II 

★(Star Print) 

109TH CONGRESS 

1ST SESSION S. 751 

To require Federal agencies, and persons engaged in interstate commerce, 

in possession of data containing personal information, to disclose any 

unauthorized acquisition of such information. 

IN THE SENATE OF THE UNITED STATES 

APRIL 11, 2005 

Mrs. FEINSTEIN introduced the following bill; which was read twice and 

referred to the Committee on the Judiciary 

A BILL 

To require Federal agencies, and persons engaged in interstate commerce, in possession of data containing personal 

information, to disclose any unauthorized acquisition of 

such information. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Notification of Risk 

5 to Personal Data Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act, the following definitions shall apply: 
2 

S 751 IS1S 

1 (1) AGENCY.—The term ‘‘agency’’ has the same 

2 meaning given such term in section 551(1) of title 

3 5, United States Code. 

4 (2) BREACH OF SECURITY OF THE SYSTEM.— 

5 The term ‘‘breach of security of the system’’— 

6 (A) means the compromise of the security, 

7 confidentiality, or integrity of data that results 

8 in, or there is a reasonable basis to conclude 

9 has resulted in, the unauthorized acquisition of 

10 personal information maintained by the person 

11 or business; and 

12 (B) does not include good faith acquisition 

13 of personal information by an employee or 

14 agent of the person or business for the purposes 

15 of the person or business, if the personal infor16 mation is not used or subject to further unau17 thorized disclosure. 

18 (3) PERSON.—The term ‘‘person’’ has the same 

19 meaning given such term in section 551(2) of title 

20 5, United States Code. 

21 (4) PERSONAL INFORMATION.—The term ‘‘per22 sonal information’’ means an individual’s last name 

23 in combination with any 1 or more of the following 

24 data elements: 

25 (A) Social security number. 
3 

S 751 IS1S 

1 (B) Driver’s license number or State iden2 tification number. 

3 (C) Account number or credit or debit card 

4 number, or, if a security code, access code, or 

5 password is required for access to an individ6 ual’s account, the account number or credit or 

7 debit card number, in combination with the re8 quired code or password. 

9 (5) SUBSTITUTE NOTICE.—The term ‘‘sub10 stitute notice’’ means— 

11 (A) conspicuous posting of the notice on 

12 the Internet site of the agency or person, if the 

13 agency or person maintains a public Internet 

14 site; and 

15 (B) notification to major print and broad16 cast media, including major media in metropoli17 tan and rural areas where the individual whose 

18 personal information was, or is reasonably be19 lieved to have been, acquired resides. The notice 

20 to media shall include a toll-free phone number 

21 where an individual can learn whether or not 

22 that individual’s personal data is included in 

23 the security breach. 

24 SEC. 3. DATABASE SECURITY. 

25 (a) DISCLOSURE OF SECURITY BREACH.— 
4 

S 751 IS1S 

1 (1) IN GENERAL.—Any agency, or person en2 gaged in interstate commerce, that owns, licenses, or 

3 collects data, whether or not held in electronic form, 

4 containing personal information shall, following the 

5 discovery of a breach of security of the system main6 tained by the agency or person that contains such 

7 data, or upon receipt of notice under paragraph (2), 

8 notify any individual of the United States whose per9 sonal information was, or is reasonably believed to 

10 have been, acquired by an unauthorized person. 

11 (2) NOTIFICATION OF OWNER OR LICENSEE.— 

12 Any agency, or person engaged in interstate com13 merce, in possession of data, whether or not held in 

14 electronic form, containing personal information that 

15 the agency does not own or license shall notify the 

16 owner or licensee of the information if the personal 

17 information was, or is reasonably believed to have 

18 been, acquired by an unauthorized person through a 

19 breach of security of the system containing such 

20 data. 

21 (3) TIMELINESS OF NOTIFICATION.— 

22 (A) IN GENERAL.—All notifications re23 quired under paragraph (1) or (2) shall be 

24 made without unreasonable delay following— 
5 

S 751 IS1S 

1 (i) the discovery by the agency or per2 son of a breach of security of the system; 

3 (ii) any measures necessary to deter4 mine the scope of the breach, prevent fur5 ther disclosures, and restore the reasonable 

6 integrity of the data system; and 

7 (iii) receipt of written notice that a 

8 law enforcement agency has determined 

9 that the notification will no longer seri10 ously impede its investigation, where notifi11 cation is delayed as provided in paragraph 

12 (4). 

13 (B) BURDEN OF PROOF.—The agency or 

14 person required to provide notification under 

15 this subsection shall have the burden of dem16 onstrating that all notifications were made as 

17 required under this paragraph, including evi18 dence demonstrating the necessity of any delay. 

19 (4) DELAY OF NOTIFICATION AUTHORIZED FOR

20 LAW ENFORCEMENT PURPOSES.—If a law enforce21 ment agency determines that the notification re22 quired under this subsection would seriously impede 

23 a criminal investigation, such notification may be de24 layed upon the written request of the law enforce25 ment agency. 
6 

S 751 IS1S 

1 (5) EXCEPTION FOR NATIONAL SECURITY AND

2 LAW ENFORCEMENT.— 

3 (A) IN GENERAL.—This subsection shall 

4 not apply to an agency if the head of the agen5 cy certifies, in writing, that notification of the 

6 breach as required by this subsection reason7 ably could be expected to— 

8 (i) cause damage to the national secu9 rity; and 

10 (ii) hinder a law enforcement inves11 tigation or the ability of the agency to con12 duct law enforcement investigations. 

13 (B) LIMITS ON CERTIFICATIONS.—The 

14 head of an agency may not execute a certifi15 cation under subparagraph (A) to— 

16 (i) conceal violations of law, ineffi17 ciency, or administrative error; 

18 (ii) prevent embarrassment to a per19 son, organization, or agency; or 

20 (iii) restrain competition. 

21 (C) NOTICE.—In every case in which a 

22 head of an agency issues a certification under 

23 subparagraph (A), a copy of the certification, 

24 accompanied by a concise description of the fac-
7 

S 751 IS1S 

1 tual basis for the certification, shall be imme2 diately provided to the Congress. 

3 (6) METHODS OF NOTICE.—An agency, or per4 son engaged in interstate commerce, shall be in com5 pliance with this subsection if it provides the indi6 vidual, with— 

7 (A) written notification; 

8 (B) e-mail notice, if the individual has con9 sented to receive such notice and the notice is 

10 consistent with the provisions permitting elec11 tronic transmission of notices under section 101 

12 of the Electronic Signatures in Global and Na13 tional Commerce Act (15 U.S.C. 7001); or 

14 (C) substitute notice, if— 

15 (i) the agency or person demonstrates 

16 that the cost of providing direct notice 

17 would exceed $500,000; 

18 (ii) the number of individuals to be 

19 notified exceeds 500,000; or 

20 (iii) the agency or person does not 

21 have sufficient contact information for 

22 those to be notified. 

23 (7) CONTENT OF NOTIFICATION.—Regardless 

24 of the method by which notice is provided to individ-
8 

S 751 IS1S 

1 uals under paragraphs (1) and (2), such notice shall 

2 include— 

3 (A) to the extent possible, a description of 

4 the categories of information that was, or is 

5 reasonably believed to have been, acquired by 

6 an unauthorized person, including social secu7 rity numbers, driver’s license or State identi8 fication numbers and financial data; 

9 (B) a toll-free number— 

10 (i) that the individual may use to con11 tact the agency or person, or the agent of 

12 the agency or person; and 

13 (ii) from which the individual may 

14 learn— 

15 (I) what types of information the 

16 agency or person maintained about 

17 that individual or about individuals in 

18 general; and 

19 (II) whether or not the agency or 

20 person maintained information about 

21 that individual; and 

22 (C) the toll-free contact telephone numbers 

23 and addresses for the major credit reporting 

24 agencies. 
9 

S 751 IS1S 

1 (8) COORDINATION OF NOTIFICATION WITH

2 CREDIT REPORTING AGENCIES.—If an agency or 

3 person is required to provide notification to more 

4 than 1,000 individuals under this subsection, the 

5 agency or person shall also notify, without unreason6 able delay, all consumer reporting agencies that 

7 compile and maintain files on consumers on a na8 tionwide basis (as defined in section 603(p) of the 

9 Fair Credit Reporting Act (15 U.S.C. 1681a(p)) of 

10 the timing and distribution of the notices. 

11 (b) CIVIL REMEDIES.— 

12 (1) PENALTIES.—Any agency, or person en13 gaged in interstate commerce, that violates sub14 section (a) shall be subject to a fine of— 

15 (A) not more than $1,000 per individual 

16 whose personal information was, or is reason17 ably believed to have been, acquired by an un18 authorized person; or 

19 (B) not more than $50,000 per day while 

20 the failure to give notice under subsection (a) 

21 persists. 

22 (2) EQUITABLE RELIEF.—Any agency or person 

23 that violates, proposes to violate, or has violated this 

24 section may be enjoined from further violations by a 

25 court of competent jurisdiction. 
10 

S 751 IS1S 

1 (3) OTHER RIGHTS AND REMEDIES.—The 

2 rights and remedies available under this subsection 

3 are cumulative and shall not affect any other rights 

4 and remedies available under law. 

5 (c) ENFORCEMENT.—The Federal Trade Commission 

6 or other appropriate regulator, is authorized to enforce 

7 compliance with this section, including the assessment of 

8 fines under subsection (b)(1). 

9 (d) FRAUD ALERT.—Section 605A(b)(1) of the Fair 

10 Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 

11 amended by inserting ‘‘, or evidence that the consumer 

12 has received notice that the consumer’s personal financial 

13 information has or may have been compromised,’’ after 

14 ‘‘identity theft report’’. 

15 SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

16 (a) IN GENERAL.— 

17 (1) CIVIL ACTIONS.—In any case in which the 

18 attorney general of a State has reason to believe 

19 that an interest of the residents of that State has 

20 been or is threatened or adversely affected by the 

21 engagement of any person in a practice that is pro22 hibited under this Act, the State, as parens patriae, 

23 may bring a civil action on behalf of the residents 

24 of the State in a district court of the United States 
11 

S 751 IS1S 

1 of appropriate jurisdiction or any other court of 

2 competent jurisdiction, including a State court, to— 

3 (A) enjoin that practice; 

4 (B) enforce compliance with this Act; 

5 (C) obtain damages, restitution, or other 

6 compensation on behalf of residents of the 

7 State; or 

8 (D) obtain such other relief as the court 

9 may consider to be appropriate. 

10 (2) NOTICE.— 

11 (A) IN GENERAL.—Before filing an action 

12 under paragraph (1), the attorney general of 

13 the State involved shall provide to the Attorney 

14 General of the United States— 

15 (i) written notice of the action; and 

16 (ii) a copy of the complaint for the ac17 tion. 

18 (B) EXEMPTION.— 

19 (i) IN GENERAL.—Subparagraph (A) 

20 shall not apply with respect to the filing of 

21 an action by an attorney general of a State 

22 under this subsection, if the State attorney 

23 general determines that it is not feasible to 

24 provide the notice described in such sub25 paragraph before the filing of the action. 
12 

S 751 IS1S 

1 (ii) NOTIFICATION.—In an action de2 scribed in clause (i), the attorney general 

3 of a State shall provide notice and a copy 

4 of the complaint to the Attorney General 

5 at the time the State attorney general files 

6 the action. 

7 (b) CONSTRUCTION.—For purposes of bringing any 

8 civil action under subsection (a), nothing in this Act shall 

9 be construed to prevent an attorney general of a State 

10 from exercising the powers conferred on such attorney 

11 general by the laws of that State to— 

12 (1) conduct investigations; 

13 (2) administer oaths or affirmations; or 

14 (3) compel the attendance of witnesses or the 

15 production of documentary and other evidence. 

16 (c) VENUE; SERVICE OF PROCESS.— 

17 (1) VENUE.—Any action brought under sub18 section (a) may be brought in— 

19 (A) the district court of the United States 

20 that meets applicable requirements relating to 

21 venue under section 1391 of title 28, United 

22 States Code; or 

23 (B) another court of competent jurisdic24 tion. 
13 

S 751 IS1S 

1 (2) SERVICE OF PROCESS.—In an action 

2 brought under subsection (a), process may be served 

3 in any district in which the defendant— 

4 (A) is an inhabitant; or 

5 (B) may be found. 

6 SEC. 5. EFFECT ON STATE LAW. 

7 The provisions of this Act shall supersede any incon8 sistent provisions of law of any State or unit of local gov9 ernment with respect to the conduct required by the spe10 cific provisions of this Act. 

11 SEC. 6. EFFECTIVE DATE. 

12 This Act shall take effect on the expiration of the 

13 date which is 6 months after the date of enactment of 

14 this Act. 

Æ