DATA Privacy Act

The DATA Privacy Act establishes national data privacy standards in the United States. It defines key terms like 'covered data' and 'covered entity', requires privacy notices, mandates certain data practices, gives individuals control over their data, sets information security standards, requires privacy protection officers for large entities, supports research into privacy enhancing technologies, and provides for enforcement by the Federal Trade Commission and State Attorneys General.

Sec. 2, Definitions: Defines terms used in the Act, including 'collect', 'Commission' (the Federal Trade Commission), 'covered data' (information collected over the internet linked to an individual or device, excluding employment data and public government records), 'covered entity' (any entity handling covered data, excluding those handling data of fewer than 50,000 individuals or devices per year), 'disclose', 'privacy enhancing technology', 'privacy risk', 'process', 'protected characteristic', 'pseudonymous data', 'reasonable interest', 'sensitive data', 'store', and 'third party service provider'.

Sec. 3, Required Privacy Notice: Requires each covered entity to post a concise, clear, and free privacy notice describing the covered data collected, the purposes and means of collection, who data is disclosed to, and how individuals can exercise their rights.

Sec. 4, Required Data Practices: Directs the Commission to issue regulations within one year requiring covered entities to implement data procedures that are reasonable (serving a legitimate interest), equitable (not discriminating based on protected characteristics), and forthright (not deceptive). It also requires opt-out consent for data collection and affirmative opt-in consent before certain actions.

Sec. 5, Individual Control Over Data Use: Directs the Commission to issue regulations requiring covered entities to provide individuals with free methods to access their data, dispute its accuracy, delete it, and transfer it in a standardized format. Entities cannot discriminate against individuals for exercising these rights.

Sec. 6, Information Security Standards: Directs the Commission to issue regulations requiring covered entities to establish information security policies considering data identifiability, sensitivity, available safeguards, cost, and impact on small businesses. Compliance with existing laws like Gramm-Leach-Bliley or HIPAA may satisfy these requirements.

Sec. 7, Privacy Protection Officers: Requires covered entities with annual revenue over $50 million to designate a privacy protection officer to educate employees, conduct audits, maintain records, and serve as a contact for enforcement. The officer cannot be penalized for performing these duties.

Sec. 8, Research into Privacy Enhancing Technology: Directs the National Science Foundation to support research on privacy enhancing technologies, amends the Cyber Security Research and Development Act to include such technologies, and requires coordination with the National Institute of Standards and Technology and the Commission. A report on progress and policy recommendations is due within two years.

Sec. 9, Enforcement: The Commission enforces the Act (except Sec. 8) as an unfair or deceptive act under the FTC Act, including against common carriers. State Attorneys General may bring civil actions for injunctions, damages, or civil penalties up to $40,000 per affected individual (adjusted for inflation), after notifying the Commission.

Sec. 10, Additional Enforcement Resources: Allows the Commission to appoint up to 300 additional personnel for privacy enforcement without regard to civil service laws, and authorizes necessary appropriations.