I 
110TH CONGRESS 
1ST SESSION H. R. 1685 
To protect information relating to consumers, to require notice of security 
breaches, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 26, 2007 
Mr. PRICE of Georgia introduced the following bill; which was referred to the 
Committee on Financial Services, and in addition to the Committees on 
Oversight and Government Reform and Energy and Commerce, for a pe-
riod to be subsequently determined by the Speaker, in each case for con-
sideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To protect information relating to consumers, to require 
notice of security breaches, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Security Act of 
2007’’. 
SEC. 2. DEFINITIONS. 
For purposes of this Act, the following definitions 
shall apply: 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(1) AFFILIATE.—The term ‘‘affiliate’’ means 
any company that controls, is controlled by, or is 
under common control with another company. 
(2) AGENCY.—The term ‘‘agency’’ has the same 
meaning given such term in section 551(1) of title 
5, United States Code. 
(3) BREACH OF DATA SECURITY.— 
(A) IN GENERAL.—The term ‘‘breach of 
data security’’ means the unauthorized acquisi-
tion of sensitive account information or sen-
sitive personal information. 
(B) EXCEPTION FOR DATA THAT IS NOT IN 
USABLE FORM.— 
(i) IN GENERAL.—The term ‘‘breach 
of data security’’ does not include the un-
authorized acquisition of sensitive account 
information or sensitive personal informa-
tion that is maintained or communicated in 
a manner that is not usable— 
(I) to commit identity theft; or 
(II) to make fraudulent trans-
actions on financial accounts. 
(ii) RULE
OF
CONSTRUCTION.—For 
purposes of this subparagraph, information 
that is maintained or communicated in a 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
manner that is not usable includes any in-
formation that is maintained or commu-
nicated in an encrypted, redacted, altered, 
edited, or coded form. 
(4) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(5) CONSUMER.—The term ‘‘consumer’’ means 
an individual. 
(6) CONSUMER REPORTING AGENCY THAT COM-
PILES AND MAINTAINS FILES ON CONSUMERS ON A 
NATIONWIDE BASIS.—The term ‘‘consumer reporting 
agency that compiles and maintains files on con-
sumers on a nationwide basis’’ has the same mean-
ing as in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
(7) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means any— 
(i) entity, the business of which is en-
gaging in financial activities, as described 
in section 4(k) of the Bank Holding Com-
pany Act of 1956 (12 U.S.C. 1843(k)); 
(ii) financial institution, including any 
institution described in section 313.3(k) of 
title 16, Code of Federal Regulations, as in 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
effect on the date of the enactment of this 
Act; 
(iii) entity that maintains or otherwise 
possesses information that is subject to 
section 628 of the Fair Credit Reporting 
Act (15 U.S.C. 1681w); or 
(iv) other individual, partnership, cor-
poration, trust, estate, cooperative, associa-
tion, or entity that maintains or commu-
nicates sensitive account information or 
sensitive personal information. 
(B) EXCEPTION.—The term ‘‘covered enti-
ty’’ does not include any agency or any other 
unit of Federal, State, or local government or 
any subdivision of such unit. 
(8) FINANCIAL
INSTITUTION.—The term ‘‘fi-
nancial institution’’ has the same meaning as in sec-
tion 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6809). 
(9) SENSITIVE
ACCOUNT
INFORMATION.—The 
term ‘‘sensitive account information’’ means a finan-
cial account number relating to a consumer, includ-
ing a credit card number or debit card number, in 
combination with any security code, access code, 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
password, or other personal identification informa-
tion required to access the financial account. 
(10) SENSITIVE PERSONAL INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘sensitive 
personal information’’ means the first and last 
name, address, or telephone number of a con-
sumer, in combination with any of the following 
relating to such consumer: 
(i) Social security account number. 
(ii) Driver’s license number or equiva-
lent State identification number. 
(iii) Taxpayer identification number. 
(B) EXCEPTION.—The term ‘‘sensitive per-
sonal information’’ does not include publicly 
available information that is lawfully made 
available to the general public from— 
(i) Federal, State, or local government 
records; or 
(ii) widely distributed media. 
(11) 
SUBSTANTIAL
HARM
OR
INCONVEN-
IENCE.— 
(A) IN GENERAL.—The term ‘‘substantial 
harm or inconvenience’’ means— 
(i) material financial loss to, or civil 
or criminal penalties imposed on, a con-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
sumer, due to the unauthorized use of sen-
sitive account information or sensitive per-
sonal information relating to such con-
sumer; or 
(ii) the need for a consumer to expend 
significant time and effort to correct erro-
neous information relating to the con-
sumer, including information maintained 
by a consumer reporting agency, financial 
institution, or government entity, in order 
to avoid material financial loss, increased 
costs, or civil or criminal penalties, due to 
the unauthorized use of sensitive account 
information or sensitive personal informa-
tion relating to such consumer. 
(B) EXCEPTION.—The term ‘‘substantial 
harm or inconvenience’’ does not include— 
(i) changing a financial account num-
ber or closing a financial account; or 
(ii) harm or inconvenience that does 
not result from identity theft or account 
fraud. 
SEC. 3. PROTECTION OF INFORMATION AND SECURITY 
BREACH NOTIFICATION. 
(a) SECURITY PROCEDURES REQUIRED.— 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(1) IN
GENERAL.—Each covered entity shall 
implement, maintain, and enforce reasonable policies 
and procedures to protect the confidentiality and se-
curity of sensitive account information and sensitive 
personal information which is maintained or is being 
communicated by or on behalf of a covered entity, 
from the unauthorized use of such information that 
is reasonably likely to result in substantial harm or 
inconvenience to the consumer to whom such infor-
mation relates. 
(2) LIMITATION.—Any policy or procedure im-
plemented or maintained under paragraph (1) shall 
be appropriate to the— 
(A) size and complexity of a covered entity; 
(B) nature and scope of the activities of 
such entity; and 
(C) sensitivity of the consumer information 
to be protected. 
(b) INVESTIGATION REQUIRED.— 
(1) IN GENERAL.—If a covered entity deter-
mines that a breach of data security has or may 
have occurred in relation to sensitive account infor-
mation or sensitive personal information that is 
maintained or is being communicated by, or on be-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
half of, such covered entity, the covered entity shall 
conduct an investigation— 
(A) to assess the nature and scope of the 
breach; 
(B) to identify any sensitive account infor-
mation or sensitive personal information that 
may have been involved in the breach; and 
(C) to determine if such information is 
reasonably likely to be misused in a manner 
causing substantial harm or inconvenience to 
the consumers to whom the information relates. 
(2) NEURAL NETWORKS AND INFORMATION SE-
CURITY PROGRAMS.—In determining the likelihood 
of misuse of sensitive account information under 
paragraph (1)(C), a covered entity shall consider 
whether any neural network or security program has 
detected, or is likely to detect or prevent, fraudulent 
transactions resulting from the breach of security. 
(c) NOTICE REQUIRED.—If a covered entity deter-
mines under subsection (b)(1)(C) that sensitive account 
information or sensitive personal information involved in 
a breach of data security is reasonably likely to be misused 
in a manner causing substantial harm or inconvenience 
to the consumers to whom the information relates, such 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
covered entity, or a third party acting on behalf of such 
covered entity, shall— 
(1) notify, in the following order— 
(A) the appropriate agency or authority 
identified in section 5; 
(B) an appropriate law enforcement agen-
cy; 
(C) any entity that owns, or is obligated 
on, a financial account to which the sensitive 
account information relates, in the case of a 
breach involving sensitive account information; 
(D) each consumer reporting agency that 
compiles and maintains files on consumers on a 
nationwide basis, in the case of a breach involv-
ing sensitive personal information relating to 
1,000 or more consumers; and 
(E) all consumers to whom the sensitive 
account information or sensitive personal infor-
mation relates; and 
(2) take reasonable measures to restore the se-
curity and confidentiality of the sensitive account in-
formation or sensitive personal information involved 
in the breach. 
(d) COMPLIANCE.— 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(1) IN GENERAL.—A financial institution shall 
be deemed to be in compliance with— 
(A) subsection (a), and any regulations 
prescribed under such subsection, if such insti-
tution maintains policies and procedures to pro-
tect the confidentiality and security of sensitive 
account information and sensitive personal in-
formation that are subject to section 501(b) of 
the 
Gramm-Leach-Bliley 
Act 
(15 
U.S.C. 
6801(b)) and any regulations or guidance pre-
scribed under that section that are applicable to 
such institution; and 
(B) subsections (b) and (c), and any regu-
lations prescribed under such subsections, if 
such institution— 
(i)(I) maintains policies and proce-
dures to investigate and provide notice to 
consumers of breaches of data security 
that are subject to the investigation and 
notice requirements established by regula-
tions or guidance under section 501(b) of 
the Gramm-Leach-Bliley Act (15 U.S.C. 
6801(b)) that are applicable to such insti-
tution; or 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(II) is an affiliate of a bank holding 
company that maintains policies and proce-
dures to investigate and provide notice to 
consumers of breaches of data security 
that are consistent with the policies and 
procedures of a bank that is an affiliate of 
such institution, and that bank’s policies 
and procedures are subject to the inves-
tigation and notice requirements estab-
lished by any regulations or guidance 
under section 501(b) of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6801(b)) that are 
applicable to that bank; and 
(ii) provides for notice to the entities 
described under subparagraphs (B), (C), 
and (D) of subsection (c)(1), if notice is 
provided to consumers pursuant to the 
policies and procedures of such institution 
described in clause (i). 
(2) DEFINITIONS.—For purposes of this sub-
section, the terms ‘‘bank holding company’’ and 
‘‘bank’’ shall have the same meaning given such 
terms under section 2 of the Bank Holding Com-
pany Act of 1956. 
(3) HARMONIZATION OF GLBA.— 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(A) IN
GENERAL.—To the extent that 
compliance by any financial institution with the 
requirements of title V of the Gramm-Leach- 
Bliley Act are deemed, pursuant to this sub-
section, to be compliance with this section, and 
the requirements of such title, and any regula-
tions, guidelines, or orders issued or prescribed 
under such title, differ in any way from this 
section, it is the sense of the Congress that the 
applicable regulators shall make every appro-
priate effort as any relevant regulations are 
prescribed, reviewed, or updated to reconcile 
such differences to harmonize the corresponding 
requirements. 
(B) AGENCIES THAT HAVE NOT FULLY IM-
PLEMENTED TITLE V OF THE GLBA.—Any Fed-
eral functional regulator (as defined in section 
509(2) of Gramm-Leach-Bliley Act) that has 
not issued or prescribed regulations, guidelines, 
or orders that are required or permitted under 
title V of the Gramm-Leach-Bliley Act and that 
set forth the requirements for compliance with 
such title, including with respect to providing 
notice of a breach of data security, shall pre-
scribe such regulations, guidelines, or orders, as 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
appropriate, before the end of the 12-month pe-
riod beginning on the date of the enactment of 
this Act, in a manner that— 
(i) is consistent with this section; and 
(ii) allows, to the extent practical, 
consistent standards across holding compa-
nies with respect to compliance with this 
section and section 501(b) of the Gramm- 
Leach-Bliley Act that is deemed compli-
ance under this subsection. 
(C) AGENCIES THAT HAVE IMPLEMENTED 
TITLE
V
OF
THE
GLBA.—Any Federal func-
tional regulator (as defined in section 509(2) of 
Gramm-Leach-Bliley Act) that has issued or 
prescribed regulations, guidelines, or orders 
that are required or permitted under title V of 
the Gramm-Leach-Bliley Act and that set forth 
the requirements for compliance with such title 
shall modify such regulations, guidelines, or or-
ders, as appropriate, before the end of the 12- 
month period beginning on the date of the en-
actment of this Act, in a manner that— 
(i) is consistent with this section; and 
(ii) allows, to the extent practical, 
consistent standards across holding compa-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
nies with respect to compliance with this 
section and section 501(b) of the Gramm- 
Leach-Bliley Act that is deemed compli-
ance under this subsection. 
(D) COORDINATION
UNDER
THIS
SEC-
TION.—To the extent practical, any regulations, 
guidelines, standards, or orders issued or pre-
scribed under this section shall be issued or 
prescribed in a manner that— 
(i) is consistent with this section; and 
(ii) allows, to the extent practical, 
consistent standards across holding compa-
nies with respect to compliance with this 
section and section 501(b) of the Gramm- 
Leach-Bliley Act that is deemed compli-
ance under this subsection. 
(e) TREATMENT OF NOTICE.—A notice provided to 
any consumer under this section may be the basis for a 
request by the consumer, or an individual acting on behalf 
of or as a personal representative of a consumer, for an 
initial fraud alert under section 605A(a)(1) of the Fair 
Credit Reporting Act. 
SEC. 4. IMPLEMENTING REGULATIONS. 
(a) IN GENERAL.—Except as provided under section 
6, the agencies and authorities identified in section 5, with 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
respect to the covered entities that are subject to the re-
spective enforcement authority of such agencies and au-
thorities, shall prescribe regulations to implement this Act. 
(b) COORDINATION.—Each agency and authority re-
quired to prescribe regulations under subsection (a) shall 
consult and coordinate with each other agency and author-
ity identified in section 5 so that, to the extent possible, 
the regulations prescribed by each agency and authority 
are consistent and comparable. 
(c) METHOD
OF
PROVIDING
NOTICE
TO
CON-
SUMERS.—The regulations required under subsection (a) 
shall— 
(1) prescribe the methods by which a covered 
entity shall notify a consumer of a breach of data se-
curity under section 3; and 
(2) allow a covered entity to provide such notice 
by— 
(A) written, telephonic, or e-mail notifica-
tion; or 
(B) substitute notification, if providing 
written, telephonic, or e-mail notification is not 
feasible due to— 
(i) lack of sufficient contact informa-
tion for the consumers that must be noti-
fied; or 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(ii) excessive cost to the covered enti-
ty. 
(d) CONTENT OF CONSUMER NOTICE.—The regula-
tions required under subsection (a) shall— 
(1) prescribe the content that shall be included 
in a notice of a breach of data security that is re-
quired to be provided to consumers under section 3; 
and 
(2) require such notice to include— 
(A) a description of the type of sensitive 
account information or sensitive personal infor-
mation involved in the breach of data security; 
(B) if known, the date, or a reasonable ap-
proximation of the period of time, on or within 
which the breach of data security occurred; 
(C) a general description of the actions 
taken by the covered entity to restore the secu-
rity and confidentiality of the sensitive account 
information or sensitive personal information 
involved in the breach of data security; and 
(D) the summary of rights of victims of 
identity theft prepared by the Commission 
under section 609(d) of the Fair Credit Report-
ing Act (15 U.S.C. 1681g), if the breach of 
data security involves sensitive personal infor-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
mation, including any additional appropriate in-
formation on how the consumer may place an 
initial fraud alert in any file relating to the con-
sumer at a consumer reporting agency under 
section 605A(a)(1) of such Act. 
(e) TIMING OF NOTICE.—The regulations required 
under subsection (a) shall establish standards for when 
a covered entity shall provide any notice required under 
section 3. 
(f) LAW ENFORCEMENT DELAY.—The regulations 
required under subsection (a) shall allow a covered entity 
to delay providing notice of a breach of data security to 
consumers under section 3 if a law enforcement agency 
requests such a delay in writing. 
(g) SERVICE PROVIDERS.—The regulations required 
under subsection (a) shall— 
(1) require any party that maintains or commu-
nicates sensitive account information or sensitive 
personal information on behalf of a covered entity to 
provide notice to that covered entity if such party 
determines that a breach of data security has, or 
may have, occurred with respect to such information; 
and 
(2) ensure that there is only 1 notification re-
sponsibility with respect to a breach of data security. 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(h) TIMING OF REGULATIONS.—The regulations re-
quired under subsection (a) shall— 
(1) be issued in final form not later than 6 
months after the date of enactment of this Act; and 
(2) take effect not later than 6 months after 
the date on which they are issued in final form. 
SEC. 5. ADMINISTRATIVE ENFORCEMENT. 
(a) IN GENERAL.—Section 3, and the regulations re-
quired under section 4, shall be enforced exclusively 
under— 
(1) section 8 of the Federal Deposit Insurance 
Act (12 U.S.C. 1818), in the case of— 
(A) a national bank, a Federal branch or 
Federal agency of a foreign bank, or any sub-
sidiary thereof (other than a broker, dealer, 
person providing insurance, investment com-
pany, or investment adviser), by the Office of 
the Comptroller of the Currency; 
(B) a member bank of the Federal Reserve 
System (other than a national bank), a branch 
or agency of a foreign bank (other than a Fed-
eral branch, Federal agency, or insured State 
branch of a foreign bank), a commercial lending 
company owned or controlled by a foreign bank, 
an organization operating under section 25 or 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
25A of the Federal Reserve Act (12 U.S.C. 
601,604), or a bank holding company and its 
nonbank subsidiary or affiliate (other than a 
broker, dealer, person providing insurance, in-
vestment company, or investment adviser), by 
the Board of Governors of the Federal Reserve 
System; 
(C) a bank, the deposits of which are in-
sured by the Federal Deposit Insurance Cor-
poration (other than a member of the Federal 
Reserve System), an insured State branch of a 
foreign bank, or any subsidiary thereof (other 
than a broker, dealer, person providing insur-
ance, investment company, or investment ad-
viser), by the Board of Directors of the Federal 
Deposit Insurance Corporation; and 
(D) a savings association, the deposits of 
which are insured by the Federal Deposit In-
surance Corporation, or any subsidiary thereof 
(other than a broker, dealer, person providing 
insurance, investment company, or investment 
adviser), by the Director of the Office of Thrift 
Supervision; 
(2) the Federal Credit Union Act (12 U.S.C. 
1751 et seq.), by the National Credit Union Admin-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
istration Board with respect to any federally insured 
credit union; 
(3) the Securities Exchange Act of 1934 (15 
U.S.C.78a et seq.), by the Securities and Exchange 
Commission with respect to any broker or dealer; 
(4) the Investment Company Act of 1940 (15 
U.S.C. 80a–1 et seq.), by the Securities and Ex-
change Commission with respect to any investment 
company; 
(5) the Investment Advisers Act of 1940 (15 
U.S.C. 80b–1 et seq.), by the Securities and Ex-
change Commission with respect to any investment 
adviser registered with the Securities and Exchange 
Commission under that Act; 
(6) the Commodity Exchange Act (7 U.S.C. 1 
et seq.), by the Commodity Futures Trading Com-
mission with respect to any futures commission mer-
chant, commodity trading advisor, commodity pool 
operator, or introducing broker; 
(7) the provisions of title XIII of the Housing 
and Community Development Act of 1992 (12 
U.S.C. 4501 et seq.), by the Director of Federal 
Housing Enterprise Oversight (and any successor to 
such functional regulatory agency) with respect to 
the Federal National Mortgage Association, the Fed-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
eral Home Loan Mortgage Corporation, and any 
other entity or enterprise (as defined in that title) 
subject to the jurisdiction of such functional regu-
latory agency under that title, including any affiliate 
of any such enterprise; 
(8) State insurance law, in the case of any per-
son engaged in providing insurance, by the applica-
ble State insurance authority of the State in which 
the person is domiciled; and 
(9) the Federal Trade Commission Act (15 
U.S.C. 41 et seq.), by the Commission for any other 
covered entity that is not subject to the jurisdiction 
of any agency or authority described under para-
graphs (1) through (8). 
(b) EXTENSION OF FEDERAL TRADE COMMISSION 
ENFORCEMENT AUTHORITY.—The authority of the Com-
mission to enforce compliance with section 3, and the reg-
ulations required under section 4, under subsection (a)(8) 
shall— 
(1) notwithstanding the Federal Aviation Act of 
1958 (49 U.S.C. App. 1301 et seq.), include the au-
thority to enforce compliance by air carriers and for-
eign air carriers; and 
(2) notwithstanding the Packers and Stock-
yards Act (7 U.S.C. 181 et seq.), include the author-
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
ity to enforce compliance by persons, partnerships, 
and corporations subject to the provisions of that 
Act. 
(c) NO PRIVATE RIGHT OF ACTION.— 
(1) IN GENERAL.—This Act, and the regula-
tions prescribed under this Act, may not be con-
strued to provide a private right of action, including 
a class action with respect to any act or practice 
regulated under this Act. 
(2) CIVIL AND CRIMINAL ACTIONS.—No civil or 
criminal action relating to any act or practice gov-
erned under this Act, or the regulations prescribed 
under this Act, shall be commenced or maintained in 
any State court or under State law, including a 
pendent State claim to an action under Federal law. 
SEC. 6. PROTECTION OF INFORMATION AT FEDERAL AGEN-
CIES. 
(a) DATA
SECURITY
STANDARDS.—Each agency 
shall implement appropriate standards relating to admin-
istrative, technical, and physical safeguards— 
(1) to insure the security and confidentiality of 
the sensitive account information and sensitive per-
sonal information that is maintained or is being 
communicated by, or on behalf of, that agency; 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(2) to protect against any anticipated threats or 
hazards to the security of such information; and 
(3) to protect against misuse of such informa-
tion, which could result in substantial harm or in-
convenience to a consumer. 
(b) SECURITY
BREACH
NOTIFICATION
STAND-
ARDS.—Each agency shall implement appropriate stand-
ards providing for notification of consumers when such 
agency determines that sensitive account information or 
sensitive personal information that is maintained or is 
being communicated by, or on behalf of, such agency— 
(1) has been acquired without authorization; 
and 
(2) is reasonably likely to be misused in a man-
ner causing substantial harm or inconvenience to the 
consumers to whom the information relates. 
SEC. 7. RELATION TO STATE LAW. 
No requirement or prohibition may be imposed under 
the laws of any State with respect to the responsibilities 
of any person to— 
(1) protect the security of information relating 
to consumers that is maintained or communicated 
by, or on behalf of, such person; 
(2) safeguard information relating to consumers 
from potential misuse; 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS
(3) investigate or provide notice of the unau-
thorized access to information relating to consumers, 
or the potential misuse of such information for 
fraudulent, illegal, or other purposes; or 
(4) mitigate any loss or harm resulting from 
the unauthorized access or misuse of information re-
lating to consumers. 
SEC. 8. DELAYED EFFECTIVE DATE FOR CERTAIN PROVI-
SIONS. 
(a) COVERED ENTITIES.—Sections 3 and 7 shall take 
effect on the later of— 
(1) 1 year after the date of the enactment of 
this Act; or 
(2) the effective date of the final regulations re-
quired under section 4. 
(b) AGENCIES.—Section 6 shall take effect 1 year 
after the date of enactment of this Act. 
Æ 
VerDate Aug 31 2005 
00:26 Mar 29, 2007
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6301
E:\BILLS\H1685.IH
H1685
hmoore on PROD1PC68 with HMBILLS