S.Amdt. 2150

SA 2150. Mr. MARKEY (for himself, Mr. Blumenthal, Mr. Whitehouse, and
Mr. Sanders) submitted an amendment intended to be proposed by him to
the bill S. 2155, to promote economic growth, provide tailored
regulatory relief, and enhance consumer protections, and for other
purposes; which was ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. __. ACCURACY OF COLLECTED PERSONAL INFORMATION.

(a) Definitions.--In this section:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) Covered data broker.--
(A) In general.--The term ``covered data broker'' includes
all data brokers except those data brokers excepted under
subparagraph (B).
(B) Exceptions.--The Commission may except a data broker if
the Commission considers, by rule, a data broker outside the

[[Page S1503]]

scope of this section, such as a data broker who processes
information collected by or on behalf of and received from or
on behalf of a nonaffiliated third party concerning an
individual who is a customer or an employee of that third
party to enable that third party, directly or through parties
acting on its behalf, to provide benefits for its employees
or directly transact business with its customers.
(3) Data broker.--The term ``data broker'' means a
commercial entity that collects, assembles, or maintains
personal information concerning an individual who is not a
customer or an employee of that entity in order to sell the
information or provide third-party access to the information.
(4) Non-public information.--The term ``non-public
information'' means information about an individual that is--
(A) of a private nature;
(B) not available to the general public; and
(C) not obtained from a public record.
(5) Public record information.--The term ``public record
information'' means information about an individual that has
been obtained originally from records of a Federal, State, or
local government entity that are available for public
inspection.
(b) Prohibition on Obtaining or Solicitation to Obtain
Personal Information by False Pretenses.--
(1) In general.--A covered data broker may not obtain or
attempt to obtain, or cause to be disclosed or attempt to
cause to be disclosed to any person, personal information or
any other information relating to any person by making a
false, fictitious, or fraudulent statement or representation
to any person, including by providing any document to any
person, that the covered data broker knows or should know--
(A) to be forged, counterfeit, lost, stolen, or
fraudulently obtained; or
(B) contains a false, fictitious, or fraudulent statement
or representation.
(2) Solicitation.--A covered data broker may not request a
person to obtain personal information, or any other
information, relating to any other person if the covered data
broker knows or should know that the person to whom the
request is made will obtain or attempt to obtain that
information in the manner described in paragraph (1).
(c) Requirements Concerning Accuracy of and Access to
Personal Information.--
(1) Accuracy.--
(A) In general.--Except as provided in subparagraph (B), a
covered data broker shall establish procedures to ensure, to
the maximum extent practicable, the accuracy of--
(i) the personal information it collects, assembles, or
maintains; and
(ii) any other information it collects, assembles, or
maintains that specifically identifies an individual, unless
the information only identifies an individual's name or
address.
(B) Exception.--A covered data broker may collect or
maintain information that may be inaccurate with respect to a
particular individual if that information is being collected
or maintained solely for the purpose of--
(i) indicating whether there may be a discrepancy or
irregularity in the personal information that is associated
with an individual;
(ii) helping to identify, or to authenticate the identity
of, an individual; or
(iii) helping to protect against or investigate fraud or
other unlawful conduct.
(2) Consumer access.--
(A) In general.--Subject to subparagraph (D), a covered
data broker shall provide an individual a means to review any
personal information or other information that specifically
identifies that individual, that the covered data broker
collects, assembles, or maintains on that individual.
(B) Review requirements.--The means for review under
subparagraph (A) shall be provided--
(i) at an individual's request;
(ii) after verifying the identity of the individual;
(iii) at least 1 time per year;
(iv) at no cost to the individual; and
(v) in a format that can be readily understood by a
consumer, as determined by the Commission.
(C) Period of review.--A covered data broker shall provide
an individual the means required under subparagraph (A)
within such period after receiving a request from such
individual as the Commission shall determine, by rule, is
appropriate.
(D) Exceptions.--The Commission may, by rule, establish
such exceptions to subparagraph (A) as the Commission
considers appropriate, such as for child protection, law
enforcement, fraud prevention, or other government purposes.
(E) Limitation on use of verifying information.--If a
covered data broker collects information from an individual
to verify the identity of the individual under subparagraph
(B)(ii) that the data broker did not have before such
collection, the data broker may not use such information for
any purpose other than for purposes of verifying the identity
of the individual under such subparagraph.
(3) Disputed information.--
(A) In general.--An individual whose personal information
is maintained by a covered data broker may dispute the
accuracy of any information described under paragraph (2)(A)
by requesting, in writing, that the covered data broker
correct the information.
(B) Correction requirements.--A covered data broker, after
verifying the identity of an individual making a request
under subparagraph (A) to correct information, and unless
there are reasonable grounds to believe the request is
frivolous or irrelevant, shall--
(i) with regard to public record information--

(I) inform the individual of the source of the information
and, if reasonably available, where to direct the
individual's request for correction; or
(II) if the individual provides proof that the public
record has been corrected or that the covered data broker was
reporting the information incorrectly, correct the inaccuracy
in the covered data broker's records; and

(ii) with regard to non-public information--

(I) note the information that is disputed, including the
individual's written request;
(II) if the information can be independently verified, use
the procedures established under paragraph (1) to
independently verify the information; and
(III) if the covered data broker was reporting the
information incorrectly, correct the inaccuracy in the
covered data broker's records.

(C) Period of correction.--In a case in which a covered
data broker is subject to a requirement under subparagraph
(B) due to a request made by an individual under subparagraph
(A), such covered data broker shall take such action as may
be required to satisfy such requirement within such period as
the Commission shall determine, by rule, is appropriate.
(4) Notice.--
(A) In general.--A covered data broker shall maintain an
Internet website and place a clear and conspicuous notice on
that Internet website instructing an individual how--
(i) to review information under paragraph (2)(A); and
(ii) to express a preference under paragraph (5)(B).
(B) Form.--A covered data broker shall ensure that the
notice the covered data broker places under subparagraph (A)
conforms to such model form as the Commission shall
promulgate for purposes of this paragraph.
(5) Certain marketing information.--
(A) In general.--A covered data broker may not use, share,
or sell any information for marketing purposes that is
subject to an expressed preference under subparagraph (B).
(B) Expression of preferences.--A covered data broker that
maintains any information described under paragraph (1) and
that uses, shares, or sells that information for marketing
purposes shall provide each individual whose information the
covered data broker maintains with a reasonable means of
expressing a preference not to have that individual's
information used for those purposes.
(6) Auditing.--
(A) In general.--Subject to subparagraph (B), each covered
data broker shall establish measures that facilitate the
auditing or retracing of any internal or external access to,
or transmission of, any data containing personal information
collected, assembled, or maintained by the covered data
broker.
(B) Exceptions.--The Commission may establish, by rule,
such exceptions to subparagraph (A) as the Commission
considers appropriate to further or protect law enforcement
or national security activities.
(7) Security.--
(A) In general.--Each covered data broker shall develop and
implement a comprehensive consumer privacy and data security
program to protect against harm that may be caused by--
(i) loss of personal information collected, assembled, or
maintained by the covered data broker; or
(ii) unauthorized access, destruction, use, modification,
or disclosure of such personal information.
(B) Notice.--Whenever a covered data broker determines that
personal information of an individual that is collected,
assembled, or maintained by the covered data broker has been
lost or the subject of an unauthorized access, destruction,
use, modification, or disclosure, the covered data broker
shall notify such individual of such loss, access,
destruction, use, modification, or disclosure.
(8) Persons regulated by the fair credit reporting act.--A
covered data broker shall be considered to be in compliance
with paragraphs (1) through (6) of this subsection with
respect to information that is subject to the Fair Credit
Reporting Act (15 U.S.C. 1681 et seq.) if the covered data
broker is in compliance with sections 609, 610, and 611 of
that Act (15 U.S.C. 1681g, 1681h, 1681i).
(d) Regulations.--
(1) In general.--Not later than 1 year after the date of
the enactment of this Act, the Commission shall promulgate
regulations under section 553 of title 5, United States Code,
to carry out this section.
(2) Elements.--The regulations promulgated under paragraph
(1) shall include the following:
(A) Such exceptions the Commission considers appropriate to
promulgate under subsection (a)(2)(B).
(B) The period of review required under subsection
(c)(2)(C).
(C) Such exceptions as the Commission considers appropriate
to promulgate under subsection (c)(2)(D).
(D) The period of correction required under subsection
(c)(3)(C).
(E) The model form required by subsection (c)(4)(B).

[[Page S1504]]

(F) Requirements for auditing under subparagraph (A) of
subsection (c)(6) and such exceptions under subparagraph (B)
of such subsection as the Commission considers appropriate.
(G) Establishment of a centralized Internet website for the
benefit of consumers that--
(i) lists the covered data brokers that are subject to a
requirement of subsection (c); and
(ii) provides information to consumers about their rights
under this section.
(H) Such other regulations as the Commission considers
appropriate to carry out this section.
(e) Enforcement.--
(1) Enforcement by federal trade commission.--
(A) Unfair or deceptive acts or practices.--A violation of
subsection (b) or (c) or a regulation promulgated under this
section shall be treated as a violation of a rule defining an
unfair or a deceptive act or practice under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)).
(B) Powers of commission.--
(i) In general.--The Commission shall enforce this section
in the same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all applicable
terms and provisions of the Federal Trade Commission Act (15
U.S.C. 41 et seq.) were incorporated into and made a part of
this section.
(ii) Privileges and immunities.--Any person who violates a
regulation prescribed under this section shall be subject to
the penalties and entitled to the privileges and immunities
provided in the Federal Trade Commission Act (15 U.S.C. 41 et
seq.).
(2) Enforcement by states.--
(A) Civil action.--Except as provided under subparagraph
(E), in any case in which the attorney general of a State has
reason to believe that an interest of the residents of that
State has been or is threatened or adversely affected by any
person subject to a provision of subsection (c) or (d) or a
regulation promulgated under this section in a practice that
violates such provision or regulation, the attorney general
of the State may, as parens patriae, bring a civil action on
behalf of the residents of the State in an appropriate
district court of the United States--
(i) to enjoin further violation of such provision or
regulation by such person;
(ii) to compel compliance with such provision or
regulation;
(iii) to obtain damages, restitution, or other compensation
on behalf of such residents;
(iv) to obtain such other relief as the court considers
appropriate; or
(v) to obtain civil penalties in the amount determined
under subparagraph (B).
(B) Civil penalties.--
(i) Calculation.--For purposes of imposing a civil penalty
under subparagraph (A)(v), the amount determined under this
paragraph is the amount calculated by multiplying the number
of separate violations of a rule by an amount not greater
than $16,000.
(ii) Adjustment for inflation.--Beginning on the date that
the Consumer Price Index is first published by the Bureau of
Labor Statistics that is after 1 year after the date of
enactment of this Act, and each year thereafter, the amount
specified in clause (i) shall be increased by the percentage
increase in the Consumer Price Index published on that date
from the Consumer Price Index published the previous year.
(C) Rights of federal trade commission.--
(i) Notice to federal trade commission.--

(I) In general.--Except as provided in subclause (III), the
attorney general of a State shall notify the Commission in
writing that the attorney general intends to bring a civil
action under subparagraph (A) before initiating the civil
action.
(II) Contents.--The notification required by subclause (I)
with respect to a civil action shall include a copy of the
complaint to be filed to initiate the civil action.
(III) Exception.--If it is not feasible for the attorney
general of a State to provide the notification required by
subclause (I) before initiating a civil action under
subparagraph (A), the attorney general shall notify the
Commission immediately upon instituting the civil action.

(ii) Intervention by federal trade commission.--The
Commission may--

(I) intervene in any civil action brought by the attorney
general of a State under subparagraph (A); and
(II) upon intervening--

(aa) be heard on all matters arising in the civil action;
and
(bb) file petitions for appeal of a decision in the civil
action.
(D) Investigatory powers.--Nothing in this paragraph may be
construed to prevent the attorney general of a State from
exercising the powers conferred on the attorney general by
the laws of the State to conduct investigations, to
administer oaths or affirmations, or to compel the attendance
of witnesses or the production of documentary or other
evidence.
(E) Preemptive action by federal trade commission.--If the
Commission institutes a civil action or an administrative
action with respect to a violation of a provision of
subsection (b) or (c) or a regulation promulgated under this
section, the attorney general of a State may not, during the
pendency of such action, bring a civil action under
subparagraph (A) against any defendant named in the complaint
of the Commission for the violation with respect to which the
Commission instituted such action.
(F) Actions by other state officials.--
(i) In general.--In addition to civil actions brought by
attorneys general under subparagraph (A), any other officer
of a State who is authorized by the State to do so may bring
a civil action under subparagraph (A), subject to the same
requirements and limitations that apply under this paragraph
to civil actions brought by attorneys general.
(ii) Savings provision.--Nothing in this paragraph may be
construed to prohibit an authorized official of a State from
initiating or continuing any proceeding in a court of the
State for a violation of any civil or criminal law of the
State.
(f) Effect on Other Laws.--
(1) Preservation of commission authority.--Nothing in this
section may be construed in any way to limit or affect the
Commission's authority under any other provision of law.
(2) Preservation of other federal law.--Nothing in this
section may be construed in any way to supersede, restrict,
or limit the application of the Fair Credit Reporting Act (15
U.S.C. 1681 et seq.) or any other Federal law.
______