not feasible due to excessive cost to the person re-
quired to provide such notification relative to the 
resources of such person. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
with respect to compliance with this section. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute notification under paragraph (2)(B), 
including the extent of notification to print 
and broadcast media that complies with the 
requirements of such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.—A 
person required to provide notification under subsection (a) 
shall, upon request of an individual whose personal infor-
mation was included in the breach of security, provide or 
arrange for the provision of, to each such individual and 
at no cost to such individual, consumer credit reports from 
at least one of the major credit reporting agencies beginning 
not later than 2 months following the discovery of a breach 
of security and continuing on a quarterly basis for a period 
of 2 years thereafter. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(f) EXEMPTION.— 
(1) GENERAL EXEMPTION.—A person shall be ex-
empt from the requirements under this section if, fol-
lowing a breach of security, such person determines 
that there is no reasonable risk of identity theft, 
fraud, or other unlawful conduct. 
(2) PRESUMPTIONS.— 
(A) ENCRYPTION.—The encryption of data 
in electronic form shall establish a presumption 
that no reasonable risk of identity theft, fraud, 
or other unlawful conduct exists following a 
breach of security of such data. Any such pre-
sumption may be rebutted by facts dem-
onstrating that the encryption has been or is rea-
sonably likely to be compromised. 
(B) 
ADDITIONAL
METHODOLOGIES
OR 
TECHNOLOGIES.—Not later than 270 days after 
the date of the enactment of this Act, the Com-
mission shall, by rule pursuant to section 553 of 
title 5, United States Code, identify any addi-
tional security methodology or technology, other 
than encryption, which renders data in elec-
tronic form unreadable or indecipherable, that 
shall, if applied to such data, establish a pre-
sumption that no reasonable risk of identity 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
theft, fraud, or other unlawful conduct exists fol-
lowing a breach of security of such data. Any 
such presumption may be rebutted by facts dem-
onstrating that any such methodology or tech-
nology has been or is reasonably likely to be com-
promised. In promulgating such a rule, the Com-
mission shall consult with relevant industries, 
consumer organizations, and data security and 
identity theft prevention experts and established 
standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 year after 
the date of the enactment of this Act, the Commission 
shall issue guidance regarding the application of the 
exemption in paragraph (1). 
(g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—If the Commission, upon receiving notification of 
any breach of security that is reported to the Commission 
under subsection (a)(2), finds that notification of such a 
breach of security via the Commission’s Internet website 
would be in the public interest or for the protection of con-
sumers, the Commission shall place such a notice in a clear 
and conspicuous location on its Internet website. 
(h) FTC STUDY ON NOTIFICATION IN LANGUAGES IN 
ADDITION TO ENGLISH.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall conduct 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
a study on the practicality and cost effectiveness of requir-
ing the notification required by subsection (d)(1) to be pro-
vided in a language in addition to English to individuals 
known to speak only such other language. 
SEC. 4. ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF COMMISSION.—The Commission 
shall enforce this Act in the same manner, by the 
same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made 
a part of this Act. Any person who violates such regu-
lations shall be subject to the penalties and entitled to 
the privileges and immunities provided in that Act. 
(3) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the deploy-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS