Data Protection Act of 2020

II 116TH CONGRESS 2D SESSION S. 3300 To establish a Federal data protection agency, and for other purposes. IN THE SENATE OF THE UNITED STATES FEBRUARY 13, 2020 Mrs. GILLIBRAND introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To establish a Federal data protection agency, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) IN GENERAL.—This Act may be cited as the 4 ‘‘Data Protection Act of 2020’’. 5 (b) TABLE OF CONTENTS.—The table of contents of 6 this Act is as follows: 7 Sec. 1. Short title; table of contents. Sec. 2. Findings and purpose. Sec. 3. Definitions. Sec. 4. Establishment of the Data Protection Agency. Sec. 5. Executive and administrative powers. Sec. 6. Purpose, objectives, and functions of the Agency. Sec. 7. Rulemaking authority. Sec. 8. Specific agency authorities. VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 2 •S 3300 IS Sec. 9. Enforcement powers. Sec. 10. Preservation of State law. Sec. 11. Reports and information. Sec. 12. Transfers of functions. Sec. 13. Authorization of appropriations. SEC. 2. FINDINGS AND PURPOSE. 1 (a) FINDINGS.—Congress finds the following: 2 (1) Privacy is an important fundamental indi- 3 vidual right protected by the Constitution of the 4 United States. 5 (2) The right of privacy is widely recognized in 6 international legal instruments that the United 7 States has endorsed, ratified, or promoted. 8 (3) The right to privacy protects the individual 9 against intrusions into seclusion, protects individual 10 autonomy, safeguards fair processing of data that 11 pertains to the individual, advances the just proc- 12 essing of data, and contributes to respect for indi- 13 vidual civil rights and fundamental freedoms. 14 (4) Privacy protections not only protect and 15 benefit the individual, but they also advance other 16 societal interests, including the protection of 17 marginalized and vulnerable groups of individuals, 18 the safeguarding of other foundational values of our 19 democracy, such as freedom of information, freedom 20 of speech, justice, and human ingenuity and dignity, 21 as well as the integrity of democratic institutions, in- 22 cluding fair and open elections. 23 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 3 •S 3300 IS (5) The privacy of an individual is directly af- 1 fected by the collection, maintenance, use, and dis- 2 semination of personal data. 3 (6) The increasing digitalization of information 4 and its application in classifying individuals and 5 groups of individuals has greatly magnified the harm 6 to individual privacy that can occur from the collec- 7 tion, maintenance, use, or dissemination of personal 8 data. 9 (7) The opportunities for an individual to se- 10 cure employment, insurance, credit, and housing and 11 the right to due process and other legal protections 12 are endangered by the unrestricted collection, disclo- 13 sure, processing, and misuse of personal data. 14 (8) Information systems lacking privacy protec- 15 tion amplify bias. 16 (9) In order to protect the privacy of individ- 17 uals, it is necessary and proper for Congress to reg- 18 ulate the collection, maintenance, use, processing, 19 storage, and dissemination of information. 20 (b) PURPOSE.—The purpose of this Act is to estab- 21 lish a data protection agency to— 22 (1) safeguard privacy, promote innovation, en- 23 sure compliance with the law, and promote best 24 practices; 25 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 4 •S 3300 IS (2) provide guidance on matters related to elec- 1 tronic data storage, communication, and usage; 2 (3) provide the public with information and 3 guidance on privacy protections and fair information 4 practices and principles; 5 (4) oversee Federal agencies’ implementation of 6 section 552a of title 5, United States Code; 7 (5) promote implementation of fair information 8 practices in the public and private sector; and 9 (6) represent the United States in international 10 forums. 11 SEC. 3. DEFINITIONS. 12 In this Act: 13 (1) AGENCY.—The term ‘‘Agency’’ means the 14 Data Protection Agency established under section 4. 15 (2) COVERED ENTITY.—The term ‘‘covered en- 16 tity’’ means any person that collects, processes, or 17 otherwise obtains personal data with the exception of 18 an individual processing personal data in the course 19 of personal or household activity. 20 (3) FEDERAL PRIVACY LAW.— 21 (A) IN GENERAL.—The term ‘‘Federal pri- 22 vacy law’’ means the provisions of this Act, the 23 laws specified in subparagraph (B), and any 24 rule or order prescribed by the Agency under 25 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 5 •S 3300 IS this Act or pursuant to the authorities trans- 1 ferred under this Act. Such term shall not in- 2 clude the Federal Trade Commission Act (15 3 U.S.C. 41 et seq.). 4 (B) SPECIFIED LAWS.—The laws specified 5 in this subparagraph are the following laws (in- 6 cluding any amendments made by such laws): 7 (i) The Children’s Online Privacy Pro- 8 tection Act (15 U.S.C. 6501 et seq.). 9 (ii) The CAN–SPAM Act of 2003 (15 10 U.S.C 7701 et seq.). 11 (iii) The Do-Not-Call Implementation 12 Act (15 U.S.C. 6152 et seq.) and Public 13 Law 108–82 (15 U.S.C. 6151). 14 (iv) The Fair Credit Reporting Act 15 (15 U.S.C. 1681 et seq.). 16 (v) Title V of the Gramm-Leach-Bli- 17 ley Act (15 U.S.C. 6801 et seq.). 18 (vi) Subtitle D of the Health Informa- 19 tion Technology for Economic and Clinical 20 Health Act (42 U.S.C. 17921 et seq.). 21 (vii) The Identity Theft Assumption 22 and Deterrence Act of 1998 (Pub. L. 105– 23 318). 24 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 6 •S 3300 IS (viii) The Telemarketing and Con- 1 sumer Fraud and Abuse Prevention Act 2 (15 U.S.C. 6101 et seq.). 3 (ix) Section 227 of the Communica- 4 tions Act of 1934 (47 U.S.C. 227) (com- 5 monly known as the ‘‘Telephone Consumer 6 Protection Act of 1991’’). 7 (4) HIGH-RISK DATA PRACTICE.—The term 8 ‘‘high-risk data practice’’ means an action by a cov- 9 ered entity that involves— 10 (A) a systematic or extensive evaluation of 11 personal data that is based on automated proc- 12 essing, including profiling, and on which deci- 13 sions are based that produce legal effects con- 14 cerning the individual or household or similarly 15 significantly affect the individual or household; 16 (B) sensitive data uses; 17 (C) a systemic monitoring of publicly ac- 18 cessible data on a large scale; 19 (D) processing involving the use of new 20 technologies, or combinations of technologies, 21 that creates adverse consequences or potential 22 adverse consequences to an individual or soci- 23 ety; 24 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 7 •S 3300 IS (E) decisions about an individual’s access 1 to a product, service, opportunity, or benefit 2 which is based to any extent on automated 3 processing; 4 (F) any profiling of individuals on a large 5 scale; 6 (G) any processing of biometric data for 7 the purpose of uniquely identifying an indi- 8 vidual; 9 (H) any processing of genetic data, other 10 than data processed by a health care profes- 11 sional for the purpose of providing health care 12 to the individual; 13 (I) combining, comparing, or matching 14 personal data obtained from multiple sources; 15 (J) processing the personal data of an in- 16 dividual that has not been obtained directly 17 from the individual; 18 (K) processing which involves tracking an 19 individual’s geolocation; or 20 (L) the use of personal data of children or 21 other vulnerable individuals for marketing pur- 22 poses, profiling, or automated processing. 23 (5) PERSONAL DATA.—The term ‘‘personal 24 data’’ means any information that identifies, relates 25 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 8 •S 3300 IS to, describes, is capable of being associated with, or 1 could reasonably be linked, directly or indirectly, 2 with a particular individual or device, including— 3 (A) an identifier such as a real name, 4 alias, signature, date of birth, gender identity, 5 sexual orientation, marital status, physical 6 characteristic or description, postal address, 7 telephone number, unique personal identifier, 8 military identification number, online identifier, 9 Internet Protocol address, email address, ac- 10 count name, mother’s maiden name, social secu- 11 rity number, driver’s license number, passport 12 number, or other similar identifiers; 13 (B) information such as employment sta- 14 tus, employment history, or other professional 15 or employment-related information; 16 (C) bank account number, credit card 17 number, debit card number, insurance policy 18 number, or any other financial information; 19 (D) medical information, mental health in- 20 formation, or health insurance information; 21 (E) commercial information, including 22 records of personal property, products or serv- 23 ices purchased, obtained, or considered, or other 24 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 9 •S 3300 IS purchasing or consuming histories or ten- 1 dencies; 2 (F) characteristics of protected classes 3 under Federal law, including race, color, na- 4 tional origin, religion, sex, age, or disability; 5 (G) biometric information; 6 (H) internet or other electronic network 7 activity information, including browsing history, 8 search history, content, and information regard- 9 ing an individual’s interaction with an internet 10 website, mobile application, or advertisement; 11 (I) historical or real-time geolocation data; 12 (J) audio, electronic, visual, thermal, olfac- 13 tory, or similar information; 14 (K) education records; 15 (L) political information; 16 (M) password-protected digital photo- 17 graphs and digital videos not otherwise avail- 18 able to the public; 19 (N) information on criminal convictions or 20 arrests; 21 (O) information (such as an Internet Pro- 22 tocol address or other similar identifier) that al- 23 lows an individual or device to be singled out 24 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 10 •S 3300 IS for interaction, even without identification of 1 such individual or device; and 2 (P) inferences drawn from any of the in- 3 formation identified in this subparagraph to 4 create a profile about an individual reflecting 5 the individual’s preferences, characteristics, 6 psychological trends, predispositions, behavior, 7 attitudes, intelligence, abilities, and aptitudes. 8 (6) PROCESS.—The term ‘‘process’’ means to 9 perform an operation or set of operations on per- 10 sonal data, either manually or by automated means, 11 including but not limited to collecting, recording, or- 12 ganizing, structuring, storing, adapting or altering, 13 retrieving, consulting, using, disclosing by trans- 14 mission, sorting, classifying, disseminating or other- 15 wise making available, aligning or combining, re- 16 stricting, erasing or destroying. 17 (7) PROFILE.—The term ‘‘profile’’ means the 18 use of an automated means to process data (includ- 19 ing personal data and other data) to derive, infer, 20 predict, or evaluate information about an individual 21 or group, such as the processing of data to analyze 22 or predict an individual’s identity, attributes, inter- 23 ests, or behavior. 24 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 11 •S 3300 IS (8) SENSITIVE DATA USE.—The term ‘‘sensitive 1 data use’’ means— 2 (A) the processing of data in a manner 3 that reveals an individual’s race, color, eth- 4 nicity, religion or creed, national origin or an- 5 cestry, sex, gender, gender identity, sexuality, 6 sexual orientation, political beliefs, trade union 7 membership, familial status, lawful source of in- 8 come, financial status (such as the individual’s 9 income or assets), veteran status, criminal con- 10 victions or arrests, citizenship, past, present, or 11 future physical or mental health or condition, 12 psychological states, disability, geospatial data, 13 or any other factor used as a proxy for identi- 14 fying any of these characteristics; or 15 (B) the use of the biometric or genetic 16 data of an individual. 17 (9) TRANSFER DATE.—The term ‘‘transfer 18 date’’ means the date that is 1 year after the date 19 of enactment of this Act. 20 SEC. 4. ESTABLISHMENT OF THE DATA PROTECTION AGEN- 21 CY. 22 (a) ESTABLISHMENT.— 23 (1) IN GENERAL.—There is established in the 24 Executive branch an agency to be known as the 25 VerDate Sep 11 2014 02:49 Feb 15, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S3300.IS S3300 kjohnson on DSK79L0C42PROD with BILLS 12 •S 3300 IS ‘‘Data Protection Agency’’ which shall regulate the 1 processing of personal data. 2 (2) STATUS.—The Agency shall be an inde- 3 pendent establishment (as defined in section 104 of 4 title 5, United States Code). 5 (b) DIRECTOR AND DEPUTY DIRECTOR.— 6 (1) IN GENERAL.—There is established a posi- 7 tion of the Director of the United States Data Pro- 8 tection Agency (referred to in this Act as the ‘‘Di- 9 rector’’), who shall serve as the head of the Agency. 10 (2) APPOINTMENT.—Subject to paragraph (3), 11 the Director shall be appointed by the President, by 12 and with the advice and consent of the Senate. 13 (3) QUALIFICATION.—The President shall 14 nominate the Director from among members of the 15 public at large who are well qualified for service on 16 the Agency by virtue of their knowledge and exper- 17 tise in— 18 (A) technology; 19 (B) protection of personal data; 20 (C) civil rights and liberties; 21 (D) law; 22 (E) social sciences; and 23 (F) business. 24 (4) COMPENSATION.— 25 VerDate Sep 11 20 [Text truncated for display. Full text available on Congress.gov.]