no attorney general of a State may bring an action 
for a violation of this subtitle that resulted from the 
same or related acts or omissions against a defend-
ant named in the Federal civil action initiated by the 
Attorney General of the United States or the Fed-
eral Trade Commission. 
(6) RULE OF CONSTRUCTION.—For purposes of 
bringing any civil action under paragraph (1) noth-
ing in this subtitle shall be construed to prevent an 
attorney general of a State from exercising the pow-
ers conferred on the attorney general by the laws of 
that State to— 
(A) conduct investigations; 
(B) administer oaths and affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(7) VENUE; SERVICE OF PROCESS.— 
(A) VENUE.—Any action brought under 
subsection (a) may be brought in— 
(i) the district court of the United 
States that meets applicable requirements 
relating to venue under section 1391 of 
title 28, United States Code; or 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(ii) another court of competent juris-
diction. 
(B) SERVICE OF PROCESS.—In an action 
brought under subsection (a), process may be 
served in any district in which the defendant— 
(i) is an inhabitant; or 
(ii) may be found. 
(b) NO PRIVATE CAUSE OF ACTION.—Nothing in 
this subtitle establishes a private cause of action against 
a business entity for violation of any provision of this sub-
title. 
SEC. 205. RELATION TO OTHER LAWS. 
(a) PREEMPTION.—For any covered entity that is 
subject to this subtitle, the provisions of this subtitle shall 
supersede any other provision of Federal law, or any provi-
sions of the law of any State or political subdivision of 
a State requiring data security practices that are less 
stringent than the requirements of this subtitle. 
(b) CONSUMER PROTECTION LAWS.—Except as pro-
vided in subsection (a), this section shall not be construed 
to limit the enforcement of any State consumer protection 
law by an attorney general of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—Noth-
ing in this Act shall be construed to preempt the applica-
bility of— 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(1) State trespass, contract, or tort law; or 
(2) any other State law to the extent that the 
law relates to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit the au-
thority of the Federal Trade Commission under any other 
provision of law. 
Subtitle B—Security Breach 
Notification 
SEC. 211. NOTICE TO INDIVIDUALS. 
(a) IN GENERAL.—Except as provided in section 212, 
a covered entity shall, following the discovery of a security 
breach of such information, notify any resident of the 
United States whose sensitive personally identifiable infor-
mation has been, or is reasonably believed to have been, 
accessed or acquired. 
(b) OBLIGATION OF THIRD PARTY ENTITIES.— 
(1) IN GENERAL.—In the event of a breach of 
security of a system maintained by a third party en-
tity that has been contracted to maintain or process 
data in electronic form containing sensitive person-
ally identifiable information on behalf of a covered 
entity who owns or possesses such data, the third 
party entity shall notify the covered entity of the 
breach of security. Upon receiving notification from 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
the third party entity, such covered entity shall pro-
vide the notification required under subsection (a). 
(2) NOTICE BY THIRD PARTY ENTITIES.—Noth-
ing in this subtitle shall prevent or abrogate an 
agreement between a covered entity required to give 
notice under this section and a third party entity 
that has been contracted to maintain or process data 
in electronic form containing sensitive personally 
identifiable information for a covered entity, to pro-
vide the notifications required under subsection (a). 
(3) SERVICE PROVIDERS.—If a service provider 
becomes aware of a security breach containing sen-
sitive personally identifiable information that is 
owned or possessed by a covered entity that connects 
to or uses a system or network provided by the serv-
ice provider for the purpose of transmitting, routing, 
or providing intermediate or transient storage of 
such data, the service provider shall be required to 
promptly notify the covered entity who initiated such 
connection, transmission, routing, or storage of the 
security breach if the covered entity can be reason-
ably identified. Upon receiving such notification 
from a service provider, the covered entity shall be 
required to provide the notification required under 
subsection (a). 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made as expediently as 
possible and without unreasonable delay following 
the discovery by the covered entity of a security 
breach. 
(2) REASONABLE
DELAY.—Reasonable delay 
under this subsection may include any reasonable 
time necessary to determine the scope of the security 
breach, prevent further disclosures, and provide no-
tice to law enforcement when required. Except as 
provided in subsection (d), delay of notification shall 
not exceed 30 days following the discovery of a secu-
rity breach. 
(3) BURDEN
OF
PRODUCTION.—The covered 
entity required to provide notice under this subtitle 
shall, upon the request of the Attorney General of 
the United States or the Federal Trade Commission 
provide records or other evidence of the notifications 
required under this subtitle, including to the extent 
applicable, the reasons for any delay of notification. 
(d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT OR NATIONAL SECURITY PURPOSES.— 
(1) IN GENERAL.—If a Federal law enforce-
ment agency or intelligence agency determines that 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
the notification required under this section would 
impede a criminal investigation, or national security 
activity, such notification shall be delayed upon writ-
ten notice from a Federal law enforcement agency or 
intelligence agency to the covered entity that experi-
enced the security breach. The notification from a 
Federal law enforcement agency or intelligence agen-
cy shall specify in writing the period of delay re-
quested for law enforcement or national security 
purposes. 
(2) EXTENDED DELAY OF NOTIFICATION.—If 
the notification required under subsection (a) is de-
layed pursuant to paragraph (1), a covered entity 
shall give notice 15 days after the day such law en-
forcement or national security delay was invoked un-
less a Federal law enforcement or intelligence agency 
provides written notification that further delay is 
necessary. 
(3) LAW ENFORCEMENT IMMUNITY.—No non- 
constitutional cause of action shall lie in any court 
against any agency for acts relating to the delay of 
notification for law enforcement or national security 
purposes under this subtitle. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(e) LIMITATIONS.—Notwithstanding any other obli-
gation under this subtitle, this subtitle does not apply to 
the following: 
(1) FINANCIAL INSTITUTIONS.—Financial insti-
tutions— 
(A) subject to and in compliance with the 
data security requirements and standards under 
section 501(b) of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6801(b)); and 
(B) subject to the jurisdiction of an agency 
or authority described in section 505(a) of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)). 
(2) HIPAA AND
HITECH
REGULATED
ENTI-
TIES.—An entity that is subject to and in compli-
ance with the data breach notification of the fol-
lowing, with respect to data that is subject to such 
requirements: 
(A) Section 13401 of the Health Informa-
tion Technology for Economic and Clinical 
Health Act (42 U.S.C. 17931). 
(B) Part 160 or 164 of title 45, Code of 
Federal Regulations (or any successor regula-
tions). 
(C) The regulations promulgated under 
section 264(c) of the Health Insurance Port-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
ability and Accountability Act of 1996 (42 
U.S.C. 1320d–2 note). 
(D) In the case of a business entity, the 
applicable data breach notification requirements 
of part 1 of subtitle D of title XIII of division 
A of the American Reinvestment and Recovery 
Act of 2009 (42 U.S.C. 17931 et seq.), if such 
business entity is acting as a covered entity, a 
business associate, or a vendor of personal 
health records, as those terms are defined in 
section 13400 of the Health Information Tech-
nology for Economic and Clinical Health Act 
(42 U.S.C. 17921). 
(E) In the case of and third party service 
provider, section 13407 of the Health Informa-
tion Technology for Economic and Clinical 
Health Act (42 U.S.C. 17937). 
SEC. 212. EXEMPTIONS. 
(a) NATIONAL SECURITY AND LAW ENFORCEMENT 
EXEMPTION.— 
(1) IN GENERAL.—Section 211 shall not apply 
to a covered entity if a Federal law enforcement 
agency or intelligence agency— 
(A) determines that notification of the se-
curity breach— 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(i) could be expected to reveal sen-
sitive sources and methods or similarly im-
pede the ability of the Government to con-
duct law enforcement investigations; or 
(ii) could be expected to cause damage 
to the national security; 
(B) communicates the determination made 
under subparagraph (A) to the covered entity; 
and 
(C) orders that notification required under 
section 211 not be made. 
(2) IMMUNITY.—No non-constitutional cause of 
action shall lie in any court against any Federal 
agency for acts relating to the exemption from noti-
fication for law enforcement or national security 
purposes under this title. 
(b) SAFE HARBOR EXEMPTION.—A covered entity 
shall be exempt from the notice requirements under sec-
tion 211 if the covered entity reasonably determines that 
sensitive personally identifiable information is rendered 
unusable, unreadable, or indecipherable through data se-
curity technology or methodology, including encryption or 
redaction, that is generally accepted by experts in the field 
of information security, such that there is no reasonable 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
likelihood that a security breach has resulted in, or will 
result in, the misuse of data. 
SEC. 213. METHODS OF NOTICE. 
A covered entity shall be in compliance with section 
211 if it provides the following: 
(1) INDIVIDUAL NOTICE.—Notice to individuals 
by 1 of the following means if the method of notifi-
cation selected can most likely be expected to reach 
the intended individual: 
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the covered entity. 
(B) Telephone notice to the individual per-
sonally, provided that the telephone notice is 
made directly to each affected consumer, and is 
not made through a prerecorded message. 
(C) E-mail notice, if— 
(i)(I) the covered entity’s primary 
method of communication with the indi-
vidual is by e-mail; or 
(II) the individual has consented to 
receive such notice and the notice is con-
sistent with the provisions permitting elec-
tronic transmission of notices under sec-
tion 101 of the Electronic Signatures in 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
Global and National Commerce Act (15 
U.S.C. 7001); and 
(ii) the e-mail notice does not request, 
or contain a hypertext link to a request, 
that the consumer provide personal infor-
mation in response to the notice. 
(2) MEDIA
AND
WEBSITE
NOTICE.—In the 
event notice is required to more than 5,000 individ-
uals in 1 State and individual notice is not feasible 
due to lack of sufficient contact information for the 
individuals required to be notified, a covered entity 
shall— 
(A) provide notice to the major media out-
lets serving the State or jurisdiction of the indi-
viduals believed to be affected; and 
(B) place notice in a clear and conspicuous 
place on the website of the covered entity if the 
covered entity operates a website. 
SEC. 214. CONTENT OF NOTIFICATION. 
(a) IN GENERAL.—Regardless of the method by 
which notice is provided to individuals under section 213, 
such notice shall include, to the extent possible— 
(1) a general description of the incident and the 
date or estimated date of the security breach and 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
the date range during which the sensitive personally 
identifiable information was compromised; 
(2) a description of the categories of sensitive 
personally identifiable information that was, or is 
reasonably believed to have been, accessed or ac-
quired by an unauthorized person; 
(3) the acts the covered entity, or the agent of 
the covered entity, has taken to protect sensitive 
personally identifiable information from further se-
curity breach; 
(4) a toll-free number— 
(A) that the individual may use to contact 
the covered entity, or the agent of the covered 
entity; and 
(B) from which the individual may learn 
what types of sensitive personally identifiable 
information the covered entity maintained about 
that individual; and 
(5) the toll-free contact telephone numbers and 
addresses for the major credit reporting agencies if 
the sensitive personally identifiable information that 
was breached could be used to commit financial 
fraud or identity theft. 
(b) DIRECT BUSINESS RELATIONSHIP.—Regardless 
of whether a covered entity or a designated third party 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
provides the notice required pursuant to section 211(b), 
such notice shall include the name of the covered entity 
that has the most direct relationship with the individual 
being notified. 
SEC. 215. COORDINATION OF NOTIFICATION WITH CREDIT 
REPORTING AGENCIES. 
If a covered entity is required to provide notification 
to more than 5,000 individuals under section 211(a) and 
the sensitive personally identifiable information that was 
breached could be used to commit financial fraud or iden-
tity theft, the covered entity shall also notify all consumer 
reporting agencies that compile and maintain files on con-
sumers on a nationwide basis (as defined in section 603(p) 
of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)) 
of the timing and distribution of the notices. Such notice 
shall be given to the consumer credit reporting agencies 
without unreasonable delay and, if it will not delay notice 
to the affected individuals, prior to the distribution of no-
tices to the affected individuals. 
SEC. 216. NOTICE TO THE FEDERAL TRADE COMMISSION. 
A covered entity required to provide notification 
under section 211(a) shall provide a copy of the notifica-
tion to the Federal Trade Commission not later than the 
date on which notice is provided to individuals required 
to be notified. The Federal Trade Commission shall estab-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
lish procedures to ensure the attorneys general of each 
State with affected residents receives a copy of the notice 
provided to it under this section. 
SEC. 217. NOTICE TO LAW ENFORCEMENT. 
(a) DESIGNATION OF GOVERNMENT ENTITY TO RE-
CEIVE NOTICE.— 
(1) IN GENERAL.—Not later than 60 days after 
the date of enactment of this Act, the Secretary of 
Homeland Security, in consultation with the Attor-
ney General, shall designate a Federal Government 
entity to receive the notices required under section 
211 and this section. 
(2) RESPONSIBILITIES
OF
THE
DESIGNATED 
ENTITY.—The designated entity shall— 
(A) promptly provide the information that 
it receives to the United States Secret Service 
or the Federal Bureau of Investigation for law 
enforcement purposes; and 
(B) provide the information described in 
subparagraph (A) as appropriate to other Fed-
eral agencies for law enforcement, national se-
curity, or data security purposes. 
(b) NOTICE.—A covered entity shall notify the des-
ignated entity of the fact that a security breach has oc-
curred if— 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(1) the number of individuals whose sensitive 
personally identifying information was, or is reason-
ably believed to have been, accessed or acquired by 
an unauthorized person exceeds 5,000; 
(2) the security breach involves a database, 
networked or integrated databases, or other data 
system containing the sensitive personally identifi-
able information of more than 500,000 individuals 
nationwide; 
(3) the security breach involves databases 
owned by the Federal Government; or 
(4) the security breach involves primarily sen-
sitive personally identifiable information of individ-
uals known to the covered entity to be employees 
and contractors of the Federal Government involved 
in national security or law enforcement. 
(c) DEPARTMENT OF JUSTICE REVIEW OF THRESH-
OLDS FOR NOTICE.—The Attorney General, in consulta-
tion with the Secretary of Homeland Security, after notice 
and the opportunity for public comment, and in a manner 
consistent with this section, shall promulgate regulations, 
as necessary, under section 553 of title 5, United States 
Code, to adjust the thresholds for notice to law enforce-
ment and national security authorities under subsection 
(a) and to facilitate the purposes of this section. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(d) TIMING.—The notice required under subsection 
(b) shall be provided as promptly as possible, but such 
notice must be provided not less than 72 hours before no-
tice is provided to an individual pursuant to section 211, 
or not later than 10 days after the discovery of the events 
requiring notice, whichever occurs first. For each breach 
requiring notice under this subsection, a copy of the notice 
to individuals required under section 211 shall also be pro-
vided to the designated entity not later than the date on 
which the notice is provided to affected individuals. 
SEC. 218. FEDERAL ENFORCEMENT. 
(a) IN GENERAL.—The Attorney General and the 
Federal Trade Commission may enforce civil violations of 
this subtitle. 
(b) CIVIL ACTIONS BY THE ATTORNEY GENERAL OF 
THE UNITED STATES.— 
(1) IN GENERAL.—The Attorney General may 
bring a civil action in the appropriate United States 
district court against any covered entity that en-
gages in conduct constituting a violation of this sub-
title and, upon proof of such conduct by a prepon-
derance of the evidence, the covered entity shall be 
subject to a civil penalty in an amount not greater 
than the product of the number of violations of this 
subtitle and $16,500. Each failure to provide notifi-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
cation to an individual as required under this sub-
title shall be treated as a separate violation. 
(2) PENALTY
LIMITATION.—Notwithstanding 
any other provision of law, the total amount of the 
civil penalty assessed against a covered entity for 
conduct involving the same or related acts or omis-
sions that results in a violation of this subtitle may 
not exceed $5,000,000, unless such conduct is found 
to be willful or intentional. 
(3) DETERMINATIONS.—The determination of 
whether a violation of a provision of this subtitle has 
occurred, and if so, the amount of the penalty to be 
imposed, if any, shall be made by the court sitting 
as the finder of fact. The determination of whether 
a violation of a provision of this subtitle was willful 
or intentional, and if so, the amount of the addi-
tional penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. 
(4) ADDITIONAL PENALTY LIMIT.—If a court 
determines under paragraph (3) that a violation of 
a provision of this subtitle was willful or intentional 
and imposes an additional penalty, the court may 
not impose an additional penalty in an amount that 
exceeds $5,000,000. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(c) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN-
ERAL.— 
(1) IN GENERAL.—If it appears that a covered 
entity has engaged, or is engaged, in any act or 
practice constituting a violation of this subtitle, the 
Attorney General may petition an appropriate dis-
trict court of the United States for an order— 
(A) enjoining such act or practice; or 
(B) enforcing compliance with this subtitle. 
(2) ISSUANCE OF ORDER.—A court may issue 
an order under paragraph (1), if the court finds that 
the conduct in question constitutes a violation of this 
subtitle. 
(d) CIVIL ACTIONS BY THE FEDERAL TRADE COM-
MISSION.— 
(1) IN GENERAL.—Compliance with the require-
ments imposed under this subtitle may be enforced 
under the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) by the Federal Trade Commission 
with respect to business entities subject to this Act. 
All of the functions and powers of the Federal Trade 
Commission under the Federal Trade Commission 
Act are available to the Commission to enforce com-
pliance by any person with the requirements imposed 
under this title. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(2) CIVIL PENALTIES.— 
(A) IN GENERAL.—Any covered entity that 
violates this subtitle shall be subject to a civil 
penalty in the amount that is not greater than 
the product of the number of violations of this 
subtitle and $16,500. Each failure to provide 
notification to an individual as required under 
this subtitle shall be treated as a separate viola-
tion. 
(B) 
PENALTY
LIMITATION.—Notwith-
standing any other provision of law, the total 
sum of civil penalties assessed against a covered 
entity for all violations of the provisions of this 
subtitle resulting from the same or related acts 
or omissions may not exceed $5,000,000, unless 
such conduct is found to be willful or inten-
tional. 
(C) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
and if so, the amount of the additional penalty 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(D) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (C) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $5,000,000. 
(3) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—For the purpose of the exercise by the Fed-
eral Trade Commission of its functions and powers 
under the Federal Trade Commission Act, a viola-
tion of any requirement or prohibition imposed 
under this title shall constitute an unfair or decep-
tive act or practice in commerce in violation of a 
regulation under section 18(a)(1)(B) of the Federal 
Trade Commission Act (15 U.S.C. 57a(a)(I)(B)) re-
garding unfair or deceptive acts or practices and 
shall be subject to enforcement by the Federal Trade 
Commission under that Act with respect to any busi-
ness entity, irrespective of whether that business en-
tity is engaged in commerce or meets any other ju-
risdictional tests in the Federal Trade Commission 
Act. 
(e) COORDINATION OF ENFORCEMENT.— 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(1) IN GENERAL.—When opening an investiga-
tion, the Federal Trade Commission shall consult 
with the Attorney General. 
(2) LIMITATION.—The Federal Trade Commis-
sion may initiate investigations under this subsection 
unless the Attorney General determines that such an 
investigation would impede an ongoing criminal in-
vestigation or national security activity. 
(3) COORDINATION AGREEMENT.— 
(A) IN GENERAL.—In order to avoid con-
flicts and promote consistency regarding the en-
forcement and litigation of matters under this 
Act, not later than 180 days after the enact-
ment of this Act, the Attorney General and the 
Federal Trade Commission shall enter into an 
agreement for coordination regarding the en-
forcement of this Act. 
(B) 
REQUIREMENT.—The 
coordination 
agreement entered into under subparagraph (A) 
shall include provisions to ensure that parallel 
investigations and proceedings under this sec-
tion are conducted in a manner that avoids con-
flicts and does not impede the ability of the At-
torney General to prosecute violations of Fed-
eral criminal laws. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(f) RULEMAKING.—The Federal Trade Commission 
may, in consultation with the Attorney General, issue such 
other regulations as it determines to be necessary to carry 
out this subtitle. All regulations promulgated under this 
Act shall be issued in accordance with section 553 of title 
5, United States Code. 
(g) OTHER RIGHTS AND REMEDIES.—The rights and 
remedies available under this subtitle are cumulative and 
shall not affect any other rights and remedies available 
under law. 
(h) FRAUD ALERT.—Section 605A(b)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 
amended by inserting ‘‘, or evidence that the consumer 
has received notice that the consumer’s financial informa-
tion has or may have been compromised,’’ after ‘‘identity 
theft report’’. 
SEC. 219. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.— 
(1) CIVIL ACTIONS.— 
(A) IN GENERAL.—In any case in which 
the attorney general of a State or any State or 
local law enforcement agency authorized by the 
State attorney general or by State statute to 
prosecute violations of consumer protection law, 
has reason to believe that a covered entity has 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
violated this subtitle, the State, as parens 
patriae, may bring a civil action on behalf of 
the residents of the State to— 
(i) enjoin that practice; 
(ii) enforce compliance with this sub-
title; or 
(iii) impose a civil penalty in an 
amount not greater than the product of 
the number of violations of this subtitle 
and $16,500. 
(B) FAILURE
TO
PROVIDE
NOTIFICA-
TION.—For purposes of subparagraph (A)(iii), 
each failure to provide notification to an indi-
vidual as required under this subtitle shall be 
treated as a separate violation. 
(2) PENALTY LIMITATION.— 
(A) IN
GENERAL.—Notwithstanding any 
other provision of law, the total sum of civil 
penalties assessed against a covered entity for 
all violations of the provisions of this subtitle 
resulting from the same or related acts or omis-
sions may not exceed $5,000,000, unless such 
conduct is found to be willful or intentional. 
(B) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
and if so, the amount of the additional penalty 
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(C) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (B) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $5,000,000. 
(3) NOTICE.— 
(A) IN GENERAL.—Before filing an action 
under paragraph (1), the attorney general of 
the State involved shall provide to the Attorney 
General of the United States and the Federal 
Trade Commission— 
(i) written notice of the action; and 
(ii) a copy of the complaint for the ac-
tion. 
(B) EXEMPTION.— 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(i) IN GENERAL.—Subparagraph (A) 
shall not apply with respect to the filing of 
an action by an attorney general of a State 
under this subtitle, if the State attorney 
general determines that it is not feasible to 
provide the notice described in such sub-
paragraph before the filing of the action. 
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general 
of a State shall provide notice and a copy 
of the complaint to the Attorney General 
of the United States and the Federal 
Trade Commission at the time the State 
attorney general files the action. 
(b) FEDERAL PROCEEDINGS.—Upon receiving notice 
under subsection (a)(2), the Attorney General and the 
Federal Trade Commission shall have the right to— 
(1) move to stay the action, pending the final 
disposition of a pending Federal proceeding or ac-
tion; 
(2) initiate an action in the appropriate United 
States district court under section 218 and move to 
consolidate all pending actions, including State ac-
tions, in such court; 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(3) intervene in an action brought under sub-
section (a)(2); and 
(4) file petitions for appeal. 
(c) PENDING PROCEEDINGS.—If the Attorney Gen-
eral or the Federal Trade Commission initiates a criminal 
proceeding or civil action for a violation of a provision of 
this subtitle, or any regulations thereunder, no attorney 
general of a State may bring an action for a violation of 
a provision of this subtitle against a defendant named in 
the Federal criminal proceeding or civil action. 
(d) CONSTRUCTION.—For purposes of bringing any 
civil action under subsection (a), nothing in this subtitle 
regarding notification shall be construed to prevent an at-
torney general of a State from exercising the powers con-
ferred on such attorney general by the laws of that State 
to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
(f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 
subtitle establishes a private cause of action against a 
business entity for violation of any provision of this sub-
title. 
SEC. 220. EFFECT ON FEDERAL AND STATE LAW. 
(a) PREEMPTION.—For a covered entity that is sub-
ject to this subtitle, the provisions of this subtitle shall 
supersede any other provision of Federal law, or any provi-
sions of the law of any State or political subdivision of 
a State requiring notification of a security breach of sen-
sitive personally identifiable information that are less 
stringent than the requirements of this subtitle. 
(b) CONSUMER PROTECTION LAWS.—Except as pro-
vided in subsection (a), this section shall not be construed 
to limit the enforcement of any State consumer protection 
law by an attorney general of a State. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(c) PROTECTION OF CERTAIN STATE LAWS.—Noth-
ing in this Act shall be construed to preempt the applica-
bility of— 
(1) State trespass, contract, or tort law; or 
(2) any other State law to the extent that the 
law relates to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit the au-
thority of the Federal Trade Commission under any other 
provision of law. 
(e) PRESERVATION OF FCC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit the au-
thority of the Federal Communications Commission under 
any other provision of law. 
SEC. 221. REPORTING ON EXEMPTIONS. 
Not later than 18 months after the date of enactment 
of this Act, and upon the request by Congress thereafter, 
the Attorney General, in consultation with the Secretary 
of Homeland Security, shall submit a report to Congress 
on the number and nature of security breaches subject to 
the national security and law enforcement exemptions 
under section 212(a). 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
SEC. 222. EFFECTIVE DATE. 
This subtitle shall take effect on the expiration of the 
date that is 90 days after the date of enactment of this 
Act. 
TITLE III—COMPLIANCE WITH 
STATUTORY PAY-AS-YOU-GO ACT 
SEC. 301. BUDGET COMPLIANCE. 
The budgetary effects of this Act, for the purpose of 
complying with the Statutory Pay-As-You-Go Act of 2010, 
shall be determined by reference to the latest statement 
titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 
Act, submitted for printing in the Congressional Record 
by the Chairman of the Senate Budget Committee, pro-
vided that such statement has been submitted prior to the 
vote on passage. 
Æ 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6301
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS