Sec. 201. Prohibition on Federal law enforcement purchase of personal data from data brokers
2,516 words·~11 min read·
/bill/119/s/4082/is/section-201A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Section 2702 of title 18, United States Code, is amended by adding at the end the following: In this subsection and subsections
(f)and (g)— the term biometric information — means any covered personal data that allows or confirms the unique identification or verification of an individual and is generated from the measurement or processing of unique biological, physical, or physiological characteristics, including— fingerprints; voice prints; iris or retina imagery scans; facial or hand mapping, geometry, or templates; and gait; and does not include— a digital or physical photograph; an audio or video recording; or data derived from a digital or physical photograph or an audio or video recording that cannot be used to identify or authenticate a specific individual; the term covered organization means a person who— is not a governmental entity; and is not an individual, unless such individual is an agent of, or otherwise acting on behalf of, a person who is not a governmental entity and is not an individual; the term covered person means an individual who— is reasonably believed to be located inside the United States at the time of the creation of the covered personal data; or is a United States person, as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 ( 50 U.S.C. 1801 ); the term covered personal data means personal data relating to a covered person; the term electronic device has the meaning given the term computer in section 1030(e); the term Federal law enforcement agency means a law enforcement agency of a department or agency of the United States; the term lawfully obtained public data means covered personal data obtained by a particular covered organization— that the covered organization reasonably understood to have been voluntarily made available to the general public by the covered person; that the covered organization obtained in compliance with all applicable laws and regulations; and if the covered organization did not initially obtain the covered personal data after the covered personal data was made available to the general public— that the covered organization reasonably understood to have been obtained in compliance with all applicable laws and regulations by— the person that initially obtained the covered personal data; and if the covered organization did not obtain the covered personal data from the person described in item (aa), each other person in the sequence of transfers of the covered personal data leading up to the obtaining of the covered personal data by the covered organization; and with respect to which the covered organization receives an attestation under penalty of perjury— by the person that initially obtained the covered personal data indicating that the covered personal data was voluntarily made available to the general public by the covered person and was obtained in compliance with all applicable laws and regulations; and if the covered organization did not obtain the covered personal data from the person described in item (aa), by each other person in the sequence of transfers of the covered personal data leading up to the obtaining of the covered personal data by the covered organization indicating that such person reasonably understood the data to have been lawfully obtained public data; the term obtain in exchange for anything of value means to obtain by purchasing, to receive in connection with services being provided for monetary or nonmonetary consideration, or to otherwise obtain in exchange for consideration, including an access fee, service fee, maintenance fee, or licensing fee; the term personal data — means data, derived data, or any unique identifier that is linked to, or is reasonably linkable to, an individual or to an electronic device that is linked to, or is reasonably linkable to, 1 or more individuals in a household; includes anonymized data that, if combined with other data, can be linked to, or is reasonably linkable to, an individual or to an electronic device that identifies, is linked to, or is reasonably linkable to 1 or more individuals in a household; and does not include data that is lawfully available through Federal, State, or local government records or through widely distributed media; and the term State or local law enforcement agency means a law enforcement department or agency of a State, or a political subdivision of a State. Subject to clauses
(ii)through (vii), a Federal law enforcement agency may not obtain in exchange for anything of value covered personal data if— the covered personal data is directly or indirectly obtained from a covered organization; or the covered personal data is derived from covered personal data that was directly or indirectly obtained from a covered organization. A Federal law enforcement agency may obtain in exchange for something of value covered personal data as part of a larger compilation of data which includes personal data about persons who are not covered persons, if— the Federal law enforcement agency is unable through reasonable means to exclude covered personal data from the larger compilation obtained; and the Federal law enforcement agency minimizes any covered personal data from the larger compilation, in accordance with the requirements described in, and the procedures established under, subsection (f). Clause
(i)shall not apply to covered personal data that is obtained by a Federal law enforcement agency under a program established by an Act of Congress under which a portion of a penalty or a similar payment or bounty is paid to an individual who discloses information about an unlawful activity to the Government, such as the program authorized under section 7623 of the Internal Revenue Code of 1986 (relating to awards to whistleblowers in cases of underpayments or fraud). Clause
(i)shall not apply to covered personal data that is obtained by a Federal law enforcement agency from a covered organization in accordance with compulsory legal process that— is established by statute; and provides for the reimbursement of costs of the covered organization that are incurred in connection with providing the record or information to the Federal law enforcement agency, such as the reimbursement of costs under section 2706. Clause
(i)shall not apply to covered personal data about an employee of, or applicant for employment by, a Federal law enforcement agency that is— obtained by the Federal law enforcement agency for lawful employment-related purposes; accessed and used by the Federal law enforcement agency only for such employment-related purposes; and destroyed at such time as the covered personal data is no longer needed for employment-related purposes. Clause
(i)shall not apply to covered personal data about a covered person that is— obtained by a Federal law enforcement agency for purposes of conducting a background check of the covered person with the written consent of the covered person; accessed and used by the Federal law enforcement agency only for background check-related purposes; and destroyed at such time as the covered personal data is no longer needed for background check-related purposes. Except as provided in subclause
(II)or
(III)of this clause, clause
(i)shall not apply to covered personal data that is obtained by a Federal law enforcement agency if— the Federal law enforcement agency reasonably believes that— the covered personal data is lawfully obtained public data; or the covered personal data is derived from covered personal data that solely consists of lawfully obtained public data; and the Federal law enforcement agency receives— an attestation under penalty of perjury from the person providing the covered personal data that the covered personal data is lawfully obtained public data or is derived from covered personal data that solely consists of lawfully obtained public data; and each attestation described in paragraph (1)(G)(iii) with respect to the lawfully obtained public data. The exception under subclause
(I)shall not apply to biometric information. The exception under subclause
(I)shall not apply to location information. The limitation under subparagraph
(A)shall apply without regard to whether the covered organization possessing the covered personal data is the covered organization that initially obtained, collected, or received the disclosure of the covered personal data. -A Federal law enforcement agency may not acquire, receive, query, or otherwise obtain or access covered personal data from any governmental entity (without regard to whether the governmental entity is a Federal entity), if the covered personal data was obtained by that governmental entity in a manner that would violate paragraph
(2)if the Federal law enforcement agency directly obtained the covered personal data in a like manner. -The prohibition in subparagraph
(A)shall apply without regard to whether the Federal law enforcement agency caused the governmental entity to obtain the covered personal data. -A Federal law enforcement agency may only acquire, receive, query, or otherwise obtain or access covered personal data from another governmental entity (without regard to whether the governmental entity is a Federal entity), if the Federal law enforcement agency obtains an attestation that the covered personal data was not obtained by that governmental entity in a manner that would violate paragraph
(2)if the Federal law enforcement agency directly obtained the covered personal data in a like manner. -If a Federal law enforcement agency learns that the Federal law enforcement agency previously acquired, received, queried, or otherwise obtained or accessed covered personal data from any governmental entity (without regard to whether the governmental entity is a Federal entity) that the governmental entity obtained in a manner described in subparagraph (A), the Federal law enforcement agency may not use or disseminate the covered personal data or any information derived from the covered personal data, and shall promptly destroy any such covered personal data that is still retained. Covered personal data acquired, received, queried, or otherwise obtained or accessed by a Federal law enforcement agency in violation of paragraph
(2)or (3), and any evidence derived therefrom, may not be used, received in evidence, or otherwise disseminated by, on behalf of, or upon a motion or other action by a Federal law enforcement agency in any investigation, trial, hearing, or other proceeding by, in, or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof. Nothing in subparagraph
(A)shall be construed to limit the use of covered personal data by a covered person aggrieved of a violation of paragraph
(2)or
(3)in connection with any action relating to such a violation. The Attorney General shall adopt specific procedures that are reasonably designed to minimize the acquisition and retention, and to restrict the querying, of covered personal data, and prohibit the dissemination of information derived from covered personal data, which shall include procedures to enforce the requirements of paragraphs (2), (3), and (4). Not later than 3 years after the date of enactment of the Government Surveillance Reform Act of 2026 , and every 3 years thereafter, the Attorney General shall— review the procedures adopted under subparagraph (A); publish a determination regarding whether the procedures need to be revised, in light of new technologies or violations of the procedures; and adopt any necessary revisions to the procedures. Each Federal law enforcement agency shall— exhaust all reasonable means— to exclude covered personal data that is not subject to 1 or more of the exceptions set forth in clauses
(iii)through
(vii)of subsection (e)(2)(A) from the data obtained; and to remove and delete covered personal data described in clause
(i)after a compilation is obtained and before operational use of the compilation or inclusion of the compilation in a dataset intended for operational use; and audit the acquisition and retention of covered personal data by the Federal law enforcement agency on an ongoing and continuous basis, to evaluate compliance with the procedures adopted under paragraph (1). If a Federal law enforcement agency identifies covered personal data in a compilation described in paragraph (2)(A)(ii), the Federal law enforcement agency shall promptly destroy the covered personal data and any dissemination of information derived from the covered personal data shall be prohibited. Except as provided in subparagraphs
(B)and (C), no officer or employee of a Federal law enforcement agency may conduct a query of personal data, including personal data already subjected to minimization, in an effort to find records of or about 1 or more particular covered persons. Subparagraph
(A)shall not apply to a query related to 1 or more particular covered persons if— such covered persons are the subject of a court order issued under this title or the Foreign Intelligence Surveillance Act of 1978 ( 50 U.S.C. 1801 et seq. ) that would authorize the Federal law enforcement agency to compel the production of the covered personal data, during the effective period of that order; the officer or employee of a Federal law enforcement agency carrying out the query has a reasonable belief that the life or safety of such covered persons are threatened and the information is sought for the purpose of assisting such covered persons, in which case information resulting from the query may be accessed or used solely for that purpose and shall be destroyed at such time as it is no longer necessary for such purpose; or such covered persons have consented to the query. For a query of a compilation of data obtained under subsection (e)(2)(A)(ii)— each query shall be reasonably designed to exclude personal data of covered persons; and any personal data of covered persons returned pursuant to a query shall not be reviewed and shall immediately be destroyed. In this subsection, the term covered Federal funds means— funds provided under the Edward Byrne Memorial Justice Assistance Grant Program under subpart 1 of part E of title I of the Omnibus Crime Control and Safe Streets Act of 1968 ( 34 U.S.C. 10151 et seq. ); funds provided through the Office of Community Oriented Policing Services; funds received under an in-kind grant made under section 2576 of title 10; funds received under an in-kind grant made via a transfer made under section 981 of this title; or funds received under any other Federal program that offers assistance to a law enforcement agency similar to the assistance under the programs described in subparagraphs
(A)through (D). If a State or local law enforcement agency, using any means or facility of interstate or foreign commerce, through activities in or affecting interstate or foreign commerce, or by using covered Federal funds, obtains covered personal data in a manner that would violate subsection (e)(2) if obtained by a Federal law enforcement agency in a like manner, the State or local law enforcement agency shall publicly report, not less frequently than once per year— the total amount in dollars of anything of value exchanged for such covered personal data during the preceding year, which shall be disaggregated into money directly exchanged and the estimated value of the other things of value that were exchanged; the categories of covered personal data obtained in such a manner in the preceding year, including whether the agency obtained location information, biometric information, web browsing data, or metadata of communications; and an estimate of the total number of covered persons whose covered data was obtained in such a manner in the preceding year. .
Connectionstraces to 2
Traces to 2 documents
Citation graph
cites case law
Sec. 201
Prohibition on Federal law enforcement purchase of personal data from data brokers
Cites 2Cited by 0 across 0 sources