HR 1560 RFS
‘‘(III) shall consider such infor-
mation the commercial, financial, and 
proprietary information of such Fed-
eral entity or non-Federal entity if so 
designated by such Federal entity or 
non-Federal entity; 
‘‘(IV) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; and 
‘‘(V) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures. 
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) shall be exempt from disclo-
sure under any State, local, or tribal 
law or regulation that requires public 
disclosure of information or records 
by a public or quasi-public entity; and 
‘‘(II) may not be used by any 
State, local, or tribal government to 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
regulate a lawful activity of a non- 
Federal entity. 
‘‘(8) LIABILITY EXEMPTIONS.— 
‘‘(A) NETWORK AWARENESS.—No cause of 
action shall lie or be maintained in any court, 
and such action shall be promptly dismissed, 
against any non-Federal entity that, for cyber-
security purposes, conducts network awareness 
under paragraph (4), if such network awareness 
is conducted in accordance with such paragraph 
and this section. 
‘‘(B) INFORMATION
SHARING.—No cause 
of action shall lie or be maintained in any 
court, and such action shall be promptly dis-
missed, against any non-Federal entity that, for 
cybersecurity purposes, shares cyber threat in-
dicators or defensive measures under paragraph 
(3), or in good faith fails to act based on such 
sharing, if such sharing is conducted in accord-
ance with such paragraph and this section. 
‘‘(C) WILLFUL MISCONDUCT.— 
‘‘(i) RULE OF CONSTRUCTION.—Noth-
ing in this section may be construed to— 
‘‘(I) require dismissal of a cause 
of action against a non-Federal entity 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
that has engaged in willful misconduct 
in the course of conducting activities 
authorized by this section; or 
‘‘(II) undermine or limit the 
availability of otherwise applicable 
common law or statutory defenses. 
‘‘(ii) 
PROOF
OF
WILLFUL
MIS-
CONDUCT.—In any action claiming that 
subparagraph (A) or (B) does not apply 
due to willful misconduct described in 
clause (i), the plaintiff shall have the bur-
den of proving by clear and convincing evi-
dence the willful misconduct by each non- 
Federal entity subject to such claim and 
that such willful misconduct proximately 
caused injury to the plaintiff. 
‘‘(iii) 
WILLFUL
MISCONDUCT
DE-
FINED.—In this subsection, the term ‘will-
ful misconduct’ means an act or omission 
that is taken— 
‘‘(I) intentionally to achieve a 
wrongful purpose; 
‘‘(II) knowingly without legal or 
factual justification; and 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
‘‘(III) in disregard of a known or 
obvious risk that is so great as to 
make it highly probable that the harm 
will outweigh the benefit. 
‘‘(D) EXCLUSION.—The term ‘non-Federal 
entity’ as used in this paragraph shall not in-
clude a State, local, or tribal government. 
‘‘(9) FEDERAL
GOVERNMENT
LIABILITY
FOR 
VIOLATIONS
OF
RESTRICTIONS
ON
THE
USE
AND 
PROTECTION
OF
VOLUNTARILY
SHARED
INFORMA-
TION.— 
‘‘(A) IN
GENERAL.—If a department or 
agency of the Federal Government intentionally 
or willfully violates the restrictions specified in 
paragraph (3), (6), or (7)(B) on the use and 
protection of voluntarily shared cyber threat in-
dicators or defensive measures, or any other 
provision of this section, the Federal Govern-
ment shall be liable to a person injured by such 
violation in an amount equal to the sum of— 
‘‘(i) the actual damages sustained by 
such person as a result of such violation or 
$1,000, whichever is greater; and 
‘‘(ii) reasonable attorney fees as deter-
mined by the court and other litigation 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
costs reasonably occurred in any case 
under this subsection in which the com-
plainant has substantially prevailed. 
‘‘(B) VENUE.—An action to enforce liabil-
ity under this subsection may be brought in the 
district court of the United States in— 
‘‘(i) the district in which the com-
plainant resides; 
‘‘(ii) the district in which the principal 
place of business of the complainant is lo-
cated; 
‘‘(iii) the district in which the depart-
ment or agency of the Federal Government 
that disclosed the information is located; or 
‘‘(iv) the District of Columbia. 
‘‘(C) STATUTE OF LIMITATIONS.—No ac-
tion shall lie under this subsection unless such 
action is commenced not later than two years 
after the date on which the cause of action 
arises. 
‘‘(D) EXCLUSIVE
CAUSE
OF
ACTION.—A 
cause of action under this subsection shall be 
the exclusive means available to a complainant 
seeking a remedy for a violation of any restric-
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
tion specified in paragraph (3), (6), or 7(B) or 
any other provision of this section. 
‘‘(10) ANTI-TRUST EXEMPTION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (C), it shall not be considered a 
violation of any provision of antitrust laws for 
two or more non-Federal entities to share a 
cyber threat indicator or defensive measure, or 
assistance relating to the prevention, investiga-
tion, or mitigation of a cybersecurity risk or in-
cident, for cybersecurity purposes under this 
Act. 
‘‘(B) APPLICABILITY.—Subparagraph (A) 
shall apply only to information that is shared or 
assistance that is provided in order to assist 
with— 
‘‘(i) facilitating the prevention, inves-
tigation, or mitigation of a cybersecurity 
risk or incident to an information system 
or information that is stored on, processed 
by, or transiting an information system; or 
‘‘(ii) communicating or disclosing a 
cyber threat indicator or defensive measure 
to help prevent, investigate, or mitigate the 
effect of a cybersecurity risk or incident to 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS