I 
115TH CONGRESS 
1ST SESSION 
H. R. 135 
To protect cyber privacy, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 3, 2017 
Mr. CONYERS (for himself and Mr. JOHNSON of Georgia) introduced the 
following bill; which was referred to the Committee on the Judiciary 
A BILL 
To protect cyber privacy, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Privacy For-
tification Act of 2017’’. 
VerDate Sep 11 2014 
00:03 Jan 10, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H135.IH
H135
smartinez on DSK3GLQ082PROD with BILLS
TITLE I—DATA BREACH 
NOTIFICATION 
SEC. 101. FAILURE TO PROVIDE NOTICE OF SECURITY 
BREACHES INVOLVING SENSITIVE PERSON-
ALLY IDENTIFIABLE INFORMATION. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
‘‘§ 1041. 
Failure 
to 
provide 
notice 
of 
security 
breaches involving sensitive personally 
identifiable information 
‘‘(a) Whoever, having a covered obligation to provide 
notice of a security breach involving sensitive personally 
identifiable information, knowingly fails to do so, shall be 
fined under this title or imprisoned not more than 5 years, 
or both. 
‘‘(b) As used in this section— 
‘‘(1) the term ‘covered obligation’, with respect 
to providing notice of a security breach, means an 
obligation under Federal law or, if the breach is in 
or affects interstate or foreign commerce, under 
State law; 
‘‘(2) the term ‘sensitive personally identifiable 
information’ means any electronic or digital informa-
tion that includes— 
VerDate Sep 11 2014 
00:03 Jan 10, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H135.IH
H135
smartinez on DSK3GLQ082PROD with BILLS
‘‘(A) an individual’s first and last name, or 
first initial and last name, or address or phone 
number in combination with any one of the fol-
lowing data elements where the data elements 
are not protected by a technology protection 
measure that renders the data element indeci-
pherable— 
‘‘(i) a nontruncated social security 
number, driver’s license number, state resi-
dent identification number, passport num-
ber, or alien registration number; 
‘‘(ii) both— 
‘‘(I) mother’s maiden name, if 
identified as such; and 
‘‘(II) month, day, and year of 
birth; and 
‘‘(iii) unique biometric data such as a 
fingerprint, voice print, a retina or iris 
image; or 
‘‘(B) a financial account number or credit 
or debit card number in combination with any 
security code, access code or password that is 
required for an individual to obtain credit, with-
draw funds, or engage in a financial transaction 
by means of such number; 
VerDate Sep 11 2014 
00:03 Jan 10, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H135.IH
H135
smartinez on DSK3GLQ082PROD with BILLS
‘‘(3) the term ‘security breach’ means a com-
promise of the security, confidentiality, or integrity 
of computerized data that there is reason to believe 
has resulted in improper access to sensitive person-
ally identifiable information; and 
‘‘(4) the term ‘improper access’ means access 
without authorization or in excess of authorization.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 47 of title 18, United States 
Code, is amended by adding at the end the following: 
‘‘1041. Concealment of security breaches involving personally identifiable infor-
mation.’’. 
(c) OBLIGATION TO REPORT.— 
(1) IN GENERAL.—A person who owns or pos-
sesses data in electronic form containing a means of 
identification and has knowledge of a major security 
breach of the system containing such data main-
tained by such person, must provide prompt notice 
of such breach to the United States Secret Service 
or Federal Bureau of Investigation. 
(2) PUBLICATION
OF
LIST
OF
NOTIFICA-
TIONS.—The Secret Service and the Federal Bureau 
of Investigation shall annually publish in the Federal 
Register a list of all notifications submitted the pre-
vious calendar year and the identity of each entity 
VerDate Sep 11 2014 
00:03 Jan 10, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H135.IH
H135
smartinez on DSK3GLQ082PROD with BILLS
with respect to which the major security breach oc-
curred. 
(3) DEFINITION.—In this subsection— 
(A) the term ‘‘major security breach’’ 
means any security breach involving— 
(i) means of identification pertaining 
to 10,000 or more individuals is, or is rea-
sonably believed to have been acquired; 
(ii) databases owned by the Federal 
Government; or 
(iii) means of identification of Federal 
Government employees or contractors in-
volved in national security matters or law 
enforcement; and 
(B) the term ‘‘means of identification’’ has 
the meaning given that term in section 1028 of 
title 18, United States Code. 
TITLE 
II—NON-CRIMINAL 
PRI-
VACY 
ENFORCEMENT 
AND 
PRIVACY 
IMPACT 
STATE-
MENTS 
SEC. 201. ENFORCEMENT BY ATTORNEY GENERAL AND 
STATE AUTHORITIES. 
(a) DEFINITION
OF ‘‘AUTHORIZED ENTITY’’.—As 
used in this section, the term ‘‘authorized entity’’ means 
VerDate Sep 11 2014 
00:03 Jan 10, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H135.IH
H135
smartinez on DSK3GLQ082PROD with BILLS
(d) OTHER RIGHTS AND REMEDIES.—The rights and 
remedies available under this section do not affect any 
other rights and remedies available under Federal or State 
law. 
SEC. 202. COORDINATION OF STATE AND FEDERAL EF-
FORTS. 
(a) NOTICE.— 
(1) IN GENERAL.—A State consumer protection 
attorney may not bring an action under section 201, 
until the attorney general of the State involved pro-
vides to the Attorney General of the United States— 
(A) written notice of the action; and 
(B) a copy of the complaint for the action. 
(2) EXCEPTION.—Paragraph (1) does not apply 
with respect to the filing of an action by an attorney 
general of a State under this section if the State at-
torney general determines that it is not feasible to 
provide the notice described in such subparagraph 
before the filing of the action, in such a case the 
State attorney general shall provide notice and a 
copy of the complaint to the Attorney General at the 
time the State attorney general files the action. 
(b) FEDERAL PROCEEDINGS.—The Attorney General 
may— 
VerDate Sep 11 2014 
00:03 Jan 10, 2017
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H135.IH
H135
smartinez on DSK3GLQ082PROD with BILLS