BILLS 116s142is

II
116TH CONGRESS
1ST SESSION
S. 142
To impose privacy requirements on providers of internet services similar
to the requirements imposed on Federal agencies under the Privacy
Act of 1974.
IN THE SENATE OF THE UNITED STATES

JANUARY 16, 2019
Mr. RUBIO introduced the following bill; which was read twice and referred
to the Committee on Commerce, Science, and Transportation
A BILL
To impose privacy requirements on providers of internet serv-
ices similar to the requirements imposed on Federal
agencies under the Privacy Act of 1974.
1 Be it enacted by the Senate and House of Representa-

2 tives of the United States of America in Congress assembled,
3 SECTION 1. SHORT TITLE.
4 This Act may be cited as the ‘‘American Data Dis-

5 semination Act of 2019’’ or the ‘‘ADD Act’’.
6 SEC. 2. DEFINITIONS.
7 (a) IN GENERAL.—In this Act—

pamtmann on DSKBFK8HB2PROD with BILLS
VerDate Sep 11 2014 23:03 Jan 23, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S142.IS S142
2
1 (1) the term ‘‘agency’’ has the meaning given
2 the term in section 552a of title 5, United States
3 Code;
4 (2) the term ‘‘appropriate committees of Con-
5 gress’’ means—
6 (A) the Committee on Commerce, Science,
7 and Transportation of the Senate; and
8 (B) the Committee on Energy and Com-
9 merce of the House of Representatives;
10 (3) the term ‘‘collect’’ means to buy, rent, gath-
11 er, obtain, receive, or access information about an
12 individual by any means, including by—
13 (A) receiving information from the indi-
14 vidual, either actively or passively; or
15 (B) observing the behavior of the indi-
16 vidual;
17 (4) the term ‘‘Commission’’ means the Federal
18 Trade Commission;
19 (5) the term ‘‘covered provider’’ means a person
20 that—
21 (A) provides a service that uses the inter-
22 net; and
23 (B) in providing the service under subpara-
24 graph (A), collects records;
•S 142 IS
3
1 (6) the term ‘‘disclose’’ means to release, dis-
2 seminate, make available, transfer, or otherwise
3 communicate orally, in writing, or by electronic or
4 other means;
5 (7) the term ‘‘maintain’’ includes maintain, col-
6 lect, use, disclose, or process;
7 (8) the term ‘‘Privacy Act of 1974’’ means sec-
8 tion 552a of title 5, United States Code;
9 (9) the term ‘‘process’’ means to perform an
10 operation or set of operations on information or on
11 sets of information, whether or not by automated
12 means;
13 (10) subject to subsection (b), the term
14 ‘‘record’’ means any item, collection, or grouping of
15 information about an individual that—
16 (A) is maintained by a covered provider,
17 including the education, financial transactions,
18 medical history, and criminal or employment
19 history of the individual; and
20 (B) contains any name or number that
21 may be used, alone or in conjunction with any
22 other information, to identify a specific indi-
23 vidual, including any—
24 (i) name, social security number, date

25 of birth, official driver’s license or identi-
•S 142 IS
4
1 fication number issued by a State, alien
2 registration number, government passport
3 number, or employer or taxpayer identi-
4 fication number;
5 (ii) unique biometric data, such as fin-
6 gerprint, voice print, retina or iris image,
7 or other unique physical representation;
8 (iii) unique electronic identification
9 number, address, or routing code;
10 (iv) telecommunication identifying in-
11 formation or access device (as those terms
12 are defined in section 1029(e) of title 18,
13 United States Code); or
14 (v) user-generated content; and
15 (11) the term ‘‘sell’’ means to disclose informa-
16 tion about an individual to another person for mone-
17 tary or other valuable consideration.
18 (b) MODIFICATION OF DEFINITION.—If the Commis-
19 sion promulgates regulations under section 4(a), the Com-
20 mission may modify, at any time, the definition of the
21 term ‘‘record’’ under subsection (a) of this section as nec-
22 essary to conform to new Federal laws or regulations.
•S 142 IS
5
1 SEC. 3. RECOMMENDED PRIVACY REQUIREMENTS FOR
2 PROVIDERS OF INTERNET SERVICES.
3 (a) IN GENERAL.—Not later than 180 days after the

4 date of enactment of this Act, the Commission shall sub-
5 mit to the appropriate committees of Congress detailed
6 recommendations for privacy requirements that Congress
7 could impose on covered providers that would be substan-
8 tially similar, to the extent practicable, to the require-
9 ments applicable to agencies under the Privacy Act of
10 1974.
11 (b) SUBJECTS FOR RECOMMENDATIONS.—The rec-
12 ommendations under subsection (a) shall address the
13 issues described in section 4.
14 SEC. 4. REGULATIONS IMPOSING PRIVACY REQUIREMENTS
15 ON PROVIDERS OF INTERNET SERVICES.
16 (a) REGULATIONS.—
17 (1) PROPOSED REGULATIONS.—Not earlier
18 than 1 year after the date on which the Commission
19 submits detailed recommendations for privacy re-
20 quirements under section 3(a), and not later than 15
21 months after that date, the Commission shall pub-
22 lish and submit to the appropriate committees of
23 Congress proposed regulations to impose privacy re-
24 quirements on covered providers that are substan-
25 tially similar, to the extent practicable, to the re-
•S 142 IS
6
1 quirements applicable to agencies under the Privacy
2 Act of 1974.
3 (2) FINAL REGULATIONS.—If a law imposing
4 privacy requirements on covered providers that are
5 substantially similar, to the extent practicable, to the
6 requirements applicable to agencies under the Pri-
7 vacy Act of 1974 is not enacted by the date that is
8 2 years after the date of enactment of this Act, the
9 Commission shall, not later than 27 months after
10 that date of enactment, promulgate final regulations
11 that impose such privacy requirements.
12 (b) CONTENTS.—In promulgating regulations under
13 subsection (a), the Commission—
14 (1) shall—
15 (A) establish criteria for exempting certain
16 small, newly formed covered providers from the
17 requirements under the regulations, taking into
18 account factors including—
19 (i) the period of time during which
20 the covered provider has been operating as
21 a covered provider;
22 (ii) the annual revenue of the covered
23 provider; and
24 (iii) the number of individuals about

25 whom the covered provider collects records;
•S 142 IS
7
1 (B) restrict disclosure of records main-
2 tained by covered providers;
3 (C) provide that—
4 (i) an individual may request access to
5 a record (or a portion thereof) maintained
6 by a covered provider that relates to the
7 individual; and
8 (ii) upon a request under clause (i),
9 the covered provider shall—
10 (I) provide the individual with ac-
11 cess to the record (or the relevant
12 portion thereof); or
13 (II) if the covered provider so
14 elects, delete the record (or the rel-
15 evant portion thereof), subject to the
16 requirements to keep and provide an
17 accounting under subparagraph (G);
18 (D) provide that if an individual dem-
19 onstrates that a record relating to the indi-
20 vidual is not accurate, relevant, timely, or com-
21 plete (as those terms are defined by the Com-
22 mission)—
23 (i) the individual may request that the
24 covered provider amend the record; and
•S 142 IS
8
1 (ii) upon a request under clause (i),
2 the covered provider shall amend the
3 record;
4 (E) establish a process modeled on the
5 process established under section 611(a) of the
6 Fair Credit Reporting Act (15 U.S.C.
7 1681i(a))—
8 (i) through which an individual and a
9 covered provider may resolve a dispute
10 under subparagraph (D) of this paragraph
11 regarding the assertion that a record relat-
12 ing to the individual is not accurate, rel-
13 evant, timely, or complete; and
14 (ii) that does not require the indi-
15 vidual to incur any expense;
16 (F) in accordance with accepted standards
17 and in consultation with the Secretary of Com-
18 merce, establish a code of ‘‘fair information
19 practices’’, for the secure collection, mainte-
20 nance, and dissemination of records, with which
21 a covered provider must comply;
22 (G) require a covered provider, in a man-
23 ner substantially similar, to the extent prac-
24 ticable, to the requirements applicable to agen-
•S 142 IS
9
1 cies under section 552a(c) of title 5, United
2 States Code, to—
3 (i) keep an accounting of certain dis-
4 closures of records for a reasonable period
5 of time, as determined by the Commission;
6 and
7 (ii) make available to an individual,
8 upon request, the accounting made under
9 clause (i) of disclosures of records relating
10 to the individual, unless the period of time
11 described in that clause has expired; and
12 (H) to the extent practicable, incorporate
13 the exceptions under paragraphs (1) through
14 (12) of section 552a(b) of title 5, United States
15 Code; and
16 (2) may promulgate regulations not described
17 in paragraph (1) that are modeled on section 552a
18 of title 5, United States Code, and the regulations
19 promulgated under that section.
20 (c) APPLICATION WITH OTHER FEDERAL LAWS.—
21 (1) EXEMPTION FOR PERSONS SUBJECT TO
22 OTHER FEDERAL PRIVACY LAWS.—To the extent

23 that a person is subject to a Federal privacy law de-
24 scribed in paragraph (2) of this subsection, the regu-

25 lations promulgated under subsection (a) shall not
•S 142 IS
10
1 apply to the person with respect to any information
2 or records governed by that Federal privacy law.
3 (2) OTHER FEDERAL PRIVACY LAWS DE-
4 SCRIBED.—The Federal privacy laws described in

5 this paragraph are as follows:
6 (A) The regulations promulgated under
7 section 264(c) of the Health Insurance Port-
8 ability and Accountability Act of 1996 (42
9 U.S.C. 1320d–2 note), as those regulations re-
10 late to—
11 (i) a person described in section
12 1172(a) of the Social Security Act (42
13 U.S.C. 1320d–1(a)); or
14 (ii) transactions referred to in section
15 1173(a)(1) of the Social Security Act (42
16 U.S.C. 1320d–2(a)(1)).
17 (B) Section 444 of the General Education
18 Provisions Act (20 U.S.C. 1232g) (commonly
19 referred to as the ‘‘Family Educational Rights
20 and Privacy Act of 1974’’).
21 (C) Section 552a of title 5, United States
22 Code.
23 (3) CONFLICTS.—
24 (A) CHILDREN’S ONLINE PRIVACY PROTEC-
25 TION ACT.—In the case of a conflict between
•S 142 IS
11
1 the regulations promulgated under subsection
2 (a) of this section and the Children’s Online
3 Privacy Protection Act of 1998 (15 U.S.C.
4 6501 et seq.) (and any regulations promulgated
5 under that Act), the Commission shall deter-
6 mine which provision of law shall apply.
7 (B) GRAMM-LEACH-BLILEY ACT.—In the
8 case of a conflict between the regulations pro-
9 mulgated under subsection (a) of this section
10 and title V of the Gramm-Leach-Bliley Act of
11 1999 (15 U.S.C. 6801 et seq.) (and any regula-
12 tions promulgated under that Act), the Com-
13 mission shall determine which provision of law
14 shall apply.
15 SEC. 5. ENFORCEMENT.
16 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—

17 A violation of a regulation promulgated under section 4(a)
18 shall be treated as a violation of a rule defining an unfair
19 or deceptive act or practice prescribed under section
20 18(a)(1)(B) of the Federal Trade Commission Act (15
21 U.S.C. 57a(a)(1)(B)).
22 (b) POWERS OF COMMISSION.—
23 (1) IN GENERAL.—Except as provided in para-
24 graph (3), if the Commission promulgates regula-

25 tions under section 4(a), the Commission shall en-
•S 142 IS
12
1 force this Act in the same manner, by the same
2 means, and with the same jurisdiction, powers, and
3 duties as though all applicable terms and provisions
4 of the Federal Trade Commission Act (15 U.S.C. 41
5 et seq.) were incorporated into and made a part of
6 this Act.
7 (2) PRIVILEGES AND IMMUNITIES.—Except as
8 provided in paragraph (3), any person who violates
9 a regulation promulgated under section 4(a) shall be
10 subject to the penalties and entitled to the privileges
11 and immunities provided in the Federal Trade Com-
12 mission Act (15 U.S.C. 41 et seq.).
13 (3) COMMON CARRIERS.—Notwithstanding sec-
14 tion 4, 5(a)(2), or 6 of the Federal Trade Commis-
15 sion Act (15 U.S.C. 44, 45(a)(2), 46) or any juris-
16 dictional limitation of the Commission, if the Com-
17 mission promulgates regulations under section 4(a),
18 the Commission shall also enforce this Act, in the
19 same manner provided in paragraphs (1) and (2) of
20 this subsection, with respect to common carriers
21 subject to the Communications Act of 1934 (47
22 U.S.C. 151 et seq.) and Acts amendatory thereof
23 and supplementary thereto.
•S 142 IS
13
1 (4) AUTHORITY PRESERVED.—Nothing in this
2 Act shall be construed to limit the authority of the
3 Commission under any other provision of law.
4 SEC. 6. EFFECT ON STATE LAWS.
5 This Act, including any regulations promulgated

6 under section 4(a), shall supersede any provision of the
7 law of a State relating to a covered provider that is subject
8 to such a regulation, to the extent that the provision re-
9 lates to the maintenance of—
10 (1) records covered by this Act; or
11 (2) any other personally identifiable information
12 or personal identification information.
Æ
•S 142 IS

BILLS 116s142is

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BILLS 116s142is

Uploaded by

Copyright:

Available Formats

II

IN THE SENATE OF THE UNITED STATES

1 Be it enacted by the Senate and House of Representa-

4 This Act may be cited as the ‘‘American Data Dis-

7 (a) IN GENERAL.—In this Act—

24 graph (A), collects records;

24 (i) name, social security number, date

2 PROVIDERS OF INTERNET SERVICES.

3 (a) IN GENERAL.—Not later than 180 days after the

15 ON PROVIDERS OF INTERNET SERVICES.

25 tially similar, to the extent practicable, to the re-

24 (iii) the number of individuals about

24 covered provider amend the record; and

24 ticable, to the requirements applicable to agen-

22 OTHER FEDERAL PRIVACY LAWS.—To the extent

24 scribed in paragraph (2) of this subsection, the regu-

4 SCRIBED.—The Federal privacy laws described in

24 (A) CHILDREN’S ONLINE PRIVACY PROTEC-

25 TION ACT.—In the case of a conflict between

16 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—

24 graph (3), if the Commission promulgates regula-

5 This Act, including any regulations promulgated

You might also like