Accountability

(a) Definition of applicable entity In this section, the term applicable entity means a covered entity or service provider that, on an annual basis, conducts collection and processing of— (1) the personal data of more than 20,000,000 individuals; or (2) the sensitive personal data of more than 1,000,000 individuals. (b) Privacy officer (1) Designation Each applicable entity shall— (A) designate an employee of the applicable entity, or an individual who is a contractor of the applicable entity, to be the privacy officer responsible for overseeing its policies and practices relating to the collection and processing of personal data; and (B) ensure that the privacy officer is involved in all issues relating to the privacy and security of personal data. (2) Conflicts of interest The privacy officer may perform other tasks and duties for the applicable entity, but only to the extent that the applicable entity ensures that the performance of those other tasks or duties does not present a conflict of interest with respect to the duties and responsibilities of the privacy officer role. (3) Responsibilities The privacy officer shall— (A) inform and advise the applicable entity of the obligations of the applicable entity under this Act; (B) monitor compliance by the applicable entity with this Act; (C) oversee— (i) in the case of an applicable entity that is a covered entity, each privacy impact assessment carried out under subsection (c); and (ii) the comprehensive privacy program implemented under subsection (d); and (D) act as a contact for the Commission, other Federal, State, and local authorities, and the applicable entity with respect to matters relating to the privacy and security of personal data. (c) Consideration of privacy implications of material changes in processing sensitive personal data (1) In general If an applicable entity that is a covered entity intends to begin a new collection or processing activity or to make a material change in its processing of sensitive personal data, the applicable entity shall, before beginning the new processing activity or making the material change, consider the privacy implications, if any, of the change. (2) Considerations An applicable entity that is a covered entity shall ensure, in considering the privacy implications of a material change as required under paragraph (1), that the consideration is reasonable and appropriate with respect to the sensitive personal data that will be affected by the new processing activity or the material change in processing by considering— (A) the nature and volume of the sensitive personal data; and (B) the potential for the new processing activity or the material change to be a proximate cause of harm to individuals to whom the sensitive personal data pertains. (3) Approval The privacy officer shall be required to approve the findings of a privacy impact assessment carried out under paragraph (1) before a applicable entity that is a covered entity may begin the new processing activity or make the material change that is the subject of the privacy impact assessment. (4) Documentation An applicable entity that is a covered entity shall document and maintain in written form any privacy impact assessment carried out under paragraph (1) if the new processing activity or material change that is the subject of the privacy impact assessment involves sensitive personal data. (d) Comprehensive privacy program (1) In general Each applicable entity shall implement a comprehensive privacy program to safeguard the privacy and security of personal data collected or processed by the applicable entity for the life cycle of development and operational practices of its products or services, including by— (A) enhancing the privacy and security of personal data collected or processed by the applicable entity through appropriate technical or operational safeguards, such as encryption, de-identification, and other privacy enhancing technologies; (B) verifying that the applicable entity's practices relating to the collection and processing of personal data are consistent with— (i) the entity's policies and documentation of such policies; (ii) in the case of an applicable entity that is a covered entity, representations the entity makes to individuals; and (iii) in the case of an applicable entity that is a service provider, representations the entity makes to covered entities to which the entity provides services; and (C) ensuring that the privacy controls of the applicable entity are adequately accessible to, and effective at safeguarding the expressed preferences of— (i) in the case of an applicable entity that is a covered entity, each individual whose personal data is collected or processed by the covered entity (excluding any personal data with respect to which the covered entity is a third party); and (ii) in the case of an applicable entity that is a service provider, each covered entity to which the entity provides services. (2) Considerations In implementing a comprehensive privacy program under paragraph (1), each applicable entity shall— (A) take into consideration, as applicable given the entity's role as a covered entity or service provider— (i) the relevant risks to the privacy and security of personal data against which the applicable entity must guard in meeting the expectations of individuals; (ii) the requirements under this Act; (iii) the size and complexity of the applicable entity; and (iv) the sensitivity and volume of the personal data that the applicable entity processes; and (B) address the findings and implement the recommendations contained in privacy impact assessments that the applicable entity carries out under subsection (c).