1. Short title This Act may be cited as the Data Broker List Act of 2019 . 2. Requirements for data brokers (a) Requirements with respect to the acquisition and use of brokered personal information A data broker shall not— (1) acquire brokered personal information through fraudulent means; (2) acquire or use brokered personal information for the purpose of— (A) stalking or harassing another person; (B) committing fraud, including identity theft, financial fraud, or e-mail fraud; or (C) engaging in unlawful discrimination, including unlawful discrimination in decisions regarding employment, housing, and credit eligibility; or (3) sell or transfer brokered personal information to a third party if the data broker knows or reasonably should know that the third party intends to engage in any conduct prohibited by this Act. (b) Duty To protect brokered personal information (1) In general A data broker shall develop, implement, and maintain a comprehensive information security program in order to protect from security breaches or other inadvertent or improper disclosure the brokered personal information acquired by the data broker. (2) Program requirements The comprehensive information security program required under paragraph (1) shall— (A) be written in one or more readily accessible parts; and (B) contain administrative, technical, and physical safeguards that are appropriate to— (i) the size, scope, and type of business of the data broker; (ii) the amount of resources available to the data broker; (iii) the amount of stored data of the data broker; and (iv) the need for security and confidentiality of brokered personal information. (c) Annual registration (1) In general Annually, on or before January 31, a data broker shall— (A) register with the Commission