Section 1 Short title
This Act may be cited as the “Drone Aircraft Privacy and Transparency Act of 2017”.
Drone Aircraft Privacy and Transparency Act of 2017
A BILL
To amend the FAA Modernization and Reform Act of 2012 to provide guidance and limitations regarding the integration of unmanned aircraft systems into United States airspace, and for other purposes.
Sec. 2 Findings
Congress finds the following:
On February 14, 2012, President Obama signed the FAA Modernization and Reform Act of 2012 (Public Law 112–95; 49 U.S.C. 40101 note) into law, and sections 331 through 336 of such Act require the Federal Aviation Administration to fully integrate government, commercial, and recreational unmanned aircraft systems, commonly known as drones, into United States airspace by October 2015.
As the technology advances and the cost decreases—unmanned aircraft systems are already orders of magnitude less expensive to purchase and operate than piloted aircraft—the market for Federal, State, and local government and commercial unmanned aircraft systems is rapidly growing.
It has been estimated there could be as many as 2,700,000 commercial unmanned aircraft systems sold annually in the United States by 2020.
There will no doubt be many beneficial applications for unmanned aircraft systems, including delivering goods, serving as early warning systems, performing search and rescue missions, and providing critical aid to those in need.
However, there also is the potential for unmanned aircraft system technology to enable invasive and pervasive surveillance without adequate privacy protections, and currently, no explicit privacy protections or public transparency measures with respect to such system technology are built into the law.
Federal standards for informing the public and protecting individual privacy with respect to unmanned aircraft systems are needed.
Sec. 3 Guidance and limitations regarding unmanned aircraft systems
In general— Subtitle B of title III of the FAA Modernization and Reform Act of 2012 (Public Law 112–95; 49 U.S.C. 40101 note) is amended by adding at the end the following new sections:
“337. Rulemaking
“(a) In general—The Secretary of Transportation shall establish procedures to ensure that the integration of unmanned aircraft systems into the national airspace system is done in compliance with the privacy principles.
“(b) Exception—The procedures established under subsection (a) shall not apply with respect to unmanned aircraft systems operated for news-gathering activities protected by the First Amendment to the Constitution of the United States.
“338. Data collection statements and data minimization statements
“(a) In general—Beginning on the date of the enactment of this section, the Secretary of Transportation may not approve, issue, or award any certificate, license, or other grant of authority to operate an unmanned aircraft system in the national airspace system unless the application for such certificate, license, or other grant of authority includes—
“(1) a data collection statement in accordance with the requirements of subsection (b) that provides reasonable assurance that the applicant will operate the unmanned aircraft system in accordance with the privacy principles; and
“(2) in the case of such an unmanned aircraft system that is to be operated by a law enforcement agency or a law enforcement agency contractor or subcontractor, a data minimization statement in accordance with the requirements of subsection (c) that provides reasonable assurance that the applicant will operate the unmanned aircraft system in accordance with the privacy principles.
“(b) Data collection statement—A data collection statement under subsection (a), with respect to an unmanned aircraft system, shall include information identifying—
“(1) the individuals or entities that will have the power to use the unmanned aircraft system;
“(2) the specific locations in which the unmanned aircraft system will operate;
“(3) the maximum period for which the unmanned aircraft system will operate in each flight;
“(4) whether the unmanned aircraft system will collect information or data about individuals or groups of individuals, and if so—
“(A) the circumstances under which the system will be used; and
“(B) the specific kinds of information or data the system will collect about individuals or groups of individuals and how such information or data, as well as conclusions drawn from such information or data, will be used, disclosed, and otherwise handled, including—
“(i) how the collection or retention of such information or data that is unrelated to the specified use will be minimized;
“(ii) whether such information or data might be sold, leased, or otherwise provided to third parties, and if so, under what circumstances it might be so sold or leased;
“(iii) the period for which such information or data will be retained; and
“(iv) when and how such information or data, including information or data no longer relevant to the specified use, will be destroyed;
“(5) the possible impact the operation of the unmanned aircraft system may have upon the privacy of individuals;
“(6) the specific steps that will be taken to mitigate any possible impact identified under paragraph (5), including steps to protect against unauthorized disclosure of any information or data described in paragraph (4), such as the use of encryption methods and other security features that will be used;
“(7) a telephone number or electronic mail address that an individual with complaints about the operation of the unmanned aircraft system may use to report such complaints and to request confirmation that personally identifiable data relating to such individual has been collected;
“(8) in a case in which personally identifiable data relating to an individual has been collected, a reasonable process for the individual to request to obtain such data in a timely and an intelligible manner;
“(9) in a case in which a request described in paragraph (8) is denied, a process by which the individual may obtain the reasons for the denial and challenge the denial; and
“(10) in a case in which personally identifiable data relating to an individual has been collected, a process by which the individual may challenge the accuracy of such data and, if the challenge is successful, have such data erased or amended.
“(c) Data minimization statement—A data minimization statement described in this subsection, with respect to an unmanned aircraft system operated by a law enforcement agency, contractor, or subcontractor described in subsection (a)(2), shall detail the applicable—
“(1) policies adopted by the agency, contractor, or subcontractor, as the case may be, that—
“(A) minimize the collection by the unmanned aircraft system of information and data unrelated to the investigation of a crime under a warrant;
“(B) require the destruction of such information and data, as well as of information and data collected by the unmanned aircraft system that is no longer relevant to the investigation of a crime under a warrant or to an ongoing criminal proceeding; and
“(C) establish procedures for the method of such destruction; and
“(2) audit and oversight procedures adopted by the agency, contractor, or subcontractor, as the case may be, that will ensure that the agency, contractor, or subcontractor, as the case may be, uses the unmanned aircraft system in accordance with the parameters outlined in the data collection statement and the statement required by this subsection.
“(d) Exception—The procedures established under subsections (a), (b), and (c) shall not apply with respect to unmanned aircraft systems operated for news-gathering activities protected by the First Amendment to the Constitution of the United States.
“339. Disclosure of approved certificates, licenses, and other grants of authority
“(a) In general—The Administrator of the Federal Aviation Administration shall make available on the public Internet website of the Federal Aviation Administration in a searchable format—
“(1) the name of each person or agency authorized to conduct civil or public unmanned aircraft system operations;
“(2) the name of the owner of each unmanned aircraft system described in paragraph (1);
“(3) the expiration date of the authorization described in paragraph (1);
“(4) the contact information for each person identified under paragraph (1) or (2), including a telephone number and electronic mail address, subject to applicable privacy laws;
“(5) the tail number or other specific identification number of each unmanned aircraft system authorized to conduct operations, with a link to the owner of the unmanned aircraft system;
“(6) the approved certificate, license, or other grant of authority for each unmanned aircraft system awarded a certificate, license, or other grant of authority to operate in the national airspace system, including any such certificate, license, or other grant of authority awarded prior to the date of the enactment of this section;
“(7) information detailing where, when, and for what purpose each unmanned aircraft system will be operated;
“(8) information detailing any data security breach that occurs with regard to information collected by an unmanned aircraft system;
“(9) a description of the technical capability of each unmanned aircraft system, including whether the system has cameras, thermal imaging capabilities, mobile phone interception capabilities, facial recognition capabilities, and license plate readers; and
“(10) in the case of a certificate, license, or other grant of authority awarded on or after the date of the enactment of this section to operate an unmanned aircraft system in the national airspace system, the data collection statement described in section 339(b) and, if applicable, the data minimization statement described in section 339(c) required with respect to such unmanned aircraft system.
“(b) Deadline—The Administrator shall complete the requirements under subsection (a) with regard to each unmanned aircraft system—
“(1) in the case of a certificate, license, or other grant of authority awarded before the date of the enactment of this section, not later than 90 days after such date of enactment; and
“(2) in the case of a certificate, license, or other grant of authority awarded on or after the date of the enactment of this section, as soon as is practicable after the date of approval of such certificate, license, or other grant of authority.
“340. Warrants required for generalized surveillance
“(a) In general—A governmental entity (as defined in section 2711 of title 18, United States Code) may not use an unmanned aircraft system or request information or data collected by another person using an unmanned aircraft system for protective activities, or for law enforcement or intelligence purposes, except pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction, or as permitted under the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.).
“(b) Exceptions
“(1) In general—Subsection (a) shall not apply in a case in which a governmental entity is using an unmanned aircraft system in exigent circumstances (as defined in paragraph (2)).
“(2) Exigent circumstances defined—Exigent circumstances exist when—
“(A) a law enforcement entity reasonably believes there is an imminent danger of death or serious physical injury; or
“(B) a law enforcement entity reasonably believes there is a high risk of an imminent terrorist attack by a specific individual or organization and the Secretary of Homeland Security has determined that credible intelligence indicates there is such a risk.
“(3) Required documentation—In the case of a person operating an unmanned aircraft system under an exception under paragraph (1), documentation justifying the exception shall be submitted to the Secretary of Transportation not later than 7 days after the date of the relevant unmanned aircraft system flight.
“(4) Information or data unrelated to exigent circumstances—A person operating an unmanned aircraft system under an exception under paragraph (1) shall minimize the collection by the unmanned aircraft system of information and data unrelated to the reason for the exception. If the unmanned aircraft system incidentally collects any such information or data while being operated under that exception, the person operating the unmanned aircraft system shall destroy the information and data.
“(c) Prohibition on information sharing—A person may not intentionally divulge information collected in accordance with this section with any other person, except as authorized by law.
“(d) Prohibition on use as evidence—If information has been collected by means of use of an unmanned aircraft system, no part of the contents of that information and no evidence derived from that information may be received in evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof unless that information is collected in accordance with this section.
“(e) Injunction—A person injured by an act in violation of this section may bring in an appropriate State court or an appropriate district court of the United States an action to enjoin such violation.”
Definitions— Section 331 of the FAA Modernization and Reform Act of 2012 (Public Law 112–95; 49 U.S.C. 40101 note) is amended—
by redesignating paragraphs (4) through (9) as paragraphs (7) through (13);
by redesignating paragraph (3) as paragraph (4);
by inserting after paragraph (2) the following:
“(3) Law enforcement—The term law enforcement means—
“(A) any entity of the United States or of a State, or political subdivision thereof, that is empowered by law to conduct investigations of or to make arrests for offenses; and
“(B) any entity or individual authorized by law to prosecute or participate in the prosecution of such offenses.”
by inserting after paragraph (4), as redesignated by paragraph (2), the following:
“(5) Privacy principles—The term privacy principles means the principles described in Part Two of the Organization for Economic Co-operation and Development guidelines titled Annex to the Recommendation of the Council of 23rd September 1980: Guidelines Governing The Protection Of Privacy And Transborder Flows Of Personal Data, adopted by the Organization for Economic Co-operation and Development on September 23, 1980.
“(6) Privacy protections—The term privacy protections means protections that relate to the use, collection, and disclosure of information and data about individuals and groups of individuals.”
Sec. 4 Enforcement
Prohibited conduct—
In general— It shall be unlawful for a person to operate an unmanned aircraft system in a manner that is not in accordance with the terms of a data collection statement submitted under section 338(a)(1) of the FAA Modernization and Reform Act of 2012, as added by section 3, or in a manner that violates any portion of the final rule required under section 332(b)(1) of such Act insofar as such portion relates to the procedures described in section 337 of such Act.
Regulations— The Commission may promulgate regulations in accordance with section 553 of title 5, United States Code, to carry out paragraph (1) with respect to persons, partnerships, and corporations described in subsection (b)(3).
Enforcement by Federal Trade Commission—
Unfair or deceptive acts or practices— A violation of subsection (a) or the regulations promulgated under such subsection shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
Powers of Commission— The Commission shall enforce subsection (a) and the regulations promulgated under such subsection in the same manner, by the same means, and with the same powers and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and any violator shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Applicability— Paragraphs (1) and (2) shall apply—
with respect to persons, partnerships, and corporations over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) (except to the extent such person, partnership, or corporation is a law enforcement contractor or subcontractor); and
notwithstanding such section, with respect to air carriers and foreign air carriers.
Actions by States—
Civil actions— In any case in which the attorney general of a State, or an official or agency of a State, has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by an act or practice in violation of subsection (a) or a regulation promulgated under such subsection, or by the operation of an unmanned aircraft system in violation of the terms of a data minimization statement submitted under section 338(a)(2) of the FAA Modernization and Reform Act of 2012, as added by section 3, the State may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to—
enjoin the violation;
enforce compliance with such subsection, regulation, or statement;
obtain damages, restitution, or other compensation on behalf of residents of the State; or
obtain such other legal and equitable relief as the court may consider to be appropriate.
Notice— Before filing an action under this subsection against a person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) (except to the extent such person, partnership, or corporation is a law enforcement contractor or subcontractor) or an air carrier or foreign air carrier, the attorney general, official, or agency of the State involved shall provide to the Commission a written notice of that action and a copy of the complaint for that action. If the attorney general, official, or agency determines that it is not feasible to provide the notice described in this paragraph before the filing of the action, the attorney general, official, or agency shall provide written notice of the action and a copy of the complaint to the Commission immediately upon the filing of the action.
Authority of the Commission—
In general— On receiving notice under paragraph (2) of an action under this subsection, the Commission shall have the right—
to intervene in the action;
upon so intervening, to be heard on all matters arising therein; and
to file petitions for appeal.
Limitation on State action while Federal action is pending— If the Commission or the Attorney General of the United States has instituted a civil action for violation of subsection (a) or a regulation promulgated under such subsection (referred to in this subparagraph as the Federal action), no State attorney general, official, or agency may bring an action under this subsection during the pendency of the Federal action against any defendant named in the complaint in the Federal action for any violation as alleged in that complaint.
Rule of construction— For purposes of bringing a civil action under this subsection, nothing in this Act or any amendment made by this Act shall be construed to prevent an attorney general, official, or agency of a State from exercising the powers conferred on the attorney general, official, or agency by the laws of that State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the production of documentary and other evidence.
Private right of action—
In general— A person injured by an act in violation of subsection (a) or the regulations promulgated under such subsection, or by the operation of an unmanned aircraft system in violation of the terms of a data minimization statement submitted under section 338(a)(2) of the FAA Modernization and Reform Act of 2012, as added by section 3, may bring in an appropriate State court or an appropriate district court of the United States—
an action to enjoin such violation;
an action to recover damages for actual monetary loss from such violation, or to receive up to $1,000 in damages for each such violation, whichever is greater; or
both such actions.
Intentional violations— If the defendant committed a violation described in paragraph (1), and intended to do so, the court may increase the amount of the award to an amount equal to not more than 3 times the amount available under paragraph (1)(B).
Costs— The court shall award to a prevailing plaintiff in an action under this subsection the costs of such action and reasonable attorney’s fees, as determined by the court.
Limitation— An action may be commenced under this subsection not later than 2 years after the date on which the person first discovered or had a reasonable opportunity to discover the violation.
Nonexclusive remedy— The remedy provided by this subsection shall be in addition to any other remedies available to the person.
Suits against governmental entities— Notwithstanding the Federal Trade Commission Act (15 U.S.C. 41 et seq.), a suit under subsection (c) or (d) may be maintained against a governmental entity.
License revocation— The Federal Aviation Administration shall revoke the certificate, license, or other grant of authority to operate an unmanned aircraft system if such system is operated in a manner that—
is not in accordance with the terms of—
a data collection statement submitted under subsection (a)(1) of section 338 of the FAA Modernization and Reform Act of 2012, as added by section 3; or
a data minimization statement submitted under subsection (a)(2) of such section; or
violates any portion of the final rule required under section 332(b)(1) of such Act insofar as such portion relates to the procedures described in section 337 of such Act, as added by section 3.
Violations— Each day on which each unmanned aircraft system is operated in violation of subsection (a), or the regulations promulgated under such subsection, or the terms of a data minimization statement submitted under section 338(a)(2) of the FAA Modernization and Reform Act of 2012, as added by section 3, shall be treated as a separate violation.
Definitions— In this section:
Air carrier; foreign air carrier— The terms air carrier and foreign air carrier have the meanings given those terms in section 40102 of title 49, United States Code.
Commission— The term Commission means the Federal Trade Commission.
Law enforcement— The term law enforcement has the meaning given such term in section 331 of the FAA Modernization and Reform Act of 2012, as amended by section 3.
State— The term State means each of the several States, the District of Columbia, each commonwealth, territory, or possession of the United States, and each federally recognized Indian tribe.
Unmanned aircraft system— The term unmanned aircraft system has the meaning given such term in section 331 of the FAA Modernization and Reform Act of 2012 (49 U.S.C. 40101 note).
Sec. 5 Model aircraft provision
Nothing in this Act may be construed to apply to model aircraft (as defined in section 336(c) of the FAA Modernization and Reform Act of 2012 (Public Law 112–95; 49 U.S.C. 40101 note)).