION. 2 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 3 A violation of section 2 shall be treated as a violation of 4 a rule defining an unfair or a deceptive act or practice 5 under section 18(a)(1)(B) of the Federal Trade Commis- 6 sion Act (15 U.S.C. 57a(a)(1)(B)). The Commission shall 7 begin enforcement of such violations by not later than 1 8 year after the date of the enactment of this Act. 9 (b) POWERS OF COMMISSION.— 10 (1) IN GENERAL.—The Commission shall en- 11 force this section in the same manner, by the same 12 means, and with the same jurisdiction, powers, and 13 duties as though all applicable terms and provisions 14 of the Federal Trade Commission Act (15 U.S.C. 41 15 et seq.) were incorporated into and made a part of 16 this section. 17 (2) PRIVILEGES AND IMMUNITIES.—Any data 18 broker who violates section 2 shall be subject to the 19 penalties and entitled to the privileges and immuni- 20 ties provided in the Federal Trade Commission Act 21 (15 U.S.C. 41 et seq.). 22 (3) AUTHORITY PRESERVED.—Nothing in this 23 section shall be construed to limit the authority of 24 the Federal Trade Commission under any other pro- 25 vision of law. 26 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 7 •S 2342 IS (c) RULEMAKING AUTHORITY FOR THE FEDERAL 1 TRADE COMMISSION.—The Commission shall have au- 2 thority under section 553 of title 5, United States Code, 3 to promulgate regulations the Commission determines to 4 be necessary to carry out the provisions of this Act. 5 SEC. 4. FTC ANNUAL REVIEW AND REPORT. 6 (a) ANNUAL REVIEW.—The Commission shall con- 7 duct an annual review of the implementation of the provi- 8 sions of this Act. Such study shall include an analysis of— 9 (1) compliance by data brokers with the re- 10 quirements under section 2; 11 (2) enforcement actions taken by the Commis- 12 sion with respect to violations of such requirements; 13 and 14 (3) other areas determined appropriate by the 15 Commission. 16 (b) ANNUAL REPORT.—Not later than 1 year after 17 the date of the enactment of this Act, and annually there- 18 after the Commission shall submit to Congress a report 19 on the review conducted under subsection (a), together 20 with recommendations for such legislation and administra- 21 tive action as the Commission determines appropriate. 22 SEC. 5. DEFINITIONS. 23 In this section: 24 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 8 •S 2342 IS (1) BROKERED PERSONAL INFORMATION.—The 1 term ‘‘brokered personal information’’ means any 2 personal information that is categorized or organized 3 for sale to a third party. 4 (2) BUSINESS.— 5 (A) IN GENERAL.—The term ‘‘business’’ 6 means a commercial entity, including a sole 7 proprietorship, partnership, corporation, asso- 8 ciation, limited liability company, or other 9 group, however organized and whether or not 10 organized to operate at a profit, including a fi- 11 nancial institution organized, chartered, or 12 holding a license or authorization certificate 13 under the laws of a State, the United States, or 14 any other country, or the parent, affiliate, or 15 subsidiary of a financial institution. 16 (B) EXCLUSION.—The term ‘‘business’’ 17 does not include a State, a State agency, any 18 political subdivision of a State, or a vendor act- 19 ing solely on behalf of, and at the direction of, 20 a State. 21 (3) COMMISSION.—The term ‘‘Commission’’ 22 means the Federal Trade Commission. 23 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 9 •S 2342 IS (4) CONSUMER.—The term ‘‘consumer’’ means 1 an individual residing in the United States acting in 2 a personal, family, or household capacity. 3 (5) DATA BROKER.— 4 (A) IN GENERAL.—The term ‘‘data 5 broker’’ means a business that collects or ob- 6 tains a consumer’s personal information and 7 sells, licenses, trades, or provides for consider- 8 ation that information to another business with 9 whom a consumer does not have a direct rela- 10 tionship. 11 (B) DIRECT RELATIONSHIP.—For pur- 12 poses of subparagraph (A), a direct relationship 13 with a business exists if the consumer— 14 (i) is a current customer; 15 (ii) obtained a good or service from 16 the business within the prior 18 months; or 17 (iii) made an inquiry about the prod- 18 ucts or services of the business within the 19 prior 90 days. 20 (C) EXCLUSION.—The following activities 21 conducted by a business, and the collection and 22 sale or licensing of brokered personal informa- 23 tion incidental to conducting these activities, do 24 not qualify the business as a data broker: 25 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 10 •S 2342 IS (i) Providing 411 directory assistance 1 or directory information services, including 2 name, address, and telephone number, on 3 behalf of or as a function of a tele- 4 communications carrier. 5 (ii) Providing a consumer’s publicly 6 available information if the information is 7 being used by the recipient as it relates to 8 that consumer’s business or profession. 9 (iii) Providing publicly available infor- 10 mation via real-time or near-real-time alert 11 services for health or safety purposes. 12 (iv) Providing or using information in 13 a manner that is regulated under another 14 Federal law, including the Fair Credit Re- 15 porting Act, the Gramm-Leach-Bliley Act, 16 or the Health Insurance Portability and 17 Accountability Act. 18 (v) Providing data to a third party at 19 the direction of the customer and with the 20 customer’s consent. 21 (D) EXCLUSION FROM SALE.—For pur- 22 poses of this paragraph, the term ‘‘sells’’ does 23 not include a one-time or occasional sale of as- 24 sets of a business as part of a transfer of con- 25 VerDate Sep 11 2014 21:28 Aug 09, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 11 •S 2342 IS trol of those assets that is not part of the ordi- 1 nary conduct of the business. 2 (6) DATA BROKER SECURITY BREACH.— 3 (A) IN GENERAL.—The term ‘‘data broker 4 security breach’’ means an unauthorized acqui- 5 sition or a reasonable belief of an unauthorized 6 acquisition of more than one element of bro- 7 kered personal information maintained by a 8 data broker when the brokered personal infor- 9 mation is not encrypted, redacted, or protected 10 by another method that renders the information 11 unreadable or unusable by an unauthorized 12 data broker. 13 (B) EXCLUSION.—The term ‘‘data broker 14 security breach’’ does not include good faith but 15 unauthorized acquisition of brokered personal 16 information by an employee or agent of the 17 data broker for a legitimate purpose of the data 18 broker, provided that the brokered personal in- 19 formation is not used for a purpose unrelated 20 to the data broker’s business or subject to fur- 21 ther unauthorized disclosure. 22 (C) APPLICATION.—In determining wheth- 23 er brokered personal information has been ac- 24 quired or is reasonably believed to have been ac- 25 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 12 •S 2342 IS quired by a data broker without valid authoriza- 1 tion, a data broker may consider the following 2 factors, among others: 3 (i) Indications that the brokered per- 4 sonal information is in the physical posses- 5 sion and control of a person without valid 6 authorization, such as a lost or stolen com- 7 puter or other device containing brokered 8 personal information. 9 (ii) Indications that the brokered per- 10 sonal information has been downloaded or 11 copied. 12 (iii) Indications that the brokered per- 13 sonal information was used by an unau- 14 thorized data broker, such as fraudulent 15 accounts opened or instances of identity 16 theft reported. 17 (iv) That the brokered personal infor- 18 mation has been made public. 19 (7) PERSONAL INFORMATION.—The term ‘‘per- 20 sonal information’’ means information which is re- 21 lated to any identified or identifiable person. 22 (8) STATE.—The term ‘‘State’’ means any 23 State of the United States, the District of Columbia, 24 the Commonwealth of Puerto Rico, Guam, American 25 VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS 13 •S 2342 IS Samoa, the Commonwealth of Northern Mariana Is- 1 lands, and the United States Virgin Islands. 2 Æ VerDate Sep 11 2014 03:29 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6301 E:\BILLS\S2342.IS S2342 kjohnson on DSK79L0C42 with BILLS