‘‘(e) FORM OF NOTICE.—Any notification required by 
this section may be provided— 
‘‘(1) to a customer— 
‘‘(A) in writing; 
‘‘(B) in electronic form, if the notice pro-
vided is consistent with the provisions regarding 
electronic records and signatures set forth in 
section 101 of the Electronic Signatures in 
Global and National Commerce Act; 
‘‘(C) if the Federal Trade Commission de-
termines that the number of all customers af-
fected by, or the cost of providing notifications 
relating to, a single breach or suspected breach 
would make other forms of notification prohibi-
tive, or in any case in which the financial insti-
tution certifies in writing to the Federal Trade 
Commission that it does not have sufficient cus-
tomer contact information to comply with other 
forms of notification, in the form of— 
‘‘(i) an e-mail notice, if the financial 
institution has access to an e-mail address 
for the affected customer that it has rea-
son to believe is accurate; 
‘‘(ii) a conspicuous posting on the 
Internet website of the financial institu-
tion, if the financial institution maintains 
such a website; or 
‘‘(iii) notification through the media 
that a breach of personal information has 
occurred or is suspected that compromises 
the security, confidentiality, or integrity of 
customer information of the financial insti-
tution; or 
‘‘(D) in such other form as the Federal 
Trade Commission may by rule prescribe; and 
‘‘(2) to consumer reporting agencies and law 
enforcement agencies (where appropriate), in such 
form as the Federal Trade Commission may pre-
scribe, by rule. 
‘‘(f) CONTENT OF NOTIFICATION.—Each notification 
to a customer under subsection (b) shall include— 
‘‘(1) a statement that— 
‘‘(A) credit reporting agencies have been 
notified of the relevant breach or suspected 
breach; and 
‘‘(B) the credit report and file of the cus-
tomer will contain a fraud alert to make credi-
tors aware of the breach or suspected breach, 
and to inform creditors that the express author-
ization of the customer is required for any new
issuance or extension of credit (in accordance 
with section 605(g) of the Fair Credit Report-
ing Act); and 
‘‘(2) such other information as the Federal 
Trade Commission determines is appropriate. 
‘‘(g) COMPLIANCE.—Notwithstanding subsection (e), 
a financial institution shall be deemed to be in compliance 
with this section if— 
‘‘(1) the financial institution has established a 
comprehensive information security program that is 
consistent with the standards prescribed by the ap-
propriate regulatory body under section 501(b); 
‘‘(2) the financial institution notifies affected 
customers and consumer reporting agencies in ac-
cordance with its own internal information security 
policies in the event of a breach or suspected breach 
of personal information; and 
‘‘(3) such internal security policies incorporate 
notification procedures that are consistent with the 
requirements of this section and the rules of the 
Federal Trade Commission under this section. 
‘‘(h) CIVIL PENALTIES.— 
‘‘(1) DAMAGES.—Any customer injured by a 
violation of this section may institute a civil action 
to recover damages arising from that violation.