I 
113TH CONGRESS 
2D SESSION 
H. R. 3990 
To prevent and mitigate identity theft, to ensure privacy, to provide notice 
of security breaches, and to enhance criminal penalties, law enforcement 
assistance, and other protections against security breaches, fraudulent 
access, and misuse of personally identifiable information. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 4, 2014 
Ms. SHEA-PORTER introduced the following bill; which was referred to the 
Committee on the Judiciary, and in addition to the Committees on En-
ergy and Commerce, Financial Services, Oversight and Government Re-
form, and the Budget, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To prevent and mitigate identity theft, to ensure privacy, 
to provide notice of security breaches, and to enhance 
criminal penalties, law enforcement assistance, and other 
protections against security breaches, fraudulent access, 
and misuse of personally identifiable information. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Personal Data Privacy and Security Act of 2014’’. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(b) TABLE OF CONTENTS.—The table of contents of 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Findings. 
Sec. 3. Definitions. 
TITLE I—ENHANCING PUNISHMENT FOR IDENTITY THEFT AND 
OTHER VIOLATIONS OF DATA PRIVACY AND SECURITY 
Sec. 101. Organized criminal activity in connection with unauthorized access to 
personally identifiable information. 
Sec. 102. Concealment of security breaches involving sensitive personally identi-
fiable information. 
Sec. 103. Penalties for fraud and related activity in connection with computers. 
Sec. 104. Trafficking in passwords. 
Sec. 105. Conspiracy and attempted computer fraud offenses. 
Sec. 106. Criminal and civil forfeiture for fraud and related activity in connec-
tion with computers. 
Sec. 107. Limitation on civil actions involving unauthorized use. 
Sec. 108. Reporting of certain criminal cases. 
Sec. 109. Damage to critical infrastructure computers. 
Sec. 110. Limitation on actions involving unauthorized use. 
TITLE II—PRIVACY AND SECURITY OF PERSONALLY 
IDENTIFIABLE INFORMATION 
Subtitle A—A Data Privacy and Security Program 
Sec. 201. Purpose and applicability of data privacy and security program. 
Sec. 202. Requirements for a personal data privacy and security program. 
Sec. 203. Enforcement. 
Sec. 204. Relation to other laws. 
Subtitle B—Security Breach Notification 
Sec. 211. Notice to individuals. 
Sec. 212. Exemptions. 
Sec. 213. Methods of notice. 
Sec. 214. Content of notification. 
Sec. 215. Coordination of notification with credit reporting agencies. 
Sec. 216. Notice to law enforcement. 
Sec. 217. Enforcement. 
Sec. 218. Enforcement by State attorneys general. 
Sec. 219. Effect on Federal and State law. 
Sec. 220. Reporting on exemptions. 
Sec. 221. Effective date. 
TITLE III—COMPLIANCE WITH STATUTORY PAY-AS-YOU-GO ACT 
Sec. 301. Budget compliance. 
SEC. 2. FINDINGS. 
Congress finds that— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(1) databases of personally identifiable informa-
tion are increasingly prime targets of hackers, iden-
tity thieves, rogue employees, and other criminals, 
including organized and sophisticated criminal oper-
ations; 
(2) identity theft is a serious threat to the Na-
tion’s economic stability, national security, homeland 
security, cybersecurity, the development of e-com-
merce, and the privacy rights of Americans; 
(3) security breaches are a serious threat to 
consumer confidence, homeland security, national se-
curity, e-commerce, and economic stability; 
(4) it is important for business entities that 
own, use, or license personally identifiable informa-
tion to adopt reasonable procedures to ensure the se-
curity, privacy, and confidentiality of that personally 
identifiable information; 
(5) individuals whose personal information has 
been compromised or who have been victims of iden-
tity theft should receive the necessary information 
and assistance to mitigate their damages and to re-
store the integrity of their personal information and 
identities; 
(6) data misuse and use of inaccurate data have 
the potential to cause serious or irreparable harm to 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
an individual’s livelihood, privacy, and liberty and 
undermine efficient and effective business and gov-
ernment operations; 
(7) government access to commercial data can 
potentially improve safety, law enforcement, and na-
tional security; and 
(8) because government use of commercial data 
containing personal information potentially affects 
individual privacy, and law enforcement and national 
security operations, there is a need for Congress to 
exercise oversight over government use of commer-
cial data. 
SEC. 3. DEFINITIONS. 
In this Act, the following definitions shall apply: 
(1) AFFILIATE.—The term ‘‘affiliate’’ means 
persons related by common ownership or by cor-
porate control. 
(2) AGENCY.—The term ‘‘agency’’ has the same 
meaning given such term in section 551 of title 5, 
United States Code. 
(3) BUSINESS
ENTITY.—The term ‘‘business 
entity’’ means any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated as-
sociation, or venture established to make a profit, or 
nonprofit. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(4) DATA SYSTEM COMMUNICATION INFORMA-
TION.—The term ‘‘data system communication in-
formation’’ means dialing, routing, addressing, or 
signaling information that identifies the origin, di-
rection, destination, processing, transmission, or ter-
mination of each communication initiated, at-
tempted, or received. 
(5) DESIGNATED
ENTITY.—The term ‘‘des-
ignated entity’’ means the Federal Government enti-
ty designated by the Secretary of Homeland Security 
under section 216(a). 
(6) ENCRYPTION.—The term ‘‘encryption’’— 
(A) means the protection of data in elec-
tronic form, in storage or in transit, using an 
encryption technology that has been generally 
accepted by experts in the field of information 
security that renders such data indecipherable 
in the absence of associated cryptographic keys 
necessary to enable decryption of such data; 
and 
(B) includes appropriate management and 
safeguards of such cryptographic keys so as to 
protect the integrity of the encryption. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(7) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means a violation of section 1028(a)(7) of 
title 18, United States Code. 
(8) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means any information, or compilation of in-
formation, in electronic or digital form that is a 
means of identification, as defined by section 
1028(d)(7) of title 18, United States Code. 
(9) PUBLIC RECORD SOURCE.—The term ‘‘pub-
lic record source’’ means the Congress, any agency, 
any State or local government agency, the govern-
ment of the District of Columbia and governments 
of the territories or possessions of the United States, 
and Federal, State or local courts, courts martial 
and military commissions, that maintain personally 
identifiable information in records available to the 
public. 
(10) SECURITY BREACH.— 
(A) IN
GENERAL.—The term ‘‘security 
breach’’ means compromise of the security, con-
fidentiality, or integrity of, or the loss of, com-
puterized data that result in, or that there is a 
reasonable basis to conclude has resulted in— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(i) the unauthorized acquisition of 
sensitive personally identifiable informa-
tion; and 
(ii) access to sensitive personally iden-
tifiable information that is for an unau-
thorized purpose, or in excess of authoriza-
tion. 
(B) 
EXCLUSION.—The 
term 
‘‘security 
breach’’ does not include— 
(i) a good faith acquisition of sensitive 
personally identifiable information by a 
business entity or agency, or an employee 
or agent of a business entity or agency, if 
the sensitive personally identifiable infor-
mation is not subject to further unauthor-
ized disclosure; 
(ii) the release of a public record not 
otherwise subject to confidentiality or non-
disclosure requirements or the release of 
information obtained from a public record, 
including information obtained from a 
news report or periodical; or 
(iii) any lawfully authorized investiga-
tive, protective, or intelligence activity of a 
law enforcement or intelligence agency of 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
the United States, a State, or a political 
subdivision of a State. 
(11) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means any information or com-
pilation of information, in electronic or digital form 
that includes the following: 
(A) An individual’s first and last name or 
first initial and last name in combination with 
any two of the following data elements: 
(i) Home address or telephone num-
ber. 
(ii) Mother’s maiden name. 
(iii) Month, day, and year of birth. 
(B) A non-truncated social security num-
ber, driver’s license number, passport number, 
or alien registration number or other govern-
ment-issued unique identification number. 
(C) Unique biometric data such as a fin-
gerprint, voice print, a retina or iris image, or 
any other unique physical representation. 
(D) A unique account identifier, including 
a financial account number or credit or debit 
card number, electronic identification number, 
user name, or routing code. 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
(E) Any combination of the following data 
elements: 
(i) An individual’s first and last name 
or first initial and last name. 
(ii) A unique account identifier, in-
cluding a financial account number or 
credit or debit card number, electronic 
identification number, user name, or rout-
ing code. 
(iii) Any security code, access code, or 
password, or source code that could be 
used to generate such codes or passwords. 
(12) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means a business entity that provides elec-
tronic data transmission, routing, intermediate and 
transient storage, or connections to its system or 
network, where the business entity providing such 
services does not select or modify the content of the 
electronic data, is not the sender or the intended re-
cipient of the data, and the business entity trans-
mits, routes, stores, or provides connections for per-
sonal information in a manner that personal infor-
mation is undifferentiated from other types of data 
that such business entity transmits, routes, stores, 
or provides connections. Any such business entity 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
shall be treated as a service provider under this Act 
only to the extent that it is engaged in the provision 
of such transmission, routing, intermediate and 
transient storage or connections. 
TITLE 
I—ENHANCING 
PUNISH-
MENT FOR IDENTITY THEFT 
AND OTHER VIOLATIONS OF 
DATA PRIVACY AND SECU-
RITY 
SEC. 101. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION 
WITH UNAUTHORIZED ACCESS TO PERSON-
ALLY IDENTIFIABLE INFORMATION. 
Section 1961(1) of title 18, United States Code, is 
amended by inserting ‘‘section 1030 (relating to fraud and 
related activity in connection with computers) if the act 
is a felony,’’ before ‘‘section 1084’’. 
SEC. 102. CONCEALMENT OF SECURITY BREACHES INVOLV-
ING SENSITIVE PERSONALLY IDENTIFIABLE 
INFORMATION. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘§ 1041. Concealment of security breaches involving 
sensitive personally identifiable informa-
tion 
‘‘(a) IN GENERAL.—Whoever, having knowledge of a 
security breach and of the fact that notice of such security 
breach is required under title II of the Personal Data Pri-
vacy and Security Act of 2014, intentionally and willfully 
conceals the fact of such security breach, shall, in the 
event that such security breach results in economic harm 
to any individual in the amount of $1,000 or more, be 
fined under this tile or imprisoned for not more than 5 
years, or both. 
‘‘(b) PERSON DEFINED.—For purposes of subsection 
(a), the term ‘person’ has the meaning given the term in 
section 1030(e)(12). 
‘‘(c) NOTICE REQUIREMENT.—Any person seeking 
an exemption under section 212(b) of the Personal Data 
Privacy and Security Act of 2014 shall be immune from 
prosecution under this section if the Federal Trade Com-
mission does not indicate, in writing, that such notice be 
given under section 212(b)(3) of such Act.’’. 
(b) CONFORMING AND TECHNICAL AMENDMENTS.— 
The table of sections for chapter 47 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘1041. Concealment of security breaches involving sensitive personally identifi-
able information.’’. 
(c) ENFORCEMENT AUTHORITY.— 
(1) IN
GENERAL.—The United States Secret 
Service and Federal Bureau of Investigation shall 
have the authority to investigate offenses under sec-
tion 1041 of title 18, United States Code, as added 
by subsection (a). 
(2) NONEXCLUSIVITY.—The authority granted 
in paragraph (1) shall not be exclusive of any exist-
ing authority held by any other Federal agency. 
SEC. 103. PENALTIES FOR FRAUD AND RELATED ACTIVITY 
IN CONNECTION WITH COMPUTERS. 
Section 1030(c) of title 18, United States Code, is 
amended to read as follows: 
‘‘(c) The punishment for an offense under subsection 
(a) or (b) of this section is— 
‘‘(1) a fine under this title or imprisonment for 
not more than 20 years, or both, in the case of an 
offense under subsection (a)(1) of this section; 
‘‘(2)(A) except as provided in subparagraph 
(B), a fine under this title or imprisonment for not 
more than 3 years, or both, in the case of an offense 
under subsection (a)(2); or 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(B) a fine under this title or imprisonment for 
not more than ten years, or both, in the case of an 
offense under paragraph (a)(2) of this section, if— 
‘‘(i) the offense was committed for pur-
poses of commercial advantage or private finan-
cial gain; 
‘‘(ii) the offense was committed in the fur-
therance of any criminal or tortious act in viola-
tion of the Constitution or laws of the United 
States, or of any State; or 
‘‘(iii) the value of the information obtained, 
or that would have been obtained if the offense 
was completed, exceeds $5,000; 
‘‘(3) a fine under this title or imprisonment for 
not more than 1 year, or both, in the case of an of-
fense under subsection (a)(3) of this section; 
‘‘(4) a fine under this title or imprisonment of 
not more than 20 years, or both, in the case of an 
offense under subsection (a)(4) of this section; 
‘‘(5)(A) except as provided in subparagraph 
(D), a fine under this title, imprisonment for not 
more than 20 years, or both, in the case of an of-
fense under subsection (a)(5)(A) of this section, if 
the offense caused— 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(i) loss to 1 or more persons during any 
1-year period (and, for purposes of an inves-
tigation, 
prosecution, 
or 
other 
proceeding 
brought by the United States only, loss result-
ing from a related course of conduct affecting 
1 or more other protected computers) aggre-
gating at least $5,000 in value; 
‘‘(ii) the modification or impairment, or 
potential modification or impairment, of the 
medical examination, diagnosis, treatment, or 
care of 1 or more individuals; 
‘‘(iii) physical injury to any person; 
‘‘(iv) a threat to public health or safety; 
‘‘(v) damage affecting a computer used by, 
or on behalf of, an entity of the United States 
Government in furtherance of the administra-
tion of justice, national defense, or national se-
curity; or 
‘‘(vi) damage affecting 10 or more pro-
tected computers during any 1-year period; 
‘‘(B) a fine under this title, imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(5)(B), if the offense 
caused a harm provided in clauses (i) through (vi) 
of subparagraph (A) of this subsection; 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(C) if the offender attempts to cause or know-
ingly or recklessly causes death from conduct in vio-
lation of subsection (a)(5)(A), a fine under this title, 
imprisonment for any term of years or for life, or 
both; or 
‘‘(D) a fine under this title, imprisonment for 
not more than 1 year, or both, for any other offense 
under subsection (a)(5); 
‘‘(6) a fine under this title or imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(6) of this section; or 
‘‘(7) a fine under this title or imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(7) of this section.’’. 
SEC. 104. TRAFFICKING IN PASSWORDS. 
Section 1030(a) of title 18, United States Code, is 
amended by striking paragraph (6) and inserting the fol-
lowing: 
‘‘(6) knowingly and with intent to defraud traf-
fics (as defined in section 1029) in— 
‘‘(A) any password or similar information 
through which a protected computer as defined 
in subparagraphs (A) and (B) of subsection 
(e)(2) may be accessed without authorization; 
or 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(B) any means of access through which a 
protected computer as defined in subsection 
(e)(2)(A) may be accessed without authoriza-
tion.’’. 
SEC. 
105. 
CONSPIRACY 
AND 
ATTEMPTED 
COMPUTER 
FRAUD OFFENSES. 
Section 1030(b) of title 18, United States Code, is 
amended by inserting ‘‘for the completed offense’’ after 
‘‘punished as provided’’. 
SEC. 106. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD 
AND RELATED ACTIVITY IN CONNECTION 
WITH COMPUTERS. 
Section 1030 of title 18, United States Code, is 
amended by striking subsections (i) and (j) and inserting 
the following: 
‘‘(i) CRIMINAL FORFEITURE.— 
‘‘(1) The court, in imposing sentence on any 
person convicted of a violation of this section, or 
convicted of conspiracy to violate this section, shall 
order, in addition to any other sentence imposed and 
irrespective of any provision of State law, that such 
person forfeit to the United States— 
‘‘(A) such person’s interest in any prop-
erty, real or personal, that was used, or in-
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS
tended to be used, to commit or facilitate the 
commission of such violation; and 
‘‘(B) any property, real or personal, consti-
tuting or derived from any gross proceeds, or 
any property traceable to such property, that 
such person obtained, directly or indirectly, as 
a result of such violation. 
‘‘(2) The criminal forfeiture of property under 
this subsection, including any seizure and disposition 
of the property, and any related judicial or adminis-
trative proceeding, shall be governed by the provi-
sions of section 413 of the Comprehensive Drug 
Abuse Prevention and Control Act of 1970 (21 
U.S.C. 853), except subsection (d) of that section. 
‘‘(j) CIVIL FORFEITURE.— 
‘‘(1) The following shall be subject to forfeiture 
to the United States and no property right, real or 
personal, shall exist in them: 
‘‘(A) Any property, real or personal, that 
was used, or intended to be used, to commit or 
facilitate the commission of any violation of this 
section, or a conspiracy to violate this section. 
‘‘(B) Any property, real or personal, con-
stituting or derived from any gross proceeds ob-
tained directly or indirectly, or any property 
VerDate Mar 15 2010 
22:16 Feb 04, 2014
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3990.IH
H3990
mstockstill on DSK4VPTVN1PROD with BILLS