‘‘ ‘www.ftc.gov.’ ’’. 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Ac-
countability and Trust Act (DATA)’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES AND PRO-
CEDURES.— 
(1) REGULATIONS.—Not later than 1 
year after the date of enactment of this 
Act, the Commission shall promulgate 
regulations under section 553 of title 5, 
United States Code, to require each per-
son engaged in interstate commerce that 
owns or possesses data in electronic form 
containing personal information, or con-
tracts to have any third party entity 
maintain such data for such person, to es-
tablish and implement policies and proce-
dures 
regarding 
information 
security 
practices for the treatment and protec-
tion of personal information taking into 
consideration— 
(A) the size of, and the nature, 
scope, and complexity of the activi-
ties engaged in by, such person; 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(B) the current state of the art in 
administrative, technical, and phys-
ical safeguards for protecting such in-
formation; and 
(C) the cost of implementing such 
safeguards. 
(2) REQUIREMENTS.—Such regulations 
shall require the policies and procedures 
to include the following: 
(A) A security policy with respect 
to the collection, use, sale, other dis-
semination, and maintenance of such 
personal information. 
(B) The identification of an officer 
or other individual as the point of 
contact with responsibility for the 
management of information security. 
(C) A process for identifying and 
assessing any reasonably foreseeable 
vulnerabilities in the system main-
tained by such person that contains 
such electronic data, which shall in-
clude regular monitoring for a breach 
of security of such system. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(D) A process for taking preven-
tive and corrective action to mitigate 
against any vulnerabilities identified 
in the process required by subpara-
graph (C), which may include imple-
menting any changes to security 
practices and the architecture, instal-
lation, or implementation of network 
or operating software. 
(E) A process for disposing of ob-
solete data in electronic form con-
taining 
personal 
information 
by 
shredding, permanently erasing, or 
otherwise modifying the personal in-
formation contained in such data to 
make such personal information per-
manently 
unreadable 
or 
undecipherable. 
(3) TREATMENT OF ENTITIES GOVERNED 
BY OTHER LAW.—In promulgating the regu-
lations under this subsection, the Com-
mission may determine to be in compli-
ance with this subsection any person who 
is required under any other Federal law 
to maintain standards and safeguards for 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
information security and protection of 
personal information that provide equal 
or greater protection than those required 
under this subsection. 
(b) DESTRUCTION
OF
OBSOLETE
PAPER 
RECORDS
CONTAINING
PERSONAL
INFORMA-
TION.— 
(1) STUDY.—Not later than 1 year after 
the date of enactment of this Act, the 
Commission shall conduct a study on the 
practicality of requiring a standard meth-
od or methods for the destruction of ob-
solete paper documents and other non- 
electronic data containing personal infor-
mation by persons engaged in interstate 
commerce who own or possess such 
paper 
documents 
and 
non-electronic 
data. The study shall consider the cost, 
benefit, feasibility, and effect of a re-
quirement of shredding or other perma-
nent destruction of such paper docu-
ments and non-electronic data. 
(2) 
REGULATIONS.—The 
Commission 
may promulgate regulations under sec-
tion 553 of title 5, United States Code, re-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
quiring a standard method or methods 
for the destruction of obsolete paper doc-
uments and other non-electronic data 
containing personal information by per-
sons engaged in interstate commerce who 
own or possess such paper documents 
and non-electronic data if the Commis-
sion finds that— 
(A) the improper disposal of obso-
lete paper documents and other non- 
electronic data creates a reasonable 
risk of identity theft, fraud, or other 
unlawful conduct; 
(B) such a requirement would be 
effective in preventing identity theft, 
fraud, or other unlawful conduct; 
(C) the benefit in preventing iden-
tity theft, fraud, or other unlawful 
conduct would outweigh the cost to 
persons subject to such a require-
ment; and 
(D) compliance with such a re-
quirement would be practicable. 
In enforcing any such regulations, the 
Commission may determine to be in com-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
pliance with such regulations any person 
who is required under any other Federal 
law to dispose of obsolete paper docu-
ments and other non-electronic data con-
taining personal information if such 
other Federal law provides equal or 
greater protection or personal informa-
tion than the regulations promulgated 
under this subsection. 
(c) SPECIAL REQUIREMENTS FOR INFORMA-
TION BROKERS.— 
(1) SUBMISSION
OF
POLICIES
TO
THE 
FTC.—The regulations promulgated under 
subsection (a) shall require information 
brokers to submit their security policies 
to the Commission in conjunction with a 
notification of a breach of security under 
section 3 or upon request of the Commis-
sion. 
(2) POST-BREACH
AUDIT.—For any in-
formation broker required to provide no-
tification under section 3, the Commis-
sion shall conduct an audit of the infor-
mation security practices of such infor-
mation broker, or require the informa-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
tion broker to conduct an independent 
audit of such practices (by an inde-
pendent auditor who has not audited 
such information broker’s security prac-
tices during the preceding 5 years). The 
Commission may conduct or require ad-
ditional audits for a period of 5 years fol-
lowing the breach of security or until the 
Commission determines that the security 
practices of the information broker are in 
compliance with the requirements of this 
section and are adequate to prevent fur-
ther breaches of security. 
(3) VERIFICATION
OF
AND
INDIVIDUAL 
ACCESS TO PERSONAL INFORMATION.— 
(A) VERIFICATION.—Each informa-
tion broker shall establish reasonable 
procedures to verify the accuracy of 
the personal information it collects, 
assembles, or maintains, and any 
other information it collects, assem-
bles, or maintains that specifically 
identifies an individual, other than 
information which merely identifies 
an individual’s name or address. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(B) CONSUMER ACCESS TO INFORMA-
TION.— 
(i) ACCESS.—Each information 
broker shall— 
(I) provide to each indi-
vidual whose personal infor-
mation it maintains, at the in-
dividual’s request at least 1 
time per year and at no cost 
to the individual, and after 
verifying the identity of such 
individual, a means for the in-
dividual to review any per-
sonal information regarding 
such 
individual 
maintained 
by 
the 
information 
broker 
and any other information 
maintained by the informa-
tion broker that specifically 
identifies 
such 
individual, 
other than information which 
merely identifies an individ-
ual’s name or address; and 
(II) place a conspicuous 
notice on its Internet website 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(if 
the 
information 
broker 
maintains such a website) in-
structing individuals how to 
request access to the informa-
tion required to be provided 
under subclause (I). 
(ii) DISPUTED
INFORMATION.— 
Whenever an individual whose in-
formation the information broker 
maintains makes a written re-
quest disputing the accuracy of 
any such information, the infor-
mation broker, after verifying the 
identity of the individual making 
such request and unless there are 
reasonable 
grounds 
to 
believe 
such request is frivolous or irrele-
vant, shall— 
(I) correct any inaccuracy; 
or 
(II)(aa) in the case of in-
formation 
that 
is 
public 
record 
information, 
inform 
the individual of the source of 
the information, and, if rea-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
sonably available, where a re-
quest for correction may be 
directed; or 
(bb) in the case of infor-
mation that is non-public in-
formation, note the informa-
tion that is disputed, includ-
ing the individual’s statement 
disputing such information, 
and take reasonable steps to 
independently verify such in-
formation under the proce-
dures outlined in subpara-
graph (A) if such information 
can be independently verified. 
(iii) LIMITATIONS.—An informa-
tion broker may limit the access 
to information required under 
subparagraph (B) in the following 
circumstances: 
(I) If access of the indi-
vidual to the information is 
limited by law or legally rec-
ognized privilege. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(II) If the information is 
used for a legitimate govern-
mental or fraud prevention 
purpose that would be com-
promised by such access. 
(iv) RULEMAKING.—The Com-
mission shall issue regulations, as 
necessary, under section 553 of 
title 5, United States Code, on the 
application of the limitations in 
clause (iii). 
(C) TREATMENT
OF
ENTITIES
GOV-
ERNED
BY
OTHER
LAW.—The Commis-
sion may promulgate rules (under 
section 553 of title 5, United States 
Code) to determine to be in compli-
ance with this paragraph any person 
who is a consumer reporting agency, 
as defined in section 603(f) of the Fair 
Credit Reporting Act, with respect to 
those products and services that are 
subject to and in compliance with the 
requirements of that Act. 
(4) REQUIREMENT
OF
AUDIT
LOG
OF 
ACCESSED
AND
TRANSMITTED
INFORMA-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
TION.—Not later than 1 year after the date 
of the enactment of this Act, the Commis-
sion shall promulgate regulations under 
section 553 of title 5, United States Code, 
to require information brokers to estab-
lish measures which facilitate the audit-
ing or retracing of any internal or exter-
nal access to, or transmissions of, any 
data in electronic form containing per-
sonal information collected, assembled, 
or 
maintained 
by 
such 
information 
broker. 
(5) PROHIBITION ON PRETEXTING BY IN-
FORMATION BROKERS.— 
(A) PROHIBITION ON OBTAINING PER-
SONAL
INFORMATION
BY
FALSE
PRE-
TENSES.—It shall be unlawful for an 
information broker to obtain or at-
tempt to obtain, or cause to be dis-
closed or attempt to cause to be dis-
closed to any person, personal infor-
mation or any other information re-
lating to any person by— 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(i) making a false, fictitious, 
or fraudulent statement or rep-
resentation to any person; or 
(ii) providing any document 
or other information to any per-
son that the information broker 
knows or should know to be 
forged, counterfeit, lost, stolen, or 
fraudulently obtained, or to con-
tain a false, fictitious, or fraudu-
lent statement or representation. 
(B) PROHIBITION
ON
SOLICITATION 
TO
OBTAIN
PERSONAL
INFORMATION 
UNDER
FALSE
PRETENSES.—It shall be 
unlawful for an information broker to 
request a person to obtain personal 
information or any other information 
relating to any other person, if the in-
formation broker knew or should 
have known that the person to whom 
such a request is made will obtain or 
attempt to obtain such information in 
the manner described in subsection 
(a). 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(d) EXEMPTION
FOR TELECOMMUNICATIONS 
CARRIER, CABLE OPERATOR, INFORMATION SERV-
ICE, 
OR
INTERACTIVE
COMPUTER
SERVICE.— 
Nothing in this section shall apply to any elec-
tronic communication by a third party stored 
by a telecommunications carrier, cable oper-
ator, or information service, as those terms 
are defined in section 3 of the Communica-
tions Act of 1934 (47 U.S.C. 153), or an inter-
active computer service, as such term is de-
fined in section 230(f)(2) of such Act (47 U.S.C. 
230(f)(2)). 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any per-
son engaged in interstate commerce that 
owns or possesses data in electronic form con-
taining personal information shall, following 
the discovery of a breach of security of the 
system maintained by such person that con-
tains such data— 
(1) notify each individual who is a cit-
izen or resident of the United States 
whose personal information was acquired 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
by an unauthorized person as a result of 
such a breach of security; and 
(2) notify the Commission. 
(b) SPECIAL
NOTIFICATION
REQUIREMENT 
FOR CERTAIN ENTITIES.— 
(1) THIRD PARTY AGENTS.—In the event 
of a breach of security by any third party 
entity that has been contracted to main-
tain or process data in electronic form 
containing personal information on be-
half of any other person who owns or 
possesses such data, such third party en-
tity shall be required only to notify such 
person of the breach of security. Upon re-
ceiving such notification from such third 
party, such person shall provide the noti-
fication required under subsection (a). 
(2) 
TELECOMMUNICATIONS
CARRIERS, 
CABLE OPERATORS, INFORMATION SERVICES, 
AND INTERACTIVE COMPUTER SERVICES.—If a 
telecommunications carrier, cable oper-
ator, or information service (as such 
terms are defined in section 3 of the Com-
munications Act of 1934 (47 U.S.C. 153)), 
or an interactive computer service (as 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
such term is defined in section 230(f)(2) 
of such Act (47 U.S.C. 230(f)(2))), becomes 
aware of a breach of security during the 
transmission of data in electronic form 
containing personal information that is 
owned or possessed by another person 
utilizing the means of transmission of 
such telecommunications carrier, cable 
operator, information service, or inter-
active 
computer 
service, 
such 
tele-
communications carrier, cable operator, 
information service, or interactive com-
puter service shall be required only to 
notify the person who initiated such 
transmission of such a breach of security 
if such person can be reasonably identi-
fied. Upon receiving such notification 
from a telecommunications carrier, cable 
operator, information service, or inter-
active computer service, such person 
shall provide the notification required 
under subsection (a). 
(3) BREACH OF HEALTH INFORMATION.— 
If the Commission receives a notification 
of a breach of security and determines 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
that information included in such breach 
is individually identifiable health infor-
mation (as such term is defined in section 
1171(6) of the Social Security Act (42 
U.S.C. 1320d(6)), the Commission shall 
send a copy of such notification to the 
Secretary of Health and Human Services. 
(c) TIMELINESS OF NOTIFICATION.—All noti-
fications required under subsection (a) shall 
be made as promptly as possible and without 
unreasonable delay following the discovery of 
a breach of security of the system and con-
sistent with any measures necessary to deter-
mine the scope of the breach, prevent further 
breach or unauthorized disclosures, and rea-
sonably restore the integrity of the data sys-
tem. 
(d) METHOD
AND CONTENT
OF NOTIFICA-
TION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD
OF
NOTIFICATION.—A 
person required to provide notifica-
tion to individuals under subsection 
(a)(1) shall be in compliance with 
such requirement if the person pro-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
vides conspicuous and clearly identi-
fied notification by one of the fol-
lowing methods (provided the se-
lected method can reasonably be ex-
pected to reach the intended indi-
vidual): 
(i) Written notification. 
(ii) Email notification, if— 
(I) the person’s primary 
method 
of 
communication 
with 
the 
individual 
is 
by 
email; or 
(II) 
the 
individual 
has 
consented to receive such no-
tification and the notification 
is provided in a manner that 
is consistent with the provi-
sions 
permitting 
electronic 
transmission of notices under 
section 101 of the Electronic 
Signatures in Global Com-
merce Act (15 U.S.C. 7001). 
(B) CONTENT
OF
NOTIFICATION.— 
Regardless of the method by which 
notification is provided to an indi-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
vidual under subparagraph (A), such 
notification shall include— 
(i) a description of the per-
sonal information that was ac-
quired by an unauthorized per-
son; 
(ii) a telephone number that 
the individual may use, at no cost 
to such individual, to contact the 
person 
to 
inquire 
about 
the 
breach of security or the informa-
tion the person maintained about 
that individual; 
(iii) notice that the individual 
is entitled to receive, at no cost to 
such individual, consumer credit 
reports on a quarterly basis for a 
period of 2 years, and instruc-
tions to the individual on request-
ing such reports from the person; 
(iv) the toll-free contact tele-
phone numbers and addresses for 
the major credit reporting agen-
cies; and 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(v) a toll-free telephone num-
ber and Internet website address 
for the Commission whereby the 
individual may obtain informa-
tion regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO 
SUBSTITUTE
NOTIFICATION.—A person 
required to provide notification to in-
dividuals under subsection (a)(1) may 
provide substitute notification in lieu 
of the direct notification required by 
paragraph (1) if— 
(i) the person owns or pos-
sesses data in electronic form 
containing personal information 
of fewer than 1,000 individuals; 
and 
(ii) such direct notification is 
not feasible due to— 
(I) excessive cost to the 
person required to provide 
such notification relative to 
the resources of such person, 
as determined in accordance 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
with the regulations issued by 
the Commission under para-
graph (3)(A); or 
(II) lack of sufficient con-
tact information for the indi-
vidual required to be notified. 
(B) FORM OF SUBSTITUTE NOTICE.— 
Such substitute notification shall in-
clude— 
(i) email notification to the 
extent that the person has email 
addresses of individuals to whom 
it is required to provide notifica-
tion under subsection (a)(1); 
(ii) a conspicuous notice on 
the Internet website of the person 
(if such person maintains such a 
website); and 
(iii) notification in print and 
to 
broadcast 
media, 
including 
major media in metropolitan and 
rural areas where the individuals 
whose personal information was 
acquired reside. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(C) CONTENT
OF
SUBSTITUTE
NO-
TICE.—Each form of substitute notice 
under this paragraph shall include— 
(i) 
notice 
that 
individuals 
whose personal information is in-
cluded in the breach of security 
are entitled to receive, at no cost 
to the individuals, consumer cred-
it reports on a quarterly basis for 
a period of 2 years, and instruc-
tions on requesting such reports 
from the person; and 
(ii) a telephone number by 
which an individual can, at no 
cost to such individual, learn 
whether 
that 
individual’s 
per-
sonal information is included in 
the breach of security. 
(3) FEDERAL TRADE COMMISSION REGU-
LATIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 
1year after the date of enactment of 
this Act, the Commission shall, by 
regulations under section 553 of title 
5, United States Code, establish cri-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
teria 
for 
determining 
the 
cir-
cumstances under which substitute 
notification may be provided under 
paragraph (2), including criteria for 
determining 
if 
notification 
under 
paragraph (1) is not feasible due to 
excessive cost to the person required 
to provide such notification relative 
to the resources of such person. 
(B) GUIDANCE.—In addition, the 
Commission shall provide and pub-
lish general guidance with respect to 
compliance with this section. Such 
guidance shall include— 
(i) a description of written or 
email notification that complies 
with the requirements of para-
graph (1); and 
(ii) guidance on the content of 
substitute 
notification 
under 
paragraph (2)(B), including the 
extent of notification to print and 
broadcast media that complies 
with the requirements of such 
paragraph. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
(e) 
OTHER
OBLIGATIONS
FOLLOWING 
BREACH.—A person required to provide notifi-
cation under subsection (a) shall, upon re-
quest of an individual whose personal infor-
mation was included in the breach of security, 
provide or arrange for the provision of, to 
each such individual and at no cost to such 
individual, consumer credit reports from at 
least one of the major credit reporting agen-
cies beginning not later than 2 months fol-
lowing the discovery of a breach of security 
and continuing on a quarterly basis for a pe-
riod of 2 years thereafter. 
(f) EXEMPTION.— 
(1) GENERAL
EXEMPTION.—A person 
shall be exempt from the requirements 
under this section if, following a breach 
of security, such person determines that 
there is no reasonable risk of identity 
theft, fraud, or other unlawful conduct. 
(2) PRESUMPTIONS.— 
(A) ENCRYPTION.—The encryption 
of data in electronic form shall estab-
lish a presumption that no reasonable 
risk of identity theft, fraud, or other 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
unlawful conduct exists following a 
breach of security of such data. Any 
such presumption may be rebutted by 
facts 
demonstrating 
that 
the 
encryption has been or is reasonably 
likely to be compromised. 
(B) ADDITIONAL METHODOLOGIES OR 
TECHNOLOGIES.—Not later than 270 
days after the date of the enactment 
of this Act, the Commission shall, by 
rule pursuant to section 553 of title 5, 
United States Code, identify any addi-
tional security methodology or tech-
nology, other than encryption, which 
renders 
data 
in 
electronic 
form 
unreadable or indecipherable, that 
shall, if applied to such data, estab-
lish a presumption that no reasonable 
risk of identity theft, fraud, or other 
unlawful conduct exists following a 
breach of security of such data. Any 
such presumption may be rebutted by 
facts demonstrating that any such 
methodology or technology has been 
or is reasonably likely to be com-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
promised. In promulgating such a 
rule, the Commission shall consult 
with relevant industries, consumer 
organizations, and data security and 
identity theft prevention experts and 
established standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 
year after the date of the enactment of 
this Act, the Commission shall issue guid-
ance regarding the application of the ex-
emption in paragraph (1). 
(g) WEBSITE NOTICE
OF FEDERAL TRADE 
COMMISSION.—If the Commission, upon receiv-
ing notification of any breach of security that 
is reported to the Commission under sub-
section (a)(2), finds that notification of such a 
breach of security via the Commission’s Inter-
net website would be in the public interest or 
for the protection of consumers, the Commis-
sion shall place such a notice in a clear and 
conspicuous location on its Internet website. 
(h) FTC STUDY ON NOTIFICATION IN LAN-
GUAGES
IN ADDITION
TO ENGLISH.—Not later 
than 1 year after the date of enactment of this 
Act, the Commission shall conduct a study on 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS