Bill > HR8413

This bill, known as the "Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act" or "SECURE Data Act," establishes a national framework for consumer privacy rights and the protection of personal data. It grants consumers rights such as confirming if their personal data is being processed, accessing a copy of that data, correcting inaccuracies, deleting their data, and obtaining a portable copy of their data. Consumers can also opt out of targeted advertising, the sale of their personal data, and decisions based on profiling that have a significant impact on them. The bill requires explicit consent for processing sensitive data, with specific rules for children and teens, and mandates that companies (referred to as "controllers") respond to consumer requests within 45 days, with a possible extension. Controllers must also implement reasonable data security practices and provide clear privacy notices. Data brokers, defined as controllers who sell personal data and derive a significant portion of their revenue from it, must register with the Federal Trade Commission (FTC) and post a notice on their website explaining how consumers can exercise their rights. The bill also outlines obligations for "processors" who handle data on behalf of controllers, requires contracts between them, and addresses the handling of deidentified and pseudonymous data. It allows for approved codes of conduct to provide a rebuttable presumption of compliance and includes provisions for international data flows, a study on universal opt-out mechanisms, and enforcement by the FTC and State attorneys general, with a right to cure for alleged violations. The Act applies to businesses meeting certain revenue and data processing thresholds and provides specific exemptions for governmental entities, financial institutions, healthcare providers, and others, while generally preempting conflicting state laws.