Data Protection Act of 2026

[Congressional Bills 119th Congress] [From the U.S. Government Publishing Office] [S. 5594 Introduced in Senate (IS)]

<DOC>

119th CONGRESS 2d Session S. 5594

To establish the Data Protection Agency, protect the privacy of individuals, and for other purposes.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

September 29, 2026

Mrs. Gillibrand introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation

_______________________________________________________________________

A BILL

To establish the Data Protection Agency, protect the privacy of individuals, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

(a) Short Title.--This Act may be cited as the ``Data Protection Act of 2026''. (b) Table of Contents.--The table of contents for this Act is as follows:

Sec. 1. Short title; table of contents. Sec. 2. Definitions. TITLE I--DATA PROTECTION AUTHORITY

Sec. 101. Establishment; purpose, objectives, and functions. Sec. 102. Administration. Sec. 103. Implementation and enforcement. Sec. 104. Relation to other laws and agencies. Sec. 105. Funding. TITLE II--PRIVACY PROTECTIONS

Sec. 201. Prohibited acts. Sec. 202. Supervision of data aggregators. TITLE III--MISCELLANEOUS

Sec. 301. Initial regulations. Sec. 302. Severability. Sec. 303. Relation to Federal and State law.

SEC. 2. DEFINITIONS.

In this Act: (1) Agency.--The term ``Agency'' means the Data Protection Agency established under section 101. (2) Agency investigation.--The term ``Agency investigation'' means any inquiry conducted by an Agency investigator for the purpose of ascertaining whether any person is or has been engaged in any conduct that is a violation, as defined in section 103(b)(1). (3) Agency investigator.--The term ``Agency investigator'' means any attorney or investigator employed by the Agency who is charged with the duty of enforcing or carrying into effect this Act or any other Federal privacy law. (4) Anonymized data.--The term ``anonymized data'' means information-- (A) that does not identify an individual; and (B) with respect to which there is no reasonable basis to believe that the information can be used on its own or in combination with other reasonably available information to identify an individual. (5) Automated decision system.--The term ``automated decision system'' means a computational process, including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques, that automates, analyzes, aids, or augments decisions. (6) Biometric information.--The term ``biometric information''-- (A) means information regarding the physiological or biological characteristics of an individual that may be used, singly or in combination with each other or with other identifying data, to establish the identity of an individual; (B) includes-- (i) genetic information; (ii) imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted; (iii) keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information; and (iv) any mathematical code, profile, or algorithmic model derived from information regarding the physiological or biological characteristics of an individual; (C) does not include information captured from a patient in a health care setting for a medical purpose or information collected, used, or stored for health care treatment, payment, or operations under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191); and (D) does not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening. (7) Collect.--The term ``collect''-- (A) means buying, renting, gathering, obtaining, receiving, or accessing any personal data by any means; and (B) includes-- (i) receiving personal data from an individual or device; and (ii) creating, deriving, or inferring personal data by analyzing data about an individual or about groups of individuals similar to the individual. (8) Custodian.--The term ``custodian'' means the custodian or any deputy custodian designated by the Agency. (9) Data aggregator.--The term ``data aggregator''-- (A) means any person that collects, uses, or shares, in or affecting interstate commerce, an amount of personal data that is not de minimis, as well as entities related to that person by common ownership or corporate control; and (B) does not include an individual who collects, uses, or shares personal data solely for non-commercial reasons. (10) Device.--The term ``device'' means any physical object that-- (A) is capable of connecting to the internet or other communication network; or (B) has computer processing capabilities that can collect, send, receive, or store data. (11) Director.--The term ``Director'' means the Director of the Data Protection Agency. (12) Documentary material.--The term ``documentary material'' includes the original or any copy of any book, document, record, report, memorandum, paper, communication, tabulation, chart, logs, electronic files, or other data or data compilations stored in any medium. (13) Electronic data.--The term ``electronic data'' means any information that is in an electronic or digital format or any electronic or digital reference that contains information about an individual or device. (14) Federal privacy law.--The term ``Federal privacy law'' means the provisions of this Act, any other rule or order prescribed by the Agency under this Act, and the following laws (including any amendments made to such laws and regulations promulgated under such laws): (A) Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.). (B) The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.). (C) The Telemarketing and Consumer Fraud and Abuse Prevention Act (15 U.S.C. 6101 et seq.). (D) The Fair and Accurate Credit Transactions Act of 2003 (Public Law 108-159; 117 Stat. 1952). (E) The CAN-SPAM Act of 2003 (15 U.S.C. 7701 et seq.). (F) Sections 222, 227, 338(l), 631, and 705 of the Communications Act of 1934 (47 U.S.C. 222, 227, 338(l), 551, 705). (G) The Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.). (H) The Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.). (I) The Identity Theft Assumption and Deterrence Act of 1998 (Public Law 105-318; 117 Stat. 3007). (J) Sections 444 and 445 of the General Education Provisions Act (20 U.S.C. 1232g, 1232h). (K) Section 552a of title 5, United States Code (commonly known as the ``Privacy Act of 1974''). (L) The E-Government Act of 2002 (Public Law 107- 347; 116 Stat. 2899). (M) The Computer Security Act of 1987 (40 U.S.C. 1441 note). (N) The Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001 et seq.). (O) The Communications Assistance for Law Enforcement Act (Public Law 103-414; 108 Stat. 4279). (P) Sections 1028A, 1030, and 1801 and chapter 119, of title 18, United States Code. (Q) The Genetic Information Nondiscrimination Act of 2008 (Public Law 110-233; 122 Stat. 881). (R) The Taxpayer Browsing Protection Act (Public Law 105-35; 111 Stat. 1104). (S) The Privacy Protection Act of 1980 (42 U.S.C. 2000aa et seq.). (T) The Cable Communications Policy Act of 1984 (Public Law 98-549; 98 Stat. 2779). (U) The Do-Not-Call Implementation Act (Public Law 108-10; 117 Stat. 557). (V) The Wireless Communications and Public Safety Act of 1999 (Public Law 106-81; 113 Stat. 1286). (W) Title XXX of the Public Health Service Act (42 U.S.C. 300jj et seq.). (X) Regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d-2 note) as those regulations relate to a person described in section 1172(a) of the Social Security Act (42 U.S.C. 1320d-1(a)) and transactions referred to in section 1173(a)(1) of the Social Security Act (42 U.S.C. 1320d-2(a)(1)). (Y) Chapter 123 of title 18, United States Code. (Z) Section 2710 of title 18, United States Code. (AA) Chapters 61, 68, 75, and 76 of the Internal Revenue Code of 1986. (BB) Section 1106 of the Social Security Act (42 U.S.C. 1306). (CC) Chapter 121 of title 18, United States Code. (DD) Subpart A of part 46 of title 45, Code of Federal Regulations (commonly known as the ``Common Rule''). (15) Genetic information.--The term ``genetic information'' has the meaning given the term in section 201 of the Genetic Information Nondiscrimination Act of 2008 (42 U.S.C. 2000ff). (16) High-risk data practice.--The term ``high-risk data practice'' means an action by a data aggregator that involves-- (A) the use of an automated decision system; (B) the processing of data in a manner that involves an individual's protected class, familial status, lawful source of income, financial status such as the individual's income or assets, veteran status, criminal convictions or arrests, citizenship, past, present, or future physical or mental health or condition, psychological states, or any other factor used as a proxy for identifying any of these characteristics; (C) a systematic processing of publicly accessible data on a large scale; (D) processing involving the use of new technologies, or combinations of technologies, that causes or materially contributes to privacy harm; (E) decisions about an individual's access to a product, service, opportunity, or benefit which is based to any extent on automated decision system processing; (F) any profiling of individuals on a large scale; (G) any processing of biometric information for the purpose of uniquely identifying an individual, with the exception of one-to-one biometric authentication; (H) combining, comparing, or matching personal data obtained from multiple sources; (I) processing which involves an individual's precise geolocation; (J) the processing of personal data of children and teens under 17 or other vulnerable individuals such as the elderly, people with disabilities, and other groups known to be susceptible for exploitation for marketing purposes, profiling, or automated processing; (K) consumer scoring or other business practices that pertain to the eligibility of an individual, and related terms, rights, benefits, and privileges, for employment (including hiring, firing, promotion, demotion, and compensation), credit, insurance, housing, education, professional certification, or the provision of health care and related services; or (L) any other practice that has comparable legal, material, or similarly significant effect or harm on an individual's life, as determined by the Agency through rules promulgated pursuant to this Act. (17) High-risk data practice impact evaluation.--The term ``high-risk data practice impact evaluation'' means a study conducted after deployment of a high-risk data practice that includes, at a minimum-- (A) an evaluation of a high-risk data practice's accuracy, disparate impacts on the basis of protected class, and privacy harms; (B) an evaluation of the effectiveness of measures taken to minimize risks as outlined in any prior high- risk data practice risk assessments; and (C) recommended measures to further minimize risks to accuracy, disparate impacts on the basis of protected class, and privacy harms. (18) High-risk data practice risk assessment.--The term ``high-risk data practice risk assessment'' means a study evaluating a high-risk data practice and the high-risk data practice's development process, including the design and training data of the high-risk data practice, if applicable, for likelihood and severity of risks to accuracy, bias, discrimination, and privacy harms that includes, at a minimum-- (A) a detailed description of the high-risk data practice, including-- (i) its design and methodologies; (ii) any applicable training data characteristics; (iii) a data description of the categories of personal data collected or processed in connection with the high-risk data practice, the sources of such categories of person data, and the purpose; and (iv) the purpose, including what context the practice will be deployed and how individuals will interact with the system and what categories of data the data aggregator will create, infer, or generate about consumers as a result of the high-risk data practice; (B) an assessment of the relative benefits and costs of the high-risk data practice in light of its purpose, potential unintended consequences, and taking into account relevant factors, including-- (i) data minimization practices; (ii) the duration and methods for which personal data and the results of the high-risk data practice are stored; (iii) what information about the high-risk data practice is available to individuals; (iv) the extent to which individuals have access to the results of the high-risk data practice and may correct or object to its results; and (v) the recipients of the results of the high-risk data practice; (C) an assessment of the risks of privacy harm posed by the high-risk data practice and the risks that the high-risk data practice may result in or contribute to inaccurate, biased, or discriminatory decisions impacting individuals or groups of individuals; (D) the decision to accept, reject, or mitigate and minimize risks and the measures a data aggregator will employ including to minimize the risks described in subparagraph (C), including technological and physical safeguards; (E) an assessment of the environmental footprint on the development and use system in terms of carbon emissions and water use; and (F) any potential or permitted use of the outputs of the high-risk data for other decisions or purposes such as advertising targeting. (19) Individual.--The term ``individual'' means a natural person. (20) Person.--The term ``person'' means an individual, a local, State, or Federal governmental entity, a partnership, a company, a corporation, an association (incorporated or unincorporated), a trust, an estate, a cooperative organization, another entity, or any other organization or group of such entities acting in concert. (21) Personal data.--The term ``personal data'' means electronic data that, alone or in combination with other data-- (A) identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, household, or device; or (B) could be used to determine that an individual or household is part of a protected class. (22) Precise geolocation.--The term ``precise geolocation'' means any data that is derived from a device and that is used or intended to be used to locate an individual within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. (23) Privacy harm.--The term ``privacy harm'' means an adverse consequence, or a potential adverse consequence, to an individual, a group of individuals, or society caused, in whole or in part, by the collection, processing, or sharing of personal data, including-- (A) direct or indirect financial loss or economic harm, including financial loss or economic harm arising from fraudulent activities or data security breaches; (B) physical harm, harassment, or a threat to an individual or property; (C) psychological harm, including anxiety, embarrassment, fear, other trauma, stigmatization, reputational harm, or the revealing or exposing of an individual, or a characteristic of an individual, in an unexpected way; (D) an adverse outcome or decision, including relating to the eligibility of an individual for the rights, benefits, or privileges in credit and insurance (including the denial of an application or obtaining less favorable terms), housing, education, professional certification, employment (including hiring, firing, promotion, demotion, and compensation), or the provision of health care and related services; (E) discrimination, including both differential treatment on the basis of a protected class and disparate impact on a protected class; (F) the chilling of free expression or action of an individual, or society generally, due to perceived or actual pervasive and excessive collection, processing, or sharing of personal data; (G) the use of information technology to covertly influence an individual's decision-making, by targeting and exploiting decision-making vulnerabilities; and (H) any other adverse consequence, or potential adverse consequence, prohibited by or defined by Federal privacy laws; provisions of Federal civil rights laws related to the processing of personal information; provisions of Federal consumer protection laws related to the processing of personal information; the First Amendment; and other constitutional rights protecting privacy. (24) Process.--The term ``process'' means to perform an operation or set of operations on personal data, either manually or by automated means, including collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, sorting, classifying, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying. (25) Profile.--The term ``profile'' means the use of an automated decision system to process data (including personal data and other data) to derive, infer, predict or evaluate information about an individual or group, such as the processing of data to analyze or predict an individual's identity, attributes, interests or behavior. (26) Protected class.--The term ``protected class'' means the actual or perceived race, color, ethnicity, national origin, religion, sex, gender, gender identity or expression, sexual orientation, familial status, biometric information, genetic information, or disability of an individual or a group of individuals. (27) Service provider.--The term ``service provider'' means a data aggregator that collects, uses, or shares personal data only on behalf of another data aggregator in order to carry out a permissible purpose, and only to the extent of such activity. (28) Share.--The term ``share'' means disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, personal data.

TITLE I--DATA PROTECTION AUTHORITY

SEC. 101. ESTABLISHMENT; PURPOSE, OBJECTIVES, AND FUNCTIONS.

(a) Establishment.--There is established in the executive branch an independent agency to be known as the ``Data Protection Agency'', which shall implement and enforce this Act, including by regulating high-risk data practices and the collection, processing, and sharing of personal data. (b) Purpose, Objectives, and Functions.-- (1) Purpose.--The Agency shall seek to-- (A) protect individuals' privacy; (B) prevent and remediate privacy harms; (C) prevent, remediate, and reduce discrimination on the basis of protected class through the processing of personal information, including both differential treatment on the basis of a protected class and disparate impact on a protected class; and (D) limit the collection, processing, and sharing of personal data; and is authorized to exercise its authorities under this Act for such purposes. (2) Objectives.--The Agency is authorized to exercise its authorities under this Act to-- (A) protect individuals from violations of this Act, other Federal privacy laws, or rules and orders issued under this Act or other Federal privacy laws; (B) promote and affirmatively further equal opportunity in all aspects of economic life as it relates to the fair and non-discriminatory processing of personal information; (C) oversee the use of high-risk data practices; (D) promote the minimization of collection of personal data for commercial purposes; (E) prevent and remediate privacy harms; and (F) ensure that Federal privacy law is enforced consistently and in order to protect individuals' privacy. (3) Functions.--The primary functions of the Agency are-- (A) providing leadership and coordination to the efforts of all Federal departments and agencies to enforce all Federal statutes, Executive orders, regulations and policies which involve privacy or data protection; (B) maximizing effort, promoting efficiency, and eliminating conflict, competition, duplication, and inconsistency among the operations, functions, and jurisdictions of Federal departments and agencies responsible for privacy or data protection, and data protection rights and standards; (C) providing active leadership, guidance, education, and appropriate assistance to private sector businesses, organizations, groups, institutions, and individuals regarding privacy and data protection rights and standards; (D) requiring and overseeing ex-ante high-risk data practice risk assessments and ex-post high-risk data practice impact evaluations to advance fair and just data practices, including making the assessments available to the public as practical under the law; (E) protecting individuals and groups of individuals from privacy harms; (F) examining the social, ethical, economic, and civil rights impacts of data collection and processing practices and proposing remedies; (G) protecting civil rights, combating unlawful discrimination, and affirmatively furthering equal opportunity as they relate to the processing of personal information; (H) ensuring that high-risk data privacy practices are fair, just, non-deceptive, and do not discriminate against a protected class; (I) collecting, researching, and responding to complaints; (J) developing model privacy and data protection standards, guidelines, and policies for use by the private sector; and (K) enforcing other privacy statutes and rules as authorized by Congress.

SEC. 102. ADMINISTRATION.

(a) Executive and Administrative Powers.-- (1) Powers of the agency.--The Director is authorized to establish the general powers of the Agency with respect to all executive and administrative functions, including-- (A) the establishment of rules for conducting the general business of the Agency, in a manner not inconsistent with this Act; (B) to bind the Agency and enter into contracts; (C) directing the establishment and maintenance of divisions or other offices within the Agency, in order to carry out the responsibilities under this Act and Federal privacy law, and to satisfy the requirements of applicable law; (D) to coordinate and oversee the operation of all administrative, enforcement, and research activities of the Agency; (E) to adopt and use a seal; (F) to determine the character of and necessity for the obligations by the Agency; (G) the appointment and supervision of personnel employed by the Agency; (H) the distribution of business among personnel appointed and supervised by the Agency; (I) the use and expenditure of funds; (J) implementing this Act and Federal privacy laws through rules, orders, guidance, interpretations, statements of policy, examinations, and enforcement actions; and (K) performing such other functions as may be authorized or required by law. (2) Delegation of authority.--The Director may delegate to any duly authorized employee, representative, or agent any power vested in the Agency by law. (3) Office responsibilities.--Notwithstanding paragraphs (1) and (2), section 101(a), and any other provision of law, with respect to the specific functional units and offices described in subsection (b)(2), the Director-- (A) shall ensure that such functional units and offices perform the functions, duties, and coordination assigned to them under the applicable provision of subsection (b); and (B) may not reorganize or rename such units or offices in a manner not provided for under the applicable provisions of subsection (b). (b) Administration.-- (1) Personnel.-- (A) Director and deputy director.-- (i) In general.--There is established a position of the Director of the Data Protection Agency (referred to in this Act as the ``Director''), who shall serve as the head of the Agency. (ii) Appointment.--Subject to subparagraph (C), the Director shall be appointed by the President, by and with the advice and consent of the Senate. (iii) Qualification.--The President shall nominate the Director from among members of the public at large who are well qualified for service at the Agency based on their knowledge and expertise in-- (I) technology; (II) privacy and protection of personal data; (III) civil rights and liberties; (IV) law; and (V) social sciences. (iv) Compensation.-- (I) In general.--The Director shall be compensated at the rate prescribed for level II of the Executive Schedule under section 5313 of title 5, United States Code. (II) Conforming amendment.--Section 5313 of title 5, United States Code, is amended by inserting after the item relating to the Federal Transit Administrator, the following new item: ``Director of the Data Protection Agency.''. (v) Deputy director.--There is established the position of Deputy Director, who shall-- (I) be appointed by the Director; and (II) serve as the acting Director in the absence or unavailability of the Director. (vi) Acting director.--In the event of the death, resignation, sickness, or absence of the Director, the President shall designate the Deputy Director to serve as acting Director until the return of the Director, or the appointment of a successor pursuant to paragraph (2). (B) Term.-- (i) In general.--The Director shall serve for a term of 5 years. (ii) Expiration of term.--An individual may serve as Director after the expiration of the term for which appointed until a successor has been appointed and qualified. (iii) Removal.--The President may remove the Director at will. (iv) Vacancy.--A vacancy in the position of Director that occurs before the expiration of the term for which a Director was appointed shall be filled in the manner established under subparagraph (B), and the Director appointed to fill such vacancy shall be appointed only for the remainder of such term. (C) Service restriction.--No Director or Deputy Director may engage in any other employment during the period of service of such person as Director or Deputy Director. (D) Appointment.-- (i) In general.--The Director may fix the number of, and appoint and direct, all employees of the Agency, in accordance with the applicable provisions of title 5, United States Code. (ii) Employees of the agency.--The Director may employ attorneys, compliance examiners, compliance supervision analysts, economists, technologists, data scientists, designers, ethicists, privacy experts, statisticians, and other employees as may be deemed necessary to conduct the business of the Agency. Unless otherwise provided expressly by law, any individual appointed under this section shall be an employee, as defined in section 2105 of title 5, United States Code, and subject to the provisions of such title and other laws generally applicable to the employees of an executive agency. (iii) Waiver authority.-- (I) In general.--In making any appointment under subparagraph (A), the Director may waive the requirements of chapter 33 of title 5, United States Code, and the regulations implementing such chapter, to the extent necessary to appoint employees on terms and conditions that are consistent with those set forth in section 11(1) of the Federal Reserve Act (12 U.S.C. 248(1)), while providing for-- (aa) fair, credible, and transparent methods of establishing qualification requirements for, recruitment for, and appointments to positions; (bb) fair and open competition and equitable treatment in the consideration and selection of individuals to positions; and (cc) fair, credible, and transparent methods of assigning, reassigning, detailing, transferring, and promoting employees. (II) Veterans preferences.--In implementing this subparagraph, the Director shall comply with the provisions of section 2302(b)(11) of title 5, United States Code, regarding veterans' preference requirements, in a manner consistent with that in which such provisions are applied under chapter 33 of that title. The authority under this subparagraph to waive the requirements of that chapter 33 shall expire 5 years after the date of enactment of this Act. (iv) Duty to provide adequate staffing.-- The Director shall ensure that the specific functional units and offices established under paragraph (2), as well as other units and offices with supervisory, rulemaking, and enforcement duties, are provided with sufficient staff to carry out the functions, duties, and coordination of those units and offices. (v) Limitation on political appointees.-- (I) In general.--In appointing employees of the Agency who are political appointees, the Director shall ensure that the number and duties of such political appointees are as similar as possible to those of other Federal regulatory agencies. (II) Political appointees defined.--For purposes of this subparagraph, the term ``political appointee'' means an employee who holds-- (aa) a position which has been excepted from the competitive service by reason of its confidential, policy- determining, policymaking, or policy-advocating character; (bb) a position in the Senior Executive Service as a noncareer appointee (as such term is defined in section 3132(a) of title 5, United States Code); or (cc) a position under the Executive Schedule (subchapter II of chapter 53 of title 5, United States Code). (E) Compensation.--Notwithstanding any otherwise applicable provision of title 5, United States Code, concerning compensation, including the provisions of chapter 51 and chapter 53, the following provisions shall apply with respect to employees of the Agency: (i) The rates of basic pay for all employees of the Agency may be set and adjusted by the Director. (ii) The Director shall at all times provide compensation (including benefits) to each class of employees that, at a minimum, are comparable to the compensation and benefits then being provided by the Board of Governors of the Federal Reserve System or the Bureau of Consumer Financial Protection for the corresponding class of employees. (iii) All such employees shall be compensated (including benefits) on terms and conditions that are consistent with the terms and conditions set forth in section 11(l) of the Federal Reserve Act (12 U.S.C. 248(l)). (F) Labor-management relations.--Chapter 71 of title 5, United States Code, shall apply to the Agency and the employees of the Agency. (G) Applicability of other laws.--Except as otherwise provided expressly by law, all Federal laws dealing with public or Federal contracts, property, works, officers, employees, budgets, or funds, including the provisions of chapter 5 and 7 of title 5, United States Code, shall apply to the exercise of the powers of the Agency. (2) Specific functional units.-- (A) Office of civil rights.--The Director shall establish an office whose powers and duties shall include-- (i) providing oversight and enforcement of this Act, rules and orders promulgated under this Act, and Federal privacy laws to ensure that the collection, processing, and sharing of personal data is fair, equitable, and non- discriminatory in treatment and effect; (ii) developing, establishing, and promoting data processing practices that affirmatively further equal opportunity to and expand access to housing, employment, credit, insurance, education, healthcare, and other aspects of interstate commerce; (iii) coordinating the Agency's civil rights efforts with other Federal agencies and State regulators, as appropriate, to promote consistent, efficient, and effective enforcement of Federal civil rights laws; (iv) working with civil rights advocates, privacy organizations, and data aggregators on the promotion of compliance with the civil rights provisions under this Act, rules and orders promulgated under this Act, and Federal privacy laws; (v) liaising with communities and consumers impacted by practices regulated by this Act and the Agency, to ensure that their needs and views are appropriately taken into account; (vi) providing annual reports to Congress on the efforts of the Agency to fulfill its civil rights mandate; and (vii) such additional powers and duties as the Director may determine are appropriate. (B) Research.--The Director shall establish a unit whose functions shall include researching, analyzing, assessing, and reporting on-- (i) the collection and processing of personal data, including automated decision systems; (ii) the collection and processing of personal data by government agencies, including contracts between government agencies and data aggregators; and (iii) unfair, deceptive, or discriminatory outcomes that result or are likely to result from the use of automated decision systems, including disparate treatment or disparate impact on the basis of protected class or proxies for protected class. (C) Collecting and tracking complaints.-- (i) In general.-- (I) Establishment of unit.--The Director shall establish a unit, the functions of which shall include identifying and facilitating the development of best practices for consumers to file a complaint, and establishing a single toll-free telephone number, a publicly available website, and a publicly available database, or utilizing an existing publicly available database, to facilitate the centralized collection of, monitoring of, and response to complaints regarding the collection, processing, and sharing of personal data. (II) Website requirements.--The Director shall ensure that-- (aa) the landing page of the main website of the Agency contains a clear and conspicuous hyperlink to the complaint database described in clause (i) and shall ensure that such database is user- friendly and in plain writing, as that term is defined in section 3 of the Plain Writing Act of 2010 (5 U.S.C. 301 note); and (bb) that all information on the website or the database that explains how a complaint with the Agency, as well as reports of the Agency with respect to information contained in that database, shall be provided in each of the 5 most commonly spoken languages, other than English, in the United States, as determined by the Bureau of the Census on an ongoing basis, and in formats accessible to individuals with hearing or vision impairments. (ii) Public availability of information.-- (I) In general.--The Director shall-- (aa) make all complaints available to the public on a website of the Agency; (bb) place a clear and conspicuous hyperlink on the landing page of the main website of the Agency to the website described under subclause (I); and (cc) ensure that such website--

(AA) is searchable and sortable by an data aggregator; and

(BB) is user- friendly and written in plain language.

(II) Removal of personal data.--In making the information described under clause (i) available to the public, the Director shall remove all personal data. (3) Agency ombudsman.-- (A) Establishment required.--The Director shall appoint an ombudsman. (B) Duties of ombudsman.--The ombudsman appointed in accordance with paragraph (1) shall-- (i) act as a liaison between the Agency and any affected person with respect to any problem that such person may have in dealing with the Agency, resulting from the regulatory activities of the Agency; and (ii) assure that safeguards exist to encourage complainants to come forward and preserve confidentiality. (4) Autonomy of agency.--No officer or agency of the United States shall have any authority to require the Director or any other officer of the Agency to submit legislative recommendations, or testimony or comments on legislation, to any officer or agency of the United States for approval, comments, or review prior to the submission of such recommendations, testimony, or comments to the Congress, if such recommendations, testimony, or comments to the Congress include a statement indicating that the views expressed therein are those of the Director or such officer, and do not necessarily reflect the views of the President. (c) Appearances Before and Reports to Congress.-- (1) Appearances before congress.--The Director of the Agency shall appear before Congress at semi-annual hearings regarding the reports required under subsection (b). (2) Reports required.--The Agency shall, concurrent with each semi-annual hearing referred to in subsection (a), prepare and submit to the President and Congress, a report, beginning with the session following the designated transfer date, and shall publish such report on the website of the Agency. (3) Contents.--The reports required by subsection (b) shall include-- (A) a discussion of the significant problems faced by persons in exercising their rights under this Act and Federal privacy laws; (B) a justification of the budget request of the previous year; (C) a list of the significant rules and orders adopted by the Agency, as well as other significant initiatives conducted by the Agency, during the preceding year and the plan of the Agency for rules, orders, or other initiatives to be undertaken during the upcoming period; (D) an analysis of complaints about practices relating to the collection, processing, or sharing of personal data that the Agency has received and collected in its central database on complaints during the preceding year; (E) a list, with a brief statement of the issues, of the public supervisory and enforcement actions to which the Agency was a party during the preceding year; (F) the actions taken regarding rules, orders, and supervisory actions with respect to data aggregators; (G) an assessment of significant actions by State attorneys general or State regulators relating to this Act or other Federal privacy laws; (H) an analysis of the efforts of the Agency to fulfill the civil rights mandate of the Agency; and (I) an analysis of the efforts of the Agency to increase workforce and contracting diversity. (d) Inspector General.--Section 401 of title 5, United States Code, is amended-- (1) in paragraph (1), by inserting ``the Data Protection Agency,'' after ``Export-Import Bank of the United States,''; and (2) in paragraph (3), by inserting ``the Director of the Data Protection Agency;'' after ``Export-Import Bank of the United States;''. (e) Offices.--The principal office of the Agency shall be in the District of Columbia. The Director may establish regional offices of the Agency.

SEC. 103. IMPLEMENTATION AND ENFORCEMENT.

(a) Rulemaking Authority.-- (1) In general.--The Agency is authorized to exercise its authorities under this Act to administer, enforce, and otherwise implement the provisions of this Act and Federal privacy law. (2) Rulemaking, orders, and guidance.-- (A) General authority.--The Director may prescribe rules and issue orders and guidance, as may be necessary or appropriate to enable the Agency to administer and carry out the purposes and objectives of this Act and other Federal privacy laws, and to prevent evasions of this Act and other Federal privacy laws. (B) No limitation.--Rules prescribed under this section shall not limit the authority of the Agency to administer, enforce, and otherwise implement the provisions of this Act and Federal privacy law. (C) Standards for rulemaking.--In prescribing a rule under this Act or Federal privacy laws-- (i) the Agency shall consider the impact of proposed rules on an individual or groups of individuals; (ii) the Agency may provide that a rule shall only apply to a subcategory of data aggregators, as defined by the Agency; and (iii) the Agency shall consult with civil society groups and members of the public. (D) Rule of construction.--Nothing in this paragraph may be construed to require the Agency to engage in cost-benefit analysis or submit a rulemaking for review to the President or the Office of Management and Budget. (E) Standard for review.--If this Act is silent or ambiguous, and the Agency has followed the procedures in section 553 or 554 of title 5, United States Code, as applicable, a reviewing court shall defer to the Agency's reasonable or permissible interpretation of this Act. (3) Monitoring.--In order to support its rulemaking and other functions, the Agency shall monitor for risks to individuals or groups of individuals in the collection, processing, or sharing of personal data. (b) Enforcement Powers.-- (1) Definitions.--In this section, the term ``violation'' means any act or omission that, if proved, would constitute a violation of any provision of this Act or any other Federal privacy law. (2) Investigations and administrative discovery.-- (A) Joint investigations.-- (i) In general.--The Agency or, where appropriate, an Agency investigator, may engage in joint investigations and requests for information, as authorized under this Act. (ii) Civil rights.--The authority under subparagraph (A) includes matters relating to protection of individuals' civil rights under this Act and joint investigations with, and requests for information from, the Director of the Bureau of Consumer Financial Protection, the Federal Trade Commission, the Secretary of Housing and Urban Development, the Department of Education, the Equal Employment Opportunity Commission, the Department of Health and Human Services, or the Attorney General. (B) Subpoenas.-- (i) In general.--The Agency or an Agency investigator may issue subpoenas for the attendance and testimony of witnesses and the production of relevant papers, books, documents, or other material in connection with hearings under this Act. (ii) Failure to obey.--In the case of contumacy or refusal to obey a subpoena issued pursuant to this subparagraph and served upon any person, the district court of the United States for any district in which such person is found, resides, or transacts business, upon application by the Agency or an Agency investigator and after notice to such person, may issue an order requiring such person to appear and give testimony or to appear and produce documents or other material. (iii) Contempt.--Any failure to obey an order of the court under this subparagraph may be punished by the court as a contempt thereof. (C) Demands.-- (i) In general.--Whenever the Agency has reason to believe that any person may be in possession, custody, or control of any documentary material or tangible things, or may have any information, relevant to a violation, the Agency may, before the institution of any proceedings under this Act, issue in writing, and cause to be served upon such person, a civil investigative demand requiring such person to-- (I) produce such documentary material for inspection and copying or reproduction in the form or medium requested by the Agency; (II) submit such tangible things; (III) file written reports or answers to questions; (IV) give oral testimony concerning documentary material, tangible things, or other information; or (V) furnish any combination of such material, answers, or testimony. (ii) Requirements.--Each civil investigative demand shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation. (iii) Production of documents.--Each civil investigative demand for the production of documentary material shall-- (I) describe each class of documentary material to be produced under the demand with such definiteness and certainty as to permit such material to be fairly identified; (II) prescribe a return date or dates which will provide a reasonable period of time within which the material so demanded may be assembled and made available for inspection and copying or reproduction; and (III) identify the custodian to whom such material shall be made available. (iv) Production of things.--Each civil investigative demand for the submission of tangible things shall-- (I) describe each class of tangible things to be submitted under the demand with such definiteness and certainty as to permit such things to be fairly identified; (II) prescribe a return date or dates which will provide a reasonable period of time within which the things so demanded may be assembled and submitted; and (III) identify the custodian to whom such things shall be submitted. (v) Demand for written reports or answers.--Each civil investigative demand for written reports or answers to questions shall-- (I) propound with definiteness and certainty the reports to be produced or the questions to be answered; (II) prescribe a date or dates at which time written reports or answers to questions shall be submitted; and (III) identify the custodian to whom such reports or answers shall be submitted. (vi) Oral testimony.--Each civil investigative demand for the giving of oral testimony shall-- (I) prescribe a date, time, and place at which oral testimony shall be commenced; and (II) identify an Agency investigator who shall conduct the investigation and the custodian to whom the transcript of such investigation shall be submitted. (vii) Service.--Any civil investigative demand issued, and any enforcement petition filed, under this paragraph may be served-- (I) by any Agency investigator at any place within the territorial jurisdiction of any court of the United States; and (II) upon any person who is not found within the territorial jurisdiction of any court of the United States-- (aa) in such manner as the Federal Rules of Civil Procedure prescribe for service in a foreign nation; and (bb) to the extent that the courts of the United States have authority to assert jurisdiction over such person, consistent with due process, the United States District Court for the District of Columbia shall have the same jurisdiction to take any action respecting compliance with this section by such person that such district court would have if such person were personally within the jurisdiction of such district court. (viii) Method of service.--Service of any civil investigative demand or any enforcement petition filed under this paragraph may be made upon a person, including any legal entity, by-- (I) delivering a duly executed copy of such demand or petition to the individual or to any partner, executive officer, managing agent, or general agent of such person, or to any agent of such person authorized by appointment or by law to receive service of process on behalf of such person; (II) delivering a duly executed copy of such demand or petition to the principal office or place of business of the person to be served; or (III) depositing a duly executed copy in the United States mails, by registered or certified mail, return receipt requested, duly addressed to such person at the principal office or place of business of such person. (ix) Proof of service.-- (I) In general.--A verified return by the individual serving any civil investigative demand or any enforcement petition filed under this paragraph setting forth the manner of such service shall be proof of such service. (II) Return receipts.--In the case of service by registered or certified mail, such return shall be accompanied by the return post office receipt of delivery of such demand or enforcement petition. (x) Production of documentary material.-- The production of documentary material in response to a civil investigative demand shall be made under a sworn certificate, in such form as the demand designates, by the person, if a natural person, to whom the demand is directed or, if not a natural person, by any person having knowledge of the facts and circumstances relating to such production, to the effect that all of the documentary material required by the demand and in the possession, custody, or control of the person to whom the demand is directed has been produced and made available to the custodian. (xi) Submission of tangible things.--The submission of tangible things in response to a civil investigative demand shall be made under a sworn certificate, in such form as the demand designates, by the person to whom the demand is directed or, if not a natural person, by any person having knowledge of the facts and circumstances relating to such production, to the effect that all of the tangible things required by the demand and in the possession, custody, or control of the person to whom the demand is directed have been submitted to the custodian. (xii) Separate answers.--Each reporting requirement or question in a civil investigative demand shall be answered separately and fully in writing under oath, unless it is objected to, in which event the reasons for the objection shall be stated in lieu of an answer, and it shall be submitted under a sworn certificate, in such form as the demand designates, by the person, if a natural person, to whom the demand is directed or, if not a natural person, by any person responsible for answering each reporting requirement or question, to the effect that all information required by the demand and in the possession, custody, control, or knowledge of the person to whom the demand is directed has been submitted. (xiii) Testimony.-- (I) In general.-- (aa) Oath and recordation.--The examination of any person pursuant to a demand for oral testimony served under this paragraph shall be taken before an officer authorized to administer oaths and affirmations by the laws of the United States or of the place at which the examination is held. The officer before whom oral testimony is to be taken shall put the witness on oath or affirmation and shall personally, or by any individual acting under the direction of and in the presence of the officer, record the testimony of the witness. (bb) Transcription.--The testimony shall be taken stenographically and transcribed. (cc) Transmission to custodian.--After the testimony is fully transcribed, the officer investigator before whom the testimony is taken shall promptly transmit a copy of the transcript of the testimony to the custodian. (II) Parties present.--Any Agency investigator before whom oral testimony is to be taken shall exclude from the place where the testimony is to be taken all other persons, except the person giving the testimony, the attorney for that person, the officer before whom the testimony is to be taken, an investigator or representative of an agency with which the Agency is engaged in a joint investigation, and any stenographer taking such testimony. (III) Location.--The oral testimony of any person taken pursuant to a civil investigative demand shall be taken in the judicial district of the United States in which such person resides, is found, or transacts business, or in such other place as may be agreed upon by the Agency investigator before whom the oral testimony of such person is to be taken and such person. (IV) Attorney representation.-- (aa) In general.--Any person compelled to appear under a civil investigative demand for oral testimony pursuant to this section may be accompanied, represented, and advised by an attorney. (bb) Authority.--The attorney may advise a person described in subclause (I), in confidence, either upon the request of such person or upon the initiative of the attorney, with respect to any question asked of such person. (cc) Objections.--A person described in subclause (I), or the attorney for that person, may object on the record to any question, in whole or in part, and such person shall briefly state for the record the reason for the objection. An objection may properly be made, received, and entered upon the record when it is claimed that such person is entitled to refuse to answer the question on grounds of any constitutional or other legal right or privilege, including the privilege against self-incrimination, but such person shall not otherwise object to or refuse to answer any question, and such person or attorney shall not otherwise interrupt the oral examination. (dd) Refusal to answer.--If a person described in subclause (I) refuses to answer any question--

(AA) the Agency may petition the district court of the United States pursuant to this section for an order compelling such person to answer such question; and

(BB) if the refusal is on grounds of the privilege against self- incrimination, the testimony of such person may be compelled in accordance with the provisions of section 6004 of title 18, United States Code.

(V) Transcripts.--For purposes of this paragraph-- (aa) after the testimony of any witness is fully transcribed, the Agency investigator shall afford the witness (who may be accompanied by an attorney) a reasonable opportunity to examine the transcript; (bb) the transcript shall be read to or by the witness, unless such examination and reading are waived by the witness; (cc) any changes in form or substance which the witness desires to make shall be entered and identified upon the transcript by the Agency investigator, with a statement of the reasons given by the witness for making such changes; (dd) the transcript shall be signed by the witness, unless the witness in writing waives the signing, is ill, cannot be found, or refuses to sign; and (ee) if the transcript is not signed by the witness during the 30-day period following the date on which the witness is first afforded a reasonable opportunity to examine the transcript, the Agency investigator shall sign the transcript and state on the record the fact of the waiver, illness, absence of the witness, or the refusal to sign, together with any reasons given for the failure to sign. (VI) Certification by investigator.--The Agency investigator shall certify on the transcript that the witness was duly sworn by him or her and that the transcript is a true record of the testimony given by the witness, and the Agency investigator shall promptly deliver the transcript or send it by registered or certified mail to the custodian. (VII) Copy of transcript.--The Agency investigator shall furnish a copy of the transcript (upon payment of reasonable charges for the transcript) to the witness only, except that the Agency may for good cause limit such witness to inspection of the official transcript of his testimony. (VIII) Witness fees.--Any witness appearing for the taking of oral testimony pursuant to a civil investigative demand shall be entitled to the same fees and mileage which are paid to witnesses in the district courts of the United States. (D) Confidential treatment of demand material.-- (i) In general.--Documentary materials and tangible things received as a result of a civil investigative demand shall be subject to requirements and procedures regarding confidentiality, in accordance with rules established by the Agency. (ii) Disclosure to congress.--No rule established by the Agency regarding the confidentiality of materials submitted to, or otherwise obtained by, the Agency shall be intended to prevent disclosure to either House of Congress or to an appropriate committee of the Congress, except that the Agency is permitted to adopt rules allowing prior notice to any party that owns or otherwise provided the material to the Agency and had designated such material as confidential. (E) Petition for enforcement.-- (i) In general.--Whenever any person fails to comply with any civil investigative demand duly served upon such person under this section, or whenever satisfactory copying or reproduction of material requested pursuant to the demand cannot be accomplished and such person refuses to surrender such material, the Agency, through such officers or attorneys as it may designate, may file, in the district court of the United States for any judicial district in which such person resides, is found, or transacts business, and serve upon such person, a petition for an order of such court for the enforcement of this paragraph. (ii) Service of process.--All process of any court to which application may be made as provided in this subparagraph may be served in any judicial district. (F) Petition for order modifying or setting aside demand.-- (i) In general.--Not later than 20 days after the service of any civil investigative demand upon any person under subparagraph (B), or at any time before the return date specified in the demand, whichever period is shorter, or within such period exceeding 20 days after service or in excess of such return date as may be prescribed in writing, subsequent to service, by any Agency investigator named in the demand, such person may file with the Agency a petition for an order by the Agency modifying or setting aside the demand. (ii) Compliance during pendency.--The time permitted for compliance with the demand in whole or in part, as determined proper and ordered by the Agency, shall not run during the pendency of a petition under clause (i) at the Agency, except that such person shall comply with any portions of the demand not sought to be modified or set aside. (iii) Specific grounds.--A petition under subparagraph (A) shall specify each ground upon which the petitioner relies in seeking relief, and may be based upon any failure of the demand to comply with the provisions of this section, or upon any constitutional or other legal right or privilege of such person. (G) Custodial control.--At any time during which any custodian is in custody or control of any documentary material, tangible things, reports, answers to questions, or transcripts of oral testimony given by any person in compliance with any civil investigative demand, such person may file, in the district court of the United States for the judicial district within which the office of such custodian is situated, and serve upon such custodian, a petition for an order of such court requiring the performance by such custodian of any duty imposed upon him by this section or rule promulgated by the Agency. (H) Jurisdiction of court.-- (i) In general.--Whenever any petition is filed in any district court of the United States under this paragraph, such court shall have jurisdiction to hear and determine the matter so presented, and to enter such order or orders as may be required to carry out the provisions of this section. (ii) Appeal.--Any final order entered as described in subparagraph (A) shall be subject to appeal pursuant to section 1291 of title 28, United States Code. (3) Hearings and adjudicatory proceedings.-- (A) In general.--The Agency is authorized to conduct hearings and adjudication proceedings with respect to any person in the manner prescribed by chapter 5 of title 5, United States Code, in order to ensure or enforce compliance with-- (i) the provisions of this Act and other Federal privacy laws, including any rules prescribed by the Agency under this Act and other Federal privacy laws; and (ii) any other Federal privacy law that the Agency is authorized to enforce, and any rules or order prescribed thereunder, unless such Federal privacy law specifically limits the Agency from conducting a hearing or adjudication proceeding and only to the extent of such limitation. (B) Special rules for cease-and-desist proceedings.-- (i) Orders authorized.-- (I) In general.--If, in the opinion of the Agency, any data aggregator is engaging or has engaged in an activity that violates a law, rule, or any condition imposed in writing on the person by the Agency, the Agency may issue and serve upon the data aggregator or service provider a notice of charges in respect thereof. (II) Content of notice.--The notice under clause (i) shall contain a statement of the facts constituting the alleged violation or violations, and shall fix a time and place at which a hearing will be held to determine whether an order to cease and desist should i

[Text truncated — read full bill via the link above.]