I 

113TH CONGRESS 

2D SESSION H. R. 4400 

To protect consumers by requiring reasonable security policies and procedures 

to protect data containing personal information, and to provide for nationwide notice in the event of a security breach. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 4, 2014 

Mr. RUSH (for himself, Mr. BARTON, Mr. CICILLINE, Mr. LIPINSKI, Mr. 

MCNERNEY, and Ms. SCHAKOWSKY) introduced the following bill; which 

was referred to the Committee on Energy and Commerce 

A BILL 

To protect consumers by requiring reasonable security policies and procedures to protect data containing personal 

information, and to provide for nationwide notice in the 

event of a security breach. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Accountability 

5 and Trust Act’’. 

6 SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 

7 (a) GENERAL SECURITY POLICIES AND PROCE8 DURES.— 


rfrederick on DSK6VPTVN1PROD with BILLS
2 

•HR 4400 IH

1 (1) REGULATIONS.—Not later than 1 year after 

2 the date of enactment of this Act, the Commission 

3 shall promulgate regulations under section 553 of 

4 title 5, United States Code, to require each person 

5 engaged in interstate commerce that owns or pos6 sesses data containing personal information, or con7 tracts to have any third party entity maintain such 

8 data for such person, to establish and implement 

9 policies and procedures regarding information secu10 rity practices for the treatment and protection of 

11 personal information taking into consideration— 

12 (A) the size of, and the nature, scope, and 

13 complexity of the activities engaged in by, such 

14 person; 

15 (B) the current state of the art in adminis16 trative, technical, and physical safeguards for 

17 protecting such information; and 

18 (C) the cost of implementing such safe19 guards. 

20 (2) REQUIREMENTS.—Such regulations shall 

21 require the policies and procedures to include the 

22 following: 

23 (A) A security policy with respect to the 

24 collection, use, sale, other dissemination, and 

25 maintenance of such personal information. 


rfrederick on DSK6VPTVN1PROD with BILLS
3 

•HR 4400 IH

1 (B) The identification of an officer or 

2 other individual as the point of contact with re3 sponsibility for the management of information 

4 security. 

5 (C) A process for identifying and assessing 

6 any reasonably foreseeable vulnerabilities in the 

7 system or systems maintained by such person 

8 that contains such data, which shall include 

9 regular monitoring for a breach of security of 

10 such system or systems. 

11 (D) A process for taking preventive and 

12 corrective action to mitigate against any 

13 vulnerabilities identified in the process required 

14 by subparagraph (C), which may include imple15 menting any changes to security practices and 

16 the architecture, installation, or implementation 

17 of network or operating software. 

18 (E) A process for disposing of data in elec19 tronic form containing personal information by 

20 shredding, permanently erasing, or otherwise 

21 modifying the personal information contained in 

22 such data to make such personal information 

23 permanently unreadable or undecipherable. 


rfrederick on DSK6VPTVN1PROD with BILLS
4 

•HR 4400 IH

1 (F) A standard method or methods for the 

2 destruction of paper documents and other non3 electronic data containing personal information. 

4 (3) TREATMENT OF ENTITIES GOVERNED BY

5 OTHER LAW.—Any person who is in compliance with 

6 any other Federal law that requires such person to 

7 maintain standards and safeguards for information 

8 security and protection of personal information that, 

9 taken as a whole and as the Commission shall deter10 mine in the rulemaking required under paragraph 

11 (1), provide protections substantially similar to, or 

12 greater than, those required under this subsection, 

13 shall be deemed to be in compliance with this sub14 section. 

15 (b) SPECIAL REQUIREMENTS FOR INFORMATION

16 BROKERS.— 

17 (1) SUBMISSION OF POLICIES TO THE FTC.— 

18 The regulations promulgated under subsection (a) 

19 shall require each information broker to submit its 

20 security policies to the Commission in conjunction 

21 with a notification of a breach of security under sec22 tion 3 or upon request of the Commission. 

23 (2) POST-BREACH AUDIT.—For any information 

24 broker required to provide notification under section 

25 3, the Commission may conduct audits of the inforVerDate Mar 15 2010 01:55 Apr 08, 2014 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H4400.IH H4400

rfrederick on DSK6VPTVN1PROD with BILLS
5 

•HR 4400 IH

1 mation security practices of such information broker, 

2 or require the information broker to conduct inde3 pendent audits of such practices (by an independent 

4 auditor who has not audited such information bro5 ker’s security practices during the preceding 5 

6 years). 

7 (3) ACCURACY OF AND INDIVIDUAL ACCESS TO

8 PERSONAL INFORMATION.— 

9 (A) ACCURACY.— 

10 (i) IN GENERAL.—Each information 

11 broker shall establish reasonable proce12 dures to assure the maximum possible ac13 curacy of the personal information it col14 lects, assembles, or maintains, and any 

15 other information it collects, assembles, or 

16 maintains that specifically identifies an in17 dividual, other than information which 

18 merely identifies an individual’s name or 

19 address. 

20 (ii) LIMITED EXCEPTION FOR FRAUD

21 DATABASES.—The requirement in clause 

22 (i) shall not prevent the collection or main23 tenance of information that may be inac24 curate with respect to a particular indiVerDate Mar 15 2010 01:55 Apr 08, 2014 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H4400.IH H4400

rfrederick on DSK6VPTVN1PROD with BILLS
6 

•HR 4400 IH

1 vidual when that information is being col2 lected or maintained solely— 

3 (I) for the purpose of indicating 

4 whether there may be a discrepancy 

5 or irregularity in the personal infor6 mation that is associated with an indi7 vidual; and 

8 (II) to help identify, or authen9 ticate the identity of, an individual, or 

10 to protect against or investigate fraud 

11 or other unlawful conduct. 

12 (B) CONSUMER ACCESS TO INFORMA13 TION.— 

14 (i) ACCESS.—Each information broker 

15 shall— 

16 (I) provide to each individual 

17 whose personal information it main18 tains, at the individual’s request at 

19 least 1 time per year and at no cost 

20 to the individual, and after verifying 

21 the identity of such individual, a 

22 means for the individual to review any 

23 personal information regarding such 

24 individual maintained by the informa25 tion broker and any other information 


rfrederick on DSK6VPTVN1PROD with BILLS
7 

•HR 4400 IH

1 maintained by the information broker 

2 that specifically identifies such indi3 vidual, other than information which 

4 merely identifies an individual’s name 

5 or address; and 

6 (II) place a conspicuous notice on 

7 its Internet website (if the informa8 tion broker maintains such a website) 

9 instructing individuals how to request 

10 access to the information required to 

11 be provided under subclause (I), and, 

12 as applicable, how to express a pref13 erence with respect to the use of per14 sonal information for marketing pur15 poses under clause (iii). 

16 (ii) DISPUTED INFORMATION.—When17 ever an individual whose information the 

18 information broker maintains makes a 

19 written request disputing the accuracy of 

20 any such information, the information 

21 broker, after verifying the identity of the 

22 individual making such request and unless 

23 there are reasonable grounds to believe 

24 such request is frivolous or irrelevant, 

25 shall— 


rfrederick on DSK6VPTVN1PROD with BILLS
8 

•HR 4400 IH

1 (I) correct any inaccuracy; or 

2 (II)(aa) in the case of informa3 tion that is public record information, 

4 inform the individual of the source of 

5 the information, and, if reasonably 

6 available, where a request for correc7 tion may be directed and, if the indi8 vidual provides proof that the public 

9 record has been corrected or that the 

10 information broker was reporting the 

11 information incorrectly, correct the in12 accuracy in the information broker’s 

13 records; or 

14 (bb) in the case of information 

15 that is non-public information, note 

16 the information that is disputed, in17 cluding the individual’s statement dis18 puting such information, and take 

19 reasonable steps to independently 

20 verify such information under the pro21 cedures outlined in subparagraph (A) 

22 if such information can be independ23 ently verified. 

24 (iii) ALTERNATIVE PROCEDURE FOR

25 CERTAIN MARKETING INFORMATION.—In 


rfrederick on DSK6VPTVN1PROD with BILLS
9 

•HR 4400 IH

1 accordance with regulations issued under 

2 clause (v), an information broker that 

3 maintains any information described in 

4 clause (i) which is used, shared, or sold by 

5 such information broker for marketing 

6 purposes, may, in lieu of complying with 

7 the access and dispute requirements set 

8 forth in clauses (i) and (ii), provide each 

9 individual whose information it maintains 

10 with a reasonable means of expressing a 

11 preference not to have his or her informa12 tion used for such purposes. If the indi13 vidual expresses such a preference, the in14 formation broker may not use, share, or 

15 sell the individual’s information for mar16 keting purposes. 

17 (iv) LIMITATIONS.—An information 

18 broker may limit the access to information 

19 required under clause (i)(I) and is not re20 quired to provide notice to individuals as 

21 required under clause (i)(II) in the fol22 lowing circumstances: 

23 (I) If access of the individual to 

24 the information is limited by law or 

25 legally recognized privilege. 


rfrederick on DSK6VPTVN1PROD with BILLS
10 

•HR 4400 IH

1 (II) If the information is used for 

2 a legitimate governmental or fraud 

3 prevention purpose that would be 

4 compromised by such access. 

5 (III) If the information consists 

6 of a published media record, unless 

7 that record has been included in a re8 port about an individual shared with a 

9 third party. 

10 (v) RULEMAKING.—Not later than 1 

11 year after the date of the enactment of this 

12 Act, the Commission shall promulgate reg13 ulations under section 553 of title 5, 

14 United States Code, to carry out this para15 graph and to facilitate the purposes of this 

16 Act. In addition, the Commission shall 

17 issue regulations, as necessary, under sec18 tion 553 of title 5, United States Code, on 

19 the scope of the application of the limita20 tions in clause (iv), including any addi21 tional circumstances in which an informa22 tion broker may limit access to information 

23 under such clause that the Commission de24 termines to be appropriate. 


rfrederick on DSK6VPTVN1PROD with BILLS
11 

•HR 4400 IH

1 (C) FCRA REGULATED PERSONS.—Any 

2 information broker who is engaged in activities 

3 subject to the Fair Credit Reporting Act and 

4 who is in compliance with sections 609, 610, 

5 and 611 of such Act (15 U.S.C. 1681g; 1681h; 

6 1681i) with respect to information subject to 

7 such Act, shall be deemed to be in compliance 

8 with this paragraph with respect to such infor9 mation. 

10 (4) REQUIREMENT OF AUDIT LOG OF ACCESSED

11 AND TRANSMITTED INFORMATION.—Not later than 

12 1 year after the date of the enactment of this Act, 

13 the Commission shall promulgate regulations under 

14 section 553 of title 5, United States Code, to require 

15 information brokers to establish measures which fa16 cilitate the auditing or retracing of any internal or 

17 external access to, or transmissions of, any data con18 taining personal information collected, assembled, or 

19 maintained by such information broker. 

20 (5) PROHIBITION ON PRETEXTING BY INFOR21 MATION BROKERS.— 

22 (A) PROHIBITION ON OBTAINING PER23 SONAL INFORMATION BY FALSE PRETENSES.— 

24 It shall be unlawful for an information broker 

25 to obtain or attempt to obtain, or cause to be 


rfrederick on DSK6VPTVN1PROD with BILLS
12 

•HR 4400 IH

1 disclosed or attempt to cause to be disclosed to 

2 any person, personal information or any other 

3 information relating to any person by— 

4 (i) making a false, fictitious, or fraud5 ulent statement or representation to any 

6 person; or 

7 (ii) providing any document or other 

8 information to any person that the infor9 mation broker knows or should know to be 

10 forged, counterfeit, lost, stolen, or fraudu11 lently obtained, or to contain a false, ficti12 tious, or fraudulent statement or represen13 tation. 

14 (B) PROHIBITION ON SOLICITATION TO

15 OBTAIN PERSONAL INFORMATION UNDER FALSE

16 PRETENSES.—It shall be unlawful for an infor17 mation broker to request a person to obtain 

18 personal information or any other information 

19 relating to any other person, if the information 

20 broker knew or should have known that the per21 son to whom such a request is made will obtain 

22 or attempt to obtain such information in the 

23 manner described in subparagraph (A). 

24 (c) EXEMPTION FOR CERTAIN SERVICE PRO25 VIDERS.—Nothing in this section shall apply to a service 


rfrederick on DSK6VPTVN1PROD with BILLS
13 

•HR 4400 IH

1 provider for any electronic communication by a third party 

2 that is transmitted, routed, or stored in intermediate or 

3 transient storage by such service provider. 

4 SEC. 3. NOTIFICATION OF INFORMATION SECURITY 

5 BREACH. 

6 (a) NATIONWIDE NOTIFICATION.—Any person en7 gaged in interstate commerce that owns or possesses data 

8 in electronic form containing personal information shall, 

9 following the discovery of a breach of security of the sys10 tem maintained by such person that contains such data— 

11 (1) notify each individual who is a citizen or 

12 resident of the United States whose personal infor13 mation was acquired or accessed as a result of such 

14 a breach of security; and 

15 (2) notify the Commission. 

16 (b) SPECIAL NOTIFICATION REQUIREMENTS.— 

17 (1) THIRD PARTY AGENTS.—In the event of a 

18 breach of security by any third party entity that has 

19 been contracted to maintain or process data in elec20 tronic form containing personal information on be21 half of any other person who owns or possesses such 

22 data, such third party entity shall be required to no23 tify such person of the breach of security. Upon re24 ceiving such notification from such third party, such 


rfrederick on DSK6VPTVN1PROD with BILLS
14 

•HR 4400 IH

1 person shall provide the notification required under 

2 subsection (a). 

3 (2) SERVICE PROVIDERS.—If a service provider 

4 becomes aware of a breach of security of data in 

5 electronic form containing personal information that 

6 is owned or possessed by another person that con7 nects to or uses a system or network provided by the 

8 service provider for the purpose of transmitting, 

9 routing, or providing intermediate or transient stor10 age of such data, such service provider shall be re11 quired to notify of such a breach of security only the 

12 person who initiated such connection, transmission, 

13 routing, or storage if such person can be reasonably 

14 identified. Upon receiving such notification from a 

15 service provider, such person shall provide the notifi16 cation required under subsection (a). 

17 (3) COORDINATION OF NOTIFICATION WITH

18 CONSUMER REPORTING AGENCIES.—If a person is 

19 required to provide notification to more than 5,000 

20 individuals under subsection (a)(1), the person shall 

21 also notify the major consumer reporting agencies of 

22 the timing and distribution of the notices. Such no23 tice shall be given to the consumer reporting agen24 cies without unreasonable delay and, if it will not 


rfrederick on DSK6VPTVN1PROD with BILLS
15 

•HR 4400 IH

1 delay notice to the affected individuals, prior to the 

2 distribution of notices to the affected individuals. 

3 (c) TIMELINESS OF NOTIFICATION.— 

4 (1) IN GENERAL.—Unless subject to a delay au5 thorized under paragraph (2), a notification required 

6 under subsection (a) shall be made not later than 60 

7 days following the discovery of a breach of security, 

8 unless the person providing notice can show that 

9 providing notice within such a time frame is not fea10 sible due to extraordinary circumstances necessary 

11 to prevent further breach or unauthorized disclo12 sures, and reasonably restore the integrity of the 

13 data system, in which case such notification shall be 

14 made as promptly as possible. 

15 (2) DELAY OF NOTIFICATION AUTHORIZED FOR

16 LAW ENFORCEMENT OR NATIONAL SECURITY PUR17 POSES.— 

18 (A) LAW ENFORCEMENT.—If a Federal, 

19 State, or local law enforcement agency deter20 mines that the notification required under this 

21 section would impede a civil or criminal inves22 tigation, such notification shall be delayed upon 

23 the written request of the law enforcement 

24 agency for 30 days or such lesser period of time 

25 which the law enforcement agency determines is 


rfrederick on DSK6VPTVN1PROD with BILLS
16 

•HR 4400 IH

1 reasonably necessary and requests in writing. A 

2 law enforcement agency may, by a subsequent 

3 written request, revoke such delay or extend the 

4 period of time set forth in the original request 

5 made under this paragraph if further delay is 

6 necessary. 

7 (B) NATIONAL SECURITY.—If a Federal 

8 national security agency or homeland security 

9 agency determines that the notification required 

10 under this section would threaten national or 

11 homeland security, such notification may be de12 layed for a period of time which the national se13 curity agency or homeland security agency de14 termines is reasonably necessary and requests 

15 in writing. A Federal national security agency 

16 or homeland security agency may revoke such 

17 delay or extend the period of time set forth in 

18 the original request made under this paragraph 

19 by a subsequent written request if further delay 

20 is necessary. 

21 (d) METHOD AND CONTENT OF NOTIFICATION.— 

22 (1) DIRECT NOTIFICATION.— 

23 (A) METHOD OF NOTIFICATION.—A person 

24 required to provide notification to individuals 

25 under subsection (a)(1) shall be in compliance 


rfrederick on DSK6VPTVN1PROD with BILLS
17 

•HR 4400 IH

1 with such requirement if the person provides 

2 conspicuous and clearly identified notification 

3 by one of the following methods (provided the 

4 selected method can reasonably be expected to 

5 reach the intended individual): 

6 (i) Written notification. 

7 (ii) Notification by email or other 

8 electronic means, if— 

9 (I) the person’s primary method 

10 of communication with the individual 

11 is by email or such other electronic 

12 means; or 

13 (II) the individual has consented 

14 to receive such notification and the 

15 notification is provided in a manner 

16 that is consistent with the provisions 

17 permitting electronic transmission of 

18 notices under section 101 of the Elec19 tronic Signatures in Global and Na20 tional Commerce Act (15 U.S.C. 

21 7001). 

22 (B) CONTENT OF NOTIFICATION.—Regard23 less of the method by which notification is pro24 vided to an individual under subparagraph (A), 

25 such notification shall include— 


rfrederick on DSK6VPTVN1PROD with BILLS
18 

•HR 4400 IH

1 (i) a description of the personal infor2 mation that was acquired or accessed by 

3 an unauthorized person; 

4 (ii) a telephone number that the indi5 vidual may use, at no cost to such indi6 vidual, to contact the person to inquire 

7 about the breach of security or the infor8 mation the person maintained about that 

9 individual; 

10 (iii) notice that the individual is enti11 tled to receive, at no cost to such indi12 vidual, consumer credit reports on a quar13 terly basis for a period of 2 years, or credit 

14 monitoring or other service that enables 

15 consumers to detect the misuse of their 

16 personal information for a period of 2 

17 years, and instructions to the individual on 

18 requesting such reports or service from the 

19 person, except when the only information 

20 which has been the subject of the security 

21 breach is the individual’s first name or ini22 tial and last name, or address, or phone 

23 number, in combination with a credit or 

24 debit card number, and any required secu25 rity code; 


rfrederick on DSK6VPTVN1PROD with BILLS
19 

•HR 4400 IH

1 (iv) the toll-free contact telephone 

2 numbers and addresses for the major con3 sumer reporting agencies; and 

4 (v) a toll-free telephone number and 

5 Internet website address for the Commis6 sion whereby the individual may obtain in7 formation regarding identity theft. 

8 (2) SUBSTITUTE NOTIFICATION.— 

9 (A) CIRCUMSTANCES GIVING RISE TO SUB10 STITUTE NOTIFICATION.—A person required to 

11 provide notification to individuals under sub12 section (a)(1) may provide substitute notifica13 tion in lieu of the direct notification required by 

14 paragraph (1) if the person owns or possesses 

15 data in electronic form containing personal in16 formation of fewer than 1,000 individuals and 

17 such direct notification is not feasible due to— 

18 (i) excessive cost to the person re19 quired to provide such notification relative 

20 to the resources of such person, as deter21 mined in accordance with the regulations 

22 issued by the Commission under paragraph 

23 (3)(A); or 


rfrederick on DSK6VPTVN1PROD with BILLS
20 

•HR 4400 IH

1 (ii) lack of sufficient contact informa2 tion for the individual required to be noti3 fied. 

4 (B) FORM OF SUBSTITUTE NOTIFICA5 TION.—Such substitute notification shall in6 clude— 

7 (i) email notification to the extent 

8 that the person has email addresses of in9 dividuals to whom it is required to provide 

10 notification under subsection (a)(1); 

11 (ii) a conspicuous notice on the Inter12 net website of the person (if such person 

13 maintains such a website); and 

14 (iii) notification in print and to broad15 cast media, including major media in met16 ropolitan and rural areas where the indi17 viduals whose personal information was ac18 quired reside. 

19 (C) CONTENT OF SUBSTITUTE NOTICE.— 

20 Each form of substitute notice under this para21 graph shall include— 

22 (i) notice that individuals whose per23 sonal information is included in the breach 

24 of security are entitled to receive, at no 

25 cost to the individuals, consumer credit reVerDate Mar 15 2010 01:55 Apr 08, 2014 Jkt 039200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\H4400.IH H4400

rfrederick on DSK6VPTVN1PROD with BILLS
21 

•HR 4400 IH

1 ports on a quarterly basis for a period of 

2 2 years, or credit monitoring or other serv3 ice that enables consumers to detect the 

4 misuse of their personal information for a 

5 period of 2 years, and instructions on re6 questing such reports or service from the 

7 person, except when the only information 

8 which has been the subject of the security 

9 breach is the individual’s first name or ini10 tial and last name, or address, or phone 

11 number, in combination with a credit or 

12 debit card number, and any required secu13 rity code; and 

14 (ii) a telephone number by which an 

15 individual can, at no cost to such indi16 vidual, learn whether that individual’s per17 sonal information is included in the breach 

18 of security. 

19 (3) REGULATIONS AND GUIDANCE.— 

20 (A) REGULATIONS.—Not later than 1 year 

21 after the date of enactment of this Act, the 

22 Commission shall, by regulation under section 

23 553 of title 5, United States Code, establish cri24 teria for determining circumstances under 

25 which substitute notification may be provided 


rfrederick on DSK6VPTVN1PROD with BILLS
22 

•HR 4400 IH

1 under paragraph (2), including criteria for de2 termining if notification under paragraph (1) is 

3 not feasible due to excessive costs to the person 

4 required to provided such notification relative to 

5 the resources of such person. Such regulations 

6 may also identify other circumstances where 

7 substitute notification would be appropriate for 

8 any person, including circumstances under 

9 which the cost of providing notification exceeds 

10 the benefits to consumers. 

11 (B) GUIDANCE.—In addition, the Commis12 sion shall provide and publish general guidance 

13 with respect to compliance with this subsection. 

14 Such guidance shall include— 

15 (i) a description of written or email 

16 notification that complies with the require17 ments of paragraph (1); and 

18 (ii) guidance on the content of sub19 stitute notification under paragraph (2), 

20 including the extent of notification to print 

21 and broadcast media that complies with 

22 the requirements of such paragraph. 

23 (e) OTHER OBLIGATIONS FOLLOWING BREACH.— 

24 (1) IN GENERAL.—A person required to provide 

25 notification under subsection (a) shall, upon request 


rfrederick on DSK6VPTVN1PROD with BILLS
23 

•HR 4400 IH

1 of an individual whose personal information was in2 cluded in the breach of security, provide or arrange 

3 for the provision of, to each such individual and at 

4 no cost to such individual— 

5 (A) consumer credit reports from at least 

6 one of the major consumer reporting agencies 

7 beginning not later than 60 days following the 

8 individual’s request and continuing on a quar9 terly basis for a period of 2 years thereafter; or 

10 (B) a credit monitoring or other service 

11 that enables consumers to detect the misuse of 

12 their personal information, beginning not later 

13 than 60 days following the individual’s request 

14 and continuing for a period of 2 years. 

15 (2) LIMITATION.—This subsection shall not 

16 apply if the only personal information which has 

17 been the subject of the security breach is the individ18 ual’s first name or initial and last name, or address, 

19 or phone number, in combination with a credit or 

20 debit card number, and any required security code. 

21 (3) RULEMAKING.—As part of the Commis22 sion’s rulemaking described in subsection (d)(3), the 

23 Commission shall determine the circumstances under 

24 which a person required to provide notification 

25 under subsection (a)(1) shall provide or arrange for 


rfrederick on DSK6VPTVN1PROD with BILLS
24 

•HR 4400 IH

1 the provision of free consumer credit reports or cred2 it monitoring or other service to affected individuals. 

3 (f) EXEMPTION.— 

4 (1) GENERAL EXEMPTION.—A person shall be 

5 exempt from the requirements under this section if, 

6 following a breach of security, such person deter7 mines that there is no reasonable risk of identity 

8 theft, fraud, or other unlawful conduct. 

9 (2) PRESUMPTION.— 

10 (A) IN GENERAL.—If the data in electronic 

11 form containing personal information is ren12 dered unusable, unreadable, or indecipherable 

13 through encryption or other security technology 

14 or methodology (if the method of encryption or 

15 such other technology or methodology is gen16 erally accepted by experts in the information se17 curity field), there shall be a presumption that 

18 no reasonable risk of identity theft, fraud, or 

19 other unlawful conduct exists following a breach 

20 of security of such data. Any such presumption 

21 may be rebutted by facts demonstrating that 

22 the encryption or other security technologies or 

23 methodologies in a specific case, have been or 

24 are reasonably likely to be compromised. 


rfrederick on DSK6VPTVN1PROD with BILLS
25 

•HR 4400 IH

1 (B) METHODOLOGIES OR TECH2 NOLOGIES.—Not later than 1 year after the 

3 date of the enactment of this Act and bian4 nually thereafter, the Commission shall issue 

5 rules (pursuant to section 553 of title 5, United 

6 States Code) or guidance to identify security 

7 methodologies or technologies which render data 

8 in electronic form unusable, unreadable, or in9 decipherable, that shall, if applied to such data, 

10 establish a presumption that no reasonable risk 

11 of identity theft, fraud, or other unlawful con12 duct exists following a breach of security of 

13 such data. Any such presumption may be rebut14 ted by facts demonstrating that any such meth15 odology or technology in a specific case has 

16 been or is reasonably likely to be compromised. 

17 In issuing such rules or guidance, the Commis18 sion shall consult with relevant industries, con19 sumer organizations, and data security and 

20 identity theft prevention experts and established 

21 standards setting bodies. 

22 (3) FTC GUIDANCE.—Not later than 1 year 

23 after the date of the enactment of this Act the Com24 mission shall issue guidance regarding the applica25 tion of the exemption in paragraph (1). 


rfrederick on DSK6VPTVN1PROD with BILLS
26 

•HR 4400 IH

1 (g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS2 SION.—If the Commission, upon receiving notification of 

3 any breach of security that is reported to the Commission 

4 under subsection (a)(2), finds that notification of such a 

5 breach of security via the Commission’s Internet website 

6 would be in the public interest or for the protection of 

7 consumers, the Commission shall place such a notice in 

8 a clear and conspicuous location on its Internet website. 

9 (h) FTC STUDY ON NOTIFICATION IN LANGUAGES

10 IN ADDITION TO ENGLISH.—Not later than 1 year after 

11 the date of enactment of this Act, the Commission shall 

12 conduct a study on the practicality and cost effectiveness 

13 of requiring the notification required by subsection (d)(1) 

14 to be provided in a language in addition to English to indi15 viduals known to speak only such other language. 

16 (i) GENERAL RULEMAKING AUTHORITY.—The Com17 mission may promulgate regulations necessary under sec18 tion 553 of title 5, United States Code, to effectively en19 force the requirements of this section. 

20 (j) TREATMENT OF PERSONS GOVERNED BY OTHER

21 LAW.—A person who is in compliance with any other Fed22 eral law that requires such person to provide notification 

23 to individuals following a breach of security, and that, 

24 taken as a whole, provides protections substantially similar 

25 to, or greater than, those required under this section, as 


rfrederick on DSK6VPTVN1PROD with BILLS
27 

•HR 4400 IH

1 the Commission shall determine by rule (under section 

2 553 of title 5, United States Code), shall be deemed to 

3 be in compliance with this section. 

4 SEC. 4. APPLICATION AND ENFORCEMENT. 

5 (a) GENERAL APPLICATION.—The requirements of 

6 sections 2 and 3 shall only apply to those persons, partner7 ships, or corporations over which the Commission has au8 thority pursuant to section 5(a)(2) of the Federal Trade 

9 Commission Act (15 U.S.C. 45(a)(2)). 

10 (b) ENFORCEMENT BY THE FEDERAL TRADE COM11 MISSION.— 

12 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC13 TICES.—A violation of section 2 or 3 shall be treated 

14 as an unfair and deceptive act or practice in viola15 tion of a regulation under section 18(a)(1)(B) of the 

16 Federal Trade Commission Act (15 U.S.C. 

17 57a(a)(1)(B)) regarding unfair or deceptive acts or 

18 practices. 

19 (2) POWERS OF COMMISSION.—The Commis20 sion shall enforce this Act in the same manner, by 

21 the same means, and with the same jurisdiction, 

22 powers, and duties as though all applicable terms 

23 and provisions of the Federal Trade Commission Act 

24 (15 U.S.C. 41 et seq.) were incorporated into and 

25 made a part of this Act. Any person who violates 


rfrederick on DSK6VPTVN1PROD with BILLS
28 

•HR 4400 IH

1 such regulations shall be subject to the penalties and 

2 entitled to the privileges and immunities provided in 

3 that Act. 

4 (3) LIMITATION.—In promulgating rules under 

5 this Act, the Commission shall not require the de6 ployment or use of any specific products or tech7 nologies, including any specific computer software or 

8 hardware. 

9 (c) ENFORCEMENT BY STATE ATTORNEYS GEN10 ERAL.— 

11 (1) CIVIL ACTION.—In any case in which the 

12 attorney general of a State, or an official or agency 

13 of a State, has reason to believe that an interest of 

14 the residents of that State has been or is threatened 

15 or adversely affected by any person who violates sec16 tion 2 or 3 of this Act, the attorney general, official, 

17 or agency of the State, as parens patriae, may bring 

18 a civil action on behalf of the residents of the State 

19 in a district court of the United States of appro20 priate jurisdiction— 

21 (A) to enjoin further violation of such sec22 tion by the defendant; 

23 (B) to compel compliance with such sec24 tion; or 


rfrederick on DSK6VPTVN1PROD with BILLS
29 

•HR 4400 IH

1 (C) to obtain civil penalties in the amount 

2 determined under paragraph (2). 

3 (2) CIVIL PENALTIES.— 

4 (A) CALCULATION.— 

5 (i) TREATMENT OF VIOLATIONS OF

6 SECTION 2.—For purposes of paragraph 

7 (1)(C) with regard to a violation of section 

8 2, the amount determined under this para9 graph is the amount calculated by multi10 plying the number of days that a person is 

11 not in compliance with such section by an 

12 amount not greater than $11,000. 

13 (ii) TREATMENT OF VIOLATIONS OF

14 SECTION 3.—For purposes of paragraph 

15 (1)(C) with regard to a violation of section 

16 3, the amount determined under this para17 graph is the amount calculated by multi18 plying the number of violations of such 

19 section by an amount not greater than 

20 $11,000. Each failure to send notification 

21 as required under section 3 to a resident of 

22 the State shall be treated as a separate 

23 violation. 

24 (B) ADJUSTMENT FOR INFLATION.—Be25 ginning on the date that the Consumer Price 


rfrederick on DSK6VPTVN1PROD with BILLS
30 

•HR 4400 IH

1 Index is first published by the Bureau of Labor 

2 Statistics that is after 1 year after the date of 

3 enactment of this Act, and each year thereafter, 

4 the amounts specified in clauses (i) and (ii) of 

5 subparagraph (A) shall be increased by the per6 centage increase in the Consumer Price Index 

7 published on that date from the Consumer 

8 Price Index published the previous year. 

9 (C) MAXIMUM TOTAL LIABILITY.—Not10 withstanding the number of actions which may 

11 be brought against a person under this sub12 section, the maximum civil penalty for which 

13 any person may be liable under this subsection 

14 shall not exceed— 

15 (i) $5,000,000 for each violation of 

16 section 2; and 

17 (ii) $5,000,000 for all violations of 

18 section 3 resulting from a single breach of 

19 security. 

20 (3) INTERVENTION BY THE FTC.— 

21 (A) NOTICE AND INTERVENTION.—The 

22 State shall provide prior written notice of any 

23 action under paragraph (1) to the Commission 

24 and provide the Commission with a copy of its 

25 complaint, except in any case in which such 


rfrederick on DSK6VPTVN1PROD with BILLS
31 

•HR 4400 IH

1 prior notice is not feasible, in which case the 

2 State shall serve such notice immediately upon 

3 instituting such action. The Commission shall 

4 have the right— 

5 (i) to intervene in the action; 

6 (ii) upon so intervening, to be heard 

7 on all matters arising therein; and 

8 (iii) to file petitions for appeal. 

9 (B) LIMITATION ON STATE ACTION WHILE

10 FEDERAL ACTION IS PENDING.—If the Commis11 sion has instituted a civil action for violation of 

12 this Act, no State attorney general, or official 

13 or agency of a State, may bring an action under 

14 this subsection during the pendency of that ac15 tion against any defendant named in the com16 plaint of the Commission for any violation of 

17 this Act alleged in the complaint. 

18 (4) CONSTRUCTION.—For purposes of bringing 

19 any civil action under paragraph (1), nothing in this 

20 Act shall be construed to prevent an attorney gen21 eral of a State from exercising the powers conferred 

22 on the attorney general by the laws of that State 

23 to— 

24 (A) conduct investigations; 

25 (B) administer oaths or affirmations; or 


rfrederick on DSK6VPTVN1PROD with BILLS
32 

•HR 4400 IH

1 (C) compel the attendance of witnesses or 

2 the production of documentary and other evi3 dence. 

4 (d) AFFIRMATIVE DEFENSE FOR A VIOLATION OF

5 SECTION 3.— 

6 (1) IN GENERAL.—It shall be an affirmative de7 fense to an enforcement action brought under sub8 section (b), or a civil action brought under sub9 section (c), based on a violation of section 3, that all 

10 of the personal information contained in the data in 

11 electronic form that was acquired or accessed as a 

12 result of a breach of security of the defendant is 

13 public record information that is lawfully made 

14 available to the general public from Federal, State, 

15 or local government records and was acquired by the 

16 defendant from such records. 

17 (2) NO EFFECT ON OTHER REQUIREMENTS.— 

18 Nothing in this subsection shall be construed to ex19 empt any person from the requirement to notify the 

20 Commission of a breach of security as required 

21 under section 3(a). 

22 SEC. 5. DEFINITIONS. 

23 In this Act, the following definitions apply: 

24 (1) BREACH OF SECURITY.—The term ‘‘breach 

25 of security’’ means the unauthorized acquisition of 


rfrederick on DSK6VPTVN1PROD with BILLS
33 

•HR 4400 IH

1 data in electronic form containing personal informa2 tion. 

3 (2) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (3) CONSUMER REPORTING AGENCY.—The term 

6 ‘‘consumer reporting agency’’ has the meaning given 

7 the term ‘‘consumer reporting agency that compiles 

8 and maintains files on consumers on a nationwide 

9 basis’’ in section 603(p) of the Fair Credit Report10 ing Act (15 U.S.C. 1681a(p)). 

11 (4) DATA IN ELECTRONIC FORM.—The term 

12 ‘‘data in electronic form’’ means any data stored 

13 electronically or digitally on any computer system or 

14 other database and includes recordable tapes and 

15 other mass storage devices. 

16 (5) ENCRYPTION.—The term ‘‘encryption’’ 

17 means the protection of data in electronic form in 

18 storage or in transit using an encryption technology 

19 that has been adopted by an established standards 

20 setting body which renders such data indecipherable 

21 in the absence of associated cryptographic keys nec22 essary to enable decryption of such data. Such 

23 encryption must include appropriate management 

24 and safeguards of such keys to protect the integrity 

25 of the encryption. 


rfrederick on DSK6VPTVN1PROD with BILLS
34 

•HR 4400 IH

1 (6) IDENTITY THEFT.—The term ‘‘identity 

2 theft’’ means the unauthorized use of another per3 son’s personal information for the purpose of engag4 ing in commercial transactions under the name of 

5 such other person. 

6 (7) INFORMATION BROKER.—The term ‘‘infor7 mation broker’’— 

8 (A) means a commercial entity whose busi9 ness is to collect, assemble, or maintain per10 sonal information concerning individuals who 

11 are not current or former customers of such en12 tity in order to sell such information or provide 

13 access to such information to any nonaffiliated 

14 third party in exchange for consideration, 

15 whether such collection, assembly, or mainte16 nance of personal information is performed by 

17 the information broker directly, or by contract 

18 or subcontract with any other entity; and 

19 (B) does not include a commercial entity to 

20 the extent that such entity processes informa21 tion collected by and received from a non22 affiliated third party concerning individuals who 

23 are current or former customers or employees 

24 of such third party to enable such third party 


rfrederick on DSK6VPTVN1PROD with BILLS
35 

•HR 4400 IH

1 to (1) provide benefits for its employees or (2) 

2 directly transact business with its customers. 

3 (8) PERSONAL INFORMATION.— 

4 (A) DEFINITION.—The term ‘‘personal in5 formation’’ means an individual’s first name or 

6 initial and last name, or address, or phone 

7 number, in combination with any 1 or more of 

8 the following data elements for that individual: 

9 (i) Social Security number. 

10 (ii) Driver’s license number, passport 

11 number, military identification number, or 

12 other similar number issued on a govern13 ment document used to verify identity. 

14 (iii) Financial account number, or 

15 credit or debit card number, and any re16 quired security code, access code, or pass17 word that is necessary to permit access to 

18 an individual’s financial account. 

19 (B) MODIFIED DEFINITION BY RULE20 MAKING.—The Commission may, by rule pro21 mulgated under section 553 of title 5, United 

22 States Code, modify the definition of ‘‘personal 

23 information’’ under subparagraph (A)— 

24 (i) for the purpose of section 2 to the 

25 extent that such modification will not unVerDate Mar 15 2010 01:55 Apr 08, 2014 Jkt 039200 PO 00000 Frm 00035 Fmt 6652 Sfmt 6201 E:\BILLS\H4400.IH H4400

rfrederick on DSK6VPTVN1PROD with BILLS
36 

•HR 4400 IH

1 reasonably impede interstate commerce, 

2 and will accomplish the purposes of this 

3 Act; or 

4 (ii) for the purpose of section 3, to the 

5 extent that such modification is necessary 

6 to accommodate changes in technology or 

7 practices, will not unreasonably impede 

8 interstate commerce, and will accomplish 

9 the purposes of this Act. 

10 (9) PUBLIC RECORD INFORMATION.—The term 

11 ‘‘public record information’’ means information 

12 about an individual which has been obtained origi13 nally from records of a Federal, State, or local gov14 ernment entity that are available for public inspec15 tion. 

16 (10) NON-PUBLIC INFORMATION.—The term 

17 ‘‘non-public information’’ means information about 

18 an individual that is of a private nature and neither 

19 available to the general public nor obtained from a 

20 public record. 

21 (11) SERVICE PROVIDER.—The term ‘‘service 

22 provider’’ means an entity that provides to a user 

23 transmission, routing, intermediate and transient 

24 storage, or connections to its system or network, for 

25 electronic communications, between or among points 


rfrederick on DSK6VPTVN1PROD with BILLS
37 

•HR 4400 IH

1 specified by such user of material of the user’s 

2 choosing, without modification to the content of the 

3 material as sent or received. Any such entity shall 

4 be treated as a service provider under this Act only 

5 to the extent that it is engaged in the provision of 

6 such transmission, routing, intermediate and tran7 sient storage or connections. 

8 SEC. 6. EFFECT ON OTHER LAWS. 

9 (a) PREEMPTION OF STATE INFORMATION SECURITY

10 LAWS.—This Act supersedes any provision of a statute, 

11 regulation, or rule of a State or political subdivision of 

12 a State, with respect to those entities covered by the regu13 lations issued pursuant to this Act, that expressly— 

14 (1) requires information security practices and 

15 treatment of data containing personal information 

16 similar to any of those required under section 2; and 

17 (2) requires notification to individuals of a 

18 breach of security resulting in unauthorized access 

19 to or acquisition of data in electronic form con20 taining personal information. 

21 (b) ADDITIONAL PREEMPTION.— 

22 (1) IN GENERAL.—No person other than a per23 son specified in section 4(c) may bring a civil action 

24 under the laws of any State if such action is preVerDate Mar 15 2010 01:55 Apr 08, 2014 Jkt 039200 PO 00000 Frm 00037 Fmt 6652 Sfmt 6201 E:\BILLS\H4400.IH H4400

rfrederick on DSK6VPTVN1PROD with BILLS
38 

•HR 4400 IH

1 mised in whole or in part upon the defendant vio2 lating any provision of this Act. 

3 (2) PROTECTION OF CONSUMER PROTECTION

4 LAWS.—This subsection shall not be construed to 

5 limit the enforcement of any State consumer protec6 tion law by an attorney general of a State. 

7 (c) PROTECTION OF CERTAIN STATE LAWS.—This 

8 Act shall not be construed to preempt the applicability 

9 of— 

10 (1) State trespass, contract, or tort law; or 

11 (2) other State laws to the extent that those 

12 laws relate to acts of fraud. 

13 (d) PRESERVATION OF FTC AUTHORITY.—Nothing 

14 in this Act may be construed in any way to limit or affect 

15 the Commission’s authority under any other provision of 

16 law. 

17 SEC. 7. EFFECTIVE DATE. 

18 This Act shall take effect 1 year after the date of 

19 enactment of this Act. 

20 SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 

21 There is authorized to be appropriated to the Com22 mission $1,000,000 for each of fiscal years 2011 through 

23 2016 to carry out this Act. 

Æ 


rfrederick on DSK6VPTVN1PROD with BILLS