(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the security breach or the informa-
tion the person maintained about that indi-
vidual; 
(iii) the toll-free contact telephone 
numbers and addresses for the major cred-
it reporting agencies; and 
(iv) a toll-free telephone number and 
Internet website address for the Commis-
sion whereby the individual may obtain in-
formation regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(1) may provide substitute notifica-
tion in lieu of the direct notification required by 
paragraph (1) if such direct notification is not 
feasible due to— 
(i) excessive cost to the person re-
quired to provide such notification relative 
to the resources of such person, as deter-
mined in accordance with the regulations
issued by the Commission under paragraph 
(3)(A); or 
(ii) lack of sufficient contact informa-
tion for the individual required to be noti-
fied. 
(B) CONTENT OF SUBSTITUTE NOTIFICA-
TION.—Such substitute notification shall in-
clude notification in print and broadcast media, 
including major media in metropolitan and 
rural areas where the individuals whose per-
sonal information was acquired reside. Such no-
tification shall include a telephone number 
where an individual can, at no cost to such indi-
vidual, learn whether or not that individual’s 
personal information is included in the security 
breach. 
(3) FEDERAL
TRADE
COMMISSION
REGULA-
TIONS AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 270 
days after the date of enactment of this Act, 
the Commission shall, by regulation, establish 
criteria for determining the circumstances 
under which substitute notification may be pro-
vided under paragraph (2), including criteria 
for determining if notification under paragraph
(1) is not feasible due to excessive cost to the 
person required to provide such notification rel-
ative to the resources of such person. 
(B) GUIDANCE.—In addition, the Commis-
sion shall provide and publish general guidance 
with respect to compliance with this section. 
Such guidance shall include— 
(i) a description of written or email 
notification that complies with the require-
ments of paragraph (1); and 
(ii) guidance on the content of sub-
stitute 
notification 
under 
paragraph 
(2)(B), including the extent of notification 
to print and broadcast media that complies 
with the requirements of such paragraph. 
(d) OTHER OBLIGATIONS FOLLOWING BREACH.—A 
person required to provide notification under subsection 
(a) shall provide or arrange for the provision of, to each 
individual to whom notification is provided under sub-
section (c)(1) and at no cost to such individual, consumer 
credit reports from at least one of the major credit report-
ing agencies beginning not later than 2 months following 
a breach of security and continuing on a quarterly basis 
for a period of 2 years thereafter. The Commission shall, 
by regulation, provide alternative requirements under this
subsection for persons who qualify to provide substitute 
notification under subsection (c)(2). 
(e) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—The Commission shall place, in a clear and con-
spicuous location on its Internet website, a notice of any 
breach of security that is reported to the Commission 
under subsection (a)(2). 
SEC. 4. ENFORCEMENT BY THE FEDERAL TRADE COMMIS-
SION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A violation of section 2 or 3 shall be treated as a violation 
of a regulation under section 18(a)(1)(B) of the Federal 
Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regard-
ing unfair or deceptive acts or practices. 
(b) POWERS
OF COMMISSION.—The Commission 
shall enforce this Act in the same manner, by the same 
means, and with the same jurisdiction, powers, and duties 
as though all applicable terms and provisions of the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.) were 
incorporated into and made a part of this Act. Any person 
who violates such regulations shall be subject to the pen-
alties and entitled to the privileges and immunities pro-
vided in that Act. Nothing in this Act shall be construed 
to limit the authority of the Commission under any other 
provision of law.
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means the unauthorized acquisition of 
data in electronic form containing personal informa-
tion that establishes a reasonable basis to conclude 
that there is a significant risk of identity theft to the 
individual to whom the personal information relates. 
The encryption of such data, combined with appro-
priate safeguards of the keys necessary to enable 
decryption of such data, shall establish a presump-
tion that no such reasonable basis exists. Any such 
presumption may be rebutted by facts demonstrating 
that the method of encryption has been or is likely 
to be compromised. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or in transit using an encryption algorithm 
implemented within a validated cryptographic mod-
ule that has been approved by the National Institute 
of Standards and Technology or another comparable 
standards body recognized by the Commission, ren-
dering such data indecipherable in the absence of as-
sociated cryptographic keys necessary to enable 
decryption of such data. Such encryption must in-
clude appropriate management and safeguards of 
such keys to protect the integrity of the encryption. 
(5) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized assumption of an-
other person’s identity for the purpose of engaging 
in commercial transactions under the name of such 
other person. 
(6) INFORMATION BROKER.—The term ‘‘infor-
mation broker’’ means a commercial entity whose 
business is to collect, assemble, or maintain personal 
information concerning individuals who are not cus-
tomers of such entity for the sale or transmission of 
such information or the provision of access to such 
information to any third party, whether such collec-
tion, assembly, or maintenance of personal informa-
tion is performed by the information broker directly, 
or by contract or subcontract with any other entity. 
(7) PERSONAL INFORMATION.—
(A) DEFINITION.—The term ‘‘personal in-
formation’’ means an individual’s first and last 
name in combination with any 1 or more of the 
following data elements for that individual: 
(i) Social Security number. 
(ii) Driver’s license number or other 
State identification number. 
(iii) Financial account number, or 
credit or debit card number, and any re-
quired security code, access code, or pass-
word that is necessary to permit access to 
an individual’s financial account. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by rule, mod-
ify the definition of ‘‘personal information’’ 
under subparagraph (A) to the extent that such 
modification is necessary to accommodate 
changes in technology or practices, will not un-
reasonably impede interstate commerce, and 
will accomplish the purposes of this Act. 
(8) PERSON.—The term ‘‘person’’ has the same 
meaning given such term in section 551(2) of title 
5, United States Code.
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SECURITY 
LAWS.—This Act supersedes any provision of a statute, 
regulation, or rule of a State or political subdivision of 
a State that expressly— 
(1) requires information security practices and 
treatment of personal information similar to any of 
those required under section 2; and 
(2) requires notification to individuals of a 
breach of security resulting in unauthorized acquisi-
tion of their personal information. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than the 
Attorney General of a State may bring a civil action 
under the laws of any State if such action is pre-
mised in whole or in part upon the defendant vio-
lating any provision of this Act. 
(2) PROTECTION
OF
CONSUMER
PROTECTION 
LAWS.—This subsection shall not be construed to 
limit the enforcement of any State consumer protec-
tion law by an Attorney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.—This 
Act shall not be construed to preempt the applicability 
of— 
(1) State trespass, contract, or tort law; or
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
SEC. 7. EFFECTIVE DATE AND SUNSET. 
(a) EFFECTIVE DATE.—This Act shall take effect 1 
year after the date of enactment of this Act. 
(b) SUNSET.—This Act shall cease to be in effect on 
the date that is 10 years from the date of enactment of 
this Act. 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $1,000,000 for each of fiscal years 2006 through 
2010 to carry out this Act. 
Æ