I 
109TH CONGRESS 
1ST SESSION H. R. 4127 
To protect consumers by requiring reasonable security policies and procedures 
to protect computerized data containing personal information, and to 
provide for nationwide notice in the event of a security breach. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 25, 2005 
Mr. STEARNS (for himself, Ms. PRYCE of Ohio, Mr. UPTON, Mr. RADANO-
VICH, Mr. BASS, Mrs. BONO, Mr. FERGUSON, and Mrs. BLACKBURN) in-
troduced the following bill; which was referred to the Committee on En-
ergy and Commerce 
A BILL 
To protect consumers by requiring reasonable security poli-
cies and procedures to protect computerized data con-
taining personal information, and to provide for nation-
wide notice in the event of a security breach. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Accountability 
and Trust Act (DATA)’’.
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES
AND PROCE-
DURES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations to require each person 
engaged in interstate commerce that owns or pos-
sesses data in electronic form containing personal in-
formation to establish and implement policies and 
procedures regarding information security practices 
for the treatment and protection of personal infor-
mation that are consistent with— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, such 
person; 
(B) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(C) the cost of implementing such safe-
guards. 
(2) REQUIREMENTS.—Such regulations shall 
require the policies and procedures to include the 
following: 
(A) A security policy with respect to the 
collection, use, sale, other dissemination, and 
maintenance of such personal information.
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system maintained by such person that contains 
such electronic data. 
(D) A process for taking preventive and 
corrective action to mitigate against any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include 
encryption of such data, implementing any 
changes to security practices and the architec-
ture, installation, or implementation of network 
or operating software. 
(b) SPECIAL REQUIREMENTS
FOR INFORMATION 
BROKERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.— 
The regulations promulgated under subsection (a) 
shall require information brokers to submit their se-
curity policies to the Commission on an annual 
basis. 
(2) POST-BREACH AUDIT.—Following a breach 
of security of an information broker, the Commis-
sion shall conduct an audit of the information secu-
rity practices of such information broker. The Com-
mission may conduct additional audits, on an annual 
basis, for a maximum of 5 years following the 
breach of security or until the Commission deter-
mines that the security practices of the information 
broker are in compliance with the requirements of 
this section and are adequate to prevent further 
breaches of security. 
(3) INDIVIDUAL ACCESS TO PERSONAL INFOR-
MATION.— 
(A) ACCESS TO INFORMATION.—Each in-
formation broker shall— 
(i) provide to each individual whose 
personal information it maintains, at the 
individual’s request at least one time per 
year and at no cost to the individual, a 
means for such individual to review any 
personal information of the individual 
maintained by the information broker and 
any other information about the individual 
maintained by the information broker; and 
(ii) place a conspicuous notice on its 
Internet website (if the information broker 
maintains such a website) instructing indi-
viduals how to request access to the infor-
mation required to be provided under 
clause (i). 
(B) DISPUTED
INFORMATION.—Whenever 
an individual whose information the information 
broker maintains files a written request dis-
puting the accuracy of any such information, 
unless there is reasonable grounds to believe 
such request is frivolous or irrelevant, the infor-
mation broker shall clearly note in the database 
maintained by such information broker, and in 
any subsequent transmission of such informa-
tion by such information broker, that such in-
formation is disputed by the individual to whom 
the information relates. Such note shall include 
either the individual’s statement disputing the 
accuracy of such information or a clear and 
concise summary thereof. 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any person en-
gaged in interstate commerce that owns or possesses data 
in electronic form containing personal information shall, 
following the discovery of a breach of security of the sys-
tem maintained by such person that contains such data—
(1) notify each individual of the United States 
whose personal information was acquired by an un-
authorized person as a result of such a breach of se-
curity; 
(2) notify the Commission; 
(3) place a conspicuous notice on the Internet 
website of the person (if such person maintains such 
a website), which shall include a telephone number 
that the individual may use, at no cost to such indi-
vidual, to contact the person to inquire about the se-
curity breach or the information the person main-
tained about that individual; and 
(4) in the case of a breach of financial account 
information of a merchant, notify the financial insti-
tution that issued the account. 
(b) TIMELINESS
OF NOTIFICATION.—All notifica-
tions required under subsection (a) shall be made as 
promptly as possible and without unreasonable delay fol-
lowing the discovery of a breach of security of the system 
and any measures necessary to determine the scope of the 
breach, prevent further breach or unauthorized disclo-
sures, and reasonably restore the integrity of the data sys-
tem. 
(c) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.—
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the 
selected method can reasonably be expected to 
reach the intended individual): 
(i) Written notification. 
(ii) Email notification, if the indi-
vidual has consented to receive such notifi-
cation and the notification is provided in a 
manner that is consistent with the provi-
sions permitting electronic transmission of 
notices under section 101 of the Electronic 
Signatures in Global Commerce Act (15 
U.S.C. 7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that was acquired by an unauthor-
ized person;