II 

Calendar No. 563 

111TH CONGRESS 

2D SESSION S. 139 

[Report No. 111–290] 

To require Federal agencies, and persons engaged in interstate commerce, 

in possession of data containing sensitive personally identifiable information, to disclose any breach of such information. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 6, 2009 

Mrs. FEINSTEIN introduced the following bill; which was read twice and 

referred to the Committee on the Judiciary 

SEPTEMBER 15, 2010 

Reported by Mr. LEAHY without amendment 

A BILL 

To require Federal agencies, and persons engaged in interstate commerce, in possession of data containing sensitive personally identifiable information, to disclose any 

breach of such information. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

mstockstill on DSKH9S0YB1PROD with BILLS

2 

S 139 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Data Breach Notifica3 tion Act’’. 

4 SEC. 2. NOTICE TO INDIVIDUALS. 

5 (a) IN GENERAL.—Any agency, or business entity en6 gaged in interstate commerce, that uses, accesses, trans7 mits, stores, disposes of or collects sensitive personally 

8 identifiable information shall, following the discovery of a 

9 security breach of such information notify any resident of 

10 the United States whose sensitive personally identifiable 

11 information has been, or is reasonably believed to have 

12 been, accessed, or acquired. 

13 (b) OBLIGATION OF OWNER OR LICENSEE.— 

14 (1) NOTICE TO OWNER OR LICENSEE.—Any 

15 agency, or business entity engaged in interstate com16 merce, that uses, accesses, transmits, stores, dis17 poses of, or collects sensitive personally identifiable 

18 information that the agency or business entity does 

19 not own or license shall notify the owner or licensee 

20 of the information following the discovery of a secu21 rity breach involving such information. 

22 (2) NOTICE BY OWNER, LICENSEE OR OTHER

23 DESIGNATED THIRD PARTY.—Nothing in this Act 

24 shall prevent or abrogate an agreement between an 

25 agency or business entity required to give notice 

26 under this section and a designated third party, inmstockstill on DSKH9S0YB1PROD with BILLS

3 

S 139 RS

1 cluding an owner or licensee of the sensitive person2 ally identifiable information subject to the security 

3 breach, to provide the notifications required under 

4 subsection (a). 

5 (3) BUSINESS ENTITY RELIEVED FROM GIVING

6 NOTICE.—A business entity obligated to give notice 

7 under subsection (a) shall be relieved of such obliga8 tion if an owner or licensee of the sensitive person9 ally identifiable information subject to the security 

10 breach, or other designated third party, provides 

11 such notification. 

12 (c) TIMELINESS OF NOTIFICATION.— 

13 (1) IN GENERAL.—All notifications required 

14 under this section shall be made without unreason15 able delay following the discovery by the agency or 

16 business entity of a security breach. 

17 (2) REASONABLE DELAY.—Reasonable delay 

18 under this subsection may include any time nec19 essary to determine the scope of the security breach, 

20 prevent further disclosures, and restore the reason21 able integrity of the data system and provide notice 

22 to law enforcement when required. 

23 (3) BURDEN OF PROOF.—The agency, business 

24 entity, owner, or licensee required to provide notifi25 cation under this section shall have the burden of 

mstockstill on DSKH9S0YB1PROD with BILLS

4 

S 139 RS

1 demonstrating that all notifications were made as re2 quired under this Act, including evidence dem3 onstrating the reasons for any delay. 

4 (d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW

5 ENFORCEMENT PURPOSES.— 

6 (1) IN GENERAL.—If a Federal law enforce7 ment agency determines that the notification re8 quired under this section would impede a criminal 

9 investigation, such notification shall be delayed upon 

10 written notice from such Federal law enforcement 

11 agency to the agency or business entity that experi12 enced the breach. 

13 (2) EXTENDED DELAY OF NOTIFICATION.—If 

14 the notification required under subsection (a) is de15 layed pursuant to paragraph (1), an agency or busi16 ness entity shall give notice 30 days after the day 

17 such law enforcement delay was invoked unless a 

18 Federal law enforcement agency provides written no19 tification that further delay is necessary. 

20 (3) LAW ENFORCEMENT IMMUNITY.—No cause 

21 of action shall lie in any court against any law en22 forcement agency for acts relating to the delay of 

23 notification for law enforcement purposes under this 

24 Act. 

mstockstill on DSKH9S0YB1PROD with BILLS

5 

S 139 RS

1 SEC. 3. EXEMPTIONS. 

2 (a) EXEMPTION FOR NATIONAL SECURITY AND LAW

3 ENFORCEMENT.— 

4 (1) IN GENERAL.—Section 2 shall not apply to 

5 an agency or business entity if the agency or busi6 ness entity certifies, in writing, that notification of 

7 the security breach as required by section 2 reason8 ably could be expected to— 

9 (A) cause damage to the national security; 

10 or 

11 (B) hinder a law enforcement investigation 

12 or the ability of the agency to conduct law en13 forcement investigations. 

14 (2) LIMITS ON CERTIFICATIONS.—An agency or 

15 business entity may not execute a certification under 

16 paragraph (1) to— 

17 (A) conceal violations of law, inefficiency, 

18 or administrative error; 

19 (B) prevent embarrassment to a business 

20 entity, organization, or agency; or 

21 (C) restrain competition. 

22 (3) NOTICE.—In every case in which an agency 

23 or business entity issues a certification under para24 graph (1), the certification, accompanied by a de25 scription of the factual basis for the certification, 

mstockstill on DSKH9S0YB1PROD with BILLS

6 

S 139 RS

1 shall be immediately provided to the United States 

2 Secret Service. 

3 (4) SECRET SERVICE REVIEW OF CERTIFI4 CATIONS.— 

5 (A) IN GENERAL.—The United States Se6 cret Service may review a certification provided 

7 by an agency under paragraph (3), and shall re8 view a certification provided by a business enti9 ty under paragraph (3), to determine whether 

10 an exemption under paragraph (1) is merited. 

11 Such review shall be completed not later than 

12 10 business days after the date of receipt of the 

13 certification, except as provided in paragraph 

14 (5)(C). 

15 (B) NOTICE.—Upon completing a review 

16 under subparagraph (A) the United States Se17 cret Service shall immediately notify the agency 

18 or business entity, in writing, of its determina19 tion of whether an exemption under paragraph 

20 (1) is merited. 

21 (C) EXEMPTION.—The exemption under 

22 paragraph (1) shall not apply if the United 

23 States Secret Service determines under this 

24 paragraph that the exemption is not merited. 

mstockstill on DSKH9S0YB1PROD with BILLS

7 

S 139 RS

1 (5) ADDITIONAL AUTHORITY OF THE SECRET

2 SERVICE.— 

3 (A) IN GENERAL.—In determining under 

4 paragraph (4) whether an exemption under 

5 paragraph (1) is merited, the United States Se6 cret Service may request additional information 

7 from the agency or business entity regarding 

8 the basis for the claimed exemption, if such ad9 ditional information is necessary to determine 

10 whether the exemption is merited. 

11 (B) REQUIRED COMPLIANCE.—Any agency 

12 or business entity that receives a request for 

13 additional information under subparagraph (A) 

14 shall cooperate with any such request. 

15 (C) TIMING.—If the United States Secret 

16 Service requests additional information under 

17 subparagraph (A), the United States Secret 

18 Service shall notify the agency or business enti19 ty not later than 10 business days after the 

20 date of receipt of the additional information 

21 whether an exemption under paragraph (1) is 

22 merited. 

23 (b) SAFE HARBOR.— 

mstockstill on DSKH9S0YB1PROD with BILLS

8 

S 139 RS

1 (1) IN GENERAL.—An agency or business entity 

2 shall be exempt from the notice requirements under 

3 section 2, if— 

4 (A) a risk assessment concludes that there 

5 is no significant risk that a security breach has 

6 resulted in, or will result in, harm to the indi7 vidual whose sensitive personally identifiable in8 formation was subject to the security breach; 

9 (B) without unreasonable delay, but not 

10 later than 45 days after the discovery of a secu11 rity breach (unless extended by the United 

12 States Secret Service), the agency or business 

13 entity notifies the United States Secret Service, 

14 in writing, of— 

15 (i) the results of the risk assessment; 

16 and 

17 (ii) its decision to invoke the risk as18 sessment exemption; and 

19 (C) the United States Secret Service does 

20 not indicate, in writing, and not later than 10 

21 business days after the date of receipt of the 

22 decision described in subparagraph (B)(ii), that 

23 notice should be given. 

24 (2) PRESUMPTIONS.—There shall be a pre25 sumption that no significant risk of harm to the inmstockstill on DSKH9S0YB1PROD with BILLS

9 

S 139 RS

1 dividual whose sensitive personally identifiable infor2 mation was subject to a security breach if such in3 formation— 

4 (A) was encrypted; or 

5 (B) was rendered indecipherable through 

6 the use of best practices or methods, such as 

7 redaction, access controls, or other such mecha8 nisms, that are widely accepted as an effective 

9 industry practice, or an effective industry 

10 standard. 

11 (c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 

12 (1) IN GENERAL.—A business entity will be ex13 empt from the notice requirement under section 2 if 

14 the business entity utilizes or participates in a secu15 rity program that— 

16 (A) is designed to block the use of the sen17 sitive personally identifiable information to ini18 tiate unauthorized financial transactions before 

19 they are charged to the account of the indi20 vidual; and 

21 (B) provides for notice to affected individ22 uals after a security breach that has resulted in 

23 fraud or unauthorized transactions. 

24 (2) LIMITATION.—The exemption by this sub25 section does not apply if— 

mstockstill on DSKH9S0YB1PROD with BILLS

10 

S 139 RS

1 (A) the information subject to the security 

2 breach includes sensitive personally identifiable 

3 information, other than a credit card number or 

4 credit card security code, of any type; or 

5 (B) the information subject to the security 

6 breach includes both the individual’s credit card 

7 number and the individual’s first and last 

8 name. 

9 SEC. 4. METHODS OF NOTICE. 

10 An agency, or business entity shall be in compliance 

11 with section 2 if it provides both: 

12 (1) INDIVIDUAL NOTICE.— 

13 (A) Written notification to the last known 

14 home mailing address of the individual in the 

15 records of the agency or business entity; 

16 (B) telephone notice to the individual per17 sonally; or 

18 (C) e-mail notice, if the individual has con19 sented to receive such notice and the notice is 

20 consistent with the provisions permitting elec21 tronic transmission of notices under section 101 

22 of the Electronic Signatures in Global and Na23 tional Commerce Act (15 U.S.C. 7001). 

24 (2) MEDIA NOTICE.—Notice to major media 

25 outlets serving a State or jurisdiction, if the number 

mstockstill on DSKH9S0YB1PROD with BILLS

11 

S 139 RS

1 of residents of such State whose sensitive personally 

2 identifiable information was, or is reasonably be3 lieved to have been, acquired by an unauthorized 

4 person exceeds 5,000. 

5 SEC. 5. CONTENT OF NOTIFICATION. 

6 (a) IN GENERAL.—Regardless of the method by 

7 which notice is provided to individuals under section 4, 

8 such notice shall include, to the extent possible— 

9 (1) a description of the categories of sensitive 

10 personally identifiable information that was, or is 

11 reasonably believed to have been, acquired by an un12 authorized person; 

13 (2) a toll-free number— 

14 (A) that the individual may use to contact 

15 the agency or business entity, or the agent of 

16 the agency or business entity; and 

17 (B) from which the individual may learn 

18 what types of sensitive personally identifiable 

19 information the agency or business entity main20 tained about that individual; and 

21 (3) the toll-free contact telephone numbers and 

22 addresses for the major credit reporting agencies. 

23 (b) ADDITIONAL CONTENT.—Notwithstanding sec24 tion 10, a State may require that a notice under submstockstill on DSKH9S0YB1PROD with BILLS

12 

S 139 RS

1 section (a) shall also include information regarding victim 

2 protection assistance provided for by that State. 

3 SEC. 6. COORDINATION OF NOTIFICATION WITH CREDIT 

4 REPORTING AGENCIES. 

5 If an agency or business entity is required to provide 

6 notification to more than 5,000 individuals under section 

7 2(a), the agency or business entity shall also notify all con8 sumer reporting agencies that compile and maintain files 

9 on consumers on a nationwide basis (as defined in section 

10 603(p) of the Fair Credit Reporting Act (15 U.S.C. 

11 1681a(p)) of the timing and distribution of the notices. 

12 Such notice shall be given to the consumer credit reporting 

13 agencies without unreasonable delay and, if it will not 

14 delay notice to the affected individuals, prior to the dis15 tribution of notices to the affected individuals. 

16 SEC. 7. NOTICE TO LAW ENFORCEMENT. 

17 (a) SECRET SERVICE.—Any business entity or agen18 cy shall notify the United States Secret Service of the fact 

19 that a security breach has occurred if— 

20 (1) the number of individuals whose sensitive 

21 personally identifying information was, or is reason22 ably believed to have been acquired by an unauthor23 ized person exceeds 10,000; 

24 (2) the security breach involves a database, 

25 networked or integrated databases, or other data 

mstockstill on DSKH9S0YB1PROD with BILLS

13 

S 139 RS

1 system containing the sensitive personally identifi2 able information of more than 1,000,000 individuals 

3 nationwide; 

4 (3) the security breach involves databases 

5 owned by the Federal Government; or 

6 (4) the security breach involves primarily sen7 sitive personally identifiable information of individ8 uals known to the agency or business entity to be 

9 employees and contractors of the Federal Govern10 ment involved in national security or law enforce11 ment. 

12 (b) NOTICE TO OTHER LAW ENFORCEMENT AGEN13 CIES.—The United States Secret Service shall be respon14 sible for notifying— 

15 (1) the Federal Bureau of Investigation, if the 

16 security breach involves espionage, foreign counter17 intelligence, information protected against unauthor18 ized disclosure for reasons of national defense or for19 eign relations, or Restricted Data (as that term is 

20 defined in section 11y of the Atomic Energy Act of 

21 1954 (42 U.S.C. 2014(y)), except for offenses af22 fecting the duties of the United States Secret Serv23 ice under section 3056(a) of title 18, United States 

24 Code; 

mstockstill on DSKH9S0YB1PROD with BILLS

14 

S 139 RS

1 (2) the United States Postal Inspection Service, 

2 if the security breach involves mail fraud; and 

3 (3) the attorney general of each State affected 

4 by the security breach. 

5 (c) TIMING OF NOTICES.—The notices required 

6 under this section shall be delivered as follows: 

7 (1) Notice under subsection (a) shall be deliv8 ered as promptly as possible, but not later than 14 

9 days after discovery of the events requiring notice. 

10 (2) Notice under subsection (b) shall be deliv11 ered not later than 14 days after the United States 

12 Secret Service receives notice of a security breach 

13 from an agency or business entity. 

14 SEC. 8. ENFORCEMENT. 

15 (a) CIVIL ACTIONS BY THE ATTORNEY GENERAL.— 

16 The Attorney General may bring a civil action in the ap17 propriate United States district court against any business 

18 entity that engages in conduct constituting a violation of 

19 this Act and, upon proof of such conduct by a preponder20 ance of the evidence, such business entity shall be subject 

21 to a civil penalty of not more than $1,000 per day per 

22 individual whose sensitive personally identifiable informa23 tion was, or is reasonably believed to have been, accessed 

24 or acquired by an unauthorized person, up to a maximum 

mstockstill on DSKH9S0YB1PROD with BILLS

15 

S 139 RS

1 of $1,000,000 per violation, unless such conduct is found 

2 to be willful or intentional. 

3 (b) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN4 ERAL.— 

5 (1) IN GENERAL.—If it appears that a business 

6 entity has engaged, or is engaged, in any act or 

7 practice constituting a violation of this Act, the At8 torney General may petition an appropriate district 

9 court of the United States for an order— 

10 (A) enjoining such act or practice; or 

11 (B) enforcing compliance with this Act. 

12 (2) ISSUANCE OF ORDER.—A court may issue 

13 an order under paragraph (1), if the court finds that 

14 the conduct in question constitutes a violation of this 

15 Act. 

16 (c) OTHER RIGHTS AND REMEDIES.—The rights and 

17 remedies available under this Act are cumulative and shall 

18 not affect any other rights and remedies available under 

19 law. 

20 (d) FRAUD ALERT.—Section 605A(b)(1) of the Fair 

21 Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 

22 amended by inserting ‘‘, or evidence that the consumer 

23 has received notice that the consumer’s financial informa24 tion has or may have been compromised,’’ after ‘‘identity 

25 theft report’’. 

mstockstill on DSKH9S0YB1PROD with BILLS

16 

S 139 RS

1 SEC. 9. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

2 (a) IN GENERAL.— 

3 (1) CIVIL ACTIONS.—In any case in which the 

4 attorney general of a State or any State or local law 

5 enforcement agency authorized by the State attorney 

6 general or by State statute to prosecute violations of 

7 consumer protection law, has reason to believe that 

8 an interest of the residents of that State has been 

9 or is threatened or adversely affected by the engage10 ment of a business entity in a practice that is pro11 hibited under this Act, the State or the State or 

12 local law enforcement agency on behalf of the resi13 dents of the agency’s jurisdiction, may bring a civil 

14 action on behalf of the residents of the State or ju15 risdiction in a district court of the United States of 

16 appropriate jurisdiction or any other court of com17 petent jurisdiction, including a State court, to— 

18 (A) enjoin that practice; 

19 (B) enforce compliance with this Act; or 

20 (C) obtain civil penalties of not more than 

21 $1,000 per day per individual whose sensitive 

22 personally identifiable information was, or is 

23 reasonably believed to have been, accessed or 

24 acquired by an unauthorized person, up to a 

25 maximum of $1,000,000 per violation, unless 

mstockstill on DSKH9S0YB1PROD with BILLS

17 

S 139 RS

1 such conduct is found to be willful or inten2 tional. 

3 (2) NOTICE.— 

4 (A) IN GENERAL.—Before filing an action 

5 under paragraph (1), the attorney general of 

6 the State involved shall provide to the Attorney 

7 General of the United States— 

8 (i) written notice of the action; and 

9 (ii) a copy of the complaint for the ac10 tion. 

11 (B) EXEMPTION.— 

12 (i) IN GENERAL.—Subparagraph (A) 

13 shall not apply with respect to the filing of 

14 an action by an attorney general of a State 

15 under this Act, if the State attorney gen16 eral determines that it is not feasible to 

17 provide the notice described in such sub18 paragraph before the filing of the action. 

19 (ii) NOTIFICATION.—In an action de20 scribed in clause (i), the attorney general 

21 of a State shall provide notice and a copy 

22 of the complaint to the Attorney General 

23 at the time the State attorney general files 

24 the action. 

mstockstill on DSKH9S0YB1PROD with BILLS

18 

S 139 RS

1 (b) FEDERAL PROCEEDINGS.—Upon receiving notice 

2 under subsection (a)(2), the Attorney General shall have 

3 the right to— 

4 (1) move to stay the action, pending the final 

5 disposition of a pending Federal proceeding or ac6 tion; 

7 (2) initiate an action in the appropriate United 

8 States district court under section 8 and move to 

9 consolidate all pending actions, including State ac10 tions, in such court; 

11 (3) intervene in an action brought under sub12 section (a)(2); and 

13 (4) file petitions for appeal. 

14 (c) PENDING PROCEEDINGS.—If the Attorney Gen15 eral has instituted a proceeding or action for a violation 

16 of this Act or any regulations thereunder, no attorney gen17 eral of a State may, during the pendency of such pro18 ceeding or action, bring an action under this Act against 

19 any defendant named in such criminal proceeding or civil 

20 action for any violation that is alleged in that proceeding 

21 or action. 

22 (d) RULE OF CONSTRUCTION.—For purposes of 

23 bringing any civil action under subsection (a), nothing in 

24 this Act regarding notification shall be construed to pre25 vent an attorney general of a State from exercising the 

mstockstill on DSKH9S0YB1PROD with BILLS

19 

S 139 RS

1 powers conferred on such attorney general by the laws of 

2 that State to— 

3 (1) conduct investigations; 

4 (2) administer oaths or affirmations; or 

5 (3) compel the attendance of witnesses or the 

6 production of documentary and other evidence. 

7 (e) VENUE; SERVICE OF PROCESS.— 

8 (1) VENUE.—Any action brought under sub9 section (a) may be brought in— 

10 (A) the district court of the United States 

11 that meets applicable requirements relating to 

12 venue under section 1391 of title 28, United 

13 States Code; or 

14 (B) another court of competent jurisdic15 tion. 

16 (2) SERVICE OF PROCESS.—In an action 

17 brought under subsection (a), process may be served 

18 in any district in which the defendant— 

19 (A) is an inhabitant; or 

20 (B) may be found. 

21 (f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

22 Act establishes a private cause of action against a business 

23 entity for violation of any provision of this Act. 

mstockstill on DSKH9S0YB1PROD with BILLS

20 

S 139 RS

1 SEC. 10. EFFECT ON FEDERAL AND STATE LAW. 

2 The provisions of this Act shall supersede any other 

3 provision of Federal law or any provision of law of any 

4 State relating to notification by a business entity engaged 

5 in interstate commerce or an agency of a security breach, 

6 except as provided in section 5(b). 

7 SEC. 11. AUTHORIZATION OF APPROPRIATIONS. 

8 There are authorized to be appropriated such sums 

9 as may be necessary to cover the costs incurred by the 

10 United States Secret Service to carry out investigations 

11 and risk assessments of security breaches as required 

12 under this Act. 

13 SEC. 12. REPORTING ON RISK ASSESSMENT EXEMPTIONS. 

14 (a) IN GENERAL.—The United States Secret Service 

15 shall report to Congress not later than 18 months after 

16 the date of enactment of this Act, and upon the request 

17 by Congress thereafter, on— 

18 (1) the number and nature of the security 

19 breaches described in the notices filed by those busi20 ness entities invoking the risk assessment exemption 

21 under section 3(b) of this Act and the response of 

22 the United States Secret Service to such notices; 

23 and 

24 (2) the number and nature of security breaches 

25 subject to the national security and law enforcement 

26 exemptions under section 3(a) of this Act. 

mstockstill on DSKH9S0YB1PROD with BILLS

21 

S 139 RS

1 (b) REPORT.—Any report submitted under sub2 section (a) shall not disclose the contents of any risk as3 sessment provided to the United States Secret Service 

4 under this Act. 

5 SEC. 13. DEFINITIONS. 

6 In this Act, the following definitions shall apply: 

7 (1) AGENCY.—The term ‘‘agency’’ has the same 

8 meaning given such term in section 551 of title 5, 

9 United States Code. 

10 (2) AFFILIATE.—The term ‘‘affiliate’’ means 

11 persons related by common ownership or by cor12 porate control. 

13 (3) BUSINESS ENTITY.—The term ‘‘business 

14 entity’’ means any organization, corporation, trust, 

15 partnership, sole proprietorship, unincorporated as16 sociation, venture established to make a profit, or 

17 nonprofit, and any contractor, subcontractor, affil18 iate, or licensee thereof engaged in interstate com19 merce. 

20 (4) ENCRYPTED.—The term ‘‘encrypted’’— 

21 (A) means the protection of data in elec22 tronic form, in storage or in transit, using an 

23 encryption technology that has been adopted by 

24 an established standards setting body which 

25 renders such data indecipherable in the absence 

mstockstill on DSKH9S0YB1PROD with BILLS

22 

S 139 RS

1 of associated cryptographic keys necessary to 

2 enable decryption of such data; and 

3 (B) includes appropriate management and 

4 safeguards of such cryptographic keys so as to 

5 protect the integrity of the encryption. 

6 (5) PERSONALLY IDENTIFIABLE INFORMA7 TION.—The term ‘‘personally identifiable informa8 tion’’ means any information, or compilation of in9 formation, in electronic or digital form serving as a 

10 means of identification, as defined by section 

11 1028(d)(7) of title 18, United State Code. 

12 (6) SECURITY BREACH.— 

13 (A) IN GENERAL.—The term ‘‘security 

14 breach’’ means compromise of the security, con15 fidentiality, or integrity of computerized data 

16 through misrepresentation or actions that result 

17 in, or there is a reasonable basis to conclude 

18 has resulted in, acquisition of or access to sen19 sitive personally identifiable information that is 

20 unauthorized or in excess of authorization. 

21 (B) EXCLUSION.—The term ‘‘security 

22 breach’’ does not include— 

23 (i) a good faith acquisition of sensitive 

24 personally identifiable information by a 

25 business entity or agency, or an employee 

mstockstill on DSKH9S0YB1PROD with BILLS

23 

S 139 RS

1 or agent of a business entity or agency, if 

2 the sensitive personally identifiable infor3 mation is not subject to further unauthor4 ized disclosure; or 

5 (ii) the release of a public record not 

6 otherwise subject to confidentiality or non7 disclosure requirements. 

8 (7) SENSITIVE PERSONALLY IDENTIFIABLE IN9 FORMATION.—The term ‘‘sensitive personally identi10 fiable information’’ means any information or com11 pilation of information, in electronic or digital form 

12 that includes— 

13 (A) an individual’s first and last name or 

14 first initial and last name in combination with 

15 any 1 of the following data elements: 

16 (i) A non-truncated social security 

17 number, driver’s license number, passport 

18 number, or alien registration number. 

19 (ii) Any 2 of the following: 

20 (I) Home address or telephone 

21 number. 

22 (II) Mother’s maiden name, if 

23 identified as such. 

24 (III) Month, day, and year of 

25 birth. 

mstockstill on DSKH9S0YB1PROD with BILLS

24 

S 139 RS

1 (iii) Unique biometric data such as a 

2 finger print, voice print, a retina or iris 

3 image, or any other unique physical rep4 resentation. 

5 (iv) A unique account identifier, elec6 tronic identification number, user name, or 

7 routing code in combination with any asso8 ciated security code, access code, or pass9 word that is required for an individual to 

10 obtain money, goods, services or any other 

11 thing of value; or 

12 (B) a financial account number or credit 

13 or debit card number in combination with any 

14 security code, access code or password that is 

15 required for an individual to obtain credit, with16 draw funds, or engage in a financial trans17 action. 

18 SEC. 14. EFFECTIVE DATE. 

19 This Act shall take effect on the expiration of the 

20 date which is 90 days after the date of enactment of this 

21 Act. 

mstockstill on DSKH9S0YB1PROD with BILLS

mstockstill on DSKH9S0YB1PROD with BILLS

Calendar No. 563 

111TH CONGRESS 

2D SESSION S. 139 

[Report No. 111–290] 

A BILL 

To require Federal agencies, and persons engaged 

tion. mation, to disclose any breach of such informacontaining sensitive personally identifiable inforin interstate commerce, in possession of data 

SEPTEMBER 15, 2010 

Reported without amendment 

mstockstill on DSKH9S0YB1PROD with BILLS