I 
115TH CONGRESS 
2D SESSION 
H. R. 5388 
To require certain entities who collect and maintain personal information 
of individuals to secure such information and to provide notice to such 
individuals in the case of a breach of security involving such information, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 22, 2018 
Mr. RUSH introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To require certain entities who collect and maintain personal 
information of individuals to secure such information 
and to provide notice to such individuals in the case 
of a breach of security involving such information, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Accountability 
and Trust Act’’. 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES
AND PROCE-
DURES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require each covered 
entity to establish and implement policies and proce-
dures regarding information security practices for 
the treatment and protection of personal information 
taking into consideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by such 
covered entity; 
(B) the sensitivity of any personal informa-
tion at issue; 
(C) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(D) the cost of implementing such safe-
guards. 
(2) REQUIREMENTS.—Such regulations shall 
require the policies and procedures to include the 
following: 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(A) A written security policy with respect 
to the collection, use, sale, other dissemination, 
and maintenance of such personal information. 
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system or systems maintained by such covered 
entity that contains such data, which shall in-
clude regular monitoring for a breach of secu-
rity of such system or systems. 
(D) A process for taking preventive and 
corrective action to mitigate against any vulner-
abilities identified in the process required by 
subparagraph (C), which may include imple-
menting any changes to security practices and 
the architecture, installation, or implementation 
of network or operating software, and for regu-
larly testing or otherwise monitoring the effec-
tiveness of the safeguards’ key controls, sys-
tems, and procedures. 
(E) A process for disposing of data con-
taining personal information by shredding, per-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS