Relation to other laws

(a) Congressional intent To preempt State privacy and security law It is the express intention of Congress to promote consistency in consumer expectations, competitive parity, and innovation through the establishment of a uniform Federal privacy framework that preempts, and occupies the field with respect to, the authority of any State or political subdivision of a State over the conduct or activities of covered entities covered by this Act (or under a law enumerated in subsection (c)) relating to the privacy or security of personal data, including consumer controls relating to personal data such as rights to access, correction, and deletion. (b) Express preemption of State law (1) In general Except as provided in paragraph (2), this Act shall supersede any provision of a law, rule, regulation, or other requirement of any State or political subdivision of a State to the extent that such provision relates to the privacy or security of personal data. (2) Preservation of State and local laws The provisions of this Act shall not be construed to preempt or supersede the applicability of any of the following laws of a State or political subdivision of a State to the extent that such law is not inconsistent with this Act: (A) Laws that address notification requirements in the event of a data breach. (B) Rules of criminal or civil procedure. (C) Laws that relate to the general standards of fraud or public safety. (D) Laws that address the privacy of any group of students (as defined in section 444(a) of the General Education Provisions Act (20 U.S.C. 1232g(a)) (commonly referred to as the Family Educational Rights and Privacy Act of 1974)). (E) Laws that address financial information held by financial institutions (as defined in section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809)). (F) Laws that address protected health information held by covered entities and business associates (as such terms are defined for purposes of regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note)). (G) Laws governing employment and employment-related data including data collected or used by an employer pursuant to an employer-employee relationship. (H) Laws protecting the right of individuals to be free of discrimination based on race, sex, national origin, or other suspect classification identified under State law. (c) Relation to other Federal laws (1) In general Except as otherwise provided in paragraphs (2) and (4), this Act shall supersede any other Federal statute or regulation relating to the privacy or security of personal data. (2) Savings provision This Act shall not be construed to modify, limit, or supersede the operation of any of the following laws: (A) The Children’s Online Privacy Protection Act (15 U.S.C. 6501 et seq.). (B) The Communications Assistance for Law Enforcement Act (47 U.S.C. 1001 et seq.). (C) Section 227 of the Communications Act of 1934 (47 U.S.C. 227). (D) Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.). (E) The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.). (F) The Health Insurance Portability and Accountability Act (Public Law 104–191). (G) The Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17931 et seq.). (H) Section 444 of the General Education Provisions Act (20 U.S.C. 1232g) (commonly referred to as the Family Educational Rights and Privacy Act of 1974). (I) The Electronic Communications Privacy Act (18 U.S.C. 2510 et seq.). (J) The Driver's Privacy Protection Act of 1994 (18 U.S.C. 2721 et seq.). (K) The Federal Aviation Act of 1958 (49 U.S.C. App. 1301 et seq.). (3) Deemed compliance A covered entity that is required to comply with a law specified in paragraph (2) and is in compliance with the data collection, processing, or security requirements of such law shall be deemed to be in compliance with the requirements of this Act with respect to personal data covered by such law. (4) Nonapplication of FCC laws and regulations to covered entities Notwithstanding any other provision of law, neither any provision of the Communications Act of 1934 (47 U.S.C. 151 et seq.) and all Acts amendatory thereof and supplementary thereto nor any regulation promulgated by the Federal Communications Commission under such Acts shall apply to any covered entity with respect to the collection, use, processing, transferring, or security of personal data, except to the extent that such provision or regulation pertains solely to 911 lines or any other emergency line of a hospital, medical provider or service office, health care facility, poison control center, fire protection agency, or law enforcement agency.