II 

115TH CONGRESS 

1ST SESSION S. 1900 

To require all persons who acquire, maintain, or use personal information 

to have in effect reasonable cybersecurity protections and practices whenever acquiring, maintaining, or using personal information in commerce, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 28, 2017 

Mr. BLUMENTHAL introduced the following bill; which was read twice and 

referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To require all persons who acquire, maintain, or use personal 

information to have in effect reasonable cybersecurity 

protections and practices whenever acquiring, maintaining, or using personal information in commerce, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Breach Account5 ability and Enforcement Act of 2017’’. 


sradovich on DSK3GMQ082PROD with BILLS
2 

•S 1900 IS

1 SEC. 2. REQUIREMENT TO IMPLEMENT REASONABLE CY2 BERSECURITY PROTECTIONS AND PRAC3 TICES. 

4 (a) REQUIREMENT.—No covered entity may acquire, 

5 maintain, or use personal information in commerce with6 out having in effect reasonable cybersecurity protections 

7 and practices. 

8 (b) ENFORCEMENT BY FEDERAL TRADE COMMIS9 SION.— 

10 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC11 TICES.—A violation of subsection (a) by a covered 

12 entity shall be treated as a violation of a rule defin13 ing an unfair or deceptive act or practice prescribed 

14 under section 18(a)(1)(B) of the Federal Trade 

15 Commission Act (15 U.S.C. 57a(a)(1)(B)). 

16 (2) POWERS OF COMMISSION.— 

17 (A) IN GENERAL.—Except as provided in 

18 subparagraph (C), the Federal Trade Commis19 sion shall enforce this section in the same man20 ner, by the same means, and with the same ju21 risdiction, powers, and duties as though all ap22 plicable terms and provisions of the Federal 

23 Trade Commission Act (15 U.S.C. 41 et seq.) 

24 were incorporated into and made a part of this 

25 Act. 


sradovich on DSK3GMQ082PROD with BILLS
3 

•S 1900 IS

1 (B) PRIVILEGES AND IMMUNITIES.—Ex2 cept as provided in subparagraph (C), any per3 son who violates this section shall be subject to 

4 the penalties and entitled to the privileges and 

5 immunities provided in the Federal Trade Com6 mission Act (15 U.S.C. 41 et seq.). 

7 (C) APPLICABILITY TO ALL COVERED EN8 TITIES.— 

9 (i) IN GENERAL.—The Federal Trade 

10 Commission shall enforce this section with 

11 respect to a person described in clause (ii) 

12 as if such person were a person over which 

13 the Commission has authority pursuant to 

14 section 5(a)(2) of the Federal Trade Com15 mission Act (15 U.S.C. 45(a)(2)) and, not16 withstanding sections 4, 5(a)(2), and 6 of 

17 such Act (15 U.S.C. 44, 45(a)(2), and 46), 

18 not jurisdictional limitation of the Commis19 sion with respect to a person described in 

20 clause (ii) shall apply for purposes of this 

21 section. 

22 (ii) PERSONS DESCRIBED.—A person 

23 described in this clause is— 

24 (I) a bank, a savings and loan in25 stitution, a Federal credit union, a 


sradovich on DSK3GMQ082PROD with BILLS
4 

•S 1900 IS

1 common carrier, an air carrier or for2 eign air carrier, or a person, partner3 ship, or corporation insofar as it is 

4 subject to the Packers and Stockyards 

5 Act, 1921, as described in section 

6 5(a)(2) of the Federal Trade Commis7 sion Act (15 U.S.C. 45(a)(2)); or 

8 (II) an organization which is not 

9 organized to carry on business for its 

10 own profit or that of its members. 

11 (3) REGULATIONS.— 

12 (A) IN GENERAL.—The Federal Trade 

13 Commission shall promulgate, in accordance 

14 with section 553 of title 5, United States Code, 

15 such regulations as may be necessary to carry 

16 out this section. 

17 (B) MINIMUM STANDARDS.—In promul18 gating any standards for cybersecurity protec19 tions and practices to carry out this section, the 

20 Commission shall ensure that any such stand21 ards that would safeguard customer informa22 tion do so as well as or better than the stand23 ards set forth under part 314 of title 16, Code 

24 of Federal Regulations, as in effect on the day 

25 before the date of the enactment of this Act. 


sradovich on DSK3GMQ082PROD with BILLS
5 

•S 1900 IS

1 (4) CIVIL PENALTIES.—Notwithstanding sec2 tion 5(m) of the Federal Trade Commission Act (15 

3 U.S.C. 45(m)), a civil penalty recovered under such 

4 section may be in excess of amounts provided for in 

5 such section as the court finds appropriate to deter 

6 violations of subsection (a) of this section. 

7 (c) DEFINITIONS.—In this section: 

8 (1) BREACH OF SECURITY.— 

9 (A) IN GENERAL.—The term ‘‘breach of 

10 security’’ means compromise of the security, 

11 confidentiality, or integrity of, or loss of, data 

12 in electronic form that results in, or there is a 

13 reasonable basis to conclude has resulted in, 

14 unauthorized access to or acquisition of per15 sonal information from a covered entity. 

16 (B) EXCLUSIONS.—The term ‘‘breach of 

17 security’’ does not include— 

18 (i) a good faith acquisition of personal 

19 information by a covered entity, or an em20 ployee or agent of a covered entity, if the 

21 personal information is not subject to fur22 ther use or unauthorized disclosure; 

23 (ii) any lawfully authorized investiga24 tive, protective, or intelligence activity of a 

25 law enforcement or an intelligence agency 


sradovich on DSK3GMQ082PROD with BILLS
6 

•S 1900 IS

1 of the United States, a State, or a political 

2 subdivision of a State; or 

3 (iii) the release of a public record not 

4 otherwise subject to confidentiality or non5 disclosure requirements. 

6 (2) COVERED ENTITY.—The term ‘‘covered en7 tity’’ means a sole proprietorship, partnership, cor8 poration, trust, estate, cooperative, association, or 

9 other commercial entity, and any charitable, edu10 cational, or nonprofit organization, that acquires, 

11 maintains, or utilizes personal information. 

12 (3) DATA IN ELECTRONIC FORM.—The term 

13 ‘‘data in electronic form’’ means any data stored 

14 electronically or digitally on any computer system or 

15 other database, including recordable tapes and other 

16 mass storage devices. 

17 (4) IDENTITY THEFT.—The term ‘‘identity 

18 theft’’ means the unauthorized use of another per19 son’s personal information for the purpose of engag20 ing in commercial transactions under the identity of 

21 such other person, including any contact that vio22 lates section 1028A of title 18, United States Code. 

23 (5) PERSONAL INFORMATION.— 


sradovich on DSK3GMQ082PROD with BILLS
7 

•S 1900 IS

1 (A) DEFINITION.—The term ‘‘personal in2 formation’’ means any information or compila3 tion of information that includes— 

4 (i) a non-truncated Social Security 

5 number; 

6 (ii) a financial account number or 

7 credit or debit card number in combination 

8 with any security code, access code, or 

9 password that is required for an individual 

10 to obtain credit, withdraw funds, or engage 

11 in a financial transaction; or 

12 (iii) an individual’s first and last 

13 name or first initial and last name in com14 bination with— 

15 (I) a driver’s license number, a 

16 passport number, or an alien registra17 tion number, or other similar number 

18 issued on a government document 

19 used to verify identity; 

20 (II) unique biometric data such 

21 as a fingerprint, voice print, retina or 

22 iris image, or any other unique phys23 ical representation; 

24 (III) a unique account identifier, 

25 electronic identification number, user 


sradovich on DSK3GMQ082PROD with BILLS
8 

•S 1900 IS

1 name, or routing code in combination 

2 with any associated security code, ac3 cess code, or password that is re4 quired for an individual to obtain 

5 money, goods, services, or any other 

6 thing of value; or 

7 (IV) 2 of the following: 

8 (aa) Home address or tele9 phone number. 

10 (bb) Mother’s maiden name, 

11 if identified as such. 

12 (cc) Month, day, and year of 

13 birth. 

14 (B) MODIFIED DEFINITION BY RULE15 MAKING.—If the Federal Trade Commission de16 termines that the definition under subpara17 graph (A) is not reasonably sufficient to protect 

18 individuals from identity theft, fraud, or other 

19 unlawful conduct, the Commission by rule pro20 mulgated under section 553 of title 5, United 

21 States Code, may modify the definition of ‘‘per22 sonal information’’ under subparagraph (A) to 

23 the extent the modification will not unreason24 ably impede interstate commerce. 

Æ 


sradovich on DSK3GMQ082PROD with BILLS