I 
115TH CONGRESS 
1ST SESSION H. R. 3816 
To require notification following a breach of security of a system containing 
personal information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 21, 2017 
Mr. RUSH introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To require notification following a breach of security of a 
system containing personal information, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. NOTIFICATION OF INFORMATION SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any person en-
gaged in interstate commerce that owns or possesses data 
in electronic form containing personal information shall, 
following the discovery of a breach of security of the sys-
tem maintained by such person that contains such data— 
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
(1) notify each individual who is a citizen or 
resident of the United States whose personal infor-
mation was acquired or accessed as a result of such 
a breach of security; 
(2) notify the Commission; and 
(3) notify the Bureau. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD-PARTY AGENTS.—In the event of a 
breach of security by any third-party entity that has 
been contracted to maintain or process data in elec-
tronic form containing personal information on be-
half of any other person who owns or possesses such 
data, such third-party entity shall be required to no-
tify such person of the breach of security. Upon re-
ceiving such notification from such third party, such 
person shall provide the notification required under 
subsection (a). 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in 
electronic form containing personal information that 
is owned or possessed by another person that con-
nects to or uses a system or network provided by the 
service provider for the purpose of transmitting, 
routing, or providing intermediate or transient stor-
age of such data, such service provider shall be re-
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
quired to notify of such a breach of security only the 
person who initiated such connection, transmission, 
routing, or storage if such person can be reasonably 
identified. Upon receiving such notification from a 
service provider, such person shall provide the notifi-
cation required under subsection (a). 
(3) COORDINATION
OF
NOTIFICATION
WITH 
CONSUMER REPORTING AGENCIES.—If a person is 
required to provide notification to more than 1,000 
individuals under subsection (a)(1), the person shall 
also notify the major consumer reporting agencies of 
the timing and distribution of the notices. Such no-
tice shall be given to the consumer reporting agen-
cies without unreasonable delay and, if it will not 
delay notice to the affected individuals, prior to the 
distribution of notices to the affected individuals. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Unless subject to a delay au-
thorized under paragraph (2), a notification required 
under subsection (a) shall be made not later than 30 
days following the discovery of a breach of security, 
unless the person providing notice can show that 
providing notice within such a timeframe is not fea-
sible due to extraordinary circumstances necessary 
to prevent further breach or unauthorized disclo-
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS
sures, and reasonably restore the integrity of the 
data system, in which case such notification shall be 
made as promptly as possible. 
(2) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW ENFORCEMENT OR NATIONAL SECURITY PUR-
POSES.— 
(A) LAW
ENFORCEMENT.—If a Federal, 
State, or local law enforcement agency deter-
mines that the notification required under this 
section would impede a civil or criminal inves-
tigation, such notification shall be delayed upon 
the written request of the law enforcement 
agency for 30 days or such lesser period of time 
which the law enforcement agency determines is 
reasonably necessary and requests in writing. A 
law enforcement agency may, by a subsequent 
written request, revoke such delay or extend the 
period of time set forth in the original request 
made under this paragraph if further delay is 
necessary. 
(B) NATIONAL
SECURITY.—If a Federal 
national security agency or homeland security 
agency determines that the notification required 
under this section would threaten national or 
homeland security, such notification may be de-
VerDate Sep 11 2014 
21:55 Sep 26, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3816.IH
H3816
ethrower on DSK3G9T082PROD with BILLS