ered entity who initiated such connection, trans-
mission, routing, or storage of the data containing 
personal information breached, if such covered entity 
can be reasonably identified. If a service provider is 
acting solely as a service provider for purposes of 
this subsection, the service provider has no other no-
tification obligations under this section. 
(2) COVERED ENTITIES WHO RECEIVE NOTICE 
FROM SERVICE PROVIDERS.—Upon receiving notifi-
cation from a service provider under paragraph (1), 
a covered entity shall provide notification as required 
under this section. 
SEC. 4. ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act in the same manner, by 
the same means, and with the same jurisdiction, 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act 
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act, and any covered entity who 
violates this Act shall be subject to the penalties and 
entitled to the privileges and immunities provided in 
the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.), and as provided in clauses (ii) and (iii) of sec-
tion 5(4)(A). 
(b) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTION.—In any case in which the 
attorney general of a State has reason to believe 
that an interest of the residents of that State has 
been or is threatened or adversely affected by any 
covered entity who violates section 2 or 3 of this 
Act, the attorney general of the State, as parens 
patriae, may bring a civil action on behalf of the 
residents of the State in a district court of the 
United States of appropriate jurisdiction to— 
(A) enjoin further violation of such section 
by the defendant; 
(B) compel compliance with such section; 
or 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(C) obtain civil penalties in the amount de-
termined under paragraph (2). 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.— 
(i) TREATMENT
OF
VIOLATIONS
OF 
SECTION 2.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
2, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of days that a covered 
entity is not in compliance with such sec-
tion by an amount not greater than 
$11,000. 
(ii) TREATMENT
OF
VIOLATIONS
OF 
SECTION 3.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
3, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of violations of such 
section by an amount not greater than 
$11,000. Each failure to send notification 
as required under section 3 to a resident of 
the State shall be treated as a separate 
violation. 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(B) MAXIMUM
TOTAL
LIABILITY.—Not-
withstanding the number of actions which may 
be brought against a covered entity under this 
subsection, the maximum civil penalty for which 
any covered entity may be liable under this sub-
section shall not exceed— 
(i) $2,500,000 for each violation of 
section 2; and 
(ii) $2,500,000 for all violations of 
section 3 resulting from a single breach of 
security. 
(C) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
Index is first published by the Bureau of Labor 
Statistics that is after one year after the date 
of enactment of this Act, and each year there-
after, the amounts specified in clauses (i) and 
(ii) of subparagraph (A) and clauses (i) and (ii) 
of subparagraph (B) shall be increased by the 
percentage increase in the Consumer Price 
Index published on that date from the Con-
sumer Price Index published the previous year. 
(D) PENALTY
FACTORS.—In determining 
the amount of such a civil penalty, the degree 
of culpability, any history of prior such conduct, 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
ability to pay, effect on ability to continue to do 
business, and such other matters as justice may 
require shall be taken into account. 
(3) INTERVENTION BY THE FEDERAL TRADE 
COMMISSION.— 
(A) NOTICE AND INTERVENTION.—In all 
cases, the State shall provide prior written no-
tice of any action under paragraph (1) to the 
Commission and provide the Commission with a 
copy of its complaint, except in any case in 
which such prior notice is not feasible, in which 
case the State shall serve such notice imme-
diately upon instituting such action. The Com-
mission shall have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) PENDING PROCEEDINGS.—If the Fed-
eral Trade Commission initiates a Federal civil 
action for a violation of this Act, no State at-
torney general may bring an action for a viola-
tion of this Act that resulted from the same or 
related acts or omissions against a defendant 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
named in the civil action initiated by the Fed-
eral Trade Commission. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(c) NO PRIVATE CAUSE OF ACTION.—Nothing in this 
Act shall be construed to establish a private cause of ac-
tion against a person for a violation of this Act. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’— 
(A) means a compromise of the security, 
confidentiality, or integrity of, or loss of, data 
in electronic form that results in, or there is a 
reasonable basis to conclude has resulted in, 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
unauthorized access to or acquisition of per-
sonal information from a covered entity; and 
(B) does not include the good faith acquisi-
tion of personal information by an employee or 
agent of the covered entity for the purposes of 
the covered entity, if the personal information is 
not used or subject to further unauthorized dis-
closure. 
(2) BREACHED COVERED ENTITY.—The term 
‘‘breached covered entity’’ means a covered entity 
that has incurred a breach of security affecting data 
in electronic form containing personal information of 
a non-breached covered entity that has directly con-
tracted the breached covered entity to maintain, 
store, or process data in electronic form containing 
personal information on behalf of such non-breached 
covered entity. For purposes of this definition, the 
term ‘‘breached covered entity’’ shall not include a 
service provider. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) CONSUMER REPORTING AGENCY THAT COM-
PILES AND MAINTAINS FILES ON CONSUMERS ON A 
NATIONWIDE BASIS.—The term ‘‘consumer reporting 
agency that compiles and maintains files on con-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
sumers on a nationwide basis’’ has the meaning 
given that term in section 603(p) of the Fair Credit 
Reporting Act (15 U.S.C. 1681a(p)). 
(5) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means— 
(i) a sole proprietorship, partnership, 
corporation, trust, estate, cooperative, as-
sociation, or other entity in or affecting 
commerce that acquires, maintains, stores, 
sells, or otherwise uses data in electronic 
form that includes personal information, 
over which the Commission has authority 
pursuant to section 5(a)(2) of the Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
45(a)(2)); 
(ii) notwithstanding section 5(a)(2) of 
the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)), common carriers subject 
to the Communications Act of 1934 (47 
U.S.C. 151 et seq.); and 
(iii) notwithstanding any jurisdictional 
limitation of the Federal Trade Commis-
sion Act (15 U.S.C. 41 et seq.), any non- 
profit organization. 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(B) EXCEPTIONS.—The term ‘‘covered en-
tity’’ does not include— 
(i) a covered entity, as defined in sec-
tion 160.103 of title 45, Code of Federal 
Regulations; 
(ii) a business associate, as defined in 
section 160.103 of title 45, Code of Fed-
eral Regulations, acting in its capacity as 
a business associate; 
(iii) if a covered entity, as defined in 
section 160.103 of title 45, Code of Fed-
eral Regulations, is a hybrid entity, as de-
fined in section 164.105 of title 45, Code 
of Federal Regulations, then the health 
care component of such hybrid entity; 
(iv) a broker, dealer, investment ad-
viser, or person engaged in providing in-
surance that is subject to title V of Public 
Law 106–102 (15 U.S.C. 6801 et seq.); or 
(v) a State-chartered credit union, as 
defined in section 101(6) of the Federal 
Credit Union Act (12 U.S.C. 1752(6)), 
that is not an insured credit union as de-
fined in section 101(7) of such Act (12 
U.S.C. 1752(7)). 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(6) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(7) ENCRYPTED.—The term ‘‘encrypted’’, used 
with respect to data in electronic form, in storage or 
in transit— 
(A) means the data is protected using an 
encryption technology that has been generally 
accepted by experts in the field of information 
security at the time the breach of security oc-
curred that renders such data indecipherable in 
the absence of associated cryptographic keys 
necessary to enable decryption of such data; 
and 
(B) includes appropriate management and 
safeguards of such cryptographic keys in order 
to protect the integrity of the encryption. 
(8) NON-BREACHED
COVERED
ENTITY.—The 
term ‘‘non-breached covered entity’’ means a covered 
entity that has not incurred the breach of security 
involving data in electronic form containing personal 
information that it owns or licenses but whose data 
has been affected by the breach of security incurred 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
by a breached covered entity it directly contracts to 
maintain, store, or process data in electronic form 
containing personal information on behalf of the 
non-breached covered entity. 
(9) NON-PROFIT
ORGANIZATION.—The term 
‘‘non-profit organization’’ means an organization 
that is described in section 501(c)(3) of the Internal 
Revenue Code of 1986 and exempt from tax under 
section 501(a) of such Code. 
(10) PERSONAL INFORMATION.— 
(A) IN GENERAL.—The term ‘‘personal in-
formation’’ means any information or compila-
tion of information in electronic form that in-
cludes the following: 
(i) An individual’s first and last name 
or first initial and last name in combina-
tion with any one of the following data ele-
ments: 
(I) A driver’s license number, 
passport number, or alien registration 
number or other government-issued 
unique identification number. 
(II) Any two of the following: 
(aa) Home address or tele-
phone number. 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(bb) Mother’s maiden name, 
if identified as such. 
(cc) Month, day, and year of 
birth. 
(ii) A financial account number or 
credit or debit card number or other iden-
tifier, in combination with any security 
code, access code, or password that is re-
quired for an individual to obtain credit, 
withdraw funds, or engage in a financial 
transaction. 
(iii) A unique account identifier (other 
than for an account described in clause 
(ii)), electronic identification number, bio-
metric data unique to an individual, user 
name, or routing code in combination with 
any associated security code, access code, 
biometric data unique to an individual, or 
password that is required for an individual 
to obtain money, or purchase goods, serv-
ices, or any other thing of value. 
(iv) A non-truncated social security 
number. 
(v) For any telecommunications car-
rier or interconnected VoIP provider, the 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS