Sec. 3. Definitions

979 words·~4 min read·/bill/116/s/3300/is/section-3

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

In this Act: The term Agency means the Data Protection Agency established under section 4. The term covered entity means any person that collects, processes, or otherwise obtains personal data with the exception of an individual processing personal data in the course of personal or household activity. The term Federal privacy law means the provisions of this Act, the laws specified in subparagraph (B), and any rule or order prescribed by the Agency under this Act or pursuant to the authorities transferred under this Act.

Such term shall not include the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.). The laws specified in this subparagraph are the following laws (including any amendments made by such laws): The Children’s Online Privacy Protection Act ( 15 U.S.C. 6501 et seq.). The CAN–SPAM Act of 2003 (15 U.S.C 7701 et seq.). The Do-Not-Call Implementation Act ( 15 U.S.C. 6152 et seq.) and Public Law 108–82 ( 15 U.S.C. 6151 ). The Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.). Title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq.).

Subtitle D of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17921 et seq.). The Identity Theft Assumption and Deterrence Act of 1998 (Pub. L. 105–318). The Telemarketing and Consumer Fraud and Abuse Prevention Act ( 15 U.S.C. 6101 et seq.). Section 227 of the Communications Act of 1934 ( 47 U.S.C. 227 ) (commonly known as the Telephone Consumer Protection Act of 1991 ). The term high-risk data practice means an action by a covered entity that involves— a systematic or extensive evaluation of personal data that is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the individual or household or similarly significantly affect the individual or household; sensitive data uses; a systemic monitoring of publicly accessible data on a large scale; processing involving the use of new technologies, or combinations of technologies, that creates adverse consequences or potential adverse consequences to an individual or society; decisions about an individual’s access to a product, service, opportunity, or benefit which is based to any extent on automated processing; any profiling of individuals on a large scale; any processing of biometric data for the purpose of uniquely identifying an individual; any processing of genetic data, other than data processed by a health care professional for the purpose of providing health care to the individual; combining, comparing, or matching personal data obtained from multiple sources; processing the personal data of an individual that has not been obtained directly from the individual; processing which involves tracking an individual’s geolocation; or the use of personal data of children or other vulnerable individuals for marketing purposes, profiling, or automated processing.

The term personal data means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or device, including— an identifier such as a real name, alias, signature, date of birth, gender identity, sexual orientation, marital status, physical characteristic or description, postal address, telephone number, unique personal identifier, military identification number, online identifier, Internet Protocol address, email address, account name, mother’s maiden name, social security number, driver’s license number, passport number, or other similar identifiers; information such as employment status, employment history, or other professional or employment-related information; bank account number, credit card number, debit card number, insurance policy number, or any other financial information; medical information, mental health information, or health insurance information; commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies; characteristics of protected classes under Federal law, including race, color, national origin, religion, sex, age, or disability; biometric information; internet or other electronic network activity information, including browsing history, search history, content, and information regarding an individual’s interaction with an internet website, mobile application, or advertisement; historical or real-time geolocation data; audio, electronic, visual, thermal, olfactory, or similar information; education records; political information; password-protected digital photographs and digital videos not otherwise available to the public; information on criminal convictions or arrests; information (such as an Internet Protocol address or other similar identifier) that allows an individual or device to be singled out for interaction, even without identification of such individual or device; and inferences drawn from any of the information identified in this subparagraph to create a profile about an individual reflecting the individual’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

The term process means to perform an operation or set of operations on personal data, either manually or by automated means, including but not limited to collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, sorting, classifying, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying. The term profile means the use of an automated means to process data (including personal data and other data) to derive, infer, predict, or evaluate information about an individual or group, such as the processing of data to analyze or predict an individual’s identity, attributes, interests, or behavior.

The term sensitive data use means— the processing of data in a manner that reveals an individual's race, color, ethnicity, religion or creed, national origin or ancestry, sex, gender, gender identity, sexuality, sexual orientation, political beliefs, trade union membership, familial status, lawful source of income, financial status (such as the individual's income or assets), veteran status, criminal convictions or arrests, citizenship, past, present, or future physical or mental health or condition, psychological states, disability, geospatial data, or any other factor used as a proxy for identifying any of these characteristics; or the use of the biometric or genetic data of an individual.

The term transfer date means the date that is 1 year after the date of enactment of this Act.

Connectionstraces to 10

Traces to 10 documents

U.S. Code