I 
111TH CONGRESS 
2D SESSION 
H. R. 6236 
To require Federal agencies, and persons engaged in interstate commerce, 
in possession of data containing sensitive personally identifiable informa-
tion, to disclose any breach of such information. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 28, 2010 
Mr. SCHIFF introduced the following bill; which was referred to the Committee 
on Energy and Commerce, and in addition to the Committees on Over-
sight and Government Reform, Financial Services, and the Judiciary, for 
a period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To require Federal agencies, and persons engaged in inter-
state commerce, in possession of data containing sen-
sitive personally identifiable information, to disclose any 
breach of such information. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Breach Notifica-
tion Act’’. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
SEC. 2. NOTICE TO INDIVIDUALS. 
(a) IN GENERAL.—Any agency, or business entity en-
gaged in interstate commerce, that uses, accesses, trans-
mits, stores, disposes of or collects sensitive personally 
identifiable information shall, following the discovery of a 
security breach of such information notify any resident of 
the United States whose sensitive personally identifiable 
information has been, or is reasonably believed to have 
been, accessed, or acquired. 
(b) OBLIGATION OF OWNER OR LICENSEE.— 
(1) NOTICE
TO
OWNER
OR
LICENSEE.—Any 
agency, or business entity engaged in interstate com-
merce, that uses, accesses, transmits, stores, dis-
poses of, or collects sensitive personally identifiable 
information that the agency or business entity does 
not own or license shall notify the owner or licensee 
of the information following the discovery of a secu-
rity breach involving such information. 
(2) NOTICE BY OWNER, LICENSEE OR OTHER 
DESIGNATED
THIRD
PARTY.—Nothing in this Act 
shall prevent or abrogate an agreement between an 
agency or business entity required to give notice 
under this section and a designated third party, in-
cluding an owner or licensee of the sensitive person-
ally identifiable information subject to the security 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
breach, to provide the notifications required under 
subsection (a). 
(3) BUSINESS ENTITY RELIEVED FROM GIVING 
NOTICE.—A business entity obligated to give notice 
under subsection (a) shall be relieved of such obliga-
tion if an owner or licensee of the sensitive person-
ally identifiable information subject to the security 
breach, or other designated third party, provides 
such notification. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay following the discovery by the agency or 
business entity of a security breach. 
(2) REASONABLE
DELAY.—Reasonable delay 
under this subsection may include any time nec-
essary to determine the scope of the security breach, 
prevent further disclosures, and restore the reason-
able integrity of the data system and provide notice 
to law enforcement when required. 
(3) BURDEN OF PROOF.—The agency, business 
entity, owner, or licensee required to provide notifi-
cation under this section shall have the burden of 
demonstrating that all notifications were made as re-
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
quired under this Act, including evidence dem-
onstrating the reasons for any delay. 
(d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.— 
(1) IN GENERAL.—If a Federal law enforce-
ment agency determines that the notification re-
quired under this section would impede a criminal 
investigation, such notification shall be delayed upon 
written notice from such Federal law enforcement 
agency to the agency or business entity that experi-
enced the breach. 
(2) EXTENDED DELAY OF NOTIFICATION.—If 
the notification required under subsection (a) is de-
layed pursuant to paragraph (1), an agency or busi-
ness entity shall give notice 30 days after the day 
such law enforcement delay was invoked unless a 
Federal law enforcement agency provides written no-
tification that further delay is necessary. 
(3) LAW ENFORCEMENT IMMUNITY.—No cause 
of action shall lie in any court against any law en-
forcement agency for acts relating to the delay of 
notification for law enforcement purposes under this 
Act. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
SEC. 3. EXEMPTIONS. 
(a) EXEMPTION FOR NATIONAL SECURITY AND LAW 
ENFORCEMENT.— 
(1) IN GENERAL.—Section 2 shall not apply to 
an agency or business entity if the agency or busi-
ness entity certifies, in writing, that notification of 
the security breach as required by section 2 reason-
ably could be expected to— 
(A) cause damage to the national security; 
or 
(B) hinder a law enforcement investigation 
or the ability of the agency to conduct law en-
forcement investigations. 
(2) LIMITS ON CERTIFICATIONS.—An agency or 
business entity may not execute a certification under 
paragraph (1) to— 
(A) conceal violations of law, inefficiency, 
or administrative error; 
(B) prevent embarrassment to a business 
entity, organization, or agency; or 
(C) restrain competition. 
(3) NOTICE.—In every case in which an agency 
or business entity issues a certification under para-
graph (1), the certification, accompanied by a de-
scription of the factual basis for the certification, 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
shall be immediately provided to the United States 
Secret Service. 
(4) SECRET
SERVICE
REVIEW
OF
CERTIFI-
CATIONS.— 
(A) IN GENERAL.—The United States Se-
cret Service may review a certification provided 
by an agency under paragraph (3), and shall re-
view a certification provided by a business enti-
ty under paragraph (3), to determine whether 
an exemption under paragraph (1) is merited. 
Such review shall be completed not later than 
10 business days after the date of receipt of the 
certification, except as provided in paragraph 
(5)(C). 
(B) NOTICE.—Upon completing a review 
under subparagraph (A) the United States Se-
cret Service shall immediately notify the agency 
or business entity, in writing, of its determina-
tion of whether an exemption under paragraph 
(1) is merited. 
(C) EXEMPTION.—The exemption under 
paragraph (1) shall not apply if the United 
States Secret Service determines under this 
paragraph that the exemption is not merited. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
(5) ADDITIONAL AUTHORITY OF THE SECRET 
SERVICE.— 
(A) IN GENERAL.—In determining under 
paragraph (4) whether an exemption under 
paragraph (1) is merited, the United States Se-
cret Service may request additional information 
from the agency or business entity regarding 
the basis for the claimed exemption, if such ad-
ditional information is necessary to determine 
whether the exemption is merited. 
(B) REQUIRED COMPLIANCE.—Any agency 
or business entity that receives a request for 
additional information under subparagraph (A) 
shall cooperate with any such request. 
(C) TIMING.—If the United States Secret 
Service requests additional information under 
subparagraph (A), the United States Secret 
Service shall notify the agency or business enti-
ty not later than 10 business days after the 
date of receipt of the additional information 
whether an exemption under paragraph (1) is 
merited. 
(b) SAFE HARBOR.— 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
(1) IN GENERAL.—An agency or business entity 
shall be exempt from the notice requirements under 
section 2, if— 
(A) a risk assessment concludes that there 
is no significant risk that a security breach has 
resulted in, or will result in, harm to the indi-
vidual whose sensitive personally identifiable in-
formation was subject to the security breach; 
(B) without unreasonable delay, but not 
later than 45 days after the discovery of a secu-
rity breach (unless extended by the United 
States Secret Service), the agency or business 
entity notifies the United States Secret Service, 
in writing, of— 
(i) the results of the risk assessment; 
and 
(ii) its decision to invoke the risk as-
sessment exemption; and 
(C) the United States Secret Service does 
not indicate, in writing, and not later than 10 
business days after the date of receipt of the 
decision described in subparagraph (B)(ii), that 
notice should be given. 
(2) PRESUMPTIONS.—There shall be a pre-
sumption that no significant risk of harm to the in-
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
dividual whose sensitive personally identifiable infor-
mation was subject to a security breach if such in-
formation— 
(A) was encrypted; or 
(B) was rendered indecipherable through 
the use of best practices or methods, such as 
redaction, access controls, or other such mecha-
nisms, that are widely accepted as an effective 
industry practice, or an effective industry 
standard. 
(c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
(1) IN GENERAL.—A business entity will be ex-
empt from the notice requirement under section 2 if 
the business entity utilizes or participates in a secu-
rity program that— 
(A) is designed to block the use of the sen-
sitive personally identifiable information to ini-
tiate unauthorized financial transactions before 
they are charged to the account of the indi-
vidual; and 
(B) provides for notice to affected individ-
uals after a security breach that has resulted in 
fraud or unauthorized transactions. 
(2) LIMITATION.—The exemption by this sub-
section does not apply if— 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
(A) the information subject to the security 
breach includes sensitive personally identifiable 
information, other than a credit card number or 
credit card security code, of any type; or 
(B) the information subject to the security 
breach includes both the individual’s credit card 
number and the individual’s first and last 
name. 
SEC. 4. METHODS OF NOTICE. 
An agency, or business entity shall be in compliance 
with section 2 if it provides both: 
(1) INDIVIDUAL NOTICE.— 
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the agency or business entity; 
(B) telephone notice to the individual per-
sonally; or 
(C) email notice, if the individual has con-
sented to receive such notice and the notice is 
consistent with the provisions permitting elec-
tronic transmission of notices under section 101 
of the Electronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 7001). 
(2) MEDIA
NOTICE.—Notice to major media 
outlets serving a State or jurisdiction, if the number 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
of residents of such State whose sensitive personally 
identifiable information was, or is reasonably be-
lieved to have been, acquired by an unauthorized 
person exceeds 5,000. 
SEC. 5. CONTENT OF NOTIFICATION. 
(a) IN GENERAL.—Regardless of the method by 
which notice is provided to individuals under section 4, 
such notice shall include, to the extent possible— 
(1) a description of the categories of sensitive 
personally identifiable information that was, or is 
reasonably believed to have been, acquired by an un-
authorized person; 
(2) a toll-free number— 
(A) that the individual may use to contact 
the agency or business entity, or the agent of 
the agency or business entity; and 
(B) from which the individual may learn 
what types of sensitive personally identifiable 
information the agency or business entity main-
tained about that individual; and 
(3) the toll-free contact telephone numbers and 
addresses for the major credit reporting agencies. 
(b) ADDITIONAL CONTENT.—Notwithstanding sec-
tion 10, a State may require that a notice under sub-
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
section (a) shall also include information regarding victim 
protection assistance provided for by that State. 
SEC. 6. COORDINATION OF NOTIFICATION WITH CREDIT 
REPORTING AGENCIES. 
If an agency or business entity is required to provide 
notification to more than 5,000 individuals under section 
2(a), the agency or business entity shall also notify all con-
sumer reporting agencies that compile and maintain files 
on consumers on a nationwide basis (as defined in section 
603(p) of the Fair Credit Reporting Act (15 U.S.C. 
1681a(p)) of the timing and distribution of the notices. 
Such notice shall be given to the consumer credit reporting 
agencies without unreasonable delay and, if it will not 
delay notice to the affected individuals, prior to the dis-
tribution of notices to the affected individuals. 
SEC. 7. NOTICE TO LAW ENFORCEMENT. 
(a) SECRET SERVICE.—Any business entity or agen-
cy shall notify the United States Secret Service of the fact 
that a security breach has occurred if— 
(1) the number of individuals whose sensitive 
personally identifying information was, or is reason-
ably believed to have been acquired by an unauthor-
ized person exceeds 10,000; 
(2) the security breach involves a database, 
networked or integrated databases, or other data 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
system containing the sensitive personally identifi-
able information of more than 1,000,000 individuals 
nationwide; 
(3) the security breach involves databases 
owned by the Federal Government; or 
(4) the security breach involves primarily sen-
sitive personally identifiable information of individ-
uals known to the agency or business entity to be 
employees and contractors of the Federal Govern-
ment involved in national security or law enforce-
ment. 
(b) NOTICE TO OTHER LAW ENFORCEMENT AGEN-
CIES.—The United States Secret Service shall be respon-
sible for notifying— 
(1) the Federal Bureau of Investigation, if the 
security breach involves espionage, foreign counter-
intelligence, information protected against unauthor-
ized disclosure for reasons of national defense or for-
eign relations, or Restricted Data (as that term is 
defined in section 11y of the Atomic Energy Act of 
1954 (42 U.S.C. 2014(y)), except for offenses af-
fecting the duties of the United States Secret Serv-
ice under section 3056(a) of title 18, United States 
Code; 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS