Sec. 118. Relation to other laws

1,464 words·~7 min read·/bill/118/hr/8818/ih/section-118

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

The purposes of this section are to— establish a uniform national privacy and data security standard in the United States to prevent administrative costs and burdens from being placed on interstate commerce; and expressly preempt the laws of a State or political subdivision of a State as provided in this subsection. Except as provided in paragraphs

(3)and (4), no State or political subdivision of a State may adopt, maintain, enforce, impose, or continue in effect any law, regulation, rule, requirement, prohibition, standard, or other provision covered by the provisions of this title or a rule, regulation, or requirement promulgated under this title. Paragraph

(2)may not be construed to preempt, displace, or supplant the following State laws, rules, regulations, or requirements: Consumer protection laws of general applicability, such as laws regulating deceptive, unfair, or unconscionable practices. Civil rights laws. Provisions of laws that address the privacy rights or other protections of employees or employee information. Provisions of laws that address the privacy rights or other protections of students or student information. Provisions of laws, insofar as such provisions address notification requirements in the event of a data breach. Contract or tort law. Criminal laws. Civil laws regarding— blackmail; stalking (including cyberstalking); cyberbullying; intimate images (whether authentic or computer-generated) known to be nonconsensual; child abuse; child sexual abuse material; child abduction or attempted child abduction; child trafficking; or sexual harassment. Public safety or sector-specific laws unrelated to privacy or data security, but only to the extent such laws do not directly conflict with the provisions of this title. Provisions of laws that address public records, criminal justice information systems, arrest records, mug shots, conviction records, or non-conviction records. Provisions of laws that address banking records, financial records, tax records, Social Security numbers, credit cards, identity theft, credit reporting and investigations, credit repair, credit clinics, or check-cashing services. Provisions of laws that address electronic surveillance, wiretapping, or telephone monitoring. Provisions of laws that address unsolicited email messages, telephone solicitation, or caller identification. Provisions of laws that protect the privacy of health information, healthcare information, medical information, medical records, HIV status, or HIV testing. Provisions of laws that address the confidentiality of library records. Provisions of laws that address the use of encryption as a means of providing data security. Notwithstanding paragraph (2), the provisions of this title shall preempt any State law, rule, or regulation that provides protections for children or teens only to the extent that such State law, rule, or regulation conflicts with a provision of this title. Nothing in this title shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to children or teens than the provisions of this title. Nothing in this title or a regulation promulgated under this title may be construed to limit— the authority of the Commission, or any other Executive agency, under any other provision of law; any requirement for a common carrier subject to section 64.2011 of title 47, Code of Federal Regulations (or any successor regulation), regarding information security breaches; or any other provision of Federal law, except as otherwise provided in this title. For purposes of this paragraph, the term antitrust laws — has the meaning given such term in subsection

(a)of the first section of the Clayton Act ( 15 U.S.C. 12(a) ); and includes section 5 of the Federal Trade Commission Act ( 15 U.S.C. 45 ), to the extent such section applies to unfair methods of competition. Nothing in this title or a regulation promulgated under this title may be construed to modify, impair, supersede the operation of, or preclude the application of the antitrust laws. To the extent that a covered entity or service provider is required to comply with any Federal law or regulation described in subparagraph (B), such covered entity or service provider is not subject to this title with respect to the activities governed by the requirements of such law or regulation. The Federal laws and regulations described in this subparagraph are the following: Title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq. ). Part C of title XI of the Social Security Act ( 42 U.S.C. 1320d et seq. ). Subtitle D of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17921 et seq. ). The regulations promulgated pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 note). The requirements regarding the confidentiality of substance use disorder information under section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 ) or any regulation promulgated under such section. The Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq. ). Section 444 of the General Education Provisions Act (commonly known as the Family Educational Rights and Privacy Act of 1974 ) ( 20 U.S.C. 1232g ) and part 99 of title 34, Code of Federal Regulations (or any successor regulation), to the extent a covered entity or service provider is an educational agency or institution (as defined in such section or section 99.3 of title 34, Code of Federal Regulations (or any successor regulation)). The regulations related to the protection of human subjects under part 46 of title 45, Code of Federal Regulations. The Health Care Quality Improvement Act of 1986 ( 42 U.S.C. 11101 et seq. ). Part C of title IX of the Public Health Service Act ( 42 U.S.C. 299b–21 et seq. ). Chapter 123 of title 18, United States Code. Not later than 1 year after the date of the enactment of this Act, the Commission shall issue guidance with respect to the implementation of this paragraph. Nothing in this title, nor any amendment, standard, rule, requirement, assessment, or regulation promulgated under this title, may be construed to preempt, displace, or supplant any Federal or State common law rights or remedies, or any State statute creating a remedy for civil relief, including any cause of action for personal injury, wrongful death, property damage, or other financial, physical, reputational, or psychological injury based in negligence, strict liability, products liability, failure to warn, an objectively offensive intrusion into the private affairs or concerns of an individual, or any other legal theory of liability under any Federal or State common law, or any State statutory law, except that the fact of a violation of this title or a regulation promulgated under this title may not be pleaded as an element of any violation of such law. Except as provided in paragraph (2), sections 201, 202, 222, 338(i), and 631 of the Communications Act of 1934 ( 47 U.S.C. 201 ; 202; 222; 338(i); 551) and section 706 of the Telecommunications Act of 1996 ( 47 U.S.C. 1302 ), and any regulation or order issued by the Federal Communications Commission under any such section, do not apply to any covered entity or service provider with respect to the collection, processing, retention, transfer, or security of covered data (or the equivalent of such data), to the extent that such sections or any regulation or order issued under such sections would otherwise cover the collection, processing, retention, transfer, or security of covered data (or the equivalent of such data) in order to protect consumer privacy or the security of such data, and a covered entity or service provider shall instead be covered by the requirements of this title with respect to the collection, processing, retention, transfer, and security of covered data. Paragraph

(1)does not supersede any authority of the Federal Communications Commission with respect to the following: Emergency services (as defined in section 7 of the Wireless Communications and Public Safety Act of 1999 ( 47 U.S.C. 615b )). Proceedings to implement section 227 of the Communications Act of 1934 ( 47 U.S.C. 227 ) or the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act ( Public Law 116–105 ; 133 Stat. 3274), or any other authority used by the Federal Communications Commission to prevent or reduce unwanted telephone calls or text messages. An enforcement action alleging or finding a violation of a section of the Communications Act of 1934 specified in paragraph (1), if such action was adopted by the Federal Communications Commission prior to the date of the enactment of this Act. Subsection

(a)of section 222 of the Communications Act of 1934 ( 47 U.S.C. 222 ), to the extent such subsection imposes a duty on every telecommunications carrier to protect the confidentiality of proprietary information of, and relating to, other telecommunications carriers and equipment manufacturers. Subsections (b), (d), and

(g)of section 222 of the Communications Act of 1934 ( 47 U.S.C. 222 ). Any obligation of an international treaty related to the exchange of traffic implemented and enforced by the Federal Communications Commission.

Connectionstraces to 14

Traces to 14 documents

U.S. Code