IB 

Union Calendar No. 719 

114TH CONGRESS 

2D SESSION H. R. 1770 

[Report No. 114–908] 

To require certain entities who collect and maintain personal information 

of individuals to secure such information and to provide notice to such 

individuals in the case of a breach of security involving such information, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 14, 2015 

Mrs. BLACKBURN (for herself, Mr. WELCH, Mr. BURGESS, and Mr. UPTON) 

introduced the following bill; which was referred to the Committee on Energy and Commerce 

JANUARY 3, 2017 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on April 14, 2015] 


sradovich on DSK3GMQ082PROD with BILLS
2 

•HR 1770 RH

A BILL 

To require certain entities who collect and maintain personal 

information of individuals to secure such information 

and to provide notice to such individuals in the case 

of a breach of security involving such information, and 

for other purposes. 


sradovich on DSK3GMQ082PROD with BILLS
3 

•HR 1770 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; PURPOSES. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Data Security and Breach Notification Act of 2015’’. 

6 (b) PURPOSES.—The purposes of this Act are to— 

7 (1) protect consumers from identity theft, eco8 nomic loss or economic harm, and financial fraud by 

9 establishing strong and uniform national data secu10 rity and breach notification standards for electronic 

11 data in interstate commerce while minimizing State 

12 law burdens that may substantially affect interstate 

13 commerce; and 

14 (2) expressly preempt any related State laws to 

15 ensure uniformity of this Act’s standards and the con16 sistency of their application across jurisdictions. 

17 SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 

18 A covered entity shall implement and maintain rea19 sonable security measures and practices to protect and se20 cure personal information in electronic form against unau21 thorized access and acquisition as appropriate for the size 

22 and complexity of such covered entity and the nature and 

23 scope of its activities. 


sradovich on DSK3GMQ082PROD with BILLS
4 

•HR 1770 RH

1 SEC. 3. NOTIFICATION OF INFORMATION SECURITY 

2 BREACH. 

3 (a) IN GENERAL.— 

4 (1) RESTORING SECURITY.—Except as otherwise 

5 provided by this section, a covered entity that uses, 

6 accesses, transmits, stores, disposes of, or collects per7 sonal information shall, following the discovery of a 

8 breach of security restore the reasonable integrity, se9 curity, and confidentiality of the data system and 

10 identify the impact of the breach pursuant to para11 graph (2). 

12 (2) INVESTIGATION.—A covered entity shall con13 duct in good faith a reasonable and prompt investiga14 tion of the breach of security to determine whether 

15 there is a reasonable risk that the breach of security 

16 has resulted in, or will result in, identity theft, eco17 nomic loss or economic harm, or financial fraud to 

18 the individuals whose personal information was sub19 ject to the breach of security. 

20 (3) NOTIFICATION TO INDIVIDUALS REQUIRED.— 

21 (A) TRIGGER.—Unless there is no reason22 able risk that the breach of security has resulted 

23 in, or will result in, identity theft, economic loss 

24 or economic harm, or financial fraud to the indi25 viduals whose personal information was affected 

26 by the breach of security, the covered entity shall 


sradovich on DSK3GMQ082PROD with BILLS
5 

•HR 1770 RH

1 notify any resident of the United States that has 

2 been affected by the breach of security pursuant 

3 to this section. 

4 (B) NOTIFICATION DUTY.—Unless subject to 

5 a delay authorized under subsection (c)— 

6 (i) a breached covered entity shall no7 tify any individual for whom an election 

8 was not made under paragraph (4)(C) not 

9 later than 25 days after the non-breached 

10 covered entity declines or fails to exercise 

11 the election under paragraph (4)(C); 

12 (ii) a non-breached covered entity shall 

13 notify any individual for whom the non14 breached covered entity provided personal 

15 information to the breached covered entity, 

16 and such personal information was affected 

17 by the breach of security, not later than 25 

18 days after exercising the election under 

19 paragraph (4)(C); and 

20 (iii) any other covered entity shall 

21 identify the individuals affected by a breach 

22 of security and make the notification re23 quired under this subsection as expedi24 tiously as possible, without unreasonable 

25 delay, and not later than 30 days after 


sradovich on DSK3GMQ082PROD with BILLS
6 

•HR 1770 RH

1 completing the requirements of paragraph 

2 (1). 

3 (C) NOTIFICATION REQUIRED UPON DIS4 COVERY OF ADDITIONAL INDIVIDUALS AF5 FECTED.—If a covered entity, breached covered 

6 entity, or non-breached covered entity has pro7 vided the notification to individuals required 

8 under this subsection and after such notification 

9 discovers additional individuals to whom notifi10 cation is required under this subsection with re11 spect to the same breach of security, the covered 

12 entity, breached covered entity, or non-breached 

13 covered entity shall make such notification to 

14 such individuals as expeditiously as possible and 

15 without unreasonable delay. 

16 (4) NON-BREACHED COVERED ENTITY ELECTION

17 NOTICE.— 

18 (A) NOTICE TO NON-BREACHED COVERED

19 ENTITY REQUIRED.—Subject to the requirements 

20 of this paragraph, unless there is no reasonable 

21 risk that the breach of security has resulted in, 

22 or will result in, identity theft, economic loss or 

23 economic harm, or financial fraud related to the 

24 personal information provided by the non25 breached covered entity to the breached covered 


sradovich on DSK3GMQ082PROD with BILLS
7 

•HR 1770 RH

1 entity, the breached covered entity shall, as expe2 ditiously as possible and without unreasonable 

3 delay within 10 days after fulfilling the require4 ments described in paragraph (1), notify in 

5 writing each non-breached covered entity of the 

6 breach of security. 

7 (B) CONTENTS OF NOTICE.—The breached 

8 covered entity shall include in the notice de9 scribed in subparagraph (A) the elements of per10 sonal information received from the non-breached 

11 covered entity pursuant to the contract described 

12 in subparagraph (C) reasonably believed to be 

13 affected by the breach of security. 

14 (C) ELECTION BY NON-BREACHED COVERED

15 ENTITY AFTER RECEIVING NOTICE FROM A

16 BREACHED COVERED ENTITY.—In the case of a 

17 breached covered entity that is a party to a writ18 ten contract with a non-breached covered entity 

19 in which the breached covered entity maintains, 

20 stores, transmits, or processes data in electronic 

21 form containing personal information, not later 

22 than 10 days after receipt of the notice described 

23 in subparagraph (A), the non-breached covered 

24 entity may elect, in writing to the breached cov25 ered entity, to provide notification required by 


sradovich on DSK3GMQ082PROD with BILLS
8 

•HR 1770 RH

1 paragraph (3) all individuals whose personal in2 formation was provided by the non-breached cov3 ered entity to the breached covered entity and 

4 was affected by the breach of security. Such elec5 tion relieves the breached covered entity of the re6 quirements under paragraph (3) with respect to 

7 such individuals. 

8 (D) OBLIGATION AFTER ELECTION.— 

9 (i) BREACHED COVERED ENTITY CO10 OPERATION.—If a non-breached covered en11 tity elects under subparagraph (C) to pro12 vide notice under paragraph (3), the 

13 breached covered entity shall cooperate in 

14 all reasonable respects with the non15 breached covered entity and provide any of 

16 the information the breached covered entity 

17 possesses that is described under subsection 

18 (d)(1)(B) and provide all personal informa19 tion received from the non-breached covered 

20 entity that was affected by the breach of se21 curity so that the notification to such indi22 viduals is made as required under this sec23 tion. Not later than 10 business days after 

24 the non-breached covered entity submits a 

25 written request for information requested 


sradovich on DSK3GMQ082PROD with BILLS
9 

•HR 1770 RH

1 under this subsection to the breached cov2 ered entity, the breached covered entity shall 

3 provide such information. 

4 (ii) NON-BREACHED COVERED ENTITY

5 COOPERATION.—If a non-breached covered 

6 entity does not elect to provide notice to in7 dividuals under subparagraph (C), the non8 breached covered entity shall provide any of 

9 the information the non-breached covered 

10 entity possesses that is described under sub11 section (d)(1)(B) for any individual whose 

12 personal information was received from the 

13 non-breached covered entity that was af14 fected by the breach of security, and cooper15 ate in all reasonable respects with, the 

16 breached covered entity so that the notifica17 tion to such individuals is made as required 

18 under this section. Not later than 10 busi19 ness days after the breached covered entity 

20 submits a written request for information 

21 requested under this subsection to the non22 breached covered entity, the non-breached 

23 covered entity shall provide such informa24 tion. 


sradovich on DSK3GMQ082PROD with BILLS
10 

•HR 1770 RH

1 (5) LAW ENFORCEMENT.—A covered entity shall 

2 as expeditiously as possible notify the Commission 

3 and the Secret Service or the Federal Bureau of In4 vestigation of the fact that a breach of security has oc5 curred if the number of individuals whose personal 

6 information was, or there is a reasonable basis to con7 clude was, accessed and acquired by an unauthorized 

8 person exceeds 10,000. Any notification provided to 

9 the Secret Service or the Federal Bureau of Investiga10 tion pursuant to this paragraph shall be provided not 

11 less than 10 days before notification is provided to in12 dividuals pursuant to paragraph (3). 

13 (b) SPECIAL NOTIFICATION REQUIREMENTS.— 

14 (1) NON-PROFIT ORGANIZATIONS.—In the event 

15 of a breach of security involving personal information 

16 that would trigger notification under subsection (a), 

17 a non-profit organization may complete such notifica18 tion according to the procedures set forth in sub19 section (d)(2). 

20 (2) COORDINATION OF NOTIFICATION WITH CON21 SUMER REPORTING AGENCIES.—If a covered entity is 

22 required to provide notification to more than 10,000 

23 individuals under subsection (a), such covered entity 

24 shall also notify a consumer reporting agency that 

25 compiles and maintains files on consumers on a naVerDate Sep 11 2014 21:52 Jan 03, 2017 Jkt 069200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\H1770.RH H1770

sradovich on DSK3GMQ082PROD with BILLS
11 

•HR 1770 RH

1 tionwide basis, of the timing and distribution of the 

2 notices. Such notice shall be given to such consumer 

3 reporting agencies without unreasonable delay and, if 

4 it will not delay notice to the affected individuals, 

5 prior to the distribution of notices to the affected in6 dividuals. 

7 (c) DELAY OF NOTIFICATION AUTHORIZED FOR LAW

8 ENFORCEMENT OR NATIONAL SECURITY PURPOSES.—Not9 withstanding paragraph (1), if a Federal, State, or local 

10 law enforcement agency determines that the notification to 

11 individuals required under this section would impede a 

12 civil or criminal investigation or a Federal agency deter13 mines that such notification would threaten national secu14 rity, such notification shall be delayed upon written request 

15 of the law enforcement agency or Federal agency which the 

16 law enforcement agency or Federal agency determines is 

17 reasonably necessary and requests in writing. A law en18 forcement agency or Federal agency may, by a subsequent 

19 written request, revoke such delay or extend the period of 

20 time set forth in the original request made under this para21 graph if further delay is necessary. If a law enforcement 

22 agency or Federal agency requests a delay of notification 

23 to individuals under this paragraph, the Commission shall, 

24 upon written request of the law enforcement agency or Fed25 eral agency, delay any public disclosure of a notification 


sradovich on DSK3GMQ082PROD with BILLS
12 

•HR 1770 RH

1 received by the Commission under this section relating to 

2 the same breach of security until the delay of notification 

3 to individuals is no longer in effect. 

4 (d) METHOD AND CONTENT OF NOTIFICATION.— 

5 (1) DIRECT NOTIFICATION.— 

6 (A) METHOD OF NOTIFICATION.—A covered 

7 entity required to provide notification to an in8 dividual under subsection (a) shall be in compli9 ance with such requirement if the covered entity 

10 provides such notice by one of the following 

11 methods (if the selected method can reasonably be 

12 expected to reach the intended individual): 

13 (i) Written notification by postal mail. 

14 (ii) Notification by email or other elec15 tronic means, if the covered entity’s pri16 mary method of communication with the 

17 individual is by email or such other elec18 tronic means or the individual has con19 sented to receive such notification. 

20 (B) CONTENT OF NOTIFICATION.—Regard21 less of the method by which notification is pro22 vided to an individual under subparagraph (A) 

23 with respect to a breach of security, such notifi24 cation shall include each of the following: 


sradovich on DSK3GMQ082PROD with BILLS
13 

•HR 1770 RH

1 (i) The identity of the covered entity 

2 that suffered the breach and, if such covered 

3 entity is also a breached covered entity pro4 viding notice under section 3(b)(1), the 

5 identity of each non-breached covered entity 

6 that did not elect to notify affected individ7 uals pursuant to section 3(b)(1)(B) suffi8 cient to show the breached covered entity’s 

9 commercial relationship to the individual 

10 receiving notice. 

11 (ii) A description of the personal infor12 mation that was, or there is a reasonable 

13 basis to conclude was, acquired and accessed 

14 by an unauthorized person. 

15 (iii) The date range of the breach of se16 curity, or an approximate date range of the 

17 breach of security if a specific date range is 

18 unknown based on the information avail19 able at the time of the notification. 

20 (iv) A telephone number, or toll-free 

21 telephone number for any covered entity 

22 that does not meet the definition of a small 

23 business concern or non-profit organization, 

24 that the individual may use to contact the 

25 covered entity to inquire about the breach of 


sradovich on DSK3GMQ082PROD with BILLS
14 

•HR 1770 RH

1 security or the information the covered enti2 ty maintained about that individual. 

3 (v) The toll-free contact telephone num4 bers and addresses for a consumer reporting 

5 agency that compiles and maintains files on 

6 consumers on a nationwide basis. 

7 (vi) The toll-free telephone number and 

8 Internet website address for the Commission 

9 whereby the individual may obtain infor10 mation regarding identity theft. 

11 (2) SUBSTITUTE NOTIFICATION.— 

12 (A) IN GENERAL.—If, after making reason13 able efforts to contact all individuals to whom 

14 notice is required under subsection (a), the cov15 ered entity finds that contact information for 

16 500 or more individuals is insufficient or out-of17 date, the covered entity shall also provide sub18 stitute notice to those individuals, which shall be 

19 reasonably calculated to reach the individuals af20 fected by the breach of security. 

21 (B) FORM OF SUBSTITUTE NOTIFICATION.— 

22 A covered entity may provide substitute notifica23 tion by— 

24 (i) email or other electronic notifica25 tion to the extent that the covered entity has 


sradovich on DSK3GMQ082PROD with BILLS
15 

•HR 1770 RH

1 contact information for individuals to 

2 whom it is required to provide notification 

3 under subsection (a); and 

4 (ii) a conspicuous notice on the covered 

5 entity’s Internet website (if such covered en6 tity maintains such a website) for at least 

7 90 days. 

8 (C) CONTENT OF SUBSTITUTE NOTICE.— 

9 Each form of substitute notice under clauses (i) 

10 and (ii) of subparagraph (B) shall include the 

11 information required under paragraph (1)(B). 

12 (3) DIRECT NOTIFICATION BY A THIRD PARTY.— 

13 Nothing in this Act shall be construed to prevent a 

14 covered entity from contracting with a third party to 

15 provide the notification required under this section, 

16 provided such third party issues such notification 

17 without unreasonable delay, in accordance with the 

18 requirements of this section, and indicates to all indi19 viduals in such notification that such third party is 

20 sending such notification on behalf of the covered en21 tity. 

22 (e) REQUIREMENTS OF SERVICE PROVIDERS.— 

23 (1) IN GENERAL.—If a service provider becomes 

24 aware of a breach of security involving data in elec25 tronic form containing personal information that is 


sradovich on DSK3GMQ082PROD with BILLS
16 

•HR 1770 RH

1 owned or licensed by a covered entity that connects to 

2 or uses a system or network provided by the service 

3 provider for the purpose of transmitting, routing, or 

4 providing intermediate or transient storage of such 

5 data, such service provider shall notify the covered en6 tity who initiated such connection, transmission, 

7 routing, or storage of the data containing personal in8 formation breached, if such covered entity can be rea9 sonably identified. If a service provider is acting sole10 ly as a service provider for purposes of this sub11 section, the service provider has no other notification 

12 obligations under this section. 

13 (2) COVERED ENTITIES WHO RECEIVE NOTICE

14 FROM SERVICE PROVIDERS.—Upon receiving notifica15 tion from a service provider under paragraph (1), a 

16 covered entity shall provide notification as required 

17 under this section. 

18 SEC. 4. ENFORCEMENT. 

19 (a) ENFORCEMENT BY THE FEDERAL TRADE COMMIS20 SION.— 

21 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC22 TICES.—A violation of section 2 or 3 shall be treated 

23 as an unfair and deceptive act or practice in viola24 tion of a regulation under section 18(a)(1)(B) of the 

25 Federal Trade Commission Act (15 U.S.C. 


sradovich on DSK3GMQ082PROD with BILLS
17 

•HR 1770 RH

1 57a(a)(1)(B)) regarding unfair or deceptive acts or 

2 practices. 

3 (2) POWERS OF COMMISSION.—The Commission 

4 shall enforce this Act in the same manner, by the 

5 same means, and with the same jurisdiction, powers, 

6 and duties as though all applicable terms and provi7 sions of the Federal Trade Commission Act (15 

8 U.S.C. 41 et seq.) were incorporated into and made 

9 a part of this Act, and any covered entity who vio10 lates this Act shall be subject to the penalties and en11 titled to the privileges and immunities provided in 

12 the Federal Trade Commission Act (15 U.S.C. 41 et 

13 seq.), and as provided in clauses (ii) and (iii) of sec14 tion 5(5)(A). Notwithstanding section 5(m) of the 

15 Federal Trade Commission Act, the Commission may 

16 impose civil penalties for violations of section 3 in an 

17 amount not greater than $1,000 per violation. Each 

18 failure to send notification as required under section 

19 3 to a resident of the United States shall be treated 

20 as a separate violation. 

21 (3) MAXIMUM TOTAL LIABILITY FOR FIRST-TIME

22 VIOLATION OF SECTION 2.—The maximum total civil 

23 penalty for which any covered entity is liable under 

24 this subsection for all violations of section 2 resulting 

25 from the same related act or omission may not exceed 


sradovich on DSK3GMQ082PROD with BILLS
18 

•HR 1770 RH

1 $8,760,000, if such act or omission constitutes the 

2 covered entity’s first violation of section 2. 

3 (4) MAXIMUM TOTAL LIABILITY FOR FIRST-TIME

4 VIOLATION OF SECTION 3.—The maximum total civil 

5 penalty for which any covered entity is liable under 

6 this subsection for all violations of section 3 resulting 

7 from the same related act or omission may not exceed 

8 $17,520,000, if such act or omission constitutes the 

9 covered entity’s first violation of section 3. 

10 (b) ENFORCEMENT BY STATE ATTORNEYS GENERAL.— 

11 (1) CIVIL ACTION.—In any case in which the at12 torney general of a State has reason to believe that an 

13 interest of the residents of that State has been or is 

14 threatened or adversely affected by any covered entity 

15 who violates section 2 or 3 of this Act, the attorney 

16 general of the State, as parens patriae, may bring a 

17 civil action on behalf of the residents of the State in 

18 a district court of the United States of appropriate 

19 jurisdiction to— 

20 (A) enjoin further violation of such section 

21 by the defendant; 

22 (B) compel compliance with such section; or 

23 (C) obtain civil penalties in the amount de24 termined under paragraph (2). 

25 (2) CIVIL PENALTIES.— 


sradovich on DSK3GMQ082PROD with BILLS
19 

•HR 1770 RH

1 (A) CALCULATION.— 

2 (i) TREATMENT OF VIOLATIONS OF

3 SECTION 2.—For purposes of paragraph 

4 (1)(C) with regard to all violations of sec5 tion 2 resulting from the same related act or 

6 omission, the amount determined under this 

7 paragraph is the amount calculated by mul8 tiplying the number of days that a covered 

9 entity is not in compliance with such sec10 tion by an amount not greater than 

11 $11,000. 

12 (ii) TREATMENT OF VIOLATIONS OF

13 SECTION 3.—For purposes of paragraph 

14 (1)(C) with regard to a violation of section 

15 3, the amount determined under this para16 graph is the amount calculated by multi17 plying the number of violations of such sec18 tion by an amount not greater than $1,000. 

19 Each failure to send notification as re20 quired under section 3 to a resident of the 

21 State shall be treated as a separate viola22 tion. 

23 (B) MAXIMUM TOTAL LIABILITY.—Notwith24 standing the number of actions which may be 

25 brought against a covered entity under this subVerDate Sep 11 2014 21:52 Jan 03, 2017 Jkt 069200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6203 E:\BILLS\H1770.RH H1770

sradovich on DSK3GMQ082PROD with BILLS
20 

•HR 1770 RH

1 section, the maximum civil penalty for which 

2 any covered entity may be liable under this sub3 section shall not exceed— 

4 (i) $2,500,000 for each violation of sec5 tion 2; and 

6 (ii) $2,500,000 for all violations of sec7 tion 3 resulting from a single breach of se8 curity. 

9 (C) ADJUSTMENT FOR INFLATION.—Begin10 ning on the date that the Consumer Price Index 

11 is first published by the Bureau of Labor Statis12 tics that is after one year after the date of enact13 ment of this Act, and each year thereafter, the 

14 amounts specified in clauses (i) and (ii) of sub15 paragraph (A) and clauses (i) and (ii) of sub16 paragraph (B) shall be increased by the percent17 age increase in the Consumer Price Index pub18 lished on that date from the Consumer Price 

19 Index published the previous year. 

20 (D) PENALTY FACTORS.—In determining 

21 the amount of such a civil penalty, the degree of 

22 culpability, any history of prior such conduct, 

23 ability to pay, effect on ability to continue to do 

24 business, and such other matters as justice may 

25 require shall be taken into account. 


sradovich on DSK3GMQ082PROD with BILLS
21 

•HR 1770 RH

1 (3) INTERVENTION BY THE FEDERAL TRADE

2 COMMISSION.— 

3 (A) NOTICE AND INTERVENTION.—In all 

4 cases, the State shall provide prior written notice 

5 of any action under paragraph (1) to the Com6 mission and provide the Commission with a 

7 copy of its complaint, except in any case in 

8 which such prior notice is not feasible, in which 

9 case the State shall serve such notice imme10 diately upon instituting such action. The Com11 mission shall have the right— 

12 (i) to intervene in the action; 

13 (ii) upon so intervening, to be heard 

14 on all matters arising therein; and 

15 (iii) to file petitions for appeal. 

16 (B) PENDING PROCEEDINGS.—If the Fed17 eral Trade Commission initiates a Federal civil 

18 action for a violation of this Act, no State attor19 ney general may bring an action for a violation 

20 of this Act that resulted from the same or related 

21 acts or omissions against a defendant named in 

22 the civil action initiated by the Federal Trade 

23 Commission. 

24 (4) CONSTRUCTION.—For purposes of bringing 

25 any civil action under paragraph (1), nothing in this 


sradovich on DSK3GMQ082PROD with BILLS
22 

•HR 1770 RH

1 Act shall be construed to prevent an attorney general 

2 of a State from exercising the powers conferred on the 

3 attorney general by the laws of that State to— 

4 (A) conduct investigations; 

5 (B) administer oaths or affirmations; or 

6 (C) compel the attendance of witnesses or 

7 the production of documentary and other evi8 dence. 

9 (c) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

10 Act shall be construed to establish a private cause of action 

11 against a person for a violation of this Act. 

12 SEC. 5. DEFINITIONS. 

13 In this Act: 

14 (1) BREACH OF SECURITY.—The term ‘‘breach of 

15 security’’— 

16 (A) means a compromise of the security, 

17 confidentiality, or integrity of, or loss of, data in 

18 electronic form that results in, or there is a rea19 sonable basis to conclude has resulted in, unau20 thorized access to and acquisition of personal in21 formation from a covered entity; and 

22 (B) does not include the good faith acquisi23 tion of personal information by an employee or 

24 agent of the covered entity for the purposes of the 

25 covered entity, if the personal information is not 


sradovich on DSK3GMQ082PROD with BILLS
23 

•HR 1770 RH

1 used or subject to further unauthorized disclo2 sure. 

3 (2) BREACHED COVERED ENTITY.—The term 

4 ‘‘breached covered entity’’ means a covered entity that 

5 has incurred a breach of security affecting data in 

6 electronic form containing personal information of a 

7 non-breached covered entity that has directly con8 tracted the breached covered entity to maintain, store, 

9 or process data in electronic form containing personal 

10 information on behalf of such non-breached covered 

11 entity. For purposes of this definition, the term 

12 ‘‘breached covered entity’’ shall not include a service 

13 provider that is subject to section 3(e). 

14 (3) COMMISSION.—The term ‘‘Commission’’ 

15 means the Federal Trade Commission. 

16 (4) CONSUMER REPORTING AGENCY THAT COM17 PILES AND MAINTAINS FILES ON CONSUMERS ON A NA18 TIONWIDE BASIS.—The term ‘‘consumer reporting 

19 agency that compiles and maintains files on con20 sumers on a nationwide basis’’ has the meaning given 

21 that term in section 603(p) of the Fair Credit Report22 ing Act (15 U.S.C. 1681a(p)). 

23 (5) COVERED ENTITY.— 

24 (A) IN GENERAL.—The term ‘‘covered enti25 ty’’ means— 


sradovich on DSK3GMQ082PROD with BILLS
24 

•HR 1770 RH

1 (i) a sole proprietorship, partnership, 

2 corporation, trust, estate, cooperative, asso3 ciation, or other entity in or affecting com4 merce that acquires, maintains, stores, sells, 

5 or otherwise uses data in electronic form 

6 that includes personal information, over 

7 which the Commission has authority pursu8 ant to section 5(a)(2) of the Federal Trade 

9 Commission Act (15 U.S.C. 45(a)(2)); 

10 (ii) notwithstanding section 5(a)(2) of 

11 the Federal Trade Commission Act (15 

12 U.S.C. 45(a)(2)), common carriers subject 

13 to the Communications Act of 1934 (47 

14 U.S.C. 151 et seq.); and 

15 (iii) notwithstanding any jurisdic16 tional limitation of the Federal Trade Com17 mission Act (15 U.S.C. 41 et seq.), any non18 profit organization. 

19 (B) EXCEPTIONS.—The term ‘‘covered enti20 ty’’ does not include— 

21 (i) a covered entity, as defined in sec22 tion 160.103 of title 45, Code of Federal 

23 Regulations; 

24 (ii) a business associate, as defined in 

25 section 160.103 of title 45, Code of Federal 


sradovich on DSK3GMQ082PROD with BILLS
25 

•HR 1770 RH

1 Regulations, acting in its capacity as a 

2 business associate; 

3 (iii) if a covered entity, as defined in 

4 section 160.103 of title 45, Code of Federal 

5 Regulations, is a hybrid entity, as defined 

6 in section 164.105 of title 45, Code of Fed7 eral Regulations, then the health care com8 ponent of such hybrid entity; 

9 (iv) a broker, dealer, investment ad10 viser, futures commission merchant, special 

11 purpose vehicle, finance company, or person 

12 engaged in providing insurance that is sub13 ject to title V of Public Law 106-102 (15 

14 U.S.C. 6801 et seq.); 

15 (v) a State-chartered credit union, as 

16 defined in section 101(6) of the Federal 

17 Credit Union Act (12 U.S.C. 1752(6)), that 

18 is not an insured credit union as defined in 

19 section 101(7) of such Act (12 U.S.C. 

20 1752(7)); or 

21 (vi) a credit union service organization 

22 as outlined in section 106(7)(I) of the Fed23 eral Credit Union Act (12 U.S.C. 

24 1757(7)(I)). 


sradovich on DSK3GMQ082PROD with BILLS
26 

•HR 1770 RH

1 (6) DATA IN ELECTRONIC FORM.—The term 

2 ‘‘data in electronic form’’ means any data stored elec3 tronically or digitally on any computer system or 

4 other database and includes recordable tapes and 

5 other mass storage devices. 

6 (7) ENCRYPTED.—The term ‘‘encrypted’’, used 

7 with respect to data in electronic form, in storage or 

8 in transit— 

9 (A) means the data is protected using an 

10 encryption technology that has been generally ac11 cepted by experts in the field of information se12 curity at the time the breach of security occurred 

13 that renders such data indecipherable in the ab14 sence of associated cryptographic keys necessary 

15 to enable decryption of such data; and 

16 (B) includes appropriate management and 

17 safeguards of such cryptographic keys in order to 

18 protect the integrity of the encryption. 

19 (8) NON-BREACHED COVERED ENTITY.—The 

20 term ‘‘non-breached covered entity’’ means a covered 

21 entity that has not incurred the breach of security in22 volving data in electronic form containing personal 

23 information that it owns or licenses but whose data 

24 has been affected by the breach of security incurred by 

25 a breached covered entity it directly contracts to 


sradovich on DSK3GMQ082PROD with BILLS
27 

•HR 1770 RH

1 maintain, store, or process data in electronic form 

2 containing personal information on behalf of the non3 breached covered entity. 

4 (9) NON-PROFIT ORGANIZATION.—The term 

5 ‘‘non-profit organization’’ means an organization 

6 that is described in section 501(c)(3) of the Internal 

7 Revenue Code of 1986 and exempt from tax under sec8 tion 501(a) of such Code. 

9 (10) PERSONAL INFORMATION.— 

10 (A) IN GENERAL.—The term ‘‘personal in11 formation’’ means any information or compila12 tion of information in electronic form that in13 cludes the following: 

14 (i) An individual’s first and last name 

15 or first initial and last name in combina16 tion with all of the following: 

17 (I) Home address or telephone 

18 number. 

19 (II) Mother’s maiden name, if 

20 identified as such. 

21 (III) Month, day, and year of 

22 birth. 

23 (ii) A financial account number or 

24 credit or debit card number or other identi25 fier, in combination with any security code, 


sradovich on DSK3GMQ082PROD with BILLS
28 

•HR 1770 RH

1 access code, or password that is required for 

2 an individual to obtain credit, withdraw 

3 funds, or engage in a financial transaction. 

4 (iii) A unique account identifier (other 

5 than for an account described in clause 

6 (ii)), electronic identification number, bio7 metric data unique to an individual, user 

8 name, or routing code in combination with 

9 any associated security code, access code, bi10 ometric data unique to an individual, or 

11 password that is required for an individual 

12 to obtain money, or purchase goods, serv13 ices, or any other thing of value. 

14 (iv) A non-truncated social security 

15 number. 

16 (v) Any information that pertains to 

17 the transmission of specific calls, including, 

18 for outbound calls, the number called, and 

19 the time, location, or duration of any call 

20 and, for inbound calls, the number from 

21 which the call was placed, and the time, lo22 cation, or duration of any call. 

23 (vi) A user name or email address, in 

24 combination with a password or security 


sradovich on DSK3GMQ082PROD with BILLS
29 

•HR 1770 RH

1 question and answer that would permit ac2 cess to an online account. 

3 (vii) A driver’s license number, pass4 port number, or alien registration number 

5 or other government-issued unique identi6 fication number. 

7 (B) EXCEPTIONS.—The term ‘‘personal in8 formation’’ does not include— 

9 (i) information that is encrypted or 

10 rendered unusable, unreadable, or indeci11 pherable through data security technology or 

12 methodology that is generally accepted by 

13 experts in the field of information security 

14 at the time the breach of security occurred, 

15 such as redaction or access controls; or 

16 (ii) information available in a pub17 licly available source, including informa18 tion obtained from a news report, peri19 odical, or other widely distributed media, or 

20 from Federal, State, or local government 

21 records. 

22 (11) SERVICE PROVIDER.—The term ‘‘service 

23 provider’’ means a covered entity subject to the Com24 munications Act of 1934 (47 U.S.C. 151 et seq.) that 

25 provides electronic data transmission, routing, interVerDate Sep 11 2014 21:52 Jan 03, 2017 Jkt 069200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6203 E:\BILLS\H1770.RH H1770

sradovich on DSK3GMQ082PROD with BILLS
30 

•HR 1770 RH

1 mediate and transient storage, or connection to its 

2 system or network, where such entity providing such 

3 service does not select or modify the content of the 

4 electronic data, is not the sender or the intended re5 cipient of the data, and does not differentiate personal 

6 information from other information that such entity 

7 transmits, routes, stores, or for which such entity pro8 vides connections. Any such entity shall be treated as 

9 a service provider under this Act only to the extent 

10 that it is engaged in the provision of such trans11 mission, routing, intermediate and transient storage, 

12 or connections. 

13 (12) SMALL BUSINESS CONCERN.—The term 

14 ‘‘small business concern’’ has the meaning given such 

15 term under section 3 of the Small Business Act (15 

16 U.S.C. 632). 

17 (13) STATE.—The term ‘‘State’’ means each of 

18 the several States, the District of Columbia, the Com19 monwealth of Puerto Rico, Guam, American Samoa, 

20 the Virgin Islands of the United States, the Common21 wealth of the Northern Mariana Islands, any other 

22 territory or possession of the United States, and each 

23 federally recognized Indian tribe. 


sradovich on DSK3GMQ082PROD with BILLS
31 

•HR 1770 RH

1 SEC. 6. EFFECT ON OTHER LAWS. 

2 (a) PREEMPTION OF STATE INFORMATION SECURITY

3 LAWS.—No State or political subdivision of a State shall, 

4 with respect to a covered entity subject to this Act, adopt, 

5 maintain, enforce, or impose or continue in effect any law, 

6 rule, regulation, duty, requirement, standard, or other pro7 vision having the force and effect of law relating to or with 

8 respect to the security of data in electronic form or notifica9 tion following a security breach of such data. 

10 (b) COMMON LAW.—This section shall not exempt a 

11 covered entity from liability under common law. 

12 (c) CERTAIN FTC ENFORCEMENT LIMITED TO DATA

13 SECURITY AND BREACH NOTIFICATION.— 

14 (1) DATA SECURITY AND BREACH NOTIFICA15 TION.—Insofar as sections 201, 202, 222, 338, and 

16 631 of the Communications Act of 1934 (47 U.S.C. 

17 201, 202, 222, 338, and 551), and any regulations 

18 promulgated thereunder, apply to covered entities 

19 with respect to securing information in electronic 

20 form from unauthorized access and acquisition, in21 cluding notification of unauthorized access and acqui22 sition to data in electronic form containing personal 

23 information, such sections and regulations promul24 gated thereunder shall have no force or effect, unless 

25 such regulations pertain solely to 9–1–1 calls. 


sradovich on DSK3GMQ082PROD with BILLS
32 

•HR 1770 RH

1 (2) RULE OF CONSTRUCTION.—Nothing in this 

2 subsection otherwise limits the Federal Communica3 tions Commission’s authority with respect to sections 

4 201, 202, 222, 338, and 631 of the Communications 

5 Act of 1934 (47 U.S.C. 201, 202, 222, 338, and 551). 

6 (d) PRESERVATION OF COMMISSION AUTHORITY.— 

7 Nothing in this Act may be construed in any way to limit 

8 or affect the Commission’s authority under any other provi9 sion of law. 

10 SEC. 7. EDUCATION AND OUTREACH FOR SMALL BUSI11 NESSES. 

12 The Commission shall conduct education and outreach 

13 for small business concerns on data security practices and 

14 how to prevent hacking and other unauthorized access to, 

15 acquisition of, or use of data maintained by such small 

16 business concerns. 

17 SEC. 8. WEBSITE ON DATA SECURITY BEST PRACTICES. 

18 The Commission shall establish and maintain an 

19 Internet website containing non-binding best practices for 

20 businesses regarding data security and how to prevent hack21 ing and other unauthorized access to, acquisition of, or use 

22 of data maintained by such businesses. 

23 SEC. 9. EFFECTIVE DATE. 

24 This Act shall take effect 1 year after the date of enact25 ment of this Act. 


sradovich on DSK3GMQ082PROD with BILLS

sradovich on DSK3GMQ082PROD with BILLS
Union Calendar No. 719 

114TH CONGRESS 

2D SESSION H. R. 1770 

[Report No. 114–908] 

A BILL 

To require certain entities who collect and maintain 

volving such information, and for other purposes. individuals in the case of a breach of security insuch information and to provide notice to such personal information of individuals to secure 

JANUARY 3, 2017 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


sradovich on DSK3GMQ082PROD with BILLS