(A) notify the information clearinghouse 
established by the Federal Trade Commission 
under section 7 upon the occurrence of any 
breach for which notice is required under para-
graph (1); and 
(B) provide such information as the Com-
mission may require with respect to the cir-
cumstances and manner of the breach and the 
system on which the breach occurred. 
(b) CIVIL REMEDIES.— 
(1) PENALTIES.—Any agency, or person en-
gaged in interstate commerce, that violates this sec-
tion shall be subject to a fine of not more than 
$5,000 per violation, to a maximum of $25,000 per 
day while such violations persist. 
(2) EQUITABLE RELIEF.—Any person engaged 
in interstate commerce that violates, proposes to vio-
late, or has violated this section may be enjoined 
from further violations by a court of competent ju-
risdiction. 
(3) OTHER
RIGHTS
AND
REMEDIES.—The 
rights and remedies available under this subsection 
are cumulative and shall not affect any other rights 
and remedies available under law.
(c) ENFORCEMENT.—The Federal Trade Commission 
is authorized to enforce compliance with this section, in-
cluding the assessment of fines under subsection (b)(1). 
(d) COORDINATION WITH OTHER PROVISIONS OF 
LAW.—This section shall not apply with respect to a fi-
nancial institution (as defined in section 509(3) of the 
Gramm-Leach-Bliley Act) that is subject to section 526 
of such Act. 
SEC. 4. TIMELY NOTIFICATION BY FINANCIAL INSTITU-
TIONS OF UNAUTHORIZED ACCESS TO PER-
SONAL INFORMATION. 
Subtitle B of title V of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6821 et seq.) is amended— 
(1) by redesignating sections 526 and 527 as 
sections 528 and 529, respectively; and 
(2) by inserting after section 525 the following: 
‘‘SEC. 526. NOTIFICATION TO CUSTOMERS OF UNAUTHOR-
IZED ACCESS TO PERSONAL INFORMATION. 
‘‘(a) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply: 
‘‘(1) BREACH.—The term ‘breach’— 
‘‘(A) means unauthorized acquisition or 
loss of computerized data or paper records 
which compromises the security, confidentiality,
or integrity of personal information maintained 
by or on behalf of a financial institution; and 
‘‘(B) does not include a good faith acquisi-
tion of personal information by an employee or 
agent of a financial institution for a business 
purpose of the institution, if the personal infor-
mation is not subject to further unauthorized 
disclosure; and 
‘‘(2) PERSONAL
INFORMATION.—With respect 
to a customer of a financial institution, the term 
‘personal information’ means the first name or first 
initial and last name of the customer, in combina-
tion with any 1 or more of the following data ele-
ments, when either the name or the data element is 
not encrypted: 
‘‘(A) A social security number. 
‘‘(B) A driver’s license number or other of-
ficially recognized form of identification. 
‘‘(C) A credit card number, debit card 
number, or any required security code, access 
code, or password that would permit access to 
financial account information relating to that 
customer. 
‘‘(b) NOTIFICATION RELATING TO BREACH OF PER-
SONAL INFORMATION.—
‘‘(1) FINANCIAL INSTITUTION REQUIREMENT.— 
In any case in which there has been a breach of per-
sonal information at a financial institution, or such 
a breach is reasonably believed to have occurred, the 
financial institution shall promptly notify— 
‘‘(A) each customer affected by the viola-
tion or suspected violation; 
‘‘(B) each consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Re-
porting Act; 
‘‘(C) the information clearinghouse estab-
lished by the Federal Trade Commission under 
section 7 of the Notification of Risk to Personal 
Data Act (together with such information as 
the Commission may require with respect to the 
circumstances and manner of the breach and 
the system on which the breach occurred); and 
‘‘(D) appropriate law enforcement agen-
cies, in any case in which the financial institu-
tion has reason to believe that the breach or 
suspected breach affects a large number of cus-
tomers, including as described in subsection 
(e)(1)(C), subject to regulations of the Federal 
Trade Commission.
‘‘(2) OTHER ENTITIES.—For purposes of para-
graph (1), any person that maintains personal infor-
mation for or on behalf of a financial institution 
shall promptly notify the financial institution of any 
case in which such customer information has been, 
or is reasonably believed to have been, breached. 
‘‘(c) TIMING.—Any notification required by this sec-
tion shall be made— 
‘‘(1) promptly and without unreasonable delay, 
upon discovery of the breach or suspected breach; 
and 
‘‘(2) consistent with— 
‘‘(A) the legitimate needs of law enforce-
ment, as provided in subsection (d); and 
‘‘(B) any measures necessary to determine 
the scope of the breach or restore the reason-
able integrity of the information security system 
of the financial institution. 
‘‘(d) DELAYS FOR LAW ENFORCEMENT PURPOSES.— 
Any notification required by this section may be delayed 
if a law enforcement agency determines that the notifica-
tion would impede a criminal investigation, and in any 
such case, notification shall be made promptly after the 
law enforcement agency determines that it would not com-
promise the investigation.