(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
initial and last name, or address, or phone 
number, in combination with any 1 or more of 
the following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number, passport 
number, military identification number, or 
other similar number issued on a govern-
ment document used to verify identity. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
word that is necessary to permit access to 
an individual’s financial account. 
(B) PUBLIC RECORD INFORMATION.—Such 
term does not include public record information. 
(C) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A)— 
(i) for the purpose of section 2, to the 
extent that such modification is necessary 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
to accomplish the purposes of such section 
as a result of changes in technology or 
practices and will not unreasonably impede 
technological innovation or otherwise ad-
versely affect interstate commerce; and 
(ii) for the purpose of section 3, if the 
Commission determines that access to or 
acquisition of the additional data elements 
in the event of a breach of security would 
create an unreasonable risk of identity 
theft, fraud, or other unlawful conduct and 
that such modification will not unreason-
ably impede technological innovation or 
otherwise adversely affect interstate com-
merce. 
(8) PUBLIC RECORD INFORMATION.—The term 
‘‘public record information’’ means information 
about an individual that is lawfully made available 
to the general public from Federal, State, or local 
government records. 
(9) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means a person that provides electronic 
data transmission, routing, intermediate and tran-
sient storage, or connections to its system or net-
work, where the person providing such services does 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
not select or modify the content of the electronic 
data, is not the sender or the intended recipient of 
the data, and does not differentiate personal infor-
mation from other information that such person 
transmits, routes, or stores, or for which such per-
son provides connections. Any such person shall be 
treated as a service provider under this Act only to 
the extent that it is engaged in the provision of such 
transmission, routing, intermediate and transient 
storage, or connections. 
SEC. 6. RELATION TO OTHER LAWS AND CONFORMING 
AMENDMENTS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
a State, with respect to any entity subject to this Act, that 
contains— 
(1) requirements for information security prac-
tices or treatment of data similar to those under sec-
tion 2; or 
(2) requirements for notification of a breach of 
security similar to the notification required under 
section 3. 
(b) ADDITIONAL PREEMPTION.— 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(1) IN GENERAL.—No person other than a per-
son specified in section 4(c) may bring a civil action 
under the laws of any State if such action is pre-
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an attorney general of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law. 
(e) CONFORMING AMENDMENT.—Section 631(c)(1) 
of the Communications Act of 1934 (47 U.S.C. 551(c)(1)) 
is amended by striking ‘‘and shall take such actions as 
are necessary to prevent unauthorized access to such in-
formation by a person other than the subscriber or cable 
operator’’. 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of 
enactment of this Act. 
Æ 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6301
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS