complaint, except in any case in 
which such prior notice is not fea-
sible, in which case the State shall 
serve such notice immediately upon 
instituting such action. The Commis-
sion shall have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be 
heard 
on 
all 
matters 
arising 
therein; and 
(iii) to file petitions for ap-
peal. 
(B) LIMITATION
ON
STATE
ACTION 
WHILE FEDERAL ACTION IS PENDING.—If 
the Commission has instituted a civil 
action for violation of this Act, no 
State attorney general, or official or 
agency of a State, may bring an ac-
tion under this subsection during the 
pendency of that action against any 
defendant named in the complaint of 
the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of 
bringing any civil action under para-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
graph (1), nothing in this Act shall be 
construed to prevent an attorney general 
of a State from exercising the powers 
conferred on the attorney general by the 
laws of that State to— 
(A) conduct investigations; 
(B) administer oaths or affirma-
tions; or 
(C) compel the attendance of wit-
nesses or the production of documen-
tary and other evidence. 
(c) AFFIRMATIVE DEFENSE FOR A VIOLATION 
OF SECTION 3.—It shall be an affirmative de-
fense to an enforcement action brought under 
subsection (a), or a civil action brought under 
subsection (b), based on a violation of section 
3, that all of the personal information con-
tained in the data in electronic form that was 
acquired as a result of a breach of security of 
the defendant is public record information 
that is lawfully made available to the general 
public from Federal, State, or local govern-
ment records and was acquired by the defend-
ant from such records. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
(1) BREACH
OF
SECURITY.—The term 
‘‘breach of security’’ means the unauthor-
ized acquisition of data in electronic 
form containing personal information. 
(2) COMMISSION.—The term ‘‘Commis-
sion’’ means the Federal Trade Commis-
sion. 
(3) DATA
IN
ELECTRONIC
FORM.—The 
term ‘‘data in electronic form’’ means any 
data stored electronically or digitally on 
any computer system or other database 
and includes recordable tapes and other 
mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ means the protection of 
data in electronic form in storage or in 
transit using an encryption technology 
that has been adopted by an established 
standards setting body which renders 
such data indecipherable in the absence 
of associated cryptographic keys nec-
essary to enable decryption of such data. 
Such encryption must include appro-
priate management and safeguards of 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
such keys to protect the integrity of the 
encryption. 
(5) IDENTITY THEFT.—The term ‘‘iden-
tity theft’’ means the unauthorized use of 
another person’s personal information 
for the purpose of engaging in commer-
cial transactions under the name of such 
other person. 
(6) INFORMATION
BROKER.—The term 
‘‘information broker’’ means a commer-
cial entity whose business is to collect, 
assemble, or maintain personal informa-
tion concerning individuals who are not 
current or former customers of such enti-
ty in order to sell such information or 
provide access to such information to any 
nonaffiliated third party in exchange for 
consideration, whether such collection, 
assembly, or maintenance of personal in-
formation is performed by the informa-
tion broker directly, or by contract or 
subcontract with any other entity. 
(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘per-
sonal information’’ means an individ-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
ual’s first name or initial and last 
name, or address, or phone number, 
in combination with any 1 or more of 
the following data elements for that 
individual: 
(i) Social Security number. 
(ii) Driver’s license number or 
other State identification number. 
(iii) Financial account num-
ber, or credit or debit card num-
ber, and any required security 
code, access code, or password 
that is necessary to permit access 
to an individual’s financial ac-
count. 
(B) MODIFIED DEFINITION BY RULE-
MAKING.—The Commission may, by 
rule, modify the definition of ‘‘per-
sonal information’’ under subpara-
graph (A) to the extent that such 
modification is necessary to accom-
modate changes in technology or 
practices, will not unreasonably im-
pede interstate commerce, and will 
accomplish the purposes of this Act. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS