to secure personal information and to provide notice to individuals when such information is compromised this bipartisan bill originally was introduced in the hundred ninth congress by representative stearns who was then chairman of the sub committee on commerce trade and consumer protection it was introduced in this congress by subcommittee chairman rush i will be introducing a bipartisan manager's amendment in the nature of a substitute that makes a number of substantive changes to h r twenty two twenty one which i'll explain in more detail upon introduction the second bill will be considering today's h r thirteen nineteen the in form p d p user act this also was a bipartisan bill we are all too familiar with the dangers of inadvertent sharing of sensitive information through the use or misuse of certain file sharing programs tax returns medical files and even classified government documents have been found on these networks the purpose of h r thirteen nineteen is to reduce inadvertent disclosures of sensitive information by making the users of this software more aware of the risks involved this important bill was introduced by representative bono mack along with ranking member barton and representative barrow as with the previous bill all the introducing a bipartisan manager's amendment in the nature of a  so i hope my colleagues at all support the same in the same way that you gave to me in my bill one hundred one congress i would like to thank a chairman rush for his leadership in reintroducing the day to bail and i'm pleased the bill has progress through our committee in a strong bipartisan way i thank chairman for his efforts in the bipartisanship manager's amendment that he will offer today which makes a few important changes and i think clarifies certain chairman of the full committee and and the ranking member and the chairman of the subcommittee of the ranking member i would like to recognize members for one minute for an opening statement who seeks recognition  do protect religion i'm a peer to peer usage you know this is obviously a rapidly changing technology i think the bill today as it stands would unintentionally perhaps cover some commercial products that have significant value that will be an everyday hughes and i hope that we have an opportunity for some further work improving the bill to make sure that we don't unintentionally sweep up in any prohibitive language peer peer filing that  haggis legitimate value both economically and for consumers and i look forward to working with you mr chair before we get to the floor to to make those improvements thank you very much thank you very much  republican side members wish to be mr radanovich mr chairman thank you very much today will consider two bills that i intend to support the h r twenty two twenty one the date accountability and trust act represents committees bipartisan effort dating back to the one hundred ninth congress congress to address data breach problems at the federal level this legislation balances requirements congress recognize starting back in two thousand and five first it sets a federal standard for business to protect sensitive personal information it maintains and second it requires notification to customers when their data has been breached and finally it provides consumers with some tools to help mitigate the problems that might arise from the data being misused add one comment for consideration the jurisdiction of the f t c does not extend to nonprofits or educational institutions unfortunately that means this legislation before us will not cover a substantial source of data breaches many colleagues in universities have been hacked or had computer stolen they are repast tori's of volumes of personal data about the current former students consumers want to know that their data is safe regardless of the entity that holds it will work i hope that we can with other committees toward filling the gap as this lead slash and moves forward turning to h r thirteen one thousand i want to echo the ranking member barton's remarks about the committee process because we work closely with the majority the co sponsors and the industry and consumer groups to get the technical issues taken care of we agreed by passing subcommittee by bypassing subcommittee in this rare case as being acceptable i want to recognize ms bono mack's leadership on the digital security over the years the legislation we're considering today to prevent inadvertent file sharing and peer to peer networks is an important step and giving consumers more tools to protect their sensitive information informing consumers and allowing them to make an educated choice is a framework that we can all stand behind and that's exactly what this bill does miss bono mack brought her attention to these issue in the previous congress introducing an earlier version of the bill file sharing software has many legitimate and important uses but it can present potential privacy and security issues as evidenced by multiple instances of inadvertent sharing of sensitive files across peer to peer networks in the past year however not only have many thousands of personal financial and health records been found on these networks but  discovered on a p two p server in iran these are clearly not legitimate uses the problem of inadvertent sharing is exacerbated by the actual architecture of the programs it's often unclear to a user what files may be open to others on the network and it can be difficult to change settings to prevent it now with the help of stakeholders i believe that we have carefully tailored this bill to address this problem without doing damage to the p two p software or discouraging innovation and in this space i commend all those involved i'm glad that we're moving forward on this legislation as a father i'm glad to support the bill because it improves the children's safety our children's safety in a digital world and finally mr chairman i understand that  addition i would like to thank legislative council and committee staff specifically mark roman and will carty for their outstanding work on this bill from the beginning this has been a bipartisan bill and their cooperation has been essential the risks associated  with file sharing programs have been widely reported by the media and thoroughly investigate investigated by congress previously we have held hearings where stakeholders made promises but the problem of inadvertent file sharing process normally i support offering industry the opportunity to sell regulate but when it comes to entities such as long wire who repeatedly and clearly disregard the could consumer's interests it's clear the time of self regulation is passed today by passing the informed p d p user act we move closer to the consumer with the input with the information to protect themselves while drafting this bill we sought to do three things one create a system where users of file sharing programs are provided with conspicuous notice and forced to give consent prior to installation and activation of a file sharing program to require entities who market and develop file sharing programs to make it reasonably simple to block or to remove these programs once installed and three to not discourage the legitimate of file sharing technology with h r thirteen nineteen i believe we've accomplished these goals my bill would require an easy to understand notice and consent rule for file sharing software it is my belief that the consumer will make the best choice when provided with clear easy to understand information additionally my bill requires entities who distribute file sharing programs to make it simple to prevent these file sharing programs from being loaded onto their computers and also easy to remove after they are loaded onto a computer finally h r thirteen nineteen exams technologies like e mail instant messaging real time audio or video communications and real time voice communications to ensure a narrow scope again i would like to thank find work on h r two two two one the data cut ability trust this important legislation requires the federal trade commission to promulgate regulations for the improved protection of personal information  understand my colleague ms bono bax concern for preserving the individual's right to consent to sharing information stored on computer disks with others via peer to peer file sharing program  consideration or rather on consideration this committee is the subject of behavioral advertising finite i like to comment briefly on h r two one which is not being called up this morning i believe that it's important that we should reduce berkeley emissions particularly with regard to the nation's great lakes i understand that the bill has been fulfilled and i believe that this is a good idea i've understand my colleagues from ohio and georgia have legitimate concerns about the effect of this bill and i believe the committee would want to inquire as to whether or not this legislation should be necessary or whether it should better be considered health care amendments you work with me and others to put in a transparency provision and i'm very appreciative of that and i mention you by name and mr green by name and  mention my good friend mr stupak by name and congressman stupak has worked very hard on transparency and worked closely with me and my staff and i didn't mention his name i do want to apologize to him because he has been a tagger on that issue and i felt very badly that i didn't compliment him on this bill or bills mr chairman first let me compliment you for pulling the mercury bill i think that would have been a long drawn out process had you wanted to mark the bill up and i think it was the wise decision to remove it from today's markup i won't say any more about it but i compliment you on that on the other two bills we do have in cooperation h r twenty two twenty one is known as a data bill this is something that we consider in the committee in the hundred ninth congress it's still timely because it addresses an important problem the breach of personal information and notification to people who are affected so that they can take appropriate precautions we've worked on this issue together in the past and i'm pleased that the force today as a result of that those bipartisan discussions in the past as this bill moves through subcommittee we did agree on a manager's mark containing several commonsense amendments in response to legitimate stakeholder concerns we also pledged to continue working on the provisions that required more attention today we have a chairman's mar threat this legislation will help guard against criminals malicious behavior stablish is a national requirement for companies to maintain enhanced security of consumers personal data additionally consumers will benefit from notification in order to take swift proactive measures to protect their identity i think this is a good bill and i hope everyone on the committee supports it on the second bill h r thirteen nineteen simple straightforward bill for people install peer to peer  software should be made aware of what it does p two p technology allows for easy sharing of files between users but it can also facilitate accidental sharing of personal files despite some effort by some in the industry there's been no consensus solution developed to address the problem h r thirteen nineteen establishes a clear choice of notice and consent regime it requires p two p to be accompanied by a notice that a human being of average intelligence can read and actually understand that means me mr practice of forcing the installation of p two p or preventing its removal given the state of the industry in the many reports of identity theft and security breaches i hope that we pass this bill i want to win congresswoman bono mack for bringing this issue to our to thank you mr chairman and subcommittee chairman rush for your bipartisanship in this effort i want to thank all the stakeholders who work very closely with various staff to solve the complicated technical issues i also have to make some comment on the process everybody here knows how much i love the reliable value of regular order in nearly everything that we do on the committee but there are some exceptions for every rule today we have before us that reasonable exception given the complex technical issues i've already mentioned we made a bipartisan decision on when emphasize that bipartisan i was a part of it to bypass the subcommittee markup while we work collaboratively to get this bill right i want to matheson thank you mr chairman i do want to really thank the committee staff particular mark gorman of your staff are working with my office to help improve h r twenty two twenty one the data act everyone knows data security is a very important issue which is why i've worked  the legislation protect consumers and does not need to sleep complicated foresman in compliance with the law and mr chairman i want to thank you on the magical memet i think the nature of a substitute has made good improvements on the original legislation i hope we can continue to work on the bills or move to the floor in order to minute minimize any potential diplomatic or inconsistent regulation is necessary and again mr chairman i want to thank you for working with me you and your staff been very helpful all yelled back thank you very much mr matheson on the republican consumer protection subcommittee two bills under consideration today h r twenty two twenty one and thirteen nineteen have been drafted a fully bipartisan way and certainly look forward to reporting them to the full house however have significan about h r twenty one ninety the mercury pollution reduction act although we now know that that bill has been pulled mr chairman this legislation twenty one ninety bans the manufacture of chlorine using the mercury cell process within two years and immediately banned the export of elemental mercury h r twenty one nine hundred only of thanks for facilities across the country but one of them happens to be in my hometown of augusta georgia the companies that will be disproportionately affected by the legislation have already unequivocally stated that if this bill is passed as written it will be more than a thousand jobs good manufacturing workers without a job in augusta the whole incorporation this will directly impact close to two hundred workers removing nine million dollars in annual payroll and reduce economic in impact to generate close to twenty five million dollars and goods and services by the local community mr chairman tamina national unemployment is close to maybe even now beyond ten percent we can't afford to pass harmful legislation that would put even more hard working americans out of work i'm glad that in your wisdom mr chairman that this bill was pulled i look forward to working very closely with mr butterfield thank you very much mr chairman for convening this hearing let me go on record mr chairman and say to you that i am definitely in support of the two bills that before us for consideration and i hope that the chairman and the ranking member and others can work trying to resolve their concerns on her bill thomas chairman the rush bill provides immediate protections to personal data during the subcommittee consideration offered an amendment to better protect consumers victimized by data breaches after working with the chairman and staff valuable protection has been added as part of the manager's amendment and these provisions require that victims be provided two years of credit monitoring services at absolutely no cost this will not undo the initial breach it will provide victims peace of mind as they move forward i also support them as bono macksville mr chairman that's the informed in order to ensure that uses a better aware that potentially sensitive information inadvertently shared and that action may be required to safeguard personal information say good work both of these authors look forward to supporting each of these bills and the balance of gentlemen back to balance as time thank you mr chairman i thank you for this markup today and i am appreciative of the fact that you have pulled the marc rich pollution reduction act we in tennessee do have some very serious concerns about that legislation and we look forward to working with you on making certain that we address those concerns in the appropriate way h r starting nineteen the informed p d p user to as we continue to try to highlight id theft and piracy and the linkage tween those two issues how it leads to cyber crime the markup that we're having today of twenty to twenty one for the data act and then also for the p d p act we appreciative of the good work that is gone they are looking at these as crimes providing the appropriate notifications and awareness and continuing to bring these issues in the concerns with p d p users and also with mr chairman i support both of the piece of legislation that are up today i do want to say something about the data accountability trust act which i have worked on for several years now along with many members of the committee and the bill offers strong consumer protections which will help prevent data breaches and inform consumers when they when they do have to happen it also includes provisions that i worked on the provide americans with additional rights when dealing with data brokers those companies that make their money buying and selling the personal information of consumers now information brokers of required to ensure the accuracy of their data consumers will have access to the information maintained by the companies and the right to request resolution of inaccurate information regarding h r twenty one ninety which a number of members are referred to the work through bill i do look forward to working with my colleagues but i do also want to remind them that we're talking about a very dangerous substance here and the the importance of acting on this cannot be overstated so i look forward to making sure that in a couple of weeks now we will be able to consider and nineteen the in form peer to peer user act which i co sponsored with congresswoman bono mack this bill tackles the privacy and security risk that come with peer to peer file sharing programs a lot of folks who connect these networks don't even realize that the most personal and private files are visible to everyone else in the network at any time they're posting their tax returns financial records and personal messages on the internet don't even know it i hope that i work on those committee will come up with a strategy to let folks know in a way they can understand when the information on their computers at risk we have opening statement the chair calls up  the chair calls up twenty two twenty one asked the clerk to report the bill h r twenty two twenty one a bill to protect consumers by requiring reasonable security policies and procedures to protect computerized data contained containing personal information and to provide for nationwide notice in the event of a security breach without objection the reading of the bill will be waived and the chair recognizes himself to acting closet insert following section one short title without objection that the amendment will be considered as read chair recognizes himself the bipartisan substitute amendment i am offering incorporates the changes made at the subcommittee markup and strengthens the bill this a meme is the result of a cooperative process staff reached out to stakeholders and improved an already good piece of legislation i'd like to thank members of staff from both sides of the aisle for their work on this bill in particular i'd like to thank mr rush for his leadership and for introducing this critical piece of legislation i also would like to acknowledge mr stearns mr barton mr read danovitch and mischa koski for working in a bipartisan fashion to move this important legislation forward a bipartisan manager's amendment makes a number of changes to the bill highlight these the most significant of these we streamline the f t c is ability to conduct rule making concerning the destruction of paper documents in addition t amendment clarifies our intent to avoid overlapping inconsistent or duplicative regulations the amendment also modifies the pipes exemption to ensure that those entities that are serving as conduits of information are not subject to the data security requirements of the act when they are simply transmitting data furthermore the management narrows the definition of information broker to ensure that it covers only those entities that collect personal information in order to sell such information to third parties and not enjoy these to collect information to provide services to third parties the amendment makes several changes that will impact the regulation of these entities moreover the amendment makes changes that will improve notifications to consumers regarding data breaches importantly the manager's amendment provides that in certain circumstances consumers who have been impacted by a breach may be offered credit monitoring which actively monitors a consumer account for signs of misuse in lieu of quarterly credit reports this provision benefits consumers and businesses alike because because not all breaches of the same and different remedies may be appropriate in different circumstances i'd like to think mr butterfield for proposing this important provision and for his leadership on behalf of american consumers this change will encourage innovation and competition and will  provide better services for consumers whose information was compromised finally the manager's amendment clarifies that the bill only applies to commercial entities subject to f t c jurisdiction i urge my colleagues to support the manager's amendment in the nature of a substitute recognize mr parker thank you mr chairman the minority also supports this bipartisan piece of legislation the base bill as a democrat to the bill that passed this committee in the hundred ninth congress did not get to the floor because dispute between this committee and the financial services committee i'm sure with your leadership will get over that hurdle and get the bill to the floor and hopefully get to the senate and have him pass it the changes that you enumerated in the manager's amendment we all support there was one change that i don't believe you mentioned this does also the manager's memo does expand the accepted methods for protection of data to include in christian or other accepted technologies or methodologies to provide a more technology neutral approach and the manager's amendment also clarifies that the civil penalties for each violation are capped at five million in total rather than per each prosecution per state mr chairman we support the bill we support the manager's amendment and we look forward to passing this bill very quickly on a bipartisan basis thank you mister any member wish to be heard on the manager's amendment hear from mrs ascher i thank you mr chairman first of all for bringing up these bills and i look forward to the work that will continue on the one that's not bringing brought up today because it is an important one that we need to address on the manager's amendment first of all i maintain the same reservations that i've expressed consistently since two thousand and six i have core support strongly the data security legislation i really main committed to protecting consumers and businesses in the harmful effects data breaches but when it comes to the safe harbor provision that encourages market based incentives for the adoption of stronger security measures measures and mr barton just mentioned this i think the legislation absolutely must be technology neutral during our discussion and debate and taking up the bill not health information technology i also pointed this out to a section that applied as it does in this legislation and i think that we need to really stick to being technology neutral now some may say well you're being picky and what's in one word plenty plenty is in one word  legislation as originally written exempted data that is unreadable or indecipherable but not unusable and unusable is the operative word that one word emission means the difference between exclusivity using encryption technology or encouraging other equally efficient technologies that would serve the same purpose or even be more effective so while the subcommittee marking now the manager's amendment contains the word  unusable it does contain the word unusable the and so my point is that that still leaves so i'm not going to offer an amendment on this what i'd like to ask you mr chairman is for your commitment that the report language will state that the legislation is not intended to suggest that encryption methods alone are capable of securing personal information and that the f t c must consider all technologies on an equal basis for is safe harbor protection i think there's some confusion when the word encryption is used i think people think that it's a very broad term it actually is very specific and so that's why i raise this and i think that  are doing that that it would really straighten this area out i think you raise an important point to really try to address that in the language but i think the report language would clarify that even more would be pleased to work with you on thank you very much m any further discussion on the manager's amendment yes let's recognize the service i just wonder if i might is the question of counsel for clarification jim is recognized for five minutes i counsel on page twelve of both the underlying bill and the manager's amendment the phrase is used if the broker knew or should have known that the person to whom a quick rest is made will obtain or attempt to obtain such information in a manner described in sub paragraph a which is a false or fake obtaining information a false or fictitious matter i'm just a little bit concerned about the the vagueness of knew or should have known do we have any any real world applications are there other in other bills where this has proven to be useful use of phraseology or is it something that we should perhaps look to tighten up as as this moves through the process i'm just taking a very close look at the language chairman the interest of time i'm sorry a little bit when you might just if this is something we could look at is as this thing moves forward in the process i just want to be sure where as precise as possible when and we all know when these things get to the various federal agencies or the rules are written sometimes things can look different when they come back to us so i'd just like to be certain have some degree of certainty on this as we move forward i think is a gentleman yield i think you raise an important point let's continue to look at it i think other statutes of use that language but i think your point is that we don't we don't want it to be too vague and so let's review it as we move forward right now you'll back thank mr further discussion of the manager's amendment if not the vote now comes on the manager all those in favor say aye i oppose no management better jer's of members adopted the motion now comes to comes to us to report the order reported h r twenty two twenty one as amended with the usual r thirteen nineteen a bill to prevent the end of a very disclosure of information on computers on a computer through the use of certain peer to peer file sharing software without first providing notice and as a result of a cooperative process staff reached out to stakeholders and improve this in port legislation by addressing several concerns i would like to think represented bono man mack barrow and barton for their leadership in raising awareness about the risks of file sharing software and for introducing this legislation i would also like to acknowledge the efforts of chairman rush and ranking member of a dozen of its file sharing software enables users to share files over the internet by accessing each other's computer hard drives lawful application applications of file sharing technology provide enormous benefits to business academia and individuals however the use of certain file sharing software  presents significant risks for consumers through the inadvertent sharing of sensitive files inadvertent file sharing has led to countless sensitive documents being disclosed including social security numbers tax returns health records and even classified government documents inadvertent file sharing is not a new problem and despite calls from congress for the file sharing industry to clean up its act the problem persists the purpose of this bill inadvertent disclosures of sensitive information by making users of file sharing programs more aware of the risks involved short this bill is about notice and consent the bill does not prohibit t use or distribution of file sharing programs requires that if such programs are distributed they provide the user with clearing conspicuous notice that programs will allow files to be shared the program must subject to civil penalties in response to concerns of the bill as introduced was overbroad the manager's amendment narrows the definition of a car covered file sharing program to avoid sweeping and le technologies that are unrelated to the problem of inadvertent file sharing a member also adds a new definition for covered entity that limited liability under the bill additionally the better jobs amendment provides f t c with  discretionary rule making authority and clarifies that the bill does not apply to the federal government by colleagues to support the manager's amendment in the nature of a substitute i wish to recognize mr barton thank you m chairman i'm not going to take long because i want congresswoman bono mack to have the ability to really go into the bill in depth if she wishes to do so suffice it to say that this is a good piece of work i want to commend you and mr rush for bringing it to the committee os want to thank congressman barrow of georgia for his co authorship with mrs bono back and of course thank mary for all that she's done on this for the number of years that she's worked on it i think this is a good bill i think it needs to be passed this p t p software is benign if used properly but it can be very dangerous if used improperly so with that mr chairman i support the you mr rush for the recognition mr doyle mr chairman i would like to engage in a colloquy with you gentlemen to recognize thank you mr chairman i agree with the intent of the proposed legislation consumers should be aware of what they're doing with their computers especially when it might clearly risk their privacy and i want to acknowledge the efforts of you and mr barton mr barrow and ms bono mack and the committee staff to respond to the concerns of stakeholders that h r thirty nine thousand is overbroad and sweeps in legitimate technologies unrelated to the problems this bill seeks to address i am concerned that despite these efforts the bill still needs some additional tweaking i'm worried that an overbroad definition of file sharing program could result in over notification to consumers and cause consumers to ignore notices because they appear so frequently it's my hope that as we move the bill to the floor the definition of covered file sharing program can be reviewed to determine if it should be narrowed further the general would yield i think i think if your comments on h r thirteen nineteen i understand appreciate your concerns since the legislative hearing on h r thirteen nineteen staff from both sides of the aisle have been working and i fully bipartisan fashion with calder's to narrow the scope and breadth of the bill our staff has made tremendous progress on this front the extensive changes in the manager's amendment are evidence of this progress and the committee's attempt to accommodate stakeholders concerns there is no policy disagreement here we do not want to sweep in technologies that are unrelated to the problem this bill is intended to address the inadvertent sharing  files to the extent that the definition of covered file sharing program may continue to be overbroad and capture legitimate technologies we want to work with you to address that concern i personally look forward to working with  gentleman from pennsylvania on h r thirteen nineteen as we move forward thank you mr chairman further discussion of the manager's amendment if not let's proceed to a vote on the manager's amendment in the nature of a substitute all those in favor say   to offer those amendments to this legislation are there further amendments thirteen nineteen good thing there aren't because we just adopted the substitute but that means we can move forward to report h r thirteen nineteen as amended with the usual instructions in favor that motion say i the ayes have it and the amendments agree to that concludes our markup for today