I 
115TH CONGRESS 
1ST SESSION H. R. 3896 
To require certain entities who collect and maintain personal information 
of individuals to secure such information and to provide notice to such 
individuals in the case of a breach of security involving such information, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 2, 2017 
Ms. SCHAKOWSKY (for herself, Mr. PALLONE, Mr. BUTTERFIELD, Ms. MAT-
SUI, Mr. TONKO, Mrs. DINGELL, Mr. WELCH, Mr. MCNERNEY, Mr. 
GENE GREEN of Texas, and Ms. KELLY of Illinois) introduced the fol-
lowing bill; which was referred to the Committee on Energy and Com-
merce 
A BILL 
To require certain entities who collect and maintain personal 
information of individuals to secure such information 
and to provide notice to such individuals in the case 
of a breach of security involving such information, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Secure and Protect 
Americans’ Data Act’’. 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES, PRACTICES, AND 
PROCEDURES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require each covered 
entity to establish and implement reasonable poli-
cies, practices, and procedures regarding information 
security practices for the treatment and protection 
of personal information taking into consideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by such 
covered entity; 
(B) the sensitivity of any personal informa-
tion at issue; 
(C) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(D) the cost of implementing such safe-
guards. 
(2) REQUIREMENTS.—Such regulations shall 
require the policies, practices, and procedures to in-
clude the following: 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(A) A written security policy with respect 
to the collection, use, sale, other dissemination, 
and maintenance of such personal information. 
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system or systems maintained by such covered 
entity that contains such data, which shall in-
clude regular monitoring for a breach of secu-
rity of such system or systems. 
(D) A process for taking preventive and 
corrective action to mitigate against any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include imple-
menting any changes to security practices and 
the architecture, installation, or implementation 
of network or operating software, and for regu-
larly testing or otherwise monitoring the effec-
tiveness of the safeguards. 
(E) A process for determining if data is no 
longer needed and disposing of data containing 
personal information by shredding, permanently 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
erasing, or otherwise modifying the personal in-
formation contained in such data to make such 
personal information permanently unreadable or 
indecipherable. 
(F) A process for overseeing persons who 
have access to personal information, including 
through Internet-connected devices, by— 
(i) taking reasonable steps to select 
and retain persons that are capable of 
maintaining appropriate safeguards for the 
personal information or Internet-connected 
devices at issue; and 
(ii) requiring all such persons to im-
plement and maintain such security meas-
ures. 
(G) A process for employee training and 
supervision for implementation of the policies, 
practices, and procedures required by this sub-
section. 
(H) A written plan or protocol for internal 
and public response in the event of a breach of 
security. 
(3) PERIODIC
ASSESSMENT
AND
CONSUMER 
PRIVACY
AND
DATA
SECURITY
MODERNIZATION.— 
Not less frequently than every 12 months, each cov-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
ered entity shall monitor, evaluate, and adjust, as 
appropriate, the consumer privacy and data security 
program of such covered entity in light of any rel-
evant changes in— 
(A) technology; 
(B) internal or external threats and 
vulnerabilities to personal information; and 
(C) the changing business arrangements of 
the covered entity, such as— 
(i) mergers and acquisitions; 
(ii) alliances and joint ventures; 
(iii) outsourcing arrangements; 
(iv) bankruptcy; and 
(v) changes to personal information 
systems. 
(4) SUBMISSION OF POLICIES TO THE FTC.— 
The regulations promulgated under this subsection 
shall require each covered entity to submit its secu-
rity policies to the Commission in conjunction with 
a notification of a breach of security under section 
3 or upon request of the Commission. 
(5) TREATMENT OF ENTITIES GOVERNED BY 
OTHER FEDERAL LAW.—Any covered entity who is 
in compliance with any other Federal law that re-
quires such covered entity to maintain standards 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
and safeguards for information security and protec-
tion of personal information that, taken as a whole 
and as the Commission shall determine in the rule-
making required under this subsection, requires cov-
ered entities to provide protections substantially 
similar to, or greater than, those required under this 
subsection, shall be deemed to be in compliance with 
this subsection. 
(b) SPECIAL REQUIREMENTS
FOR INFORMATION 
BROKERS.— 
(1) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission may require the information 
broker to conduct independent audits of such prac-
tices (by an independent auditor who has not au-
dited such information broker’s security practices 
during the preceding 5 years). 
(2) ACCURACY OF AND INDIVIDUAL ACCESS TO 
PERSONAL INFORMATION.— 
(A) ACCURACY.— 
(i) IN
GENERAL.—Each information 
broker shall establish reasonable proce-
dures to assure the maximum possible ac-
curacy of the personal information the in-
formation broker collects, assembles, or 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
maintains, and any other information the 
information broker collects, assembles, or 
maintains that specifically identifies an in-
dividual, other than information which 
merely identifies an individual’s name or 
address. 
(ii) LIMITED EXCEPTION FOR FRAUD 
DATABASES.—The requirement in clause 
(i) shall not prevent the collection or main-
tenance of information that may be inac-
curate with respect to a particular indi-
vidual when that information is being col-
lected or maintained solely— 
(I) for the purpose of indicating 
whether there may be a discrepancy 
or irregularity in the personal infor-
mation that is associated with an indi-
vidual; and 
(II) to help identify, or authen-
ticate the identity of, an individual, or 
to protect against or investigate fraud 
or other unlawful conduct. 
(B) CONSUMER
ACCESS
TO
INFORMA-
TION.—Each information broker shall— 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(i) provide to each individual whose 
personal 
information 
the 
information 
broker maintains, at the individual’s re-
quest at least once per year and at no cost 
to the individual, and after verifying the 
identity of such individual, a means for the 
individual to review any personal informa-
tion regarding such individual maintained 
by the information broker and any other 
information maintained by the information 
broker that specifically identifies such indi-
vidual, other than information which mere-
ly identifies an individual’s name or ad-
dress; and 
(ii) place a conspicuous notice on the 
Internet website of the information broker 
(if the information broker maintains such 
a website) notifying consumers that the en-
tity is an information broker using specific 
language that the Commission shall deter-
mine in the rulemaking required under this 
subsection and instructing individuals how 
to request access to the information re-
quired to be provided under clause (i), and, 
as applicable, how to express a preference 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
with respect to the use of personal infor-
mation for marketing purposes under sub-
paragraph (D). 
(C) DISPUTED
INFORMATION.—Whenever 
an individual whose information the information 
broker maintains makes a written request dis-
puting the accuracy of any such information, 
the information broker, after verifying the iden-
tity of the individual making such request and 
unless there are reasonable grounds to believe 
such request is frivolous or irrelevant, shall— 
(i) correct any inaccuracy; or 
(ii) in the case of information that 
is— 
(I) public record information, in-
form the individual of the source of 
the information, and, if reasonably 
available, where a request for correc-
tion may be directed and, if the indi-
vidual provides proof that the public 
record has been corrected or that the 
information broker was reporting the 
information incorrectly, correct the in-
accuracy in the information broker’s 
records; or 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(II) nonpublic information, note 
the information that is disputed, in-
cluding the individual’s statement dis-
puting such information, and take 
reasonable steps to independently 
verify such information under the pro-
cedures outlined in subparagraph (A) 
if such information can be independ-
ently verified. 
(D) ALTERNATIVE PROCEDURE FOR CER-
TAIN
MARKETING
INFORMATION.—In accord-
ance with regulations issued under subpara-
graph (F), an information broker that main-
tains any information described in subpara-
graph (A) which is used, shared, or sold by 
such information broker for marketing pur-
poses, may, in lieu of complying with the access 
and dispute requirements set forth in subpara-
graphs (B) and (C), provide each individual 
whose information the information broker main-
tains with a reasonable means of expressing a 
preference not to have his or her information 
used for such purposes. If the individual ex-
presses such a preference, the information 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
broker may not use, share, or sell the individ-
ual’s information for marketing purposes. 
(E) LIMITATIONS.—An information broker 
may limit the access to information required 
under subparagraph (B)(i), is not required to 
provide notice to individuals as required under 
subparagraph (B)(ii), and is not required to 
comply with a disputed information request 
under subparagraph (C) in the following cir-
cumstances: 
(i) If access of the individual to the 
information is limited by law or legally rec-
ognized privilege. 
(ii) If the information is used for a le-
gitimate governmental or fraud prevention 
purpose that would be compromised by 
such access. 
(iii) If the information consists of a 
published media record, unless that record 
has been included in a report about an in-
dividual shared with a third party. 
(F) RULEMAKING.—Not later than 1 year 
after the date of enactment of this Act, the 
Commission shall promulgate regulations under 
section 553 of title 5, United States Code, to 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
carry out this paragraph and to facilitate the 
purposes of this Act. In addition, the Commis-
sion shall issue regulations, as necessary, under 
section 553 of title 5, United States Code, on 
the scope of the application of the limitations in 
subparagraph (E), including any additional cir-
cumstances in which an information broker may 
limit access to information under such subpara-
graph that the Commission determines to be 
appropriate. 
(G) FCRA REGULATED
PERSONS.—Any 
information broker who is engaged in activities 
subject to the Fair Credit Reporting Act and 
who is in compliance with sections 609, 610, 
and 611 of such Act (15 U.S.C. 1681g; 1681h; 
1681i) with respect to information subject to 
such Act, shall be deemed to be in compliance 
with this paragraph with respect to such infor-
mation. 
(3) REQUIREMENT OF AUDIT LOG OF ACCESSED 
AND TRANSMITTED INFORMATION.—Not later than 
1 year after the date of enactment of this Act, the 
Commission shall promulgate regulations under sec-
tion 553 of title 5, United States Code, to require 
information brokers to establish measures which fa-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
cilitate the auditing or retracing of any internal or 
external access to, or transmissions of, any data con-
taining personal information collected, assembled, or 
maintained by such information broker. 
(4) PROHIBITION ON PRETEXTING BY INFOR-
MATION BROKERS.— 
(A) PROHIBITION
ON
OBTAINING
PER-
SONAL INFORMATION BY FALSE PRETENSES.— 
It shall be unlawful for an information broker 
to obtain or attempt to obtain, or cause to be 
disclosed or attempt to cause to be disclosed to 
any person, personal information or any other 
information relating to any person by— 
(i) making a false, fictitious, or fraud-
ulent statement or representation to any 
person; or 
(ii) providing any document or other 
information to any person that the infor-
mation broker knows or should know to be 
forged, counterfeit, lost, stolen, or fraudu-
lently obtained, or to contain a false, ficti-
tious, or fraudulent statement or represen-
tation. 
(B) PROHIBITION
ON
SOLICITATION
TO 
OBTAIN PERSONAL INFORMATION UNDER FALSE 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
PRETENSES.—It shall be unlawful for an infor-
mation broker to request a person to obtain 
personal information or any other information 
relating to any other person, if the information 
broker knew or should have known that the per-
son to whom such a request is made will obtain 
or attempt to obtain such information in the 
manner described in subparagraph (A). 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) INDIVIDUAL NOTIFICATION.— 
(1) IN GENERAL.—Each covered entity shall, 
following the discovery of a breach of security, notify 
each individual who is a citizen or resident of the 
United States whose personal information was, or is 
reasonably believed to have been, acquired or 
accessed by an unauthorized person, or used for an 
unauthorized purpose. 
(2) TIMELINESS OF NOTIFICATION.— 
(A) IN
GENERAL.—Unless subject to a 
delay authorized under subparagraph (B), a no-
tification required under paragraph (1) shall be 
made as expeditiously as practicable and with-
out unreasonable delay, but not later than 30 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
days following the discovery of a breach of secu-
rity. 
(B) DELAY OF NOTIFICATION AUTHORIZED 
FOR LAW ENFORCEMENT OR NATIONAL SECU-
RITY PURPOSES.— 
(i) LAW
ENFORCEMENT.—If a Fed-
eral or State law enforcement agency, in-
cluding an attorney general of a State, de-
termines that the notification required 
under this section would impede a civil or 
criminal investigation, such notification 
shall be delayed upon the written request 
of the law enforcement agency for 30 days 
or such lesser period of time which the law 
enforcement agency determines is reason-
ably necessary and requests in writing. 
Such a law enforcement agency may, by a 
subsequent written request, revoke such 
delay or extend the period of time set forth 
in the original request made under this 
clause if further delay is necessary. 
(ii) NATIONAL SECURITY.—If a Fed-
eral national security agency or homeland 
security agency determines that the notifi-
cation required under this section would 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
threaten national or homeland security, 
such notification may be delayed for a pe-
riod of time of up to 60 days which the na-
tional security agency or homeland security 
agency determines is reasonably necessary 
and requests in writing. A Federal national 
security agency or homeland security agen-
cy may revoke such delay or extend the pe-
riod of time set forth in the original re-
quest made under this clause by a subse-
quent written request if further delay is 
necessary. 
(iii) LIMITATION ON DELAY OR EX-
TENSION.—Any delay or extension of noti-
fication permitted under this subparagraph 
may not exceed a total time period of one 
year. 
(b) COORDINATION OF NOTIFICATION WITH CON-
SUMER REPORTING AGENCIES.—If a covered entity is re-
quired to provide notification to more than 5,000 individ-
uals under subsection (a)(1), the covered entity shall also 
notify the major consumer reporting agencies that compile 
and maintain files on consumers on a nationwide basis, 
of the timing and distribution of the notifications, except 
for a case in which the only information that is the subject 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
of the breach of security is the individual’s first name or 
initial and last name, address, or phone number, in com-
bination with a credit or debit card number and any re-
quired security code. Such notification shall be given to 
the consumer reporting agencies without unreasonable 
delay and, if such notification will not delay notification 
to the affected individuals, prior to the distribution of noti-
fications to the affected individuals. 
(c) METHOD AND CONTENT OF NOTIFICATION.— 
(1) GENERAL NOTIFICATION.—A covered entity 
required to provide notification to individuals under 
subsection (a)(1) shall be in compliance with such 
requirement if the covered entity provides con-
spicuous and clearly identified notification by one of 
the following methods (provided the selected method 
can reasonably be expected to reach the intended in-
dividual): 
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the covered entity. 
(B) Notification by email or other elec-
tronic means, if— 
(i) the covered entity’s primary meth-
od of communication with the individual is 
by email or such other electronic means; or 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(ii) the individual has consented to re-
ceive such notification and the notification 
is provided in a manner that is consistent 
with the provisions permitting electronic 
transmission of notifications under section 
101 of the Electronic Signatures in Global 
and National Commerce Act (15 U.S.C. 
7001). 
(2) WEBSITE NOTIFICATION.—The covered en-
tity shall also provide conspicuous notification on the 
Internet website of the covered entity (if such cov-
ered entity maintains such a website) for a period of 
not less than 90 days. 
(3) MEDIA NOTIFICATION.—If the number of 
residents of a State whose personal information was, 
or is reasonably believed to have been, acquired or 
accessed by an unauthorized person, or used for an 
unauthorized purpose, exceeds 5,000, the covered 
entity shall also provide notification in print and to 
broadcast media, including major media in metro-
politan and rural areas where the individuals whose 
personal information was, or is reasonably believed 
to have been, acquired or accessed by an unauthor-
ized person, or used for an unauthorized purpose, 
reside. 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(4) CONTENT OF NOTIFICATION.— 
(A) IN
GENERAL.—Regardless of the 
method by which notification is provided to an 
individual under paragraphs (1), (2), and (3), 
such notification shall include— 
(i) a description of the personal infor-
mation that was, or is reasonably believed 
to have been, acquired or accessed by an 
unauthorized person, or used for an unau-
thorized purpose; 
(ii) a general description of the inci-
dent and the date or estimated date of the 
breach of security and the date range dur-
ing which the personal information was 
compromised; 
(iii) the acts the covered entity, or the 
agent of the covered entity, has taken to 
protect personal information from further 
breach of security; 
(iv) a telephone number, website, and 
email address that the individual may use, 
at no cost to such individual, to contact 
the covered entity, or agent of the covered 
entity, to inquire about the breach of secu-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
rity or the information the covered entity 
maintained about that individual; 
(v) in the case of an individual that is 
entitled to receive services under sub-
section (e), notification that the individual 
is entitled to receive such services; 
(vi) the toll-free contact telephone 
numbers and addresses for the major con-
sumer reporting agencies; and 
(vii) a toll-free telephone number and 
Internet website address for the Commis-
sion whereby the individual may obtain in-
formation regarding identity theft. 
(B) DIRECT
BUSINESS
RELATIONSHIP.— 
The notification required under subsection (a) 
shall identify the covered entity that has a di-
rect business relationship with the individual, if 
applicable, as well as the entity that experi-
enced the breach of security. 
(5) REGULATIONS FOR SUBSTITUTE NOTIFICA-
TION.—Not later than 1 year after the date of en-
actment of this Act, the Commission shall, by regu-
lation under section 553 of title 5, United States 
Code— 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(A) establish criteria for determining cir-
cumstances under which substitute notification 
may be provided in lieu of direct notification re-
quired by paragraph (1), including criteria for 
determining if notification under paragraph (1) 
is not feasible due to excessive costs to the cov-
ered entity required to provide such notification 
relative to the resources of such covered entity; 
and 
(B) establish the form and content of sub-
stitute notification. 
(d) NOTIFICATION
FOR LAW ENFORCEMENT
AND 
OTHER PURPOSES.—A covered entity shall, as expedi-
tiously as practicable and without unreasonable delay, but 
not later than 5 days following the discovery of a breach 
of security, provide notification of the breach to— 
(1) the Commission; 
(2) the Federal Bureau of Investigation; 
(3) the Secret Service; 
(4) for common carriers, the Federal Commu-
nications Commission; 
(5) for entities that provide a consumer finan-
cial product or service (as defined in section 1002 of 
the Consumer Financial Protection Act of 2010 (12 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
U.S.C. 5481)), the Bureau of Consumer Financial 
Protection; and 
(6) the attorney general of each State in which 
the personal information of a resident or residents 
of the State was, or is reasonably believed to have 
been, acquired or accessed by an unauthorized per-
son, or used for an unauthorized purpose. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—A covered entity required to 
provide notification under subsection (a) shall, upon 
request of an individual whose personal information 
was included in the breach of security, provide or ar-
range for the provision of, to each such individual 
and at no cost to such individual— 
(A) at the option of such individual, ei-
ther— 
(i) consumer credit reports from all of 
the major consumer reporting agencies be-
ginning not later than 60 days following 
the individual’s request and continuing on 
a quarterly basis for a period of not less 
than 10 years thereafter; or 
(ii) a credit monitoring or other serv-
ice that— 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(I) enables consumers to detect 
the misuse of their personal informa-
tion, beginning not later than 60 days 
following the individual’s request and 
continuing for a period of not less 
than 10 years thereafter; and 
(II) includes monitoring of the 
individual’s credit file at all of the 
major consumer reporting agencies; 
and 
(B) a service that enables consumers to 
control access to their personal information and 
credit reports, beginning not later than 60 days 
following the individual’s request and con-
tinuing for a period of not less than 10 years 
thereafter. 
(2) LIMITATION.—This subsection shall not 
apply if the only personal information which has 
been the subject of the breach of security is the indi-
vidual’s first name or initial and last name, address, 
or phone number, in combination with a credit or 
debit card number and any required security code. 
(f) EXEMPTION.— 
(1) GENERAL
EXEMPTION.—A covered entity 
shall be exempt from the requirements under this 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
section if the data containing personal information 
that was, or is reasonably believed to have been, ac-
quired or accessed by an unauthorized person, or 
used for an unauthorized purpose, is unusable, 
unreadable, or indecipherable because of security 
technologies or methodologies generally accepted by 
experts in the field of information security at the 
time the breach of security occurred. This exemption 
does not apply with regard to the use of encryption 
technology generally accepted by experts in the field 
of information security at the time the breach of se-
curity occurred if any cryptographic keys necessary 
to enable decryption of such data are also accessed 
or acquired without authorization. 
(2) FTC GUIDANCE.—Not later than 1 year 
after the date of enactment of this Act, the Commis-
sion shall issue guidance regarding the application of 
the exemption in paragraph (1). 
(g) WEBSITE NOTIFICATION OF FEDERAL TRADE 
COMMISSION.—If the Commission, upon receiving notifi-
cation of any breach of security that is reported to the 
Commission under subsection (d)(1), finds that notifica-
tion of such a breach of security via the Commission’s 
Internet website would be in the public interest, the Com-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
mission shall place such a notification in a clear and con-
spicuous location on its Internet website. 
(h) WEBSITE NOTIFICATION OF STATE ATTORNEYS 
GENERAL.—If a State attorney general, upon receiving 
notification of any breach of security that is reported to 
such State attorney general under subsection (d)(6), finds 
that notification of such breach of security via the State 
attorney general’s Internet website would be in the public 
interest or for the protection of consumers, the State at-
torney general may place such a notification in a clear and 
conspicuous location on its Internet website. 
(i) FTC STUDY ON NOTIFICATION IN LANGUAGES IN 
ADDITION TO ENGLISH.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall con-
duct a study on the practicality and cost effectiveness of 
requiring the notification required by subsection (c)(1) to 
be provided in a language in addition to English to individ-
uals known to speak only such other language. 
(j) EDUCATION AND OUTREACH FOR SMALL BUSI-
NESSES.—The Commission shall conduct education and 
outreach for small business concerns on data security 
practices and how to prevent hacking and other unauthor-
ized access to, acquisition of, or use of data maintained 
by such small business concerns. 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(k) WEBSITE
ON DATA SECURITY BEST PRAC-
TICES.—The Commission shall maintain an Internet 
website containing nonbinding best practices for busi-
nesses regarding data security and how to prevent hacking 
and other unauthorized access to, acquisition of, or use 
of data maintained by such businesses. 
(l) GENERAL RULEMAKING AUTHORITY.— 
(1) IN GENERAL.—The Commission may pro-
mulgate regulations necessary under section 553 of 
title 5, United States Code, to effectively enforce the 
requirements of this section. 
(2) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
(m) TREATMENT OF PERSONS GOVERNED BY OTHER 
LAW.—A covered entity who is in compliance with any 
other Federal law that requires such covered entity to pro-
vide notification to individuals following a breach of secu-
rity in at least the same or substantially similar cir-
cumstances and in at the least same or substantially simi-
lar manner as required to be provided under this Act, 
taken as a whole and as determined by the Commission 
in the rulemaking required under this section, shall be 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
deemed to be in compliance with this section with respect 
to activities and information covered under such Federal 
law. 
SEC. 4. APPLICATION AND ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices and shall be subject to enforcement by the 
Commission under that Act with respect to any cov-
ered entity. All of the functions and powers of the 
Commission under the Federal Trade Commission 
Act are available to the Commission to enforce com-
pliance by any person with the requirements imposed 
under this Act, irrespective of whether that person 
is engaged in commerce or meets any other jurisdic-
tional tests under the Federal Trade Commission 
Act. 
(2) COORDINATION
WITH
FEDERAL
COMMU-
NICATIONS
COMMISSION.—Where enforcement re-
lates to entities subject to the authority of the Fed-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
eral Communications Commission, enforcement ac-
tions by the Commission will be coordinated with the 
Federal Communications Commission. 
(3) COORDINATION
WITH
BUREAU
OF
CON-
SUMER
FINANCIAL
PROTECTION.—Where enforce-
ment relates to entities that provide a consumer fi-
nancial product or service (as defined in section 
1002 of the Consumer Financial Protection Act of 
2010 (12 U.S.C. 5481)), enforcement actions by the 
Commission will be coordinated with the Bureau of 
Consumer Financial Protection. 
(b) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) IN GENERAL.—If the chief law enforcement 
officer of a State, or an official or agency designated 
by a State, has reason to believe that any covered 
entity has violated or is violating section 2 or 3 of 
this Act, the attorney general, official, or agency of 
the State, in addition to any authority it may have 
to bring an action in State court under its consumer 
protection law, may bring a civil action in any ap-
propriate United States district court or in any 
other court of competent jurisdiction, including a 
State court, to— 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(A) enjoin further such violation by the de-
fendant; 
(B) enforce compliance with such section; 
(C) obtain civil penalties; and 
(D) obtain damages, restitution, or other 
compensation on behalf of residents of the 
State. 
(2) NOTICE
AND
INTERVENTION
BY
THE 
FTC.—The attorney general of a State shall provide 
prior written notice of any action under paragraph 
(1) to the Commission and provide the Commission 
with a copy of the complaint in the action, except in 
any case in which such prior notice is not feasible, 
in which case the attorney general shall serve such 
notice immediately upon instituting such action. The 
Commission shall have the right— 
(A) to intervene in the action; 
(B) upon so intervening, to be heard on all 
matters arising therein; and 
(C) to file petitions for appeal. 
(3) LIMITATION ON STATE ACTION WHILE FED-
ERAL ACTION IS PENDING.—If the Commission has 
instituted a civil action for violation of this Act, no 
State attorney general, or official or agency of a 
State, may bring an action under this subsection 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
during the pendency of that action against any de-
fendant named in the complaint of the Commission 
for any violation of this Act alleged in the complaint. 
(4) RELATIONSHIP WITH STATE-LAW CLAIMS.— 
If the attorney general of a State has authority to 
bring an action under State law directed at acts or 
practices that also violate this Act, the attorney gen-
eral may assert the State-law claim and a claim 
under this Act in the same civil action. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means unauthorized access to, acquisi-
tion of, or use of data containing personal informa-
tion. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) CONSUMER REPORTING AGENCY.—The term 
‘‘consumer reporting agency’’ has the meaning given 
that term in section 603 of the Fair Credit Report-
ing Act (15 U.S.C. 1681a). 
(4) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means— 
(A) any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
association, or venture over which the Commis-
sion has authority pursuant to section 5(a)(2) 
of the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)); 
(B) notwithstanding section 5(a)(2) of the 
Federal Trade Commission Act (15 U.S.C. 
45(a)(2)), common carriers subject to the Com-
munications Act of 1934 (47 U.S.C. 151 et 
seq.); and 
(C) notwithstanding sections 4 and 5(a)(2) 
of the Federal Trade Commission Act (15 
U.S.C. 44 and 45(a)(2)), any nonprofit organi-
zation, including any organization described in 
section 501(c) of the Internal Revenue Code of 
1986 that is exempt from taxation under sec-
tion 501(a) of the Internal Revenue Code of 
1986. 
(5) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’— 
(A) means a commercial entity whose busi-
ness is to collect, assemble, or maintain per-
sonal information concerning individuals who 
are not current or former customers of such en-
tity in order to sell such information or provide 
access to such information to any nonaffiliated 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
third party in exchange for consideration, 
whether such collection, assembly, or mainte-
nance of personal information is performed by 
the information broker directly, or by contract 
or subcontract with any other entity; and 
(B) does not include a commercial entity to 
the extent that such entity processes informa-
tion collected by and received from a non-
affiliated third party concerning individuals who 
are current or former customers or employees 
of the third party to enable the third party to 
provide benefits for the employees or directly 
transact business with the customers. 
(6) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means any information or compila-
tion of information that includes any of the fol-
lowing: 
(i) An individual’s first name or initial 
and last name in combination with any 2 
or more of the following data elements for 
that individual: 
(I) Home address or telephone 
number. 
(II) Mother’s maiden name. 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(III) Month, day, and year of 
birth. 
(IV) User name or electronic 
mail address. 
(ii) Driver’s license number, passport 
number, military identification number, 
alien registration number, or other similar 
number issued on a government document 
used to verify identity. 
(iii) Unique account identifier, includ-
ing a financial account number, or credit 
or debit card number, electronic identifica-
tion number, user name, or routing code. 
(iv) Partial or complete Social Secu-
rity number. 
(v) Unique biometric or genetic data 
such as a faceprint, fingerprint, voice 
print, a retina or iris image, or any other 
unique physical representations. 
(vi) Information that could be used to 
access an individual’s account, such as 
user name and password or email address 
and password. 
(vii) Any security code, access code, or 
password, or source code that could be 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
used to generate such codes or passwords, 
in combination with either of the following 
data elements: 
(I) An individual’s first and last 
name or first initial and last name. 
(II) A unique account identifier, 
including a financial account number 
or credit or debit card number, elec-
tronic identification number, user 
name, or routing code. 
(viii) Information generated or derived 
from the operation or use of an electronic 
communications device that is sufficient to 
identify the street name and name of the 
city or town in which the device is located. 
(ix) Any information regarding an in-
dividual’s medical history, mental or phys-
ical condition, medical treatment or diag-
nosis by a health care professional, or the 
provision of health care to the individual, 
including health information provided to a 
website or mobile application. 
(x) A health insurance policy number 
or subscriber identification number and 
any unique identifier used by a health in-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
surer to identify the individual, or any in-
formation in an individual’s health insur-
ance application and claims history, includ-
ing any appeals records. 
(xi) Digitized or other electronic sig-
nature. 
(xii) Nonpublic communications or 
other user-created content such as emails, 
photographs, or videos. 
(xiii) Any record or information con-
cerning payroll, income, financial accounts, 
mortgages, loans, lines of credit, utility 
bills, accumulated purchases, or any other 
information regarding financial assets, ob-
ligations, or spending habits. 
(xiv) Any additional element the Com-
mission defines as personal information. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A). 
(7) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, the 
Commonwealth of Puerto Rico, Guam, American 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
Samoa, the United States Virgin Islands, the Com-
monwealth of the Northern Mariana Islands, any 
other territory or possession of the United States, 
and each federally recognized Indian tribe. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE DATA SECURITY AND 
BREACH NOTIFICATION LAWS.—No State or political sub-
division thereof shall have any authority to establish or 
continue in effect any standard or requirement that is not 
identical to the standards and requirements established 
under this Act for— 
(1) information security practices for the treat-
ment and protection of the personal information de-
fined in section 5(6)(A), or as subsequently amended 
by the Commission under section 5(6)(B), by cov-
ered entities, as defined in section 5(4); or 
(2) notification to individuals of a breach of se-
curity of the personal information defined in section 
5(6)(A), or as subsequently amended by the Com-
mission under section 5(6)(B), by covered entities, 
as defined in section 5(4). 
(b) EFFECT ON STATE LAW.—In the case of a provi-
sion of the law of a State that is superseded by subsection 
(a), this Act may be enforced in the same manner and 
to the same extent as the State law could have been en-
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
forced under State law had the provision of the law of 
the State not been superseded. 
(c) EFFECT ON OTHER STATE LAWS.—Except as 
provided in subsection (a), nothing in this Act shall be 
construed to— 
(1) preempt or limit any provision of any law, 
rule, regulation, requirement, standard, or other pro-
vision having the force and effect of law of any 
State, including any State consumer protection law, 
any State law relating to acts of fraud or deception, 
and any State trespass, contract, or tort law; 
(2) preempt or limit any provision of any law, 
rule, regulation, requirement, standard, or other pro-
vision having the force and effect of law of any State 
regarding post-data breach services, including secu-
rity or credit freezes, credit monitoring, identity 
theft monitoring, and identity theft services; 
(3) prevent or limit the attorney general of a 
State from exercising the powers conferred upon the 
attorney general by the laws of the State, including 
conducting investigations, administering oaths or af-
firmations, or compelling the attendance of witnesses 
or the production of documentary and other evi-
dence; or 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
(4) preempt or limit any provision of any law, 
rule, regulation, requirement, standard, or other pro-
vision having the force and effect of law of any State 
with respect to any person that is not a covered enti-
ty, as defined in section 5(4), or any information 
that is not personal information, as defined in sec-
tion 5(6)(A), or as subsequently amended by the 
Commission under section 5(6)(B). 
(d) PRESERVATION OF AUTHORITY.— 
(1) FEDERAL TRADE COMMISSION.—Nothing in 
this Act may be construed in any way to limit the 
Commission’s authority under any other provision of 
law. 
(2) FEDERAL COMMUNICATIONS COMMISSION.— 
Nothing in this Act may be construed in any way to 
limit or affect the Federal Communications Commis-
sion’s authority under any other provision of law. 
(3) BUREAU OF CONSUMER FINANCIAL PROTEC-
TION.—Nothing in this Act may be construed in any 
way to limit or affect the authority of the Bureau 
of Consumer Financial Protection under any other 
provision of law. 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 90 days after the date of 
enactment of this Act. 
Æ 
VerDate Sep 11 2014 
04:06 Oct 04, 2017
Jkt 079200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6301
E:\BILLS\H3896.IH
H3896
dlhill on DSK3GLQ082PROD with BILLS