II 

114TH CONGRESS 

1ST SESSION S. 1027 

To require notification of information security breaches and to enhance 

penalties for cyber criminals, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

APRIL 21, 2015 

Mr. KIRK (for himself and Mrs. GILLIBRAND) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require notification of information security breaches and 

to enhance penalties for cyber criminals, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Breach Notifica5 tion and Punishing Cyber Criminals Act of 2015’’. 

6 SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 

7 Each covered entity shall take reasonable measures 

8 to protect and secure data in electronic form containing 

9 personal information. 


smartinez on DSK4TPTVN1PROD with BILLS
2 

•S 1027 IS

1 SEC. 3. NOTIFICATION OF INFORMATION SECURITY 

2 BREACH. 

3 (a) NOTIFICATION.— 

4 (1) IN GENERAL.—A covered entity that owns 

5 or licenses data in electronic form containing per6 sonal information shall give notice of any breach of 

7 the security of the system following discovery by the 

8 covered entity of the breach of the security of the 

9 system to each individual who is a citizen or resident 

10 of the United States— 

11 (A) whose personal information was, or 

12 that the covered entity reasonably believes to 

13 have been, accessed and acquired by an unau14 thorized person; or 

15 (B) who the covered entity reasonably be16 lieves may be at risk of identity theft, fraud, ac17 tual financial harm, or other unlawful conduct. 

18 (2) LAW ENFORCEMENT.— 

19 (A) DESIGNATION OF A GOVERNMENT EN20 TITY TO RECEIVE NOTICE.— 

21 (i) IN GENERAL.—Not later than 60 

22 days after the date of enactment of this 

23 Act, the Secretary of Homeland Security, 

24 in consultation with the Attorney General, 

25 shall designate a Federal Government enti26 ty to receive the information required to be 


smartinez on DSK4TPTVN1PROD with BILLS
3 

•S 1027 IS

1 submitted under this section, and any 

2 other reports and information about infor3 mation security incidents, threats, and 

4 vulnerabilities. 

5 (ii) RESPONSIBILITIES OF THE DES6 IGNATED ENTITY.—The designated entity 

7 shall— 

8 (I) be responsible for promptly 

9 providing the information it receives 

10 to the United States Secret Service 

11 and the Federal Bureau of Investiga12 tion, and to the Federal Trade Com13 mission for civil law enforcement pur14 poses; and 

15 (II) provide the information de16 scribed in subclause (I) as appropriate 

17 to other Federal agencies for law en18 forcement, national security, or data 

19 security purposes. 

20 (B) NOTICE.—Not later than 30 days 

21 after the date on which a security breach is dis22 covered, a covered entity shall notify the des23 ignated entity of the fact that the breach of se24 curity has occurred if— 


smartinez on DSK4TPTVN1PROD with BILLS
4 

•S 1027 IS

1 (i) the number of individuals whose 

2 personal information was, or is reasonably 

3 believed to be to have been accessed and 

4 acquired by an unauthorized person is 

5 more than 1,000; 

6 (ii) the security breach involves a 

7 database, networked or integrated data8 bases, or other data system containing the 

9 personal information of more than 250,000 

10 individuals; 

11 (iii) the security breach involves data12 bases owned by the Federal Government; 

13 or 

14 (iv) the security breach involves per15 sonal information of primarily individuals 

16 known to the covered entity to be employ17 ees and contractors of the Federal Govern18 ment involved in national security or law 

19 enforcement. 

20 (C) FTC REVIEW OF THRESHOLDS.— 

21 (i) REVIEW.—Not later than 1 year 

22 after the date of enactment of this Act, the 

23 Federal Trade Commission, in consultation 

24 with the Attorney General and the Sec25 retary of Homeland Security, shall promulVerDate Sep 11 2014 05:20 Apr 29, 2015 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1027.IS S1027

smartinez on DSK4TPTVN1PROD with BILLS
5 

•S 1027 IS

1 gate regulations regarding the reports re2 quired under subparagraph (A). 

3 (ii) RULEMAKING.—The Federal 

4 Trade Commission, in consultation with 

5 the Attorney General and the Secretary of 

6 Homeland Security, after notice and the 

7 opportunity for public comment, and in a 

8 manner consistent with this section, shall 

9 promulgate regulations, as necessary, 

10 under section 553 of title 5, United States 

11 Code, to adjust the thresholds for notice to 

12 law enforcement and national security au13 thorities under subparagraph (A) and to 

14 facilitate the purposes of this section. 

15 (b) SPECIAL NOTIFICATION REQUIREMENTS.— 

16 (1) THIRD-PARTY AGENTS.— 

17 (A) IN GENERAL.—In the event of a 

18 breach of security of a system maintained by a 

19 third-party entity that has been contracted to 

20 maintain, store, or process data in electronic 

21 form containing personal information on behalf 

22 of a covered entity who owns or possesses such 

23 data, the third-party entity shall notify the cov24 ered entity of the breach of security. 


smartinez on DSK4TPTVN1PROD with BILLS
6 

•S 1027 IS

1 (B) COVERED ENTITIES WHO RECEIVE NO2 TICE FROM THIRD PARTIES.—Upon receiving 

3 notification from a third party under subpara4 graph (A), a covered entity shall provide notifi5 cation as required under subsection (a). 

6 (C) EXCEPTION FOR SERVICE PRO7 VIDERS.—For purposes of this paragraph, a 

8 service provider shall not be considered a third9 party agent. 

10 (2) SERVICE PROVIDERS.— 

11 (A) IN GENERAL.—If a service provider be12 comes aware of a breach of security involving 

13 data in electronic form containing personal in14 formation that is owned or possessed by a cov15 ered entity that connects to or uses a system or 

16 network provided by the service provider for the 

17 purpose of transmitting, routing, or providing 

18 intermediate or transient storage of such data, 

19 the service provider shall notify the covered en20 tity who initiated such connection, transmission, 

21 routing, or storage if the covered entity can be 

22 reasonably identified. 

23 (B) COVERED ENTITIES WHO RECEIVE NO24 TICE FROM SERVICE PROVIDERS.—Upon receiv25 ing notification from a service provider under 


smartinez on DSK4TPTVN1PROD with BILLS
7 

•S 1027 IS

1 subparagraph (A), a covered entity shall provide 

2 notification as required under subsection (a). 

3 (c) TIMELINESS OF NOTIFICATION.— 

4 (1) NOTIFICATION TO AFFECTED INDIVID5 UALS.— 

6 (A) IN GENERAL.—Unless subject to a 

7 delay authorized under subparagraph (B) or 

8 paragraph (2), a notification required under 

9 subsection (a)(1) with respect to a security 

10 breach shall be made not later than 30 days 

11 after the date on which the security breach was 

12 discovered, consistent with any measures nec13 essary to determine the scope of the security 

14 breach and restore the reasonable integrity of 

15 the data system that was breached. 

16 (B) FOLLOW-UP NOTIFICATION.—Not later 

17 than 60 days after the date on which notice is 

18 provided under subsection (a)(1), if a covered 

19 entity has discovered additional information re20 lating to how a breach of security occurred (as 

21 required under subsection (d)(1)(B)(iii) to be 

22 included in a notification) the covered entity 

23 may provide a follow-up notification to affected 

24 individuals that contains the additional infor25 mation. 


smartinez on DSK4TPTVN1PROD with BILLS
8 

•S 1027 IS

1 (2) DELAY OF NOTIFICATION AUTHORIZED FOR

2 LAW ENFORCEMENT OR NATIONAL SECURITY PUR3 POSES.— 

4 (A) LAW ENFORCEMENT.—If a Federal 

5 law enforcement agency determines that the no6 tification required under subsection (a) would 

7 impede a civil or criminal investigation, such 

8 notification shall be delayed upon the written 

9 request of the law enforcement agency for any 

10 period which the law enforcement agency deter11 mines is reasonably necessary. A law enforce12 ment agency may, by a subsequent written re13 quest, revoke such delay or extend the period 

14 set forth in the original request made under 

15 this subparagraph by a subsequent request if 

16 further delay is necessary. 

17 (B) NATIONAL SECURITY.—If a Federal 

18 national security agency or homeland security 

19 agency determines that the notification required 

20 under this section would threaten national or 

21 homeland security, such notification may be de22 layed upon the written request of the national 

23 security agency or homeland security agency for 

24 any period which the national security agency 

25 or homeland security agency determines is reaVerDate Sep 11 2014 05:20 Apr 29, 2015 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1027.IS S1027

smartinez on DSK4TPTVN1PROD with BILLS
9 

•S 1027 IS

1 sonably necessary. A Federal national security 

2 agency or homeland security agency may revoke 

3 such delay or extend the period set forth in the 

4 original request made under this subparagraph 

5 by a subsequent written request if further delay 

6 is necessary. 

7 (d) METHOD AND CONTENT OF NOTIFICATION.— 

8 (1) DIRECT NOTIFICATION.— 

9 (A) METHOD OF NOTIFICATION.—A cov10 ered entity required to provide notification to 

11 an individual under subsection (a) shall be in 

12 compliance with such requirement if the covered 

13 entity provides such notice by any one of the 

14 following methods: 

15 (i) Written notification, sent to the 

16 postal address of the individual in the 

17 records of the covered entity. 

18 (ii) Telephone. 

19 (iii) Email or other electronic means. 

20 (B) CONTENT OF NOTIFICATION.—Regard21 less of the method by which notification is pro22 vided to an individual under subparagraph (A) 

23 with respect to a security breach, such notifica24 tion, to the extent practicable, shall include— 


smartinez on DSK4TPTVN1PROD with BILLS
10 

•S 1027 IS

1 (i) the date, estimated date, or esti2 mated date range of the breach of security; 

3 (ii) a description of the personal infor4 mation that was accessed and acquired, or 

5 reasonably believed to have been accessed 

6 and acquired, by an unauthorized person 

7 as a part of the security breach; 

8 (iii) a general description of how the 

9 breach of security occurred; and 

10 (iv) information that the individual 

11 can use to contact the covered entity to in12 quire about— 

13 (I) the breach of security; or 

14 (II) the information the covered 

15 entity maintained about that indi16 vidual. 

17 (2) SUBSTITUTE NOTIFICATION.— 

18 (A) CIRCUMSTANCES GIVING RISE TO SUB19 STITUTE NOTIFICATION.—A covered entity re20 quired to provide notification to an individual 

21 under subsection (a) may provide substitute no22 tification in lieu of the direct notification re23 quired by paragraph (1) if such direct notifica24 tion is not feasible due to— 


smartinez on DSK4TPTVN1PROD with BILLS
11 

•S 1027 IS

1 (i) excessive cost to the covered entity 

2 required to provide such notification rel3 ative to the resources of such covered enti4 ty; or 

5 (ii) lack of sufficient contact informa6 tion for the individual required to be noti7 fied. 

8 (B) FORM OF SUBSTITUTE NOTIFICA9 TION.—Substitute notification described in sub10 paragraph (A) shall include— 

11 (i) a conspicuous notice on the Inter12 net Web site of the covered entity (if such 

13 covered entity maintains such a Web site); 

14 and 

15 (ii) notification in print and to broad16 cast media, including major media in met17 ropolitan and rural areas where the indi18 viduals whose personal information was ac19 quired reside. 

20 (3) COST OF NOTIFICATION.—A covered entity 

21 required to provide notification to an individual 

22 under subsection (a) shall provide such notification 

23 at no cost to the individual. 

24 (e) TREATMENT OF PERSONS GOVERNED BY OTHER

25 FEDERAL LAW.—Except as provided in section 4(b), a 


smartinez on DSK4TPTVN1PROD with BILLS
12 

•S 1027 IS

1 covered entity who is in compliance with any other Federal 

2 law that requires such covered entity to provide notifica3 tion to individuals following a breach of security shall be 

4 deemed to be in compliance with this section. 

5 SEC. 4. APPLICATION AND ENFORCEMENT. 

6 (a) GENERAL APPLICATION.—The requirements of 

7 sections 2 and 3 apply to— 

8 (1) any covered entity over which the Commis9 sion has authority pursuant to section 5(a)(2) of the 

10 Federal Trade Commission Act (15 U.S.C. 

11 45(a)(2)); and 

12 (2) notwithstanding section 5(a)(2) of the Fed13 eral Trade Commission Act (15 U.S.C. 45(a)(2)), 

14 common carriers subject to the Communications Act 

15 of 1934 (47 U.S.C. 151 et seq.). 

16 (b) APPLICATION TO CABLE OPERATORS, SATELLITE

17 OPERATORS, AND TELECOMMUNICATIONS CARRIERS.— 

18 Sections 222, 338, and 631 of the Communications Act 

19 of 1934 (47 U.S.C. 222, 338, and 551), and any regula20 tions promulgated thereunder, shall not apply with respect 

21 to the information security practices, including practices 

22 relating to the notification of unauthorized access to data 

23 in electronic form, of any covered entity otherwise subject 

24 to those sections. 


smartinez on DSK4TPTVN1PROD with BILLS
13 

•S 1027 IS

1 (c) ENFORCEMENT BY FEDERAL TRADE COMMIS2 SION.— 

3 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC4 TICES.—A violation of section 2 or 3 shall be treated 

5 as an unfair or deceptive act or practice in violation 

6 of a regulation under section 18(a)(1)(B) of the 

7 Federal Trade Commission Act (15 U.S.C. 

8 57a(a)(1)(B)) regarding unfair or deceptive acts or 

9 practices. 

10 (2) POWERS OF COMMISSION.— 

11 (A) IN GENERAL.—Except as provided in 

12 subsection (a), the Commission shall enforce 

13 this Act in the same manner, by the same 

14 means, and with the same jurisdiction, powers, 

15 and duties as though all applicable terms and 

16 provisions of the Federal Trade Commission 

17 Act (15 U.S.C. 41 et seq.) were incorporated 

18 into and made a part of this Act. 

19 (B) PRIVILEGES AND IMMUNITIES.—Any 

20 person who violates section 3 or 4 shall be sub21 ject to the penalties and entitled to the privi22 leges and immunities provided in such Act. 

23 (3) MAXIMUM TOTAL LIABILITY.—Notwith24 standing the number of actions which may be 

25 brought against a covered entity under this subVerDate Sep 11 2014 05:20 Apr 29, 2015 Jkt 049200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S1027.IS S1027

smartinez on DSK4TPTVN1PROD with BILLS
14 

•S 1027 IS

1 section, the maximum civil penalty for which any 

2 covered entity may be liable under this subsection 

3 for all actions shall not exceed— 

4 (A) $1,000,000 for all violations of section 

5 2 resulting from the same related act or omis6 sion; and 

7 (B) $1,000,000 for all violations of section 

8 3 resulting from a single breach of security. 

9 (d) NO PRIVATE CAUSE OF ACTION.—Nothing in 

10 this Act shall be construed to establish a private cause 

11 of action against a person for a violation of this Act. 

12 SEC. 5. CRIMINAL PENALTIES FOR CYBER CRIMES. 

13 Part I of title 18, United States Code, is amended— 

14 (1) in chapter 47— 

15 (A) in section 1028(b)— 

16 (i) in paragraph (1)— 

17 (I) in subparagraph (B), by in18 serting ‘‘or’’ after the semicolon; 

19 (II) in subparagraph (C), by 

20 striking ‘‘or’’ after the semicolon; and 

21 (III) by striking subparagraph 

22 (D); 

23 (ii) by redesignating paragraphs (5) 

24 and (6), as paragraphs (6) and (7), respec25 tively; and 


smartinez on DSK4TPTVN1PROD with BILLS
15 

•S 1027 IS

1 (iii) by inserting after paragraph (4), 

2 the following: 

3 ‘‘(5) for an offense under paragraph (7) of such 

4 subsection, a fine of not more than $500,000 

5 ($1,000,000 if the person is an organization), im6 prisonment for not more than 30 years, or both;’’; 

7 (B) in section 1028A(a)(1), by striking ‘‘2 

8 years’’ and inserting ‘‘4 years’’; 

9 (C) in section 1029(c)(1)— 

10 (i) in subparagraph (A)— 

11 (I) in clause (i), by striking ‘‘a 

12 fine under this title or imprisonment 

13 for not more than 10 years’’ and in14 serting ‘‘a fine of not more than 

15 $500,000 ($1,000,000 if the person is 

16 an organization), imprisonment for 

17 not more than 20 years’’; and 

18 (II) in clause (ii), by striking ‘‘a 

19 fine under this title or imprisonment 

20 for not more than 15 years’’ and in21 serting ‘‘a fine of not more than 

22 $500,000 ($1,000,000 if the person is 

23 an organization), imprisonment for 

24 not more than 30 years’’; and 


smartinez on DSK4TPTVN1PROD with BILLS
16 

•S 1027 IS

1 (ii) in subparagraph (B), by striking 

2 ‘‘a fine under this title or imprisonment for 

3 not more than 20 years’’ and inserting ‘‘a 

4 fine of not more than $500,000 

5 ($1,000,000 if the person is an organiza6 tion), imprisonment for not more than 40 

7 years’’; and 

8 (D) in section 1030(c)— 

9 (i) in paragraph (2)— 

10 (I) in subparagraph (A), by strik11 ing ‘‘subsection (a)(2), (a)(3),’’ and 

12 inserting ‘‘subsection (a)(3)’’; 

13 (II) in subparagraph (B)— 

14 (aa) in the matter preceding 

15 clause (i), by striking ‘‘a fine 

16 under this title or imprisonment 

17 for not more than 5 years’’ and 

18 inserting ‘‘a fine of not more 

19 than $500,000 ($1,000,000 if the 

20 person is an organization), im21 prisonment for not more than 10 

22 years’’; and 

23 (bb) in clause (iii), by strik24 ing ‘‘and’’ at the end; 


smartinez on DSK4TPTVN1PROD with BILLS
17 

•S 1027 IS

1 (III) in subparagraph (C), by 

2 striking ‘‘(a)(2),’’; and 

3 (IV) by adding at the end the fol4 lowing: 

5 ‘‘(D) a fine of not more than $500,000 

6 ($1,000,000 if the person is an organization), im7 prisonment for not more than 2 years, or both, in 

8 the case of an offense under subsection (a)(2) which 

9 does not occur after a conviction for another offense 

10 under this section, or an attempt to commit an of11 fense punishable under this subparagraph; and 

12 ‘‘(E) a fine of not more than $500,000 

13 ($1,000,000 if the person is an organization), im14 prisonment for not more than 20 years, or both, in 

15 the case of an offense under subsection (a)(2) which 

16 occurs after a conviction for another offense under 

17 this section, or an attempt to commit an offense 

18 punishable under this subparagraph;’’; 

19 (ii) in paragraph (3)— 

20 (I) in subparagraph (A), by strik21 ing ‘‘(a)(4) or’’; and 

22 (II) in subparagraph (B), by 

23 striking ‘‘(a)(4), or’’; 

24 (iii) in paragraph (4)— 


smartinez on DSK4TPTVN1PROD with BILLS
18 

•S 1027 IS

1 (I) in subparagraph (A), in the 

2 matter preceding clause (i), by strik3 ing ‘‘a fine under this title, imprison4 ment for not more than 5 years’’ and 

5 inserting ‘‘a fine of not more than 

6 $500,000 ($1,000,000 if the person is 

7 an organization), imprisonment for 

8 not more than 10 years’’; 

9 (II) in subparagraph (B), in the 

10 matter preceding clause (i), by strik11 ing ‘‘a fine under this title, imprison12 ment for not more than 10 years’’ and 

13 inserting ‘‘a fine of not more than 

14 $500,000 ($1,000,000 if the person is 

15 an organization), imprisonment for 

16 not more than 20 years’’; 

17 (III) in subparagraph (C), in the 

18 matter preceding clause (i), by strik19 ing ‘‘a fine under this title, imprison20 ment for not more than 20 years’’ and 

21 inserting ‘‘a fine of not more than 

22 $500,000 ($1,000,000 if the person is 

23 an organization), imprisonment for 

24 not more than 40 years’’; 


smartinez on DSK4TPTVN1PROD with BILLS
19 

•S 1027 IS

1 (IV) in subparagraph (D), in the 

2 matter preceding clause (i), by strik3 ing ‘‘a fine under this title, imprison4 ment for not more than 10 years’’ and 

5 inserting ‘‘a fine of not more than 

6 $500,000 ($1,000,000 if the person is 

7 an organization), imprisonment for 

8 not more than 20 years’’; 

9 (V) in subparagraph (E), by 

10 striking ‘‘a fine under this title, im11 prisonment for not more than 20 

12 years’’ and inserting ‘‘a fine of not 

13 more than $500,000 ($1,000,000 if 

14 the person is an organization), impris15 onment for not more than 40 years’’; 

16 (VI) in subparagraph (F)— 

17 (aa) by striking ‘‘a fine 

18 under this title’’ and inserting ‘‘a 

19 fine of not more than $500,000 

20 ($1,000,000 if the person is an 

21 organization)’’; and 

22 (bb) by striking ‘‘or’’ at the 

23 end; and 

24 (VII) in subparagraph (G)— 


smartinez on DSK4TPTVN1PROD with BILLS
20 

•S 1027 IS

1 (aa) in the matter preceding 

2 clause (i), by striking ‘‘under this 

3 title, imprisonment for not more 

4 than 1 year’’ and inserting ‘‘of 

5 not more than $500,000 

6 ($1,000,000 if the person is an 

7 organization), imprisonment for 

8 not more than 2 years’’; and 

9 (bb) in clause (ii), by strik10 ing the period at the end and in11 serting ‘‘; and’’; and 

12 (iv) by adding at the end the fol13 lowing: 

14 ‘‘(5)(A) a fine of not more than $500,000 

15 ($1,000,000 if the person is an organization), im16 prisonment for not more than 10 years, or both, in 

17 the case of an offense under subsection (a)(4) which 

18 does not occur after a conviction for another offense 

19 under this section, or an attempt to commit an of20 fense punishable under this subparagraph; and 

21 ‘‘(B) a fine of not more than $500,000 

22 ($1,000,000 if the person is an organization), im23 prisonment for not more than 20 years, or both, in 

24 the case of an offense under subsection (a)(4) which 

25 occurs after a conviction for another offense under 


smartinez on DSK4TPTVN1PROD with BILLS
21 

•S 1027 IS

1 this section, or an attempt to commit an offense 

2 punishable under this subparagraph.’’; 

3 (2) in chapter 63— 

4 (A) in section 1343— 

5 (i) in the first sentence, by striking 

6 ‘‘fined under this title or imprisoned not 

7 more than 20 years’’ and inserting ‘‘fined 

8 not more than $500,000 ($1,000,000 if the 

9 person is an organization), imprisoned not 

10 more than 40 years’’; and 

11 (ii) in the second sentence, by striking 

12 ‘‘$1,000,000 or imprisoned not more than 

13 30 years’’ and inserting ‘‘$2,000,000, im14 prisoned for any term of years or for life’’; 

15 and 

16 (B) in section 1344, by striking 

17 ‘‘$1,000,000 or imprisoned not more than 30 

18 years’’ and inserting ‘‘$2,000,000 or imprisoned 

19 for any term of years or for life’’; and 

20 (3) in section 1519, by striking ‘‘fined under 

21 this title, imprisoned not more than 20 years’’ and 

22 inserting ‘‘fined not more than $500,000 

23 ($1,000,000 if the person is an organization), im24 prisoned not more than 40 years’’. 


smartinez on DSK4TPTVN1PROD with BILLS
22 

•S 1027 IS

1 SEC. 6. APPREHENSION AND PROSECUTION OF INTER2 NATIONAL CYBER CRIMINALS. 

3 (a) INTERNATIONAL CYBER CRIMINAL DEFINED.— 

4 In this section, the term ‘‘international cyber criminal’’ 

5 means an individual— 

6 (1) who is physically present within a country 

7 with which the United States does not have a mu8 tual legal assistance treaty or an extradition treaty; 

9 (2) who is believed to have committed a 

10 cybercrime or intellectual property crime against the 

11 interests of the United States or its citizens; and 

12 (3) for whom— 

13 (A) an arrest warrant has been issued by 

14 a judge in the United States; or 

15 (B) an international wanted notice (com16 monly referred to as a ‘‘Red Notice’’) has been 

17 circulated by Interpol. 

18 (b) BILATERAL CONSULTATIONS.—The Secretary of 

19 State, or designee, shall consult with the appropriate gov20 ernment official of each country in which one or more 

21 international cyber criminals are physically present to de22 termine what actions the government of such country has 

23 taken— 

24 (1) to apprehend and prosecute such criminals; 

25 and 


smartinez on DSK4TPTVN1PROD with BILLS
23 

•S 1027 IS

1 (2) to prevent such criminals from carrying out 

2 cybercrimes or intellectual property crimes against 

3 the interests of the United States or its citizens. 

4 (c) ANNUAL REPORT.— 

5 (1) IN GENERAL.—The Secretary of State shall 

6 submit to the appropriate congressional committees 

7 an annual report that identifies— 

8 (A) the number of international cyber 

9 criminals who are located in countries that do 

10 not have an extradition treaty or mutual legal 

11 assistance treaty with the United States, broken 

12 down by country; 

13 (B) the dates on which an official of the 

14 Department of State, as a result of this Act, 

15 discussed ways to thwart or prosecute inter16 national cyber criminals in a bilateral conversa17 tion with an official of another country, includ18 ing the name of each such country; and 

19 (C) for each international cyber criminal 

20 who was extradited into the United States dur21 ing the most recently completed calendar 

22 year— 

23 (i) his or her name; 

24 (ii) the crimes for which he or she was 

25 charged; 


smartinez on DSK4TPTVN1PROD with BILLS
24 

•S 1027 IS

1 (iii) his or her previous country of res2 idence; and 

3 (iv) the country from which he or she 

4 was extradited into the United States. 

5 (2) APPROPRIATE CONGRESSIONAL COMMIT6 TEES.—For purposes of this subsection, the term 

7 ‘‘appropriate congressional committees’’ means— 

8 (A) the Committee on Foreign Relations of 

9 the Senate; 

10 (B) the Committee on Appropriations of 

11 the Senate; 

12 (C) the Committee on Homeland Security 

13 and Governmental Affairs of the Senate; 

14 (D) the Committee on Banking, Housing, 

15 and Urban Affairs of the Senate; 

16 (E) the Committee on Foreign Affairs of 

17 the House of Representatives; 

18 (F) the Committee on Appropriations of 

19 the House of Representatives; 

20 (G) the Committee on Homeland Security 

21 of the House of Representatives; and 

22 (H) the Committee on Financial Services 

23 of the House of Representatives. 

24 SEC. 7. DEFINITIONS. 

25 In this Act: 


smartinez on DSK4TPTVN1PROD with BILLS
25 

•S 1027 IS

1 (1) BREACH OF SECURITY.—The term ‘‘breach 

2 of security’’ means unauthorized access and acquisi3 tion of data in electronic form containing personal 

4 information. 

5 (2) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (3) COVERED ENTITY.— 

8 (A) IN GENERAL.—The term ‘‘covered en9 tity’’ means a sole proprietorship, partnership, 

10 corporation, trust, estate, cooperative, associa11 tion, or other commercial entity that acquires, 

12 maintains, stores, or utilizes personal informa13 tion. 

14 (B) EXEMPTIONS.—The term ‘‘covered en15 tity’’ does not include the following: 

16 (i) Financial institutions subject to 

17 title V of the Gramm-Leach-Bliley Act (15 

18 U.S.C. 6801 et seq.). 

19 (ii) An entity covered by the regula20 tions issued under section 264(c) of the 

21 Health Insurance Portability and Account22 ability Act of 1996 (Public Law 104–191) 

23 to the extent that such entity is subject to 

24 the requirements of such regulations with 

25 respect to protected health information. 


smartinez on DSK4TPTVN1PROD with BILLS
26 

•S 1027 IS

1 (4) DATA IN ELECTRONIC FORM.—The term 

2 ‘‘data in electronic form’’ means any data stored 

3 electronically or digitally on any computer system or 

4 other database and includes recordable tapes and 

5 other mass storage devices. 

6 (5) DESIGNATED ENTITY.—The term ‘‘des7 ignated entity’’ means the Federal Government enti8 ty designated under section 3(a)(2)(A). 

9 (6) PERSONAL INFORMATION.— 

10 (A) IN GENERAL.—The term ‘‘personal in11 formation’’ means an individual’s first name or 

12 first initial and last name in combination with 

13 any one or more of the following data elements 

14 for that individual: 

15 (i) Social Security number. 

16 (ii) Driver’s license number, passport 

17 number, military identification number, or 

18 other similar number issued on a govern19 ment document used to verify identity. 

20 (iii) Financial account number, or 

21 credit or debit card number, and any re22 quired security code, access code, or pass23 word that is necessary to permit access to 

24 an individual’s financial account. 


smartinez on DSK4TPTVN1PROD with BILLS
27 

•S 1027 IS

1 (iv) Federal or State government 

2 issued identification card. 

3 (v) A username or email address, in 

4 combination with a password or security 

5 question and answer that would allow ac6 cess to an online account. 

7 (vi) Medical information, including the 

8 medical history, mental or physical condi9 tion, or medical treatment or diagnosis by 

10 a health care professional of the individual. 

11 (vii) Health insurance information, in12 cluding a health insurance policy number 

13 or subscriber identification number, any 

14 unique identifier used by a health insurer 

15 to identify an individual, or any informa16 tion in a health insurance application or 

17 claim history filed by the individual. 

18 (viii) An individual taxpayer identi19 fication number. 

20 (B) EXCLUSIONS.— 

21 (i) PUBLIC RECORD INFORMATION.— 

22 Personal information does not include in23 formation obtained about an individual 

24 which has been lawfully made publicly 

25 available by a Federal, State, or local govVerDate Sep 11 2014 05:20 Apr 29, 2015 Jkt 049200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6201 E:\BILLS\S1027.IS S1027

smartinez on DSK4TPTVN1PROD with BILLS
28 

•S 1027 IS

1 ernment entity or widely distributed by 

2 media. 

3 (ii) ENCRYPTED, REDACTED, OR SE4 CURED DATA.—Personal information does 

5 not include information that is encrypted, 

6 redacted, or secured by any other method 

7 or technology that renders the data ele8 ments unusable. 

9 (7) SERVICE PROVIDER.—The term ‘‘service 

10 provider’’ means an entity that provides electronic 

11 data transmission, routing, intermediate, and tran12 sient storage, or connections to its system or net13 work, where such entity providing such services does 

14 not select or modify the content of the electronic 

15 data, is not the sender or the intended recipient of 

16 the data, and does not differentiate personal infor17 mation from other information that such entity 

18 transmits, routes, stores, or for which such entity 

19 provides connections. Any such entity shall be treat20 ed as a service provider under this Act only to the 

21 extent that it is engaged in the provision of such 

22 transmission, routing, intermediate and transient 

23 storage, or connections. 


smartinez on DSK4TPTVN1PROD with BILLS
29 

•S 1027 IS

1 SEC. 8. EFFECT ON OTHER LAWS. 

2 This Act preempts any law, rule, regulation, require3 ment, standard, or other provision having the force and 

4 effect of law of any State, or political subdivision of a 

5 State, relating to the protection or security of data in elec6 tronic form containing personal information or the notifi7 cation of a breach of security. 

8 SEC. 9. EFFECTIVE DATE. 

9 This Act shall take effect on the date that is 1 year 

10 after the date of enactment of this Act. 

Æ 


smartinez on DSK4TPTVN1PROD with BILLS