II 

Calendar No. 297 

109TH CONGRESS 

1ST SESSION S. 1789 

To prevent and mitigate identity theft, to ensure privacy, to provide notice 

of security breaches, and to enhance criminal penalties, law enforcement 

assistance, and other protections against security breaches, fraudulent 

access, and misuse of personally identifiable information. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 29, 2005 

Mr. SPECTER (for himself, Mr. LEAHY, Mrs. FEINSTEIN, and Mr. FEINGOLD) 

introduced the following bill; which was read twice and referred to the 

Committee on the Judiciary 

NOVEMBER 17, 2005 

Reported by Mr. SPECTER, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To prevent and mitigate identity theft, to ensure privacy, 

to provide notice of security breaches, and to enhance 

criminal penalties, law enforcement assistance, and other 

protections against security breaches, fraudulent access, 

and misuse of personally identifiable information. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•S 1789 RS

1 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

2 (a) SHORT TITLE.—This Act may be cited as the 

3 ‘‘Personal Data Privacy and Security Act of 2005’’. 

4 (b) TABLE OF CONTENTS.—The table of contents for 

5 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Findings. 

Sec. 3. Definitions. 

TITLE I—ENHANCING PUNISHMENT FOR IDENTITY THEFT AND 

OTHER VIOLATIONS OF DATA PRIVACY AND SECURITY 

Sec. 101. Fraud and related criminal activity in connection with unauthorized 

access to personally identifiable information. 

Sec. 102. Organized criminal activity in connection with unauthorized access to 

personally identifiable information. 

Sec. 103. Concealment of security breaches involving sensitive personally identifiable information. 

Sec. 104. Aggravated fraud in connection with computers. 

Sec. 105. Review and amendment of Federal sentencing guidelines related to 

fraudulent access to or misuse of digitized or electronic personally identifiable information. 

TITLE II—ASSISTANCE FOR STATE AND LOCAL LAW ENFORCEMENT COMBATING CRIMES RELATED TO FRAUDULENT, UNAUTHORIZED, OR OTHER CRIMINAL USE OF PERSONALLY IDENTIFIABLE INFORMATION 

Sec. 201. Grants for State and local enforcement. 

Sec. 202. Authorization of appropriations. 

TITLE III—DATA BROKERS 

Sec. 301. Transparency and accuracy of data collection. 

Sec. 302. Enforcement. 

Sec. 303. Relation to State laws. 

Sec. 304. Effective date. 

TITLE IV—PRIVACY AND SECURITY OF PERSONALLY 

IDENTIFIABLE INFORMATION 

Subtitle A—Data Privacy and Security Program 

Sec. 401. Purpose and applicability of data privacy and security program. 

Sec. 402. Requirements for a personal data privacy and security program. 

Sec. 403. Enforcement. 

Sec. 404. Relation to State laws. 

Subtitle B—Security Breach Notification 

Sec. 421. Right to notice of security breach. 

Sec. 422. Notice procedures. 
3 

•S 1789 RS

Sec. 423. Content of notice. 

Sec. 424. Risk assessment and fraud prevention notice exemptions. 

Sec. 425. Victim protection assistance. 

Sec. 426. Enforcement. 

Sec. 427. Relation to State laws. 

Sec. 428. Study on securing personally identifiable information in the digital 

era. 

Sec. 429. Reporting on risk assessment exemption. 

Sec. 430. Authorization of appropriations. 

Sec. 431. Reporting on risk assessment exemption. 

Sec. 432. Effective date. 

TITLE V—GOVERNMENT ACCESS TO AND USE OF COMMERCIAL 

DATA 

Sec. 501. General Services Administration review of contracts. 

Sec. 502. Requirement to audit information security practices of contractors 

and third party business entities. 

Sec. 503. Privacy impact assessment of government use of commercial information services containing personally identifiable information. 

Sec. 504. Implementation of Chief Privacy Officer requirements. 

1 SEC. 2. FINDINGS. 

2 Congress finds that— 

3 (1) databases of personally identifiable informa4 tion are increasingly prime targets of hackers, iden5 tity thieves, rogue employees, and other criminals, 

6 including organized and sophisticated criminal oper7 ations; 

8 (2) identity theft is a serious threat to the na9 tion’s economic stability, homeland security, the de10 velopment of e-commerce, and the privacy rights of 

11 Americans; 

12 (3) over 9,300,000 individuals were victims of 

13 identity theft in America last year; 

14 (4) security breaches are a serious threat to 

15 consumer confidence, homeland security, e-com16 merce, and economic stability; 
4 

•S 1789 RS

1 (5) it is important for business entities that 

2 own, use, or license personally identifiable informa3 tion to adopt reasonable procedures to ensure the se4 curity, privacy, and confidentially of that personally 

5 identifiable information; 

6 (6) individuals whose personal information has 

7 been compromised or who have been victims of iden8 tity theft should receive the necessary information 

9 and assistance to mitigate their damages and to re10 store the integrity of their personal information and 

11 identities; 

12 (7) data brokers have assumed a significant 

13 role in providing identification, authentication, and 

14 screening services, and related data collection and 

15 analyses for commercial, nonprofit, and government 

16 operations; 

17 (8) data misuse and use of inaccurate data have 

18 the potential to cause serious or irreparable harm to 

19 an individual’s livelihood, privacy, and liberty and 

20 undermine efficient and effective business and gov21 ernment operations; 

22 (9) there is a need to insure that data brokers 

23 conduct their operations in a manner that prioritizes 

24 fairness, transparency, accuracy, and respect for the 

25 privacy of consumers; 
5 

•S 1789 RS

1 (10) government access to commercial data can 

2 potentially improve safety, law enforcement, and na3 tional security; and 

4 (11) because government use of commercial 

5 data containing personal information potentially af6 fects individual privacy, and law enforcement and 

7 national security operations, there is a need for Con8 gress to exercise oversight over government use of 

9 commercial data. 

10 SEC. 3. DEFINITIONS. 

11 In this Act: 

12 (1) AGENCY.—The term ‘‘agency’’ has the same 

13 meaning given such term in section 551 of title 5, 

14 United States Code. 

15 (2) AFFILIATE.—The term ‘‘affiliate’’ means 

16 persons related by common ownership or by cor17 porate control. 

18 (3) BUSINESS ENTITY.—The term ‘‘business 

19 entity’’ means any organization, corporation, trust, 

20 partnership, sole proprietorship, unincorporated as21 sociation, venture established to make a profit, or 

22 nonprofit, and any contractor, subcontractor, affil23 iate, or licensee thereof engaged in interstate com24 merce. 
6 

•S 1789 RS

1 (4) IDENTITY THEFT.—The term ‘‘identity 

2 theft’’ means a violation of section 1028 of title 18, 

3 United States Code, or any other similar provision 

4 of applicable State law. 

5 (5) DATA BROKER.—The term ‘‘data broker’’ 

6 means a business entity which for monetary fees, 

7 dues, or on a cooperative nonprofit basis, currently 

8 or regularly engages, in whole or in part, in the 

9 practice of collecting, transmitting, or providing ac10 cess to sensitive personally identifiable information 

11 primarily for the purposes of providing such infor12 mation to nonaffiliated third parties on a nationwide 

13 basis on more than 5,000 individuals who are not 

14 the customers or employees of the business entity or 

15 affiliate. 

16 (6) DATA FURNISHER.—The term ‘‘data fur17 nisher’’ means any agency, governmental entity, or18 ganization, corporation, trust, partnership, sole pro19 prietorship, unincorporated association, venture es20 tablished to make a profit, or nonprofit, and any 

21 contractor, subcontractor, affiliate, or licensee there22 of, that serves as a source of information for a data 

23 broker. 

24 (7) PERSONAL ELECTRONIC RECORD.—The 

25 term ‘‘personal electronic record’’ means data associ-
7 

•S 1789 RS

1 ated with an individual contained in a database, 

2 networked or integrated databases, or other data 

3 system that holds sensitive personally identifiable in4 formation of that individual and is provided to non5 affiliated third parties. 

6 (8) PERSONALLY IDENTIFIABLE INFORMA7 TION.—The term ‘‘personally identifiable informa8 tion’’ means any information, or compilation of in9 formation, in electronic or digital form serving as a 

10 means of identification, as defined by section 

11 1028(d)(7) of title 18, United State Code. 

12 (9) PUBLIC RECORD SOURCE.—The term ‘‘pub13 lic record source’’ means any agency, Federal court, 

14 or State court that maintains personally identifiable 

15 information in records available to the public. 

16 (10) SECURITY BREACH.— 

17 (A) IN GENERAL.—The term ‘‘security 

18 breach’’ means compromise of the security, con19 fidentiality, or integrity of computerized data 

20 through misrepresentation or actions that result 

21 in, or there is a reasonable basis to conclude 

22 has resulted in, the unauthorized acquisition of 

23 and access to sensitive personally identifiable 

24 information. 
8 

•S 1789 RS

1 (B) EXCLUSION.—The term ‘‘security 

2 breach’’ does not include— 

3 (i) a good faith acquisition of sensitive 

4 personally identifiable information by a 

5 business entity or agency, or an employee 

6 or agent of a business entity or agency, if 

7 the sensitive personally identifiable infor8 mation is not subject to further unauthor9 ized disclosure; or 

10 (ii) the release of a public record not 

11 otherwise subject to confidentiality or non12 disclosure requirements. 

13 (11) SENSITIVE PERSONALLY IDENTIFIABLE IN14 FORMATION.—The term ‘‘sensitive personally identi15 fiable information’’ means any information or com16 pilation of information, in electronic or digital form 

17 that includes: 

18 (A) An individual’s name in combination 

19 with any 1 of the following data elements: 

20 (i) A non-truncated social security 

21 number, driver’s license number, passport 

22 number, or alien registration number. 

23 (ii) Any 2 of the following: 

24 (I) Information that relates to— 
9 

•S 1789 RS

1 (aa) the past, present, or fu2 ture physical or mental health or 

3 condition of an individual; 

4 (bb) the provision of health 

5 care to an individual; or 

6 (cc) the past, present, or fu7 ture payment for the provision of 

8 health care to an individual. 

9 (II) Home address or telephone 

10 number. 

11 (III) Mother’s maiden name, if 

12 identified as such. 

13 (IV) Month, day, and year of 

14 birth. 

15 (iii) Unique biometric data such as a 

16 finger print, voice print, a retina or iris 

17 image, or any other unique physical rep18 resentation. 

19 (iv) A unique electronic identification 

20 number, user name, or routing code in 

21 combination with the associated security 

22 code, access code, or password. 

23 (v) Any other information regarding 

24 an individual determined appropriate by 

25 the Federal Trade Commission. 
10 

•S 1789 RS

1 (B) A financial account number or credit 

2 or debit card number in combination with the 

3 required security code, access code, or pass4 word. 

5 TITLE I—ENHANCING PUNISH6 MENT FOR IDENTITY THEFT 

7 AND OTHER VIOLATIONS OF 

8 DATA PRIVACY AND SECU9 RITY 

10 SEC. 101. FRAUD AND RELATED CRIMINAL ACTIVITY IN 

11 CONNECTION WITH UNAUTHORIZED ACCESS 

12 TO PERSONALLY IDENTIFIABLE INFORMA13 TION. 

14 Section 1030(a)(2) of title 18, United States Code, 

15 is amended— 

16 (1) in subparagraph (B), by striking ‘‘or’’ after 

17 the semicolon; 

18 (2) in subparagraph (C), by inserting ‘‘or’’ after 

19 the semicolon; and 

20 (3) by adding at the end the following: 

21 ‘‘(D) information contained in the data22 bases or systems of a data broker, or in other 

23 personal electronic records, as such terms are 

24 defined in section 3 of the Personal Data Pri25 vacy and Security Act of 2005;’’. 
11 

•S 1789 RS

1 SEC. 102. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION 

2 WITH UNAUTHORIZED ACCESS TO PERSON3 ALLY IDENTIFIABLE INFORMATION. 

4 Section 1961(1) of title 18, United States Code, is 

5 amended by inserting ‘‘section 1030(a)(2)(D)(relating to 

6 fraud and related activity in connection with unauthorized 

7 access to personally identifiable information,’’ before ‘‘sec8 tion 1084’’. 

9 SEC. 103. CONCEALMENT OF SECURITY BREACHES INVOLV10 ING SENSITIVE PERSONALLY IDENTIFIABLE 

11 INFORMATION. 

12 (a) IN GENERAL.—Chapter 47 of title 18, United 

13 States Code, is amended by adding at the end the fol14 lowing: 

15 ‘‘§ 1039. Concealment of security breaches involving 

16 sensitive personally identifiable informa17 tion 

18 ‘‘(a) Whoever, having knowledge of a security breach 

19 and the obligation to provide notice of such breach to indi20 viduals under title IV of the Personal Data Privacy and 

21 Security Act of 2005, and having not otherwise qualified 

22 for an exemption from providing notice under section 422 

23 of such Act, intentionally and willfully conceals the fact 

24 of such security breach which causes economic damages 

25 to 1 or more persons, shall be fined under this title or 

26 imprisoned not more than 5 years, or both. 
12 

•S 1789 RS

1 ‘‘(b) For purposes of subsection (a), the term ‘person’ 

2 means any individual, corporation, company, association, 

3 firm, partnership, society, or joint stock company.’’. 

4 (b) CONFORMING AND TECHNICAL AMENDMENTS.— 

5 The table of sections for chapter 47 of title 18, United 

6 States Code, is amended by adding at the end the fol7 lowing: 

‘‘1039. Concealment of security breaches involving personally identifiable information.’’. 

8 (c) ENFORCEMENT AUTHORITY.—The United States 

9 Secret Service shall have the authority to investigate of10 fenses under this section. 

11 SEC. 104. AGGRAVATED FRAUD IN CONNECTION WITH COM12 PUTERS. 

13 (a) IN GENERAL.—Chapter 47 of title 18, United 

14 States Code, is amended by adding after section 1030 the 

15 following: 

16 ‘‘§ 1030A. Aggravated fraud in connection with com17 puters 

18 ‘‘(a) IN GENERAL.—Whoever, during and in relation 

19 to any felony violation enumerated in subsection (c), 

20 knowingly obtains, accesses, or transmits, without lawful 

21 authority, a means of identification of another person 

22 may, in addition to the punishment provided for such fel23 ony, be sentenced to a term of imprisonment of up to 2 

24 years. 
13 

•S 1789 RS

1 ‘‘(b) CONSECUTIVE SENTENCES.—Notwithstanding 

2 any other provision of law, should a court in its discretion 

3 impose an additional sentence under subsection (a)— 

4 ‘‘(1) no term of imprisonment imposed on a 

5 person under this section shall run concurrently, ex6 cept as provided in paragraph (3), with any other 

7 term of imprisonment imposed on such person under 

8 any other provision of law, including any term of im9 prisonment imposed for the felony during which the 

10 means of identifications was obtained, accessed, or 

11 transmitted; 

12 ‘‘(2) in determining any term of imprisonment 

13 to be imposed for the felony during which the means 

14 of identification was obtained, accessed, or trans15 mitted, a court shall not in any way reduce the term 

16 to be imposed for such crime so as to compensate 

17 for, or otherwise take into account, any separate 

18 term of imprisonment imposed or to be imposed for 

19 a violation of this section; and 

20 ‘‘(3) a term of imprisonment imposed on a per21 son for a violation of this section may, in the discre22 tion of the court, run concurrently, in whole or in 

23 part, only with another term of imprisonment that 

24 is imposed by the court at the same time on that 

25 person for an additional violation of this section. 
14 

•S 1789 RS

1 ‘‘(c) DEFINITION.—For purposes of this section, the 

2 term ‘felony violation enumerated in subsection (c)’ means 

3 any offense that is a felony violation of paragraphs (2) 

4 through (7) of section 1030(a).’’. 

5 (b) CONFORMING AND TECHNICAL AMENDMENTS.— 

6 The table of sections for chapter 47 of title 18, United 

7 States Code, is amended by inserting after the item relat8 ing to section 1030 the following new item: 

‘‘1030A. Aggravated fraud in connection with computers.’’. 

9 SEC. 105. REVIEW AND AMENDMENT OF FEDERAL SEN10 TENCING GUIDELINES RELATED TO FRAUDU11 LENT ACCESS TO OR MISUSE OF DIGITIZED 

12 OR ELECTRONIC PERSONALLY IDENTIFIABLE 

13 INFORMATION. 

14 (a) REVIEW AND AMENDMENT.—Not later than 180 

15 days after the date of enactment of this Act, the United 

16 States Sentencing Commission, pursuant to its authority 

17 under section 994 of title 28, United States Code, and 

18 in accordance with this section, shall review and, if appro19 priate, amend the Federal sentencing guidelines (including 

20 its policy statements) applicable to persons convicted of 

21 using fraud to access, or misuse of, digitized or electronic 

22 personally identifiable information, including identity theft 

23 or any offense under— 

24 (1) sections 1028, 1028A, 1030, 1030A, 2511, 

25 and 2701 of title 18, United States Code; or 
15 

•S 1789 RS

1 (2) any other relevant provision. 

2 (b) REQUIREMENTS.—In carrying out the require3 ments of this section, the United States Sentencing Com4 mission shall— 

5 (1) ensure that the Federal sentencing guide6 lines (including its policy statements) reflect— 

7 (A) the serious nature of the offenses and 

8 penalties referred to in this Act; 

9 (B) the growing incidences of theft and 

10 misuse of digitized or electronic personally iden11 tifiable information, including identity theft; 

12 and 

13 (C) the need to deter, prevent, and punish 

14 such offenses; 

15 (2) consider the extent to which the Federal 

16 sentencing guidelines (including its policy state17 ments) adequately address violations of the sections 

18 amended by this Act to— 

19 (A) sufficiently deter and punish such of20 fenses; and 

21 (B) adequately reflect the enhanced pen22 alties established under this Act; 

23 (3) maintain reasonable consistency with other 

24 relevant directives and sentencing guidelines; 
16 

•S 1789 RS

1 (4) account for any additional aggravating or 

2 mitigating circumstances that might justify excep3 tions to the generally applicable sentencing ranges; 

4 (5) consider whether to provide a sentencing en5 hancement for those convicted of the offenses de6 scribed in subsection (a), if the conduct involves— 

7 (A) the online sale of fraudulently obtained 

8 or stolen personally identifiable information; 

9 (B) the sale of fraudulently obtained or 

10 stolen personally identifiable information to an 

11 individual who is engaged in terrorist activity or 

12 aiding other individuals engaged in terrorist ac13 tivity; or 

14 (C) the sale of fraudulently obtained or 

15 stolen personally identifiable information to fi16 nance terrorist activity or other criminal activi17 ties; 

18 (6) make any necessary conforming changes to 

19 the Federal sentencing guidelines to ensure that 

20 such guidelines (including its policy statements) as 

21 described in subsection (a) are sufficiently stringent 

22 to deter, and adequately reflect crimes related to 

23 fraudulent access to, or misuse of, personally identi24 fiable information; and 
17 

•S 1789 RS

1 (7) ensure that the Federal sentencing guide2 lines adequately meet the purposes of sentencing 

3 under section 3553(a)(2) of title 18, United States 

4 Code. 

5 (c) EMERGENCY AUTHORITY TO SENTENCING COM6 MISSION.—The United States Sentencing Commission 

7 may, as soon as practicable, promulgate amendments 

8 under this section in accordance with procedures estab9 lished in section 21(a) of the Sentencing Act of 1987 (28 

10 U.S.C. 994 note) as though the authority under that Act 

11 had not expired. 

12 TITLE II—ASSISTANCE FOR 

13 STATE AND LOCAL LAW EN14 FORCEMENT COMBATING 

15 CRIMES RELATED TO FRAUD16 ULENT, UNAUTHORIZED, OR 

17 OTHER CRIMINAL USE OF 

18 PERSONALLY IDENTIFIABLE 

19 INFORMATION 

20 SEC. 201. GRANTS FOR STATE AND LOCAL ENFORCEMENT. 

21 (a) IN GENERAL.—Subject to the availability of 

22 amounts provided in advance in appropriations Acts, the 

23 Assistant Attorney General for the Office of Justice Pro24 grams of the Department of Justice may award a grant 

25 to a State to establish and develop programs to increase 
18 

•S 1789 RS

1 and enhance enforcement against crimes related to fraud2 ulent, unauthorized, or other criminal use of personally 

3 identifiable information. 

4 (b) APPLICATION.—A State seeking a grant under 

5 subsection (a) shall submit an application to the Assistant 

6 Attorney General for the Office of Justice Programs of 

7 the Department of Justice at such time, in such manner, 

8 and containing such information as the Assistant Attorney 

9 General may require. 

10 (c) USE OF GRANT AMOUNTS.—A grant awarded to 

11 a State under subsection (a) shall be used by a State, in 

12 conjunction with units of local government within that 

13 State, State and local courts, other States, or combina14 tions thereof, to establish and develop programs to— 

15 (1) assist State and local law enforcement agen16 cies in enforcing State and local criminal laws relat17 ing to crimes involving the fraudulent, unauthorized, 

18 or other criminal use of personally identifiable infor19 mation; 

20 (2) assist State and local law enforcement agen21 cies in educating the public to prevent and identify 

22 crimes involving the fraudulent, unauthorized, or 

23 other criminal use of personally identifiable informa24 tion; 
19 

•S 1789 RS

1 (3) educate and train State and local law en2 forcement officers and prosecutors to conduct inves3 tigations and forensic analyses of evidence and pros4 ecutions of crimes involving the fraudulent, unau5 thorized, or other criminal use of personally identifi6 able information; 

7 (4) assist State and local law enforcement offi8 cers and prosecutors in acquiring computer and 

9 other equipment to conduct investigations and foren10 sic analysis of evidence of crimes involving the 

11 fraudulent, unauthorized, or other criminal use of 

12 personally identifiable information; and 

13 (5) facilitate and promote the sharing of Fed14 eral law enforcement expertise and information 

15 about the investigation, analysis, and prosecution of 

16 crimes involving the fraudulent, unauthorized, or 

17 other criminal use of personally identifiable informa18 tion with State and local law enforcement officers 

19 and prosecutors, including the use of multi-jurisdic20 tional task forces. 

21 (d) ASSURANCES AND ELIGIBILITY.—To be eligible 

22 to receive a grant under subsection (a), a State shall pro23 vide assurances to the Attorney General that the State— 

24 (1) has in effect laws that penalize crimes in25 volving the fraudulent, unauthorized, or other crimi-
20 

•S 1789 RS

1 nal use of personally identifiable information, such 

2 as penal laws prohibiting— 

3 (A) fraudulent schemes executed to obtain 

4 personally identifiable information; 

5 (B) schemes executed to sell or use fraudu6 lently obtained personally identifiable informa7 tion; and 

8 (C) online sales of personally identifiable 

9 information obtained fraudulently or by other 

10 illegal means; 

11 (2) will provide an assessment of the resource 

12 needs of the State and units of local government 

13 within that State, including criminal justice re14 sources being devoted to the investigation and en15 forcement of laws related to crimes involving the 

16 fraudulent, unauthorized, or other criminal use of 

17 personally identifiable information; and 

18 (3) will develop a plan for coordinating the pro19 grams funded under this section with other federally 

20 funded technical assistant and training programs, 

21 including directly funded local programs such as the 

22 Local Law Enforcement Block Grant program (de23 scribed under the heading ‘‘Violent Crime Reduction 

24 Programs, State and Local Law Enforcement As25 sistance’’ of the Departments of Commerce, Justice, 
21 

•S 1789 RS

1 and State, the Judiciary, and Related Agencies Ap2 propriations Act, 1998 (Public Law 105–119)). 

3 (e) MATCHING FUNDS.—The Federal share of a 

4 grant received under this section may not exceed 90 per5 cent of the total cost of a program or proposal funded 

6 under this section unless the Attorney General waives, 

7 wholly or in part, the requirements of this subsection. 

8 SEC. 202. AUTHORIZATION OF APPROPRIATIONS. 

9 (a) IN GENERAL.—There is authorized to be appro10 priated to carry out this title $25,000,000 for each of fis11 cal years 2006 through 2009. 

12 (b) LIMITATIONS.—Of the amount made available to 

13 carry out this title in any fiscal year not more than 3 per14 cent may be used by the Attorney General for salaries and 

15 administrative expenses. 

16 (c) MINIMUM AMOUNT.—Unless all eligible applica17 tions submitted by a State or units of local government 

18 within a State for a grant under this title have been fund19 ed, the State, together with grantees within the State 

20 (other than Indian tribes), shall be allocated in each fiscal 

21 year under this title not less than 0.75 percent of the total 

22 amount appropriated in the fiscal year for grants pursuant 

23 to this title, except that the United States Virgin Islands, 

24 American Samoa, Guam, and the Northern Mariana Is25 lands each shall be allocated 0.25 percent. 
22 

•S 1789 RS

1 (d) GRANTS TO INDIAN TRIBES.—Notwithstanding 

2 any other provision of this title, the Attorney General may 

3 use amounts made available under this title to make 

4 grants to Indian tribes for use in accordance with this 

5 title. 

6 TITLE III—DATA BROKERS 

7 SEC. 301. TRANSPARENCY AND ACCURACY OF DATA COL8 LECTION. 

9 (a) IN GENERAL.—Data brokers engaging in inter10 state commerce are subject to the requirements of this 

11 title for any product or service offered to third parties that 

12 allows access, use, compilation, distribution, processing, 

13 analyzing, or evaluation of sensitive personally identifiable 

14 information. 

15 (b) LIMITATION.—Notwithstanding any other para16 graph of this title, this section shall not apply to— 

17 (1) data brokers engaging in interstate com18 merce for any offered product or service currently 

19 subject to, and in compliance with, access and accu20 racy protections similar to those under subsections 

21 (c) through (f) of this section under the Fair Credit 

22 Reporting Act (Public Law 91–508), or the Gramm23 Leach Bliley Act (Public Law 106–102); 

24 (2) data brokers engaging in interstate com25 merce for any offered product or service currently in 
23 

•S 1789 RS

1 compliance with the requirements for such entities 

2 under the Health Insurance Portability and Ac3 countability Act (Public Law 104–191), and imple4 menting regulations; 

5 (3) information in a personal electronic record 

6 held by a data broker if— 

7 (A) the data broker maintains such infor8 mation solely pursuant to a license agreement 

9 with another business entity; and 

10 (B) the business entity providing such in11 formation to the data broker pursuant to a li12 cense agreement either complies with the provi13 sions of this section or qualifies for this exemp14 tion; and 

15 (4) information in a personal record that— 

16 (A) the data broker has identified as inac17 curate, but maintains for the purpose of aiding 

18 the data broker in preventing inaccurate infor19 mation from entering an individual’s personal 

20 electronic record; and 

21 (B) is not maintained primarily for the 

22 purpose of transmitting or otherwise providing 

23 that information, or assessments based on that 

24 information, to non-affiliated third parties. 

25 (c) DISCLOSURES TO INDIVIDUALS.— 
24 

•S 1789 RS

1 (1) IN GENERAL.—A data broker shall, upon 

2 the request of an individual, clearly and accurately 

3 disclose to such individual for a reasonable fee all 

4 personal electronic records pertaining to that indi5 vidual maintained for disclosure to third parties in 

6 the ordinary course of business in the databases or 

7 systems of the data broker at the time of the re8 quest. 

9 (2) INFORMATION ON HOW TO CORRECT INAC10 CURACIES.—The disclosures required under para11 graph (1) shall also include guidance to individuals 

12 on the processes and procedures for demonstrating 

13 and correcting any inaccuracies. 

14 (d) CREATION OF AN ACCURACY RESOLUTION PROC15 ESS.—A data broker shall develop and publish on its 

16 website timely and fair processes and procedures for re17 sponding to claims of inaccuracies, including procedures 

18 for correcting inaccurate information in the personal elec19 tronic records it maintains on individuals. 

20 (e) ACCURACY RESOLUTION PROCESS.— 

21 (1) INFORMATION FROM A PUBLIC RECORD

22 SOURCE.— 

23 (A) IN GENERAL.—If an individual notifies 

24 a data broker of a dispute as to the complete25 ness or accuracy of information, and the data 
25 

•S 1789 RS

1 broker determines that such information is de2 rived from a public record source, the data 

3 broker shall determine within 30 days whether 

4 the information in its system accurately and 

5 completely records the information offered by 

6 the public record source. 

7 (B) DATA BROKER ACTIONS.—If a data 

8 broker determines under subparagraph (A) that 

9 the information in its systems— 

10 (i) does not accurately and completely 

11 record the information offered by a public 

12 record source, the data broker shall correct 

13 any inaccuracies or incompleteness, and 

14 provide to such individual written notice of 

15 such changes; and 

16 (ii) does accurately and completely 

17 record the information offered by a public 

18 record source, the data broker shall— 

19 (I) provide such individual with 

20 the name, address, and telephone con21 tact information of the public record 

22 source; and 

23 (II) notify such individual of the 

24 right to add for a period of 90 days 

25 to the personal electronic record of 
26 

•S 1789 RS

1 the individual maintained by the data 

2 broker notice of the dispute under 

3 subsection (f). 

4 (2) INVESTIGATION OF DISPUTED INFORMATION

5 NOT FROM A PUBLIC RECORD SOURCE.—If the com6 pleteness or accuracy of any nonpublic record source 

7 disclosed to an individual under subsection (c) is dis8 puted by the individual and such individual notifies 

9 the data broker directly of such dispute, the data 

10 broker shall, before the end of the 30-day period be11 ginning on the date on which the data broker re12 ceives the notice of the dispute— 

13 (A) investigate free of charge and record 

14 the current status of the disputed information; 

15 or 

16 (B) delete the item from the individuals 

17 data file in accordance with paragraph (8). 

18 (3) EXTENSION OF PERIOD TO INVESTIGATE.— 

19 Except as provided in paragraph (4), the 30-day pe20 riod described in paragraph (1) may be extended for 

21 not more than 15 additional days if a data broker 

22 receives information from the individual during that 

23 30-day period that is relevant to the investigation. 

24 (4) LIMITATIONS ON EXTENSION OF PERIOD TO

25 INVESTIGATE.—Paragraph (3) shall not apply to any 
27 

•S 1789 RS

1 investigation in which, during the 30-day period de2 scribed in paragraph (1), the information that is the 

3 subject of the investigation is found to be inaccurate 

4 or incomplete or a data broker determines that the 

5 information cannot be verified. 

6 (5) NOTICE IDENTIFYING THE DATA FUR7 NISHER.—If the completeness or accuracy of any in8 formation disclosed to an individual under sub9 section (c) is disputed by the individual, a data 

10 broker shall provide upon the request of the indi11 vidual, the name, business address, and telephone 

12 contact information of any data furnisher who pro13 vided an item of information in dispute. 

14 (6) DETERMINATION THAT DISPUTE IS FRIVO15 LOUS OR IRRELEVANT.— 

16 (A) IN GENERAL.—Notwithstanding para17 graphs (1) through (4), a data broker may de18 cline to investigate or terminate an investiga19 tion of information disputed by an individual 

20 under those paragraphs if the data broker rea21 sonably determines that the dispute by the indi22 vidual is frivolous or irrelevant, including by 

23 reason of a failure by the individual to provide 

24 sufficient information to investigate the dis25 puted information. 
28 

•S 1789 RS

1 (B) NOTICE.—Not later than 5 business 

2 days after making any determination in accord3 ance with subparagraph (A) that a dispute is 

4 frivolous or irrelevant, a data broker shall no5 tify the individual of such determination by 

6 mail, or if authorized by the individual, by any 

7 other means available to the data broker. 

8 (C) CONTENTS OF NOTICE.—A notice 

9 under subparagraph (B) shall include— 

10 (i) the reasons for the determination 

11 under subparagraph (A); and 

12 (ii) identification of any information 

13 required to investigate the disputed infor14 mation, which may consist of a standard15 ized form describing the general nature of 

16 such information. 

17 (7) CONSIDERATION OF INDIVIDUAL INFORMA18 TION.—In conducting any investigation with respect 

19 to disputed information in the personal electronic 

20 record of any individual, a data broker shall review 

21 and consider all relevant information submitted by 

22 the individual in the period described in paragraph 

23 (2) with respect to such disputed information. 

24 (8) TREATMENT OF INACCURATE OR UNVERIFI25 ABLE INFORMATION.— 
29 

•S 1789 RS

1 (A) IN GENERAL.—If, after any review of 

2 public record information under paragraph (1) 

3 or any investigation of any information disputed 

4 by an individual under paragraphs (2) through 

5 (4), an item of information is found to be inac6 curate or incomplete or cannot be verified, a 

7 data broker shall promptly delete that item of 

8 information from the individual’s personal elec9 tronic record or modify that item of informa10 tion, as appropriate, based on the results of the 

11 investigation. 

12 (B) NOTICE TO INDIVIDUALS OF REINSER13 TION OF PREVIOUSLY DELETED INFORMA14 TION.—If any information that has been de15 leted from an individual’s personal electronic 

16 record pursuant to subparagraph (A) is re17 inserted in the personal electronic record of the 

18 individual, a data broker shall, not later than 5 

19 days after reinsertion, notify the individual of 

20 the reinsertion and identify any data furnisher 

21 not previously disclosed in writing, or if author22 ized by the individual for that purpose, by any 

23 other means available to the data broker, unless 

24 such notification has been previously given 

25 under this subsection. 
30 

•S 1789 RS

1 (C) NOTICE OF RESULTS OF INVESTIGA2 TION OF DISPUTED INFORMATION FROM A NON3 PUBLIC RECORD SOURCE.— 

4 (i) IN GENERAL.—Not later than 5 

5 business days after the completion of an 

6 investigation under paragraph (2), a data 

7 broker shall provide written notice to an 

8 individual of the results of the investiga9 tion, by mail or, if authorized by the indi10 vidual for that purpose, by other means 

11 available to the data broker. 

12 (ii) ADDITIONAL REQUIREMENT.—Be13 fore the expiration of the 5-day period, as 

14 part of, or in addition to such notice, a 

15 data broker shall, in writing, provide to an 

16 individual— 

17 (I) a statement that the inves18 tigation is completed; 

19 (II) a report that is based upon 

20 the personal electronic record of such 

21 individual as that personal electronic 

22 record is revised as a result of the in23 vestigation; 

24 (III) a notice that, if requested 

25 by the individual, a description of the 
31 

•S 1789 RS

1 procedures used to determine the ac2 curacy and completeness of the infor3 mation shall be provided to the indi4 vidual by the data broker, including 

5 the business name, address, and tele6 phone number of any data furnisher 

7 of information contacted in connection 

8 with such information; and 

9 (IV) a notice that the individual 

10 has the right to request notifications 

11 under subsection (f). 

12 (D) DESCRIPTION OF INVESTIGATION PRO13 CEDURES.—Not later than 15 days after receiv14 ing a request from an individual for a descrip15 tion referred to in subparagraph (C)(ii)(III), a 

16 data broker shall provide to the individual such 

17 a description. 

18 (E) EXPEDITED DISPUTE RESOLUTION.— 

19 If by no later than 3 business days after the 

20 date on which a data broker receives notice of 

21 a dispute from an individual of information in 

22 the personal electronic record of such individual 

23 in accordance with paragraph (2), a data 

24 broker resolves such dispute in accordance with 

25 subparagraph (A) by the deletion of the dis-
32 

•S 1789 RS

1 puted information, then the data broker shall 

2 not be required to comply with subsections (e) 

3 and (f) with respect to that dispute if the data 

4 broker provides to the individual, by telephone 

5 or other means authorized by the individual, 

6 prompt notice of the deletion. 

7 (f) NOTICE OF DISPUTE.— 

8 (1) IN GENERAL.—If the completeness or accu9 racy of any information disclosed to an individual 

10 under subsection (c) is disputed and unless there is 

11 a reasonable ground to believe that such dispute is 

12 frivolous or irrelevant, an individual may request 

13 that the data broker indicate notice of the dispute 

14 for a period of— 

15 (A) 30 days for information from a non16 public record source; and 

17 (B) 90 days for information from a public 

18 record source. 

19 (2) COMPLIANCE.—A data broker shall be 

20 deemed in compliance with the requirements under 

21 paragraph (1) by either— 

22 (A) allowing the individual to file a brief 

23 statement setting forth the nature of the dis24 pute under paragraph (3); or 
33 

•S 1789 RS

1 (B) using an alternative notice method 

2 that— 

3 (i) clearly flags the disputed informa4 tion for third parties accessing the infor5 mation; and 

6 (ii) provides a means for third parties 

7 to obtain further information regarding the 

8 nature of the dispute. 

9 (3) CONTENTS OF STATEMENT.—A data broker 

10 may limit statements made under paragraph (2)(A) 

11 to not more than 100 words if it provides an indi12 vidual with assistance in writing a clear summary of 

13 the dispute or until the dispute is resolved. 

14 (g) ADDITIONAL REQUIREMENTS.—The Federal 

15 Trade Commission may exempt certain classes of data 

16 brokers from this title in a rulemaking process pursuant 

17 to section 553 of title 5, United States Code. 

18 SEC. 302. ENFORCEMENT. 

19 (a) CIVIL PENALTIES.— 

20 (1) PENALTIES.—Any data broker that violates 

21 the provisions of section 301 shall be subject to civil 

22 penalties of not more than $1,000 per violation per 

23 day, with a maximum of $15,000 per day, while 

24 such violations persist. 
34 

•S 1789 RS

1 (2) INTENTIONAL OR WILLFUL VIOLATION.—A 

2 data broker that intentionally or willfully violates the 

3 provisions of section 301 shall be subject to addi4 tional penalties in the amount of $1,000 per viola5 tion per day, with a maximum of an additional 

6 $15,000 per day, while such violations persist. 

7 (3) EQUITABLE RELIEF.—A data broker en8 gaged in interstate commerce that violates this sec9 tion may be enjoined from further violations by a 

10 court of competent jurisdiction. 

11 (4) OTHER RIGHTS AND REMEDIES.—The 

12 rights and remedies available under this subsection 

13 are cumulative and shall not affect any other rights 

14 and remedies available under law. 

15 (b) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN16 ERAL.— 

17 (1) IN GENERAL.—Whenever it appears that a 

18 data broker to which this title applies has engaged, 

19 is engaged, or is about to engage, in any act or prac20 tice constituting a violation of this title, the Attorney 

21 General may bring a civil action in an appropriate 

22 district court of the United States to— 

23 (A) enjoin such act or practice; 

24 (B) enforce compliance with this title; 

25 (C) obtain damages— 
35 

•S 1789 RS

1 (i) in the sum of actual damages, res2 titution, and other compensation on behalf 

3 of the affected residents of a State; and 

4 (ii) punitive damages, if the violation 

5 is willful or intentional; and 

6 (D) obtain such other relief as the court 

7 determines to be appropriate. 

8 (2) OTHER INJUNCTIVE RELIEF.—Upon a 

9 proper showing in the action under paragraph (1), 

10 the court shall grant a permanent injunction or a 

11 temporary restraining order without bond. 

12 (c) STATE ENFORCEMENT.— 

13 (1) CIVIL ACTIONS.—In any case in which the 

14 attorney general of a State has reason to believe 

15 that an interest of the residents of that State has 

16 been or is threatened or adversely affected by an act 

17 or practice that violates this title, the State may 

18 bring a civil action on behalf of the residents of that 

19 State in a district court of the United States of ap20 propriate jurisdiction, or any other court of com21 petent jurisdiction, to— 

22 (A) enjoin that act or practice; 

23 (B) enforce compliance with this title; 

24 (C) obtain— 
36 

•S 1789 RS

1 (i) damages in the sum of actual dam2 ages, restitution, or other compensation on 

3 behalf of affected residents of the State; 

4 and 

5 (ii) punitive damages, if the violation 

6 is willful or intentional; or 

7 (D) obtain such other legal and equitable 

8 relief as the court may consider to be appro9 priate. 

10 (2) NOTICE.— 

11 (A) IN GENERAL.—Before filing an action 

12 under this subsection, the attorney general of 

13 the State involved shall provide to the Attorney 

14 General— 

15 (i) a written notice of that action; and 

16 (ii) a copy of the complaint for that 

17 action. 

18 (B) EXCEPTION.—Subparagraph (A) shall 

19 not apply with respect to the filing of an action 

20 by an attorney general of a State under this 

21 subsection, if the attorney general of a State 

22 determines that it is not feasible to provide the 

23 notice described in this subparagraph before the 

24 filing of the action. 
37 

•S 1789 RS

1 (C) NOTIFICATION WHEN PRACTICABLE.— 

2 In an action described under subparagraph (B), 

3 the attorney general of a State shall provide the 

4 written notice and the copy of the complaint to 

5 the Attorney General as soon after the filing of 

6 the complaint as practicable. 

7 (3) ATTORNEY GENERAL AUTHORITY.—Upon 

8 receiving notice under paragraph (2), the Attorney 

9 General shall have the right to— 

10 (A) move to stay the action, pending the 

11 final disposition of a pending Federal pro12 ceeding or action as described in paragraph (4); 

13 (B) intervene in an action brought under 

14 paragraph (1); and 

15 (C) file petitions for appeal. 

16 (4) PENDING PROCEEDINGS.—If the Attorney 

17 General has instituted a proceeding or action for a 

18 violation of this title or any regulations thereunder, 

19 no attorney general of a State may, during the pend20 ency of such proceeding or action, bring an action 

21 under this subsection against any defendant named 

22 in such criminal proceeding or civil action for any 

23 violation that is alleged in that proceeding or action. 

24 (5) RULE OF CONSTRUCTION.—For purposes of 

25 bringing any civil action under paragraph (1), noth-
38 

•S 1789 RS

1 ing in this title shall be construed to prevent an at2 torney general of a State from exercising the powers 

3 conferred on the attorney general by the laws of that 

4 State to— 

5 (A) conduct investigations; 

6 (B) administer oaths and affirmations; or 

7 (C) compel the attendance of witnesses or 

8 the production of documentary and other evi9 dence. 

10 (6) VENUE; SERVICE OF PROCESS.— 

11 (A) VENUE.—Any action brought under 

12 this subsection may be brought in the district 

13 court of the United States that meets applicable 

14 requirements relating to venue under section 

15 1931 of title 28, United States Code. 

16 (B) SERVICE OF PROCESS.—In an action 

17 brought under this subsection process may be 

18 served in any district in which the defendant— 

19 (i) is an inhabitant; or 

20 (ii) may be found. 

21 (d) NO PRIVATE CAUSE OF ACTION.—Nothing in 

22 this title establishes a private cause of action against a 

23 data broker for violation of any provision of this title. 
39 

•S 1789 RS

1 SEC. 303. RELATION TO STATE LAWS. 

2 No requirement or prohibition may be imposed under 

3 the laws of any State with respect to any subject matter 

4 regulated under section 301, relating to individual access 

5 to, and correction of, personal electronic records held by 

6 databrokers. 

7 SEC. 304. EFFECTIVE DATE. 

8 This title shall take effect 180 days after the date 

9 of enactment of this Act and shall be implemented pursu10 ant to a State by State rollout schedule set by the Federal 

11 Trade Commission, but in no case shall full implementa12 tion and effect of this title occur later than 1 year and 

13 180 days after the date of enactment of this Act. 

14 TITLE IV—PRIVACY AND SECU15 RITY OF PERSONALLY IDEN16 TIFIABLE INFORMATION 

17 Subtitle A—Data Privacy and 

18 Security Program 

19 SEC. 401. PURPOSE AND APPLICABILITY OF DATA PRIVACY 

20 AND SECURITY PROGRAM. 

21 (a) PURPOSE.—The purpose of this subtitle is to en22 sure standards for developing and implementing adminis23 trative, technical, and physical safeguards to protect the 

24 privacy, security, confidentiality, integrity, storage, and 

25 disposal of sensitive personally identifiable information. 
40 

•S 1789 RS

1 (b) IN GENERAL.—A business entity engaging in 

2 interstate commerce that involves collecting, accessing, 

3 transmitting, using, storing, or disposing of sensitive per4 sonally identifiable information in electronic or digital 

5 form on 10,000 or more United States persons is subject 

6 to the requirements for a data privacy and security pro7 gram under section 402 for protecting sensitive personally 

8 identifiable information. 

9 (c) LIMITATIONS.—Notwithstanding any other obli10 gation under this subtitle, this subtitle does not apply to— 

11 (1) financial institutions— 

12 (A) subject to the data security require13 ments and implementing regulations under the 

14 Gramm-Leach-Bliley Act (15 U.S.C. 6801 et 

15 seq.); and 

16 (B) subject to— 

17 (i) examinations for compliance with 

18 the requirements of this Act by 1 or more 

19 Federal or State functional regulators (as 

20 defined in section 509 of the Gramm21 Leach-Bliley Act (15 U.S.C. 6809)); or 

22 (ii) compliance with part 314 of title 

23 16, Code of Federal Regulations; or 

24 (2) ‘‘covered entities’’ subject to the Health In25 surance Portability and Accountability Act of 1996 
41 

•S 1789 RS

1 (42 U.S.C. 1301 et seq.), including the data security 

2 requirements and implementing regulations of that 

3 Act. 

4 (d) SAFE HARBOR.—A business entity shall be 

5 deemed in compliance with the privacy and security pro6 gram requirements under section 402 if the business enti7 ty complies with or provides protection equal to industry 

8 standards, as identified by the Federal Trade Commission, 

9 that are applicable to the type of sensitive personally iden10 tifiable information involved in the ordinary course of 

11 business of such business entity. 

12 SEC. 402. REQUIREMENTS FOR A PERSONAL DATA PRIVACY 

13 AND SECURITY PROGRAM. 

14 (a) PERSONAL DATA PRIVACY AND SECURITY PRO15 GRAM.—Unless otherwise limited under section 401(c), a 

16 business entity subject to this subtitle shall comply with 

17 the following safeguards and any others identified by the 

18 Federal Trade Commission in a rulemaking process pursu19 ant to section 553 of title 5, United States Code, to pro20 tect the privacy and security of sensitive personally identi21 fiable information: 

22 (1) SCOPE.—A business entity shall implement 

23 a comprehensive personal data privacy and security 

24 program that includes administrative, technical, and 

25 physical safeguards appropriate to the size and com-
42 

•S 1789 RS

1 plexity of the business entity and the nature and 

2 scope of its activities. 

3 (2) DESIGN.—The personal data privacy and 

4 security program shall be designed to— 

5 (A) ensure the privacy, security, and con6 fidentiality of personal electronic records; 

7 (B) protect against any anticipated 

8 vulnerabilities to the privacy, security, or integ9 rity of personal electronic records; and 

10 (C) protect against unauthorized access to 

11 use of personal electronic records that could re12 sult in substantial harm or inconvenience to any 

13 individual. 

14 (3) RISK ASSESSMENT.—A business entity 

15 shall— 

16 (A) identify reasonably foreseeable internal 

17 and external vulnerabilities that could result in 

18 unauthorized access, disclosure, use, or alter19 ation of sensitive personally identifiable infor20 mation or systems containing sensitive person21 ally identifiable information; 

22 (B) assess the likelihood of and potential 

23 damage from unauthorized access, disclosure, 

24 use, or alteration of sensitive personally identifi25 able information; and 
43 

•S 1789 RS

1 (C) assess the sufficiency of its policies, 

2 technologies, and safeguards in place to control 

3 and minimize risks from unauthorized access, 

4 disclosure, use, or alteration of sensitive person5 ally identifiable information. 

6 (4) RISK MANAGEMENT AND CONTROL.—Each 

7 business entity shall— 

8 (A) design its personal data privacy and 

9 security program to control the risks identified 

10 under paragraph (3); and 

11 (B) adopt measures commensurate with 

12 the sensitivity of the data as well as the size, 

13 complexity, and scope of the activities of the 

14 business entity that— 

15 (i) control access to systems and fa16 cilities containing sensitive personally iden17 tifiable information, including controls to 

18 authenticate and permit access only to au19 thorized individuals; 

20 (ii) detect actual and attempted 

21 fraudulent, unlawful, or unauthorized ac22 cess, disclosure, use, or alteration of sen23 sitive personally identifiable information, 

24 including by employees and other individ-
44 

•S 1789 RS

1 uals otherwise authorized to have access; 

2 and 

3 (iii) protect sensitive personally identi4 fiable information during use, trans5 mission, storage, and disposal by 

6 encryption or other reasonable means (in7 cluding as directed for disposal of records 

8 under section 628 of the Fair Credit Re9 porting Act (15 U.S.C. 1681w) and the 

10 implementing regulations of such Act as 

11 set forth in section 682 of title 16, Code 

12 of Federal Regulations). 

13 (b) TRAINING.—Each business entity subject to this 

14 subtitle shall take steps to ensure employee training and 

15 supervision for implementation of the data security pro16 gram of the business entity. 

17 (c) VULNERABILITY TESTING.— 

18 (1) IN GENERAL.—Each business entity subject 

19 to this subtitle shall take steps to ensure regular 

20 testing of key controls, systems, and procedures of 

21 the personal data privacy and security program to 

22 detect, prevent, and respond to attacks or intrusions, 

23 or other system failures. 

24 (2) FREQUENCY.—The frequency and nature of 

25 the tests required under paragraph (1) shall be de-
45 

•S 1789 RS

1 termined by the risk assessment of the business enti2 ty under subsection (a)(3). 

3 (d) RELATIONSHIP TO SERVICE PROVIDERS.—In the 

4 event a business entity subject to this subtitle engages 

5 service providers not subject to this subtitle, such business 

6 entity shall— 

7 (1) exercise appropriate due diligence in select8 ing those service providers for responsibilities related 

9 to sensitive personally identifiable information, and 

10 take reasonable steps to select and retain service 

11 providers that are capable of maintaining appro12 priate safeguards for the security, privacy, and in13 tegrity of the sensitive personally identifiable infor14 mation at issue; and 

15 (2) require those service providers by contract 

16 to implement and maintain appropriate measures de17 signed to meet the objectives and requirements gov18 erning entities subject to this section, section 401, 

19 and subtitle B. 

20 (e) PERIODIC ASSESSMENT AND PERSONAL DATA

21 PRIVACY AND SECURITY MODERNIZATION.—Each busi22 ness entity subject to this subtitle shall on a regular basis 

23 monitor, evaluate, and adjust, as appropriate its data pri24 vacy and security program in light of any relevant changes 

25 in— 
46 

•S 1789 RS

1 (1) technology; 

2 (2) the sensitivity of personally identifiable in3 formation; 

4 (3) internal or external threats to personally 

5 identifiable information; and 

6 (4) the changing business arrangements of the 

7 business entity, such as— 

8 (A) mergers and acquisitions; 

9 (B) alliances and joint ventures; 

10 (C) outsourcing arrangements; 

11 (D) bankruptcy; and 

12 (E) changes to sensitive personally identifi13 able information systems. 

14 (f) IMPLEMENTATION TIME LINE.—Not later than 1 

15 year after the date of enactment of this Act, a business 

16 entity subject to the provisions of this subtitle shall imple17 ment a data privacy and security program pursuant to this 

18 subtitle. 

19 SEC. 403. ENFORCEMENT. 

20 (a) CIVIL PENALTIES.— 

21 (1) IN GENERAL.—Any business entity that vio22 lates the provisions of sections 401 or 402 shall be 

23 subject to civil penalties of not more than $5,000 

24 per violation per day, with a maximum of $35,000 

25 per day, while such violations persist. 
47 

•S 1789 RS

1 (2) INTENTIONAL OR WILLFUL VIOLATION.—A 

2 business entity that intentionally or willfully violates 

3 the provisions of sections 401 or 402 shall be subject 

4 to additional penalties in the amount of $5,000 per 

5 violation per day, with a maximum of an additional 

6 $35,000 per day, while such violations persist. 

7 (3) EQUITABLE RELIEF.—A business entity en8 gaged in interstate commerce that violates this sec9 tion may be enjoined from further violations by a 

10 court of competent jurisdiction. 

11 (4) OTHER RIGHTS AND REMEDIES.—The 

12 rights and remedies available under this section are 

13 cumulative and shall not affect any other rights and 

14 remedies available under law 

15 (b) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN16 ERAL.— 

17 (1) IN GENERAL.—Whenever it appears that a 

18 business entity or agency to which this subtitle ap19 plies has engaged, is engaged, or is about to engage, 

20 in any act or practice constituting a violation of this 

21 subtitle, the Attorney General may bring a civil ac22 tion in an appropriate district court of the United 

23 States to— 

24 (A) enjoin such act or practice; 
48 

•S 1789 RS

1 (B) enforce compliance with this subtitle; 

2 and 

3 (C) obtain damages— 

4 (i) in the sum of actual damages, res5 titution, and other compensation on behalf 

6 of the affected residents of a State; and 

7 (ii) punitive damages, if the violation 

8 is willful or intentional; and 

9 (D) obtain such other relief as the court 

10 determines to be appropriate. 

11 (2) OTHER INJUNCTIVE RELIEF.—Upon a 

12 proper showing in the action under paragraph (1), 

13 the court shall grant a permanent injunction or a 

14 temporary restraining order without bond. 

15 (c) STATE ENFORCEMENT.— 

16 (1) CIVIL ACTIONS.—In any case in which the 

17 attorney general of a State has reason to believe 

18 that an interest of the residents of that State has 

19 been or is threatened or adversely affected by an act 

20 or practice that violates this subtitle, the State may 

21 bring a civil action on behalf of the residents of that 

22 State in a district court of the United States of ap23 propriate jurisdiction, or any other court of com24 petent jurisdiction, to— 

25 (A) enjoin that act or practice; 
49 

•S 1789 RS

1 (B) enforce compliance with this subtitle; 

2 (C) obtain— 

3 (i) damages in the sum of actual dam4 ages, restitution, or other compensation on 

5 behalf of affected residents of the State; 

6 and 

7 (ii) punitive damages, if the violation 

8 is willful or intentional; or 

9 (D) obtain such other legal and equitable 

10 relief as the court may consider to be appro11 priate. 

12 (2) NOTICE.— 

13 (A) IN GENERAL.—Before filing an action 

14 under this subsection, the attorney general of 

15 the State involved shall provide to the Attorney 

16 General— 

17 (i) a written notice of that action; and 

18 (ii) a copy of the complaint for that 

19 action. 

20 (B) EXCEPTION.—Subparagraph (A) shall 

21 not apply with respect to the filing of an action 

22 by an attorney general of a State under this 

23 subsection, if the attorney general of a State 

24 determines that it is not feasible to provide the 
50 

•S 1789 RS

1 notice described in this subparagraph before the 

2 filing of the action. 

3 (C) NOTIFICATION WHEN PRACTICABLE.— 

4 In an action described under subparagraph (B), 

5 the attorney general of a State shall provide the 

6 written notice and the copy of the complaint to 

7 the Attorney General as soon after the filing of 

8 the complaint as practicable. 

9 (3) ATTORNEY GENERAL AUTHORITY.—Upon 

10 receiving notice under paragraph (2), the Attorney 

11 General shall have the right to— 

12 (A) move to stay the action, pending the 

13 final disposition of a pending Federal pro14 ceeding or action as described in paragraph (4); 

15 (B) intervene in an action brought under 

16 paragraph (1); and 

17 (C) file petitions for appeal. 

18 (4) PENDING PROCEEDINGS.—If the Attorney 

19 General has instituted a proceeding or action for a 

20 violation of this title or any regulations thereunder, 

21 no attorney general of a State may, during the pend22 ency of such proceeding or action, bring an action 

23 under this subsection against any defendant named 

24 in such criminal proceeding or civil action for any 

25 violation that is alleged in that proceeding or action. 
51 

•S 1789 RS

1 (5) RULE OF CONSTRUCTION.—For purposes of 

2 bringing any civil action under paragraph (1) noth3 ing in this title shall be construed to prevent an at4 torney general of a State from exercising the powers 

5 conferred on the attorney general by the laws of that 

6 State to— 

7 (A) conduct investigations; 

8 (B) administer oaths and affirmations; or 

9 (C) compel the attendance of witnesses or 

10 the production of documentary and other evi11 dence. 

12 (6) VENUE; SERVICE OF PROCESS.— 

13 (A) VENUE.—Any action brought under 

14 this subsection may be brought in the district 

15 court of the United States that meets applicable 

16 requirements relating to venue under section 

17 1931 of title 28, United States Code. 

18 (B) SERVICE OF PROCESS.—In an action 

19 brought under this subsection process may be 

20 served in any district in which the defendant— 

21 (i) is an inhabitant; or 

22 (ii) may be found. 

23 (d) NO PRIVATE CAUSE OF ACTION.—Nothing in 

24 this title establishes a private cause of action against a 
52 

•S 1789 RS

1 business entity for violation of any provision of this sub2 title. 

3 SEC. 404. RELATION TO STATE LAWS. 

4 (a) IN GENERAL.—No State may— 

5 (1) require an entity described in section 401(c) 

6 to comply with this subtitle or any regulation pro7 mulgated thereunder; and 

8 (2) require an entity in compliance with the 

9 safe harbor established under section 401(d), to 

10 comply with any other provision of this subtitle. 

11 (b) EFFECT OF SUBTITLE A.—Except as provided in 

12 subsection (a), this subtitle does not annul, alter, affect, 

13 or exempt any person subject to the provisions of this sub14 title from complying with the laws of any State with re15 spect to security programs for sensitive personally identifi16 able information, except to the extent that those laws are 

17 inconsistent with any provisions of this subtitle, and then 

18 only to the extent of such inconsistency. 

19 Subtitle B—Security Breach 

20 Notification 

21 SEC. 421. NOTICE TO INDIVIDUALS. 

22 (a) IN GENERAL.—Any agency, or business entity en23 gaged in interstate commerce, that uses, accesses, trans24 mits, stores, disposes of or collects sensitive personally 

25 identifiable information shall, following the discovery of a 
53 

•S 1789 RS

1 security breach maintained by the agency or business enti2 ty that contains such information, notify any resident of 

3 the United States whose sensitive personally identifiable 

4 information was subject to the security breach. 

5 (b) OBLIGATION OF OWNER OR LICENSEE.— 

6 (1) NOTICE TO OWNER OR LICENSEE.—Any 

7 agency, or business entity engaged in interstate com8 merce, that uses, accesses, transmits, stores, dis9 poses of, or collects sensitive personally identifiable 

10 information that the agency or business entity does 

11 not own or license shall notify the owner or licensee 

12 of the information following the discovery of a secu13 rity breach containing such information. 

14 (2) NOTICE BY OWNER, LICENSEE OR OTHER

15 DESIGNATED THIRD PARTY.—Noting in this subtitle 

16 shall prevent or abrogate an agreement between an 

17 agency or business entity required to give notice 

18 under this section and a designated third party, in19 cluding an owner or licensee of the sensitive person20 ally identifiable information subject to the security 

21 breach, to provide the notifications required under 

22 subsection (a). 

23 (3) BUSINESS ENTITY RELIEVED FROM GIVING

24 NOTICE.—A business entity obligated to give notice 

25 under subsection (a) shall be relieved of such obliga-
54 

•S 1789 RS

1 tion if an owner or licensee of the sensitive person2 ally identifiable information subject to the security 

3 breach, or other designated third party, provides 

4 such notification. 

5 (c) TIMELINESS OF NOTIFICATION.— 

6 (1) IN GENERAL.—All notifications required 

7 under this section shall be made without unreason8 able delay following— 

9 (A) the discovery by the agency or business 

10 entity of a security breach; and 

11 (B) any measures necessary to determine 

12 the scope of the breach, prevent further disclo13 sures, and restore the reasonable integrity of 

14 the data system. 

15 (2) BURDEN OF PROOF.—The agency, business 

16 entity, owner, or licensee required to provide notifi17 cation under this section shall have the burden of 

18 demonstrating that all notifications were made as re19 quired under this subtitle, including evidence dem20 onstrating the necessity of any delay. 

21 (d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW

22 ENFORCEMENT PURPOSES.— 

23 (1) IN GENERAL.—If a law enforcement agency 

24 determines that the notification required under this 

25 section would impede a criminal investigation, such 
55 

•S 1789 RS

1 notification may be delayed upon the written request 

2 of the law enforcement agency. 

3 (2) EXTENDED DELAY OF NOTIFICATION.—If 

4 the notification required under subsection (a) is de5 layed pursuant to paragraph (1), an agency or busi6 ness entity shall give notice 30 days after the day 

7 such law enforcement delay was invoked unless a law 

8 enforcement agency provides written notification 

9 that further delay is necessary. 

10 SEC. 422. EXEMPTIONS. 

11 (a) EXEMPTION FOR NATIONAL SECURITY AND LAW

12 ENFORCEMENT.— 

13 (1) IN GENERAL.—Section 421 shall not apply 

14 to an agency if the head of the agency certifies, in 

15 writing, that notification of the security breach as 

16 required by section 421 reasonably could be expected 

17 to— 

18 (A) cause damage to the national security; 

19 or 

20 (B) hinder a law enforcement investigation 

21 or the ability of the agency to conduct law en22 forcement investigations. 

23 (2) LIMITS ON CERTIFICATIONS.—The head of 

24 an agency may not execute a certification under 

25 paragraph (1) to— 
56 

•S 1789 RS

1 (A) conceal violations of law, inefficiency, 

2 or administrative error; 

3 (B) prevent embarrassment to a business 

4 entity, organization, or agency; or 

5 (C) restrain competition. 

6 (3) NOTICE.—In every case in which a head of 

7 an agency issues a certification under paragraph (1), 

8 the certification, accompanied by a concise descrip9 tion of the factual basis for the certification, shall be 

10 immediately provided to the Congress. 

11 (b) RISK ASSESSMENT EXEMPTION.—An agency or 

12 business entity will be exempt from the notice require13 ments under section 421, if— 

14 (1) a risk assessment concludes that there is no 

15 significant risk that the security breach has resulted 

16 in, or will result in, harm to the individuals whose 

17 sensitive personally identifiable information was sub18 ject to the security breach; 

19 (2) without unreasonable delay, but not later 

20 than 45 days after the discovery of a security 

21 breach, unless extended by the United States Secret 

22 Service, the business entity notifies the United 

23 States Secret Service, in writing, of— 

24 (A) the results of the risk assessment; 
57 

•S 1789 RS

1 (B) its decision to invoke the risk assess2 ment exemption; and 

3 (3) the United States Secret Service does not 

4 indicate, in writing, within 10 days from receipt of 

5 the decision, that notice should be given. 

6 (c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 

7 (1) IN GENERAL.—A business entity will be ex8 empt from the notice requirement under section 421 

9 if the business entity utilizes or participates in a se10 curity program that— 

11 (A) is designed to block the use of the sen12 sitive personally identifiable information to ini13 tiate unauthorized financial transactions before 

14 they are charged to the account of the indi15 vidual; and 

16 (B) provides for notice after a security 

17 breach that has resulted in fraud or unauthor18 ized transactions. 

19 (2) LIMITATION.—The exemption by this sub20 section does not apply if the information subject to 

21 the security breach includes, in addition to an ac22 count number, sensitive personally identifiable infor23 mation. 
58 

•S 1789 RS

1 SEC. 423. METHODS OF NOTICE. 

2 An agency, or business entity shall be in compliance 

3 with section 421 if it provides: 

4 (1) INDIVIDUAL NOTICE.— 

5 (A) Written notification to the last known 

6 home mailing address of the individual in the 

7 records of the agency or business entity; or 

8 (B) E-mail notice, if the individual has 

9 consented to receive such notice and the notice 

10 is consistent with the provisions permitting elec11 tronic transmission of notices under section 101 

12 of the Electronic Signatures in Global and Na13 tional Commerce Act (15 U.S.C. 7001). 

14 (2) MEDIA NOTICE.—If more than 5,000 resi15 dents of a State or jurisdiction are impacted, notice 

16 to major media outlets serving that State or jurisdic17 tion. 

18 SEC. 424. CONTENT OF NOTIFICATION. 

19 (a) IN GENERAL.—Regardless of the method by 

20 which notice is provided to individuals under section 423, 

21 such notice shall include, to the extent possible— 

22 (1) a description of the categories of sensitive 

23 personally identifiable information that was, or is 

24 reasonably believed to have been, acquired by an un25 authorized person; 

26 (2) a toll-free number— 
59 

•S 1789 RS

1 (A) that the individual may use to contact 

2 the agency or business entity, or the agent of 

3 the agency or business entity; and 

4 (B) from which the individual may learn— 

5 (i) what types of sensitive personally 

6 identifiable information the agency or busi7 ness entity maintained about that indi8 vidual or about individuals in general; and 

9 (ii) whether or not the agency or busi10 ness entity maintained sensitive personally 

11 identifiable information about that indi12 vidual; and 

13 (3) the toll-free contact telephone numbers and 

14 addresses for the major credit reporting agencies. 

15 (b) ADDITIONAL CONTENT.—Notwithstanding sec16 tion 429, a State may require that a notice under sub17 section (a) shall also include information regarding victim 

18 protection assistance provided for by that State. 

19 SEC. 425. COORDINATION OF NOTIFICATION WITH CREDIT 

20 REPORTING AGENCIES. 

21 If an agency or business entity is required to provide 

22 notification to more than 1,000 individuals under section 

23 421(a), the agency or business entity shall also notify, 

24 without unreasonable delay, all consumer reporting agen25 cies that compile and maintain files on consumers on a 
60 

•S 1789 RS

1 nationwide basis (as defined in section 603(p) of the Fair 

2 Credit Reporting Act (15 U.S.C. 1681a(p)) of the timing 

3 and distribution of the notices. 

4 SEC. 426. NOTICE TO LAW ENFORCEMENT. 

5 (a) SECRET SERVICE.—Any business entity or agen6 cy required to give notice under section 421 shall also give 

7 notice to the United States Secret Service if the security 

8 breach impacts— 

9 (1) more than 10,000 individuals nationwide; 

10 (2) a database, networked or integrated data11 bases, or other data system associated with the sen12 sitive personally identifiable information on more 

13 than 1,000,000 individuals nationwide; 

14 (3) databases owned by the Federal Govern15 ment; or 

16 (4) primarily sensitive personally identifiable in17 formation of employees and contractors of the Fed18 eral Government involved in national security or law 

19 enforcement. 

20 (b) NOTICE TO OTHER LAW ENFORCEMENT AGEN21 CIES.—The United States Secret Service shall be respon22 sible for notifying— 

23 (1)(A) the Federal Bureau of Investigation, if 

24 the security breach involves espionage, foreign coun25 terintelligence, information protected against unau-
61 

•S 1789 RS

1 thorized disclosure for reasons of national defense or 

2 foreign relations, or Restricted Data (as that term 

3 is defined in section 11y of the Atomic Energy Act 

4 of 1954 (42 U.S.C. 2014(y)), except for offenses af5 fecting the duties of the United States Secret Serv6 ice under section 3056(a) of title 18, United States 

7 Code; and 

8 (B) the United States Postal Inspection Serv9 ice, if the security breach involves mail fraud; and 

10 (2) the attorney general of each State affected 

11 by the security breach. 

12 (c) 30-DAY RULE.—The notices to Federal law en13 forcement and the attorney general of each State affected 

14 by a security breach required under this section shall be 

15 delivered without unreasonable delay, but not later than 

16 30 days after discovery of the events requiring notice. 

17 SEC. 427. CIVIL REMEDIES. 

18 (a) PENALTIES.—Any agency, or business entity en19 gaged in interstate commerce, that violates this subtitle 

20 shall be subject to a fine of— 

21 (1) not more than $1,000 per individual per 

22 day whose sensitive personally identity information 

23 was, or is reasonably believed to have been, acquired 

24 by an unauthorized person; or 
62 

•S 1789 RS

1 (2) not more than $50,000 per day while the 

2 failure to give notice under this subtitle persists. 

3 (b) EQUITABLE RELIEF.—Any agency or business 

4 entity that violates, proposes to violate, or has violated this 

5 subtitle may be enjoined from further violations by a court 

6 of competent jurisdiction. 

7 (c) OTHER RIGHTS AND REMEDIES.—The rights and 

8 remedies available under this subtitle are cumulative and 

9 shall not affect any other rights and remedies available 

10 under law. 

11 (d) FRAUD ALERT.—Section 605A(b)(1) of the Fair 

12 Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 

13 amended by inserting ‘‘, or evidence that the consumer 

14 has received notice that the consumer’s financial informa15 tion has or may have been compromised,’’ after ‘‘identity 

16 theft report’’. 

17 (e) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN18 ERAL.—Whenever it appears that a business entity or 

19 agency to which this subtitle applies has engaged, is en20 gaged, or is about to engage, in any act or practice consti21 tuting a violation of this subtitle, the Attorney General 

22 may bring a civil action in an appropriate district court 

23 of the United States to— 

24 (1) enjoin such act or practice; 

25 (2) enforce compliance with this subtitle; 
63 

•S 1789 RS

1 (3) obtain damages— 

2 (A) in the sum of actual damages, restitu3 tion, and other compensation on behalf of the 

4 affected residents of a State; and 

5 (B) punitive damages, if the violation is 

6 willful or intentional; and 

7 (4) obtain such other relief as the court deter8 mines to be appropriate. 

9 SEC. 428. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

10 (a) IN GENERAL.— 

11 (1) CIVIL ACTIONS.—In any case in which the 

12 attorney general of a State, or any State or local law 

13 enforcement agency authorized by the State attorney 

14 general or by State statute to prosecute violations of 

15 consumer protection law, has reason to believe that 

16 an interest of the residents of that State has been 

17 or is threatened or adversely affected by the engage18 ment of any agency or business entity in a practice 

19 that is prohibited under this subtitle, the State, as 

20 parens patriae on behalf of the residents of the 

21 State, or the State or local law enforcement agency 

22 on behalf of the residents of the agency’s jurisdic23 tion, may bring a civil action on behalf of the resi24 dents of the State or jurisdiction in a district court 

25 of the United States of appropriate jurisdiction or 
64 

•S 1789 RS

1 any other court of competent jurisdiction, including 

2 a State court, to— 

3 (A) enjoin that practice; 

4 (B) enforce compliance with this subtitle; 

5 (C) obtain damages, restitution, or other 

6 compensation on behalf of residents of the 

7 State; or 

8 (D) obtain such other relief as the court 

9 may consider to be appropriate. 

10 (2) NOTICE.— 

11 (A) IN GENERAL.—Before filing an action 

12 under paragraph (1), the attorney general of 

13 the State involved shall provide to the Attorney 

14 General of the United States— 

15 (i) written notice of the action; and 

16 (ii) a copy of the complaint for the ac17 tion. 

18 (B) EXEMPTION.— 

19 (i) IN GENERAL.—Subparagraph (A) 

20 shall not apply with respect to the filing of 

21 an action by an attorney general of a State 

22 under this subtitle, if the State attorney 

23 general determines that it is not feasible to 

24 provide the notice described in such sub25 paragraph before the filing of the action. 
65 

•S 1789 RS

1 (ii) NOTIFICATION.—In an action de2 scribed in clause (i), the attorney general 

3 of a State shall provide notice and a copy 

4 of the complaint to the Attorney General 

5 at the time the State attorney general files 

6 the action. 

7 (b) FEDERAL PROCEEDINGS.—Upon receiving notice 

8 under subsection (a)(2), the Attorney General shall have 

9 the right to— 

10 (1) move to stay the action, pending the final 

11 disposition of a pending Federal proceeding or ac12 tion; 

13 (2) intervene in an action brought under sub14 section (a)(2); and 

15 (3) file petitions for appeal. 

16 (c) PENDING PROCEEDINGS.—If the Attorney Gen17 eral has instituted a proceeding or action for a violation 

18 of this subtitle or any regulations thereunder, no attorney 

19 general of a State may, during the pendency of such pro20 ceeding or action, bring an action under this subtitle 

21 against any defendant named in such criminal proceeding 

22 or civil action for any violation that is alleged in that pro23 ceeding or action. 

24 (d) CONSTRUCTION.—For purposes of bringing any 

25 civil action under subsection (a), nothing in this subtitle 
66 

•S 1789 RS

1 regarding notification shall be construed to prevent an at2 torney general of a State from exercising the powers con3 ferred on such attorney general by the laws of that State 

4 to— 

5 (1) conduct investigations; 

6 (2) administer oaths or affirmations; or 

7 (3) compel the attendance of witnesses or the 

8 production of documentary and other evidence. 

9 (e) VENUE; SERVICE OF PROCESS.— 

10 (1) VENUE.—Any action brought under sub11 section (a) may be brought in— 

12 (A) the district court of the United States 

13 that meets applicable requirements relating to 

14 venue under section 1391 of title 28, United 

15 States Code; or 

16 (B) another court of competent jurisdic17 tion. 

18 (2) SERVICE OF PROCESS.—In an action 

19 brought under subsection (a), process may be served 

20 in any district in which the defendant— 

21 (A) is an inhabitant; or 

22 (B) may be found. 

23 (f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

24 subtitle establishes a private cause of action against a data 

25 broker for violation of any provision of this subtitle. 
67 

•S 1789 RS

1 SEC. 429. EFFECT ON FEDERAL AND STATE LAW. 

2 The provisions of this subtitle shall supersede any 

3 other provision of Federal law or any provision of law of 

4 any State relating to notification of a security breach, ex5 cept as provided in section 424(b). 

6 SEC. 430. AUTHORIZATION OF APPROPRIATIONS. 

7 There are authorized to be appropriated such sums 

8 as may be necessary to cover the costs incurred by the 

9 United States Secret Service to carry out investigations 

10 and risk assessments of security breaches as required 

11 under this subtitle. 

12 SEC. 431. REPORTING ON RISK ASSESSMENT EXEMPTION. 

13 The United States Secret Service shall report to Con14 gress not later than 18 months after the date of enactment 

15 of this Act, and upon the request by Congress thereafter, 

16 on the number and nature of the security breaches de17 scribed in the notices filed by those business entities invok18 ing the risk assessment exemption under section 422(b) 

19 and the response of the United States Secret Service to 

20 those notices. 

21 SEC. 432. EFFECTIVE DATE. 

22 This subtitle shall take effect on the expiration of the 

23 date which is 90 days after the date of enactment of this 

24 Act. 
68 

•S 1789 RS

1 TITLE V—GOVERNMENT ACCESS 

2 TO AND USE OF COMMERCIAL 

3 DATA 

4 SEC. 501. GENERAL SERVICES ADMINISTRATION REVIEW 

5 OF CONTRACTS. 

6 (a) IN GENERAL.—In considering contract awards 

7 totaling more than $500,000 and entered into after the 

8 date of enactment of this Act with data brokers, the Ad9 ministrator of the General Services Administration shall 

10 evaluate— 

11 (1) the data privacy and security program of a 

12 data broker to ensure the privacy and security of 

13 data containing personally identifiable information, 

14 including whether such program adequately address15 es privacy and security threats created by malicious 

16 software or code, or the use of peer-to-peer file shar17 ing software; 

18 (2) the compliance of a data broker with such 

19 program; 

20 (3) the extent to which the databases and sys21 tems containing personally identifiable information 

22 of a data broker have been compromised by security 

23 breaches; and 
69 

•S 1789 RS

1 (4) the response by a data broker to such 

2 breaches, including the efforts by such data broker 

3 to mitigate the impact of such breaches. 

4 (b) COMPLIANCE SAFE HARBOR.—The data privacy 

5 and security program of a data broker shall be deemed 

6 sufficient for the purposes of subsection (a), if the data 

7 broker complies with or provides protection equal to indus8 try standards, as identified by the Federal Trade Commis9 sion, that are applicable to the type of personally identifi10 able information involved in the ordinary course of busi11 ness of such data broker. 

12 (c) PENALTIES.—In awarding contracts with data 

13 brokers for products or services related to access, use, 

14 compilation, distribution, processing, analyzing, or evalu15 ating personally identifiable information, the Adminis16 trator of the General Services Administration shall— 

17 (1) include monetary or other penalties— 

18 (A) for failure to comply with subtitles A 

19 and B of title IV of this Act; or 

20 (B) if a contractor knows or has reason to 

21 know that the personally identifiable informa22 tion being provided is inaccurate, and provides 

23 such inaccurate information; and 

24 (2) require a data broker that engages service 

25 providers not subject to subtitle A of title IV for re-
70 

•S 1789 RS

1 sponsibilities related to sensitive personally identifi2 able information to— 

3 (A) exercise appropriate due diligence in 

4 selecting those service providers for responsibil5 ities related to personally identifiable informa6 tion; 

7 (B) take reasonable steps to select and re8 tain service providers that are capable of main9 taining appropriate safeguards for the security, 

10 privacy, and integrity of the personally identifi11 able information at issue; and 

12 (C) require such service providers, by con13 tract, to implement ad maintain appropriate 

14 measures designed to meet the objectives and 

15 requirements in title IV. 

16 (d) LIMITATION.—The penalties under subsection (c) 

17 shall not apply to a data broker providing information that 

18 is accurately and completely recorded from a public record 

19 source. 

20 SEC. 502. REQUIREMENT TO AUDIT INFORMATION SECU21 RITY PRACTICES OF CONTRACTORS AND 

22 THIRD PARTY BUSINESS ENTITIES. 

23 Section 3544(b) of title 44, United States Code, is 

24 amended— 
71 

•S 1789 RS

1 (1) in paragraph (7)(C)(iii), by striking ‘‘and’’ 

2 after the semicolon; 

3 (2) in paragraph (8), by striking the period and 

4 inserting ‘‘; and’’; and 

5 (3) by adding at the end the following: 

6 ‘‘(9) procedures for evaluating and auditing the 

7 information security practices of contractors or third 

8 party business entities supporting the information 

9 systems or operations of the agency involving per10 sonally identifiable information (as that term is de11 fined in section 3 of the Personal Data Privacy and 

12 Security Act of 2005) and ensuring remedial action 

13 to address any significant deficiencies.’’. 

14 SEC. 503. PRIVACY IMPACT ASSESSMENT OF GOVERNMENT 

15 USE OF COMMERCIAL INFORMATION SERV16 ICES CONTAINING PERSONALLY IDENTIFI17 ABLE INFORMATION. 

18 (a) IN GENERAL.—Section 208(b)(1) of the E-Gov19 ernment Act of 2002 (44 U.S.C. 3501 note) is amended— 

20 (1) in subparagraph (A)(i), by striking ‘‘or’’; 

21 and 

22 (2) in subparagraph (A)(ii), by striking the pe23 riod and inserting ‘‘; or’’; and 

24 (3) by inserting after clause (ii) the following: 
72 

•S 1789 RS

1 ‘‘(iii) purchasing or subscribing for a 

2 fee to personally identifiable information 

3 from a data broker (as such terms are de4 fined in section 3 of the Personal Data 

5 Privacy and Security Act of 2005).’’. 

6 (b) LIMITATION.—Notwithstanding any other provi7 sion of law, commencing 1 year after the date of enact8 ment of this Act, no Federal department or agency may 

9 enter into a contract with a data broker to access for a 

10 fee any database consisting primarily of personally identi11 fiable information concerning United States persons 

12 (other than news reporting or telephone directories) unless 

13 the head of such department or agency— 

14 (1) completes a privacy impact assessment 

15 under section 208 of the E-Government Act of 2002 

16 (44 U.S.C. 3501 note), which shall subject to the 

17 provision in that Act pertaining to sensitive informa18 tion, include a description of— 

19 (A) such database; 

20 (B) the name of the data broker from 

21 whom it is obtained; and 

22 (C) the amount of the contract for use; 

23 (2) adopts regulations that specify— 

24 (A) the personnel permitted to access, ana25 lyze, or otherwise use such databases; 
73 

•S 1789 RS

1 (B) standards governing the access, anal2 ysis, or use of such databases; 

3 (C) any standards used to ensure that the 

4 personally identifiable information accessed, 

5 analyzed, or used is the minimum necessary to 

6 accomplish the intended legitimate purpose of 

7 the Federal department or agency; 

8 (D) standards limiting the retention and 

9 redisclosure of personally identifiable informa10 tion obtained from such databases; 

11 (E) procedures ensuring that such data 

12 meet standards of accuracy, relevance, com13 pleteness, and timeliness; 

14 (F) the auditing and security measures to 

15 protect against unauthorized access, analysis, 

16 use, or modification of data in such databases; 

17 (G) applicable mechanisms by which indi18 viduals may secure timely redress for any ad19 verse consequences wrongly incurred due to the 

20 access, analysis, or use of such databases; 

21 (H) mechanisms, if any, for the enforce22 ment and independent oversight of existing or 

23 planned procedures, policies, or guidelines; and 

24 (I) an outline of enforcement mechanisms 

25 for accountability to protect individuals and the 
74 

•S 1789 RS

1 public against unlawful or illegitimate access or 

2 use of databases; and 

3 (3) incorporates into the contract or other 

4 agreement totaling more than $500,000, provi5 sions— 

6 (A) providing for penalties— 

7 (i) for failure to comply with title IV 

8 of this Act; or 

9 (ii) if the entity knows or has reason 

10 to know that the personally identifiable in11 formation being provided to the Federal 

12 department or agency is inaccurate, and 

13 provides such inaccurate information. 

14 (B) requiring a data broker that engages 

15 service providers not subject to subtitle A of 

16 title IV for responsibilities related to sensitive 

17 personally identifiable information to— 

18 (i) exercise appropriate due diligence 

19 in selecting those service providers for re20 sponsibilities related to personally identifi21 able information; 

22 (ii) take reasonable steps to select and 

23 retain service providers that are capable of 

24 maintaining appropriate safeguards for the 

25 security, privacy, and integrity of the per-
75 

•S 1789 RS

1 sonally identifiable information at issue; 

2 and 

3 (iii) require such service providers, by 

4 contract, to implement ad maintain appro5 priate measures designed to meet the ob6 jectives and requirements in title IV. 

7 (c) LIMITATION ON PENALTIES.—The penalties 

8 under paragraph (3)(A) shall not apply to a data broker 

9 providing information that is accurately and completely re10 corded from a public record source. 

11 (d) INDIVIDUAL SCREENING PROGRAMS.— 

12 (1) IN GENERAL.—Notwithstanding any other 

13 provision of law, commencing one year after the date 

14 of enactment of this Act, no Federal department or 

15 agency may use commercial databases or contract 

16 with a data broker to implement an individual 

17 screening program unless such program is— 

18 (A) congressionally authorized; and 

19 (B) subject to regulations developed by no20 tice and comment that— 

21 (i) establish a procedure to enable in22 dividuals, who suffer an adverse con23 sequence because the screening system de24 termined that they might pose a security 

25 threat, to appeal such determination and 
76 

•S 1789 RS

1 correct information contained in the sys2 tem; 

3 (ii) ensure that Federal and commer4 cial databases that will be used to establish 

5 the identity of individuals or otherwise 

6 make assessments of individuals under the 

7 system will not produce a large number of 

8 false positives or unjustified adverse con9 sequences; 

10 (iii) ensure the efficacy and accuracy 

11 of all of the search tools that will be used 

12 and ensure that the department or agency 

13 can make an accurate predictive assess14 ment of those who may constitute a threat; 

15 (iv) establish an internal oversight 

16 board to oversee and monitor the manner 

17 in which the system is being implemented; 

18 (v) establish sufficient operational 

19 safeguards to reduce the opportunities for 

20 abuse; 

21 (vi) implement substantial security 

22 measures to protect the system from unau23 thorized access; 
77 

•S 1789 RS

1 (vii) adopt policies establishing the ef2 fective oversight of the use and operation 

3 of the system; and 

4 (viii) ensure that there are no specific 

5 privacy concerns with the technological ar6 chitecture of the system; and 

7 (C) coordinated with the Terrorist Screen8 ing Center or any such successor organization. 

9 (2) DEFINITION.—As used in this subsection, 

10 the term ‘‘individual screening program’’— 

11 (A) means a system that relies on person12 ally identifiable information from commercial 

13 databases to— 

14 (i) evaluate all or most individuals 

15 seeking to exercise a particular right or 

16 privilege under Federal law; and 

17 (ii) determine whether such individ18 uals are on a terrorist watch list or other19 wise pose a security threat; and 

20 (B) does not include any program or sys21 tem to grant security clearances. 

22 (e) STUDY OF GOVERNMENT USE.— 

23 (1) SCOPE OF STUDY.—Not later than 180 

24 days after the date of enactment of this Act, the 

25 Comptroller General of the United States shall con-
78 

•S 1789 RS

1 duct a study and audit and prepare a report on Fed2 eral agency use of data brokers or commercial data3 bases containing personally identifiable information, 

4 including the impact on privacy and security, and 

5 the extent to which Federal contracts include suffi6 cient provisions to ensure privacy and security pro7 tections, and penalties for failures in privacy and se8 curity practices. 

9 (2) REPORT.—A copy of the report required 

10 under paragraph (1) shall be submitted to Congress. 

11 SEC. 504. IMPLEMENTATION OF CHIEF PRIVACY OFFICER 

12 REQUIREMENTS. 

13 (a) DESIGNATION OF THE CHIEF PRIVACY OFFI14 CER.—Pursuant to the requirements under section 522 of 

15 the Transportation, Treasury, Independent Agencies, and 

16 General Government Appropriations Act, 2005 (division H 

17 of Public Law 108–447; 118 Stat. 3199) that each agency 

18 designate a Chief Privacy Officer, the Department of Jus19 tice shall implement such requirements by designating a 

20 department-wide Chief Privacy Officer, whose primary 

21 role shall be to fulfill the duties and responsibilities of 

22 Chief Privacy Officer and who shall report directly to the 

23 Deputy Attorney General. 

24 (b) DUTIES AND RESPONSIBILITIES OF CHIEF PRI25 VACY OFFICER.—In addition to the duties and responsibil-
79 

•S 1789 RS

1 ities outlined under section 522 of the Transportation, 

2 Treasury, Independent Agencies, and General Government 

3 Appropriations Act, 2005 (division H of Public Law 108– 

4 447; 118 Stat. 3199), the Department of Justice Chief 

5 Privacy Officer shall— 

6 (1) oversee the Department of Justice’s imple7 mentation of the requirements under section 603 to 

8 conduct privacy impact assessments of the use of 

9 commercial data containing personally identifiable 

10 information by the Department; 

11 (2) promote the use of law enforcement tech12 nologies that sustain privacy protections, and assure 

13 that the implementation of such technologies relat14 ing to the use, collection, and disclosure of person15 ally identifiable information preserve the privacy and 

16 security of such information; and 

17 (3) coordinate with the Privacy and Civil Lib18 erties Oversight Board, established in the Intel19 ligence Reform and Terrorism Prevention Act of 

20 2004 (Public Law 108–458), in implementing para21 graphs (1) and (2) of this subsection. 

22 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

23 (a) SHORT TITLE.—This Act may be cited as the ‘‘Per24 sonal Data Privacy and Security Act of 2005’’. 
80 

•S 1789 RS

1 (b) TABLE OF CONTENTS.—The table of contents for 

2 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Findings. 

Sec. 3. Definitions. 

TITLE I—ENHANCING PUNISHMENT FOR IDENTITY THEFT AND 

OTHER VIOLATIONS OF DATA PRIVACY AND SECURITY 

Sec. 101. Organized criminal activity in connection with unauthorized access to 

personally identifiable information. 

Sec. 102. Concealment of security breaches involving sensitive personally identifiable information. 

Sec. 103. Review and amendment of Federal sentencing guidelines related to 

fraudulent access to or misuse of digitized or electronic personally identifiable information. 

TITLE II—DATA BROKERS 

Sec. 201. Transparency and accuracy of data collection. 

Sec. 202. Enforcement. 

Sec. 203. Relation to state laws. 

Sec. 204. Effective date. 

TITLE III—PRIVACY AND SECURITY OF PERSONALLY IDENTIFIABLE 

INFORMATION 

Subtitle A—A Data Privacy and Security Program 

Sec. 301. Purpose and applicability of data privacy and security program. 

Sec. 302. Requirements for a personal data privacy and security program. 

Sec. 303. Enforcement. 

Sec. 304. Relation to other laws. 

Subtitle B—Security Breach Notification 

Sec. 321. Notice to individuals. 

Sec. 322. Exemptions. 

Sec. 323. Methods of notice. 

Sec. 324. Content of notification. 

Sec. 325. Coordination of notification with credit reporting agencies. 

Sec. 326. Notice to law enforcement. 

Sec. 327. Enforcement. 

Sec. 328. Enforcement by State attorneys general. 

Sec. 329. Effect on Federal and State law. 

Sec. 330. Authorization of appropriations. 

Sec. 331. Reporting on risk assessment exemptions. 

Sec. 332. Effective date. 

TITLE IV—GOVERNMENT ACCESS TO AND USE OF COMMERCIAL 

DATA 

Sec. 401. General services administration review of contracts. 

Sec. 402. Requirement to audit information security practices of contractors and 

third party business entities. 
81 

•S 1789 RS

Sec. 403. Privacy impact assessment of government use of commercial information services containing personally identifiable information. 

Sec. 404. Implementation of chief privacy officer requirements. 

1 SEC. 2. FINDINGS. 

2 Congress finds that— 

3 (1) databases of personally identifiable informa4 tion are increasingly prime targets of hackers, iden5 tity thieves, rogue employees, and other criminals, in6 cluding organized and sophisticated criminal oper7 ations; 

8 (2) identity theft is a serious threat to the na9 tion’s economic stability, homeland security, the de10 velopment of e-commerce, and the privacy rights of 

11 Americans; 

12 (3) over 9,300,000 individuals were victims of 

13 identity theft in America last year; 

14 (4) security breaches are a serious threat to con15 sumer confidence, homeland security, e-commerce, and 

16 economic stability; 

17 (5) it is important for business entities that own, 

18 use, or license personally identifiable information to 

19 adopt reasonable procedures to ensure the security, 

20 privacy, and confidentiality of that personally identi21 fiable information; 

22 (6) individuals whose personal information has 

23 been compromised or who have been victims of iden24 tity theft should receive the necessary information and 
82 

•S 1789 RS

1 assistance to mitigate their damages and to restore 

2 the integrity of their personal information and identi3 ties; 

4 (7) data brokers have assumed a significant role 

5 in providing identification, authentication, and 

6 screening services, and related data collection and 

7 analyses for commercial, nonprofit, and government 

8 operations; 

9 (8) data misuse and use of inaccurate data have 

10 the potential to cause serious or irreparable harm to 

11 an individual’s livelihood, privacy, and liberty and 

12 undermine efficient and effective business and govern13 ment operations; 

14 (9) there is a need to insure that data brokers 

15 conduct their operations in a manner that prioritizes 

16 fairness, transparency, accuracy, and respect for the 

17 privacy of consumers; 

18 (10) government access to commercial data can 

19 potentially improve safety, law enforcement, and na20 tional security; and 

21 (11) because government use of commercial data 

22 containing personal information potentially affects 

23 individual privacy, and law enforcement and na24 tional security operations, there is a need for Con-
83 

•S 1789 RS

1 gress to exercise oversight over government use of com2 mercial data. 

3 SEC. 3. DEFINITIONS. 

4 In this Act: 

5 (1) AGENCY.—The term ‘‘agency’’ has the same 

6 meaning given such term in section 551 of title 5, 

7 United States Code. 

8 (2) AFFILIATE.—The term ‘‘affiliate’’ means per9 sons related by common ownership or by corporate 

10 control. 

11 (3) BUSINESS ENTITY.—The term ‘‘business enti12 ty’’ means any organization, corporation, trust, part13 nership, sole proprietorship, unincorporated associa14 tion, venture established to make a profit, or non15 profit, and any contractor, subcontractor, affiliate, or 

16 licensee thereof engaged in interstate commerce. 

17 (4) IDENTITY THEFT.—The term ‘‘identity theft’’ 

18 means a violation of section 1028 of title 18, United 

19 States Code. 

20 (5) DATA BROKER.—The term ‘‘data broker’’ 

21 means a business entity which for monetary fees or 

22 dues regularly engages in the practice of collecting, 

23 transmitting, or providing access to sensitive person24 ally identifiable information on more than 5,000 in25 dividuals who are not the customers or employees of 
84 

•S 1789 RS

1 that business entity or affiliate primarily for the pur2 poses of providing such information to nonaffiliated 

3 third parties on an interstate basis. 

4 (6) DATA FURNISHER.—The term ‘‘data fur5 nisher’’ means any agency, organization, corporation, 

6 trust, partnership, sole proprietorship, unincor7 porated association, or nonprofit that serves as a 

8 source of information for a data broker. 

9 (7) PERSONAL ELECTRONIC RECORD.— 

10 (A) IN GENERAL.—The term ‘‘personal elec11 tronic record’’ means data associated with an in12 dividual contained in a database, networked or 

13 integrated databases, or other data system that 

14 holds sensitive personally identifiable informa15 tion of that individual and is provided to non16 affiliated third parties. 

17 (B) EXCLUSIONS.—The term ‘‘personal elec18 tronic record’’ does not include— 

19 (i) any data related to an individual’s 

20 past purchases of consumer goods; or 

21 (ii) any proprietary assessment or 

22 evaluation of an individual or any propri23 etary assessment or evaluation of informa24 tion about an individual. 
85 

•S 1789 RS

1 (8) PERSONALLY IDENTIFIABLE INFORMATION.— 

2 The term ‘‘personally identifiable information’’ means 

3 any information, or compilation of information, in 

4 electronic or digital form serving as a means of iden5 tification, as defined by section 1028(d)(7) of title 18, 

6 United State Code. 

7 (9) PUBLIC RECORD SOURCE.—The term ‘‘public 

8 record source’’ means the Congress, any agency, any 

9 State or local government agency, the government of 

10 the District of Columbia and governments of the terri11 tories or possessions of the United States, and Fed12 eral, State or local courts, courts martial and mili13 tary commissions, that maintain personally identifi14 able information in records available to the public. 

15 (10) SECURITY BREACH.— 

16 (A) IN GENERAL.—The term ‘‘security 

17 breach’’ means compromise of the security, con18 fidentiality, or integrity of computerized data 

19 through misrepresentation or actions that result 

20 in, or there is a reasonable basis to conclude has 

21 resulted in, acquisition of or access to sensitive 

22 personally identifiable information that is unau23 thorized or in excess of authorization. 

24 (B) EXCLUSION.—The term ‘‘security 

25 breach’’ does not include— 
86 

•S 1789 RS

1 (i) a good faith acquisition of sensitive 

2 personally identifiable information by a 

3 business entity or agency, or an employee or 

4 agent of a business entity or agency, if the 

5 sensitive personally identifiable information 

6 is not subject to further unauthorized disclo7 sure; or 

8 (ii) the release of a public record not 

9 otherwise subject to confidentiality or non10 disclosure requirements. 

11 (11) SENSITIVE PERSONALLY IDENTIFIABLE IN12 FORMATION.—The term ‘‘sensitive personally identifi13 able information’’ means any information or com14 pilation of information, in electronic or digital form 

15 that includes— 

16 (A) an individual’s first and last name or 

17 first initial and last name in combination with 

18 any 1 of the following data elements: 

19 (i) A non-truncated social security 

20 number, driver’s license number, passport 

21 number, or alien registration number. 

22 (ii) Any 2 of the following: 

23 (I) Home address or telephone 

24 number. 
87 

•S 1789 RS

1 (II) Mother’s maiden name, if 

2 identified as such. 

3 (III) Month, day, and year of 

4 birth. 

5 (iii) Unique biometric data such as a 

6 finger print, voice print, a retina or iris 

7 image, or any other unique physical rep8 resentation. 

9 (iv) A unique account identifier, elec10 tronic identification number, user name, or 

11 routing code in combination with any asso12 ciated security code, access code, or pass13 word that is required for an individual to 

14 obtain money, goods, services or any other 

15 thing of value; or 

16 (B) a financial account number or credit or 

17 debit card number in combination with any se18 curity code, access code or password that is re19 quired for an individual to obtain money, goods, 

20 services or any other thing of value. 
88 

•S 1789 RS

1 TITLE I—ENHANCING PUNISH2 MENT FOR IDENTITY THEFT 

3 AND OTHER VIOLATIONS OF 

4 DATA PRIVACY AND SECURITY 

5 SEC. 101. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION 

6 WITH UNAUTHORIZED ACCESS TO PERSON7 ALLY IDENTIFIABLE INFORMATION. 

8 Section 1961(1) of title 18, United States Code, is 

9 amended by inserting ‘‘section 1030(a)(2)(D) (relating to 

10 fraud and related activity in connection with unauthorized 

11 access to sensitive personally identifiable information as de12 fined in the Data Privacy and Security Act of 2005,’’ before 

13 ‘‘section 1084’’ . 

14 SEC. 102. CONCEALMENT OF SECURITY BREACHES INVOLV15 ING SENSITIVE PERSONALLY IDENTIFIABLE 

16 INFORMATION. 

17 (a) IN GENERAL.—Chapter 47 of title 18, United 

18 States Code, is amended by adding at the end the following: 

19 ‘‘SEC. 1039. CONCEALMENT OF SECURITY BREACHES IN20 VOLVING SENSITIVE PERSONALLY IDENTIFI21 ABLE INFORMATION. 

22 ‘‘(a) Whoever, having knowledge of a security breach 

23 and of the obligation either individually or collectively to 

24 provide notice of such breach to individuals under title IV 

25 of the Personal Data Privacy and Security Act of 2005, 
89 

•S 1789 RS

1 and having not otherwise qualified for an exemption from 

2 providing notice under section 422 of such Act, inten3 tionally and willfully conceals the fact of such security 

4 breach and which breach causes economic damage to 1 or 

5 more persons, shall be fined under this title or imprisoned 

6 not more than 5 years, or both. 

7 ‘‘(b) For purposes of subsection (a), the term ‘person’ 

8 has the same meaning as in section 1030(e)(12) of title 18, 

9 United States Code.’’. 

10 (b) CONFORMING AND TECHNICAL AMENDMENTS.— 

11 The table of sections for chapter 47 of title 18, United States 

12 Code, is amended by adding at the end the following: 

‘‘1039. Concealment of security breaches involving personally identifiable information.’’. 

13 (c) ENFORCEMENT AUTHORITY.— 

14 (1) IN GENERAL.—The United States Secret 

15 Service shall have the authority to investigate offenses 

16 under this section. 

17 (2) NON-EXCLUSIVITY.—The authority granted 

18 in paragraph (1) shall not be exclusive of any exist19 ing authority held by any other Federal agency. 
90 

•S 1789 RS

1 SEC. 103. REVIEW AND AMENDMENT OF FEDERAL SEN2 TENCING GUIDELINES RELATED TO FRAUDU3 LENT ACCESS TO OR MISUSE OF DIGITIZED 

4 OR ELECTRONIC PERSONALLY IDENTIFIABLE 

5 INFORMATION. 

6 (a) REVIEW AND AMENDMENT.—The United States 

7 Sentencing Commission, pursuant to its authority under 

8 section 994 of title 28, United States Code, and in accord9 ance with this section, shall review and, if appropriate, 

10 amend the Federal sentencing guidelines (including its pol11 icy statements) applicable to persons convicted of using 

12 fraud to access, or misuse of, digitized or electronic person13 ally identifiable information, including identity theft or 

14 any offense under— 

15 (1) sections 1028, 1028A, 1030, 1030A, 2511, 

16 and 2701 of title 18, United States Code; and 

17 (2) any other relevant provision. 

18 (b) REQUIREMENTS.—In carrying out the require19 ments of this section, the United States Sentencing Commis20 sion shall— 

21 (1) ensure that the Federal sentencing guidelines 

22 (including its policy statements) reflect— 

23 (A) the serious nature of the offenses and 

24 penalties referred to in this Act; 
91 

•S 1789 RS

1 (B) the growing incidences of theft and mis2 use of digitized or electronic personally identifi3 able information, including identity theft; and 

4 (C) the need to deter, prevent, and punish 

5 such offenses; 

6 (2) consider the extent to which the Federal sen7 tencing guidelines (including its policy statements) 

8 adequately address violations of the sections amended 

9 by this Act to— 

10 (A) sufficiently deter and punish such of11 fenses; and 

12 (B) adequately reflect the enhanced pen13 alties established under this Act; 

14 (3) maintain reasonable consistency with other 

15 relevant directives and sentencing guidelines; 

16 (4) account for any additional aggravating or 

17 mitigating circumstances that might justify excep18 tions to the generally applicable sentencing ranges; 

19 (5) consider whether to provide a sentencing en20 hancement for those convicted of the offenses described 

21 in subsection (a), if the conduct involves— 

22 (A) the online sale of fraudulently obtained 

23 or stolen personally identifiable information; 

24 (B) the sale of fraudulently obtained or sto25 len personally identifiable information to an in-
92 

•S 1789 RS

1 dividual who is engaged in terrorist activity or 

2 aiding other individuals engaged in terrorist ac3 tivity; or 

4 (C) the sale of fraudulently obtained or sto5 len personally identifiable information to finance 

6 terrorist activity or other criminal activities; 

7 (6) make any necessary conforming changes to 

8 the Federal sentencing guidelines to ensure that such 

9 guidelines (including its policy statements) as de10 scribed in subsection (a) are sufficiently stringent to 

11 deter, and adequately reflect crimes related to fraudu12 lent access to, or misuse of, personally identifiable in13 formation; and 

14 (7) ensure that the Federal sentencing guidelines 

15 adequately meet the purposes of sentencing under sec16 tion 3553(a)(2) of title 18, United States Code. 

17 (c) EMERGENCY AUTHORITY TO SENTENCING COMMIS18 SION.—The United States Sentencing Commission may, as 

19 soon as practicable, promulgate amendments under this sec20 tion in accordance with procedures established in section 

21 21(a) of the Sentencing Act of 1987 (28 U.S.C. 994 note) 

22 as though the authority under that Act had not expired. 
93 

•S 1789 RS

1 TITLE II—DATA BROKERS 

2 SEC. 201. TRANSPARENCY AND ACCURACY OF DATA COL3 LECTION. 

4 (a) IN GENERAL.—Data brokers engaging in interstate 

5 commerce are subject to the requirements of this title for 

6 any product or service offered to third parties that allows 

7 access or use of sensitive personally identifiable informa8 tion. 

9 (b) LIMITATION.—Notwithstanding any other provi10 sion of this title, this section shall not apply to— 

11 (1) any product or service offered by a data 

12 broker engaging in interstate commerce where such 

13 product or service is currently subject to, and in com14 pliance with, access and accuracy protections similar 

15 to those under subsections (c) through (f) of this sec16 tion under the Fair Credit Reporting Act (Public 

17 Law 91–508); 

18 (2) any data broker that is subject to regulation 

19 under the Gramm-Leach-Bliley Act (Public Law 106- 

20 102); 

21 (3) any data broker currently subject to and in 

22 compliance with the data security requirements for 

23 such entities under the Health Insurance Portability 

24 and Accountability Act (Public Law 104–191), and 

25 its implementing regulations; 
94 

•S 1789 RS

1 (4) information in a personal electronic record 

2 that— 

3 (A) the data broker has identified as inac4 curate, but maintains for the purpose of aiding 

5 the data broker in preventing inaccurate infor6 mation from entering an individual’s personal 

7 electronic record; and 

8 (B) is not maintained primarily for the 

9 purpose of transmitting or otherwise providing 

10 that information, or assessments based on that 

11 information, to non-affiliated third parties; and 

12 (5) information concerning proprietary meth13 odologies, techniques, scores, or algorithms relating to 

14 fraud prevention not normally provided to third par15 ties in the ordinary course of business. 

16 (c) DISCLOSURES TO INDIVIDUALS.— 

17 (1) IN GENERAL.—A data broker shall, upon the 

18 request of an individual, disclose to such individual 

19 for a reasonable fee all personal electronic records per20 taining to that individual maintained specifically for 

21 disclosure to third parties that request information on 

22 that individual in the ordinary course of business in 

23 the databases or systems of the data broker at the time 

24 of such request. 
95 

•S 1789 RS

1 (2) INFORMATION ON HOW TO CORRECT INAC2 CURACIES.—The disclosures required under para3 graph (1) shall also include guidance to individuals 

4 on procedures for correcting inaccuracies. 

5 (d) ACCURACY RESOLUTION PROCESS.— 

6 (1) INFORMATION FROM A PUBLIC RECORD OR

7 LICENSOR.— 

8 (A) IN GENERAL.—If an individual notifies 

9 a data broker of a dispute as to the completeness 

10 or accuracy of information disclosed to such in11 dividual under subsection (c) that is derived 

12 from a public record source or pursuant to a li13 cense agreement, such data broker shall deter14 mine within 30 days whether the information in 

15 its system accurately and completely records the 

16 information available from the public record 

17 source or licensor. 

18 (B) DATA BROKER ACTIONS.—If a data 

19 broker determines under subparagraph (A) that 

20 the information in its systems does not accu21 rately and completely record the information 

22 available from a public record source or licensor, 

23 the data broker shall — 
96 

•S 1789 RS

1 (i) correct any inaccuracies or incom2 pleteness, and provide to such individual 

3 written notice of such changes; or 

4 (ii) provide such individual with the 

5 contact information of the public record or 

6 licensor. 

7 (2) INFORMATION NOT FROM A PUBLIC RECORD

8 SOURCE OR LICENSOR.—If an individual notifies a 

9 data broker of a dispute as to the completeness or ac10 curacy of information not from a public record or li11 censor that was disclosed to the individual under sub12 section (c), the data broker shall, within 30 days of 

13 receiving notice of such dispute— 

14 (A) review and consider free of charge any 

15 information submitted by such individual that is 

16 relevant to the completeness or accuracy of the 

17 disputed information; and 

18 (B) correct any information found to be in19 complete or inaccurate and provide notice to 

20 such individual of whether and what informa21 tion was corrected, if any. 

22 (3) EXTENSION OF REVIEW PERIOD.—The 30- 

23 day period described in paragraph (1) may be ex24 tended for not more than 30 additional days if a data 

25 broker receives information from the individual dur-
97 

•S 1789 RS

1 ing the initial 30-day period that is relevant to the 

2 completeness or accuracy of any disputed informa3 tion. 

4 (4) NOTICE IDENTIFYING THE DATA FUR5 NISHER.—If the completeness or accuracy of any in6 formation not from a public record source or licensor 

7 that was disclosed to an individual under subsection 

8 (c) is disputed by such individual, the data broker 

9 shall provide, upon the request of such individual, the 

10 contact information of any data furnisher that pro11 vided the disputed information. 

12 (5) DETERMINATION THAT DISPUTE IS FRIVO13 LOUS OR IRRELEVANT.— 

14 (A) IN GENERAL.—Notwithstanding para15 graphs (1) through (3), a data broker may de16 cline to investigate or terminate a review of in17 formation disputed by an individual under those 

18 paragraphs if the data broker reasonably deter19 mines that the dispute by the individual is frivo20 lous or intended to perpetrate fraud. 

21 (B) NOTICE.—A data broker shall notify an 

22 individual of a determination under subpara23 graph (A) within a reasonable time by any 

24 means available to such data broker. 
98 

•S 1789 RS

1 SEC. 202. ENFORCEMENT. 

2 (a) CIVIL PENALTIES.— 

3 (1) PENALTIES.—Any data broker that violates 

4 the provisions of section 201 shall be subject to civil 

5 penalties of not more than $1,000 per violation per 

6 day while such violations persist, up to a maximum 

7 of $250,000 per violation. 

8 (2) INTENTIONAL OR WILLFUL VIOLATION.—A 

9 data broker that intentionally or willfully violates the 

10 provisions of section 201 shall be subject to additional 

11 penalties in the amount of $1,000 per violation per 

12 day, to a maximum of an additional $250,000 per 

13 violation, while such violations persist. 

14 (3) EQUITABLE RELIEF.—A data broker engaged 

15 in interstate commerce that violates this section may 

16 be enjoined from further violations by a court of com17 petent jurisdiction. 

18 (4) OTHER RIGHTS AND REMEDIES.—The rights 

19 and remedies available under this subsection are cu20 mulative and shall not affect any other rights and 

21 remedies available under law. 

22 (b) FEDERAL TRADE COMMISSION AUTHORITY.—Any 

23 data broker shall have the provisions of this title enforced 

24 against it by the Federal Trade Commission. 

25 (c) STATE ENFORCEMENT.— 
99 

•S 1789 RS

1 (1) CIVIL ACTIONS.—In any case in which the 

2 attorney general of a State or any State or local law 

3 enforcement agency authorized by the State attorney 

4 general or by State statute to prosecute violations of 

5 consumer protection law, has reason to believe that an 

6 interest of the residents of that State has been or is 

7 threatened or adversely affected by the acts or prac8 tices of a data broker that violate this subtitle, the 

9 State may bring a civil action on behalf of the resi10 dents of that State in a district court of the United 

11 States of appropriate jurisdiction, or any other court 

12 of competent jurisdiction, to— 

13 (A) enjoin that act or practice; 

14 (B) enforce compliance with this title; or 

15 (C) obtain civil penalties of not more than 

16 $1,000 per violation per day while such viola17 tions persist, up to a maximum of $250,000 per 

18 violation. 

19 (2) NOTICE.— 

20 (A) IN GENERAL.—Before filing an action 

21 under this subsection, the attorney general of the 

22 State involved shall provide to the Federal Trade 

23 Commission— 

24 (i) a written notice of that action; and 
100 

•S 1789 RS

1 (ii) a copy of the complaint for that 

2 action. 

3 (B) EXCEPTION.—Subparagraph (A) shall 

4 not apply with respect to the filing of an action 

5 by an attorney general of a State under this sub6 section, if the attorney general of a State deter7 mines that it is not feasible to provide the notice 

8 described in subparagraph (A) before the filing of 

9 the action. 

10 (C) NOTIFICATION WHEN PRACTICABLE.—In 

11 an action described under subparagraph (B), the 

12 attorney general of a State shall provide the 

13 written notice and the copy of the complaint to 

14 the Federal Trade Commission as soon after the 

15 filing of the complaint as practicable. 

16 (3) FEDERAL TRADE COMMISSION AUTHORITY.— 

17 Upon receiving notice under paragraph (2), the Fed18 eral Trade Commission shall have the right to— 

19 (A) move to stay the action, pending the 

20 final disposition of a pending Federal proceeding 

21 or action as described in paragraph (4); 

22 (B) intervene in an action brought under 

23 paragraph (1); and 

24 (C) file petitions for appeal. 
101 

•S 1789 RS

1 (4) PENDING PROCEEDINGS.—If the Federal 

2 Trade Commission has instituted a proceeding or 

3 civil action for a violation of this title, no attorney 

4 general of a State may, during the pendency of such 

5 proceeding or civil action, bring an action under this 

6 subsection against any defendant named in such civil 

7 action for any violation that is alleged in that civil 

8 action. 

9 (5) RULE OF CONSTRUCTION.—For purposes of 

10 bringing any civil action under paragraph (1), noth11 ing in this title shall be construed to prevent an attor12 ney general of a State from exercising the powers con13 ferred on the attorney general by the laws of that 

14 State to— 

15 (A) conduct investigations; 

16 (B) administer oaths and affirmations; or 

17 (C) compel the attendance of witnesses or 

18 the production of documentary and other evi19 dence. 

20 (6) VENUE; SERVICE OF PROCESS.— 

21 (A) VENUE.—Any action brought under this 

22 subsection may be brought in the district court 

23 of the United States that meets applicable re24 quirements relating to venue under section 1931 

25 of title 28, United States Code. 
102 

•S 1789 RS

1 (B) SERVICE OF PROCESS.—In an action 

2 brought under this subsection process may be 

3 served in any district in which the defendant— 

4 (i) is an inhabitant; or 

5 (ii) may be found. 

6 (d) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

7 title establishes a private cause of action against a data 

8 broker for violation of any provision of this title. 

9 (e) IMPLEMENTATION TIME LINE.—Not later than 1 

10 year after the date of enactment of this Act, a business enti11 ty subject to the provisions of this title shall implement a 

12 data privacy and security program pursuant to this title. 

13 SEC. 203. RELATION TO STATE LAWS. 

14 No requirement or prohibition may be imposed under 

15 the laws of any State with respect to any subject matter 

16 regulated under section 201, relating to individual access 

17 to, and correction of, personal electronic records held by 

18 data brokers. 

19 SEC. 204. EFFECTIVE DATE. 

20 This title shall take effect 180 days after the date of 

21 enactment of this Act. 
103 

•S 1789 RS

1 TITLE III—PRIVACY AND SECU2 RITY OF PERSONALLY IDENTI3 FIABLE INFORMATION 

4 Subtitle A—A Data Privacy and 

5 Security Program 

6 SEC. 301. PURPOSE AND APPLICABILITY OF DATA PRIVACY 

7 AND SECURITY PROGRAM. 

8 (a) PURPOSE.—The purpose of this subtitle is to en9 sure standards for developing and implementing adminis10 trative, technical, and physical safeguards to protect the se11 curity of sensitive personally identifiable information. 

12 (b) IN GENERAL.—A business entity engaging in 

13 interstate commerce that involves collecting, accessing, 

14 transmitting, using, storing, or disposing of sensitive per15 sonally identifiable information in electronic or digital 

16 form on 10,000 or more United States persons is subject 

17 to the requirements for a data privacy and security pro18 gram under section 302 for protecting sensitive personally 

19 identifiable information. 

20 (c) LIMITATIONS.—Notwithstanding any other obliga21 tion under this subtitle, this subtitle does not apply to: 

22 (1) FINANCIAL INSTITUTIONS.—Financial insti23 tutions— 

24 (A) subject to the data security requirements 

25 and implementing regulations under the 
104 

•S 1789 RS

1 Gramm-Leach-Bliley Act (15 U.S.C. 6801 et 

2 seq.); and 

3 (B) subject to— 

4 (i) examinations for compliance with 

5 the requirements of this Act by a Federal 

6 Functional Regulator or State Insurance 

7 Authority (as those terms are defined in sec8 tion 509 of the Gramm-Leach-Bliley Act 

9 (15 U.S.C. 6809)); or 

10 (ii) compliance with part 314 of title 

11 16, Code of Federal Regulations. 

12 (2) HIPPA REGULATED ENTITIES.— 

13 (A) COVERED ENTITIES.—Covered entities 

14 subject to the Health Insurance Portability and 

15 Accountability Act of 1996 (42 U.S.C. 1301 et 

16 seq.), including the data security requirements 

17 and implementing regulations of that Act. 

18 (B) BUSINESS ENTITIES.—A business entity 

19 shall be deemed in compliance with the privacy 

20 and security program requirements under section 

21 302 if the business entity is acting as a ‘‘busi22 ness associate’’ as that term is defined in the 

23 Health Insurance Portability and Accountability 

24 Act of 1996 (42 U.S.C. 1301 et. seq.) and is in 
105 

•S 1789 RS

1 compliance with requirements imposed under 

2 that Act and its implementing regulations 

3 (d) SAFE HARBORS.— 

4 (1) IN GENERAL.—A business entity shall be 

5 deemed in compliance with the privacy and security 

6 program requirements under section 302 if the busi7 ness entity complies with or provides protection equal 

8 to industry standards, as identified by the Federal 

9 Trade Commission, that are applicable to the type of 

10 sensitive personally identifiable information involved 

11 in the ordinary course of business of such business en12 tity. 

13 (2) LIMITATION.—Nothing in this subsection 

14 shall be construed to permit, and nothing does permit, 

15 the Federal Trade Commission to issue regulations re16 quiring, or according greater legal status to, the im17 plementation of or application of a specific technology 

18 or technological specifications for meeting the require19 ments of this title. 

20 SEC. 302. REQUIREMENTS FOR A PERSONAL DATA PRIVACY 

21 AND SECURITY PROGRAM. 

22 (a) PERSONAL DATA PRIVACY AND SECURITY PRO23 GRAM.—A business entity subject to this subtitle shall com24 ply with the following safeguards and any other adminis25 trative, technical, or physical safeguards identified by the 
106 

•S 1789 RS

1 Federal Trade Commission in a rulemaking process pursu2 ant to section 553 of title 5, United States Code, for the 

3 protection of sensitive personally identifiable information: 

4 (1) SCOPE.—A business entity shall implement a 

5 comprehensive personal data privacy and security 

6 program that includes administrative, technical, and 

7 physical safeguards appropriate to the size and com8 plexity of the business entity and the nature and 

9 scope of its activities. 

10 (2) DESIGN.—The personal data privacy and se11 curity program shall be designed to— 

12 (A) ensure the privacy, security, and con13 fidentiality of personal electronic records; 

14 (B) protect against any anticipated 

15 vulnerabilities to the privacy, security, or integ16 rity of sensitive personally identifying informa17 tion; and 

18 (C) protect against unauthorized access to 

19 use of sensitive personally identifying informa20 tion that could result in substantial harm or in21 convenience to any individual. 

22 (3) RISK ASSESSMENT.—A business entity 

23 shall— 

24 (A) identify reasonably foreseeable internal 

25 and external vulnerabilities that could result in 
107 

•S 1789 RS

1 unauthorized access, disclosure, use, or alteration 

2 of sensitive personally identifiable information 

3 or systems containing sensitive personally identi4 fiable information; 

5 (B) assess the likelihood of and potential 

6 damage from unauthorized access, disclosure, 

7 use, or alteration of sensitive personally identifi8 able information; 

9 (C) assess the sufficiency of its policies, 

10 technologies, and safeguards in place to control 

11 and minimize risks from unauthorized access, 

12 disclosure, use, or alteration of sensitive person13 ally identifiable information; and 

14 (D) assess the vulnerability of sensitive per15 sonally identifiable information during destruc16 tion and disposal of such information, including 

17 through the disposal or retirement of hardware. 

18 (4) RISK MANAGEMENT AND CONTROL.—Each 

19 business entity shall— 

20 (A) design its personal data privacy and se21 curity program to control the risks identified 

22 under paragraph (3); and 

23 (B) adopt measures commensurate with the 

24 sensitivity of the data as well as the size, com-
108 

•S 1789 RS

1 plexity, and scope of the activities of the business 

2 entity that— 

3 (i) control access to systems and facili4 ties containing sensitive personally identifi5 able information, including controls to au6 thenticate and permit access only to author7 ized individuals; 

8 (ii) detect actual and attempted fraud9 ulent, unlawful, or unauthorized access, dis10 closure, use, or alteration of sensitive per11 sonally identifiable information, including 

12 by employees and other individuals other13 wise authorized to have access; 

14 (iii) protect sensitive personally identi15 fiable information during use, transmission, 

16 storage, and disposal by encryption or other 

17 reasonable means (including as directed for 

18 disposal of records under section 628 of the 

19 Fair Credit Reporting Act (15 U.S.C. 

20 1681w) and the implementing regulations of 

21 such Act as set forth in section 682 of title 

22 16, Code of Federal Regulations); and 

23 (iv) ensure that sensitive personally 

24 identifiable information is properly de25 stroyed and disposed of, including during 
109 

•S 1789 RS

1 the destruction of computers, diskettes, and 

2 other electronic media that contain sensitive 

3 personally identifiable information. 

4 (b) TRAINING.—Each business entity subject to this 

5 subtitle shall take steps to ensure employee training and 

6 supervision for implementation of the data security pro7 gram of the business entity. 

8 (c) VULNERABILITY TESTING.— 

9 (1) IN GENERAL.—Each business entity subject 

10 to this subtitle shall take steps to ensure regular test11 ing of key controls, systems, and procedures of the 

12 personal data privacy and security program to detect, 

13 prevent, and respond to attacks or intrusions, or other 

14 system failures. 

15 (2) FREQUENCY.—The frequency and nature of 

16 the tests required under paragraph (1) shall be deter17 mined by the risk assessment of the business entity 

18 under subsection (a)(3). 

19 (d) RELATIONSHIP TO SERVICE PROVIDERS.—In the 

20 event a business entity subject to this subtitle engages serv21 ice providers not subject to this subtitle, such business entity 

22 shall— 

23 (1) exercise appropriate due diligence in select24 ing those service providers for responsibilities related 

25 to sensitive personally identifiable information, and 
110 

•S 1789 RS

1 take reasonable steps to select and retain service pro2 viders that are capable of maintaining appropriate 

3 safeguards for the security, privacy, and integrity of 

4 the sensitive personally identifiable information at 

5 issue; and 

6 (2) require those service providers by contract to 

7 implement and maintain appropriate measures de8 signed to meet the objectives and requirements gov9 erning entities subject to section 301, this section, and 

10 subtitle B. 

11 (e) PERIODIC ASSESSMENT AND PERSONAL DATA PRI12 VACY AND SECURITY MODERNIZATION.—Each business en13 tity subject to this subtitle shall on a regular basis monitor, 

14 evaluate, and adjust, as appropriate its data privacy and 

15 security program in light of any relevant changes in— 

16 (1) technology; 

17 (2) the sensitivity of personally identifiable in18 formation; 

19 (3) internal or external threats to personally 

20 identifiable information; and 

21 (4) the changing business arrangements of the 

22 business entity, such as— 

23 (A) mergers and acquisitions; 

24 (B) alliances and joint ventures; 

25 (C) outsourcing arrangements; 
111 

•S 1789 RS

1 (D) bankruptcy; and 

2 (E) changes to sensitive personally identifi3 able information systems. 

4 (f) IMPLEMENTATION TIME LINE.—Not later than 1 

5 year after the date of enactment of this Act, a business enti6 ty subject to the provisions of this subtitle shall implement 

7 a data privacy and security program pursuant to this sub8 title. 

9 SEC. 303. ENFORCEMENT. 

10 (a) CIVIL PENALTIES.— 

11 (1) IN GENERAL.—Any business entity that vio12 lates the provisions of sections 301 or 302 shall be 

13 subject to civil penalties of not more than $5,000 per 

14 violation per day while such a violation exists, with 

15 a maximum of $500,000 per violation. 

16 (2) INTENTIONAL OR WILLFUL VIOLATION.—A 

17 business entity that intentionally or willfully violates 

18 the provisions of sections 301 or 302 shall be subject 

19 to additional penalties in the amount of $5,000 per 

20 violation per day while such a violation exists, with 

21 a maximum of an additional $500,000 per violation. 

22 (3) EQUITABLE RELIEF.—A business entity en23 gaged in interstate commerce that violates this section 

24 may be enjoined from further violations by a court of 

25 competent jurisdiction. 
112 

•S 1789 RS

1 (4) OTHER RIGHTS AND REMEDIES.—The rights 

2 and remedies available under this section are cumu3 lative and shall not affect any other rights and rem4 edies available under law. 

5 (b) FEDERAL TRADE COMMISSION AUTHORITY.—Any 

6 data broker shall have the provisions of this title enforced 

7 against it by the Federal Trade Commission. 

8 (c) STATE ENFORCEMENT.— 

9 (1) CIVIL ACTIONS.—In any case in which the 

10 attorney general of a State or any State or local law 

11 enforcement agency authorized by the State attorney 

12 general or by State statute to prosecute violations of 

13 consumer protection law, has reason to believe that an 

14 interest of the residents of that State has been or is 

15 threatened or adversely affected by the acts or prac16 tices of a data broker that violate this subtitle, the 

17 State may bring a civil action on behalf of the resi18 dents of that State in a district court of the United 

19 States of appropriate jurisdiction, or any other court 

20 of competent jurisdiction, to— 

21 (A) enjoin that act or practice; 

22 (B) enforce compliance with this title; or 

23 (C) obtain civil penalties of not more than 

24 $5,000 per violation per day while such viola-
113 

•S 1789 RS

1 tions persist, up to a maximum of $500,000 per 

2 violation. 

3 (2) NOTICE.— 

4 (A) IN GENERAL.—Before filing an action 

5 under this subsection, the Attorney General of the 

6 State involved shall provide to the Federal Trade 

7 Commission— 

8 (i) a written notice of that action; and 

9 (ii) a copy of the complaint for that 

10 action. 

11 (B) EXCEPTION.—Subparagraph (A) shall 

12 not apply with respect to the filing of an action 

13 by an Attorney General of a State under this 

14 subsection, if the attorney general of a State de15 termines that it is not feasible to provide the no16 tice described in this subparagraph before the fil17 ing of the action. 

18 (C) NOTIFICATION WHEN PRACTICABLE.—In 

19 an action described under subparagraph (B), the 

20 Attorney General of a State shall provide the 

21 written notice and the copy of the complaint to 

22 the Federal Trade Commission as soon after the 

23 filing of the complaint as practicable. 
114 

•S 1789 RS

1 (3) FEDERAL TRADE COMMISSION AUTHORITY.— 

2 Upon receiving notice under paragraph (2), the Fed3 eral Trade Commission shall have the right to— 

4 (A) move to stay the action, pending the 

5 final disposition of a pending Federal proceeding 

6 or action as described in paragraph (4); 

7 (B) intervene in an action brought under 

8 paragraph (1); and 

9 (C) file petitions for appeal. 

10 (4) PENDING PROCEEDINGS.—If the Federal 

11 Trade Commission has instituted a proceeding or ac12 tion for a violation of this title or any regulations 

13 thereunder, no attorney general of a State may, dur14 ing the pendency of such proceeding or action, bring 

15 an action under this subsection against any defend16 ant named in such criminal proceeding or civil ac17 tion for any violation that is alleged in that pro18 ceeding or action. 

19 (5) RULE OF CONSTRUCTION.—For purposes of 

20 bringing any civil action under paragraph (1) noth21 ing in this title shall be construed to prevent an attor22 ney general of a State from exercising the powers con23 ferred on the attorney general by the laws of that 

24 State to— 

25 (A) conduct investigations; 
115 

•S 1789 RS

1 (B) administer oaths and affirmations; or 

2 (C) compel the attendance of witnesses or 

3 the production of documentary and other evi4 dence. 

5 (6) VENUE; SERVICE OF PROCESS.— 

6 (A) VENUE.—Any action brought under this 

7 subsection may be brought in the district court 

8 of the United States that meets applicable re9 quirements relating to venue under section 1391 

10 of title 28, United States Code. 

11 (B) SERVICE OF PROCESS.—In an action 

12 brought under this subsection process may be 

13 served in any district in which the defendant— 

14 (i) is an inhabitant; or 

15 (ii) may be found. 

16 (d) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

17 subtitle establishes a private cause of action against a busi18 ness entity for violation of any provision of this subtitle. 

19 SEC. 304. RELATION TO OTHER LAWS. 

20 (a) IN GENERAL.—No State may require any business 

21 entity subject to this subtitle to comply with any require22 ments with respect to administrative, technical, and phys23 ical safeguards for the protection of sensitive personally 

24 identifying information. 
116 

•S 1789 RS

1 (b) LIMITATIONS.—Nothing in this subtitle shall be 

2 construed to modify, limit, or supersede the operation of 

3 the Gramm-Leach-Bliley Act or its implementing regula4 tions, including those adopted or enforced by States. 

5 Subtitle B—Security Breach 

6 Notification 

7 SEC. 321. NOTICE TO INDIVIDUALS. 

8 (a) IN GENERAL.—Any agency, or business entity en9 gaged in interstate commerce, that uses, accesses, transmits, 

10 stores, disposes of or collects sensitive personally identifiable 

11 information shall, following the discovery of a security 

12 breach of such information notify any resident of the United 

13 States whose sensitive personally identifiable information 

14 has been, or is reasonably believed to have been, accessed, 

15 or acquired. 

16 (b) OBLIGATION OF OWNER OR LICENSEE.— 

17 (1) NOTICE TO OWNER OR LICENSEE.—Any 

18 agency, or business entity engaged in interstate com19 merce, that uses, accesses, transmits, stores, disposes 

20 of, or collects sensitive personally identifiable infor21 mation that the agency or business entity does not 

22 own or license shall notify the owner or licensee of the 

23 information following the discovery of a security 

24 breach involving such information. 
117 

•S 1789 RS

1 (2) NOTICE BY OWNER, LICENSEE OR OTHER

2 DESIGNATED THIRD PARTY.—Nothing in this subtitle 

3 shall prevent or abrogate an agreement between an 

4 agency or business entity required to give notice 

5 under this section and a designated third party, in6 cluding an owner or licensee of the sensitive person7 ally identifiable information subject to the security 

8 breach, to provide the notifications required under 

9 subsection (a). 

10 (3) BUSINESS ENTITY RELIEVED FROM GIVING

11 NOTICE.—A business entity obligated to give notice 

12 under subsection (a) shall be relieved of such obliga13 tion if an owner or licensee of the sensitive personally 

14 identifiable information subject to the security breach, 

15 or other designated third party, provides such notifi16 cation. 

17 (c) TIMELINESS OF NOTIFICATION.— 

18 (1) IN GENERAL.—All notifications required 

19 under this section shall be made without unreasonable 

20 delay following the discovery by the agency or busi21 ness entity of a security breach. 

22 (2) REASONABLE DELAY.—Reasonable delay 

23 under this subsection may include any time necessary 

24 to determine the scope of the security breach, prevent 

25 further disclosures, and restore the reasonable integ-
118 

•S 1789 RS

1 rity of the data system and provide notice to law en2 forcement when required. 

3 (3) BURDEN OF PROOF.—The agency, business 

4 entity, owner, or licensee required to provide notifica5 tion under this section shall have the burden of dem6 onstrating that all notifications were made as re7 quired under this subtitle, including evidence dem8 onstrating the necessity of any delay. 

9 (d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW

10 ENFORCEMENT PURPOSES.— 

11 (1) IN GENERAL.—If a Federal law enforcement 

12 agency determines that the notification required 

13 under this section would impede a criminal investiga14 tion, such notification shall be delayed upon written 

15 notice from such Federal law enforcement agency to 

16 the agency or business entity that experienced the 

17 breach. 

18 (2) EXTENDED DELAY OF NOTIFICATION.—If the 

19 notification required under subsection (a) is delayed 

20 pursuant to paragraph (1), an agency or business en21 tity shall give notice 30 days after the day such law 

22 enforcement delay was invoked unless a Federal law 

23 enforcement agency provides written notification that 

24 further delay is necessary. 
119 

•S 1789 RS

1 (3) LAW ENFORCEMENT IMMUNITY.—No cause of 

2 action shall lie in any court against any law enforce3 ment agency for acts relating to the delay of notifica4 tion for law enforcement purposes under this Act. 

5 SEC. 322. EXEMPTIONS. 

6 (a) EXEMPTION FOR NATIONAL SECURITY AND LAW

7 ENFORCEMENT.— 

8 (1) IN GENERAL.—Section 321 shall not apply to 

9 an agency if the agency certifies, in writing, that no10 tification of the security breach as required by section 

11 321 reasonably could be expected to— 

12 (A) cause damage to the national security; 

13 or 

14 (B) hinder a law enforcement investigation 

15 or the ability of the agency to conduct law en16 forcement investigations. 

17 (2) LIMITS ON CERTIFICATIONS.—An agency 

18 may not execute a certification under paragraph (1) 

19 to— 

20 (A) conceal violations of law, inefficiency, 

21 or administrative error; 

22 (B) prevent embarrassment to a business 

23 entity, organization, or agency; or 

24 (C) restrain competition. 
120 

•S 1789 RS

1 (3) NOTICE.—In every case in which an agency 

2 issues a certification under paragraph (1), the certifi3 cation, accompanied by a description of the factual 

4 basis for the certification, shall be immediately pro5 vided to the United States Secret Service. 

6 (b) SAFE HARBOR.—An agency or business entity will 

7 be exempt from the notice requirements under section 321, 

8 if— 

9 (1) a risk assessment concludes that there is no 

10 significant risk that the security breach has resulted 

11 in, or will result in, harm to the individuals whose 

12 sensitive personally identifiable information was sub13 ject to the security breach; 

14 (2) without unreasonable delay, but not later 

15 than 45 days after the discovery of a security breach, 

16 unless extended by the United States Secret Service, 

17 the agency or business entity notifies the United 

18 States Secret Service, in writing, of— 

19 (A) the results of the risk assessment; and 

20 (B) its decision to invoke the risk assess21 ment exemption; and 

22 (3) the United States Secret Service does not in23 dicate, in writing, within 10 days from receipt of the 

24 decision, that notice should be given. 

25 (c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
121 

•S 1789 RS

1 (1) IN GENERAL.—A business entity will be ex2 empt from the notice requirement under section 321 

3 if the business entity utilizes or participates in a se4 curity program that— 

5 (A) is designed to block the use of the sen6 sitive personally identifiable information to ini7 tiate unauthorized financial transactions before 

8 they are charged to the account of the individual; 

9 and 

10 (B) provides for notice to affected individ11 uals after a security breach that has resulted in 

12 fraud or unauthorized transactions. 

13 (2) LIMITATION.—The exemption by this sub14 section does not apply if the information subject to 

15 the security breach includes sensitive personally iden16 tifiable information in addition to the sensitive per17 sonally identifiable information identified in section 

18 3. 

19 SEC. 323. METHODS OF NOTICE. 

20 An agency, or business entity shall be in compliance 

21 with section 321 if it provides both: 

22 (1) INDIVIDUAL NOTICE.— 

23 (A) Written notification to the last known 

24 home mailing address of the individual in the 

25 records of the agency or business entity; 
122 

•S 1789 RS

1 (B) Telephone notice to the individual per2 sonally; or 

3 (C) E-mail notice, if the individual has 

4 consented to receive such notice and the notice is 

5 consistent with the provisions permitting elec6 tronic transmission of notices under section 101 

7 of the Electronic Signatures in Global and Na8 tional Commerce Act (15 U.S.C. 7001). 

9 (2) MEDIA NOTICE.—Notice to major media out10 lets serving a State or jurisdiction, if the number of 

11 residents of such State whose sensitive personally 

12 identifiable information was, or is reasonably believed 

13 to have been, acquired by an unauthorized person ex14 ceeds 5,000. 

15 SEC. 324. CONTENT OF NOTIFICATION. 

16 (a) IN GENERAL.—Regardless of the method by which 

17 notice is provided to individuals under section 323, such 

18 notice shall include, to the extent possible— 

19 (1) a description of the categories of sensitive 

20 personally identifiable information that was, or is 

21 reasonably believed to have been, acquired by an un22 authorized person; 

23 (2) a toll-free number— 
123 

•S 1789 RS

1 (A) that the individual may use to contact 

2 the agency or business entity, or the agent of the 

3 agency or business entity; and 

4 (B) from which the individual may learn 

5 what types of sensitive personally identifiable in6 formation the agency or business entity main7 tained about that individual; and 

8 (3) the toll-free contact telephone numbers and 

9 addresses for the major credit reporting agencies. 

10 (b) ADDITIONAL CONTENT.—Notwithstanding section 

11 329, a State may require that a notice under subsection 

12 (a) shall also include information regarding victim protec13 tion assistance provided for by that State. 

14 SEC. 325. COORDINATION OF NOTIFICATION WITH CREDIT 

15 REPORTING AGENCIES. 

16 If an agency or business entity is required to provide 

17 notification to more than 1,000 individuals under section 

18 321(a), the agency or business entity shall also notify, with19 out unreasonable delay, all consumer reporting agencies 

20 that compile and maintain files on consumers on a nation21 wide basis (as defined in section 603(p) of the Fair Credit 

22 Reporting Act (15 U.S.C. 1681a(p)) of the timing and dis23 tribution of the notices. 
124 

•S 1789 RS

1 SEC. 326. NOTICE TO LAW ENFORCEMENT. 

2 (a) SECRET SERVICE.—Any business entity or agency 

3 shall give notice of a security breach to the United States 

4 Secret Service if— 

5 (1) the number of individuals whose sensitive 

6 personally identifying information was, or is reason7 ably believed to have been acquired by an unauthor8 ized person exceeds 10,000; 

9 (2) the security breach involves a database, 

10 networked or integrated databases, or other data sys11 tem containing the sensitive personally identifiable 

12 information of more than 1,000,000 individuals na13 tionwide; 

14 (3) the security breach involves databases owned 

15 by the Federal Government; or 

16 (4) the security breach involves primarily sen17 sitive personally identifiable information of employees 

18 and contractors of the Federal Government involved 

19 in national security or law enforcement. 

20 (b) NOTICE TO OTHER LAW ENFORCEMENT AGEN21 CIES.—The United States Secret Service shall be responsible 

22 for notifying— 

23 (1) the Federal Bureau of Investigation, if the se24 curity breach involves espionage, foreign counterintel25 ligence, information protected against unauthorized 

26 disclosure for reasons of national defense or foreign 
125 

•S 1789 RS

1 relations, or Restricted Data (as that term is defined 

2 in section 11y of the Atomic Energy Act of 1954 (42 

3 U.S.C. 2014(y)), except for offenses affecting the du4 ties of the United States Secret Service under section 

5 3056(a) of title 18, United States Code; 

6 (2) the United States Postal Inspection Service, 

7 if the security breach involves mail fraud; and 

8 (3) the attorney general of each State affected by 

9 the security breach. 

10 (c) 14-DAY RULE.—The notices to Federal law enforce11 ment and the attorney general of each State affected by a 

12 security breach required under this section shall be delivered 

13 as promptly as possible, but not later than 14 days after 

14 discovery of the events requiring notice. 

15 SEC. 327. ENFORCEMENT. 

16 (a) CIVIL ACTIONS BY THE ATTORNEY GENERAL.—The 

17 Attorney General may bring a civil action in the appro18 priate United States district court against any business en19 tity that engages in conduct constituting a violation of this 

20 subtitle and, upon proof of such conduct by a preponderance 

21 of the evidence, such business entity shall be subject to a 

22 civil penalty of not more than $1,000 per day per indi23 vidual whose sensitive personally identifiable information 

24 was, or is reasonably believed to have been, accessed or ac-
126 

•S 1789 RS

1 quired by an unauthorized person, up to a maximum of 

2 $50,000 per person. 

3 (b) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN4 ERAL.— 

5 (1) IN GENERAL.—If it appears that a business 

6 entity has engaged, or is engaged, in any act or prac7 tice constituting a violation of this subtitle, the Attor8 ney General may petition an appropriate district 

9 court of the United States for an order— 

10 (A) enjoining such act or practice; or 

11 (B) enforcing compliance with this subtitle. 

12 (2) ISSUANCE OF ORDER.—A court may issue an 

13 order under paragraph (1), if the court finds that the 

14 conduct in question constitutes a violation of this sub15 title. 

16 (c) OTHER RIGHTS AND REMEDIES.—The rights and 

17 remedies available under this subtitle are cumulative and 

18 shall not affect any other rights and remedies available 

19 under law. 

20 (d) FRAUD ALERT.—Section 605A(b)(1) of the Fair 

21 Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is amended 

22 by inserting ‘‘, or evidence that the consumer has received 

23 notice that the consumer’s financial information has or 

24 may have been compromised,’’ after ‘‘identity theft report’’. 
127 

•S 1789 RS

1 SEC. 328. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

2 (a) IN GENERAL.— 

3 (1) CIVIL ACTIONS.—In any case in which the 

4 attorney general of a State or any State or local law 

5 enforcement agency authorized by the State attorney 

6 general or by State statute to prosecute violations of 

7 consumer protection law, has reason to believe that an 

8 interest of the residents of that State has been or is 

9 threatened or adversely affected by the engagement of 

10 a business entity in a practice that is prohibited 

11 under this subtitle, the State or the State or local law 

12 enforcement agency on behalf of the residents of the 

13 agency’s jurisdiction, may bring a civil action on be14 half of the residents of the State or jurisdiction in a 

15 district court of the United States of appropriate ju16 risdiction or any other court of competent jurisdic17 tion, including a State court, to— 

18 (A) enjoin that practice; 

19 (B) enforce compliance with this subtitle; or 

20 (C) civil penalties of not more than $1,000 

21 per day per individual whose sensitive person22 ally identifiable information was, or is reason23 ably believed to have been, accessed or acquired 

24 by an unauthorized person, up to a maximum of 

25 $50,000 per day. 

26 (2) NOTICE.— 
128 

•S 1789 RS

1 (A) IN GENERAL.—Before filing an action 

2 under paragraph (1), the attorney general of the 

3 State involved shall provide to the Attorney Gen4 eral of the United States— 

5 (i) written notice of the action; and 

6 (ii) a copy of the complaint for the ac7 tion. 

8 (B) EXEMPTION.— 

9 (i) IN GENERAL.—Subparagraph (A) 

10 shall not apply with respect to the filing of 

11 an action by an attorney general of a State 

12 under this subtitle, if the State attorney 

13 general determines that it is not feasible to 

14 provide the notice described in such sub15 paragraph before the filing of the action. 

16 (ii) NOTIFICATION.—In an action de17 scribed in clause (i), the attorney general of 

18 a State shall provide notice and a copy of 

19 the complaint to the Attorney General at 

20 the time the State attorney general files the 

21 action. 

22 (b) FEDERAL PROCEEDINGS.—Upon receiving notice 

23 under subsection (a)(2), the Attorney General shall have the 

24 right to— 
129 

•S 1789 RS

1 (1) move to stay the action, pending the final 

2 disposition of a pending Federal proceeding or action; 

3 (2) initiate an action in the appropriate United 

4 States district court under section 327 and move to 

5 consolidate all pending actions, including State ac6 tions, in such court; 

7 (3) intervene in an action brought under sub8 section (a)(2); and 

9 (4) file petitions for appeal. 

10 (c) PENDING PROCEEDINGS.—If the Attorney General 

11 has instituted a proceeding or action for a violation of this 

12 subtitle or any regulations thereunder, no attorney general 

13 of a State may, during the pendency of such proceeding 

14 or action, bring an action under this subtitle against any 

15 defendant named in such criminal proceeding or civil ac16 tion for any violation that is alleged in that proceeding or 

17 action. 

18 (d) CONSTRUCTION.—For purposes of bringing any 

19 civil action under subsection (a), nothing in this subtitle 

20 regarding notification shall be construed to prevent an at21 torney general of a State from exercising the powers con22 ferred on such attorney general by the laws of that State 

23 to— 

24 (1) conduct investigations; 

25 (2) administer oaths or affirmations; or 
130 

•S 1789 RS

1 (3) compel the attendance of witnesses or the 

2 production of documentary and other evidence. 

3 (e) VENUE; SERVICE OF PROCESS.— 

4 (1) VENUE.—Any action brought under sub5 section (a) may be brought in— 

6 (A) the district court of the United States 

7 that meets applicable requirements relating to 

8 venue under section 1391 of title 28, United 

9 States Code; or 

10 (B) another court of competent jurisdiction. 

11 (2) SERVICE OF PROCESS.—In an action brought 

12 under subsection (a), process may be served in any 

13 district in which the defendant— 

14 (A) is an inhabitant; or 

15 (B) may be found. 

16 (f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

17 subtitle establishes a private cause of action against a busi18 ness entity for violation of any provision of this subtitle. 

19 SEC. 329. EFFECT ON FEDERAL AND STATE LAW. 

20 (a) IN GENERAL.—The provisions of this subtitle shall 

21 supersede any other provision of Federal law or any provi22 sion of law of any State relating to notification of a secu23 rity breach, except as provided in section 324(b). 
131 

•S 1789 RS

1 (b) GRAMM-LEACH-BLILEY.—This subtitle shall not 

2 preclude any operation permitted under section 507 of the 

3 Gramm-Leach-Bliley Act (15 U.S.C. 6807). 

4 SEC. 330. AUTHORIZATION OF APPROPRIATIONS. 

5 There are authorized to be appropriated such sums as 

6 may be necessary to cover the costs incurred by the United 

7 States Secret Service to carry out investigations and risk 

8 assessments of security breaches as required under this sub9 title. 

10 SEC. 331. REPORTING ON RISK ASSESSMENT EXEMPTIONS. 

11 The United States Secret Service shall report to Con12 gress not later than 18 months after the date of enactment 

13 of this Act, and upon the request by Congress thereafter, 

14 on— 

15 (1) the number and nature of the security 

16 breaches described in the notices filed by those busi17 ness entities invoking the risk assessment exemption 

18 under section 322(b) of this Act and the response of 

19 the United States Secret Service to such notices; and 

20 (2) the number and nature of security breaches 

21 subject to the national security and law enforcement 

22 exemptions under section 322(a) of this Act. 
132 

•S 1789 RS

1 SEC. 332. EFFECTIVE DATE. 

2 This subtitle shall take effect on the expiration of the 

3 date which is 90 days after the date of enactment of this 

4 Act. 

5 TITLE IV—GOVERNMENT ACCESS 

6 TO AND USE OF COMMERCIAL 

7 DATA 

8 SEC. 401. GENERAL SERVICES ADMINISTRATION REVIEW OF 

9 CONTRACTS. 

10 (a) IN GENERAL.—In considering contract awards to11 taling more than $500,000 and entered into after the date 

12 of enactment of this Act with data brokers, the Adminis13 trator of the General Services Administration shall evalu14 ate— 

15 (1) the data privacy and security program of a 

16 data broker to ensure the privacy and security of data 

17 containing personally identifiable information, in18 cluding whether such program adequately addresses 

19 privacy and security threats created by malicious 

20 software or code, or the use of peer-to-peer file sharing 

21 software; 

22 (2) the compliance of a data broker with such 

23 program; 

24 (3) the extent to which the databases and systems 

25 containing personally identifiable information of a 
133 

•S 1789 RS

1 data broker have been compromised by security 

2 breaches; and 

3 (4) the response by a data broker to such 

4 breaches, including the efforts by such data broker to 

5 mitigate the impact of such security breaches. 

6 (b) COMPLIANCE SAFE HARBOR.—The data privacy 

7 and security program of a data broker shall be deemed suffi8 cient for the purposes of subsection (a), if the data broker 

9 complies with or provides protection equal to industry 

10 standards, as identified by the Federal Trade Commission, 

11 that are applicable to the type of personally identifiable in12 formation involved in the ordinary course of business of 

13 such data broker. 

14 (c) PENALTIES.—In awarding contracts with data 

15 brokers for products or services related to access, use, com16 pilation, distribution, processing, analyzing, or evaluating 

17 personally identifiable information, the Administrator of 

18 the General Services Administration shall— 

19 (1) include monetary or other penalties— 

20 (A) for failure to comply with subtitles A 

21 and B of title IV of this Act; or 

22 (B) if a contractor knows or has reason to 

23 know that the personally identifiable informa24 tion being provided is inaccurate, and provides 

25 such inaccurate information; and 
134 

•S 1789 RS

1 (2) require a data broker that engages service 

2 providers not subject to subtitle A of title IV for re3 sponsibilities related to sensitive personally identifi4 able information to— 

5 (A) exercise appropriate due diligence in se6 lecting those service providers for responsibilities 

7 related to personally identifiable information; 

8 (B) take reasonable steps to select and re9 tain service providers that are capable of main10 taining appropriate safeguards for the security, 

11 privacy, and integrity of the personally identifi12 able information at issue; and 

13 (C) require such service providers, by con14 tract, to implement and maintain appropriate 

15 measures designed to meet the objectives and re16 quirements in title IV. 

17 (d) LIMITATION.—The penalties under subsection (c) 

18 shall not apply to a data broker providing information that 

19 is accurately and completely recorded from a public record 

20 source or licensor. 

21 SEC. 402. REQUIREMENT TO AUDIT INFORMATION SECU22 RITY PRACTICES OF CONTRACTORS AND 

23 THIRD PARTY BUSINESS ENTITIES. 

24 Section 3544(b) of title 44, United States Code, is 

25 amended— 
135 

•S 1789 RS

1 (1) in paragraph (7)(C)(iii), by striking ‘‘and’’ 

2 after the semicolon; 

3 (2) in paragraph (8), by striking the period and 

4 inserting ‘‘; and’’; and 

5 (3) by adding at the end the following: 

6 ‘‘(9) procedures for evaluating and auditing the 

7 information security practices of contractors or third 

8 party business entities supporting the information 

9 systems or operations of the agency involving person10 ally identifiable information (as that term is defined 

11 in section 3 of the Personal Data Privacy and Secu12 rity Act of 2005) and ensuring remedial action to ad13 dress any significant deficiencies.’’. 

14 SEC. 403. PRIVACY IMPACT ASSESSMENT OF GOVERNMENT 

15 USE OF COMMERCIAL INFORMATION SERV16 ICES CONTAINING PERSONALLY IDENTIFI17 ABLE INFORMATION. 

18 (a) IN GENERAL.—Section 208(b)(1) of the E-Govern19 ment Act of 2002 (44 U.S.C. 3501 note) is amended— 

20 (1) in subparagraph (A)(i), by striking ‘‘or’’; 

21 and 

22 (2) in subparagraph (A)(ii), by striking the pe23 riod and inserting ‘‘; or’’; and 

24 (3) by inserting after clause (ii) the following: 
136 

•S 1789 RS

1 ‘‘(iii) purchasing or subscribing for a 

2 fee to personally identifiable information 

3 from a data broker (as such terms are de4 fined in section 3 of the Personal Data Pri5 vacy and Security Act of 2005).’’. 

6 (b) LIMITATION.—Notwithstanding any other provi7 sion of law, commencing 1 year after the date of enactment 

8 of this Act, no Federal agency may enter into a contract 

9 with a data broker to access for a fee any database con10 sisting primarily of personally identifiable information 

11 concerning United States persons (other than news report12 ing or telephone directories) unless the head of such depart13 ment or agency— 

14 (1) completes a privacy impact assessment under 

15 section 208 of the E–Government Act of 2002 (44 

16 U.S.C. 3501 note), which shall subject to the provision 

17 in that Act pertaining to sensitive information, in18 clude a description of— 

19 (A) such database; 

20 (B) the name of the data broker from whom 

21 it is obtained; and 

22 (C) the amount of the contract for use; 

23 (2) adopts regulations that specify— 

24 (A) the personnel permitted to access, ana25 lyze, or otherwise use such databases; 
137 

•S 1789 RS

1 (B) standards governing the access, anal2 ysis, or use of such databases; 

3 (C) any standards used to ensure that the 

4 personally identifiable information accessed, 

5 analyzed, or used is the minimum necessary to 

6 accomplish the intended legitimate purpose of the 

7 Federal agency; 

8 (D) standards limiting the retention and re9 disclosure of personally identifiable information 

10 obtained from such databases; 

11 (E) procedures ensuring that such data 

12 meet standards of accuracy, relevance, complete13 ness, and timeliness; 

14 (F) the auditing and security measures to 

15 protect against unauthorized access, analysis, 

16 use, or modification of data in such databases; 

17 (G) applicable mechanisms by which indi18 viduals may secure timely redress for any ad19 verse consequences wrongly incurred due to the 

20 access, analysis, or use of such databases; 

21 (H) mechanisms, if any, for the enforcement 

22 and independent oversight of existing or planned 

23 procedures, policies, or guidelines; and 

24 (I) an outline of enforcement mechanisms 

25 for accountability to protect individuals and the 
138 

•S 1789 RS

1 public against unlawful or illegitimate access or 

2 use of databases; and 

3 (3) incorporates into the contract or other agree4 ment totaling more than $500,000, provisions— 

5 (A) providing for penalties— 

6 (i) for failure to comply with title IV 

7 of this Act; or 

8 (ii) if the entity knows or has reason 

9 to know that the personally identifiable in10 formation being provided to the Federal de11 partment or agency is inaccurate, and pro12 vides such inaccurate information; and 

13 (B) requiring a data broker that engages 

14 service providers not subject to subtitle A of title 

15 IV for responsibilities related to sensitive person16 ally identifiable information to— 

17 (i) exercise appropriate due diligence 

18 in selecting those service providers for re19 sponsibilities related to personally identifi20 able information; 

21 (ii) take reasonable steps to select and 

22 retain service providers that are capable of 

23 maintaining appropriate safeguards for the 

24 security, privacy, and integrity of the per-
139 

•S 1789 RS

1 sonally identifiable information at issue; 

2 and 

3 (iii) require such service providers, by 

4 contract, to implement ad maintain appro5 priate measures designed to meet the objec6 tives and requirements in title IV. 

7 (c) LIMITATION ON PENALTIES.—The penalties under 

8 subsection (b)(3)(A) shall not apply to a data broker pro9 viding information that is accurately and completely re10 corded from a public record source. 

11 (d) STUDY OF GOVERNMENT USE.— 

12 (1) SCOPE OF STUDY.—Not later than 180 days 

13 after the date of enactment of this Act, the Comp14 troller General of the United States shall conduct a 

15 study and audit and prepare a report on Federal 

16 agency use of data brokers or commercial databases 

17 containing personally identifiable information, in18 cluding the impact on privacy and security, and the 

19 extent to which Federal contracts include sufficient 

20 provisions to ensure privacy and security protections, 

21 and penalties for failures in privacy and security 

22 practices. 

23 (2) REPORT.—A copy of the report required 

24 under paragraph (1) shall be submitted to Congress. 
140 

•S 1789 RS

1 SEC. 404. IMPLEMENTATION OF CHIEF PRIVACY OFFICER 

2 REQUIREMENTS. 

3 (a) DESIGNATION OF THE CHIEF PRIVACY OFFICER.— 

4 Pursuant to the requirements under section 522 of the 

5 Transportation, Treasury, Independent Agencies, and Gen6 eral Government Appropriations Act, 2005 (division H of 

7 Public Law 108–447; 118 Stat. 3199) that each agency des8 ignate a Chief Privacy Officer, the Department of Justice 

9 shall implement such requirements by designating a depart10 ment-wide Chief Privacy Officer, whose primary role shall 

11 be to fulfill the duties and responsibilities of Chief Privacy 

12 Officer and who shall report directly to the Deputy Attorney 

13 General. 

14 (b) DUTIES AND RESPONSIBILITIES OF CHIEF PRI15 VACY OFFICER.—In addition to the duties and responsibil16 ities outlined under section 522 of the Transportation, 

17 Treasury, Independent Agencies, and General Government 

18 Appropriations Act, 2005 (division H of Public Law 108– 

19 447; 118 Stat. 3199), the Department of Justice Chief Pri20 vacy Officer shall— 

21 (1) oversee the Department of Justice’s imple22 mentation of the requirements under section 603 to 

23 conduct privacy impact assessments of the use of com24 mercial data containing personally identifiable infor25 mation by the Department; and 
141 

•S 1789 RS

1 (2) coordinate with the Privacy and Civil Lib2 erties Oversight Board, established in the Intelligence 

3 Reform and Terrorism Prevention Act of 2004 (Public 

4 Law 108–458), in implementing this section. 
Calendar No. 297 

109TH CONGRESS 

1ST SESSION S. 1789 

A BILL 

To prevent and mitigate identity theft, to ensure 

of personally identifiable information. security breaches, fraudulent access, and misuse ment assistance, and other protections against and to enhance criminal penalties, law enforceprivacy, to provide notice of security breaches, 

NOVEMBER 17, 2005 

Reported with an amendment