I 
114TH CONGRESS 
1ST SESSION 
H. R. 580 
To protect consumers by requiring reasonable security policies and procedures 
to protect data containing personal information, and to provide for na-
tionwide notice in the event of a security breach. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 28, 2015 
Mr. RUSH (for himself, Mr. BARTON, Mr. LIPINSKI, Mr. CICILLINE, and Mr. 
MCNERNEY) introduced the following bill; which was referred to the Com-
mittee on Energy and Commerce 
A BILL 
To protect consumers by requiring reasonable security poli-
cies and procedures to protect data containing personal 
information, and to provide for nationwide notice in the 
event of a security breach. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Accountability 
and Trust Act’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES
AND PROCE-
DURES.— 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require each person 
engaged in interstate commerce that owns or pos-
sesses data containing personal information, or con-
tracts to have any third party entity maintain such 
data for such person, to establish and implement 
policies and procedures regarding information secu-
rity practices for the treatment and protection of 
personal information taking into consideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, such 
person; 
(B) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(C) the cost of implementing such safe-
guards. 
(2) REQUIREMENTS.—Such regulations shall 
require the policies and procedures to include the 
following: 
(A) A security policy with respect to the 
collection, use, sale, other dissemination, and 
maintenance of such personal information. 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system or systems maintained by such person 
that contains such data, which shall include 
regular monitoring for a breach of security of 
such system or systems. 
(D) A process for taking preventive and 
corrective action to mitigate against any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include imple-
menting any changes to security practices and 
the architecture, installation, or implementation 
of network or operating software. 
(E) A process for disposing of data in elec-
tronic form containing personal information by 
shredding, permanently erasing, or otherwise 
modifying the personal information contained in 
such data to make such personal information 
permanently unreadable or undecipherable. 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(F) A standard method or methods for the 
destruction of paper documents and other non- 
electronic data containing personal information. 
(3) TREATMENT OF ENTITIES GOVERNED BY 
OTHER LAW.—Any person who is in compliance with 
any other Federal law that requires such person to 
maintain standards and safeguards for information 
security and protection of personal information that, 
taken as a whole and as the Commission shall deter-
mine in the rulemaking required under paragraph 
(1), provide protections substantially similar to, or 
greater than, those required under this subsection, 
shall be deemed to be in compliance with this sub-
section. 
(b) SPECIAL REQUIREMENTS
FOR INFORMATION 
BROKERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.— 
The regulations promulgated under subsection (a) 
shall require each information broker to submit its 
security policies to the Commission in conjunction 
with a notification of a breach of security under sec-
tion 3 or upon request of the Commission. 
(2) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission may conduct audits of the infor-
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
mation security practices of such information broker, 
or require the information broker to conduct inde-
pendent audits of such practices (by an independent 
auditor who has not audited such information bro-
ker’s security practices during the preceding 5 
years). 
(3) ACCURACY OF AND INDIVIDUAL ACCESS TO 
PERSONAL INFORMATION.— 
(A) ACCURACY.— 
(i) IN
GENERAL.—Each information 
broker shall establish reasonable proce-
dures to assure the maximum possible ac-
curacy of the personal information it col-
lects, assembles, or maintains, and any 
other information it collects, assembles, or 
maintains that specifically identifies an in-
dividual, other than information which 
merely identifies an individual’s name or 
address. 
(ii) LIMITED EXCEPTION FOR FRAUD 
DATABASES.—The requirement in clause 
(i) shall not prevent the collection or main-
tenance of information that may be inac-
curate with respect to a particular indi-
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
vidual when that information is being col-
lected or maintained solely— 
(I) for the purpose of indicating 
whether there may be a discrepancy 
or irregularity in the personal infor-
mation that is associated with an indi-
vidual; and 
(II) to help identify, or authen-
ticate the identity of, an individual, or 
to protect against or investigate fraud 
or other unlawful conduct. 
(B) CONSUMER
ACCESS
TO
INFORMA-
TION.— 
(i) ACCESS.—Each information broker 
shall— 
(I) provide to each individual 
whose personal information it main-
tains, at the individual’s request at 
least 1 time per year and at no cost 
to the individual, and after verifying 
the identity of such individual, a 
means for the individual to review any 
personal information regarding such 
individual maintained by the informa-
tion broker and any other information 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
maintained by the information broker 
that specifically identifies such indi-
vidual, other than information which 
merely identifies an individual’s name 
or address; and 
(II) place a conspicuous notice on 
its Internet website (if the informa-
tion broker maintains such a website) 
instructing individuals how to request 
access to the information required to 
be provided under subclause (I), and, 
as applicable, how to express a pref-
erence with respect to the use of per-
sonal information for marketing pur-
poses under clause (iii). 
(ii) DISPUTED INFORMATION.—When-
ever an individual whose information the 
information broker maintains makes a 
written request disputing the accuracy of 
any such information, the information 
broker, after verifying the identity of the 
individual making such request and unless 
there are reasonable grounds to believe 
such request is frivolous or irrelevant, 
shall— 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(I) correct any inaccuracy; or 
(II)(aa) in the case of informa-
tion that is public record information, 
inform the individual of the source of 
the information, and, if reasonably 
available, where a request for correc-
tion may be directed and, if the indi-
vidual provides proof that the public 
record has been corrected or that the 
information broker was reporting the 
information incorrectly, correct the in-
accuracy in the information broker’s 
records; or 
(bb) in the case of information 
that is non-public information, note 
the information that is disputed, in-
cluding the individual’s statement dis-
puting such information, and take 
reasonable steps to independently 
verify such information under the pro-
cedures outlined in subparagraph (A) 
if such information can be independ-
ently verified. 
(iii) ALTERNATIVE
PROCEDURE
FOR 
CERTAIN
MARKETING
INFORMATION.—In 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
accordance with regulations issued under 
clause (v), an information broker that 
maintains any information described in 
clause (i) which is used, shared, or sold by 
such information broker for marketing 
purposes, may, in lieu of complying with 
the access and dispute requirements set 
forth in clauses (i) and (ii), provide each 
individual whose information it maintains 
with a reasonable means of expressing a 
preference not to have his or her informa-
tion used for such purposes. If the indi-
vidual expresses such a preference, the in-
formation broker may not use, share, or 
sell the individual’s information for mar-
keting purposes. 
(iv) LIMITATIONS.—An information 
broker may limit the access to information 
required under clause (i)(I) and is not re-
quired to provide notice to individuals as 
required under clause (i)(II) in the fol-
lowing circumstances: 
(I) If access of the individual to 
the information is limited by law or 
legally recognized privilege. 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(II) If the information is used for 
a legitimate governmental or fraud 
prevention purpose that would be 
compromised by such access. 
(III) If the information consists 
of a published media record, unless 
that record has been included in a re-
port about an individual shared with a 
third party. 
(v) RULEMAKING.—Not later than 1 
year after the date of the enactment of this 
Act, the Commission shall promulgate reg-
ulations under section 553 of title 5, 
United States Code, to carry out this para-
graph and to facilitate the purposes of this 
Act. In addition, the Commission shall 
issue regulations, as necessary, under sec-
tion 553 of title 5, United States Code, on 
the scope of the application of the limita-
tions in clause (iv), including any addi-
tional circumstances in which an informa-
tion broker may limit access to information 
under such clause that the Commission de-
termines to be appropriate. 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(C) FCRA REGULATED
PERSONS.—Any 
information broker who is engaged in activities 
subject to the Fair Credit Reporting Act and 
who is in compliance with sections 609, 610, 
and 611 of such Act (15 U.S.C. 1681g; 1681h; 
1681i) with respect to information subject to 
such Act, shall be deemed to be in compliance 
with this paragraph with respect to such infor-
mation. 
(4) REQUIREMENT OF AUDIT LOG OF ACCESSED 
AND TRANSMITTED INFORMATION.—Not later than 
1 year after the date of the enactment of this Act, 
the Commission shall promulgate regulations under 
section 553 of title 5, United States Code, to require 
information brokers to establish measures which fa-
cilitate the auditing or retracing of any internal or 
external access to, or transmissions of, any data con-
taining personal information collected, assembled, or 
maintained by such information broker. 
(5) PROHIBITION ON PRETEXTING BY INFOR-
MATION BROKERS.— 
(A) PROHIBITION
ON
OBTAINING
PER-
SONAL INFORMATION BY FALSE PRETENSES.— 
It shall be unlawful for an information broker 
to obtain or attempt to obtain, or cause to be 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
disclosed or attempt to cause to be disclosed to 
any person, personal information or any other 
information relating to any person by— 
(i) making a false, fictitious, or fraud-
ulent statement or representation to any 
person; or 
(ii) providing any document or other 
information to any person that the infor-
mation broker knows or should know to be 
forged, counterfeit, lost, stolen, or fraudu-
lently obtained, or to contain a false, ficti-
tious, or fraudulent statement or represen-
tation. 
(B) PROHIBITION
ON
SOLICITATION
TO 
OBTAIN PERSONAL INFORMATION UNDER FALSE 
PRETENSES.—It shall be unlawful for an infor-
mation broker to request a person to obtain 
personal information or any other information 
relating to any other person, if the information 
broker knew or should have known that the per-
son to whom such a request is made will obtain 
or attempt to obtain such information in the 
manner described in subparagraph (A). 
(c) EXEMPTION
FOR
CERTAIN
SERVICE
PRO-
VIDERS.—Nothing in this section shall apply to a service 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
provider for any electronic communication by a third party 
that is transmitted, routed, or stored in intermediate or 
transient storage by such service provider. 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any person en-
gaged in interstate commerce that owns or possesses data 
in electronic form containing personal information shall, 
following the discovery of a breach of security of the sys-
tem maintained by such person that contains such data— 
(1) notify each individual who is a citizen or 
resident of the United States whose personal infor-
mation was acquired or accessed as a result of such 
a breach of security; and 
(2) notify the Commission. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD PARTY AGENTS.—In the event of a 
breach of security by any third party entity that has 
been contracted to maintain or process data in elec-
tronic form containing personal information on be-
half of any other person who owns or possesses such 
data, such third party entity shall be required to no-
tify such person of the breach of security. Upon re-
ceiving such notification from such third party, such 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
person shall provide the notification required under 
subsection (a). 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in 
electronic form containing personal information that 
is owned or possessed by another person that con-
nects to or uses a system or network provided by the 
service provider for the purpose of transmitting, 
routing, or providing intermediate or transient stor-
age of such data, such service provider shall be re-
quired to notify of such a breach of security only the 
person who initiated such connection, transmission, 
routing, or storage if such person can be reasonably 
identified. Upon receiving such notification from a 
service provider, such person shall provide the notifi-
cation required under subsection (a). 
(3) COORDINATION
OF
NOTIFICATION
WITH 
CONSUMER REPORTING AGENCIES.—If a person is 
required to provide notification to more than 5,000 
individuals under subsection (a)(1), the person shall 
also notify the major consumer reporting agencies of 
the timing and distribution of the notices. Such no-
tice shall be given to the consumer reporting agen-
cies without unreasonable delay and, if it will not 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
delay notice to the affected individuals, prior to the 
distribution of notices to the affected individuals. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Unless subject to a delay au-
thorized under paragraph (2), a notification required 
under subsection (a) shall be made not later than 45 
days following the discovery of a breach of security, 
unless the person providing notice can show that 
providing notice within such a time frame is not fea-
sible due to extraordinary circumstances necessary 
to prevent further breach or unauthorized disclo-
sures, and reasonably restore the integrity of the 
data system, in which case such notification shall be 
made as promptly as possible. 
(2) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW ENFORCEMENT OR NATIONAL SECURITY PUR-
POSES.— 
(A) LAW
ENFORCEMENT.—If a Federal, 
State, or local law enforcement agency deter-
mines that the notification required under this 
section would impede a civil or criminal inves-
tigation, such notification shall be delayed upon 
the written request of the law enforcement 
agency for 30 days or such lesser period of time 
which the law enforcement agency determines is 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
reasonably necessary and requests in writing. A 
law enforcement agency may, by a subsequent 
written request, revoke such delay or extend the 
period of time set forth in the original request 
made under this paragraph if further delay is 
necessary. 
(B) NATIONAL
SECURITY.—If a Federal 
national security agency or homeland security 
agency determines that the notification required 
under this section would threaten national or 
homeland security, such notification may be de-
layed for a period of time which the national se-
curity agency or homeland security agency de-
termines is reasonably necessary and requests 
in writing. A Federal national security agency 
or homeland security agency may revoke such 
delay or extend the period of time set forth in 
the original request made under this paragraph 
by a subsequent written request if further delay 
is necessary. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the 
selected method can reasonably be expected to 
reach the intended individual): 
(i) Written notification. 
(ii) Notification by email or other 
electronic means, if— 
(I) the person’s primary method 
of communication with the individual 
is by email or such other electronic 
means; or 
(II) the individual has consented 
to receive such notification and the 
notification is provided in a manner 
that is consistent with the provisions 
permitting electronic transmission of 
notices under section 101 of the Elec-
tronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 
7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(i) a description of the personal infor-
mation that was acquired or accessed by 
an unauthorized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the infor-
mation the person maintained about that 
individual; 
(iii) notice that the individual is enti-
tled to receive, at no cost to such indi-
vidual, consumer credit reports on a quar-
terly basis for a period of 2 years, or credit 
monitoring or other service that enables 
consumers to detect the misuse of their 
personal information for a period of 2 
years, and instructions to the individual on 
requesting such reports or service from the 
person, except when the only information 
which has been the subject of the security 
breach is the individual’s first name or ini-
tial and last name, or address, or phone 
number, in combination with a credit or 
debit card number, and any required secu-
rity code; 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS