DATA Privacy Act
The source supplies the latest action, but no lifecycle stage.
Latest action (12 Nov 2020): Referred to the Committee on Energy and Commerce, and in addition to the Committee on Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
What this bill does
The DATA Privacy Act would establish federal requirements for how businesses and organizations handle personal information collected through digital means. It would require "covered entities"—defined generally as those handling data on 3,000 or more individuals or devices in a year—to post clear privacy notices explaining what data they collect and why, and to implement data-handling practices that are reasonable, non-discriminatory, and not deceptive. The bill directs the Federal Trade Commission to write implementing regulations within a year covering opt-out and opt-in consent requirements (the latter for sensitive data such as health or precise location information), data minimization, and information security standards. It also gives individuals rights to access, correct, delete, and transfer their data, and requires larger companies (over $25 million in annual revenue) to designate a privacy protection officer.
The bill primarily affects businesses and other entities that collect, process, store, or share personal data online, exempting smaller entities and certain government or employment-related data. Individuals whose data is collected would gain new notice, consent, and control rights. Enforcement would rest with the FTC, which could hire additional staff, and with state attorneys general, who could sue on behalf of residents and seek civil penalties.
The bill was introduced in the House on November 12, 2020, by Rep. Filemon Vela and referred to the Committees on Energy and Commerce and on Science, Space, and Technology. It did not receive a vote and did not advance before the end of the 116th Congress, meaning it did not become law.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
Digital Accountability and Transparency to Advance Privacy Act or the DATA Privacy Act
This bill establishes information security requirements for businesses that collect, process, store, or disclose information relating to at least 3,000 people in a 12-month period. The bill applies to information that may be linked to a specific individual or a device associated with a specific individual. It does not cover data related to employment or publicly available government records. Specifically, covered businesses must • provide consumers with accessible notice of the business’ privacy practices with respect to such information; and
• if meeting a certain revenue threshold, appoint a privacy officer to oversee compliance with the information privacy standards of this bill.
The bill further requires the Federal Trade Commission to promulgate rules requiring covered businesses to
• limit the purpose and amount of consumer data collection to reasonable business purposes, provide consumers with clear methods to opt-in and opt-out of such collection, and refrain from using such data for discriminatory purposes;
• provide consumers with a method to access, revise, transmit, and delete such collected information; and
• establish information security practices based on the sensitivity and level of identifiability of the collected data, risk of exposure of such data, widely-accepted practices of securing such data, and cost and impact of implementing such practices.
The bill further revises the National Science Foundation information security grants program to include research about methods to encrypt or remove identifiable elements from collected consumer data.
Timeline
12 Nov 2020
Referred to the Committee on Energy and Commerce, and in addition to the Committee on Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Common questions
- What does H.R. 8749 do?
- The DATA Privacy Act would establish federal requirements for how businesses and organizations handle personal information collected through digital means. It would require "covered entities"—defined generally as those handling data on 3,000 or more individuals or devices in a year—to post clear privacy notices explaining what data they collect and why, and to implement data-handling practices that are reasonable, non-discriminatory, and not deceptive. The bill directs the Federal Trade Commission to write implementing regulations within a year covering opt-out and opt-in consent requirements (the latter for sensitive data such as health or precise location information), data minimization, and information security standards. It also gives individuals rights to access, correct, delete, and transfer their data, and requires larger companies (over $25 million in annual revenue) to designate a privacy protection officer. The bill primarily affects businesses and other entities that collect, process, store, or share personal data online, exempting smaller entities and certain government or employment-related data. Individuals whose data is collected would gain new notice, consent, and control rights. Enforcement would rest with the FTC, which could hire additional staff, and with state attorneys general, who could sue on behalf of residents and seek civil penalties. The bill was introduced in the House on November 12, 2020, by Rep. Filemon Vela and referred to the Committees on Energy and Commerce and on Science, Space, and Technology. It did not receive a vote and did not advance before the end of the 116th Congress, meaning it did not become law.
- Has H.R. 8749 become law?
- The source does not supply a confirmed lifecycle stage for H.R. 8749. Check the latest action and official source below.
- Who sponsored H.R. 8749?
- H.R. 8749 was sponsored by Rep. Vela, Filemon [D-TX-34] (D-TX), with 0 cosponsors.
- What's the latest action on H.R. 8749?
- Referred to the Committee on Energy and Commerce, and in addition to the Committee on Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned. (12 Nov 2020).
Related bills in Commerce
Critical Infrastructure Manufacturing Feasibility Act
Cybersecurity for Small Businesses Act of 2026
Small Business Payment for Performance Act of 2026
Combating Foreign Threats to Main Street Act of 2026
More bills from Rep. Vela, Filemon [D-TX-34]
DATA Privacy Act
Digital Defense Leadership Act
DHS Body-Worn Camera Act of 2018
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.