House Republicans Introduce Privacy Bill

April 13, 2011. Rep. Cliff Stearns (R-FL), Rep. Jim Matheson (D-UT), Rep. Brian Bilbray (R-CA), and Rep. Dan Manzullo (R-IL) introduced HR 1528 [LOC | WW], the "Consumer Privacy Protection Act of 2011".

This bill would regulate the collection and use of personally identifiable information or PII (including a name, address, email address, phone number, or credit or debit card number) by any covered entity (an entity that "sells, discloses for consideration, or uses personally identifiable information of more than 5,000 consumers during any consecutive 12-month period").

This bill would require covered entities to notify consumers that their PII may be used for a purpose unrelated to the transaction in which it was collected.

This bill would require covered entities to write and publish privacy policies, set minimum standards for such policies, and require notice to consumers of changes in the policies. It would require every covered entity to "establish a privacy policy with respect to the collection, sale, disclosure for consideration, dissemination, use, and security of the personally identifiable information of consumers".

This bill would require covered entities to "implement an information security policy" for PII.

This bill would require covered entities to provide consumers "the opportunity to preclude any sale or disclosure for consideration of the consumer's personally identifiable information, provided in a particular data collection, that may be used for a purpose other than a transaction with the consumer, to any covered entity that is not an information-sharing affiliate of the covered entity providing such opportunity."

This bill would provide for compliance with its requirements via participation in self-regulatory programs.

This bill would give enforcement authority to the Federal Trade Commission (FTC). It would create no private right of action.

It would also give the FTC rulemaking authority, under Section 18 of the FTC Act, 15 U.S.C. § 57a, but not the Administrative Procedure Act, 5 U.S.C. § 553. Section 18 rulemakings require due process and fairness for affected parties. Hence, the FTC rarely engages in Section 18 rulemakings.

This bill would not give the states any authority to enforce it. It also contains strong preemption language.

This bill was referred to the House Commerce Committee (HCC).

On February 11, 2011, Rep. Jackie Speier (D-CA), Rep. Alcee Hastings (D-FL), and Rep. Bob Filner (D-CA) introduced HR 654 [LOC | WW], the "Do Not Track Me Online Act of 2011". See also, Rep. Speier's release.

On February 10, 2011, Rep. Bobby Rush (D-IL) introduced HR 611 [LOC | WW], the "Building Effective Strategies To Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards Act" or "BEST PRACTICES Act".