Regulations, acting in its capacity as a 
business associate; 
(iii) if a covered entity, as defined in 
section 160.103 of title 45, Code of Federal 
Regulations, is a hybrid entity, as defined 
in section 164.105 of title 45, Code of Fed-
eral Regulations, then the health care com-
ponent of such hybrid entity; 
(iv) a broker, dealer, investment ad-
viser, futures commission merchant, special 
purpose vehicle, finance company, or person 
engaged in providing insurance that is sub-
ject to title V of Public Law 106-102 (15 
U.S.C. 6801 et seq.); 
(v) a State-chartered credit union, as 
defined in section 101(6) of the Federal 
Credit Union Act (12 U.S.C. 1752(6)), that 
is not an insured credit union as defined in 
section 101(7) of such Act (12 U.S.C. 
1752(7)); or 
(vi) a credit union service organization 
as outlined in section 106(7)(I) of the Fed-
eral 
Credit 
Union 
Act 
(12 
U.S.C. 
1757(7)(I)). 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
(6) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored elec-
tronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(7) ENCRYPTED.—The term ‘‘encrypted’’, used 
with respect to data in electronic form, in storage or 
in transit— 
(A) means the data is protected using an 
encryption technology that has been generally ac-
cepted by experts in the field of information se-
curity at the time the breach of security occurred 
that renders such data indecipherable in the ab-
sence of associated cryptographic keys necessary 
to enable decryption of such data; and 
(B) includes appropriate management and 
safeguards of such cryptographic keys in order to 
protect the integrity of the encryption. 
(8) 
NON-BREACHED
COVERED
ENTITY.—The 
term ‘‘non-breached covered entity’’ means a covered 
entity that has not incurred the breach of security in-
volving data in electronic form containing personal 
information that it owns or licenses but whose data 
has been affected by the breach of security incurred by 
a breached covered entity it directly contracts to 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
maintain, store, or process data in electronic form 
containing personal information on behalf of the non- 
breached covered entity. 
(9) 
NON-PROFIT
ORGANIZATION.—The 
term 
‘‘non-profit organization’’ means an organization 
that is described in section 501(c)(3) of the Internal 
Revenue Code of 1986 and exempt from tax under sec-
tion 501(a) of such Code. 
(10) PERSONAL INFORMATION.— 
(A) IN GENERAL.—The term ‘‘personal in-
formation’’ means any information or compila-
tion of information in electronic form that in-
cludes the following: 
(i) An individual’s first and last name 
or first initial and last name in combina-
tion with all of the following: 
(I) Home address or telephone 
number. 
(II) Mother’s maiden name, if 
identified as such. 
(III) Month, day, and year of 
birth. 
(ii) A financial account number or 
credit or debit card number or other identi-
fier, in combination with any security code, 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
access code, or password that is required for 
an individual to obtain credit, withdraw 
funds, or engage in a financial transaction. 
(iii) A unique account identifier (other 
than for an account described in clause 
(ii)), electronic identification number, bio-
metric data unique to an individual, user 
name, or routing code in combination with 
any associated security code, access code, bi-
ometric data unique to an individual, or 
password that is required for an individual 
to obtain money, or purchase goods, serv-
ices, or any other thing of value. 
(iv) A non-truncated social security 
number. 
(v) Any information that pertains to 
the transmission of specific calls, including, 
for outbound calls, the number called, and 
the time, location, or duration of any call 
and, for inbound calls, the number from 
which the call was placed, and the time, lo-
cation, or duration of any call. 
(vi) A user name or email address, in 
combination with a password or security 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
question and answer that would permit ac-
cess to an online account. 
(vii) A driver’s license number, pass-
port number, or alien registration number 
or other government-issued unique identi-
fication number. 
(B) EXCEPTIONS.—The term ‘‘personal in-
formation’’ does not include— 
(i) information that is encrypted or 
rendered unusable, unreadable, or indeci-
pherable through data security technology or 
methodology that is generally accepted by 
experts in the field of information security 
at the time the breach of security occurred, 
such as redaction or access controls; or 
(ii) information available in a pub-
licly available source, including informa-
tion obtained from a news report, peri-
odical, or other widely distributed media, or 
from Federal, State, or local government 
records. 
(11) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means a covered entity subject to the Com-
munications Act of 1934 (47 U.S.C. 151 et seq.) that 
provides electronic data transmission, routing, inter-
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
mediate and transient storage, or connection to its 
system or network, where such entity providing such 
service does not select or modify the content of the 
electronic data, is not the sender or the intended re-
cipient of the data, and does not differentiate personal 
information from other information that such entity 
transmits, routes, stores, or for which such entity pro-
vides connections. Any such entity shall be treated as 
a service provider under this Act only to the extent 
that it is engaged in the provision of such trans-
mission, routing, intermediate and transient storage, 
or connections. 
(12) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ has the meaning given such 
term under section 3 of the Small Business Act (15 
U.S.C. 632). 
(13) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, the Com-
monwealth of Puerto Rico, Guam, American Samoa, 
the Virgin Islands of the United States, the Common-
wealth of the Northern Mariana Islands, any other 
territory or possession of the United States, and each 
federally recognized Indian tribe. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—No State or political subdivision of a State shall, 
with respect to a covered entity subject to this Act, adopt, 
maintain, enforce, or impose or continue in effect any law, 
rule, regulation, duty, requirement, standard, or other pro-
vision having the force and effect of law relating to or with 
respect to the security of data in electronic form or notifica-
tion following a security breach of such data. 
(b) COMMON LAW.—This section shall not exempt a 
covered entity from liability under common law. 
(c) CERTAIN FTC ENFORCEMENT LIMITED TO DATA 
SECURITY AND BREACH NOTIFICATION.— 
(1) DATA
SECURITY
AND
BREACH
NOTIFICA-
TION.—Insofar as sections 201, 202, 222, 338, and 
631 of the Communications Act of 1934 (47 U.S.C. 
201, 202, 222, 338, and 551), and any regulations 
promulgated thereunder, apply to covered entities 
with respect to securing information in electronic 
form from unauthorized access and acquisition, in-
cluding notification of unauthorized access and acqui-
sition to data in electronic form containing personal 
information, such sections and regulations promul-
gated thereunder shall have no force or effect, unless 
such regulations pertain solely to 9–1–1 calls. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
(2) RULE OF CONSTRUCTION.—Nothing in this 
subsection otherwise limits the Federal Communica-
tions Commission’s authority with respect to sections 
201, 202, 222, 338, and 631 of the Communications 
Act of 1934 (47 U.S.C. 201, 202, 222, 338, and 551). 
(d) PRESERVATION
OF COMMISSION AUTHORITY.— 
Nothing in this Act may be construed in any way to limit 
or affect the Commission’s authority under any other provi-
sion of law. 
SEC. 7. EDUCATION AND OUTREACH FOR SMALL BUSI-
NESSES. 
The Commission shall conduct education and outreach 
for small business concerns on data security practices and 
how to prevent hacking and other unauthorized access to, 
acquisition of, or use of data maintained by such small 
business concerns. 
SEC. 8. WEBSITE ON DATA SECURITY BEST PRACTICES. 
The Commission shall establish and maintain an 
Internet website containing non-binding best practices for 
businesses regarding data security and how to prevent hack-
ing and other unauthorized access to, acquisition of, or use 
of data maintained by such businesses. 
SEC. 9. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of enact-
ment of this Act. 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS
Union Calendar No. 719 
114TH CONGRESS 
2D SESSION 
H. R. 1770 
[Report No. 114–908] 
A BILL 
To require certain entities who collect and maintain 
personal information of individuals to secure 
such information and to provide notice to such 
individuals in the case of a breach of security in-
volving such information, and for other purposes. 
JANUARY 3, 2017 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
21:52 Jan 03, 2017
Jkt 069200
PO 00000
Frm 00034
Fmt 6651
Sfmt 6651
E:\BILLS\H1770.RH
H1770
sradovich on DSK3GMQ082PROD with BILLS