Sec. 5. Individual control over data use
326 words·~1 min read·
/bill/116/hr/8749/ih/section-5A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to require covered entities to provide conspicuous, understandable, clear, and free of charge method to— upon the request of an individual, provide the individual with access to, or an accurate representation of, covered data linked to the individual or the individual’s device stored by the covered entity; upon the request of an individual, provide the individual with a means to dispute and resolve the accuracy or completeness of the covered data linked to the individual or the individual’s device stored by the entity; upon the request of an individual, delete any covered data that the covered entity stores linked to the individual or the individual’s device; and when technically feasible, upon the request of an individual, allow the individual to transmit or transfer covered data linked to the individual or the individual’s device that is maintained by the entity to the individual in a format that is standardized and interoperable.
If the covered data that an individual has requested processed under subsection
(a)is pseudonymous data, a covered entity may decline the request if processing the request is not technically feasible. In fulfilling any requests made by the individual under subsection
(a)the covered entity shall act in as timely a manner as is reasonably possible. A covered entity shall not discriminate against an individual because of any action the individual took under their rights described in subsection (a), including— denying goods or services to the individual; charging, or advertising, different prices or rates for goods or services; or providing different quality of goods or services. The Commission shall allow a covered entity, by contract, to provide relevant obligations to the individual under subsection
(a)on behalf of a third party service provider that collects, processes, stores, or discloses covered data only on behalf of the covered entity.