Sec. 113. Commission-approved compliance guidelines
766 words·~3 min read·
/bill/118/hr/8818/ih/section-113·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity that is not a data broker and is not a large data holder, or a group of such covered entities, may apply to the Commission for approval of 1 or more sets of compliance guidelines governing the collection, processing, retention, or transfer of covered data by the covered entity or covered entities. An application under paragraph
(1)shall include— a description of how the proposed guidelines will meet or exceed the applicable requirements of this title; a description of the entities or activities the proposed guidelines are designed to cover; a list of the covered entities, to the extent known at the time of application, that intend to adhere to the proposed guidelines; a description of an independent organization, not associated with any of the intended adhering covered entities, that will administer the proposed guidelines; and a description of how such intended adhering entities will be assessed for adherence to the proposed guidelines by the independent organization described in subparagraph (D). Not later than 90 days after receipt of an application regarding proposed guidelines submitted pursuant to paragraph (1), the Commission shall publish the application and provide an opportunity for public comment on such proposed guidelines. The Commission shall approve an application regarding proposed guidelines submitted pursuant to paragraph (1), including the independent organization that will administer the guidelines, if the applicant demonstrates that the proposed guidelines— meet or exceed the applicable requirements of this title; provide for regular review and validation by an independent organization to ensure that the covered entity or covered entities adhering to the guidelines continue to meet or exceed the applicable requirements of this title; and include a means of enforcement if a covered entity does not meet or exceed the requirements in the guidelines, which may include referral to the Commission for enforcement under section 115 or referral to the appropriate State attorney general for enforcement under section 116. Not later than 1 year after the date on which the Commission receives an application regarding proposed guidelines pursuant to paragraph (1), the Commission shall issue a determination approving or denying the application, including the relevant independent organization, and providing the reasons for approving or denying the application. If the independent organization administering a set of guidelines approved under subparagraph
(A)makes significant changes to the guidelines, the independent organization shall submit the updated guidelines to the Commission for approval. As soon as feasible, the Commission shall publish the updated guidelines and provide an opportunity for public comment. The Commission shall approve or deny any significant change to guidelines submitted under clause
(i)not later than 180 days after the date on which the Commission receives the submission for approval. If at any time the Commission determines that guidelines previously approved under this section no longer meet the applicable requirements of this title or that compliance with the approved guidelines is insufficiently enforced by the independent organization administering the guidelines, the Commission shall notify the relevant covered entity or group of covered entities and the independent organization of the determination of the Commission to withdraw approval of the guidelines, including the basis for the determination. Not later than 180 days after receipt of a notice under paragraph (1), the covered entity or group of covered entities and the independent organization may cure any alleged deficiency with the guidelines or the enforcement of the guidelines and submit each proposed cure to the Commission. If the Commission determines that cures proposed under subparagraph
(A)eliminate alleged deficiencies in the guidelines, the Commission may not withdraw the approval of such guidelines on the basis of such deficiencies. A covered entity with guidelines approved by the Commission under this section shall— publicly self-certify that the covered entity is in compliance with the guidelines; and as part of the self-certification under paragraph (1), indicate the independent organization responsible for assessing compliance with the guidelines. A covered entity that is eligible to participate in guidelines approved under this section, participates in the guidelines, and is in compliance with the guidelines shall be entitled to a rebuttable presumption that the covered entity is in compliance with the relevant provisions of this title to which the guidelines apply. This section shall apply to a service provider that is not a large data holder, or a group of such service providers, in the same manner as this section applies to a covered entity or group of covered entities. Such a service provider or group of service providers may apply for approval of, and participate in, the same guidelines as a covered entity or group of covered entities.