Bill > S2367

This bill establishes a comprehensive federal tort law focused on protecting individuals' personal data in the context of artificial intelligence and digital technologies. The legislation defines "covered data" broadly, including personally identifiable information, unique identifiers, geolocation data, biometric information, and behavioral data, and makes it illegal for any person or entity to appropriate, use, collect, process, sell, or exploit such data without the individual's express, prior consent. The bill provides individuals with a private right of action, allowing them to sue entities that misuse their data, with potential remedies including compensatory damages (up to $1,000 or treble profits), punitive damages, injunctive relief, and attorney's fees. Critically, the bill invalidates predispute arbitration agreements and joint-action waivers related to data misuse, ensuring that individuals can pursue legal action in court. The legislation also requires clear, specific disclosure of third-party data usage, mandating that consent can only be considered valid if third parties are explicitly and distinctly disclosed to the individual at the time consent is sought. Importantly, the bill does not preempt existing state laws and is intended to serve as a minimum standard of protection, allowing states to provide additional data privacy safeguards. The bill specifically addresses concerns around generative AI systems, including how such systems might train on or generate content derived from individuals' data without their consent.

Justice

https://www.congress.gov/bill/119th-congress/senate-bill/2367/all-info