manently erasing, or otherwise modifying the 
personal information contained in such data to 
make such personal information permanently 
unreadable or undecipherable. 
(F) A process for overseeing persons to 
whom personal information is disclosed, or who 
have access to internet-connected devices, by— 
(i) taking reasonable steps to select 
and retain persons that are capable of 
maintaining appropriate safeguards for the 
personal information or internet-connected 
devices at issue; and 
(ii) requiring all such persons to im-
plement and maintain such security meas-
ures. 
(3) TREATMENT OF ENTITIES GOVERNED BY 
OTHER FEDERAL LAW.—Any covered entity who is 
in compliance with any other Federal law that re-
quires such covered entity to maintain standards 
and safeguards for information security and protec-
tion of personal information that, taken as a whole 
and as the Commission shall determine in the rule-
making required under this subsection, provide pro-
tections substantially similar to, or greater than, 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
those required under this subsection, shall be 
deemed to be in compliance with this subsection. 
(b) SPECIAL REQUIREMENTS
FOR INFORMATION 
BROKERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.— 
The regulations promulgated under subsection (a) 
shall require each information broker to submit its 
security policies to the Commission in conjunction 
with a notification of a breach of security under sec-
tion 3 or upon request of the Commission. 
(2) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission may conduct audits of the infor-
mation security practices of such information broker, 
or require the information broker to conduct inde-
pendent audits of such practices (by an independent 
auditor who has not audited such information bro-
ker’s security practices during the preceding 5 
years). 
(3) ACCURACY OF AND INDIVIDUAL ACCESS TO 
PERSONAL INFORMATION.— 
(A) ACCURACY.— 
(i) IN
GENERAL.—Each information 
broker shall establish reasonable proce-
dures to assure the maximum possible ac-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
curacy of the personal information the in-
formation broker collects, assembles, or 
maintains, and any other information the 
information broker collects, assembles, or 
maintains that specifically identifies an in-
dividual, other than information which 
merely identifies an individual’s name or 
address. 
(ii) LIMITED EXCEPTION FOR FRAUD 
DATABASES.—The requirement in clause 
(i) shall not prevent the collection or main-
tenance of information that may be inac-
curate with respect to a particular indi-
vidual when that information is being col-
lected or maintained solely— 
(I) for the purpose of indicating 
whether there may be a discrepancy 
or irregularity in the personal infor-
mation that is associated with an indi-
vidual; and 
(II) to help identify, or authen-
ticate the identity of, an individual, or 
to protect against or investigate fraud 
or other unlawful conduct. 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(B) CONSUMER
ACCESS
TO
INFORMA-
TION.—Each information broker shall— 
(i) provide to each individual whose 
personal 
information 
the 
information 
broker maintains, at the individual’s re-
quest at least once per year and at no cost 
to the individual, and after verifying the 
identity of such individual, a means for the 
individual to review any personal informa-
tion regarding such individual maintained 
by the information broker and any other 
information maintained by the information 
broker that specifically identifies such indi-
vidual, other than information which mere-
ly identifies an individual’s name or ad-
dress; and 
(ii) place a conspicuous notice on the 
Internet website of the information broker 
(if the information broker maintains such 
a website) instructing individuals how to 
request access to the information required 
to be provided under clause (i), and, as ap-
plicable, how to express a preference with 
respect to the use of personal information 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
for marketing purposes under subpara-
graph (D). 
(C) DISPUTED
INFORMATION.—Whenever 
an individual whose information the information 
broker maintains makes a written request dis-
puting the accuracy of any such information, 
the information broker, after verifying the iden-
tity of the individual making such request and 
unless there are reasonable grounds to believe 
such request is frivolous or irrelevant, shall— 
(i) correct any inaccuracy; or 
(ii) in the case of information that 
is— 
(I) public record information, in-
form the individual of the source of 
the information, and, if reasonably 
available, where a request for correc-
tion may be directed and, if the indi-
vidual provides proof that the public 
record has been corrected or that the 
information broker was reporting the 
information incorrectly, correct the in-
accuracy in the information broker’s 
records; or 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(II) nonpublic information, note 
the information that is disputed, in-
cluding the individual’s statement dis-
puting such information, and take 
reasonable steps to independently 
verify such information under the pro-
cedures outlined in subparagraph (A) 
if such information can be independ-
ently verified. 
(D) ALTERNATIVE PROCEDURE FOR CER-
TAIN
MARKETING
INFORMATION.—In accord-
ance with regulations issued under subpara-
graph (F), an information broker that main-
tains any information described in subpara-
graph (A) which is used, shared, or sold by 
such information broker for marketing pur-
poses, may, in lieu of complying with the access 
and dispute requirements set forth in subpara-
graphs (B) and (C), provide each individual 
whose information the information broker main-
tains with a reasonable means of expressing a 
preference not to have his or her information 
used for such purposes. If the individual ex-
presses such a preference, the information 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS