My Body, My Data Act of 2023

I 118TH CONGRESS 1ST SESSION H. R. 3420 To protect the privacy of personal reproductive or sexual health information, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MAY 17, 2023 Ms. JACOBS (for herself, Mr. CONNOLLY, Mr. HUFFMAN, Mr. GRIJALVA, Ms. BONAMICI, Mr. SHERMAN, Ms. BARRAGA´N, Ms. ESCOBAR, Ms. WILD, Mr. SWALWELL, Mr. VEASEY, Ms. GARCIA of Texas, Ms. WILLIAMS of Geor- gia, Mr. MOULTON, Mr. VARGAS, Mr. PAYNE, Ms. STANSBURY, Mr. BOW- MAN, Mr. CASTRO of Texas, Ms. WILSON of Florida, Ms. MOORE of Wis- consin, Mr. ALLRED, Ms. ROSS, Ms. CROCKETT, Mr. DOGGETT, Mr. CA´RDENAS, Mr. TRONE, Mr. GOTTHEIMER, Ms. MENG, Mr. TORRES of New York, Ms. BROWNLEY, Mr. TONKO, Mr. DESAULNIER, Mr. CASTEN, Mr. CARTER of Louisiana, Mr. PAPPAS, Ms. SCANLON, Mr. MORELLE, Ms. VELA´ZQUEZ, Mr. SMITH of Washington, Ms. JAYAPAL, Mrs. TRAHAN, Ms. PRESSLEY, Ms. MCCOLLUM, Ms. LOIS FRANKEL of Flor- ida, Mr. COHEN, Ms. TITUS, Ms. SEWELL, Ms. LEE of California, Ms. TOKUDA, Ms. CHU, Mr. KHANNA, Mr. KEATING, Ms. CLARKE of New York, Ms. JACKSON LEE, Mr. QUIGLEY, Mrs. FLETCHER, Ms. NORTON, Ms. SHERRILL, Mr. SCHIFF, Ms. MATSUI, Mrs. TORRES of California, Mrs. NAPOLITANO, Mrs. HAYES, Ms. BROWN, Mr. POCAN, Mrs. MCCLEL- LAN, Ms. LEGER FERNANDEZ, Mr. MEEKS, Mr. PANETTA, Mr. TAKANO, Mr. KRISHNAMOORTHI, Ms. SPANBERGER, Ms. LOFGREN, Ms. KAMLAGER-DOVE, Mr. CROW, Ms. ESHOO, Ms. BALINT, Ms. MANNING, Mr. JOHNSON of Georgia, Ms. KUSTER, Mr. PHILLIPS, Ms. PETTERSEN, Mr. JACKSON of Illinois, Mr. CARBAJAL, Ms. WEXTON, Mr. GREEN of Texas, Ms. SALINAS, Mrs. CHERFILUS-MCCORMICK, Ms. PELOSI, Mrs. WATSON COLEMAN, and Ms. PORTER) introduced the following bill; which was referred to the Committee on Energy and Commerce VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 3420 IH A BILL To protect the privacy of personal reproductive or sexual health information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘My Body, My Data 4 Act of 2023’’. 5 SEC. 2. MINIMIZATION. 6 (a) MINIMIZATION OF COLLECTING, RETAINING, 7 USING, AND DISCLOSING.—A regulated entity may not 8 collect, retain, use, or disclose personal reproductive or 9 sexual health information, except as is strictly necessary 10 to provide a product or service that the individual to whom 11 such information relates has requested from such regu- 12 lated entity. 13 (b) MINIMIZATION OF EMPLOYEE ACCESS.—A regu- 14 lated entity shall restrict access to personal reproductive 15 or sexual health information by the employees or service 16 providers of such regulated entity to such employees or 17 service providers for which access is necessary to provide 18 a product or service that the individual to whom such in- 19 formation relates has requested from such regulated enti- 20 ty. 21 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 3420 IH SEC. 3. RIGHT OF ACCESS, CORRECTION, AND DELETION. 1 (a) RIGHT OF ACCESS.— 2 (1) IN GENERAL.—A regulated entity shall 3 make available a reasonable mechanism by which an 4 individual, upon a verified request, may access— 5 (A) any personal reproductive or sexual 6 health information relating to such individual 7 that is retained by such regulated entity, in- 8 cluding— 9 (i) in the case of such information 10 that such regulated entity collected from 11 third parties, how and from which specific 12 third parties such regulated entity collected 13 such information; and 14 (ii) such information that such regu- 15 lated entity inferred about such individual; 16 and 17 (B) a list of the specific third parties to 18 which such regulated entity has disclosed any 19 personal reproductive or sexual health informa- 20 tion relating to such individual. 21 (2) FORMAT.—A regulated entity shall make 22 the information described in paragraph (1) available 23 in both a human-readable format and a structured, 24 interoperable, and machine-readable format. 25 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 3420 IH (b) RIGHT OF CORRECTION.—A regulated entity 1 shall make available a reasonable mechanism by which an 2 individual, upon a verified request, may direct the correc- 3 tion of any inaccurate personal reproductive or sexual 4 health information relating to such individual that is re- 5 tained by such regulated entity or the service providers 6 of such regulated entity, including any such information 7 that such regulated entity collected from a third party or 8 inferred from other information retained by such regu- 9 lated entity. 10 (c) RIGHT OF DELETION.—A regulated entity shall 11 make available a reasonable mechanism by which an indi- 12 vidual, upon a verified request, may direct the deletion of 13 any personal reproductive or sexual health information re- 14 lating to such individual that is retained by such regulated 15 entity and the service providers of such regulated entity, 16 including any such information that such regulated entity 17 collected from a third party or inferred from other infor- 18 mation retained by such regulated entity. 19 (d) GENERAL PROVISIONS.— 20 (1) REASONABLE MECHANISM DEFINED.—In 21 this section, the term ‘‘reasonable mechanism’’ 22 means, with respect to a regulated entity and a right 23 under this section, a mechanism that— 24 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 5 •HR 3420 IH (A) is provided in the primary manner 1 through which such regulated entity provides 2 the goods or services of such regulated entity; 3 (B) is easy to use and prominently avail- 4 able; and 5 (C) includes an online means of exercising 6 such right. 7 (2) TIMELINE FOR COMPLYING WITH RE- 8 QUESTS.—A regulated entity shall comply with a 9 verified request received under this section without 10 undue delay and not later than 15 days after the 11 date on which the requesting individual submits the 12 verified request. 13 (3) FEES PROHIBITED.—A regulated entity 14 may not charge a fee to an individual for a request 15 made under this section. 16 (4) RULES OF CONSTRUCTION.—Nothing in 17 this section shall be construed to require a regulated 18 entity to— 19 (A) take an action that would convert in- 20 formation that is not personal information into 21 personal information; 22 (B) collect or retain personal information 23 that such regulated entity would otherwise not 24 collect or retain; or 25 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 6 •HR 3420 IH (C) retain personal information longer 1 than such regulated entity would otherwise re- 2 tain such information. 3 SEC. 4. PRIVACY POLICY. 4 (a) POLICY REQUIRED.—A regulated entity shall 5 maintain a privacy policy relating to the practices of such 6 regulated entity regarding the collecting, retaining, using, 7 and disclosing of personal reproductive or sexual health 8 information. 9 (b) PUBLICATION REQUIRED.—A regulated entity 10 shall prominently publish the privacy policy required by 11 subsection (a) on the website of such regulated entity. 12 (c) CONTENTS.—The privacy policy required by sub- 13 section (a) shall be clear and conspicuous and shall con- 14 tain, at a minimum, the following: 15 (1) A description of the practices of the regu- 16 lated entity regarding the collecting, retaining, 17 using, and disclosing of personal reproductive or sex- 18 ual health information. 19 (2) A concise statement of the categories of 20 such information collected, retained, used, or dis- 21 closed by the regulated entity. 22 (3) A concise statement, for each such category, 23 of the purposes of such regulated entity for the col- 24 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 7 •HR 3420 IH lecting, retaining, using, or disclosing of such infor- 1 mation. 2 (4) A list of the specific third parties to which 3 such regulated entity discloses such information, and 4 a concise statement of the purposes for which such 5 regulated entity discloses such information, including 6 how such information may be used by each such 7 third party. 8 (5) A list of the specific third parties from 9 which such regulated entity has collected such infor- 10 mation, and a concise statement of the purposes for 11 which such regulated entity collects such informa- 12 tion. 13 (6) A concise statement describing the extent to 14 which individuals may exercise control over the col- 15 lecting, retaining, using, and disclosing of personal 16 reproductive or sexual health information by such 17 regulated entity, the steps an individual is required 18 to take to implement such controls, and direct links 19 to such controls. 20 (7) A concise statement describing the efforts 21 of the regulated entity to protect personal reproduc- 22 tive or sexual health information from unauthorized 23 disclosure. 24 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 8 •HR 3420 IH SEC. 5. PROHIBITION AGAINST RETALIATION. 1 A regulated entity may not retaliate against an indi- 2 vidual because the individual exercises a right of the indi- 3 vidual under this Act, including by— 4 (1) denying goods or services to the individual; 5 (2) charging the individual different prices or 6 rates for goods or services, including by using dis- 7 counts or other benefits or imposing penalties; 8 (3) providing a different level or quality of 9 goods or services to the individual; or 10 (4) suggesting that the individual will receive a 11 different price or rate for goods or services or a dif- 12 ferent level or quality of goods or services. 13 SEC. 6. ENFORCEMENT. 14 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS- 15 SION.— 16 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC- 17 TICES.—A violation of this Act or a regulation pro- 18 mulgated under this Act shall be treated as a viola- 19 tion of a regulation under section 18(a)(1)(B) of the 20 Federal Trade Commission Act (15 U.S.C. 21 57a(a)(1)(B)) regarding unfair or deceptive acts or 22 practices. 23 (2) POWERS OF COMMISSION.—Except as pro- 24 vided in section 7(6)(A)(ii), the Commission shall 25 enforce this Act and the regulations promulgated 26 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 9 •HR 3420 IH under this Act in the same manner, by the same 1 means, and with the same jurisdiction, powers, and 2 duties as though all applicable terms and provisions 3 of the Federal Trade Commission Act (15 U.S.C. 41 4 et seq.) were incorporated into and made a part of 5 this Act, and any regulated entity that violates this 6 Act or a regulation promulgated under this Act shall 7 be subject to the penalties and entitled to the privi- 8 leges and immunities provided in the Federal Trade 9 Commission Act. 10 (3) RULEMAKING AUTHORITY.—The Commis- 11 sion may promulgate regulations under section 553 12 of title 5, United States Code, to implement this 13 Act. 14 (b) ENFORCEMENT BY INDIVIDUALS.— 15 (1) IN GENERAL.—Any individual alleging a 16 violation of this Act or a regulation promulgated 17 under this Act may bring a civil action in any court 18 of competent jurisdiction. 19 (2) RELIEF.—In a civil action brought under 20 paragraph (1) in which the plaintiff prevails, the 21 court may award— 22 (A) an amount not less than $100 and not 23 greater than $1,000 per violation per day, or 24 actual damages, whichever is greater; 25 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 10 •HR 3420 IH (B) punitive damages; 1 (C) reasonable attorney’s fees and litiga- 2 tion costs; and 3 (D) any other relief, including equitable or 4 declaratory relief, that the court determines ap- 5 propriate. 6 (3) INJURY IN FACT.—A violation of this Act, 7 or a regulation promulgated under this Act, with re- 8 spect to personal reproductive or sexual health infor- 9 mation constitutes a concrete and particularized in- 10 jury in fact to the individual to whom such informa- 11 tion relates. 12 (4) INVALIDITY OF PRE-DISPUTE ARBITRATION 13 AGREEMENTS AND PRE-DISPUTE JOINT ACTION 14 WAIVERS.— 15 (A) IN GENERAL.—Notwithstanding any 16 other provision of law, no pre-dispute arbitra- 17 tion agreement or pre-dispute joint-action waiv- 18 er shall be valid or enforceable with respect to 19 a dispute arising under this Act. 20 (B) APPLICABILITY.—Any determination 21 as to whether or how this paragraph applies to 22 any dispute shall be made by a court, rather 23 than an arbitrator, without regard to whether 24 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 11 •HR 3420 IH such agreement purports to delegate such deter- 1 mination to an arbitrator. 2 (C) DEFINITIONS.—For purposes of this 3 paragraph: 4 (i) PRE-DISPUTE ARBITRATION 5 AGREEMENT.—The term ‘‘pre-dispute arbi- 6 tration agreement’’ means any agreement 7 to arbitrate a dispute that has not arisen 8 at the time of the making of the agree- 9 ment. 10 (ii) PRE-DISPUTE JOINT-ACTION 11 WAIVER.—The term ‘‘pre-dispute joint-ac- 12 tion waiver’’ means an agreement that 13 would prohibit a party from participating 14 in a joint, class, or collective action in a ju- 15 dicial, arbitral, administrative, or other 16 forum, concerning a dispute that has not 17 arisen at the time of the making of the 18 agreement. 19 SEC. 7. DEFINITIONS. 20 In this Act: 21 (1) COLLECT.—The term ‘‘collect’’ means, with 22 respect to personal reproductive or sexual health in- 23 formation, for a regulated entity to obtain such in- 24 formation in any manner. 25 VerDate Sep 11 2014 19:32 Jun 07, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H3420.IH H3420 kjohnson on DSK79L0C42PROD with BILLS 12 •HR 3420 IH (2) COMMISSION.—The term ‘‘Commission’’ 1 means the Federal Trade Commission. 2 (3) DISCLOSE.—The term ‘‘disclose’’ means, 3 with respect to personal reproductive or sexual 4 health information, for a regulated entity to release, 5 transfer, sell [Text truncated for display. Full text available on Congress.gov.]