Privacy Bill of Rights Act

This bill requires the Federal Trade Commission (FTC) to establish rules concerning the collection of personal information that are intended to increase consumer privacy. Specifically, entities that collect, use, retain, or share information that could identify a particular individual must

• provide notice about how the personal information will be used;
• obtain express approval to collect and use the personal information and provide the ability to withdraw approval;
• upon request, provide access to, and the ability to correct or delete, retained personal information;
• ensure that depersonalized information is not restored in a way that makes an individual identifiable;
• not deny service based on an individual’s refusal to approve of the collection or use of that person’s information;
• not offer price incentives in exchange for approval of the collection of personal information; and
• not disclose personal information to a third party under a written contract unless the contract prohibits the third party from using the personal information for any reason other than performing the contracted service or from disclosing the personal information to another third party.

The FTC also must limit the sale or disclosure of biometric data and prohibit the use of personal information in a discriminatory manner. Individuals may bring civil claims for alleged violations of these requirements.