Index is first published by the Bureau of Labor 
Statistics that is after 1 year after the date of 
enactment of this Act, and each year thereafter, 
the amounts specified in clauses (i) and (ii) of 
subparagraph (A) shall be increased by the per-
centage increase in the Consumer Price Index 
published on that date from the Consumer 
Price Index published the previous year. 
(C) MAXIMUM
TOTAL
LIABILITY.—Not-
withstanding the number of actions which may 
be brought against a person under this sub-
section, the maximum civil penalty for which 
any person may be liable under this subsection 
shall not exceed— 
(i) $5,000,000 for each violation of 
section 2; and 
(ii) $5,000,000 for all violations of 
section 3 resulting from a single breach of 
security. 
(3) INTERVENTION BY THE FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission 
and provide the Commission with a copy of its 
complaint, except in any case in which such 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this Act, no State attorney general, or official 
or agency of a State, may bring an action under 
this subsection during the pendency of that ac-
tion against any defendant named in the com-
plaint of the Commission for any violation of 
this Act alleged in the complaint. 
(4) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
Act shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(d) AFFIRMATIVE DEFENSE FOR A VIOLATION OF 
SECTION 3.— 
(1) IN GENERAL.—It shall be an affirmative de-
fense to an enforcement action brought under sub-
section (b), or a civil action brought under sub-
section (c), based on a violation of section 3, that all 
of the personal information contained in the data in 
electronic form that was acquired or accessed as a 
result of a breach of security of the defendant is 
public record information that is lawfully made 
available to the general public from Federal, State, 
or local government records and was acquired by the 
defendant from such records. 
(2) NO EFFECT ON OTHER REQUIREMENTS.— 
Nothing in this subsection shall be construed to ex-
empt any person from the requirement to notify the 
Commission of a breach of security as required 
under section 3(a). 
SEC. 5. DEFINITIONS. 
In this Act, the following definitions apply: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means the unauthorized acquisition of 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
data in electronic form containing personal informa-
tion. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) CONSUMER REPORTING AGENCY.—The term 
‘‘consumer reporting agency’’ has the meaning given 
the term ‘‘consumer reporting agency that compiles 
and maintains files on consumers on a nationwide 
basis’’ in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
(4) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(5) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
essary to enable decryption of such data. Such 
encryption must include appropriate management 
and safeguards of such keys to protect the integrity 
of the encryption. 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
(6) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personal information for the purpose of engag-
ing in commercial transactions under the name of 
such other person. 
(7) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’— 
(A) means a commercial entity whose busi-
ness is to collect, assemble, or maintain per-
sonal information concerning individuals who 
are not current or former customers of such en-
tity in order to sell such information or provide 
access to such information to any nonaffiliated 
third party in exchange for consideration, 
whether such collection, assembly, or mainte-
nance of personal information is performed by 
the information broker directly, or by contract 
or subcontract with any other entity; and 
(B) does not include a commercial entity to 
the extent that such entity processes informa-
tion collected by and received from a non-
affiliated third party concerning individuals who 
are current or former customers or employees 
of such third party to enable such third party 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
to (1) provide benefits for its employees or (2) 
directly transact business with its customers. 
(8) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
initial and last name, or address, or phone 
number, in combination with any 1 or more of 
the following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number, passport 
number, military identification number, or 
other similar number issued on a govern-
ment document used to verify identity. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
word that is necessary to permit access to 
an individual’s financial account. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule pro-
mulgated under section 553 of title 5, United 
States Code, modify the definition of ‘‘personal 
information’’ under subparagraph (A)— 
(i) for the purpose of section 2 to the 
extent that such modification will not un-
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
reasonably impede interstate commerce, 
and will accomplish the purposes of this 
Act; or 
(ii) for the purpose of section 3, to the 
extent that such modification is necessary 
to accommodate changes in technology or 
practices, will not unreasonably impede 
interstate commerce, and will accomplish 
the purposes of this Act. 
(9) PUBLIC RECORD INFORMATION.—The term 
‘‘public record information’’ means information 
about an individual which has been obtained origi-
nally from records of a Federal, State, or local gov-
ernment entity that are available for public inspec-
tion. 
(10) NON-PUBLIC
INFORMATION.—The term 
‘‘non-public information’’ means information about 
an individual that is of a private nature and neither 
available to the general public nor obtained from a 
public record. 
(11) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means an entity that provides to a user 
transmission, routing, intermediate and transient 
storage, or connections to its system or network, for 
electronic communications, between or among points 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
specified by such user of material of the user’s 
choosing, without modification to the content of the 
material as sent or received. Any such entity shall 
be treated as a service provider under this Act only 
to the extent that it is engaged in the provision of 
such transmission, routing, intermediate and tran-
sient storage or connections. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
a State, with respect to those entities covered by the regu-
lations issued pursuant to this Act, that expressly— 
(1) requires information security practices and 
treatment of data containing personal information 
similar to any of those required under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized access 
to or acquisition of data in electronic form con-
taining personal information. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than a per-
son specified in section 4(c) may bring a civil action 
under the laws of any State if such action is pre-
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an attorney general of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law. 
SEC. 7. EFFECTIVE DATE. 
This Act shall take effect 1 year after the date of 
enactment of this Act. 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $1,000,000 for each of fiscal years 2011 through 
2016 to carry out this Act. 
Æ 
VerDate Sep 11 2014 
07:00 Feb 03, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6301
E:\BILLS\H580.IH
H580
emcdonald on DSK67QTVN1PROD with BILLS