H.R.8014

H. R. 8014

March 19, 2026

Ms. Lofgren introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committees on the Judiciary, and Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To provide for individual rights relating to privacy of personal information, to establish privacy and security requirements for covered entities relating to personal information, and to establish an agency to be known as the Digital Privacy Agency to enforce such rights and requirements, and for other purposes.

1. Short title; table of contents; 2. Definitions; 3. General provisions; 4. Limitation on disclosing nonredacted government records; 5. Criminal prohibition on doxxing; TITLE I—INDIVIDUAL RIGHTS; 101. Right of access; 102. Right of correction; 103. Right of deletion; 104. Right of portability; 105. Right to human review of automated decisions; 106. Right to individual autonomy; 107. Right to be informed; 108. Right to impermanence; 109. Exemptions, exceptions, fees, timelines, and rules of construction for rights under this title; TITLE II—REQUIREMENTS FOR COVERED ENTITIES, SERVICE PROVIDERS, AND THIRD PARTIES; 201. Minimization; 202. Minimization and records of access by employees and contractors; 203. Prohibitions on disclosing of personal information; 204. Disclosing to entities not subject to United States jurisdiction or not compliant with this Act; 205. Prohibition on re-identification; 206. Restrictions on collecting, processing, maintaining, and disclosing contents of communications; 207. Prohibition on discriminatory processing; 208. Requirements for notice and consent processes and privacy policies; 209. Prohibition on “dark patterns” in notice and consent processes and privacy policies; 210. Notice and consent required; 211. Privacy policy; 212. Information security requirements; 213. Notification of data breach or data-sharing abuse; TITLE III—DIGITAL PRIVACY AGENCY; 301. Establishment; Director and Deputy Director; 302. Agency powers and authorities; 303. Reporting and audit requirements; 304. Relation to other agencies; 305. Personnel; 306. Office of Civil Rights; 307. Complaints of individuals; 308. Advisory boards; 309. Authorization of appropriations; TITLE IV—ENFORCEMENT; 401. Investigations and administrative discovery; 402. Hearings and adjudication proceedings; 403. Litigation authority; 404. Enforcement by States; 405. Private rights of action; 406. Relief available; 407. Referral for criminal proceedings; 408. Whistleblower enforcement; TITLE V—RELATION TO OTHER LAW; 501. Effective date; 502. Relation to other Federal law; 503. Relation to State law; 504. Severability; TITLE VI—NIST AND NSF ACTIVITIES; 601. National Institute of Standards and Technology privacy research and development; 602. National privacy awareness and education initiative; 603. National Science Foundation privacy research