1. Short title
This Act may be cited as the “Information Transparency & Personal Data Control Act”.
Information Transparency & Personal Data Control Act
A BILL
To require the Federal Trade Commission to promulgate regulations related to sensitive personal information, and for other purposes.
2. Sense of Congress
It is the Sense of Congress that—
the United States must develop a balanced, high-standard digital framework that establishes global standards;
a key element of this framework is a strong national standard that combats anti-consumer practices;
it is critical that the Federal Government provide guidance on the collection and storage of sensitive data;
it is important to provide our country with fair and thoughtful digital consumer rights; and
it is important to ensure that our enforcement authorities have the resources needed to protect consumers from bad actors in the privacy and security space.
3. Requirements for sensitive personal information
Regulations— Not later than 1 year after the date of the enactment of this Act, the Federal Trade Commission shall promulgate regulations under section 553 of title 5, United States Code, to require, except as provided in subsection (b), any controller that provides services to the public involving the collection, storage, processing, sale, sharing with third parties, or other use of sensitive personal information from United States persons or persons located in the United States when the data is collected, to meet the following requirements:
Affirmative, express, and opt-in consent— Provide users with notice through a privacy and data use policy of a specific request to use their sensitive personal information and require that users provide affirmative, express, and opt-in consent to any functionality that involves the collection, storage, processing, sale, sharing, or other use of sensitive personal information, including sharing sensitive personal information with third parties.
Privacy and data use policy— Provide users with an up-to-date, transparent privacy, security, and data use policy that meets general requirements, including that such policy, presented to users in the context where it applies—
is concise and intelligible;
is clear and prominent in appearance;
uses clear and plain language;
uses visualizations where appropriate to make complex information understandable by the ordinary user; and
is provided free of charge.
Additional requirements for privacy and data use policy— The privacy, security, and data use policy required under paragraph (2) shall include the following:
Identity and contact information of the entity collecting the sensitive personal information.
The purpose or use for collecting, storing, processing, selling, sharing, or otherwise using the sensitive personal information.
Third parties with whom the sensitive personal information will be shared and for what purposes.
The storage period for how long the sensitive personal information will be retained by the controller and any third party, as applicable.
How consent to collecting, storing, processing, selling, sharing, or otherwise using the sensitive personal information, including sharing with third parties, may be withdrawn.
How a user can view or obtain the sensitive personal information that they have provided to a controller and whether it can be exported to other web-based platforms.
What kind of sensitive personal information is collected and shared.
Whether the sensitive personal information will be used to create profiles about users and whether they will be integrated across platforms.
How sensitive personal information is protected from unauthorized access or acquisition.
Opt-out consent— For any collection, storage, processing, selling, sharing, or other use of non-sensitive personal information, including sharing with third parties, controllers shall provide users with the ability to opt out at any time.
Privacy audits—
In general— Except as provided in subparagraphs (C) and (D), annually, each controller collecting, storing, processing, selling, sharing, or otherwise using sensitive personal information shall—
obtain a privacy audit from a qualified, objective, independent third-party; and
shall make public whether or not the privacy audit found the controller compliant.
Audit requirements— Each such audit shall—
set forth the privacy, security, and data use controls that the controller has implemented and maintained during the reporting period;
describe whether such controls are appropriate to the size and complexity of the controller, the nature and scope of the activities of the controller, and the nature of the sensitive personal information or behavioral data collected by the controller;
certify whether the privacy and security controls operate with sufficient effectiveness to provide reasonable assurance to protect the privacy and security of sensitive personal information or behavioral data, including with respect to data shared with third parties, and that the controls have so operated throughout the reporting period;
be prepared and completed within 60 days after the end of the reporting period to which the audit applies; and
be provided to the Federal Trade Commission or to the attorney general of a State, or other authorized State officer, within 10 days of notification by the Commission or the attorney general of a State, or other authorized State officer where such person has presented to the controller allegations that a violation of this Act or any regulation issued under this Act has been committed by the controller.
Small business audit exemption— The audit requirements described in this paragraph shall not apply to controllers who collect, store, process, sell, share, or otherwise use sensitive personal information relating to 5,000 or fewer individuals.
Non-sensitive personal information exemption— The audit requirements set forth above shall not apply to controllers who do not collect, store, process, sell, share, or otherwise use sensitive personal information.
Exemptions—
Necessary operations and security purposes— Subsection (a) shall not apply to the processing, collecting, storing, sharing, selling of sensitive personal information for the following purposes:
Preventing or detecting fraud, identity theft, or criminal activity.
The use of such information to identify errors that impair functionality or otherwise enhancing or maintaining the availability of the services or information systems of the controller for authorized access and use.
Protecting the vital interests of the consumer or another natural person.
Responding in good faith to valid legal process or providing information as otherwise required or authorized by law.
Monitoring or enforcing agreements between the controller and an individual, including but not limited to, terms of service, terms of use, user agreements, or agreements concerning monitoring criminal activity.
Protecting the property, services, or information systems of the controller against unauthorized access or use.
Advancing a substantial public interest, including archival purposes, scientific or historical research, and public health, if such processing does not create a significant risk of harm to consumers.
Reasonable expectation of users— The regulations promulgated pursuant to subsection (a) with respect to the requirement to provide opt-in consent shall not apply to the processing, storage, and collection of sensitive personal information or behavioral data in which such processing does not deviate from purposes consistent with a controller’s relationship with users as understood by the reasonable user.
4. Application and enforcement by the Federal Trade Commission
Common carriers— Notwithstanding the limitations in the Federal Trade Commission Act (15 U.S.C. 41 et seq.) on Commission authority with respect to common carriers, this Act applies, according to its terms, to common carriers subject to the Communications Act of 1934 (47 U.S.C. 151 et seq.) and all Acts amendatory thereof and supplementary thereto.
Enforcement—
Unfair or deceptive acts or practices— A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
Powers of Commission— Except as provided in subsection (a), the Federal Trade Commission shall enforce this Act and the regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Construction— Nothing in this Act shall be construed to limit the authority of the Federal Trade Commission under any other provision of law.
5. Right of action
Right of action— Except as provided in subsection (e), the attorney general of a State, or other authorized State officer, alleging a violation of this Act or any regulation issued under this Act that affects or may affect such State or its residents may bring an action on behalf of the residents of the State in any United States district court for the district in which the defendant is found, resides, or transacts business, or wherever venue is proper under section 1391 of title 28, to obtain appropriate injunctive relief.
Notice to Commission required— A State shall provide prior written notice to the Federal Trade Commission of any civil action under subsection (a) together with a copy of its complaint, except that if it is not feasible for the State to provide such prior notice, the State shall provide such notice immediately upon instituting such action.
Intervention by the Commission— The Commission may intervene in such civil action and upon intervening—
be heard on all matters arising in such civil action; and
file petitions for appeal of a decision in such civil action.
Construction— Nothing in this section shall be construed—
to prevent the attorney general of a State, or other authorized State officer, from exercising the powers conferred on the attorney general, or other authorized State officer, by the laws of such State; or
to prohibit the attorney general of a State, or other authorized State officer, from proceeding in State or Federal court on the basis of an alleged violation of any civil or criminal statute of that State.
Limitation—
No separate action— An action may not be brought under subsection (a) if the same alleged violation is the subject of a pending action by the Commission or the United States.
Exclusive period to act by Commission— An action—
may not be brought under subsection (a) until the expiration of the 60-day period that begins on the date on which a violation is discovered by the Commission or the date on which the Commission is notified of the violation; and
may only be brought under subsection (a) if the Commission does not bring an action related to the violation during such period.
6. Privacy and data security employees and funding for the Commission
Employment authority— The Commission shall hire 50 new full-time employees to focus on privacy and data security, 15 of which shall have technology expertise.
Additional funding for privacy and data security— There is authorized to be appropriated to the Commission $35,000,000 for issues related to privacy and data security.
7. Definitions
In this Act:
Call detail record— The term call detail record—
means session-identifying information (including an originating or terminating telephone number, an International Mobile Subscriber Identity number, or an International Mobile Station Equipment Identity number), a telephone calling card number, or the time or duration of a call;
does not include—
the contents (as defined in section 2510(8) of title 18, United States Code) of any communication;
the name, address, or financial information of a subscriber or customer;
cell site location or global positioning system information; or
business customers.
Clear and prominent— The term clear and prominent means in any communication medium, the required disclosure is—
of a type, size, and location sufficiently noticeable for an ordinary consumer to read and comprehend the communication;
provided in a manner such that an ordinary consumer is able to read and comprehend the communication;
is presented in an understandable language and syntax;
includes nothing contrary to, inconsistent with, or that mitigates any statement contained within the disclosure or within any document linked to or referenced therein; and
includes an option that is compliant with applicable obligations of the controller under title III of the Americans with Disabilities Act of 1990 (42 U.S.C. 12181 et seq.).
Commission— The term Commission means the Federal Trade Commission.
Controller— The term controller means a person that, on its own or jointly with other entities, determines the purposes and means of processing sensitive personal information.
Processor— The term processor means a person that processes data on behalf of the controller.
Sensitive personal information—
The term sensitive personal information means information relating to an identified or identifiable individual, including the following:
Financial account information.
Health information.
Genetic data.
Information pertaining to children under 13 years of age.
Social Security numbers.
Unique government-issued identifiers
Authentication credentials, such as a username and password.
Precise geolocation information.
Content of a wire communication, oral communication, or electronic communication with respect to any entity that is not the intended recipient of the communication.
Call detail records.
Web browsing history, application usage history, and the functional equivalent of either.
Biometric information.
Sexual orientation.
Religious beliefs.
The term sensitive personal information does not include—
de-identified information (or the process of transforming personal data so that it is not directly relatable to an identified or identifiable consumer);
information related to employment; or
publicly available information.
State— The term State means each State of the United States, the District of Columbia, and each commonwealth, territory, or possession of the United States.
Third party— The term third party means an individual or entity that uses or receives sensitive personal information or behavioral data obtained by or on behalf of a controller, other than—
a service provider of a controller to whom the controller discloses the consumer’s sensitive personal information for an operational purpose pursuant to an agreement that prohibits the service provider receiving the sensitive personal information from using or disclosing the sensitive personal information for the benefit of the provider; and
any entity that uses sensitive personal information only as reasonably necessary—
to comply with applicable law, regulation, or legal process;
to enforce the terms of use of a controller; or
to detect, prevent, or mitigate fraud or security vulnerabilities.
8. Rule of construction
Nothing in this Act may be construed to preclude the acquisition by the Federal Government of—
the contents of a wire or electronic communication pursuant to other lawful authorities, including the authorities under chapter 119 of title 18, United States Code (commonly known as the “Wiretap Act”), the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), or any other provision of Federal law not specifically amended by this Act; or
records or other information relating to a subscriber or customer of any electronic communication service or remote computing service (not including the content of such communications) pursuant to the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), chapter 119 of title 18, United States Code (commonly known as the “Wiretap Act”), or any other provision of Federal law not specifically amended by this Act.
9. National standard
Preemption— For a controller that is subject to this Act, or any regulation promulgated pursuant to this Act, the provisions of this Act, or any such regulation, shall preempt any civil provision of the law of any State or political subdivision of a State to the degree the law is focused on the reduction of privacy risk through the regulation of the collection of sensitive personal information and the collection, storage, processing, sale, sharing with third parties, or other use of such information.
Consumer protection laws— Except as provided in subsection (a), this section may not be construed to limit the enforcement, or the bringing of a claim pursuant to any State consumer protection law by an attorney general of a State, other than the extent to which any such law regulates the collection of sensitive personal information and the collection, storage, processing, sale, sharing with third parties, or other use of such information.
Protection of certain State law— Nothing in this Act may be construed to preempt the applicability of any of the following:
State constitutional, trespass, contract, data breach notification, or tort law, other than to the degree such law is substantially intended to govern the collection of sensitive personal information and the collection, storage, processing, sale, sharing with third parties, or other use of such information.
Any other State law to the extent that the law relates to acts of fraud, wiretapping, or the protection of social security numbers.
Any State law to the extent the law provides additional provisions to specifically regulate the covered entities as defined for purposes of the regulations promulgated pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191), section 444 of the General Education Provisions Act (commonly known as the Family Educational Rights and Privacy Act of 1974) (20 U.S.C. 1232g), the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), or the Gramm-Leach-Bliley Act (15 U.S.C. 6701 et seq.).
Any private contract based on a State law that requires a party to provide additional or greater privacy for sensitive personal information or data security protections to an individual than this Act, or any regulation promulgated pursuant to this Act.
10. Effective date
This Act shall take effect 180 days after the date of the enactment of this Act.