I 
111TH CONGRESS 
1ST SESSION H. R. 2221 
To protect consumers by requiring reasonable security policies and procedures 
to protect computerized data containing personal information, and to 
provide for nationwide notice in the event of a security breach. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 30, 2009 
Mr. RUSH
(for himself, Mr. STEARNS, Mr. BARTON
of Texas, Ms. 
SCHAKOWSKY, and Mr. RADANOVICH) introduced the following bill; which 
was referred to the Committee on Energy and Commerce 
A BILL 
To protect consumers by requiring reasonable security poli-
cies and procedures to protect computerized data con-
taining personal information, and to provide for nation-
wide notice in the event of a security breach. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Data Accountability 
and Trust Act’’. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
(a) GENERAL SECURITY POLICIES
AND PROCE-
DURES.— 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(1) REGULATIONS.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate regulations under section 553 of 
title 5, United States Code, to require each person 
engaged in interstate commerce that owns or pos-
sesses data in electronic form containing personal in-
formation, or contracts to have any third party enti-
ty maintain such data for such person, to establish 
and implement policies and procedures regarding in-
formation security practices for the treatment and 
protection of personal information taking into con-
sideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, such 
person; 
(B) the current state of the art in adminis-
trative, technical, and physical safeguards for 
protecting such information; and 
(C) the cost of implementing such safe-
guards. 
(2) REQUIREMENTS.—Such regulations shall 
require the policies and procedures to include the 
following: 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(A) A security policy with respect to the 
collection, use, sale, other dissemination, and 
maintenance of such personal information. 
(B) The identification of an officer or 
other individual as the point of contact with re-
sponsibility for the management of information 
security. 
(C) A process for identifying and assessing 
any reasonably foreseeable vulnerabilities in the 
system maintained by such person that contains 
such electronic data, which shall include regular 
monitoring for a breach of security of such sys-
tem. 
(D) A process for taking preventive and 
corrective action to mitigate against any 
vulnerabilities identified in the process required 
by subparagraph (C), which may include imple-
menting any changes to security practices and 
the architecture, installation, or implementation 
of network or operating software. 
(E) A process for disposing of obsolete 
data in electronic form containing personal in-
formation by shredding, permanently erasing, 
or otherwise modifying the personal information 
contained in such data to make such personal 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
information 
permanently 
unreadable 
or 
undecipherable. 
(3) TREATMENT OF ENTITIES GOVERNED BY 
OTHER
LAW.—In promulgating the regulations 
under this subsection, the Commission may deter-
mine to be in compliance with this subsection any 
person who is required under any other Federal law 
to maintain standards and safeguards for informa-
tion security and protection of personal information 
that provide equal or greater protection than those 
required under this subsection. 
(b) DESTRUCTION OF OBSOLETE PAPER RECORDS 
CONTAINING PERSONAL INFORMATION.— 
(1) STUDY.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall 
conduct a study on the practicality of requiring a 
standard method or methods for the destruction of 
obsolete paper documents and other non-electronic 
data containing personal information by persons en-
gaged in interstate commerce who own or possess 
such paper documents and non-electronic data. The 
study shall consider the cost, benefit, feasibility, and 
effect of a requirement of shredding or other perma-
nent destruction of such paper documents and non- 
electronic data. 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(2) REGULATIONS.—The Commission may pro-
mulgate regulations under section 553 of title 5, 
United States Code, requiring a standard method or 
methods for the destruction of obsolete paper docu-
ments and other non-electronic data containing per-
sonal information by persons engaged in interstate 
commerce who own or possess such paper documents 
and non-electronic data if the Commission finds 
that— 
(A) the improper disposal of obsolete paper 
documents and other non-electronic data cre-
ates a reasonable risk of identity theft, fraud, 
or other unlawful conduct; 
(B) such a requirement would be effective 
in preventing identity theft, fraud, or other un-
lawful conduct; 
(C) the benefit in preventing identity theft, 
fraud, or other unlawful conduct would out-
weigh the cost to persons subject to such a re-
quirement; and 
(D) compliance with such a requirement 
would be practicable. 
In enforcing any such regulations, the Commission 
may determine to be in compliance with such regula-
tions any person who is required under any other 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
Federal law to dispose of obsolete paper documents 
and other non-electronic data containing personal in-
formation if such other Federal law provides equal 
or greater protection or personal information than 
the regulations promulgated under this subsection. 
(c) SPECIAL
REQUIREMENTS
FOR
INFORMATION 
BROKERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.— 
The regulations promulgated under subsection (a) 
shall require information brokers to submit their se-
curity policies to the Commission in conjunction with 
a notification of a breach of security under section 
3 or upon request of the Commission. 
(2) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission shall conduct an audit of the in-
formation security practices of such information 
broker, or require the information broker to conduct 
an independent audit of such practices (by an inde-
pendent auditor who has not audited such informa-
tion broker’s security practices during the preceding 
5 years). The Commission may conduct or require 
additional audits for a period of 5 years following 
the breach of security or until the Commission deter-
mines that the security practices of the information 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
broker are in compliance with the requirements of 
this section and are adequate to prevent further 
breaches of security. 
(3) VERIFICATION OF AND INDIVIDUAL ACCESS 
TO PERSONAL INFORMATION.— 
(A) 
VERIFICATION.—Each 
information 
broker shall establish reasonable procedures to 
verify the accuracy of the personal information 
it collects, assembles, or maintains, and any 
other information it collects, assembles, or 
maintains that specifically identifies an indi-
vidual, other than information which merely 
identifies an individual’s name or address. 
(B) CONSUMER
ACCESS
TO
INFORMA-
TION.— 
(i) ACCESS.—Each information broker 
shall— 
(I) provide to each individual 
whose personal information it main-
tains, at the individual’s request at 
least 1 time per year and at no cost 
to the individual, and after verifying 
the identity of such individual, a 
means for the individual to review any 
personal information regarding such 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
individual maintained by the informa-
tion broker and any other information 
maintained by the information broker 
that specifically identifies such indi-
vidual, other than information which 
merely identifies an individual’s name 
or address; and 
(II) place a conspicuous notice on 
its Internet website (if the informa-
tion broker maintains such a website) 
instructing individuals how to request 
access to the information required to 
be provided under subclause (I). 
(ii) DISPUTED INFORMATION.—When-
ever an individual whose information the 
information broker maintains makes a 
written request disputing the accuracy of 
any such information, the information 
broker, after verifying the identity of the 
individual making such request and unless 
there are reasonable grounds to believe 
such request is frivolous or irrelevant, 
shall— 
(I) correct any inaccuracy; or 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(II)(aa) in the case of informa-
tion that is public record information, 
inform the individual of the source of 
the information, and, if reasonably 
available, where a request for correc-
tion may be directed; or 
(bb) in the case of information 
that is non-public information, note 
the information that is disputed, in-
cluding the individual’s statement dis-
puting such information, and take 
reasonable steps to independently 
verify such information under the pro-
cedures outlined in subparagraph (A) 
if such information can be independ-
ently verified. 
(iii) LIMITATIONS.—An information 
broker may limit the access to information 
required under subparagraph (B) in the 
following circumstances: 
(I) If access of the individual to 
the information is limited by law or 
legally recognized privilege. 
(II) If the information is used for 
a legitimate governmental or fraud 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
prevention purpose that would be 
compromised by such access. 
(iv) RULEMAKING.—The Commission 
shall issue regulations, as necessary, under 
section 553 of title 5, United States Code, 
on the application of the limitations in 
clause (iii). 
(C) TREATMENT OF ENTITIES GOVERNED 
BY
OTHER
LAW.—The Commission may pro-
mulgate rules (under section 553 of title 5, 
United States Code) to determine to be in com-
pliance with this paragraph any person who is 
a consumer reporting agency, as defined in sec-
tion 603(f) of the Fair Credit Reporting Act, 
with respect to those products and services that 
are subject to and in compliance with the re-
quirements of that Act. 
(4) REQUIREMENT OF AUDIT LOG OF ACCESSED 
AND TRANSMITTED INFORMATION.—Not later than 
1 year after the date of the enactment of this Act, 
the Commission shall promulgate regulations under 
section 553 of title 5, United States Code, to require 
information brokers to establish measures which fa-
cilitate the auditing or retracing of any internal or 
external access to, or transmissions of, any data in 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
electronic form containing personal information col-
lected, assembled, or maintained by such information 
broker. 
(5) PROHIBITION ON PRETEXTING BY INFOR-
MATION BROKERS.— 
(A) PROHIBITION
ON
OBTAINING
PER-
SONAL INFORMATION BY FALSE PRETENSES.— 
It shall be unlawful for an information broker 
to obtain or attempt to obtain, or cause to be 
disclosed or attempt to cause to be disclosed to 
any person, personal information or any other 
information relating to any person by— 
(i) making a false, fictitious, or fraud-
ulent statement or representation to any 
person; or 
(ii) providing any document or other 
information to any person that the infor-
mation broker knows or should know to be 
forged, counterfeit, lost, stolen, or fraudu-
lently obtained, or to contain a false, ficti-
tious, or fraudulent statement or represen-
tation. 
(B) PROHIBITION
ON
SOLICITATION
TO 
OBTAIN PERSONAL INFORMATION UNDER FALSE 
PRETENSES.—It shall be unlawful for an infor-
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
mation broker to request a person to obtain 
personal information or any other information 
relating to any other person, if the information 
broker knew or should have known that the per-
son to whom such a request is made will obtain 
or attempt to obtain such information in the 
manner described in subsection (a). 
(d) EXEMPTION FOR TELECOMMUNICATIONS CAR-
RIER, CABLE OPERATOR, INFORMATION SERVICE, OR 
INTERACTIVE COMPUTER SERVICE.—Nothing in this sec-
tion shall apply to any electronic communication by a third 
party stored by a telecommunications carrier, cable oper-
ator, or information service, as those terms are defined 
in section 3 of the Communications Act of 1934 (47 
U.S.C. 153), or an interactive computer service, as such 
term is defined in section 230(f)(2) of such Act (47 U.S.C. 
230(f)(2)). 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) NATIONWIDE NOTIFICATION.—Any person en-
gaged in interstate commerce that owns or possesses data 
in electronic form containing personal information shall, 
following the discovery of a breach of security of the sys-
tem maintained by such person that contains such data— 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(1) notify each individual who is a citizen or 
resident of the United States whose personal infor-
mation was acquired by an unauthorized person as 
a result of such a breach of security; and 
(2) notify the Commission. 
(b) SPECIAL NOTIFICATION REQUIREMENT FOR CER-
TAIN ENTITIES.— 
(1) THIRD PARTY AGENTS.—In the event of a 
breach of security by any third party entity that has 
been contracted to maintain or process data in elec-
tronic form containing personal information on be-
half of any other person who owns or possesses such 
data, such third party entity shall be required only 
to notify such person of the breach of security. Upon 
receiving such notification from such third party, 
such person shall provide the notification required 
under subsection (a). 
(2) TELECOMMUNICATIONS
CARRIERS, CABLE 
OPERATORS, INFORMATION SERVICES, AND INTER-
ACTIVE
COMPUTER
SERVICES.—If a telecommuni-
cations carrier, cable operator, or information service 
(as such terms are defined in section 3 of the Com-
munications Act of 1934 (47 U.S.C. 153)), or an 
interactive computer service (as such term is defined 
in section 230(f)(2) of such Act (47 U.S.C. 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
230(f)(2))), becomes aware of a breach of security 
during the transmission of data in electronic form 
containing personal information that is owned or 
possessed by another person utilizing the means of 
transmission of such telecommunications carrier, 
cable operator, information service, or interactive 
computer service, such telecommunications carrier, 
cable operator, information service, or interactive 
computer service shall be required only to notify the 
person who initiated such transmission of such a 
breach of security if such person can be reasonably 
identified. Upon receiving such notification from a 
telecommunications carrier, cable operator, informa-
tion service, or interactive computer service, such 
person shall provide the notification required under 
subsection (a). 
(3) BREACH OF HEALTH INFORMATION.—If the 
Commission receives a notification of a breach of se-
curity and determines that information included in 
such breach is individually identifiable health infor-
mation (as such term is defined in section 1171(6) 
of the Social Security Act (42 U.S.C. 1320d(6)), the 
Commission shall send a copy of such notification to 
the Secretary of Health and Human Services. 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(c) TIMELINESS OF NOTIFICATION.—All notifications 
required under subsection (a) shall be made as promptly 
as possible and without unreasonable delay following the 
discovery of a breach of security of the system and con-
sistent with any measures necessary to determine the 
scope of the breach, prevent further breach or unauthor-
ized disclosures, and reasonably restore the integrity of the 
data system. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the 
selected method can reasonably be expected to 
reach the intended individual): 
(i) Written notification. 
(ii) Email notification, if— 
(I) the person’s primary method 
of communication with the individual 
is by email; or 
(II) the individual has consented 
to receive such notification and the 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
notification is provided in a manner 
that is consistent with the provisions 
permitting electronic transmission of 
notices under section 101 of the Elec-
tronic Signatures in Global Commerce 
Act (15 U.S.C. 7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that was acquired by an unauthor-
ized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the infor-
mation the person maintained about that 
individual; 
(iii) notice that the individual is enti-
tled to receive, at no cost to such indi-
vidual, consumer credit reports on a quar-
terly basis for a period of 2 years, and in-
structions to the individual on requesting 
such reports from the person; 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(iv) the toll-free contact telephone 
numbers and addresses for the major cred-
it reporting agencies; and 
(v) a toll-free telephone number and 
Internet website address for the Commis-
sion whereby the individual may obtain in-
formation regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(1) may provide substitute notifica-
tion in lieu of the direct notification required by 
paragraph (1) if— 
(i) the person owns or possesses data 
in electronic form containing personal in-
formation of fewer than 1,000 individuals; 
and 
(ii) such direct notification is not fea-
sible due to— 
(I) excessive cost to the person 
required to provide such notification 
relative to the resources of such per-
son, as determined in accordance with 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
the regulations issued by the Commis-
sion under paragraph (3)(A); or 
(II) lack of sufficient contact in-
formation for the individual required 
to be notified. 
(B) FORM
OF
SUBSTITUTE
NOTIFICA-
TION.—Such substitute notification shall in-
clude— 
(i) email notification to the extent 
that the person has email addresses of in-
dividuals to whom it is required to provide 
notification under subsection (a)(1); 
(ii) a conspicuous notice on the Inter-
net website of the person (if such person 
maintains such a website); and 
(iii) notification in print and to broad-
cast media, including major media in met-
ropolitan and rural areas where the indi-
viduals whose personal information was ac-
quired reside. 
(C) CONTENT OF SUBSTITUTE NOTICE.— 
Each form of substitute notice under this para-
graph shall include— 
(i) notice that individuals whose per-
sonal information is included in the breach 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
of security are entitled to receive, at no 
cost to the individuals, consumer credit re-
ports on a quarterly basis for a period of 
2 years, and instructions on requesting 
such reports from the person; and 
(ii) a telephone number by which an 
individual can, at no cost to such indi-
vidual, learn whether that individual’s per-
sonal information is included in the breach 
of security. 
(3) FEDERAL
TRADE
COMMISSION
REGULA-
TIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 1 year 
after the date of enactment of this Act, the 
Commission shall, by regulations under section 
553 of title 5, United States Code, establish cri-
teria for determining the circumstances under 
which substitute notification may be provided 
under paragraph (2), including criteria for de-
termining if notification under paragraph (1) is 
not feasible due to excessive cost to the person 
required to provide such notification relative to 
the resources of such person. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
with respect to compliance with this section. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute 
notification 
under 
paragraph 
(2)(B), including the extent of notification 
to print and broadcast media that complies 
with the requirements of such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.—A 
person required to provide notification under subsection 
(a) shall, upon request of an individual whose personal in-
formation was included in the breach of security, provide 
or arrange for the provision of, to each such individual 
and at no cost to such individual, consumer credit reports 
from at least one of the major credit reporting agencies 
beginning not later than 2 months following the discovery 
of a breach of security and continuing on a quarterly basis 
for a period of 2 years thereafter. 
(f) EXEMPTION.— 
(1) GENERAL EXEMPTION.—A person shall be 
exempt from the requirements under this section if, 
following a breach of security, such person deter-
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
technology has been or is reasonably likely to be 
compromised. In promulgating such a rule, the 
Commission shall consult with relevant indus-
tries, consumer organizations, and data security 
and identity theft prevention experts and estab-
lished standards setting bodies. 
(3) FTC GUIDANCE.—Not later than 1 year 
after the date of the enactment of this Act, the 
Commission shall issue guidance regarding the appli-
cation of the exemption in paragraph (1). 
(g) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—If the Commission, upon receiving notification of 
any breach of security that is reported to the Commission 
under subsection (a)(2), finds that notification of such a 
breach of security via the Commission’s Internet website 
would be in the public interest or for the protection of 
consumers, the Commission shall place such a notice in 
a clear and conspicuous location on its Internet website. 
(h) FTC STUDY ON NOTIFICATION IN LANGUAGES 
IN ADDITION TO ENGLISH.—Not later than 1 year after 
the date of enactment of this Act, the Commission shall 
conduct a study on the practicality and cost effectiveness 
of requiring the notification required by subsection (d)(1) 
to be provided in a language in addition to English to indi-
viduals known to speak only such other language. 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
SEC. 4. ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or 3 shall be treated 
as an unfair and deceptive act or practice in viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act in the same manner, by 
the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act 
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act. Any person who violates 
such regulations shall be subject to the penalties and 
entitled to the privileges and immunities provided in 
that Act. 
(3) LIMITATION.—In promulgating rules under 
this Act, the Commission shall not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(b) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTION.—In any case in which the 
attorney general of a State, or an official or agency 
of a State, has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by any person who violates sec-
tion 2 or 3 of this Act, the attorney general, official, 
or agency of the State, as parens patriae, may bring 
a civil action on behalf of the residents of the State 
in a district court of the United States of appro-
priate jurisdiction— 
(A) to enjoin further violation of such sec-
tion by the defendant; 
(B) to compel compliance with such sec-
tion; or 
(C) to obtain civil penalties in the amount 
determined under paragraph (2). 
(2) CIVIL PENALTIES.— 
(A) CALCULATION.— 
(i) TREATMENT
OF
VIOLATIONS
OF 
SECTION
2.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
2, the amount determined under this para-
graph is the amount calculated by multi-
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
plying the number of violations of such 
section by an amount not greater than 
$11,000. Each day that a person is not in 
compliance with the requirements of such 
section shall be treated as a separate viola-
tion. The maximum civil penalty calculated 
under 
this 
clause 
shall 
not 
exceed 
$5,000,000. 
(ii) TREATMENT
OF
VIOLATIONS
OF 
SECTION
3.—For purposes of paragraph 
(1)(C) with regard to a violation of section 
3, the amount determined under this para-
graph is the amount calculated by multi-
plying the number of violations of such 
section by an amount not greater than 
$11,000. Each failure to send notification 
as required under section 3 to a resident of 
the State shall be treated as a separate 
violation. The maximum civil penalty cal-
culated under this clause shall not exceed 
$5,000,000. 
(B) ADJUSTMENT
FOR
INFLATION.—Be-
ginning on the date that the Consumer Price 
Index is first published by the Bureau of Labor 
Statistics that is after 1 year after the date of 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
enactment of this Act, and each year thereafter, 
the amounts specified in clauses (i) and (ii) of 
subparagraph (A) shall be increased by the per-
centage increase in the Consumer Price Index 
published on that date from the Consumer 
Price Index published the previous year. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission 
and provide the Commission with a copy of its 
complaint, except in any case in which such 
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(c) AFFIRMATIVE DEFENSE FOR A VIOLATION OF 
SECTION 3.—It shall be an affirmative defense to an en-
forcement action brought under subsection (a), or a civil 
action brought under subsection (b), based on a violation 
of section 3, that all of the personal information contained 
in the data in electronic form that was acquired as a result 
of a breach of security of the defendant is public record 
information that is lawfully made available to the general 
public from Federal, State, or local government records 
and was acquired by the defendant from such records. 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means the unauthorized acquisition of 
data in electronic form containing personal informa-
tion. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
essary to enable decryption of such data. Such 
encryption must include appropriate management 
and safeguards of such keys to protect the integrity 
of the encryption. 
(5) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personal information for the purpose of engag-
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
ing in commercial transactions under the name of 
such other person. 
(6) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’ means a commercial entity whose 
business is to collect, assemble, or maintain personal 
information concerning individuals who are not cur-
rent or former customers of such entity in order to 
sell such information or provide access to such infor-
mation to any nonaffiliated third party in exchange 
for consideration, whether such collection, assembly, 
or maintenance of personal information is performed 
by the information broker directly, or by contract or 
subcontract with any other entity. 
(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
initial and last name, or address, or phone 
number, in combination with any 1 or more of 
the following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number or other 
State identification number. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
word that is necessary to permit access to 
an individual’s financial account. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule, mod-
ify the definition of ‘‘personal information’’ 
under subparagraph (A) to the extent that such 
modification is necessary to accommodate 
changes in technology or practices, will not un-
reasonably impede interstate commerce, and 
will accomplish the purposes of this Act. 
(8) PUBLIC RECORD INFORMATION.—The term 
‘‘public record information’’ means information 
about an individual which has been obtained origi-
nally from records of a Federal, State, or local gov-
ernment entity that are available for public inspec-
tion. 
(9) NON-PUBLIC
INFORMATION.—The term 
‘‘non-public information’’ means information about 
an individual that is of a private nature and neither 
available to the general public nor obtained from a 
public record. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
a State, with respect to those entities covered by the regu-
lations issued pursuant to this Act, that expressly— 
(1) requires information security practices and 
treatment of data in electronic form containing per-
sonal information similar to any of those required 
under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized acquisi-
tion of data in electronic form containing personal 
information. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than the 
Attorney General of a State may bring a civil action 
under the laws of any State if such action is pre-
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an Attorney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. EFFECTIVE DATE AND SUNSET. 
(a) EFFECTIVE DATE.—This Act shall take effect 1 
year after the date of enactment of this Act. 
(b) SUNSET.—This Act shall cease to be in effect on 
the date that is 10 years from the date of enactment of 
this Act. 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $1,000,000 for each of fiscal years 2010 through 
2015 to carry out this Act. 
Æ 
VerDate Nov 24 2008 
05:29 May 04, 2009
Jkt 079200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6301
E:\BILLS\H2221.IH
H2221
rfrederick on PROD1PC67 with BILLS