Sec. 206. Third-party collecting entities
566 words·~3 min read·
/bill/117/hr/8152/ih/section-206·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Each third-party collecting entity shall place a clear and conspicuous notice on the website or mobile application of the third-party collecting entity (if the third-party collecting entity maintains such a website or mobile application) that— notifies individuals that the entity is a third-party collecting entity using specific language that the Commission shall develop through rulemaking under section 553 of title 5, United States Code; and includes a link to the website established under subsection (b)(3).
Not later than January 31 of each calendar year that follows a calendar year during which a covered entity acted as a third-party collecting entity and processed covered data pertaining to more than 5,000 individuals or devices that identify or are linked or reasonably linkable to an individual, such covered entity shall register with the Commission in accordance with this subsection. In registering with the Commission as required under paragraph (1), a third-party collecting entity shall do the following:
Pay to the Commission a registration fee of $100. Provide the Commission with the following information: The legal name and primary physical, email, and internet addresses of the third-party collecting entity. A description of the categories of data the third-party collecting entity processes and transfers. The contact information of the third-party collecting entity, including a contact person, telephone number, an e-mail address, a website, and a physical mailing address. Link to a website through which an individual may easily exercise the rights provided under this subsection.
The Commission shall establish and maintain on a website a searchable, publicly available, central registry of third-party collecting entities that are registered with the Commission under this subsection that includes the following: A listing of all registered third-party collecting entities and a search feature that allows members of the public to identify individual third-party collecting entities. For each registered third-party collecting entity, the information described in paragraph (2).
A Do Not Collect registry link and mechanism by which an individual may, after the Commission has verified the identity of the individual or individual’s parent or guardian, which may include tokenization, easily submit a request to all registered third-party collecting entities that are not consumer reporting agencies, and to the extent they are not acting as consumer reporting agencies, as defined in section 603(f) of the Fair Credit Reporting Act ( 15 U.S.C. 1681a(f) ) to— delete all covered data related to such individual that the third-party collecting entity did not collect from the individual directly or when acting as a service provider; and ensure that any third-party collecting entity no longer collects covered data related to such individual without the affirmative express consent of such individual, except insofar as such covered entity is acting as a service provider.
Each third-party collecting entity that receives such a request from an individual shall delete all the covered data of the individual not later than 30 days after the request is received by the third-party collecting entity. A third-party collecting entity that fails to register or provide the notice as required under this section shall be liable for— a civil penalty of $50 for each day it fails to register or provide notice as required under this subsection, not to exceed a total of $10,000 for any year; and an amount equal to the registration fees due under paragraph
(2)of subsection
(b)for each year that it failed to register as required under paragraph
(1)of such subsection.
Connectionstraces to 1
Traces to 1 document
Citation graph
cites case law
Sec. 206
Third-party collecting entities
Cites 1Cited by 0 across 0 sources