Online Privacy Act of 2019

I 116TH CONGRESS 1ST SESSION H. R. 4978 To provide for individual rights relating to privacy of personal information, to establish privacy and security requirements for covered entities relating to personal information, and to establish an agency to be known as the United States Digital Privacy Agency to enforce such rights and requirements, and for other purposes. IN THE HOUSE OF REPRESENTATIVES NOVEMBER 5, 2019 Ms. ESHOO (for herself and Ms. LOFGREN) introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subse- quently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To provide for individual rights relating to privacy of per- sonal information, to establish privacy and security re- quirements for covered entities relating to personal infor- mation, and to establish an agency to be known as the United States Digital Privacy Agency to enforce such rights and requirements, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 4978 IH SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 1 (a) SHORT TITLE.—This Act may be cited as the 2 ‘‘Online Privacy Act of 2019’’. 3 (b) TABLE OF CONTENTS.—The table of contents for 4 this Act is as follows: 5 Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Prohibition on waivers. Sec. 4. Effective date. Sec. 5. Journalism protection. Sec. 6. Small business compliance ramp. Sec. 7. Criminal prohibition on disclosing personal information. Sec. 8. Limitation on disclosing nonredacted government records. TITLE I—INDIVIDUAL RIGHTS Sec. 101. Right of access. Sec. 102. Right of correction. Sec. 103. Right of deletion. Sec. 104. Right of portability. Sec. 105. Right to human review of automated decisions. Sec. 106. Right to individual autonomy. Sec. 107. Right to be informed. Sec. 108. Right to impermanence. Sec. 109. Exemptions, exceptions, fees, timelines, and rules of construction for rights under this title. TITLE II—REQUIREMENTS FOR COVERED ENTITIES, SERVICE PROVIDERS, AND THIRD PARTIES Sec. 201. Minimization and articulated basis for collection, processing, and maintenance. Sec. 202. Minimization and records of access by employees and contractors. Sec. 203. Prohibition on the collection or maintenance of personal information. Sec. 204. Prohibitions on the disclosure of personal information. Sec. 205. Disclosure to entities not subject to United States jurisdiction or not compliant with this Act. Sec. 206. Prohibition on reidentification. Sec. 207. Restrictions on collection, processing, and disclosure of contents of communications. Sec. 208. Prohibition on discriminatory processing. Sec. 209. Restrictions on genetic information. Sec. 210. Requirements for notice and consent processes and privacy policies. Sec. 211. Prohibition on deceptive notice and consent processes and privacy policies. Sec. 212. Notice and consent required. Sec. 213. Privacy policy. Sec. 214. Information security requirements. Sec. 215. Notification of data breach or data sharing abuse. TITLE III—UNITED STATES DIGITAL PRIVACY AGENCY VerDate Sep 11 2014 22:27 Nov 14, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6211 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 4978 IH Sec. 301. Establishment. Sec. 302. Executive and administrative powers. Sec. 303. Rulemaking authority. Sec. 304. Personnel. Sec. 305. Complaints of individuals. Sec. 306. User advisory board. Sec. 307. Academic and research advisory board. Sec. 308. Small business and investor advisory board. Sec. 309. Consultation. Sec. 310. Reports. Sec. 311. Grants for developing open-source machine learning training data. Sec. 312. Annual audits. Sec. 313. Inspector General. Sec. 314. Authorization of appropriations. TITLE IV—ENFORCEMENT Sec. 401. Definitions. Sec. 402. Investigations and administrative discovery. Sec. 403. Hearings and adjudication proceedings. Sec. 404. Litigation authority. Sec. 405. Coordination with other Federal agencies. Sec. 406. Enforcement by States. Sec. 407. Private rights of action. Sec. 408. Relief available. Sec. 409. Referral for criminal proceedings. Sec. 410. Whistleblower enforcement. TITLE V—RELATION TO OTHER LAW Sec. 501. Relation to other Federal law. Sec. 502. Severability. SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) AGENCY.—The term ‘‘Agency’’ means the 3 United States Digital Privacy Agency established by 4 section 301. 5 (2) BEHAVIORAL PERSONALIZATION.— 6 (A) IN GENERAL.—The term ‘‘behavioral 7 personalization’’ means the processing of an in- 8 dividual’s personal information, using an algo- 9 rithm, model, or other means built using that 10 individual’s personal information collected over 11 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 4978 IH a period of time, or an aggregate of the per- 1 sonal information of one or more similarly situ- 2 ated individuals and designed to— 3 (i) alter, influence, guide, or predict 4 an individual’s behavior; 5 (ii) tailor or personalize a product or 6 service; or 7 (iii) filter, sort, limit, promote, display 8 or otherwise differentiate between specific 9 content or categories of content that would 10 otherwise be accessible to the individual. 11 (B) EXCLUSIONS.—The term ‘‘behavioral 12 personalization’’ does not include the use of his- 13 torical personal information to merely prevent 14 the display of or provide additional information 15 about previously accessed content. 16 (3) COLLECT.—The term ‘‘collect’’ includes, 17 with respect to personal information or contents of 18 communication, obtaining such information in any 19 manner, except when solely transmitting, routing, 20 providing intermediate storage for, or providing con- 21 nections for personal information through a system 22 or network. 23 (4) CONTENTS.—The term ‘‘contents’’, when 24 used with respect to communication, has the mean- 25 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 4978 IH ing given such term in section 2510 of title 18, 1 United States Code. 2 (5) COVERED ENTITY.— 3 (A) IN GENERAL.—The term ‘‘covered en- 4 tity’’ means a person who— 5 (i) intentionally collects, processes, or 6 maintains personal information; and 7 (ii) sends or receives such personal in- 8 formation over the internet or a similar 9 communications network. 10 (B) EXCLUSION.—The term ‘‘covered enti- 11 ty’’ does not include a natural person, except to 12 the extent such person is engaged in a commer- 13 cial activity that is more than de minimis. 14 (6) DATA BREACH.—The term ‘‘data breach’’ 15 means unauthorized access to or acquisition of per- 16 sonal information or contents of communications 17 maintained by such covered entity. 18 (7) DATA SHARING ABUSE.—The term ‘‘data 19 sharing abuse’’ means processing, by a third party, 20 of personal information or contents of communica- 21 tions disclosed by a covered entity to the third party, 22 for any purpose other than— 23 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 4978 IH (A) a purpose specified by the covered en- 1 tity to the third party at the time of disclosure; 2 or 3 (B) a purpose to which the individual to 4 whom the information relates has consented. 5 (8) DE-Identified.— 6 (A) IN GENERAL.—The term ‘‘de-identi- 7 fied’’ means information that cannot reasonably 8 identify, relate to, describe, reference, be capa- 9 ble of being associated with, or be linked, di- 10 rectly or indirectly, to a particular individual or 11 device, provided that a business that uses de- 12 identified information— 13 (i) has de-identified the personal in- 14 formation using best practices for the 15 types of data the information contains; 16 (ii) has implemented technical safe- 17 guards that prohibit re-identification of the 18 individual with whom the information was 19 linked; 20 (iii) has implemented business proc- 21 esses that specifically prohibit re-identifica- 22 tion of the information; 23 VerDate Sep 11 2014 22:27 Nov 14, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 4978 IH (iv) has implemented business proc- 1 esses to prevent inadvertent release of de- 2 identified information; and 3 (v) makes no attempt to re-identify 4 the information. 5 (B) The Director may determine that a 6 methodology of de-identifying personal informa- 7 tion is insufficient for the purposes of this defi- 8 nition. 9 (9) DIRECTOR.—The term ‘‘Director’’ means 10 the Director of the Agency. 11 (10) DISCLOSE.—The term ‘‘disclose’’ means, 12 with respect to personal information or contents of 13 communication, to sell, release, transfer, share, dis- 14 seminate, make available, or otherwise cause to be 15 communicated such information to a third party. 16 (11) INDIVIDUAL.—The term ‘‘individual’’ 17 means a natural person residing in the United 18 States. 19 (12) MAINTAIN.—The term ‘‘maintain’’ means, 20 with respect to personal information or contents of 21 communication, to store, secure, or otherwise cause 22 the retaining of such information, or taking actions 23 necessary for such purposes. 24 (13) PERSONAL INFORMATION.— 25 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 4978 IH (A) IN GENERAL.—The term ‘‘personal in- 1 formation’’ means any information maintained 2 by a covered entity that is linked or reasonably 3 linkable to a specific individual or a specific de- 4 vice, including de-identified personal informa- 5 tion and the means to behavioral personaliza- 6 tion created for or linked to a specific indi- 7 vidual. 8 (B) EXCLUSIONS.—The term ‘‘personal in- 9 formation’’ does not include— 10 (i) publicly available information re- 11 lated to an individual; or 12 (ii) information derived or inferred 13 from personal information, if the derived 14 or inferred information is not linked or 15 reasonably linkable to a specific individual. 16 (14) PRIVACY HARM.—The term ‘‘privacy 17 harm’’ means adverse consequences or potential ad- 18 verse consequences to an individual or society arising 19 from the collection, processing, maintenance, or dis- 20 closure of personal information, including— 21 (A) direct or indirect financial loss or eco- 22 nomic harm; 23 (B) physical harm; 24 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 4978 IH (C) psychological harm, including anxiety, 1 embarrassment, fear, and other demonstrable 2 mental trauma; 3 (D) adverse outcomes or decisions with re- 4 spect to the eligibility of an individual for 5 rights, benefits, or privileges in employment (in- 6 cluding hiring, firing, promotion, demotion, and 7 compensation), credit and insurance (including 8 denial of an application or obtaining less favor- 9 able terms), housing, education, professional 10 certification, or the provision of health care and 11 related services; 12 (E) stigmatization or reputational harm; 13 (F) price discrimination; 14 (G) other adverse consequences that affect 15 the private life of an individual, including pri- 16 vate family matters and actions and commu- 17 nications within the home of such individual or 18 a similar physical, online, or digital location 19 where such individual has a reasonable expecta- 20 tion that personal information will not be col- 21 lected, processed, or retained; 22 (H) chilling of free expression or action of 23 an individual, group of individuals, or society 24 generally, due to perceived or actual pervasive 25 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 4978 IH and excessive collection, processing, disclosure, 1 or maintenance of personal information by a 2 covered entity; 3 (I) impairing the autonomy of an indi- 4 vidual, group of individuals, or society gen- 5 erally; and 6 (J) other adverse consequences or potential 7 adverse consequences, consistent with the provi- 8 sions of this Act, as determined by the Direc- 9 tor. 10 (15) PRIVACY PRESERVING COMPUTING.— 11 (A) IN GENERAL.—The term ‘‘privacy pre- 12 serving computing’’ means— 13 (i) the collecting, processing, dis- 14 closing, or maintaining of personal infor- 15 mation that has been encrypted or other- 16 wise rendered unintelligible using a means 17 that cannot be reversed by a covered enti- 18 ty, or a covered entity’s service provider, 19 such that— 20 (I) if such personal information 21 could be rendered intelligible through 22 cooperation or sharing of cryp- 23 tographic secrets by multiple persons, 24 the covered entity has both technical 25 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 11 •HR 4978 IH safeguards and business processes to 1 prevent such cooperation or sharing; 2 (II) if such personal information 3 is rendered intelligible within a hard- 4 ware processing unit or other means 5 of performing operations on the infor- 6 mation, there are technical safeguards 7 that, during the normal course of op- 8 eration— 9 (aa) prevent rendering per- 10 sonal information intelligible any- 11 where but within the hardware 12 processing unit or other means of 13 performing operations; and 14 (bb) make the exporting or 15 otherwise observing of such intel- 16 ligible information, or the cryp- 17 tographic secret used to protect 18 such information, impossible; and 19 (III) if the result of such proc- 20 essing of the personal information is 21 also personal information, such result 22 must be unintelligible to the covered 23 entity or service provider and pro- 24 VerDate Sep 11 2014 00:42 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H4978.IH H4978 pamtmann on DSKBC07HB2PROD with BILLS 12 •HR 4978 IH tected by privacy preserving com- 1 puting. 2 (B) INSUFFICIENT METHODOLOGIES.—The 3 Director may determine that a methodology of 4 [Text truncated for display. Full text available on Congress.gov.]