Setting an American Framework to Ensure Data Access, Transparency, and Accountability Act
A BILL
To establish data privacy and data security protections for consumers in the United States.
Sec. 2 Definitions
In this Act:
Affirmative express consent— The term affirmative express consent means, upon being presented with a clear and conspicuous description of an act or practice for which consent is sought, an affirmative act by the individual clearly communicating the individual’s authorization for the act or practice.
Algorithm— The term algorithm means a computational process derived from machine learning, statistics, or other data processing or artificial intelligence techniques, that processes covered data for the purpose of making a decision or facilitating human decision making.
Algorithmic ranking system— The term algorithmic ranking system means a computational process, including one derived from algorithmic decision making, machine learning, statistical analysis, or other data processing or artificial intelligence techniques, used to determine the order or manner that a set of information is provided to a user on a covered internet platform, including the ranking of search results, the provision of content recommendations, the display of social media posts, or any other method of automated content selection.
Behavioral or psychological experiments or research— The term behavioral or psychological experiments or research means the study, including through human experimentation, of overt or observable actions and mental phenomena inferred from behavior, including interactions between and among individuals and the activities of social groups.
Collection— The term collection means buying, renting, gathering, obtaining, receiving, or accessing any covered data of an individual by any means.
Commission— The term Commission means the Federal Trade Commission.
Common branding— The term common branding means a shared name, servicemark, or trademark.
Compulsive usage— The term compulsive usage means any response stimulated by external factors that causes an individual to engage in repetitive, purposeful, and intentional behavior causing psychological distress, loss of control, anxiety, depression, or harmful stress responses.
Connected device— For purposes of paragraphs (20) and (37), the term connected device means a physical object that—
is capable of connecting to the internet, either directly or indirectly through a network, to communicate information at the direction of an individual; and
has computer processing capabilities for collecting, sending, receiving, or analyzing data.
Covered data—
In general— The term covered data means information that identifies or is linked or reasonably linkable to an individual or a device that is linked or reasonably linkable to an individual.
Linked or reasonably linkable— For purposes of subparagraph (A), information held by a covered entity is linked or reasonably linkable to an individual or a device if, as a practical matter, it can be used on its own or in combination with other information held by, or readily accessible to, the covered entity to identify such individual or such device.
Exclusions— Such term does not include—
aggregated data;
de-identified data;
employee data; or
publicly available information.
Aggregated data— For purposes of subparagraph (C), the term aggregated data means information that relates to a group or category of individuals or devices that does not identify and is not linked or reasonably linkable to any individual.
De-identified data— For purposes of subparagraph (C), the term de-identified data means information held by a covered entity that—
does not identify, and is not linked or reasonably linkable to, an individual or device;
does not contain any persistent identifier or other information that could readily be used to re-identify the individual to whom, or the device to which, the identifier or information pertains;
is subject to a public commitment by the covered entity—
to refrain from attempting to use such information to identify any individual or device; and
to adopt technical and organizational measures to ensure that such information is not linked to any individual or device; and
is not disclosed by the covered entity to any other party unless the disclosure is subject to a contractually or other legally binding requirement that—
the recipient of the information shall not use the information to identify any individual or device; and
all onward disclosures of the information shall be subject to the requirement described in subclause (I).
Employee data— For purposes of subparagraph (C), the term employee data means—
information relating to an individual collected by a covered entity in the course of the individual acting as a job applicant to, or employee (regardless of whether such employee is paid or unpaid, or employed on a temporary basis), owner, director, officer, staff member, trainee, vendor, visitor, volunteer, intern, or contractor of, the entity, provided that such information is collected, processed, or transferred by the covered entity solely for purposes related to the individual’s status as a current or former job applicant to, or an employee, owner, director, officer, staff member, trainee, vendor, visitor, volunteer, intern, or contractor of, that covered entity;
business contact information of an individual, including the individual's name, position or title, business telephone number, business address, business email address, qualifications, and other similar information, that is provided to a covered entity by an individual who is acting in a professional capacity, provided that such information is collected, processed, or transferred solely for purposes related to such individual's professional activities;
emergency contact information collected by a covered entity that relates to an individual who is acting in a role described in clause (i) with respect to the covered entity, provided that such information is collected, processed, or transferred solely for the purpose of having an emergency contact on file for the individual; or
information relating to an individual (or a relative or beneficiary of such individual) that is necessary for the covered entity to collect, process, or transfer for the purpose of administering benefits to which such individual (or relative or beneficiary of such individual) is entitled on the basis of the individual acting in a role described in clause (i) with respect to the entity, provided that such information is collected, processed, or transferred solely for the purpose of administering such benefits.
Publicly available information—
In general— For the purposes of subparagraph (C), the term publicly available information means any information that a covered entity has a reasonable basis to believe—
has been lawfully made available to the general public from Federal, State, or local government records;
is widely available to the general public, including information from—
a telephone book or online directory;
television, internet, or radio content or programming; or
the news media or a website that is lawfully available to the general public on an unrestricted basis (for purposes of this subclause a website is not restricted solely because there is a fee or log-in requirement associated with accessing the website); or
is a disclosure to the general public that is required to be made by Federal, State, or local law.
Exclusions— Such term does not include an obscene visual depiction (as defined for purposes of section 1460 of title 18, United States Code).
Covered entity— The term covered entity means any person that—
is subject to the Federal Trade Commission Act (15 U.S.C. 41 et seq.) or is—
a common carrier described in section 5(a)(2) of such Act (15 U.S.C. 45(a)(2)); or
an organization not organized to carry on business for their own profit or that of their members;
collects, processes, or transfers covered data; and
determines the purposes and means of such collection, processing, or transfer.
Covered internet platform—
In general— The term covered internet platform means any public-facing website, internet application, or mobile application, including a social network site, video sharing service, search engine, or content aggregation service.
Exclusions— Such term shall not include a platform that—
is wholly owned, controlled, and operated by a person that—
for the most recent 6-month period, did not employ more than 500 employees;
for the most recent 3-year period, averaged less than $50,000,000 in annual gross receipts; and
collects or processes on an annual basis the personal data of less than 1,000,000 individuals; or
is operated for the sole purpose of conducting research that is not made for profit either directly or indirectly.
Data Broker—
In general— The term data broker means a covered entity whose principal source of revenue is derived from processing or transferring the covered data of individuals with whom the entity does not have a direct relationship on behalf of third parties for such third parties' use.
Exclusion— Such term does not include a service provider.
Delete— The term delete means to remove or destroy information such that it is not maintained in human or machine readable form and cannot be retrieved or utilized in such form in the normal course of business.
Executive agency— The term Executive agency has the meaning set forth in section 105 of title 5, United States Code.
Independent review board— The term independent review board means a board, committee, or other group formally designated by a large online operator to review, to approve the initiation of, and to conduct periodic review of, any research by, or at the direction or discretion of a large online operator, involving human subjects.
Individual— The term individual means a natural person residing in the United States.
Inferred data— The term inferred data means information that is created by a covered entity through the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
Informed consent— For purposes of section 206, the term informed consent—
means a process by which a research subject is provided adequate information prior to being included in any experiment or study to allow for an informed decision about voluntary participation in a behavioral or psychological research experiment or study, while ensuring the understanding of the potential participant of the furnished information and any associated benefits, risks, or consequences of participation prior to obtaining the voluntary agreement to participate by the participant; and
does not include—
the consent of an individual under the age of 13; or
the consent to a provision contained in a general contract or service agreement.
Input-transparent algorithm—
In general— For purposes of section 205, the term input-transparent algorithm means an algorithmic ranking system that does not use the user-specific data of a user to determine the order or manner that information is furnished to such user on a covered internet platform, unless the user-specific data is expressly provided to the platform by the user for such purpose.
Inclusion of age-appropriate content filters— Such term shall include an algorithmic ranking system that uses user-specific data to determine whether a user is old enough to access age-restricted content on a covered internet platform, provided that the system otherwise meets the requirements of subparagraph (A).
Data provided for express purpose of interaction with platform— For purposes of subparagraph (A), user-specific data that is provided by a user for the express purpose of determining the order or manner that information is furnished to a user on a covered internet platform—
shall include user-supplied search terms, filters, speech patterns (if provided for the purpose of enabling the platform to accept spoken input or selecting the language in which the user interacts with the platform), saved preferences, and the user's current geographical location;
shall include data supplied to the platform by the user that expresses the user's desire that information be furnished to them, such as the social media profiles the user follows, the video channels the user subscribes to, or other sources of content on the platform the user follows;
shall not include the history of the user's connected device, including the user's history of web searches and browsing, geographical locations, physical activity, device interaction, and financial transactions; and
shall not include inferences about the user or the user's connected device, without regard to whether such inferences are based on data described in clause (i).
Large data holder— The term large data holder means a covered entity that in the most recent calendar year—
processed or transferred the covered data of more than 8,000,000 individuals; or
processed or transferred the sensitive covered data of more than 300,000 individuals or devices that are linked or reasonably linkable to an individual (excluding any instance where the covered entity processes the log-in information of an individual or device to allow the individual or device to log in to an account administered by the covered entity).
Large online operator— For purposes of section 206, the term large online operator means any person that—
provides an online service;
has more than 100,000,000 authenticated users of an online service in any 30-day period; and
is subject to the jurisdiction of the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Material— The term material means, with respect to an act, practice, or representation of a covered entity (including a representation made by the covered entity in a privacy policy or similar disclosure to individuals), that such act, practice, or representation is likely to affect an individual's decision or conduct regarding a product or service.
Online service— For purposes of section 206, the term online service means a website or a service, other than an internet access service, that is made available to the public over the internet, including a social network, a search engine, or email service.
Opaque algorithm—
In general— The term opaque algorithm means an algorithmic ranking system that determines the order or manner that information is furnished to a user on a covered internet platform based, in whole or part, on user-specific data that was not expressly provided by the user to the platform for such purpose.
Exception for age-appropriate content filters— Such term shall not include an algorithmic ranking system used by a covered internet platform if—
the only user-specific data (including inferences about the user) that the system uses is information relating to the age of the user; and
such information is only used to restrict a user's access to content on the basis that the individual is not old enough to access such content.
Process— The term process means any operation or set of operations performed on covered data including analysis, organization, structuring, retaining, using, or otherwise handling covered data.
Processing purpose— The term processing purpose means a reason for which a covered entity processes covered data.
Research— The term research means the scientific analysis of information, including covered data, by a covered entity or those with whom the covered entity is cooperating or others acting at the direction or on behalf of the covered entity, that is conducted for the primary purpose of advancing scientific knowledge and may be for the commercial benefit of the covered entity.
Search syndication contract; upstream provider; downstream provider—
Search syndication contract— The term search syndication contract means a contract or subcontract for the sale, license, or other right to access an index of web pages on the internet for the purpose of operating an internet search engine.
Upstream provider— The term upstream provider means, with respect to a search syndication contract, the person that grants access to an index of web pages on the internet to a downstream provider under the contract.
Downstream provider— The term downstream provider means, with respect to a search syndication contract, the person that receives access to an index of web pages on the internet from an upstream provider under such contract.
Sensitive covered data—
In general— The term sensitive covered data means any of the following forms of covered data of an individual:
A unique, government-issued identifier, such as a Social Security number, passport number, or driver’s license number, that is not required to be displayed to the public.
Any covered data that describes or reveals the diagnosis or treatment of the past, present, or future physical health, mental health, or disability of an individual.
A financial account number, debit card number, credit card number, or any required security or access code, password, or credentials allowing access to any such account.
Covered data that is biometric information.
A persistent identifier.
Precise geolocation information.
The contents of an individual’s private communications, such as emails, texts, direct messages, or mail, or the identity of the parties subject to such communications, unless the covered entity is the intended recipient of the communication.
Account log-in credentials such as a user name or email address, in combination with a password or security question and answer that would permit access to an online account.
Covered data revealing an individual’s racial or ethnic origin, or religion in a manner inconsistent with the individual’s reasonable expectation regarding the processing or transfer of such information.
Covered data revealing the sexual orientation or sexual behavior of an individual in a manner inconsistent with the individual’s reasonable expectation regarding the processing or transfer of such information.
Covered data about the online activities of an individual that addresses or reveals a category of covered data described in another subparagraph of this paragraph.
Covered data that is calendar information, address book information, phone or text logs, photos, or videos maintained for private use on an individual’s device.
Any covered data collected or processed by a covered entity for the purpose of identifying covered data described in another clause of this paragraph.
Any other category of covered data designated by the Commission pursuant to a rulemaking under section 553 of title 5, United States Code.
Biometric information— For purposes of subparagraph (A), the term biometric information—
means the physiological or biological characteristics of an individual, including deoxyribonucleic acid, that are used, singly or in combination with each other or with other identifying data, to establish the identity of an individual; and
includes—
imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted; and
keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
Persistent identifier— For purposes of subparagraph (A), the term persistent identifier means a technologically derived identifier that identifies an individual, or is linked or reasonably linkable to an individual over time and across services and platforms, which may include a customer number held in a cookie, a static Internet Protocol address, a processor or device serial number, or another unique device identifier.
Precise geolocation information— For purposes of subparagraph (A), the term precise geolocation information means technologically derived information capable of determining the past or present actual physical location of an individual or an individual’s device at a specific point in time to within 1,750 feet.
Service provider— The term service provider means, with respect to a set of covered data, a covered entity that processes or transfers such covered data for the purpose of performing one or more services or functions on behalf of, and at the direction of, another covered entity that—
is not related to the covered entity providing the service or function by common ownership or corporate control; and
does not share common branding with the covered entity providing the service or function.
Service provider data— The term service provider data means, with respect to a set of covered data and a service provider, covered data that is collected by the service provider on behalf of a covered entity or transferred to the service provider by a covered entity for the purpose of allowing the service provider to perform a service or function on behalf of, and at the direction of, such covered entity.
Third party— The term third party means, with respect to a set of covered data, a covered entity—
that is not a service provider with respect to such covered data; and
that received such covered data from another covered entity—
that is not related to the covered entity by common ownership or corporate control; and
that does not share common branding with the covered entity.
Third party data— The term third party data means, with respect to a third party, covered data that has been transferred to the third party by a covered entity.
Transfer— The term transfer means to disclose, release, share, disseminate, make available, or license in writing, electronically, or by any other means for consideration of any kind or for a commercial purpose.
User data— For purposes of section 206, the term user data means any information relating to an identified or identifiable individual user, whether directly submitted to the large online operator by the user, or derived from the observed activity of the user by the large online operator.
User-specific data— For purposes of section 205, the term user-specific data means information relating to an individual or a specific connected device that would not necessarily be true of every individual or device.
Sec. 3 Effective date
Except as otherwise provided in this Act, this Act shall take effect 18 months after the date of enactment of this Act.