H.R. 2135 (107th): Consumer Privacy Protection Act

107th Congress, 2001–2002. Text as of Jun 12, 2001 (Introduced).

Status & Summary | PDF | Source: GPO

HR 2135 IH

107th CONGRESS

1st Session

H. R. 2135

To protect consumer privacy.

IN THE HOUSE OF REPRESENTATIVES

June 12, 2001

Mr. SAWYER introduced the following bill; which was referred to the Committee on Energy and Commerce


A BILL

To protect consumer privacy.

    Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ‘Consumer Privacy Protection Act’.

SEC. 2. FINDINGS AND PURPOSE.

    (a) FINDINGS- The Congress finds the following:

      (1) People in the United States lack important privacy protections.

      (2) The opportunities for an individual to secure employment, insurance, and credit, to obtain medical care, and to participate in electronic commerce are endangered by the potential for misuse of certain personal information.

      (3) Because markets work through trust, predictability, and stability, privacy protections should help businesses gain the trust of consumers and compliment existing practices.

      (4) 84 percent of Internet users are concerned about businesses and people they do not know obtaining personal information about them.

      (5) Nearly 80 percent of online consumers have at some time abandoned e-commerce transactions due to privacy concerns, resulting in an estimated loss to companies of $12.4 billion in 2000.

      (6) In order to protect the privacy of individuals in the Information Age, it is necessary and appropriate for public officials to take steps to safeguard this essential freedom.

    (b) PURPOSE- The purpose of this Act is to assure that personal information about an individual consumer in the United States is properly protected and that any use of such information by others is consistent with the prior consent of the consumer.

SEC. 3. PROTECTION OF PERSONAL INFORMATION.

    (a) LIMITATIONS ON DISCLOSURE OF PERSONAL INFORMATION- An information recipient shall not disclose to any other person personal information collected or obtained from or about a consumer, unless--

      (1) such disclosure is made after the consumer has been provided with a clear and concise description of the extent and circumstances under which such a disclosure may occur;

      (2) such disclosure does not exceed the scope of the consumer’s prior consent, which shall be--

        (A) in the case of disclosure of personal information, granted tacitly or affirmatively by the consumer after receiving the description required by paragraph (1); or

        (B) in the case of disclosure of sensitive personal information, granted affirmatively by the consumer after receiving the description required by paragraph (1); and

      (3) the consent granted under paragraph (2) has not subsequently been withdrawn by the consumer.

    (b) LIMITATION ON COLLECTION OF OPTIONAL INFORMATION- An information recipient may not require a consumer to provide, as a condition of entering into or completing a transaction with the information recipient, personal information that is not necessary to complete the transaction.

    (c) LIMITATION ON REFUSAL TO TRANSACT- An information recipient may not terminate or refuse to enter into a transaction with a consumer because the consumer has not granted, or has withdrawn, the consent required by subsection (a), except when the sole purpose of the transaction is the acquisition of such information for disclosure.

    (d) REASONABLE ACCESS TO PERSONAL INFORMATION- An information recipient shall provide to a consumer about whom personal information has been obtained reasonable access to the consumer’s personal information.

SEC. 4. EXCEPTIONS.

    Section 3 does not apply to the disclosure of personal information--

      (1) as necessary to effect, administer, or enforce a transaction requested or authorized by the consumer;

      (2) to protect the confidentiality or security of personal information;

      (3) to prevent or investigate fraud, an unauthorized transaction, a claim, or other liability;

      (4) to collect a debt or dishonored item;

      (5) for the purpose of a securitization or secondary market sale (including servicing rights);

      (6) for the purposes of legal process;

      (7) for law enforcement purposes;

      (8) for governmental regulatory purposes;

      (9) as otherwise authorized or required under a Federal law; or

      (10) if the Federal Trade Commission has made a finding that such a disclosure is consistent with the purposes of this Act and in the public interest.

SEC. 5. UNFAIR OR DECEPTIVE ACT OR PRACTICE.

    (a) VIOLATION OF ACT- Disclosure of personal information about a consumer in a manner that violates this Act constitutes an unfair or deceptive act or practice in or affecting commerce (within the meaning of section 5(a)(1) of the Federal Trade Commission Act (15 U.S.C. 45)).

    (b) VIOLATION OF RULE- Violation of a rule made under this Act constitutes violation of a rule defining an

unfair or deceptive act or practice made under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

SEC. 6. SAFE HARBOR.

    (a) PRACTICES AND PROCEDURES, GUIDELINES- A person does not commit a violation of this Act if such person--

      (1) establishes, implements, and follows reasonable practices and procedures to effectively prevent a violation of this Act;

      (2) implements and follows a set of guidelines setting forth reasonable practices and procedures to effectively prevent a violation of this Act, if such guidelines are--

        (A) issued by a self-regulatory organization to which such person is, or could be, subject; and

        (B) approved under subsection (b), after submission by such organization to the Federal Trade Commission; or

      (3) implements and follows a set of model guidelines issued by the Commission, after notice and opportunity for comment, setting forth reasonable practices and procedures to effectively prevent a violation of this Act.

    (b) APPROVAL OF GUIDELINES- Not later than 90 days after receiving a request by a self-regulatory organization for approval of guidelines under subsection (a)(2) and after notice and an opportunity for comment, the Federal Trade Commission shall approve or disapprove such proposed guidelines (setting forth in writing the reasons for any disapproval).

SEC. 7. PRIVATE RIGHT OF ACTION.

    A consumer may bring in an appropriate district court of the United States or, if otherwise permitted by the laws or rules of court of a State, in an appropriate court of that State--

      (1) a civil action to enjoin a violation of this Act;

      (2) a civil action to recover--

        (A) the greater of actual monetary loss or $1,000 in damages for each such violation; and

        (B) up to $10,000, to be determined in the discretion of the court, if the court finds that the defendant willfully or knowingly violated such rules; or

      (3) both such actions.

SEC. 8. ACTIONS BY STATES.

    (a) AUTHORITY OF STATES- Whenever the attorney general of a State, or an official or agency designated by a State, has reason to believe that any person has engaged or is engaging in a pattern or practice of violations of this Act, the State, on behalf of its residents, may bring--

      (1) a civil action to enjoin such violations; and

      (2) a civil action to recover--

        (A) the greater of actual monetary loss of such residents or $1,000 in damages for each such violation; and

        (B) up to $10,000, to be determined in the discretion of the court, if the court finds that the defendant willfully or knowingly violated such rules; or

      (3) both such actions.

    (b) EXCLUSIVE JURISDICTION OF FEDERAL COURTS- (1) The district courts of the United States shall have exclusive jurisdiction over all civil actions brought under this section.

    (2) Upon a proper showing in a civil action brought under this section, a permanent or temporary injunction or restraining order shall be granted without bond.

    (c) RIGHTS OF FEDERAL TRADE COMMISSION- (1) The State shall serve prior written notice of any civil action brought under this section upon the Federal Trade Commission and provide the Commission with a copy of its complaint, except in any case where such prior notice is not feasible, in which case the State shall serve such notice immediately upon instituting such action.

    (2) The Commission shall have the right--

      (A) to intervene in the action;

      (B) upon so intervening, to be heard on all matters arising therein; and

      (C) to file petitions for appeal.

    (d) LIMITATION- Whenever the Federal Trade Commission has commenced a civil action for violation of this Act, no State may, during the pendency of such action commenced by the Commission, subsequently commence a civil action against any defendant named in the Commission’s complaint for any violation as alleged in the Commission’s complaint.

SEC. 9. PREEMPTION.

    This Act and the rules made under this Act preempt any inconsistent provision of State law.

SEC. 10. DEFINITIONS.

    In this Act:

      (1) The term ‘information recipient’ means any person who obtains personal information from or about a consumer, through a transaction in or affecting interstate or foreign commerce. Such term does not include--

        (A) an affiliate, parent entity, or subsidiary of such person; or

        (B) the consumer about whom such information has been obtained.

      (2) The term ‘consumer’ means an individual who is or was in a consumer relationship with an information recipient.

      (3) The term ‘personal information’ means personally identifiable information and sensitive personal information.

      (4) The term ‘personally identifiable information’ includes, with respect to a consumer--

        (A) a name;

        (B) an address;

        (C) a phone number; and

        (D) an electronic mail address.

      (5) The term ‘sensitive personal information’ includes, with respect to a consumer--

        (A) a Social Security identification number; and

        (B) financial information.

      (6) The term ‘State’ includes any commonwealth, territory, or possession of the United States.

      (7) The term ‘violation of this Act’ includes violation of a rule made under this Act.

SEC. 11. RULEMAKING AUTHORITY.

    Not later than one year after the date of enactment of this Act, the Federal Trade Commission shall prescribe rules, in accordance with section 553 of title 5, United States Code, to carry out this Act, which shall take effect not later than 180 days after their publication in final form.

SEC. 12. EFFECTIVE DATE.

    This Act (other than section 11) shall take effect on the same date that the rules prescribed under section 11 take effect.