Sec. 13. Enforcement powers
5,669 words·~26 min read·
/bill/117/s/2134/is/section-13·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
For purposes of this section, the following definitions shall apply: The term Agency investigation means any inquiry conducted by an Agency investigator for the purpose of ascertaining whether any person is or has been engaged in any conduct that is a violation, as defined in this section. The term Agency investigator means any attorney or investigator employed by the Agency who is charged with the duty of enforcing or carrying into effect this Act any other Federal privacy law.
The term custodian means the custodian or any deputy custodian designated by the Agency. The term documentary material includes the original or any copy of any book, document, record, report, memorandum, paper, communication, tabulation, chart, logs, electronic files, or other data or data compilations stored in any medium. The term violation means any act or omission that, if proved, would constitute a violation of any provision of this Act or any other Federal privacy law. The Agency or, where appropriate, an Agency investigator, may engage in joint investigations and requests for information, as authorized under this Act.
The authority under subparagraph
(A)includes matters relating to protection of individuals’ civil rights under this Act and joint investigations with, and requests for information from, the Director of the Bureau of Consumer Financial Protection, the Federal Trade Commission, the Secretary of Housing and Urban Development, the Department of Education, the Equal Employment Opportunity Commission, the Department of Health and Human Services, or the Attorney General. The Agency or an Agency investigator may issue subpoenas for the attendance and testimony of witnesses and the production of relevant papers, books, documents, or other material in connection with hearings under this Act. In the case of contumacy or refusal to obey a subpoena issued pursuant to this subparagraph and served upon any person, the district court of the United States for any district in which such person is found, resides, or transacts business, upon application by the Agency or an Agency investigator and after notice to such person, may issue an order requiring such person to appear and give testimony or to appear and produce documents or other material. Any failure to obey an order of the court under this subparagraph may be punished by the court as a contempt thereof. Whenever the Agency has reason to believe that any person may be in possession, custody, or control of any documentary material or tangible things, or may have any information, relevant to a violation, the Agency may, before the institution of any proceedings under this Act, issue in writing, and cause to be served upon such person, a civil investigative demand requiring such person to— produce such documentary material for inspection and copying or reproduction in the form or medium requested by the Agency; submit such tangible things; file written reports or answers to questions; give oral testimony concerning documentary material, tangible things, or other information; or furnish any combination of such material, answers, or testimony. Each civil investigative demand shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation. Each civil investigative demand for the production of documentary material shall— describe each class of documentary material to be produced under the demand with such definiteness and certainty as to permit such material to be fairly identified; prescribe a return date or dates which will provide a reasonable period of time within which the material so demanded may be assembled and made available for inspection and copying or reproduction; and identify the custodian to whom such material shall be made available. Each civil investigative demand for the submission of tangible things shall— describe each class of tangible things to be submitted under the demand with such definiteness and certainty as to permit such things to be fairly identified; prescribe a return date or dates which will provide a reasonable period of time within which the things so demanded may be assembled and submitted; and identify the custodian to whom such things shall be submitted. Each civil investigative demand for written reports or answers to questions shall— propound with definiteness and certainty the reports to be produced or the questions to be answered; prescribe a date or dates at which time written reports or answers to questions shall be submitted; and identify the custodian to whom such reports or answers shall be submitted. Each civil investigative demand for the giving of oral testimony shall— prescribe a date, time, and place at which oral testimony shall be commenced; and identify an Agency investigator who shall conduct the investigation and the custodian to whom the transcript of such investigation shall be submitted. Any civil investigative demand issued, and any enforcement petition filed, under this paragraph may be served— by any Agency investigator at any place within the territorial jurisdiction of any court of the United States; and upon any person who is not found within the territorial jurisdiction of any court of the United States— in such manner as the Federal Rules of Civil Procedure prescribe for service in a foreign nation; and to the extent that the courts of the United States have authority to assert jurisdiction over such person, consistent with due process, the United States District Court for the District of Columbia shall have the same jurisdiction to take any action respecting compliance with this section by such person that such district court would have if such person were personally within the jurisdiction of such district court. Service of any civil investigative demand or any enforcement petition filed under this paragraph may be made upon a person, including any legal entity, by— delivering a duly executed copy of such demand or petition to the individual or to any partner, executive officer, managing agent, or general agent of such person, or to any agent of such person authorized by appointment or by law to receive service of process on behalf of such person; delivering a duly executed copy of such demand or petition to the principal office or place of business of the person to be served; or depositing a duly executed copy in the United States mails, by registered or certified mail, return receipt requested, duly addressed to such person at the principal office or place of business of such person. A verified return by the individual serving any civil investigative demand or any enforcement petition filed under this paragraph setting forth the manner of such service shall be proof of such service. In the case of service by registered or certified mail, such return shall be accompanied by the return post office receipt of delivery of such demand or enforcement petition. The production of documentary material in response to a civil investigative demand shall be made under a sworn certificate, in such form as the demand designates, by the person, if a natural person, to whom the demand is directed or, if not a natural person, by any person having knowledge of the facts and circumstances relating to such production, to the effect that all of the documentary material required by the demand and in the possession, custody, or control of the person to whom the demand is directed has been produced and made available to the custodian. The submission of tangible things in response to a civil investigative demand shall be made under a sworn certificate, in such form as the demand designates, by the person to whom the demand is directed or, if not a natural person, by any person having knowledge of the facts and circumstances relating to such production, to the effect that all of the tangible things required by the demand and in the possession, custody, or control of the person to whom the demand is directed have been submitted to the custodian. Each reporting requirement or question in a civil investigative demand shall be answered separately and fully in writing under oath, unless it is objected to, in which event the reasons for the objection shall be stated in lieu of an answer, and it shall be submitted under a sworn certificate, in such form as the demand designates, by the person, if a natural person, to whom the demand is directed or, if not a natural person, by any person responsible for answering each reporting requirement or question, to the effect that all information required by the demand and in the possession, custody, control, or knowledge of the person to whom the demand is directed has been submitted. The examination of any person pursuant to a demand for oral testimony served under this paragraph shall be taken before an officer authorized to administer oaths and affirmations by the laws of the United States or of the place at which the examination is held. The officer before whom oral testimony is to be taken shall put the witness on oath or affirmation and shall personally, or by any individual acting under the direction of and in the presence of the officer, record the testimony of the witness. The testimony shall be taken stenographically and transcribed. After the testimony is fully transcribed, the officer investigator before whom the testimony is taken shall promptly transmit a copy of the transcript of the testimony to the custodian. Any Agency investigator before whom oral testimony is to be taken shall exclude from the place where the testimony is to be taken all other persons, except the person giving the testimony, the attorney for that person, the officer before whom the testimony is to be taken, an investigator or representative of an agency with which the Agency is engaged in a joint investigation, and any stenographer taking such testimony. The oral testimony of any person taken pursuant to a civil investigative demand shall be taken in the judicial district of the United States in which such person resides, is found, or transacts business, or in such other place as may be agreed upon by the Agency investigator before whom the oral testimony of such person is to be taken and such person. Any person compelled to appear under a civil investigative demand for oral testimony pursuant to this section may be accompanied, represented, and advised by an attorney. The attorney may advise a person described in subclause (I), in confidence, either upon the request of such person or upon the initiative of the attorney, with respect to any question asked of such person. A person described in subclause (I), or the attorney for that person, may object on the record to any question, in whole or in part, and such person shall briefly state for the record the reason for the objection. An objection may properly be made, received, and entered upon the record when it is claimed that such person is entitled to refuse to answer the question on grounds of any constitutional or other legal right or privilege, including the privilege against self-incrimination, but such person shall not otherwise object to or refuse to answer any question, and such person or attorney shall not otherwise interrupt the oral examination. If a person described in subclause
(I)refuses to answer any question— the Agency may petition the district court of the United States pursuant to this section for an order compelling such person to answer such question; and if the refusal is on grounds of the privilege against self-incrimination, the testimony of such person may be compelled in accordance with the provisions of section 6004 of title 18, United States Code. For purposes of this paragraph— after the testimony of any witness is fully transcribed, the Agency investigator shall afford the witness (who may be accompanied by an attorney) a reasonable opportunity to examine the transcript; the transcript shall be read to or by the witness, unless such examination and reading are waived by the witness; any changes in form or substance which the witness desires to make shall be entered and identified upon the transcript by the Agency investigator, with a statement of the reasons given by the witness for making such changes; the transcript shall be signed by the witness, unless the witness in writing waives the signing, is ill, cannot be found, or refuses to sign; and if the transcript is not signed by the witness during the 30-day period following the date on which the witness is first afforded a reasonable opportunity to examine the transcript, the Agency investigator shall sign the transcript and state on the record the fact of the waiver, illness, absence of the witness, or the refusal to sign, together with any reasons given for the failure to sign. The Agency investigator shall certify on the transcript that the witness was duly sworn by him or her and that the transcript is a true record of the testimony given by the witness, and the Agency investigator shall promptly deliver the transcript or send it by registered or certified mail to the custodian. The Agency investigator shall furnish a copy of the transcript (upon payment of reasonable charges for the transcript) to the witness only, except that the Agency may for good cause limit such witness to inspection of the official transcript of his testimony. Any witness appearing for the taking of oral testimony pursuant to a civil investigative demand shall be entitled to the same fees and mileage which are paid to witnesses in the district courts of the United States. Documentary materials and tangible things received as a result of a civil investigative demand shall be subject to requirements and procedures regarding confidentiality, in accordance with rules established by the Agency. No rule established by the Agency regarding the confidentiality of materials submitted to, or otherwise obtained by, the Agency shall be intended to prevent disclosure to either House of Congress or to an appropriate committee of the Congress, except that the Agency is permitted to adopt rules allowing prior notice to any party that owns or otherwise provided the material to the Agency and had designated such material as confidential. Whenever any person fails to comply with any civil investigative demand duly served upon such person under this section, or whenever satisfactory copying or reproduction of material requested pursuant to the demand cannot be accomplished and such person refuses to surrender such material, the Agency, through such officers or attorneys as it may designate, may file, in the district court of the United States for any judicial district in which such person resides, is found, or transacts business, and serve upon such person, a petition for an order of such court for the enforcement of this paragraph. All process of any court to which application may be made as provided in this subparagraph may be served in any judicial district. Not later than 20 days after the service of any civil investigative demand upon any person under subparagraph (B), or at any time before the return date specified in the demand, whichever period is shorter, or within such period exceeding 20 days after service or in excess of such return date as may be prescribed in writing, subsequent to service, by any Agency investigator named in the demand, such person may file with the Agency a petition for an order by the Agency modifying or setting aside the demand. The time permitted for compliance with the demand in whole or in part, as determined proper and ordered by the Agency, shall not run during the pendency of a petition under clause
(i)at the Agency, except that such person shall comply with any portions of the demand not sought to be modified or set aside. A petition under subparagraph
(A)shall specify each ground upon which the petitioner relies in seeking relief, and may be based upon any failure of the demand to comply with the provisions of this section, or upon any constitutional or other legal right or privilege of such person. At any time during which any custodian is in custody or control of any documentary material, tangible things, reports, answers to questions, or transcripts of oral testimony given by any person in compliance with any civil investigative demand, such person may file, in the district court of the United States for the judicial district within which the office of such custodian is situated, and serve upon such custodian, a petition for an order of such court requiring the performance by such custodian of any duty imposed upon him by this section or rule promulgated by the Agency. Whenever any petition is filed in any district court of the United States under this paragraph, such court shall have jurisdiction to hear and determine the matter so presented, and to enter such order or orders as may be required to carry out the provisions of this section. Any final order entered as described in subparagraph
(A)shall be subject to appeal pursuant to section 1291 of title 28, United States Code. The Agency is authorized to conduct hearings and adjudication proceedings with respect to any person in the manner prescribed by chapter 5 of title 5, United States Code in order to ensure or enforce compliance with— the provisions of this Act and other Federal privacy laws, including any rules prescribed by the Agency under this Act and other Federal privacy laws; and any other Federal privacy law that the Agency is authorized to enforce, and any rules or order prescribed thereunder, unless such Federal privacy law specifically limits the Agency from conducting a hearing or adjudication proceeding and only to the extent of such limitation. If, in the opinion of the Agency, any data aggregator is engaging or has engaged in an activity that violates a law, rule, or any condition imposed in writing on the person by the Agency, the Agency may issue and serve upon the data aggregator or service provider a notice of charges in respect thereof. The notice under clause
(i)shall contain a statement of the facts constituting the alleged violation or violations, and shall fix a time and place at which a hearing will be held to determine whether an order to cease and desist should issue against the data aggregator or service provider, such hearing to be held not earlier than 30 days nor later than 60 days after the date of service of such notice, unless an earlier or a later date is set by the Agency, at the request of any party so served. Unless the party or parties served under clause
(ii)appear at the hearing personally or by a duly authorized representative, such person shall be deemed to have consented to the issuance of the cease-and-desist order. In the event of consent under clause (ii), or if, upon the record made at any such hearing, the Agency finds that any violation specified in the notice of charges has been established, the Agency may issue and serve upon the data aggregator or service provider an order to cease and desist from the violation or practice. Such order may, by provisions which may be mandatory or otherwise, require the data aggregator or service provider to cease and desist from the subject activity, and to take affirmative action to correct the conditions resulting from any such violation. A cease-and-desist order shall become effective at the expiration of 30 days after the date of service of an order under subparagraph
(A)upon the data aggregator or service provider concerned (except in the case of a cease-and-desist order issued upon consent, which shall become effective at the time specified therein), and shall remain effective and enforceable as provided therein, except to such extent as the order is stayed, modified, terminated, or set aside by action of the Agency or a reviewing court. Any hearing provided for in this subsection shall be held in the Federal judicial district or in the territory in which the residence or principal office or place of business of the person is located unless the person consents to another place, and shall be conducted in accordance with the provisions of chapter 5 of title 5 of the United States Code. After such hearing, and within 90 days after the Agency has notified the parties that the case has been submitted to the Agency for final decision, the Agency shall render its decision (which shall include findings of fact upon which its decision is predicated) and shall issue and serve upon each party to the proceeding an order or orders consistent with the provisions of this section. Judicial review of any such order shall be exclusively as provided in this subsection. Unless a petition for review is timely filed in a court of appeals of the United States, as provided in subparagraph (D), and thereafter until the record in the proceeding has been filed as provided in subparagraph (D), the Agency may at any time, upon such notice and in such manner as the Agency shall determine proper, modify, terminate, or set aside any such order. Upon filing of the record as provided, the Agency may modify, terminate, or set aside any such order with permission of the court. Any party to any proceeding under this subsection may obtain a review of any order served pursuant to this subparagraph (other than an order issued with the consent of the person concerned) by the filing in the court of appeals of the United States for the circuit in which the principal office of the covered person is located, or in the United States Court of Appeals for the District of Columbia Circuit, within 30 days after the date of service of such order, a written petition praying that the order of the Agency be modified, terminated, or set aside. A copy of such petition shall be forthwith transmitted by the clerk of the court to the Agency, and thereupon the Agency shall file in the court the record in the proceeding, as provided in section 2112 of title 28 of the United States Code. Upon the filing of such petition, such court shall have jurisdiction, which upon the filing of the record shall except as provided in the last sentence of subparagraph
(C)be exclusive, to affirm, modify, terminate, or set aside, in whole or in part, the order of the Agency. Review of such proceedings shall be had as provided in chapter 7 of title 5 of the United States Code. The judgment and decree of the court shall be final, except that the same shall be subject to review by the Supreme Court of the United States, upon certiorari, as provided in section 1254 of title 28 of the United States Code. The commencement of proceedings for judicial review under clause
(iv)shall not, unless specifically ordered by the court, operate as a stay of any order issued by the Agency. Whenever the Agency determines that the violation specified in the notice of charges served upon a data aggregator, including a service provider, pursuant to paragraph (2), or the continuation thereof, is likely to cause the person to be insolvent or otherwise prejudice the interests of individuals before the completion of the proceedings conducted pursuant to paragraph (2), the Agency may issue a temporary order requiring the data aggregator or service provider to cease and desist from any such violation or practice and to take affirmative action to prevent or remedy such insolvency or other condition pending completion of such proceedings. Such order may include any requirement authorized under this Act. Such order shall become effective upon service upon the data aggregator or servicer provider and, unless set aside, limited, or suspended by a court in proceedings authorized by clause (ii), shall remain effective and enforceable pending the completion of the administrative proceedings pursuant to such notice and until such time as the Agency shall dismiss the charges specified in such notice, or if a cease-and-desist order is issued against the person, until the effective date of such order. Not later than 10 days after the data aggregator or service provider concerned has been served with a temporary cease-and-desist order, the data aggregator or service provider may apply to the United States district court for the judicial district in which the residence or principal office or place of business of such data aggregator or servicer provider is located, or the United States District Court for the District of Columbia, for an injunction setting aside, limiting, or suspending the enforcement, operation, or effectiveness of such order pending the completion of the administrative proceedings pursuant to the notice of charges served upon the data aggregator or servicer provider under subparagraph (B), and such court shall have jurisdiction to issue such injunction. If a notice of charges served under paragraph
(2)specifies, on the basis of particular facts and circumstances, that the books and records of a data aggregator or service provider are so incomplete or inaccurate that the Agency is unable to determine the financial condition of that data aggregator or service provider or the details or purpose of any transaction or transactions that may have a material effect on the financial condition of that person, the Agency may issue a temporary order requiring— the cessation of any activity or practice which gave rise, whether in whole or in part, to the incomplete or inaccurate state of the books or records; or affirmative action to restore such books or records to a complete and accurate state, until the completion of the proceedings under paragraph (2)(A). Any temporary order issued under clause (i)— shall become effective upon service; and unless set aside, limited, or suspended by a court in proceedings under subparagraph (B), shall remain in effect and enforceable until the earlier of— the completion of the proceeding initiated under paragraph
(2)in connection with the notice of charges; or the date the Agency determines, by examination or otherwise, that the books and records of the covered person or service provider are accurate and reflect the financial condition thereof. The Agency may in its discretion apply to the United States district court within the jurisdiction of which the principal office or place of business of the person is located, for the enforcement of any effective and outstanding notice or order issued under this section, and such court shall have jurisdiction and power to order and require compliance herewith. Except as otherwise provided in this subparagraph, no court shall have jurisdiction to affect by injunction or otherwise the issuance or enforcement of any notice or order or to review, modify, suspend, terminate, or set aside any such notice or order. The Agency shall prescribe rules establishing such procedures as may be necessary to carry out this paragraph. If any person violates this Act, a rule or order issued under this Act, or a Federal privacy law, the Agency may commence a civil action against such person to impose a civil penalty or to seek all appropriate legal and equitable relief including a permanent or temporary injunction as permitted by law. The Agency may act in its own name and through its own attorneys in enforcing any provision of this Act, rules thereunder, or any other law or regulation, or in any action, suit, or proceeding to which the Agency is a party. The Agency may compromise or settle any action if such compromise is approved by the court. When commencing a civil action under this Act or any Federal privacy law, or any rule thereunder, the Agency shall notify the Attorney General. In addition to any notice required under subparagraph (A), the Agency shall notify the Attorney General concerning any action, suit, or proceeding to which the Agency is a party, except an action, suit, or proceeding that involves a violation of this Act or a Federal privacy law. In order to avoid conflicts and promote consistency regarding litigation of matters under Federal law, the Attorney General and the Agency shall consult regarding the coordination of investigations and proceedings, including by negotiating an agreement for coordination by not later than 180 days after the designated transfer date. The agreement under this subclause shall include provisions to ensure that parallel investigations and proceedings involving the Federal privacy laws are conducted in a manner that avoids conflicts and does not impede the ability of the Attorney General to prosecute violations of Federal criminal laws. Nothing in this paragraph shall be construed to limit the authority of the Agency under this title, including the authority to interpret Federal privacy law . The Agency may represent itself in its own name before the Supreme Court of the United States, if the Agency makes a written request to the Attorney General within the 10-day period that begins on the date of entry of the judgment that would permit any party to file a petition for writ of certiorari, and the Attorney General concurs with such request or fails to take action within 60 days of the request of the Agency. Any civil action brought under a Federal privacy law may be brought in a United States district court or in any court of competent jurisdiction of a State in a district in which the defendant is located or resides or is doing business, and such court shall have jurisdiction to enjoin such person and to require compliance with any Federal privacy law. Except as otherwise permitted by law or equity, no action may be brought under this Act or other Federal privacy law more than 5 years after the date of discovery of the violation to which an action relates. The court (or the Agency, as the case may be) in an action or adjudication proceeding brought under this Act or a Federal privacy law, shall have jurisdiction to grant any appropriate legal or equitable relief with respect to a violation of this Act or Federal privacy law, including a violation of a rule or order prescribed under this Act or Federal privacy law. Relief under this section may include, without limitation— rescission or reformation of contracts; refund of moneys or return of real property; restitution; disgorgement of any revenue, data, or technologies, including automated decision systems, data sets, or algorithms, attributable to a violation of this Act, Federal privacy law, or any rule or order issued by the Agency under this Act; payment of damages or other monetary relief; public notification regarding the violation, including the costs of notification; limits on the activities or functions of the person; and civil money penalties, as set forth more fully in paragraph (3). Nothing in this subparagraph shall be construed as authorizing the imposition of exemplary or punitive damages in an action brought by the Agency. In any action brought by the Agency, a State attorney general, or any State regulator to enforce this Act or any Federal privacy law, the Agency, the State attorney general, or the State regulator may recover its costs in connection with prosecuting such action if the Agency, the State attorney general, or the State regulator is the prevailing party in the action. Any person that violates, through any act or omission, any provision of this Act or any Federal privacy law shall forfeit and pay a civil penalty pursuant to this subparagraph. For any violation of a law, rule, or final order or condition imposed in writing by the Agency, a civil penalty may not exceed— $5,000 for each day during which such violation or failure to pay continues; or $15,000 for each day during which such violation or failure to pay continues if such violation involves the personal data of individuals under the age of 13. Notwithstanding clause (i), for any person that recklessly engages in a violation of this Act or any Federal privacy law, a civil penalty may not exceed— $25,000 for each day during which such violation or failure to pay continues; or $75,000 for each day during which such violation or failure to pay continues if such violation involves the personal data of individuals under the age of 13. Notwithstanding clauses
(i)and (ii), for any person that knowingly violates this Act or any Federal privacy law, a civil penalty may not exceed— $1,000,000 for each day during which such violation continues; or $3,000,000 for each day during which such violation or failure to pay continues if such violation involves the personal data of individuals under the age of 13. Any person that re-identifies, or attempts to re-identify, anonymized data shall be assessed a third tier civil penalty under subparagraph (B), unless conducting authorized testing to prove personal data has been anonymized. In determining the amount of any penalty assessed under subparagraph (B), the Agency or the court shall take into account the appropriateness of the penalty with respect to— the size of financial resources and good faith of the person charged; the gravity of the violation or failure to pay; the severity of the risks or harms to individuals; the history of previous violations; and such other matters as justice may require. The Agency may compromise, modify, or remit any penalty which may be assessed or had already been assessed under subparagraph (B). The amount of such penalty, when finally determined, shall be exclusive of any sums owed by the person to the United States in connection with the costs of the proceeding, and may be deducted from any sums owed by the United States to the person charged. No civil penalty may be assessed under this subsection with respect to a violation of this Act or any Federal privacy law, unless— the Agency gives notice and an opportunity for a hearing to the person accused of the violation; or the appropriate court has ordered such assessment and entered judgment in favor of the Agency. If the Agency obtains evidence that any person, domestic or foreign, has engaged in conduct that may constitute a violation of Federal criminal law, the Agency shall transmit such evidence to the Attorney General of the United States, who may institute criminal proceedings under appropriate law. Nothing in this section affects any other authority of the Agency to disclose information.