I 
109TH CONGRESS 
2D SESSION 
H. R. 5582 
To require Federal agencies, and persons engaged in interstate commerce, 
in possession of data containing personal information, to disclose any 
unauthorized acquisition of such information. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 12, 2006 
Mr. LANTOS introduced the following bill; which was referred to the Com-
mittee on Energy and Commerce, and in addition to the Committees on 
Government Reform and Financial Services, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To require Federal agencies, and persons engaged in inter-
state commerce, in possession of data containing personal 
information, to disclose any unauthorized acquisition of 
such information. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Notification of Risk 
to Personal Data Act’’. 
SEC. 2. DEFINITIONS. 
In this Act, the following definitions shall apply: 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(1) AGENCY.—The term ‘‘agency’’ has the same 
meaning given such term in section 551(1) of title 
5, United States Code. 
(2) BREACH OF SECURITY OF THE SYSTEM.— 
The term ‘‘breach of security of the system’’— 
(A) means the compromise of the security, 
confidentiality, or integrity of data that results 
in, or there is a reasonable basis to conclude 
has resulted in, the unauthorized acquisition of 
personal information maintained by the person 
or business; and 
(B) does not include good faith acquisition 
of personal information by an employee or 
agent of the person or business for the purposes 
of the person or business, if the personal infor-
mation is not used or subject to further unau-
thorized disclosure. 
(3) PERSON.—The term ‘‘person’’ has the same 
meaning given such term in section 551(2) of title 
5, United States Code. 
(4) PERSONAL INFORMATION.—The term ‘‘per-
sonal information’’ means an individual’s last name 
in combination with any 1 or more of the following 
data elements: 
(A) Social security number. 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(B) Driver’s license number or State iden-
tification number. 
(C) Account number or credit or debit card 
number, or, if a security code, access code, or 
password is required for access to an individ-
ual’s account, the account number or credit or 
debit card number, in combination with the re-
quired code or password. 
(5) SUBSTITUTE
NOTICE.—The term ‘‘sub-
stitute notice’’ means— 
(A) conspicuous posting of the notice on 
the Internet site of the agency or person, if the 
agency or person maintains a public Internet 
site; and 
(B) notification to major print and broad-
cast media, including major media in metropoli-
tan and rural areas where the individual whose 
personal information was, or is reasonably be-
lieved to have been, acquired resides. The notice 
to media shall include a toll-free phone number 
where an individual can learn whether or not 
that individual’s personal data is included in 
the security breach. 
SEC. 3. DATABASE SECURITY. 
(a) DISCLOSURE OF SECURITY BREACH.— 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(1) IN GENERAL.—Any agency, or person en-
gaged in interstate commerce, that owns, licenses, or 
collects data, whether or not held in electronic form, 
containing personal information shall, following the 
discovery of a breach of security of the system main-
tained by the agency or person that contains such 
data, or upon receipt of notice under paragraph (2), 
notify any individual of the United States whose per-
sonal information was, or is reasonably believed to 
have been, acquired by an unauthorized person. 
(2) NOTIFICATION OF OWNER OR LICENSEE.— 
Any agency, or person engaged in interstate com-
merce, in possession of data, whether or not held in 
electronic form, containing personal information that 
the agency does not own or license shall notify the 
owner or licensee of the information if the personal 
information was, or is reasonably believed to have 
been, acquired by an unauthorized person through a 
breach of security of the system containing such 
data. 
(3) TIMELINESS OF NOTIFICATION.— 
(A) IN
GENERAL.—All notifications re-
quired under paragraph (1) or (2) shall be 
made without unreasonable delay following— 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(i) the discovery by the agency or per-
son of a breach of security of the system; 
(ii) any measures necessary to deter-
mine the scope of the breach, prevent fur-
ther disclosures, and restore the reasonable 
integrity of the data system; and 
(iii) receipt of written notice that a 
law enforcement agency has determined 
that the notification will no longer seri-
ously impede its investigation, where notifi-
cation is delayed as provided in paragraph 
(4). 
(B) BURDEN OF PROOF.—The agency or 
person required to provide notification under 
this subsection shall have the burden of dem-
onstrating that all notifications were made as 
required under this paragraph, including evi-
dence demonstrating the necessity of any delay. 
(4) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW ENFORCEMENT PURPOSES.—If a law enforce-
ment agency determines that the notification re-
quired under this subsection would seriously impede 
a criminal investigation, such notification may be de-
layed upon the written request of the law enforce-
ment agency. 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(5) EXCEPTION FOR NATIONAL SECURITY AND 
LAW ENFORCEMENT.— 
(A) IN
GENERAL.—This subsection shall 
not apply to an agency if the head of the agen-
cy certifies, in writing, that notification of the 
breach as required by this subsection reason-
ably could be expected to— 
(i) cause damage to the national secu-
rity; and 
(ii) hinder a law enforcement inves-
tigation or the ability of the agency to con-
duct law enforcement investigations. 
(B) LIMITS
ON
CERTIFICATIONS.—The 
head of an agency may not execute a certifi-
cation under subparagraph (A) to— 
(i) conceal violations of law, ineffi-
ciency, or administrative error; 
(ii) prevent embarrassment to a per-
son, organization, or agency; or 
(iii) restrain competition. 
(C) NOTICE.—In every case in which a 
head of an agency issues a certification under 
subparagraph (A), a copy of the certification, 
accompanied by a concise description of the fac-
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
tual basis for the certification, shall be imme-
diately provided to the Congress. 
(6) METHODS OF NOTICE.—An agency, or per-
son engaged in interstate commerce, shall be in com-
pliance with this subsection if it provides the indi-
vidual, with— 
(A) written notification; 
(B) e-mail notice, if the individual has con-
sented to receive such notice and the notice is 
consistent with the provisions permitting elec-
tronic transmission of notices under section 101 
of the Electronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 7001); or 
(C) substitute notice, if— 
(i) the agency or person demonstrates 
that the cost of providing direct notice 
would exceed $500,000; 
(ii) the number of individuals to be 
notified exceeds 500,000; or 
(iii) the agency or person does not 
have sufficient contact information for 
those to be notified. 
(7) CONTENT
OF
NOTIFICATION.—Regardless 
of the method by which notice is provided to individ-
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
uals under paragraphs (1) and (2), such notice shall 
include— 
(A) to the extent possible, a description of 
the categories of information that was, or is 
reasonably believed to have been, acquired by 
an unauthorized person, including social secu-
rity numbers, driver’s license or State identi-
fication numbers and financial data; 
(B) a toll-free number— 
(i) that the individual may use to con-
tact the agency or person, or the agent of 
the agency or person; and 
(ii) from which the individual may 
learn— 
(I) what types of information the 
agency or person maintained about 
that individual or about individuals in 
general; and 
(II) whether or not the agency or 
person maintained information about 
that individual; and 
(C) the toll-free contact telephone numbers 
and addresses for the major credit reporting 
agencies. 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(8) COORDINATION
OF
NOTIFICATION
WITH 
CREDIT
REPORTING
AGENCIES.—If an agency or 
person is required to provide notification to more 
than 1,000 individuals under this subsection, the 
agency or person shall also notify, without unreason-
able delay, all consumer reporting agencies that 
compile and maintain files on consumers on a na-
tionwide basis (as defined in section 603(p) of the 
Fair Credit Reporting Act (15 U.S.C. 1681a(p)) of 
the timing and distribution of the notices. 
(b) CIVIL REMEDIES.— 
(1) PENALTIES.—Any agency, or person en-
gaged in interstate commerce, that violates sub-
section (a) shall be subject to a fine of— 
(A) not more than $1,000 per individual 
whose personal information was, or is reason-
ably believed to have been, acquired by an un-
authorized person; or 
(B) not more than $50,000 per day while 
the failure to give notice under subsection (a) 
persists. 
(2) EQUITABLE RELIEF.—Any agency or person 
that violates, proposes to violate, or has violated this 
section may be enjoined from further violations by a 
court of competent jurisdiction. 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(3) OTHER
RIGHTS
AND
REMEDIES.—The 
rights and remedies available under this subsection 
are cumulative and shall not affect any other rights 
and remedies available under law. 
(c) ENFORCEMENT.—The Federal Trade Commission 
or other appropriate regulator, is authorized to enforce 
compliance with this section, including the assessment of 
fines under subsection (b)(1). 
(d) FRAUD ALERT.—Section 605A(b)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 
amended by inserting ‘‘, or evidence that the consumer 
has received notice that the consumer’s personal financial 
information has or may have been compromised,’’ after 
‘‘identity theft report’’. 
SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State has reason to believe 
that an interest of the residents of that State has 
been or is threatened or adversely affected by the 
engagement of any person in a practice that is pro-
hibited under this Act, the State, as parens patriae, 
may bring a civil action on behalf of the residents 
of the State in a district court of the United States 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
of appropriate jurisdiction or any other court of 
competent jurisdiction, including a State court, to— 
(A) enjoin that practice; 
(B) enforce compliance with this Act; 
(C) obtain damages, restitution, or other 
compensation on behalf of residents of the 
State; or 
(D) obtain such other relief as the court 
may consider to be appropriate. 
(2) NOTICE.— 
(A) IN GENERAL.—Before filing an action 
under paragraph (1), the attorney general of 
the State involved shall provide to the Attorney 
General of the United States— 
(i) written notice of the action; and 
(ii) a copy of the complaint for the ac-
tion. 
(B) EXEMPTION.— 
(i) IN GENERAL.—Subparagraph (A) 
shall not apply with respect to the filing of 
an action by an attorney general of a State 
under this subsection, if the State attorney 
general determines that it is not feasible to 
provide the notice described in such sub-
paragraph before the filing of the action. 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general 
of a State shall provide notice and a copy 
of the complaint to the Attorney General 
at the time the State attorney general files 
the action. 
(b) CONSTRUCTION.—For purposes of bringing any 
civil action under subsection (a), nothing in this Act shall 
be construed to prevent an attorney general of a State 
from exercising the powers conferred on such attorney 
general by the laws of that State to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(c) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
SEC. 5. EFFECT ON STATE LAW. 
The provisions of this Act shall supersede any incon-
sistent provisions of law of any State or unit of local gov-
ernment with respect to the conduct required by the spe-
cific provisions of this Act. 
SEC. 6. EFFECTIVE DATE. 
This Act shall take effect on the expiration of the 
date which is 6 months after the date of enactment of 
this Act. 
Æ 
VerDate Aug 31 2005 
03:40 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6301
E:\BILLS\H5582.IH
H5582
hmoore on PROD1PC68 with HMBILLS