Commercial data operators

(a) Requirements (1) In general A commercial data operator shall— (A) on a routine basis, and not less frequently than once every 90 days— (i) provide each user of the commercial data operator with an assessment of the economic value that the commercial data operator places on the data of that user; and (ii) in a clear and conspicuous manner, in accordance with paragraph (3), identify to each user of the commercial data operator— (I) the types of data collected from users of the commercial data operator, whether by the commercial data operator or another person pursuant to an agreement with the commercial data operator; and (II) the ways that the data of a user of the commercial data operator are used if the use is not directly or exclusively related to the online service that the commercial data operator provides to the user; and (B) except as provided in paragraph (2), provide a user of the commercial data operator with the ability to delete all data, in the aggregate and for an individual field, that the commercial data operator possesses, or maintains control or access to with respect to the user, through— (i) a single setting; or (ii) another clear and conspicuous mechanism by which the user may make such a deletion. (2) Deletion exceptions (A) In general A commercial data operator shall comply with a user directive to delete, in whole or in part, the data of the user except— (i) in cases where there is a legal obligation of the commercial data operator to maintain the data; (ii) for the establishment, exercise, or defense of legal claims; or (iii) if the data is necessary to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or assist in the prosecution of those responsible for such activity. (B) Retention A commercial data operator may not retain any more user data than is necessary to carry out an activity described in clauses (i) through (iii) of subparagraph (A). (3) Availability A commercial data operator shall ensure that all disclosures required under paragraph (1) are available to a user of the commercial data operator— (A) on and after the date on which the commercial data operator makes the identification; and (B) through any normal mechanism by which a user may interact with the online service provided by the commercial data operator. (4) Unfair and deceptive acts or practices (A) Unfair or deceptive acts or practices A violation of this subsection shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (B) Powers of Federal Trade Commission (i) In general The Federal Trade Commission shall enforce this subsection in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this subsection. (ii) Privileges and immunities Any person who violates this subsection shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.). (b) Regulations Not later than 1 year after the date of enactment of this Act, the Federal Trade Commission shall promulgate regulations carrying out subsection (a).