Information Transparency & Personal Data Control Act

This bill requires the Federal Trade Commission (FTC) to establish requirements for entities providing services to the public that collect, store, process, use, or otherwise control sensitive personal information. Information relating to an identifiable individual is generally considered sensitive personal information. However, information that is publicly available is not considered sensitive.

The FTC must require controllers of sensitive personal information to (1) provide consumers with a privacy and data use policy, (2) obtain affirmative consent to collect or use consumers' sensitive data, and (3) obtain an annual privacy audit that evaluates the sufficiency of the controller's data privacy and security controls.