I 
116TH CONGRESS 
1ST SESSION 
H. R. 327 
To prohibit entities from requiring individuals to submit to arbitration for 
disputes arising from a security breach, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 8, 2019 
Mr. TED LIEU of California introduced the following bill; which was referred 
to the Committee on Energy and Commerce 
A BILL 
To prohibit entities from requiring individuals to submit to 
arbitration for disputes arising from a security breach, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Ending Forced Arbi-
tration for Victims of Data Breaches Act of 2019’’. 
SEC. 2. PROTECTION OF DATA SECURITY BREACH VICTIMS. 
An entity may not require, as part of a customer or 
other similar agreement, an individual to agree to submit 
any dispute related to a security breach, including any dis-
pute related to identity theft, to arbitration. 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
SEC. 3. APPLICABILITY. 
A provision of an agreement entered into prior to the 
date of the enactment of this Act, that violates section 
2, is void. 
SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A violation of section 2 shall be treated as an unfair and 
deceptive act or practice in violation of a regulation under 
section 18(a)(1)(B) of the Federal Trade Commission Act 
(15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive 
acts or practices. 
(b) POWERS
OF COMMISSION.—The Commission 
shall enforce this Act in the same manner, by the same 
means, and with the same jurisdiction, powers, and duties 
as though all applicable terms and provisions of the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.) were 
incorporated into and made a part of this Act. Any person 
who violates section 2 shall be subject to the penalties and 
entitled to the privileges and immunities provided in that 
Act. 
(c) RULES.—The Commission shall promulgate, 
under section 553 of title 5, United States Code, such 
rules as may be necessary to carry out the provisions of 
this Act. 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
SEC. 5. ENFORCEMENT BY STATES. 
(a) IN GENERAL.—If the attorney general of a State 
has reason to believe that an interest of the residents of 
the State has been or is being threatened or adversely af-
fected by a practice that violates section 2, the attorney 
general of the State may, as parens patriae, bring a civil 
action on behalf of the residents of the State in an appro-
priate district court of the United States to obtain appro-
priate relief. 
(b) RIGHTS OF FEDERAL TRADE COMMISSION.— 
(1) NOTICE
TO
FEDERAL
TRADE
COMMIS-
SION.— 
(A) IN GENERAL.—Except as provided in 
clause (iii), the attorney general of a State, be-
fore initiating a civil action under paragraph 
(1), shall provide written notification to the 
Federal Trade Commission that the attorney 
general intends to bring such civil action. 
(B) CONTENTS.—The notification required 
under clause (i) shall include a copy of the com-
plaint to be filed to initiate the civil action. 
(C) EXCEPTION.—If it is not feasible for 
the attorney general of a State to provide the 
notification required under clause (i) before ini-
tiating a civil action under paragraph (1), the 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
attorney general shall notify the Commission 
immediately upon instituting the civil action. 
(2) INTERVENTION BY FEDERAL TRADE COM-
MISSION.—The Commission may— 
(A) intervene in any civil action brought by 
the attorney general of a State under para-
graph (1); and 
(B) upon intervening— 
(i) be heard on all matters arising in 
the civil action; and 
(ii) file petitions for appeal of a deci-
sion in the civil action. 
(c) INVESTIGATORY POWERS.—Nothing in this sub-
section may be construed to prevent the attorney general 
of a State from exercising the powers conferred on the 
attorney general by the laws of the State to conduct inves-
tigations, to administer oaths or affirmations, or to compel 
the attendance of witnesses or the production of documen-
tary or other evidence. 
(d) PREEMPTIVE ACTION BY FEDERAL TRADE COM-
MISSION.—If the Federal Trade Commission institutes a 
civil action or an administrative action with respect to a 
violation of section 2, the attorney general of a State may 
not, during the pendency of such action, bring a civil ac-
tion under paragraph (1) against any defendant named 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
in the complaint of the Commission for the violation with 
respect to which the Commission instituted such action. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under para-
graph (1) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under paragraph (1), process may be served 
in any district in which— 
(A) the defendant is an inhabitant, may be 
found, or transacts business; or 
(B) venue is proper under section 1391 of 
title 28, United States Code. 
SEC. 6. PRIVATE RIGHT OF ACTION. 
(a) IN GENERAL.—An individual who is injured by 
a violation of section 2 may bring a private right of action 
in any court of appropriate jurisdiction for rescission and 
restitution, as well as for all damages and may be awarded 
injunctive relief against a violation of such section. The 
individual shall also be entitled to recover its costs of liti-
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
gation and reasonable attorney’s fees and expert witness 
fees, against any entity or person found to be liable for 
such violation. 
(b) LIABILITY.—Every person who directly or indi-
rectly controls a person liable under subsection (a), every 
partner in a firm so liable, every principal executive officer 
or director of a corporation so liable, every person occu-
pying a similar status or performing similar functions and 
every employee of a person so liable who materially aids 
in the act or transaction constituting the violation is also 
liable jointly and severally with and to the same extent 
as such person, unless the person who would otherwise be 
liable hereunder had no knowledge of or reasonable 
grounds to know of the existence of the facts by reason 
of which the liability is alleged to exist. 
(c) STATUTE OF LIMITATIONS.—No action may be 
commenced pursuant to this section more than the later 
of— 
(1) 2 years after the date on which the violation 
occurs; or 
(2) 2 years after the date on which the violation 
is discovered or should have been discovered through 
exercise of reasonable diligence. 
(d) VENUE.—An action under this section may be 
brought in— 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
(1) the district court of the United States that 
meets applicable requirements relating to venue 
under section 1391 of title 28, United States Code; 
or 
(2) another court of competent jurisdiction. 
(e) CUMULATIVE RIGHT.—The private rights pro-
vided for in this section are in addition to and not in lieu 
of other rights or remedies created by Federal or State 
law. 
SEC. 7. DEFINITIONS. 
In this Act— 
(1) the term ‘‘security breach’’— 
(A) means a compromise of the security, 
confidentiality, or integrity of, or the loss of, 
computerized data that results in, or there is a 
reasonable basis to conclude has resulted in— 
(i) the unauthorized acquisition of 
sensitive personally identifiable informa-
tion; or 
(ii) access to sensitive personally iden-
tifiable information that is for an unau-
thorized purpose, or in excess of authoriza-
tion; 
(B) does not include any lawfully author-
ized investigative, protective, or intelligence ac-
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
tivity of a law enforcement agency of the 
United States, a State, or a political subdivision 
of a State, or of an element of the intelligence 
community; and 
(2) the term ‘‘sensitive personally identifiable 
information’’ means any information or compilation 
of information, in electronic or digital form that in-
cludes one or more of the following: 
(A) An individual’s first and last name or 
first initial and last name in combination with 
any two of the following data elements: 
(i) Home address or telephone num-
ber. 
(ii) Mother’s maiden name. 
(iii) Month, day, and year of birth. 
(B) A Social Security number (but not in-
cluding only the last four digits of a Social Se-
curity number), driver’s license number, pass-
port number, or alien registration number or 
other Government-issued unique identification 
number. 
(C) Unique biometric data such as a finger 
print, voice print, a retina or iris image, or any 
other unique physical representation. 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS
(D) A unique account identifier, including 
a financial account number or credit or debit 
card number, electronic identification number, 
user name, or routing code. 
(E) A user name or electronic mail ad-
dress, in combination with a password or secu-
rity question and answer that would permit ac-
cess to an online account. 
(F) Any combination of the following data 
elements: 
(i) An individual’s first and last name 
or first initial and last name. 
(ii) A unique account identifier, in-
cluding a financial account number or 
credit or debit card number, electronic 
identification number, user name, or rout-
ing code. 
(iii) Any security code, access code, or 
password, or source code that could be 
used to generate such codes or passwords. 
Æ 
VerDate Sep 11 2014 
22:58 Jan 18, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H327.IH
H327
pamtmann on DSKBFK8HB2PROD with BILLS