H.R. 8413 — SECURE Data Act

This section provides the short title of the Act as the “Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act” or the “SECURE Data Act” and sets forth the table of contents for the Act’s 18 sections.

This section establishes consumer privacy rights with respect to controllers, including the rights to confirm and access personal data (unless revealing a trade secret), correct inaccuracies, delete data, obtain a portable copy in a digital format, and opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. It requires controllers to obtain consent before processing sensitive data, with special rules mandating compliance with the Children’s Online Privacy Protection Act of 1998 for children and verifiable parental consent for teens; limits exercise of rights for children and teens to parents only; requires controllers to respond to authenticated requests without undue delay and no later than 45 days (extendable once by an additional 45 days); allows consumers two free requests per right per year with reasonable fees permitted thereafter for additional, infeasible, or unfounded requests; and mandates an appeal process with a 60-day response deadline.

This section establishes requirements for controllers regarding the collection, processing, and disclosure of personal data. It requires controllers to limit collection to data that is adequate, relevant, and reasonably necessary for each disclosed purpose and prohibits processing for secondary uses unless the controller obtains consumer consent. It bars controllers from processing personal data in violation of federal anti-discrimination laws and from discriminating against consumers who exercise rights under section 2, including by denying goods or services or charging different prices. The section clarifies that these non-discrimination rules do not prohibit bona fide loyalty, rewards, or discount programs and voids any contractual provisions that waive or limit consumer rights. It further requires controllers to provide consumers with a clear privacy notice before processing that details categories of data collected, processing purposes, consumer rights and appeals, data sharing with other controllers or governmental entities, and any transfers to covered nations. The section also mandates clear and conspicuous disclosures before any sale of personal data or use for targeted advertising, as well as before any profiling-based decision that has a legal or similarly significant effect on a consumer.

This section establishes data security requirements for controllers of personal data. It requires controllers to implement reasonable administrative, technical, and physical data security practices appropriate to the volume, sensitivity, and nature of such data. It also creates a rebuttable presumption of compliance with these requirements for controllers that adhere to an approved code of conduct or certification, or that maintain state-of-the-art security practices and a comprehensive data security program conforming to a relevant Federal or widely accepted international risk management framework.

This section requires data brokers to post a conspicuous notice on a publicly available website or mobile application stating that the entity is a data broker, that the notice is clear and readily accessible, and that it informs consumers how to exercise rights under section 2. It also requires data brokers to register annually with the Commission no later than 12 months after enactment, pay a reasonable registration fee, and submit specified information including the broker’s legal name and contact details, categories of personal data sold, whether a purchaser credentialing process is used, reported security incidents affecting consumers, and links to the broker’s privacy policy and consumer rights page. Finally, this section directs the Commission to establish and maintain a publicly available, searchable central registry of registered data brokers within 18 months of enactment that includes search functionality and links to each broker’s privacy policy and consumer rights page.

This section requires processors to adhere to controller instructions and assist controllers in fulfilling consumer rights and other obligations under the Act by implementing appropriate administrative and technical measures. It mandates a contract between a controller and processor that specifies the nature, purpose, type, and duration of personal data processing, along with the rights and obligations of each party. At a minimum, the contract must require the processor to maintain confidentiality, delete or return personal data at the controller’s direction, provide information to demonstrate compliance, undergo or facilitate assessments of its policies and measures, and impose equivalent obligations on any subcontractors. The section includes a rule of construction preserving liability for controllers and processors based on their roles and clarifies that controller or processor status is a fact-specific determination that can shift if a processor begins determining the purposes and means of processing.

This section establishes requirements for controllers in possession of deidentified data to take reasonable measures ensuring the data cannot be associated with an individual, publicly commit to maintaining and using the data without re-identification attempts, and contractually obligate recipients to comply with the Act. It further requires controllers disclosing deidentified or pseudonymous data to exercise reasonable oversight of contractual compliance and address any breaches. The section limits the applicability of consumer rights under section 2 to pseudonymous data when the controller keeps identifying information separately under appropriate safeguards, and includes rules of construction clarifying that controllers need not re-identify such data or comply with consumer requests when they cannot reasonably associate the request with the data or meet specified conditions.

This section establishes a process for the Secretary to approve codes of conduct submitted by controllers or processors that meet or exceed the requirements of this Act. An application must describe the specific requirements addressed, how the code meets or exceeds them, the entities covered, the independent organization that will administer and assess compliance with the code, and the process for referring noncompliant entities to the Commission or State attorneys general. The Secretary must publish each application for public comment within 90 days and issue a determination approving or denying it within 1 year, in consultation with the Commission. The section also sets procedures and timelines for approving significant modifications to an approved code (180 days) and for withdrawing approval after providing notice and a 180-day opportunity to cure deficiencies.

This section establishes the Secretary as the principal advisor to the President on policy relating to the international flow of personal data and the protection of personal data in international commerce. It directs the Secretary to assess foreign laws and practices for alignment with consumer protections in this Act and for impacts on U.S. consumers, businesses, and national interests; develop policies to promote data flows while addressing foreign restrictions and risks from covered nations; establish frameworks and partnerships to facilitate commercial data transfers; and coordinate with relevant agencies. The section authorizes the Secretary to enter agreements with foreign governments or international bodies to advance these objectives, provided the agreements do not conflict with protections in this Act, remain consistent with U.S. economic and security interests, and are submitted to the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation within 60 days. It includes a rule of construction preserving agency authorities under subtitle A of title V of the Gramm-Leach-Bliley Act.

This section directs the Secretary to publish a report, developed through public consultation, on a publicly available website not later than 3 years after the date of enactment of this Act. The report reviews commercially available technologies, including web browser settings or extensions and global electronic device settings, that allow consumers to opt out of personal data processing by controllers; considers the feasibility of a universal opt-out mechanism that accounts for beneficial uses of personal data; and is limited to the scope of this Act. The technologies reviewed must require an affirmative, freely given, and unambiguous consumer choice to opt out, be consumer-friendly and easy to use, and avoid unduly burdening lawful data processing.

This section establishes rules of construction clarifying that nothing in the Act restricts controllers or processors from cooperating with law enforcement regarding suspected violations of Federal, State, or local law; investigating, preparing for, or defending legal claims; providing products or services requested by a consumer or parent (if the consumer is a child or teen); performing contracts or warranties; taking steps to protect life or physical safety; preventing, detecting, or responding to security incidents, fraud, identity theft, or similar illegal activity; preserving system integrity; or investigating and reporting such incidents. The section further provides that nothing restricts the collection, use, or retention of personal data for internal research to develop or improve products, effectuating product recalls, repairing technical errors, or performing internal operations reasonably aligned with consumer expectations or the controller-consumer relationship. It also clarifies that the Act does not restrict privileged communications, impose liability on a disclosing controller or processor for a recipient's subsequent violation if the discloser lacked knowledge of intent to violate the Act, or adversely affect constitutional rights including freedom of speech or processing for purely personal or household activities.

This section establishes enforcement mechanisms for violations of the Act. It treats such violations as unfair or deceptive acts or practices under section 18(a)(1)(B) of the Federal Trade Commission Act and authorizes the Commission to enforce the Act using the same procedures, jurisdiction, and remedies as under that Act, including with respect to common carriers subject to the Communications Act of 1934. The Commission may not enforce violations of section 3(c) but must transmit related information to agencies with authority to act. State attorneys general may bring civil actions as parens patriae on behalf of state residents to enjoin violations, enforce compliance, or obtain damages or other relief, subject to prior written notice to the Commission, Commission intervention rights, and a bar on parallel state actions while a federal action is pending. The section also creates a right to cure, under which neither the Commission nor a state attorney general may initiate an action until providing written notice identifying the specific violation and allowing at least 45 days for the controller or processor to cure it and provide a written assurance against recurrence.

This section establishes the applicability of the Act to any person subject to the Federal Trade Commission Act or a common carrier subject to title II of the Communications Act of 1934 that conducts business in the United States, offers products or services to U.S. residents, or processes personal data of U.S. residents and meets one of two thresholds: collects and processes personal data of more than 200,000 consumers annually (excluding payment transaction data) with annual gross revenue of $25,000,000 or more (adjusted annually for CPI-U), or collects and processes personal data of 100,000 or more consumers annually and derives 25 percent or more of annual gross revenue from the sale of such data. This section exempts Federal, State, and local governmental entities and their processors; financial institutions subject to title V of the Gramm-Leach-Bliley Act; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; the National Center for Missing and Exploited Children; and specified categories of data, including health information protected under HIPAA, Fair Credit Reporting Act data, Family Educational Rights and Privacy Act student data, and nonpublic personal information under the Gramm-Leach-Bliley Act.

This section preserves obligations that controllers or processors have under twelve specified federal laws, including the Children’s Online Privacy Protection Act of 1998, Title V of the Gramm-Leach-Bliley Act, Part C of Title XI of the Social Security Act, the Fair Credit Reporting Act, the Family Educational Rights and Privacy Act, and regulations on human subjects protection. It also provides that the Communications Act of 1934 and related FCC regulations do not apply to controllers or processors with respect to the collection, use, processing, transfer, or security of personal data, except for regulations or orders that pertain solely to emergency services. Finally, this section repeals section 2710 of title 18, United States Code.

This section limits states and their political subdivisions from prescribing, maintaining, or enforcing any law, rule, regulation, requirement, standard, or other provision that relates to the provisions of this Act.

This section defines terms used in the Act, including affiliate (a legal entity that controls or shares common branding with another), biometric data (automatic measurements of biological characteristics used to identify an individual, excluding photographs or HIPAA-protected information), child (an individual under age 13), consent (a clear affirmative act signifying freely given agreement), consumer (an individual acting in a noncommercial or nonemployment capacity), controller, data broker (a controller deriving 50 percent or more of annual gross revenue from selling personal data of non-customers), decision that has a legal or similarly significant effect, deidentified data, parent, personal data, and precise geolocation data (information identifying a specific location within a 1,750-foot radius).

This section provides a severability clause ensuring that if any provision of this Act or its application to any person or circumstance is held invalid, the remaining provisions and their application to other persons or circumstances remain in effect.

This section delays the effective date of the Act until 2 years after the date of enactment, except that sections 2, 4, and 5 take effect 1 year after the date of enactment.