Online Privacy Act of 2023

I 118TH CONGRESS 1ST SESSION H. R. 2701 To provide for individual rights relating to privacy of personal information, to establish privacy and security requirements for covered entities relating to personal information, and to establish an agency to be known as the Digital Privacy Agency to enforce such rights and requirements, and for other purposes. IN THE HOUSE OF REPRESENTATIVES APRIL 19, 2023 Ms. ESHOO (for herself and Ms. LOFGREN) introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committees on the Judiciary, House Administration, and Science, Space, and Technology, for a period to be subsequently deter- mined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To provide for individual rights relating to privacy of per- sonal information, to establish privacy and security re- quirements for covered entities relating to personal infor- mation, and to establish an agency to be known as the Digital Privacy Agency to enforce such rights and re- quirements, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 2 •HR 2701 IH SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 1 (a) SHORT TITLE.—This Act may be cited as the 2 ‘‘Online Privacy Act of 2023’’. 3 (b) TABLE OF CONTENTS.—The table of contents for 4 this Act is as follows: 5 Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. General provisions. Sec. 4. Limitation on disclosing nonredacted government records. Sec. 5. Privacy considerations for legislative branch agencies. Sec. 6. Criminal prohibition on doxxing. TITLE I—INDIVIDUAL RIGHTS Sec. 101. Right of access. Sec. 102. Right of correction. Sec. 103. Right of deletion. Sec. 104. Right of portability. Sec. 105. Right to human review of automated decisions. Sec. 106. Right to individual autonomy. Sec. 107. Right to be informed. Sec. 108. Right to impermanence. Sec. 109. Exemptions, exceptions, fees, timelines, and rules of construction for rights under this title. TITLE II—REQUIREMENTS FOR COVERED ENTITIES, SERVICE PROVIDERS, AND THIRD PARTIES Sec. 201. Minimization. Sec. 202. Minimization and records of access by employees and contractors. Sec. 203. Prohibitions on disclosing of personal information. Sec. 204. Disclosing to entities not subject to United States jurisdiction or not compliant with this Act. Sec. 205. Prohibition on re-identification. Sec. 206. Restrictions on collecting, processing, maintaining, and disclosing contents of communications. Sec. 207. Prohibition on discriminatory processing. Sec. 208. Requirements for notice and consent processes and privacy policies. Sec. 209. Prohibition on ‘‘dark patterns’’ in notice and consent processes and privacy policies. Sec. 210. Notice and consent required. Sec. 211. Privacy policy. Sec. 212. Information security requirements. Sec. 213. Notification of data breach or data-sharing abuse. TITLE III—DIGITAL PRIVACY AGENCY Sec. 301. Establishment; Director and Deputy Director. Sec. 302. Agency powers and authorities. Sec. 303. Reporting and audit requirements. Sec. 304. Relation to other agencies. VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6211 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 3 •HR 2701 IH Sec. 305. Personnel. Sec. 306. Office of Civil Rights. Sec. 307. Complaints of individuals. Sec. 308. Advisory boards. Sec. 309. Authorization of appropriations. TITLE IV—ENFORCEMENT Sec. 401. Investigations and administrative discovery. Sec. 402. Hearings and adjudication proceedings. Sec. 403. Litigation authority. Sec. 404. Enforcement by States. Sec. 405. Private rights of action. Sec. 406. Relief available. Sec. 407. Referral for criminal proceedings. Sec. 408. Whistleblower enforcement. TITLE V—RELATION TO OTHER LAW Sec. 501. Effective date. Sec. 502. Relation to other Federal law. Sec. 503. Relation to State law. Sec. 504. Severability. TITLE VI—NIST AND NSF ACTIVITIES Sec. 601. National Institute of Standards and Technology privacy research and development. Sec. 602. National privacy awareness and education initiative. Sec. 603. National Science Foundation privacy research. SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) AGENCY.—The term ‘‘Agency’’ means the 3 Digital Privacy Agency established in section 301. 4 (2) AGENCY INVESTIGATOR.—The term ‘‘Agen- 5 cy investigator’’ means any attorney or investigator 6 employed by the Agency who is charged with the 7 duty of enforcing or carrying into effect any provi- 8 sion of this Act or a rule or order prescribed under 9 this Act. 10 (3) BEHAVIORAL PERSONALIZATION.— 11 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 4 •HR 2701 IH (A) IN GENERAL.—The term ‘‘behavioral 1 personalization’’ means the processing of an in- 2 dividual’s personal information, using an algo- 3 rithm, model, or other means— 4 (i) built using— 5 (I) that individual’s personal in- 6 formation collected over a period of 7 time; or 8 (II) an aggregate of the informa- 9 tion of one or more similarly situated 10 individuals; and 11 (ii) designed to— 12 (I) alter, influence, guide, or pre- 13 dict that individual’s behavior; 14 (II) tailor or personalize a prod- 15 uct or service to that individual; or 16 (III) filter, sort, limit, promote, 17 display or otherwise differentiate be- 18 tween specific content or categories of 19 content that would otherwise be acces- 20 sible to that individual. 21 (B) EXCLUSIONS.—The term ‘‘behavioral 22 personalization’’ does not include the use of his- 23 torical personal information to merely prevent 24 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 5 •HR 2701 IH the display of or provide additional information 1 about previously accessed content. 2 (4) COLLECT.—The term ‘‘collect’’ includes, 3 with respect to personal information or the contents 4 of any communication, obtaining such information or 5 contents in any manner, except when solely trans- 6 mitting, routing, providing intermediate storage for, 7 or providing connections for such personal informa- 8 tion or communication through a system or network. 9 (5) COMMISSION.—The term ‘‘Commission’’ 10 means the Federal Trade Commission. 11 (6) CONTENTS.—The term ‘‘contents’’, when 12 used with respect to communication, has the mean- 13 ing given such term in section 2510 of title 18, 14 United States Code. 15 (7) COVERED ENTITY.— 16 (A) IN GENERAL.—The term ‘‘covered en- 17 tity’’ means a person who— 18 (i) intentionally collects, processes, or 19 maintains personal information; and 20 (ii) sends or receives such personal in- 21 formation over the internet or a similar 22 communications network. 23 (B) EXCLUSION.—The term ‘‘covered enti- 24 ty’’ does not include a natural person, except to 25 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 6 •HR 2701 IH the extent such person is engaged in a commer- 1 cial activity that is more than de minimis. 2 (8) CUSTODIAN.—The term ‘‘custodian’’ means 3 the custodian or any deputy custodian designated by 4 the Agency. 5 (9) DATA BREACH.—The term ‘‘data breach’’ 6 means unauthorized access to or acquisition of per- 7 sonal information or contents of communications 8 maintained by such covered entity. 9 (10) DATA-SHARING ABUSE.—The term ‘‘data- 10 sharing abuse’’ means processing, by a third party, 11 of personal information or contents of communica- 12 tions disclosed by a covered entity to the third party, 13 for any purpose other than— 14 (A) a purpose specified by the covered en- 15 tity to the third party at the time such personal 16 information or contents of communications was 17 disclosed; or 18 (B) a purpose to which the individual to 19 whom the information relates has consented. 20 (11) DE-IDENTIFY.— 21 (A) IN GENERAL.—The term ‘‘de-identify’’ 22 means, with respect to information, performing 23 actions so that such information cannot reason- 24 ably identify, relate to, describe, reference, be 25 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 7 •HR 2701 IH capable of being associated with, or be linked, 1 directly or indirectly, to a particular individual 2 or device, but only to the extent that the cov- 3 ered entity that uses such information— 4 (i) has performed such actions using 5 best practices for the types of data such 6 information contains; 7 (ii) has implemented technical safe- 8 guards that prohibit re-identification of the 9 individual with whom such information was 10 linked; 11 (iii) has implemented business proc- 12 esses that specifically prohibit re-identifica- 13 tion of the information; 14 (iv) has implemented business proc- 15 esses to prevent inadvertent release of such 16 information; and 17 (v) makes no attempt to re-identify 18 such information. 19 (B) DETERMINATION BY THE DIRECTOR.— 20 The Director may determine that a method- 21 ology of de-identifying personal information is 22 insufficient for the purposes of this paragraph. 23 (12) DIRECTOR.—The term ‘‘Director’’ means 24 the Director of the Agency. 25 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 8 •HR 2701 IH (13) DISCLOSE.—The term ‘‘disclose’’ means, 1 with respect to personal information or contents of 2 communication, to sell, release, transfer, share, dis- 3 seminate, make available, or otherwise cause to be 4 communicated, such information or contents to a 5 third party. 6 (14) DOCUMENTARY MATERIAL.—The term 7 ‘‘documentary material’’ includes the original or any 8 copy of any book, document, record, report, memo- 9 randum, paper, communication, tabulation, chart, 10 logs, electronic files, or other data or data compila- 11 tions stored in any medium. 12 (15) FEDERAL AGENCY.—The term ‘‘Federal 13 agency’’ has the meaning given to the term ‘‘agen- 14 cy’’ in section 3371 of title 5, United States Code. 15 (16) FEDERAL PRIVACY LAWS.—The term 16 ‘‘Federal privacy laws’’ includes the laws and regula- 17 tions described in section 502. 18 (17) GOVERNMENT ENTITY.—The term ‘‘gov- 19 ernment entity’’ means— 20 (A) a Federal agency; 21 (B) a State or political subdivision thereof; 22 (C) or any agency, authority, or instru- 23 mentality of a State or political subdivision 24 thereof. 25 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 9 •HR 2701 IH (18) INDIVIDUAL.—The term ‘‘individual’’ 1 means a natural person residing in the United 2 States. 3 (19) INDIAN TRIBE.—The term ‘‘Indian Tribe’’ 4 has the meaning given such term in section 4(e) of 5 the Indian Self-Determination and Education Assist- 6 ance Act (25 U.S.C. 5304(e)). 7 (20) MAINTAIN.—The term ‘‘maintain’’ means, 8 with respect to personal information or the contents 9 of any communication, to store, secure, or otherwise 10 cause the retention of such information or contents, 11 or to take actions necessary for storing, securing, or 12 otherwise causing the retention of such information 13 or contents. 14 (21) NONPUBLIC INFORMATION.—The term 15 ‘‘nonpublic information’’ means information that has 16 not been disclosed in a criminal, civil, or administra- 17 tive proceeding, in a government investigation, re- 18 port, or audit, or by the news media or other public 19 source of information, and that was not obtained in 20 violation of the law. 21 (22) PERSONAL INFORMATION.— 22 (A) IN GENERAL.—The term ‘‘personal in- 23 formation’’ means any information maintained 24 by a covered entity that, on its own or com- 25 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 10 •HR 2701 IH bined with other information, is linked or rea- 1 sonably linkable to a specific individual or a 2 specific device, including de-identified personal 3 information and the means to behavioral per- 4 sonalization created for or linked to a specific 5 individual. 6 (B) EXCLUSIONS.—The term ‘‘personal in- 7 formation’’ does not include— 8 (i) publicly available information 9 linked to an individual; or 10 (ii) information derived or inferred 11 from personal information, if the derived 12 or inferred information is not linked or 13 reasonably linkable to a specific individual. 14 (23) PRIVACY HARM.—The term ‘‘privacy 15 harm’’ means an adverse consequence or a potential 16 adverse consequence to an individual, a group of in- 17 dividuals, or society caused from collecting, proc- 18 essing, maintaining, or disclosing of personal infor- 19 mation or contents of communications, including— 20 (A) direct or indirect financial loss or eco- 21 nomic harm; 22 (B) physical harm; 23 (C) psychological harm, including anxiety, 24 embarrassment, fear, and other trauma; 25 VerDate Sep 11 2014 02:53 Apr 27, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H2701.IH H2701 pbinns on DSKJLVW7X2PROD with $$_JOB 11 •HR 2701 IH (D) adverse outcomes or decisions with re- 1 spect to the eligibility of an individual for 2 rights, benefits, or privileges in employment (in- 3 cluding hiring, firing, promotion, demotion, and 4 compensation), credit and insurance (including 5 denial of an application or obtaining less favor- 6 able terms), housing, education, professional 7 certification, or the provision of health care and 8 related services; 9 (E) stigmatization or reputational harm; 10 (F) price discrimination; 11 (G) adverse consequences that affect the 12 private life of an individual, including private 13 family matters and actions and communications 14 within the home of such individual or a similar 15 physical, online, or digital location where such 16 individual has a reasonable expectation that 17 personal information will not be collected, proc- 18 essed, or maintained; 19 (H) the chilling of free expression or action 20 of an individual, a group of individuals, or soci- 21 ety, due to perceived or actual pervasive and ex- 22 cessive collecting, processing, disclosing, or 23 maintaining of personal inform [Text truncated for display. Full text available on Congress.gov.]