traceable to such property, as a result of the 
commission of any violation of this section, or 
a conspiracy to violate this section. 
‘‘(2) Seizures and forfeitures under this sub-
section shall be governed by the provisions in chap-
ter 46 relating to civil forfeitures, except that such 
duties as are imposed on the Secretary of the Treas-
ury under the customs laws described in section 
981(d) shall be performed by such officers, agents 
and other persons as may be designated for that 
purpose by the Secretary of Homeland Security or 
the Attorney General.’’. 
SEC. 107. LIMITATION ON CIVIL ACTIONS INVOLVING UNAU-
THORIZED USE. 
Section 1030(g) of title 18, United States Code, is 
amended— 
(1) by inserting ‘‘(1)’’ before ‘‘Any person’’; 
and 
(2) by adding at the end the following: 
‘‘(2) No action may be brought under this subsection 
if a violation of a contractual obligation or agreement, 
such as an acceptable use policy or terms of service agree-
ment, constitutes the sole basis for determining that ac-
cess to the protected computer is unauthorized, or in ex-
cess of authorization.’’. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 108. REPORTING OF CERTAIN CRIMINAL CASES. 
Section 1030 of title 18, United States Code, is 
amended by adding at the end the following: 
‘‘(k) REPORTING CERTAIN CRIMINAL CASES.—Not 
later than 1 year after the date of the enactment of this 
Act, and annually thereafter, the Attorney General shall 
report to the Committee on the Judiciary of the Senate 
and the Committee on the Judiciary of the House of Rep-
resentatives the number of criminal cases brought under 
subsection (a) that involve conduct in which— 
‘‘(1) the defendant— 
‘‘(A) exceeded authorized access to a non- 
governmental computer; or 
‘‘(B) accessed a non-governmental com-
puter without authorization; and 
‘‘(2) the sole basis for the Government deter-
mining that access to the non-governmental com-
puter was unauthorized, or in excess of authoriza-
tion was that the defendant violated a contractual 
obligation or agreement with a service provider or 
employer, such as an acceptable use policy or terms 
of service agreement.’’. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 109. DAMAGE TO CRITICAL INFRASTRUCTURE COM-
PUTERS. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by inserting after section 1030 
the following: 
‘‘§ 1030A. Aggravated damage to a critical infrastruc-
ture computer 
‘‘(a) DEFINITIONS.—In this section— 
‘‘(1) the terms ‘computer’ and ‘damage’ have 
the meanings given such terms in section 1030; and 
‘‘(2) the term ‘critical infrastructure computer’ 
means a computer that manages or controls systems 
or assets vital to national defense, national security, 
national economic security, public health or safety, 
or any combination of those matters, whether pub-
licly or privately owned or operated, including— 
‘‘(A) gas and oil production, storage, and 
delivery systems; 
‘‘(B) water supply systems; 
‘‘(C) telecommunication networks; 
‘‘(D) electrical power delivery systems; 
‘‘(E) finance and banking systems; 
‘‘(F) emergency services; 
‘‘(G) transportation systems and services; 
and 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(H) government operations that provide 
essential services to the public. 
‘‘(b) OFFENSE.—It shall be unlawful to, during and 
in relation to a felony violation of section 1030, inten-
tionally cause or attempt to cause damage to a critical 
infrastructure computer, and such damage results in (or, 
in the case of an attempt, would, if completed have re-
sulted in) the substantial impairment— 
‘‘(1) of the operation of the critical infrastruc-
ture computer; or 
‘‘(2) of the critical infrastructure associated 
with the computer. 
‘‘(c) PENALTY.—Any person who violates subsection 
(b) shall be fined under this title, imprisoned for not less 
than 3 years nor more than 20 years, or both. 
‘‘(d) CONSECUTIVE
SENTENCE.—Notwithstanding 
any other provision of law— 
‘‘(1) a court shall not place on probation any 
person convicted of a violation of this section; 
‘‘(2) except as provided in paragraph (4), no 
term of imprisonment imposed on a person under 
this section shall run concurrently with any other 
term of imprisonment, including any term of impris-
onment imposed on the person under any other pro-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
vision of law, including any term of imprisonment 
imposed for the felony violation section 1030; 
‘‘(3) in determining any term of imprisonment 
to be imposed for a felony violation of section 1030, 
a court shall not in any way reduce the term to be 
imposed for such crime so as to compensate for, or 
otherwise take into account, any separate term of 
imprisonment imposed or to be imposed for a viola-
tion of this section; and 
‘‘(4) a term of imprisonment imposed on a per-
son for a violation of this section may, in the discre-
tion of the court, run concurrently, in whole or in 
part, only with another term of imprisonment that 
is imposed by the court at the same time on that 
person for an additional violation of this section, 
provided that such discretion shall be exercised in 
accordance with any applicable guidelines and policy 
statements issued by the United States Sentencing 
Commission pursuant to section 994 of title 28.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for chapter 47 of title 18, United 
States Code, is amended by inserting after the item relat-
ing to section 1030 the following: 
‘‘1030A. Aggravated damage to a critical infrastructure computer.’’. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6211
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 110. LIMITATION ON ACTIONS INVOLVING UNAUTHOR-
IZED USE. 
Section 1030(e)(6) of title 18, United States Code, 
is amended by striking ‘‘alter;’’ and inserting ‘‘alter, but 
does not include access in violation of a contractual obliga-
tion or agreement, such as an acceptable use policy or 
terms of service agreement, with an Internet service pro-
vider, Internet website, or non-government employer, if 
such violation constitutes the sole basis for determining 
that access to a protected computer is unauthorized;’’. 
TITLE II—PRIVACY AND SECU-
RITY OF PERSONALLY IDEN-
TIFIABLE INFORMATION 
Subtitle A—A Data Privacy and 
Security Program 
SEC. 201. PURPOSE AND APPLICABILITY OF DATA PRIVACY 
AND SECURITY PROGRAM. 
(a) PURPOSE.—The purpose of this subtitle is to en-
sure standards for developing and implementing adminis-
trative, technical, and physical safeguards to protect the 
security of sensitive personally identifiable information. 
(b) APPLICABILITY.—A business entity engaging in 
interstate commerce that involves collecting, accessing, 
transmitting, using, storing, or disposing of sensitive per-
sonally identifiable information in electronic or digital 
form on 10,000 or more United States persons is subject 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
to the requirements for a data privacy and security pro-
gram under section 202 for protecting sensitive personally 
identifiable information. 
(c) LIMITATIONS.—Notwithstanding any other obli-
gation under this subtitle, this subtitle does not apply to 
the following: 
(1) FINANCIAL INSTITUTIONS.—Financial insti-
tutions— 
(A) subject to the data security require-
ments and standards under section 501(b) of 
the 
Gramm-Leach-Bliley 
Act 
(15 
U.S.C. 
6801(b)); and 
(B) subject to the jurisdiction of an agency 
or authority described in section 505(a) of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)). 
(2) HIPAA REGULATED ENTITIES.— 
(A) COVERED ENTITIES.—Covered entities 
subject to the Health Insurance Portability and 
Accountability Act of 1996 (42 U.S.C. 1301 et 
seq.), including the data security requirements 
and implementing regulations of that Act. 
(B) BUSINESS ENTITIES.—A business enti-
ty shall be deemed in compliance with this Act 
if the business entity— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(i) is acting as a business associate, 
as that term is defined under the Health 
Insurance Portability and Accountability 
Act of 1996 (42 U.S.C. 1301 et seq.) and 
is in compliance with the requirements im-
posed under that Act and implementing 
regulations promulgated under that Act; 
and 
(ii) is subject to, and currently in 
compliance, with the privacy and data se-
curity requirements under sections 13401 
and 13404 of division A of the American 
Reinvestment and Recovery Act of 2009 
(42 U.S.C. 17931 and 17934) and imple-
menting regulations promulgated under 
such sections. 
(3) SERVICE
PROVIDERS.—A service provider 
for any electronic communication by a third party, 
to the extent that the service provider is exclusively 
engaged in the transmission, routing, or temporary, 
intermediate, or transient storage of that commu-
nication. 
(4) PUBLIC RECORDS.—Public records not oth-
erwise subject to a confidentiality or nondisclosure 
requirement, or information obtained from a public 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
record, including information obtained from a news 
report or periodical. 
(d) SAFE HARBORS.— 
(1) IN GENERAL.—A business entity shall be 
deemed in compliance with the privacy and security 
program requirements under section 202 if the busi-
ness entity complies with or provides protection 
equal to industry standards or standards widely ac-
cepted as an effective industry practice, as identified 
by the Federal Trade Commission, that are applica-
ble to the type of sensitive personally identifiable in-
formation involved in the ordinary course of business 
of such business entity. 
(2) LIMITATION.—Nothing in this subsection 
shall be construed to permit, and nothing does per-
mit, the Federal Trade Commission to issue regula-
tions requiring, or according greater legal status to, 
the implementation of or application of a specific 
technology or technological specifications for meeting 
the requirements of this title. 
SEC. 202. REQUIREMENTS FOR A PERSONAL DATA PRIVACY 
AND SECURITY PROGRAM. 
(a) PERSONAL DATA PRIVACY AND SECURITY PRO-
GRAM.—A business entity subject to this subtitle shall 
comply with the following safeguards and any other ad-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
ministrative, technical, or physical safeguards identified by 
the Federal Trade Commission in a rulemaking process 
pursuant to section 553 of title 5, United States Code, 
for the protection of sensitive personally identifiable infor-
mation: 
(1) SCOPE.—A business entity shall implement 
a comprehensive personal data privacy and security 
program that includes administrative, technical, and 
physical safeguards appropriate to the size and com-
plexity of the business entity and the nature and 
scope of its activities. 
(2) DESIGN.—The personal data privacy and 
security program shall be designed to— 
(A) ensure the privacy, security, and con-
fidentiality of sensitive personally identifying in-
formation; 
(B) 
protect 
against 
any 
anticipated 
vulnerabilities to the privacy, security, or integ-
rity of sensitive personally identifying informa-
tion; and 
(C) protect against unauthorized access to 
use of sensitive personally identifying informa-
tion that could create a significant risk of harm 
or fraud to any individual. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(3) RISK
ASSESSMENT.—A business entity 
shall— 
(A) identify reasonably foreseeable internal 
and external vulnerabilities that could result in 
unauthorized access, disclosure, use, or alter-
ation of sensitive personally identifiable infor-
mation or systems containing sensitive person-
ally identifiable information; 
(B) assess the likelihood of and potential 
damage from unauthorized access, disclosure, 
use, or alteration of sensitive personally identifi-
able information; 
(C) assess the sufficiency of its policies, 
technologies, and safeguards in place to control 
and minimize risks from unauthorized access, 
disclosure, use, or alteration of sensitive person-
ally identifiable information; and 
(D) assess the vulnerability of sensitive 
personally identifiable information during de-
struction and disposal of such information, in-
cluding through the disposal or retirement of 
hardware. 
(4) RISK MANAGEMENT AND CONTROL.—Each 
business entity shall— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(A) design its personal data privacy and 
security program to control the risks identified 
under paragraph (3); 
(B) adopt measures commensurate with 
the sensitivity of the data as well as the size, 
complexity, and scope of the activities of the 
business entity that— 
(i) control access to systems and fa-
cilities containing sensitive personally iden-
tifiable information, including controls to 
authenticate and permit access only to au-
thorized individuals; 
(ii) detect, record, and preserve infor-
mation relevant to actual and attempted 
fraudulent, unlawful, or unauthorized ac-
cess, disclosure, use, or alteration of sen-
sitive personally identifiable information, 
including by employees and other individ-
uals otherwise authorized to have access; 
(iii) protect sensitive personally identi-
fiable information during use, trans-
mission, 
storage, 
and 
disposal 
by 
encryption, redaction, or access controls 
that are widely accepted as an effective in-
dustry practice or industry standard, or 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
other reasonable means (including as di-
rected for disposal of records under section 
628 of the Fair Credit Reporting Act (15 
U.S.C. 1681w) and the implementing regu-
lations of such Act as set forth in section 
682 of title 16, Code of Federal Regula-
tions); 
(iv) ensure that sensitive personally 
identifiable information is properly de-
stroyed and disposed of, including during 
the destruction of computers, diskettes, 
and other electronic media that contain 
sensitive personally identifiable informa-
tion; 
(v) trace access to records containing 
sensitive personally identifiable information 
so that the business entity can determine 
who accessed or acquired such sensitive 
personally identifiable information per-
taining to specific individuals; and 
(vi) ensure that no third party or cus-
tomer of the business entity is authorized 
to access or acquire sensitive personally 
identifiable information without the busi-
ness entity first performing sufficient due 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
diligence to ascertain, with reasonable cer-
tainty, that such information is being 
sought for a valid legal purpose; and 
(C) establish a plan and procedures for 
minimizing the amount of sensitive personally 
identifiable information maintained by such 
business entity, which shall provide for the re-
tention of sensitive personally identifiable infor-
mation only as reasonably needed for the busi-
ness purposes of such business entity or as nec-
essary to comply with any legal obligation. 
(b) TRAINING.—Each business entity subject to this 
subtitle shall take steps to ensure employee training and 
supervision for implementation of the data security pro-
gram of the business entity. 
(c) VULNERABILITY TESTING.— 
(1) IN GENERAL.—Each business entity subject 
to this subtitle shall take steps to ensure regular 
testing of key controls, systems, and procedures of 
the personal data privacy and security program to 
detect, prevent, and respond to attacks or intrusions, 
or other system failures. 
(2) FREQUENCY.—The frequency and nature of 
the tests required under paragraph (1) shall be de-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
termined by the risk assessment of the business enti-
ty under subsection (a)(3). 
(d) RELATIONSHIP
TO CERTAIN PROVIDERS
OF 
SERVICES.—In the event a business entity subject to this 
subtitle engages a person or entity not subject to this sub-
title (other than a service provider) to receive sensitive 
personally identifiable information in performing services 
or functions (other than the services or functions provided 
by a service provider) on behalf of and under the instruc-
tion of such business entity, such business entity shall— 
(1) exercise appropriate due diligence in select-
ing the person or entity for responsibilities related to 
sensitive personally identifiable information, and 
take reasonable steps to select and retain a person 
or entity that is capable of maintaining appropriate 
safeguards for the security, privacy, and integrity of 
the sensitive personally identifiable information at 
issue; and 
(2) require the person or entity by contract to 
implement and maintain appropriate measures de-
signed to meet the objectives and requirements gov-
erning entities subject to section 201, this section, 
and subtitle B. 
(e) PERIODIC ASSESSMENT AND PERSONAL DATA 
PRIVACY AND SECURITY MODERNIZATION.—Each busi-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
ness entity subject to this subtitle shall on a regular basis 
monitor, evaluate, and adjust, as appropriate its data pri-
vacy and security program in light of any relevant changes 
in— 
(1) technology; 
(2) the sensitivity of personally identifiable in-
formation; 
(3) internal or external threats to personally 
identifiable information; and 
(4) the changing business arrangements of the 
business entity, such as— 
(A) mergers and acquisitions; 
(B) alliances and joint ventures; 
(C) outsourcing arrangements; 
(D) bankruptcy; and 
(E) changes to sensitive personally identifi-
able information systems. 
(f) IMPLEMENTATION TIMELINE.—Not later than 1 
year after the date of enactment of this Act, a business 
entity subject to the provisions of this subtitle shall imple-
ment a data privacy and security program pursuant to this 
subtitle. 
SEC. 203. ENFORCEMENT. 
(a) CIVIL PENALTIES.— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(1) IN GENERAL.—Any business entity that vio-
lates the provisions of section 201 or 202 shall be 
subject to civil penalties of not more than $5,000 
per violation per day while such a violation exists, 
with a maximum of $500,000 per violation. 
(2) INTENTIONAL OR WILLFUL VIOLATION.—A 
business entity that intentionally or willfully violates 
the provisions of section 201 or 202 shall be subject 
to additional penalties in the amount of $5,000 per 
violation per day while such a violation exists, with 
a maximum of an additional $500,000 per violation. 
(3) PENALTY LIMITS.— 
(A) IN
GENERAL.—Notwithstanding any 
other provision of law, the total sum of civil 
penalties assessed against a business entity for 
all violations of the provisions of this subtitle 
resulting from the same or related acts or omis-
sions shall not exceed $500,000, unless such 
conduct is found to be willful or intentional. 
(B) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
sion of this subtitle was willful or intentional, 
and if so, the amount of the additional penalty 
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(C) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (B) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $500,000. 
(4) EQUITABLE RELIEF.—A business entity en-
gaged in interstate commerce that violates this sec-
tion may be enjoined from further violations by a 
United States district court. 
(5) OTHER
RIGHTS
AND
REMEDIES.—The 
rights and remedies available under this section are 
cumulative and shall not affect any other rights and 
remedies available under law. 
(b) FEDERAL TRADE COMMISSION AUTHORITY.— 
Any business entity shall have the provisions of this sub-
title enforced against it by the Federal Trade Commission. 
(c) STATE ENFORCEMENT.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or any State or local law 
enforcement agency authorized by the State attorney 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
general or by State statute to prosecute violations of 
consumer protection law, has reason to believe that 
an interest of the residents of that State has been 
or is threatened or adversely affected by the acts or 
practices of a business entity that violate this sub-
title, the State may bring a civil action on behalf of 
the residents of that State in a district court of the 
United States of appropriate jurisdiction to— 
(A) enjoin that act or practice; 
(B) enforce compliance with this subtitle; 
or 
(C) obtain civil penalties of not more than 
$5,000 per violation per day while such viola-
tions persist, up to a maximum of $500,000 per 
violation. 
(2) PENALTY LIMITS.— 
(A) IN
GENERAL.—Notwithstanding any 
other provision of law, the total sum of civil 
penalties assessed against a business entity for 
all violations of the provisions of this subtitle 
resulting from the same or related acts or omis-
sions shall not exceed $500,000, unless such 
conduct is found to be willful or intentional. 
(B) DETERMINATIONS.—The determina-
tion of whether a violation of a provision of this 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
subtitle has occurred, and if so, the amount of 
the penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. The 
determination of whether a violation of a provi-
sion of this subtitle was willful or intentional, 
and if so, the amount of the additional penalty 
to be imposed, if any, shall be made by the 
court sitting as the finder of fact. 
(C) ADDITIONAL
PENALTY
LIMIT.—If a 
court determines under subparagraph (B) that 
a violation of a provision of this subtitle was 
willful or intentional and imposes an additional 
penalty, the court may not impose an additional 
penalty in an amount that exceeds $500,000. 
(3) NOTICE.— 
(A) IN GENERAL.—Before filing an action 
under this subsection, the attorney general of 
the State involved shall provide to the Federal 
Trade Commission— 
(i) a written notice of that action; and 
(ii) a copy of the complaint for that 
action. 
(B) EXCEPTION.—Subparagraph (A) shall 
not apply with respect to the filing of an action 
by an attorney general of a State under this 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
subsection, if the attorney general of a State 
determines that it is not feasible to provide the 
notice described in this subparagraph before the 
filing of the action. 
(C) NOTIFICATION WHEN PRACTICABLE.— 
In an action described under subparagraph (B), 
the attorney general of a State shall provide the 
written notice and the copy of the complaint to 
the Federal Trade Commission as soon after 
the filing of the complaint as practicable. 
(4) FEDERAL
TRADE
COMMISSION
AUTHOR-
ITY.—Upon receiving notice under paragraph (2), 
the Federal Trade Commission shall have the right 
to— 
(A) move to stay the action, pending the 
final disposition of a pending Federal pro-
ceeding or action as described in paragraph (4); 
(B) intervene in an action brought under 
paragraph (1); and 
(C) file petitions for appeal. 
(5) PENDING
PROCEEDINGS.—If the Federal 
Trade Commission initiates a Federal civil action for 
a violation of this subtitle, or any regulations there-
under, no attorney general of a State may bring an 
action for a violation of this subtitle that resulted 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
from the same or related acts or omissions against 
a defendant named in the Federal civil action initi-
ated by the Federal Trade Commission. 
(6) RULE OF CONSTRUCTION.—For purposes of 
bringing any civil action under paragraph (1) noth-
ing in this subtitle shall be construed to prevent an 
attorney general of a State from exercising the pow-
ers conferred on the attorney general by the laws of 
that State to— 
(A) conduct investigations; 
(B) administer oaths and affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(7) VENUE; SERVICE OF PROCESS.— 
(A) VENUE.—Any action brought under 
this subsection may be brought in the district 
court of the United States that meets applicable 
requirements relating to venue under section 
1391 of title 28, United States Code. 
(B) SERVICE OF PROCESS.—In an action 
brought under this subsection, process may be 
served in any district in which the defendant— 
(i) is an inhabitant; or 
(ii) may be found. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(d) NO PRIVATE CAUSE OF ACTION.—Nothing in 
this subtitle establishes a private cause of action against 
a business entity for violation of any provision of this sub-
title. 
SEC. 204. RELATION TO OTHER LAWS. 
(a) IN GENERAL.—No State may require any busi-
ness entity subject to this subtitle to comply with any re-
quirements with respect to administrative, technical, and 
physical safeguards for the protection of personal informa-
tion. 
(b) LIMITATIONS.—Nothing in this subtitle shall be 
construed to modify, limit, or supersede the operation of 
the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) or 
its implementing regulations, including those adopted or 
enforced by States. 
Subtitle B—Security Breach 
Notification 
SEC. 211. NOTICE TO INDIVIDUALS. 
(a) IN GENERAL.—Except as provided in section 212, 
any agency, or business entity engaged in interstate com-
merce, other than a service provider, that uses, accesses, 
transmits, stores, disposes of or collects sensitive person-
ally identifiable information shall, following the discovery 
of a security breach of such information, notify any resi-
dent of the United States whose sensitive personally iden-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
tifiable information has been, or is reasonably believed to 
have been, accessed, or acquired. 
(b) OBLIGATION OF OWNER OR LICENSEE.— 
(1) NOTICE
TO
OWNER
OR
LICENSEE.—Any 
agency, or business entity engaged in interstate com-
merce, that uses, accesses, transmits, stores, dis-
poses of, or collects sensitive personally identifiable 
information that the agency or business entity does 
not own or license shall notify the owner or licensee 
of the information following the discovery of a secu-
rity breach involving such information. 
(2) NOTICE BY OWNER, LICENSEE, OR OTHER 
DESIGNATED THIRD PARTY.—Nothing in this sub-
title shall prevent or abrogate an agreement between 
an agency or business entity required to give notice 
under this section and a designated third party, in-
cluding an owner or licensee of the sensitive person-
ally identifiable information subject to the security 
breach, to provide the notifications required under 
subsection (a). 
(3) BUSINESS ENTITY RELIEVED FROM GIVING 
NOTICE.—A business entity obligated to give notice 
under subsection (a) shall be relieved of such obliga-
tion if an owner or licensee of the sensitive person-
ally identifiable information subject to the security 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
breach, or other designated third party, provides 
such notification. 
(4) SERVICE PROVIDERS.—If a service provider 
becomes aware of a security breach of data in elec-
tronic form containing sensitive personal information 
that is owned or possessed by another business enti-
ty that connects to or uses a system or network pro-
vided by the service provider for the purpose of 
transmitting, routing, or providing intermediate or 
transient storage of such data, the service provider 
shall be required to notify the business entity who 
initiated such connection, transmission, routing, or 
storage of the security breach if the business entity 
can be reasonably identified. Upon receiving such 
notification from a service provider, the business en-
tity shall be required to provide the notification re-
quired under subsection (a). 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay following the discovery by the agency or 
business entity of a security breach. 
(2) REASONABLE DELAY.— 
(A) IN GENERAL.—Reasonable delay under 
this subsection may include any time necessary 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
to determine the scope of the security breach, 
prevent further disclosures, conduct the risk as-
sessment described in section 202(a)(3), and re-
store the reasonable integrity of the data sys-
tem and provide notice to law enforcement 
when required. 
(B) EXTENSION.— 
(i) IN GENERAL.—Except as provided 
in subsection (d), delay of notification shall 
not exceed 60 days following the discovery 
of the security breach, unless the business 
entity or agency requests an extension of 
time and the Federal Trade Commission 
determines in writing that additional time 
is reasonably necessary to determine the 
scope of the security breach, prevent fur-
ther disclosures, conduct the risk assess-
ment, restore the reasonable integrity of 
the data system, or to provide notice to the 
designated entity. 
(ii) APPROVAL OF REQUEST.—If the 
Federal Trade Commission approves the 
request for delay, the agency or business 
entity may delay the time period for notifi-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
cation for additional periods of up to 30 
days. 
(3) BURDEN
OF
PRODUCTION.—The agency, 
business entity, owner, or licensee required to pro-
vide notice under this subtitle shall, upon the re-
quest of the Attorney General or the Federal Trade 
Commission provide records or other evidence of the 
notifications required under this subtitle, including 
to the extent applicable, the reasons for any delay of 
notification. 
(d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT OR NATIONAL SECURITY PURPOSES.— 
(1) IN GENERAL.—If the United States Secret 
Service or the Federal Bureau of Investigation de-
termines that the notification required under this 
section would impede a criminal investigation, or na-
tional security activity, such notification shall be de-
layed upon written notice from the United States 
Secret Service or the Federal Bureau of Investiga-
tion to the agency or business entity that experi-
enced the breach. The notification from the United 
States Secret Service or the Federal Bureau of In-
vestigation shall specify in writing the period of 
delay requested for law enforcement or national se-
curity purposes. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(2) EXTENDED DELAY OF NOTIFICATION.—If 
the notification required under subsection (a) is de-
layed pursuant to paragraph (1), an agency or busi-
ness entity shall give notice 30 days after the day 
such law enforcement or national security delay was 
invoked unless a Federal law enforcement or intel-
ligence agency provides written notification that fur-
ther delay is necessary. 
(3) LAW ENFORCEMENT IMMUNITY.—No non- 
constitutional cause of action shall lie in any court 
against any agency for acts relating to the delay of 
notification for law enforcement or national security 
purposes under this subtitle. 
(e) LIMITATIONS.—Notwithstanding any other obli-
gation under this subtitle, this subtitle does not apply to 
the following: 
(1) FINANCIAL INSTITUTIONS.—Financial insti-
tutions— 
(A) subject to the data security require-
ments and standards under section 501(b) of 
the 
Gramm-Leach-Bliley 
Act 
(15 
U.S.C. 
6801(b)); and 
(B) subject to the jurisdiction of an agency 
or authority described in section 505(a) of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)). 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(2) HIPAA REGULATED ENTITIES.— 
(A) COVERED ENTITIES.—Covered entities 
subject to the Health Insurance Portability and 
Accountability Act of 1996 (42 U.S.C. 1301 et 
seq.), including the data security requirements 
and implementing regulations of that Act. 
(B) BUSINESS ENTITIES.—A business enti-
ty shall be deemed in compliance with this Act 
if the business entity— 
(i)(I) is acting as a covered entity and 
as a business associate, as those terms are 
defined under the Health Insurance Port-
ability and Accountability Act of 1996 (42 
U.S.C. 1301 et seq.) and is in compliance 
with the requirements imposed under that 
Act and implementing regulations promul-
gated under that Act; and 
(II) is subject to, and currently in 
compliance, with the data breach notifica-
tion, privacy and data security require-
ments under the Health Information Tech-
nology for Economic and Clinical Health 
(HITECH) Act, (42 U.S.C. 17932) and 
implementing 
regulations 
promulgated 
thereunder; or 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(ii) is acting as a vendor of personal 
health records and third party service pro-
vider, subject to the Health Information 
Technology for Economic and Clinical 
Health (HITECH) Act (42 U.S.C. 17937), 
including the data breach notification re-
quirements and implementing regulations 
of that Act. 
SEC. 212. EXEMPTIONS. 
(a) EXEMPTION FOR NATIONAL SECURITY AND LAW 
ENFORCEMENT.— 
(1) IN GENERAL.—Section 211 shall not apply 
to an agency or business entity if— 
(A) the United States Secret Service or the 
Federal Bureau of Investigation determines 
that notification of the security breach could be 
expected to reveal sensitive sources and meth-
ods or similarly impede the ability of the Gov-
ernment to conduct law enforcement investiga-
tions; or 
(B) the Federal Bureau of Investigation 
determines that notification of the security 
breach could be expected to cause damage to 
the national security. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(2) IMMUNITY.—No non-constitutional cause of 
action shall lie in any court against any Federal 
agency for acts relating to the exemption from noti-
fication for law enforcement or national security 
purposes under this title. 
(b) SAFE HARBOR.— 
(1) IN GENERAL.—An agency or business entity 
shall be exempt from the notice requirements under 
section 211, if— 
(A) a risk assessment conducted by the 
agency or business entity concludes that, based 
upon the information available, there is no sig-
nificant risk that a security breach has resulted 
in, or will result in, identity theft, economic loss 
or harm, or physical harm to the individuals 
whose sensitive personally identifiable informa-
tion was subject to the security breach; 
(B) without unreasonable delay, but not 
later than 45 days after the discovery of a secu-
rity breach, unless extended by the Federal 
Trade Commission, the agency or business enti-
ty notifies the Federal Trade Commission, in 
writing, of— 
(i) the results of the risk assessment; 
and 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(ii) its decision to invoke the risk as-
sessment exemption; and 
(C) the Federal Trade Commission does 
not indicate, in writing, within 10 business days 
from receipt of the decision, that notice should 
be given. 
(2) REBUTTABLE
PRESUMPTIONS.—For pur-
poses of paragraph (1)— 
(A) the encryption of sensitive personally 
identifiable information described in paragraph 
(1)(A)(i) shall establish a rebuttable presump-
tion that no significant risk exists; and 
(B) the rendering of sensitive personally 
identifiable information described in paragraph 
(1)(A)(ii) unusable, unreadable, or indecipher-
able through data security technology or meth-
odology that is generally accepted by experts in 
the field of information security, such as redac-
tion or access controls shall establish a rebutta-
ble presumption that no significant risk exists. 
(3) VIOLATION.—It shall be a violation of this 
section to— 
(A) fail to conduct the risk assessment in 
a reasonable manner, or according to standards 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
generally accepted by experts in the field of in-
formation security; or 
(B) submit the results of a risk assessment 
that contains fraudulent or deliberately mis-
leading information. 
(c) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
(1) IN GENERAL.—A business entity will be ex-
empt from the notice requirement under section 211 
if the business entity utilizes or participates in a se-
curity program that— 
(A) effectively blocks the use of the sen-
sitive personally identifiable information to ini-
tiate unauthorized financial transactions before 
they are charged to the account of the indi-
vidual; and 
(B) provides for notice to affected individ-
uals after a security breach that has resulted in 
fraud or unauthorized transactions. 
(2) LIMITATION.—The exemption in paragraph 
(1) does not apply if the information subject to the 
security breach includes an individual’s first and last 
name, or any other type of sensitive personally iden-
tifiable information as defined in section 3, unless 
that information is only a credit card number or 
credit card security code. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 213. METHODS OF NOTICE. 
An agency or business entity shall be in compliance 
with section 211 if it provides the following: 
(1) INDIVIDUAL NOTICE.—Notice to individuals 
by one of the following means: 
(A) Written notification to the last known 
home mailing address of the individual in the 
records of the agency or business entity. 
(B) Telephone notice to the individual per-
sonally. 
(C) E-mail notice, if the individual has 
consented to receive such notice and the notice 
is consistent with the provisions permitting elec-
tronic transmission of notices under section 101 
of the Electronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 7001). 
(2) MEDIA
NOTICE.—Notice to major media 
outlets serving a State or jurisdiction, if the number 
of residents of such State whose sensitive personally 
identifiable information was, or is reasonably be-
lieved to have been, accessed or acquired by an un-
authorized person exceeds 5,000. 
SEC. 214. CONTENT OF NOTIFICATION. 
(a) IN GENERAL.—Regardless of the method by 
which notice is provided to individuals under section 213, 
such notice shall include, to the extent possible— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(1) a description of the categories of sensitive 
personally identifiable information that was, or is 
reasonably believed to have been, accessed or ac-
quired by an unauthorized person; 
(2) a toll-free number— 
(A) that the individual may use to contact 
the agency or business entity, or the agent of 
the agency or business entity; and 
(B) from which the individual may learn 
what types of sensitive personally identifiable 
information the agency or business entity main-
tained about that individual; and 
(3) the toll-free contact telephone numbers and 
addresses for the major credit reporting agencies. 
(b) ADDITIONAL CONTENT.—Notwithstanding sec-
tion 219, a State may require that a notice under sub-
section (a) shall also include information regarding victim 
protection assistance provided for by that State. 
(c) DIRECT BUSINESS RELATIONSHIP.—Regardless 
of whether a business entity, agency, or a designated third 
party provides the notice required pursuant to section 
211(b), such notice shall include the name of the business 
entity or agency that has a direct relationship with the 
individual being notified. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 215. COORDINATION OF NOTIFICATION WITH CREDIT 
REPORTING AGENCIES. 
If an agency or business entity is required to provide 
notification to more than 5,000 individuals under section 
211(a), the agency or business entity shall also notify all 
consumer reporting agencies that compile and maintain 
files on consumers on a nationwide basis (as defined in 
section 603(p) of the Fair Credit Reporting Act (15 
U.S.C. 1681a(p))) of the timing and distribution of the 
notices. Such notice shall be given to the consumer credit 
reporting agencies without unreasonable delay and, if it 
will not delay notice to the affected individuals, prior to 
the distribution of notices to the affected individuals. 
SEC. 216. NOTICE TO LAW ENFORCEMENT. 
(a) DESIGNATION OF GOVERNMENT ENTITY TO RE-
CEIVE NOTICE.— 
(1) IN GENERAL.—Not later than 60 days after 
the date of enactment of this Act, the Secretary of 
Homeland Security shall designate a Federal Gov-
ernment entity to receive the notices required under 
section 212 and this section, and any other reports 
and information about information security inci-
dents, threats, and vulnerabilities. 
(2) RESPONSIBILITIES
OF
THE
DESIGNATED 
ENTITY.—The designated entity shall— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(A) be responsible for promptly providing 
the information that it receives to the United 
States Secret Service and the Federal Bureau 
of Investigation, and to the Federal Trade 
Commission for civil law enforcement purposes; 
and 
(B) provide the information described in 
subparagraph (A) as appropriate to other Fed-
eral agencies for law enforcement, national se-
curity, or data security purposes. 
(b) NOTICE.—Any business entity or agency shall no-
tify the designated entity of the fact that a security breach 
has occurred if— 
(1) the number of individuals whose sensitive 
personally identifying information was, or is reason-
ably believed to have been accessed or acquired by 
an unauthorized person exceeds 5,000; 
(2) the security breach involves a database, 
networked or integrated databases, or other data 
system containing the sensitive personally identifi-
able information of more than 500,000 individuals 
nationwide; 
(3) the security breach involves databases 
owned by the Federal Government; or 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(4) the security breach involves primarily sen-
sitive personally identifiable information of individ-
uals known to the agency or business entity to be 
employees and contractors of the Federal Govern-
ment involved in national security or law enforce-
ment. 
(c) FTC RULEMAKING AND REVIEW OF THRESH-
OLDS.— 
(1) REPORTS.—Not later than 1 year after the 
date of the enactment of this Act, the Federal Trade 
Commission, in consultation with the Attorney Gen-
eral of the United States and the Secretary of 
Homeland Security, shall promulgate regulations 
under section 553 of title 5, United States Code, re-
garding the reports required under subsection (a). 
(2) THRESHOLDS FOR NOTICE.—The Federal 
Trade Commission, in consultation with the Attor-
ney General and the Secretary of Homeland Secu-
rity, after notice and the opportunity for public com-
ment, and in a manner consistent with this section, 
shall promulgate regulations, as necessary, under 
section 553 of title 5, United States Code, to adjust 
the thresholds for notice to law enforcement and na-
tional security authorities under subsection (a) and 
to facilitate the purposes of this section. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(d) TIMING.—The notice required under subsection 
(a) shall be provided as promptly as possible, but such 
notice must be provided either 72 hours before notice is 
provided to an individual pursuant to section 211, or not 
later than 10 days after the business entity or agency dis-
covers the security breach or discovers that the nature of 
the security breach requires notice to law enforcement 
under this section, whichever occurs first. 
SEC. 217. ENFORCEMENT. 
(a) IN GENERAL.—The Attorney General and the 
Federal Trade Commission may enforce civil violations of 
section 211. 
(b) CIVIL ACTIONS BY THE ATTORNEY GENERAL OF 
THE UNITED STATES.— 
(1) IN GENERAL.—The Attorney General may 
bring a civil action in the appropriate United States 
district court against any business entity that en-
gages in conduct constituting a violation of this sub-
title and, upon proof of such conduct by a prepon-
derance of the evidence, such business entity shall be 
subject to a civil penalty of not more than $11,000 
per day per security breach. 
(2) PENALTY
LIMITATION.—Notwithstanding 
any other provision of law, the total amount of the 
civil penalty assessed against a business entity for 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
conduct involving the same or related acts or omis-
sions that results in a violation of this subtitle may 
not exceed $1,000,000. 
(3) DETERMINATIONS.—The determination of 
whether a violation of a provision of this subtitle has 
occurred, and if so, the amount of the penalty to be 
imposed, if any, shall be made by the court sitting 
as the finder of fact. The determination of whether 
a violation of a provision of this subtitle was willful 
or intentional, and if so, the amount of the addi-
tional penalty to be imposed, if any, shall be made 
by the court sitting as the finder of fact. 
(4) ADDITIONAL PENALTY LIMIT.—If a court 
determines under paragraph (3) that a violation of 
a provision of this subtitle was willful or intentional 
and imposes an additional penalty, the court may 
not impose an additional penalty in an amount that 
exceeds $1,000,000. 
(c) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN-
ERAL.— 
(1) IN GENERAL.—If it appears that a business 
entity has engaged, or is engaged, in any act or 
practice constituting a violation of this subtitle, the 
Attorney General may petition an appropriate dis-
trict court of the United States for an order— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general 
of a State shall provide notice and a copy 
of the complaint to the Attorney General 
at the time the State attorney general files 
the action. 
(b) FEDERAL PROCEEDINGS.—Upon receiving notice 
under subsection (a)(2), the Attorney General shall have 
the right to— 
(1) move to stay the action, pending the final 
disposition of a pending Federal proceeding or ac-
tion; 
(2) initiate an action in the appropriate United 
States district court under section 217 and move to 
consolidate all pending actions, including State ac-
tions, in such court; 
(3) intervene in an action brought under sub-
section (a)(2); and 
(4) file petitions for appeal. 
(c) PENDING PROCEEDINGS.—If the Attorney Gen-
eral or the Federal Trade Commission initiate a criminal 
proceeding or civil action for a violation of a provision of 
this subtitle, or any regulations thereunder, no attorney 
general of a State may bring an action for a violation of 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS