location of, number from which and to 
which a call is placed, and the time and 
duration of such call. 
(B) EXCEPTIONS.—The term ‘‘personal in-
formation’’ does not include— 
(i) information that is encrypted or 
rendered unusable, unreadable, or indeci-
pherable through data security technology 
or methodology that is generally accepted 
by experts in the field of information secu-
rity at the time the breach of security oc-
curred, such as redaction or access con-
trols; or 
(ii) information available in a publicly 
available source, including information ob-
tained from a news report, periodical, or 
other widely distributed media, or from 
Federal, 
State, 
or 
local 
government 
records. 
(11) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means a covered entity subject to the 
Communications Act of 1934 (47 U.S.C. 151 et 
seq.) that provides electronic data transmission, 
routing, intermediate and transient storage, or con-
nection to its system or network, where such entity 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
providing such service does not select or modify the 
content of the electronic data, is not the sender or 
the intended recipient of the data, and does not dif-
ferentiate personal information from other informa-
tion that such entity transmits, routes, stores, or for 
which such entity provides connections. Any such en-
tity shall be treated as a service provider under this 
Act only to the extent that it is engaged in the pro-
vision of such transmission, routing, intermediate 
and transient storage, or connections. 
(12) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ has the meaning given 
such term under section 3 of the Small Business Act 
(15 U.S.C. 632). 
(13) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, the 
Commonwealth of Puerto Rico, Guam, American 
Samoa, the Virgin Islands of the United States, the 
Commonwealth of the Northern Mariana Islands, 
any other territory or possession of the United 
States, and each federally recognized Indian tribe. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—No State or political subdivision of a State shall, 
with respect to a covered entity subject to this Act, adopt, 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
maintain, enforce, or impose or continue in effect any law, 
rule, regulation, duty, requirement, standard, or other 
provision having the force and effect of law relating to or 
with respect to the security of data in electronic form or 
notification following a security breach of such data. 
(b) COMMON LAW.—This section shall not exempt a 
covered entity from liability under common law. 
(c) CERTAIN FTC ENFORCEMENT LIMITED TO DATA 
SECURITY AND BREACH NOTIFICATION.— 
(1) DATA
SECURITY
AND
BREACH
NOTIFICA-
TION.—Insofar as sections 201, 202, 222, 338, and 
631 of the Communications Act of 1934 (47 U.S.C. 
201, 202, 222, 338, and 551), and any regulations 
promulgated thereunder, apply to covered entities 
with respect to securing information in electronic 
form from unauthorized access, including notifica-
tion of unauthorized access to data in electronic 
form containing personal information, such sections 
and regulations promulgated thereunder shall have 
no force or effect, unless such regulations pertain 
solely to 9–1–1 calls. 
(2) RULE OF CONSTRUCTION.—Nothing in this 
subsection otherwise limits the Federal Communica-
tions Commission’s authority with respect to sec-
tions 201, 202, 222, 338, and 631 of the Commu-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
nications Act of 1934 (47 U.S.C. 201, 202, 222, 
338, and 551). 
(d) PRESERVATION OF COMMISSION AUTHORITY.— 
Nothing in this Act may be construed in any way to limit 
or affect the Commission’s authority under any other pro-
vision of law. 
SEC. 7. EDUCATION AND OUTREACH FOR SMALL BUSI-
NESSES. 
The Commission shall conduct education and out-
reach for small business concerns on data security prac-
tices and how to prevent hacking and other unauthorized 
access to, acquisition of, or use of data maintained by such 
small business concerns. 
SEC. 8. WEBSITE ON DATA SECURITY BEST PRACTICES. 
The Commission shall establish and maintain an 
Internet website containing non-binding best practices for 
businesses regarding data security and how to prevent 
hacking and other unauthorized access to, acquisition of, 
or use of data maintained by such businesses. 
SEC. 9. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of 
enactment of this Act. 
Æ 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6301
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS