H.R. 9857: Protecting Americans from Doxing and Political Violence Act

This bill would create new privacy protections for Members of Congress, certain congressional employees, their immediate family members, and former Members of Congress. It is aimed at limiting the public spread of personal information that could be used for harassment, doxing, or targeting.

What information would be protected

The bill defines “covered information” to include personal details such as:

• Home addresses, including primary and secondary residences
• Home or personal mobile phone numbers
• Personal email addresses
• Social Security numbers and driver’s license numbers
• Bank account and credit or debit card numbers
• License plate numbers or other unique vehicle identifiers
• Information identifying a child under 18
• School or day care names, addresses, schedules, or routes
• Routes to or from work
• Precise, non-anonymized geolocation data that could identify a device’s location

Some information already required to be filed with election authorities or under election laws would not be covered by these restrictions.

Government records and agency websites

Covered individuals could notify government agencies that they want their protected information, and that of their immediate family members, marked as private. Government agencies would be barred from publicly posting or displaying that protected information. If a request is made, the agency would have to remove the information from publicly available content within 72 hours.

The bill also allows access to such records in some situations, including when a requester has a signed release, a court order, a required financial privacy status, or a confidentiality agreement with the agency.

Data brokers and online businesses

The bill would make it unlawful for data brokers to knowingly sell, license, trade, or buy covered information about a covered person, which includes U.S. individuals and U.S. persons. State attorneys general and the U.S. Attorney General could seek court orders to enforce this rule.

For other businesses, if an at-risk individual or their family member asks in writing, they generally would have to:

• Remove the covered information from the internet within 72 hours
• Make sure it is not available on websites they control
• Stop transferring that information to others

These requirements would not apply in certain situations, such as:

• News reporting, commentary, editorial content, or other speech on matters of public concern
• Information the person voluntarily publishes online after the bill becomes law
• Information lawfully obtained from a federal government source

Legal remedies and limits

If protected information is made public because the rules were violated, the affected individual could ask a court for an injunction or declaratory relief.

The bill says it should not be read to stop lawful press reporting on alleged misconduct or matters of public concern, to block access to Members of Congress’s public actions or statements, to prevent disclosure required by federal law, or to limit information sharing by data brokers with government entities. It also says the law should be interpreted broadly to protect the covered information.

Relevant Companies

• ACN - Accenture, and similar firms that provide data aggregation or data brokerage-related services, could face compliance impacts if they handle covered personal information for sale or licensing.
• EFX - Equifax, as a consumer reporting agency, is excluded from the data broker definition when acting under the Fair Credit Reporting Act, but related data-handling practices could still be affected in limited areas.
• EXPN - Experian, similar to other credit reporting firms, could see limited impacts where its business overlaps with personal data collection or distribution outside FCRA-covered activity.
• TRI - Thomson Reuters, through data and information products, could be indirectly affected if any offerings involve the collection or resale of personal information covered by the bill.
• RELX - RELX, which operates data and analytics businesses, could face compliance considerations if it handles restricted personal information in ways covered by the bill.