Sec. 10. Rulemaking authority
506 words·~2 min read·
/bill/117/s/2134/is/section-10·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Agency is authorized to exercise its authorities under this Act to administer, enforce, and otherwise implement the provisions of this Act and Federal privacy law. The Director may prescribe rules and issue orders and guidance, as may be necessary or appropriate to enable the Agency to administer and carry out the purposes and objectives of this Act and other Federal privacy laws, and to prevent evasions of this Act and other Federal privacy laws. The Agency shall issue such regulations, after notice and comment in accordance with section 553 of title 5, United States Code, as may be necessary to carry out this Act.
The Agency shall prescribe rules applicable to a data aggregator or service provider identifying— high-risk data practices in connection with the collection, processing, or sharing of personal data, which may include requirements for the purpose of auditing, preventing, or restricting such acts or practices; acts or practices in connection with the collection, processing, or sharing of personal data that causes or are likely to cause privacy harm to individuals or groups of individuals, which may include requirements for the purpose of preventing or restricting such acts or practices; unlawful, unfair, deceptive, abusive, or discriminatory acts or practices in connection with the collection, processing, or sharing of personal data, which may include requirements for the purpose of preventing or restricting such acts or practices, for the purpose of preventing disparate impacts on the basis of protected class, or for the purpose of affirmatively furthering equal opportunity; rights that data aggregators must provide to individuals, including the right to access and correct, limit the processing of, and request deletion of the individual’s personal data; and obligations on data aggregators, including transparency about business practices, data collection limitations, processing and disclosure limitations, purpose specification and legal basis for processing requirements, accountability requirements, confidentiality and security requirements, and data accuracy requirements.
Rules prescribed under this section shall not limit the authority of the Agency to administer, enforce, and otherwise implement the provisions of this Act and Federal privacy law. In prescribing a rule under this Act or Federal privacy laws— the Agency shall consider the impact of proposed rules on an individual or groups of individuals; the Agency may provide that a rule shall only apply to a subcategory of data aggregators, as defined by the Agency; and the Agency shall consult with civil society groups and members of the public.
Nothing in this paragraph may be construed to require the Agency to engage in cost-benefit analysis or submit a rulemaking for review to the President or the Office of Management and Budget. If this Act is silent or ambiguous, and the Agency has followed the procedures in section 553 or 554 of title 5, United States Code, as applicable, a reviewing court shall defer to the Agency’s reasonable or permissible interpretation of this Act. In order to support its rulemaking and other functions, the Agency shall monitor for risks to individuals or groups of individuals in the collection, processing, or sharing of personal data.