(A) enjoining such act or practice; or 
(B) enforcing compliance with this subtitle. 
(2) ISSUANCE OF ORDER.—A court may issue 
an order under paragraph (1), if the court finds that 
the conduct in question constitutes a violation of this 
subtitle. 
(d) CIVIL ACTIONS BY THE FEDERAL TRADE COM-
MISSION.— 
(1) IN GENERAL.—Compliance with the require-
ments imposed under this subtitle may be enforced 
under the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) by the Federal Trade Commission 
with respect to business entities subject to this Act. 
All of the functions and powers of the Federal Trade 
Commission under the Federal Trade Commission 
Act are available to the Commission to enforce com-
pliance by any person with the requirements imposed 
under this title. 
(2) PENALTY LIMITATION.— 
(A) IN
GENERAL.—Notwithstanding any 
other provision of law, the total sum of civil 
penalties assessed against a business entity for 
all violations of the provisions of this subtitle 
resulting from the same or related acts or omis-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
sions may not exceed $1,000,000, unless such 
conduct is found to be willful or intentional. 
(B) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
and if so, the amount of the additional penalty 
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(C) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (B) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $1,000,000. 
(3) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—For the purpose of the exercise by the Fed-
eral Trade Commission of its functions and powers 
under the Federal Trade Commission Act, a viola-
tion of any requirement or prohibition imposed 
under this title shall constitute an unfair or decep-
tive act or practice in commerce in violation of a 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
regulation under section 18(a)(1)(B) of the Federal 
Trade Commission Act (15 U.S.C. 57a(a)(I)(B)) re-
garding unfair or deceptive acts or practices and 
shall be subject to enforcement by the Federal Trade 
Commission under that Act with respect to any busi-
ness entity, irrespective of whether that business en-
tity is engaged in commerce or meets any other ju-
risdictional tests in the Federal Trade Commission 
Act. 
(e) COORDINATION OF ENFORCEMENT.— 
(1) IN GENERAL.—Before opening an investiga-
tion, the Federal Trade Commission shall consult 
with the Attorney General. 
(2) LIMITATION.—The Federal Trade Commis-
sion may initiate investigations under this subsection 
unless the Attorney General determines that such an 
investigation would impede an ongoing criminal in-
vestigation or national security activity. 
(3) COORDINATION AGREEMENT.— 
(A) IN GENERAL.—In order to avoid con-
flicts and promote consistency regarding the en-
forcement and litigation of matters under this 
Act, not later than 180 days after the enact-
ment of this Act, the Attorney General and the 
Federal Trade Commission shall enter into an 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
agreement for coordination regarding the en-
forcement of this Act. 
(B) 
REQUIREMENT.—The 
coordination 
agreement entered into under subparagraph (A) 
shall include provisions to ensure that parallel 
investigations and proceedings under this sec-
tion are conducted in a matter that avoids con-
flicts and does not impede the ability of the At-
torney General to prosecute violations of Fed-
eral criminal laws. 
(4) COORDINATION WITH THE FCC.—If an en-
forcement action under this Act relates to customer 
proprietary network information, the Federal Trade 
Commission shall coordinate the enforcement action 
with the Federal Communications Commission. 
(f) RULEMAKING.—The Federal Trade Commission 
may, in consultation with the Attorney General, issue such 
other regulations as it determines to be necessary to carry 
out this subtitle. All regulations promulgated under this 
Act shall be issued in accordance with section 553 of title 
5, United States Code. Where regulations relate to cus-
tomer proprietary network information, the promulgation 
of such regulations will be coordinated with the Federal 
Communications Commission. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(g) OTHER RIGHTS AND REMEDIES.—The rights and 
remedies available under this subtitle are cumulative and 
shall not affect any other rights and remedies available 
under law. 
(h) FRAUD ALERT.—Section 605A(b)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 
amended by inserting ‘‘, or evidence that the consumer 
has received notice that the consumer’s financial informa-
tion has or may have been compromised,’’ after ‘‘identity 
theft report’’. 
SEC. 218. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or any State or local law 
enforcement agency authorized by the State attorney 
general or by State statute to prosecute violations of 
consumer protection law, has reason to believe that 
an interest of the residents of that State has been 
or is threatened or adversely affected by the engage-
ment of a business entity in a practice that is pro-
hibited under this subtitle, the State or the State or 
local law enforcement agency on behalf of the resi-
dents of the agency’s jurisdiction, may bring a civil 
action on behalf of the residents of the State or ju-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
risdiction in a district court of the United States of 
appropriate jurisdiction to— 
(A) enjoin that practice; 
(B) enforce compliance with this subtitle; 
or 
(C) civil penalties of not more than 
$11,000 per day per security breach up to a 
maximum of $1,000,000 per violation, unless 
such conduct is found to be willful or inten-
tional. 
(2) PENALTY LIMITATION.— 
(A) IN
GENERAL.—Notwithstanding any 
other provision of law, the total sum of civil 
penalties assessed against a business entity for 
all violations of the provisions of this subtitle 
resulting from the same or related acts or omis-
sions may not exceed $1,000,000, unless such 
conduct is found to be willful or intentional. 
(B) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
a provision of this subtitle against a defendant named in 
the Federal criminal proceeding or civil action. 
(d) CONSTRUCTION.—For purposes of bringing any 
civil action under subsection (a), nothing in this subtitle 
regarding notification shall be construed to prevent an at-
torney general of a State from exercising the powers con-
ferred on such attorney general by the laws of that State 
to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(B) may be found. 
(f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 
subtitle establishes a private cause of action against a 
business entity for violation of any provision of this sub-
title. 
SEC. 219. EFFECT ON FEDERAL AND STATE LAW. 
For any entity, or agency that is subject to this sub-
title, the provisions of this subtitle shall supersede any 
other provision of Federal law, or any provisions of the 
law of any State, relating to notification of a security 
breach, except as provided in section 214(b). Nothing in 
this subtitle shall be construed to modify, limit, or super-
sede the operation of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801 et seq.) or its implementing regulations, in-
cluding those regulations adopted or enforced by States, 
the Health Insurance Portability and Accountability Act 
of 1996 (42 U.S.C. 1301 et seq.) or its implementing reg-
ulations, or the Health Information Technology for Eco-
nomic and Clinical Health Act (42 U.S.C. 17937) or its 
implementing regulations. 
SEC. 220. REPORTING ON EXEMPTIONS. 
(a) FTC REPORT.—Not later than 18 months after 
the date of enactment of this Act, and upon request by 
Congress thereafter, the Federal Trade Commission shall 
submit a report to Congress on the number and nature 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
of the security breaches described in the notices filed by 
those business entities invoking the risk assessment ex-
emption under section 212(b) and their response to such 
notices. 
(b) LAW ENFORCEMENT REPORT.— 
(1) IN GENERAL.—Not later than 18 months 
after the date of enactment of this Act, and upon 
the request by Congress thereafter, the United 
States Secret Service and Federal Bureau of Inves-
tigation shall submit a report to Congress on the 
number and nature of security breaches subject to 
the national security and law enforcement exemp-
tions under section 212(a). 
(2) REQUIREMENT.—The report required under 
paragraph (1) shall not include the contents of any 
risk assessment provided to the United States Secret 
Service and the Federal Bureau of Investigation 
under this subtitle. 
SEC. 221. EFFECTIVE DATE. 
This subtitle shall take effect on the expiration of the 
date which is 90 days after the date of enactment of this 
Act. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
TITLE III—COMPLIANCE WITH 
STATUTORY PAY-AS-YOU-GO ACT 
SEC. 301. BUDGET COMPLIANCE. 
The budgetary effects of this Act, for the purpose of 
complying with the Statutory Pay-As-You-Go Act of 2010, 
shall be determined by reference to the latest statement 
titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 
Act, submitted for printing in the Congressional Record 
by the Chairman of the Senate Budget Committee, pro-
vided that such statement has been submitted prior to the 
vote on passage. 
Æ 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6301
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS