State, with respect to those entities covered by the regula-
tions issued pursuant to this Act, that expressly— 
(1) requires information security practices and 
treatment of data in electronic form containing per-
sonal information similar to any of those required 
under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized acquisi-
tion of data in electronic form containing personal 
information. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than the At-
torney General of a State may bring a civil action 
under the laws of any State if such action is premised 
in whole or in part upon the defendant violating any 
provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to limit 
the enforcement of any State consumer protection law 
by an Attorney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This Act 
shall not be construed to preempt the applicability of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those laws 
relate to acts of fraud. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(d) PRESERVATION OF FTC AUTHORITY.—Nothing in 
this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. EFFECTIVE DATE AND SUNSET. 
(a) EFFECTIVE DATE.—This Act shall take effect 1 
year after the date of enactment of this Act. 
(b) SUNSET.—This Act shall cease to be in effect on 
the date that is 10 years from the date of enactment of this 
Act. 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Commis-
sion $1,000,000 for each of fiscal years 2006 through 2010 
to carry out this Act. 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Ac-
countability and Trust Act (DATA)’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES AND PRO-
CEDURES.— 
(1) REGULATIONS.—Not later than 1 
year after the date of enactment of this 
Act, the Commission shall promulgate 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
regulations under section 553 of title 5, 
United States Code, to require each per-
son engaged in interstate commerce that 
owns or possesses data in electronic form 
containing personal information, or con-
tracts to have any third party entity 
maintain such data for such person, to es-
tablish and implement policies and proce-
dures 
regarding 
information 
security 
practices for the treatment and protec-
tion of personal informtion taking into 
consideration— 
(A) the size of, and the nature, 
scope, and complexity of the activi-
ties engaged in by, such person; 
(B) the current state of the art in 
administrative, technical, and phys-
ical safeguards for protecting such in-
formation; and 
(C) the cost of implementing such 
safeguards. 
(2) REQUIREMENTS.—Such regulations 
shall require the policies and procedures 
to include the following: 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(A) A security policy with respect 
to the collection, use, sale, other dis-
semination, and maintenance of such 
personal information. 
(B) The identification of an officer 
or other individual as the point of 
contact with responsibility for the 
management of information security. 
(C) A process for identifying and 
assessing any reasonably foreseeable 
vulnerabilities in the system main-
tained by such person that contains 
such electronic data, which shall in-
clude regular monitoring for a breach 
of security of such system. 
(D) A process for taking preven-
tive and corrective action to mitigate 
against any vulnerabilities identified 
in the process required by subpara-
graph (C), which may include imple-
menting any changes to security 
practices and the architecture, instal-
lation, or implementation of network 
or operating software. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS