I 
114TH CONGRESS 
1ST SESSION H. R. 2205 
To protect financial information relating to consumers, to require notice 
of security breaches, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 1, 2015 
Mr. NEUGEBAUER (for himself and Mr. CARNEY) introduced the following bill; 
which was referred to the Committee on Energy and Commerce, and in 
addition to the Committee on Financial Services, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To protect financial information relating to consumers, to 
require notice of security breaches, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Security Act of 
2015’’. 
SEC. 2. PURPOSES. 
The purposes of this Act are— 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(1) to establish strong and uniform national 
data security and breach notification standards for 
electronic data; and 
(2) to expressly preempt any related State laws 
in order to provide the Federal Trade Commission 
with authority to enforce such standards for entities 
covered under this Act. 
SEC. 3. DEFINITIONS. 
For purposes of this Act, the following definitions 
shall apply: 
(1) AFFILIATE.—The term ‘‘affiliate’’ means 
any company that controls, is controlled by, or is 
under common control with another company. 
(2) AGENCY.—The term ‘‘agency’’ has the same 
meaning as in section 551(1) of title 5, United 
States Code. 
(3) BREACH OF DATA SECURITY.— 
(A) IN GENERAL.—The term ‘‘breach of 
data security’’ means the unauthorized acquisi-
tion of sensitive financial account information 
or sensitive personal information. 
(B) EXCEPTION FOR DATA THAT IS NOT IN 
USABLE FORM.—The term ‘‘breach of data se-
curity’’ does not include the unauthorized ac-
quisition of sensitive financial account informa-
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
tion or sensitive personal information that is 
encrypted, redacted, or otherwise protected by 
another method that renders the information 
unreadable and unusable if the encryption, re-
daction, or protection process or key is not also 
acquired without authorization. 
(4) CARRIER.—The term ‘‘carrier’’ means any 
entity that— 
(A) provides electronic data transmission, 
routing, intermediate, and transient storage, or 
connections to its system or network; 
(B) does not select or modify the content 
of the electronic data; 
(C) is not the sender or the intended re-
cipient of the data; and 
(D) does not differentiate sensitive finan-
cial account information or sensitive personal 
information from other information that the en-
tity transmits, routes, stores in intermediate or 
transient storage, or for which such entity pro-
vides connections. 
(5) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(6) CONSUMER.—The term ‘‘consumer’’ means 
an individual. 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(7) CONSUMER REPORTING AGENCY THAT COM-
PILES AND MAINTAINS FILES ON CONSUMERS ON A 
NATIONWIDE BASIS.—The term ‘‘consumer reporting 
agency that compiles and maintains files on con-
sumers on a nationwide basis’’ has the same mean-
ing as in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
(8) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means any individual, partnership, cor-
poration, trust, estate, cooperative, association, 
or entity that accesses, maintains, commu-
nicates, or handles sensitive financial account 
information or sensitive personal information. 
(B) EXCEPTION.—The term ‘‘covered enti-
ty’’ does not include any agency or any other 
unit of Federal, State, or local government or 
any subdivision of the unit. 
(9) FINANCIAL
INSTITUTION.—The term ‘‘fi-
nancial institution’’ has the same meaning as in sec-
tion 509(3) of the Gramm-Leach-Bliley Act (15 
U.S.C. 6809(3)). 
(10) INFORMATION SECURITY PROGRAM.—The 
term ‘‘information security program’’ means the ad-
ministrative, technical, or physical safeguards that a 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
covered entity uses to access, collect, distribute, 
process, protect, store, use, transmit, dispose of, or 
otherwise handle sensitive financial account informa-
tion and sensitive personal information. 
(11) SENSITIVE FINANCIAL ACCOUNT INFORMA-
TION.—The term ‘‘sensitive financial account infor-
mation’’ means a financial account number relating 
to a consumer, including a credit card number or 
debit card number, in combination with any security 
code, access code, password, or other personal identi-
fication information required to access the financial 
account. 
(12) SENSITIVE PERSONAL INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘sensitive 
personal information’’ includes— 
(i) a Social Security number; and 
(ii) the first and last name of a con-
sumer in combination with— 
(I) the consumer’s driver’s li-
cense number, passport number, mili-
tary identification number, or other 
similar number issued on a govern-
ment document used to verify identity; 
(II) information that could be 
used to access a consumer’s account, 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
such as a user name and password or 
e-mail and password; or 
(III) biometric data of the con-
sumer used to gain access to financial 
accounts of the consumer. 
(B) EXCEPTION.—The term ‘‘sensitive per-
sonal information’’ does not include publicly 
available information that is lawfully made 
available to the general public and obtained 
from— 
(i) Federal, State, or local government 
records; or 
(ii) widely distributed media. 
(13) 
SUBSTANTIAL
HARM
OR
INCONVEN-
IENCE.—The term ‘‘substantial harm or inconven-
ience’’ means— 
(A) identity theft; or 
(B) fraudulent transactions on financial 
accounts. 
(14) THIRD-PARTY
SERVICE
PROVIDER.—The 
term ‘‘third-party service provider’’ means any per-
son that maintains, processes, or otherwise is per-
mitted access to sensitive financial account informa-
tion or sensitive personal information in connection 
with providing services to a covered entity. 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
SEC. 4. PROTECTION OF INFORMATION AND SECURITY 
BREACH NOTIFICATION. 
(a) SECURITY PROCEDURES REQUIRED.— 
(1) IN GENERAL.—Each covered entity shall de-
velop, implement, and maintain a comprehensive in-
formation security program that contains adminis-
trative, technical, and physical safeguards that are 
reasonably designed to achieve the objectives in 
paragraph (2). 
(2) OBJECTIVES.—The objectives of this sub-
section are to— 
(A) ensure the security and confidentiality 
of sensitive financial account information and 
sensitive personal information; 
(B) protect against any anticipated threats 
or hazards to the security or integrity of such 
information; and 
(C) protect against unauthorized acquisi-
tion of such information that could result in 
substantial harm to the individuals to whom 
such information relates. 
(3) LIMITATION.—A covered entity’s informa-
tion security program under paragraph (1) shall be 
appropriate to— 
(A) the size and complexity of the covered 
entity; 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(B) the nature and scope of the activities 
of the covered entity; and 
(C) the sensitivity of the consumer infor-
mation to be protected. 
(4) ELEMENTS.—In order to develop, imple-
ment, maintain, and enforce its information security 
program, a covered entity shall— 
(A) designate an employee or employees to 
coordinate the information security program; 
(B) identify reasonably foreseeable internal 
and external risks to the security, confiden-
tiality, and integrity of sensitive financial ac-
count information and sensitive personal infor-
mation and assess the sufficiency of any safe-
guards in place to control these risks, including 
consideration of risks in each relevant area of 
the covered entity’s operations, including— 
(i) employee training and manage-
ment; 
(ii) information systems, including 
network and software design, as well as in-
formation 
processing, 
storage, 
trans-
mission, and disposal; and 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(iii) detecting, preventing, and re-
sponding to attacks, intrusions, or other 
systems failures; 
(C) design and implement information 
safeguards to control the risks identified in its 
risk assessment, and regularly assess the effec-
tiveness of the safeguards’ key controls, sys-
tems, and procedures; 
(D) oversee third-party service providers 
by— 
(i) taking reasonable steps to select 
and retain third-party service providers 
that are capable of maintaining appro-
priate safeguards for the sensitive financial 
account information or sensitive personal 
information at issue; 
(ii) requiring third-party service pro-
viders by contract to implement and main-
tain such safeguards; and 
(iii) reasonably oversee or obtain an 
assessment of the third-party service pro-
vider’s compliance with contractual obliga-
tions, where appropriate in light of the 
covered entity’s risk assessment; and 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(E) evaluate and adjust the information 
security program in light of the results of the 
risk assessments and testing and monitoring re-
quired by subparagraphs (C) and (D) and any 
material changes to the covered entity’s oper-
ations or business arrangements, or any other 
circumstances that the covered entity knows or 
has reason to know may have a material impact 
on its information security program. 
(5) SECURITY CONTROLS.—Each covered entity 
shall— 
(A) consider whether the following security 
measures are appropriate for the covered entity 
and, if so, adopt those measures that the cov-
ered entity concludes are appropriate— 
(i) access controls on information sys-
tems, including controls to authenticate 
and permit access only to authorized indi-
viduals and controls to prevent employees 
from providing sensitive financial account 
information or sensitive personal informa-
tion to unauthorized individuals who may 
seek to obtain this information through 
fraudulent means; 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(ii) access restrictions at physical lo-
cations containing sensitive financial ac-
count information or sensitive personal in-
formation, such as buildings, computer fa-
cilities, and records storage facilities, to 
permit access only to authorized individ-
uals; 
(iii) encryption of electronic sensitive 
financial account information or sensitive 
personal information, including while in 
transit or in storage on networks or sys-
tems to which unauthorized individuals 
may have access; 
(iv) procedures designed to ensure 
that information system modifications are 
consistent with the covered entity’s infor-
mation security program; 
(v) dual control procedures, segrega-
tion of duties, and employee background 
checks for employees with responsibilities 
for, or access to, sensitive financial account 
information or sensitive personal informa-
tion; 
(vi) monitoring systems and proce-
dures to detect actual and attempted at-
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
tacks on, or intrusions into, information 
systems; 
(vii) response programs that specify 
actions to be taken when the covered entity 
suspects or detects that unauthorized indi-
viduals have gained access to information 
systems; and 
(viii) measures to protect against de-
struction, loss, or damage of sensitive fi-
nancial account information or sensitive 
personal information due to potential envi-
ronmental hazards, such as fire and water 
damage or technological failures; 
(B) develop, implement, and maintain ap-
propriate measures to properly dispose of sen-
sitive financial account information and sen-
sitive personal information; and 
(C) train staff to implement the covered 
entity’s information security program. 
(6) ADMINISTRATIVE REQUIREMENTS.— 
(A) BOARD OVERSIGHT.—If a covered enti-
ty has a board of directors, the covered entity’s 
board of directors or an appropriate committee 
of the board shall— 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(i) approve the covered entity’s writ-
ten information security program; and 
(ii) oversee the development, imple-
mentation, and maintenance of the covered 
entity’s information security program, in-
cluding assigning specific responsibility for 
its implementation and reviewing reports 
from management. 
(B) REPORT TO THE BOARD.—If a covered 
entity has a board of directors, the covered enti-
ty shall report to its board or an appropriate 
committee of the board at least annually, in-
cluding describing— 
(i) the overall status of the informa-
tion security program and the covered enti-
ty’s compliance with this Act; and 
(ii) material matters related to its 
program, addressing issues such as risk as-
sessment, risk management and control de-
cisions, service provider arrangements, re-
sults of testing, security breaches or viola-
tions and management’s responses, and 
recommendations for changes in the infor-
mation security program. 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(b) INVESTIGATION REQUIRED.—If a covered entity 
believes that a breach of data security has or may have 
occurred in relation to sensitive financial account informa-
tion or sensitive personal information that is maintained, 
communicated, or otherwise handled by, or on behalf of, 
the covered entity, the covered entity shall conduct an in-
vestigation to— 
(1) assess the nature and scope of the incident; 
(2) identify any sensitive financial account in-
formation or sensitive personal information that may 
have been involved in the incident; 
(3) determine if the sensitive financial account 
information or sensitive personal information has 
been acquired without authorization; and 
(4) take reasonable measures to restore the se-
curity and confidentiality of the systems com-
promised in the breach. 
(c) NOTICE REQUIRED.— 
(1) IN GENERAL.—If a covered entity deter-
mines under subsection (b) that the unauthorized 
acquisition of sensitive financial account information 
or sensitive personal information involved in a 
breach of data security is reasonably likely to cause 
substantial harm to the consumers to whom the in-
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
formation relates, the covered entity, or a third 
party acting on behalf of the covered entity, shall— 
(A) notify, without unreasonable delay— 
(i) an appropriate Federal law en-
forcement agency; 
(ii) the appropriate agency or author-
ity identified in section 5; 
(iii) any relevant payment card net-
work, if the breach involves a breach of 
payment card numbers; 
(iv) each consumer reporting agency 
that compiles and maintains files on con-
sumers on a nationwide basis, if the breach 
involves sensitive personal information or 
sensitive financial account information re-
lating to 5,000 or more consumers; and 
(v) all consumers to whom the sen-
sitive financial account information or sen-
sitive personal information relates; 
(B) provide notice to consumers by— 
(i) written notification sent to the 
postal address of the consumer in the 
records of the covered entity; 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(ii) telephonic notification to the num-
ber of the consumer in the records of the 
covered entity; 
(iii) e-mail notification to the con-
sumer (or via other electronic means) in 
the records of the covered entity; or 
(iv) substitute notification in print 
and to broadcast media where the indi-
vidual whose personal information was ac-
quired resides, if providing written or e- 
mail notification is not feasible due to— 
(I) lack of sufficient contact in-
formation for the consumers that 
must be notified; 
(II) excessive cost to the covered 
entity; or 
(III) exigent circumstances; and 
(C) provide notice that includes— 
(i) a description of the type of sen-
sitive financial account information or sen-
sitive personal information involved in the 
breach of data security; 
(ii) a general description of the ac-
tions taken by the covered entity to restore 
the security and confidentiality of the sen-
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
sitive financial account information or sen-
sitive personal information involved in the 
breach of data security; and 
(iii) a summary of rights of victims of 
identity theft prepared under section 
609(d) of the Fair Credit Reporting Act 
(15 U.S.C. 1681g(d)), if the breach of 
data security involves sensitive personal in-
formation. 
(2) DELAY PERMITTED WHEN REQUESTED BY 
LAW ENFORCEMENT.—A covered entity may delay 
any notification described under paragraph (1) if 
such delay is requested by a law enforcement agen-
cy. 
(d) CLARIFICATION.—A financial institution shall 
have no obligation under this Act for a breach of security 
at another covered entity involving sensitive financial ac-
count information relating to an account owned by the fi-
nancial institution. 
(e) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD-PARTY SERVICE PROVIDERS.—In the 
event of a breach of security of a system maintained 
by a third-party service provider that has been con-
tracted to maintain, store, or process data in elec-
tronic form containing sensitive financial account in-
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
formation or sensitive personal information on behalf 
of a covered entity who owns or possesses such data, 
such third-party service provider shall— 
(A) notify the covered entity; and 
(B) notify consumers if it is agreed in 
writing that the third-party service provider will 
provide such notification on behalf of the cov-
ered entity. 
(2) CARRIER OBLIGATIONS.— 
(A) IN
GENERAL.—If a carrier becomes 
aware of a breach of security involving data in 
electronic form containing sensitive financial ac-
count information or sensitive personal informa-
tion that is owned or licensed by a covered enti-
ty that connects to or uses a system or network 
provided by the carrier for the purpose of trans-
mitting, routing, or providing intermediate or 
transient storage of such data, such carrier 
shall notify the covered entity who initiated 
such connection, transmission, routing, or stor-
age of the data containing sensitive financial 
account information or sensitive personal infor-
mation, if such covered entity can be reasonably 
identified. If a service provider is acting solely 
as a third-party service provider for purposes of 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
investigate and provide notice to con-
sumers of data breaches of data secu-
rity that are consistent with the poli-
cies and procedures of a savings asso-
ciation that is an affiliate of the fi-
nancial institution; and 
(BB) the policies and procedures 
of the savings association are designed 
to comply with the investigation and 
notice requirements established by any 
regulations or guidelines under section 
501(b) of the Gramm-Leach-Bliley 
Act (15 U.S. 6801(b)) that are appli-
cable to savings associations; and 
(II) provides for notice to the en-
tities described under clauses (ii), (iii), 
and (iv) of subsection (c)(1)(A), if no-
tice is provided to consumers pursu-
ant to the policies and procedures of 
the financial institution described in 
subclause (I); and 
(B) subsections (a), (b), and (c)— 
(i) if the entity is a covered entity for 
purposes of the regulations promulgated 
under section 264(c) of the Health Insur-
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
ance Portability and Accountability Act of 
1996 (42 U.S.C. 1320d–2 note), to the ex-
tent that the entity is in compliance with 
such regulations; or 
(ii) if the entity is in compliance with 
sections 13402 and 13407 of the HITECH 
Act (42 U.S.C. 17932 and 17937). 
(2) DEFINITIONS.—In this subsection— 
(A) the terms ‘‘bank holding company’’ 
and ‘‘bank’’ have the meanings given the terms 
in section 2 of the Bank Holding Company Act 
of 1956 (12 U.S.C. 1841); 
(B) the term ‘‘savings and loan holding 
company’’ has the meaning given the term in 
section 10 of the Home Owners’ Loan Act (12 
U.S.C. 1467a); and 
(C) the term ‘‘savings association’’ has the 
meaning given the term in section 2 of the 
Home Owners’ Loan Act (12 U.S.C. 1462). 
SEC. 5. ADMINISTRATIVE ENFORCEMENT. 
(a) IN GENERAL.—Notwithstanding any other provi-
sion of law section 4 shall be enforced exclusively under— 
(1) section 8 of the Federal Deposit Insurance 
Act (12 U.S.C. 1818), in the case of— 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(A) a national bank, a Federal branch or 
Federal agency of a foreign bank, or any sub-
sidiary thereof (other than a broker, dealer, 
person providing insurance, investment com-
pany, or investment adviser), or a savings asso-
ciation, the deposits of which are insured by the 
Federal Deposit Insurance Corporation, or any 
subsidiary thereof (other than a broker, dealer, 
person providing insurance, investment com-
pany, or investment adviser), by the Office of 
the Comptroller of the Currency; 
(B) a member bank of the Federal Reserve 
System (other than a national bank), a branch 
or agency of a foreign bank (other than a Fed-
eral branch, Federal agency, or insured State 
branch of a foreign bank), a commercial lending 
company owned or controlled by a foreign bank, 
an organization operating under section 25 or 
25A of the Federal Reserve Act (12 U.S.C. 
601, 611), or a bank holding company and its 
nonbank subsidiary or affiliate (other than a 
broker, dealer, person providing insurance, in-
vestment company, or investment adviser), by 
the Board of Governors of the Federal Reserve 
System; and 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(C) a bank, the deposits of which are in-
sured by the Federal Deposit Insurance Cor-
poration (other than a member of the Federal 
Reserve System), an insured State branch of a 
foreign bank, or any subsidiary thereof (other 
than a broker, dealer, person providing insur-
ance, investment company, or investment ad-
viser), by the Board of Directors of the Federal 
Deposit Insurance Corporation; 
(2) the Federal Credit Union Act (12 U.S.C. 
1751 et seq.), by the National Credit Union Admin-
istration Board with respect to any federally insured 
credit union; 
(3) the Securities Exchange Act of 1934 (15 
U.S.C. 78a et seq.), by the Securities and Exchange 
Commission with respect to any broker or dealer; 
(4) the Investment Company Act of 1940 (15 
U.S.C. 80a–1 et seq.), by the Securities and Ex-
change Commission with respect to any investment 
company; 
(5) the Investment Advisers Act of 1940 (15 
U.S.C. 80b–1 et seq.), by the Securities and Ex-
change Commission with respect to any investment 
adviser registered with the Securities and Exchange 
Commission under that Act; 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(6) the Commodity Exchange Act (7 U.S.C. 1 
et seq.), by the Commodity Futures Trading Com-
mission with respect to any futures commission mer-
chant, commodity trading advisor, commodity pool 
operator, or introducing broker; 
(7) the provisions of title XIII of the Housing 
and Community Development Act of 1992 (12 
U.S.C. 4501 et seq.), by the Director of Federal 
Housing Enterprise Oversight (and any successor to 
the functional regulatory agency) with respect to the 
Federal National Mortgage Association, the Federal 
Home Loan Mortgage Corporation, and any other 
entity or enterprise (as defined in that title) subject 
to the jurisdiction of the functional regulatory agen-
cy under that title, including any affiliate of any the 
enterprise; 
(8) State insurance law, in the case of any per-
son engaged in providing insurance, by the applica-
ble State insurance authority of the State in which 
the person is domiciled; and 
(9) the Federal Trade Commission Act (15 
U.S.C. 41 et seq.), by the Commission for any other 
covered entity that is not subject to the jurisdiction 
of any agency or authority described under para-
graphs (1) through (8), including— 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(A) notwithstanding section 5(a)(2) of the 
Federal Trade Commission Act (15 U.S.C. 
45(a)(2)), common carriers subject to the Com-
munications Act of 1934 (47 U.S.C. 151 et 
seq.); 
(B) notwithstanding the Federal Aviation 
Act of 1958 (49 U.S.C. App. 1301 et seq.), in-
clude the authority to enforce compliance by air 
carriers and foreign air carriers; and 
(C) notwithstanding the Packers and 
Stockyards Act (7 U.S.C. 181 et seq.), include 
the authority to enforce compliance by persons, 
partnerships, and corporations subject to the 
provisions of that Act. 
(b) APPLICATION TO CABLE OPERATORS, SATELLITE 
OPERATORS, AND TELECOMMUNICATIONS CARRIERS.— 
(1) DATA
SECURITY
AND
BREACH
NOTIFICA-
TION.—Sections 201, 202, 222, 338, and 631 of the 
Communications Act of 1934 (47 U.S.C. 201, 202, 
222, 338, and 551), and any regulations promul-
gated in accordance with those sections, shall not 
apply with respect to the information security prac-
tices, including practices relating to the notification 
of unauthorized access to data in electronic form, of 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
any covered entity otherwise subject to those sec-
tions. 
(2) RULE OF CONSTRUCTION.—Nothing in this 
subsection limits authority of the Federal Commu-
nication Commission with respect to sections 201, 
202, 222, 338, and 631 of the Communications Act 
of 1934 (47 U.S.C. 201, 202, 222, 338, and 551). 
SEC. 6. RELATION TO STATE LAW. 
No requirement or prohibition may be imposed under 
the laws of any State with respect to the responsibilities 
of any person to— 
(1) protect the security of information relating 
to consumers that is maintained, communicated, or 
otherwise handled by, or on behalf of, the person; 
(2) safeguard information relating to consumers 
from— 
(A) unauthorized access; and 
(B) unauthorized acquisition; 
(3) investigate or provide notice of the unau-
thorized acquisition of, or access to, information re-
lating to consumers, or the potential misuse of the 
information, for fraudulent, illegal, or other pur-
poses; or 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS
(4) mitigate any potential or actual loss or 
harm resulting from the unauthorized acquisition of, 
or access to, information relating to consumers. 
SEC. 7. DELAYED EFFECTIVE DATE FOR CERTAIN PROVI-
SIONS. 
Sections 4 and 6 shall take effect 1 year after the 
date of enactment of this Act. 
Æ 
VerDate Sep 11 2014 
23:49 May 12, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6301
E:\BILLS\H2205.IH
H2205
smartinez on DSK4TPTVN1PROD with BILLS