(2) the United States Postal Inspection Service, 
if the security breach involves mail fraud; and 
(3) the attorney general of each State affected 
by the security breach. 
(c) TIMING
OF NOTICES.—The notices required 
under this section shall be delivered as follows: 
(1) Notice under subsection (a) shall be deliv-
ered as promptly as possible, but not later than 14 
days after discovery of the events requiring notice. 
(2) Notice under subsection (b) shall be deliv-
ered not later than 14 days after the United States 
Secret Service receives notice of a security breach 
from an agency or business entity. 
SEC. 8. ENFORCEMENT. 
(a) CIVIL ACTIONS BY THE ATTORNEY GENERAL.— 
The Attorney General may bring a civil action in the ap-
propriate United States district court against any business 
entity that engages in conduct constituting a violation of 
this Act and, upon proof of such conduct by a preponder-
ance of the evidence, such business entity shall be subject 
to a civil penalty of not more than $1,000 per day per 
individual whose sensitive personally identifiable informa-
tion was, or is reasonably believed to have been, accessed 
or acquired by an unauthorized person, up to a maximum 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
of $1,000,000 per violation, unless such conduct is found 
to be willful or intentional. 
(b) INJUNCTIVE ACTIONS BY THE ATTORNEY GEN-
ERAL.— 
(1) IN GENERAL.—If it appears that a business 
entity has engaged, or is engaged, in any act or 
practice constituting a violation of this Act, the At-
torney General may petition an appropriate district 
court of the United States for an order— 
(A) enjoining such act or practice; or 
(B) enforcing compliance with this Act. 
(2) ISSUANCE OF ORDER.—A court may issue 
an order under paragraph (1), if the court finds that 
the conduct in question constitutes a violation of this 
Act. 
(c) OTHER RIGHTS AND REMEDIES.—The rights and 
remedies available under this Act are cumulative and shall 
not affect any other rights and remedies available under 
law. 
(d) FRAUD ALERT.—Section 605A(b)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is 
amended by inserting ‘‘, or evidence that the consumer 
has received notice that the consumer’s financial informa-
tion has or may have been compromised,’’ after ‘‘identity 
theft report’’. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
SEC. 9. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or any State or local law 
enforcement agency authorized by the State attorney 
general or by State statute to prosecute violations of 
consumer protection law, has reason to believe that 
an interest of the residents of that State has been 
or is threatened or adversely affected by the engage-
ment of a business entity in a practice that is pro-
hibited under this Act, the State or the State or 
local law enforcement agency on behalf of the resi-
dents of the agency’s jurisdiction, may bring a civil 
action on behalf of the residents of the State or ju-
risdiction in a district court of the United States of 
appropriate jurisdiction or any other court of com-
petent jurisdiction, including a State court, to— 
(A) enjoin that practice; 
(B) enforce compliance with this Act; or 
(C) obtain civil penalties of not more than 
$1,000 per day per individual whose sensitive 
personally identifiable information was, or is 
reasonably believed to have been, accessed or 
acquired by an unauthorized person, up to a 
maximum of $1,000,000 per violation, unless 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
such conduct is found to be willful or inten-
tional. 
(2) NOTICE.— 
(A) IN GENERAL.—Before filing an action 
under paragraph (1), the attorney general of 
the State involved shall provide to the Attorney 
General of the United States— 
(i) written notice of the action; and 
(ii) a copy of the complaint for the ac-
tion. 
(B) EXEMPTION.— 
(i) IN GENERAL.—Subparagraph (A) 
shall not apply with respect to the filing of 
an action by an attorney general of a State 
under this Act, if the State attorney gen-
eral determines that it is not feasible to 
provide the notice described in such sub-
paragraph before the filing of the action. 
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general 
of a State shall provide notice and a copy 
of the complaint to the Attorney General 
at the time the State attorney general files 
the action. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
(b) FEDERAL PROCEEDINGS.—Upon receiving notice 
under subsection (a)(2), the Attorney General shall have 
the right to— 
(1) move to stay the action, pending the final 
disposition of a pending Federal proceeding or ac-
tion; 
(2) initiate an action in the appropriate United 
States district court under section 8 and move to 
consolidate all pending actions, including State ac-
tions, in such court; 
(3) intervene in an action brought under sub-
section (a)(2); and 
(4) file petitions for appeal. 
(c) PENDING PROCEEDINGS.—If the Attorney Gen-
eral has instituted a proceeding or action for a violation 
of this Act or any regulations thereunder, no attorney gen-
eral of a State may, during the pendency of such pro-
ceeding or action, bring an action under this Act against 
any defendant named in such criminal proceeding or civil 
action for any violation that is alleged in that proceeding 
or action. 
(d) RULE
OF CONSTRUCTION.—For purposes of 
bringing any civil action under subsection (a), nothing in 
this Act regarding notification shall be construed to pre-
vent an attorney general of a State from exercising the 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
powers conferred on such attorney general by the laws of 
that State to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
(f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 
Act establishes a private cause of action against a business 
entity for violation of any provision of this Act. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
SEC. 10. EFFECT ON FEDERAL AND STATE LAW. 
The provisions of this Act shall supersede any other 
provision of Federal law or any provision of law of any 
State relating to notification by a business entity engaged 
in interstate commerce or an agency of a security breach, 
except as provided in section 5(b). 
SEC. 11. AUTHORIZATION OF APPROPRIATIONS. 
There are authorized to be appropriated such sums 
as may be necessary to cover the costs incurred by the 
United States Secret Service to carry out investigations 
and risk assessments of security breaches as required 
under this Act. 
SEC. 12. REPORTING ON RISK ASSESSMENT EXEMPTIONS. 
(a) IN GENERAL.—The United States Secret Service 
shall report to Congress not later than 18 months after 
the date of enactment of this Act, and upon the request 
by Congress thereafter, on— 
(1) the number and nature of the security 
breaches described in the notices filed by those busi-
ness entities invoking the risk assessment exemption 
under section 3(b) of this Act and the response of 
the United States Secret Service to such notices; 
and 
(2) the number and nature of security breaches 
subject to the national security and law enforcement 
exemptions under section 3(a) of this Act. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
(b) REPORT.—Any report submitted under sub-
section (a) shall not disclose the contents of any risk as-
sessment provided to the United States Secret Service 
under this Act. 
SEC. 13. DEFINITIONS. 
In this Act, the following definitions shall apply: 
(1) AGENCY.—The term ‘‘agency’’ has the same 
meaning given such term in section 551 of title 5, 
United States Code. 
(2) AFFILIATE.—The term ‘‘affiliate’’ means 
persons related by common ownership or by cor-
porate control. 
(3) BUSINESS
ENTITY.—The term ‘‘business 
entity’’ means any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated as-
sociation, venture established to make a profit, or 
nonprofit, and any contractor, subcontractor, affil-
iate, or licensee thereof engaged in interstate com-
merce. 
(4) ENCRYPTED.—The term ‘‘encrypted’’— 
(A) means the protection of data in elec-
tronic form, in storage or in transit, using an 
encryption technology that has been adopted by 
an established standards setting body which 
renders such data indecipherable in the absence 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
of associated cryptographic keys necessary to 
enable decryption of such data; and 
(B) includes appropriate management and 
safeguards of such cryptographic keys so as to 
protect the integrity of the encryption. 
(5) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means any information, or compilation of in-
formation, in electronic or digital form serving as a 
means of identification, as defined by section 
1028(d)(7) of title 18, United State Code. 
(6) SECURITY BREACH.— 
(A) IN
GENERAL.—The term ‘‘security 
breach’’ means compromise of the security, con-
fidentiality, or integrity of computerized data 
through misrepresentation or actions that result 
in, or there is a reasonable basis to conclude 
has resulted in, acquisition of or access to sen-
sitive personally identifiable information that is 
unauthorized or in excess of authorization. 
(B) 
EXCLUSION.—The 
term 
‘‘security 
breach’’ does not include— 
(i) a good faith acquisition of sensitive 
personally identifiable information by a 
business entity or agency, or an employee 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
or agent of a business entity or agency, if 
the sensitive personally identifiable infor-
mation is not subject to further unauthor-
ized disclosure; or 
(ii) the release of a public record not 
otherwise subject to confidentiality or non-
disclosure requirements. 
(7) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means any information or com-
pilation of information, in electronic or digital form 
that includes— 
(A) an individual’s first and last name or 
first initial and last name in combination with 
any 1 of the following data elements: 
(i) A non-truncated Social Security 
number, driver’s license number, passport 
number, or alien registration number. 
(ii) Any 2 of the following: 
(I) Home address or telephone 
number. 
(II) Mother’s maiden name, if 
identified as such. 
(III) Month, day, and year of 
birth. 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS
(iii) Unique biometric data such as a 
finger print, voice print, a retina or iris 
image, or any other unique physical rep-
resentation. 
(iv) A unique account identifier, elec-
tronic identification number, user name, or 
routing code in combination with any asso-
ciated security code, access code, or pass-
word that is required for an individual to 
obtain money, goods, services or any other 
thing of value; or 
(B) a financial account number or credit 
or debit card number in combination with any 
security code, access code or password that is 
required for an individual to obtain credit, with-
draw funds, or engage in a financial trans-
action. 
SEC. 14. EFFECTIVE DATE. 
This Act shall take effect on the expiration of the 
date which is 90 days after the date of enactment of this 
Act. 
Æ 
VerDate Mar 15 2010 
04:20 Oct 05, 2010
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6301
E:\BILLS\H6236.IH
H6236
jbell on DSKDVH8Z91PROD with BILLS