1. Short title
This Act may be cited as the “Protecting Personal Information Act of 2019”.
Protecting Personal Information Act of 2019
A BILL
To require entities to provide consumers with the opportunity to prohibit the entity from collecting or using certain data concerning the consumer and to request deletion of such data.
2. Requirements for entities with respect to the collection or use of certain data concerning the consumer
Opportunity To prohibit the entity from collecting or using certain data— A covered entity shall, prior to collecting covered data concerning an individual, provide the individual with an opportunity to prohibit the covered entity from collecting such data or selling or otherwise transferring such data to a third party.
Deletion upon request— Upon a request from an individual for whom a covered entity has collected covered data, the covered entity shall, without undue delay, delete such covered data.
3. Enforcement by the Federal Trade Commission
Unfair or deceptive acts or practices— A violation of section 2 shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Powers of Commission—
In general— The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.
Privileges and immunities— Any covered entity that violates section 2 shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Authority preserved— Nothing in this Act shall be construed to limit the authority of the Federal Trade Commission under any other provision of law.
4. Enforcement by States
In general— In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any covered entity subject to section 2 in a practice that violates such section, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States—
to enjoin further violation of such section by such person;
to compel compliance with such section; and
to obtain damages, restitution, or other compensation on behalf of such residents.
Rights of Federal Trade Commission—
Notice to Federal Trade Commission—
In general— Except as provided in subparagraph (C), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under subsection (a) not later than 10 days before initiating the civil action.
Contents— The notification required by subparagraph (A) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action.
Exception— If it is not feasible for the attorney general of a State to provide the notification required by subparagraph (A) before initiating a civil action under subsection (a), the attorney general shall notify the Commission immediately upon instituting the civil action.
Intervention by Federal Trade Commission— The Commission may—
intervene in any civil action brought by the attorney general of a State under subsection (a); and
upon intervening—
be heard on all matters arising in the civil action; and
file petitions for appeal of a decision in the civil action.
Investigatory powers— Nothing in this section may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.
Preemptive action by Federal Trade Commission— If the Commission institutes a civil action or an administrative action with respect to a violation of section (2), the attorney general of a State may not, during the pendency of such action, bring a civil action under subsection (a) against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action.
Venue; service of process—
Venue— Any action brought under subsection (a) may be brought in—
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
another court of competent jurisdiction.
Service of process— In an action brought under subsection (a), process may be served in any district in which the defendant—
is an inhabitant; or
may be found.
Actions by other State officials—
In general— In addition to civil actions brought by attorneys general under subsection (a), any other consumer protection officer of a State who is authorized by the State to do so may bring a civil action under subsection (a), subject to the same requirements and limitations that apply under this section to civil actions brought by attorneys general.
Savings provision— Nothing in this section may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State.
5. Definitions
In this Act:
Commission— The term Commission means the Federal Trade Commission.
Covered data—
In general— Except as provided in subparagraph (B), the term covered data means only the following:
Personally identifiable information.
Unique identifier information.
Any information that is collected, used, or stored in connection with personally identifiable information or unique identifier information in a manner that may reasonably be used by the party collecting the information to identify a specific individual.
Exception— The term covered data does not include the following:
Personally identifiable information obtained from public records that is not merged with covered information gathered elsewhere.
Personally identifiable information that is obtained from a forum—
where the individual voluntarily shared the information or authorized the information to be shared; and
that—
is widely and publicly available and was not made publicly available in bad faith; and
contains no restrictions on who can access and view such information.
Personally identifiable information reported in public media.
Personally identifiable information dedicated to contacting an individual at the individual's place of work.
Covered entity— The term covered entity means an entity—
that collects covered data concerning individuals;
that—
has gross annual revenue in excess of $25,000,000;
annually buys, receives, sells, or shares covered data of 50,000 or more individuals; or
derives 50 percent or more of its annual revenue from selling individuals' covered data; and
that is—
a person over which the Commission has authority pursuant to section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2));
a common carrier subject to the Communications Act of 1934 (47 U.S.C. 151 et seq.), notwithstanding the definition of the term “Acts to regulate commerce” in section 4 of the Federal Trade Commission Act (15 U.S.C. 44) and the exception provided by section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) for such carriers; or
a nonprofit organization, including any organization described in section 501(c) of the Internal Revenue Code of 1986 that is exempt from taxation under section 501(a) of such Code, notwithstanding the definition of the term “Acts to regulate commerce” in section 4 of the Federal Trade Commission Act (15 U.S.C. 44) and the exception provided by section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) for such organizations.
Delete— The term delete means to remove personally identifiable information such that the information is not maintained in retrievable form and cannot be retrieved in the normal course of business.
Personally identifiable information— The term personally identifiable information means only the following:
Any of the following information about an individual:
The first name (or initial) and last name of an individual, whether given at birth or time of adoption, or resulting from a lawful change of name.
The postal address of a physical place of residence of such individual.
An e-mail address.
A telephone number or mobile device number.
A social security number or other government issued identification number issued to such individual.
The account number of a credit card issued to such individual.
Unique identifier information that alone can be used to identify a specific individual.
Biometric data about such individual, including fingerprints and retina scans.
If used, transferred, or stored in connection with one or more of the items of information described in subparagraph (A), any of the following:
A date of birth.
The number of a certificate of birth or adoption.
A place of birth.
Unique identifier information that alone cannot be used to identify a specific individual.
Precise geographic location, at the same degree of specificity as a global positioning system or equivalent system, and not including any general geographic information that may be derived from an Internet Protocol address.
Information about an individual's destination, location, and amount of uses of voice services, regardless of technology used.
Any other information concerning an individual that may reasonably be used by the party using, collecting, or storing that information to identify that individual.
Third party— The term third party means, with respect to a covered entity, a person that—
is—
not related to the covered entity by common ownership or corporate control; or
related to the covered entity by common ownership or corporate control and an ordinary consumer would not understand that the covered entity and the person were related by common ownership or corporate control;
is not a service provider used by the covered entity to receive covered data in performing services or functions on behalf of and under the instruction of the covered entity; and
with respect to the collection of covered data of an individual, does not have an established business relationship with the individual and does not identify itself to the individual at the time of such collection in a clear and conspicuous manner that is visible to the individual.