ment or use of any specific products or technologies, 
including any specific computer software or hard-
ware. 
(c) ENFORCEMENT BY STATE ATTORNEYS GENERAL.— 
(1) CIVIL ACTION.—In any case in which the at-
torney general of a State, or an official or agency of 
a State, has reason to believe that an interest of the 
residents of that State has been or is threatened or 
adversely affected by any person who violates section 
2 or 3 of this Act, the attorney general, official, or 
agency of the State, as parens patriae, may bring a 
civil action on behalf of the residents of the State in 
a district court of the United States of appropriate 
jurisdiction— 
(A) to enjoin further violation of such sec-
tion by the defendant; 
(B) to compel compliance with such section; 
or 
(C) to obtain civil penalties in the amount 
determined under paragraph (2). 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.— 
(i) TREATMENT
OF
VIOLATIONS
OF 
SECTION
2.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
2, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of days that a person is 
not in compliance with such section by an 
amount not greater than $11,000. 
(ii) TREATMENT
OF
VIOLATIONS
OF 
SECTION
3.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
3, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of violations of such sec-
tion by an amount not greater than 
$11,000. Each failure to send notification 
as required under section 3 to a resident of 
the State shall be treated as a separate vio-
lation. 
(B) ADJUSTMENT FOR INFLATION.—Begin-
ning on the date that the Consumer Price Index 
is first published by the Bureau of Labor Statis-
tics that is after 1 year after the date of enact-
ment of this Act, and each year thereafter, the 
amounts specified in clauses (i) and (ii) of sub-
paragraph (A) shall be increased by the percent-
age increase in the Consumer Price Index pub-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
lished on that date from the Consumer Price 
Index published the previous year. 
(C) MAXIMUM TOTAL LIABILITY.—Notwith-
standing the number of actions which may be 
brought against a person under this subsection 
the maximum civil penalty for which any person 
may be liable under this subsection shall not ex-
ceed— 
(i) $5,000,000 for each violation of sec-
tion 2; and 
(ii) $5,000,000 for all violations of sec-
tion 3 resulting from a single breach of se-
curity. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE AND INTERVENTION.—The State 
shall provide prior written notice of any action 
under paragraph (1) to the Commission and 
provide the Commission with a copy of its com-
plaint, except in any case in which such prior 
notice is not feasible, in which case the State 
shall serve such notice immediately upon insti-
tuting such action. The Commission shall have 
the right— 
(i) to intervene in the action; 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official or 
agency of a State, may bring an action under 
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney general 
of a State from exercising the powers conferred on the 
attorney general by the laws of that State to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(d) AFFIRMATIVE DEFENSE FOR A VIOLATION OF SEC-
TION 3.— 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(1) IN GENERAL.—It shall be an affirmative de-
fense to an enforcement action brought under sub-
section (b), or a civil action brought under subsection 
(c), based on a violation of section 3, that all of the 
personal information contained in the data in elec-
tronic form that was acquired or accessed as a result 
of a breach of security of the defendant is public 
record information that is lawfully made available to 
the general public from Federal, State, or local gov-
ernment records and was acquired by the defendant 
from such records. 
(2) NO
EFFECT
ON
OTHER
REQUIREMENTS.— 
Nothing in this subsection shall be construed to ex-
empt any person from the requirement to notify the 
Commission of a breach of security as required under 
section 3(a). 
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
(1) BREACH OF SECURITY.—The term ‘‘breach of 
security’’ means unauthorized access to or acquisition 
of data in electronic form containing personal infor-
mation. 
(2) 
COMMISSION.—The 
term 
‘‘Commission’’ 
means the Federal Trade Commission. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(3) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored elec-
tronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(4) ENCRYPTION.—The term ‘‘encryption’’ means 
the protection of data in electronic form in storage or 
in transit using an encryption technology that has 
been adopted by an established standards setting body 
which renders such data indecipherable in the absence 
of associated cryptographic keys necessary to enable 
decryption of such data. Such encryption must in-
clude appropriate management and safeguards of 
such keys to protect the integrity of the encryption. 
(5) IDENTITY THEFT.—The term ‘‘identity theft’’ 
means the unauthorized use of another person’s per-
sonal information for the purpose of engaging in com-
mercial transactions under the name of such other 
person. 
(6) INFORMATION BROKER.—The term ‘‘informa-
tion broker’’— 
(A) means a commercial entity whose busi-
ness is to collect, assemble, or maintain personal 
information concerning individuals who are not 
current or former customers of such entity in 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
order to sell such information or provide access 
to such information to any nonaffiliated third 
party in exchange for consideration, whether 
such collection, assembly, or maintenance of per-
sonal information is performed by the informa-
tion broker directly, or by contract or sub-
contract with any other entity; and 
(B) does not include a commercial entity to 
the extent that such entity processes information 
collected by and received from a nonaffiliated 
third party concerning individuals who are cur-
rent or former customers or employees of such 
third party to enable such third party to (1) 
provide benefits for its employees or (2) directly 
transact business with its customers. 
(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
initial and last name, or address, or phone num-
ber, in combination with any 1 or more of the 
following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number, passport 
number, military identification number, or 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
other similar number issued on a govern-
ment document used to verify identity. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
word that is necessary to permit access to 
an individual’s financial account. 
(B) 
MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A)— 
(i) for the purpose of section 2 to the 
extent that such modification will not un-
reasonably impede interstate commerce, and 
will accomplish the purposes of this Act; or 
(ii) for the purpose of section 3, to the 
extent that such modification is necessary to 
accommodate changes in technology or prac-
tices, will not unreasonably impede inter-
state commerce, and will accomplish the 
purposes of this Act. 
(8) PUBLIC
RECORD
INFORMATION.—The term 
‘‘public record information’’ means information about 
an individual which has been obtained originally 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
from records of a Federal, State, or local government 
entity that are available for public inspection. 
(9) NON-PUBLIC INFORMATION.—The term ‘‘non- 
public information’’ means information about an in-
dividual that is of a private nature and neither avail-
able to the general public nor obtained from a public 
record. 
(10) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means an entity that provides to a user 
transmission, routing, intermediate and transient 
storage, or connections to its system or network, for 
electronic communications, between or among points 
specified by such user of material of the user’s choos-
ing, without modification to the content of the mate-
rial as sent or received . Any such entity shall be 
treated as a service provider under this Act only to 
the extent that it is engaged in the provision of such 
transmission, routing, intermediate and transient 
storage or connections. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, reg-
ulation, or rule of a State or political subdivision of a 
State, with respect to those entities covered by the regula-
tions issued pursuant to this Act, that expressly— 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(1) requires information security practices and 
treatment of data containing personal information 
similar to any of those required under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized access to 
or acquisition of data in electronic form containing 
personal information. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than a person 
specified in section 4(c) may bring a civil action 
under the laws of any State if such action is premised 
in whole or in part upon the defendant violating any 
provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to limit 
the enforcement of any State consumer protection law 
by an Attorney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This Act 
shall not be construed to preempt the applicability of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those laws 
relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing in 
this Act may be construed in any way to limit or affect 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
the Commission’s authority under any other provision of 
law. 
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of enact-
ment of this Act. 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Commis-
sion $1,000,000 for each of fiscal years 2010 through 2015 
to carry out this Act. 
Amend the title so as to read: ‘‘A bill to protect con-
sumers by requiring reasonable security policies and pro-
cedures to protect data containing personal information, 
and to provide for nationwide notice in the event of a se-
curity breach.’’. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
Union Calendar No. 214 
111TH CONGRESS 
1ST SESSION 
H. R. 2221 
[Report No. 111–362] 
A BILL 
To protect consumers by requiring reasonable secu-
rity policies and procedures to protect computer-
ized data containing personal information, and to 
provide for nationwide notice in the event of a se-
curity breach. 
DECEMBER 8, 2009 
Reported with amendments, committed to the Committee 
of the Whole House on the State of the Union, and or-
dered to be printed 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00040
Fmt 6651
Sfmt 6651
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS