tain a false, fictitious, or fraudu-
lent statement or representation. 
(B) PROHIBITION
ON
SOLICITATION 
TO
OBTAIN
PERSONAL
INFORMATION 
UNDER
FALSE
PRETENSES.—It shall be 
unlawful for an information broker to 
request a person to obtain personal 
information or any other information 
relating to any other person, if the in-
formation broker knew or should 
have known that the person to whom 
such a request is made will obtain or 
attempt to obtain such information in 
the manner described in subsection 
(a). 
(d) EXEMPTION
FOR TELECOMMUNICATIONS 
CARRIER, CABLE OPERATOR, INFORMATION SERV-
ICE, 
OR
INTERACTIVE
COMPUTER
SERVICE.— 
Nothing in this section shall apply to any elec-
tronic communication by a third party stored 
by a telecommunications carrier, cable oper-
ator, or information service, as those terms 
are defined in section 3 of the Communica-
tions Act of 1934 (47 U.S.C. 153), or an inter-
active computer service, as such term is de-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
fined in section 230(f)(2) of such Act (47 U.S.C. 
230(f)(2)). 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any per-
son engaged in interstate commerce that 
owns or possesses data in electronic form con-
taining personal information shall, following 
the discovery of a breach of security of the 
system maintained by such person that con-
tains such data— 
(1) notify each individual who is a cit-
izen or resident of the United States 
whose personal information was acquired 
by an unauthorized person as a result of 
such a breach of security; and 
(2) notify the Commission. 
(b) SPECIAL
NOTIFICATION
REQUIREMENT 
FOR CERTAIN ENTITIES.— 
(1) THIRD PARTY AGENTS.—In the event 
of a breach of security by any third party 
entity that has been contracted to main-
tain or process data in electronic form 
containing personal information on be-
half of any other person who owns or 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
possesses such data, such third party en-
tity shall be required only to notify such 
person of the breach of security. Upon re-
ceiving such notification from such third 
party, such person shall provide the noti-
fication required under subsection (a). 
(2) 
TELECOMMUNICATIONS
CARRIERS, 
CABLE OPERATORS, INFORMATION SERVICES, 
AND INTERACTIVE COMPUTER SERVICES.—If a 
telecommunications carrier, cable oper-
ator, or information service (as such 
terms are defined in section 3 of the Com-
munications Act of 1934 (47 U.S.C. 153)), 
or an interactive computer service (as 
such term is defined in section 230(f)(2) 
of such Act (47 U.S.C. 230(f)(2))), becomes 
aware of a breach of security during the 
transmission of data in electronic form 
containing personal information that is 
owned or possessed by another person 
utilizing the means of transmission of 
such telecommunications carrier, cable 
operator, information service, or inter-
active 
computer 
service, 
such 
tele-
communications carrier, cable operator, 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
information service, or interactive com-
puter service shall be required only to 
notify the person who initiated such 
transmission of such a breach of security 
if such person can be reasonably identi-
fied. Upon receiving such notification 
from a telecommunications carrier, cable 
operator, information service, or inter-
active computer service, such person 
shall provide the notification required 
under subsection (a). 
(3) BREACH OF HEALTH INFORMATION.— 
If the Commission receives a notification 
of a breach of security and determines 
that information included in such breach 
is individually identifiable health infor-
mation (as such term is defined in section 
1171(6) of the Social Security Act (42 
U.S.C. 1320d(6)), the Commission shall 
send a copy of such notification to the 
Secretary of Health and Human Services. 
(c) TIMELINESS OF NOTIFICATION.—All noti-
fications required under subsection (a) shall 
be made as promptly as possible and without 
unreasonable delay following the discovery of 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS