IB 
Union Calendar No. 719 
114TH CONGRESS 
2D SESSION 
H. R. 1770 
[Report No. 114–908] 
To require certain entities who collect and maintain personal information 
of individuals to secure such information and to provide notice to such 
individuals in the case of a breach of security involving such information, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 14, 2015 
Mrs. BLACKBURN (for herself, Mr. WELCH, Mr. BURGESS, and Mr. UPTON) 
introduced the following bill; which was referred to the Committee on En-
ergy and Commerce 
JANUARY 3, 2017 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on April 14, 2015] 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
A BILL 
To require certain entities who collect and maintain personal 
information of individuals to secure such information 
and to provide notice to such individuals in the case 
of a breach of security involving such information, and 
for other purposes. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; PURPOSES. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Data Security and Breach Notification Act of 2015’’. 
(b) PURPOSES.—The purposes of this Act are to— 
(1) protect consumers from identity theft, eco-
nomic loss or economic harm, and financial fraud by 
establishing strong and uniform national data secu-
rity and breach notification standards for electronic 
data in interstate commerce while minimizing State 
law burdens that may substantially affect interstate 
commerce; and 
(2) expressly preempt any related State laws to 
ensure uniformity of this Act’s standards and the con-
sistency of their application across jurisdictions. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
A covered entity shall implement and maintain rea-
sonable security measures and practices to protect and se-
cure personal information in electronic form against unau-
thorized access and acquisition as appropriate for the size 
and complexity of such covered entity and the nature and 
scope of its activities. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) IN GENERAL.— 
(1) RESTORING SECURITY.—Except as otherwise 
provided by this section, a covered entity that uses, 
accesses, transmits, stores, disposes of, or collects per-
sonal information shall, following the discovery of a 
breach of security restore the reasonable integrity, se-
curity, and confidentiality of the data system and 
identify the impact of the breach pursuant to para-
graph (2). 
(2) INVESTIGATION.—A covered entity shall con-
duct in good faith a reasonable and prompt investiga-
tion of the breach of security to determine whether 
there is a reasonable risk that the breach of security 
has resulted in, or will result in, identity theft, eco-
nomic loss or economic harm, or financial fraud to 
the individuals whose personal information was sub-
ject to the breach of security. 
(3) NOTIFICATION TO INDIVIDUALS REQUIRED.— 
(A) TRIGGER.—Unless there is no reason-
able risk that the breach of security has resulted 
in, or will result in, identity theft, economic loss 
or economic harm, or financial fraud to the indi-
viduals whose personal information was affected 
by the breach of security, the covered entity shall 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
notify any resident of the United States that has 
been affected by the breach of security pursuant 
to this section. 
(B) NOTIFICATION DUTY.—Unless subject to 
a delay authorized under subsection (c)— 
(i) a breached covered entity shall no-
tify any individual for whom an election 
was not made under paragraph (4)(C) not 
later than 25 days after the non-breached 
covered entity declines or fails to exercise 
the election under paragraph (4)(C); 
(ii) a non-breached covered entity shall 
notify any individual for whom the non- 
breached covered entity provided personal 
information to the breached covered entity, 
and such personal information was affected 
by the breach of security, not later than 25 
days after exercising the election under 
paragraph (4)(C); and 
(iii) any other covered entity shall 
identify the individuals affected by a breach 
of security and make the notification re-
quired under this subsection as expedi-
tiously as possible, without unreasonable 
delay, and not later than 30 days after 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
entity, the breached covered entity shall, as expe-
ditiously as possible and without unreasonable 
delay within 10 days after fulfilling the require-
ments described in paragraph (1), notify in 
writing each non-breached covered entity of the 
breach of security. 
(B) CONTENTS OF NOTICE.—The breached 
covered entity shall include in the notice de-
scribed in subparagraph (A) the elements of per-
sonal information received from the non-breached 
covered entity pursuant to the contract described 
in subparagraph (C) reasonably believed to be 
affected by the breach of security. 
(C) ELECTION BY NON-BREACHED COVERED 
ENTITY
AFTER
RECEIVING
NOTICE
FROM
A 
BREACHED COVERED ENTITY.—In the case of a 
breached covered entity that is a party to a writ-
ten contract with a non-breached covered entity 
in which the breached covered entity maintains, 
stores, transmits, or processes data in electronic 
form containing personal information, not later 
than 10 days after receipt of the notice described 
in subparagraph (A), the non-breached covered 
entity may elect, in writing to the breached cov-
ered entity, to provide notification required by 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
paragraph (3) all individuals whose personal in-
formation was provided by the non-breached cov-
ered entity to the breached covered entity and 
was affected by the breach of security. Such elec-
tion relieves the breached covered entity of the re-
quirements under paragraph (3) with respect to 
such individuals. 
(D) OBLIGATION AFTER ELECTION.— 
(i) BREACHED
COVERED
ENTITY
CO-
OPERATION.—If a non-breached covered en-
tity elects under subparagraph (C) to pro-
vide notice under paragraph (3), the 
breached covered entity shall cooperate in 
all reasonable respects with the non- 
breached covered entity and provide any of 
the information the breached covered entity 
possesses that is described under subsection 
(d)(1)(B) and provide all personal informa-
tion received from the non-breached covered 
entity that was affected by the breach of se-
curity so that the notification to such indi-
viduals is made as required under this sec-
tion. Not later than 10 business days after 
the non-breached covered entity submits a 
written request for information requested 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
under this subsection to the breached cov-
ered entity, the breached covered entity shall 
provide such information. 
(ii) NON-BREACHED COVERED ENTITY 
COOPERATION.—If a non-breached covered 
entity does not elect to provide notice to in-
dividuals under subparagraph (C), the non- 
breached covered entity shall provide any of 
the information the non-breached covered 
entity possesses that is described under sub-
section (d)(1)(B) for any individual whose 
personal information was received from the 
non-breached covered entity that was af-
fected by the breach of security, and cooper-
ate in all reasonable respects with, the 
breached covered entity so that the notifica-
tion to such individuals is made as required 
under this section. Not later than 10 busi-
ness days after the breached covered entity 
submits a written request for information 
requested under this subsection to the non- 
breached covered entity, the non-breached 
covered entity shall provide such informa-
tion. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
(5) LAW ENFORCEMENT.—A covered entity shall 
as expeditiously as possible notify the Commission 
and the Secret Service or the Federal Bureau of In-
vestigation of the fact that a breach of security has oc-
curred if the number of individuals whose personal 
information was, or there is a reasonable basis to con-
clude was, accessed and acquired by an unauthorized 
person exceeds 10,000. Any notification provided to 
the Secret Service or the Federal Bureau of Investiga-
tion pursuant to this paragraph shall be provided not 
less than 10 days before notification is provided to in-
dividuals pursuant to paragraph (3). 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) NON-PROFIT ORGANIZATIONS.—In the event 
of a breach of security involving personal information 
that would trigger notification under subsection (a), 
a non-profit organization may complete such notifica-
tion according to the procedures set forth in sub-
section (d)(2). 
(2) COORDINATION OF NOTIFICATION WITH CON-
SUMER REPORTING AGENCIES.—If a covered entity is 
required to provide notification to more than 10,000 
individuals under subsection (a), such covered entity 
shall also notify a consumer reporting agency that 
compiles and maintains files on consumers on a na-
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
tionwide basis, of the timing and distribution of the 
notices. Such notice shall be given to such consumer 
reporting agencies without unreasonable delay and, if 
it will not delay notice to the affected individuals, 
prior to the distribution of notices to the affected in-
dividuals. 
(c) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT OR NATIONAL SECURITY PURPOSES.—Not-
withstanding paragraph (1), if a Federal, State, or local 
law enforcement agency determines that the notification to 
individuals required under this section would impede a 
civil or criminal investigation or a Federal agency deter-
mines that such notification would threaten national secu-
rity, such notification shall be delayed upon written request 
of the law enforcement agency or Federal agency which the 
law enforcement agency or Federal agency determines is 
reasonably necessary and requests in writing. A law en-
forcement agency or Federal agency may, by a subsequent 
written request, revoke such delay or extend the period of 
time set forth in the original request made under this para-
graph if further delay is necessary. If a law enforcement 
agency or Federal agency requests a delay of notification 
to individuals under this paragraph, the Commission shall, 
upon written request of the law enforcement agency or Fed-
eral agency, delay any public disclosure of a notification 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
received by the Commission under this section relating to 
the same breach of security until the delay of notification 
to individuals is no longer in effect. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A covered 
entity required to provide notification to an in-
dividual under subsection (a) shall be in compli-
ance with such requirement if the covered entity 
provides such notice by one of the following 
methods (if the selected method can reasonably be 
expected to reach the intended individual): 
(i) Written notification by postal mail. 
(ii) Notification by email or other elec-
tronic means, if the covered entity’s pri-
mary method of communication with the 
individual is by email or such other elec-
tronic means or the individual has con-
sented to receive such notification. 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A) 
with respect to a breach of security, such notifi-
cation shall include each of the following: 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
(i) The identity of the covered entity 
that suffered the breach and, if such covered 
entity is also a breached covered entity pro-
viding notice under section 3(b)(1), the 
identity of each non-breached covered entity 
that did not elect to notify affected individ-
uals pursuant to section 3(b)(1)(B) suffi-
cient to show the breached covered entity’s 
commercial relationship to the individual 
receiving notice. 
(ii) A description of the personal infor-
mation that was, or there is a reasonable 
basis to conclude was, acquired and accessed 
by an unauthorized person. 
(iii) The date range of the breach of se-
curity, or an approximate date range of the 
breach of security if a specific date range is 
unknown based on the information avail-
able at the time of the notification. 
(iv) A telephone number, or toll-free 
telephone number for any covered entity 
that does not meet the definition of a small 
business concern or non-profit organization, 
that the individual may use to contact the 
covered entity to inquire about the breach of 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
security or the information the covered enti-
ty maintained about that individual. 
(v) The toll-free contact telephone num-
bers and addresses for a consumer reporting 
agency that compiles and maintains files on 
consumers on a nationwide basis. 
(vi) The toll-free telephone number and 
Internet website address for the Commission 
whereby the individual may obtain infor-
mation regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) IN GENERAL.—If, after making reason-
able efforts to contact all individuals to whom 
notice is required under subsection (a), the cov-
ered entity finds that contact information for 
500 or more individuals is insufficient or out-of- 
date, the covered entity shall also provide sub-
stitute notice to those individuals, which shall be 
reasonably calculated to reach the individuals af-
fected by the breach of security. 
(B) FORM OF SUBSTITUTE NOTIFICATION.— 
A covered entity may provide substitute notifica-
tion by— 
(i) email or other electronic notifica-
tion to the extent that the covered entity has 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
contact information for individuals to 
whom it is required to provide notification 
under subsection (a); and 
(ii) a conspicuous notice on the covered 
entity’s Internet website (if such covered en-
tity maintains such a website) for at least 
90 days. 
(C) CONTENT
OF
SUBSTITUTE
NOTICE.— 
Each form of substitute notice under clauses (i) 
and (ii) of subparagraph (B) shall include the 
information required under paragraph (1)(B). 
(3) DIRECT NOTIFICATION BY A THIRD PARTY.— 
Nothing in this Act shall be construed to prevent a 
covered entity from contracting with a third party to 
provide the notification required under this section, 
provided such third party issues such notification 
without unreasonable delay, in accordance with the 
requirements of this section, and indicates to all indi-
viduals in such notification that such third party is 
sending such notification on behalf of the covered en-
tity. 
(e) REQUIREMENTS OF SERVICE PROVIDERS.— 
(1) IN GENERAL.—If a service provider becomes 
aware of a breach of security involving data in elec-
tronic form containing personal information that is 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
owned or licensed by a covered entity that connects to 
or uses a system or network provided by the service 
provider for the purpose of transmitting, routing, or 
providing intermediate or transient storage of such 
data, such service provider shall notify the covered en-
tity who initiated such connection, transmission, 
routing, or storage of the data containing personal in-
formation breached, if such covered entity can be rea-
sonably identified. If a service provider is acting sole-
ly as a service provider for purposes of this sub-
section, the service provider has no other notification 
obligations under this section. 
(2) COVERED ENTITIES WHO RECEIVE NOTICE 
FROM SERVICE PROVIDERS.—Upon receiving notifica-
tion from a service provider under paragraph (1), a 
covered entity shall provide notification as required 
under this section. 
SEC. 4. ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF COMMISSION.—The Commission 
shall enforce this Act in the same manner, by the 
same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made 
a part of this Act, and any covered entity who vio-
lates this Act shall be subject to the penalties and en-
titled to the privileges and immunities provided in 
the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.), and as provided in clauses (ii) and (iii) of sec-
tion 5(5)(A). Notwithstanding section 5(m) of the 
Federal Trade Commission Act, the Commission may 
impose civil penalties for violations of section 3 in an 
amount not greater than $1,000 per violation. Each 
failure to send notification as required under section 
3 to a resident of the United States shall be treated 
as a separate violation. 
(3) MAXIMUM TOTAL LIABILITY FOR FIRST-TIME 
VIOLATION OF SECTION 2.—The maximum total civil 
penalty for which any covered entity is liable under 
this subsection for all violations of section 2 resulting 
from the same related act or omission may not exceed 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
$8,760,000, if such act or omission constitutes the 
covered entity’s first violation of section 2. 
(4) MAXIMUM TOTAL LIABILITY FOR FIRST-TIME 
VIOLATION OF SECTION 3.—The maximum total civil 
penalty for which any covered entity is liable under 
this subsection for all violations of section 3 resulting 
from the same related act or omission may not exceed 
$17,520,000, if such act or omission constitutes the 
covered entity’s first violation of section 3. 
(b) ENFORCEMENT BY STATE ATTORNEYS GENERAL.— 
(1) CIVIL ACTION.—In any case in which the at-
torney general of a State has reason to believe that an 
interest of the residents of that State has been or is 
threatened or adversely affected by any covered entity 
who violates section 2 or 3 of this Act, the attorney 
general of the State, as parens patriae, may bring a 
civil action on behalf of the residents of the State in 
a district court of the United States of appropriate 
jurisdiction to— 
(A) enjoin further violation of such section 
by the defendant; 
(B) compel compliance with such section; or 
(C) obtain civil penalties in the amount de-
termined under paragraph (2). 
(2) CIVIL PENALTIES.— 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
section, the maximum civil penalty for which 
any covered entity may be liable under this sub-
section shall not exceed— 
(i) $2,500,000 for each violation of sec-
tion 2; and 
(ii) $2,500,000 for all violations of sec-
tion 3 resulting from a single breach of se-
curity. 
(C) ADJUSTMENT FOR INFLATION.—Begin-
ning on the date that the Consumer Price Index 
is first published by the Bureau of Labor Statis-
tics that is after one year after the date of enact-
ment of this Act, and each year thereafter, the 
amounts specified in clauses (i) and (ii) of sub-
paragraph (A) and clauses (i) and (ii) of sub-
paragraph (B) shall be increased by the percent-
age increase in the Consumer Price Index pub-
lished on that date from the Consumer Price 
Index published the previous year. 
(D) PENALTY
FACTORS.—In determining 
the amount of such a civil penalty, the degree of 
culpability, any history of prior such conduct, 
ability to pay, effect on ability to continue to do 
business, and such other matters as justice may 
require shall be taken into account. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
(3) INTERVENTION
BY
THE
FEDERAL
TRADE 
COMMISSION.— 
(A) NOTICE
AND
INTERVENTION.—In all 
cases, the State shall provide prior written notice 
of any action under paragraph (1) to the Com-
mission and provide the Commission with a 
copy of its complaint, except in any case in 
which such prior notice is not feasible, in which 
case the State shall serve such notice imme-
diately upon instituting such action. The Com-
mission shall have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) PENDING
PROCEEDINGS.—If the Fed-
eral Trade Commission initiates a Federal civil 
action for a violation of this Act, no State attor-
ney general may bring an action for a violation 
of this Act that resulted from the same or related 
acts or omissions against a defendant named in 
the civil action initiated by the Federal Trade 
Commission. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
Act shall be construed to prevent an attorney general 
of a State from exercising the powers conferred on the 
attorney general by the laws of that State to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(c) NO PRIVATE CAUSE OF ACTION.—Nothing in this 
Act shall be construed to establish a private cause of action 
against a person for a violation of this Act. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) BREACH OF SECURITY.—The term ‘‘breach of 
security’’— 
(A) means a compromise of the security, 
confidentiality, or integrity of, or loss of, data in 
electronic form that results in, or there is a rea-
sonable basis to conclude has resulted in, unau-
thorized access to and acquisition of personal in-
formation from a covered entity; and 
(B) does not include the good faith acquisi-
tion of personal information by an employee or 
agent of the covered entity for the purposes of the 
covered entity, if the personal information is not 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
used or subject to further unauthorized disclo-
sure. 
(2) BREACHED
COVERED
ENTITY.—The term 
‘‘breached covered entity’’ means a covered entity that 
has incurred a breach of security affecting data in 
electronic form containing personal information of a 
non-breached covered entity that has directly con-
tracted the breached covered entity to maintain, store, 
or process data in electronic form containing personal 
information on behalf of such non-breached covered 
entity. For purposes of this definition, the term 
‘‘breached covered entity’’ shall not include a service 
provider that is subject to section 3(e). 
(3) 
COMMISSION.—The 
term 
‘‘Commission’’ 
means the Federal Trade Commission. 
(4) CONSUMER REPORTING AGENCY THAT COM-
PILES AND MAINTAINS FILES ON CONSUMERS ON A NA-
TIONWIDE
BASIS.—The term ‘‘consumer reporting 
agency that compiles and maintains files on con-
sumers on a nationwide basis’’ has the meaning given 
that term in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
(5) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered enti-
ty’’ means— 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
(i) a sole proprietorship, partnership, 
corporation, trust, estate, cooperative, asso-
ciation, or other entity in or affecting com-
merce that acquires, maintains, stores, sells, 
or otherwise uses data in electronic form 
that includes personal information, over 
which the Commission has authority pursu-
ant to section 5(a)(2) of the Federal Trade 
Commission Act (15 U.S.C. 45(a)(2)); 
(ii) notwithstanding section 5(a)(2) of 
the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)), common carriers subject 
to the Communications Act of 1934 (47 
U.S.C. 151 et seq.); and 
(iii) notwithstanding any jurisdic-
tional limitation of the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.), any non- 
profit organization. 
(B) EXCEPTIONS.—The term ‘‘covered enti-
ty’’ does not include— 
(i) a covered entity, as defined in sec-
tion 160.103 of title 45, Code of Federal 
Regulations; 
(ii) a business associate, as defined in 
section 160.103 of title 45, Code of Federal 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS