IIB 
111TH CONGRESS 
1ST SESSION H. R. 2221 
IN THE SENATE OF THE UNITED STATES 
DECEMBER 9, 2009 
Received; read twice and referred to the Committee on Commerce, Science, 
and Transportation 
AN ACT 
To protect consumers by requiring reasonable security poli-
cies and procedures to protect data containing personal 
information, and to provide for nationwide notice in the 
event of a security breach. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Accountability 
and Trust Act’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES
AND PROCE-
DURES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require each person 
engaged in interstate commerce that owns or pos-
sesses data containing personal information, or con-
tracts to have any third party entity maintain such 
data for such person, to establish and implement 
policies and procedures regarding information secu-
rity practices for the treatment and protection of 
personal information taking into consideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, such 
person; 
(B) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(C) the cost of implementing such safe-
guards. 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(2) REQUIREMENTS.—Such regulations shall 
require the policies and procedures to include the 
following: 
(A) A security policy with respect to the 
collection, use, sale, other dissemination, and 
maintenance of such personal information. 
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system or systems maintained by such person 
that contains such data, which shall include 
regular monitoring for a breach of security of 
such system or systems. 
(D) A process for taking preventive and 
corrective action to mitigate against any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include imple-
menting any changes to security practices and 
the architecture, installation, or implementation 
of network or operating software. 
(E) A process for disposing of data in elec-
tronic form containing personal information by 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
shredding, permanently erasing, or otherwise 
modifying the personal information contained in 
such data to make such personal information 
permanently unreadable or undecipherable. 
(F) A standard method or methods for the 
destruction of paper documents and other non- 
electronic data containing personal information. 
(3) TREATMENT OF ENTITIES GOVERNED BY 
OTHER LAW.—Any person who is in compliance with 
any other Federal law that requires such person to 
maintain standards and safeguards for information 
security and protection of personal information that, 
taken as a whole and as the Commission shall deter-
mine in the rulemaking required under paragraph 
(1), provide protections substantially similar to, or 
greater than, those required under this subsection, 
shall be deemed to be in compliance with this sub-
section. 
(b) SPECIAL REQUIREMENTS
FOR INFORMATION 
BROKERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.— 
The regulations promulgated under subsection (a) 
shall require each information broker to submit its 
security policies to the Commission in conjunction 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
with a notification of a breach of security under sec-
tion 3 or upon request of the Commission. 
(2) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission may conduct audits of the infor-
mation security practices of such information broker, 
or require the information broker to conduct inde-
pendent audits of such practices (by an independent 
auditor who has not audited such information bro-
ker’s security practices during the preceding 5 
years). 
(3) ACCURACY OF AND INDIVIDUAL ACCESS TO 
PERSONAL INFORMATION.— 
(A) ACCURACY.— 
(i) IN
GENERAL.—Each information 
broker shall establish reasonable proce-
dures to assure the maximum possible ac-
curacy of the personal information it col-
lects, assembles, or maintains, and any 
other information it collects, assembles, or 
maintains that specifically identifies an in-
dividual, other than information which 
merely identifies an individual’s name or 
address. 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(ii) LIMITED EXCEPTION FOR FRAUD 
DATABASES.—The requirement in clause 
(i) shall not prevent the collection or main-
tenance of information that may be inac-
curate with respect to a particular indi-
vidual when that information is being col-
lected or maintained solely— 
(I) for the purpose of indicating 
whether there may be a discrepancy 
or irregularity in the personal infor-
mation that is associated with an indi-
vidual; and 
(II) to help identify, or authen-
ticate the identity of, an individual, or 
to protect against or investigate fraud 
or other unlawful conduct. 
(B) CONSUMER
ACCESS
TO
INFORMA-
TION.— 
(i) ACCESS.—Each information broker 
shall— 
(I) provide to each individual 
whose personal information it main-
tains, at the individual’s request at 
least 1 time per year and at no cost 
to the individual, and after verifying 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
cedures outlined in subparagraph (A) 
if such information can be independ-
ently verified. 
(iii) ALTERNATIVE
PROCEDURE
FOR 
CERTAIN
MARKETING
INFORMATION.—In 
accordance with regulations issued under 
clause (v), an information broker that 
maintains any information described in 
clause (i) which is used, shared, or sold by 
such information broker for marketing 
purposes, may, in lieu of complying with 
the access and dispute requirements set 
forth in clauses (i) and (ii), provide each 
individual whose information it maintains 
with a reasonable means of expressing a 
preference not to have his or her informa-
tion used for such purposes. If the indi-
vidual expresses such a preference, the in-
formation broker may not use, share, or 
sell the individual’s information for mar-
keting purposes. 
(iv) LIMITATIONS.—An information 
broker may limit the access to information 
required under subparagraph (B)(i)(I) and 
is not required to provide notice to individ-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
uals as required under subparagraph 
(B)(i)(II) in the following circumstances: 
(I) If access of the individual to 
the information is limited by law or 
legally recognized privilege. 
(II) If the information is used for 
a legitimate governmental or fraud 
prevention purpose that would be 
compromised by such access. 
(III) If the information consists 
of a published media record, unless 
that record has been included in a re-
port about an individual shared with a 
third party. 
(v) RULEMAKING.—Not later than 1 
year after the date of the enactment of this 
Act, the Commission shall promulgate reg-
ulations under section 553 of title 5, 
United States Code, to carry out this para-
graph and to facilitate the purposes of this 
Act. In addition, the Commission shall 
issue regulations, as necessary, under sec-
tion 553 of title 5, United States Code, on 
the scope of the application of the limita-
tions in clause (iv), including any addi-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
tional circumstances in which an informa-
tion broker may limit access to information 
under such clause that the Commission de-
termines to be appropriate. 
(C) FCRA REGULATED
PERSONS.—Any 
information broker who is engaged in activities 
subject to the Fair Credit Reporting Act and 
who is in compliance with sections 609, 610, 
and 611 of such Act with respect to information 
subject to such Act, shall be deemed to be in 
compliance with this paragraph with respect to 
such information. 
(4) REQUIREMENT OF AUDIT LOG OF ACCESSED 
AND TRANSMITTED INFORMATION.—Not later than 
1 year after the date of the enactment of this Act, 
the Commission shall promulgate regulations under 
section 553 of title 5, United States Code, to require 
information brokers to establish measures which fa-
cilitate the auditing or retracing of any internal or 
external access to, or transmissions of, any data con-
taining personal information collected, assembled, or 
maintained by such information broker. 
(5) PROHIBITION ON PRETEXTING BY INFOR-
MATION BROKERS.— 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(A) PROHIBITION
ON
OBTAINING
PER-
SONAL INFORMATION BY FALSE PRETENSES.— 
It shall be unlawful for an information broker 
to obtain or attempt to obtain, or cause to be 
disclosed or attempt to cause to be disclosed to 
any person, personal information or any other 
information relating to any person by— 
(i) making a false, fictitious, or fraud-
ulent statement or representation to any 
person; or 
(ii) providing any document or other 
information to any person that the infor-
mation broker knows or should know to be 
forged, counterfeit, lost, stolen, or fraudu-
lently obtained, or to contain a false, ficti-
tious, or fraudulent statement or represen-
tation. 
(B) PROHIBITION
ON
SOLICITATION
TO 
OBTAIN PERSONAL INFORMATION UNDER FALSE 
PRETENSES.—It shall be unlawful for an infor-
mation broker to request a person to obtain 
personal information or any other information 
relating to any other person, if the information 
broker knew or should have known that the per-
son to whom such a request is made will obtain 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
or attempt to obtain such information in the 
manner described in subparagraph (A). 
(c) EXEMPTION
FOR
CERTAIN
SERVICE
PRO-
VIDERS.—Nothing in this section shall apply to a service 
provider for any electronic communication by a third party 
that is transmitted, routed, or stored in intermediate or 
transient storage by such service provider. 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any person en-
gaged in interstate commerce that owns or possesses data 
in electronic form containing personal information shall, 
following the discovery of a breach of security of the sys-
tem maintained by such person that contains such data— 
(1) notify each individual who is a citizen or 
resident of the United States whose personal infor-
mation was acquired or accessed as a result of such 
a breach of security; and 
(2) notify the Commission. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD PARTY AGENTS.—In the event of a 
breach of security by any third party entity that has 
been contracted to maintain or process data in elec-
tronic form containing personal information on be-
half of any other person who owns or possesses such 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
data, such third party entity shall be required to no-
tify such person of the breach of security. Upon re-
ceiving such notification from such third party, such 
person shall provide the notification required under 
subsection (a). 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in 
electronic form containing personal information that 
is owned or possessed by another person that con-
nects to or uses a system or network provided by the 
service provider for the purpose of transmitting, 
routing, or providing intermediate or transient stor-
age of such data, such service provider shall be re-
quired to notify of such a breach of security only the 
person who initiated such connection, transmission, 
routing, or storage if such person can be reasonably 
identified. Upon receiving such notification from a 
service provider, such person shall provide the notifi-
cation required under subsection (a). 
(3) COORDINATION
OF
NOTIFICATION
WITH 
CREDIT REPORTING AGENCIES.—If a person is re-
quired to provide notification to more than 5,000 in-
dividuals under subsection (a)(1), the person shall 
also notify the major credit reporting agencies that 
compile and maintain files on consumers on a na-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
tionwide basis, of the timing and distribution of the 
notices. Such notice shall be given to the credit re-
porting agencies without unreasonable delay and, if 
it will not delay notice to the affected individuals, 
prior to the distribution of notices to the affected in-
dividuals. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Unless subject to a delay au-
thorized under paragraph (2), a notification required 
under subsection (a) shall be made not later than 60 
days following the discovery of a breach of security, 
unless the person providing notice can show that 
providing notice within such a time frame is not fea-
sible due to extraordinary circumstances necessary 
to prevent further breach or unauthorized disclo-
sures, and reasonably restore the integrity of the 
data system, in which case such notification shall be 
made as promptly as possible. 
(2) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW ENFORCEMENT OR NATIONAL SECURITY PUR-
POSES.— 
(A) LAW
ENFORCEMENT.—If a Federal, 
State, or local law enforcement agency deter-
mines that the notification required under this 
section would impede a civil or criminal inves-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
tigation, such notification shall be delayed upon 
the written request of the law enforcement 
agency for 30 days or such lesser period of time 
which the law enforcement agency determines is 
reasonably necessary and requests in writing. A 
law enforcement agency may, by a subsequent 
written request, revoke such delay or extend the 
period of time set forth in the original request 
made under this paragraph if further delay is 
necessary. 
(B) NATIONAL
SECURITY.—If a Federal 
national security agency or homeland security 
agency determines that the notification required 
under this section would threaten national or 
homeland security, such notification may be de-
layed for a period of time which the national se-
curity agency or homeland security agency de-
termines is reasonably necessary and requests 
in writing. A Federal national security agency 
or homeland security agency may revoke such 
delay or extend the period of time set forth in 
the original request made under this paragraph 
by a subsequent written request if further delay 
is necessary. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the 
selected method can reasonably be expected to 
reach the intended individual): 
(i) Written notification. 
(ii) Notification by email or other 
electronic means, if— 
(I) the person’s primary method 
of communication with the individual 
is by email or such other electronic 
means; or 
(II) the individual has consented 
to receive such notification and the 
notification is provided in a manner 
that is consistent with the provisions 
permitting electronic transmission of 
notices under section 101 of the Elec-
tronic Signatures in Global Commerce 
Act (15 U.S.C. 7001). 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that was acquired or accessed by 
an unauthorized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the infor-
mation the person maintained about that 
individual; 
(iii) notice that the individual is enti-
tled to receive, at no cost to such indi-
vidual, consumer credit reports on a quar-
terly basis for a period of 2 years, or credit 
monitoring or other service that enables 
consumers to detect the misuse of their 
personal information for a period of 2 
years, and instructions to the individual on 
requesting such reports or service from the 
person, except when the only information 
which has been the subject of the security 
breach is the individual’s first name or ini-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; 
(iv) the toll-free contact telephone 
numbers and addresses for the major cred-
it reporting agencies; and 
(v) a toll-free telephone number and 
Internet website address for the Commis-
sion whereby the individual may obtain in-
formation regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(1) may provide substitute notifica-
tion in lieu of the direct notification required by 
paragraph (1) if the person owns or possesses 
data in electronic form containing personal in-
formation of fewer than 1,000 individuals and 
such direct notification is not feasible due to— 
(i) excessive cost to the person re-
quired to provide such notification relative 
to the resources of such person, as deter-
mined in accordance with the regulations 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
issued by the Commission under paragraph 
(3)(A); or 
(ii) lack of sufficient contact informa-
tion for the individual required to be noti-
fied. 
(B) FORM
OF
SUBSTITUTE
NOTIFICA-
TION.—Such substitute notification shall in-
clude— 
(i) email notification to the extent 
that the person has email addresses of in-
dividuals to whom it is required to provide 
notification under subsection (a)(1); 
(ii) a conspicuous notice on the Inter-
net website of the person (if such person 
maintains such a website); and 
(iii) notification in print and to broad-
cast media, including major media in met-
ropolitan and rural areas where the indi-
viduals whose personal information was ac-
quired reside. 
(C) CONTENT OF SUBSTITUTE NOTICE.— 
Each form of substitute notice under this para-
graph shall include— 
(i) notice that individuals whose per-
sonal information is included in the breach 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
of security are entitled to receive, at no 
cost to the individuals, consumer credit re-
ports on a quarterly basis for a period of 
2 years, or credit monitoring or other serv-
ice that enables consumers to detect the 
misuse of their personal information for a 
period of 2 years, and instructions on re-
questing such reports or service from the 
person, except when the only information 
which has been the subject of the security 
breach is the individual’s first name or ini-
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; and 
(ii) a telephone number by which an 
individual can, at no cost to such indi-
vidual, learn whether that individual’s per-
sonal information is included in the breach 
of security. 
(3) REGULATIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 1 year 
after the date of enactment of this Act, the 
Commission shall, by regulation under section 
553 of title 5, United States Code, establish cri-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
teria for determining circumstances under 
which substitute notification may be provided 
under paragraph (2), including criteria for de-
termining if notification under paragraph (1) is 
not feasible due to excessive costs to the person 
required to provided such notification relative to 
the resources of such person. Such regulations 
may also identify other circumstances where 
substitute notification would be appropriate for 
any person, including circumstances under 
which the cost of providing notification exceeds 
the benefits to consumers. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
with respect to compliance with this subsection. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute notification under paragraph (2), 
including the extent of notification to print 
and broadcast media that complies with 
the requirements of such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(1) IN GENERAL.—A person required to provide 
notification under subsection (a) shall, upon request 
of an individual whose personal information was in-
cluded in the breach of security, provide or arrange 
for the provision of, to each such individual and at 
no cost to such individual— 
(A) consumer credit reports from at least 
one of the major credit reporting agencies be-
ginning not later than 60 days following the in-
dividual’s request and continuing on a quarterly 
basis for a period of 2 years thereafter; or 
(B) a credit monitoring or other service 
that enables consumers to detect the misuse of 
their personal information, beginning not later 
than 60 days following the individual’s request 
and continuing for a period of 2 years. 
(2) LIMITATION.—This subsection shall not 
apply if the only personal information which has 
been the subject of the security breach is the individ-
ual’s first name or initial and last name, or address, 
or phone number, in combination with a credit or 
debit card number, and any required security code. 
(3) RULEMAKING.—As part of the Commis-
sion’s rulemaking described in subsection (d)(3), the 
Commission shall determine the circumstances under 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
which a person required to provide notification 
under subsection (a)(1) shall provide or arrange for 
the provision of free consumer credit reports or cred-
it monitoring or other service to affected individuals. 
(f) EXEMPTION.— 
(1) GENERAL EXEMPTION.—A person shall be 
exempt from the requirements under this section if, 
following a breach of security, such person deter-
mines that there is no reasonable risk of identity 
theft, fraud, or other unlawful conduct. 
(2) PRESUMPTION.— 
(A) IN GENERAL.—If the data in electronic 
form containing personal information is ren-
dered unusable, unreadable, or indecipherable 
through encryption or other security technology 
or methodology (if the method of encryption or 
such other technology or methodology is gen-
erally accepted by experts in the information se-
curity field), there shall be a presumption that 
no reasonable risk of identity theft, fraud, or 
other unlawful conduct exists following a breach 
of security of such data. Any such presumption 
may be rebutted by facts demonstrating that 
the encryption or other security technologies or 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
methodologies in a specific case, have been or 
are reasonably likely to be compromised. 
(B) 
METHODOLOGIES
OR
TECH-
NOLOGIES.—Not later than 1 year after the 
date of the enactment of this Act and bian-
nually thereafter, the Commission shall issue 
rules (pursuant to section 553 of title 5, United 
States Code) or guidance to identify security 
methodologies or technologies which render data 
in electronic form unusable, unreadable, or in-
decipherable, that shall, if applied to such data, 
establish a presumption that no reasonable risk 
of identity theft, fraud, or other unlawful con-
duct exists following a breach of security of 
such data. Any such presumption may be rebut-
ted by facts demonstrating that any such meth-
odology or technology in a specific case has 
been or is reasonably likely to be compromised. 
In issuing such rules or guidance, the Commis-
sion shall consult with relevant industries, con-
sumer organizations, and data security and 
identity theft prevention experts and established 
standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 year 
after the date of the enactment of this Act the Com-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
mission shall issue guidance regarding the applica-
tion of the exemption in paragraph (1). 
(g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—If the Commission, upon receiving notification of 
any breach of security that is reported to the Commission 
under subsection (a)(2), finds that notification of such a 
breach of security via the Commission’s Internet website 
would be in the public interest or for the protection of 
consumers, the Commission shall place such a notice in 
a clear and conspicuous location on its Internet website. 
(h) FTC STUDY ON NOTIFICATION IN LANGUAGES 
IN ADDITION TO ENGLISH.—Not later than 1 year after 
the date of enactment of this Act, the Commission shall 
conduct a study on the practicality and cost effectiveness 
of requiring the notification required by subsection (d)(1) 
to be provided in a language in addition to English to indi-
viduals known to speak only such other language. 
(i) GENERAL RULEMAKING AUTHORITY.—The Com-
mission may promulgate regulations necessary under sec-
tion 553 of title 5, United States Code, to effectively en-
force the requirements of this section. 
(j) TREATMENT OF PERSONS GOVERNED BY OTHER 
LAW.—A person who is in compliance with any other Fed-
eral law that requires such person to provide notification 
to individuals following a breach of security, and that, 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
taken as a whole, provides protections substantially similar 
to, or greater than, those required under this section, as 
the Commission shall determine by rule (under section 
553 of title 5, United States Code), shall be deemed to 
be in compliance with this section. 
SEC. 4. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
sections 2 and 3 shall only apply to those persons, partner-
ships, or corporations over which the Commission has au-
thority pursuant to section 5(a)(2) of the Federal Trade 
Commission Act. 
(b) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act in the same manner, by 
the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act. Any person who violates 
such regulations shall be subject to the penalties and 
entitled to the privileges and immunities provided in 
that Act. 
(3) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
(c) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTION.—In any case in which the 
attorney general of a State, or an official or agency 
of a State, has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by any person who violates sec-
tion 2 or 3 of this Act, the attorney general, official, 
or agency of the State, as parens patriae, may bring 
a civil action on behalf of the residents of the State 
in a district court of the United States of appro-
priate jurisdiction— 
(A) to enjoin further violation of such sec-
tion by the defendant; 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(B) to compel compliance with such sec-
tion; or 
(C) to obtain civil penalties in the amount 
determined under paragraph (2). 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.— 
(i) TREATMENT
OF
VIOLATIONS
OF 
SECTION
2.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
2, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of days that a person is 
not in compliance with such section by an 
amount not greater than $11,000. 
(ii) TREATMENT
OF
VIOLATIONS
OF 
SECTION
3.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
3, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of violations of such 
section by an amount not greater than 
$11,000. Each failure to send notification 
as required under section 3 to a resident of 
the State shall be treated as a separate 
violation. 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(B) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
Index is first published by the Bureau of Labor 
Statistics that is after 1 year after the date of 
enactment of this Act, and each year thereafter, 
the amounts specified in clauses (i) and (ii) of 
subparagraph (A) shall be increased by the per-
centage increase in the Consumer Price Index 
published on that date from the Consumer 
Price Index published the previous year. 
(C) MAXIMUM
TOTAL
LIABILITY.—Not-
withstanding the number of actions which may 
be brought against a person under this sub-
section the maximum civil penalty for which 
any person may be liable under this subsection 
shall not exceed— 
(i) $5,000,000 for each violation of 
section 2; and 
(ii) $5,000,000 for all violations of 
section 3 resulting from a single breach of 
security. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
and provide the Commission with a copy of its 
complaint, except in any case in which such 
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(d) AFFIRMATIVE DEFENSE FOR A VIOLATION OF 
SECTION 3.— 
(1) IN GENERAL.—It shall be an affirmative de-
fense to an enforcement action brought under sub-
section (b), or a civil action brought under sub-
section (c), based on a violation of section 3, that all 
of the personal information contained in the data in 
electronic form that was acquired or accessed as a 
result of a breach of security of the defendant is 
public record information that is lawfully made 
available to the general public from Federal, State, 
or local government records and was acquired by the 
defendant from such records. 
(2) NO EFFECT ON OTHER REQUIREMENTS.— 
Nothing in this subsection shall be construed to ex-
empt any person from the requirement to notify the 
Commission of a breach of security as required 
under section 3(a). 
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means unauthorized access to or acqui-
sition of data in electronic form containing personal 
information. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
essary to enable decryption of such data. Such 
encryption must include appropriate management 
and safeguards of such keys to protect the integrity 
of the encryption. 
(5) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personal information for the purpose of engag-
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
ing in commercial transactions under the name of 
such other person. 
(6) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’— 
(A) means a commercial entity whose busi-
ness is to collect, assemble, or maintain per-
sonal information concerning individuals who 
are not current or former customers of such en-
tity in order to sell such information or provide 
access to such information to any nonaffiliated 
third party in exchange for consideration, 
whether such collection, assembly, or mainte-
nance of personal information is performed by 
the information broker directly, or by contract 
or subcontract with any other entity; and 
(B) does not include a commercial entity to 
the extent that such entity processes informa-
tion collected by or on behalf of and received 
from or on behalf of a nonaffiliated third party 
concerning individuals who are current or 
former customers or employees of such third 
party to enable such third party directly or 
through parties acting on its behalf to: (1) pro-
vide benefits for its employees; or (2) directly 
transact business with its customers. 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
initial and last name, or address, or phone 
number, in combination with any 1 or more of 
the following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number, passport 
number, military identification number, or 
other similar number issued on a govern-
ment document used to verify identity. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
word that is necessary to permit access to 
an individual’s financial account. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A)— 
(i) for the purpose of section 2 to the 
extent that such modification will not un-
reasonably impede interstate commerce, 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
and will accomplish the purposes of this 
Act; or 
(ii) for the purpose of section 3, to the 
extent that such modification is necessary 
to accommodate changes in technology or 
practices, will not unreasonably impede 
interstate commerce, and will accomplish 
the purposes of this Act. 
(8) PUBLIC RECORD INFORMATION.—The term 
‘‘public record information’’ means information 
about an individual which has been obtained origi-
nally from records of a Federal, State, or local gov-
ernment entity that are available for public inspec-
tion. 
(9) NON-PUBLIC
INFORMATION.—The term 
‘‘non-public information’’ means information about 
an individual that is of a private nature and neither 
available to the general public nor obtained from a 
public record. 
(10) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means a person that provides electronic 
data transmission, routing, intermediate and tran-
sient storage, or connections to its system or net-
work, where the person providing such services does 
not select or modify the content of the electronic 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
data, is not the sender or the intended recipient of 
the data, and such person transmits, routes, stores, 
or provides connections for personal information in 
a manner that personal information is undifferen-
tiated from other types of data that such person 
transmits, routes, stores, or provides connections. 
Any such person shall be treated as a service pro-
vider under this Act only to the extent that it is en-
gaged in the provision of such transmission, routing, 
intermediate and transient storage or connections. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
a State, with respect to those entities covered by the regu-
lations issued pursuant to this Act, that expressly— 
(1) requires information security practices and 
treatment of data containing personal information 
similar to any of those required under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized access 
to or acquisition of data in electronic form con-
taining personal information. 
(b) ADDITIONAL PREEMPTION.— 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
(1) IN GENERAL.—No person other than a per-
son specified in section 4(c) may bring a civil action 
under the laws of any State if such action is pre-
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an Attorney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law. 
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of 
enactment of this Act. 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS
HR 2221 RFS 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $1,000,000 for each of fiscal years 2010 through 
2015 to carry out this Act. 
Passed the House of Representatives December 8, 
2009. 
Attest: 
LORRAINE C. MILLER, 
Clerk. 
VerDate Nov 24 2008 
00:27 Dec 10, 2009
Jkt 089200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RFS
H2221
dcolon on DSK2BSOYB1PROD with BILLS