(B) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
Index is first published by the Bureau of Labor 
Statistics that is after 1 year after the date of 
enactment of this Act, and each year thereafter, 
the amounts specified in clauses (i) and (ii) of 
subparagraph (A) shall be increased by the per-
centage increase in the Consumer Price Index 
published on that date from the Consumer 
Price Index published the previous year. 
(C) MAXIMUM
TOTAL
LIABILITY.—Not-
withstanding the number of actions which may 
be brought against a person under this sub-
section the maximum civil penalty for which 
any person may be liable under this subsection 
shall not exceed— 
(i) $5,000,000 for each violation of 
section 2; and 
(ii) $5,000,000 for all violations of 
section 3 resulting from a single breach of 
security. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission
and provide the Commission with a copy of its 
complaint, except in any case in which such 
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to—
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(d) AFFIRMATIVE DEFENSE FOR A VIOLATION OF 
SECTION 3.— 
(1) IN GENERAL.—It shall be an affirmative de-
fense to an enforcement action brought under sub-
section (b), or a civil action brought under sub-
section (c), based on a violation of section 3, that all 
of the personal information contained in the data in 
electronic form that was acquired or accessed as a 
result of a breach of security of the defendant is 
public record information that is lawfully made 
available to the general public from Federal, State, 
or local government records and was acquired by the 
defendant from such records. 
(2) NO EFFECT ON OTHER REQUIREMENTS.— 
Nothing in this subsection shall be construed to ex-
empt any person from the requirement to notify the 
Commission of a breach of security as required 
under section 3(a). 
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply:
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means unauthorized access to or acqui-
sition of data in electronic form containing personal 
information. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
essary to enable decryption of such data. Such 
encryption must include appropriate management 
and safeguards of such keys to protect the integrity 
of the encryption. 
(5) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personal information for the purpose of engag-
ing in commercial transactions under the name of 
such other person. 
(6) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’— 
(A) means a commercial entity whose busi-
ness is to collect, assemble, or maintain per-
sonal information concerning individuals who 
are not current or former customers of such en-
tity in order to sell such information or provide 
access to such information to any nonaffiliated 
third party in exchange for consideration, 
whether such collection, assembly, or mainte-
nance of personal information is performed by 
the information broker directly, or by contract 
or subcontract with any other entity; and 
(B) does not include a commercial entity to 
the extent that such entity processes informa-
tion collected by or on behalf of and received 
from or on behalf of a nonaffiliated third party 
concerning individuals who are current or 
former customers or employees of such third 
party to enable such third party directly or 
through parties acting on its behalf to: (1) pro-
vide benefits for its employees; or (2) directly 
transact business with its customers.
(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
initial and last name, or address, or phone 
number, in combination with any 1 or more of 
the following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number, passport 
number, military identification number, or 
other similar number issued on a govern-
ment document used to verify identity. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
word that is necessary to permit access to 
an individual’s financial account. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A)— 
(i) for the purpose of section 2 to the 
extent that such modification will not un-
reasonably impede interstate commerce,