access, download, and transmit their information;
correct inaccurate or incomplete information;
request the deletion of their information; and
request human reviews of certain automated processes.
Further, the bill limits how covered entities may use, retain, and disclose personal information and otherwise requires actions to preserve information privacy. For example, covered entities must (1) notify and obtain consent from individuals before using, retaining, or disclosing their information in most instances; and (2) maintain privacy and information security policies. Additionally, covered entities may not process information for purposes related to employment, housing, and other opportunities in a discriminatory manner.
The bill establishes the Digital Privacy Agency to administer the provisions of the bill and transfers certain authorities, employees, and responsibilities related to information privacy from the Federal Communications Commission to the agency.
Violations of the bill's requirements may be enforced by the Digital Privacy Agency, states, and individuals. The bill sets out specific guidelines for investigating and adjudicating violations, with violations subject to civil penalties.
The bill also requires research and public education on information privacy.