layed for a period of time which the national se-
curity agency or homeland security agency de-
termines is reasonably necessary and requests 
in writing. A Federal national security agency 
or homeland security agency may revoke such 
delay or extend the period of time set forth in 
the original request made under this paragraph 
by a subsequent written request if further delay 
is necessary. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the 
selected method can reasonably be expected to 
reach the intended individual): 
(i) Written notification. 
(ii) Notification by email or other 
electronic means, if— 
(I) the person’s primary method 
of communication with the individual 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
is by email or such other electronic 
means; or 
(II) the individual has consented 
to receive such notification and the 
notification is provided in a manner 
that is consistent with the provisions 
permitting electronic transmission of 
notices under section 101 of the Elec-
tronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 
7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that was acquired or accessed by 
an unauthorized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the infor-
mation the person maintained about that 
individual; 
VerDate Sep 11 2014 
21:06 Sep 27, 2017
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(iii) notice that the individual is enti-
tled to receive, at no cost to such indi-
vidual, consumer credit reports on a quar-
terly basis for a period of 5 years, credit 
monitoring or other service that enables 
consumers to detect the misuse of their 
personal information for a period of 10 
years, and instructions to the individual on 
requesting such reports or service from the 
person, except when the only information 
which has been the subject of the security 
breach is the individual’s first name or ini-
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; 
(iv) the toll-free contact telephone 
numbers and addresses for the major con-
sumer reporting agencies; 
(v) a toll-free telephone number and 
Internet website address for the Commis-
sion whereby the individual may obtain in-
formation regarding identity theft; and 
(vi) a toll-free telephone number and 
Internet website address for the Bureau 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
whereby the individual may obtain infor-
mation regarding identity theft and credit 
reports. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(1) may provide substitute notifica-
tion in lieu of the direct notification required by 
paragraph (1) if the person owns or possesses 
data in electronic form containing personal in-
formation of fewer than 1,000 individuals and 
such direct notification is not feasible due to— 
(i) excessive cost to the person re-
quired to provide such notification relative 
to the resources of such person, as deter-
mined in accordance with the regulations 
issued by the Commission under paragraph 
(3)(A); or 
(ii) lack of sufficient contact informa-
tion for the individual required to be noti-
fied. 
(B) FORM
OF
SUBSTITUTE
NOTIFICA-
TION.—Such substitute notification shall in-
clude— 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(i) email notification to the extent 
that the person has email addresses of in-
dividuals to whom it is required to provide 
notification under subsection (a)(1); 
(ii) a conspicuous notice on the Inter-
net website of the person (if such person 
maintains such a website); and 
(iii) notification in print and to broad-
cast media, including major media in met-
ropolitan and rural areas where the indi-
viduals whose personal information was ac-
quired reside. 
(C) CONTENT OF SUBSTITUTE NOTICE.— 
Each form of substitute notice under this para-
graph shall include— 
(i) notice that individuals whose per-
sonal information is included in the breach 
of security are entitled to receive, at no 
cost to the individuals, consumer credit re-
ports on a quarterly basis for a period of 
5 years, credit monitoring or other service 
that enables consumers to detect the mis-
use of their personal information for a pe-
riod of 10 years, and instructions on re-
questing such reports or service from the 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
person, except when the only information 
which has been the subject of the security 
breach is the individual’s first name or ini-
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; and 
(ii) a telephone number by which an 
individual can, at no cost to such indi-
vidual, learn whether that individual’s per-
sonal information is included in the breach 
of security. 
(3) REGULATIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 1 year 
after the date of enactment of this Act, the 
Commission shall, by regulation under section 
553 of title 5, United States Code, establish cri-
teria for determining circumstances under 
which substitute notification may be provided 
under paragraph (2), including criteria for de-
termining if notification under paragraph (1) is 
not feasible due to excessive costs to the person 
required to provide such notification relative to 
5 the resources of such person. Such regula-
tions may also identify other circumstances 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
where substitute notification would be appro-
priate for any person, including circumstances 
under which the cost of providing notification 
exceeds the benefits to consumers. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
with respect to compliance with this subsection. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute notification under paragraph (2), 
including the extent of notification to print 
and broadcast media that complies with 
the requirements of such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—A person required to provide 
notification under subsection (a) shall, upon request 
of an individual whose personal information was in-
cluded in the breach of security, provide or arrange 
for the provision of, to each such individual and at 
no cost to such individual— 
(A) consumer credit reports from at least 
one of the major consumer reporting agencies 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
beginning not later than 30 days following the 
individual’s request and continuing on a quar-
terly basis for a period of 10 years thereafter; 
or 
(B) a credit monitoring or other service 
that enables consumers to detect the misuse of 
their personal information, beginning not later 
than 30 days following the individual’s request 
and continuing for a period of 10 years. 
(2) LIMITATION.—This subsection shall not 
apply if the only personal information which has 
been the subject of the security breach is the individ-
ual’s first name or initial and last name, or address, 
or phone number, in combination with a credit or 
debit card number, and any required security code. 
(3) RULEMAKING.—As part of the Commis-
sion’s rulemaking described in subsection (d)(3), the 
Commission shall determine the circumstances under 
which a person required to provide notification 
under subsection (a)(1) shall provide or arrange for 
the provision of free consumer credit reports or cred-
it monitoring or other service to affected individuals. 
(4) BREACH OF CONSUMER REPORTING AGEN-
CY.—In the event of a breach of security of a con-
sumer reporting agency, that agency shall provide 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
any consumer credit report required under para-
graph (1)(A) from another consumer reporting agen-
cy. 
(f) EXEMPTION.— 
(1) GENERAL EXEMPTION.—A person shall be 
exempt from the requirements under this section if, 
following a breach of security, such person deter-
mines that there is no reasonable risk of identity 
theft, fraud, or other unlawful conduct. 
(2) PRESUMPTION.— 
(A) IN GENERAL.—If the data in electronic 
form containing personal information is ren-
dered unusable, unreadable, or indecipherable 
through encryption or other security technology 
or methodology (if the method of encryption or 
such other technology or methodology is gen-
erally accepted by experts in the information se-
curity field), there shall be a presumption that 
no reasonable risk of identity theft, fraud, or 
other unlawful conduct exists following a breach 
of security of such data. Any such presumption 
may be rebutted by facts demonstrating that 
the encryption or other security technologies or 
methodologies in a specific case, have been or 
are reasonably likely to be compromised. 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(B) 
METHODOLOGIES
OR
TECH-
NOLOGIES.—Not later than 1 year after the 
date of the enactment of this Act and bian-
nually thereafter, the Commission shall issue 
rules (pursuant to section 553 of title 5, United 
States Code) or guidance to identify security 
methodologies or technologies which render data 
in electronic form unusable, unreadable, or in-
decipherable, that shall, if applied to such data, 
establish a presumption that no reasonable risk 
of identity theft, fraud, or other unlawful con-
duct exists following a breach of security of 
such data. Any such presumption may be rebut-
ted by facts demonstrating that any such meth-
odology or technology in a specific case has 
been or is reasonably likely to be compromised. 
In issuing such rules or guidance, the Commis-
sion shall consult with relevant industries, con-
sumer organizations, and data security and 
identity theft prevention experts and established 
standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 year 
after the date of the enactment of this Act the Com-
mission shall issue guidance regarding the applica-
tion of the exemption in paragraph (1). 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—If the Commission, upon receiving notification of 
any breach of security that is reported to the Commission 
under subsection (a)(2), finds that notification of such a 
breach of security via the Commission’s Internet website 
would be in the public interest or for the protection of 
consumers, the Commission shall place such a notice in 
a clear and conspicuous location on its Internet website. 
(h) WEBSITE NOTICE
OF CONSUMER FINANCIAL 
PROTECTION BUREAU.—If the Bureau, upon receiving no-
tification of any breach of security that is reported to the 
Bureau under subsection (a)(2), finds that notification of 
such a breach of security via the Bureau’s Internet website 
would be in the public interest or for the protection of 
consumers, the Bureau shall place such a notice in a clear 
and conspicuous location on its Internet website. 
(i) FTC STUDY ON NOTIFICATION IN LANGUAGES IN 
ADDITION TO ENGLISH.—Not later than 1 year after the 
date of enactment of this Act, the Commission, in con-
sultation with the Bureau, shall conduct a study on the 
practicality and cost effectiveness of requiring the notifica-
tion required by subsection (d)(1) to be provided in a lan-
guage in addition to English to individuals known to speak 
only such other language. 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(j) GENERAL RULEMAKING AUTHORITY.—The Com-
mission and Bureau may promulgate regulations nec-
essary under section 553 of title 5, United States Code, 
to effectively enforce the requirements of this section. 
(k) TREATMENT OF PERSONS GOVERNED BY OTHER 
LAW.—A person who is in compliance with any other Fed-
eral law that requires such person to provide notification 
to individuals following a breach of security, and that, 
taken as a whole, provides protections substantially similar 
to, or greater than, those required under this section, as 
the Commission shall determine by rule (under section 
553 of title 5, United States Code), shall be deemed to 
be in compliance with this section. 
SEC. 2. APPLICATION AND ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 1 shall be treated as 
an unfair and deceptive act or practice in violation 
of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act in the same manner, by 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act 
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act. Any person who violates 
such regulations shall be subject to the penalties and 
entitled to the privileges and immunities provided in 
that Act. 
(3) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
(b) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTION.—In any case in which the 
attorney general of a State, or an official or agency 
of a State, has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by any person who violates sec-
tion 1 of this Act, the attorney general, official, or 
agency of the State, as parens patriae, may bring a 
civil action on behalf of the residents of the State in 
a district court of the United States of appropriate 
jurisdiction— 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(A) to enjoin further violation of such sec-
tion by the defendant; 
(B) to compel compliance with such sec-
tion; or 
(C) to obtain civil penalties in the amount 
determined under paragraph (2). 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.—For purposes of para-
graph (1)(C) with regard to a violation of sec-
tion 1, the amount determined under this para-
graph is the amount calculated by multiplying 
the number of violations of such section by an 
amount not greater than $11,000. Each failure 
to send notification as required under section 3 
to a resident of the State shall be treated as a 
separate violation. 
(B) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
Index is first published by the Bureau of Labor 
Statistics that is after 1 year after the date of 
enactment of this Act, and each year thereafter, 
the amounts specified in clause (i) of subpara-
graph (A) shall be increased by the percentage 
increase in the Consumer Price Index published 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
on that date from the Consumer Price Index 
published the previous year. 
(C) MAXIMUM
TOTAL
LIABILITY.—Not 
withstanding the number of actions which may 
be brought against a person under this sub-
section, the maximum civil penalty for which 
any person may be liable under this subsection 
shall not exceed— 
(i) $5,000,000 for each violation of 
section 2; and 
(ii) $5,000,000 for all violations of 
section 3 resulting from a single breach of 
security. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission 
and provide the Commission with a copy of its 
complaint, except in any case in which such 
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(c) AFFIRMATIVE DEFENSE FOR A VIOLATION OF 
SECTION 1.— 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(1) IN GENERAL.—It shall be an affirmative de-
fense to an enforcement action brought under sub-
section (a), or a civil action brought under sub-
section (b), based on a violation of section 1, that 
all of the personal information contained in the data 
in electronic form that was acquired or accessed as 
a result of a breach of security of the defendant is 
public record information that is lawfully made 
available to the general public from Federal, State, 
or local government records and was acquired by the 
defendant from such records. 
(2) NO EFFECT ON OTHER REQUIREMENTS.— 
Nothing in this subsection shall be construed to ex-
empt any person from the requirement to notify the 
Commission of a breach of security as required 
under section 3(a). 
SEC. 3. PROHIBITION ON CERTAIN CONTRACT CLAUSES. 
(a) UNLAWFUL CONDUCT.—It shall be unlawful for 
any person to include a clause in a contract that— 
(1) prohibits an individual described in section 
(1)(a)(1) from pursuing civil action related to the 
breach; or 
(2) requires mandatory arbitration related to 
the breach. 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS