Home > 106th Congressional Bills > H.R. 4367 (ih) To amend title 10, United States Code, to enhance the ability of States and local governments to participate in projects conducted under the alternative authority of the Department of Defense to acquire and improve military housing. [Introd...H.R. 4367 (ih) To amend title 10, United States Code, to enhance the ability of States and local governments to participate in projects conducted under the alternative authority of the Department of Defense to acquire and improve military housing. [Introd...
108th CONGRESS
2d Session
H. R. 4366
To prohibit the transfer of personal information to any person outside
the United States, without notice and consent, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
May 13, 2004
Mr. Markey introduced the following bill; which was referred to the
Committee on Energy and Commerce
_______________________________________________________________________
A BILL
To prohibit the transfer of personal information to any person outside
the United States, without notice and consent, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Personal Data Offshoring Protection
Act of 2004''.
SEC. 2. DEFINITIONS.
As used in this Act, the following definitions apply:
(1) Business enterprise.--The term ``business enterprise''
means any organization, association, or venture established to
make a profit, or any private, nonprofit organization that
collects or retains personally identifiable information.
(2) Country with adequate privacy protection.--The term
``country with adequate privacy protection'' means a country
that has been certified by the Federal Trade Commission as
having a legal system that provides adequate privacy protection
for personally identifiable information.
(3) Personally identifiable information.--The term
``personally identifiable information'' includes information
such as--
(A) name;
(B) postal address;
(C) financial information;
(D) medical records;
(E) date of birth;
(F) phone number;
(G) e-mail address;
(H) social security number;
(I) mother's maiden name;
(J) password;
(K) state identification information;
(L) driver's license number;
(M) personal tax information; and
(N) any consumer transactional or experiential
information relating to the person.
(4) Transmit.--The term ``transmit'' or ``transmission''
means the use of any instrumentality of interstate commerce,
including the mails or any electronic means, to transfer
information or to provide access to such information via the
Internet or any comparable telecommunications system.
SEC. 3. PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION FROM
UNAUTHORIZED TRANSMISSION.
(a) In General.--A business enterprise may transmit personally
identifiable information regarding a citizen of the United States to
any foreign affiliate or subcontractor located in a country that is a
country with adequate privacy protection, provided that the citizen has
been provided prior notice that such information may be transmitted to
such a foreign affiliate or subcontractor and has not objected to such
transmission.
(b) ``Opt-In'' Consent Required for Countries Without Adequate
Privacy Protection.--A business enterprise may not transmit personally
identifiable information regarding a citizen of the United States to
any foreign affiliate or subcontractor located in a country that is a
country without adequate privacy protection unless--
(1) the business enterprise discloses to the citizen that
the country to which the information will be transmitted does
not have adequate privacy protection;
(2) the business enterprise obtains consent from the
citizen, before a consumer relationship is established or
before the effective date of this Act, to transmit such
information to such foreign affiliate or subcontractor; and
(3) the consent referred to in paragraph (2) is renewed by
the citizen within 1 year before such information is
transmitted.
(c) Prohibition on Refusal to Provide Services.--A business
enterprise shall not deny the provision of any good or service to, nor
change the terms of or refuse to enter into a business relationship
with any person based upon that person's exercise of the consent rights
provided for in this Act or in any other applicable law.
SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMISSION.
(a) Unfair and Deceptive Act or Practice.--A violation of this Act
shall be treated as a violation of a rule defining an unfair or
deceptive act or practice prescribed under section 18(a)(1)(B) of the
Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(b) Enforcement Authority.--The Federal Trade Commission shall
enforce this Act in the same manner, by the same means, and with the
same jurisdiction, powers, and duties as though all applicable terms
and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et
seq.) were incorporated into and made a part of this Act.
SEC. 5. CIVIL REMEDIES.
(a) Private Right of Action.--A person or entity may, if otherwise
permitted by the laws or rules of court of a State, bring in an
appropriate court of that State--
(1) an action based on a violation of this Act or the
regulations prescribed pursuant to this Act to enjoin such
violation;
(2) an action to recover for actual monetary loss from such
a violation, or to receive $10,000 in damages for each such
violation, whichever is greater, or
(3) both such actions.
If the court finds that the defendant willfully or knowingly violated
this subsection or the regulations prescribed under this subsection,
the court may, in its discretion, increase the amount of the award to
an amount equal to not more than 3 times the amount available under
paragraph (2).
(b) Actions by States.--
(1) Authority of states.--Whenever the attorney general of
a State, or an official or agency designated by a State, has
reason to believe that any person has engaged or is engaging in
a violation of this Act or the regulations prescribed pursuant
to this Act, the State may bring a civil action on behalf of
its residents to enjoin such violation, an action to recover
for actual monetary loss or receive $10,000 in damages for each
violation, or both such actions. If the court finds the
defendant willfully or knowingly violated this Act or
regulations prescribed pursuant to this Act, the court may, in
its discretion, increase the amount of the award to an amount
equal to not more than 3 times the amount available under the
preceding sentence.
(2) Exclusive jurisdiction of federal courts.--The district
courts of the United States, the United States courts of any
territory, and the District Court of the United States for the
District of Columbia shall have exclusive jurisdiction over all
civil actions brought under this subsection. Upon proper
application, such courts shall also have jurisdiction to issue
writs of mandamus, or orders affording like relief, commanding
the defendant to comply with the provisions of this Act or
regulations prescribed pursuant to this Act, including the
requirement that the defendant take such action as is necessary
to remove the danger of such violation. Upon a proper showing,
a permanent or temporary injunction or restraining order shall
be granted without bond.
(3) Notice to an intervention of federal trade
commission.--The State bringing a civil action under this
section shall serve prior written notice of any such civil
action upon the Federal Trade Commission and provide the
Commission with a copy of its complaint, except in any case
where such prior notice is not feasible, in which case the
State shall serve such notice immediately upon instituting such
action. The Commission shall have the right--
(A) to intervene in the action;
(B) upon so intervening, to be heard on all matters
arising therein; and
(C) to file petitions for appeal.
(4) Venue; service of process.--Any civil action brought
under this subsection in a district court of the United States
may be brought in the district wherein the defendant is found
or is an inhabitant or transacts business or wherein the
violation occurred or is occurring, and process in such cases
may be served in any district in which the defendant is an
inhabitant or where the defendant may be found.
(5) Investigatory powers.--For purposes of bringing any
civil action under this subsection, nothing in this Act shall
prevent the attorney general of a State, or an official or
agency designated by a State, from exercising the powers
conferred on the attorney general or such official by the laws
of such State to conduct investigations or to administer oaths
or affirmations or to compel the attendance of witnesses or the
production of documentary and other evidence.
(6) Effect on state court proceedings.--Nothing contained
in this section shall be construed to prohibit an authorized
State official from proceeding in State court on the basis of
an alleged violation of any general civil or criminal statute
of such State.
(7) Limitation.--Whenever the Federal Trade Commission has
instituted a civil action for violation of this Act or the
regulations prescribed pursuant to this Act, no State may,
during the pendency of such action instituted by the
Commission, subsequently institute a civil action against any
defendant named in the Commission's complaint for any violation
as alleged in the Commission's complaint.
SEC. 6. CERTIFICATION OF COUNTRIES WITH ADEQUATE PRIVACY PROTECTION.
(a) In General.--Not later than 6 months after the date of
enactment of this Act, the Federal Trade Commission, after providing
notice and opportunity for public comment, shall--
(1) certify those countries that have legal systems that
provide adequate privacy protection for personally identifiable
information; and
(2) make the list of countries certified under paragraph
(1) available to the general public.
(b) Certification Criteria.--
(1) In general.--In determining whether a country should be
certified under this section, the Federal Trade Commission
shall consider the adequacy of the country's infrastructure for
detecting, evaluating, and responding to privacy violations.
(2) Presumption.--The Commission shall presume that a
country's privacy protections are inadequate if they are any
less protective of personally identifiable information than
those afforded under Federal law or under the laws of any
State, or if the Commission determines that such country's laws
are not adequately enforced.
(c) European Union Date Protection Directive.--A country that has
comprehensive privacy laws that meet the requirements of the European
Union Data Protection Directive shall be certified under this section
unless the Federal Trade Commission determines that such laws are not
commonly enforced within such country.
SEC. 7. EFFECTIVE DATE.
Section 6 of this Act shall take effect on the date of enactment of
this Act. Sections 2 through 5 of this Act shall take effect 60 days
after the the completion of the certification required by section 6.
<all>
Pages: 1 Other Popular 106th Congressional Bills Documents:
|
| GovRecords.org presents information on various agencies of the United States Government. Even though all information is believed to be credible and accurate, no guarantees are made on the complete accuracy of our government records archive. Care should be taken to verify the information presented by responsible parties. Please see our reference page for congressional, presidential, and judicial branch contact information. GovRecords.org values visitor privacy. Please see the privacy page for more information. |
 |