[DISCUSSION DRAFT] 117TH CONGRESS 2D SESSION H. R. __ To provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement. m o c . 5 IN THE HOUSE OF REPRESENTATIVES M_. ______ introduced the following bill; which was referred to the Committee on ______________ b u A BILL h t i g To provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement. Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1. SHORT TITLE; TABLE OF CONTENTS. (a) SHORT TITLE.—This Act may be cited as the “American Data Privacy and Protection Act”. (b) TABLE OF CONTENTS.—The table of contents of this Act is as follows: Sec. 1. Short title; table of contents. Sec. 2. Definitions. TITLE I—DUTY OF LOYALTY 1 Sec. 101. Data minimization. Sec. 102. Loyalty Duties. Sec. 103. Privacy by design. Sec. 104. Loyalty to individuals with respect to pricing. TITLE II—CONSUMER DATA RIGHTS Sec. 201. Consumer Awareness. Sec. 202. Transparency. Sec. 203. Individual data ownership and control. Sec. 204. Right to consent and object. Sec. 205. Data protections for children and minors. Sec. 206. Third-Party Collecting Entities. Sec. 207. Civil rights and algorithms. Sec. 208. Data security and protection of covered data. Sec. 209. General exceptions. Sec. 210. Unified opt-out mechanisms. TITLE III—CORPORATE ACCOUNTABILITY m o c . 5 Sec. 301. Executive responsibility. Sec. 302. Service providers and third parties. Sec. 303. Technical compliance programs. Sec. 304. Commission approved compliance guidelines. Sec. 305. Digital content forgeries. TITLE IV—ENFORCEMENT, APPLICABILITY, AND MISCELLANEOUS b u h t i g Sec. 401. Enforcement by the Federal Trade Commission. Sec. 402. Enforcement by State attorneys general. Sec. 403. Enforcement by individuals. Sec. 404. Relationship to Federal and State laws. Sec. 405. Severability. Sec. 406. COPPA. Sec. 407. Authorization of appropriations. Sec. 408. Effective date. SEC. 2. DEFINITIONS. In this Act: (1) AFFIRMATIVE EXPRESS CONSENT.— (A) IN GENERAL.—The term “affirmative express consent” means an affirmative act by an individual that clearly communicates the individual’s freely given, specific, informed, and unambiguous authorization for an act or practice, in response to a 2 specific request from a covered entity that meets the requirements of subparagraph (B). (B) REQUEST REQUIREMENTS.—The requirements of this subparagraph with respect to a request from a covered entity to an individual are the following: (i) The request is provided to the individual in a clear and conspicuous standalone disclosure made through the primary medium used to offer the covered entity's product or service. (ii) The request includes a description of each act or practice for which the individual’s consent is sought and— m o (I) clearly states the specific types of covered data that the covered entity shall collect, process, or transfer for each act or practice; c . 5 b u (II) clearly distinguishes between any act or practice which is necessary to fulfill a request of the individual and any act or practice which is for another purpose; and h t i g (III) is written in easy-to-understand language and includes a prominent heading that would enable a reasonable individual to identify and understand the act or practice and the covered data to be collected, processed, or transferred by the covered entity for such act or practice. (iii) The request clearly explains the individual’s applicable rights related to consent. (iv) The request shall be made available to the public in each language in which the covered entity provides a product or service for which authorization is sought or in which the covered entity carries out any activity related to any product or service the covered data of the individual may be collected, processed, or transferred. (C) EXPRESS CONSENT REQUIRED.—A covered entity shall not infer that an individual has provided affirmative express 3 consent to an act or practice from the inaction of the individual or the individual’s continued use of a service or product provided by the entity. (D) PRETEXTUAL CONSENT PROHIBITED.—A covered entity shall not obtain or attempt to obtain the affirmative express consent of an individual through— (i) the use of any false, fictitious, fraudulent, or materially misleading statement