II 

109TH CONGRESS 

1ST SESSION S. 1326 

To require agencies and persons in possession of computerized data containing 

sensitive personal information, to disclose security breaches where such 

breach poses a significant risk of identity theft. 

IN THE SENATE OF THE UNITED STATES 

JUNE 28, 2005 

Mr. SESSIONS introduced the following bill; which was read twice and referred 

to the Committee on the Judiciary 

A BILL 

To require agencies and persons in possession of computerized data containing sensitive personal information, to 

disclose security breaches where such breach poses a 

significant risk of identity theft. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Notification of Risk 

5 to Personal Data Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act, the following definitions shall apply: 

8 (1) AGENCY.—The term ‘‘agency’’— 
2 

•S 1326 IS

1 (A) has the meaning given such term in 

2 section 551(1) of title 5, United States Code; 

3 and 

4 (B) includes any authority of a State or 

5 political subdivision. 

6 (2) BREACH OF SECURITY OF THE SYSTEM.— 

7 The term ‘‘breach of security of the system’’— 

8 (A) means the compromise of the security 

9 of computerized data containing sensitive per10 sonal information that establishes a reasonable 

11 basis to conclude that a significant risk of iden12 tity theft to an individual exists; and 

13 (B) does not include the compromise of the 

14 security of computerized data, if the agency or 

15 person concludes, after conducting a reasonable 

16 investigation, that there is not a significant risk 

17 of identity theft to an individual, including a 

18 situation in which— 

19 (i) sensitive personal information is 

20 acquired in good faith by an employee or 

21 agent of the agency or person and the in22 formation is not subject to further unau23 thorized disclosure; 

24 (ii) an investigation by an appropriate 

25 law enforcement agency, government agen-
3 

•S 1326 IS

1 cy, or official determines that there is not 

2 a significant risk of identity theft; or 

3 (iii) the agency or person maintains or 

4 participates in a security program reason5 ably designed to block unauthorized trans6 actions before they are charged to an indi7 vidual’s account and the security program 

8 does not indicate that the compromise of 

9 sensitive personal information has resulted 

10 in fraud or unauthorized transactions. 

11 (3) PERSON.—The term ‘‘person’’ has the 

12 meaning given such term in section 551(2) of title 

13 5, United States Code. 

14 (4) SENSITIVE PERSONAL INFORMATION.—The 

15 term ‘‘sensitive personal information’’— 

16 (A) means— 

17 (i) an individual’s first and last name; 

18 (ii) the individual’s address or tele19 phone number; and 

20 (iii) the individual’s social security 

21 number, the individual’s driver’s license 

22 number or equivalent State identification 

23 number, or the individual’s financial ac24 count number, credit or debit card number, 

25 in combination with any required security 
4 

•S 1326 IS

1 code, access code, or password that would 

2 permit access to an individual’s financial 

3 account, if the data element under this 

4 clause is not encrypted or redacted and is 

5 linked to the information described in 

6 clauses (i) and (ii); and 

7 (B) does not include— 

8 (i) any list, description, or other 

9 grouping of individuals (and publicly avail10 able information pertaining to them) that 

11 is derived without using any sensitive per12 sonal information; or 

13 (ii) publicly available information that 

14 is lawfully made available to the general 

15 public from Federal, State or local govern16 ment records. 

17 (5) REDACTED.—The term ‘‘redacted’’ means 

18 truncated so that not more than the last 4 digits of 

19 the social security number, driver’s license number, 

20 State identification card number, or account number 

21 are accessible as part of the data. 

22 (6) IDENTITY THEFT.—The term ‘‘identity 

23 theft’’ means a fraud committed using the identifica24 tion of another person with the intent to commit, or 

25 to aid or abet any unlawful activity that constitutes 
5 

•S 1326 IS

1 a violation of Federal law, or that constitutes a fel2 ony under any applicable State or local law and that 

3 results in economic loss to the individual. 

4 (7) PERSONAL INFORMATION.—The term ‘‘per5 sonal information’’ means personally identifiable in6 formation about a specific individual. 

7 (8) FUNCTIONAL REGULATOR.—The term 

8 ‘‘functional regulator’’ means— 

9 (A) the Office of the Comptroller of the 

10 Currency with respect to national banks, and 

11 Federal branches, Federal agencies of foreign 

12 banks, and any subsidiaries of such entities (ex13 cept brokers, dealers, persons providing insur14 ance, investment companies, and investment ad15 visers); 

16 (B) the Board of Governors of the Federal 

17 Reserve System with respect to member banks 

18 of the Federal Reserve System (other than na19 tional banks), branches and agencies of foreign 

20 banks (other than Federal branches, Federal 

21 agencies, and insured State branches of foreign 

22 banks), commercial lending companies owned or 

23 controlled by foreign banks, organizations oper24 ating under section 25 or 25A of the Federal 

25 Reserve Act (12 U.S.C. 601 and 611), bank 
6 

•S 1326 IS

1 and financial holding companies, and any 

2 nonbank subsidiaries or affiliates of such enti3 ties (except brokers, dealers, persons providing 

4 insurance, investment companies, and invest5 ment advisers); 

6 (C) the Board of Directors of the Federal 

7 Deposit Insurance Corporation with respect to 

8 banks insured by the Federal Deposit Insurance 

9 Corporation (other than members of the Fed10 eral Reserve System), insured State branches of 

11 foreign banks, and any subsidiaries of such en12 tities (except brokers, dealers, persons providing 

13 insurance, investment companies, and invest14 ment advisers); 

15 (D) the Director of the Office of Thrift 

16 Supervision with respect to savings association 

17 the deposits of which are insured by the Fed18 eral Deposit Insurance Corporation, savings 

19 and loan holding companies, and any subsidi20 aries of such entities (except brokers, dealers, 

21 persons providing insurance, investment compa22 nies, and investment advisers); 

23 (E) the National Credit Union Administra24 tion Board with respect to any Federal credit 

25 union and any subsidiaries of such an entity; 
7 

•S 1326 IS

1 (F) the Secretary of Transportation with 

2 respect to any air carrier or foreign air carrier 

3 subject to part A of subtitle VII of title 49, 

4 United States Code; 

5 (G) the Secretary of Agriculture with re6 spect to any activities subject to the Packers 

7 and Stockyards Act, 1921 (7 U.S.C. 181 et 

8 seq.) (except as provided in section 406 of that 

9 Act (7 U.S.C. 226 and 227)); 

10 (H) the Farm Credit Administration with 

11 respect to any Federal land bank, Federal land 

12 bank association, Federal intermediate credit 

13 bank, or production credit association; 

14 (I) the Securities and Exchange Commis15 sion with respect to any broker or dealer, in16 vestment company or investment adviser; 

17 (J) the applicable State insurance author18 ity of the State in which the person is domiciled 

19 with respect to any person engaged in providing 

20 insurance; 

21 (K) the Federal Communications Commis22 sion with respect to any entity subject to the ju23 risdiction of the Commission; and 

24 (L) the Federal Trade Commission with 

25 respect to any other financial institution or 
8 

•S 1326 IS

1 other person that is not subject to the jurisdic2 tion of any agency or authority under subpara3 graphs (A) through (K). 

4 SEC. 3. DATABASE SECURITY. 

5 (a) IN GENERAL.—Any agency or person that owns 

6 or licenses computerized data containing sensitive personal 

7 information shall implement and maintain reasonable se8 curity and notification procedures and practices appro9 priate to the size and nature of the agency or person and 

10 the nature of the information to protect the sensitive per11 sonal information from unauthorized access, destruction, 

12 use, modification or disclosure. 

13 (b) DISCLOSURE OF SECURITY BREACH.— 

14 (1) NOTIFICATION OF INDIVIDUAL.— 

15 (A) IN GENERAL.—If an agency or person 

16 that owns or licenses computerized data con17 taining sensitive personal information, deter18 mines, after discovery and a reasonable inves19 tigation, or notification under paragraph (2), 

20 that a significant risk of identity theft exists as 

21 a result of a breach of security of the system 

22 of such agency or person containing such data, 

23 the agency or person shall notify any individual 

24 whose sensitive personal information was com-
9 

•S 1326 IS

1 promised if such individual is known to be a 

2 resident of the United States. 

3 (B) DELAY OF NOTIFICATION.—If a Fed4 eral law enforcement agency of either appro5 priate domestic or foreign jurisdiction deter6 mines that the notification required under this 

7 subsection would impede a criminal or civil in8 vestigation, such notification may be delayed 

9 until such Federal law enforcement agency de10 termines that the notification will no longer 

11 compromise such investigation. 

12 (2) NOTIFICATION OF OWNER OR LICENSOR.— 

13 Any agency or person in possession of computerized 

14 data containing sensitive personal information that 

15 the agency or person does not own or license shall 

16 notify the entity from whom it received the informa17 tion if the security of the sensitive personal informa18 tion was compromised and such compromise has re19 sulted in a significant risk of identity theft to an in20 dividual. 

21 (3) TIMELINESS OF NOTIFICATION.—All notifi22 cations required under paragraph (1) or (2) shall be 

23 made as expediently as possible and without unrea24 sonable delay following— 
10 

•S 1326 IS

1 (A) the discovery and reasonable investiga2 tion by the agency or person of a breach of se3 curity of the system; and 

4 (B) any measures the agency or person 

5 takes that are necessary to determine the scope 

6 of the breach, prevent further breaches, deter7 mine whether there is a reasonable basis to con8 clude that a significant risk of identity theft to 

9 an individual exists, restore the reasonable in10 tegrity of the data system, and comply with ap11 plicable requirements of securities laws and reg12 ulations. 

13 (4) METHODS OF NOTICE.—An agency or per14 son shall be in compliance with this subsection if it 

15 provides the resident, owner, or licensee, as appro16 priate, with— 

17 (A) written notification to a mailing ad18 dress for the subject individual; 

19 (B) telephonic notification to a telephone 

20 number for the subject individual; 

21 (C) e-mail notice to an e-mail address for 

22 the subject individual; or 

23 (D) conspicuous posting of the notice on 

24 the Internet site of the agency or person, if the 
11 

•S 1326 IS

1 agency or person maintains an Internet site, or 

2 notification to major media, if— 

3 (i) the agency or person demonstrates 

4 that the cost of providing direct notice 

5 under paragraphs (A) through (C) of this 

6 subsection would exceed $250,000; 

7 (ii) the affected class of subject indi8 viduals to be notified exceeds 500,000; or 

9 (iii) the agency or person does not 

10 have sufficient contact information for 

11 those to be notified. 

12 (5) CONTENTS OF NOTICE.—Notice under this 

13 subsection shall— 

14 (A) be given in a clear and conspicuous 

15 manner; 

16 (B) describe the breach of security of the 

17 system in general terms and the type of sen18 sitive personal information involved; and 

19 (C) include a toll-free telephone number or 

20 website that individuals can utilize for further 

21 information and assistance. 

22 (6) DUTY TO COORDINATE WITH CONSUMER

23 REPORTING AGENCIES.—Before any agency or per24 son provides notice to more than 1,000 individuals 

25 at any time, or provides notice pursuant to para-
12 

•S 1326 IS

1 graph (4)(D), that sensitive personal information on 

2 the individuals was, or may reasonably be expected 

3 to have been, the subject of a breach of security of 

4 the system, the agency or person shall, without un5 reasonable delay— 

6 (A) notify all nationwide consumer report7 ing agencies (as defined in section 603(p) of the 

8 Fair Credit Reporting Act (15 U.S.C. 

9 1681a(p))) of the timing, content, and distribu10 tion of the notice, including— 

11 (i) the number of individuals to whom 

12 the notice will be given; or 

13 (ii) the type of notice provided under 

14 paragraph (4)(D); and 

15 (B) conform the notice to individuals to be 

16 delivered by such agency or person to accu17 rately reflect, to the extent given in such no18 tice— 

19 (i) the method of contact reasonably 

20 specified by each nationwide consumer re21 porting agency that such individuals are to 

22 use with respect to the particular notice; 

23 and 

24 (ii) the responsibilities of a nationwide 

25 consumer reporting agency under the Fair 
13 

•S 1326 IS

1 Credit Reporting Act (15 U.S.C. 1681 et 

2 seq.) and any other applicable law. 

3 (7) SAFE HARBOR.—Notwithstanding any other 

4 obligation under this subsection, an agency or per5 son that maintains notification procedures as part of 

6 an information security policy for the treatment of 

7 sensitive personal information and is otherwise con8 sistent with the requirements of paragraphs (3) and 

9 (6) shall be in compliance with this subsection if the 

10 agency or person notifies subject persons in accord11 ance with its policies in the event of a breach of se12 curity of the system. 

13 (8) RELATION TO OTHER PROVISIONS.—Noth14 ing in this Act shall be construed to modify, limit or 

15 supersede the operation of either the Fair Credit Re16 porting Act, the Gramm-Leach-Bliley Act, or any 

17 other applicable provision of Federal law. 

18 (c) CIVIL REMEDIES.— 

19 (1) PENALTIES.— 

20 (A) IN GENERAL.—Except as provided 

21 under subparagraph (B), any agency or person 

22 that fails to give notice in accordance with 

23 paragraph (1) through (4) of subsection (b) 

24 shall be subject to— 
14 

•S 1326 IS

1 (i) a fine in an amount not to exceed 

2 $250,000 per breach of security of the sys3 tem; or 

4 (ii) in the case of a violation of sub5 section (a), such actual damages as may be 

6 proven. 

7 (B) EXEMPTION.—An agency or person 

8 shall not be subject to a fine under this para9 graph if the breach of security of the system— 

10 (i) was not a result of the negligence 

11 of such agency or person; and 

12 (ii) was the result of fraud committed 

13 by a third party. 

14 (2) EQUITABLE RELIEF.—Any person that vio15 lates, proposes to violate, or has violated this section 

16 may be enjoined from further violations by a court 

17 of competent jurisdiction. 

18 (3) OTHER RIGHTS AND REMEDIES.—The 

19 rights and remedies available under this subsection 

20 are cumulative and shall not affect any other rights 

21 and remedies available under law. 

22 (d) ENFORCEMENT.— 

23 (1) IN GENERAL.—The functional regulator is 

24 authorized to enforce compliance with this section, 
15 

•S 1326 IS

1 including the assessment of fines under subsection 

2 (c)(1). 

3 (2) CIVIL ACTIONS.—No private right of action 

4 or class action shall be brought under this Act. No 

5 person other than the attorney general of a State 

6 may bring a civil action under the law of any State 

7 if such action is premised in whole or in part upon 

8 the defendant violating any provision of this Act. 

9 SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

10 (a) IN GENERAL.— 

11 (1) CIVIL ACTIONS.—In any case in which the 

12 attorney general of a State has reason to believe 

13 that an interest of the residents of that State has 

14 been or is threatened or adversely affected by the 

15 engagement of any person in a practice that is pro16 hibited under this Act, the State, as parens patriae, 

17 may bring a civil action on behalf of the residents 

18 of the State in a United States district court of ap19 propriate jurisdiction to— 

20 (A) enjoin that practice; 

21 (B) enforce compliance with this Act; or 

22 (C) obtain damage, restitution, or other 

23 compensation on behalf of residents of the 

24 State under the conditions and up to the mone25 tary limits set forth in section 3(c)(1). 
16 

•S 1326 IS

1 (2) NOTICE.— 

2 (A) IN GENERAL.—Before filing an action 

3 under paragraph (1), the attorney general of 

4 the State shall provide the Attorney General of 

5 the United States and the functional regu6 lator— 

7 (i) written notice of the action; and 

8 (ii) a copy of the complaint for the ac9 tion. 

10 (B) EXEMPTION.— 

11 (i) IN GENERAL.—Subparagraph (A) 

12 shall not apply with respect to the filing of 

13 an action by an attorney general of a State 

14 under this subsection, if the State attorney 

15 general determines that it is not feasible to 

16 provide the notice described in such sub17 paragraph before the filing of the action. 

18 (ii) NOTIFICATION.—In an action de19 scribed in clause (i), the attorney general 

20 of a State shall provide notice and a copy 

21 of the complaint to the functional regulator 

22 and the Attorney General at the time the 

23 State attorney general files the action. 

24 (C) UNITED STATES ATTORNEY GENERAL

25 PRIORITY.—After having been notified, as pro-
17 

•S 1326 IS

1 vided in subparagraph (A), the Attorney Gen2 eral shall have the right— 

3 (i) to file a civil action, subject to 

4 monetary limits equal to those set forth in 

5 section 3(c)(1); 

6 (ii) to intervene in the action; 

7 (iii) upon so intervening, to be heard 

8 on all matters arising therein; 

9 (iv) to remove the action to the appro10 priate United States district court; and 

11 (v) to file petitions for appeal. 

12 (D) PREEMPTION.— 

13 (i) ACTION BY DEPARTMENT OF JUS14 TICE.—If the Attorney General institutes a 

15 civil action or intervenes in an action 

16 under this subsection, the functional regu17 lator, a State attorney general, or an offi18 cial or agency of a State may not bring an 

19 action under this section for any violation 

20 of this Act alleged in the complaint. 

21 (ii) ACTION BY FUNCTIONAL REGU22 LATOR.—If the functional regulator insti23 tutes a civil action or intervenes under sec24 tion 3(d)(1) to enforce compliance with 

25 section 3, a State attorney general or offi-
18 

•S 1326 IS

1 cial or agency of a State, may not bring an 

2 action under this section for any violation 

3 of this Act alleged in the complaint. 

4 (b) LIMITATIONS ON STATE ACTIONS.— 

5 (1) VIOLATION OF INJUNCTION REQUIRED.—A 

6 State may not bring an action against a person 

7 under subsection (a)(1)(C) unless— 

8 (A) the person has been enjoined from 

9 committing the violation, in an action brought 

10 by the State under subsection (a)(1)(A); and 

11 (B) the person has violated the injunction. 

12 (2) LIMITATION ON DAMAGES RECOVERABLE.— 

13 In an action under subsection (a)(1)(C), a State 

14 may not recover any damages incurred before the 

15 date of the violation of an injunction on which the 

16 action is based. 

17 (c) CONSTRUCTION.—For purposes of a civil action 

18 under subsection (a), nothing in this Act shall be con19 strued to prevent the attorney general of a State from ex20 ercising the powers conferred on such attorney general by 

21 the laws of that State to— 

22 (1) conduct investigations; 

23 (2) administer oaths or affirmations; or 

24 (3) compel the attendance of witnesses or the 

25 production of documentary and other evidence. 
19 

•S 1326 IS

1 (d) VENUE; SERVICE OF PROCESS.— 

2 (1) VENUE.—Any action brought under sub3 section (a) may be brought in the district court of 

4 the United States that meets applicable require5 ments relating to venue under section 1391 of title 

6 28, United States Code. 

7 (2) SERVICE OF PROCESS.—In an action 

8 brought under subsection (a), process may be served 

9 in any district in which the defendant— 

10 (A) is an inhabitant; or 

11 (B) may be found. 

12 SEC. 5. EFFECT ON STATE LAW. 

13 The provisions of this Act shall supersede any law, 

14 rule, or regulation of any State or unit of local government 

15 that relates in any way to electronic information security 

16 standards or the notification of any resident of the United 

17 States of any breach of security pertaining to any collec18 tion of personal information about such resident. 

19 SEC. 6. EFFECTIVE DATE. 

20 This Act shall take effect on the expiration of the 

21 date which is 180 days after the date of enactment of this 

22 Act. 

Æ