Representative Introduces Consumer Privacy Protection Act

Monday, April 18, 2011



Last week Representative Cliff Stearns (R-FL) introduced the Consumer Privacy Protection Act of 2011, a bill designed to address numerous issues regarding consumer privacy issues.

The legislation will define limits and the fair use of information collected by online marketers and retailers, and set forth provisions for better notifying consumers of their right to opt out of data collection.

The disclosure rules would affect any entity that collects personally identifiable information on more than 5000 individuals in any one year period, excluding government agencies and some outsourced data processors.

Penalties for violations of the Act include fines of up to $500,000 for all violations by a single covered entity, and the bill seeks to supersede any existing state laws regarding privacy and consumer data collection.

According to the Hunton and Williams Privacy Law Blog, the Consumer Privacy Protection Act would require covered entities to:

  • Provide the consumer with a privacy notice before PII is used for a purpose unrelated to a “transaction” (which is broadly defined under the act to include interactions between the consumer and a covered entity resulting in (1) any use of the information that is necessary to complete the interaction in the course of which information is collected, or to maintain the provisions of a requested good or service; (2) any disclosure of information necessary for the consumer to enforce his or her right; (3) any disclosure required by law or court order; (4) any use to verify PII; and (5) the collection or use of PII for marketing or advertising the covered entity’s products or services to its customers or potential customers);
  • Provide the consumer with a privacy notice upon a material change in the covered entity’s privacy policy;
  • Provide the consumer with a clear and concise “privacy policy statement” (at the time the covered entity collects a consumer’s PII that may be used for a purpose unrelated to a transaction with the consumer) that discloses (1) the identity of each covered entity or each class or type of covered entity that may collect the information, (2) the type of information that may be collected or stored, (3) how the information may be used, (4) whether the consumer is required to provide the information to do business with the entity, (5) the extent to which the information is subject to sale or disclosure for consideration, and (6) whether the entity’s information security practices meet the requirements of the Act to prevent the unauthorized disclosure or release of PII;
  • Provide the consumer with the opportunity (at no charge) to prevent for up to five years the sale or disclosure for consideration of the consumer’s PII that may be used for a purpose other than a transaction with the consumer; and
  • Implement an information security policy that safeguards PII and is designed to prevent the unauthorized disclosure of release of such information.

The Consumer Privacy Protection Act of 2011 is offered in addition to several bills previously introduced, such as the Commercial Privacy Bill of Rights Act of 2011, the Do Not Track Me Online Act of 2011 and the Financial Information Privacy Act of 2011.

Possibly Related Articles:
Privacy Marketing Headlines legislation Congress Personally Identifiable Information Tracking Consumers
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.