(3) IMMUNITY.—No cause of action for which 
jurisdiction is based under section 1346(b) of title 
28, United States Code, shall lie against any Federal 
law enforcement agency for acts relating to the ex-
tension of the deadline for notification for law en-
forcement or national security purposes under this 
section. 
(e) DESIGNATION OF BREACH NOTIFICATION ENTI-
TY.—Not later than 60 days after the date of the enact-
ment of this Act, the Secretary of Homeland Security shall 
designate a Federal Government entity to receive notices, 
reports, and information about information security inci-
dents, threats, and vulnerabilities under this Act. 
SEC. 3. EXEMPTIONS FROM NOTIFICATION TO INDIVID-
UALS. 
(a) EXEMPTION FOR NATIONAL SECURITY AND LAW 
ENFORCEMENT.— 
(1) IN GENERAL.—Notwithstanding section 2, 
if the Director of the United States Secret Service 
or the Director of the Federal Bureau of Investiga-
tion determines that notification of the security 
breach required by such section could be expected to 
reveal sensitive sources and methods or similarly im-
pede the ability of a Federal, State, or local law en-
forcement agency to conduct law enforcement inves-
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
tigations, or if the Director of the Federal Bureau 
of Investigation determines that notification of the 
security breach could be expected to cause damage 
to national security, such notification is not re-
quired. 
(2) IMMUNITY.—No cause of action for which 
jurisdiction is based under section 1346(b) of title 
28, United States Code, shall lie against any Federal 
law enforcement agency for acts relating to provision 
of an exemption from notification for law enforce-
ment or national security purposes under this sec-
tion. 
(b) SAFE HARBOR.— 
(1) IN GENERAL.—A business entity is exempt 
from the notification requirement under section 2, if 
the following requirements are met: 
(A) RISK
ASSESSMENT.—A risk assess-
ment, in accordance with paragraph (3), is con-
ducted by or on behalf of the business entity 
that concludes that there is no reasonable risk 
that a security breach has resulted in, or will 
result in, harm to the individuals whose sen-
sitive personally identifiable information was 
subject to the security breach. 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(B) NOTICE
TO
COMMISSION.—Without 
unreasonable delay and not later than 30 days 
after the discovery of a security breach, unless 
extended by the Commission, the Director of 
the United States Secret Service, or the Direc-
tor of the Federal Bureau of Investigation 
under section 2 (in which case, before the ex-
tended deadline), the business entity notifies 
the Commission, in writing, of— 
(i) the results of the risk assessment; 
and 
(ii) the decision by the business entity 
to invoke the risk assessment exemption 
described under subparagraph (A). 
(C) DETERMINATION
BY
COMMISSION.— 
During the period beginning on the date on 
which the notification described in subpara-
graph (B) is submitted and ending 10 days 
after such date, the Commission has not issued 
a determination in writing that a notification 
should be provided under section 2. 
(2) REBUTTABLE
PRESUMPTION.—For pur-
poses of paragraph (1)— 
(A) the rendering of sensitive personally 
identifiable information at issue unusable, 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
unreadable, or indecipherable through a secu-
rity technology generally accepted by experts in 
the field of information security shall establish 
a rebuttable presumption that such reasonable 
risk does not exist; and 
(B) any such presumption shall be rebutta-
ble by facts demonstrating that the security 
technologies or methodologies in a specific case 
have been, or are reasonably likely to have 
been, compromised. 
(3) RISK ASSESSMENT REQUIREMENTS.—A risk 
assessment is in accordance with this paragraph if 
the following requirements are met: 
(A) PROPERLY CONDUCTED.—The risk as-
sessment is conducted in a reasonable manner 
or according to standards generally accepted by 
experts in the field of information security. 
(B) LOGGING DATA REQUIRED.—The risk 
assessment includes logging data, as applicable 
and to the extent available, for a period of at 
least six months before the discovery of a secu-
rity breach described in section 2(a)— 
(i) for each communication or at-
tempted communication with a database or 
data system containing sensitive personally 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
identifiable information, the data system 
communication information for the com-
munication or attempted communication, 
including any Internet addresses, and the 
date and time associated with the commu-
nication or attempted communication; and 
(ii) all log-in information associated 
with databases or data systems containing 
sensitive personally identifiable informa-
tion, including both administrator and user 
log-in information. 
(C) FRAUDULENT OR MISLEADING INFOR-
MATION.—The risk assessment does not contain 
fraudulent or deliberately misleading informa-
tion. 
(c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
(1) IN GENERAL.—A business entity is exempt 
from the notification requirement under section 2 if 
the business entity uses or participates in a security 
program that— 
(A) effectively blocks the use of the sen-
sitive personally identifiable information to ini-
tiate unauthorized financial transactions before 
they are charged to the account of the indi-
vidual; and 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(B) provides notification to affected indi-
viduals after a security breach that has resulted 
in fraud or unauthorized transactions. 
(2) LIMITATION.—The exemption in paragraph 
(1) does not apply if the information subject to the 
security breach includes the individual’s first and 
last name or any other type of sensitive personally 
identifiable information other than a credit card 
number or credit card security code. 
SEC. 4. METHODS OF NOTIFICATION. 
A business entity shall be in compliance with the re-
quirements of this section if, with respect to the method 
of notification as required under section 2, the following 
requirements are met: 
(1) INDIVIDUAL NOTIFICATION.—Notification to 
an individual is by one of the following means: 
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the business entity. 
(B) Telephone notification to the individual 
personally. 
(C) E-mail notification, if the individual 
has consented to receive such notification and 
the notification is consistent with the provisions 
permitting electronic transmission of notifica-
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
tions under section 101 of the Electronic Signa-
tures in Global and National Commerce Act (15 
U.S.C. 7001). 
(2) MEDIA NOTIFICATION.—If the number of 
residents of a State whose sensitive personally iden-
tifiable information was, or is reasonably believed to 
have been, accessed or acquired by an unauthorized 
person exceeds 5,000, notification is provided to 
media reasonably calculated to reach such individ-
uals, such as major media outlets serving a State or 
jurisdiction. 
SEC. 5. CONTENT OF NOTIFICATION. 
The notification provided to individuals required by 
section 2 shall include, to the extent possible, the fol-
lowing: 
(1) A description of the categories of sensitive 
personally identifiable information that was, or is 
reasonably believed to have been, accessed or ac-
quired by an unauthorized person. 
(2) A toll-free number— 
(A) that the individual may use to contact 
the business entity, or the agent of the business 
entity; and 
(B) from which the individual may learn 
what types of sensitive personally identifiable 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
information the business entity maintained 
about that individual. 
(3) The toll-free contact telephone numbers and 
addresses for the major credit reporting agencies 
and the Commission. 
(4) The name of the business entity that has a 
direct business relationship with the individual. 
(5) Notwithstanding section 10, any informa-
tion regarding victim protection assistance required 
by the State in which the individual resides. 
SEC. 6. COORDINATION OF NOTIFICATION WITH CREDIT 
REPORTING AGENCIES. 
(a) REQUIREMENT TO NOTIFY CREDIT REPORTING 
AGENCIES.—If a business entity is required to notify more 
than 5,000 individuals under section 2, the business entity 
shall also notify each consumer reporting agency that com-
piles and maintains files on consumers on a nationwide 
basis (as defined in section 603(p) of the Fair Credit Re-
porting Act (15 U.S.C. 1681a(p))) of the timing and dis-
tribution of the notifications. Such notification shall be 
given to the consumer credit reporting agencies without 
unreasonable delay and, if it will not delay notification to 
the affected individuals, prior to the distribution of notifi-
cations to the affected individuals. 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(b) REASONABLE DELAY.—Reasonable delay under 
subsection (a) shall not exceed 30 days following the dis-
covery of a security breach, except as provided in sub-
section (c) or (d) of section 2 (in which case, before the 
extended deadline), or unless the business entity providing 
notification can demonstrate to the Commission that addi-
tional time is reasonably necessary to determine the scope 
of the security breach, prevent further disclosures, conduct 
the risk assessment, restore the reasonable integrity of the 
data system, and provide notice to the breach notification 
entity. If the Commission determines that additional time 
is necessary, the Commission may extend the time period 
for notification for additional periods of up to 30 days 
each. Any such extension shall be provided in writing. 
SEC. 7. NOTIFICATION FOR LAW ENFORCEMENT AND 
OTHER PURPOSES. 
(a) NOTIFICATION TO LAW ENFORCEMENT AND NA-
TIONAL SECURITY AUTHORITIES.—Any business entity 
shall notify the breach notification entity, and the breach 
notification entity shall promptly notify and provide that 
information to the United States Secret Service, the Fed-
eral Bureau of Investigation, and the Commission for civil 
law enforcement purposes, and shall make it available as 
appropriate to other Federal agencies for law enforcement, 
national security, or computer security purposes, if— 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
(1) the number of individuals whose sensitive 
personally identifiable information was, or is reason-
ably believed to have been, accessed or acquired by 
an unauthorized person exceeds 5,000; 
(2) the security breach involves a database, 
networked or integrated databases, or other data 
system containing the sensitive personally identifi-
able information of more than 500,000 individuals 
nationwide; 
(3) the security breach involves databases 
owned by the Federal Government; or 
(4) the security breach involves primarily sen-
sitive personally identifiable information of individ-
uals known to the business entity to be employees 
and contractors of the Federal Government involved 
in national security or law enforcement. 
(b) REGULATIONS.—Not later than one year after the 
date of enactment of this Act, the Commission shall pro-
mulgate regulations (in accordance with section 553 of 
title 5, United States Code), in consultation with the At-
torney General and the Secretary of Homeland Security, 
that describe what information is required to be included 
in the notification under subsection (a). In addition, the 
Commission shall, as necessary, promulgate regulations 
(in accordance with section 553 of title 5, United States 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
report on the number and nature of the security breaches 
described in the notices filed by business entities invoking 
the risk assessment exemption under section 3(b) and the 
response of the Commission to such notices. 
SEC. 12. EXCLUDED BUSINESS ENTITIES. 
Nothing in this Act, or the regulations promulgated 
under this Act, shall apply to— 
(1) business entities to the extent that such en-
tities act as covered entities or business associates 
(as such terms are defined in section 13400 of the 
Health Information Technology for Economic and 
Clinical Health Act (42 U.S.C. 17921)) subject to 
section 13402 of such Act (42 U.S.C. 17932); and 
(2) business entities to the extent that they act 
as vendors of personal health records (as such term 
is defined in section 13400 of such Act (42 U.S.C. 
17921)) and third-party service providers subject to 
section 13407 of such Act (42 U.S.C. 17937). 
SEC. 13. DEFINITIONS. 
In this Act: 
(1) BREACH NOTIFICATION ENTITY.—The term 
‘‘breach notification entity’’ means the Federal Gov-
ernment entity designated pursuant to section 2(e). 
(2) BUSINESS
ENTITY.—The term ‘‘business 
entity’’ means any organization, corporation, trust, 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS