Registration requirement

(a) Data broker registration Not later than 12 months after the date of the enactment of this subtitle, and annually thereafter, a covered data broker shall register with the Commission by paying the registration fee set by the Commission under subsection (c) and by filing a registration statement that includes the following information: (1) The legal name of the covered data broker. (2) A contact person and the primary physical address, human-monitored email address, human-monitored telephone number, and website address for the covered data broker. (3) A description of each category of personal data sold by the covered data broker. (4) A statement of whether the covered data broker implements a purchaser credentialing process. (5) A description of any incident of unauthorized access to personal data that the covered data broker has reported to a Federal or State governmental entity pursuant to an applicable law, rule, or regulation during the year before the year in which the registration is filed and, if known, the total number of consumers affected by each previously reported incident of such unauthorized access. (b) Data broker registry Not later than 18 months after the date of the enactment of this subtitle, the Commission shall establish and maintain on a publicly available website of the Commission a searchable, central registry of covered data brokers registered under subsection (a) that includes— (1) a search feature that allows members of the public to search for and identify covered data brokers; and (2) for each covered data broker, the information required by paragraphs (1) through (5) of subsection (a). (c) Annual registration fee The Commission may charge a covered data broker an annual registration fee of at least $22,500 (as adjusted on January 1 each year by the percentage increase (if any), during the preceding 12-month period, in the Consumer Price Index for All Urban Consumers published by the Bureau of Labor Statistics).

(a) Data broker registration Not later than 12 months after the date of the enactment of this subtitle, and annually thereafter, a covered data broker shall register with the Commission by paying the registration fee set by the Commission under subsection (c) and by filing a registration statement that includes the following information: (1) The legal name of the covered data broker. (2) A contact person and the primary physical address, human-monitored email address, human-monitored telephone number, and website address for the covered data broker. (3) A description of each category of personal data sold by the covered data broker. (4) A statement of whether the covered data broker implements a purchaser credentialing process. (5) A description of any incident of unauthorized access to personal data that the covered data broker has reported to a Federal or State governmental entity pursuant to an applicable law, rule, or regulation during the year before the year in which the registration is filed and, if known, the total number of consumers affected by each previously reported incident of such unauthorized access. (b) Data broker registry Not later than 18 months after the date of the enactment of this subtitle, the Commission shall establish and maintain on a publicly available website of the Commission a searchable, central registry of covered data brokers registered under subsection (a) that includes— (1) a search feature that allows members of the public to search for and identify covered data brokers; and (2) for each covered data broker, the information required by paragraphs (1) through (5) of subsection (a). (c) Annual registration fee The Commission may charge a covered data broker an annual registration fee of at least $22,500 (as adjusted on January 1 each year by the percentage increase (if any), during the preceding 12-month period, in the Consumer Price Index for All Urban Consumers published by the Bureau of Labor Statistics).