Federal tort for misuse of covered data

(a) Liability Any person who, in or affecting interstate or foreign commerce, appropriates, uses, collects, processes, sells, or otherwise exploits the covered data of an individual, without the express, prior consent of the individual, shall be liable to the individual in accordance with this section. (b) Private right of action (1) In general Any individual whose covered data is appropriated, used, collected, processed, sold, or otherwise exploited without the express, prior consent of the individual as described in subsection (a) may bring a civil action in an appropriate district court of the United States or a State court of competent jurisdiction against any person who— (A) engaged in the appropriation, use, collection, processing, sale, or other exploitation of the covered data; or (B) aided and abetted another person in the appropriation, use, collection, processing, sale, or other exploitation of the covered data. (2) Remedies An individual prevailing in a civil action brought under paragraph (1) may recover— (A) compensatory damages in an amount equal to the greater of— (i) actual damages; (ii) treble any profits from the appropriation, use, collection, processing, sale, or other exploitation of the covered data of the individual as described in subsection (a); or (iii) $1,000; (B) punitive damages; (C) injunctive relief; and (D) attorney’s fees and costs. (3) Affirmative defense of consent (A) In general It shall be an affirmative defense to a civil action under paragraph (1) brought by or on behalf of an individual whose covered data was appropriated, used, collected, processed, sold, or otherwise exploited if the defendant demonstrates that the individual provided express, prior consent for such appropriation, use, collection, processing, sale, or other exploitation of the covered data of the individual. (B) Invalid grounds for consent Consent to the appropriation, use, collection, processing, sale, or other exploitation of covered data shall not be deemed valid if such consent was obtained— (i) through coercion or deception; or (ii) as a condition of using a product or service through which the appropriation, use, collection, processing, sale, or other exploitation of the covered data exceeds what is reasonably necessary to provide that product or service. (c) Inapplicability of the Federal Arbitration Act (1) In general Notwithstanding any other provision of law, including chapter 1 of title 9, United States Code (commonly known as the Federal Arbitration Act), a predispute arbitration agreement or predispute joint-action waiver shall not be valid or enforceable with respect to any claim arising under this Act. (2) Unenforceable agreements Any agreement purporting to waive, limit, or preclude the right of an individual to bring an action in a court of law or to participate in a joint, class, collective, or representative action concerning any claim arising under this Act shall be deemed contrary to public policy and shall be null, void, and unenforceable. (3) Determination under Federal law by Federal court An issue as to whether this Act applies with respect to a dispute shall be determined under Federal law. The applicability of this Act to an agreement to arbitrate and the validity and enforceability of an agreement to which this Act applies shall be determined by a court, rather than an arbitrator, irrespective of whether the party resisting arbitration challenges the arbitration agreement specifically or in conjunction with other terms of the contract containing such agreement, and irrespective of whether the agreement purports to delegate such determinations to an arbitrator. (4) Collective bargaining agreements Nothing in this Act shall apply to any arbitration provision in a contract between an employer and a labor organization or between labor organizations, except that no such arbitration provision shall have the effect of waiving the right of a worker to seek judicial enforcement of a right arising under a provision of the Constitution of the United States, a State constitution, or a Federal or State statute, or public policy arising therefrom. (d) Specific disclosure of third parties required (1) In general Consent required under subsection (a) shall not be valid for the appropriation, use, collection, processing, sale, or other exploitation of covered data by or to any third party unless— (A) each third party is specifically and clearly disclosed to the individual to whom the covered data pertains at the time consent is sought; and (B) the disclosure described in subparagraph (A) is affirmatively presented to the individual to whom the covered data pertains in a manner that ensures the disclosure is seen and acknowledged. (2) Presentation Any disclosure described in paragraph (1)— (A) shall be presented distinctly and separately from any privacy policy, terms of service, or other general conditions or agreements; and (B) shall not be satisfied by the mere inclusion of a hyperlink or general reference to a privacy policy, user agreement, or other similar document. (3) Invalid consent Any purported consent for the appropriation, use, collection, processing, sale, or other exploitation of covered data by or to any third party obtained solely by inclusion within such general documents described in paragraph (2) or via non-specific or passive disclosure shall be invalid and unenforceable.