I 

110TH CONGRESS 

1ST SESSION H. R. 1685 

To protect information relating to consumers, to require notice of security 

breaches, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 26, 2007 

Mr. PRICE of Georgia introduced the following bill; which was referred to the 

Committee on Financial Services, and in addition to the Committees on 

Oversight and Government Reform and Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To protect information relating to consumers, to require 

notice of security breaches, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Security Act of 

5 2007’’. 

6 SEC. 2. DEFINITIONS. 

7 For purposes of this Act, the following definitions 

8 shall apply: 


hmoore on PROD1PC68 with HMBILLS
2 

•HR 1685 IH

1 (1) AFFILIATE.—The term ‘‘affiliate’’ means 

2 any company that controls, is controlled by, or is 

3 under common control with another company. 

4 (2) AGENCY.—The term ‘‘agency’’ has the same 

5 meaning given such term in section 551(1) of title 

6 5, United States Code. 

7 (3) BREACH OF DATA SECURITY.— 

8 (A) IN GENERAL.—The term ‘‘breach of 

9 data security’’ means the unauthorized acquisi10 tion of sensitive account information or sen11 sitive personal information. 

12 (B) EXCEPTION FOR DATA THAT IS NOT IN

13 USABLE FORM.— 

14 (i) IN GENERAL.—The term ‘‘breach 

15 of data security’’ does not include the un16 authorized acquisition of sensitive account 

17 information or sensitive personal informa18 tion that is maintained or communicated in 

19 a manner that is not usable— 

20 (I) to commit identity theft; or 

21 (II) to make fraudulent trans22 actions on financial accounts. 

23 (ii) RULE OF CONSTRUCTION.—For 

24 purposes of this subparagraph, information 

25 that is maintained or communicated in a 


hmoore on PROD1PC68 with HMBILLS
3 

•HR 1685 IH

1 manner that is not usable includes any in2 formation that is maintained or commu3 nicated in an encrypted, redacted, altered, 

4 edited, or coded form. 

5 (4) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (5) CONSUMER.—The term ‘‘consumer’’ means 

8 an individual. 

9 (6) CONSUMER REPORTING AGENCY THAT COM10 PILES AND MAINTAINS FILES ON CONSUMERS ON A

11 NATIONWIDE BASIS.—The term ‘‘consumer reporting 

12 agency that compiles and maintains files on con13 sumers on a nationwide basis’’ has the same mean14 ing as in section 603(p) of the Fair Credit Report15 ing Act (15 U.S.C. 1681a(p)). 

16 (7) COVERED ENTITY.— 

17 (A) IN GENERAL.—The term ‘‘covered en18 tity’’ means any— 

19 (i) entity, the business of which is en20 gaging in financial activities, as described 

21 in section 4(k) of the Bank Holding Com22 pany Act of 1956 (12 U.S.C. 1843(k)); 

23 (ii) financial institution, including any 

24 institution described in section 313.3(k) of 

25 title 16, Code of Federal Regulations, as in 


hmoore on PROD1PC68 with HMBILLS
4 

•HR 1685 IH

1 effect on the date of the enactment of this 

2 Act; 

3 (iii) entity that maintains or otherwise 

4 possesses information that is subject to 

5 section 628 of the Fair Credit Reporting 

6 Act (15 U.S.C. 1681w); or 

7 (iv) other individual, partnership, cor8 poration, trust, estate, cooperative, associa9 tion, or entity that maintains or commu10 nicates sensitive account information or 

11 sensitive personal information. 

12 (B) EXCEPTION.—The term ‘‘covered enti13 ty’’ does not include any agency or any other 

14 unit of Federal, State, or local government or 

15 any subdivision of such unit. 

16 (8) FINANCIAL INSTITUTION.—The term ‘‘fi17 nancial institution’’ has the same meaning as in sec18 tion 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 

19 6809). 

20 (9) SENSITIVE ACCOUNT INFORMATION.—The 

21 term ‘‘sensitive account information’’ means a finan22 cial account number relating to a consumer, includ23 ing a credit card number or debit card number, in 

24 combination with any security code, access code, 


hmoore on PROD1PC68 with HMBILLS
5 

•HR 1685 IH

1 password, or other personal identification informa2 tion required to access the financial account. 

3 (10) SENSITIVE PERSONAL INFORMATION.— 

4 (A) IN GENERAL.—The term ‘‘sensitive 

5 personal information’’ means the first and last 

6 name, address, or telephone number of a con7 sumer, in combination with any of the following 

8 relating to such consumer: 

9 (i) Social security account number. 

10 (ii) Driver’s license number or equiva11 lent State identification number. 

12 (iii) Taxpayer identification number. 

13 (B) EXCEPTION.—The term ‘‘sensitive per14 sonal information’’ does not include publicly 

15 available information that is lawfully made 

16 available to the general public from— 

17 (i) Federal, State, or local government 

18 records; or 

19 (ii) widely distributed media. 

20 (11) SUBSTANTIAL HARM OR INCONVEN21 IENCE.— 

22 (A) IN GENERAL.—The term ‘‘substantial 

23 harm or inconvenience’’ means— 

24 (i) material financial loss to, or civil 

25 or criminal penalties imposed on, a conVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
6 

•HR 1685 IH

1 sumer, due to the unauthorized use of sen2 sitive account information or sensitive per3 sonal information relating to such con4 sumer; or 

5 (ii) the need for a consumer to expend 

6 significant time and effort to correct erro7 neous information relating to the con8 sumer, including information maintained 

9 by a consumer reporting agency, financial 

10 institution, or government entity, in order 

11 to avoid material financial loss, increased 

12 costs, or civil or criminal penalties, due to 

13 the unauthorized use of sensitive account 

14 information or sensitive personal informa15 tion relating to such consumer. 

16 (B) EXCEPTION.—The term ‘‘substantial 

17 harm or inconvenience’’ does not include— 

18 (i) changing a financial account num19 ber or closing a financial account; or 

20 (ii) harm or inconvenience that does 

21 not result from identity theft or account 

22 fraud. 

23 SEC. 3. PROTECTION OF INFORMATION AND SECURITY 

24 BREACH NOTIFICATION. 

25 (a) SECURITY PROCEDURES REQUIRED.— 


hmoore on PROD1PC68 with HMBILLS
7 

•HR 1685 IH

1 (1) IN GENERAL.—Each covered entity shall 

2 implement, maintain, and enforce reasonable policies 

3 and procedures to protect the confidentiality and se4 curity of sensitive account information and sensitive 

5 personal information which is maintained or is being 

6 communicated by or on behalf of a covered entity, 

7 from the unauthorized use of such information that 

8 is reasonably likely to result in substantial harm or 

9 inconvenience to the consumer to whom such infor10 mation relates. 

11 (2) LIMITATION.—Any policy or procedure im12 plemented or maintained under paragraph (1) shall 

13 be appropriate to the— 

14 (A) size and complexity of a covered entity; 

15 (B) nature and scope of the activities of 

16 such entity; and 

17 (C) sensitivity of the consumer information 

18 to be protected. 

19 (b) INVESTIGATION REQUIRED.— 

20 (1) IN GENERAL.—If a covered entity deter21 mines that a breach of data security has or may 

22 have occurred in relation to sensitive account infor23 mation or sensitive personal information that is 

24 maintained or is being communicated by, or on beVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
8 

•HR 1685 IH

1 half of, such covered entity, the covered entity shall 

2 conduct an investigation— 

3 (A) to assess the nature and scope of the 

4 breach; 

5 (B) to identify any sensitive account infor6 mation or sensitive personal information that 

7 may have been involved in the breach; and 

8 (C) to determine if such information is 

9 reasonably likely to be misused in a manner 

10 causing substantial harm or inconvenience to 

11 the consumers to whom the information relates. 

12 (2) NEURAL NETWORKS AND INFORMATION SE13 CURITY PROGRAMS.—In determining the likelihood 

14 of misuse of sensitive account information under 

15 paragraph (1)(C), a covered entity shall consider 

16 whether any neural network or security program has 

17 detected, or is likely to detect or prevent, fraudulent 

18 transactions resulting from the breach of security. 

19 (c) NOTICE REQUIRED.—If a covered entity deter20 mines under subsection (b)(1)(C) that sensitive account 

21 information or sensitive personal information involved in 

22 a breach of data security is reasonably likely to be misused 

23 in a manner causing substantial harm or inconvenience 

24 to the consumers to whom the information relates, such 


hmoore on PROD1PC68 with HMBILLS
9 

•HR 1685 IH

1 covered entity, or a third party acting on behalf of such 

2 covered entity, shall— 

3 (1) notify, in the following order— 

4 (A) the appropriate agency or authority 

5 identified in section 5; 

6 (B) an appropriate law enforcement agen7 cy; 

8 (C) any entity that owns, or is obligated 

9 on, a financial account to which the sensitive 

10 account information relates, in the case of a 

11 breach involving sensitive account information; 

12 (D) each consumer reporting agency that 

13 compiles and maintains files on consumers on a 

14 nationwide basis, in the case of a breach involv15 ing sensitive personal information relating to 

16 1,000 or more consumers; and 

17 (E) all consumers to whom the sensitive 

18 account information or sensitive personal infor19 mation relates; and 

20 (2) take reasonable measures to restore the se21 curity and confidentiality of the sensitive account in22 formation or sensitive personal information involved 

23 in the breach. 

24 (d) COMPLIANCE.— 


hmoore on PROD1PC68 with HMBILLS
10 

•HR 1685 IH

1 (1) IN GENERAL.—A financial institution shall 

2 be deemed to be in compliance with— 

3 (A) subsection (a), and any regulations 

4 prescribed under such subsection, if such insti5 tution maintains policies and procedures to pro6 tect the confidentiality and security of sensitive 

7 account information and sensitive personal in8 formation that are subject to section 501(b) of 

9 the Gramm-Leach-Bliley Act (15 U.S.C. 

10 6801(b)) and any regulations or guidance pre11 scribed under that section that are applicable to 

12 such institution; and 

13 (B) subsections (b) and (c), and any regu14 lations prescribed under such subsections, if 

15 such institution— 

16 (i)(I) maintains policies and proce17 dures to investigate and provide notice to 

18 consumers of breaches of data security 

19 that are subject to the investigation and 

20 notice requirements established by regula21 tions or guidance under section 501(b) of 

22 the Gramm-Leach-Bliley Act (15 U.S.C. 

23 6801(b)) that are applicable to such insti24 tution; or 


hmoore on PROD1PC68 with HMBILLS
11 

•HR 1685 IH

1 (II) is an affiliate of a bank holding 

2 company that maintains policies and proce3 dures to investigate and provide notice to 

4 consumers of breaches of data security 

5 that are consistent with the policies and 

6 procedures of a bank that is an affiliate of 

7 such institution, and that bank’s policies 

8 and procedures are subject to the inves9 tigation and notice requirements estab10 lished by any regulations or guidance 

11 under section 501(b) of the Gramm-Leach12 Bliley Act (15 U.S.C. 6801(b)) that are 

13 applicable to that bank; and 

14 (ii) provides for notice to the entities 

15 described under subparagraphs (B), (C), 

16 and (D) of subsection (c)(1), if notice is 

17 provided to consumers pursuant to the 

18 policies and procedures of such institution 

19 described in clause (i). 

20 (2) DEFINITIONS.—For purposes of this sub21 section, the terms ‘‘bank holding company’’ and 

22 ‘‘bank’’ shall have the same meaning given such 

23 terms under section 2 of the Bank Holding Com24 pany Act of 1956. 

25 (3) HARMONIZATION OF GLBA.— 


hmoore on PROD1PC68 with HMBILLS
12 

•HR 1685 IH

1 (A) IN GENERAL.—To the extent that 

2 compliance by any financial institution with the 

3 requirements of title V of the Gramm-Leach4 Bliley Act are deemed, pursuant to this sub5 section, to be compliance with this section, and 

6 the requirements of such title, and any regula7 tions, guidelines, or orders issued or prescribed 

8 under such title, differ in any way from this 

9 section, it is the sense of the Congress that the 

10 applicable regulators shall make every appro11 priate effort as any relevant regulations are 

12 prescribed, reviewed, or updated to reconcile 

13 such differences to harmonize the corresponding 

14 requirements. 

15 (B) AGENCIES THAT HAVE NOT FULLY IM16 PLEMENTED TITLE V OF THE GLBA.—Any Fed17 eral functional regulator (as defined in section 

18 509(2) of Gramm-Leach-Bliley Act) that has 

19 not issued or prescribed regulations, guidelines, 

20 or orders that are required or permitted under 

21 title V of the Gramm-Leach-Bliley Act and that 

22 set forth the requirements for compliance with 

23 such title, including with respect to providing 

24 notice of a breach of data security, shall pre25 scribe such regulations, guidelines, or orders, as 


hmoore on PROD1PC68 with HMBILLS
13 

•HR 1685 IH

1 appropriate, before the end of the 12-month pe2 riod beginning on the date of the enactment of 

3 this Act, in a manner that— 

4 (i) is consistent with this section; and 

5 (ii) allows, to the extent practical, 

6 consistent standards across holding compa7 nies with respect to compliance with this 

8 section and section 501(b) of the Gramm9 Leach-Bliley Act that is deemed compli10 ance under this subsection. 

11 (C) AGENCIES THAT HAVE IMPLEMENTED

12 TITLE V OF THE GLBA.—Any Federal func13 tional regulator (as defined in section 509(2) of 

14 Gramm-Leach-Bliley Act) that has issued or 

15 prescribed regulations, guidelines, or orders 

16 that are required or permitted under title V of 

17 the Gramm-Leach-Bliley Act and that set forth 

18 the requirements for compliance with such title 

19 shall modify such regulations, guidelines, or or20 ders, as appropriate, before the end of the 12- 

21 month period beginning on the date of the en22 actment of this Act, in a manner that— 

23 (i) is consistent with this section; and 

24 (ii) allows, to the extent practical, 

25 consistent standards across holding compaVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
14 

•HR 1685 IH

1 nies with respect to compliance with this 

2 section and section 501(b) of the Gramm3 Leach-Bliley Act that is deemed compli4 ance under this subsection. 

5 (D) COORDINATION UNDER THIS SEC6 TION.—To the extent practical, any regulations, 

7 guidelines, standards, or orders issued or pre8 scribed under this section shall be issued or 

9 prescribed in a manner that— 

10 (i) is consistent with this section; and 

11 (ii) allows, to the extent practical, 

12 consistent standards across holding compa13 nies with respect to compliance with this 

14 section and section 501(b) of the Gramm15 Leach-Bliley Act that is deemed compli16 ance under this subsection. 

17 (e) TREATMENT OF NOTICE.—A notice provided to 

18 any consumer under this section may be the basis for a 

19 request by the consumer, or an individual acting on behalf 

20 of or as a personal representative of a consumer, for an 

21 initial fraud alert under section 605A(a)(1) of the Fair 

22 Credit Reporting Act. 

23 SEC. 4. IMPLEMENTING REGULATIONS. 

24 (a) IN GENERAL.—Except as provided under section 

25 6, the agencies and authorities identified in section 5, with 


hmoore on PROD1PC68 with HMBILLS
15 

•HR 1685 IH

1 respect to the covered entities that are subject to the re2 spective enforcement authority of such agencies and au3 thorities, shall prescribe regulations to implement this Act. 

4 (b) COORDINATION.—Each agency and authority re5 quired to prescribe regulations under subsection (a) shall 

6 consult and coordinate with each other agency and author7 ity identified in section 5 so that, to the extent possible, 

8 the regulations prescribed by each agency and authority 

9 are consistent and comparable. 

10 (c) METHOD OF PROVIDING NOTICE TO CON11 SUMERS.—The regulations required under subsection (a) 

12 shall— 

13 (1) prescribe the methods by which a covered 

14 entity shall notify a consumer of a breach of data se15 curity under section 3; and 

16 (2) allow a covered entity to provide such notice 

17 by— 

18 (A) written, telephonic, or e-mail notifica19 tion; or 

20 (B) substitute notification, if providing 

21 written, telephonic, or e-mail notification is not 

22 feasible due to— 

23 (i) lack of sufficient contact informa24 tion for the consumers that must be noti25 fied; or 


hmoore on PROD1PC68 with HMBILLS
16 

•HR 1685 IH

1 (ii) excessive cost to the covered enti2 ty. 

3 (d) CONTENT OF CONSUMER NOTICE.—The regula4 tions required under subsection (a) shall— 

5 (1) prescribe the content that shall be included 

6 in a notice of a breach of data security that is re7 quired to be provided to consumers under section 3; 

8 and 

9 (2) require such notice to include— 

10 (A) a description of the type of sensitive 

11 account information or sensitive personal infor12 mation involved in the breach of data security; 

13 (B) if known, the date, or a reasonable ap14 proximation of the period of time, on or within 

15 which the breach of data security occurred; 

16 (C) a general description of the actions 

17 taken by the covered entity to restore the secu18 rity and confidentiality of the sensitive account 

19 information or sensitive personal information 

20 involved in the breach of data security; and 

21 (D) the summary of rights of victims of 

22 identity theft prepared by the Commission 

23 under section 609(d) of the Fair Credit Report24 ing Act (15 U.S.C. 1681g), if the breach of 

25 data security involves sensitive personal inforVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
17 

•HR 1685 IH

1 mation, including any additional appropriate in2 formation on how the consumer may place an 

3 initial fraud alert in any file relating to the con4 sumer at a consumer reporting agency under 

5 section 605A(a)(1) of such Act. 

6 (e) TIMING OF NOTICE.—The regulations required 

7 under subsection (a) shall establish standards for when 

8 a covered entity shall provide any notice required under 

9 section 3. 

10 (f) LAW ENFORCEMENT DELAY.—The regulations 

11 required under subsection (a) shall allow a covered entity 

12 to delay providing notice of a breach of data security to 

13 consumers under section 3 if a law enforcement agency 

14 requests such a delay in writing. 

15 (g) SERVICE PROVIDERS.—The regulations required 

16 under subsection (a) shall— 

17 (1) require any party that maintains or commu18 nicates sensitive account information or sensitive 

19 personal information on behalf of a covered entity to 

20 provide notice to that covered entity if such party 

21 determines that a breach of data security has, or 

22 may have, occurred with respect to such information; 

23 and 

24 (2) ensure that there is only 1 notification re25 sponsibility with respect to a breach of data security. 


hmoore on PROD1PC68 with HMBILLS
18 

•HR 1685 IH

1 (h) TIMING OF REGULATIONS.—The regulations re2 quired under subsection (a) shall— 

3 (1) be issued in final form not later than 6 

4 months after the date of enactment of this Act; and 

5 (2) take effect not later than 6 months after 

6 the date on which they are issued in final form. 

7 SEC. 5. ADMINISTRATIVE ENFORCEMENT. 

8 (a) IN GENERAL.—Section 3, and the regulations re9 quired under section 4, shall be enforced exclusively 

10 under— 

11 (1) section 8 of the Federal Deposit Insurance 

12 Act (12 U.S.C. 1818), in the case of— 

13 (A) a national bank, a Federal branch or 

14 Federal agency of a foreign bank, or any sub15 sidiary thereof (other than a broker, dealer, 

16 person providing insurance, investment com17 pany, or investment adviser), by the Office of 

18 the Comptroller of the Currency; 

19 (B) a member bank of the Federal Reserve 

20 System (other than a national bank), a branch 

21 or agency of a foreign bank (other than a Fed22 eral branch, Federal agency, or insured State 

23 branch of a foreign bank), a commercial lending 

24 company owned or controlled by a foreign bank, 

25 an organization operating under section 25 or 


hmoore on PROD1PC68 with HMBILLS
19 

•HR 1685 IH

1 25A of the Federal Reserve Act (12 U.S.C. 

2 601,604), or a bank holding company and its 

3 nonbank subsidiary or affiliate (other than a 

4 broker, dealer, person providing insurance, in5 vestment company, or investment adviser), by 

6 the Board of Governors of the Federal Reserve 

7 System; 

8 (C) a bank, the deposits of which are in9 sured by the Federal Deposit Insurance Cor10 poration (other than a member of the Federal 

11 Reserve System), an insured State branch of a 

12 foreign bank, or any subsidiary thereof (other 

13 than a broker, dealer, person providing insur14 ance, investment company, or investment ad15 viser), by the Board of Directors of the Federal 

16 Deposit Insurance Corporation; and 

17 (D) a savings association, the deposits of 

18 which are insured by the Federal Deposit In19 surance Corporation, or any subsidiary thereof 

20 (other than a broker, dealer, person providing 

21 insurance, investment company, or investment 

22 adviser), by the Director of the Office of Thrift 

23 Supervision; 

24 (2) the Federal Credit Union Act (12 U.S.C. 

25 1751 et seq.), by the National Credit Union AdminVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
20 

•HR 1685 IH

1 istration Board with respect to any federally insured 

2 credit union; 

3 (3) the Securities Exchange Act of 1934 (15 

4 U.S.C.78a et seq.), by the Securities and Exchange 

5 Commission with respect to any broker or dealer; 

6 (4) the Investment Company Act of 1940 (15 

7 U.S.C. 80a–1 et seq.), by the Securities and Ex8 change Commission with respect to any investment 

9 company; 

10 (5) the Investment Advisers Act of 1940 (15 

11 U.S.C. 80b–1 et seq.), by the Securities and Ex12 change Commission with respect to any investment 

13 adviser registered with the Securities and Exchange 

14 Commission under that Act; 

15 (6) the Commodity Exchange Act (7 U.S.C. 1 

16 et seq.), by the Commodity Futures Trading Com17 mission with respect to any futures commission mer18 chant, commodity trading advisor, commodity pool 

19 operator, or introducing broker; 

20 (7) the provisions of title XIII of the Housing 

21 and Community Development Act of 1992 (12 

22 U.S.C. 4501 et seq.), by the Director of Federal 

23 Housing Enterprise Oversight (and any successor to 

24 such functional regulatory agency) with respect to 

25 the Federal National Mortgage Association, the FedVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
21 

•HR 1685 IH

1 eral Home Loan Mortgage Corporation, and any 

2 other entity or enterprise (as defined in that title) 

3 subject to the jurisdiction of such functional regu4 latory agency under that title, including any affiliate 

5 of any such enterprise; 

6 (8) State insurance law, in the case of any per7 son engaged in providing insurance, by the applica8 ble State insurance authority of the State in which 

9 the person is domiciled; and 

10 (9) the Federal Trade Commission Act (15 

11 U.S.C. 41 et seq.), by the Commission for any other 

12 covered entity that is not subject to the jurisdiction 

13 of any agency or authority described under para14 graphs (1) through (8). 

15 (b) EXTENSION OF FEDERAL TRADE COMMISSION

16 ENFORCEMENT AUTHORITY.—The authority of the Com17 mission to enforce compliance with section 3, and the reg18 ulations required under section 4, under subsection (a)(8) 

19 shall— 

20 (1) notwithstanding the Federal Aviation Act of 

21 1958 (49 U.S.C. App. 1301 et seq.), include the au22 thority to enforce compliance by air carriers and for23 eign air carriers; and 

24 (2) notwithstanding the Packers and Stock25 yards Act (7 U.S.C. 181 et seq.), include the authorVerDate Aug 31 2005 00:26 Mar 29, 2007 Jkt 059200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\H1685.IH H1685

hmoore on PROD1PC68 with HMBILLS
22 

•HR 1685 IH

1 ity to enforce compliance by persons, partnerships, 

2 and corporations subject to the provisions of that 

3 Act. 

4 (c) NO PRIVATE RIGHT OF ACTION.— 

5 (1) IN GENERAL.—This Act, and the regula6 tions prescribed under this Act, may not be con7 strued to provide a private right of action, including 

8 a class action with respect to any act or practice 

9 regulated under this Act. 

10 (2) CIVIL AND CRIMINAL ACTIONS.—No civil or 

11 criminal action relating to any act or practice gov12 erned under this Act, or the regulations prescribed 

13 under this Act, shall be commenced or maintained in 

14 any State court or under State law, including a 

15 pendent State claim to an action under Federal law. 

16 SEC. 6. PROTECTION OF INFORMATION AT FEDERAL AGEN17 CIES. 

18 (a) DATA SECURITY STANDARDS.—Each agency 

19 shall implement appropriate standards relating to admin20 istrative, technical, and physical safeguards— 

21 (1) to insure the security and confidentiality of 

22 the sensitive account information and sensitive per23 sonal information that is maintained or is being 

24 communicated by, or on behalf of, that agency; 


hmoore on PROD1PC68 with HMBILLS
23 

•HR 1685 IH

1 (2) to protect against any anticipated threats or 

2 hazards to the security of such information; and 

3 (3) to protect against misuse of such informa4 tion, which could result in substantial harm or in5 convenience to a consumer. 

6 (b) SECURITY BREACH NOTIFICATION STAND7 ARDS.—Each agency shall implement appropriate stand8 ards providing for notification of consumers when such 

9 agency determines that sensitive account information or 

10 sensitive personal information that is maintained or is 

11 being communicated by, or on behalf of, such agency— 

12 (1) has been acquired without authorization; 

13 and 

14 (2) is reasonably likely to be misused in a man15 ner causing substantial harm or inconvenience to the 

16 consumers to whom the information relates. 

17 SEC. 7. RELATION TO STATE LAW. 

18 No requirement or prohibition may be imposed under 

19 the laws of any State with respect to the responsibilities 

20 of any person to— 

21 (1) protect the security of information relating 

22 to consumers that is maintained or communicated 

23 by, or on behalf of, such person; 

24 (2) safeguard information relating to consumers 

25 from potential misuse; 


hmoore on PROD1PC68 with HMBILLS
24 

•HR 1685 IH

1 (3) investigate or provide notice of the unau2 thorized access to information relating to consumers, 

3 or the potential misuse of such information for 

4 fraudulent, illegal, or other purposes; or 

5 (4) mitigate any loss or harm resulting from 

6 the unauthorized access or misuse of information re7 lating to consumers. 

8 SEC. 8. DELAYED EFFECTIVE DATE FOR CERTAIN PROVI9 SIONS. 

10 (a) COVERED ENTITIES.—Sections 3 and 7 shall take 

11 effect on the later of— 

12 (1) 1 year after the date of the enactment of 

13 this Act; or 

14 (2) the effective date of the final regulations re15 quired under section 4. 

16 (b) AGENCIES.—Section 6 shall take effect 1 year 

17 after the date of enactment of this Act. 

Æ 


hmoore on PROD1PC68 with HMBILLS