this title shall be treated as a violation of a regulation 
under section 18(a)(1)(B) of the Federal Trade Commis-
sion Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or de-
ceptive acts or practices. 
(b) POWERS OF COMMISSION.—The Federal Trade 
Commission shall enforce this title and the regulations 
promulgated under this title in the same manner, by the 
same means, and with the same jurisdiction, powers, and 
duties as though all applicable terms and provisions of the 
Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
were incorporated into and made a part of this Act, except 
that the exceptions described in section 5(a)(2) of such 
Act (15 U.S.C. 45(a)(2)) shall not apply. Any business 
entity who violates this title or a regulation promulgated 
under this title shall be subject to the penalties and enti-
tled to the privileges and immunities provided in the Fed-
eral Trade Commission Act. 
(c) FEDERAL COMMUNICATIONS COMMISSION.—In a 
case in which enforcement under this title involves a busi-
ness entity that is subject to the authority of the Federal 
Communications Commission, enforcement actions by the 
Commission, the Commission shall consult with the Fed-
eral Communications Commission. 
(d) CONSUMER FINANCIAL PROTECTION BUREAU.— 
In a case in which enforcement under this title relates to 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
financial information or information associated with the 
provision of a consumer financial product or service, en-
forcement actions by the Commission, the Commission 
shall consult with the Consumer Financial Protection Bu-
reau. 
(e) CONSULTATION WITH THE ATTORNEY GENERAL 
REQUIRED.—The Commission shall consult with the At-
torney General before opening an investigation. If the At-
torney General determines that such an investigation 
would impede an ongoing criminal investigation or na-
tional security activity, the Commission may not open such 
investigation. 
(f) REGULATIONS.— 
(1) IN GENERAL.—The Commission may pro-
mulgate regulations, in addition to the regulations 
promulgated pursuant to section 106(b), relating to 
the duties of the Commission under this title, in ac-
cordance with section 553 of title 5, United States 
Code, as the Commission determines to be necessary 
to carry out this title. 
(2) FEDERAL COMMUNICATIONS COMMISSION.— 
With regard to a regulation promulgated under this 
section that relates to an entity subject to the au-
thority of the Federal Communications Commission, 
the Commission may only promulgate such regula-
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
tion after consultation with the Federal Communica-
tions Commission. 
(3) CONSUMER
FINANCIAL
PROTECTION
BU-
REAU.—With regard to a regulation promulgated 
under this section that relates to financial informa-
tion or information associated with the provision of 
a consumer financial product or service, the Com-
mission may only promulgate such regulation after 
consultation with the Consumer Financial Protection 
Bureau. 
SEC. 108. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or an official or agency 
of a State has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by an act or practice in viola-
tion of this title or a regulation promulgated under 
this title, the State, as parens patriae, may bring a 
civil action on behalf of the residents of the State in 
an appropriate State court or an appropriate district 
court of the United States to— 
(A) enjoin that practice; 
(B) enforce compliance with this title; or 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(C) impose civil penalties of not more than 
$1,000 per day per individual whose sensitive 
personally identifiable information was, or is 
reasonably believed to have been, accessed or 
acquired by an unauthorized person, up to a 
maximum of $1,000,000 per violation, unless 
such conduct is found to be willful or inten-
tional. 
(2) NOTICE.—Before filing an action under 
paragraph (1), the attorney general, official, or 
agency of the State involved shall provide to the At-
torney General and the Commission— 
(A) a written notice of the action; and 
(B) a copy of the complaint for the action. 
(3) ATTORNEY GENERAL CERTIFICATION.—An 
action may not be filed under paragraph (1) if the 
Attorney General determines that the filing would 
impede a criminal investigation or national security 
activity. 
(b) AUTHORITY OF FEDERAL TRADE COMMISSION.— 
Upon receiving notice under subsection (a)(2), the Com-
mission may— 
(1) move to stay the action, pending the final 
disposition of a pending Federal proceeding or ac-
tion; 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(2) initiate an action in the appropriate United 
States district court under section 107 and move to 
consolidate all pending actions, including State ac-
tions, in such court; 
(3) intervene in the action brought under sub-
section (a); or 
(4) file petitions for appeal. 
(c) PENDING PROCEEDINGS.—If the Commission has 
instituted a proceeding or action for a violation of this title 
or any regulations promulgated under this title, a State 
attorney general, official, or agency may not bring an ac-
tion under this title during the pendency of the Federal 
action against any defendant named in such proceeding 
or action for any violation that is alleged in that pro-
ceeding or action. 
(d) CONSTRUCTION.—For purposes of bringing any 
civil action under subsection (a), nothing in this title shall 
be construed to prevent an attorney general, official, or 
agency of a State from exercising the powers conferred 
on such attorney general, official, or agency by the laws 
of that State to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
SEC. 109. EFFECT ON STATE LAW. 
The provisions of this title shall supersede any provi-
sion of the law of any State, or a political subdivision 
thereof, relating to notification by a business entity en-
gaged in interstate commerce of a security breach, except 
as provided in section 104(5). 
SEC. 110. REPORTING ON SECURITY BREACHES. 
(a) REPORT REQUIRED ON NATIONAL SECURITY AND 
LAW ENFORCEMENT EXEMPTIONS.—Not later than 18 
months after the date of enactment of this title, and annu-
ally thereafter, the Director of the United States Secret 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
Service and the Director of the Federal Bureau of Inves-
tigation shall submit to the Committee on Energy and 
Commerce of the House of Representatives and the Com-
mittee on Commerce, Science, and Transportation of the 
Senate on a report on the number and nature of security 
breaches subject to the national security and law enforce-
ment exemptions under section 102(a). 
(b) REPORT REQUIRED ON SAFE HARBOR EXEMP-
TIONS.—Not later than 18 months after the date of enact-
ment of this title, and annually thereafter, the Commission 
shall submit to the Committee on Energy and Commerce 
of the House of Representatives and the Committee on 
Commerce, Science, and Transportation of the Senate a 
report on the number and nature of the security breaches 
described in the notices filed by business entities invoking 
the risk assessment exemption under section 102(b) and 
the response of the Commission to such notices. 
SEC. 111. EXCLUDED BUSINESS ENTITIES. 
Nothing in this title, or the regulations promulgated 
under this title, shall apply to— 
(1) business entities to the extent that such en-
tities act as covered entities or business associates 
(as such terms are defined in section 13400 of the 
Health Information Technology for Economic and 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
Clinical Health Act (42 U.S.C. 17921)) subject to 
section 13402 of such Act (42 U.S.C. 17932); and 
(2) business entities to the extent that they act 
as vendors of personal health records (as such term 
is defined in section 13400 of such Act (42 U.S.C. 
17921)) and third-party service providers subject to 
section 13407 of such Act (42 U.S.C. 17937). 
SEC. 112. DEFINITIONS. 
In this title: 
(1) AFFILIATE.—The term ‘‘affiliate’’ means 
persons related by common ownership or by cor-
porate control. 
(2) BREACH NOTIFICATION ENTITY.—The term 
‘‘breach notification entity’’ means the Federal Gov-
ernment entity designated pursuant to section 
101(e). 
(3) BUSINESS
ENTITY.—The term ‘‘business 
entity’’ means any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated as-
sociation, or venture, whether or not established to 
make a profit. 
(4) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(5) CONSUMER FINANCIAL PRODUCT OR SERV-
ICE.—The term ‘‘consumer financial product or 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
service’’ has the meaning given that term in section 
1002 of the Dodd-Frank Wall Street Reform and 
Consumer Protection Act (12 U.S.C. 5481). 
(6) DATA SYSTEM COMMUNICATION INFORMA-
TION.—The term ‘‘data system communication in-
formation’’ means dialing, routing, addressing, or 
signaling information that identifies the origin, di-
rection, destination, processing, transmission, or ter-
mination of each communication initiated, at-
tempted, or received. 
(7) DATE
AND
TIME.—The term ‘‘date and 
time’’ includes the date, time, and specification of 
the time zone offset from Coordinated Universal 
Time. 
(8) FEDERAL
AGENCY.—The term ‘‘Federal 
agency’’ has the meaning given the term ‘‘agency’’ 
in section 3502 of title 44, United States Code. 
(9) INTELLIGENCE
COMMUNITY.—The term 
‘‘intelligence community’’ has the meaning given 
that term in section 3(4) of the National Security 
Act of 1947 (50 U.S.C. 3003(4)). 
(10) INTERNET ADDRESS.—The term ‘‘Internet 
address’’ means an Internet Protocol address as 
specified by the Internet Protocol version 4 or 6 pro-
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
tocol, or any successor protocol or any unique num-
ber for a specific host on the Internet. 
(11) SECURITY BREACH.— 
(A) IN
GENERAL.—The term ‘‘security 
breach’’ means a compromise of the security, 
confidentiality, or integrity of, or the loss of, 
computerized data that results in, or there is a 
reasonable basis to conclude has resulted in— 
(i) the unauthorized acquisition of 
sensitive personally identifiable informa-
tion; or 
(ii) access to sensitive personally iden-
tifiable information that is for an unau-
thorized purpose, or in excess of authoriza-
tion. 
(B) 
EXCLUSION.—The 
term 
‘‘security 
breach’’ does not include any lawfully author-
ized investigative, protective, or intelligence ac-
tivity of a law enforcement agency of the 
United States, a State, or a political subdivision 
of a State, or of an element of the intelligence 
community. 
(12) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means any information or com-
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
pilation of information, in electronic or digital form 
that includes one or more of the following: 
(A) An individual’s first and last name or 
first initial and last name in combination with 
any two of the following data elements: 
(i) Home address or telephone num-
ber. 
(ii) Mother’s maiden name. 
(iii) Month, day, and year of birth. 
(B) A social security number (but not in-
cluding only the last four digits of a social secu-
rity number), driver’s license number, passport 
number, or alien registration number or other 
government-issued unique identification num-
ber. 
(C) Unique biometric data such as a finger 
print, voice print, a retina or iris image, or any 
other unique physical representation. 
(D) A unique account identifier, including 
a financial account number or credit or debit 
card number, electronic identification number, 
user name, or routing code. 
(E) A user name or electronic mail ad-
dress, in combination with a password or secu-
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
rity question and answer that would permit ac-
cess to an online account. 
(F) Any combination of the following data 
elements: 
(i) An individual’s first and last name 
or first initial and last name. 
(ii) A unique account identifier, in-
cluding a financial account number or 
credit or debit card number, electronic 
identification number, user name, or rout-
ing code. 
(iii) Any security code, access code, or 
password, or source code that could be 
used to generate such codes or passwords. 
(13) 
MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule promul-
gated under section 553 of title 5, United States 
Code, amend the definition of ‘‘sensitive personally 
identifiable information’’ to the extent that such 
amendment will accomplish the purposes of this 
title. In amending the definition, the Commission 
may determine— 
(A) that any particular combinations of in-
formation are sensitive personally identifiable 
information; or 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(B) that any particular piece of informa-
tion, on its own, is sensitive personally identifi-
able information. 
SEC. 113. EFFECTIVE DATE. 
This title shall take effect 90 days after the date of 
enactment of this Act. 
TITLE 
II—EXTRATERRITORIAL 
APPLICATION 
OF 
CYBER 
CRIME LAW 
SEC. 201. EXTRATERRITORIAL JURISDICTION. 
Subsection (h) of section 1029 of title 18, United 
States Code, is amended to read as follows: 
‘‘(h) Any person who, outside the jurisdiction of the 
United States, engages in any act that, if committed with-
in the jurisdiction of the United States, would constitute 
an offense under subsection (a) or (b), shall be subject 
to the fines, penalties, imprisonment, and forfeiture pro-
vided in this title if the offense involves an access device 
issued, owned, managed, or controlled by a financial insti-
tution, account issuer, credit card system member, or 
other entity organized under the laws of the United 
States, or any State, the District of Columbia, or other 
territory of the United States.’’. 
Æ 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6301
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS