(b) VIOLATION OF RULE.—A violation of subsection 
(a) shall be treated as a violation of a rule defining an 
unfair or deceptive act or practice prescribed under section 
18(a)(1)(B) of the Federal Trade Commission Act (15 
U.S.C. 57a(a)(1)(B)). 
(c) POWERS OF COMMISSION.—The Commission shall 
enforce this section in the same manner, by the same 
means, and with the same jurisdiction, powers, and duties 
as though all applicable terms and provisions of the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.) were 
incorporated into and made a part of this Act. Any person 
who violates subsection (a) shall be subject to the penalties 
and entitled to the privileges and immunities provided in 
the Federal Trade Commission Act. 
SEC. 4. DEFINITIONS. 
In this Act: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means the unauthorized acquisition of 
data in electronic form containing personal informa-
tion. 
(2) BUREAU.—The term ‘‘Bureau’’ means the 
Consumer Financial Protection Bureau. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(4) CONSUMER REPORTING AGENCY.—The term 
‘‘consumer reporting agency’’ has the meaning given 
the term ‘‘consumer reporting agency that compiles 
and maintains files on consumers on a nationwide 
basis’’ in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
(5) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(6) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
essary to enable decryption of such data. Such 
encryption must include appropriate management 
and safeguards of such keys to protect the integrity 
of the encryption. 
(7) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personal information for the purpose of engag-
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
ing in commercial transactions under the name of 
such other person. 
(8) NON-PUBLIC
INFORMATION.—The term 
‘‘non-public information’’ means information about 
an individual that is of a private nature and neither 
available to the general public nor obtained from a 
public record. 
(9) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means any information or compila-
tion of information that includes any of the fol-
lowing: 
(i) An individual’s first name or initial 
and last name in combination with any or 
more of the following data elements for 
that individuals: 
(I) Home address or telephone 
number. 
(II) Mother’s maiden name. 
(III) Month, day, and year of 
birth. 
(IV) User name or electronic 
mail address. 
(ii) Driver’s license number, passport 
number, military identification number, 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
alien registration number, or other similar 
number issued on a government document 
used to verify identity. 
(iii) Unique account identifier, includ-
ing a financial account number, credit or 
debit card number, electronic identification 
number, user name, or routing code. 
(iv) Partial or complete Social Secu-
rity number. 
(v) Unique biometric or genetic data 
such as a fingerprint, voice print, a retina 
or iris image, or any other unique physical 
representations. 
(vi) Information that could be used to 
access an individual’s account, such as 
user name and password or email address 
and password. 
(vii) Any two or more of the following 
data elements: 
(I) An individual’s first and last 
name or first initial and last name. 
(II) A unique account identifier, 
including a financial account number 
or credit or debit card number, elec-
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
tronic identification number, user 
name, or routing code. 
(III) Any security code, access 
code, or password, or source code that 
could be used to generate such codes 
or passwords. 
(viii) Information generated or derived 
from the operation or use of an electronic 
communications device that is sufficient to 
identify the street name and name of the 
city or town in which the device is located. 
(ix) Any information regarding an in-
dividual’s medical history, mental or phys-
ical condition, medical treatment or diag-
nosis by a health care professional, or the 
provision of health care to the individual, 
including health information provided to a 
website or mobile application. 
(x) A health insurance policy number 
or subscriber identification number and 
any unique identifier used by a health in-
surer to identify the individual, or any in-
formation in an individual’s health insur-
ance application and claims history, includ-
ing any appeals records. 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(xi) Digitized or other electronic sig-
nature. 
(xii) Nonpublic communications or 
other user-created content such as emails, 
photographs, or videos. 
(xiii) Any record or information con-
cerning payroll, income, financial accounts, 
mortgages, loans, lines of credit, utility 
bills, accumulated purchases, or any other 
information regarding financial assets, ob-
ligations, or spending habits. 
(xiv) Any additional element the Com-
mission defines as personal information. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A). 
(10) 
PUBLIC
RECORD
INFORMATION.—The 
term ‘‘public record information’’ means information 
about an individual which has been obtained origi-
nally from records of a Federal, State, or local gov-
ernment entity that are available for public inspec-
tion. 
VerDate Sep 11 2014 
21:06 Sep 27, 2017
Jkt 069200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(11) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means an entity that provides to a user 
transmission, routing, intermediate and transient 
storage, or connections to its system or network, for 
electronic communications, between or among points 
specified by such user of material of the user’s 
choosing, without modification to the content of the 
material as sent or received. Any such entity shall 
be treated as a service provider under this Act only 
to the extent that it is engaged in the provision of 
such transmission, routing, intermediate and tran-
sient storage, or connections. 
(12) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, the 
Commonwealth of Puerto Rico, Guam, American 
Samoa, the United States Virgin Islands, the Com-
monwealth of the Northern Mariana Islands, any 
other territory or possession of the United States, 
and each federally recognized Indian Tribe. 
SEC. 5. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
a State, with respect to those entities covered by the regu-
lations issued pursuant to this Act, that expressly requires 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
notification to individuals of a breach of security resulting 
in unauthorized access to or acquisition of data in elec-
tronic form containing personal information. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than a per-
son specified in section 2(b) may bring a civil action 
under the laws of any State if such action is pre-
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an attorney general of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed to limit or affect the Com-
mission’s authority under any other provision of law. 
SEC. 6. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of 
enactment of this Act. 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
SEC. 7. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $1,000,000 for each of fiscal years 2018 through 
2023 to carry out this Act. 
Æ 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6301
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS