broker may not use, share, or sell the individ-
ual’s information for marketing purposes. 
(E) LIMITATIONS.—An information broker 
may limit the access to information required 
under subparagraph (B)(i) and is not required 
to provide notice to individuals as required 
under subparagraph (B)(ii) in the following cir-
cumstances: 
(i) If access of the individual to the 
information is limited by law or legally rec-
ognized privilege. 
(ii) If the information is used for a le-
gitimate governmental or fraud prevention 
purpose that would be compromised by 
such access. 
(iii) If the information consists of a 
published media record, unless that record 
has been included in a report about an in-
dividual shared with a third party. 
(F) RULEMAKING.—Not later than 1 year 
after the date of enactment of this Act, the 
Commission shall promulgate regulations under 
section 553 of title 5, United States Code, to 
carry out this paragraph and to facilitate the 
purposes of this Act. In addition, the Commis-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
sion shall issue regulations, as necessary, under 
section 553 of title 5, United States Code, on 
the scope of the application of the limitations in 
subparagraph (E), including any additional cir-
cumstances in which an information broker may 
limit access to information under such clause 
that the Commission determines to be appro-
priate. 
(G) FCRA REGULATED
PERSONS.—Any 
information broker who is engaged in activities 
subject to the Fair Credit Reporting Act and 
who is in compliance with sections 609, 610, 
and 611 of such Act (15 U.S.C. 1681g; 1681h; 
1681i) with respect to information subject to 
such Act, shall be deemed to be in compliance 
with this paragraph with respect to such infor-
mation. 
(4) REQUIREMENT OF AUDIT LOG OF ACCESSED 
AND TRANSMITTED INFORMATION.—Not later than 
1 year after the date of enactment of this Act, the 
Commission shall promulgate regulations under sec-
tion 553 of title 5, United States Code, to require 
information brokers to establish measures which fa-
cilitate the auditing or retracing of any internal or 
external access to, or transmissions of, any data con-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
taining personal information collected, assembled, or 
maintained by such information broker. 
(5) PROHIBITION ON PRETEXTING BY INFOR-
MATION BROKERS.— 
(A) PROHIBITION
ON
OBTAINING
PER-
SONAL INFORMATION BY FALSE PRETENSES.— 
It shall be unlawful for an information broker 
to obtain or attempt to obtain, or cause to be 
disclosed or attempt to cause to be disclosed to 
any person, personal information or any other 
information relating to any person by— 
(i) making a false, fictitious, or fraud-
ulent statement or representation to any 
person; or 
(ii) providing any document or other 
information to any person that the infor-
mation broker knows or should know to be 
forged, counterfeit, lost, stolen, or fraudu-
lently obtained, or to contain a false, ficti-
tious, or fraudulent statement or represen-
tation. 
(B) PROHIBITION
ON
SOLICITATION
TO 
OBTAIN PERSONAL INFORMATION UNDER FALSE 
PRETENSES.—It shall be unlawful for an infor-
mation broker to request a person to obtain 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
personal information or any other information 
relating to any other person, if the information 
broker knew or should have known that the per-
son to whom such a request is made will obtain 
or attempt to obtain such information in the 
manner described in subparagraph (A). 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) INDIVIDUAL NOTIFICATION.— 
(1) IN GENERAL.—Each covered entity shall, 
following the discovery of a breach of security, notify 
each individual who is a citizen or resident of the 
United States whose personal information was, or is 
reasonably believed to have been, acquired or 
accessed by an unauthorized person, or used for an 
unauthorized purpose. 
(2) TIMELINESS OF NOTIFICATION.— 
(A) IN
GENERAL.—Unless subject to a 
delay authorized under subparagraph (B), a no-
tification required under paragraph (1) shall be 
made as expeditiously as practicable and with-
out unreasonable delay, but not later than 30 
days following the discovery of a breach of secu-
rity. 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(B) DELAY OF NOTIFICATION AUTHORIZED 
FOR LAW ENFORCEMENT OR NATIONAL SECU-
RITY PURPOSES.— 
(i) LAW
ENFORCEMENT.—If a Fed-
eral or State law enforcement agency, in-
cluding an attorney general of a State, de-
termines that the notification required 
under this section would impede a civil or 
criminal investigation, such notification 
shall be delayed upon the written request 
of the law enforcement agency for 30 days 
or such lesser period of time which the law 
enforcement agency determines is reason-
ably necessary and requests in writing. 
Such law enforcement agency may, by a 
subsequent written request, revoke such 
delay or extend the period of time set forth 
in the original request made under this 
paragraph if further delay is necessary. 
(ii) NATIONAL SECURITY.—If a Fed-
eral national security agency or homeland 
security agency determines that the notifi-
cation required under this section would 
threaten national or homeland security, 
such notification may be delayed for a pe-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
riod of time which the national security 
agency or homeland security agency deter-
mines is reasonably necessary and requests 
in writing. A Federal national security 
agency or homeland security agency may 
revoke such delay or extend the period of 
time set forth in the original request made 
under this paragraph by a subsequent 
written request if further delay is nec-
essary. 
(b) COORDINATION OF NOTIFICATION WITH CREDIT 
REPORTING AGENCIES.—If a covered entity is required to 
provide notification to more than 5,000 individuals under 
subsection (a)(1), the covered entity shall also notify the 
major consumer reporting agencies that compile and 
maintain files on consumers on a nationwide basis, of the 
timing and distribution of the notifications. Such notifica-
tion shall be given to the credit reporting agencies without 
unreasonable delay and, if such notification will not delay 
notification to the affected individuals, prior to the dis-
tribution of notifications to the affected individuals. 
(c) METHOD AND CONTENT OF NOTIFICATION.— 
(1) GENERAL NOTIFICATION.—A covered entity 
required to provide notification to individuals under 
subsection (a)(1) shall be in compliance with such 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
requirement if the covered entity provides con-
spicuous and clearly identified notification by one of 
the following methods (provided the selected method 
can reasonably be expected to reach the intended in-
dividual): 
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the covered entity. 
(B) Notification by email or other elec-
tronic means, if— 
(i) the covered entity’s primary meth-
od of communication with the individual is 
by email or such other electronic means; or 
(ii) the individual has consented to re-
ceive such notification and the notification 
is provided in a manner that is consistent 
with the provisions permitting electronic 
transmission of notifications under section 
101 of the Electronic Signatures in Global 
Commerce Act (15 U.S.C. 7001). 
(2) WEBSITE NOTIFICATION.—The covered en-
tity shall also provide conspicuous notification on the 
Internet website of the covered entity (if such cov-
ered entity maintains such a website) for a period of 
not less than 90 days. 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(3) MEDIA NOTIFICATION.—If the number of 
residents of a State whose personal information was, 
or is reasonably believed to have been acquired or 
accessed by an unauthorized person, or used for an 
unauthorized purpose exceeds 5,000, the covered en-
tity shall also provide notification in print and to 
broadcast media, including major media in metro-
politan and rural areas where the individuals whose 
personal information was, or is reasonably believed 
to have been, acquired or accessed by an unauthor-
ized person, or used for an unauthorized purpose, 
reside. 
(4) CONTENT OF NOTIFICATION.— 
(A) IN
GENERAL.—Regardless of the 
method by which notification is provided to an 
individual under paragraphs (1), (2), and (3), 
such notification shall include— 
(i) a description of the personal infor-
mation that was, or is reasonably believed 
to have been, acquired or accessed by an 
unauthorized person, or used for an unau-
thorized purpose; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the covered entity, or 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
agent of the covered entity, to inquire 
about the breach of security or the infor-
mation the covered entity maintained 
about that individual; 
(iii) notification that the individual is 
entitled to receive, at no cost to such indi-
vidual, consumer credit reports on a quar-
terly basis for a period of 5 years, or credit 
monitoring or other service that enables 
consumers to detect the misuse of their 
personal information for a period of 5 
years, and instructions to the individual on 
requesting such reports or service from the 
covered entity; 
(iv) the toll-free contact telephone 
numbers and addresses for the major cred-
it reporting agencies; and 
(v) a toll-free telephone number and 
Internet website address for the Commis-
sion whereby the individual may obtain in-
formation regarding identity theft. 
(B) DIRECT
BUSINESS
RELATIONSHIP.— 
Regardless of whether the covered entity or a 
designated third party provides notification 
under this subsection, such notification shall 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
identify the covered entity that has a direct 
business relationship with the individual. 
(5) REGULATIONS FOR SUBSTITUTE NOTIFICA-
TION.—Not later than 1 year after the date of en-
actment of this Act, the Commission shall, by regu-
lation under section 553 of title 5, United States 
Code— 
(A) establish criteria for determining cir-
cumstances under which substitute notification 
may be provided in lieu of direct notification re-
quired by paragraph (1), including criteria for 
determining if notification under paragraph (1) 
is not feasible due to excessive costs to the cov-
ered entity required to provided such notifica-
tion relative to the resources of such covered 
entity; and 
(B) establish the form and content of sub-
stitute notification. 
(d) NOTIFICATION
FOR LAW ENFORCEMENT
AND 
OTHER PURPOSES.—A covered entity shall, as expedi-
tiously as practicable and without unreasonable delay, but 
not later than 14 days following the discovery of a breach 
of security, provide notification of the breach to— 
(1) the Commission; 
(2) the Federal Bureau of Investigation; 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(3) the Secret Service; 
(4) for common carriers, the Federal Commu-
nications Commission; 
(5) the Consumer Financial Protection Bureau; 
and 
(6) the attorney general of each State in which 
the personal information of a resident or residents 
of the State was, or is reasonably believed to have 
been, acquired or accessed by an unauthorized per-
son, or used for an unauthorized purpose. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—A covered entity required to 
provide notification under subsection (a) shall, upon 
request of an individual whose personal information 
was included in the breach of security, provide or ar-
range for the provision of, to each such individual 
and at no cost to such individual— 
(A) consumer credit reports from the 
major credit reporting agencies beginning not 
later than 60 days following the individual’s re-
quest and continuing on a quarterly basis for a 
period of 5 years thereafter; or 
(B) a credit monitoring or other service 
that enables consumers to detect the misuse of 
their personal information, beginning not later 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
than 60 days following the individual’s request 
and continuing for a period of 5 years. 
(2) RULEMAKING.—As part of the Commis-
sion’s rulemaking described in subsection (c)(5), the 
Commission shall determine the circumstances under 
which a covered entity required to provide notifica-
tion under subsection (a) shall provide or arrange 
for the provision of free consumer credit reports or 
credit monitoring or other service to affected individ-
uals. 
(f) WEBSITE NOTIFICATION OF FEDERAL TRADE 
COMMISSION.—If the Commission, upon receiving notifi-
cation of any breach of security that is reported to the 
Commission under subsection (d)(1), finds that notifica-
tion of such a breach of security via the Commission’s 
Internet website would be in the public interest or for the 
protection of consumers, the Commission shall place such 
a notification in a clear and conspicuous location on its 
Internet website. 
(g) WEBSITE NOTIFICATION OF STATE ATTORNEYS 
GENERAL.—If a State attorney general, upon receiving 
notification of any breach of security that is reported to 
the Commission under subsection (d)(5), finds that notifi-
cation of such a breach of security through the State at-
torney general’s Internet website would be in the public 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
interest or for the protection of consumers, the State at-
torney general shall place such a notification in a clear 
and conspicuous location on its Internet website. 
(h) FTC STUDY ON NOTIFICATION IN LANGUAGES 
IN ADDITION TO ENGLISH.—Not later than 1 year after 
the date of enactment of this Act, the Commission shall 
conduct a study on the practicality and cost effectiveness 
of requiring the notification required by subsection (c)(1) 
to be provided in a language in addition to English to indi-
viduals known to speak only such other language. 
(i) EDUCATION AND OUTREACH FOR SMALL BUSI-
NESSES.—The Commission shall conduct education and 
outreach for small business concerns on data security 
practices and how to prevent hacking and other unauthor-
ized access to, acquisition of, or use of data maintained 
by such small business concerns. 
(j) WEBSITE
ON DATA SECURITY BEST PRAC-
TICES.—The Commission shall establish and maintain an 
Internet website containing non-binding best practices for 
businesses regarding data security and how to prevent 
hacking and other unauthorized access to, acquisition of, 
or use of data maintained by such businesses. 
(k) GENERAL RULEMAKING AUTHORITY.— 
(1) IN GENERAL.—The Commission may pro-
mulgate regulations necessary under section 553 of 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
title 5, United States Code, to effectively enforce the 
requirements of this section. 
(2) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
(l) TREATMENT OF PERSONS GOVERNED BY OTHER 
LAW.—A covered entity who is in compliance with any 
other Federal law that requires such covered entity to pro-
vide notification to individuals following a breach of secu-
rity, shall be deemed to be in compliance with this section 
with respect to activities and information covered under 
such Federal law. 
SEC. 4. APPLICATION AND ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices and shall be subject to enforcement by the 
Commission under that Act with respect to any cov-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
ered entity. All of the functions and powers of the 
Commission under the Federal Trade Commission 
Act are available to the Commission to enforce com-
pliance by any person with the requirements imposed 
under this title, irrespective of whether that person 
is engaged in commerce or meets any other jurisdic-
tional tests under the Federal Trade Commission 
Act. 
(2) COORDINATION
WITH
FEDERAL
COMMU-
NICATIONS
COMMISSION.—Where enforcement re-
lates to entities subject to the authority of the Fed-
eral Communications Commission, enforcement ac-
tions by the Commission will be coordinated with the 
Federal Communications Commission. 
(3) COORDINATION WITH CONSUMER FINANCIAL 
PROTECTION BUREAU.—Where enforcement relates 
to financial information or information associated 
with the provision of financial products or services, 
enforcement actions by the Commission will be co-
ordinated with the Consumer Financial Protection 
Bureau. 
(b) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) IN GENERAL.—If the chief law enforcement 
officer of a State, or an official or agency designated 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
by a State, has reason to believe that any covered 
entity has violated or is violating section 2 or 3 of 
this Act, the attorney general, official, or agency of 
the State, in addition to any authority it may have 
to bring an action in State court under its consumer 
protection law, may bring a civil action in any ap-
propriate United States district court or in any 
other court of competent jurisdiction, including a 
State court, to— 
(A) enjoin further such violation by the de-
fendant; 
(B) enforce compliance with this such sec-
tion; 
(C) obtain civil penalties in the amount de-
termined under paragraph (2); and 
(D) obtain damages, restitution, or other 
compensation on behalf of residents of the 
State. 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.— 
(i) TREATMENT
OF
VIOLATIONS
OF 
SECTION
2.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
2, the amount determined under this para-
graph is the amount calculated by multi-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
plying the number of days that a covered 
entity is not in compliance with such sec-
tion by an amount to be determined by the 
Commission. Such amount determined by 
the Commission shall be adjusted as de-
scribed in the Federal Civil Penalties Infla-
tion Adjustment Act of 1990 (Public Law 
101-410; 28 U.S.C. 2461 note). 
(ii) TREATMENT
OF
VIOLATIONS
OF 
SECTION
3.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
3, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of violations of such 
section by an amount to be determined by 
the Commission. Each failure to send noti-
fication as required under section 3 to a 
citizen or resident of the United States 
shall be treated as a separate violation. 
(B) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
Index is first published by the Bureau of Labor 
Statistics that is after 1 year after the date of 
enactment of this Act, and each year thereafter, 
the amounts specified in clauses (i) and (ii) of 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS