Data Security Act of 2015

To protect information relating to consumers, to require notice of security breaches, and for other purposes. 1. Short title This Act may be cited as the Data Security Act of 2015 2. Purposes The purposes of this Act are— (1) to establish strong and uniform national data security and breach notification standards for electronic data; and (2) to expressly preempt any related State laws in order to provide the Federal Trade Commission with authority to enforce such standards for entities covered under this Act. 3. Definitions For purposes of this Act, the following definitions shall apply: (1) Affiliate The term affiliate (2) Agency The term agency (3) Breach of data security (A) In general The term breach of data security (B) Exception for data that is not in usable form The term breach of data security (4) Carrier The term carrier (A) provides electronic data transmission, routing, intermediate, and transient storage, or connections to its system or network; (B) does not select or modify the content of the electronic data; (C) is not the sender or the intended recipient of the data; and (D) does not differentiate sensitive account information or sensitive personal information from other information that the entity transmits, routes, stores in intermediate or transient storage, or for which such entity provides connections. (5) Commission The term Commission (6) Consumer The term consumer (7) Consumer reporting agency that compiles and maintains files on consumers on a nationwide basis The term consumer reporting agency that compiles and maintains files on consumers on a nationwide basis 15 U.S.C. 1681a(p) (8) Covered entity (A) In general The term covered entity (B) Exception The term covered entity (9) Financial institution The term financial institution 15 U.S.C. 6809(3) (10) Information security program The term information security program (11) Sensitive account information The term sensitive account information (12) Sensitive personal information (A) In general The term sensitive personal information (i) a Social Security number; or (ii) the first and last name of a consumer in combination with— (I) the consumer’s driver’s license number, passport number, military identification number, or other similar number issued on a government document used to verify identity; (II) information that could be used to access a consumer’s account, such as a user name and password or e-mail and password; or (III) biometric data of the consumer used to gain access to financial accounts of the consumer. (B) Exception The term sensitive personal information (i) Federal, State, or local government records; or (ii) widely distributed media. (13) Substantial harm or inconvenience The term substantial harm or inconvenience (A) identity theft; or (B) fraudulent transactions on financial accounts. (14) Third-party service provider The term third-party service provider 4. Protection of information and security breach notification (a) Security procedures required (1) In general Each covered entity shall develop, implement, and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards that are reasonably designed to achieve the objectives in paragraph (2). (2) Objectives The objectives of this subsection are to— (A) ensure the security and confidentiality of sensitive account information and sensitive personal information; (B) protect against any anticipated threats or hazards to the security or integrity of such information; and (C) protect against unauthorized acquisition of such information that could result in substantial harm to the individuals to whom such information relates. (3) Limitation A covered entity’s information security program under paragraph (1) shall be appropriate to— (A) the size and complexity of the covered entity; (B) the nature and scope of the activities of the covered entity; and (C) the sensitivity of the consumer information to be protected. (4) Elements In order to develop, implement, and maintain its information security program, a covered entity shall— (A) designate an employee or employees to coordinate the information security program; (B) identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of sensitive account information and sensitive personal information and assess the sufficiency of any safeguards in place to control these risks, including consideration of risks in each relevant area of the covered entity’s operations, including— (i) employee training and management; (ii) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (iii) detecting, preventing and responding to attacks, intrusions, or other systems failures; (C) design and implement information safeguards to control the risks identified in its risk assessment, and regularly assess the effectiveness of the safeguards’ key controls, systems, and procedures; (D) oversee service providers by— (i) taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the sensitive account information or sensitive personal information at issue; (ii) requiring service providers by contract to implement and maintain such safeguards; and (iii) reasonably oversee or obtain an assessment of the service provider’s compliance with contractual obligations, where appropriate in light of the covered entity’s risk assessment; and (E) evaluate and adjust the information security program in light of the results of the risk assessments and testing and monitoring required by subparagraphs (C) and (D) and any material changes to the covered entity’s operations or business arrangements, or any other circumstances that the covered entity knows or has reason to know may have a material impact on its information security program. (5) Security controls Each covered entity shall— (A) consider whether the following security measures are appropriate for the covered entity and, if so, adopt those measures that the covered entity concludes are appropriate— (i) access controls on information systems, including controls to authenticate and permit access only to authorized individuals and controls to prevent employees from providing sensitive account information or sensitive personal information to unauthorized individuals who may seek to obtain this information through fraudulent means; (ii) access restrictions at physical locations containing sensitive account information or sensitive personal information, such as buildings, computer facilities, and records storage facilities, to permit access only to authorized individuals; (iii) encryption of electronic sensitive account information or sensitive personal information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access; (iv) procedures designed to ensure that information system modifications are consistent with the covered entity’s information security program; (v) dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for, or access to, sensitive account information or sensitive personal information; (vi) monitoring systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems; (vii) response programs that specify actions to be taken when the covered entity suspects or detects that unauthorized individuals have gained access to information systems; and (viii) measures to protect against destruction, loss, or damage of sensitive account information or sensitive personal information due to potential environmental hazards, such as fire and water damage or technological failures; (B) develop, implement, and maintain appropriate measures to properly dispose of sensitive account information and sensitive personal information; and (C) train staff to implement the covered entity’s information security program. (6) Administrative requirements (A) Board oversight If a covered entity has a board of directors, the covered entity’s board of directors or an appropriate committee of the board shall— (i) approve the covered entity’s written information security program; and (ii) oversee the development, implementation, and maintenance of the covered entity’s information security program, including assigning specific responsibility for its implementation and reviewing reports from management. (B) Report to the board If a covered entity has a board of directors, the covered entity shall report to its board or an appropriate committee of the board at least annually, including describing— (i) the overall status of the information security program and the covered entity’s compliance with this Act; and (ii) material matters related to its program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations and management’s responses, and recommendations for changes in the information security program. (b) Investigation required (1) In general If a covered entity believes that a breach of data security has or may have occurred in relation to sensitive account information or sensitive personal information that is maintained, communicated, or otherwise handled by, or on behalf of, the covered entity, the covered entity shall conduct an investigation to— (A) assess the nature and scope of the incident; (B) identify any sensitive account information or sensitive personal information that may have been involved in the incident; (C) determine if the sensitive account information or sensitive personal information has been acquired without authorization; and (D) take reasonable measures to restore the security and confidentiality of the systems compromised in the breach. (c) Notice required If a covered entity determines under subsection (b)(1)(C) that the unauthorized acquisition of sensitive account information or sensitive personal information involved in a breach of data security is reasonably likely to cause substantial harm to the consumers to whom the information relates, the covered entity, or a third party acting on behalf of the covered entity, shall— (1) notify, without unreasonable delay— (A) an appropriate Federal law enforcement agency; (B) the appropriate agency or authority identified in section 5; (C) any relevant payment card network, if the breach involves a breach of payment card numbers; (D) each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, if the breach involves sensitive personal information or sensitive account information relating to 5,000 or more consumers; and (E) all consumers to whom the sensitive account information or sensitive personal information relates; (2) provide notice to consumers by— (A) written notification sent to the postal address of the consumer in the records of the covered entity; (B) telephonic notification to the number of the consumer in the records of the covered entity; (C) e-mail of the consumer or other electronic means in the records of the covered entity; or (D) substitute notification in print and to broadcast media where the individual whose personal information was acquired resides, if providing written or e-mail notification is not feasible due to— (i) lack of sufficient contact information for the consumers that must be notified; (ii) excessive cost to the covered entity; or (iii) exigent circumstances; and (3) provide notice that includes— (A) a description of the type of sensitive account information or sensitive personal information involved in the breach of data security; (B) a general description of the actions taken by the covered entity to restore the security and confidentiality of the sensitive account information or sensitive personal information involved in the breach of data security; and (C) a summary of rights of victims of identity theft prepared by the Commission under section 609(d) of the Fair Credit Reporting Act ( 15 U.S.C. 1681g(d) (d) Clarification A financial institution shall have no obligation under this Act for a breach of security at another covered entity involving sensitive account information relating to an account owned by the financial institution. (e) Special notification requirements (1) Third-party service providers In the event of a breach of data security of a system maintained by a third-party entity that has been contracted to maintain, store, or process data in electronic form containing sensitive account information or sensitive personal information on behalf of a covered entity who owns or possesses such data, such third-party shall— (A) notify the covered entity; and (B) notify consumers if it is agreed in writing that the third-party service provider will provide such notification on behalf of the covered entity. (2) Carrier obligations (A) In general If a carrier becomes aware of a breach of data security involving data in electronic form containing sensitive account information or sensitive personal information that is owned or licensed by a covered entity that connects to or uses a system or network provided by the carrier for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, such carrier shall notify the covered entity who initiated such connection, transmission, routing, or storage of the data containing sensitive account information or sensitive personal information, if such covered entity can be reasonably identified. If a service provider is acting solely as a service provider for purposes of this subsection, the service provider has no other notification obligations under this section. (B) Covered entities who receive notice from carriers Upon receiving notification from a service provider under paragraph (1), a covered entity shall provide notification as required under this section. (3) Communications with account holders If a covered entity that is not a financial institution experiences a breach of data security involving sensitive account information, a financial institution that issues an account to which the sensitive account information relates may communicate with the account holder regarding the breach, including— (A) an explanation that the financial institution was not breached, and that the breach occurred at a third-party that had access to the consumer’s sensitive account information; or (B) identify the covered entity that experienced the breach after the covered entity has provided notice consistent with this Act. (f) Compliance (1) In general An entity shall be deemed to be in compliance with— (A) in the case of a financial institution— (i) subsection (a), if the financial institution maintains policies and procedures to protect the confidentiality and security of sensitive account information and sensitive personal information that are consistent with the policies and procedures of the financial institution that are designed to comply with the requirements of section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) (ii) subsections (b) and (c), if the financial institution— (I) (aa) maintains policies and procedures to investigate and provide notice to consumers of breaches of data security that are consistent with the policies and procedures of the financial institution that are designed to comply with the investigation and notice requirements established by regulations or guidance under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) (bb) is an affiliate of a bank holding company that maintains policies and procedures to investigate and provide notice to consumers of breaches of data security that are consistent with the policies and procedures of a bank that is an affiliate of the financial institution, and the policies and procedures of the bank are designed to comply with the investigation and notice requirements established by any regulations or guidance under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) (cc) (AA) is an affiliate of a savings and loan holding company that maintains policies and procedures to investigate and provide notice to consumers of data breaches of data security that are consistent with the policies and procedures of a savings association that is an affiliate of the financial institution; and (BB) the policies and procedures of the savings association are designed to comply with the investigation and notice requirements established by any regulations or guidelines under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S. 6801(b)) that are applicable to savings associations; and (II) provides for notice to the entities described under subparagraphs (B), (C), and (D) of subsection (c)(1), if notice is provided to consumers pursuant to the policies and procedures of the financial institution described in subclause (I); and (B) subsections (a), (b), and (c)— (i) if the entity is a covered entity for purposes of the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d-2 (ii) if the entity is in compliance with sections 13402 and 13407 of the HITECH Act (42 U.S.C. 17932 and 17937). (2) Definitions In this subsection— (A) the terms bank holding company bank 12 U.S.C. 1841 (B) the term savings and loan holding company 12 U.S.C. 1467a (C) the term savings association 12 U.S.C. 1462 5. Administrative enforcement (a) In general Notwithstanding any other provision of law section 4 shall be enforced exclusively under— (1) section 8 of the Federal Deposit Insurance Act ( 12 U.S.C. 1818 (A) a national bank, a Federal branch or Federal agency of a foreign bank, or any subsidiary thereof (other than a broker, dealer, person providing insurance, investment company, or investment adviser), or a savings association, the deposits of which are insured by the Federal Deposit Insurance Corporation, or any subsidiary thereof (other than a broker, dealer, person providing insurance, investment company, or investment adviser), by the Office of the Comptroller of the Currency; (B) a member bank of the Federal Reserve System (other than a national bank), a branch or agency of a foreign bank (other than a Federal branch, Federal agency, or insured State branch of a foreign bank), a commercial lending company owned or controlled by a foreign bank, an organization operating under section 25 or 25A of the Federal Reserve Act ( 12 U.S.C. 601 (C) a bank, the deposits of which are insured by the Federal Deposit Insurance Corporation (other than a member of the Federal Reserve System), an insured State branch of a foreign bank, or any subsidiary thereof (other than a broker, dealer, person providing insurance, investment company, or investment adviser), by the Board of Directors of the Federal Deposit Insurance Corporation; (2) the Federal Credit Union Act ( 12 U.S.C. 1751 et seq. (3) the Securities Exchange Act of 1934 ( 15 U.S.C. 78a et seq. (4) the Investment Company Act of 1940 ( 15 U.S.C. 80a–1 et seq. (5) the Investment Advisers Act of 1940 ( 15 U.S.C. 80b–1 et seq. (6) the Commodity Exchange Act ( 7 U.S.C. 1 et seq. (7) the provisions of title XIII of the Housing and Community Development Act of 1992 ( 12 U.S.C. 4501 et seq. (8) State insurance law, in the case of any person engaged in providing insurance, by the applicable State insurance authority of the State in which the person is domiciled; and (9) the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. (A) notwithstanding section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) 47 U.S.C. 151 et seq. (B) notwithstanding the Federal Aviation Act of 1958 (49 U.S.C. App. 1301 et seq.), include the authority to enforce compliance by air carriers and foreign air carriers; and (C) notwithstanding the Packers and Stockyards Act ( 7 U.S.C. 181 et seq. (b) Application to cable operators, satellite operators, and telecommunications carriers (1) Data security and breach notification Sections 201, 202, 222, 338, and 631 of the Communications Act of 1934 ( 47 U.S.C. 201 (2) Rule of construction Nothing in this subsection otherwise limits authority of the Federal Communication Commission with respect to sections 201, 202, 222, 338, and 631 of the Communications Act of 1934 ( 47 U.S.C. 201 (c) No private right of action (1) In general This Act may not be construed to provide a private right of action, including a class action with respect to any Act or practice regulated under this Act. (2) Exception A consumer or entity that suffers financial harm as a result of a covered entity’s violation of this Act may bring an action in a district court of the United States for the judicial district in which the consumer or entity suffered the harm against the covered entity to recover— (A) in the case of a negligent violation of this Act, actual financial damages, court costs allowed by the rules of the court, and reasonable attorney’s fees; and (B) in the case of a knowing violation of this Act, the damages, costs, and attorney’s fees described in subparagraph (A) of this subsection and punitive damages. 6. Relation to State law No requirement or prohibition may be imposed under the laws of any State with respect to the responsibilities of any person to— (1) protect the security of information relating to consumers that is maintained, communicated, or otherwise handled by, or on behalf of, the person; (2) safeguard information relating to consumers from— (A) unauthorized access; and (B) unauthorized acquisition; (3) investigate or provide notice of the unauthorized acquisition of, or access to, information relating to consumers, or the potential misuse of the information, for fraudulent, illegal, or other purposes; or (4) mitigate any potential or actual loss or harm resulting from the unauthorized acquisition of, or access to, information relating to consumers. 7. Delayed effective date for certain provisions Sections 4 and 6 shall take effect 1 year after the date of enactment of this Act.

Summary: Data Security Act of 2015 Requires individuals, corporations, or other non-government entities that access, maintain, communicate, or handle sensitive account information or nonpublic personal information to implement an information security program and to notify consumers, federal law enforcement, appropriate administrative agencies, payment card networks, and consumer reporting agencies of certain data breaches of unencrypted sensitive information likely to cause identity theft or fraudulent transactions on consumer financial accounts. Directs entities to require their service providers by contract to implement appropriate safeguards for sensitive information. Provides special notification procedures for: (1) third-party service providers that maintain data in electronic form on behalf of another entity, and (2) certain electronic data carriers. Allows financial institutions to communicate with account holders regarding breaches at third-party entities with access to their account information. Sets forth alternative compliance procedures for: (1) financial institutions and affiliates under the Gramm-Leach-Bliley Act, and (2) entities complying with certain health record privacy laws. Requires this Act to be enforced by the Federal Trade Commission, the Comptroller of the Currency, the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration Board, the Securities and Exchange Commission, the Commodity Futures Trading Commission, the Office of Federal Housing Enterprise Oversight, or a state insurance authority depending on the type of entity handling the sensitive information. Allows a consumer or entity that suffers financial harm from an entity's violation of this Act to bring an action in federal court to recover damages for negligent or knowing violations. Prohibits certain state laws from being imposed for information security and breach notification purposes. Provides for the requirements of this Act to apply to certain entities in place of existing security practices and notifications standards currently enforced by the Federal Communications Commission.