HR 2644 IH, Personal Data Privacy Act of 1999.
Re: prohibiting government and private entities from transferring personal data without consent.
Sponsor: Rep. Maurice Hinchey (D-NY).
Date Introduced: July 29, 1999.
Source: Library of Congress.

To prohibit Federal, State, and local agencies and private entities from transferring, selling, or disclosing personal data with respect to an individual to other agencies or entities without the express consent of the individual except in limited circumstances, and to require such agencies and entities to provide individuals with personal data maintained with respect to such individuals.

Mr. HINCHEY (for himself, Mr. KLECZKA, and Mr. GEORGE MILLER of California) introduced the following bill; which was referred to the Committee on Government Reform

To prohibit Federal, State, and local agencies and private entities from transferring, selling, or disclosing personal data with respect to an individual to other agencies or entities without the express consent of the individual except in limited circumstances, and to require such agencies and entities to provide individuals with personal data maintained with respect to such individuals.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Personal Data Privacy Act of 1999'.

SEC. 2. LIMITATIONS ON TRANSFER, SALE, OR DISCLOSURE OF PERSONAL DATA.

(a) LIMITATION ON TRANSFER, SALE, OR DISCLOSURE OF PERSONAL DATA- Except as provided in subsection (b), no Government agency or private entity may transfer, sell, or disclose any personal data with respect to an individual to another Government agency or private entity without the express consent of such individual. The preceding sentence shall apply with respect to each transfer, sale, or disclosure of personal data by a Government agency or private entity.

(b) EXCEPTIONS- Subsection (a) shall not apply with respect to the transfer, sale, or disclosure of data by a Government agency for a national security purpose, law enforcement purpose, or purpose relating to the Federal or State regulation of an industry.

SEC. 3. REQUIREMENT TO PROVIDE ACCESS TO PERSONAL DATA UPON REQUEST OF INDIVIDUAL; REPORTS ON DATA COLLECTED.

(a) ACCESS TO PERSONAL DATA REQUIRED- A Government agency or private entity, shall, upon the request of an individual with respect to whom the agency or entity maintains personal data, provide such individual with access to such personal data not later than five business days after the individual makes the request.

(b) REPORTS- Each year a Government agency or private entity shall provide, to each individual regarding whom the agency or entity has collected or maintained personal data during the preceding 12-month period, a report including the personal data collected with respect to the individual during such period. A Government agency or private entity shall provide such report to an individual regardless of whether the agency or entity has provided the data to the individual pursuant to the requirement in subsection (a).

SEC. 4. DEFINITIONS.

For purposes of this Act:

(1) The term `personal data' means any data that contains individually identifiable information with respect to an individual, including (but not limited to) the following:

(A) The name of the individual.

(B) The address of the individual.

(C) The Social Security number of the individual.

(D) Any information relating to the medical records of the individual.

(E) The passport number or driver's-license number of the individual.

(F) Any student identification or taxpayer identification numbers with respect to the individual.

(G) Any school records of the individual.

(H) The Internet address of the individual.

(I) Any information relating to a credit card account of the individual.

(J) Any other information regarding an account with information that is individually identifiable with respect to the individual.

(2) The term `Government agency' means any Federal, State, or local agency.

(3) The term `private entity' means any business, corporation, joint venture, affiliate, or subsidiary thereof.

SEC. 5. PRIVATE RIGHT OF ACTION FOR VIOLATIONS.

Whenever a Government agency or private entity fails to comply with the provisions of this Act, the individual with respect to whom the personal data relates may bring a civil action against such agency or entity, and the district courts of the United States shall have jurisdiction in the matters under the provisions in this Act.

SEC. 6. EFFECTIVE DATE.

This Act shall take effect on the date that is 60 days after the date of the enactment of this Act.