I 

112TH CONGRESS 

1ST SESSION H. R. 3730 

To amend title 38, United States Code, to require the Secretary of Veterans 

Affairs to provide notice to individuals whose sensitive personal information is involved in a data breach, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 19, 2011 

Mr. DONNELLY of Indiana (for himself and Mr. JOHNSON of Ohio) introduced 

the following bill; which was referred to the Committee on Veterans’ Affairs 

A BILL 

To amend title 38, United States Code, to require the Secretary of Veterans Affairs to provide notice to individuals 

whose sensitive personal information is involved in a 

data breach, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Veterans Data Breach 

5 Timely Notification Act’’. 


jlentini on DSK4TPTVN1PROD with BILLS
2 

•HR 3730 IH

1 SEC. 2. NOTIFICATION BY THE SECRETARY OF VETERANS 

2 AFFAIRS OF INDIVIDUALS WHOSE SENSITIVE 

3 PERSONAL INFORMATION IS INVOLVED IN A 

4 DATA BREACH. 

5 (a) IN GENERAL.—Subchapter III of chapter 57 of 

6 title 38, United States Code is amended by inserting after 

7 section 5724 the following new section: 

8 ‘‘§ 5724A. Data breach notification 

9 ‘‘(a) NOTIFICATION REQUIREMENT.—Except as pro10 vided in subsection (d), in the event of a data breach with 

11 respect to sensitive personal information that is processed 

12 or maintained by the Secretary, by not later than five busi13 ness days after the data breach, the Secretary shall notify 

14 the appropriate committees of Congress and each indi15 vidual whose sensitive personal information is involved in 

16 the data breach is notified of the data breach. If the Sec17 retary determines that providing such notification within 

18 five business days is not feasible due to circumstances nec19 essary to accurately identify the individuals whose sen20 sitive personal information is involved in the data breach 

21 or to prevent further breach or unauthorized disclosure 

22 and reasonably restore the integrity of the data system 

23 the Secretary shall provide such notification not later than 

24 10 business days after the data breach. 

25 ‘‘(b) CONTRACTS FOR DATA PROCESSING OR MAIN26 TENANCE.—If the Secretary enters into a contract for the 


jlentini on DSK4TPTVN1PROD with BILLS
3 

•HR 3730 IH

1 performance of any Department function that requires ac2 cess to sensitive personal information, the Secretary shall 

3 require as a condition of the contract that the contractor 

4 agree to provide notification of data breaches in the same 

5 manner as required of the Secretary under subsection (a). 

6 ‘‘(c) METHOD AND CONTENT OF NOTIFICATION.— 

7 (1) Notification provided to an individual under subsection 

8 (a) shall be provided clearly and conspicuously by one of 

9 the following methods: 

10 ‘‘(A) Written notification. 

11 ‘‘(B) Notification by email or other electronic 

12 means, if the Secretary’s primary method of commu13 nication with the individual is by email or such other 

14 electronic means. 

15 ‘‘(2) Regardless of the method by which notification 

16 is provided to an individual under paragraph (1), such no17 tification shall include— 

18 ‘‘(A) a description of the sensitive personal in19 formation involved in the data breach; 

20 ‘‘(B) a telephone number that the individual 

21 may use, at no cost to the individual, to contact an 

22 appropriate employee of the Department to inquire 

23 about the data breach or the individual’s sensitive 

24 personal information maintained by the Department; 


jlentini on DSK4TPTVN1PROD with BILLS
4 

•HR 3730 IH

1 ‘‘(C) notice that the individual is entitled to re2 ceive, at no cost to such individual, credit protection 

3 services under section 5724 of this title; 

4 ‘‘(D) the toll-free contact telephone numbers 

5 and addresses for the major credit reporting agen6 cies; and 

7 ‘‘(E) a toll-free telephone number and website 

8 address whereby the individual may obtain informa9 tion regarding identity theft. 

10 ‘‘(d) NOTIFICATION OF GENERAL PUBLIC.—The Sec11 retary, acting through the Office of Public Affairs of the 

12 Department, shall notify the general public concerning any 

13 data breach involving sensitive personal information by 

14 not later than five working days after the incident, unless 

15 the Secretary determines that to do so is not feasible due 

16 to circumstances necessary to accurately identify the indi17 viduals whose sensitive personal information is involved in 

18 the data breach or to prevent further breach or unauthor19 ized disclosure and reasonably restore the integrity of the 

20 data system, such notification shall be made as soon as 

21 possible. 

22 ‘‘(e) APPROPRIATE COMMITTEES OF CONGRESS.—In 

23 this section, the term ‘appropriate committees of Con24 gress’ means the Committee on Veterans Affairs’ of the 


jlentini on DSK4TPTVN1PROD with BILLS
5 

•HR 3730 IH

1 House of Representatives and the Committee on Veterans’ 

2 Affairs of the Senate.’’. 

3 (b) CLERICAL AMENDMENT.—The table of sections 

4 at the beginning of such chapter is amended by inserting 

5 after the item relating to section 5724 the following new 

6 item: 

‘‘5724A. Data breach notification.’’. 

7 (c) EFFECTIVE DATE.—The amendments made by 

8 this section shall apply with respect to a data breach oc9 curring on or after the date that is 90 days after the date 

10 of the enactment of this Act. 

Æ 


jlentini on DSK4TPTVN1PROD with BILLS