II 

112TH CONGRESS 

1ST SESSION S. 1434 

To protect information relating to consumers, to require notice of security 

breaches, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 28, 2011 

Mr. CARPER (for himself and Mr. BLUNT) introduced the following bill; which 

was read twice and referred to the Committee on Banking, Housing, and 

Urban Affairs 

A BILL 

To protect information relating to consumers, to require 

notice of security breaches, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Security Act of 

5 2011’’. 

6 SEC. 2. DEFINITIONS. 

7 For purposes of this Act, the following definitions 

8 shall apply: 


jbell on DSKDVH8Z91PROD with BILLS
2 

•S 1434 IS

1 (1) AFFILIATE.—The term ‘‘affiliate’’ means 

2 any company that controls, is controlled by, or is 

3 under common control with another company. 

4 (2) AGENCY.—The term ‘‘agency’’ has the same 

5 meaning as in section 551(1) of title 5, United 

6 States Code. 

7 (3) BREACH OF DATA SECURITY.— 

8 (A) IN GENERAL.—The term ‘‘breach of 

9 data security’’ means the unauthorized acquisi10 tion of sensitive account information or sen11 sitive personal information. 

12 (B) EXCEPTION FOR DATA THAT IS NOT IN

13 USABLE FORM.— 

14 (i) IN GENERAL.—The term ‘‘breach 

15 of data security’’ does not include the un16 authorized acquisition of sensitive account 

17 information or sensitive personal informa18 tion that is maintained or communicated in 

19 a manner that is not usable— 

20 (I) to commit identity theft; or 

21 (II) to make fraudulent trans22 actions on financial accounts. 

23 (ii) RULE OF CONSTRUCTION.—For 

24 purposes of this subparagraph, information 

25 that is maintained or communicated in a 


jbell on DSKDVH8Z91PROD with BILLS
3 

•S 1434 IS

1 manner that is not usable includes any in2 formation that is maintained or commu3 nicated in an encrypted, redacted, altered, 

4 edited, or coded form. 

5 (4) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (5) CONSUMER.—The term ‘‘consumer’’ means 

8 an individual. 

9 (6) CONSUMER REPORTING AGENCY THAT COM10 PILES AND MAINTAINS FILES ON CONSUMERS ON A

11 NATIONWIDE BASIS.—The term ‘‘consumer reporting 

12 agency that compiles and maintains files on con13 sumers on a nationwide basis’’ has the same mean14 ing as in section 603(p) of the Fair Credit Report15 ing Act (15 U.S.C. 1681a(p)). 

16 (7) COVERED ENTITY.— 

17 (A) IN GENERAL.—The term ‘‘covered en18 tity’’ means any— 

19 (i) entity, the business of which is en20 gaging in financial activities, as described 

21 in section 4(k) of the Bank Holding Com22 pany Act of 1956 (12 U.S.C. 1843(k)); 

23 (ii) financial institution, including any 

24 institution described in section 313.3(k) of 


jbell on DSKDVH8Z91PROD with BILLS
4 

•S 1434 IS

1 title 16, Code of Federal Regulations, as in 

2 effect on the date of enactment of this Act; 

3 (iii) entity that maintains or otherwise 

4 possesses information that is subject to 

5 section 628 of the Fair Credit Reporting 

6 Act (15 U.S.C. 1681w); or 

7 (iv) other individual, partnership, cor8 poration, trust, estate, cooperative, associa9 tion, or entity that maintains or commu10 nicates sensitive account information or 

11 sensitive personal information. 

12 (B) EXCEPTION.—The term ‘‘covered enti13 ty’’ does not include any agency or any other 

14 unit of Federal, State, or local government or 

15 any subdivision of such unit. 

16 (8) FINANCIAL INSTITUTION.—The term ‘‘fi17 nancial institution’’ has the same meaning as in sec18 tion 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 

19 6809). 

20 (9) SENSITIVE ACCOUNT INFORMATION.—The 

21 term ‘‘sensitive account information’’ means a finan22 cial account number relating to a consumer, includ23 ing a credit card number or debit card number, in 

24 combination with any security code, access code, 


jbell on DSKDVH8Z91PROD with BILLS
5 

•S 1434 IS

1 password, or other personal identification informa2 tion required to access the financial account. 

3 (10) SENSITIVE PERSONAL INFORMATION.— 

4 (A) IN GENERAL.—The term ‘‘sensitive 

5 personal information’’ means the first and last 

6 name, address, or telephone number of a con7 sumer, in combination with any of the following 

8 relating to such consumer: 

9 (i) Social Security account number. 

10 (ii) Driver’s license number or equiva11 lent State identification number. 

12 (iii) Taxpayer identification number. 

13 (B) EXCEPTION.—The term ‘‘sensitive per14 sonal information’’ does not include publicly 

15 available information that is lawfully made 

16 available to the general public from— 

17 (i) Federal, State, or local government 

18 records; or 

19 (ii) widely distributed media. 

20 (11) SUBSTANTIAL HARM OR INCONVEN21 IENCE.— 

22 (A) IN GENERAL.—The term ‘‘substantial 

23 harm or inconvenience’’ means— 

24 (i) material financial loss to, or civil 

25 or criminal penalties imposed on, a conVerDate Mar 15 2010 03:04 Jul 29, 2011 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1434.IS S1434

jbell on DSKDVH8Z91PROD with BILLS
6 

•S 1434 IS

1 sumer, due to the unauthorized use of sen2 sitive account information or sensitive per3 sonal information relating to such con4 sumer; or 

5 (ii) the need for a consumer to expend 

6 significant time and effort to correct erro7 neous information relating to the con8 sumer, including information maintained 

9 by a consumer reporting agency, financial 

10 institution, or government entity, in order 

11 to avoid material financial loss, increased 

12 costs, or civil or criminal penalties, due to 

13 the unauthorized use of sensitive account 

14 information or sensitive personal informa15 tion relating to such consumer. 

16 (B) EXCEPTION.—The term ‘‘substantial 

17 harm or inconvenience’’ does not include— 

18 (i) changing a financial account num19 ber or closing a financial account; or 

20 (ii) harm or inconvenience that does 

21 not result from identity theft or account 

22 fraud. 

23 SEC. 3. PROTECTION OF INFORMATION AND SECURITY 

24 BREACH NOTIFICATION. 

25 (a) SECURITY PROCEDURES REQUIRED.— 


jbell on DSKDVH8Z91PROD with BILLS
7 

•S 1434 IS

1 (1) IN GENERAL.—Each covered entity shall 

2 implement, maintain, and enforce reasonable policies 

3 and procedures to protect the confidentiality and se4 curity of sensitive account information and sensitive 

5 personal information which is maintained or is being 

6 communicated by or on behalf of a covered entity, 

7 from the unauthorized use of such information that 

8 is reasonably likely to result in substantial harm or 

9 inconvenience to the consumer to whom such infor10 mation relates. 

11 (2) LIMITATION.—Any policy or procedure im12 plemented or maintained under paragraph (1) shall 

13 be appropriate to the— 

14 (A) size and complexity of a covered entity; 

15 (B) nature and scope of the activities of 

16 such entity; and 

17 (C) sensitivity of the consumer information 

18 to be protected. 

19 (b) INVESTIGATION REQUIRED.— 

20 (1) IN GENERAL.—If a covered entity deter21 mines that a breach of data security has or may 

22 have occurred in relation to sensitive account infor23 mation or sensitive personal information that is 

24 maintained or is being communicated by, or on beVerDate Mar 15 2010 03:04 Jul 29, 2011 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1434.IS S1434

jbell on DSKDVH8Z91PROD with BILLS
8 

•S 1434 IS

1 half of, such covered entity, the covered entity shall 

2 conduct an investigation— 

3 (A) to assess the nature and scope of the 

4 breach; 

5 (B) to identify any sensitive account infor6 mation or sensitive personal information that 

7 may have been involved in the breach; and 

8 (C) to determine if such information is 

9 reasonably likely to be misused in a manner 

10 causing substantial harm or inconvenience to 

11 the consumers to whom the information relates. 

12 (2) NEURAL NETWORKS AND INFORMATION SE13 CURITY PROGRAMS.—In determining the likelihood 

14 of misuse of sensitive account information under 

15 paragraph (1)(C), a covered entity shall consider 

16 whether any neural network or security program has 

17 detected, or is likely to detect or prevent, fraudulent 

18 transactions resulting from the breach of security. 

19 (c) NOTICE REQUIRED.—If a covered entity deter20 mines under subsection (b)(1)(C) that sensitive account 

21 information or sensitive personal information involved in 

22 a breach of data security is reasonably likely to be misused 

23 in a manner causing substantial harm or inconvenience 

24 to the consumers to whom the information relates, such 


jbell on DSKDVH8Z91PROD with BILLS
9 

•S 1434 IS

1 covered entity, or a third party acting on behalf of such 

2 covered entity, shall— 

3 (1) notify, in the following order— 

4 (A) the appropriate agency or authority 

5 identified in section 5; 

6 (B) an appropriate law enforcement agen7 cy; 

8 (C) any entity that owns, or is obligated 

9 on, a financial account to which the sensitive 

10 account information relates, if the breach in11 volves a breach of sensitive account informa12 tion; 

13 (D) each consumer reporting agency that 

14 compiles and maintains files on consumers on a 

15 nationwide basis, if the breach involves sensitive 

16 personal information relating to 5,000 or more 

17 consumers; and 

18 (E) all consumers to whom the sensitive 

19 account information or sensitive personal infor20 mation relates; and 

21 (2) take reasonable measures to restore the se22 curity and confidentiality of the sensitive account in23 formation or sensitive personal information involved 

24 in the breach. 

25 (d) COMPLIANCE.— 


jbell on DSKDVH8Z91PROD with BILLS
10 

•S 1434 IS

1 (1) IN GENERAL.—A financial institution shall 

2 be deemed to be in compliance with— 

3 (A) subsection (a), and any regulations 

4 prescribed under such subsection, if such insti5 tution maintains policies and procedures to pro6 tect the confidentiality and security of sensitive 

7 account information and sensitive personal in8 formation that are consistent with the policies 

9 and procedures of such institution that are de10 signed to comply with the requirements of sec11 tion 501(b) of the Gramm-Leach-Bliley Act (15 

12 U.S.C. 6801(b)) and any regulations or guid13 ance prescribed under that section that are ap14 plicable to such institution; and 

15 (B) subsections (b) and (c), and any regu16 lations prescribed under such subsections, if 

17 such institution— 

18 (i)(I) maintains policies and proce19 dures to investigate and provide notice to 

20 consumers of breaches of data security 

21 that are consistent with the policies and 

22 procedures of such institution that are de23 signed to comply with the investigation and 

24 notice requirements established by regula25 tions or guidance under section 501(b) of 


jbell on DSKDVH8Z91PROD with BILLS
11 

•S 1434 IS

1 the Gramm-Leach-Bliley Act (15 U.S.C. 

2 6801(b)) that are applicable to such insti3 tution; or 

4 (II) is an affiliate of a bank holding 

5 company that maintains policies and proce6 dures to investigate and provide notice to 

7 consumers of breaches of data security 

8 that are consistent with the policies and 

9 procedures of a bank that is an affiliate of 

10 such institution, and that bank’s policies 

11 and procedures are designed to comply 

12 with the investigation and notice require13 ments established by any regulations or 

14 guidance under section 501(b) of the 

15 Gramm-Leach-Bliley Act (15 U.S.C. 

16 6801(b)) that are applicable to that bank; 

17 and 

18 (ii) provides for notice to the entities 

19 described under subparagraphs (B), (C), 

20 and (D) of subsection (c)(1), if notice is 

21 provided to consumers pursuant to the 

22 policies and procedures of such institution 

23 described in clause (i). 

24 (2) DEFINITIONS.—For purposes of this sub25 section, the terms ‘‘bank holding company’’ and 


jbell on DSKDVH8Z91PROD with BILLS
12 

•S 1434 IS

1 ‘‘bank’’ shall have the same meaning given such 

2 terms under section 2 of the Bank Holding Com3 pany Act of 1956 (12 U.S.C. 1841). 

4 SEC. 4. IMPLEMENTING REGULATIONS. 

5 (a) IN GENERAL.—Notwithstanding any other provi6 sion of law, and except as provided under section 6, the 

7 agencies and authorities identified in section 5, with re8 spect to the covered entities that are subject to the respec9 tive enforcement authority of such agencies and authori10 ties, shall prescribe regulations to implement this Act. 

11 (b) COORDINATION.—Each agency and authority re12 quired to prescribe regulations under subsection (a) shall 

13 consult and coordinate with each other agency and author14 ity identified in section 5 so that, to the extent possible, 

15 the regulations prescribed by each agency and authority 

16 are consistent and comparable. 

17 (c) METHOD OF PROVIDING NOTICE TO CON18 SUMERS.—The regulations required under subsection (a) 

19 shall— 

20 (1) prescribe the methods by which a covered 

21 entity shall notify a consumer of a breach of data se22 curity under section 3; and 

23 (2) allow a covered entity to provide such notice 

24 by— 


jbell on DSKDVH8Z91PROD with BILLS
13 

•S 1434 IS

1 (A) written, telephonic, or e-mail notifica2 tion; or 

3 (B) substitute notification, if providing 

4 written, telephonic, or e-mail notification is not 

5 feasible due to— 

6 (i) lack of sufficient contact informa7 tion for the consumers that must be noti8 fied; or 

9 (ii) excessive cost to the covered enti10 ty. 

11 (d) CONTENT OF CONSUMER NOTICE.—The regula12 tions required under subsection (a) shall— 

13 (1) prescribe the content that shall be included 

14 in a notice of a breach of data security that is re15 quired to be provided to consumers under section 3; 

16 and 

17 (2) require such notice to include— 

18 (A) a description of the type of sensitive 

19 account information or sensitive personal infor20 mation involved in the breach of data security; 

21 (B) a general description of the actions 

22 taken by the covered entity to restore the secu23 rity and confidentiality of the sensitive account 

24 information or sensitive personal information 

25 involved in the breach of data security; and 


jbell on DSKDVH8Z91PROD with BILLS
14 

•S 1434 IS

1 (C) the summary of rights of victims of 

2 identity theft prepared by the Commission 

3 under section 609(d) of the Fair Credit Report4 ing Act (15 U.S.C. 1681g), if the breach of 

5 data security involves sensitive personal infor6 mation. 

7 (e) TIMING OF NOTICE.—The regulations required 

8 under subsection (a) shall establish standards for when 

9 a covered entity shall provide any notice required under 

10 section 3. 

11 (f) LAW ENFORCEMENT DELAY.—The regulations 

12 required under subsection (a) shall allow a covered entity 

13 to delay providing notice of a breach of data security to 

14 consumers under section 3 if a law enforcement agency 

15 requests such a delay in writing. 

16 (g) SERVICE PROVIDERS.—The regulations required 

17 under subsection (a) shall— 

18 (1) require any party that maintains or commu19 nicates sensitive account information or sensitive 

20 personal information on behalf of a covered entity to 

21 provide notice to that covered entity if such party 

22 determines that a breach of data security has, or 

23 may have, occurred with respect to such information; 

24 and 


jbell on DSKDVH8Z91PROD with BILLS
15 

•S 1434 IS

1 (2) ensure that there is only 1 notification re2 sponsibility with respect to a breach of data security. 

3 (h) TIMING OF REGULATIONS.—The regulations re4 quired under subsection (a) shall— 

5 (1) be issued in final form not later than 6 

6 months after the date of enactment of this Act; and 

7 (2) take effect not later than 6 months after 

8 the date on which they are issued in final form. 

9 SEC. 5. ADMINISTRATIVE ENFORCEMENT. 

10 (a) IN GENERAL.—Notwithstanding any other provi11 sion of law, section 3, and the regulations required under 

12 section 4, shall be enforced exclusively under— 

13 (1) section 8 of the Federal Deposit Insurance 

14 Act (12 U.S.C. 1818), in the case of— 

15 (A) a national bank, a Federal branch or 

16 Federal agency of a foreign bank, or any sub17 sidiary thereof (other than a broker, dealer, 

18 person providing insurance, investment com19 pany, or investment adviser), or a savings asso20 ciation, the deposits of which are insured by the 

21 Federal Deposit Insurance Corporation, or any 

22 subsidiary thereof (other than a broker, dealer, 

23 person providing insurance, investment com24 pany, or investment adviser), by the Office of 

25 the Comptroller of the Currency; 


jbell on DSKDVH8Z91PROD with BILLS
16 

•S 1434 IS

1 (B) a member bank of the Federal Reserve 

2 System (other than a national bank), a branch 

3 or agency of a foreign bank (other than a Fed4 eral branch, Federal agency, or insured State 

5 branch of a foreign bank), a commercial lending 

6 company owned or controlled by a foreign bank, 

7 an organization operating under section 25 or 

8 25A of the Federal Reserve Act (12 U.S.C. 

9 601, 604), or a bank holding company and its 

10 nonbank subsidiary or affiliate (other than a 

11 broker, dealer, person providing insurance, in12 vestment company, or investment adviser), by 

13 the Board of Governors of the Federal Reserve 

14 System; and 

15 (C) a bank, the deposits of which are in16 sured by the Federal Deposit Insurance Cor17 poration (other than a member of the Federal 

18 Reserve System), an insured State branch of a 

19 foreign bank, or any subsidiary thereof (other 

20 than a broker, dealer, person providing insur21 ance, investment company, or investment ad22 viser), by the Board of Directors of the Federal 

23 Deposit Insurance Corporation; 

24 (2) the Federal Credit Union Act (12 U.S.C. 

25 1751 et seq.), by the National Credit Union AdminVerDate Mar 15 2010 03:04 Jul 29, 2011 Jkt 099200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S1434.IS S1434

jbell on DSKDVH8Z91PROD with BILLS
17 

•S 1434 IS

1 istration Board with respect to any federally insured 

2 credit union; 

3 (3) the Securities Exchange Act of 1934 (15 

4 U.S.C. 78a et seq.), by the Securities and Exchange 

5 Commission with respect to any broker or dealer; 

6 (4) the Investment Company Act of 1940 (15 

7 U.S.C. 80a–1 et seq.), by the Securities and Ex8 change Commission with respect to any investment 

9 company; 

10 (5) the Investment Advisers Act of 1940 (15 

11 U.S.C. 80b–1 et seq.), by the Securities and Ex12 change Commission with respect to any investment 

13 adviser registered with the Securities and Exchange 

14 Commission under that Act; 

15 (6) the Commodity Exchange Act (7 U.S.C. 1 

16 et seq.), by the Commodity Futures Trading Com17 mission with respect to any futures commission mer18 chant, commodity trading advisor, commodity pool 

19 operator, or introducing broker; 

20 (7) the provisions of title XIII of the Housing 

21 and Community Development Act of 1992 (12 

22 U.S.C. 4501 et seq.), by the Director of Federal 

23 Housing Enterprise Oversight (and any successor to 

24 such functional regulatory agency) with respect to 

25 the Federal National Mortgage Association, the FedVerDate Mar 15 2010 03:04 Jul 29, 2011 Jkt 099200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S1434.IS S1434

jbell on DSKDVH8Z91PROD with BILLS
18 

•S 1434 IS

1 eral Home Loan Mortgage Corporation, and any 

2 other entity or enterprise (as defined in that title) 

3 subject to the jurisdiction of such functional regu4 latory agency under that title, including any affiliate 

5 of any such enterprise; 

6 (8) State insurance law, in the case of any per7 son engaged in providing insurance, by the applica8 ble State insurance authority of the State in which 

9 the person is domiciled; and 

10 (9) the Federal Trade Commission Act (15 

11 U.S.C. 41 et seq.), by the Commission for any other 

12 covered entity that is not subject to the jurisdiction 

13 of any agency or authority described under para14 graphs (1) through (8). 

15 (b) EXTENSION OF FEDERAL TRADE COMMISSION

16 ENFORCEMENT AUTHORITY.—The authority of the Com17 mission to enforce compliance with section 3, and the reg18 ulations required under section 4, under subsection (a)(8) 

19 shall— 

20 (1) notwithstanding the Federal Aviation Act of 

21 1958 (49 U.S.C. App. 1301 et seq.), include the au22 thority to enforce compliance by air carriers and for23 eign air carriers; and 

24 (2) notwithstanding the Packers and Stock25 yards Act (7 U.S.C. 181 et seq.), include the authorVerDate Mar 15 2010 03:04 Jul 29, 2011 Jkt 099200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S1434.IS S1434

jbell on DSKDVH8Z91PROD with BILLS
19 

•S 1434 IS

1 ity to enforce compliance by persons, partnerships, 

2 and corporations subject to the provisions of that 

3 Act. 

4 (c) NO PRIVATE RIGHT OF ACTION.— 

5 (1) IN GENERAL.—This Act, and the regula6 tions prescribed under this Act, may not be con7 strued to provide a private right of action, including 

8 a class action with respect to any act or practice 

9 regulated under this Act. 

10 (2) CIVIL AND CRIMINAL ACTIONS.—No civil or 

11 criminal action relating to any act or practice gov12 erned under this Act, or the regulations prescribed 

13 under this Act, shall be commenced or maintained in 

14 any State court or under State law, including a 

15 pendent State claim to an action under Federal law. 

16 SEC. 6. PROTECTION OF INFORMATION AT FEDERAL AGEN17 CIES. 

18 (a) DATA SECURITY STANDARDS.—Each agency 

19 shall implement appropriate standards relating to admin20 istrative, technical, and physical safeguards— 

21 (1) to insure the security and confidentiality of 

22 the sensitive account information and sensitive per23 sonal information that is maintained or is being 

24 communicated by, or on behalf of, that agency; 


jbell on DSKDVH8Z91PROD with BILLS
20 

•S 1434 IS

1 (2) to protect against any anticipated threats or 

2 hazards to the security of such information; and 

3 (3) to protect against misuse of such informa4 tion, which could result in substantial harm or in5 convenience to a consumer. 

6 (b) SECURITY BREACH NOTIFICATION STAND7 ARDS.—Each agency shall implement appropriate stand8 ards providing for notification of consumers when such 

9 agency determines that sensitive account information or 

10 sensitive personal information that is maintained or is 

11 being communicated by, or on behalf of, such agency— 

12 (1) has been acquired without authorization; 

13 and 

14 (2) is reasonably likely to be misused in a man15 ner causing substantial harm or inconvenience to the 

16 consumers to whom the information relates. 

17 SEC. 7. RELATION TO STATE LAW. 

18 No requirement or prohibition may be imposed under 

19 the laws of any State with respect to the responsibilities 

20 of any person to— 

21 (1) protect the security of information relating 

22 to consumers that is maintained or communicated 

23 by, or on behalf of, such person; 

24 (2) safeguard information relating to consumers 

25 from potential misuse; 


jbell on DSKDVH8Z91PROD with BILLS
21 

•S 1434 IS

1 (3) investigate or provide notice of the unau2 thorized access to information relating to consumers, 

3 or the potential misuse of such information for 

4 fraudulent, illegal, or other purposes; or 

5 (4) mitigate any loss or harm resulting from 

6 the unauthorized access or misuse of information re7 lating to consumers. 

8 SEC. 8. DELAYED EFFECTIVE DATE FOR CERTAIN PROVI9 SIONS. 

10 (a) COVERED ENTITIES.—Sections 3 and 7 shall take 

11 effect on the later of— 

12 (1) 1 year after the date of enactment of this 

13 Act; or 

14 (2) the effective date of the final regulations re15 quired under section 4. 

16 (b) AGENCIES.—Section 6 shall take effect 1 year 

17 after the date of enactment of this Act. 

Æ 


jbell on DSKDVH8Z91PROD with BILLS