IB 
Union Calendar No. 214 
111TH CONGRESS 
1ST SESSION H. R. 2221 
[Report No. 111–362] 
To protect consumers by requiring reasonable security policies and procedures 
to protect computerized data containing personal information, and to 
provide for nationwide notice in the event of a security breach. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 30, 2009 
Mr. RUSH
(for himself, Mr. STEARNS, Mr. BARTON
of Texas, Ms. 
SCHAKOWSKY, and Mr. RADANOVICH) introduced the following bill; which 
was referred to the Committee on Energy and Commerce 
DECEMBER 8, 2009 
Reported with amendments, committed to the Committee of the Whole House 
on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on April 30, 2009] 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
A BILL 
To protect consumers by requiring reasonable security poli-
cies and procedures to protect computerized data con-
taining personal information, and to provide for nation-
wide notice in the event of a security breach. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Accountability and 
Trust Act’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL
SECURITY
POLICIES
AND
PROCE-
DURES.— 
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of title 
5, United States Code, to require each person engaged 
in interstate commerce that owns or possesses data 
containing personal information, or contracts to have 
any third party entity maintain such data for such 
person, to establish and implement policies and proce-
dures regarding information security practices for the 
treatment and protection of personal information tak-
ing into consideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, such 
person; 
(B) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(C) the cost of implementing such safe-
guards. 
(2) REQUIREMENTS.—Such regulations shall re-
quire the policies and procedures to include the fol-
lowing: 
(A) A security policy with respect to the col-
lection, use, sale, other dissemination, and main-
tenance of such personal information. 
(B) The identification of an officer or other 
individual as the point of contact with responsi-
bility for the management of information secu-
rity. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system or systems maintained by such person 
that contains such data, which shall include reg-
ular monitoring for a breach of security of such 
system or systems. 
(D) A process for taking preventive and cor-
rective 
action 
to 
mitigate 
against 
any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include imple-
menting any changes to security practices and 
the architecture, installation, or implementation 
of network or operating software. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(E) A process for disposing of data in elec-
tronic form containing personal information by 
shredding, permanently erasing, or otherwise 
modifying the personal information contained in 
such data to make such personal information 
permanently unreadable or undecipherable. 
(F) A standard method or methods for the 
destruction of paper documents and other non- 
electronic data containing personal information. 
(3) TREATMENT
OF
ENTITIES
GOVERNED
BY 
OTHER LAW.—Any person who is in compliance with 
any other Federal law that requires such person to 
maintain standards and safeguards for information 
security and protection of personal information that, 
taken as a whole and as the Commission shall deter-
mine in the rulemaking required under paragraph 
(1), provide protections substantially similar to, or 
greater than, those required under this subsection, 
shall be deemed to be in compliance with this sub-
section. 
(b) SPECIAL REQUIREMENTS FOR INFORMATION BRO-
KERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.—The 
regulations promulgated under subsection (a) shall re-
quire each information broker to submit its security 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
policies to the Commission in conjunction with a no-
tification of a breach of security under section 3 or 
upon request of the Commission. 
(2) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission may conduct audits of the infor-
mation security practices of such information broker, 
or require the information broker to conduct inde-
pendent audits of such practices (by an independent 
auditor who has not audited such information bro-
ker’s security practices during the preceding 5 years). 
(3) ACCURACY OF AND INDIVIDUAL ACCESS TO 
PERSONAL INFORMATION.— 
(A) ACCURACY.— 
(i) IN
GENERAL.—Each information 
broker shall establish reasonable procedures 
to assure the maximum possible accuracy of 
the personal information it collects, assem-
bles, or maintains, and any other informa-
tion it collects, assembles, or maintains that 
specifically identifies an individual, other 
than information which merely identifies 
an individual’s name or address. 
(ii) LIMITED EXCEPTION FOR FRAUD 
DATABASES.—The requirement in clause (i) 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
shall not prevent the collection or mainte-
nance of information that may be inac-
curate with respect to a particular indi-
vidual when that information is being col-
lected or maintained solely— 
(I) for the purpose of indicating 
whether there may be a discrepancy or 
irregularity in the personal informa-
tion that is associated with an indi-
vidual; and 
(II) to help identify, or authen-
ticate the identity of, an individual, or 
to protect against or investigate fraud 
or other unlawful conduct. 
(B) CONSUMER ACCESS TO INFORMATION.— 
(i) ACCESS.—Each information broker 
shall— 
(I) provide to each individual 
whose personal information it main-
tains, at the individual’s request at 
least 1 time per year and at no cost to 
the individual, and after verifying the 
identity of such individual, a means 
for the individual to review any per-
sonal information regarding such indi-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
vidual maintained by the information 
broker and any other information 
maintained by the information broker 
that specifically identifies such indi-
vidual, other than information which 
merely identifies an individual’s name 
or address; and 
(II) place a conspicuous notice on 
its Internet website (if the information 
broker maintains such a website) in-
structing individuals how to request 
access to the information required to be 
provided under subclause (I), and, as 
applicable, how to express a preference 
with respect to the use of personal in-
formation 
for 
marketing 
purposes 
under clause (iii). 
(ii) DISPUTED
INFORMATION.—When-
ever an individual whose information the 
information broker maintains makes a 
written request disputing the accuracy of 
any such information, the information 
broker, after verifying the identity of the in-
dividual making such request and unless 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
there are reasonable grounds to believe such 
request is frivolous or irrelevant, shall— 
(I) correct any inaccuracy; or 
(II)(aa) in the case of information 
that is public record information, in-
form the individual of the source of the 
information, and, if reasonably avail-
able, where a request for correction 
may be directed and, if the individual 
provides proof that the public record 
has been corrected or that the informa-
tion broker was reporting the informa-
tion incorrectly, correct the inaccuracy 
in the information broker’s records; or 
(bb) in the case of information 
that is non-public information, note 
the information that is disputed, in-
cluding the individual’s statement dis-
puting such information, and take rea-
sonable steps to independently verify 
such information under the procedures 
outlined in subparagraph (A) if such 
information 
can 
be 
independently 
verified. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(iii) ALTERNATIVE
PROCEDURE
FOR 
CERTAIN MARKETING INFORMATION.—In ac-
cordance with regulations issued under 
clause (v), an information broker that 
maintains any information described in 
clause (i) which is used, shared, or sold by 
such information broker for marketing pur-
poses, may, in lieu of complying with the 
access and dispute requirements set forth in 
clauses (i) and (ii), provide each individual 
whose information it maintains with a rea-
sonable means of expressing a preference not 
to have his or her information used for such 
purposes. If the individual expresses such a 
preference, the information broker may not 
use, share, or sell the individual’s informa-
tion for marketing purposes. 
(iv) LIMITATIONS.—An information 
broker may limit the access to information 
required under subparagraph (B)(i)(I) and 
is not required to provide notice to individ-
uals 
as 
required 
under 
subparagraph 
(B)(i)(II) in the following circumstances: 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(I) If access of the individual to 
the information is limited by law or le-
gally recognized privilege. 
(II) If the information is used for 
a legitimate governmental or fraud 
prevention purpose that would be com-
promised by such access. 
(III) If the information consists of 
a published media record, unless that 
record has been included in a report 
about an individual shared with a 
third party. 
(v) RULEMAKING.—Not later than 1 
year after the date of the enactment of this 
Act, the Commission shall promulgate regu-
lations under section 553 of title 5, United 
States Code, to carry out this paragraph 
and to facilitate the purposes of this Act. In 
addition, the Commission shall issue regula-
tions, as necessary, under section 553 of 
title 5, United States Code, on the scope of 
the application of the limitations in clause 
(iv), 
including 
any 
additional 
cir-
cumstances in which an information broker 
may limit access to information under such 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
clause that the Commission determines to be 
appropriate. 
(C) FCRA REGULATED PERSONS.—Any in-
formation broker who is engaged in activities 
subject to the Fair Credit Reporting Act and who 
is in compliance with sections 609, 610, and 611 
of such Act with respect to information subject to 
such Act, shall be deemed to be in compliance 
with this paragraph with respect to such infor-
mation. 
(4) REQUIREMENT OF AUDIT LOG OF ACCESSED 
AND TRANSMITTED INFORMATION.—Not later than 1 
year after the date of the enactment of this Act, the 
Commission shall promulgate regulations under sec-
tion 553 of title 5, United States Code, to require in-
formation brokers to establish measures which facili-
tate the auditing or retracing of any internal or ex-
ternal access to, or transmissions of, any data con-
taining personal information collected, assembled, or 
maintained by such information broker. 
(5) PROHIBITION ON PRETEXTING BY INFORMA-
TION BROKERS.— 
(A) PROHIBITION ON OBTAINING PERSONAL 
INFORMATION BY FALSE PRETENSES.—It shall be 
unlawful for an information broker to obtain or 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
attempt to obtain, or cause to be disclosed or at-
tempt to cause to be disclosed to any person, per-
sonal information or any other information re-
lating to any person by— 
(i) making a false, fictitious, or fraud-
ulent statement or representation to any 
person; or 
(ii) providing any document or other 
information to any person that the informa-
tion broker knows or should know to be 
forged, counterfeit, lost, stolen, or fraudu-
lently obtained, or to contain a false, ficti-
tious, or fraudulent statement or representa-
tion. 
(B) PROHIBITION ON SOLICITATION TO OB-
TAIN
PERSONAL
INFORMATION
UNDER
FALSE 
PRETENSES.—It shall be unlawful for an infor-
mation broker to request a person to obtain per-
sonal information or any other information re-
lating to any other person, if the information 
broker knew or should have known that the per-
son to whom such a request is made will obtain 
or attempt to obtain such information in the 
manner described in subparagraph (A). 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(c) EXEMPTION FOR CERTAIN SERVICE PROVIDERS.— 
Nothing in this section shall apply to a service provider 
for any electronic communication by a third party that is 
transmitted, routed, or stored in intermediate or transient 
storage by such service provider. 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any person engaged 
in interstate commerce that owns or possesses data in elec-
tronic form containing personal information shall, fol-
lowing the discovery of a breach of security of the system 
maintained by such person that contains such data— 
(1) notify each individual who is a citizen or 
resident of the United States whose personal informa-
tion was acquired or accessed as a result of such a 
breach of security; and 
(2) notify the Commission. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD PARTY AGENTS.—In the event of a 
breach of security by any third party entity that has 
been contracted to maintain or process data in elec-
tronic form containing personal information on be-
half of any other person who owns or possesses such 
data, such third party entity shall be required to no-
tify such person of the breach of security. Upon re-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
ceiving such notification from such third party, such 
person shall provide the notification required under 
subsection (a). 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in elec-
tronic form containing personal information that is 
owned or possessed by another person that connects to 
or uses a system or network provided by the service 
provider for the purpose of transmitting, routing, or 
providing intermediate or transient storage of such 
data, such service provider shall be required to notify 
of such a breach of security only the person who initi-
ated such connection, transmission, routing, or stor-
age if such person can be reasonably identified. Upon 
receiving such notification from a service provider, 
such person shall provide the notification required 
under subsection (a). 
(3) COORDINATION
OF
NOTIFICATION
WITH 
CREDIT
REPORTING
AGENCIES.—If a person is re-
quired to provide notification to more than 5,000 in-
dividuals under subsection (a)(1), the person shall 
also notify the major credit reporting agencies that 
compile and maintain files on consumers on a na-
tionwide basis, of the timing and distribution of the 
notices. Such notice shall be given to the credit report-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
ing agencies without unreasonable delay and, if it 
will not delay notice to the affected individuals, prior 
to the distribution of notices to the affected individ-
uals. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Unless subject to a delay au-
thorized under paragraph (2), a notification required 
under subsection (a) shall be made not later than 60 
days following the discovery of a breach of security, 
unless the person providing notice can show that pro-
viding notice within such a time frame is not feasible 
due to extraordinary circumstances necessary to pre-
vent further breach or unauthorized disclosures, and 
reasonably restore the integrity of the data system, in 
which case such notification shall be made as prompt-
ly as possible. 
(2) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW
ENFORCEMENT
OR
NATIONAL
SECURITY
PUR-
POSES.— 
(A) LAW
ENFORCEMENT.—If a Federal, 
State, or local law enforcement agency deter-
mines that the notification required under this 
section would impede a civil or criminal inves-
tigation, such notification shall be delayed upon 
the written request of the law enforcement agency 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
for 30 days or such lesser period of time which 
the law enforcement agency determines is reason-
ably necessary and requests in writing. A law 
enforcement agency may, by a subsequent writ-
ten request, revoke such delay or extend the pe-
riod of time set forth in the original request 
made under this paragraph if further delay is 
necessary. 
(B) NATIONAL SECURITY.—If a Federal na-
tional security agency or homeland security 
agency determines that the notification required 
under this section would threaten national or 
homeland security, such notification may be de-
layed for a period of time which the national se-
curity agency or homeland security agency deter-
mines is reasonably necessary and requests in 
writing. A Federal national security agency or 
homeland security agency may revoke such delay 
or extend the period of time set forth in the 
original request made under this paragraph by 
a subsequent written request if further delay is 
necessary. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the se-
lected method can reasonably be expected to 
reach the intended individual): 
(i) Written notification. 
(ii) Notification by email or other elec-
tronic means , if— 
(I) the person’s primary method 
of communication with the individual 
is by email or such other electronic 
means; or 
(II) the individual has consented 
to receive such notification and the no-
tification is provided in a manner that 
is consistent with the provisions per-
mitting electronic transmission of no-
tices under section 101 of the Elec-
tronic Signatures in Global Commerce 
Act (15 U.S.C. 7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that was acquired or accessed by an 
unauthorized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the informa-
tion the person maintained about that indi-
vidual; 
(iii) notice that the individual is enti-
tled to receive, at no cost to such individual, 
consumer credit reports on a quarterly basis 
for a period of 2 years, or credit monitoring 
or other service that enables consumers to 
detect the misuse of their personal informa-
tion for a period of 2 years, and instruc-
tions to the individual on requesting such 
reports or service from the person, except 
when the only information which has been 
the subject of the security breach is the indi-
vidual’s first name or initial and last 
name, or address, or phone number, in com-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
bination with a credit or debit card num-
ber, and any required security code; 
(iv) the toll-free contact telephone num-
bers and addresses for the major credit re-
porting agencies; and 
(v) a toll-free telephone number and 
Internet website address for the Commission 
whereby the individual may obtain infor-
mation regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(1) may provide substitute notification 
in lieu of the direct notification required by 
paragraph (1) if the person owns or possesses 
data in electronic form containing personal in-
formation of fewer than 1,000 individuals and 
such direct notification is not feasible due to— 
(i) excessive cost to the person required 
to provide such notification relative to the 
resources of such person, as determined in 
accordance with the regulations issued by 
the Commission under paragraph (3)(A); or 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(ii) lack of sufficient contact informa-
tion for the individual required to be noti-
fied. 
(B) FORM OF SUBSTITUTE NOTIFICATION.— 
Such substitute notification shall include— 
(i) email notification to the extent that 
the person has email addresses of individ-
uals to whom it is required to provide noti-
fication under subsection (a)(1); 
(ii) a conspicuous notice on the Inter-
net website of the person (if such person 
maintains such a website); and 
(iii) notification in print and to 
broadcast media, including major media in 
metropolitan and rural areas where the in-
dividuals whose personal information was 
acquired reside. 
(C) CONTENT
OF
SUBSTITUTE
NOTICE.— 
Each form of substitute notice under this para-
graph shall include— 
(i) notice that individuals whose per-
sonal information is included in the breach 
of security are entitled to receive, at no cost 
to the individuals, consumer credit reports 
on a quarterly basis for a period of 2 years, 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
or credit monitoring or other service that 
enables consumers to detect the misuse of 
their personal information for a period of 2 
years, and instructions on requesting such 
reports or service from the person, except 
when the only information which has been 
the subject of the security breach is the indi-
vidual’s first name or initial and last 
name, or address, or phone number, in com-
bination with a credit or debit card num-
ber, and any required security code; and 
(ii) a telephone number by which an 
individual can, at no cost to such indi-
vidual, learn whether that individual’s per-
sonal information is included in the breach 
of security. 
(3) REGULATIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 1 year 
after the date of enactment of this Act, the Com-
mission shall, by regulation under section 553 of 
title 5, United States Code, establish criteria for 
determining circumstances under which sub-
stitute notification may be provided under para-
graph (2), including criteria for determining if 
notification under paragraph (1) is not feasible 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
due to excessive costs to the person required to 
provided such notification relative to the re-
sources of such person. Such regulations may 
also identify other circumstances where sub-
stitute notification would be appropriate for any 
person, including circumstances under which the 
cost of providing notification exceeds the benefits 
to consumers. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
with respect to compliance with this subsection. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute notification under paragraph (2), 
including the extent of notification to print 
and broadcast media that complies with the 
requirements of such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—A person required to provide 
notification under subsection (a) shall, upon request 
of an individual whose personal information was in-
cluded in the breach of security, provide or arrange 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
for the provision of, to each such individual and at 
no cost to such individual— 
(A) consumer credit reports from at least 
one of the major credit reporting agencies begin-
ning not later than 60 days following the indi-
vidual’s request and continuing on a quarterly 
basis for a period of 2 years thereafter; or 
(B) a credit monitoring or other service that 
enables consumers to detect the misuse of their 
personal information, beginning not later than 
60 days following the individual’s request and 
continuing for a period of 2 years. 
(2) LIMITATION.—This subsection shall not 
apply if the only personal information which has 
been the subject of the security breach is the individ-
ual’s first name or initial and last name, or address, 
or phone number, in combination with a credit or 
debit card number, and any required security code. 
(3) RULEMAKING.—As part of the Commission’s 
rulemaking described in subsection (d)(3), the Com-
mission shall determine the circumstances under 
which a person required to provide notification under 
subsection (a)(1) shall provide or arrange for the pro-
vision of free consumer credit reports or credit moni-
toring or other service to affected individuals. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
(f) EXEMPTION.— 
(1) GENERAL EXEMPTION.—A person shall be ex-
empt from the requirements under this section if, fol-
lowing a breach of security, such person determines 
that there is no reasonable risk of identity theft, 
fraud, or other unlawful conduct. 
(2) PRESUMPTION.— 
(A) IN GENERAL.—If the data in electronic 
form containing personal information is ren-
dered unusable, unreadable, or indecipherable 
through encryption or other security technology 
or methodology (if the method of encryption or 
such other technology or methodology is generally 
accepted by experts in the information security 
field), there shall be a presumption that no rea-
sonable risk of identity theft, fraud, or other un-
lawful conduct exists following a breach of secu-
rity of such data. Any such presumption may be 
rebutted 
by 
facts 
demonstrating 
that 
the 
encryption or other security technologies or 
methodologies in a specific case, have been or are 
reasonably likely to be compromised. 
(B) METHODOLOGIES OR TECHNOLOGIES.— 
Not later than 1 year after the date of the enact-
ment of this Act and biannually thereafter, the 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
Commission shall issue rules (pursuant to sec-
tion 553 of title 5, United States Code) or guid-
ance to identify security methodologies or tech-
nologies which render data in electronic form 
unusable, unreadable, or indecipherable, that 
shall, if applied to such data, establish a pre-
sumption that no reasonable risk of identity 
theft, fraud, or other unlawful conduct exists fol-
lowing a breach of security of such data. Any 
such presumption may be rebutted by facts dem-
onstrating that any such methodology or tech-
nology in a specific case has been or is reason-
ably likely to be compromised. In issuing such 
rules or guidance, the Commission shall consult 
with relevant industries, consumer organizations, 
and data security and identity theft prevention 
experts and established standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 year after 
the date of the enactment of this Act the Commission 
shall issue guidance regarding the application of the 
exemption in paragraph (1). 
(g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—If the Commission, upon receiving notification of 
any breach of security that is reported to the Commission 
under subsection (a)(2), finds that notification of such a 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
breach of security via the Commission’s Internet website 
would be in the public interest or for the protection of con-
sumers, the Commission shall place such a notice in a clear 
and conspicuous location on its Internet website. 
(h) FTC STUDY ON NOTIFICATION IN LANGUAGES IN 
ADDITION TO ENGLISH.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall conduct 
a study on the practicality and cost effectiveness of requir-
ing the notification required by subsection (d)(1) to be pro-
vided in a language in addition to English to individuals 
known to speak only such other language. 
(i) GENERAL RULEMAKING AUTHORITY.—The Com-
mission may promulgate regulations necessary under sec-
tion 553 of title 5, United States Code, to effectively enforce 
the requirements of this section. 
(j) TREATMENT OF PERSONS GOVERNED BY OTHER 
LAW.—A person who is in compliance with any other Fed-
eral law that requires such person to provide notification 
to individuals following a breach of security, and that, 
taken as a whole, provides protections substantially similar 
to, or greater than, those required under this section, as the 
Commission shall determine by rule (under section 553 of 
title 5, United States Code), shall be deemed to be in compli-
ance with this section. 
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS
SEC. 4. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of sec-
tions 2 and 3 shall only apply to those persons, partner-
ships, or corporations over which the Commission has au-
thority pursuant to section 5(a)(2) of the Federal Trade 
Commission Act. 
(b) ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF COMMISSION.—The Commission 
shall enforce this Act in the same manner, by the 
same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made 
a part of this Act. Any person who violates such regu-
lations shall be subject to the penalties and entitled to 
the privileges and immunities provided in that Act. 
(3) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the deploy-
VerDate Nov 24 2008 
21:08 Dec 08, 2009
Jkt 089200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H2221.RH
H2221
hsrobinson on DSK69SOYB1PROD with BILLS