My Body, My Data Act of 2023

II 118TH CONGRESS 1ST SESSION S. 1656 To protect the privacy of personal reproductive or sexual health information, and for other purposes. IN THE SENATE OF THE UNITED STATES MAY 17, 2023 Ms. HIRONO (for herself, Mr. WYDEN, Ms. BALDWIN, Mr. BLUMENTHAL, Mr. BROWN, Ms. CANTWELL, Ms. DUCKWORTH, Mrs. GILLIBRAND, Ms. KLO- BUCHAR, Mr. MERKLEY, Mr. MENENDEZ, Mrs. SHAHEEN, and Ms. SMITH) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To protect the privacy of personal reproductive or sexual health information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘My Body, My Data 4 Act of 2023’’. 5 SEC. 2. MINIMIZATION. 6 (a) MINIMIZATION OF COLLECTING, RETAINING, 7 USING, AND DISCLOSING.—A regulated entity may not 8 collect, retain, use, or disclose personal reproductive or 9 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1656 IS sexual health information, except as is strictly necessary 1 to provide a product or service that the individual to whom 2 such information relates has requested from such regu- 3 lated entity. 4 (b) MINIMIZATION OF EMPLOYEE ACCESS.—A regu- 5 lated entity shall restrict access to personal reproductive 6 or sexual health information by the employees or service 7 providers of such regulated entity to such employees or 8 service providers for which access is necessary to provide 9 a product or service that the individual to whom such in- 10 formation relates has requested from such regulated enti- 11 ty. 12 SEC. 3. RIGHT OF ACCESS, CORRECTION, AND DELETION. 13 (a) RIGHT OF ACCESS.— 14 (1) IN GENERAL.—A regulated entity shall 15 make available a reasonable mechanism by which an 16 individual, upon a verified request, may access— 17 (A) any personal reproductive or sexual 18 health information relating to such individual 19 that is retained by such regulated entity, in- 20 cluding— 21 (i) in the case of such information 22 that such regulated entity collected from 23 third parties, how and from which specific 24 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1656 IS third parties such regulated entity collected 1 such information; and 2 (ii) such information that such regu- 3 lated entity inferred about such individual; 4 and 5 (B) a list of the specific third parties to 6 which such regulated entity has disclosed any 7 personal reproductive or sexual health informa- 8 tion relating to such individual. 9 (2) FORMAT.—A regulated entity shall make 10 the information described in paragraph (1) available 11 in both a human-readable format and a structured, 12 interoperable, and machine-readable format. 13 (b) RIGHT OF CORRECTION.—A regulated entity 14 shall make available a reasonable mechanism by which an 15 individual, upon a verified request, may direct the correc- 16 tion of any inaccurate personal reproductive or sexual 17 health information relating to such individual that is re- 18 tained by such regulated entity or the service providers 19 of such regulated entity, including any such information 20 that such regulated entity collected from a third party or 21 inferred from other information retained by such regu- 22 lated entity. 23 (c) RIGHT OF DELETION.—A regulated entity shall 24 make available a reasonable mechanism by which an indi- 25 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1656 IS vidual, upon a verified request, may direct the deletion of 1 any personal reproductive or sexual health information re- 2 lating to such individual that is retained by such regulated 3 entity and the service providers of such regulated entity, 4 including any such information that such regulated entity 5 collected from a third party or inferred from other infor- 6 mation retained by such regulated entity. 7 (d) GENERAL PROVISIONS.— 8 (1) REASONABLE MECHANISM DEFINED.—In 9 this section, the term ‘‘reasonable mechanism’’ 10 means, with respect to a regulated entity and a right 11 under this section, a mechanism that— 12 (A) is provided in the primary manner 13 through which such regulated entity provides 14 the goods or services of such regulated entity; 15 (B) is easy to use and prominently avail- 16 able; and 17 (C) includes an online means of exercising 18 such right. 19 (2) TIMELINE FOR COMPLYING WITH RE- 20 QUESTS.—A regulated entity shall comply with a 21 verified request received under this section without 22 undue delay and not later than 15 days after the 23 date on which the requesting individual submits the 24 verified request. 25 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 5 •S 1656 IS (3) FEES PROHIBITED.—A regulated entity 1 may not charge a fee to an individual for a request 2 made under this section. 3 (4) RULES OF CONSTRUCTION.—Nothing in 4 this section shall be construed to require a regulated 5 entity to— 6 (A) take an action that would convert in- 7 formation that is not personal information into 8 personal information; 9 (B) collect or retain personal information 10 that such regulated entity would otherwise not 11 collect or retain; or 12 (C) retain personal information longer 13 than such regulated entity would otherwise re- 14 tain such information. 15 SEC. 4. PRIVACY POLICY. 16 (a) POLICY REQUIRED.—A regulated entity shall 17 maintain a privacy policy relating to the practices of such 18 regulated entity regarding the collecting, retaining, using, 19 and disclosing of personal reproductive or sexual health 20 information. 21 (b) PUBLICATION REQUIRED.—A regulated entity 22 shall prominently publish the privacy policy required by 23 subsection (a) on the website of such regulated entity. 24 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 6 •S 1656 IS (c) CONTENTS.—The privacy policy required by sub- 1 section (a) shall be clear and conspicuous and shall con- 2 tain, at a minimum, the following: 3 (1) A description of the practices of the regu- 4 lated entity regarding the collecting, retaining, 5 using, and disclosing of personal reproductive or sex- 6 ual health information. 7 (2) A concise statement of the categories of 8 such information collected, retained, used, or dis- 9 closed by the regulated entity. 10 (3) A concise statement, for each such category, 11 of the purposes of such regulated entity for the col- 12 lecting, retaining, using, or disclosing of such infor- 13 mation. 14 (4) A list of the specific third parties to which 15 such regulated entity discloses such information, and 16 a concise statement of the purposes for which such 17 regulated entity discloses such information, including 18 how such information may be used by each such 19 third party. 20 (5) A list of the specific third parties from 21 which such regulated entity has collected such infor- 22 mation, and a concise statement of the purposes for 23 which such regulated entity collects such informa- 24 tion. 25 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 7 •S 1656 IS (6) A concise statement describing the extent to 1 which individuals may exercise control over the col- 2 lecting, retaining, using, and disclosing of personal 3 reproductive or sexual health information by such 4 regulated entity, the steps an individual is required 5 to take to implement such controls, and direct links 6 to such controls. 7 (7) A concise statement describing the efforts 8 of the regulated entity to protect personal reproduc- 9 tive or sexual health information from unauthorized 10 disclosure. 11 SEC. 5. PROHIBITION AGAINST RETALIATION. 12 A regulated entity may not retaliate against an indi- 13 vidual because the individual exercises a right of the indi- 14 vidual under this Act, including by— 15 (1) denying goods or services to the individual; 16 (2) charging the individual different prices or 17 rates for goods or services, including by using dis- 18 counts or other benefits or imposing penalties; 19 (3) providing a different level or quality of 20 goods or services to the individual; or 21 (4) suggesting that the individual will receive a 22 different price or rate for goods or services or a dif- 23 ferent level or quality of goods or services. 24 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 8 •S 1656 IS SEC. 6. ENFORCEMENT. 1 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS- 2 SION.— 3 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC- 4 TICES.—A violation of this Act or a regulation pro- 5 mulgated under this Act shall be treated as a viola- 6 tion of a regulation under section 18(a)(1)(B) of the 7 Federal Trade Commission Act (15 U.S.C. 8 57a(a)(1)(B)) regarding unfair or deceptive acts or 9 practices. 10 (2) POWERS OF COMMISSION.—Except as pro- 11 vided in section 7(6)(A)(ii), the Commission shall 12 enforce this Act and the regulations promulgated 13 under this Act in the same manner, by the same 14 means, and with the same jurisdiction, powers, and 15 duties as though all applicable terms and provisions 16 of the Federal Trade Commission Act (15 U.S.C. 41 17 et seq.) were incorporated into and made a part of 18 this Act, and any regulated entity that violates this 19 Act or a regulation promulgated under this Act shall 20 be subject to the penalties and entitled to the privi- 21 leges and immunities provided in the Federal Trade 22 Commission Act. 23 (3) RULEMAKING AUTHORITY.—The Commis- 24 sion may promulgate regulations under section 553 25 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 9 •S 1656 IS of title 5, United States Code, to implement this 1 Act. 2 (b) ENFORCEMENT BY INDIVIDUALS.— 3 (1) IN GENERAL.—Any individual alleging a 4 violation of this Act or a regulation promulgated 5 under this Act may bring a civil action in any court 6 of competent jurisdiction. 7 (2) RELIEF.—In a civil action brought under 8 paragraph (1) in which the plaintiff prevails, the 9 court may award— 10 (A) an amount not less than $100 and not 11 greater than $1,000 per violation per day, or 12 actual damages, whichever is greater; 13 (B) punitive damages; 14 (C) reasonable attorney’s fees and litiga- 15 tion costs; and 16 (D) any other relief, including equitable or 17 declaratory relief, that the court determines ap- 18 propriate. 19 (3) INJURY IN FACT.—A violation of this Act, 20 or a regulation promulgated under this Act, with re- 21 spect to personal reproductive or sexual health infor- 22 mation constitutes a concrete and particularized in- 23 jury in fact to the individual to whom such informa- 24 tion relates. 25 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 10 •S 1656 IS (4) INVALIDITY OF PRE-DISPUTE ARBITRATION 1 AGREEMENTS AND PRE-DISPUTE JOINT ACTION 2 WAIVERS.— 3 (A) IN GENERAL.—Notwithstanding any 4 other provision of law, no pre-dispute arbitra- 5 tion agreement or pre-dispute joint-action waiv- 6 er shall be valid or enforceable with respect to 7 a dispute arising under this Act. 8 (B) APPLICABILITY.—Any determination 9 as to whether or how this paragraph applies to 10 any dispute shall be made by a court, rather 11 than an arbitrator, without regard to whether 12 such agreement purports to delegate such deter- 13 mination to an arbitrator. 14 (C) DEFINITIONS.—For purposes of this 15 paragraph: 16 (i) PRE-DISPUTE ARBITRATION 17 AGREEMENT.—The term ‘‘pre-dispute arbi- 18 tration agreement’’ means any agreement 19 to arbitrate a dispute that has not arisen 20 at the time of the making of the agree- 21 ment. 22 (ii) PRE-DISPUTE JOINT-ACTION 23 WAIVER.—The term ‘‘pre-dispute joint-ac- 24 tion waiver’’ means an agreement that 25 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 11 •S 1656 IS would prohibit a party from participating 1 in a joint, class, or collective action in a ju- 2 dicial, arbitral, administrative, or other 3 forum, concerning a dispute that has not 4 arisen at the time of the making of the 5 agreement. 6 SEC. 7. DEFINITIONS. 7 In this Act: 8 (1) COLLECT.—The term ‘‘collect’’ means, with 9 respect to personal reproductive or sexual health in- 10 formation, for a regulated entity to obtain such in- 11 formation in any manner. 12 (2) COMMISSION.—The term ‘‘Commission’’ 13 means the Federal Trade Commission. 14 (3) DISCLOSE.—The term ‘‘disclose’’ means, 15 with respect to personal reproductive or sexual 16 health information, for a regulated entity to release, 17 transfer, sell, provide access to, license, or divulge 18 such information in any manner to a third party or 19 government entity. 20 (4) PERSONAL INFORMATION.—The term ‘‘per- 21 sonal information’’ means information that identi- 22 fies, relates to, describes, is reasonably capable of 23 being associated with, or could reasonably be linked, 24 VerDate Sep 11 2014 19:33 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1656.IS S1656 kjohnson on DSK79L0C42PROD with BILLS 12 •S 1656 IS directly or indirectly, with a particular individual, 1 household, or device. 2 (5) PERSONAL REPRODUCTIVE OR SEXUAL 3 HEALTH INFORMATION.—The term ‘‘personal repro- 4 ductive or sexual health information’’ means per- 5 sonal information relating to the past, present, or 6 future reproductive or sexual health of an individual, 7 including— 8 (A) efforts to research or obtain reproduc- 9 tive or sexual health information, services, or 10 supplies, including location information that 11 might indicate an attempt to acquire or receive 12 such information, services, or supplies; 13 (B) reproductive or sexual health condi- 14 tions, status, diseases, or diagnoses, including 15 pregnancy and pregnancy-related conditions, 16 menstruation, ovulation, ability to conceive a 17 pregnancy, whether such individual is sexually 18 active, and whether such individual is engaging [Text truncated for display. Full text available on Congress.gov.]