subparagraph (A) shall be increased by the per-
centage increase in the Consumer Price Index 
published on that date from the Consumer 
Price Index published the previous year. 
(3) NOTICE
AND
INTERVENTION
BY
THE 
FTC.— 
(A) The attorney general of a State shall 
provide prior written notice of any action under 
paragraph (1) to the Commission and provide 
the Commission with a copy of the complaint in 
the action, except in any case in which such 
prior notice is not feasible, in which case the at-
torney general shall serve such notice imme-
diately upon instituting such action. The Com-
mission shall have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
this subsection during the pendency of that ac-
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) RELATIONSHIP WITH STATE-LAW CLAIMS.— 
If the attorney general of a State has authority to 
bring an action under State law directed at acts or 
practices that also violate this Act, the attorney gen-
eral may assert the State-law claim and a claim 
under this Act in the same civil action. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means unauthorized access to, acquisi-
tion of, sale of, or use of data containing personal 
information. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means— 
(A) any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated 
association, or venture over which the Commis-
sion has authority pursuant to section 5(a)(2) 
of the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)); 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(B) notwithstanding section 5(a)(2) of the 
Federal Trade Commission Act (15 U.S.C. 
45(a)(2)), common carriers subject to the Com-
munications Act of 1934 (47 U.S.C. 151 et 
seq.); and 
(C) notwithstanding sections 4 and 5(a)(2) 
of the Federal Trade Commission Act (15 
U.S.C. 44 and 45(a)(2)), any non-profit organi-
zation, including any organization described in 
section 501(c) of the Internal Revenue Code of 
1986 that is exempt from taxation under sec-
tion 501(a) of the Internal Revenue Code of 
1986. 
(4) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means any information or compila-
tion of information that includes any of the fol-
lowing: 
(i) An individual’s first name or initial 
and last name in combination with any of 
the following data elements for that indi-
vidual: 
(I) Home address or telephone 
number. 
(II) Mother’s maiden name. 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(III) Month, day, and year of 
birth. 
(IV) User name or electronic 
mail address. 
(ii) Driver’s license number, passport 
number, military identification number, 
alien registration number, or other similar 
number issued on a government document 
used to verify identity. 
(iii) Unique account identifier, includ-
ing a financial account number, or credit 
or debit card number, electronic identifica-
tion number, user name, or routing code. 
(iv) Partial or complete Social Secu-
rity number. 
(v) Unique biometric or genetic data 
such as a fingerprint, voice print, a retina 
or iris image, or any other unique physical 
representations. 
(vi) Information that could be used to 
access an individual’s account, such as 
user name and password or e-mail address 
and password. 
(vii) Any two or more of the following 
data elements: 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(I) An individual’s first and last 
name or first initial and last name. 
(II) A unique account identifier, 
including a financial account number 
or credit or debit card number, elec-
tronic identification number, user 
name, or routing code. 
(III) Any security code, access 
code, or password, or source code that 
could be used to generate such codes 
or passwords. 
(viii) Information generated or derived 
from the operation or use of an electronic 
communications device that is sufficient to 
identify the street name and name of the 
city or town in which the device is located. 
(ix) Any information regarding an in-
dividual’s medical history, mental or phys-
ical condition, medical treatment or diag-
nosis by a health care professional, or the 
provision of health care to the individual, 
including health information provided to a 
website or mobile application. 
(x) A health insurance policy number 
or subscriber identification number and 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
any unique identifier used by a health in-
surer to identify the individual, or any in-
formation in an individual’s health insur-
ance application and claims history, includ-
ing any appeals records. 
(xi) Digitized or other electronic sig-
nature. 
(xii) Nonpublic communications or 
other user-created content such as emails, 
photographs, or videos. 
(xiii) Any record or information con-
cerning payroll, income, financial accounts, 
mortgages, loans, lines of credit, utility 
bills, accumulated purchases, or any other 
information regarding financial assets, ob-
ligations, or spending habits. 
(xiv) Any additional element the Com-
mission defines as personal information. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A). 
(5) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, the 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
Commonwealth of Puerto Rico, Guam, American 
Samoa, the United States Virgin Islands, the Com-
monwealth of the Northern Mariana Islands, any 
other territory or possession of the United States, 
and each federally recognized Indian tribe. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) EFFECT
ON
STATE
DATA
SECURITY
AND 
BREACH NOTIFICATION LAWS.—This Act supersedes any 
provision of a statute or regulation of a State or political 
subdivision of a State, with respect to a covered entity, 
that expressly— 
(1) requires information security practices for 
the treatment and protection of personal information 
similar to any of those required under section 2; or 
(2) requires notification to individuals of a 
breach of security of personal information. 
(b) EFFECT ON OTHER STATE LAWS.—Nothing in 
this Act shall be construed to— 
(1) preempt or limit any provision of any law, 
rule, regulation, requirement, standard, or other pro-
vision having the force and effect of law of any 
State, including any State consumer protection law, 
any State law relating to acts of fraud or deception, 
and any State trespass, contract, or tort law; 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
(2) prevent or limit the attorney general of a 
State from exercising the powers conferred upon the 
attorney general by the laws of the State, including 
conducting investigations, administering oaths or af-
firmations, or compelling the attendance of witnesses 
or the production of documentary and other evi-
dence; or 
(3) preempt or limit any provision of any law, 
rule, regulation, requirement, standard, or other pro-
vision having the force and effect of law of any State 
with respect to any person that is not a covered enti-
ty. 
(c) PRESERVATION OF AUTHORITY.— 
(1) FEDERAL TRADE COMMISSION.—Nothing in 
this Act may be construed in any way to limit the 
Commission’s authority under any other provision of 
law. 
(2) FEDERAL COMMUNICATIONS COMMISSION.— 
Nothing in this Act may be construed in any way to 
limit or affect the Federal Communication Commis-
sion’s authority under any other provision of law. 
(3) CONSUMER
FINANCIAL
PROTECTION
BU-
REAU.—Nothing in this Act may be construed in 
any way to limit or affect the Consumer Financial 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS
Protection Bureau’s authority under any other pro-
vision of law. 
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 90 days after the date of 
enactment of this Act. 
Æ 
VerDate Sep 11 2014 
04:27 Apr 04, 2018
Jkt 079200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6301
E:\BILLS\H5388.IH
H5388
lotter on DSKBCFDHB2PROD with BILLS