I 
114TH CONGRESS 
1ST SESSION H. R. 1704 
To establish a national data breach notification standard, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 26, 2015 
Mr. LANGEVIN introduced the following bill; which was referred to the Com-
mittee on Energy and Commerce, and in addition to the Committee on 
the Judiciary, for a period to be subsequently determined by the Speaker, 
in each case for consideration of such provisions as fall within the juris-
diction of the committee concerned 
A BILL 
To establish a national data breach notification standard, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Personal Data Notification and Protection Act of 2015’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
TITLE I—NATIONAL DATA BREACH NOTIFICATION STANDARD 
VerDate Sep 11 2014 
20:38 Apr 07, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
Sec. 101. Notification to individuals. 
Sec. 102. Exemptions from notification to individuals. 
Sec. 103. Methods of notification. 
Sec. 104. Content of notification. 
Sec. 105. Coordination of notification with credit reporting agencies. 
Sec. 106. Notification for law enforcement and other purposes. 
Sec. 107. Enforcement by the Federal Trade Commission. 
Sec. 108. Enforcement by State attorneys general. 
Sec. 109. Effect on State law. 
Sec. 110. Reporting on security breaches. 
Sec. 111. Excluded business entities. 
Sec. 112. Definitions. 
Sec. 113. Effective date. 
TITLE II—EXTRATERRITORIAL APPLICATION OF CYBER CRIME 
LAW 
Sec. 201. Extraterritorial jurisdiction. 
TITLE 
I—NATIONAL 
DATA 
BREACH 
NOTIFICATION 
STANDARD 
SEC. 101. NOTIFICATION TO INDIVIDUALS. 
(a) IN GENERAL.—Except as provided for in section 
102, any business entity engaged in or affecting interstate 
commerce, that uses, accesses, transmits, stores, disposes 
of, or collects sensitive personally identifiable information 
about more than 10,000 individuals during any 12-month 
period shall, following the discovery of a security breach 
of such information, notify, in accordance with sections 
103 and 104, any individual whose sensitive personally 
identifiable information has been, or is reasonably believed 
to have been, accessed or acquired. 
(b) OBLIGATIONS
OF
AND
TO
OWNER
OR
LI-
CENSEE.— 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(1) NOTIFICATION TO OWNER OR LICENSEE.— 
Any business entity engaged in or affecting inter-
state commerce, that uses, accesses, transmits, 
stores, disposes of, or collects sensitive personally 
identifiable information that the business entity does 
not own or license shall notify the owner or licensee 
of the information following the discovery of a secu-
rity breach involving such information, unless there 
is no reasonable risk of harm or fraud to such owner 
or licensee. 
(2) NOTIFICATION BY OWNER, LICENSEE, OR 
OTHER DESIGNATED THIRD PARTY.—Nothing in this 
title shall prevent or abrogate an agreement between 
a business entity required to provide notification 
under this section and a designated third party, in-
cluding an owner or licensee of the sensitive person-
ally identifiable information subject to the security 
breach, to provide the notifications required under 
subsection (a). 
(3) BUSINESS ENTITY RELIEVED FROM GIVING 
NOTIFICATION.—A business entity required to pro-
vide notification under subsection (a) shall not be re-
quired to provide such notification if an owner or li-
censee of the sensitive personally identifiable infor-
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
mation subject to the security breach, or other des-
ignated third party, provides such notification. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay following the discovery by the business en-
tity of a security breach. A business entity shall, 
upon the request of the Commission, provide records 
or other evidence of the notifications required under 
this section. 
(2) REASONABLE DELAY.— 
(A) IN GENERAL.—Except as provided in 
subsection (d), reasonable delay under this sub-
section shall not exceed 30 days, unless the 
business entity seeking additional time requests 
an extension of time and the Commission deter-
mines that additional time is reasonably nec-
essary to determine the scope of the security 
breach, prevent further disclosures, conduct the 
risk assessment, restore the reasonable integrity 
of the data system, or provide notice to the 
breach notification entity. 
(B) EXTENSION.—If the Commission de-
termines that additional time is reasonably nec-
essary as described in subparagraph (A), the 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
Bureau of Investigation provides written notification 
that further extension of the time period is nec-
essary. The Director of the United States Secret 
Service or the Director of the Federal Bureau of In-
vestigation may extend the time period for additional 
periods of up to 30 days each. 
(3) IMMUNITY.—No cause of action for which 
jurisdiction is based under section 1346(b) of title 
28, United States Code, shall lie against any Federal 
law enforcement agency for acts relating to the ex-
tension of the deadline for notification for law en-
forcement or national security purposes under this 
section. 
(e) DESIGNATION OF BREACH NOTIFICATION ENTI-
TY.—Not later than 60 days after the date of the enact-
ment of this Act, the Secretary of Homeland Security shall 
designate a Federal Government entity to receive notices, 
reports, and information about information security inci-
dents, threats, and vulnerabilities under this title. 
SEC. 102. EXEMPTIONS FROM NOTIFICATION TO INDIVID-
UALS. 
(a) EXEMPTION FOR NATIONAL SECURITY AND LAW 
ENFORCEMENT.— 
(1) IN
GENERAL.—Notwithstanding section 
101, if the Director of the United States Secret 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
Service or the Director of the Federal Bureau of In-
vestigation determines that notification of the secu-
rity breach required by such section could be ex-
pected to reveal sensitive sources and methods or 
similarly impede the ability of a Federal, State, or 
local law enforcement agency to conduct law enforce-
ment investigations, or if the Director of the Federal 
Bureau of Investigation determines that notification 
of the security breach could be expected to cause 
damage to national security, such notification is not 
required. 
(2) IMMUNITY.—No cause of action for which 
jurisdiction is based under section 1346(b) of title 
28, United States Code, shall lie against any Federal 
law enforcement agency for acts relating to the ex-
tension of the deadline for notification for law en-
forcement or national security purposes under this 
section. 
(b) SAFE HARBOR.— 
(1) IN GENERAL.—A business entity is exempt 
from the notification requirement under section 101, 
if the following requirements are met: 
(A) RISK
ASSESSMENT.—A risk assess-
ment, in accordance with paragraph (3), is con-
ducted by or on behalf of the business entity 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
that concludes that there is no reasonable risk 
that a security breach has resulted in, or will 
result in, harm to the individuals whose sen-
sitive personally identifiable information was 
subject to the security breach. 
(B) NOTICE
TO
COMMISSION.—Without 
unreasonable delay and not later than 30 days 
after the discovery of a security breach, unless 
extended by the Commission, the Director of 
the United States Secret Service, or the Direc-
tor of the Federal Bureau of Investigation 
under section 101 (in which case, before the ex-
tended deadline), the business entity notifies 
the Commission, in writing, of— 
(i) the results of the risk assessment; 
and 
(ii) the decision by the business entity 
to invoke the risk assessment exemption 
described under subparagraph (A). 
(C) DETERMINATION
BY
COMMISSION.— 
During the period beginning on the date on 
which the notification described in subpara-
graph (B) is submitted and ending 10 days 
after such date, the Commission has not issued 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
a determination in writing that a notification 
should be provided under section 101. 
(2) REBUTTABLE
PRESUMPTION.—For pur-
poses of paragraph (1)— 
(A) the rendering of sensitive personally 
identifiable information at issue unusable, 
unreadable, or indecipherable through a secu-
rity technology generally accepted by experts in 
the field of information security shall establish 
a rebuttable presumption that such reasonable 
risk does not exist; and 
(B) any such presumption shall be rebutta-
ble by facts demonstrating that the security 
technologies or methodologies in a specific case 
have been, or are reasonably likely to have 
been, compromised. 
(3) RISK ASSESSMENT REQUIREMENTS.—A risk 
assessment is in accordance with this paragraph if 
the following requirements are met: 
(A) PROPERLY CONDUCTED.—The risk as-
sessment is conducted in a reasonable manner 
or according to standards generally accepted by 
experts in the field of information security. 
(B) LOGGING DATA REQUIRED.—The risk 
assessment includes logging data, as applicable 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
and to the extent available, for a period of at 
least six months before the discovery of a secu-
rity breach described in section 101(a)— 
(i) for each communication or at-
tempted communication with a database or 
data system containing sensitive personally 
identifiable information, the data system 
communication information for the com-
munication or attempted communication, 
including any Internet addresses, and the 
date and time associated with the commu-
nication or attempted communication; and 
(ii) all log-in information associated 
with databases or data systems containing 
sensitive personally identifiable informa-
tion, including both administrator and user 
log-in information. 
(C) FRAUDULENT OR MISLEADING INFOR-
MATION.—The risk assessment does not contain 
fraudulent or deliberately misleading informa-
tion. 
(c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
(1) IN GENERAL.—A business entity is exempt 
from the notification requirement under section 101 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
if the business entity uses or participates in a secu-
rity program that— 
(A) effectively blocks the use of the sen-
sitive personally identifiable information to ini-
tiate unauthorized financial transactions before 
they are charged to the account of the indi-
vidual; and 
(B) provides notification to affected indi-
viduals after a security breach that has resulted 
in fraud or unauthorized transactions. 
(2) LIMITATION.—The exemption in paragraph 
(1) does not apply if the information subject to the 
security breach includes the individual’s first and 
last name or any other type of sensitive personally 
identifiable information other than a credit card 
number or credit card security code. 
SEC. 103. METHODS OF NOTIFICATION. 
A business entity shall be in compliance with the re-
quirements of this section if, with respect to the method 
of notification as required under section 101, the following 
requirements are met: 
(1) INDIVIDUAL NOTIFICATION.—Notification to 
an individual is by one of the following means: 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the business entity. 
(B) Telephone notification to the individual 
personally. 
(C) E-mail notification, if the individual 
has consented to receive such notification and 
the notification is consistent with the provisions 
permitting electronic transmission of notifica-
tions under section 101 of the Electronic Signa-
tures in Global and National Commerce Act (15 
U.S.C. 7001). 
(2) MEDIA NOTIFICATION.—If the number of 
residents of a State whose sensitive personally iden-
tifiable information was, or is reasonably believed to 
have been, accessed or acquired by an unauthorized 
person exceeds 5,000, notification is provided to 
media reasonably calculated to reach such individ-
uals, such as major media outlets serving a State or 
jurisdiction. 
SEC. 104. CONTENT OF NOTIFICATION. 
The notification provided to individuals required by 
section 101 shall include, to the extent possible, the fol-
lowing: 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
(1) A description of the categories of sensitive 
personally identifiable information that was, or is 
reasonably believed to have been, accessed or ac-
quired by an unauthorized person. 
(2) A toll-free number— 
(A) that the individual may use to contact 
the business entity, or the agent of the business 
entity; and 
(B) from which the individual may learn 
what types of sensitive personally identifiable 
information the business entity maintained 
about that individual. 
(3) The toll-free contact telephone numbers and 
addresses for the major credit reporting agencies 
and the Commission. 
(4) The name of the business entity that has a 
direct business relationship with the individual. 
(5) Notwithstanding section 109, any informa-
tion regarding victim protection assistance required 
by the State in which the individual resides. 
SEC. 105. COORDINATION OF NOTIFICATION WITH CREDIT 
REPORTING AGENCIES. 
(a) REQUIREMENT TO NOTIFY CREDIT REPORTING 
AGENCIES.—If a business entity is required to notify more 
than 5,000 individuals under section 101, the business en-
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
tity shall also notify each consumer reporting agency that 
compiles and maintains files on consumers on a nation-
wide basis (as defined in section 603(p) of the Fair Credit 
Reporting Act (15 U.S.C. 1681a(p))) of the timing and 
distribution of the notifications. Such notification shall be 
given to the consumer credit reporting agencies without 
unreasonable delay and, if it will not delay notification to 
the affected individuals, prior to the distribution of notifi-
cations to the affected individuals. 
(b) REASONABLE DELAY.—Reasonable delay under 
subsection (a) shall not exceed 30 days following the dis-
covery of a security breach, except as provided in sub-
section (c) or (d) of section 101 (in which case, before 
the extended deadline), or unless the business entity pro-
viding notification can demonstrate to the Commission 
that additional time is reasonably necessary to determine 
the scope of the security breach, prevent further disclo-
sures, conduct the risk assessment, restore the reasonable 
integrity of the data system, and provide notice to the 
breach notification entity. If the Commission determines 
that additional time is necessary, the Commission may ex-
tend the time period for notification for additional periods 
of up to 30 days each. Any such extension shall be pro-
vided in writing. 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 106. NOTIFICATION FOR LAW ENFORCEMENT AND 
OTHER PURPOSES. 
(a) NOTIFICATION TO LAW ENFORCEMENT AND NA-
TIONAL SECURITY AUTHORITIES.—Any business entity 
shall notify the breach notification entity, and the breach 
notification entity shall promptly notify and provide that 
information to the United States Secret Service, the Fed-
eral Bureau of Investigation, and the Commission for civil 
law enforcement purposes, and shall make it available as 
appropriate to other Federal agencies for law enforcement, 
national security, or computer security purposes, if— 
(1) the number of individuals whose sensitive 
personally identifiable information was, or is reason-
ably believed to have been, accessed or acquired by 
an unauthorized person exceeds 5,000; 
(2) the security breach involves a database, 
networked or integrated databases, or other data 
system containing the sensitive personally identifi-
able information of more than 500,000 individuals 
nationwide; 
(3) the security breach involves databases 
owned by the Federal Government; or 
(4) the security breach involves primarily sen-
sitive personally identifiable information of individ-
uals known to the business entity to be employees 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS
and contractors of the Federal Government involved 
in national security or law enforcement. 
(b) REGULATIONS.—Not later than one year after the 
date of enactment of this Act, the Commission shall pro-
mulgate regulations (in accordance with section 553 of 
title 5, United States Code) in consultation with the Attor-
ney General and the Secretary of Homeland Security, that 
describe what information is required to be included in the 
notification under subsection (a). In addition the Commis-
sion shall promulgate regulations, as necessary, (in ac-
cordance with section 553 of title 5, United States Code) 
in consultation with the Attorney General, to adjust the 
thresholds for notification to law enforcement and national 
security authorities under subsection (a) and to facilitate 
the purposes of this section. 
(c) TIMING OF NOTIFICATION.—The notification re-
quired under this section shall be provided as promptly 
as possible and at least 72 hours before notification of an 
individual pursuant to section 101 or 10 days after dis-
covery of the breach requiring notification, whichever 
comes first. 
SEC. 107. ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A violation of this title or a regulation promulgated under 
VerDate Sep 11 2014 
03:07 Apr 03, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1704.IH
H1704
mstockstill on DSK4VPTVN1PROD with BILLS