```

[House Report 109-453]
[From the U.S. Government Publishing Office]

109th Congress                                            Rept. 109-453
                        HOUSE OF REPRESENTATIVES
 2d Session                                                      Part 2

======================================================================

 
                DATA ACCOUNTABILITY AND TRUST ACT (DATA)

                                _______
                                

                  May 26, 2006.--Ordered to be printed

                                _______
                                

 Mr. Sensenbrenner,  from the Committee on the Judiciary submitted the 
                               following

                              R E P O R T

                        [To accompany H.R. 4127]

          [Including Committee on the Judiciary cost estimate]

    The Committee on the Judiciary, to whom was referred the 
bill (H.R. 4127) to protect consumers by requiring reasonable 
security policies and procedures to protect computerized data 
containing personal information, and to provide for nationwide 
notice in the event of security breach, having considered the 
same, report favorably thereon with an amendment and recommend 
that the bill as amended do pass.

                                CONTENTS

                                                                   Page
The Amendment....................................................     1
Purpose and Summary..............................................     9
Background and Need for Legislation..............................    10
Hearings.........................................................    11
Committee Consideration..........................................    12
Vote of the Committee............................................    12
Committee Oversight Findings.....................................    12
New Budget Authority and Tax Expenditures........................    12
Committee Cost Estimate..........................................    12
Performance Goals and Objectives.................................    13
Constitutional Authority Statement...............................    13
Section-by-Section Analysis and Discussion.......................    13

                             THE AMENDMENT

    The amendment is as follows:
    Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Data Accountability and Trust Act 
(DATA)''.

SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY.

    (a) General Security Policies and Procedures.--
          (1) Regulations.--Not later than 1 year after the date of 
        enactment of this Act, the Commission shall promulgate 
        regulations under section 553 of title 5, United States Code, 
        to require each person engaged in interstate commerce that owns 
        or possesses data in electronic form containing personal 
        information, or contracts to have any third party entity 
        maintain such data for such person, to establish and implement 
        policies and procedures regarding information security 
        practices for the treatment and protection of personal 
        informtion taking into consideration--
                  (A) the size of, and the nature, scope, and 
                complexity of the activities engaged in by, such 
                person;
                  (B) the current state of the art in administrative, 
                technical, and physical safeguards for protecting such 
                information; and
                  (C) the cost of implementing such safeguards.
          (2) Requirements.--Such regulations shall require the 
        policies and procedures to include the following:
                  (A) A security policy with respect to the collection, 
                use, sale, other dissemination, and maintenance of such 
                personal information.
                  (B) The identification of an officer or other 
                individual as the point of contact with responsibility 
                for the management of information security.
                  (C) A process for identifying and assessing any 
                reasonably foreseeable vulnerabilities in the system 
                maintained by such person that contains such electronic 
                data, which shall include regular monitoring for a 
                breach of security of such system.
                  (D) A process for taking preventive and corrective 
                action to mitigate against any vulnerabilities 
                identified in the process required by subparagraph (C), 
                which may include implementing any changes to security 
                practices and the architecture, installation, or 
                implementation of network or operating software.
                  (E) A process for disposing of obsolete data in 
                electronic form containing personal information by 
                shredding, permanently erasing, or otherwise modifying 
                the personal information contained in such data to make 
                such personal information permanently unreadable or 
                undecipherable.
          (3) Treatment of entities governed by other law.--In 
        promulgating the regulations under this subsection, the 
        Commission may determine to be in compliance with this 
        subsection any person who is required under any other Federal 
        law to maintain standards and safeguards for information 
        security and protection of personal information that provide 
        equal or greater protection than those required under this 
        subsection.
    (b) Destruction of Obsolete Paper Records Containing Personal 
Information.--
          (1) Study.--Not later than 1 year after the date of enactment 
        of this Act, the Commission shall conduct a study on the 
        practicality of requiring a standard method or methods for the 
        destruction of obsolete paper documents and other non-
        electronic data containing personal information by persons 
        engaged in interstate commerce who own or possess such paper 
        documents and non-electronic data. The study shall consider the 
        cost, benefit, feasibility, and effect of a requirement of 
        shredding or other permanent destruction of such paper 
        documents and non-electronic data.
          (2) Regulations.--The Commission may promulgate regulations 
        under section 553 of title 5, United States Code, requiring a 
        standard method or methods for the destruction of obsolete 
        paper documents and other non-electronic data containing 
        personal information by persons engaged in interstate commerce 
        who own or possess such paper documents and non-electronic data 
        if the Commission finds that--
                  (A) the improper disposal of obsolete paper documents 
                and other non-electronic data creates a reasonable risk 
                of identity theft, fraud, or other unlawful conduct;
                  (B) such a requirement would be effective in 
                preventing identity theft, fraud, or other unlawful 
                conduct;
                  (C) the benefit in preventing identity theft, fraud, 
                or other unlawful conduct would outweigh the cost to 
                persons subject to such a requirement; and
                  (D) compliance with such a requirement would be 
                practicable.
In enforcing any such regulations, the Commission may determine to be 
in compliance with such regulations any person who is required under 
any other Federal law to dispose of obsolete paper documents and other 
non-electronic data containing personal information if such other 
Federal law provides equal or greater protection or personal 
information than the regulations promulgated under this subsection.
    (c) Special Requirements for Information Brokers.--
          (1) Submission of policies to the ftc.--The regulations 
        promulgated under subsection (a) shall require information 
        brokers to submit their security policies to the Commission in 
        conjunction with a notification of a breach of security under 
        section 3 or upon request of the Commission.
          (2) Post-breach audit.--For any information broker required 
        to provide notification under section 3, the Commission shall 
        conduct an audit of the information security practices of such 
        information broker, or require the information broker to 
        conduct an independent audit of such practices (by an 
        independent auditor who has not audited such information 
        broker's security practices during the preceding 5 years). The 
        Commission may conduct or require additional audits for a 
        period of 5 years following the breach of security or until the 
        Commission determines that the security practices of the 
        information broker are in compliance with the requirements of 
        this section and are adequate to prevent further breaches of 
        security.
          (3) Verification of and individual access to personal 
        information.--
                  (A) Verification.--Each information broker shall 
                establish reasonable procedures to verify the accuracy 
                of the personal information it collects, assembles, or 
                maintains, and any other information it collects, 
                assembles, or maintains that specifically identifies an 
                individual, other than information which merely 
                identifies an individual's name or address.
                  (B) Consumer access to information.--
                          (i) Access.--Each information broker shall--
                                  (I) provide to each individual whose 
                                personal information it maintains, at 
                                the individual's request at least 1 
                                time per year and at no cost to the 
                                individual, and after verifying the 
                                identity of such individual, a means 
                                for the individual to review any 
                                personal information regarding such 
                                individual maintained by the 
                                information broker and any other 
                                information maintained by the 
                                information broker that specifically 
                                identifies such individual, other than 
                                information which merely identifies an 
                                individual's name or address; and
                                  (II) place a conspicuous notice on 
                                its Internet website (if the 
                                information broker maintains such a 
                                website) instructing individuals how to 
                                request access to the information 
                                required to be provided under subclause 
                                (I).
                          (ii) Disputed information.--Whenever an 
                        individual whose information the information 
                        broker maintains makes a written request 
                        disputing the accuracy of any such information, 
                        the information broker, after verifying the 
                        identity of the individual making such request 
                        and unless there are reasonable grounds to 
                        believe such request is frivolous or 
                        irrelevant, shall--
                                  (I) correct any inaccuracy; or
                                  (II)(aa) in the case of information 
                                that is public record information, 
                                inform the individual of the source of 
                                the information, and, if reasonably 
                                available, where a request for 
                                correction may be directed; or
                                  (bb) in the case of information that 
                                is non-public information, note the 
                                information that is disputed, including 
                                the individual's statement disputing 
                                such information, and take reasonable 
                                steps to independently verify such 
                                information under the procedures 
                                outlined in subparagraph (A) if such 
                                information can be independently 
                                verified.
                          (iii) Limitations.--An information broker may 
                        limit the access to information required under 
                        subparagraph (B) in the following 
                        circumstances:
                                  (I) If access of the individual to 
                                the information is limited by law or 
                                legally recognized privilege.
                                  (II) If the information is used for a 
                                legitimate governmental or fraud 
                                prevention purpose that would be 
                                compromised by such access.
                          (iv) Rulemaking.--The Commission shall issue 
                        regulations, as necessary, under section 553 of 
                        title 5, United States Code, on the application 
                        of the limitations in clause (iii).
                  (C) Treatment of entities governed by other law.--The 
                Commission may promulgate rules (under section 553 of 
                title 5, United States Code) to determine to be in 
                compliance with this paragraph any person who is a 
                consumer reporting agency, as defined in section 603(f) 
                of the Fair Credit Reporting Act, with respect to those 
                products and services that are subject to and in 
                compliance with the requirements of that Act.
          (4) Requirement of audit log of accessed and transmitted 
        information.--Not later than 1 year after the date of the 
        enactment of this Act, the Commission shall promulgate 
        regulations under section 553 of title 5, UnitedStates Code, to 
require information brokers to establish measures which facilitate the 
auditing or retracing of any internal or external access to, or 
transmissions of, any data in electronic form containing personal 
information collected, assembled, or maintained by such information 
broker.
          (5) Prohibition on pretexting by information brokers.--
                  (A) Prohibition on obtaining personal information by 
                false pretenses.--It shall be unlawful for an 
                information broker to obtain or attempt to obtain, or 
                cause to be disclosed or attempt to cause to be 
                disclosed to any person, personal information or any 
                other information relating to any person by--
                          (i) making a false, fictitious, or fraudulent 
                        statement or representation to any person; or
                          (ii) providing any document or other 
                        information to any person that the information 
                        broker knows or should know to be forged, 
                        counterfeit, lost, stolen, or fraudulently 
                        obtained, or to contain a false, fictitious, or 
                        fraudulent statement or representation.
                  (B) Prohibition on solicitation to obtain personal 
                information under false pretenses.--It shall be 
                unlawful for an information broker to request a person 
                to obtain personal information or any other information 
                relating to any other person, if the information broker 
                knew or should have known that the person to whom such 
                a request is made will obtain or attempt to obtain such 
                information in the manner described in subsection (a).
    (d) Exemption for Telecommunications Carrier, Cable Operator, 
Information Service, or Interactive Computer Service.--Nothing in this 
section shall apply to any electronic communication by a third party 
stored by a telecommunications carrier, cable operator, or information 
service, as those terms are defined in section 3 of the Communications 
Act of 1934 (47 U.S.C. 153), or an interactive computer service, as 
such term is defined in section 230(f)(2) of such Act (47 U.S.C. 
230(f)(2)).

SEC. 3. NOTIFICATION OF INFORMATION SECURITY BREACH.

    (a) Nationwide Notification.--Any person engaged in interstate 
commerce that owns or possesses data in electronic form containing 
personal information shall, following the discovery of a breach of 
security of the system maintained by such person that contains such 
data--
          (1) notify each individual who is a citizen or resident of 
        the United States whose personal information was acquired by an 
        unauthorized person as a result of such a breach of security; 
        and
          (2) notify the Commission.
    (b) Special Notification Requirement for Certain Entities.--
          (1) Third party agents.--In the event of a breach of security 
        by any third party entity that has been contracted to maintain 
        or process data in electronic form containing personal 
        information on behalf of any other person who owns or possesses 
        such data, such third party entity shall be required only to 
        notify such person of the breach of security. Upon receiving 
        such notification from such third party, such person shall 
        provide the notification required under subsection (a).
          (2) Telecommunications carriers, cable operators, information 
        services, and interactive computer services.--If a 
        telecommunications carrier, cable operator, or information 
        service (as such terms are defined in section 3 of the 
        Communications Act of 1934 (47 U.S.C. 153)), or an interactive 
        computer service (as such term is defined in section 230(f)(2) 
        of such Act (47 U.S.C. 230(f)(2))), becomes aware of a breach 
        of security during the transmission of data in electronic form 
        containing personal information that is owned or possessed by 
        another person utilizing the means of transmission of such 
        telecommunications carrier, cable operator, information 
        service, or interactive computer service, such 
        telecommunications carrier, cable operator, information 
        service, or interactive computer service shall be required only 
        to notify the person who initiated such transmission of such a 
        breach of security if such person can be reasonably identified. 
        Upon receiving such notification from a telecommunications 
        carrier, cable operator, information service, or interactive 
        computer service, such person shall provide the notification 
        required under subsection (a).
          (3) Breach of health information.--If the Commission receives 
        a notification of a breach of security and determines that 
        information included in such breach is individually 
        identifiable health information (as such term is defined in 
        section 1171(6) of the Social Security Act (42 U.S.C. 
        1320d(6)), the Commission shall send a copy of such 
        notification to the Secretary of Health and Human Services.
    (c) Timeliness of Notification.--All notifications required under 
subsection (a) shall be made as promptly as possible and without 
unreasonable delay following the discovery of a breach of security of 
the system and consistent with any measures necessary to determine the 
scope of the breach, prevent further breach or unauthorized 
disclosures, and reasonably restore the integrity of the data system.
    (d) Method and Content of Notification.--
          (1) Direct notification.--
                  (A) Method of notification.--A person required to 
                provide notification to individuals under subsection 
                (a)(1) shall be in compliance with such requirement if 
                the person provides conspicuous and clearly identified 
                notification by one of the following methods (provided 
                the selected method can reasonably be expected to reach 
                the intended individual):
                          (i) Written notification.
                          (ii) Email notification, if--
                                  (I) the person's primary method of 
                                communication with the individual is by 
                                email; or
                                  (II) the individual has consented to 
                                receive such notification and the 
                                notification is provided in a manner 
                                that is consistent with the provisions 
                                permitting electronic transmission of 
                                notices under section 101 of the 
                                Electronic Signatures in Global 
                                Commerce Act (15 U.S.C. 7001).
                  (B) Content of notification.--Regardless of the 
                method by which notification is provided to an 
                individual under subparagraph (A), such notification 
                shall include--
                          (i) a description of the personal information 
                        that was acquired by an unauthorized person;
                          (ii) a telephone number that the individual 
                        may use, at no cost to such individual, to 
                        contact the person to inquire about the breach 
                        of security or the information the person 
                        maintained about that individual;
                          (iii) notice that the individual is entitled 
                        to receive, at no cost to such individual, 
                        consumer credit reports on a quarterly basis 
                        for a period of 2 years, and instructions to 
                        the individual on requesting such reports from 
                        the person;
                          (iv) the toll-free contact telephone numbers 
                        and addresses for the major credit reporting 
                        agencies; and
                          (v) a toll-free telephone number and Internet 
                        website address for the Commission whereby the 
                        individual may obtain information regarding 
                        identity theft.
          (2) Substitute notification.--
                  (A) Circumstances giving rise to substitute 
                notification.--A person required to provide 
                notification to individuals under subsection (a)(1) may 
                provide substitute notification in lieu of the direct 
                notification required by paragraph (1) if--
                          (i) the person owns or possesses data in 
                        electronic form containing personal information 
                        of fewer than 1,000 individuals; and
                          (ii) such direct notification is not feasible 
                        due to--
                                  (I) excessive cost to the person 
                                required to provide such notification 
                                relative to the resources of such 
                                person, as determined in accordance 
                                with the regulations issued by the 
                                Commission under paragraph (3)(A); or
                                  (II) lack of sufficient contact 
                                information for the individual required 
                                to be notified.
                  (B) Form of substitute notice.--Such substitute 
                notification shall include--
                          (i) email notification to the extent that the 
                        person has email addresses of individuals to 
                        whom it is required to provide notification 
                        under subsection (a)(1);
                          (ii) a conspicuous notice on the Internet 
                        website of the person (if such person maintains 
                        such a website); and
                          (iii) notification in print and to broadcast 
                        media, including major media in metropolitan 
                        and rural areas where the individuals whose 
                        personal information was acquired reside.
                  (C) Content of substitute notice.--Each form of 
                substitute notice under this paragraph shall include--
                          (i) notice that individuals whose personal 
                        information is included in the breach of 
                        security are entitled to receive, at no cost to 
                        the individuals, consumer credit reports on a 
                        quarterly basis for a period of 2 years, and 
                        instructions on requesting such reports from 
                        the person; and
                          (ii) a telephone number by which an 
                        individual can, at no cost to such individual, 
                        learn whether that individual's personal 
                        information is included in the breach of 
                        security.
          (3) Federal trade commission regulations and guidance.--
                  (A) Regulations.--Not later than 1year after the date 
                of enactment of this Act, the Commission shall, by 
                regulations under section 553 of title 5, United States 
                Code, establish criteria for determining the 
                circumstances under which substitute notification may 
                be provided under paragraph (2), including criteria for 
                determining if notification under paragraph (1) is not 
                feasible due to excessive cost to the person required 
                to provide such notification relative to the resources 
                of such person.
                  (B) Guidance.--In addition, the Commission shall 
                provide and publish general guidance with respect to 
                compliance with this section. Such guidance shall 
                include--
                          (i) a description of written or email 
                        notification that complies with the 
                        requirements of paragraph (1); and
                          (ii) guidance on the content of substitute 
                        notification under paragraph (2)(B), including 
                        the extent of notification to print and 
                        broadcast media that complies with the 
                        requirements of such paragraph.
    (e) Other Obligations Following Breach.--A person required to 
provide notification under subsection (a) shall, upon request of an 
individual whose personal information was included in the breach of 
security, provide or arrange for the provision of, to each such 
individual and at no cost to such individual, consumer credit reports 
from at least one of the major credit reporting agencies beginning not 
later than 2 months following the discovery of a breach of security and 
continuing on a quarterly basis for a period of 2 years thereafter.
    (f) Exemption.--
          (1) General exemption.--A person shall be exempt from the 
        requirements under this section if, following a breach of 
        security, such person determines that there is no reasonable 
        risk of identity theft, fraud, or other unlawful conduct.
          (2) Presumptions.--
                  (A) Encryption.--The encryption of data in electronic 
                form shall establish a presumption that no reasonable 
                risk of identity theft, fraud, or other unlawful 
                conduct exists following a breach of security of such 
                data. Any such presumption may be rebutted by facts 
                demonstrating that the encryption has been or is 
                reasonably likely to be compromised.
                  (B) Additional methodologies or technologies.--Not 
                later than 270 days after the date of the enactment of 
                this Act, the Commission shall, by rule pursuant to 
                section 553 of title 5, United States Code, identify 
                any additional security methodology or technology, 
                other than encryption, which renders data in electronic 
                form unreadable or indecipherable, that shall, if 
                applied to such data, establish a presumption that no 
                reasonable risk of identity theft, fraud, or other 
                unlawful conduct exists following a breach of security 
                of such data. Any such presumption may be rebutted by 
                facts demonstrating that any such methodology or 
                technology has been or is reasonably likely to be 
                compromised. In promulgating such a rule, the 
                Commission shall consult with relevant industries, 
                consumer organizations, and data security and identity 
                theft prevention experts and established standards 
                setting bodies.
          (3) FTC guidance.--Not later than 1 year after the date of 
        the enactment of this Act, the Commission shall issue guidance 
        regarding the application of the exemption in paragraph (1).
    (g) Website Notice of Federal Trade Commission.--If the Commission, 
upon receiving notification of any breach of security that is reported 
to the Commission under subsection (a)(2), finds that notification of 
such a breach of security via the Commission's Internet website would 
be in the public interest or for the protection of consumers, the 
Commission shall place such a notice in a clear and conspicuous 
location on its Internet website.
    (h) FTC Study on Notification in Languages in Addition to 
English.--Not later than 1 year after the date of enactment of this 
Act, the Commission shall conduct a study on the practicality and cost 
effectiveness of requiring the notification required by subsection 
(d)(1) to be provided in a language in addition to English to 
individuals known to speak only such other language.
    (i) Special Notification Requirement for Federal Agencies.--
          (1) Nationwide notification.--Any Federal agency that owns or 
        possesses data in electronic form containing personal 
        information shall, following the discovery of a breach of 
        security of the system maintained by such agency that contains 
        such data, notify each individual who is a citizen or resident 
        of the United States whose personal information was acquired by 
        an unauthorized person as a result of such a breach of security
          (2) Method and content of notification.--
                  (A) Method of notification.--A Federal agency 
                required to provide written notification to individuals 
                under paragraph (1) shall be in compliance with such 
                requirement if the agency provides conspicuous and 
                clearly identified written notification that includes 
                the content required under subparagraph (B).
                  (B) Content of notification.--Notification required 
                under this subsection shall include--
                          (i) a description of the personal information 
                        that was acquired by an unauthorized person;
                          (ii) a telephone number that the individual 
                        may use, at no cost to such individual, to 
                        contact the Federal agency to inquire about the 
                        breach of security or the information the 
                        Federal agency maintained about that 
                        individual;
                          (iii) the toll-free contact telephone number 
                        and addresses for the major credit reporting 
                        agencies; and
                          (iv) a toll-free telephone number and 
                        Internet website address whereby the individual 
                        may obtain information regarding identity 
                        theft.
          (3) Exemption.--A Federal agency shall be exempt from the 
        requirements of this subsection if, following a breach of 
        security, such agency determines that there is no reasonable 
        risk of identity theft, fraud, or other unlawful conduct.

SEC. 4. ENFORCEMENT.

    (a) Enforcement by the Federal Trade Commission.--
          (1) Unfair or deceptive acts or practices.--A violation of 
        section 2 or 3 shall be treated as an unfair and deceptive act 
        or practice in violation of a regulation under section 
        18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
        57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
          (2) Powers of commission.--The Commission shall enforce this 
        Act in the same manner, by the same means, and with the same 
        jurisdiction, powers, and duties as though all applicable terms 
        and provisions of the Federal Trade Commission Act (15 U.S.C. 
        41 et seq.) were incorporated into and made a part of this Act. 
        Any person who violates such regulations shall be subject to 
        the penalties and entitled to the privileges and immunities 
        provided in that Act.
          (3) Limitation.--In promulgating rules under this Act, the 
        Commission shall not require the deployment or use of any 
        specific products or technologies, including any specific 
        computer software or hardware.
    (b) Enforcement by State Attorneys General.--
          (1) Civil action.--In any case in which the attorney general 
        of a State, or an official or agency of a State, has reason to 
        believe that an interest of the residents of that State has 
        been or is threatened or adversely affected by any person who 
        violates section 2 or 3 of this Act, the attorney general, 
        official, or agency of the State, as parens patriae, may bring 
        a civil action on behalf of the residents of the State in a 
        district court of the United States of appropriate 
        jurisdiction--
                  (A) to enjoin further violation of such section by 
                the defendant;
                  (B) to compel compliance with such section; or
                  (C) to obtain civil penalties in the amount 
                determined under paragraph (2).
          (2) Civil penalties.--
                  (A) Calculation.--
                          (i) Treatment of violations of section 2.--
                        For purposes of paragraph (1)(C) with regard to 
                        a violation of section 2, the amount determined 
                        under this paragraph is the amount calculated 
                        by multiplying the number of violations of such 
                        section by an amount not greater than $11,000. 
                        Each day that a person is not in compliance 
                        with the requirements of such section shall be 
                        treated as a separate violation. The maximum 
                        civil penalty calculated under this clause 
                        shall not exceed $5,000,000.
                          (ii) Treatment of violations of section 3.--
                        For purposes of paragraph (1)(C) with regard to 
                        a violation of section 3, the amount determined 
                        under this paragraph is the amount calculated 
                        by multiplying the number of violations of such 
                        section by an amount not greater than $11,000. 
                        Each failure to send notification as required 
                        under section 3 to a resident of the State 
                        shall be treated as a separate violation. 
Themaximum civil penalty calculated under this clause shall not exceed 
$5,000,000.
                  (B) Adjustment for inflation.--Beginning on the date 
                that the Consumer Price Index is first published by the 
                Bureau of Labor Statistics that is after 1 year after 
                the date of enactment of this Act, and each year 
                thereafter, the amounts specified in clauses (i) and 
                (ii) of subparagraph (A) shall be increased by the 
                percentage increase in the Consumer Price Index 
                published on that date from the Consumer Price Index 
                published the previous year.
          (3) Intervention by the ftc.--
                  (A) Notice and intervention.--The State shall provide 
                prior written notice of any action under paragraph (1) 
                to the Commission and provide the Commission with a 
                copy of its complaint, except in any case in which such 
                prior notice is not feasible, in which case the State 
                shall serve such notice immediately upon instituting 
                such action. The Commission shall have the right--
                          (i) to intervene in the action;
                          (ii) upon so intervening, to be heard on all 
                        matters arising therein; and
                          (iii) to file petitions for appeal.
                  (B) Limitation on state action while federal action 
                is pending.--If the Commission has instituted a civil 
                action for violation of this Act, no State attorney 
                general, or official or agency of a State, may bring an 
                action under this subsection during the pendency of 
                that action against any defendant named in the 
                complaint of the Commission for any violation of this 
                Act alleged in the complaint.
          (4) Construction.--For purposes of bringing any civil action 
        under paragraph (1), nothing in this Act shall be construed to 
        prevent an attorney general of a State from exercising the 
        powers conferred on the attorney general by the laws of that 
        State to--
                  (A) conduct investigations;
                  (B) administer oaths or affirmations; or
                  (C) compel the attendance of witnesses or the 
                production of documentary and other evidence.
    (c) Affirmative Defense for a Violation of Section 3.--It shall be 
an affirmative defense to an enforcement action brought under 
subsection (a), or a civil action brought under subsection (b), based 
on a violation of section 3, that all of the personal information 
contained in the data in electronic form that was acquired as a result 
of a breach of security of the defendant is public record information 
that is lawfully made available to the general public from Federal, 
State, or local government records and was acquired by the defendant 
from such records.

SEC. 5. DEFINITIONS.

    In this Act the following definitions apply:
          (1) Breach of security.--The term ``breach of security'' 
        means the unauthorized acquisition of data in electronic form 
        containing personal information.
          (2) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
          (3) Data in electronic form.--The term ``data in electronic 
        form'' means any data stored electronically or digitally on any 
        computer system or other database and includes recordable tapes 
        and other mass storage devices.
          (4) Encryption.--The term ``encryption'' means the protection 
        of data in electronic form in storage or in transit using an 
        encryption technology that has been adopted by an established 
        standards setting body which renders such data indecipherable 
        in the absence of associated cryptographic keys necessary to 
        enable decryption of such data. Such encryption must include 
        appropriate management and safeguards of such keys to protect 
        the integrity of the encryption.
          (5) Identity theft.--The term ``identity theft'' means the 
        unauthorized use of another person's personal information for 
        the purpose of engaging in commercial transactions under the 
        name of such other person.
          (6) Information broker.--The term ``information broker'' 
        means a commercial entity whose business is to collect, 
        assemble, or maintain personal information concerning 
        individuals who are not current or former customers of such 
        entity in order to sell such information or provide access to 
        such information to any nonaffiliated third party in exchange 
        for consideration, whether such collection, assembly, or 
        maintenance of personal information is performed by the 
        information broker directly, or by contract or subcontract with 
        any other entity.
          (7) Personal information.--
                  (A) Definition.--The term ``personal information'' 
                means an individual's first name or initial and last 
                name, or address, or phone number, in combination with 
                any 1 or more of the following data elements for that 
                individual:
                          (i) Social Security number.
                          (ii) Driver's license number or other State 
                        identification number.
                          (iii) Financial account number, or credit or 
                        debit card number, and any required security 
                        code, access code, or password that is 
                        necessary to permit access to an individual's 
                        financial account.
                  (B) Modified definition by rulemaking.--The 
                Commission may, by rule, modify the definition of 
                ``personal information'' under subparagraph (A) to the 
                extent that such modification is necessary to 
                accommodate changes in technology or practices, will 
                not unreasonably impede interstate commerce, and will 
                accomplish the purposes of this Act.
          (8) Public record information.--The term ``public record 
        information'' means information about an individual which has 
        been obtained originally from records of a Federal, State, or 
        local government entity that are available for public 
        inspection.
          (9) Non-public information.--The term ``non-public 
        information'' means information about an individual that is of 
        a private nature and neither available to the general public 
        nor obtained from a public record.

SEC. 6. EFFECT ON OTHER LAWS.

    (a) Preemption of State Information Security Laws.--This Act 
supersedes any provision of a statute, regulation, or rule of a State 
or political subdivision of a State, with respect to those entities 
covered by the regulations issued pursuant to this Act, that 
expressly--
          (1) requires information security practices and treatment of 
        data in electronic form containing personal information similar 
        to any of those required under section 2; and
          (2) requires notification to individuals of a breach of 
        security resulting in unauthorized acquisition of data in 
        electronic form containing personal information.
    (b) Additional Preemption.--
          (1) In general.--No person other than the Attorney General of 
        a State may bring a civil action under the laws of any State if 
        such action is premised in whole or in part upon the defendant 
        violating any provision of this Act.
          (2) Protection of consumer protection laws.--This subsection 
        shall not be construed to limit the enforcement of any State 
        consumer protection law by an Attorney General of a State.
    (c) Protection of Certain State Laws.--This Act shall not be 
construed to preempt the applicability of--
          (1) State trespass, contract, or tort law; or
          (2) other State laws to the extent that those laws relate to 
        acts of fraud.
    (d) Preservation of FTC Authority.--Nothing in this Act may be 
construed in any way to limit or affect the Commission's authority 
under any other provision of law, including the authority to issue 
advisory opinions (under part 1 of volume 16 of the Code of Federal 
Regulations), policy statements, or guidance regarding this Act.

SEC. 7. EFFECTIVE DATE AND SUNSET.

    (a) Effective Date.--This Act shall take effect 1 year after the 
date of enactment of this Act.
    (b) Sunset.--This Act shall cease to be in effect on the date that 
is 10 years from the date of enactment of this Act.

SEC. 8. AUTHORIZATION OF APPROPRIATIONS.

    There is authorized to be appropriated to the Commission $1,000,000 
for each of fiscal years 2006 through 2010 to carry out this Act.

                          PURPOSE AND SUMMARY

    As reported by the Committee on the Judiciary, H.R. 4127, 
the ``Data Accountability and Trust Act of 2006,'' is intended 
to protect consumers by requiring security policies and 
procedures to protect computerized data containing personal 
information, and to provide nationwide notice to consumers in 
the event of a breach of such data. The bill authorizes the 
Federal Trade Commission (FTC) to establish such policies and 
procedures, which would be enforced by the FTC and State 
Attorneys General. An amendment added by the Judiciary 
Committee would also require Federal departments and agencies 
to notify consumers of data breaches in the same manner as the 
private sector.

                BACKGROUND AND NEED FOR THE LEGISLATION

    On May 4, 2006, the Committee on Energy and Commerce 
reported H.R. 4127, the ``Data Accountability and Trust Act of 
2006.'' \1\ The bill was sequentially referred to the Committee 
on the Judiciary for a period ending not later than June 2, 
2006. The sections within the jurisdiction of the Committee on 
the Judiciary pertain to civil enforcement by State Attorneys 
General, and related civil penalties, as well as the bill's 
effect on State laws related to trespass, contract, tort law 
and acts of fraud.
---------------------------------------------------------------------------
    \1\ See H.R. Rep. No. 109-453, Part I (2006).
---------------------------------------------------------------------------
    The Committee on the Judiciary became acutely aware of the 
need to provide greater oversight and regulation of personally 
identifiable data with the revelation in February 2005 that 
organized criminals had fraudulently obtained personal data on 
nearly 145,000 consumers from ChoicePoint, Inc., an Alpharetta, 
Georgia-based data broker.\2\ The criminals used the data to 
commit various acts of identity theft. Since that watershed 
breach, businesses that maintain such data, including other 
data brokers,\3\ financial institutions,\4\ media companies,\5\ 
retailers,\6\ universities,\7\ and Federal government agencies 
\8\ have experienced similar breaches involving sensitive 
information that can be used to commit identity theft.
---------------------------------------------------------------------------
    \2\ Joseph Menn, Fraud Ring Taps Into Credit Data, L.A. Times, 
February 15, 2005 at 1.
    \3\ David Colker, ID Thieves Tap Files at 2nd Big Data Firm, L.A. 
Times, March 10, 2005 at 1.
    \4\ Mark Mueller, Inside Ring is Charged in Financial Data Scheme, 
Nwrk. Star-Ledger, April 29, 2005 at 21.
    \5\ Jon Swartz, Time-Warner Data on 600,000 Missing, USA Today, May 
3, 2005.
    \6\ Bill Husted & David Markiewicz, I.D. Theft Slams Chain, 1.4 
Million Cards Stolen, Atl.J-Const., April 20, 2005 at 1.
    \7\ Allison Kolodziej, Data Thieves Prey on Colleges: Schools 
Becoming More Vigilant to Safeguard Personal Information, Columbus 
Dis., May 13, 2006 (online version).
    \8\ Christopher Lee, Personal Data on Veterans is Stolen, Wash. 
Post, May 23, 2006 at A1.
---------------------------------------------------------------------------
    Although the focus of public attention has been on the 
missteps of data brokers, the Judiciary Committee understands 
that data brokers provide a wide array of beneficial 
information services to business and government entities, 
particularly law enforcement. For example, data broker 
information is used by Federal, State and local law enforcement 
officials in locating criminals, such as those who fail to 
appear at trial, or fail to pay court-ordered child support. 
Businesses also use data broker-provided services to detect and 
deter fraudulent transactions. Despite these benefits, the 
seeming epidemic in data breaches over the last year raises 
serious questions about the aggregation of sensitive consumer 
information, whether this information is protected adequately 
from misuse and unauthorized disclosure, and the relationship, 
if any, to the increase in identity theft and other crimes.
    Data security breaches have raised questions about the 
sufficiency of current laws to protect consumer information 
from identity theft. Although there are Federal laws that 
provide standards for disclosure of some types of personal 
information and require certain entities to take steps to 
safeguard personal information, there is no comprehensive 
Federal law dealing with data security. In addition, many of 
our Federal laws have not been adequately updated since the 
growth of the Internet as a tool of commerce during the last 
decade, making consumers as vulnerable as they have ever been 
to the threat of identity theft.
    H.R. 4127 attempts to create a uniform Federal standard for 
the protection of sensitive personal information and for 
providing notice to consumers in the event that their personal 
information is compromised by a security breach. The bill 
authorizes the Federal Trade Commission (FTC) to set such 
standards, and enforce those standards as violations of Section 
5 of the Federal Trade Commission Act. The legislation also 
authorizes State Attorneys General to enforce the Federal law 
and obtain civil penalties for violations of the Act.
    The Committee on the Judiciary supports the goal of 
crafting comprehensive, rational, and non-duplicative national 
standards for handling data breaches involving personal 
information. Unfortunately, H.R. 4127 as reported to the 
Judiciary Committee falls short of that goal in a few key 
areas.
    First, the bill permits the FTC to regulate the data 
collection and retention activities of virtually any entity 
that owns or possesses personal information. This includes 
financial services firms that are already subject to stringent 
privacy and information security standards under the Federal 
Gramm-Leach-Bliley Act. Rather than expressly exempting 
federally-regulated institutions from the scope of the bill's 
coverage, H.R. 4127 allows the FTC to determine whether and how 
financial institutions should be covered by the law. The FTC 
has little expertise in the area of financial data regulation, 
and the Judiciary Committee believes that this expansion of the 
FTC's jurisdiction is unwarranted, and potentially could result 
in duplicative and burdensome Federal regulation.
    Second, the bill permits State Attorneys General to enforce 
the bill's data protection and consumer notice requirements if 
the FTC fails to act. Again, because the bill sweeps in 
virtually every entity that owns or possesses personal 
information, the bill would allow State Attorneys General to 
bring enforcement actions against financial institutions, 
rather than leaving regulation and enforcement of these 
entities to the Federal financial regulators. The Committee 
believesthat State Attorneys General can and should play an 
important role in enforcing violations of State and Federal law, 
including in the area of data security. H.R. 4127 goes too far, 
however, by expanding State Attorney General enforcement in an area 
traditionally reserved to Federal financial regulators.
    Finally, the bill's preemption provision undermines the 
legislation's general effort to create a uniform set of Federal 
requirements governing data security and consumer notice. 
Although the bill attempts to create national standards, it 
expressly protects State consumer protection laws and does not 
preempt any State law relating to fraud. These broad exceptions 
raise questions about whether entities regulated under H.R. 
4127 will be subject to conflicting State and Federal laws and 
regulations, undermining the goal of a nationwide standard for 
the protection of personal data.

                                HEARINGS

    No hearings were held in the Committee on the Judiciary on 
H.R. 4127. On May 9, 2006, the House Judiciary Committee's 
Subcommittee on Crime, Terrorism and Homeland Security held a 
hearing on the policy issues raised by the increase in computer 
crime and identity theft. The Subcommittee received testimony 
from: Ms. Laura H. Parsky, Deputy Assistant Attorney General, 
Criminal Division, United States Department of Justice; Mr. 
Joseph LaRocca, Vice President, Loss Prevention, National 
Retail Federation; Ms. Anne Wallace, Executive Director, 
Identity Theft Assistance Corporation; and Ms. Susanna 
Montezemolo, Policy Analyst, Consumers Union.

                        COMMITTEE CONSIDERATION

    On Thursday, May 25, 2006, the Committee met in open 
session and ordered favorably reported the bill, H.R. 4127, by 
voice vote with an amendment, a quorum being present.

                         VOTE OF THE COMMITTEE

    In compliance with clause 3(b) of Rule XIII of the Rules of 
the House of Representatives, the Committee notes that there 
were no recorded votes on H.R. 4127 during the Committee on the 
Judiciary's consideration of the bill.

                      COMMITTEE OVERSIGHT FINDINGS

    In compliance with clause 3(c)(1) of rule XIII of the Rules 
of the House of Representatives, the Committee reports that the 
findings and recommendations of the Committee, based on 
oversight activities under clause 2(b)(1) of rule X of the 
Rules of the House of Representatives, are incorporated in the 
descriptive portions of this report.

               NEW BUDGET AUTHORITY AND TAX EXPENDITURES

    Clause 3(c)(2) of House Rule XIII is inapplicable because 
this legislation does not provide new budgetary authority or 
increased tax expenditures.

                        COMMITTEE COST ESTIMATE

    In compliance with clause 3(d)(2) of rule XIII of the Rules 
of the House of Representatives, the Committee sets forth, with 
respect to H.R. 4127, the following estimate. This Committee 
primarily adopts the Congressional Budget Office's prepared 
cost estimate of H.R. 4127 as reported by the House Committee 
and Energy Commerce, which is included in their report.\9\ An 
amendment was adopted to the bill that would require Federal 
departments and agencies to notify consumers of data breaches 
in the same manner as the private sector. The following excerpt 
draws Congressional Budget Office's prepared cost for S. 1789, 
and is describing a substantively identical provision in that 
legislation. The Committee believes the cost analysis for this 
amendment would be virtually identical to the following 
analysis.
---------------------------------------------------------------------------
    \9\ See H.R. Rep. No. 109-453, Part I (2006).
---------------------------------------------------------------------------
    The Federal Information Security Management Act of 2002 
provides requirements for securing the federal government's 
information systems, including the protection of personal 
privacy. The National Institute of Standards and Technology 
develops information security standards and guidelines for 
other federal agencies, and the Office of Management and Budget 
(OMB) oversees information technology security policies and 
practices. OMB estimates that federal agencies spend around $5 
billion a year to secure the government's information systems.
    In the event of a security breach involving a significant 
risk of identity theft, government agencies would be required 
to notify an individual whose information may have been 
compromised. Notification would be in the form of individual 
notice (written notice to a home mailing address, via 
telephone, or via e-mail) as well as through the mass media. 
The cost of such notification would depend on the number of 
security breaches that occur, the number of persons affected, 
and the cost per person of notification. CBO cannot estimate 
the number of security breaches that might occur within the 
federal government in any year.
    Nationwide, only the largest breaches are identified and 
reported. Limited anecdotal information over the last two years 
suggests that security breaches involving the federal 
government have occurred regularly usually involving the theft 
of computers containing personal information from specific 
agencies. Such thefts have affected the personal information of 
about 3 percent of the 4 million civilian and military federal 
employees (about 120,000). Based on that data and information 
from OMB and other agencies, CBOdoes not expect that there 
would be significant notification costs under the bill in any one year. 
Thus, CBO estimates that implementing the notification provision in S. 
1789 would cost less than $500,000 annually.
    Nonetheless, the federal government is also one of the 
largest providers, collectors, consumers, and disseminators of 
personnel information in the United States. The cost to notify 
individuals of a security breach to personnel information may 
cost up to $2 per notification. Although, CBO cannot anticipate 
the number of security breaches, a significant breach of 
security involving a major collector of personnel information, 
such as the Internal Revenue Service or the Social Security 
Administration could involve millions of individuals and would 
have a significant budgetary impact.\10\
---------------------------------------------------------------------------
    \10\ Congressional Budget Office Cost Estimate of S. 1789, the 
``Personal Data Privacy and Security Act of 2005,'' as reported by the 
Senate Judiciary Committee on November 17, 2005, available at http://
cbo.gov/ftpdocs/71xx/doc7161/s1789.pdf.
---------------------------------------------------------------------------

                    PERFORMANCE GOALS AND OBJECTIVES

    The goal of H.R. 4127 is to protect consumers by requiring 
reasonable security policies and procedures to protect 
computerized data containing personal information, and to 
provide for uniform nationwide notice in the event of a 
security breach.

                   CONSTITUTIONAL AUTHORITY STATEMENT

    Pursuant to clause 3(d)(1) of rule XIII of the Rules of the 
House of Representatives, the Committee finds the authority for 
this legislation in art. I, Sec. 8 of the Constitution.

               SECTION-BY-SECTION ANALYSIS AND DISCUSSION

    The following section-by-section analysis describes the 
sections of H.R. 4127 as reported that fall within the Rule X 
jurisdiction of the Committee on the Judiciary. For a 
description of the other sections of the bill, please refer to 
the report of the Committee on Energy and Commerce.\11\
---------------------------------------------------------------------------
    \11\ Id.
---------------------------------------------------------------------------

Section 3. Notification of information security breach

    Section 3 requires any entity engaged in interstate 
commerce that owns or possesses personal information in 
electronic form to notify individuals whose information was 
acquired by an unauthorized person and the FTC, following the 
discovery of a breach of security of the system containing such 
information.
    Section 3(b) requires special notification for entities 
that do not own the data subject to a security breach. 
Specifically, a third party agent contracted to maintain or 
process data in electronic form on behalf of an entity who owns 
or possesses such personal information is required to notify 
the person or entity that owns or possesses the data who in 
turn provides notice as required by section 3(a). The Committee 
recognizes that many companies are contracted to provide data 
services for companies that own or possess personal 
information. Contracted entities in many an instance do not 
have contact information for an individual whose information 
was breached and would therefore be unable to provide notice. 
Additionally, the Committee believes for a notice to be most 
effective, it should come from the entity with whom the 
individuals are most likely to identify or recognize by means 
of a relationship.
    Similarly, section 3(b)(2) recognizes that 
telecommunications carriers, cable operators, information 
service or interactive computer services provide transmission 
utility for data in transit. As such, a breach of data in 
transit that utilizes the means of transmission may not be 
identifiable. Further, in such cases where a breach is 
identifiable, the nature of the data and identity of the sender 
of the data may not be readily identifiable by the provider of 
the transmission utility. This subsection provides that such 
third party entity will only be required to notify the entity 
that initiated the transmission of the data of the breach, 
provided such entity can be reasonably identified.
    Section 3(b)(3) addresses security breaches that include 
individually identifiable health information. Upon receiving 
notice from the entity that suffered the breach, the FTC is 
required to provide a copy of such notice to the Secretary of 
Health and Human Services.
    Section 3(c) requires notices be made as promptly as 
possible but consistent with any measures undertaken to 
determine the scope of the breach, prevent further breach, and 
restore integrity of the system. Section 3(d) provides for the 
method of the notification. Entities required to send notice 
may do so by either written notification or by email. Notice by 
email is only permitted in cases when it is the entity's 
primary contact method with the individual or the individual 
has consented to receive such notification by email and the 
notification is consistent with applicable law.
    Section 3(e) provides that an entity required to provide 
notice for a breach of security shall provide, or make 
arrangements for the provision of, quarterly consumer credit 
reports for two years from one of the major credit reporting 
agencies, and at no cost to the individual, upon request from 
the individual.
    Section 3(f) provides an exemption from the requirements of 
section 3 under certain circumstances. Specifically, under 
section 3(f)(1) an entity is not required to provide notice if 
it determines there is no reasonable risk of identity theft, 
fraud, or other unlawful conduct following a breach of 
security. The Committee expects these determinations will be 
fact specific and will take account of the types of information 
breached, the party that acquired the information, and the 
usability of the information by the party who acquired it. 
Further, section 3(f)(2)(A) establishes a rebuttable 
presumption that there is no reasonable risk of identity theft, 
fraud, or other unlawful conduct if the data that is breached 
is encrypted. The presumption may be rebutted by facts 
demonstrating that the encryption has been or is likely to be 
compromised. The Committee recognizes that, given sufficient 
time, all encryption may be ``compromised'' asencryption 
standards evolve and forms of encryption become outdated.
    Although encryption is a widely used and accepted practice 
of securing data, the Committee does not intend to deem 
encryption as the only effective method or technology of 
securing and protecting data. In fact, many industry experts 
take the position that other methods and technologies used to 
protect data are equally, and in some cases more, effective 
than encryption. Section 3(f)(2)(B) provides that the FTC 
shall, by rule and within nine months of the date of enactment 
of the Act, identify any other methods or technologies that 
render electronic data unreadable or indecipherable. The 
Committee's intent in requiring the FTC to undertake this 
rulemaking is that the Commission should not be limited in 
determining any other effective data protection technologies or 
methods, in addition to encryption, which would render data 
unusable and therefore establish a presumption there is no 
reasonable risk of identity theft, fraud, or other unlawful 
activity.
    Section 3(f)(3) requires the Commission to issue guidance 
within one year of enactment of the Act regarding the 
application of the exemption in section 3(f).
    Section 3(g) provides the Commission with discretion to 
place a notice of a breach of security it has received under 
section 3(a)(2) on its website if the Commission determines 
such posting is in the public interest and for the protection 
of consumers.
    Section 3(h) provides for an FTC study regarding the 
practicality and cost effectiveness of requiring notification 
to be provided in a language in addition to English.
    Section 3(i) requires Federal agencies that own or possess 
data in electronic form containing personal information to 
provide written notice to each individual who is a citizen or 
resident of the United States if their personal information is 
acquired by an unauthorized person as a result of a security 
breach. Agencies are exempt from making such disclosures if 
they determine that the breach causes no reasonable risk of 
identity theft, fraud, or other unlawful conduct. The Committee 
intends this provision to address circumstances where the 
Federal government maintains information in a similar manner as 
the private sector, such as the recent breach of the personal 
information of nearly 26.5 million veterans maintained by the 
United States Department of Veterans Affairs, and does not 
intend it to apply in circumstances where disclosure of the 
breach or the information that is the subject of the breach 
could compromise a criminal investigation or national security.

Section 4. Enforcement

    Section 4(a)(1) provides that a violation of the Act shall 
be enforced by the FTC as an unfair and deceptive act or 
practice in violation of a regulation under section 18 the 
Federal Trade Commission Act. The FTC has limited or no 
jurisdiction over certain types of entities and activities. 
These include banks, savings associations, and Federal credit 
unions; regulated common carriers; air carriers; non-retail 
sales of livestock and meat products; nonprofit entities; and 
the business of insurance. See, e.g., 15 U.S.C. Sec. 
Sec. Sec. 44, 45, 46 (FTC Act); 15 U.S.C. Sec. 21 (Clayton 
Act); 7 U.S.C. Sec. 227 (Packers and Stockyards Act); 15 U.S.C. 
Sec. 1011 et seq. (McCarran-Ferguson Act).
    Section 4(a)(3) prohibits the FTC from requiring the 
deployment of any specific products or technologies, including 
any specific computer software or hardware, in promulgating 
rules under this Act. The Committee recognizes the rapidly 
evolving improvements in technologies and products to protect 
personal information and believes the market is the most 
effective mechanism in determining which specific products best 
protect personal information.
    Section 4(b) provides for enforcement by an attorney 
general of a State or an official or agency of a State if the 
attorney general, or an official or agency of a State has 
reason to believe that an interest of the residents of that 
State has been or is threatened or adversely affected by a 
violation of section 2 or 3. The attorney general or official 
or agency of a State may bring civil action to enjoin further 
violations of section 2 or 3, compel compliance with section 2 
or 3, or to obtain civil penalties for violations of section 2 
or 3.
    Section 4(b)(2)(A) sets forth the structure for civil 
penalties. With respect to a violation of section 2, the civil 
penalty is calculated by multiplying the number of violations 
of the section by an amount not greater than $11,000, with each 
day of noncompliance treated as a separate violation. Civil 
penalties for violations of section 2 are capped at $5 million.
    Beginning with the first Consumer Price Index published at 
least one year after the date of enactment of this Act, and 
continuing on an annual basis, section 4(b)(2)(B) requires the 
amounts specified in section 4(b)(2)(A) to be increased by the 
annual percentage increase in the Consumer Price Index.
    Section 4(b)(3) provides specific obligations and 
limitations on State actions. In particular, section 4(b)(3)(A) 
requires a State to provide prior written notice to the FTC of 
any action brought under this Act and to provide the Commission 
with a copy of the complaint. The Commission has the right to 
intervene in the action by the State, to be heard on all 
matters relating to the action, and to file petitions for 
appeal. Further, if the FTC has instituted a civil action for a 
violation of this Act, State action is stayed during the 
pendency of the Federal action.
    Section 4(c) provides an affirmative defense to an 
enforcement action brought under subsection (a) or a civil 
action brought under subsection (b), if all of the personal 
information contained in the data was acquired as a result of a 
breach of security is public record information and was 
acquired by the defendant from public records.

Section 6. Effect on other laws

    Section 6(a) provides that the Act preempts statutes, 
regulations, or rules of a State, or a subdivision of a State, 
with respect to the entities covered by the regulations issued 
pursuant to the Act, that require information security 
practices and treatment of data in electronic form containing 
personal information similar to any of those required under 
section 2 and notification for a breach of security resulting 
in an unauthorized acquisition of data in electronic form 
containing personal information.
    Section 6(b) prohibits any person other than the attorney 
general of a State to bring a civil action under the law of any 
State if such action is premised in whole or in part upon the 
defendant violating any provision of this Act, but makes clear 
that this prohibition shall not be construed to limit the 
enforcement of any State consumer protection law by an Attorney 
General of a State. Section 6(c) specifically preserves State 
trespass, contract, and tort law, and other State laws to the 
extent those acts relate to acts of general consumer fraud. 
Section 6(d) preserves the FTC's authority under any other 
provision of law, including the authority to issue advisory 
opinions, policy statements, or guidance regarding the Act.
    In addition, the Act is not intended to weaken the privacy 
protections for health information established pursuant to the 
Health Insurance Portability and Accountability Act of 1996 
(HIPAA) and its regulations. This includes maintaining HIPAA's 
provisions regarding State privacy laws related to identifiable 
health information that are not contrary to or that are more 
stringent than the requirements, standards, or implementation 
specifications imposed under the HIPAA regulation.

                                  

```