I 
112TH CONGRESS 
1ST SESSION H. R. 3730 
To amend title 38, United States Code, to require the Secretary of Veterans 
Affairs to provide notice to individuals whose sensitive personal informa-
tion is involved in a data breach, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 19, 2011 
Mr. DONNELLY of Indiana (for himself and Mr. JOHNSON of Ohio) introduced 
the following bill; which was referred to the Committee on Veterans’ Affairs 
A BILL 
To amend title 38, United States Code, to require the Sec-
retary of Veterans Affairs to provide notice to individuals 
whose sensitive personal information is involved in a 
data breach, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Veterans Data Breach 
Timely Notification Act’’. 
VerDate Mar 15 2010 
20:30 Dec 23, 2011
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3730.IH
H3730
jlentini on DSK4TPTVN1PROD with BILLS
SEC. 2. NOTIFICATION BY THE SECRETARY OF VETERANS 
AFFAIRS OF INDIVIDUALS WHOSE SENSITIVE 
PERSONAL INFORMATION IS INVOLVED IN A 
DATA BREACH. 
(a) IN GENERAL.—Subchapter III of chapter 57 of 
title 38, United States Code is amended by inserting after 
section 5724 the following new section: 
‘‘§ 5724A. Data breach notification 
‘‘(a) NOTIFICATION REQUIREMENT.—Except as pro-
vided in subsection (d), in the event of a data breach with 
respect to sensitive personal information that is processed 
or maintained by the Secretary, by not later than five busi-
ness days after the data breach, the Secretary shall notify 
the appropriate committees of Congress and each indi-
vidual whose sensitive personal information is involved in 
the data breach is notified of the data breach. If the Sec-
retary determines that providing such notification within 
five business days is not feasible due to circumstances nec-
essary to accurately identify the individuals whose sen-
sitive personal information is involved in the data breach 
or to prevent further breach or unauthorized disclosure 
and reasonably restore the integrity of the data system 
the Secretary shall provide such notification not later than 
10 business days after the data breach. 
‘‘(b) CONTRACTS FOR DATA PROCESSING OR MAIN-
TENANCE.—If the Secretary enters into a contract for the 
VerDate Mar 15 2010 
20:30 Dec 23, 2011
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3730.IH
H3730
jlentini on DSK4TPTVN1PROD with BILLS
performance of any Department function that requires ac-
cess to sensitive personal information, the Secretary shall 
require as a condition of the contract that the contractor 
agree to provide notification of data breaches in the same 
manner as required of the Secretary under subsection (a). 
‘‘(c) METHOD AND CONTENT OF NOTIFICATION.— 
(1) Notification provided to an individual under subsection 
(a) shall be provided clearly and conspicuously by one of 
the following methods: 
‘‘(A) Written notification. 
‘‘(B) Notification by email or other electronic 
means, if the Secretary’s primary method of commu-
nication with the individual is by email or such other 
electronic means. 
‘‘(2) Regardless of the method by which notification 
is provided to an individual under paragraph (1), such no-
tification shall include— 
‘‘(A) a description of the sensitive personal in-
formation involved in the data breach; 
‘‘(B) a telephone number that the individual 
may use, at no cost to the individual, to contact an 
appropriate employee of the Department to inquire 
about the data breach or the individual’s sensitive 
personal information maintained by the Department; 
VerDate Mar 15 2010 
20:30 Dec 23, 2011
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3730.IH
H3730
jlentini on DSK4TPTVN1PROD with BILLS