S.Amdt. 3024

SA 3024. Mrs. CLINTON (for herself and Mr. Dayton) submitted an amendment intended to be proposed to amendment SA 3011 proposed by Mr. Frist to the bill S. 1637, to amend the Internal Revenue Code of 1986 to comply with the World Trade Organization rulings of the FSC/ETI benefit in a manner that preserves jobs and production activities in the United States, to reform and simplify the international taxation rules of the United States, and for other purposes; which was ordered to lie on the table; as follows:

Insert at the appropriate place the following:

SEC. __. TRANSMISSION OF PERSONALLY IDENTIFIABLE INFORMATION TO FOREIGN AFFILIATES OR SUBCONTRACTORS.

(a) Definitions.--As used in this section, the following definitions shall apply:

(1) Business enterprise.--The term “business enterprise” means any organization, association, or venture established to make a profit.

(2) Country with adequate privacy protection.--The term “country with adequate privacy protection” means a country that has been certified by the Federal Trade Commission as having a legal system that provides adequate privacy protection for personally identifiable information.

(3) Health care business.--The term “health care business” means any business enterprise or private, nonprofit organization that collects or retains personally identifiable information about consumers in relation to medical care, including--

(A) hospitals;

(B) health maintenance organizations;

(C) medical partnerships;

(D) emergency medical transportation companies;

(E) medical transcription companies;

(F) banks that collect or process medical billing information; and

(G) subcontractors, or potential subcontractors, of the entities described in subparagraphs (A) through (F).

(4) Personally identifiable information.--The term “personally identifiable information” includes--

(A) name;

(B) bank account information;

(C) social security number;

(D) address;

(E) telephone number;

(F) passwords;

(G) mother's maiden name; and

(H) date of birth.

(b) Transmission of Information.--

(1) In general.--A business enterprise may transmit personally identifiable information regarding a citizen of the United States to any foreign affiliate or subcontractor located in a country that is a country with adequate privacy protection in accordance with paragraph (2).

(2) Consent required.--A business enterprise may not transmit personally identifiable information regarding a citizen of the United States to any foreign affiliate or subcontractor located outside of the United States unless--

(A) the business enterprise discloses to the citizen whether the country to which the information will be transmitted has been certified under subsection (d);

(B) the business enterprise obtains consent from the citizen, before a consumer relationship is established or before the effective date of this section, to transmit such information to such foreign affiliate or subcontractor; and

(C) the consent referred to in subparagraph (B) is renewed by the citizen within 1 year before such information is transmitted.

(3) Liability.--A business enterprise shall be liable for any damages arising from the improper storage, duplication, sharing, or other misuse of personally identifiable information by the business enterprise or by any of its foreign affiliates or subcontractors that received such information from the business enterprise.

(4) Rulemaking.--The Chairman of the Federal Trade Commission shall promulgate regulations through which the Chairman may enforce the provisions of this subsection and impose a fine for a violation of this subsection.

(c) Health Care Information.--

(1) In general.--A health care business shall be liable for any damages arising from the improper storage, duplication, sharing, or other misuse of personally identifiable information by the business enterprise or by any of its foreign affiliates or subcontractors that received such information from the business enterprise.

(2) No opt out provision.--A health care business may not terminate an existing relationship with a consumer of health care services to avoid the consent requirement under subsection (b)(2).

(3) Rulemaking.--The Secretary of Health and Human Services shall promulgate regulations through which the Secretary may enforce the provisions of this subsection and impose a fine for the violation of this subsection.

(d) Certification.--

(1) In general.--Not later than 6 months after the date of enactment of this Act, the Federal Trade Commission shall--

(A) certify those countries that have legal systems that provide adequate privacy protection for personally identifiable information; and

(B) make the list of countries certified under subparagraph (A) available to the general public.

(2) Certification criteria.--In determining whether a country should be certified under this subsection, the Federal Trade Commission shall consider the adequacy of the country's infrastructure for detecting, evaluating, and responding to privacy violations.

(3) European union data protection directive.--A country that has passed comprehensive privacy legislation that meets the requirements of the European Union Data Protection Directive shall be certified under this subsection unless the Federal Trade Commission determines that such legislation is not commonly observed within such country.

(e) Effective Date.--This section shall take effect on the date which is 90 days after the date of enactment of this Act.