Sec. 201 Disclosure of human rights due diligence
“(s) Disclosure of human rights due diligence
“(1) Disclosure—Except as provided in paragraph (3), each Internet communications service company that operates in an Internet-restricting country shall include in the annual report of the company information relating to the company, any subsidiary of the company, and any entity under the control of either of such companies, relating to the following:
“(A) Human rights due diligence—Company policies applicable to the company’s internal operations that address human rights due diligence through a statement of policy that is consistent with applicable provisions of the Guidelines for Multinational Enterprises issued by the Organization for Economic Co-operation and Development, and whether such policy—
“(i) is approved at the most senior level of the company;
“(ii) explicitly states the company’s expectations of personnel, business partners, and other parties under the control of the company, products, or services;
“(iii) is publicly available and communicated internally and externally to all personnel, business partners, other relevant partners, customers, and users;
“(iv) is reflected in operational policies and procedures necessary to embed it throughout the company; and
“(v) is independently assessed by a third party to demonstrate compliance in practice, which should include—
“(I) whether the assessment was conducted under the supervision of any third party organization or multi-stakeholder initiative;
“(II) a description of the assessment process;
“(III) a description of measures taken to ensure the assessor’s independence; and
“(IV) inclusion of the assessor’s public report.
“(B) Non-compliance—If the company’s policy does not comply with any of the requirements of clauses (i) through (iv) of subparagraph (A), an explanation of why the company’s policy does not meet each such requirement.
“(C) Policies pertaining to disclosure of personally identifiable information—If the company collects or obtains personally identifiable information, the contents of wire communications or electronic communications in electronic storage, or the contents of wire communications or electronic communications in a remote computing service on the Internet, a summary of any internal policies or procedures of the company that set out how the company will assess and respond to requests by the governments of Internet-restricting countries for disclosure of such personally identifiable information or communications.
“(D) Restrictions on Internet search engines and Internet content hosting services—If the company creates, provides, or hosts an Internet search engine or an Internet content hosting service, all steps taken to provide users and customers with clear, prominent, and timely notice when access to specific content has been removed or blocked at the request of an Internet-restricting country.
“(2) Availability of information—The Commission shall make all information reported by an issuer pursuant to this subsection available online to the public.
“(3) Safe harbor
“(A) In general—An Internet communications service company that operates in an Internet-restricting country shall not be required to include in the annual report of the company information described in paragraph (1) if the company includes in the annual report of the company a certification of the Global Network Initiative or a multi-stakeholder initiative described in subparagraph (B) that the company participates in good standing in the Global Network Initiative or the multi-stakeholder initiative (as the case may be).
“(B) Multi-stakeholder initiative—A multi-stakeholder initiative referred to in subparagraph (A) is an initiative that—
“(i) is composed of civil society organizations, including human rights organizations and Internet communications service companies;
“(ii) promotes the rule of law and the adoption of laws, policies, and practices that protect, respect, and fulfill freedom of expression and privacy; and
“(iii) requires each company participating in the initiative to undergo assessments by an independent third party described in subparagraph (C) of the company’s compliance with the standards described in clause (ii).
“(C) Independent third party—An independent third party referred to in subparagraph (B)(iii) is an entity accredited by the multi-stakeholder initiative to conduct assessments based on criteria that include—
“(i) general expertise in legal and human rights standards; and
“(ii) specific expertise in global business processes relating to information and communication technology, including operations, product development cycles, market segments and industry relationships, information technology privacy, safety, and security standards, data retention systems, and database forensics.
“(4) Definitions—In this subsection:
“(A) Electronic communication and other title 18 definitions—The terms electronic communication, “electronic communication service”, electronic storage, “wire communication”, and contents have the meanings given such terms in section 2510 of title 18, United States Code.
“(B) Internet—The term Internet has the meaning given the term in section 231(e)(3) of the Communications Act of 1934 (47 U.S.C. 231(e)(3)).
“(C) Internet communications service company—The term Internet communications service company means an issuer that—
“(i) is required to file an annual report with the Commission; and
“(ii)
“(I) provides electronic communication services or remote computing services, but does not include—
“(aa) businesses that provide such services as an ancillary service to the provision of lodging, transportation, or food services; or
“(bb) activities conducted by a financial institution (as such term is defined in section 5312 of title 31, United States Code) that are financial in nature, even if such activities are conducted using the Internet; or
“(II) is a domain name registrar, domain name registry, or other domain name registration authority.
“(D) Internet content hosting service—The term Internet content hosting service means a service that—
“(i) stores, through electromagnetic or other means, electronic data, such as the content of Web pages, electronic mail, documents, images, audio and video files, online discussion boards, or Web logs; and
“(ii) makes such data available via the Internet.
“(E) Internet-restricting country—The term Internet-restricting country has the meaning given such term under section 3 of the Global Online Freedom Act of 2013.
“(F) Internet search engine—The term Internet search engine means a service made available via the Internet that, on the basis of a query consisting of terms, concepts, questions, or other data input by a user, searches information available on the Internet and returns to the user a link to or other means of locating, viewing, or downloading information or data available on the Internet relating to such query.
“(G) Personally identifiable information—The term personally identifiable information means data in a form that identifies a particular person.
“(H) Remote computing service—The term “remote computing service” has the meaning given such term under section 2711(2) of title 18, United States Code.”