Section 1 Short title
This Act may be cited as the “Prevent Recording of Individuals with Video and Audio Technologies when not Enabled Act” or the “PRIVATE Act”.
Prevent Recording of Individuals with Video and Audio Technologies when not Enabled Act
A BILL
To provide for certain requirements for the collection, transmission, processing, or disclosure of camera or microphone data by the manufacturer of an internet-connected device or developer of an application installed on such a device, and for other purposes.
Sec. 2 Treatment of camera and microphone data by internet-connected devices and applications
Prohibition—
In general— A covered entity may not collect any data using the camera or microphone of a covered device of an individual, cause any data so collected to be transmitted from the device, or process or disclose to another person any data so collected, unless—
the collection, transmission, processing, or disclosure is consistent with reasonable consumer expectations within the context of the interaction between the covered entity and the individual; or
the covered entity obtains the express, affirmative consent of the individual to the collection, transmission, processing, or disclosure in the manner required by subsection (b).
Reasonable consumer expectations— For purposes of paragraph (1)(A), the collection, transmission, processing, or disclosure of data is not consistent with reasonable consumer expectations if—
the collection, transmission, processing, or disclosure is not reasonably required for the functionality of the covered device manufactured by the covered entity or the covered application developed by the covered entity (as the case may be); or
the data is collected, transmitted, or processed (regardless of whether the processing occurs on the covered device or on the systems of the covered entity) when the individual is not actively using the covered device or covered application (as the case may be).
Requirements for obtaining express, affirmative consent—
In general— To obtain the express, affirmative consent of an individual to the collection of data using the camera or microphone of a covered device of the individual, the causing of any data so collected to be transmitted from the device, or the processing or disclosure to another person of any data so collected, a covered entity shall—
provide to the individual a brief notice of the collection, transmission, processing, or disclosure that meets the requirements of paragraph (2); and
obtain an affirmative response from the individual indicating that the individual consents to the collection, transmission, processing, or disclosure.
Brief notice— The brief notice required by paragraph (1)(A) shall—
briefly describe the collection, transmission, processing, or disclosure for which consent is sought;
be provided in a conspicuous manner;
be separate from any other privacy policy or terms or conditions relating to the covered device or covered application;
be in plain language;
be provided—
in the case of a covered device that has a screen (or a covered application installed on a covered device that has a screen)—
in the form of text displayed on the screen; and
if the individual so chooses, in spoken form; and
in the case of a covered device that does not have a screen (or a covered application installed on a covered device that does not have a screen)—
in spoken form; and
if the individual so chooses, in an alternative form that is accessible to individuals with a hearing impairment; and
clearly and conspicuously direct the individual to a website on which the individual may access the privacy policy required by paragraph (3).
Privacy policy for camera and microphone data— A covered entity that collects any data using the camera or microphone of a covered device of an individual, causes any data so collected to be transmitted from the device, or processes or discloses to another person any data so collected, shall maintain on a publicly available website a privacy policy that describes in detail, but using plain language, the collection, transmission, processing, or disclosure, including the purposes of the collection, transmission, processing, or disclosure. The privacy policy shall be separate from any other privacy policy or terms or conditions relating to the covered device or covered application and shall be displayed in a conspicuous manner on the website.
Voice-Activated functionality—
In general— Notwithstanding subsection (a)(1)(A)—
if the covered device of an individual has voice-activated functionality, the covered entity that manufactured the covered device may not, in connection with such functionality, collect any data using the camera or microphone of the covered device, cause any data so collected to be transmitted from the device, or process or disclose to another person any data so collected, unless, before such functionality is activated, the covered entity obtains the express, affirmative consent of the individual to the collection, transmission, processing, or disclosure; and
if a covered application installed on the covered device of an individual has voice-activated functionality, the covered entity that developed the covered application may not, in connection with such functionality, collect any data using the camera or microphone of the covered device, cause any data so collected to be transmitted from the device, or process or disclose to another person any data so collected, unless, before such functionality is activated, the covered entity obtains the express, affirmative consent of the individual to the collection, transmission, processing, or disclosure.
Requirements— The express, affirmative consent required by paragraph (1) shall be obtained in the manner required by subsection (b), except that the brief notice required by subparagraph (A) of paragraph (1) of such subsection and the affirmative response required by subparagraph (B) of such paragraph shall be specific to the collection, transmission, processing, or disclosure of data in connection with the voice-activated functionality and separate from the notice provided and response obtained under such subparagraphs with respect to the collection, transmission, processing, or disclosure of data not in connection with such functionality.
Status of consent; revocation— A covered entity shall provide a convenient means, on the covered device manufactured by the covered entity or within the covered application developed by the covered entity (as the case may be), for an individual—
to revoke any consent provided under this section to the collection, transmission, processing, or disclosure of data; and
to view whether the individual has provided or revoked any such consent.
Federal Trade Commission guidance; safe harbor—
Guidance— The Commission shall issue guidance containing examples of language for the brief notice required by subsection (b)(1)(A) (including text and spoken versions) and the privacy policy required by subsection (b)(3).
Safe harbor—
Submission of brief notice or privacy policy to Commission— A covered entity may submit to the Commission for approval a brief notice that the covered entity intends to use to comply with subsection (b)(1)(A) or a privacy policy that the covered entity intends to use to comply with subsection (b)(3) with respect to the collection, transmission, processing, or disclosure of data. The covered entity shall include with the submission such information as the Commission may require about the collection, transmission, processing, or disclosure, as the Commission considers necessary to evaluate the adequacy of the brief notice or privacy policy.
Approval or rejection— Not later than 120 days after receiving a brief notice or privacy policy from a covered entity under subparagraph (A), the Commission shall approve or reject the brief notice or privacy policy and inform the covered entity of the approval or rejection.
Effect— If the Commission approves a brief notice or privacy policy under subparagraph (B), the brief notice or privacy policy shall be considered to meet the requirements of subsection (b)(1)(A) or (b)(3), respectively, with respect to the collection, transmission, processing, or disclosure of data to which the brief notice or privacy policy relates, to the extent the covered entity conducts the collection, transmission, processing, or disclosure in a manner that is consistent in all material respects with the information provided to the Commission under subparagraph (A).
Enforcement by Federal Trade Commission—
Unfair or deceptive acts or practices— A violation of this section or a regulation promulgated under this section shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
Powers of Commission— The Commission shall enforce this section and the regulations promulgated under this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section. Any person who violates this section or a regulation promulgated under this section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Rulemaking— The Commission may promulgate regulations under section 553 of title 5, United States Code, to implement this section.
Definitions— In this section:
Commission— The term “Commission” means the Federal Trade Commission.
Covered application— The term “covered application” means a software application that is designed to be installed on a covered device.
Covered device— The term “covered device” means a device that—
is capable of connecting to the internet, either directly or indirectly through a network;
has computer processing capabilities for collecting, transmitting, or otherwise processing data; and
has a camera or microphone.
Covered entity— The term “covered entity” means—
a manufacturer of a covered device; and
a developer of a covered application.
Voice-activated functionality— The term “voice-activated functionality” means a functionality of a covered device or covered application that—
allows an individual to control the covered device or covered application using voice commands; and
uses the microphone of the covered device being controlled, or the microphone of the covered device on which the covered application being controlled is installed, to listen for such commands when the individual is not actively using the covered device or covered application, respectively.