I 

115TH CONGRESS 

2D SESSION H. R. 5165 

To prohibit entities from requiring individuals to submit to arbitration for 

disputes arising from a security breach, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 5, 2018 

Mr. TED LIEU of California introduced the following bill; which was referred 

to the Committee on Energy and Commerce 

A BILL 

To prohibit entities from requiring individuals to submit to 

arbitration for disputes arising from a security breach, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Ending Forced Arbi5 tration for Victims of Data Breaches Act of 2018’’. 

6 SEC. 2. PROTECTION OF DATA SECURITY BREACH VICTIMS. 

7 An entity may not require, as part of a customer or 

8 other similar agreement, an individual to agree to submit 

9 any dispute related to a security breach, including any dis10 pute related to identity theft, to arbitration. 


amozie on DSK30RV082PROD with BILLS
2 

•HR 5165 IH

1 SEC. 3. APPLICABILITY. 

2 A provision of an agreement entered into prior to the 

3 date of the enactment of this Act, that violates section 

4 2, is void. 

5 SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMIS6 SION. 

7 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

8 A violation of section 2 shall be treated as an unfair and 

9 deceptive act or practice in violation of a regulation under 

10 section 18(a)(1)(B) of the Federal Trade Commission Act 

11 (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive 

12 acts or practices. 

13 (b) POWERS OF COMMISSION.—The Commission 

14 shall enforce this Act in the same manner, by the same 

15 means, and with the same jurisdiction, powers, and duties 

16 as though all applicable terms and provisions of the Fed17 eral Trade Commission Act (15 U.S.C. 41 et seq.) were 

18 incorporated into and made a part of this Act. Any person 

19 who violates section 2 shall be subject to the penalties and 

20 entitled to the privileges and immunities provided in that 

21 Act. 

22 (c) RULES.—The Commission shall promulgate, 

23 under section 553 of title 5, United States Code, such 

24 rules as may be necessary to carry out the provisions of 

25 this Act. 


amozie on DSK30RV082PROD with BILLS
3 

•HR 5165 IH

1 SEC. 5. ENFORCEMENT BY STATES. 

2 (a) IN GENERAL.—If the attorney general of a State 

3 has reason to believe that an interest of the residents of 

4 the State has been or is being threatened or adversely af5 fected by a practice that violates section 2, the attorney 

6 general of the State may, as parens patriae, bring a civil 

7 action on behalf of the residents of the State in an appro8 priate district court of the United States to obtain appro9 priate relief. 

10 (b) RIGHTS OF FEDERAL TRADE COMMISSION.— 

11 (1) NOTICE TO FEDERAL TRADE COMMIS12 SION.— 

13 (A) IN GENERAL.—Except as provided in 

14 clause (iii), the attorney general of a State, be15 fore initiating a civil action under paragraph 

16 (1), shall provide written notification to the 

17 Federal Trade Commission that the attorney 

18 general intends to bring such civil action. 

19 (B) CONTENTS.—The notification required 

20 under clause (i) shall include a copy of the com21 plaint to be filed to initiate the civil action. 

22 (C) EXCEPTION.—If it is not feasible for 

23 the attorney general of a State to provide the 

24 notification required under clause (i) before ini25 tiating a civil action under paragraph (1), the 


amozie on DSK30RV082PROD with BILLS
4 

•HR 5165 IH

1 attorney general shall notify the Commission 

2 immediately upon instituting the civil action. 

3 (2) INTERVENTION BY FEDERAL TRADE COM4 MISSION.—The Commission may— 

5 (A) intervene in any civil action brought by 

6 the attorney general of a State under para7 graph (1); and 

8 (B) upon intervening— 

9 (i) be heard on all matters arising in 

10 the civil action; and 

11 (ii) file petitions for appeal of a deci12 sion in the civil action. 

13 (c) INVESTIGATORY POWERS.—Nothing in this sub14 section may be construed to prevent the attorney general 

15 of a State from exercising the powers conferred on the 

16 attorney general by the laws of the State to conduct inves17 tigations, to administer oaths or affirmations, or to compel 

18 the attendance of witnesses or the production of documen19 tary or other evidence. 

20 (d) PREEMPTIVE ACTION BY FEDERAL TRADE COM21 MISSION.—If the Federal Trade Commission institutes a 

22 civil action or an administrative action with respect to a 

23 violation of section 2, the attorney general of a State may 

24 not, during the pendency of such action, bring a civil ac25 tion under paragraph (1) against any defendant named 


amozie on DSK30RV082PROD with BILLS
5 

•HR 5165 IH

1 in the complaint of the Commission for the violation with 

2 respect to which the Commission instituted such action. 

3 (e) VENUE; SERVICE OF PROCESS.— 

4 (1) VENUE.—Any action brought under para5 graph (1) may be brought in— 

6 (A) the district court of the United States 

7 that meets applicable requirements relating to 

8 venue under section 1391 of title 28, United 

9 States Code; or 

10 (B) another court of competent jurisdic11 tion. 

12 (2) SERVICE OF PROCESS.—In an action 

13 brought under paragraph (1), process may be served 

14 in any district in which— 

15 (A) the defendant is an inhabitant, may be 

16 found, or transacts business; or 

17 (B) venue is proper under section 1391 of 

18 title 28, United States Code. 

19 SEC. 6. PRIVATE RIGHT OF ACTION. 

20 (a) IN GENERAL.—An individual who is injured by 

21 a violation of section 2 may bring a private right of action 

22 in any court of appropriate jurisdiction for rescission and 

23 restitution, as well as for all damages and may be awarded 

24 injunctive relief against a violation of such section. The 

25 individual shall also be entitled to recover its costs of litiVerDate Sep 11 2014 21:46 Mar 09, 2018 Jkt 079200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H5165.IH H5165

amozie on DSK30RV082PROD with BILLS
6 

•HR 5165 IH

1 gation and reasonable attorney’s fees and expert witness 

2 fees, against any entity or person found to be liable for 

3 such violation. 

4 (b) LIABILITY.—Every person who directly or indi5 rectly controls a person liable under subsection (a), every 

6 partner in a firm so liable, every principal executive officer 

7 or director of a corporation so liable, every person occu8 pying a similar status or performing similar functions and 

9 every employee of a person so liable who materially aids 

10 in the act or transaction constituting the violation is also 

11 liable jointly and severally with and to the same extent 

12 as such person, unless the person who would otherwise be 

13 liable hereunder had no knowledge of or reasonable 

14 grounds to know of the existence of the facts by reason 

15 of which the liability is alleged to exist. 

16 (c) STATUTE OF LIMITATIONS.—No action may be 

17 commenced pursuant to this section more than the later 

18 of— 

19 (1) 2 years after the date on which the violation 

20 occurs; or 

21 (2) 2 years after the date on which the violation 

22 is discovered or should have been discovered through 

23 exercise of reasonable diligence. 

24 (d) VENUE.—An action under this section may be 

25 brought in— 


amozie on DSK30RV082PROD with BILLS
7 

•HR 5165 IH

1 (1) the district court of the United States that 

2 meets applicable requirements relating to venue 

3 under section 1391 of title 28, United States Code; 

4 or 

5 (2) another court of competent jurisdiction. 

6 (e) CUMULATIVE RIGHT.—The private rights pro7 vided for in this section are in addition to and not in lieu 

8 of other rights or remedies created by Federal or State 

9 law. 

10 SEC. 7. DEFINITIONS. 

11 In this Act— 

12 (1) the term ‘‘security breach’’— 

13 (A) means a compromise of the security, 

14 confidentiality, or integrity of, or the loss of, 

15 computerized data that results in, or there is a 

16 reasonable basis to conclude has resulted in— 

17 (i) the unauthorized acquisition of 

18 sensitive personally identifiable informa19 tion; or 

20 (ii) access to sensitive personally iden21 tifiable information that is for an unau22 thorized purpose, or in excess of authoriza23 tion; 

24 (B) does not include any lawfully author25 ized investigative, protective, or intelligence acVerDate Sep 11 2014 21:46 Mar 09, 2018 Jkt 079200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H5165.IH H5165

amozie on DSK30RV082PROD with BILLS
8 

•HR 5165 IH

1 tivity of a law enforcement agency of the 

2 United States, a State, or a political subdivision 

3 of a State, or of an element of the intelligence 

4 community; and 

5 (2) the term ‘‘sensitive personally identifiable 

6 information’’ means any information or compilation 

7 of information, in electronic or digital form that in8 cludes one or more of the following: 

9 (A) An individual’s first and last name or 

10 first initial and last name in combination with 

11 any two of the following data elements: 

12 (i) Home address or telephone num13 ber. 

14 (ii) Mother’s maiden name. 

15 (iii) Month, day, and year of birth. 

16 (B) A Social Security number (but not in17 cluding only the last four digits of a Social Se18 curity number), driver’s license number, pass19 port number, or alien registration number or 

20 other Government-issued unique identification 

21 number. 

22 (C) Unique biometric data such as a finger 

23 print, voice print, a retina or iris image, or any 

24 other unique physical representation. 


amozie on DSK30RV082PROD with BILLS
9 

•HR 5165 IH

1 (D) A unique account identifier, including 

2 a financial account number or credit or debit 

3 card number, electronic identification number, 

4 user name, or routing code. 

5 (E) A user name or electronic mail ad6 dress, in combination with a password or secu7 rity question and answer that would permit ac8 cess to an online account. 

9 (F) Any combination of the following data 

10 elements: 

11 (i) An individual’s first and last name 

12 or first initial and last name. 

13 (ii) A unique account identifier, in14 cluding a financial account number or 

15 credit or debit card number, electronic 

16 identification number, user name, or rout17 ing code. 

18 (iii) Any security code, access code, or 

19 password, or source code that could be 

20 used to generate such codes or passwords. 

Æ 


amozie on DSK30RV082PROD with BILLS