Consumer Privacy Protection Act of 2003
The source supplies the latest action, but no lifecycle stage.
Latest action (24 Apr 2003): Referred to the Subcommittee on Commerce, Trade and Consumer Protection.
What this bill does
Here is a plain-English summary.
H.R. 1636, the Consumer Privacy Protection Act of 2003, would establish federal rules for how businesses collect, use, and share personal information about consumers. Companies that gather personal data (called "data collection organizations") would generally have to notify consumers when their information is collected, publish a plain-language privacy policy describing what data is gathered and how it is used or sold, give consumers a way to opt out of having their information sold or disclosed to unrelated companies, and maintain information-security policies, including responding to federal security advisories. The bill also allows industries to create self-regulatory privacy programs, which the Federal Trade Commission could approve and which would create a presumption of compliance. A separate title addresses identity theft, including improvements to identity-theft affidavits, dispute resolution, data clearinghouses, and address-change protections, while a third title directs a study and possible actions regarding international privacy law differences affecting U.S. businesses.
The bill would primarily affect businesses that collect personal data from consumers—exempting small businesses, nonprofits acting noncommercially, professional service providers bound by confidentiality rules, and data-processing contractors. Consumers would gain new notice and opt-out rights regarding their personal information, and identity-theft victims would benefit from procedural improvements. Enforcement would rest with the FTC, and the bill explicitly states it creates no private right of action for individuals to sue.
The bill was introduced on April 3, 2003, by Rep. Cliff Stearns with several cosponsors and referred to the House Committee on Energy and Commerce and the Committee on International Relations. It did not receive a vote and did not advance further in the 108th Congress.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
Consumer Privacy Protection Act of 2003 - Requires data collection organizations, under specified conditions, to notify consumers: (1) at the time of collection that their personally identifiable information may be used for an unrelated transaction purpose; and (2) of any material change in the organization's privacy policy statement immediately after each change.
Requires such organizations to establish a privacy policy with respect to the collection, sale, disclosure for consideration, or use of the consumer's information.
Requires an organization to provide consumers, without charge, the opportunity to preclude the sale or disclosure of their information to any organization that is not an information-sharing partner. Prescribes requirements for opportunities an organization may give consumers to limit other information practices of the organization.
Directs an organization to prepare and implement an information security policy that prevents the unauthorized disclosure or release of a consumer's information.
Requires the Federal Trade Commission (FTC) to presume that an organization is in compliance with this Act if it participates in an approved five-year self-regulatory program. Prescribes requirements for a self-regulatory consumer dispute resolution process.
Directs the FTC to: (1) facilitate electronic and promote the use of common identity theft affidavits; (2) require the timely resolution of identity theft disputes; (3) utilize the Identity Theft Clearinghouse to transmit information to appropriate entities for protective action and to mitigate losses; and (4) provide change of address protection for consumers.
Requires: (1) the Comptroller General to analyze the impact on U.S. interstate and foreign commerce of information privacy laws, regulations, or agreements enacted, promulgated, or adopted by other nations, and whether the enforcement mechanisms or procedures of them result in discriminatory treatment of U.S. entities; and (2) the Secretary of Commerce, based on such results, to take steps to mitigate against such discriminatory impact.
Directs the Secretary to seek harmonization of this Act with other international privacy laws, regulations, and agreements for the advancement of transnational and electronic commerce.
Timeline
24 Apr 2003
Referred to the Subcommittee on Commerce, Trade and Consumer Protection.
Common questions
- What does H.R. 1636 do?
- Here is a plain-English summary. H.R. 1636, the Consumer Privacy Protection Act of 2003, would establish federal rules for how businesses collect, use, and share personal information about consumers. Companies that gather personal data (called "data collection organizations") would generally have to notify consumers when their information is collected, publish a plain-language privacy policy describing what data is gathered and how it is used or sold, give consumers a way to opt out of having their information sold or disclosed to unrelated companies, and maintain information-security policies, including responding to federal security advisories. The bill also allows industries to create self-regulatory privacy programs, which the Federal Trade Commission could approve and which would create a presumption of compliance. A separate title addresses identity theft, including improvements to identity-theft affidavits, dispute resolution, data clearinghouses, and address-change protections, while a third title directs a study and possible actions regarding international privacy law differences affecting U.S. businesses. The bill would primarily affect businesses that collect personal data from consumers—exempting small businesses, nonprofits acting noncommercially, professional service providers bound by confidentiality rules, and data-processing contractors. Consumers would gain new notice and opt-out rights regarding their personal information, and identity-theft victims would benefit from procedural improvements. Enforcement would rest with the FTC, and the bill explicitly states it creates no private right of action for individuals to sue. The bill was introduced on April 3, 2003, by Rep. Cliff Stearns with several cosponsors and referred to the House Committee on Energy and Commerce and the Committee on International Relations. It did not receive a vote and did not advance further in the 108th Congress.
- Has H.R. 1636 become law?
- The source does not supply a confirmed lifecycle stage for H.R. 1636. Check the latest action and official source below.
- Who sponsored H.R. 1636?
- H.R. 1636 was sponsored by Rep. Stearns, Cliff [R-FL-6] (R-FL), with 22 cosponsors.
- What's the latest action on H.R. 1636?
- Referred to the Subcommittee on Commerce, Trade and Consumer Protection. (24 Apr 2003).
Related bills in Commerce
Critical Infrastructure Manufacturing Feasibility Act
Cybersecurity for Small Businesses Act of 2026
Combating Foreign Threats to Main Street Act of 2026
Small Business Payment for Performance Act of 2026
More bills from Rep. Stearns, Cliff [R-FL-6]
Consumer Privacy Protection Act of 2011
Expressing support for the designation of January 28, 2010, as National Data Privacy Day.
Requiring the display of the Ten Commandments in the United States Capitol.
Consumer Privacy Protection Act of 2005
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.