PRIVCY ACT

I 116TH CONGRESS 2D SESSION H. R. 5703 To amend the Children’s Online Privacy Protection Act of 1998 to update and expand the coverage of such Act, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JANUARY 29, 2020 Ms. CASTOR of Florida introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend the Children’s Online Privacy Protection Act of 1998 to update and expand the coverage of such Act, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 This Act may be cited as the ‘‘Protecting the Infor- 4 mation of our Vulnerable Children and Youth Act’’ or the 5 ‘‘PRIVCY ACT’’. 6 SEC. 2. DEFINITIONS. 7 Section 1302 of the Children’s Online Privacy Protec- 8 tion Act of 1998 (15 U.S.C. 6501) is amended— 9 (1) in paragraph (1)— 10 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 5703 IH (A) by inserting ‘‘or ‘children’ ’’ after 1 ‘‘child’’; and 2 (B) by inserting ‘‘or individuals, respec- 3 tively,’’ after ‘‘individual’’; 4 (2) by striking paragraph (10); 5 (3) by redesignating paragraphs (2) through 6 (9) as paragraphs (3) through (10), respectively; 7 (4) inserting after paragraph (1) the following: 8 ‘‘(2) YOUNG CONSUMER.—The term ‘young 9 consumer’ means an individual over the age of 12 10 and under the age of 18.’’; 11 (5) by amending paragraph (3) (as so redesig- 12 nated) to read as follows: 13 ‘‘(3) COVERED ENTITY.—The term ‘covered en- 14 tity’ means— 15 ‘‘(A) any organization, corporation, trust, 16 partnership, sole proprietorship, unincorporated 17 association, or venture over which the Commis- 18 sion has authority pursuant to section 5(a)(2) 19 of the Federal Trade Commission Act (15 20 U.S.C. 45(a)(2)); 21 ‘‘(B) notwithstanding section 5(a)(2) of 22 the Federal Trade Commission Act (15 U.S.C. 23 45(a)(2)), common carriers; and 24 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 5703 IH ‘‘(C) notwithstanding sections 4 and 1 5(a)(2) of the Federal Trade Commission Act 2 (15 U.S.C. 44 and 45(a)(2)), any nonprofit or- 3 ganization, including any organization described 4 in section 501(c) of the Internal Revenue Code 5 of 1986 that is exempt from taxation under sec- 6 tion 501(a) of the Internal Revenue Code of 7 1986.’’; 8 (6) by amending paragraph (5) (as so redesig- 9 nated) to read as follows: 10 ‘‘(5) DISCLOSE.—The term ‘disclose’ means to 11 intentionally or unintentionally release, transfer, sell, 12 disseminate, share, publish, lease, license, make 13 available, allow access to, fail to restrict access to, 14 or otherwise communicate covered information.’’; 15 (7) by amending paragraph (9) (as so redesig- 16 nated) to read as follows: 17 ‘‘(9) COVERED INFORMATION.—The term ‘cov- 18 ered information’— 19 ‘‘(A) means any information, linked or rea- 20 sonably linkable to a specific young consumer 21 or child, or consumer device of a young con- 22 sumer or child; 23 ‘‘(B) may include— 24 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 5703 IH ‘‘(i) a name, alias, home or other 1 physical address, online identifier, Internet 2 Protocol address, email address, account 3 name, Social Security number, physical 4 characteristics or description, telephone 5 number, State identification card number, 6 driver’s license number, where applicable, 7 passport number, or other similar identi- 8 fier; 9 ‘‘(ii) race, religion, sex, sexual orienta- 10 tion, sexual behavior, familial status, gen- 11 der identity, disability, age, political affili- 12 ation, or national origin; 13 ‘‘(iii) commercial information, includ- 14 ing records relating to personal property, 15 products or services purchased, obtained, 16 or considered, or other purchasing or con- 17 suming histories or tendencies; 18 ‘‘(iv) biometric information; 19 ‘‘(v) Internet or other electronic net- 20 work activity information, including brows- 21 ing history, search history, and informa- 22 tion regarding a young consumer’s or 23 child’s interaction with an Internet 24 website, application, or advertisement; 25 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 5703 IH ‘‘(vi) geolocation information; 1 ‘‘(vii) audio, electronic, visual, ther- 2 mal, olfactory, or similar information; 3 ‘‘(viii) education information; 4 ‘‘(ix) health information; 5 ‘‘(x) facial recognition information; 6 ‘‘(xi) contents of and parties to infor- 7 mation, including with respect to electronic 8 mail, text messages, picture messages, 9 voicemails, audio conversations, and video 10 conversations; 11 ‘‘(xii) financial information, including 12 bank account numbers, credit card num- 13 bers, debit card numbers, or insurance pol- 14 icy numbers, where applicable; 15 ‘‘(xiii) inferences drawn from any of 16 the information described in this para- 17 graph to create a profile about a young 18 consumer or child reflecting the young con- 19 sumer’s or child’s preferences, characteris- 20 tics, psychological trends, predispositions, 21 behavior, attitudes, intelligence, abilities, 22 and aptitudes; and 23 ‘‘(C) does not include— 24 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 5703 IH ‘‘(i) information that is processed 1 solely for the purpose of employment of a 2 young consumer; 3 ‘‘(ii) de-identified information.’’; 4 (8) by amending paragraph (10) (as so redesig- 5 nated) to read as follows: 6 ‘‘(10) VERIFIABLE CONSENT.—The term 7 ‘verifiable consent’ means express, affirmative con- 8 sent freely given by a young consumer, or by the 9 parent of a child, to the processing of covered infor- 10 mation of that young consumer or child, respec- 11 tively— 12 ‘‘(A) that is specific, informed, and unam- 13 biguous; 14 ‘‘(B) that is given separately for each proc- 15 ess of specific types of covered information; 16 ‘‘(C) where the young consumer or parent 17 of a child, as applicable, has not received any 18 financial or other incentive in exchange for such 19 consent; and 20 ‘‘(D) that is given before any processing 21 occurs, at a time and in a context in which the 22 young consumer or parent of a child, as appli- 23 cable, would reasonably expect to make choices 24 concerning such processing.’’; 25 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 5703 IH (9) by redesignating paragraphs (11) and (12) 1 as paragraphs (12) and (13), respectively; and 2 (10) by adding at the end the following: 3 ‘‘(14) PROCESS.—The term ‘process’ means 4 any operation or set of operations which is per- 5 formed on covered information, whether or not by 6 automated means, including collecting, creating, ac- 7 quiring, disclosing, recording, deriving, inferring, ob- 8 taining, assembling, organizing, structuring, storing, 9 retaining, adapting or altering, using, or retrieving 10 covered information. 11 ‘‘(15) DE-IDENTIFIED INFORMATION AND RE- 12 LATED TERMS.— 13 ‘‘(A) The term ‘de-identified information’ 14 means information that has been de-identified 15 by a covered entity, where the covered entity 16 publicly discloses the methods it uses to de- 17 identify information. 18 ‘‘(B) The term ‘de-identify’ means the re- 19 moval of identifying information from informa- 20 tion such that the information is not reasonably 21 linkable to a specific young consumer or child 22 or consumer device of a young consumer or 23 child. 24 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 5703 IH ‘‘(C) The term ‘re-identify’ means to link 1 information that has been de-identified to a 2 specific young consumer or child or consumer 3 device of a young consumer or child. 4 ‘‘(16) STATE.—The term ‘State’ means each of 5 the several States, the District of Columbia, each 6 territory of the United States, and each federally 7 recognized Indian Tribe. 8 ‘‘(17) SERVICE PROVIDER.—The term ‘service 9 provider’ means a covered entity that processes cov- 10 ered information at the direction of, and for the sole 11 benefit of, another covered entity, and— 12 ‘‘(A) is contractually or legally prohibited 13 from processing such covered information for 14 any other purpose; and 15 ‘‘(B) complies with all of the requirements 16 of this Act.’’. 17 SEC. 3. UNFAIR OR DECEPTIVE ACTS OR PRACTICES. 18 Section 1303 of the Children’s Online Privacy Protec- 19 tion Act of 1998 (15 U.S.C. 6502) is amended— 20 (1) in the section heading, by striking ‘‘COL- 21 LECTION AND USE OF PERSONAL INFORMA- 22 TION FROM AND ABOUT CHILDREN ON THE 23 INTERNET’’ and inserting ‘‘PROCESSING OF COV- 24 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 5703 IH ERED INFORMATION FROM AND ABOUT YOUNG 1 CONSUMERS OR CHILDREN’’; 2 (2) by amending subsection (a) to read as fol- 3 lows: 4 ‘‘(a) ACTS PROHIBITED.—It is unlawful for a covered 5 entity that has actual or constructive knowledge that such 6 covered entity is processing covered information about a 7 young consumer or child to process such information in 8 a manner that violates the regulations prescribed under 9 subsection (b).’’; 10 (3) by amending subsection (b) to read as fol- 11 lows: 12 ‘‘(b) IN GENERAL.—Not later than 1 year after the 13 date of enactment of the Protecting the Information of 14 our Vulnerable Children and Youth Act, the Commission 15 shall, under section 553 of title 5, United States Code, 16 revise regulations issued under this Act prior to such date 17 of enactment and issue additional regulations as necessary 18 that implement the requirements and prohibitions set 19 forth in paragraphs (1) through (7). The Commission 20 shall have the authority to revise such regulations every 21 7 years or as it determines necessary due to changes in 22 or emerging technology. 23 ‘‘(1) TRANSPARENCY.—Such regulations shall 24 require a covered entity to develop and make pub- 25 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 5703 IH licly available at all times and in a machine-readable 1 format, a privacy policy, in a manner that is clear, 2 easily understood, and written in plain and concise 3 language, that includes— 4 ‘‘(A) the categories of covered information 5 that the covered entity processes about young 6 consumers and children; 7 ‘‘(B) how and under what circumstances 8 covered information is collected directly from a 9 young consumer or child; 10 ‘‘(C) the categories and the sources of any 11 covered information processed by a covered en- 12 tity that is not collected directly from a young 13 consumer or child; 14 ‘‘(D) a description of the purposes for 15 which the covered entity processes covered in- 16 formation, including— 17 ‘‘(i) a description of whether and how 18 the covered entity customizes products or 19 services, or adjusts the prices of products 20 or services for young consumers or chil- 21 dren or based in any part on processing of 22 covered information; 23 ‘‘(ii) a description of whether and how 24 the covered entity, or the covered entity’s 25 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 11 •HR 5703 IH affiliates or service providers, de-identifies 1 information, including the methods used to 2 de-identify such information; and 3 ‘‘(iii) a description of whether and 4 how the covered entity, or the covered enti- 5 ty’s affiliates or service providers, gen- 6 erates or uses any consumer score to make 7 decisions concerning a young consumer or 8 child, and the source or sources of any 9 such consumer score; 10 ‘‘(E) a description of how long and the cir- 11 cumstances under which the covered entity re- 12 tains covered information; 13 ‘‘(F) a description of all of the purposes 14 for which the covered entity discloses covered 15 information with service providers and, on a bi- 16 ennial basis, the categories of service providers; 17 ‘‘(G) a description of whether and for what 18 purposes the covered entity discloses informa- 19 tion to third parties; 20 ‘‘(H) whether a covered entity sells or oth- 21 erwise shares covered information with data 22 brokers or processes covered information for 23 targeted advertising; 24 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 12 •HR 5703 IH ‘‘(I) whether a covered entity collects cov- 1 ered information about young consumers or 2 children over time and across different websites 3 or mobile applications when a young consumer 4 or child uses the covered entity’s website or mo- 5 bile application; 6 ‘‘(J) how a young consumer or a parent of 7 a child can exercise their rights to access, cor- 8 rect, and delete such young consumer’s or 9 child’s covered information as set forth under 10 paragraph (5); 11 ‘‘(K) how a young consumer or a parent of 12 a child can grant, withhold, or withdraw the 13 consent required under paragraph (2), including 14 how to modify consent for the processing of 15 covered information, and the consequences of 16 withholding, withdrawing, or modifying such 17 consent; 18 ‘‘(L) the effective date of the notice; and 19 ‘‘(M) how the covered entity will commu- 20 nicate material changes of the privacy policy to 21 the young consumer or the parent of a child. 22 ‘‘(2) CONSENT REQUIRED.— 23 ‘‘(A) IN GENERAL.—Such regulations shall 24 require a covered entity that has actual or con- 25 VerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703 pamtmann on DSKBC07HB2PROD with BILLS 13 •HR 5703 IH structive knowledge that such covered entity is 1 processing covered information about a young 2 consumer or child— 3 ‘‘(i) to provide clear and concise no- 4 tice to a young consumer or the parent of 5 a child of the items of covered information 6 about such young consumer or child, re- [Text truncated for display. Full text available on Congress.gov.]