New House Privacy Bill: Information Transparency and Personal Data Control Act

U.S. Representatives Suzan DelBene (D-WA) and Hakeem Jeffries (D-NY) have introduced the Information Transparency and Personal Data Control act into the U.S. House of Representatives. The proposed House privacy bill applies broadly to any entity operating a website and who collects or maintains personal information for commercial purposes. It requires:

Transparent Privacy Policy: It requires an up-to-date, transparent privacy, security and data use policy that is concise, intelligible, appears prominently, uses plain languages, and makes complex information understandable where appropriate through visualizations. The policies will need to include the identity and contact information of the entity collecting the data, the purpose or use of actions with respect to the data (collection, storage, processing, sharing, etc.), third parties with whom the sensitive personal information will be shared, the period of retention by the organization and any third party, how to withdraw consent, how to access your data, and how the organization is protecting it from unauthorized access.

Right to Opt-In for Sensitive Personal Information: Requires businesses to collect affirmative, express, opt-in consent for any functionality that involves collection, storage, processing, sale, sharing or other use of sensitive personal information. Sensitive personal information is defined as information relating to an identified or identifiable individual. The law provides 15 examples and has a catch all for any other information that the FTC determines is sensitive.

Right to Opt Out for Non-Sensitive Personal Information: For non-sensitive personal information, website operators will need to provide users with the ability to opt out at any time.

Privacy Audits: It will require annual audits of website operators, with 501 employees or more, by an independent third-party professional if the business collects sensitive personal information. If an authorized state or federal entity brings forth allegations of a violation of the law (or any regulations issued under it), the entity will have 10 days to provide the audit to the government. The audit

Rulemaking and Enforcement: It gives the FTC the power to engage in notice and comment rulemaking under 5 U.S.C. 553 for the privacy regulations specified in the legislation. The FTC will also have the power to enforce the law and regulations under its Section 5 authority of the FTC Act. It also gives enforcement power to State Attorney Generals. A state AG must provide the FTC with prior notice and the FTC has the ability to intervene in the lawsuit.

The law would go into effect 180 days after it is enacted and the FTC would have one year to issue regulations. The bill does not on its face preempt the California Consumer Privacy Act of 2018, despite businesses pushing for action by Congress to stop the prospect of compliance with 50 different state laws on privacy.

Rep. DelBene is a former Microsoft executive that worked at the technology company from 1989 to 1998 and again from 2004 until 2007. When she floated the draft bill this summer, she said that it included input from both consumer groups and tech companies.

More from Clarip

EU GDPR
– GDPR Compliance
– Consent Management Software
– GDPR Data Mapping Software
– DSAR Portal
– GDPR Text

ePrivacy
– Cookie Scanner
– Cookie Banner Generator
– Cookie Consent Manager
– ePrivacy Regulation

California Consumer Privacy Act
– CCPA Summary
– CCPA vs GDPR
– CCPA Privacy Software
– CCPA Webinar

Other Blog Posts on Privacy Bills in the US House:

Internet Bill of Rights for Privacy
New Privacy Bills: APPS Act and DATA Act of 2018
Highlights of the Secure and Protect Americans’ Data Act in U.S. House
Highlights of Browser Act to Protect Privacy in U.S. House
BROWSER Act and Privacy Discussed in House Communications Subcommittee Hearing
Privacy Focus of Last Week’s DCCP Subcommittee Hearing on Digital Advertising
House Subcommittee Asks FTC Commissioners About Consumer Privacy
Do Not Track Kids Act Back in Congress