Data Broker Accountability and Transparency Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2577 To require data brokers to establish procedures to ensure the accuracy of collected personal information, and for other purposes. IN THE SENATE OF THE UNITED STATES SEPTEMBER 26, 2019 Mr. MARKEY (for himself, Mr. BLUMENTHAL, and Ms. SMITH) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To require data brokers to establish procedures to ensure the accuracy of collected personal information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Data Broker Account- 4 ability and Transparency Act of 2019’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) COMMISSION.—The term ‘‘Commission’’ 8 means the Federal Trade Commission. 9 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 2 •S 2577 IS (2) COVERED DATA BROKER.— 1 (A) IN GENERAL.—The term ‘‘covered 2 data broker’’ includes all data brokers except 3 those data brokers excepted under subpara- 4 graph (B). 5 (B) EXCEPTIONS.—The Commission may 6 except a data broker if the Commission con- 7 siders, by rule, a data broker outside the scope 8 of this Act, such as a data broker who proc- 9 esses information collected by or on behalf of 10 and received from or on behalf of a non- 11 affiliated third party concerning an individual 12 who is a customer or an employee of that third 13 party to enable that third party, directly or 14 through parties acting on its behalf, to provide 15 benefits for its employees or directly transact 16 business with its customers. 17 (3) DATA BROKER.—The term ‘‘data broker’’ 18 means a commercial entity that collects, assembles, 19 or maintains personal information concerning an in- 20 dividual who is not a customer or an employee of 21 that entity in order to sell the information or provide 22 third party access to the information. 23 (4) PERSONAL INFORMATION.— 24 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 3 •S 2577 IS (A) IN GENERAL.—The term ‘‘personal in- 1 formation’’ means information that directly or 2 indirectly identifies, relates to, describes, is ca- 3 pable of being associated with, or could reason- 4 ably be linked to, a particular individual. 5 (B) EXAMPLES.—The term ‘‘personal in- 6 formation’’ includes— 7 (i) an identifier such as a real name, 8 alias, signature, date of birth, gender iden- 9 tity, sexual orientation, marital status, 10 physical characteristic or description, post- 11 al address, telephone number, unique per- 12 sonal identifier, military identification 13 number, online identifier, Internet Protocol 14 address, email address, account name, 15 mother’s maiden name, social security 16 number, driver’s license number, passport 17 number, or other similar identifier; 18 (ii) information such as employment, 19 employment history, bank account number, 20 credit card number, debit card number, in- 21 surance policy number, or any other finan- 22 cial information, medical information, men- 23 tal health information, or health insurance 24 information; 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 4 •S 2577 IS (iii) commercial information, including 1 a record of personal property, income, as- 2 sets, leases, rentals, products or services 3 purchased, obtained, or considered, or 4 other purchasing or consuming history; 5 (iv) biometric information, including a 6 retina or iris scan, fingerprint, voiceprint, 7 or scan of hand or face geometry; 8 (v) internet or other electronic net- 9 work activity information, including brows- 10 ing history, search history, content, includ- 11 ing text, photographs, audio or video re- 12 cordings, or other user generated-content, 13 non-public communications, and informa- 14 tion regarding an individual’s interaction 15 with an internet website, mobile applica- 16 tion, or advertisement; 17 (vi) historical or real-time geolocation 18 data; 19 (vii) audio, electronic, visual, thermal, 20 olfactory, or similar information; 21 (viii) education records, as defined in 22 section 99.3 of title 34, Code of Federal 23 Regulations, or any successor regulation; 24 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 5 •S 2577 IS (ix) political information or informa- 1 tion on criminal convictions or arrests; 2 (x) any required security code, access 3 code, password, or username necessary to 4 permit access to the account of an indi- 5 vidual; 6 (xi) characteristics of protected class- 7 es under Federal law, including race, color, 8 national origin, religion, sex, age, or dis- 9 ability; or 10 (xii) an inference drawn from any of 11 the information described in this subpara- 12 graph to create a profile about an indi- 13 vidual reflecting the individual’s pref- 14 erences, characteristics, psychological 15 trends, preferences, predispositions, behav- 16 ior, attitudes, intelligence, abilities, or apti- 17 tudes. 18 (C) EXCLUSIONS.— 19 (i) IN GENERAL.—The term ‘‘personal 20 information’’ does not include publicly 21 available information. 22 (ii) PUBLICLY AVAILABLE INFORMA- 23 TION.—For purposes of clause (i), the 24 term ‘‘publicly available information’’ 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 6 •S 2577 IS means information that is lawfully made 1 available from Federal, State, or local gov- 2 ernment records. 3 (5) PUBLIC RECORD INFORMATION.—The term 4 ‘‘public record information’’ means information 5 about an individual that has been obtained originally 6 from records of a Federal, State, or local govern- 7 ment entity that are available for public inspection. 8 SEC. 3. PROHIBITION ON OBTAINING OR SOLICITATION TO 9 OBTAIN PERSONAL INFORMATION BY FALSE 10 PRETENSES. 11 (a) IN GENERAL.—A covered data broker may not 12 obtain or attempt to obtain, or cause to be disclosed or 13 attempt to cause to be disclosed to any person, personal 14 information or any other information relating to any per- 15 son by making a false, fictitious, or fraudulent statement 16 or representation to any person, including by providing 17 any document to any person, that the covered data broker 18 knows or should know— 19 (1) to be forged, counterfeit, lost, stolen, or 20 fraudulently obtained; or 21 (2) contains a false, fictitious, or fraudulent 22 statement or representation. 23 (b) SOLICITATION.—A covered data broker may not 24 request a person to obtain personal information, or any 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 7 •S 2577 IS other information, relating to any other person if the cov- 1 ered data broker knows or should know that the person 2 to whom the request is made will obtain or attempt to 3 obtain that information in the manner described in sub- 4 section (a). 5 SEC. 4. REQUIREMENTS CONCERNING ACCURACY OF AND 6 ACCESS TO PERSONAL INFORMATION. 7 (a) ACCURACY.— 8 (1) IN GENERAL.—Except as provided in para- 9 graph (2), a covered data broker shall establish pro- 10 cedures to ensure, to the maximum extent prac- 11 ticable, the accuracy of— 12 (A) the personal information the broker 13 collects, assembles, or maintains; and 14 (B) any other information the broker col- 15 lects, assembles, or maintains that specifically 16 identifies an individual, unless the information 17 only identifies the name or address of an indi- 18 vidual. 19 (2) EXCEPTION.—A covered data broker may 20 collect or maintain information that may be inac- 21 curate with respect to a particular individual if that 22 information is being collected or maintained solely 23 for the purpose of— 24 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 8 •S 2577 IS (A) indicating whether there may be a dis- 1 crepancy or irregularity in the personal infor- 2 mation that is associated with an individual; 3 (B) helping to identify, or to authenticate 4 the identity of, an individual; or 5 (C) helping to protect against or inves- 6 tigate fraud or other unlawful conduct. 7 (b) CONSUMER ACCESS.— 8 (1) IN GENERAL.—Subject to paragraph (4), a 9 covered data broker shall provide an individual a 10 means to review any personal information or other 11 information that specifically identifies that indi- 12 vidual, that the covered data broker collects, assem- 13 bles, or maintains on that individual. 14 (2) REVIEW REQUIREMENTS.— 15 (A) ELEMENTS.—As part of the review de- 16 scribed in paragraph (1), a covered data broker 17 shall provide a description of— 18 (i) the personal information being re- 19 tained; 20 (ii) each date on which the covered 21 entity collected the personal information; 22 (iii) the third parties to which the cov- 23 ered entity has disclosed or will disclose 24 the personal information; and 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 9 •S 2577 IS (iv) if possible, how long the personal 1 information will be retained or stored, or if 2 not possible, the criteria used for deter- 3 mining how long the personal information 4 will be retained or stored. 5 (B) ADDITIONAL REQUIREMENTS.—A cov- 6 ered data broker shall provide the means for re- 7 view under paragraph (1)— 8 (i) at the request of an individual; 9 (ii) after verifying the identity of the 10 individual; 11 (iii) not less than 1 time per year; 12 (iv) at no cost to the individual; and 13 (v) in a format that can be readily un- 14 derstood by a consumer, as determined by 15 the Commission. 16 (3) PERIOD OF REVIEW.—A covered data 17 broker shall provide an individual the means re- 18 quired under paragraph (1) within such period after 19 receiving a request from the individual as the Com- 20 mission shall determine, by rule, is appropriate. 21 (4) EXCEPTIONS.—The Commission may, by 22 rule, establish any exceptions to paragraph (1) that 23 the Commission considers appropriate, such as for 24 VerDate Sep 11 2014 22:29 Oct 07, 2019 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 10 •S 2577 IS child protection, law enforcement, fraud prevention, 1 or other government purposes. 2 (5) LIMITATION ON USE OF VERIFYING INFOR- 3 MATION.—If a covered data broker collects informa- 4 tion from an individual to verify the identity of the 5 individual under paragraph (2)(B) that the data 6 broker did not have before that collection, the data 7 broker may not use the information for any purpose 8 other than for purposes of verifying the identity of 9 the individual under that paragraph. 10 (c) DISPUTED INFORMATION.— 11 (1) IN GENERAL.—An individual whose per- 12 sonal information is maintained by a covered data 13 broker may dispute the accuracy of any information 14 described under subsection (b)(1) by requesting, in 15 writing, that the covered data broker correct the in- 16 formation. 17 (2) CORRECTION REQUIREMENTS.—A covered 18 data broker, after verifying the identity of an indi- 19 vidual making a request under paragraph (1) to cor- 20 rect information, and unless there are reasonable 21 grounds to believe the request is frivolous or irrele- 22 vant, shall— 23 (A) with regard to publicly available infor- 24 mation— 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 11 •S 2577 IS (i) inform the individual of the source 1 of the information and, if reasonably avail- 2 able, where to direct the request for correc- 3 tion; or 4 (ii) if the individual provides proof 5 that the public record has been corrected 6 or that the covered data broker was report- 7 ing the information incorrectly, correct the 8 inaccuracy in the records of the covered 9 data broker; and 10 (B) with regard to personal information— 11 (i) note the information that is dis- 12 puted, including the written request of the 13 individual; 14 (ii) if the information can be inde- 15 pendently verified, use the procedures es- 16 tablished under subsection (a) to independ- 17 ently verify the information; and 18 (iii) if the covered data broker was re- 19 porting the information incorrectly, correct 20 the inaccuracy in the records of the cov- 21 ered data broker. 22 (3) PERIOD OF CORRECTION.—If a covered 23 data broker is subject to a requirement under para- 24 graph (2) due to a request made by an individual 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 12 •S 2577 IS under paragraph (1), the covered data broker shall 1 take any action that may be required to satisfy the 2 requirement within a period determined appropriate 3 by the Commission, by rule. 4 (d) NOTICE.— 5 (1) IN GENERAL.—A covered data broker shall 6 maintain an internet website and place a clear and 7 conspicuous notice on that internet website instruct- 8 ing an individual how— 9 (A) to review information under subsection 10 (b)(1); and 11 (B) to express a preference under sub- 12 section (e)(2). 13 (2) FORM.—A covered data broker shall ensure 14 that the notice the covered data broker places under 15 paragraph (1) conforms to a model form that the 16 Commission shall promulgate for purposes of this 17 subsection. 18 (e) CERTAIN MARKETING INFORMATION.— 19 (1) IN GENERAL.—A covered data broker may 20 not use, share, or sell any information for marketing 21 purposes that is subject to an expressed preference 22 under paragraph (2). 23 (2) EXPRESSION OF PREFERENCES.—A covered 24 data broker that maintains any information de- 25 VerDate Sep 11 2014 02:21 Oct 05, 2019 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2577.IS S2577 kjohnson on DSK79L0C42 with BILLS 13 •S 2577 IS scribed under subsection (a) and that uses, shares, 1 or sells that information for marketing purposes 2 shall provide each individual whose information the 3 covered data broker maintains with a reasonable 4 means of expressing a preference not to have that 5 individual’s information used for those purposes. 6 (f) AUDITING.— [Text truncated for display. Full text available on Congress.gov.]