Code), in consultation with the Attorney General, to ad-
just the thresholds for notification to law enforcement and 
national security authorities under subsection (a) and to 
facilitate the purposes of this section. 
(c) TIMING OF NOTIFICATION.—The notification re-
quired under this section shall be provided as promptly 
as possible and at least 72 hours before notification of an 
individual pursuant to section 2 or 10 days after discovery 
of the breach requiring notification, whichever comes first. 
SEC. 8. ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A violation of this Act or a regulation promulgated under 
this Act shall be treated as a violation of a regulation 
under section 18(a)(1)(B) of the Federal Trade Commis-
sion Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or de-
ceptive acts or practices. 
(b) POWERS OF COMMISSION.—The Federal Trade 
Commission shall enforce this Act and the regulations pro-
mulgated under this Act in the same manner, by the same 
means, and with the same jurisdiction, powers, and duties 
as though all applicable terms and provisions of the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.) were 
incorporated into and made a part of this Act, except that 
the exceptions described in section 5(a)(2) of such Act (15 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
U.S.C. 45(a)(2)) shall not apply. Any business entity who 
violates this Act or a regulation promulgated under this 
Act shall be subject to the penalties and entitled to the 
privileges and immunities provided in the Federal Trade 
Commission Act. 
(c) FEDERAL COMMUNICATIONS COMMISSION.—In a 
case in which enforcement under this Act involves a busi-
ness entity that is subject to the authority of the Federal 
Communications Commission, in enforcement actions by 
the Commission, the Commission shall consult with the 
Federal Communications Commission. 
(d) CONSUMER FINANCIAL PROTECTION BUREAU.— 
In a case in which enforcement under this Act relates to 
financial information or information associated with the 
provision of a consumer financial product or service, in 
enforcement actions by the Commission, the Commission 
shall consult with the Consumer Financial Protection Bu-
reau. 
(e) CONSULTATION WITH THE ATTORNEY GENERAL 
REQUIRED.—The Commission shall consult with the At-
torney General before opening an investigation. If the At-
torney General determines that such an investigation 
would impede an ongoing criminal investigation or na-
tional security activity, the Commission may not open such 
investigation. 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(f) REGULATIONS.— 
(1) IN GENERAL.—The Commission may pro-
mulgate regulations, in addition to the regulations 
promulgated pursuant to section 7(b), relating to the 
duties of the Commission under this Act, in accord-
ance with section 553 of title 5, United States Code, 
as the Commission determines to be necessary to 
carry out this Act. 
(2) FEDERAL COMMUNICATIONS COMMISSION.— 
With regard to a regulation promulgated under this 
section that relates to an entity subject to the au-
thority of the Federal Communications Commission, 
the Commission may only promulgate such regula-
tion after consultation with the Federal Communica-
tions Commission. 
(3) CONSUMER
FINANCIAL
PROTECTION
BU-
REAU.—With regard to a regulation promulgated 
under this section that relates to financial informa-
tion or information associated with the provision of 
a consumer financial product or service, the Com-
mission may only promulgate such regulation after 
consultation with the Consumer Financial Protection 
Bureau. 
SEC. 9. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.— 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or an official or agency 
of a State has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by an act or practice in viola-
tion of this Act or a regulation promulgated under 
this Act, the State, as parens patriae, may bring a 
civil action on behalf of the residents of the State in 
an appropriate State court or an appropriate district 
court of the United States to— 
(A) enjoin that practice; 
(B) enforce compliance with this Act; or 
(C) impose civil penalties of not more than 
$1,000 per day per individual whose sensitive 
personally identifiable information was, or is 
reasonably believed to have been, accessed or 
acquired by an unauthorized person, up to a 
maximum of $1,000,000 per violation, unless 
such conduct is found to be willful or inten-
tional. 
(2) NOTICE.—Before filing an action under 
paragraph (1), the attorney general, official, or 
agency of the State involved shall provide to the At-
torney General and the Commission— 
(A) a written notice of the action; and 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(B) a copy of the complaint for the action. 
(3) ATTORNEY GENERAL CERTIFICATION.—An 
action may not be filed under paragraph (1) if the 
Attorney General determines that the filing would 
impede a criminal investigation or national security 
activity. 
(b) AUTHORITY OF FEDERAL TRADE COMMISSION.— 
Upon receiving notice under subsection (a)(2), the Com-
mission may— 
(1) move to stay the action, pending the final 
disposition of a pending Federal proceeding or ac-
tion; 
(2) initiate an action in the appropriate United 
States district court under section 8 and move to 
consolidate all pending actions, including State ac-
tions, in such court; 
(3) intervene in the action brought under sub-
section (a); or 
(4) file petitions for appeal. 
(c) PENDING PROCEEDINGS.—If the Commission has 
instituted a proceeding or action for a violation of this Act 
or any regulations promulgated under this Act, a State 
attorney general, official, or agency may not bring an ac-
tion under this Act during the pendency of the Federal 
proceeding or action against any defendant named in such 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
proceeding or action for any violation that is alleged in 
such proceeding or action. 
(d) CONSTRUCTION.—For purposes of bringing any 
civil action under subsection (a), nothing in this Act shall 
be construed to prevent an attorney general, official, or 
agency of a State from exercising the powers conferred 
on such attorney general, official, or agency by the laws 
of that State to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
partnership, sole proprietorship, unincorporated as-
sociation, or venture, whether or not established to 
make a profit. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) CONSUMER FINANCIAL PRODUCT OR SERV-
ICE.—The term ‘‘consumer financial product or 
service’’ has the meaning given that term in section 
1002 of the Dodd-Frank Wall Street Reform and 
Consumer Protection Act (12 U.S.C. 5481). 
(5) DATA SYSTEM COMMUNICATION INFORMA-
TION.—The term ‘‘data system communication in-
formation’’ means dialing, routing, addressing, or 
signaling information that identifies the origin, di-
rection, destination, processing, transmission, or ter-
mination of each communication initiated, at-
tempted, or received. 
(6) DATE
AND
TIME.—The term ‘‘date and 
time’’ includes the date, time, and specification of 
the time zone offset from Coordinated Universal 
Time. 
(7) FEDERAL
AGENCY.—The term ‘‘Federal 
agency’’ has the meaning given the term ‘‘agency’’ 
in section 3502 of title 44, United States Code. 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(8) INTELLIGENCE
COMMUNITY.—The term 
‘‘intelligence community’’ has the meaning given 
that term in section 3(4) of the National Security 
Act of 1947 (50 U.S.C. 3003(4)). 
(9) INTERNET ADDRESS.—The term ‘‘Internet 
address’’ means an Internet Protocol address as 
specified by the Internet Protocol version 4 or 6 pro-
tocol, or any successor protocol or any unique num-
ber for a specific host on the Internet. 
(10) SECURITY BREACH.— 
(A) IN
GENERAL.—The term ‘‘security 
breach’’ means a compromise of the security, 
confidentiality, or integrity of, or the loss of, 
computerized data that results in, or there is a 
reasonable basis to conclude has resulted in— 
(i) the unauthorized acquisition of 
sensitive personally identifiable informa-
tion; or 
(ii) access to sensitive personally iden-
tifiable information that is for an unau-
thorized purpose, or in excess of authoriza-
tion. 
(B) 
EXCLUSION.—The 
term 
‘‘security 
breach’’ does not include any lawfully author-
ized investigative, protective, or intelligence ac-
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
tivity of a law enforcement agency of the 
United States, a State, or a political subdivision 
of a State, or of an element of the intelligence 
community. 
(11) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means any information or com-
pilation of information, in electronic or digital form 
that includes one or more of the following: 
(A) An individual’s first and last name or 
first initial and last name in combination with 
any two of the following data elements: 
(i) Home address or telephone num-
ber. 
(ii) Mother’s maiden name. 
(iii) Month, day, and year of birth. 
(B) A Social Security number (but not in-
cluding only the last four digits of a Social Se-
curity number), driver’s license number, pass-
port number, or alien registration number or 
other Government-issued unique identification 
number. 
(C) Unique biometric data such as a finger 
print, voice print, a retina or iris image, or any 
other unique physical representation. 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(D) A unique account identifier, including 
a financial account number or credit or debit 
card number, electronic identification number, 
user name, or routing code. 
(E) A user name or electronic mail ad-
dress, in combination with a password or secu-
rity question and answer that would permit ac-
cess to an online account. 
(F) Any combination of the following data 
elements: 
(i) An individual’s first and last name 
or first initial and last name. 
(ii) A unique account identifier, in-
cluding a financial account number or 
credit or debit card number, electronic 
identification number, user name, or rout-
ing code. 
(iii) Any security code, access code, or 
password, or source code that could be 
used to generate such codes or passwords. 
(12) 
MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule promul-
gated under section 553 of title 5, United States 
Code, amend the definition of ‘‘sensitive personally 
identifiable information’’ to the extent that such 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
amendment will accomplish the purposes of this Act. 
In amending the definition, the Commission may de-
termine— 
(A) that any particular combinations of in-
formation are sensitive personally identifiable 
information; or 
(B) that any particular piece of informa-
tion, on its own, is sensitive personally identifi-
able information. 
SEC. 14. EFFECTIVE DATE. 
This Act shall take effect 90 days after the date of 
enactment of this Act. 
Æ 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6301
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS