I 
114TH CONGRESS 
1ST SESSION H. R. 1770 
To require certain entities who collect and maintain personal information 
of individuals to secure such information and to provide notice to such 
individuals in the case of a breach of security involving such information, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 14, 2015 
Mrs. BLACKBURN (for herself, Mr. WELCH, Mr. BURGESS, and Mr. UPTON) 
introduced the following bill; which was referred to the Committee on En-
ergy and Commerce 
A BILL 
To require certain entities who collect and maintain personal 
information of individuals to secure such information 
and to provide notice to such individuals in the case 
of a breach of security involving such information, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; PURPOSES. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Data Security and Breach Notification Act of 2015’’. 
(b) PURPOSES.—The purposes of this Act are to— 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(1) protect consumers from identity theft, eco-
nomic loss or economic harm, and financial fraud by 
establishing strong and uniform national data secu-
rity and breach notification standards for electronic 
data in interstate commerce while minimizing State 
law burdens that may substantially affect interstate 
commerce; and 
(2) expressly preempt any related State laws to 
ensure uniformity of this Act’s standards and the 
consistency of their application across jurisdictions. 
SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 
A covered entity shall implement and maintain rea-
sonable security measures and practices to protect and se-
cure personal information in electronic form against unau-
thorized access as appropriate for the size and complexity 
of such covered entity and the nature and scope of its ac-
tivities. 
SEC. 
3. 
NOTIFICATION 
OF 
INFORMATION 
SECURITY 
BREACH. 
(a) IN GENERAL.— 
(1) RESTORING
SECURITY.—Except as other-
wise provided by this section, a covered entity that 
uses, accesses, transmits, stores, disposes of, or col-
lects personal information shall, following the dis-
covery of a breach of security restore the reasonable 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
integrity, security, and confidentiality of the data 
system. 
(2) INVESTIGATION.—A covered entity or 
breached covered entity shall conduct in good faith 
a reasonable and prompt investigation of the breach 
of security to determine whether there is a reason-
able risk that the breach of security has resulted in, 
or will result in, identity theft, economic loss or eco-
nomic harm, or financial fraud to the individuals 
whose personal information was subject to the 
breach of security. 
(3) 
NOTIFICATION
TO
INDIVIDUALS
RE-
QUIRED.—Unless there is no reasonable risk that 
the breach of security has resulted in, or will result 
in, identity theft, economic loss or economic harm, 
or financial fraud to the individuals whose personal 
information was affected by the breach of security, 
the covered entity, breached covered entity, or non- 
breached covered entity, as the case may be, shall 
notify any resident of the United States that has 
been affected by the breach of security within the 
time specified in subsection (c). 
(4) NON-BREACHED
COVERED
ENTITY
ELEC-
TION NOTICE.— 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(A) NOTICE TO NON-BREACHED COVERED 
ENTITY
REQUIRED.—Subject to the require-
ments of this paragraph, in the event of a 
breach of security that presents a reasonable 
risk that the breach of security has resulted in, 
or will result in, identity theft, economic loss or 
economic harm, or financial fraud to individuals 
whose personal information or record is de-
scribed in the notice provided under this para-
graph the breached covered entity shall, as ex-
peditiously as possible and without unreason-
able delay within 10 days after fulfilling the re-
quirements described in paragraph (1), notify 
in writing each non-breached covered entity of 
the breach of security. 
(B) CONTENTS OF NOTICE.—The breached 
covered entity shall include in the notice de-
scribed in subparagraph (A)— 
(i) the elements of personal informa-
tion reasonably believed to be affected by 
the breach of security; 
(ii) an identification of the records re-
ceived from the non-breached entity that 
have been, or are reasonably believed to 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
have been, affected by the breach of secu-
rity; and 
(iii) whether there is a reasonable risk 
that the breach of security relating to such 
information and records has resulted in, or 
will result in, identity theft, economic loss 
or economic harm, or financial fraud. 
(C) ELECTION
BY
NON-BREACHED
COV-
ERED ENTITY AFTER RECEIVING NOTICE FROM 
A BREACHED COVERED ENTITY.—In the case of 
a breached covered entity that is a party to a 
written contract with a non-breached covered 
entity in which the breached covered entity 
maintains, stores, transmits, or processes data 
in electronic form containing personal informa-
tion identified in subparagraph (B), not later 
than 10 days after receipt of the notice de-
scribed in subparagraph (A), the non-breached 
covered entity may elect, in writing to the 
breached covered entity, to provide notification 
required by paragraph (3) to the individuals de-
scribed in the notice. Such election relieves the 
breached covered entity of the requirements 
under paragraph (3) with respect to the individ-
uals described in the notice. 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(D) OBLIGATION AFTER ELECTION.— 
(i) BREACHED COVERED ENTITY CO-
OPERATION.—If a non-breached covered 
entity elects under subparagraph (C) to 
provide notice under paragraph (3), the 
breached covered entity shall cooperate in 
all reasonable respects with the non- 
breached covered entity so that the notifi-
cation to such individuals is made as re-
quired under this section. Not later than 
10 business days after the non-breached 
covered entity submits a written request 
for necessary information to the breached 
covered entity, the breached covered entity 
shall provide such information. 
(ii) NON-BREACHED COVERED ENTITY 
COOPERATION.—If a non-breached covered 
entity does not elect to provide notice to 
individuals under subparagraph (C), the 
non-breached covered entity shall provide 
all required information about such indi-
viduals to, and cooperate in all reasonable 
respects with, the breached covered entity 
so that the notification to such individuals 
is made as required under this section. Not 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
later than 10 business days after the 
breached covered entity submits a written 
request for necessary information to the 
non-breached covered entity, the non- 
breached covered entity shall provide such 
information. 
(5) LAW
ENFORCEMENT.—A covered entity 
shall as expeditiously as possible notify the Commis-
sion and the Secret Service or the Federal Bureau 
of Investigation of the fact that a breach of security 
has occurred if the number of individuals whose per-
sonal information was, or there is a reasonable basis 
to conclude was, accessed or acquired by an unau-
thorized person exceeds 10,000. Any notification 
provided to the Secret Service or the Federal Bu-
reau of Investigation pursuant to this paragraph 
shall be provided not less than 10 days before notifi-
cation is provided to individuals pursuant to para-
graph (3). 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) NON-PROFIT ORGANIZATIONS.—In the event 
of a breach of security involving personal informa-
tion that would trigger notification under subsection 
(a), a non-profit organization may complete such no-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
the individuals affected by a breach of security and 
make the notification required under subsection (a) 
as expeditiously as possible and without unreason-
able delay, not later than 30 days after completing 
the requirements of subsection (a)(1). If a covered 
entity has provided the notification to individuals re-
quired under subsection (a) and after such notifica-
tion discovers additional individuals to whom notifi-
cation is required under such subsection with respect 
to the same breach of security, the covered entity 
shall make such notification to such individuals as 
expeditiously as possible and without unreasonable 
delay. 
(2) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW ENFORCEMENT OR NATIONAL SECURITY PUR-
POSES.—Notwithstanding paragraph (1), if a Fed-
eral, State, or local law enforcement agency deter-
mines that the notification to individuals required 
under this section would impede a civil or criminal 
investigation or a Federal agency determines that 
such notification would threaten national security, 
such notification shall be delayed upon written re-
quest of the law enforcement agency or Federal 
agency which the law enforcement agency or Federal 
agency determines is reasonably necessary and re-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
quests in writing. A law enforcement agency or Fed-
eral agency may, by a subsequent written request, 
revoke such delay or extend the period of time set 
forth in the original request made under this para-
graph if further delay is necessary. If a law enforce-
ment agency or Federal agency requests a delay of 
notification to individuals under this paragraph, the 
Commission shall, upon written request of the law 
enforcement agency or Federal agency, delay any 
public disclosure of a notification received by the 
Commission under this section relating to the same 
breach of security until the delay of notification to 
individuals is no longer in effect. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A cov-
ered entity required to provide notification to 
an individual under subsection (a) shall be in 
compliance with such requirement if the covered 
entity provides such notice by one of the fol-
lowing methods (if the selected method can rea-
sonably be expected to reach the intended indi-
vidual): 
(i) Written notification by postal mail. 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(ii) Notification by email or other 
electronic means, if— 
(I) the covered entity’s primary 
method of communication with the in-
dividual is by email or such other elec-
tronic means or the individual has 
consented to receive such notification; 
and 
(II) the email or other electronic 
means does not contain a hyperlink. 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A) 
with respect to a breach of security, such notifi-
cation shall include each of the following: 
(i) The identity of the covered entity 
that suffered the breach and, if such cov-
ered entity is also a breached covered enti-
ty providing notice under section 3(b)(1), 
the identity of each non-breached covered 
entity that did not elect to notify affected 
individuals pursuant to section 3(b)(1)(B) 
sufficient to show the breached covered en-
tity’s commercial relationship to the indi-
vidual receiving notice. 
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
(ii) A description of the personal in-
formation that was, or there is a reason-
able basis to conclude was, acquired or 
accessed by an unauthorized person. 
(iii) The date range of the breach of 
security, or an approximate date range of 
the breach of security if a specific date 
range is unknown based on the information 
available at the time of the notification. 
(iv) A telephone number, or toll-free 
telephone number for any covered entity 
that does not meet the definition of a small 
business concern or non-profit organiza-
tion, that the individual may use to contact 
the covered entity to inquire about the 
breach of security or the information the 
covered entity maintained about that indi-
vidual. 
(v) The toll-free contact telephone 
numbers and addresses for a consumer re-
porting agency that compiles and main-
tains files on consumers on a nationwide 
basis. 
(vi) The toll-free telephone number 
and Internet website address for the Com-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
mission whereby the individual may obtain 
information regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) IN GENERAL.—If, after making rea-
sonable efforts to contact all individuals to 
whom notice is required under subsection (a), 
the covered entity finds that contact informa-
tion for 500 or more individuals is insufficient 
or out-of-date, the covered entity shall also pro-
vide substitute notice to those individuals, 
which shall be reasonably calculated to reach 
the individuals affected by the breach of secu-
rity. 
(B) FORM
OF
SUBSTITUTE
NOTIFICA-
TION.—A covered entity may provide substitute 
notification by— 
(i) email or other electronic notifica-
tion to the extent that the covered entity 
has contact information for individuals to 
whom it is required to provide notification 
under subsection (a) and provided such 
email or electronic means does not contain 
a hyperlink; and 
(ii) a conspicuous notice on the cov-
ered entity’s Internet website (if such cov-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS
ered entity maintains such a website) for 
at least 90 days. 
(C) CONTENT OF SUBSTITUTE NOTICE.— 
Each form of substitute notice under clauses (i) 
and (ii) of subparagraph (B) shall include the 
information required under paragraph (1)(B). 
(3) 
DIRECT
NOTIFICATION
BY
A
THIRD 
PARTY.—Nothing in this Act shall be construed to 
prevent a covered entity from contracting with a 
third party to provide the notification required under 
this section, provided such third party issues such 
notification without unreasonable delay, in accord-
ance with the requirements of this section, and indi-
cates to all individuals in such notification that such 
third party is sending such notification on behalf of 
the covered entity. 
(e) REQUIREMENTS OF SERVICE PROVIDERS.— 
(1) IN GENERAL.—If a service provider becomes 
aware of a breach of security involving data in elec-
tronic form containing personal information that is 
owned or licensed by a covered entity that connects 
to or uses a system or network provided by the serv-
ice provider for the purpose of transmitting, routing, 
or providing intermediate or transient storage of 
such data, such service provider shall notify the cov-
VerDate Sep 11 2014 
06:08 Apr 15, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1770.IH
H1770
emcdonald on DSK67QTVN1PROD with BILLS