This bill prohibits data brokers from selling, reselling, or transferring health data and location data of individuals, whether that information is directly stated or inferred from other data. The law applies broadly to any company that buys and resells personal data for profit, affecting the data brokerage industry and any entity that sells sensitive information to data brokers. The bill includes narrow exceptions for activities that comply with existing health privacy rules, newsworthy publications of legitimate public concern, and disclosures made with valid individual authorization. The Federal Trade Commission will enforce the law with authority to pursue civil penalties up to 15 percent of a company's annual revenues, and states and individuals can also sue violators in federal court. The FTC must issue final rules within 180 days of the law's enactment, and the prohibition takes effect either when those rules are issued or 180 days after passage, whichever comes first. The bill appropriates $1 billion to the FTC through 2035 to carry out enforcement.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.