S.Amdt. 33

1. Adds TITLE XVI--PERSONAL DATA OFFSHORING PROTECTION on page 505, line 13

   Adds a titlePrinted page

   Inserted: TITLE XVI--PERSONAL DATA OFFSHORING PROTECTION

   Inserted: SEC. 1601. SHORT TITLE.

   Inserted: This title may be cited as the "Personal Data Offshoring Protection Act of 2005".

   Inserted: SEC. 1602. DEFINITIONS.

   Inserted: As used in this title, the following definitions apply:

   Inserted: (1) Business enterprise.--The term "business enterprise" means any organization, association, or venture established to make a profit, or any private, nonprofit organization that collects or retains personally identifiable information.

   Inserted: (2) Country with adequate privacy protection.--The term "country with adequate privacy protection" means a country that has been certified by the Federal Trade Commission as having a legal system that provides adequate privacy protection for personally identifiable information.

   Inserted: (3) Personally identifiable information.--The term "personally identifiable information" includes information such as--

   Inserted: (A) name;

   Inserted: (B) postal address;

   Inserted: (C) financial information;

   Inserted: (D) medical records;

   Show 48 more inserted paragraphsShow less

   Inserted: (E) date of birth;

   Inserted: (F) phone number;

   Inserted: (G) e-mail address;

   Inserted: (H) social security number;

   Inserted: (I) mother's maiden name;

   Inserted: (J) password;

   Inserted: (K) state identification information;

   Inserted: (L) driver's license number;

   Inserted: (M) personal tax information; and

   Inserted: (N) any consumer transactional or experiential information relating to the person.

   Inserted: (4) Transmit.--The term "transmit" or "transmission" means the use of any instrumentality of interstate commerce, including the mails or any electronic means, to transfer information or to provide access to such information via the Internet or any comparable telecommunications system.

   Inserted: SEC. 1603. PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION FROM UNAUTHORIZED TRANSMISSION.

   Inserted: (a) In General.--A business enterprise may transmit personally identifiable information regarding a citizen of the United States to any foreign affiliate or subcontractor located in a country that is a country with adequate privacy protection, provided that the citizen has been provided prior notice that such information may be transmitted to such a foreign affiliate or subcontractor and has not objected to such transmission.

   Inserted: (b) "Opt-In" Consent Required for Countries Without Adequate Privacy Protection.--A business enterprise may not transmit personally identifiable information regarding a citizen of the United States to any foreign affiliate or subcontractor located in a country that is a country without adequate privacy protection unless--

   Inserted: (1) the business enterprise discloses to the citizen that the country to which the information will be transmitted does not have adequate privacy protection and specifies in the disclosure the country to which the information will be transmitted;

   Inserted: (2) the business enterprise obtains consent from the citizen, before a consumer relationship is established or before the effective date of this title, to transmit such information to such foreign affiliate or subcontractor and such consent contains a list that indicates each country to which the information will be sent; and

   Inserted: (3) the consent referred to in paragraph (2) is renewed by the citizen within 1 year before such information is transmitted.

   Inserted: (c) Prohibition on Refusal to Provide Services.--A business enterprise shall not deny the provision of any good or service to, nor change the terms of or refuse to enter into a business relationship with any person based upon that person's exercise of the consent rights provided for in this title or in any other applicable law.

   Inserted: SEC. 1604. ENFORCEMENT BY THE FEDERAL TRADE COMMISSION.

   Inserted: (a) Unfair and Deceptive Act or Practice.--A violation of this title shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

   Inserted: (b) Enforcement Authority.--The Federal Trade Commission shall enforce this title in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this title.

   Inserted: SEC. 1605. CIVIL REMEDIES.

   Inserted: (a) Private Right of Action.--A person or entity may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State--

   Inserted: (1) an action based on a violation of this title or the regulations prescribed pursuant to this title to enjoin such violation;

   Inserted: (2) an action to recover for actual monetary loss from such a violation, or to receive $10,000 in damages for each such violation, whichever is greater, or

   Inserted: (3) both such actions.

   Inserted: If the court finds that the defendant willfully or knowingly violated this subsection or the regulations prescribed under this subsection, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under paragraph (2).

   Inserted: (b) Actions by States.--

   Inserted: (1) Authority of states.--Whenever the attorney general of a State, or an official or agency designated by a State, has reason to believe that any person has engaged or is engaging in a violation of this title or the regulations prescribed pursuant to this title, the State may bring a civil action on behalf of its residents to enjoin such violation, an action to recover for actual monetary loss or receive $10,000 in damages for each violation, or both such actions. If the court finds the defendant willfully or knowingly violated this title or regulations prescribed pursuant to this title, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under the preceding sentence.

   Inserted: (2) Exclusive jurisdiction of federal courts.--The district courts of the United States, the United States courts of any territory, and the District Court of the United States for the District of Columbia shall have exclusive jurisdiction over all civil actions brought under this subsection. Upon proper application, such courts shall also have jurisdiction to issue writs of mandamus, or orders affording like relief, commanding the defendant to comply with the provisions of this title or regulations prescribed pursuant to this title, including the requirement that the defendant take such action as is necessary to remove the danger of such violation. Upon a proper showing, a permanent or temporary injunction or restraining order shall be granted without bond.

   Inserted: (3) Notice to an intervention of federal trade commission.--The State bringing a civil action under this section shall serve prior written notice of any such civil action upon the Federal Trade Commission and provide the Commission with a copy of its complaint, except in any case where such prior notice is not feasible, in which case the State shall serve such notice immediately upon instituting such action. The Commission shall have the right--

   Inserted: (A) to intervene in the action;

   Inserted: (B) upon so intervening, to be heard on all matters arising therein; and

   Inserted: (C) to file petitions for appeal.

   Inserted: (4) Venue; service of process.--Any civil action brought under this subsection in a district court of the United States may be brought in the district wherein the defendant is found or is an inhabitant or transacts business or wherein the violation occurred or is occurring, and process in such cases may be served in any district in which the defendant is an inhabitant or where the defendant may be found.

   Inserted: (5) Investigatory powers.--For purposes of bringing any civil action under this subsection, nothing in this title shall prevent the attorney general of a State, or an official or agency designated by a State, from exercising the powers conferred on the attorney general or such official by the laws of such State to conduct investigations or to administer oaths or affirmations or to compel the attendance of witnesses or the production of documentary and other evidence.

   Inserted: (6) Effect on state court proceedings.--Nothing contained in this section shall be construed to prohibit an authorized State official from proceeding in State court on the basis of an alleged violation of any general civil or criminal statute of such State.

   Inserted: (7) Limitation.--Whenever the Federal Trade Commission has instituted a civil action for violation of this title or the regulations prescribed pursuant to this title, no State may, during the pendency of such action instituted by the Commission, subsequently institute a civil action against any defendant named in the Commission's complaint for any violation as alleged in the Commission's complaint.

   Inserted: SEC. 1606. CERTIFICATION OF COUNTRIES WITH ADEQUATE PRIVACY PROTECTION.

   Inserted: (a) In General.--Not later than 6 months after the date of enactment of this title, the Federal Trade Commission, after providing notice and opportunity for public comment, shall--

   Inserted: (1) certify those countries that have legal systems that provide adequate privacy protection for personally identifiable information; and

   Inserted: (2) make the list of countries certified under paragraph (1) available to the general public.

   Inserted: (b) Certification Criteria.--

   Inserted: (1) In general.--In determining whether a country should be certified under this section, the Federal Trade Commission shall consider the adequacy of the country's infrastructure for detecting, evaluating, and responding to privacy violations.

   Inserted: (2) Presumption.--The Commission shall presume that a country's privacy protections are inadequate if they are any less protective of personally identifiable information than those afforded under Federal law or under the laws of any State, or if the Commission determines that such country's laws are not adequately enforced.

   Inserted: (c) European Union Date Protection Directive.--A country that has comprehensive privacy laws that meet the requirements of the European Union Data Protection Directive shall be certified under this section unless the Federal Trade Commission determines that such laws are not commonly enforced within such country.

   Inserted: SEC. 1607. EFFECTIVE DATE.

   Inserted: Section 1606 of this title shall take effect on the date of enactment of this title. Sections 1602 through 1605 of this title shall take effect 60 days after the completion of the certification required by section 1606.

   Original wording

   On page 505, after line 13, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed