Requirements for notice and consent processes and privacy policies

(a) Minimum threshold The Director shall establish minimum thresholds that covered entities must meet for the percentage of individuals who understand a notice or consent process or privacy policy required by this Act. In establishing such minimum thresholds, the Director shall— (1) vary required thresholds on types and scale of reasonably foreseeable privacy harms; and (2) take into account expectations of individuals, potential privacy harms, and individuals’ awareness of privacy harms. (b) Consent revocation A covered entity shall make available a reasonable mechanism by which an individual may revoke consent for any consent given under this Act. (c) Safe harbor (1) Approval procedures The Director shall develop procedures for analyzing and approving data submitted by a covered entity to establish that a notice and consent process or privacy policy of such covered entity meets the threshold established under subsection (a). (2) Presumption If a covered entity submits testing data to and receives an approval from the Director under paragraph (1) establishing that a notice or consent process or privacy policy of such covered entity meets the threshold established under subsection (a), such notice or consent process or privacy policy shall be presumed to have met such threshold. Such presumption may be rebutted by clear and convincing evidence. (3) Public availability of Approved processes and policies and associated testing data The Director shall make publicly available online the notice and consent processes and privacy policies and associated testing data that the Director approves under paragraph (1). (4) Small business adoption of notice or consent process of another covered entity (A) In general If a small business adopts a notice or consent process of another covered entity that collects, processes, maintains, or discloses personal information in substantially the same way as such small business, if the process of such other covered entity has been approved under paragraph (1), the process of such small business shall receive the presumption under paragraph (2). (B) Ability to freely use Approved process A covered entity whose notice or consent process is approved under paragraph (1) shall permit a small business to freely use such process, or a derivative thereof, as described in subparagraph (A). (C) No published process In the case of a small business for which there is no approved notice or consent process published under paragraph (3) of a covered entity that collects, processes, maintains, or discloses personal information in substantially the same way as such small business, any requirement under this title for a notice or consent process to be objectively shown to meet the threshold established by the Director under subsection (a) shall not apply to such small business. Nothing in the preceding sentence exempts a small business from the requirement to use such notice or consent process or that such process be concise and clear. (D) Inapplicability to privacy policy Paragraph (4) does not apply with respect to a privacy policy. (5) Minor changes A covered entity may make minor changes in a notice or consent process or privacy policy approved under paragraph (1) and retain the presumption under paragraph (2) for such process or policy without retesting or resubmission of testing data to the Director.