SAFE DATA Act

II 116TH CONGRESS 2D SESSION S. 4626 To establish data privacy and data security protections for consumers in the United States. IN THE SENATE OF THE UNITED STATES SEPTEMBER 17, 2020 Mr. WICKER (for himself, Mr. THUNE, Mrs. BLACKBURN, and Mrs. FISCHER) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To establish data privacy and data security protections for consumers in the United States. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Setting an American Framework to Ensure Data Access, 5 Transparency, and Accountability Act’’ or the ‘‘SAFE 6 DATA Act’’. 7 (b) TABLE OF CONTENTS.—The table of contents for 8 this Act is as follows: 9 Sec. 1. Short title; table of contents. Sec. 2. Definitions. VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 2 •S 4626 IS Sec. 3. Effective date. TITLE I—INDIVIDUAL CONSUMER DATA RIGHTS Sec. 101. Consumer loyalty. Sec. 102. Transparency. Sec. 103. Individual control. Sec. 104. Rights to consent. Sec. 105. Minimizing data collection, processing, and retention. Sec. 106. Service providers and third parties. Sec. 107. Privacy impact assessments. Sec. 108. Scope of coverage. TITLE II—DATA TRANSPARENCY, INTEGRITY, AND SECURITY Sec. 201. Algorithm bias, detection, and mitigation. Sec. 202. Digital content forgeries. Sec. 203. Data brokers. Sec. 204. Protection of covered data. Sec. 205. Filter bubble transparency. Sec. 206. Unfair and deceptive acts and practices relating to the manipulation of user interfaces. TITLE III—CORPORATE ACCOUNTABILITY Sec. 301. Designation of data privacy officer and data security officer. Sec. 302. Internal controls. Sec. 303. Whistleblower protections. TITLE IV—ENFORCEMENT AUTHORITY AND NEW PROGRAMS Sec. 401. Enforcement by the Federal Trade Commission. Sec. 402. Enforcement by State attorneys general. Sec. 403. Authority of Commission to seek permanent injunction and other eq- uitable remedies. Sec. 404. Approved certification programs. Sec. 405. Relationship between Federal and State law. Sec. 406. Constitutional avoidance. Sec. 407. Severability. SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) AFFIRMATIVE EXPRESS CONSENT.—The 3 term ‘‘affirmative express consent’’ means, upon 4 being presented with a clear and conspicuous de- 5 scription of an act or practice for which consent is 6 sought, an affirmative act by the individual clearly 7 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 3 •S 4626 IS communicating the individual’s authorization for the 1 act or practice. 2 (2) ALGORITHM.—The term ‘‘algorithm’’ means 3 a computational process derived from machine learn- 4 ing, statistics, or other data processing or artificial 5 intelligence techniques, that processes covered data 6 for the purpose of making a decision or facilitating 7 human decision making. 8 (3) ALGORITHMIC RANKING SYSTEM.—The 9 term ‘‘algorithmic ranking system’’ means a com- 10 putational process, including one derived from algo- 11 rithmic decision making, machine learning, statis- 12 tical analysis, or other data processing or artificial 13 intelligence techniques, used to determine the order 14 or manner that a set of information is provided to 15 a user on a covered internet platform, including the 16 ranking of search results, the provision of content 17 recommendations, the display of social media posts, 18 or any other method of automated content selection. 19 (4) BEHAVIORAL OR PSYCHOLOGICAL EXPERI- 20 MENTS OR RESEARCH.—The term ‘‘behavioral or 21 psychological experiments or research’’ means the 22 study, including through human experimentation, of 23 overt or observable actions and mental phenomena 24 inferred from behavior, including interactions be- 25 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 4 •S 4626 IS tween and among individuals and the activities of so- 1 cial groups. 2 (5) COLLECTION.—The term ‘‘collection’’ 3 means buying, renting, gathering, obtaining, receiv- 4 ing, or accessing any covered data of an individual 5 by any means. 6 (6) COMMISSION.—The term ‘‘Commission’’ 7 means the Federal Trade Commission. 8 (7) COMMON BRANDING.—The term ‘‘common 9 branding’’ means a shared name, servicemark, or 10 trademark. 11 (8) COMPULSIVE USAGE.—The term ‘‘compul- 12 sive usage’’ means any response stimulated by exter- 13 nal factors that causes an individual to engage in re- 14 petitive, purposeful, and intentional behavior causing 15 psychological distress, loss of control, anxiety, de- 16 pression, or harmful stress responses. 17 (9) CONNECTED DEVICE.—For purposes of 18 paragraphs (20) and (37), the term ‘‘connected de- 19 vice’’ means a physical object that— 20 (A) is capable of connecting to the inter- 21 net, either directly or indirectly through a net- 22 work, to communicate information at the direc- 23 tion of an individual; and 24 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 5 •S 4626 IS (B) has computer processing capabilities 1 for collecting, sending, receiving, or analyzing 2 data. 3 (10) COVERED DATA.— 4 (A) IN GENERAL.—The term ‘‘covered 5 data’’ means information that identifies or is 6 linked or reasonably linkable to an individual or 7 a device that is linked or reasonably linkable to 8 an individual. 9 (B) LINKED OR REASONABLY LINKABLE.— 10 For purposes of subparagraph (A), information 11 held by a covered entity is linked or reasonably 12 linkable to an individual or a device if, as a 13 practical matter, it can be used on its own or 14 in combination with other information held by, 15 or readily accessible to, the covered entity to 16 identify such individual or such device. 17 (C) EXCLUSIONS.—Such term does not in- 18 clude— 19 (i) aggregated data; 20 (ii) de-identified data; 21 (iii) employee data; or 22 (iv) publicly available information. 23 (D) AGGREGATED DATA.—For purposes of 24 subparagraph (C), the term ‘‘aggregated data’’ 25 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 6 •S 4626 IS means information that relates to a group or 1 category of individuals or devices that does not 2 identify and is not linked or reasonably linkable 3 to any individual. 4 (E) DE-IDENTIFIED DATA.—For purposes 5 of subparagraph (C), the term ‘‘de-identified 6 data’’ means information held by a covered en- 7 tity that— 8 (i) does not identify, and is not linked 9 or reasonably linkable to, an individual or 10 device; 11 (ii) does not contain any persistent 12 identifier or other information that could 13 readily be used to re-identify the individual 14 to whom, or the device to which, the identi- 15 fier or information pertains; 16 (iii) is subject to a public commitment 17 by the covered entity— 18 (I) to refrain from attempting to 19 use such information to identify any 20 individual or device; and 21 (II) to adopt technical and orga- 22 nizational measures to ensure that 23 such information is not linked to any 24 individual or device; and 25 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 7 •S 4626 IS (iv) is not disclosed by the covered en- 1 tity to any other party unless the disclo- 2 sure is subject to a contractually or other 3 legally binding requirement that— 4 (I) the recipient of the informa- 5 tion shall not use the information to 6 identify any individual or device; and 7 (II) all onward disclosures of the 8 information shall be subject to the re- 9 quirement described in subclause (I). 10 (F) EMPLOYEE DATA.—For purposes of 11 subparagraph (C), the term ‘‘employee data’’ 12 means— 13 (i) information relating to an indi- 14 vidual collected by a covered entity in the 15 course of the individual acting as a job ap- 16 plicant to, or employee (regardless of 17 whether such employee is paid or unpaid, 18 or employed on a temporary basis), owner, 19 director, officer, staff member, trainee, 20 vendor, visitor, volunteer, intern, or con- 21 tractor of, the entity, provided that such 22 information is collected, processed, or 23 transferred by the covered entity solely for 24 purposes related to the individual’s status 25 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 8 •S 4626 IS as a current or former job applicant to, or 1 an employee, owner, director, officer, staff 2 member, trainee, vendor, visitor, volunteer, 3 intern, or contractor of, that covered enti- 4 ty; 5 (ii) business contact information of an 6 individual, including the individual’s name, 7 position or title, business telephone num- 8 ber, business address, business email ad- 9 dress, qualifications, and other similar in- 10 formation, that is provided to a covered en- 11 tity by an individual who is acting in a 12 professional capacity, provided that such 13 information is collected, processed, or 14 transferred solely for purposes related to 15 such individual’s professional activities; 16 (iii) emergency contact information 17 collected by a covered entity that relates to 18 an individual who is acting in a role de- 19 scribed in clause (i) with respect to the 20 covered entity, provided that such informa- 21 tion is collected, processed, or transferred 22 solely for the purpose of having an emer- 23 gency contact on file for the individual; or 24 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 9 •S 4626 IS (iv) information relating to an indi- 1 vidual (or a relative or beneficiary of such 2 individual) that is necessary for the cov- 3 ered entity to collect, process, or transfer 4 for the purpose of administering benefits 5 to which such individual (or relative or 6 beneficiary of such individual) is entitled 7 on the basis of the individual acting in a 8 role described in clause (i) with respect to 9 the entity, provided that such information 10 is collected, processed, or transferred solely 11 for the purpose of administering such ben- 12 efits. 13 (G) PUBLICLY AVAILABLE INFORMA- 14 TION.— 15 (i) IN GENERAL.—For the purposes of 16 subparagraph (C), the term ‘‘publicly 17 available information’’ means any informa- 18 tion that a covered entity has a reasonable 19 basis to believe— 20 (I) has been lawfully made avail- 21 able to the general public from Fed- 22 eral, State, or local government 23 records; 24 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 10 •S 4626 IS (II) is widely available to the 1 general public, including information 2 from— 3 (aa) a telephone book or on- 4 line directory; 5 (bb) television, internet, or 6 radio content or programming; or 7 (cc) the news media or a 8 website that is lawfully available 9 to the general public on an unre- 10 stricted basis (for purposes of 11 this subclause a website is not re- 12 stricted solely because there is a 13 fee or log-in requirement associ- 14 ated with accessing the website); 15 or 16 (III) is a disclosure to the gen- 17 eral public that is required to be made 18 by Federal, State, or local law. 19 (ii) EXCLUSIONS.—Such term does 20 not include an obscene visual depiction (as 21 defined for purposes of section 1460 of 22 title 18, United States Code). 23 (11) COVERED ENTITY.—The term ‘‘covered 24 entity’’ means any person that— 25 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 11 •S 4626 IS (A) is subject to the Federal Trade Com- 1 mission Act (15 U.S.C. 41 et seq.) or is— 2 (i) a common carrier described in sec- 3 tion 5(a)(2) of such Act (15 U.S.C. 4 45(a)(2)); or 5 (ii) an organization not organized to 6 carry on business for their own profit or 7 that of their members; 8 (B) collects, processes, or transfers covered 9 data; and 10 (C) determines the purposes and means of 11 such collection, processing, or transfer. 12 (12) COVERED INTERNET PLATFORM.— 13 (A) IN GENERAL.—The term ‘‘covered 14 internet platform’’ means any public-facing 15 website, internet application, or mobile applica- 16 tion, including a social network site, video shar- 17 ing service, search engine, or content aggrega- 18 tion service. 19 (B) EXCLUSIONS.—Such term shall not in- 20 clude a platform that— 21 (i) is wholly owned, controlled, and 22 operated by a person that— 23 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 12 •S 4626 IS (I) for the most recent 6-month 1 period, did not employ more than 500 2 employees; 3 (II) for the most recent 3-year 4 period, averaged less than 5 $50,000,000 in annual gross receipts; 6 and 7 (III) collects or processes on an 8 annual basis the personal data of less 9 than 1,000,000 individuals; or 10 (ii) is operated for the sole purpose of 11 conducting research that is not made for 12 profit either directly or indirectly. 13 (13) DATA BROKER.— 14 (A) IN GENERAL.—The term ‘‘data 15 broker’’ means a covered entity whose principal 16 source of revenue is derived from processing or 17 transferring the covered data of individuals with 18 whom the entity does not have a direct relation- 19 ship on behalf of third parties for such third 20 parties’ use. 21 (B) EXCLUSION.—Such term does not in- 22 clude a service provider. 23 (14) DELETE.—The term ‘‘delete’’ means to re- 24 move or destroy information such that it is not 25 VerDate Sep 11 2014 22:43 Oct 10, 2020 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S4626.IS S4626 pbinns on DSKJLVW7X2PROD with BILLS 13 •S 4626 IS maintained in human or machine readable form and 1 cannot be retrieved or utilized in such form in the 2 normal course of business. 3 (15) EXECUTIVE AGENCY.—The term ‘‘Execu- 4 tive agency’’ has the meaning set forth in section 5 105 of title 5, United States Code. 6 (16) INDEPENDENT REVIEW BOARD.—The term 7 ‘‘independent review bo [Text truncated for display. Full text available on Congress.gov.]