Privacy & Information Security Law Blog

On April 13, 2011, Representative Cliff Stearns (R-FL) introduced the Consumer Privacy Protection Act of 2011 (the “Act”), which seeks to “protect and enhance consumer privacy” both online and offline by imposing certain notice and choice requirements with respect to the collection and use of personal information.

The legislation would apply to any “covered entity,” which is defined as an entity “that collects…sells, discloses for consideration, or uses personally identifiable information of more than 5,000 consumers during any consecutive 12-month period” (excluding governmental agencies, providers of professional services obligated by rules of ethics and confidentiality requirements and data processing outsourcing entities).  The term “personally identifiable information” (“PII”) means “individually identifiable information relating to a living individual who can be identified from that information” and includes primary data elements (e.g., name, address, Social Security number), as well as birth date and an electronic address (including an IP address) when used in combination with one of the primary data elements.  The bill explicitly excludes from the definition of PII anonymous or aggregate data (or any other information that does not identify a unique living individual), information about a consumer inferred from data maintained about a consumer, and information about a consumer that is publicly available or obtained from a public record.

Among other requirements, the Act would obligate covered entities to:

• Provide the consumer with a privacy notice before PII is used for a purpose unrelated to a “transaction” (which is broadly defined under the act to include interactions between the consumer and a covered entity resulting in (1) any use of the information that is necessary to complete the interaction in the course of which information is collected, or to maintain the provisions of a requested good or service; (2) any disclosure of information necessary for the consumer to enforce his or her right; (3) any disclosure required by law or court order; (4) any use to verify PII; and (5) the collection or use of PII for marketing or advertising the covered entity’s products or services to its customers or potential customers);
• Provide the consumer with a privacy notice upon a material change in the covered entity’s privacy policy;
• Provide the consumer with a clear and concise “privacy policy statement” (at the time the covered entity collects a consumer’s PII that may be used for a purpose unrelated to a transaction with the consumer) that discloses (1) the identity of each covered entity or each class or type of covered entity that may collect the information, (2) the type of information that may be collected or stored, (3) how the information may be used, (4) whether the consumer is required to provide the information to do business with the entity, (5) the extent to which the information is subject to sale or disclosure for consideration, and (6) whether the entity’s information security practices meet the requirements of the Act to prevent the unauthorized disclosure or release of PII;
• Provide the consumer with the opportunity (at no charge) to prevent for up to five years the sale or disclosure for consideration of the consumer’s PII that may be used for a purpose other than a transaction with the consumer; and
• Implement an information security policy that safeguards PII and is designed to prevent the unauthorized disclosure of release of such information.

Violations of the Act would constitute unfair or deceptive acts or practices and could result in civil penalties up to $500,000 for all related violations by a single violator.  The Act also instructs the FTC to approve self-regulatory programs for a period of five years that exempt participants from civil penalties imposed under the Act.  Finally, the Act provides that compliance with certain other federal privacy laws shall be deemed compliance with the Act and that the Act preempts state statutory laws and regulations to the extent they affect the collection or use of PII in commerce.

The Consumer Privacy Protection Act of 2011 joins a list of bills previously introduced in the past couple of months, including the Commercial Privacy Bill of Rights Act of 2011, the Do Not Track Me Online Act of 2011 and the Financial Information Privacy Act of 2011.