vider in order to perform the same service or func-
tions for that covered entity does not constitute an 
unauthorized use. 
(3) LIABILITY REMAINS WITH COVERED ENTI-
TY.—A covered entity remains responsible and liable 
for the protection of covered information that has 
been transferred to a service provider for processing, 
notwithstanding any agreement to the contrary be-
tween a covered entity and the service provider. 
Subtitle C—Rights Relating to Data 
Minimization, 
Constraints 
on 
Distribution, and Data Integrity 
SEC. 131. DATA MINIMIZATION. 
Each covered entity shall— 
(1) collect only as much covered information re-
lating to an individual as is reasonably necessary— 
(A) to process or enforce a transaction or 
deliver a service requested by such individual; 
(B) for the covered entity to provide a 
transaction or delivering a service requested by 
such individual, such as inventory management, 
financial reporting and accounting, planning, 
product or service improvement or forecasting, 
and customer support and service; 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(C) to prevent or detect fraud or to provide 
for a secure environment; 
(D) to investigate a possible crime; 
(E) to comply with a provision of law; 
(F) for the covered entity to market or ad-
vertise to such individual if the covered infor-
mation used for such marketing or advertising 
was collected directly by the covered entity; or 
(G) for internal operations, including— 
(i) collecting customer satisfaction 
surveys and conducting customer research 
to improve customer service; and 
(ii) collection from an Internet website 
of information about visits and click- 
through rates relating to such website to 
improve— 
(I) website navigation and per-
formance; and 
(II) the customer’s experience; 
(2) retain covered information for only such du-
ration as— 
(A) with respect to the provision of a 
transaction or delivery of a service to an indi-
vidual— 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(i) is necessary to provide such trans-
action or deliver such service to such indi-
vidual; or 
(ii) if such service is ongoing, is rea-
sonable for the ongoing nature of the serv-
ice; or 
(B) is required by a provision of law; 
(3) retain covered information only for the pur-
pose it was collected, or reasonably related purposes; 
and 
(4) exercise reasonable data retention proce-
dures with respect to both the initial collection and 
subsequent retention. 
SEC. 132. CONSTRAINTS ON DISTRIBUTION OF INFORMA-
TION. 
(a) IN GENERAL.—Each covered entity shall— 
(1) require by contract that any third party to 
which it transfers covered information use the infor-
mation only for purposes that are consistent with— 
(A) the provisions of this title; and 
(B) as specified in the contract; 
(2) require by contract that such third party 
may not combine information that the covered entity 
has transferred to it, that relates to an individual, 
and that is not personally identifiable information 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
with other information in order to identify such indi-
vidual, unless the covered entity has obtained the 
opt-in consent of such individual for such combina-
tion and identification; and 
(3) before executing a contract with a third 
party— 
(A) assure through due diligence that the 
third party is a legitimate organization; and 
(B) in the case of a material violation of 
the contract, at a minimum notify the Commis-
sion of such violation. 
(b) TRANSFERS TO UNRELIABLE THIRD PARTIES 
PROHIBITED.—A covered entity may not transfer covered 
information to a third party that the covered entity 
knows— 
(1) has intentionally or willfully violated a con-
tract required by subsection (a); and 
(2) is reasonably likely to violate such contract. 
(c) APPLICATION OF RULES TO THIRD PARTIES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a third party that receives covered infor-
mation from a covered entity shall be subject to the 
provisions of this Act as if it were a covered entity. 
(2) EXEMPTION.—The Commission may, as it 
determines appropriate, exempt classes of third par-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
ties from liability under any provision of subtitle B 
if the Commission finds that— 
(A) such class of third parties cannot rea-
sonably comply with such provision; or 
(B) with respect to covered information re-
lating to individuals that is transferred to such 
class, compliance by such class with such provi-
sion would not sufficiently benefit such individ-
uals. 
SEC. 133. DATA INTEGRITY. 
(a) IN GENERAL.—Each covered entity shall attempt 
to establish and maintain reasonable procedures to ensure 
that personally identifiable information that is covered in-
formation and maintained by the covered entity is accu-
rate in those instances where the covered information 
could be used to deny consumers benefits or cause signifi-
cant harm. 
(b) EXCEPTION.—Subsection (a) shall not apply to 
covered information of an individual maintained by a cov-
ered entity that is provided— 
(1) directly to the covered entity by the indi-
vidual; 
(2) to the covered entity by another entity at 
the request of the individual; 
(3) to prevent or detect fraud; or 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(4) to provide for a secure environment. 
Subtitle D—Right to Notice of 
Breaches of Security 
SEC. 141. DEFINITIONS. 
In this subtitle: 
(1) BREACH OF SECURITY.— 
(A) IN GENERAL.—The term ‘‘breach of 
security’’ means compromise of the security, 
confidentiality, or integrity of, or loss of, data 
in electronic form that results in, or there is a 
reasonable basis to conclude has resulted in, 
unauthorized access to or acquisition of person-
ally identifiable information from a covered en-
tity. 
(B) EXCLUSIONS.—The term ‘‘breach of 
security’’ does not include— 
(i) a good faith acquisition of person-
ally identifiable information by a covered 
entity, or an employee or agent of a cov-
ered entity, if the personally identifiable in-
formation is not subject to further use or 
unauthorized disclosure; 
(ii) any lawfully authorized investiga-
tive, protective, or intelligence activity of a 
law enforcement or an intelligence agency 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
of the United States, a State, or a political 
subdivision of a State; or 
(iii) the release of a public record not 
otherwise subject to confidentiality or non-
disclosure requirements. 
(2) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database, including recordable tapes and other 
mass storage devices. 
(3) DESIGNATED
ENTITY.—The term ‘‘des-
ignated entity’’ means the Federal Government enti-
ty designated by the Secretary of Homeland Security 
under section 143(a). 
(4) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personally identifiable information for the pur-
pose of engaging in commercial transactions under 
the identity of such other person, including any con-
tact that violates section 1028A of title 18, United 
States Code. 
(5) MAJOR CREDIT REPORTING AGENCY.—The 
term ‘‘major credit reporting agency’’ means a con-
sumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis within the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
meaning of section 603(p) of the Fair Credit Re-
porting Act (15 U.S.C. 1681a(p)). 
(6) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means a person that provides electronic 
data transmission, routing, intermediate and tran-
sient storage, or connections to its system or net-
work, where the person providing such services does 
not select or modify the content of the electronic 
data, is not the sender or the intended recipient of 
the data, and does not differentiate personally iden-
tifiable information from other information that 
such person transmits, routes, or stores, or for 
which such person provides connections. Any such 
person shall be treated as a service provider under 
this subtitle only to the extent that it is engaged in 
the provision of such transmission, routing, inter-
mediate and transient storage, or connections. 
SEC. 142. NOTICE TO INDIVIDUALS. 
(a) IN GENERAL.—A covered entity that owns or pos-
sesses data in electronic form containing personally identi-
fiable information, following the discovery of a breach of 
security of the system maintained by the covered entity 
that contains such information, shall notify— 
(1) each individual who is a citizen or resident 
of the United States and whose personally identifi-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
able information has been, or is reasonably believed 
to have been, acquired or accessed from the covered 
entity as a result of the breach of security; and 
(2) the Commission, unless the covered entity 
has notified the designated entity under section 143. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD PARTIES.—In the event of a breach 
of security of a system maintained by a third party 
that has been contracted to maintain or process data 
in electronic form containing personally identifiable 
information on behalf of a covered entity who owns 
or possesses such data, the third party shall notify 
the covered entity of the breach of security. 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in 
electronic form containing personally identifiable in-
formation that is owned or possessed by another cov-
ered entity that connects to or uses a system or net-
work provided by the service provider for the pur-
pose of transmitting, routing, or providing inter-
mediate or transient storage of such data, the serv-
ice provider shall notify of the breach of security 
only the covered entity who initiated such connec-
tion, transmission, routing, or storage if such cov-
ered entity can be reasonably identified. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(3) COORDINATION
OF
NOTIFICATION
WITH 
CREDIT REPORTING AGENCIES.— 
(A) IN GENERAL.—If a covered entity is 
required to provide notification to more than 
5,000 individuals under subsection (a)(1), the 
covered entity also shall notify each major cred-
it reporting agency of the timing and distribu-
tion of the notices, except when the only per-
sonally identifiable information that is the sub-
ject of the breach of security is the individual’s 
first name or initial and last name, or address, 
or phone number, in combination with a credit 
or debit card number, and any required security 
code. 
(B) NOTICE TO CREDIT REPORTING AGEN-
CIES BEFORE INDIVIDUALS.—Such notice shall 
be given to each credit reporting agency without 
unreasonable delay and, if it will not delay no-
tice to the affected individuals, prior to the dis-
tribution of notices to the affected individuals. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay following the discovery by the covered en-
tity of a security breach. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(2) REASONABLE DELAY.— 
(A) IN GENERAL.—Reasonable delay under 
this subsection may include any time necessary 
to determine the scope of the security breach, 
prevent further disclosures, restore the reason-
able integrity of the data system, and provide 
notice to law enforcement when required. 
(B) EXTENSION.— 
(i) IN GENERAL.—Except as provided 
in subsection (d), delay of notification shall 
not exceed 60 days following the discovery 
of the security breach, unless the covered 
entity requests an extension of time and 
the Commission determines in writing that 
additional time is reasonably necessary to 
determine the scope of the security breach, 
prevent further disclosures, restore the rea-
sonable integrity of the data system, or to 
provide notice to the designated entity. 
(ii) APPROVAL OF REQUEST.—If the 
Commission approves the request for delay, 
the covered entity may delay the period for 
notification for additional periods of up to 
30 days. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(3) BURDEN
OF
PRODUCTION.—The covered 
entity, third party, or service provider required to 
provide notice under this title shall, upon the request 
of the Commission provide records or other evidence 
of the notifications required under this subtitle, in-
cluding to the extent applicable, the reasons for any 
delay of notification. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF DIRECT NOTIFICATION.— 
Except as provided in paragraph (2), a covered 
entity shall be in compliance with the notifica-
tion requirement under subsection (a)(1) if— 
(i) the covered entity provides con-
spicuous and clearly identified notifica-
tion— 
(I) in writing; or 
(II) by e-mail or other electronic 
means if— 
(aa) the covered entity’s pri-
mary method of communication 
with the individual is by e-mail or 
such other electronic means; or 
(bb) the individual has con-
sented to receive notification by 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
e-mail or such other electronic 
means and such notification is 
provided in a manner that is con-
sistent with the provisions per-
mitting electronic transmission of 
notices under section 101 of the 
Electronic Signatures in Global 
and National Commerce Act (15 
U.S.C. 7001); and 
(ii) the method of notification selected 
under clause (i) can reasonably be expected 
to reach the intended individual. 
(B) CONTENT
OF
DIRECT
NOTIFICA-
TION.—Each method of notification under sub-
paragraph (A) shall include the following: 
(i) The date, estimated date, or esti-
mated date range of the breach of security. 
(ii) A description of the personally 
identifiable information that was or is rea-
sonably believed to have been acquired or 
accessed as a result of the breach of secu-
rity. 
(iii) A telephone number that an indi-
vidual can use at no cost to the individual 
to contact the covered entity to inquire 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
about the breach of security or the infor-
mation the covered entity maintained 
about that individual. 
(iv) Notice that the individual may be 
entitled to consumer credit reports under 
subsection (e)(1). 
(v) Instructions how an individual can 
request consumer credit reports under sub-
section (e)(1). 
(vi) A telephone number, that an indi-
vidual can use at no cost to the individual, 
and an address to contact each major cred-
it reporting agency. 
(vii) A telephone number, that an in-
dividual can use at no cost to the indi-
vidual, and an Internet website address to 
obtain information regarding identity theft 
from the Commission. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A covered entity re-
quired to provide notification to individuals 
under subsection (a)(1) may provide notifica-
tion under this paragraph instead of paragraph 
(1) of this subsection if— 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(i) notification under paragraph (1) is 
not feasible due to lack of sufficient con-
tact information for the individual required 
to be notified; or 
(ii) the covered entity owns or pos-
sesses data in electronic form containing 
personally identifiable information of fewer 
than 10,000 individuals and direct notifica-
tion is not feasible due to excessive cost to 
the covered entity required to provide such 
notification relative to the resources of 
such covered entity, as determined in ac-
cordance with the regulations issued by the 
Commission under paragraph (3)(A). 
(B) METHOD OF SUBSTITUTE NOTIFICA-
TION.—Notification under this paragraph shall 
include the following: 
(i) Conspicuous and clearly identified 
notification by e-mail to the extent the cov-
ered entity has an e-mail address for an in-
dividual who is entitled to notification 
under subsection (a)(1). 
(ii) Conspicuous and clearly identified 
notification on the Internet website of the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
covered entity if the covered entity main-
tains an Internet website. 
(iii) Notification to print and to 
broadcast media, including major media in 
metropolitan and rural areas where the in-
dividuals whose personally identifiable in-
formation was acquired or accessed reside. 
(C) CONTENT OF SUBSTITUTE NOTIFICA-
TION.—Each method of notification under this 
paragraph shall include the following: 
(i) The date, estimated date, or esti-
mated date range of the breach of security. 
(ii) A description of the types of per-
sonally identifiable information that were 
or are reasonably believed to have been ac-
quired or accessed as a result of the breach 
of security. 
(iii) Notice that an individual may be 
entitled to consumer credit reports under 
subsection (e)(1). 
(iv) Instructions how an individual 
can request consumer credit reports under 
subsection (e)(1). 
(v) A telephone number that an indi-
vidual can use at no cost to the individual 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
to learn whether the individual’s personally 
identifiable information is included in the 
breach of security. 
(vi) A telephone number, that an indi-
vidual can use at no cost to the individual, 
and an address to contact each major cred-
it reporting agency. 
(vii) A telephone number, that an in-
dividual can use at no cost to the indi-
vidual, and an Internet website address to 
obtain information from the Commission 
regarding identity theft. 
(3) REGULATIONS AND GUIDANCE.— 
(A) 
REGULATIONS
CONCERNING
SUB-
STITUTE NOTIFICATION.— 
(i) IN GENERAL.—Not later than 1 
year after the date of enactment of this 
Act, the Commission shall prescribe cri-
teria for determining circumstances under 
which notification may be provided under 
paragraph (2), including criteria for deter-
mining 
whether 
providing 
notification 
under paragraph (1) is not feasible due to 
excessive costs to the covered entity re-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
quired to provide such notification relative 
to the resources of such covered entity. 
(ii) 
OTHER
CIRCUMSTANCES.—The 
regulations required by clause (i) may also 
identify other circumstances in which noti-
fication under paragraph (2) would be ap-
propriate, including circumstances under 
which the cost of providing direct notifica-
tion exceeds the benefits to individuals. 
(B) GUIDANCE.— 
(i) IN GENERAL.—The Commission, in 
consultation with the Administrator of the 
Small Business Administration, shall pub-
lish and otherwise make available general 
guidance with respect to compliance with 
this subsection. 
(ii) CONTENTS.—The guidance re-
quired by clause (i) shall include the fol-
lowing: 
(I) A description of written or e- 
mail notification that complies with 
paragraph (1). 
(II) Guidance on the content of 
notification under paragraph (2), in-
cluding the extent of notification to 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS