Sec. 108. Scope of coverage
484 words·~2 min read·
/bill/116/s/4626/is/section-108A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Notwithstanding any provision of this title other than subsections
(a)through
(c)of section 102, a covered entity may collect, process or transfer covered data for any of the following purposes, provided that the collection, processing, or transfer is reasonably necessary, proportionate, and limited to such purpose: To initiate or complete a transaction or to fulfill an order or provide a service specifically requested by an individual, including associated routine administrative activities such as billing, shipping, financial reporting, and accounting. To perform internal system maintenance, diagnostics, product or service management, inventory management, and network management. To prevent, detect, or respond to a security incident or trespassing, provide a secure environment, or maintain the safety and security of a product, service, or individual. To protect against malicious, deceptive, fraudulent, or illegal activity. To comply with a legal obligation or the establishment, exercise, analysis, or defense of legal claims or rights, or as required or specifically authorized by law. To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by an Executive agency. To cooperate with an Executive agency or a law enforcement official acting under the authority of an Executive or State agency concerning conduct or activity that the Executive agency or law enforcement official reasonably and in good faith believes may violate Federal, State, or local law, or pose a threat to public safety or national security. To address risks to the safety of an individual or group of individuals, or to ensure customer safety, including by authenticating individuals in order to provide access to large venues open to the public. To effectuate a product recall pursuant to Federal or State law. To conduct public or peer-reviewed scientific, historical, or statistical research that— is in the public interest; adheres to all applicable ethics and privacy laws; and is approved, monitored, and governed by an institutional review board or other oversight entity that meets standards promulgated by the Commission pursuant to section 553 of title 5, United States Code. To transfer covered data to a service provider. For a purpose identified by the Commission pursuant to a regulation promulgated under subsection (b). The Commission may promulgate regulations under section 553 of title 5, United States Code, identifying additional purposes for which a covered entity may collect, process or transfer covered data. Sections 103, 105, and 301 shall not apply in the case of a covered entity that can establish that, for the 3 preceding calendar years (or for the period during which the covered entity has been in existence if such period is less than 3 years)— the covered entity's average annual gross revenues did not exceed $50,000,000; on average, the covered entity annually processed the covered data of less than 1,000,000 individuals; the covered entity never employed more than 500 individuals at any one time; and the covered entity derived less than 50 percent of its revenues from transferring covered data.