I 

112TH CONGRESS 

1ST SESSION H. R. 1707 

To protect consumers by requiring reasonable security policies and procedures 

to protect data containing personal information, and to provide for nationwide notice in the event of a security breach. 

IN THE HOUSE OF REPRESENTATIVES 

MAY 4, 2011 

Mr. RUSH (for himself, Mr. BARTON of Texas, and Ms. SCHAKOWSKY) introduced the following bill; which was referred to the Committee on Energy 

and Commerce 

A BILL 

To protect consumers by requiring reasonable security policies and procedures to protect data containing personal 

information, and to provide for nationwide notice in the 

event of a security breach. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Accountability 

5 and Trust Act’’. 

6 SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 

7 (a) GENERAL SECURITY POLICIES AND PROCE8 DURES.— 


smartinez on DSKB9S0YB1PROD with BILLS
2 

•HR 1707 IH

1 (1) REGULATIONS.—Not later than 1 year after 

2 the date of enactment of this Act, the Commission 

3 shall promulgate regulations under section 553 of 

4 title 5, United States Code, to require each person 

5 engaged in interstate commerce that owns or pos6 sesses data containing personal information, or con7 tracts to have any third party entity maintain such 

8 data for such person, to establish and implement 

9 policies and procedures regarding information secu10 rity practices for the treatment and protection of 

11 personal information taking into consideration— 

12 (A) the size of, and the nature, scope, and 

13 complexity of the activities engaged in by, such 

14 person; 

15 (B) the current state of the art in adminis16 trative, technical, and physical safeguards for 

17 protecting such information; and 

18 (C) the cost of implementing such safe19 guards. 

20 (2) REQUIREMENTS.—Such regulations shall 

21 require the policies and procedures to include the 

22 following: 

23 (A) A security policy with respect to the 

24 collection, use, sale, other dissemination, and 

25 maintenance of such personal information. 


smartinez on DSKB9S0YB1PROD with BILLS
3 

•HR 1707 IH

1 (B) The identification of an officer or 

2 other individual as the point of contact with re3 sponsibility for the management of information 

4 security. 

5 (C) A process for identifying and assessing 

6 any reasonably foreseeable vulnerabilities in the 

7 system or systems maintained by such person 

8 that contains such data, which shall include 

9 regular monitoring for a breach of security of 

10 such system or systems. 

11 (D) A process for taking preventive and 

12 corrective action to mitigate against any 

13 vulnerabilities identified in the process required 

14 by subparagraph (C), which may include imple15 menting any changes to security practices and 

16 the architecture, installation, or implementation 

17 of network or operating software. 

18 (E) A process for disposing of data in elec19 tronic form containing personal information by 

20 shredding, permanently erasing, or otherwise 

21 modifying the personal information contained in 

22 such data to make such personal information 

23 permanently unreadable or undecipherable. 


smartinez on DSKB9S0YB1PROD with BILLS
4 

•HR 1707 IH

1 (F) A standard method or methods for the 

2 destruction of paper documents and other non3 electronic data containing personal information. 

4 (3) TREATMENT OF ENTITIES GOVERNED BY

5 OTHER LAW.—Any person who is in compliance with 

6 any other Federal law that requires such person to 

7 maintain standards and safeguards for information 

8 security and protection of personal information that, 

9 taken as a whole and as the Commission shall deter10 mine in the rulemaking required under paragraph 

11 (1), provide protections substantially similar to, or 

12 greater than, those required under this subsection, 

13 shall be deemed to be in compliance with this sub14 section. 

15 (b) SPECIAL REQUIREMENTS FOR INFORMATION

16 BROKERS.— 

17 (1) SUBMISSION OF POLICIES TO THE FTC.— 

18 The regulations promulgated under subsection (a) 

19 shall require each information broker to submit its 

20 security policies to the Commission in conjunction 

21 with a notification of a breach of security under sec22 tion 3 or upon request of the Commission. 

23 (2) POST-BREACH AUDIT.—For any information 

24 broker required to provide notification under section 

25 3, the Commission may conduct audits of the inforVerDate Mar 15 2010 01:08 May 05, 2011 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1707.IH H1707

smartinez on DSKB9S0YB1PROD with BILLS
5 

•HR 1707 IH

1 mation security practices of such information broker, 

2 or require the information broker to conduct inde3 pendent audits of such practices (by an independent 

4 auditor who has not audited such information bro5 ker’s security practices during the preceding 5 

6 years). 

7 (3) ACCURACY OF AND INDIVIDUAL ACCESS TO

8 PERSONAL INFORMATION.— 

9 (A) ACCURACY.— 

10 (i) IN GENERAL.—Each information 

11 broker shall establish reasonable proce12 dures to assure the maximum possible ac13 curacy of the personal information it col14 lects, assembles, or maintains, and any 

15 other information it collects, assembles, or 

16 maintains that specifically identifies an in17 dividual, other than information which 

18 merely identifies an individual’s name or 

19 address. 

20 (ii) LIMITED EXCEPTION FOR FRAUD

21 DATABASES.—The requirement in clause 

22 (i) shall not prevent the collection or main23 tenance of information that may be inac24 curate with respect to a particular indiVerDate Mar 15 2010 01:08 May 05, 2011 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1707.IH H1707

smartinez on DSKB9S0YB1PROD with BILLS
6 

•HR 1707 IH

1 vidual when that information is being col2 lected or maintained solely— 

3 (I) for the purpose of indicating 

4 whether there may be a discrepancy 

5 or irregularity in the personal infor6 mation that is associated with an indi7 vidual; and 

8 (II) to help identify, or authen9 ticate the identity of, an individual, or 

10 to protect against or investigate fraud 

11 or other unlawful conduct. 

12 (B) CONSUMER ACCESS TO INFORMA13 TION.— 

14 (i) ACCESS.—Each information broker 

15 shall— 

16 (I) provide to each individual 

17 whose personal information it main18 tains, at the individual’s request at 

19 least 1 time per year and at no cost 

20 to the individual, and after verifying 

21 the identity of such individual, a 

22 means for the individual to review any 

23 personal information regarding such 

24 individual maintained by the informa25 tion broker and any other information 


smartinez on DSKB9S0YB1PROD with BILLS
7 

•HR 1707 IH

1 maintained by the information broker 

2 that specifically identifies such indi3 vidual, other than information which 

4 merely identifies an individual’s name 

5 or address; and 

6 (II) place a conspicuous notice on 

7 its Internet website (if the informa8 tion broker maintains such a website) 

9 instructing individuals how to request 

10 access to the information required to 

11 be provided under subclause (I), and, 

12 as applicable, how to express a pref13 erence with respect to the use of per14 sonal information for marketing pur15 poses under clause (iii). 

16 (ii) DISPUTED INFORMATION.—When17 ever an individual whose information the 

18 information broker maintains makes a 

19 written request disputing the accuracy of 

20 any such information, the information 

21 broker, after verifying the identity of the 

22 individual making such request and unless 

23 there are reasonable grounds to believe 

24 such request is frivolous or irrelevant, 

25 shall— 


smartinez on DSKB9S0YB1PROD with BILLS
8 

•HR 1707 IH

1 (I) correct any inaccuracy; or 

2 (II)(aa) in the case of informa3 tion that is public record information, 

4 inform the individual of the source of 

5 the information, and, if reasonably 

6 available, where a request for correc7 tion may be directed and, if the indi8 vidual provides proof that the public 

9 record has been corrected or that the 

10 information broker was reporting the 

11 information incorrectly, correct the in12 accuracy in the information broker’s 

13 records; or 

14 (bb) in the case of information 

15 that is non-public information, note 

16 the information that is disputed, in17 cluding the individual’s statement dis18 puting such information, and take 

19 reasonable steps to independently 

20 verify such information under the pro21 cedures outlined in subparagraph (A) 

22 if such information can be independ23 ently verified. 

24 (iii) ALTERNATIVE PROCEDURE FOR

25 CERTAIN MARKETING INFORMATION.—In 


smartinez on DSKB9S0YB1PROD with BILLS
9 

•HR 1707 IH

1 accordance with regulations issued under 

2 clause (v), an information broker that 

3 maintains any information described in 

4 clause (i) which is used, shared, or sold by 

5 such information broker for marketing 

6 purposes, may, in lieu of complying with 

7 the access and dispute requirements set 

8 forth in clauses (i) and (ii), provide each 

9 individual whose information it maintains 

10 with a reasonable means of expressing a 

11 preference not to have his or her informa12 tion used for such purposes. If the indi13 vidual expresses such a preference, the in14 formation broker may not use, share, or 

15 sell the individual’s information for mar16 keting purposes. 

17 (iv) LIMITATIONS.—An information 

18 broker may limit the access to information 

19 required under clause (i)(I) and is not re20 quired to provide notice to individuals as 

21 required under clause (i)(II) in the fol22 lowing circumstances: 

23 (I) If access of the individual to 

24 the information is limited by law or 

25 legally recognized privilege. 


smartinez on DSKB9S0YB1PROD with BILLS
10 

•HR 1707 IH

1 (II) If the information is used for 

2 a legitimate governmental or fraud 

3 prevention purpose that would be 

4 compromised by such access. 

5 (III) If the information consists 

6 of a published media record, unless 

7 that record has been included in a re8 port about an individual shared with a 

9 third party. 

10 (v) RULEMAKING.—Not later than 1 

11 year after the date of the enactment of this 

12 Act, the Commission shall promulgate reg13 ulations under section 553 of title 5, 

14 United States Code, to carry out this para15 graph and to facilitate the purposes of this 

16 Act. In addition, the Commission shall 

17 issue regulations, as necessary, under sec18 tion 553 of title 5, United States Code, on 

19 the scope of the application of the limita20 tions in clause (iv), including any addi21 tional circumstances in which an informa22 tion broker may limit access to information 

23 under such clause that the Commission de24 termines to be appropriate. 


smartinez on DSKB9S0YB1PROD with BILLS
11 

•HR 1707 IH

1 (C) FCRA REGULATED PERSONS.—Any 

2 information broker who is engaged in activities 

3 subject to the Fair Credit Reporting Act and 

4 who is in compliance with sections 609, 610, 

5 and 611 of such Act (15 U.S.C. 1681g; 1681h; 

6 1681i) with respect to information subject to 

7 such Act, shall be deemed to be in compliance 

8 with this paragraph with respect to such infor9 mation. 

10 (4) REQUIREMENT OF AUDIT LOG OF ACCESSED

11 AND TRANSMITTED INFORMATION.—Not later than 

12 1 year after the date of the enactment of this Act, 

13 the Commission shall promulgate regulations under 

14 section 553 of title 5, United States Code, to require 

15 information brokers to establish measures which fa16 cilitate the auditing or retracing of any internal or 

17 external access to, or transmissions of, any data con18 taining personal information collected, assembled, or 

19 maintained by such information broker. 

20 (5) PROHIBITION ON PRETEXTING BY INFOR21 MATION BROKERS.— 

22 (A) PROHIBITION ON OBTAINING PER23 SONAL INFORMATION BY FALSE PRETENSES.— 

24 It shall be unlawful for an information broker 

25 to obtain or attempt to obtain, or cause to be 


smartinez on DSKB9S0YB1PROD with BILLS
12 

•HR 1707 IH

1 disclosed or attempt to cause to be disclosed to 

2 any person, personal information or any other 

3 information relating to any person by— 

4 (i) making a false, fictitious, or fraud5 ulent statement or representation to any 

6 person; or 

7 (ii) providing any document or other 

8 information to any person that the infor9 mation broker knows or should know to be 

10 forged, counterfeit, lost, stolen, or fraudu11 lently obtained, or to contain a false, ficti12 tious, or fraudulent statement or represen13 tation. 

14 (B) PROHIBITION ON SOLICITATION TO

15 OBTAIN PERSONAL INFORMATION UNDER FALSE

16 PRETENSES.—It shall be unlawful for an infor17 mation broker to request a person to obtain 

18 personal information or any other information 

19 relating to any other person, if the information 

20 broker knew or should have known that the per21 son to whom such a request is made will obtain 

22 or attempt to obtain such information in the 

23 manner described in subparagraph (A). 

24 (c) EXEMPTION FOR CERTAIN SERVICE PRO25 VIDERS.—Nothing in this section shall apply to a service 


smartinez on DSKB9S0YB1PROD with BILLS
13 

•HR 1707 IH

1 provider for any electronic communication by a third party 

2 that is transmitted, routed, or stored in intermediate or 

3 transient storage by such service provider. 

4 SEC. 3. NOTIFICATION OF INFORMATION SECURITY 

5 BREACH. 

6 (a) NATIONWIDE NOTIFICATION.—Any person en7 gaged in interstate commerce that owns or possesses data 

8 in electronic form containing personal information shall, 

9 following the discovery of a breach of security of the sys10 tem maintained by such person that contains such data— 

11 (1) notify each individual who is a citizen or 

12 resident of the United States whose personal infor13 mation was acquired or accessed as a result of such 

14 a breach of security; and 

15 (2) notify the Commission. 

16 (b) SPECIAL NOTIFICATION REQUIREMENTS.— 

17 (1) THIRD PARTY AGENTS.—In the event of a 

18 breach of security by any third party entity that has 

19 been contracted to maintain or process data in elec20 tronic form containing personal information on be21 half of any other person who owns or possesses such 

22 data, such third party entity shall be required to no23 tify such person of the breach of security. Upon re24 ceiving such notification from such third party, such 


smartinez on DSKB9S0YB1PROD with BILLS
14 

•HR 1707 IH

1 person shall provide the notification required under 

2 subsection (a). 

3 (2) SERVICE PROVIDERS.—If a service provider 

4 becomes aware of a breach of security of data in 

5 electronic form containing personal information that 

6 is owned or possessed by another person that con7 nects to or uses a system or network provided by the 

8 service provider for the purpose of transmitting, 

9 routing, or providing intermediate or transient stor10 age of such data, such service provider shall be re11 quired to notify of such a breach of security only the 

12 person who initiated such connection, transmission, 

13 routing, or storage if such person can be reasonably 

14 identified. Upon receiving such notification from a 

15 service provider, such person shall provide the notifi16 cation required under subsection (a). 

17 (3) COORDINATION OF NOTIFICATION WITH

18 CREDIT REPORTING AGENCIES.—If a person is re19 quired to provide notification to more than 5,000 in20 dividuals under subsection (a)(1), the person shall 

21 also notify the major credit reporting agencies that 

22 compile and maintain files on consumers on a na23 tionwide basis, of the timing and distribution of the 

24 notices. Such notice shall be given to the credit re25 porting agencies without unreasonable delay and, if 


smartinez on DSKB9S0YB1PROD with BILLS
15 

•HR 1707 IH

1 it will not delay notice to the affected individuals, 

2 prior to the distribution of notices to the affected in3 dividuals. 

4 (c) TIMELINESS OF NOTIFICATION.— 

5 (1) IN GENERAL.—Unless subject to a delay au6 thorized under paragraph (2), a notification required 

7 under subsection (a) shall be made not later than 60 

8 days following the discovery of a breach of security, 

9 unless the person providing notice can show that 

10 providing notice within such a time frame is not fea11 sible due to extraordinary circumstances necessary 

12 to prevent further breach or unauthorized disclo13 sures, and reasonably restore the integrity of the 

14 data system, in which case such notification shall be 

15 made as promptly as possible. 

16 (2) DELAY OF NOTIFICATION AUTHORIZED FOR

17 LAW ENFORCEMENT OR NATIONAL SECURITY PUR18 POSES.— 

19 (A) LAW ENFORCEMENT.—If a Federal, 

20 State, or local law enforcement agency deter21 mines that the notification required under this 

22 section would impede a civil or criminal inves23 tigation, such notification shall be delayed upon 

24 the written request of the law enforcement 

25 agency for 30 days or such lesser period of time 


smartinez on DSKB9S0YB1PROD with BILLS
16 

•HR 1707 IH

1 which the law enforcement agency determines is 

2 reasonably necessary and requests in writing. A 

3 law enforcement agency may, by a subsequent 

4 written request, revoke such delay or extend the 

5 period of time set forth in the original request 

6 made under this paragraph if further delay is 

7 necessary. 

8 (B) NATIONAL SECURITY.—If a Federal 

9 national security agency or homeland security 

10 agency determines that the notification required 

11 under this section would threaten national or 

12 homeland security, such notification may be de13 layed for a period of time which the national se14 curity agency or homeland security agency de15 termines is reasonably necessary and requests 

16 in writing. A Federal national security agency 

17 or homeland security agency may revoke such 

18 delay or extend the period of time set forth in 

19 the original request made under this paragraph 

20 by a subsequent written request if further delay 

21 is necessary. 

22 (d) METHOD AND CONTENT OF NOTIFICATION.— 

23 (1) DIRECT NOTIFICATION.— 

24 (A) METHOD OF NOTIFICATION.—A person 

25 required to provide notification to individuals 


smartinez on DSKB9S0YB1PROD with BILLS
17 

•HR 1707 IH

1 under subsection (a)(1) shall be in compliance 

2 with such requirement if the person provides 

3 conspicuous and clearly identified notification 

4 by one of the following methods (provided the 

5 selected method can reasonably be expected to 

6 reach the intended individual): 

7 (i) Written notification. 

8 (ii) Notification by email or other 

9 electronic means, if— 

10 (I) the person’s primary method 

11 of communication with the individual 

12 is by email or such other electronic 

13 means; or 

14 (II) the individual has consented 

15 to receive such notification and the 

16 notification is provided in a manner 

17 that is consistent with the provisions 

18 permitting electronic transmission of 

19 notices under section 101 of the Elec20 tronic Signatures in Global and Na21 tional Commerce Act (15 U.S.C. 

22 7001). 

23 (B) CONTENT OF NOTIFICATION.—Regard24 less of the method by which notification is proVerDate Mar 15 2010 01:08 May 05, 2011 Jkt 099200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\H1707.IH H1707

smartinez on DSKB9S0YB1PROD with BILLS
18 

•HR 1707 IH

1 vided to an individual under subparagraph (A), 

2 such notification shall include— 

3 (i) a description of the personal infor4 mation that was acquired or accessed by 

5 an unauthorized person; 

6 (ii) a telephone number that the indi7 vidual may use, at no cost to such indi8 vidual, to contact the person to inquire 

9 about the breach of security or the infor10 mation the person maintained about that 

11 individual; 

12 (iii) notice that the individual is enti13 tled to receive, at no cost to such indi14 vidual, consumer credit reports on a quar15 terly basis for a period of 2 years, or credit 

16 monitoring or other service that enables 

17 consumers to detect the misuse of their 

18 personal information for a period of 2 

19 years, and instructions to the individual on 

20 requesting such reports or service from the 

21 person, except when the only information 

22 which has been the subject of the security 

23 breach is the individual’s first name or ini24 tial and last name, or address, or phone 

25 number, in combination with a credit or 


smartinez on DSKB9S0YB1PROD with BILLS
19 

•HR 1707 IH

1 debit card number, and any required secu2 rity code; 

3 (iv) the toll-free contact telephone 

4 numbers and addresses for the major cred5 it reporting agencies; and 

6 (v) a toll-free telephone number and 

7 Internet website address for the Commis8 sion whereby the individual may obtain in9 formation regarding identity theft. 

10 (2) SUBSTITUTE NOTIFICATION.— 

11 (A) CIRCUMSTANCES GIVING RISE TO SUB12 STITUTE NOTIFICATION.—A person required to 

13 provide notification to individuals under sub14 section (a)(1) may provide substitute notifica15 tion in lieu of the direct notification required by 

16 paragraph (1) if the person owns or possesses 

17 data in electronic form containing personal in18 formation of fewer than 1,000 individuals and 

19 such direct notification is not feasible due to— 

20 (i) excessive cost to the person re21 quired to provide such notification relative 

22 to the resources of such person, as deter23 mined in accordance with the regulations 

24 issued by the Commission under paragraph 

25 (3)(A); or 


smartinez on DSKB9S0YB1PROD with BILLS
20 

•HR 1707 IH

1 (ii) lack of sufficient contact informa2 tion for the individual required to be noti3 fied. 

4 (B) FORM OF SUBSTITUTE NOTIFICA5 TION.—Such substitute notification shall in6 clude— 

7 (i) email notification to the extent 

8 that the person has email addresses of in9 dividuals to whom it is required to provide 

10 notification under subsection (a)(1); 

11 (ii) a conspicuous notice on the Inter12 net website of the person (if such person 

13 maintains such a website); and 

14 (iii) notification in print and to broad15 cast media, including major media in met16 ropolitan and rural areas where the indi17 viduals whose personal information was ac18 quired reside. 

19 (C) CONTENT OF SUBSTITUTE NOTICE.— 

20 Each form of substitute notice under this para21 graph shall include— 

22 (i) notice that individuals whose per23 sonal information is included in the breach 

24 of security are entitled to receive, at no 

25 cost to the individuals, consumer credit reVerDate Mar 15 2010 01:08 May 05, 2011 Jkt 099200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\H1707.IH H1707

smartinez on DSKB9S0YB1PROD with BILLS
21 

•HR 1707 IH

1 ports on a quarterly basis for a period of 

2 2 years, or credit monitoring or other serv3 ice that enables consumers to detect the 

4 misuse of their personal information for a 

5 period of 2 years, and instructions on re6 questing such reports or service from the 

7 person, except when the only information 

8 which has been the subject of the security 

9 breach is the individual’s first name or ini10 tial and last name, or address, or phone 

11 number, in combination with a credit or 

12 debit card number, and any required secu13 rity code; and 

14 (ii) a telephone number by which an 

15 individual can, at no cost to such indi16 vidual, learn whether that individual’s per17 sonal information is included in the breach 

18 of security. 

19 (3) REGULATIONS AND GUIDANCE.— 

20 (A) REGULATIONS.—Not later than 1 year 

21 after the date of enactment of this Act, the 

22 Commission shall, by regulation under section 

23 553 of title 5, United States Code, establish cri24 teria for determining circumstances under 

25 which substitute notification may be provided 


smartinez on DSKB9S0YB1PROD with BILLS
22 

•HR 1707 IH

1 under paragraph (2), including criteria for de2 termining if notification under paragraph (1) is 

3 not feasible due to excessive costs to the person 

4 required to provided such notification relative to 

5 the resources of such person. Such regulations 

6 may also identify other circumstances where 

7 substitute notification would be appropriate for 

8 any person, including circumstances under 

9 which the cost of providing notification exceeds 

10 the benefits to consumers. 

11 (B) GUIDANCE.—In addition, the Commis12 sion shall provide and publish general guidance 

13 with respect to compliance with this subsection. 

14 Such guidance shall include— 

15 (i) a description of written or email 

16 notification that complies with the require17 ments of paragraph (1); and 

18 (ii) guidance on the content of sub19 stitute notification under paragraph (2), 

20 including the extent of notification to print 

21 and broadcast media that complies with 

22 the requirements of such paragraph. 

23 (e) OTHER OBLIGATIONS FOLLOWING BREACH.— 

24 (1) IN GENERAL.—A person required to provide 

25 notification under subsection (a) shall, upon request 


smartinez on DSKB9S0YB1PROD with BILLS
23 

•HR 1707 IH

1 of an individual whose personal information was in2 cluded in the breach of security, provide or arrange 

3 for the provision of, to each such individual and at 

4 no cost to such individual— 

5 (A) consumer credit reports from at least 

6 one of the major credit reporting agencies be7 ginning not later than 60 days following the in8 dividual’s request and continuing on a quarterly 

9 basis for a period of 2 years thereafter; or 

10 (B) a credit monitoring or other service 

11 that enables consumers to detect the misuse of 

12 their personal information, beginning not later 

13 than 60 days following the individual’s request 

14 and continuing for a period of 2 years. 

15 (2) LIMITATION.—This subsection shall not 

16 apply if the only personal information which has 

17 been the subject of the security breach is the individ18 ual’s first name or initial and last name, or address, 

19 or phone number, in combination with a credit or 

20 debit card number, and any required security code. 

21 (3) RULEMAKING.—As part of the Commis22 sion’s rulemaking described in subsection (d)(3), the 

23 Commission shall determine the circumstances under 

24 which a person required to provide notification 

25 under subsection (a)(1) shall provide or arrange for 


smartinez on DSKB9S0YB1PROD with BILLS
24 

•HR 1707 IH

1 the provision of free consumer credit reports or cred2 it monitoring or other service to affected individuals. 

3 (f) EXEMPTION.— 

4 (1) GENERAL EXEMPTION.—A person shall be 

5 exempt from the requirements under this section if, 

6 following a breach of security, such person deter7 mines that there is no reasonable risk of identity 

8 theft, fraud, or other unlawful conduct. 

9 (2) PRESUMPTION.— 

10 (A) IN GENERAL.—If the data in electronic 

11 form containing personal information is ren12 dered unusable, unreadable, or indecipherable 

13 through encryption or other security technology 

14 or methodology (if the method of encryption or 

15 such other technology or methodology is gen16 erally accepted by experts in the information se17 curity field), there shall be a presumption that 

18 no reasonable risk of identity theft, fraud, or 

19 other unlawful conduct exists following a breach 

20 of security of such data. Any such presumption 

21 may be rebutted by facts demonstrating that 

22 the encryption or other security technologies or 

23 methodologies in a specific case, have been or 

24 are reasonably likely to be compromised. 


smartinez on DSKB9S0YB1PROD with BILLS
25 

•HR 1707 IH

1 (B) METHODOLOGIES OR TECH2 NOLOGIES.—Not later than 1 year after the 

3 date of the enactment of this Act and bian4 nually thereafter, the Commission shall issue 

5 rules (pursuant to section 553 of title 5, United 

6 States Code) or guidance to identify security 

7 methodologies or technologies which render data 

8 in electronic form unusable, unreadable, or in9 decipherable, that shall, if applied to such data, 

10 establish a presumption that no reasonable risk 

11 of identity theft, fraud, or other unlawful con12 duct exists following a breach of security of 

13 such data. Any such presumption may be rebut14 ted by facts demonstrating that any such meth15 odology or technology in a specific case has 

16 been or is reasonably likely to be compromised. 

17 In issuing such rules or guidance, the Commis18 sion shall consult with relevant industries, con19 sumer organizations, and data security and 

20 identity theft prevention experts and established 

21 standards setting bodies. 

22 (3) FTC GUIDANCE.—Not later than 1 year 

23 after the date of the enactment of this Act the Com24 mission shall issue guidance regarding the applica25 tion of the exemption in paragraph (1). 


smartinez on DSKB9S0YB1PROD with BILLS
26 

•HR 1707 IH

1 (g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS2 SION.—If the Commission, upon receiving notification of 

3 any breach of security that is reported to the Commission 

4 under subsection (a)(2), finds that notification of such a 

5 breach of security via the Commission’s Internet website 

6 would be in the public interest or for the protection of 

7 consumers, the Commission shall place such a notice in 

8 a clear and conspicuous location on its Internet website. 

9 (h) FTC STUDY ON NOTIFICATION IN LANGUAGES

10 IN ADDITION TO ENGLISH.—Not later than 1 year after 

11 the date of enactment of this Act, the Commission shall 

12 conduct a study on the practicality and cost effectiveness 

13 of requiring the notification required by subsection (d)(1) 

14 to be provided in a language in addition to English to indi15 viduals known to speak only such other language. 

16 (i) GENERAL RULEMAKING AUTHORITY.—The Com17 mission may promulgate regulations necessary under sec18 tion 553 of title 5, United States Code, to effectively en19 force the requirements of this section. 

20 (j) TREATMENT OF PERSONS GOVERNED BY OTHER

21 LAW.—A person who is in compliance with any other Fed22 eral law that requires such person to provide notification 

23 to individuals following a breach of security, and that, 

24 taken as a whole, provides protections substantially similar 

25 to, or greater than, those required under this section, as 


smartinez on DSKB9S0YB1PROD with BILLS
27 

•HR 1707 IH

1 the Commission shall determine by rule (under section 

2 553 of title 5, United States Code), shall be deemed to 

3 be in compliance with this section. 

4 SEC. 4. APPLICATION AND ENFORCEMENT. 

5 (a) GENERAL APPLICATION.—The requirements of 

6 sections 2 and 3 shall only apply to those persons, partner7 ships, or corporations over which the Commission has au8 thority pursuant to section 5(a)(2) of the Federal Trade 

9 Commission Act (15 U.S.C. 45(a)(2)). 

10 (b) ENFORCEMENT BY THE FEDERAL TRADE COM11 MISSION.— 

12 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC13 TICES.—A violation of section 2 or 3 shall be treated 

14 as an unfair and deceptive act or practice in viola15 tion of a regulation under section 18(a)(1)(B) of the 

16 Federal Trade Commission Act (15 U.S.C. 

17 57a(a)(1)(B)) regarding unfair or deceptive acts or 

18 practices. 

19 (2) POWERS OF COMMISSION.—The Commis20 sion shall enforce this Act in the same manner, by 

21 the same means, and with the same jurisdiction, 

22 powers, and duties as though all applicable terms 

23 and provisions of the Federal Trade Commission Act 

24 (15 U.S.C. 41 et seq.) were incorporated into and 

25 made a part of this Act. Any person who violates 


smartinez on DSKB9S0YB1PROD with BILLS
28 

•HR 1707 IH

1 such regulations shall be subject to the penalties and 

2 entitled to the privileges and immunities provided in 

3 that Act. 

4 (3) LIMITATION.—In promulgating rules under 

5 this Act, the Commission shall not require the de6 ployment or use of any specific products or tech7 nologies, including any specific computer software or 

8 hardware. 

9 (c) ENFORCEMENT BY STATE ATTORNEYS GEN10 ERAL.— 

11 (1) CIVIL ACTION.—In any case in which the 

12 attorney general of a State, or an official or agency 

13 of a State, has reason to believe that an interest of 

14 the residents of that State has been or is threatened 

15 or adversely affected by any person who violates sec16 tion 2 or 3 of this Act, the attorney general, official, 

17 or agency of the State, as parens patriae, may bring 

18 a civil action on behalf of the residents of the State 

19 in a district court of the United States of appro20 priate jurisdiction— 

21 (A) to enjoin further violation of such sec22 tion by the defendant; 

23 (B) to compel compliance with such sec24 tion; or 


smartinez on DSKB9S0YB1PROD with BILLS
29 

•HR 1707 IH

1 (C) to obtain civil penalties in the amount 

2 determined under paragraph (2). 

3 (2) CIVIL PENALTIES.— 

4 (A) CALCULATION.— 

5 (i) TREATMENT OF VIOLATIONS OF

6 SECTION 2.—For purposes of paragraph 

7 (1)(C) with regard to a violation of section 

8 2, the amount determined under this para9 graph is the amount calculated by multi10 plying the number of days that a person is 

11 not in compliance with such section by an 

12 amount not greater than $11,000. 

13 (ii) TREATMENT OF VIOLATIONS OF

14 SECTION 3.—For purposes of paragraph 

15 (1)(C) with regard to a violation of section 

16 3, the amount determined under this para17 graph is the amount calculated by multi18 plying the number of violations of such 

19 section by an amount not greater than 

20 $11,000. Each failure to send notification 

21 as required under section 3 to a resident of 

22 the State shall be treated as a separate 

23 violation. 

24 (B) ADJUSTMENT FOR INFLATION.—Be25 ginning on the date that the Consumer Price 


smartinez on DSKB9S0YB1PROD with BILLS
30 

•HR 1707 IH

1 Index is first published by the Bureau of Labor 

2 Statistics that is after 1 year after the date of 

3 enactment of this Act, and each year thereafter, 

4 the amounts specified in clauses (i) and (ii) of 

5 subparagraph (A) shall be increased by the per6 centage increase in the Consumer Price Index 

7 published on that date from the Consumer 

8 Price Index published the previous year. 

9 (C) MAXIMUM TOTAL LIABILITY.—Not10 withstanding the number of actions which may 

11 be brought against a person under this sub12 section, the maximum civil penalty for which 

13 any person may be liable under this subsection 

14 shall not exceed— 

15 (i) $5,000,000 for each violation of 

16 section 2; and 

17 (ii) $5,000,000 for all violations of 

18 section 3 resulting from a single breach of 

19 security. 

20 (3) INTERVENTION BY THE FTC.— 

21 (A) NOTICE AND INTERVENTION.—The 

22 State shall provide prior written notice of any 

23 action under paragraph (1) to the Commission 

24 and provide the Commission with a copy of its 

25 complaint, except in any case in which such 


smartinez on DSKB9S0YB1PROD with BILLS
31 

•HR 1707 IH

1 prior notice is not feasible, in which case the 

2 State shall serve such notice immediately upon 

3 instituting such action. The Commission shall 

4 have the right— 

5 (i) to intervene in the action; 

6 (ii) upon so intervening, to be heard 

7 on all matters arising therein; and 

8 (iii) to file petitions for appeal. 

9 (B) LIMITATION ON STATE ACTION WHILE

10 FEDERAL ACTION IS PENDING.—If the Commis11 sion has instituted a civil action for violation of 

12 this Act, no State attorney general, or official 

13 or agency of a State, may bring an action under 

14 this subsection during the pendency of that ac15 tion against any defendant named in the com16 plaint of the Commission for any violation of 

17 this Act alleged in the complaint. 

18 (4) CONSTRUCTION.—For purposes of bringing 

19 any civil action under paragraph (1), nothing in this 

20 Act shall be construed to prevent an attorney gen21 eral of a State from exercising the powers conferred 

22 on the attorney general by the laws of that State 

23 to— 

24 (A) conduct investigations; 

25 (B) administer oaths or affirmations; or 


smartinez on DSKB9S0YB1PROD with BILLS
32 

•HR 1707 IH

1 (C) compel the attendance of witnesses or 

2 the production of documentary and other evi3 dence. 

4 (d) AFFIRMATIVE DEFENSE FOR A VIOLATION OF

5 SECTION 3.— 

6 (1) IN GENERAL.—It shall be an affirmative de7 fense to an enforcement action brought under sub8 section (b), or a civil action brought under sub9 section (c), based on a violation of section 3, that all 

10 of the personal information contained in the data in 

11 electronic form that was acquired or accessed as a 

12 result of a breach of security of the defendant is 

13 public record information that is lawfully made 

14 available to the general public from Federal, State, 

15 or local government records and was acquired by the 

16 defendant from such records. 

17 (2) NO EFFECT ON OTHER REQUIREMENTS.— 

18 Nothing in this subsection shall be construed to ex19 empt any person from the requirement to notify the 

20 Commission of a breach of security as required 

21 under section 3(a). 

22 SEC. 5. DEFINITIONS. 

23 In this Act, the following definitions apply: 

24 (1) BREACH OF SECURITY.—The term ‘‘breach 

25 of security’’ means unauthorized access to or acquiVerDate Mar 15 2010 01:08 May 05, 2011 Jkt 099200 PO 00000 Frm 00032 Fmt 6652 Sfmt 6201 E:\BILLS\H1707.IH H1707

smartinez on DSKB9S0YB1PROD with BILLS
33 

•HR 1707 IH

1 sition of data in electronic form containing personal 

2 information. 

3 (2) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (3) DATA IN ELECTRONIC FORM.—The term 

6 ‘‘data in electronic form’’ means any data stored 

7 electronically or digitally on any computer system or 

8 other database and includes recordable tapes and 

9 other mass storage devices. 

10 (4) ENCRYPTION.—The term ‘‘encryption’’ 

11 means the protection of data in electronic form in 

12 storage or in transit using an encryption technology 

13 that has been adopted by an established standards 

14 setting body which renders such data indecipherable 

15 in the absence of associated cryptographic keys nec16 essary to enable decryption of such data. Such 

17 encryption must include appropriate management 

18 and safeguards of such keys to protect the integrity 

19 of the encryption. 

20 (5) IDENTITY THEFT.—The term ‘‘identity 

21 theft’’ means the unauthorized use of another per22 son’s personal information for the purpose of engag23 ing in commercial transactions under the name of 

24 such other person. 


smartinez on DSKB9S0YB1PROD with BILLS
34 

•HR 1707 IH

1 (6) INFORMATION BROKER.—The term ‘‘infor2 mation broker’’— 

3 (A) means a commercial entity whose busi4 ness is to collect, assemble, or maintain per5 sonal information concerning individuals who 

6 are not current or former customers of such en7 tity in order to sell such information or provide 

8 access to such information to any nonaffiliated 

9 third party in exchange for consideration, 

10 whether such collection, assembly, or mainte11 nance of personal information is performed by 

12 the information broker directly, or by contract 

13 or subcontract with any other entity; and 

14 (B) does not include a commercial entity to 

15 the extent that such entity processes informa16 tion collected by and received from a non17 affiliated third party concerning individuals who 

18 are current or former customers or employees 

19 of such third party to enable such third party 

20 to (1) provide benefits for its employees or (2) 

21 directly transact business with its customers. 

22 (7) PERSONAL INFORMATION.— 

23 (A) DEFINITION.—The term ‘‘personal in24 formation’’ means an individual’s first name or 

25 initial and last name, or address, or phone 


smartinez on DSKB9S0YB1PROD with BILLS
35 

•HR 1707 IH

1 number, in combination with any 1 or more of 

2 the following data elements for that individual: 

3 (i) Social Security number. 

4 (ii) Driver’s license number, passport 

5 number, military identification number, or 

6 other similar number issued on a govern7 ment document used to verify identity. 

8 (iii) Financial account number, or 

9 credit or debit card number, and any re10 quired security code, access code, or pass11 word that is necessary to permit access to 

12 an individual’s financial account. 

13 (B) MODIFIED DEFINITION BY RULE14 MAKING.—The Commission may, by rule pro15 mulgated under section 553 of title 5, United 

16 States Code, modify the definition of ‘‘personal 

17 information’’ under subparagraph (A)— 

18 (i) for the purpose of section 2 to the 

19 extent that such modification will not un20 reasonably impede interstate commerce, 

21 and will accomplish the purposes of this 

22 Act; or 

23 (ii) for the purpose of section 3, to the 

24 extent that such modification is necessary 

25 to accommodate changes in technology or 


smartinez on DSKB9S0YB1PROD with BILLS
36 

•HR 1707 IH

1 practices, will not unreasonably impede 

2 interstate commerce, and will accomplish 

3 the purposes of this Act. 

4 (8) PUBLIC RECORD INFORMATION.—The term 

5 ‘‘public record information’’ means information 

6 about an individual which has been obtained origi7 nally from records of a Federal, State, or local gov8 ernment entity that are available for public inspec9 tion. 

10 (9) NON-PUBLIC INFORMATION.—The term 

11 ‘‘non-public information’’ means information about 

12 an individual that is of a private nature and neither 

13 available to the general public nor obtained from a 

14 public record. 

15 (10) SERVICE PROVIDER.—The term ‘‘service 

16 provider’’ means an entity that provides to a user 

17 transmission, routing, intermediate and transient 

18 storage, or connections to its system or network, for 

19 electronic communications, between or among points 

20 specified by such user of material of the user’s 

21 choosing, without modification to the content of the 

22 material as sent or received. Any such entity shall 

23 be treated as a service provider under this Act only 

24 to the extent that it is engaged in the provision of 


smartinez on DSKB9S0YB1PROD with BILLS
37 

•HR 1707 IH

1 such transmission, routing, intermediate and tran2 sient storage or connections. 

3 SEC. 6. EFFECT ON OTHER LAWS. 

4 (a) PREEMPTION OF STATE INFORMATION SECURITY

5 LAWS.—This Act supersedes any provision of a statute, 

6 regulation, or rule of a State or political subdivision of 

7 a State, with respect to those entities covered by the regu8 lations issued pursuant to this Act, that expressly— 

9 (1) requires information security practices and 

10 treatment of data containing personal information 

11 similar to any of those required under section 2; and 

12 (2) requires notification to individuals of a 

13 breach of security resulting in unauthorized access 

14 to or acquisition of data in electronic form con15 taining personal information. 

16 (b) ADDITIONAL PREEMPTION.— 

17 (1) IN GENERAL.—No person other than a per18 son specified in section 4(c) may bring a civil action 

19 under the laws of any State if such action is pre20 mised in whole or in part upon the defendant vio21 lating any provision of this Act. 

22 (2) PROTECTION OF CONSUMER PROTECTION

23 LAWS.—This subsection shall not be construed to 

24 limit the enforcement of any State consumer protec25 tion law by an attorney general of a State. 


smartinez on DSKB9S0YB1PROD with BILLS
38 

•HR 1707 IH

1 (c) PROTECTION OF CERTAIN STATE LAWS.—This 

2 Act shall not be construed to preempt the applicability 

3 of— 

4 (1) State trespass, contract, or tort law; or 

5 (2) other State laws to the extent that those 

6 laws relate to acts of fraud. 

7 (d) PRESERVATION OF FTC AUTHORITY.—Nothing 

8 in this Act may be construed in any way to limit or affect 

9 the Commission’s authority under any other provision of 

10 law. 

11 SEC. 7. EFFECTIVE DATE. 

12 This Act shall take effect 1 year after the date of 

13 enactment of this Act. 

14 SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 

15 There is authorized to be appropriated to the Com16 mission $1,000,000 for each of fiscal years 2011 through 

17 2016 to carry out this Act. 

Æ 


smartinez on DSKB9S0YB1PROD with BILLS