I 
115TH CONGRESS 
1ST SESSION H. R. 3806 
To establish a national data breach notification standard, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 18, 2017 
Mr. LANGEVIN (for himself and Mr. TED LIEU of California) introduced the 
following bill; which was referred to the Committee on Energy and Com-
merce, and in addition to the Committee on the Judiciary, for a period 
to be subsequently determined by the Speaker, in each case for consider-
ation of such provisions as fall within the jurisdiction of the committee 
concerned 
A BILL 
To establish a national data breach notification standard, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Personal Data Notification and Protection Act of 2017’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Notification to individuals. 
Sec. 3. Exemptions from notification to individuals. 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
Sec. 4. Methods of notification. 
Sec. 5. Content of notification. 
Sec. 6. Coordination of notification with credit reporting agencies. 
Sec. 7. Notification for law enforcement and other purposes. 
Sec. 8. Enforcement by the Federal Trade Commission. 
Sec. 9. Enforcement by State attorneys general. 
Sec. 10. Effect on State law. 
Sec. 11. Reporting on security breaches. 
Sec. 12. Excluded business entities. 
Sec. 13. Definitions. 
Sec. 14. Effective date. 
SEC. 2. NOTIFICATION TO INDIVIDUALS. 
(a) IN GENERAL.—Except as provided for in section 
3, any business entity engaged in or affecting interstate 
commerce, that uses, accesses, transmits, stores, disposes 
of, or collects sensitive personally identifiable information 
about more than 10,000 individuals during any 12-month 
period shall, following the discovery of a security breach 
of such information, notify, in accordance with sections 
4 and 5, any individual whose sensitive personally identifi-
able information has been, or is reasonably believed to 
have been, accessed or acquired. 
(b) OBLIGATIONS
OF
AND
TO
OWNER
OR
LI-
CENSEE.— 
(1) NOTIFICATION TO OWNER OR LICENSEE.— 
Any business entity engaged in or affecting inter-
state commerce, that uses, accesses, transmits, 
stores, disposes of, or collects sensitive personally 
identifiable information that the business entity does 
not own or license shall notify the owner or licensee 
of the information following the discovery of a secu-
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
rity breach involving such information, unless there 
is no reasonable risk of harm or fraud to such owner 
or licensee. 
(2) NOTIFICATION BY OWNER, LICENSEE, OR 
OTHER DESIGNATED THIRD PARTY.—Nothing in this 
Act shall prevent or abrogate an agreement between 
a business entity required to provide notification 
under this section and a designated third party, in-
cluding an owner or licensee of the sensitive person-
ally identifiable information subject to the security 
breach, to provide the notifications required under 
subsection (a). 
(3) BUSINESS ENTITY RELIEVED FROM GIVING 
NOTIFICATION.—A business entity required to pro-
vide notification under subsection (a) shall not be re-
quired to provide such notification if an owner or li-
censee of the sensitive personally identifiable infor-
mation subject to the security breach, or other des-
ignated third party, provides such notification. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay following the discovery by the business en-
tity of a security breach. A business entity shall, 
upon the request of the Commission, provide records 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS
or other evidence of the notifications required under 
this section. 
(2) REASONABLE DELAY.— 
(A) IN GENERAL.—Except as provided in 
subsection (d), reasonable delay under this sub-
section shall not exceed 30 days, unless the 
business entity seeking additional time requests 
an extension of time and the Commission deter-
mines that additional time is reasonably nec-
essary to determine the scope of the security 
breach, prevent further disclosures, conduct the 
risk assessment, restore the reasonable integrity 
of the data system, or provide notice to the 
breach notification entity. 
(B) EXTENSION.—If the Commission de-
termines that additional time is reasonably nec-
essary as described in subparagraph (A), the 
Commission may extend the time period for no-
tification for additional periods of up to 30 days 
each. Any such extension shall be provided in 
writing by the Commission. 
(3) BURDEN OF PRODUCTION.—If a business 
entity requires additional time under paragraph (2), 
the business entity shall provide the Commission 
VerDate Sep 11 2014 
23:32 Sep 22, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3806.IH
H3806
lotter on DSKBCFDHB2PROD with BILLS