Data Security Act of 2015

To protect financial information relating to consumers, to require notice of security breaches, and for other purposes. 1. Short title This Act may be cited as the Data Security Act of 2015 2. Purposes The purposes of this Act are— (1) to establish strong and uniform national data security and breach notification standards for electronic data; and (2) to expressly preempt any related State laws in order to provide the Federal Trade Commission with authority to enforce such standards for entities covered under this Act. 3. Definitions For purposes of this Act, the following definitions shall apply: (1) Affiliate The term affiliate (2) Agency The term agency (3) Breach of data security (A) In general The term breach of data security (B) Exception for data that is not in usable form The term breach of data security (4) Carrier The term carrier (A) provides electronic data transmission, routing, intermediate, and transient storage, or connections to its system or network; (B) does not select or modify the content of the electronic data; (C) is not the sender or the intended recipient of the data; and (D) does not differentiate sensitive financial account information or sensitive personal information from other information that the entity transmits, routes, stores in intermediate or transient storage, or for which such entity provides connections. (5) Commission The term Commission (6) Consumer The term consumer (7) Consumer reporting agency that compiles and maintains files on consumers on a nationwide basis The term consumer reporting agency that compiles and maintains files on consumers on a nationwide basis 15 U.S.C. 1681a(p) (8) Covered entity (A) In general The term covered entity (B) Exception The term covered entity (9) Financial institution The term financial institution 15 U.S.C. 6809(3) (10) Information security program The term information security program (11) sensitive financial account information The term sensitive financial account information (12) Sensitive personal information (A) In general The term sensitive personal information (i) a Social Security number; and (ii) the first and last name of a consumer in combination with— (I) the consumer’s driver’s license number, passport number, military identification number, or other similar number issued on a government document used to verify identity; (II) information that could be used to access a consumer’s account, such as a user name and password or e-mail and password; or (III) biometric data of the consumer used to gain access to financial accounts of the consumer. (B) Exception The term sensitive personal information (i) Federal, State, or local government records; or (ii) widely distributed media. (13) Substantial harm or inconvenience The term substantial harm or inconvenience (A) identity theft; or (B) fraudulent transactions on financial accounts. (14) Third-party service provider The term third-party service provider 4. Protection of information and security breach notification (a) Security procedures required (1) In general Each covered entity shall develop, implement, and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards that are reasonably designed to achieve the objectives in paragraph (2). (2) Objectives The objectives of this subsection are to— (A) ensure the security and confidentiality of sensitive financial account information and sensitive personal information; (B) protect against any anticipated threats or hazards to the security or integrity of such information; and (C) protect against unauthorized acquisition of such information that could result in substantial harm to the individuals to whom such information relates. (3) Limitation A covered entity’s information security program under paragraph (1) shall be appropriate to— (A) the size and complexity of the covered entity; (B) the nature and scope of the activities of the covered entity; and (C) the sensitivity of the consumer information to be protected. (4) Elements In order to develop, implement, maintain, and enforce its information security program, a covered entity shall— (A) designate an employee or employees to coordinate the information security program; (B) identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of sensitive financial account information and sensitive personal information and assess the sufficiency of any safeguards in place to control these risks, including consideration of risks in each relevant area of the covered entity’s operations, including— (i) employee training and management; (ii) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (iii) detecting, preventing, and responding to attacks, intrusions, or other systems failures; (C) design and implement information safeguards to control the risks identified in its risk assessment, and regularly assess the effectiveness of the safeguards’ key controls, systems, and procedures; (D) oversee third-party service providers by— (i) taking reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate safeguards for the sensitive financial account information or sensitive personal information at issue; (ii) requiring third-party service providers by contract to implement and maintain such safeguards; and (iii) reasonably oversee or obtain an assessment of the third-party service provider’s compliance with contractual obligations, where appropriate in light of the covered entity’s risk assessment; and (E) evaluate and adjust the information security program in light of the results of the risk assessments and testing and monitoring required by subparagraphs (C) and (D) and any material changes to the covered entity’s operations or business arrangements, or any other circumstances that the covered entity knows or has reason to know may have a material impact on its information security program. (5) Security controls Each covered entity shall— (A) consider whether the following security measures are appropriate for the covered entity and, if so, adopt those measures that the covered entity concludes are appropriate— (i) access controls on information systems, including controls to authenticate and permit access only to authorized individuals and controls to prevent employees from providing sensitive financial account information or sensitive personal information to unauthorized individuals who may seek to obtain this information through fraudulent means; (ii) access restrictions at physical locations containing sensitive financial account information or sensitive personal information, such as buildings, computer facilities, and records storage facilities, to permit access only to authorized individuals; (iii) encryption of electronic sensitive financial account information or sensitive personal information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access; (iv) procedures designed to ensure that information system modifications are consistent with the covered entity’s information security program; (v) dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for, or access to, sensitive financial account information or sensitive personal information; (vi) monitoring systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems; (vii) response programs that specify actions to be taken when the covered entity suspects or detects that unauthorized individuals have gained access to information systems; and (viii) measures to protect against destruction, loss, or damage of sensitive financial account information or sensitive personal information due to potential environmental hazards, such as fire and water damage or technological failures; (B) develop, implement, and maintain appropriate measures to properly dispose of sensitive financial account information and sensitive personal information; and (C) train staff to implement the covered entity’s information security program. (6) Administrative requirements (A) Board oversight If a covered entity has a board of directors, the covered entity’s board of directors or an appropriate committee of the board shall— (i) approve the covered entity’s written information security program; and (ii) oversee the development, implementation, and maintenance of the covered entity’s information security program, including assigning specific responsibility for its implementation and reviewing reports from management. (B) Report to the board If a covered entity has a board of directors, the covered entity shall report to its board or an appropriate committee of the board at least annually, including describing— (i) the overall status of the information security program and the covered entity’s compliance with this Act; and (ii) material matters related to its program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations and management’s responses, and recommendations for changes in the information security program. (b) Investigation required If a covered entity believes that a breach of data security has or may have occurred in relation to sensitive financial account information or sensitive personal information that is maintained, communicated, or otherwise handled by, or on behalf of, the covered entity, the covered entity shall conduct an investigation to— (1) assess the nature and scope of the incident; (2) identify any sensitive financial account information or sensitive personal information that may have been involved in the incident; (3) determine if the sensitive financial account information or sensitive personal information has been acquired without authorization; and (4) take reasonable measures to restore the security and confidentiality of the systems compromised in the breach. (c) Notice required (1) In general If a covered entity determines under subsection (b) that the unauthorized acquisition of sensitive financial account information or sensitive personal information involved in a breach of data security is reasonably likely to cause substantial harm to the consumers to whom the information relates, the covered entity, or a third party acting on behalf of the covered entity, shall— (A) notify, without unreasonable delay— (i) an appropriate Federal law enforcement agency; (ii) the appropriate agency or authority identified in section 5; (iii) any relevant payment card network, if the breach involves a breach of payment card numbers; (iv) each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, if the breach involves sensitive personal information or sensitive financial account information relating to 5,000 or more consumers; and (v) all consumers to whom the sensitive financial account information or sensitive personal information relates; (B) provide notice to consumers by— (i) written notification sent to the postal address of the consumer in the records of the covered entity; (ii) telephonic notification to the number of the consumer in the records of the covered entity; (iii) e-mail notification to the consumer (or via other electronic means) in the records of the covered entity; or (iv) substitute notification in print and to broadcast media where the individual whose personal information was acquired resides, if providing written or e-mail notification is not feasible due to— (I) lack of sufficient contact information for the consumers that must be notified; (II) excessive cost to the covered entity; or (III) exigent circumstances; and (C) provide notice that includes— (i) a description of the type of sensitive financial account information or sensitive personal information involved in the breach of data security; (ii) a general description of the actions taken by the covered entity to restore the security and confidentiality of the sensitive financial account information or sensitive personal information involved in the breach of data security; and (iii) a summary of rights of victims of identity theft prepared under section 609(d) of the Fair Credit Reporting Act ( 15 U.S.C. 1681g(d) (2) Delay permitted when requested by law enforcement A covered entity may delay any notification described under paragraph (1) if such delay is requested by a law enforcement agency. (d) Clarification A financial institution shall have no obligation under this Act for a breach of security at another covered entity involving sensitive financial account information relating to an account owned by the financial institution. (e) Special notification requirements (1) Third-party service providers In the event of a breach of security of a system maintained by a third-party service provider that has been contracted to maintain, store, or process data in electronic form containing sensitive financial account information or sensitive personal information on behalf of a covered entity who owns or possesses such data, such third-party service provider shall— (A) notify the covered entity; and (B) notify consumers if it is agreed in writing that the third-party service provider will provide such notification on behalf of the covered entity. (2) Carrier obligations (A) In general If a carrier becomes aware of a breach of security involving data in electronic form containing sensitive financial account information or sensitive personal information that is owned or licensed by a covered entity that connects to or uses a system or network provided by the carrier for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, such carrier shall notify the covered entity who initiated such connection, transmission, routing, or storage of the data containing sensitive financial account information or sensitive personal information, if such covered entity can be reasonably identified. If a service provider is acting solely as a third-party service provider for purposes of this subsection, the service provider has no other notification obligations under this section. (B) Covered entities who receive notice from carriers Upon receiving notification from a service provider under paragraph (1), a covered entity shall provide notification as required under this section. (3) Communications with account holders If a covered entity that is not a financial institution experiences a breach of security involving sensitive financial account information, a financial institution that issues an account to which the sensitive financial account information relates may communicate with the account holder regarding the breach, including— (A) an explanation that the financial institution was not breached, and that the breach occurred at a third-party that had access to the consumer’s sensitive financial account information; or (B) identify the covered entity that experienced the breach after the covered entity has provided notice consistent with this Act. (f) Compliance (1) In general An entity shall be deemed to be in compliance with— (A) in the case of a financial institution— (i) subsection (a), and any regulations prescribed under subsection (a), if the financial institution maintains policies and procedures to protect the confidentiality and security of sensitive financial account information and sensitive personal information that are consistent with the policies and procedures of the financial institution that are designed to comply with the requirements of section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) (ii) subsections (b) and (c), and any regulations prescribed under subsections (b) and (c), if the financial institution— (I) (aa) maintains policies and procedures to investigate and provide notice to consumers of breaches of data security that are consistent with the policies and procedures of the financial institution that are designed to comply with the investigation and notice requirements established by regulations or guidance under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) (bb) is an affiliate of a bank holding company that maintains policies and procedures to investigate and provide notice to consumers of breaches of data security that are consistent with the policies and procedures of a bank that is an affiliate of the financial institution, and the policies and procedures of the bank are designed to comply with the investigation and notice requirements established by any regulations or guidance under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) (cc) (AA) is an affiliate of a savings and loan holding company that maintains policies and procedures to investigate and provide notice to consumers of data breaches of data security that are consistent with the policies and procedures of a savings association that is an affiliate of the financial institution; and (BB) the policies and procedures of the savings association are designed to comply with the investigation and notice requirements established by any regulations or guidelines under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S. 6801(b)) that are applicable to savings associations; and (II) provides for notice to the entities described under clauses (ii), (iii), and (iv) of subsection (c)(1)(A), if notice is provided to consumers pursuant to the policies and procedures of the financial institution described in subclause (I); and (B) subsections (a), (b), and (c)— (i) if the entity is a covered entity for purposes of the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 (ii) if the entity is in compliance with sections 13402 and 13407 of the HITECH Act (42 U.S.C. 17932 and 17937). (2) Definitions In this subsection— (A) the terms bank holding company bank 12 U.S.C. 1841 (B) the term savings and loan holding company 12 U.S.C. 1467a (C) the term savings association 12 U.S.C. 1462 5. Administrative enforcement (a) In general Notwithstanding any other provision of law section 4 shall be enforced exclusively under— (1) section 8 of the Federal Deposit Insurance Act ( 12 U.S.C. 1818 (A) a national bank, a Federal branch or Federal agency of a foreign bank, or any subsidiary thereof (other than a broker, dealer, person providing insurance, investment company, or investment adviser), or a savings association, the deposits of which are insured by the Federal Deposit Insurance Corporation, or any subsidiary thereof (other than a broker, dealer, person providing insurance, investment company, or investment adviser), by the Office of the Comptroller of the Currency; (B) a member bank of the Federal Reserve System (other than a national bank), a branch or agency of a foreign bank (other than a Federal branch, Federal agency, or insured State branch of a foreign bank), a commercial lending company owned or controlled by a foreign bank, an organization operating under section 25 or 25A of the Federal Reserve Act ( 12 U.S.C. 601 (C) a bank, the deposits of which are insured by the Federal Deposit Insurance Corporation (other than a member of the Federal Reserve System), an insured State branch of a foreign bank, or any subsidiary thereof (other than a broker, dealer, person providing insurance, investment company, or investment adviser), by the Board of Directors of the Federal Deposit Insurance Corporation; (2) the Federal Credit Union Act ( 12 U.S.C. 1751 et seq. (3) the Securities Exchange Act of 1934 ( 15 U.S.C. 78a et seq. (4) the Investment Company Act of 1940 ( 15 U.S.C. 80a–1 et seq. (5) the Investment Advisers Act of 1940 ( 15 U.S.C. 80b–1 et seq. (6) the Commodity Exchange Act ( 7 U.S.C. 1 et seq. (7) the provisions of title XIII of the Housing and Community Development Act of 1992 ( 12 U.S.C. 4501 et seq. (8) State insurance law, in the case of any person engaged in providing insurance, by the applicable State insurance authority of the State in which the person is domiciled; and (9) the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. (A) notwithstanding section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) 47 U.S.C. 151 et seq. (B) notwithstanding the Federal Aviation Act of 1958 (49 U.S.C. App. 1301 et seq.), include the authority to enforce compliance by air carriers and foreign air carriers; and (C) notwithstanding the Packers and Stockyards Act ( 7 U.S.C. 181 et seq. (b) Application to cable operators, satellite operators, and telecommunications carriers (1) Data security and breach notification Sections 201, 202, 222, 338, and 631 of the Communications Act of 1934 ( 47 U.S.C. 201 (2) Rule of construction Nothing in this subsection limits authority of the Federal Communication Commission with respect to sections 201, 202, 222, 338, and 631 of the Communications Act of 1934 ( 47 U.S.C. 201 6. Relation to State law No requirement or prohibition may be imposed under the laws of any State with respect to the responsibilities of any person to— (1) protect the security of information relating to consumers that is maintained, communicated, or otherwise handled by, or on behalf of, the person; (2) safeguard information relating to consumers from— (A) unauthorized access; and (B) unauthorized acquisition; (3) investigate or provide notice of the unauthorized acquisition of, or access to, information relating to consumers, or the potential misuse of the information, for fraudulent, illegal, or other purposes; or (4) mitigate any potential or actual loss or harm resulting from the unauthorized acquisition of, or access to, information relating to consumers. 7. Delayed effective date for certain provisions Sections 4 and 6 shall take effect 1 year after the date of enactment of this Act.

Summary: Data Security Act of 2015 (Sec. 4) This bill requires individuals, corporations, or other non-government entities that access, maintain, communicate, or handle sensitive financial account information or nonpublic personal information to: (1) implement an information security program to protect the security and confidentiality of such information against anticipated threats, hazards, or unauthorized acquisitions; and (2) notify consumers, state and federal law enforcement, appropriate administrative agencies, payment card networks, and consumer reporting agencies of certain data breaches of sensitive information that is not encrypted, redacted, or protected and is likely to cause harm to the consumers. The types of sensitive information subject to this bill include: consumer financial account numbers (including credit or debit card numbers) in combination with security codes, passwords, or personal identification information required to access an account; non-truncated Social Security numbers; the first name or initial and last name of a consumer in combination with numbers issued on government documents used to verify identity (e.g., driver's license, passport, or military identification numbers), usernames and passwords for email or consumer accounts, or consumer biometric data used to gain access to financial accounts; and medical and health insurance information. The requirements of this bill do not apply to information lawfully made available to the general public that is obtained from government records or widely distributed media. The entities subject to this bill must: (1) designate employees to coordinate their information security programs; (2) identify reasonably foreseeable internal and external risks; (3) assess, design, and implement safeguards; (4) oversee their third-party service providers; and (5) adjust security in light of risk assessments, testing, changes to operations or business arrangements, or other circumstances that may impact the security program. Entities must require their third-party service providers by contract to implement appropriate safeguards and assess compliance with such contractual obligations. If appropriate, entities must adopt: access controls and authentication procedures for information systems; access restrictions at physical locations; encryption of electronic information; procedures to ensure that any information system modifications are consistent with security programs; dual control procedures, segregation of duties, and criminal background checks for employees with access to sensitive information; monitoring systems to detect intrusions; response programs that specify actions to be taken when an entity suspects or detects unauthorized access; and measures to protect against destruction of information due to fire, water damage, or technological failures. If an entity has a board of directors: (1) the board must direct the entity to have a written information security program in place and appoint personnel to oversee the program, and (2) an annual report shall be made to the board describing the status and implementation of the entity's security program. Entities must investigate data breaches they believe may have occurred in relation to the sensitive information they handle or that is handled on their behalf. If an entity determines that an unauthorized acquisition is reasonably likely to harm consumers, the entity must notify within the most expedient time possible: federal and state law enforcement; the Federal Trade Commission (FTC) or the appropriate federal or state administrative enforcement agency designated to enforce this bill with respect to banks or other financial institutions; payment card networks, if the breach involves card numbers; consumer reporting agencies, if the breach involves 5,000 or more consumers; and all consumers to whom the sensitive information relates. An entity's notice to consumers about a breach must be provided by telephone, email, or written notification to a postal address. An entity may use a substitute notification method in print and to broadcast media if telephonic, email, or written notification is infeasible because of: (1) insufficient contact information, (2) costs exceeding $250,000, (3) the number of consumers exceeding 500,000, or (4) exigent circumstances. Notifications may be delayed at the request of a law enforcement agency. Third-party service providers contracted to maintain, store, or process data in electronic form on behalf of another entity must provide notice regarding a breach to: (1) such entity, and (2) consumers if so provided under the contract. Certain electronic data carriers that provide only transmission, routing, transient storage, or network connection services must notify entities that initiate connections or transmissions that become involved in a breach involving sensitive information if: (1) the carrier becomes aware of the breach, and (2) the entity that owns or licenses the information can be reasonably identified. The entity that initiated the connection must then provide the required notices under this bill. Financial institutions may communicate with account holders regarding breaches at other entities with access to their account information. The bill provides alternative compliance procedures for: (1) financial institutions and affiliates under the Gramm-Leach-Bliley Act, and (2) entities complying with certain health record privacy laws under the Health Information Technology for Economic and Clinical Health Act or regulations under the Health Insurance Portability and Accountability Act of 1996. (Sec. 5) The bill designates the federal or state administrative enforcement agencies responsible for enforcing compliance with this bill by banks, financial institutions, or entities that are not financial institutions. Depending on the type of entity, the enforcement must be conducted by the FTC, the Office of the Comptroller of the Currency, the Federal Reserve Board, the Federal Deposit Insurance Corporation, the National Credit Union Administration Board, the Securities and Exchange Commission, the Commodity Futures Trading Commission, the Federal Housing Finance Agency, state insurance regulators, the state of domicile, or state securities commissioners. Cable operators, satellite operators, or telecommunications carriers whose information security practices are subject to enforcement under this bill are exempt from certain other information security and breach notification requirements under the Communications Act of 1934 and regulations promulgated by the Federal Communications Commission. State attorneys general may enforce this bill with respect to entities that are not financial institutions. (Sec. 6) No state law, regulatory requirement, or prohibition may be imposed with respect to the responsibilities of any person to: (1) protect the security of consumer information, (2) safeguard consumer information from unauthorized access or acquisition, (3) investigate or provide notice of unauthorized acquisition or access, or (4) mitigate any potential or actual loss or harm resulting from unauthorized acquisition or access of consumer information.