I 
112TH CONGRESS 
1ST SESSION H. R. 2577 
To protect consumers by requiring reasonable security policies and procedures 
to protect data containing personal information, and to provide for na-
tionwide notice in the event of a security breach. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 18, 2011 
Mrs. BONO MACK introduced the following bill; which was referred to the 
Committee on Energy and Commerce 
A BILL 
To protect consumers by requiring reasonable security poli-
cies and procedures to protect data containing personal 
information, and to provide for nationwide notice in the 
event of a security breach. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Secure and Fortify 
Electronic Data Act’’ or the ‘‘SAFE Data Act’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES
AND PROCE-
DURES.— 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require any person 
engaged in interstate commerce that owns or pos-
sesses data containing personal information related 
to that commercial activity, including an information 
broker and any third party that has contracted with 
such person to maintain or process such data on be-
half of such person, to establish and implement rea-
sonable policies and procedures regarding informa-
tion security practices for the treatment and protec-
tion of personal information, taking into consider-
ation— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, such 
person; 
(B) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(C) the cost of implementing such safe-
guards. 
(2) DATA
SECURITY
REQUIREMENTS.—Such 
regulations shall, taking into consideration the quan-
tity, type, nature, and sensitivity of the personal in-
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
formation, require the policies and procedures to in-
clude the following: 
(A) A security policy with respect to the 
collection, use, sale, other dissemination, and 
maintenance of such personal information. 
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in 
each system maintained by such person that 
contains such data, which shall include regular 
monitoring to detect a breach of security of 
each such system. 
(D) A process for taking preventive and 
corrective action to mitigate against any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include imple-
menting any changes to security practices and 
to the architecture and installation of network 
or operating software. 
(E) A process for disposing of data in elec-
tronic form containing personal information by 
shredding, permanently erasing, or otherwise 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
modifying the personal information contained in 
such data to make such personal information 
permanently unreadable or indecipherable. 
(F) A standard method or methods for the 
destruction of paper documents and other non- 
electronic data containing personal information. 
(b) DATA MINIMIZATION REQUIREMENTS.—A person 
subject to the requirements under subsection (a) shall es-
tablish a plan and procedures for minimizing the amount 
of personal information maintained by such person. Such 
plan and procedures shall provide for the retention of such 
personal information only as reasonably needed for the 
business purposes of such person or as necessary to com-
ply with any legal obligation. 
(c) EXEMPTION
FOR
CERTAIN
SERVICE
PRO-
VIDERS.—Nothing in this section shall apply to a service 
provider for any electronic communication by a third party 
that is transmitted, routed, or stored in intermediate or 
transient storage by such service provider. 
SEC. 3. NOTIFICATION AND OTHER REQUIREMENTS IN THE 
EVENT OF A BREACH OF SECURITY. 
(a) REQUIREMENTS IN THE EVENT OF A BREACH OF 
SECURITY.—Any person engaged in interstate commerce 
that owns or possesses data in electronic form containing 
personal information related to that commercial activity, 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
following the discovery of a breach of security of any sys-
tem maintained by such person that contains such data, 
shall, without unreasonable delay— 
(1) notify appropriate Federal law enforcement 
officials of the breach of security, unless such person 
determines that the breach involved no unlawful ac-
tivity; 
(2) take such steps necessary to prevent further 
breach or unauthorized disclosures; 
(3) identify affected individuals whose personal 
information may have been acquired or accessed; 
and 
(4) not later than 48 hours after identifying af-
fected individuals under paragraph (3), unless the 
person makes a reasonable determination that the 
breach of security presents no reasonable risk of 
identity theft, fraud, or other unlawful conduct af-
fecting such individuals, notify— 
(A) the Commission; and 
(B) as promptly as possible, subject to 
subsection (c), each individual who is a citizen 
or resident of the United States whose personal 
information is known to have been acquired or 
accessed as a result of such a breach of secu-
rity. 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD PARTY AGENTS.—In the event of a 
breach of security of any third party entity that has 
contracted with a person to maintain or process data 
in electronic form containing personal information 
on behalf of such person, such third party entity 
shall— 
(A) take the actions required under para-
graphs (1) and (2) of subsection (a); and 
(B) notify as promptly as possible such 
person of the breach of security. 
Upon receiving notification from the third party en-
tity under subparagraph (B), such person shall take 
the actions required under paragraphs (3) and (4) 
of subsection (a). 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in 
electronic form containing personal information that 
is owned or possessed by another person engaged in 
interstate commerce that connects to or uses a sys-
tem or network provided by the service provider for 
the purpose of transmitting, routing, or providing in-
termediate or transient storage of such data in con-
nection with that commercial activity, such service 
provider shall— 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(A) take the actions required under para-
graphs (1) and (2) of subsection (a); and 
(B) notify only the person who initiated 
such connection, transmission, routing, or stor-
age, of the breach of security, if such person 
can be reasonably identified. 
Upon receiving such notification from a service pro-
vider, such person shall take the action required 
under paragraphs (3) and (4) of subsection (a). 
(3) COORDINATION
OF
NOTIFICATION
WITH 
CREDIT REPORTING AGENCIES.—If a person is re-
quired to provide notification to more than 5,000 in-
dividuals under subsection (a)(4)(B), the person 
shall also notify the major credit reporting agencies 
that compile and maintain files on consumers on a 
nationwide basis of the timing and distribution of 
the notices. Such notice shall be given to the credit 
reporting agencies without unreasonable delay and, 
if it will not delay notice to the affected individuals, 
prior to the distribution of notices to the affected in-
dividuals. 
(c) TIMING AND DELAY OF NOTIFICATION AUTHOR-
IZED FOR LAW ENFORCEMENT OR NATIONAL SECURITY 
PURPOSES.— 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(1) DEADLINE
FOR
COMMENCING
NOTIFICA-
TION.—Except as provided under paragraph (2) or 
(3), a person required to provide notification to indi-
viduals of a breach of security pursuant to sub-
section (a)(4)(B) shall begin to notify such individ-
uals not later than 45 days after discovery of such 
breach. 
(2) LAW ENFORCEMENT.—If a Federal law en-
forcement agency determines that the notification 
required under subsection (a)(4)(B) would impede a 
civil or criminal investigation, such notification shall 
be delayed upon the request of the law enforcement 
agency for 30 days or such lesser period of time that 
the law enforcement agency determines is reasonably 
necessary. The law enforcement agency shall follow 
up such a request in writing. A law enforcement 
agency may, by a subsequent written request, revoke 
such delay or extend the period of time set forth in 
the original request made under this paragraph if 
further delay is necessary. 
(3) NATIONAL
SECURITY.—If a Federal na-
tional security agency or homeland security agency 
determines that the notification required under sub-
section (a)(4)(B) would threaten national or home-
land security, such notification may be delayed for 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
a period of time that the national security agency or 
homeland security agency determines is reasonably 
necessary. The national security agency or homeland 
security agency shall follow up such a request in 
writing. A Federal national security agency or home-
land security agency may revoke such delay or ex-
tend the period of time set forth in the original re-
quest made under this paragraph by a subsequent 
written request if further delay is necessary. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(4)(B) shall be in compli-
ance with such requirement if the person pro-
vides a conspicuous and clearly identified notifi-
cation by one of the following methods (pro-
vided the selected method can reasonably be ex-
pected to reach the intended individual): 
(i) Written notification. 
(ii) Notification by email or other 
electronic means, if— 
(I) the person’s primary method 
of communication with the individual 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
is by email or such other electronic 
means; or 
(II) the individual has consented 
to receive such notification and the 
notification is provided in a manner 
that is consistent with the provisions 
permitting electronic transmission of 
notices under section 101 of the Elec-
tronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 
7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that may have been acquired or 
accessed by an unauthorized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the infor-
mation the person maintained about that 
individual; 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(iii) notice that the individual is enti-
tled to receive, at no cost to such indi-
vidual, consumer credit reports on a quar-
terly basis for a period of 2 years, or credit 
monitoring or other service that enables 
consumers to detect the misuse of their 
personal information for a period of 2 
years, and instructions to the individual on 
requesting such reports or service from the 
person, except when the only information 
which has been the subject of the security 
breach is the individual’s first name or ini-
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; 
(iv) the toll-free contact telephone 
numbers and addresses for the major cred-
it reporting agencies; and 
(v) a toll-free telephone number and 
website address for the Commission where-
by the individual may obtain information 
regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(4)(B) may provide substitute notifi-
cation in lieu of the direct notification required 
by paragraph (1) if the person owns or pos-
sesses data in electronic form containing per-
sonal information of fewer than 1,000 individ-
uals and such direct notification is not feasible 
due to— 
(i) excessive cost to the person re-
quired to provide such notification relative 
to the resources of such person, as deter-
mined in accordance with the regulations 
issued by the Commission under paragraph 
(3)(A); or 
(ii) lack of sufficient contact informa-
tion for the individual required to be noti-
fied. 
(B) FORM
OF
SUBSTITUTE
NOTIFICA-
TION.—Such substitute notification shall in-
clude— 
(i) email notification to the extent 
that the person has email addresses of in-
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
dividuals to whom it is required to provide 
notification under subsection (a)(4)(B); 
(ii) a conspicuous notice on the 
website of the person (if such person main-
tains a website); and 
(iii) notification in print and to broad-
cast media, including major media in met-
ropolitan and rural areas where the indi-
viduals whose personal information was ac-
quired or accessed reside. 
(C) CONTENT OF SUBSTITUTE NOTICE.— 
Each form of substitute notice under this para-
graph shall include— 
(i) notice that individuals whose per-
sonal information is included in the breach 
of security are entitled to receive, at no 
cost to the individuals, consumer credit re-
ports on a quarterly basis for a period of 
2 years, or credit monitoring or other serv-
ice that enables consumers to detect the 
misuse of their personal information for a 
period of 2 years, and instructions on re-
questing such reports or service from the 
person, except when the only information 
which has been the subject of the security 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
breach is the individual’s first name or ini-
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; and 
(ii) a telephone number by which an 
individual can, at no cost to such indi-
vidual, learn whether that individual’s per-
sonal information is included in the breach 
of security. 
(3) REGULATIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 1 year 
after the date of enactment of this Act, the 
Commission shall, by regulation under section 
553 of title 5, United States Code, establish cri-
teria for determining circumstances under 
which substitute notification may be provided 
under paragraph (2), including criteria for de-
termining if notification under paragraph (1) is 
not feasible due to excessive costs to the person 
required to provide such notification relative to 
the resources of such person. Such regulations 
may also identify other circumstances where 
substitute notification would be appropriate for 
any person, including circumstances under 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
which the cost of providing notification exceeds 
the benefits to consumers. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
with respect to compliance with this subsection. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute notification under paragraph (2), 
including the extent of notification to print 
and broadcast media that complies with 
the requirements of such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—A person required to provide 
notification under subsection (a)(4)(B) shall, in ac-
cordance with the determination described in para-
graph (3), upon request of an individual whose per-
sonal information was included in the breach of se-
curity, provide or arrange for the provision of, to 
each such individual and at no cost to such indi-
vidual— 
(A) consumer credit reports from at least 
one of the major credit reporting agencies be-
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
ginning not later than 60 days following the in-
dividual’s request and continuing on a quarterly 
basis for a period of 2 years thereafter; or 
(B) a credit monitoring or other service 
that enables consumers to detect the misuse of 
their personal information, beginning not later 
than 60 days following the individual’s request 
and continuing for a period of 2 years. 
(2) LIMITATION.—This subsection shall not 
apply if the only personal information which has 
been the subject of the security breach is the individ-
ual’s first name or initial and last name, or address, 
or phone number, in combination with a credit or 
debit card number, and any required security code. 
(3) RULEMAKING.—As part of the Commis-
sion’s rulemaking described in subsection (d)(3), the 
Commission shall determine the circumstances under 
which a person required to provide notification 
under subsection (a)(4)(B) shall provide or arrange 
for the provision of free consumer credit reports or 
credit monitoring or other service to affected individ-
uals. 
(f) PRESUMPTION CONCERNING DATA IN CERTAIN 
FORMS.— 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(1) IN
GENERAL.—If the data in electronic 
form containing personal information is unusable, 
unreadable, or indecipherable to an unauthorized 
person by encryption or other security technology or 
methodology (if the method of encryption or such 
other technology or methodology is generally accept-
ed by experts in the information security field), 
there shall be a presumption, for purposes of sub-
section (a)(4), that no reasonable risk of identity 
theft, fraud, or other unlawful conduct exists fol-
lowing a breach of security of such data. Any such 
presumption may be rebutted by facts demonstrating 
that the encryption or other security technologies or 
methodologies in a specific case have been or are 
reasonably likely to be compromised. 
(2) METHODOLOGIES OR TECHNOLOGIES.—The 
Commission may issue guidance to identify security 
methodologies or technologies that render data in 
electronic form unusable, unreadable, or indecipher-
able, that shall, if applied to such data, establish a 
presumption that no reasonable risk of identity 
theft, fraud, or other unlawful conduct exists fol-
lowing a breach of security of such data. Any such 
presumption may be rebutted by facts demonstrating 
that any such methodology or technology in a spe-
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
cific case has been or is reasonably likely to be com-
promised. In issuing such rules or guidance, the 
Commission shall consult with relevant industries, 
consumer organizations, and data security and iden-
tity theft prevention experts and established stand-
ards setting bodies. 
(g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—If the Commission, upon receiving notification of 
any breach of security that is reported to the Commission 
under subsection (a)(4)(A), finds that notification of such 
a breach of security available on the Commission’s website 
would be in the public interest or for the protection of 
consumers, the Commission may place such a notice in 
a clear and conspicuous location on such website. 
(h) FTC STUDY ON NOTIFICATION IN LANGUAGES 
IN ADDITION TO ENGLISH.—Not later than 1 year after 
the date of enactment of this Act, the Commission shall 
conduct a study on the practicality and cost effectiveness 
of requiring the notification required by subsection (d)(1) 
to be provided in a language in addition to English to indi-
viduals known to speak only such other language. 
(i) GENERAL RULEMAKING AUTHORITY.—The Com-
mission may promulgate regulations, pursuant to section 
553 of title 5, United States Code, as necessary to effec-
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
tively implement and enforce the requirements of this sec-
tion. 
SEC. 4. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
sections 2 and 3 apply, according to their terms, to— 
(1) those persons, partnerships, or corporations 
over which the Commission has authority pursuant 
to section 5(a)(2) of the Federal Trade Commission 
Act (15 U.S.C. 45(a)(2)); and 
(2) notwithstanding section 4 and section 
5(a)(2) of that Act (15 U.S.C. 44 and 45(a)(2)), 
any organization described in section 501(c) of the 
Internal Revenue Code of 1986 that is exempt from 
taxation under section 501(a) of such Code. 
(b) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act in the same manner, by 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act 
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act. Any person who violates 
section 2 or 3 shall be subject to the penalties and 
entitled to the privileges and immunities provided in 
that Act, except that the Commission may not assess 
civil penalties for a violation of section 3(a)(1). 
(c) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTION.—In any case in which the 
attorney general of a State, or an official or agency 
of a State, has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by any person who violates sec-
tion 2 or 3 of this Act, the attorney general, official, 
or agency of the State, as parens patriae, may bring 
a civil action on behalf of the residents of the State 
in a district court of the United States of appro-
priate jurisdiction— 
(A) to enjoin further violation of such sec-
tion by the defendant; 
(B) to compel compliance with such sec-
tion; or 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(C) to obtain civil penalties in the amount 
determined under paragraph (2). 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.— 
(i) TREATMENT
OF
VIOLATIONS
OF 
SECTION 2.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
2, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of days that a person is 
not in compliance with such section by an 
amount not greater than $11,000. 
(ii) TREATMENT
OF
VIOLATIONS
OF 
SECTION 3.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
3, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of violations of such 
section by an amount not greater than 
$11,000. Each failure to send notification 
as required under section 3 to a resident of 
the State shall be treated as a separate 
violation. 
(B) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
Index is first published by the Bureau of Labor 
Statistics that is at least 1 year after the date 
of enactment of this Act, and each year there-
after, the amounts specified in clauses (i) and 
(ii) of subparagraph (A) shall be increased by 
the percentage increase in the Consumer Price 
Index published on that date from the Con-
sumer Price Index published the previous year. 
(C) MAXIMUM
TOTAL
LIABILITY.—Not-
withstanding the number of actions which may 
be brought against a person under this sub-
section, the maximum civil penalty for which 
any person may be liable under this subsection 
shall not exceed— 
(i) $5,000,000 for all related viola-
tions of section 2; and 
(ii) $5,000,000 for all violations of 
section 3 resulting from a single breach of 
security. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission 
and provide the Commission with a copy of its 
complaint, except in any case in which such 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(d) ENTITIES GOVERNED BY HIPAA AND GRAMM- 
LEACH-BLILEY.— 
(1) HIPAA.— 
(A) INFORMATION
SECURITY
REQUIRE-
MENTS.—To the extent that the information se-
curity requirements of part C of title XI of the 
Social Security Act (42 U.S.C. 1320d et seq.) 
apply in any circumstance to a person who is 
subject to such part, including as applied under 
subtitle D of title IV of the Health Information 
Technology for Economic and Clinical Health 
Act (42 U.S.C. 17921 et seq.), such person 
shall be exempt from the requirements of sec-
tion 2. 
(B) NOTIFICATION
REQUIREMENTS.—To 
the extent that the breach notification require-
ments of part C of title XI of the Social Secu-
rity Act (42 U.S.C. 1320d et seq.) apply in any 
circumstance to a person who is subject to such 
part, including as applied under subtitle D of 
title IV of the Health Information Technology 
for Economic and Clinical Health Act (42 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
U.S.C. 17921 et seq.), such person shall be ex-
empt from the requirements of section 3. 
(2) GRAMM-LEACH-BLILEY.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), a person who is subject to 
title V of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801 et seq.)— 
(i) with regard to information security 
requirements, shall be exempt from the re-
quirements of section 2; and 
(ii) with regard to notification require-
ments, shall be exempt from the require-
ments of section 3. 
(B) EXCEPTION.—Notwithstanding sub-
paragraph (A), those persons subject to the ju-
risdiction of the Federal Trade Commission 
under section 505(a)(7) of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6805) shall be subject to 
the requirements of this Act. If such person is 
in compliance with the information security re-
quirements of title V of such Act, such person 
shall be deemed in compliance with section 2 of 
this Act. 
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means any unauthorized access to or ac-
quisition of data in electronic form containing per-
sonal information. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
essary to enable decryption of such data. Such 
encryption must include appropriate management 
and safeguards of such keys to protect the integrity 
of the encryption. 
(5) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personal information for the purpose of engag-
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS
ing in commercial transactions under the name of 
such other person. 
(6) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’— 
(A) means a commercial entity whose busi-
ness is to collect, assemble, or maintain per-
sonal information concerning individuals who 
are not current or former customers of such en-
tity in order to sell such information or provide 
access to such information to any nonaffiliated 
third party in exchange for consideration, 
whether such collection, assembly, or mainte-
nance of personal information is performed by 
the information broker directly, or by contract 
or subcontract with any other entity; and 
(B) does not include a commercial entity to 
the extent that such entity processes informa-
tion collected by or on behalf of and received 
from or on behalf of a nonaffiliated third party 
concerning individuals who are current or 
former customers or employees of such third 
party to enable such third party directly or 
through parties acting on its behalf to provide 
benefits for its employees or directly transact 
business with its customers. 
VerDate Mar 15 2010 
02:43 Jul 19, 2011
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2577.IH
H2577
rfrederick on DSK29S0YB1PROD with BILLS