1d20 
[DOCID: f:h112ih.txt]






107th CONGRESS
  1st Session
                                H. R. 112

 To prohibit the making, importation, exportation, distribution, sale, 
   offer for sale, installation, or use of an information collection 
         device without proper labeling or notice and consent.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                            January 3, 2001

   Mr. Holt introduced the following bill; which was referred to the 
                    Committee on Energy and Commerce

_______________________________________________________________________

                                 A BILL


 
 To prohibit the making, importation, exportation, distribution, sale, 
   offer for sale, installation, or use of an information collection 
         device without proper labeling or notice and consent.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Electronic Privacy Protection Act''.

SEC. 2. PROHIBITIONS RELATING TO INFORMATION COLLECTION DEVICES.

    (a) Prohibition.--It is unlawful for any person to knowingly make, 
import, export, distribute, sell, offer for sale, install, or use an 
information collection device in a manner that violates any regulation 
issued under subsection (b).
    (b) Regulations.--
            (1) In general.--Not later than 120 days after the date of 
        the enactment of this Act, the Federal Trade Commission shall 
        issue regulations that make it unlawful under subsection (a) 
        for any person--
                    (A) to knowingly make, import, export, distribute, 
                sell, or offer for sale an information collection 
                device, unless the device has a label that discloses in 
                a manner that is readily apparent and understood that 
                the device may transmit from a computer information 
                that is identifiable to that computer, to a primary 
                user of that computer, or to an individual who operates 
                that computer but is not a primary user thereof;
                    (B) to knowingly install an information collection 
                device on a computer that is not under general 
                management and control of that person, unless that 
                person in accordance with regulations issued under 
                paragraph (2)--
                            (i) has given a primary user of that 
                        computer notice of such installation; and
                            (ii) after providing such notice to a 
                        primary user, has obtained the consent of the 
                        primary user to such installation; or
                    (C) to knowingly use an information collection 
                device to transmit from a computer that is not under 
                general management and control of that person, any 
                information that is identifiable to that computer, to a 
                primary user of that computer, or to an individual who 
                operates that computer but is not a primary user 
                thereof, unless that person in accordance with 
                regulations issued under paragraph (2)--
                            (i) has given a primary user of that 
                        computer notice that the device may transmit 
                        such information; and
                            (ii) after providing such notice to a 
                        primary user, has obtained consent by the 
                        primary user to such a transmission.
            (2) Notice and consent.--For purposes of notice and consent 
        required by paragraph (1), regulations shall require that--
                    (A) notice be given and consent be obtained for 
                each instance of installation or use of an information 
                collection device; and
                    (B) consent is effective only if the person 
                obtaining the consent has a good faith belief that the 
                person giving the consent--
                            (i) has attained 18 years of age; and
                            (ii) has authority to give such consent.
    (c) Limitation on Application of Regulations.--Regulations issued 
under subsection (b)(1)(A) shall not prohibit the making, importation, 
exportation, distribution, sale, or offer for sale of any information 
collection device made before the date of the enactment of this Act.
    (d) Penalty.--
            (1) In general.--Subject to paragraph (2), whoever violates 
        this section shall be fined $500 for the first such violation 
        and $1,500 for each subsequent violation.
            (2) Information about minors.--Whoever commits a violation 
        of a regulation issued under subsection (b)(1)(C) shall be 
        fined twice the amount of the fine that would otherwise apply 
        under this subsection if such violation results in the 
        transmission from a computer of information that is 
        identifiable to--
                    (A) an individual who operates that computer and 
                has not attained 18 years of age; or
                    (B) that computer if a primary user of that 
                computer is an individual who has not attained such 
                age.
            (3) Subsequent violations.--Each violation of a regulation 
        issued under subsection (b)(1), including each transmission of 
        information in violation of subsection (b)(1)(C), constitutes a 
        separate violation for purposes of this subsection.
    (e) Definitions.--For purposes of this section:
            (1) Computer.--The term ``computer'' means a programmable 
        electronically activated device that--
                    (A) is capable of accepting information, applying 
                prescribed processes to the information, and supplying 
                the results of those processes with or without human 
                intervention; and
                    (B) consists of a central processing unit 
                containing extensive storage, logic, and control 
                capabilities.
            (2) Information collection device.--The term ``information 
        collection device'' means any device that--
                    (A) is a computer program that is capable of 
                collecting and transmitting from a computer to a person 
                other than a primary user of that computer, information 
                that is identifiable to that computer, to a primary 
                user of that computer, or to an individual who operates 
                that computer but is not a primary user thereof; and
                    (B) does not consist of only a simple identifying 
                string of computer code, commonly referred to as a 
                ``cookie''.
            (3) Primary user.--The term ``primary user'' means any 
        individual with general authority over management and use of a 
        computer or any person on whose behalf an individual exercises 
        such general authority.
                                 <all>

0