Obligations and immunity for platforms

(a) Provision of qualified data and information A platform shall provide access to qualified data and information relating to a qualified research project to a qualified researcher under the terms and privacy and cybersecurity safeguards dictated by the Commission pursuant to section 3 for the purpose of carrying out the qualified research project. (b) Continued access to qualified data and information (1) In general A platform may not restrict or terminate a qualified researcher’s access to qualified data and information for an ongoing qualified research project unless the platform has a reasonable belief that the qualified researcher is not acting in accordance with the cybersecurity and privacy safeguards required for the qualified research project pursuant to section 3. (2) Notice and review of change to access If a platform restricts or terminates a qualified researcher's access to qualified data and information for an ongoing qualified research project— (A) the platform shall, within a reasonable time (as established by the Commission), inform the Commission in writing that the platform has restricted or terminated the qualified researcher's access to the qualified data and information; and (B) the Commission shall promptly review the platform's decision and determine whether the qualified researcher has violated the privacy and cybersecurity safeguards established for the qualified research project. (c) Notice to platform users The Commission shall issue regulations requiring that platforms, through posting of notices or other appropriate means, keep users informed of their privacy protections and the information that the platform is required to share with qualified researchers under this Act. (d) Safe harbor No cause of action under State or Federal law arising solely from the release of qualified data and information to qualified researchers in furtherance of a qualified research project may be brought against any platform that complies with the Act. (e) Right of review If a platform fails to provide all of the qualified data and information required under the terms of a qualified research project to the qualified researcher conducting the project, the qualified researcher or the researcher's affiliated university or non-profit organization may bring an action in district court for injunctive relief or petition the Commission to bring an enforcement action against the platform. (f) Security Nothing in this Act shall be construed to restrict a platform’s ability to— (1) take immediate steps to protect an interest that is essential for the life or physical safety of a natural person; or (2) respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or illegal activity, preserve the integrity of security of systems, or investigate or report those responsible for such actions.