electronic data, is not the sender or the intended re-
cipient of the data, and the business entity trans-
mits, routes, or provides connections for sensitive 
personally identifiable information in a manner that 
sensitive personally identifiable information is undif-
ferentiated from other types of data that such busi-
ness entity transmits, routes, or provides connec-
tions. Any such business entity shall be treated as 
a service provider under this Act only to the extent 
that it is engaged in the provision of such trans-
mission, routing, intermediate and transient storage 
or connections. 
TITLE I—PUNISHMENT FOR CON-
CEALMENT 
OF 
SECURITY 
BREACHES AND TOOLS TO 
COMBAT CYBERCRIME 
SEC. 101. CONCEALMENT OF SECURITY BREACHES INVOLV-
ING SENSITIVE PERSONALLY IDENTIFIABLE 
INFORMATION. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
‘‘§ 1041. Concealment of security breaches involving 
sensitive personally identifiable informa-
tion 
‘‘(a) IN GENERAL.—Whoever, having knowledge of a 
security breach and of the fact that notice of such security 
breach is required under title II of the Consumer Privacy 
Protection Act of 2015, intentionally and willfully conceals 
the fact of such security breach, shall, in the event that 
such security breach results in economic harm to any indi-
vidual in the amount of $1,000 or more, be fined under 
this title or imprisoned for not more than 5 years, or both. 
‘‘(b) PERSON DEFINED.—For purposes of subsection 
(a), the term ‘person’ has the meaning given the term in 
section 1030(e)(12).’’. 
(b) CONFORMING AND TECHNICAL AMENDMENTS.— 
The table of sections for chapter 47 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
‘‘1041. Concealment of security breaches involving sensitive personally identifi-
able information.’’. 
(c) ENFORCEMENT AUTHORITY.— 
(1) IN
GENERAL.—The United States Secret 
Service and Federal Bureau of Investigation shall 
have the authority to investigate offenses under sec-
tion 1041 of title 18, United States Code, as added 
by subsection (a). 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(2) NONEXCLUSIVITY.—The authority granted 
in paragraph (1) shall not be exclusive of any exist-
ing authority held by any other Federal agency. 
SEC. 102. REPORTING OF CERTAIN CYBERCRIMES. 
Section 1030 of title 18, United States Code, is 
amended by striking subsection (h) and inserting the fol-
lowing: 
‘‘(h) REPORTING CERTAIN CRIMINAL CASES.—Not 
later than 1 year after the date of the enactment of this 
subsection, and annually thereafter, the Attorney General 
shall report to the Committee on the Judiciary of the Sen-
ate and the Committee on the Judiciary of the House of 
Representatives the number of criminal cases brought 
under subsection (a) that involve conduct in which— 
‘‘(1) the defendant— 
‘‘(A) exceeded authorized access to a non- 
governmental computer; or 
‘‘(B) accessed a non-governmental com-
puter without authorization; and 
‘‘(2) the sole basis for the Government deter-
mining that access to the non-governmental com-
puter was unauthorized, or in excess of authoriza-
tion, was that the defendant violated a contractual 
obligation or agreement with a service provider or 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
employer, such as an acceptable use policy or terms 
of service agreement.’’. 
SEC. 103. AUTHORITY TO SHUT DOWN BOTNETS. 
(a) AMENDMENT.—Section 1345 of title 18, United 
States Code, is amended— 
(1) in the heading, by inserting ‘‘and abuse’’ 
after ‘‘fraud’’; 
(2) in subsection (a)— 
(A) in paragraph (1)— 
(i) in subparagraph (B), by striking 
‘‘or’’ at the end; 
(ii) in subparagraph (C), by inserting 
‘‘or’’ after the semicolon; and 
(iii) by inserting after subparagraph 
(C) the following: 
‘‘(D) violating section 1030(a)(5) where such 
conduct would damage (as defined in section 1030), 
100 or more protected computers (as defined in sec-
tion 1030) during any 1-year period, including by 
denying access to or operation of the computers, in-
stalling unwanted software on the computers, using 
the computers without authorization, or obtaining 
information from the computers without authoriza-
tion;’’; and 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(B) in paragraph (2), by inserting ‘‘, a vio-
lation of section 1030(a)(5) as described in sub-
section (a)(1)(D),’’ before ‘‘or a Federal’’; 
(3) in subsection (b), by adding ‘‘, except in the 
case of a person violating section 1030(a)(5) in the 
manner described in subsection (a)(1)(D),’’ before 
‘‘take such other action’’; and 
(4) by adding at the end the following: 
‘‘(c) A restraining order or prohibition described in 
subsection (b), if issued in circumstances described in sub-
section (a)(1)(D)— 
‘‘(1) may only authorize action that solely af-
fects persons violating section 1030 in the manner 
described in subsection (a)(1)(D); and 
‘‘(2) may, upon application of the Attorney 
General— 
‘‘(A) specify that no cause of action shall 
lie in any court against a person for complying 
with the restraining order, prohibition, or other 
action; and 
‘‘(B) provide that the United States shall 
pay to such person a fee for reimbursement for 
such costs as are reasonably necessary and 
which have been directly incurred in complying 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
with the restraining order, prohibition, or other 
action. 
‘‘(d) There are authorized to be appropriated to the 
Department of Justice, the Department of Homeland Se-
curity, and the Department of the Treasury such sums 
as are necessary to implement this section, including pay-
ments made by the United States of a fee for reimburse-
ment.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of section for chapter 63 is amended by striking 
the item relating to section 1345 and inserting the fol-
lowing: 
‘‘1345. Injunctions against fraud and abuse.’’. 
SEC. 104. DETERRING THE DEVELOPMENT AND SALE OF 
COMPUTER AND CELL PHONE SPYING DE-
VICES. 
Section 1956(c)(7)(D) of title 18, United States 
Code, is amended by inserting ‘‘section 2512 (relating to 
the manufacture, distribution, possession, and advertising 
of wire, oral, or electronic communication intercepting de-
vices),’’ before ‘‘section 46502’’. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
TITLE II—CONSUMER PRIVACY 
AND SECURITY OF SENSITIVE 
PERSONALLY 
IDENTIFIABLE 
INFORMATION 
Subtitle A—Consumer Privacy and 
Data Security Program 
SEC. 201. PURPOSE AND APPLICABILITY OF CONSUMER 
PRIVACY AND DATA SECURITY PROGRAM. 
(a) PURPOSE.—The purpose of this subtitle is to en-
sure standards for developing and implementing adminis-
trative, technical, and physical safeguards to protect the 
security of sensitive personally identifiable information. 
(b) APPLICABILITY.—A covered entity engaging in 
interstate commerce that collects, uses, accesses, trans-
mits, stores, or disposes of sensitive personally identifiable 
information in electronic or digital form of not less than 
10,000 United States persons during any 12-month period 
is subject to the requirements for a consumer privacy and 
data security program for protecting sensitive personally 
identifiable information. 
(c) LIMITATIONS.—Notwithstanding any other obli-
gation under this subtitle, this subtitle does not apply to 
the following: 
(1) FINANCIAL INSTITUTIONS.—Financial insti-
tutions— 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(A) subject to and in compliance with the 
data security requirements and standards under 
section 501(b) of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6801(b)); and 
(B) subject to the jurisdiction of an agency 
or authority described in section 505(a) of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)). 
(2) HIPAA AND
HITECH
REGULATED
ENTI-
TIES.—An entity that is subject to and in compli-
ance with the data security requirements of the fol-
lowing, with respect to data that is subject to such 
requirements: 
(A) Section 13401 of the Health Informa-
tion Technology for Economic and Clinical 
Health Act (42 U.S.C. 17931). 
(B) Part 160 or 164 of title 45, Code of 
Federal Regulations (or any successor regula-
tions). 
(C) The regulations promulgated under 
section 264(c) of the Health Insurance Port-
ability and Accountability Act of 1996 (42 
U.S.C. 1320d–2 note). 
(D) In the case of a business associate, as 
defined in section 13400 of the Health Informa-
tion Technology for Economic and Clinical 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
Health Act (42 U.S.C. 17921), the applicable 
privacy and data security requirements of part 
1 of subtitle D of title XIII of division A of the 
American Reinvestment and Recovery Act of 
2009 (42 U.S.C. 17931 et seq.). 
(3) SERVICE
PROVIDERS.—A service provider 
for any electronic communication by a third-party, 
to the extent that the service provider is engaged 
solely in the transmission, routing, or temporary, in-
termediate, or transient storage of that communica-
tion. 
SEC. 202. REQUIREMENTS FOR CONSUMER PRIVACY AND 
DATA SECURITY PROGRAM. 
(a) CONSUMER PRIVACY AND DATA SECURITY PRO-
GRAM.—A covered entity subject to this subtitle shall com-
ply with the following safeguards and any other adminis-
trative, technical, or physical safeguards identified by the 
Federal Trade Commission in a rulemaking process pursu-
ant to section 553 of title 5, United States Code, for the 
protection of sensitive personally identifiable information: 
(1) SCOPE.—A covered entity shall implement a 
comprehensive consumer privacy and data security 
program that includes administrative, technical, and 
physical safeguards appropriate to the size and com-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
plexity, and the nature and scope, of the activities 
of the covered entity. 
(2) DESIGN.—The consumer privacy and data 
security program shall be designed to— 
(A) ensure the privacy and security of sen-
sitive personally identifying information; 
(B) 
protect 
against 
any 
anticipated 
vulnerabilities to the privacy and security of 
sensitive personally identifying information; and 
(C) protect against unauthorized access, 
acquisition, disclosure, or use of sensitive per-
sonally identifying information. 
(3) RISK
ASSESSMENT.—A covered entity 
shall— 
(A) identify reasonably foreseeable internal 
and external vulnerabilities and internal and ex-
ternal threats that could result in unauthorized 
access, disclosure, or use of sensitive personally 
identifiable information or of systems con-
taining sensitive personally identifiable informa-
tion; 
(B) assess the likelihood of and potential 
damage from unauthorized access, acquisition, 
disclosure, or use of sensitive personally identi-
fiable information; 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(C) assess the sufficiency of its technical, 
physical, and administrative controls in place to 
control and minimize risks from unauthorized 
access, acquisition, disclosure, or use of sen-
sitive personally identifiable information; and 
(D) assess the vulnerability of sensitive 
personally identifiable information during de-
struction and disposal of such information, in-
cluding through the disposal or retirement of 
hardware. 
(4) RISK MANAGEMENT AND CONTROL.—Each 
covered entity shall— 
(A) design its consumer privacy and data 
security program to control the risks identified 
under paragraph (3); 
(B) adopt measures commensurate with 
the sensitivity of the data as well as the size, 
complexity, nature, and scope of the activities 
of the covered entity that— 
(i) controls access to sensitive person-
ally identifiable information, including con-
trols to authenticate and permit access 
only to authorized individuals; 
(ii) detect, record, and preserve infor-
mation relevant to actual and attempted 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
fraudulent, unlawful, or unauthorized ac-
cess, acquisition, disclosure, or use of sen-
sitive personally identifiable information, 
including by employees and other individ-
uals otherwise authorized to have access; 
(iii) protect sensitive personally identi-
fiable information during use, trans-
mission, 
storage, 
and 
disposal 
by 
encryption, redaction, disclosure limitation 
methodologies, or access controls, that are 
widely accepted as an effective industry 
practice or industry standard, or other rea-
sonable means; 
(iv) ensure that sensitive personally 
identifiable information is properly de-
stroyed and disposed of, including during 
the destruction of computers and other 
electronic media that contain sensitive per-
sonally identifiable information; and 
(v) ensure that no third party is au-
thorized to access or acquire sensitive per-
sonally identifiable information in its pos-
session without the covered entity first per-
forming sufficient due diligence to ascer-
tain, with reasonable certainty, that such 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
information is being sought for a valid 
legal purpose; and 
(C) establish a plan and procedures for 
minimizing the amount of sensitive personally 
identifiable information maintained by the cov-
ered entity, which shall provide for the reten-
tion of sensitive personally identifiable informa-
tion only as reasonably needed for the business 
purposes of such business entity or as necessary 
to comply with any legal obligation. 
(5) LIMITATION.—Nothing in this subsection 
shall be construed to permit, and nothing does per-
mit, the Federal Trade Commission to issue regula-
tions requiring, or according greater legal status to, 
the implementation of or application of a specific 
technology or technological specifications for meeting 
the requirements of this title. 
(b) TRAINING.—Covered entities subject to this sub-
title shall take steps to ensure employee training and su-
pervision for implementation of the consumer privacy and 
data security program of the covered entity. 
(c) VULNERABILITY TESTING.— 
(1) IN GENERAL.—Covered entities subject to 
this subtitle shall take steps to ensure regular test-
ing of key technical, physical, and administrative 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
controls for information and information systems of 
the consumer privacy and data security program to 
detect, prevent, and respond to attacks or intrusions, 
or other system failures. 
(2) FREQUENCY.—The frequency and nature of 
the tests required under paragraph (1) shall be de-
termined by the risk assessment of the covered enti-
ty under subsection (a)(3). 
(d) RELATIONSHIP
TO CERTAIN PROVIDERS
OF 
SERVICES.—In the event a covered entity subject to this 
subtitle engages a person or entity not subject to this sub-
title (other than a service provider) to receive sensitive 
personally identifiable information in performing services 
or functions (other than the services or functions provided 
by a service provider) on behalf of and under the instruc-
tion of such covered entity, the covered entity shall— 
(1) exercise appropriate due diligence in select-
ing the person or entity for responsibilities related to 
sensitive personally identifiable information, and 
take reasonable steps to select and retain a person 
or entity that is capable of maintaining appropriate 
controls for the privacy and security of the sensitive 
personally identifiable information at issue; and 
(2) require the person or entity by contract to 
implement and maintain appropriate measures de-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
signed to meet the objectives and requirements gov-
erning subtitle A. 
(e) PERIODIC ASSESSMENT AND CONSUMER PRIVACY 
AND DATA SECURITY MODERNIZATION.—Each covered 
entity subject to this subtitle shall on a regular basis mon-
itor, evaluate, and adjust, as appropriate its consumer pri-
vacy and data security program in light of any relevant 
changes in— 
(1) technology; 
(2) 
internal 
or 
external 
threats 
and 
vulnerabilities to sensitive personally identifiable in-
formation; and 
(3) the changing business arrangements of the 
covered entity, such as— 
(A) mergers and acquisitions; 
(B) alliances and joint ventures; 
(C) outsourcing arrangements; 
(D) bankruptcy; and 
(E) changes to sensitive personally identifi-
able information systems. 
(f) IMPLEMENTATION TIMELINE.—Not later than 1 
year after the date of enactment of this Act, a covered 
entity subject to the provisions of this subtitle shall imple-
ment a consumer privacy and data security program pur-
suant to this subtitle. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
SEC. 203. FEDERAL ENFORCEMENT. 
(a) IN GENERAL.—The Attorney General and the 
Federal Trade Commission may enforce civil violations of 
section 201 or 202. 
(b) CIVIL ACTIONS BY THE ATTORNEY GENERAL OF 
THE UNITED STATES.— 
(1) IN GENERAL.—The Attorney General may 
bring a civil action in the appropriate United States 
district court against any covered entity that en-
gages in conduct constituting a violation of this sub-
title and, upon proof of such conduct by a prepon-
derance of the evidence, such covered entity shall be 
subject to a civil penalty in an amount that is not 
greater than the product of the number of individ-
uals whose sensitive personally identifiable informa-
tion was placed at risk as a result of the violation 
and $16,500. 
(2) PENALTY
LIMITATION.—Notwithstanding 
any other provision of law, the total amount of the 
civil penalty assessed against a covered entity for 
conduct involving the same or related acts or omis-
sions that results in a violation of this subtitle may 
not exceed $5,000,000, unless such conduct is found 
to be willful or intentional. 
(3) DETERMINATIONS.—The determination of 
whether a violation of a provision of this subtitle has 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
occurred, and if so, the amount of the penalty to be 
imposed, if any, shall be made by the court sitting 
as the finder of fact. The determination of whether 
a violation of a provision of this subtitle was willful 
or intentional, and if so, the amount of the addi-
tional penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. 
(4) ADDITIONAL PENALTY LIMIT.—If a court 
determines under paragraph (3) that a violation of 
a provision of this subtitle was willful or intentional 
and imposes an additional penalty, the court may 
not impose an additional penalty in an amount that 
exceeds $5,000,000. 
(c) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN-
ERAL.— 
(1) IN GENERAL.—If it appears that a covered 
entity has engaged, or is engaged, in any act or 
practice constituting a violation of this subtitle, the 
Attorney General may petition an appropriate dis-
trict court of the United States for an order— 
(A) enjoining such act or practice; or 
(B) enforcing compliance with this subtitle. 
(2) ISSUANCE OF ORDER.—A court may issue 
an order under paragraph (1), if the court finds that 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
the conduct in question constitutes a violation of this 
subtitle. 
(d) CIVIL ACTIONS BY THE FEDERAL TRADE COM-
MISSION.— 
(1) IN GENERAL.—Compliance with the require-
ments imposed under this subtitle may be enforced 
under the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) by the Federal Trade Commission 
with respect to business entities subject to this Act. 
All of the functions and powers of the Federal Trade 
Commission under the Federal Trade Commission 
Act are available to the Commission to enforce com-
pliance by any person with the requirements imposed 
under this title. 
(2) CIVIL PENALTIES.— 
(A) IN GENERAL.—Any covered entity that 
violates the provisions of this subtitle shall be 
subject to a civil penalty in the amount that is 
not greater than the product of the number of 
individuals whose sensitive personally identifi-
able information was placed at risk as a result 
of the violation and $16,500. 
(B) 
PENALTY
LIMITATION.—Notwith-
standing any other provision of law, the total 
amount of the civil penalty assessed against a 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
covered entity for conduct involving the same or 
related acts or omissions that results in a viola-
tion of this subtitle may not exceed $5,000,000, 
unless such conduct is found to be willful or in-
tentional. 
(C) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
and if so, the amount of the additional penalty 
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(D) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (C) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $5,000,000. 
(3) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—For the purpose of the exercise by the Fed-
eral Trade Commission of its functions and powers 
under the Federal Trade Commission Act, a viola-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
tion of any requirement or prohibition imposed 
under this title shall constitute an unfair or decep-
tive act or practice in commerce in violation of a 
regulation under section 18(a)(1)(B) of the Federal 
Trade Commission Act (15 U.S.C. 57a(a)(I)(B)) re-
garding unfair or deceptive acts or practices and 
shall be subject to enforcement by the Federal Trade 
Commission under that Act with respect to any busi-
ness entity, irrespective of whether that business en-
tity is engaged in commerce or meets any other ju-
risdictional tests in the Federal Trade Commission 
Act. 
(e) COORDINATION OF ENFORCEMENT.— 
(1) IN GENERAL.—When opening an investiga-
tion, the Federal Trade Commission shall consult 
with the Attorney General. 
(2) LIMITATION.—The Federal Trade Commis-
sion may initiate investigations under this subsection 
unless the Attorney General determines that such an 
investigation would impede an ongoing criminal in-
vestigation or national security activity. 
(3) COORDINATION AGREEMENT.— 
(A) IN GENERAL.—In order to avoid con-
flicts and promote consistency regarding the en-
forcement and litigation of matters under this 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
Act, not later than 180 days after the date of 
enactment of this Act, the Attorney General 
and the Federal Trade Commission shall enter 
into an agreement for coordination regarding 
the enforcement of this Act. 
(B) 
REQUIREMENT.—The 
coordination 
agreement entered into under subparagraph (A) 
shall include provisions to ensure that parallel 
investigations and proceedings under this sec-
tion are conducted in a manner that avoids con-
flicts and does not impede the ability of the At-
torney General to prosecute violations of Fed-
eral criminal laws. 
(f) OTHER RIGHTS AND REMEDIES.—The rights and 
remedies available under this section are cumulative and 
shall not affect any other rights and remedies available 
under law. 
SEC. 204. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) STATE ENFORCEMENT.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or any State or local law 
enforcement agency authorized by the State attorney 
general or by State statute to prosecute violations of 
consumer protection law, has reason to believe that 
a covered entity has violated section 201 or 202, the 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
State, as parens patriae, may bring a civil action on 
behalf of the residents of that State to— 
(A) enjoin that act or practice; 
(B) enforce compliance with section 201 or 
202; or 
(C) impose a civil penalty in an amount 
that is not greater than the product of the 
number of individuals whose sensitive personally 
identifiable information was placed at risk as a 
result of the violation and $16,500. 
(2) PENALTY LIMITATION.— 
(A) IN
GENERAL.—Notwithstanding any 
other provision of law, the total sum of civil 
penalties assessed against a covered entity for 
all violations of the provisions of this subtitle 
resulting from the same or related acts or omis-
sions may not exceed $5,000,000, unless such 
conduct is found to be willful or intentional. 
(B) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
and if so, the amount of the additional penalty 
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(C) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (B) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $5,000,000. 
(3) NOTICE.— 
(A) IN GENERAL.—Before filing an action 
under this subsection, the attorney general of 
the State involved shall provide to the Attorney 
General of the United States and the Federal 
Trade Commission— 
(i) a written notice of that action; and 
(ii) a copy of the complaint for that 
action. 
(B) EXCEPTION.—Subparagraph (A) shall 
not apply with respect to the filing of an action 
by an attorney general of a State under this 
subsection, if the attorney general of a State 
determines that it is not feasible to provide the 
notice described in this subparagraph before the 
filing of the action. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
(C) NOTIFICATION WHEN PRACTICABLE.— 
In an action described under subparagraph (B), 
the attorney general of a State shall provide the 
written notice and the copy of the complaint to 
the Attorney General of the United States and 
the Federal Trade Commission as soon after 
the filing of the complaint as practicable. 
(4) FEDERAL
PROCEEDINGS.—Upon receiving 
notice under paragraph (2), the Attorney General of 
the United States and the Federal Trade Commis-
sion shall have the right to— 
(A) move to stay the action, pending the 
final disposition of a pending Federal pro-
ceeding or action as described in section 203; 
(B) initiate an action in the appropriate 
United States district court under section 203 
and move to consolidate all pending actions, in-
cluding State actions, in such court; 
(C) intervene in an action brought under 
paragraph (1); and 
(D) file petitions for appeal. 
(5) PENDING PROCEEDINGS.—If the Attorney 
General of the United States or the Federal Trade 
Commission initiates a Federal civil action for a vio-
lation of this subtitle, or any regulations thereunder, 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS