a breach of security of the system and con-
sistent with any measures necessary to deter-
mine the scope of the breach, prevent further 
breach or unauthorized disclosures, and rea-
sonably restore the integrity of the data sys-
tem. 
(d) METHOD
AND CONTENT
OF NOTIFICA-
TION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD
OF
NOTIFICATION.—A 
person required to provide notifica-
tion to individuals under subsection 
(a)(1) shall be in compliance with 
such requirement if the person pro-
vides conspicuous and clearly identi-
fied notification by one of the fol-
lowing methods (provided the se-
lected method can reasonably be ex-
pected to reach the intended indi-
vidual): 
(i) Written notification. 
(ii) Email notification, if— 
(I) the person’s primary 
method 
of 
communication 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
with 
the 
individual 
is 
by 
email; or 
(II) 
the 
individual 
has 
consented to receive such no-
tification and the notification 
is provided in a manner that 
is consistent with the provi-
sions 
permitting 
electronic 
transmission of notices under 
section 101 of the Electronic 
Signatures in Global Com-
merce Act (15 U.S.C. 7001). 
(B) CONTENT
OF
NOTIFICATION.— 
Regardless of the method by which 
notification is provided to an indi-
vidual under subparagraph (A), such 
notification shall include— 
(i) a description of the per-
sonal information that was ac-
quired by an unauthorized per-
son; 
(ii) a telephone number that 
the individual may use, at no cost 
to such individual, to contact the 
person 
to 
inquire 
about 
the 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
breach of security or the informa-
tion the person maintained about 
that individual; 
(iii) notice that the individual 
is entitled to receive, at no cost to 
such individual, consumer credit 
reports on a quarterly basis for a 
period of 2 years, and instruc-
tions to the individual on request-
ing such reports from the person; 
(iv) the toll-free contact tele-
phone numbers and addresses for 
the major credit reporting agen-
cies; and 
(v) a toll-free telephone num-
ber and Internet website address 
for the Commission whereby the 
individual may obtain informa-
tion regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO 
SUBSTITUTE
NOTIFICATION.—A person 
required to provide notification to in-
dividuals under subsection (a)(1) may 
provide substitute notification in lieu 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
of the direct notification required by 
paragraph (1) if— 
(i) the person owns or pos-
sesses data in electronic form 
containing personal information 
of fewer than 1,000 individuals; 
and 
(ii) such direct notification is 
not feasible due to— 
(I) excessive cost to the 
person required to provide 
such notification relative to 
the resources of such person, 
as determined in accordance 
with the regulations issued by 
the Commission under para-
graph (3)(A); or 
(II) lack of sufficient con-
tact information for the indi-
vidual required to be notified. 
(B) FORM OF SUBSTITUTE NOTICE.— 
Such substitute notification shall in-
clude— 
(i) email notification to the 
extent that the person has email 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
addresses of individuals to whom 
it is required to provide notifica-
tion under subsection (a)(1); 
(ii) a conspicuous notice on 
the Internet website of the person 
(if such person maintains such a 
website); and 
(iii) notification in print and 
to 
broadcast 
media, 
including 
major media in metropolitan and 
rural areas where the individuals 
whose personal information was 
acquired reside. 
(C) CONTENT
OF
SUBSTITUTE
NO-
TICE.—Each form of substitute notice 
under this paragraph shall include— 
(i) 
notice 
that 
individuals 
whose personal information is in-
cluded in the breach of security 
are entitled to receive, at no cost 
to the individuals, consumer cred-
it reports on a quarterly basis for 
a period of 2 years, and instruc-
tions on requesting such reports 
from the person; and 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS