(ii) a telephone number by 
which an individual can, at no 
cost to such individual, learn 
whether 
that 
individual’s 
per-
sonal information is included in 
the breach of security. 
(3) FEDERAL TRADE COMMISSION REGU-
LATIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 
1year after the date of enactment of 
this Act, the Commission shall, by 
regulations under section 553 of title 
5, United States Code, establish cri-
teria 
for 
determining 
the 
cir-
cumstances under which substitute 
notification may be provided under 
paragraph (2), including criteria for 
determining 
if 
notification 
under 
paragraph (1) is not feasible due to 
excessive cost to the person required 
to provide such notification relative 
to the resources of such person. 
(B) GUIDANCE.—In addition, the 
Commission shall provide and pub-
lish general guidance with respect to 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
compliance with this section. Such 
guidance shall include— 
(i) a description of written or 
email notification that complies 
with the requirements of para-
graph (1); and 
(ii) guidance on the content of 
substitute 
notification 
under 
paragraph (2)(B), including the 
extent of notification to print and 
broadcast media that complies 
with the requirements of such 
paragraph. 
(e) 
OTHER
OBLIGATIONS
FOLLOWING 
BREACH.—A person required to provide notifi-
cation under subsection (a) shall, upon re-
quest of an individual whose personal infor-
mation was included in the breach of security, 
provide or arrange for the provision of, to 
each such individual and at no cost to such 
individual, consumer credit reports from at 
least one of the major credit reporting agen-
cies beginning not later than 2 months fol-
lowing the discovery of a breach of security 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
and continuing on a quarterly basis for a pe-
riod of 2 years thereafter. 
(f) EXEMPTION.— 
(1) GENERAL
EXEMPTION.—A person 
shall be exempt from the requirements 
under this section if, following a breach 
of security, such person determines that 
there is no reasonable risk of identity 
theft, fraud, or other unlawful conduct. 
(2) PRESUMPTIONS.— 
(A) ENCRYPTION.—The encryption 
of data in electronic form shall estab-
lish a presumption that no reasonable 
risk of identity theft, fraud, or other 
unlawful conduct exists following a 
breach of security of such data. Any 
such presumption may be rebutted by 
facts 
demonstrating 
that 
the 
encryption has been or is reasonably 
likely to be compromised. 
(B) ADDITIONAL METHODOLOGIES OR 
TECHNOLOGIES.—Not later than 270 
days after the date of the enactment 
of this Act, the Commission shall, by 
rule pursuant to section 553 of title 5, 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
United States Code, identify any addi-
tional security methodology or tech-
nology, other than encryption, which 
renders 
data 
in 
electronic 
form 
unreadable or indecipherable, that 
shall, if applied to such data, estab-
lish a presumption that no reasonable 
risk of identity theft, fraud, or other 
unlawful conduct exists following a 
breach of security of such data. Any 
such presumption may be rebutted by 
facts demonstrating that any such 
methodology or technology has been 
or is reasonably likely to be com-
promised. In promulgating such a 
rule, the Commission shall consult 
with relevant industries, consumer 
organizations, and data security and 
identity theft prevention experts and 
established standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 
year after the date of the enactment of 
this Act, the Commission shall issue guid-
ance regarding the application of the ex-
emption in paragraph (1). 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS