2000 
[DOCID: f:h2135ih.txt]






107th CONGRESS
  1st Session
                                H. R. 2135

                      To protect consumer privacy.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             June 12, 2001

  Mr. Sawyer introduced the following bill; which was referred to the 
                    Committee on Energy and Commerce

_______________________________________________________________________

                                 A BILL


 
                      To protect consumer privacy.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Consumer Privacy Protection Act''.

SEC. 2. FINDINGS AND PURPOSE.

    (a) Findings.--The Congress finds the following:
            (1) People in the United States lack important privacy 
        protections.
            (2) The opportunities for an individual to secure 
        employment, insurance, and credit, to obtain medical care, and 
        to participate in electronic commerce are endangered by the 
        potential for misuse of certain personal information.
            (3) Because markets work through trust, predictability, and 
        stability, privacy protections should help businesses gain the 
        trust of consumers and compliment existing practices.
            (4) 84 percent of Internet users are concerned about 
        businesses and people they do not know obtaining personal 
        information about them.
            (5) Nearly 80 percent of online consumers have at some time 
        abandoned e-commerce transactions due to privacy concerns, 
        resulting in an estimated loss to companies of $12.4 billion in 
        2000.
            (6) In order to protect the privacy of individuals in the 
        Information Age, it is necessary and appropriate for public 
        officials to take steps to safeguard this essential freedom.
    (b) Purpose.--The purpose of this Act is to assure that personal 
information about an individual consumer in the United States is 
properly protected and that any use of such information by others is 
consistent with the prior consent of the consumer.

SEC. 3. PROTECTION OF PERSONAL INFORMATION.

    (a) Limitations on Disclosure of Personal Information.--An 
information recipient shall not disclose to any other person personal 
information collected or obtained from or about a consumer, unless--
            (1) such disclosure is made after the consumer has been 
        provided with a clear and concise description of the extent and 
        circumstances under which such a disclosure may occur;
            (2) such disclosure does not exceed the scope of the 
        consumer's prior consent, which shall be--
                    (A) in the case of disclosure of personal 
                information, granted tacitly or affirmatively by the 
                consumer after receiving the description required by 
                paragraph (1); or
                    (B) in the case of disclosure of sensitive personal 
                information, granted affirmatively by the consumer 
                after receiving the description required by paragraph 
                (1); and
            (3) the consent granted under paragraph (2) has not 
        subsequently been withdrawn by the consumer.
    (b) Limitation on Collection of Optional Information.--An 
information recipient may not require a consumer to provide, as a 
condition of entering into or completing a transaction with the 
information recipient, personal information that is not necessary to 
complete the transaction.
    (c) Limitation on Refusal to Transact.--An information recipient 
may not terminate or refuse to enter into a transaction with a consumer 
because the consumer has not granted, or has withdrawn, the consent 
required by subsection (a), except when the sole purpose of the 
transaction is the acquisition of such information for disclosure.
    (d) Reasonable Access to Personal Information.--An information 
recipient shall provide to a consumer about whom personal information 
has been obtained reasonable access to the consumer's personal 
information.

SEC. 4. EXCEPTIONS.

    Section 3 does not apply to the disclosure of personal 
information--
            (1) as necessary to effect, administer, or enforce a 
        transaction requested or authorized by the consumer;
            (2) to protect the confidentiality or security of personal 
        information;
            (3) to prevent or investigate fraud, an unauthorized 
        transaction, a claim, or other liability;
            (4) to collect a debt or dishonored item;
            (5) for the purpose of a securitization or secondary market 
        sale (including servicing rights);
            (6) for the purposes of legal process;
            (7) for law enforcement purposes;
            (8) for governmental regulatory purposes;
            (9) as otherwise authorized or required under a Federal 
        law; or
            (10) if the Federal Trade Commission has made a finding 
        that such a disclosure is consistent with the purposes of this 
        Act and in the public interest.

SEC. 5. UNFAIR OR DECEPTIVE ACT OR PRACTICE.

    (a) Violation of Act.--Disclosure of personal information about a 
consumer in a manner that violates this Act constitutes an unfair or 
deceptive act or practice in or affecting commerce (within the meaning 
of section 5(a)(1) of the Federal Trade Commission Act (15 U.S.C. 45)).
    (b) Violation of Rule.--Violation of a rule made under this Act 
constitutes violation of a rule defining an unfair or deceptive act or 
practice made under section 18(a)(1)(B) of the Federal Trade Commission 
Act (15 U.S.C. 57a(a)(1)(B)).

SEC. 6. SAFE HARBOR.

    (a) Practices and Procedures, Guidelines.--A person does not commit 
a violation of this Act if such person--
            (1) establishes, implements, and follows reasonable 
        practices and procedures to effectively prevent a violation of 
        this Act;
            (2) implements and follows a set of guidelines setting 
        forth reasonable practices and procedures to effectively 
        prevent a violation of this Act, if such guidelines are--
                    (A) issued by a self-regulatory organization to 
                which such person is, or could be, subject; and
                    (B) approved under subsection (b), after submission 
                by such organization to the Federal Trade Commission; 
                or
            (3) implements and follows a set of model guidelines issued 
        by the Commission, after notice and opportunity for comment, 
        setting forth reasonable practices and procedures to 
        effectively prevent a violation of this Act.
    (b) Approval of Guidelines.--Not later than 90 days after receiving 
a request by a self-regulatory organization for approval of guidelines 
under subsection (a)(2) and after notice and an opportunity for 
comment, the Federal Trade Commission shall approve or disapprove such 
proposed guidelines (setting forth in writing the reasons for any 
disapproval).

SEC. 7. PRIVATE RIGHT OF ACTION.

    A consumer may bring in an appropriate district court of the United 
States or, if otherwise permitted by the laws or rules of court of a 
State, in an appropriate court of that State--
            (1) a civil action to enjoin a violation of this Act;
            (2) a civil action to recover--
                    (A) the greater of actual monetary loss or $1,000 
                in damages for each such violation; and
                    (B) up to $10,000, to be determined in the 
                discretion of the court, if the court finds that the 
                defendant willfully or knowingly violated such rules; 
                or
            (3) both such actions.

SEC. 8. ACTIONS BY STATES.

    (a) Authority of States.--Whenever the attorney general of a State, 
or an 
1073
official or agency designated by a State, has reason to believe 
that any person has engaged or is engaging in a pattern or practice of 
violations of this Act, the State, on behalf of its residents, may 
bring--
            (1) a civil action to enjoin such violations; and
            (2) a civil action to recover--
                    (A) the greater of actual monetary loss of such 
                residents or $1,000 in damages for each such violation; 
                and
                    (B) up to $10,000, to be determined in the 
                discretion of the court, if the court finds that the 
                defendant willfully or knowingly violated such rules; 
                or
            (3) both such actions.
    (b) Exclusive Jurisdiction of Federal Courts.--(1) The district 
courts of the United States shall have exclusive jurisdiction over all 
civil actions brought under this section.
    (2) Upon a proper showing in a civil action brought under this 
section, a permanent or temporary injunction or restraining order shall 
be granted without bond.
    (c) Rights of Federal Trade Commission.--(1) The State shall serve 
prior written notice of any civil action brought under this section 
upon the Federal Trade Commission and provide the Commission with a 
copy of its complaint, except in any case where such prior notice is 
not feasible, in which case the State shall serve such notice 
immediately upon instituting such action.
    (2) The Commission shall have the right--
            (A) to intervene in the action;
            (B) upon so intervening, to be heard on all matters arising 
        therein; and
            (C) to file petitions for appeal.
    (d) Limitation.--Whenever the Federal Trade Commission has 
commenced a civil action for violation of this Act, no State may, 
during the pendency of such action commenced by the Commission, 
subsequently commence a civil action against any defendant named in the 
Commission's complaint for any violation as alleged in the Commission's 
complaint.

SEC. 9. PREEMPTION.

    This Act and the rules made under this Act preempt any inconsistent 
provision of State law.

SEC. 10. DEFINITIONS.

    In this Act:
            (1) The term ``information recipient'' means any person who 
        obtains personal information from or about a consumer, through 
        a transaction in or affecting interstate or foreign commerce. 
        Such term does not include--
                    (A) an affiliate, parent entity, or subsidiary of 
                such person; or
                    (B) the consumer about whom such information has 
                been obtained.
            (2) The term ``consumer'' means an individual who is or was 
        in a consumer relationship with an information recipient.
            (3) The term ``personal information'' means personally 
        identifiable information and sensitive personal information.
            (4) The term ``personally identifiable information'' 
        includes, with respect to a consumer--
                    (A) a name;
                    (B) an address;
                    (C) a phone number; and
                    (D) an electronic mail address.
            (5) The term ``sensitive personal information'' includes, 
        with respect to a consumer--
                    (A) a Social Security identification number; and
                    (B) financial information.
            (6) The term ``State'' includes any commonwealth, 
        territory, or possession of the United States.
            (7) The term ``violation of this Act'' includes violation 
        of a rule made under this Act.

SEC. 11. RULEMAKING AUTHORITY.

    Not later than one year after the date of enactment of this Act, 
the Federal Trade Commission shall prescribe rules, in accordance with 
section 553 of title 5, United States Code, to carry out this Act, 
which shall take effect not later than 180 days after their publication 
in final form.

SEC. 12. EFFECTIVE DATE.

    This Act (other than section 11) shall take effect on the same date 
that the rules prescribed under section 11 take effect.
                                 <all>

0