HR 5571 IH

To prohibit the making, importation, exportation, distribution, sale, offer for sale, installation, or use of an information collection device without proper labeling or notice and consent.

October 26, 2000

Mr. HOLT introduced the following bill; which was referred to the Committee on Commerce

To prohibit the making, importation, exportation, distribution, sale, offer for sale, installation, or use of an information collection device without proper labeling or notice and consent.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Electronic Privacy Protection Act'.

SEC. 2. PROHIBITIONS RELATING TO INFORMATION COLLECTION DEVICES.

(a) PROHIBITION- It is unlawful for any person to knowingly make, import, export, distribute, sell, offer for sale, install, or use an information collection device in a manner that violates any regulation issued under subsection (b).

(b) REGULATIONS-

(1) IN GENERAL- Not later than 120 days after the date of the enactment of this Act, the Federal Trade Commission shall issue regulations that make it unlawful under subsection (a) for any person--

(A) to knowingly make, import, export, distribute, sell, or offer for sale an information collection device, unless the device has a label that discloses in a manner that is readily apparent and understood that the device may transmit from a computer information that is identifiable to that computer, to a primary user of that computer, or to an individual who operates that computer but is not a primary user thereof;

(B) to knowingly install an information collection device on a computer that is not under general management and control of that person, unless that person in accordance with regulations issued under paragraph (2)--

(i) has given a primary user of that computer notice of such installation; and

(ii) after providing such notice to a primary user, has obtained the consent of the primary user to such installation; or

(C) to knowingly use an information collection device to transmit from a computer that is not under general management and control of that person, any information that is identifiable to that computer, to a primary user of that computer, or to an individual who operates that computer but is not a primary user thereof, unless that person in accordance with regulations issued under paragraph (2)--

(i) has given a primary user of that computer notice that the device may transmit such information; and

(ii) after providing such notice to a primary user, has obtained consent by the primary user to such a transmission.

(2) NOTICE AND CONSENT- For purposes of notice and consent required by paragraph (1), regulations shall require that--

(A) notice be given and consent be obtained for each instance of installation or use of an information collection device; and

(B) consent is effective only if the person obtaining the consent has a good faith belief that the person giving the consent--

(i) has attained 18 years of age; and

(ii) has authority to give such consent.

(c) LIMITATION ON APPLICATION OF REGULATIONS- Regulations issued under subsection (b)(1)(A) shall not prohibit the making, importation, exportation, distribution, sale, or offer for sale of any information collection device made before the date of the enactment of this Act.

(d) PENALTY-

(1) IN GENERAL- Subject to paragraph (2), whoever violates this section shall be fined $500 for the first such violation and $1,500 for each subsequent violation.

(2) INFORMATION ABOUT MINORS- Whoever commits a violation of a regulation issued under subsection (b)(1)(C) shall be fined twice the amount of the fine that would otherwise apply under this subsection if such violation results in the transmission from a computer of information that is identifiable to--

(A) an individual who operates that computer and has not attained 18 years of age; or

(B) that computer if a primary user of that computer is an individual who has not attained such age.

(3) SUBSEQUENT VIOLATIONS- Each violation of a regulation issued under subsection (b)(1), including each transmission of information in violation of subsection (b)(1)(C), constitutes a separate violation for purposes of this subsection.

(e) DEFINITIONS- For purposes of this section:

(1) COMPUTER- The term `computer' means a programmable electronically activated device that--

(A) is capable of accepting information, applying prescribed processes to the information, and supplying the results of those processes with or without human intervention; and

(B) consists of a central processing unit containing extensive storage, logic, and control capabilities.

(2) INFORMATION COLLECTION DEVICE- The term `information collection device' means any device that--

(A) is a computer program that is capable of collecting and transmitting from a computer to a person other than a primary user of that computer, information that is identifiable to that computer, to a primary user of that computer, or to an individual who operates that computer but is not a primary user thereof; and

(B) does not consist of only a simple identifying string of computer code, commonly referred to as a `cookie'.

(3) PRIMARY USER- The term `primary user' means any individual with general authority over management and use of a computer or any person on whose behalf an individual exercises such general authority.

END