(i)

built using—

(ii)

designed to—

(i)

intentionally collects, processes, or maintains personal information; and

(ii)

sends or receives such personal information over the internet or a similar communications network.

(i)

generates not more than $5,000 in gross revenue in a 12-month period; or

(ii)

involves the personal information of fewer than 5,000 individuals in such period.

(i)

has performed such actions using best practices for the types of data such information contains;

(ii)

has implemented technical safeguards that prohibit re-identification of the individual with whom such information was linked;

(iii)

has implemented business processes that specifically prohibit re-identification of the information;

(iv)

has implemented business processes to prevent inadvertent release of such information; and

(v)

makes no attempt to re-identify such information.

(i)

publicly available information linked to an individual if that information was not unlawfully made public; or

(ii)

information derived or inferred from personal information, if the derived or inferred information is not linked or reasonably linkable to a specific individual.

(i)

if such personal information could be rendered intelligible through cooperation or sharing of cryptographic secrets by multiple persons, the covered entity has both technical safeguards and business processes to prevent such cooperation or sharing;

(ii)

if such personal information is rendered intelligible within a hardware processing unit or other means of performing operations on the information, there are technical safeguards that, during the normal course of operation—

(iii)

if the result of such processing of the personal information is also personal information, such result must be unintelligible to the covered entity or service provider and protected by privacy-preserving computing.

(i)

information that is lawfully made available from a government entity;

(ii)

information linked to a public individual or official that is made publicly accessible, without restrictions on accessibility other than the general authorization to access the services used to make the information accessible; or

(iii)

information of an individual that—

(i)

biometric information of an individual collected by a covered entity without the individual’s knowledge;

(ii)

information used for a purpose that is not compatible with the purpose for which the information is maintained and made available in government records;

(iii)

information obtained from government records for the purpose of selling such information; or

(iv)

information used to contact or locate a private individual either physically or electronically.

(i)

the disclosing of personal information of an individual to a third party with which the individual has a direct relationship for purposes of providing a product or service requested by the individual or otherwise in a manner that is consistent with an individual’s reasonable expectations considering the context in which the individual provided the personal information to the covered entity;

(ii)

the disclosing or transfer of personal information to a subsidiary or an affiliate of the covered entity; or

(iii)

the disclosing or transfer of personal information to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the covered entity’s assets, unless personal information makes up the majority of the value of the assets of which the third party assumes control.

(i)

processes, discloses, or maintains personal information, where such covered entity does not process, disclose, or maintain the personal information other than in accordance with the directions and on behalf of another covered entity;

(ii)

does not directly collect personal information from or control the mechanism for collecting personal information from an individual;

(iii)

does not earn revenue from processing, maintaining, or disclosing personal information disclosed to such covered entity by another covered entity except by providing contracted services to such other covered entity;

(iv)

does not disclose personal information to another covered entity unless such personal information was provided by such other covered entity or resulted from maintaining or processing performed on personal information exclusively provided by such other covered entity;

(v)

does not offer services that allow another covered entity to target specific individuals using personal information not provided by such other covered entity;

(vi)

with respect to personal information processed or maintained by such covered entity on behalf of another covered entity, assists such other covered entity in complying with title I, including providing tools for such other covered entity to comply with such requirements if requested; and

(vii)

does not link the personal information provided by another covered entity to personal information from any other source.

(i)

such covered entity;

(ii)

a subsidiary or corporate affiliate of such covered entity; or

(iii)

a service provider of such covered entity.

(1)

the categories of personal information and contents of communications of such individual that is maintained by such covered entity, including, in the case of personal information that such covered entity did not collect from such individual, how and from whom such covered entity obtained such personal information;

(2)

a list of the third parties, subsidiaries, and corporate affiliates, to which such covered entity has disclosed and from which such covered entity has, at any time on or after the effective date of this Act, obtained the personal information of such individual;

(3)

a concise and clear description of the business or commercial purposes of such covered entity—

(4)

a list of automated decision-making processes that an individual has a right to request human review of under section 105 with a concise and clear description of the implications and intended effects of each such process.

(1)

correct or complete (as the case may be) the disputed information and notify such individual that the correction or completion has been made; or

(2)

notify such individual that—

(1)

delete such information and notify such individual that such information has been deleted; or

(2)

notify such individual that such covered entity is denying the request for deletion in reliance on an exemption or exception provided by section 109(g).

(1) Annual determination

Not less frequently than once per calendar year, the Director shall—

(2) Opportunity for public comment

Before publishing the final list under paragraph (1)(C), the Director shall—

(1) In general

A covered entity that offers a product or service in a portable category and that maintains personal information or the contents of any communications of an individual shall make available to such individual a reasonable mechanism by which such individual may—

(2) Requirements for application programming interface

The application programming interface, or similar mechanism, required by paragraph (1)(B) shall—

(1) Access

Except as provided in paragraph (2)(A), a covered entity shall provide access to the application programming interface or similar mechanism required by subsection (b)(1)(B) upon the request of another covered entity if the requesting covered entity has self-certified, using the procedures established by the Director under paragraph (3)(A), that such requesting covered entity—

(2) Denial of access

(3) Certification and review procedures

The Director shall establish—

(1)

for which the sum obtained by adding the number of users or estimated users of each product or service in such category is greater than 10,000,000; and

(2)

that—

(1) Consent required

A covered entity shall obtain express affirmative consent from an individual before the entity provides a behaviorally personalized version of a product or service, and not less than every calendar year thereafter.

(2) Denial of consent

For a case in which consent is denied, the covered entity shall provide the product or service without behavioral personalization, except as provided in subsection (c).

(1) Infeasibility

For a case in which the offering of a substantially similar product or service without behavioral personalization is infeasible, a covered entity shall provide, to the greatest extent feasible, a core aspect or part of the product or service that can be offered without behavioral personalization.

(2) Denial for inability to function

For a case in which a core aspect or part of the product or service is not able to function in a substantially similar function without behavioral personalization, a covered entity may deny providing an individual use of such product or service if such individual does not consent to behavioral personalization as required in subsection (a).

(1)

are built using aggregated personal information that is representative of all the personal information the covered entity maintains; and

(2)

have an output that is both uniform across the individuals that use the product or service and independent of a specific individual’s inherent or behavioral characteristics.

(1)

for no longer than needed to complete the specific request or transaction (including a reasonable estimate of such duration by the covered entity);

(2)

until consent is revoked; and

(3)

one or more additional durations based on reasonable expectations and norms for maintaining the category of personal information.

(1)

Identity verification and authentication procedures.

(2)

Standardized formats and reasonable mechanisms for submitting and fulfilling requests.

(3)

Reasonable limits to prevent fraud, abuse, or excessive and duplicative requests.

(4)

Timelines and recordkeeping requirements consistent with this title.

(5)

Narrowly tailored exceptions necessary to prevent a legitimate risk to the privacy, security, or safety of another individual, or to protect free expression, consistent with section 110(b).

(1) In general

This title does not apply with respect to personal information that is collected, processed, maintained, or disclosed for any of the following purposes (or a combination of such purposes), where a covered entity has technical safeguards and business processes that limit collecting, processing, maintaining, or disclosing of such personal information to the following purposes:

(2) Re-identification

Where compliance with this title would require the re-identification of de-identified personal information, and the covered entity does not already maintain the information necessary for such re-identification, the covered entity shall be exempt from such compliance, except for requirements under section 106.

(3) Disclosing

A covered entity relying on an exemption under paragraph (1) with respect to personal information shall disclose in the privacy policy maintained by such entity under section 211—

(1) In general

A covered entity may deny the request of an individual under this title if—

(2) Limitations on requests for additional information to confirm identity

A covered entity may not deny a request of an individual under paragraph (1)(A) on the basis of the refusal of such individual to provide additional personal information to such covered entity to confirm the identity of such individual—

(1)

comply with such request; or

(2)

inform such individual of the reason for denying such request, as allowed under subsection (a) or (b).

(1) In general

Except as provided in paragraph (2), a covered entity may not charge a fee to an individual for a request made under this title.

(2) Unfounded or excessive requests

If a request under this title is unfounded or excessive, a covered entity may charge a reasonable fee that reflects the estimated administrative costs of complying with such request.

(3) Agency notice

If a covered entity plans to charge a fee under paragraph (2), it must notify the Digital Privacy Agency at least 7 days before charging such fee.

(4) Agency review

The Director may reject any fee that a covered entity plans to charge for a request made under this title if the Director finds—

(1)

take an action that would convert information that is not personal information into personal information;

(2)

collect or maintain personal information or contents of communication that the covered entity would otherwise not maintain (including a record of an individual exercising rights under this title); or

(3)

maintain personal information or contents of communication longer than the covered entity would otherwise maintain such personal information.

(1) Collecting

A covered entity may not collect more personal information than is reasonably needed to provide a product or service that an individual has requested.

(2) Processing

A covered entity may not process personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity.

(3) Maintaining

A covered entity may not maintain personal information once such information is no longer needed for the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity.

(4) Disclosing

A covered entity may not disclose personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity.

(1) No notice or consent required

A covered entity may collect, process, or maintain personal information without additional notice or consent if the purpose for such collecting, processing, or maintaining is substantially similar to the type of personal information and purpose for which such personal information was originally collected and such ancillary collecting, processing, or maintaining will not result in additional or increased privacy harms.

(2) Notice required

A covered entity shall provide notice of ancillary collecting, processing, maintaining, or disclosing of personal information in the case of one, but not more than one, of the following instances:

(3) Notice and consent required

For scenarios not covered under paragraph (1) or (2), and notwithstanding sections 208(b)(2) and (3), a covered entity shall provide notice of and obtain consent for ancillary collecting, processing, maintaining, or disclosing of personal information.

(1) In general

A covered entity shall maintain records identifying each instance in which an employee or a contractor of such covered entity accesses personal information or contents of communications if disclosing such personal information or contents of communication, or a data breach or data-sharing abuse involving such personal information or contents of communication, may foreseeably result in increased privacy harms.

(2) Information required

The records required by paragraph (1) shall include the following:

(3) Small businesses excluded

This subsection does not apply to a small business.

(1) In general

A covered entity may not intentionally disclose personal information unless the covered entity obtains consent of the individual whose personal information is being disclosed for each category of third party to which such personal information will be disclosed. Such covered entity must also provide such individual with notice of—

(2) Additional requirements for sale of personal information

(3) Requirement to include original purpose of collecting

A covered entity may not intentionally disclose personal information without including the purpose for which the personal information was originally collected.

(4) Exception for privacy-preserving computing

Notwithstanding paragraph (1), consent is not required for disclosing (not including selling) personal information secured using privacy-preserving computing.

(5) Exception for de-identified personal information

Notwithstanding paragraph (1), consent is not required for disclosing (not including selling) de-identified personal information where the disclosed personal information is limited to the narrowest possible scope likely to yield the intended benefit and contractual obligations are in place that prohibit—

(1) In general

A covered entity may not intentionally disclose for advertising or marketing purposes a unique identifier or any other personal information that would allow information disclosed to be linked to information relating to the same individual or device disclosed in the past.

(2) Treatment of certain types of information

Disclosing personal information or contents of communication for advertising or marketing purposes may not be treated as violating paragraph (1) by reason of including any or all of the following:

(1)

is not subject to the jurisdiction of the United States; or

(2)

is not in compliance with all requirements of this Act.

(1)

the receiving covered entity has entered into an agreement, as described in subsection (e), with the Digital Privacy Agency, and—

(2)

the covered entity has—

(1)

The principal place of business for the covered entity must be in a country that allows for the domestication of a United States court decision for civil fines payable to a government entity and injunctive relief. Where a foreign court refuses to enforce a United States court decision under this Act, the agreement, and all other agreements with covered entities with a principal place of business in the same jurisdiction, shall be void.

(2)

The covered entity agrees to comply with this Act.

(3)

The covered entity agrees to be subject to this Act with choice of venue being a United States court.

(4)

The covered entity agrees to comply with Digital Privacy Agency investigative requests or orders, and United States court orders or decisions under this Act.

(5)

The covered entity consents to United States Federal court personal jurisdiction for the sole purpose of enforcing this Act.

(6)

Where enforcement of the decision requires the use of a foreign court, the covered entity agrees to pay reasonable attorney fees necessary to enforce the judgment.

(7)

A default judgment, failure to comply with Digital Privacy Agency investigative requests or orders, or failure to comply with United States court orders or decisions shall result in the immediate termination of the agreement.

(1)

transmitting or displaying the communication to any intended recipient or the original sender, or maintaining such communications for such purposes;

(2)

detecting, responding to, or preventing security incidents or threats;

(3)

providing services to assist in the drafting or creation of the content of a communication;

(4)

processing expressly requested by the sender or intended recipient, if the sender or intended recipient can terminate such processing using a reasonable mechanism;

(5)

disclosing otherwise required by law;

(6)

filtering a communication where the primary purpose of the communication is the commercial advertisement or promotion of a commercial product or service of a covered entity; or

(7)

detecting or enforcing an abuse or violation of the terms of service of the covered entity that would result in either a temporary or permanent ban from using the service.

(1)

at least one intended recipient is a natural person other than an employee or contractor of the covered entity;

(2)

at least one intended recipient is a person other than the covered entity; or

(3)

a purpose of the covered entity’s service is to maintain, at the direction of the sender, the content of said communication for more than a transitory period.

(1)

Where the sender is a natural person, they shall be the sender of the entire content of the communication, regardless of the original author of any portion of the content.

(2)

Otherwise, a sender shall be the sender of only the content it was an original author of, or content it received as an intended recipient.

(1)

prohibit or prevent a person from encrypting or otherwise rendering unintelligible the content of a communication using a means that prevents the covered entity from being able to decrypt or otherwise render intelligible said content; and

(2)

require or cause a person to disclose or circumvent the means described in paragraph (1) to the covered entity that would allow it to render the content intelligible.

(1)

describes other circumstances in which an individual or group of individuals may be harmed by an action of a covered entity through the processing of personal information or contents of communication of the protected class status of that individual in a manner not described in subsection (a) or (b);

(2)

prohibits such action; and

(3)

provides for enforcement under this Act or through regulation.

(1)

vary required thresholds on types and scale of reasonably foreseeable privacy harms; and

(2)

take into account expectations of individuals, potential privacy harms, and individuals’ awareness of privacy harms.

(1) Approval procedures

The Director shall develop procedures for analyzing and approving data submitted by a covered entity to establish that a notice and consent process or privacy policy of such covered entity meets the threshold established under subsection (a).

(2) Presumption

If a covered entity submits testing data to and receives an approval from the Director under paragraph (1) establishing that a notice or consent process or privacy policy of such covered entity meets the threshold established under subsection (a), such notice or consent process or privacy policy shall be presumed to have met such threshold. Such presumption may be rebutted by clear and convincing evidence.

(3) Public availability of Approved processes and policies and associated testing data

The Director shall make publicly available online the notice and consent processes and privacy policies and associated testing data that the Director approves under paragraph (1).

(4) Small business adoption of notice or consent process of another covered entity

(5) Minor changes

A covered entity may make minor changes in a notice or consent process or privacy policy approved under paragraph (1) and retain the presumption under paragraph (2) for such process or policy without retesting or resubmission of testing data to the Director.

(1) Express consent required

Except as provided in paragraphs (2) and (3), a covered entity may not collect from an individual personal information that creates or increases the risk of foreseeable privacy harms, or process or maintain any such personal information collected from an individual, unless such entity obtains the express consent of such individual to the collecting, processing, or maintaining (or any combination thereof) of such information through a process that is concise and clear and can be objectively shown to meet the threshold established by the Director under section 208(a).

(2) Exception for implied consent

Notwithstanding paragraph (1), express consent is not required for collecting, processing, or maintaining personal information if the collecting, processing, or maintaining is, on its face, obvious and necessary to provide a service at the request of the individual and the personal information is collected, processed, or maintained only for such request. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection (a) to provide notice to such individual with respect to such collecting, processing, or maintaining.

(3) Exemption for privacy-preserving computing

Notwithstanding paragraph (1), except with regard to consent for purposes of section 106, express consent is not required for collecting, processing, or maintaining personal information secured using privacy-preserving computing. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection (a) to provide notice to such individual with respect to such collecting, processing, or maintaining.

(1)

A general description of the practices of the covered entity regarding the collecting, processing, maintaining, and disclosing of personal information.

(2)

A description of how individuals may exercise the rights provided by title I.

(3)

A clear and concise summary of the following:

(4)

A description of the personal information that the covered entity maintains that the covered entity does not collect from individuals and how the covered entity obtains such personal information.

(5)

A list of the third parties to which the covered entity has disclosed personal information.

(6)

A list of the third parties from which the covered entity has obtained personal information at any time on or after the effective date of this Act.

(7)

The articulated basis for the collecting, processing, disclosing, and maintaining of personal information, as required under section 201(a).

(1) Form and manner

The privacy policy required by subsection (a) shall be—

(2) Timing

The privacy policy required by subsection (a) shall be made available as required by paragraph (1) before the covered entity collects personal information after the effective date of this Act.

(1)

the nature, scope, and complexity of the activities engaged in by such covered entity;

(2)

the sensitivity of any personal information at issue;

(3)

the current state of the art in administrative, technical, and physical safeguards for protecting such information; and

(4)

the cost of implementing such administrative, technical, and physical safeguards.

(1)

A written security policy with respect to collecting, processing, maintaining, and disclosing of personal information. Such policy shall be made publicly available in a prominent location on an ongoing basis, except that the publicly available version is not required to contain information that would compromise a purpose described in section 109(a)(1).

(2)

A process for identifying and assessing reasonably foreseeable security vulnerabilities in the system or systems used by such covered entity that contain personal information, which shall include regular monitoring for vulnerabilities or data breaches involving such system or systems.

(3)

A process for taking action designed to mitigate against vulnerabilities identified in the process required by paragraph (2), which may include implementing any changes to security practices and the architecture, installation, or implementation of network or operating software, or for regularly testing or otherwise monitoring the effectiveness of the existing safeguards.

(4)

A process for determining if personal information is no longer needed and disposing of personal information by shredding, permanently erasing, or otherwise modifying the medium on which such personal information is maintained to make such personal information permanently unreadable or indecipherable.

(5)

A process for overseeing persons who have access to personal information, including through network-connected devices.

(6)

A process for employee training and supervision for implementation of the policies, practices, and procedures required by this section.

(7)

A written plan or protocol for internal and public response in the event of a data breach or data-sharing abuse.

(1) In general

In the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity, such covered entity shall, without undue delay and, if feasible, not later than 72 hours after becoming aware of such data breach or data-sharing abuse, notify the Director of such data breach or data-sharing abuse, unless such data breach or data-sharing abuse is unlikely to create or increase foreseeable privacy harms.

(2) Reasons for delay

If the notification required by paragraph (1) is made more than 72 hours after the covered entity becomes aware of the data breach or data-sharing abuse, such notification shall be accompanied by a statement of the reasons for the delay.

(1) In general

In the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity (or a data breach or data-sharing abuse about which a covered entity is notified under subsection (b)), if such covered entity has a relationship with an individual whose personal information was involved or potentially involved in such data breach or data-sharing abuse, such covered entity shall notify such individual of such data breach or data-sharing abuse not later than 14 days after becoming aware of such data breach or data-sharing abuse (or, in the case of a data breach or data-sharing abuse about which a covered entity is notified under subsection (b), not later than 14 days after being so notified), if such data breach or data-sharing abuse creates or increases foreseeable privacy harms.

(2) Medium of notification

A covered entity shall notify an individual as required by paragraph (1) through—

(1) In general

There is established the position of the Director, who shall serve as the head of the Digital Privacy Agency.

(2) Appointment

Subject to paragraph (3), the Director shall be appointed by the President, by and with the advice and consent of the Senate.

(3) Qualification

The Director shall have a professional background, experience, knowledge, and expertise in the following:

(4) Term

(5) Compensation

(1) In general

Sections 3345 through 3349d of title 5, United States Code (commonly known as the Federal Vacancies Reform Act of 1998), shall not apply to the office of the Director of the Digital Privacy Agency.

(2) Line of succession

The Deputy Director shall serve as acting Director if the Director dies, resigns, or is otherwise unable to perform the functions and duties of the office. The Director shall establish a line of succession among senior officers of the Digital Privacy Agency in the event the position of Deputy Director is vacant to perform the functions and duties of the Director temporarily in an acting capacity.

(1)

establishing of rules for conducting the general business of the Digital Privacy Agency, in a manner not inconsistent with this Act;

(2)

binding the Digital Privacy Agency and entering into contracts;

(3)

directing the establishment and continued operation of divisions or other offices within the Digital Privacy Agency, in order to carry out the responsibilities of the Digital Privacy Agency under this Act, and to satisfy the requirements of other applicable law;

(4)

coordinating and overseeing the operation of all administrative, enforcement, and research activities of the Digital Privacy Agency;

(5)

adopting and using a seal;

(6)

determining the character of and the necessity for the obligations and expenditures of the Digital Privacy Agency;

(7)

appointing and supervising of personnel employed by the Digital Privacy Agency;

(8)

distributing business among personnel appointed and supervised by the Director and among administrative units of the Digital Privacy Agency;

(9)

using and expending of funds;

(10)

implementing this Act through rules, orders, guidance, interpretations, statements of policy, investigations, and enforcement actions; and

(11)

performing such other functions as may be authorized or required by law.

(1) In general

The Director may prescribe such rules and regulations as may be necessary and appropriate, and in the public interest, to implement, administer, and carry out this Act, and to prevent evasions thereof.

(2) Regulations

The Digital Privacy Agency may issue regulations after notice and comment in accordance with section 553 of title 5, United States Code, as may be necessary to implement, administer, and carry out this Act.

(1)

Federal agencies that have—

(2)

State attorneys general, State privacy regulators, and other State agencies that have expertise in privacy or information security;

(3)

international and intergovernmental bodies that conduct activities relating to the privacy or information security;

(4)

agencies of other countries that are similar to the Digital Privacy Agency or have expertise in privacy or information security;

(5)

privacy and information security experts in academia, government, civil society, or industry; and

(6)

advisory boards of the Digital Privacy Agency established under section 308, as appropriate.

(1) In general

Not later than 6 months after the date of the enactment of this Act, and every 6 months thereafter, the Director shall submit a report to the President and to the Committee on Energy and Commerce, the Committee on the Judiciary, and the Committee on Appropriations of the House of Representatives and the Committee on Commerce, Science, and Transportation, the Committee on the Judiciary, and the Committee on Appropriations of the Senate, and shall publish such report on the website of the Digital Privacy Agency.

(2) Contents

Each report required by subsection (a) shall include—

(1) In general

With respect to covered entities and service providers, to the extent that Federal law authorizes the Digital Privacy Agency and another Federal agency to enforce a Federal privacy law, the head of the other Federal agency shall coordinate with the Director of the Digital Privacy Agency to promote consistent enforcement of this Act and the other Federal privacy law.

(2) Referral

Any Federal agency authorized to enforce Federal privacy laws may recommend in writing to the Digital Privacy Agency that the Digital Privacy Agency initiate an enforcement proceeding, as the Digital Privacy Agency is authorized by that Federal privacy law or by this Act.

(1) Transfers of authority

(2) Transfer of privacy employees

Any employee of the Commission employed in a division, bureau, office, or other subdivision of the Commission with the primary responsibility of administering, investigating, or enforcing Federal privacy laws or applications of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) related to unfair or deceptive acts or practices relating to privacy, information security, identity theft, data abuses, and related matters shall be transferred to the Digital Privacy Agency. Such employee shall be provided with compensation and benefits not less than the equivalent of compensation and benefits provided to such employee on the date of enactment of this Act or compensation and benefits provided to an employee of the Digital Privacy Agency in comparable position with comparable experience.

(1) Appointment generally

The Director may fix the number of, and appoint and direct, all employees of the Digital Privacy Agency, in accordance with the applicable provisions of title 5, United States Code. The Director may appoint personnel without regard to the provisions of title 5, United States Code, governing appointments in the competitive service, so long as the Director sets requirements, conducts recruitment, and determines appointments in a fair, transparent, and equitable manner.

(2) Employees of the agency

The Director is authorized to employ privacy experts, technologists, computer scientists, user experience designers and researchers, data scientists, ethicists, attorneys, investigators, economists, civil rights experts, and other employees as the Director considers necessary to conduct the business of the Digital Privacy Agency. Unless otherwise provided expressly by law, any individual appointed under this section shall be an employee, as defined in section 2105 of title 5, United States Code, and subject to the provisions of such title and other laws generally applicable to the employees of an executive agency.

(3) Employee compensation

The Director may fix and adjust the pay and benefits of personnel as the Director considers desirable, competitive, transparent, and equitable, without regard to the provisions of chapter 51 and subchapter III of chapter 53 of title 5, United States Code, relating to classification and General Schedule pay rates, respectively.

(4) Labor-management relations

Chapter 71 of title 5, United States Code, shall apply to the Digital Privacy Agency and the employees of the Digital Privacy Agency.

(1) Chief information officer

(2) Inspector general

Section 401 of title 5, United States Code, is amended—

(3) Ombud

The Director shall appoint an ombud who shall—

(1)

the State agency system has the functional capacity to receive calls or electronic reports routed by the Digital Privacy Agency systems;

(2)

the State agency has satisfied any conditions of participation in the system that the Digital Privacy Agency may establish, including treatment of personal information and sharing of information on complaint resolution or related compliance procedures and resources; and

(3)

participation by the State agency includes measures necessary to provide for protection of personal information that conform to the standards for protection of the confidentiality of personal information and for data integrity and security that apply to Federal agencies.

(1) Consent required

In collecting a complaint from an individual, the Digital Privacy Agency shall request consent for publishing the complaint without any information identifying the individual.

(2) Public database

The Digital Privacy Agency shall make publicly available on its website a database of each complaint for which it has received consent to publish the complaint from an individual who provided the complaint to the Digital Privacy Agency.

(3) Redacting information

When necessary, the Digital Privacy Agency may redact information from a published complaint to protect the privacy of the individual.

(1)

The User Advisory Board, which shall be composed of experts in consumer protection, privacy, civil rights, and ethics.

(2)

The Research Advisory Board, which shall be composed of individuals with academic and research expertise in privacy, cybersecurity, computer science, innovation, design, ethics, economics, law, and public policy.

(3)

The Startup Advisory Board, which shall be composed of representatives of small businesses and investors in small businesses.

(4)

The Product Advisory Board, which shall be composed of technologists, computer scientists, designers, product managers, attorneys, and other representatives of covered entities.

(1)

be entitled to receive compensation at a rate fixed by the Director while attending meetings of the advisory board, including travel time; and

(2)

receive travel expenses, including per diem in lieu of subsistence, in accordance with applicable provisions under subchapter I of chapter 57 of title 5, United States Code.

(1) In general

The Digital Privacy Agency or a Digital Privacy Agency investigator may issue subpoenas for the attendance and testimony of witnesses and the production of relevant papers, books, documents, or other material in connection with hearings under this Act.

(2) Failure to obey

In the case of contumacy or refusal to obey a subpoena issued pursuant to this subsection and served upon any person, the district court of the United States for any district in which such person is found, resides, or transacts business, upon application by the Digital Privacy Agency or a Digital Privacy Agency investigator and after notice to such person, may issue an order requiring such person to appear and give testimony or to appear and produce documents or other material.

(3) Contempt

Any failure to obey an order of the court under paragraph (2) may be punished by the court as a contempt thereof.

(1) In general

Whenever the Digital Privacy Agency has reason to believe that any person may be in possession, custody, or control of any documentary material or tangible things, or may have any information, relevant to a violation, the Digital Privacy Agency may, before the institution of any proceedings under this Act, issue in writing, and cause to be served upon such person, a civil investigative demand requiring such person to—

(2) Requirements

Each civil investigative demand shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.

(3) Production of documents

Each civil investigative demand for the production of documentary material shall—

(4) Production of things

Each civil investigative demand for the submission of tangible things shall—

(5) Demand for written reports or answers

Each civil investigative demand for written reports or answers to questions shall—

(6) Oral testimony

Each civil investigative demand for the giving of oral testimony shall—

(7) Service

Any civil investigative demand issued, and any enforcement petition filed, under this section may be served—

(8) Method of service

Service of any civil investigative demand or any enforcement petition filed under this section may be made upon a person by—

(9) Proof of service

(10) Production of documentary material

The production of documentary material in response to a civil investigative demand shall be made under a sworn certificate, in such form as the demand designates, by the person, if a natural person, to whom the demand is directed or, if not a natural person, by any person having knowledge of the facts and circumstances relating to such production, to the effect that all of the documentary material required by the demand and in the possession, custody, or control of the person to whom the demand is directed has been produced and made available to the custodian.

(11) Submission of tangible things

The submission of tangible things in response to a civil investigative demand shall be made under a sworn certificate, in such form as the demand designates, by the person to whom the demand is directed or, if not a natural person, by any person having knowledge of the facts and circumstances relating to such production, to the effect that all of the tangible things required by the demand and in the possession, custody, or control of the person to whom the demand is directed have been submitted to the custodian.

(12) Separate answers

Each reporting requirement or question in a civil investigative demand shall be answered separately and fully in writing under oath, unless it is objected to, in which event the reasons for the objection shall be stated in lieu of an answer, and it shall be submitted under a sworn certificate, in such form as the demand designates, by the person, if a natural person, to whom the demand is directed or, if not a natural person, by any person responsible for answering each reporting requirement or question, to the effect that all information required by the demand and in the possession, custody, control, or knowledge of the person to whom the demand is directed has been submitted.

(13) Testimony

(1) In general

Documentary materials and tangible things received as a result of a civil investigative demand shall be subject to requirements and procedures regarding confidentiality, in accordance with rules established by the Digital Privacy Agency.

(2) Disclosure to congress

No rule established by the Digital Privacy Agency regarding the confidentiality of materials submitted to, or otherwise obtained by, the Digital Privacy Agency shall be intended to prevent disclosure to either House of Congress or to an appropriate committee of the Congress, except that the Digital Privacy Agency is permitted to adopt rules allowing prior notice to any party that owns or otherwise provided the material to the Digital Privacy Agency and had designated such material as confidential.

(1) In general

Whenever any person fails to comply with any civil investigative demand duly served upon such person under this section, or whenever satisfactory copying or reproduction of material requested pursuant to the demand cannot be accomplished and such person refuses to surrender such material, the Digital Privacy Agency, through such officers or attorneys as it may designate, may file, in the district court of the United States for any judicial district in which such person resides, is found, or transacts business, and serve upon such person, a petition for an order of such court for the enforcement of this section.

(2) Service of process

All process of any court to which application may be made as provided in this subsection may be served in any judicial district.

(1) In general

Not later than 20 days after the service of any civil investigative demand upon any person under subsection (c), or at any time before the return date specified in the demand, whichever period is shorter, or within such period exceeding 20 days after service or in excess of such return date as may be prescribed in writing, subsequent to service, by any Digital Privacy Agency investigator named in the demand, such person may file with the Digital Privacy Agency a petition for an order by the Digital Privacy Agency modifying or setting aside the demand.

(2) Compliance during pendency

The time permitted for compliance with the demand in whole or in part, as determined proper and ordered by the Digital Privacy Agency, shall not run during the pendency of a petition under paragraph (1) at the Digital Privacy Agency, except that such person shall comply with any portions of the demand not sought to be modified or set aside.

(3) Specific grounds

A petition under paragraph (1) shall specify each ground upon which the petitioner relies in seeking relief, and may be based upon any failure of the demand to comply with the provisions of this section, or upon any constitutional or other legal right or privilege of such person.

(1) In general

Whenever any petition is filed in any district court of the United States under this section, such court shall have jurisdiction to hear and determine the matter so presented, and to enter such order or orders as may be required to carry out the provisions of this section.

(2) Appeal

Any final order entered as described in paragraph (1) shall be subject to appeal pursuant to section 1291 of title 28, United States Code.

(1) Orders authorized

(2) Effectiveness of order

A cease-and-desist order shall become effective at the expiration of 30 days after the date of service of the order under paragraph (1)(D) (except in the case of a cease-and-desist order issued upon consent, which shall become effective 180 days after the date of service of the notice of charges under paragraph (1)(A)), and shall remain effective and enforceable as provided therein, except to such extent as the order is stayed, modified, terminated, or set aside by action of the Digital Privacy Agency or a reviewing court.

(3) Decision and Appeal

Any hearing provided for in this subsection shall be held in the Federal judicial district or in the territory in which the residence or principal office or place of business of the person is located unless the person consents to another place, and shall be conducted in accordance with the provisions of subchapter II of chapter 5 of title 5, United States Code. After such hearing, and not later than 90 days after the Digital Privacy Agency has served the notice under paragraph (1)(A), the Digital Privacy Agency shall render its decision (which shall include findings of fact upon which its decision is predicated) and shall issue and serve upon each such party an order or orders consistent with the provisions of this section. Judicial review of any such order shall be exclusively as provided in this subsection. Unless a petition for review is timely filed in a court of appeals of the United States, as provided in paragraph (4), and thereafter until the record in the proceeding has been filed as provided in paragraph (4), the Digital Privacy Agency may at any time, upon such notice and in such manner as the Digital Privacy Agency shall determine proper, modify, terminate, or set aside any such order. Upon filing of the record as provided, the Digital Privacy Agency may modify, terminate, or set aside any such order with permission of the court.

(4) Appeal to court of Appeals

Any party to any proceeding under this subsection may obtain a review of any order served pursuant to this subsection (other than an order issued with the consent of the party) by filing in the court of appeals of the United States for the circuit in which the residence or principal office or place of business of the party is located, or in the United States Court of Appeals for the District of Columbia Circuit, within 30 days after the date of service of such order, a written petition praying that the order of the Digital Privacy Agency be modified, terminated, or set aside. A copy of such petition shall be forthwith transmitted by the clerk of the court to the Digital Privacy Agency, and thereupon the Digital Privacy Agency shall file in the court the record in the proceeding, as provided in section 2112 of title 28, United States Code. Upon the filing of such petition, such court shall have jurisdiction, which upon the filing of the record shall be exclusive, to affirm, modify, terminate, or set aside, in whole or in part, the order of the Digital Privacy Agency. Review of such proceedings shall be had as provided in chapter 7 of title 5, United States Code.

(5) No stay

The commencement of proceedings for judicial review under paragraph (4) shall not, unless specifically ordered by the court, operate as a stay of any order issued by the Digital Privacy Agency.

(1) In general

Whenever the Digital Privacy Agency determines that the violation specified in the notice of charges served upon a person pursuant to subsection (b), or the continuation thereof, is likely to cause the person to be insolvent or otherwise prejudice the interests of individuals before the completion of the proceedings conducted pursuant to subsection (b), the Digital Privacy Agency may issue a temporary order requiring the person to cease and desist from any such violation and to take affirmative action to prevent or remedy such insolvency or other condition pending completion of such proceedings. Such order may include any requirement authorized under this title. Such order shall become effective upon service upon the person and, unless set aside, limited, or suspended by a court in proceedings authorized by paragraph (2), shall remain effective and enforceable pending the completion of the administrative proceedings pursuant to such notice and until such time as the Digital Privacy Agency shall dismiss the charges specified in such notice, or if a cease-and-desist order is issued against the person, until the effective date of such order.

(2) Appeal

Not later than 10 days after a person has been served with a temporary cease-and-desist order, the person may apply to the United States district court for the judicial district in which the residence or principal office or place of business of the person is located, or the United States District Court for the District of Columbia, for an injunction setting aside, limiting, or suspending the enforcement, operation, or effectiveness of such order pending the completion of the administrative proceedings pursuant to the notice of charges served upon the person under subsection (b), and such court shall have jurisdiction to issue such injunction.

(1) In general

When commencing a civil action under this Act or regulations or rules or orders issued pursuant to this Act, the Digital Privacy Agency shall notify the Attorney General.

(2) Notice and coordination

(1)

enjoin further violation of such provision by the defendant;

(2)

compel compliance with such provision; or

(3)

obtain relief under section 406.

(1)

intervene in such action; and

(2)

upon intervening—

(1)

A nonprofit may represent a class of aggrieved individuals.

(2)

A prevailing nonprofit shall receive reasonable compensation for expenses, including attorneys’ fees.

(3)

Individuals shall receive an equally divided share of the total damages.

(1) Jurisdiction

In any civil action or any adjudication proceeding brought by the Digital Privacy Agency, a State attorney general, or State privacy regulator under any provision of this Act or a rule or order prescribed under this Act, the court or the Digital Privacy Agency (as the case may be) shall have jurisdiction to grant any appropriate legal or equitable relief with respect to a violation of such provision.

(2) Relief

Relief under this section may include—

(3) No exemplary or punitive damages

Nothing in this subsection shall be construed as authorizing the imposition of exemplary or punitive damages.

(1) In general

Any person who violates, through any act or omission, any provision of this Act or a rule or order issued pursuant to this Act shall forfeit and pay a civil penalty under this subsection.

(2) Penalty amount

(3) Mitigating factors

In determining the amount of any penalty assessed under paragraph (2), the court or the Digital Privacy Agency shall take into account the appropriateness of the penalty with respect to—

(4) Authority to modify or remit penalty

The Digital Privacy Agency, State attorney general, or State privacy regulator may compromise, modify, or remit any penalty which may be assessed or has already been assessed under paragraph (2). The amount of such penalty, when finally determined, shall be exclusive of any sums owed by the person to the United States in connection with the costs of the proceeding, and may be deducted from any sums owing by the United States to the person charged.

(5) Notice and hearing

No civil penalty may be assessed under this subsection with respect to a violation of any provision of this Act or a rule or order issued pursuant to this Act, unless—

(1)

If the Director files suit within 90 days from receipt of the written request to commence the action, no other action may be brought unless the action brought by the Director is dismissed without prejudice.

(2)

If the Director does not file suit within 90 days from receipt of the written request to commence the action, the person requesting the action may proceed to file a civil action.

(3)

The time period within which a civil action shall be commenced shall be tolled from the date of receipt by the Director of the written request to either the date that the civil action is dismissed without prejudice, or for 150 days, whichever is later, but only for a civil action brought by the person who requested the Director to commence the action.

(1)

If the action was brought by the Director upon a request made by a person pursuant to subsection (a), the person who made the request shall be entitled to 15 percent of the civil penalties.

(2)

If the action was brought by the person who made the request pursuant to subsection (a), that person shall receive an amount the court determines is reasonable for collecting the civil penalties on behalf of the government. The amount shall be not less than 25 percent and not more than 50 percent of the proceeds of the action and shall be paid out of the proceeds.

(A)

a person described in section 1172(a) of the Social Security Act (42 U.S.C. 1320d–1(a)); or

(B)

transactions referred to in section 1173(a)(1) of the Social Security Act (42 U.S.C. 1320d–2(a)(1)).

(1)

The widespread dissemination of privacy-related technical standards and best practices identified by the Director.

(2)

Efforts to make privacy-related technical standards and best practices usable by individuals, small- to medium-sized businesses, educational institutions, and State, local, and Tribal governments.

(3)

Activities to increase the awareness of privacy risks, individual privacy rights, and responsibilities.

(4)

Supporting the development of technical standards and best practices to describe privacy-related tasks, knowledge, skills, competencies, and work roles to guide career development, education, and training activities in industry, academia, nonprofit organizations, and the Federal Government, including support for credentialing.