and will accomplish the purposes of this 
Act; or 
(ii) for the purpose of section 3, to the 
extent that such modification is necessary 
to accommodate changes in technology or 
practices, will not unreasonably impede 
interstate commerce, and will accomplish 
the purposes of this Act. 
(8) PUBLIC RECORD INFORMATION.—The term 
‘‘public record information’’ means information 
about an individual which has been obtained origi-
nally from records of a Federal, State, or local gov-
ernment entity that are available for public inspec-
tion. 
(9) NON-PUBLIC
INFORMATION.—The term 
‘‘non-public information’’ means information about 
an individual that is of a private nature and neither 
available to the general public nor obtained from a 
public record. 
(10) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means a person that provides electronic 
data transmission, routing, intermediate and tran-
sient storage, or connections to its system or net-
work, where the person providing such services does 
not select or modify the content of the electronic
data, is not the sender or the intended recipient of 
the data, and such person transmits, routes, stores, 
or provides connections for personal information in 
a manner that personal information is undifferen-
tiated from other types of data that such person 
transmits, routes, stores, or provides connections. 
Any such person shall be treated as a service pro-
vider under this Act only to the extent that it is en-
gaged in the provision of such transmission, routing, 
intermediate and transient storage or connections. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
a State, with respect to those entities covered by the regu-
lations issued pursuant to this Act, that expressly— 
(1) requires information security practices and 
treatment of data containing personal information 
similar to any of those required under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized access 
to or acquisition of data in electronic form con-
taining personal information. 
(b) ADDITIONAL PREEMPTION.—
(1) IN GENERAL.—No person other than a per-
son specified in section 4(c) may bring a civil action 
under the laws of any State if such action is pre-
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an Attorney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law. 
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of 
enactment of this Act.
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $1,000,000 for each of fiscal years 2010 through 
2015 to carry out this Act. 
Passed the House of Representatives December 8, 
2009. 
Attest: 
Clerk.
111TH CONGRESS 
1ST SESSION 
H. R. 2221 
AN ACT 
To protect consumers by requiring reasonable secu-
rity policies and procedures to protect data con-
taining personal information, and to provide for 
nationwide notice in the event of a security 
breach.