in the complaint of the Commission for the violation with 
respect to which the Commission instituted such action. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under para-
graph (1) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under paragraph (1), process may be served 
in any district in which— 
(A) the defendant is an inhabitant, may be 
found, or transacts business; or 
(B) venue is proper under section 1391 of 
title 28, United States Code. 
SEC. 6. PRIVATE RIGHT OF ACTION. 
(a) IN GENERAL.—An individual who is injured by 
a violation of section 2 may bring a private right of action 
in any court of appropriate jurisdiction for rescission and 
restitution, as well as for all damages and may be awarded 
injunctive relief against a violation of such section. The 
individual shall also be entitled to recover its costs of liti-
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5165.IH
H5165
amozie on DSK30RV082PROD with BILLS
gation and reasonable attorney’s fees and expert witness 
fees, against any entity or person found to be liable for 
such violation. 
(b) LIABILITY.—Every person who directly or indi-
rectly controls a person liable under subsection (a), every 
partner in a firm so liable, every principal executive officer 
or director of a corporation so liable, every person occu-
pying a similar status or performing similar functions and 
every employee of a person so liable who materially aids 
in the act or transaction constituting the violation is also 
liable jointly and severally with and to the same extent 
as such person, unless the person who would otherwise be 
liable hereunder had no knowledge of or reasonable 
grounds to know of the existence of the facts by reason 
of which the liability is alleged to exist. 
(c) STATUTE OF LIMITATIONS.—No action may be 
commenced pursuant to this section more than the later 
of— 
(1) 2 years after the date on which the violation 
occurs; or 
(2) 2 years after the date on which the violation 
is discovered or should have been discovered through 
exercise of reasonable diligence. 
(d) VENUE.—An action under this section may be 
brought in— 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5165.IH
H5165
amozie on DSK30RV082PROD with BILLS
(1) the district court of the United States that 
meets applicable requirements relating to venue 
under section 1391 of title 28, United States Code; 
or 
(2) another court of competent jurisdiction. 
(e) CUMULATIVE RIGHT.—The private rights pro-
vided for in this section are in addition to and not in lieu 
of other rights or remedies created by Federal or State 
law. 
SEC. 7. DEFINITIONS. 
In this Act— 
(1) the term ‘‘security breach’’— 
(A) means a compromise of the security, 
confidentiality, or integrity of, or the loss of, 
computerized data that results in, or there is a 
reasonable basis to conclude has resulted in— 
(i) the unauthorized acquisition of 
sensitive personally identifiable informa-
tion; or 
(ii) access to sensitive personally iden-
tifiable information that is for an unau-
thorized purpose, or in excess of authoriza-
tion; 
(B) does not include any lawfully author-
ized investigative, protective, or intelligence ac-
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5165.IH
H5165
amozie on DSK30RV082PROD with BILLS
tivity of a law enforcement agency of the 
United States, a State, or a political subdivision 
of a State, or of an element of the intelligence 
community; and 
(2) the term ‘‘sensitive personally identifiable 
information’’ means any information or compilation 
of information, in electronic or digital form that in-
cludes one or more of the following: 
(A) An individual’s first and last name or 
first initial and last name in combination with 
any two of the following data elements: 
(i) Home address or telephone num-
ber. 
(ii) Mother’s maiden name. 
(iii) Month, day, and year of birth. 
(B) A Social Security number (but not in-
cluding only the last four digits of a Social Se-
curity number), driver’s license number, pass-
port number, or alien registration number or 
other Government-issued unique identification 
number. 
(C) Unique biometric data such as a finger 
print, voice print, a retina or iris image, or any 
other unique physical representation. 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5165.IH
H5165
amozie on DSK30RV082PROD with BILLS
(D) A unique account identifier, including 
a financial account number or credit or debit 
card number, electronic identification number, 
user name, or routing code. 
(E) A user name or electronic mail ad-
dress, in combination with a password or secu-
rity question and answer that would permit ac-
cess to an online account. 
(F) Any combination of the following data 
elements: 
(i) An individual’s first and last name 
or first initial and last name. 
(ii) A unique account identifier, in-
cluding a financial account number or 
credit or debit card number, electronic 
identification number, user name, or rout-
ing code. 
(iii) Any security code, access code, or 
password, or source code that could be 
used to generate such codes or passwords. 
Æ 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H5165.IH
H5165
amozie on DSK30RV082PROD with BILLS