Sec. 11. Supervision of data aggregators
237 words·~1 min read·
/bill/117/s/2134/is/section-11·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A large data aggregator is a data aggregator that satisfies one or more of the following thresholds: The data aggregator has annual gross revenues that exceed $25,000,000. The data aggregator annually collects, uses, or shares, alone or in combination, the personal data of 50,000 or more individuals, households, or devices. The Agency may require reports and conduct examinations on a periodic basis of large data aggregators described in subsection
(a)for purposes of— assessing compliance with the requirements of this Act, rules and orders issued by the Agency, or other Federal privacy laws; obtaining information about the activities subject to such laws and the associated compliance systems or procedures of such entities; detecting and assessing associated risks to individuals and groups of individuals; and requiring and overseeing high-risk data practice risk impact assessments and high-risk data practice impact evaluations to advance fair and just data practices. The Agency shall maintain a publicly accessible list of data aggregators that collect, process, or share personal data of more than 10,000 persons or households, and the permissible purposes for which the data aggregators purport to collect personal data. The Agency shall conduct a review and submit to the Federal Trade Commission and Department of Justice a report on the privacy and data protection implications of— any merger involving a data aggregator described in subsection (a); or any merger that proposes the transfer of personal data of 50,000 or more individuals.