mation with respect and in accordance with common 
standards. 
(5) On the day before the date of the enactment 
of this Act, the laws of the Federal Government and 
State and local governments provided inadequate 
privacy protection for individuals engaging in and 
interacting with persons engaged in interstate com-
merce. 
(6) As of the day before the date of the enact-
ment of this Act, with the exception of Federal 
Trade Commission enforcement of laws against un-
fair and deceptive practices, the Federal Government 
has eschewed general commercial privacy laws in 
favor of industry self-regulation, which has led to 
several self-policing schemes, some of which are en-
forceable, and some of which provide insufficient pri-
vacy protection to individuals. 
(7) As of the day before the date of the enact-
ment of this Act, many collectors of personally iden-
tifiable information have yet to provide baseline fair 
information practice protections for individuals. 
(8) The ease of gathering and compiling per-
sonal information on the Internet and off, both 
overtly and surreptitiously, is becoming increasingly 
efficient and effortless due to advances in technology 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
which have provided information gatherers the abil-
ity to compile seamlessly highly detailed personal 
histories of individuals. 
(9) Personal information requires greater pri-
vacy protection than is available on the day before 
the date of the enactment of this Act. Vast amounts 
of personal information, including sensitive informa-
tion, about individuals are collected on and off the 
Internet, often combined and sold or otherwise 
transferred to third parties, for purposes unknown 
to an individual to whom the personally identifiable 
information pertains. 
(10) Toward the close of the 20th century, as 
individuals’ personal information was increasingly 
collected, profiled, and shared for commercial pur-
poses, and as technology advanced to facilitate these 
practices, Congress enacted numerous statutes to 
protect privacy. 
(11) Those statutes apply to the government, 
telephones, cable television, e-mail, video tape rent-
als, and the Internet (but only with respect to chil-
dren and law enforcement requests). 
(12) As in those instances, the Federal Govern-
ment has a substantial interest in creating a level 
playing field of protection across all collectors of per-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
sonally identifiable information, both in the United 
States and abroad. 
(13) Enhancing individual privacy protection in 
a balanced way that establishes clear, consistent 
rules, both domestically and internationally, will 
stimulate commerce by instilling greater consumer 
confidence at home and greater confidence abroad as 
more and more entities digitize personally identifi-
able information, whether collected, stored, or used 
online or offline. 
SEC. 103. DEFINITIONS. 
(a) IN GENERAL.—Subject to subsection (b), in this 
title: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means any person to whom this title applies 
under section 151. 
(3) COVERED INFORMATION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘covered informa-
tion’’ means only the following: 
(i) Personally identifiable information. 
(ii) Unique identifier information. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(iii) Any information that is collected, 
used, or stored in connection with person-
ally identifiable information or unique 
identifier information in a manner that 
may reasonably be used by the party col-
lecting the information to identify a spe-
cific individual. 
(B) EXCEPTION.—The term ‘‘covered in-
formation’’ does not include the following: 
(i) Personally identifiable information 
obtained from public records that is not 
merged with covered information gathered 
elsewhere. 
(ii) Personally identifiable information 
that is obtained from a forum— 
(I) where the individual volun-
tarily shared the information or au-
thorized the information to be shared; 
and 
(II) that— 
(aa) is widely and publicly 
available and was not made pub-
licly available in bad faith; and 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(bb) contains no restrictions 
on who can access and view such 
information. 
(iii) Personally identifiable informa-
tion reported in public media. 
(iv) Personally identifiable informa-
tion dedicated to contacting an individual 
at the individual’s place of work. 
(4) ESTABLISHED BUSINESS RELATIONSHIP.— 
The term ‘‘established business relationship’’ means, 
with respect to a covered entity and a person, a rela-
tionship formed with or without the exchange of con-
sideration, involving the establishment of an account 
by the person with the covered entity for the receipt 
of products or services offered by the covered entity. 
(5) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means only the following: 
(A) Any of the following information about 
an individual: 
(i) The first name (or initial) and last 
name of an individual, whether given at 
birth or time of adoption, or resulting from 
a lawful change of name. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(ii) The postal address of a physical 
place of residence of such individual. 
(iii) An e-mail address. 
(iv) A telephone number or mobile de-
vice number. 
(v) A social security number or other 
government issued identification number 
issued to such individual. 
(vi) The account number of a credit 
card issued to such individual. 
(vii) Unique identifier information 
that alone can be used to identify a spe-
cific individual. 
(viii) Biometric data about such indi-
vidual, including fingerprints and retina 
scans. 
(B) If used, transferred, or stored in con-
nection with 1 or more of the items of informa-
tion described in subparagraph (A), any of the 
following: 
(i) A date of birth. 
(ii) The number of a certificate of 
birth or adoption. 
(iii) A place of birth. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(iv) Unique identifier information that 
alone cannot be used to identify a specific 
individual. 
(v) Precise geographic location, at the 
same degree of specificity as a global posi-
tioning system or equivalent system, and 
not including any general geographic infor-
mation that may be derived from an Inter-
net Protocol address. 
(vi) Information about an individual’s 
quantity, technical configuration, type, des-
tination, location, and amount of uses of 
voice services, regardless of technology 
used. 
(vii) Any other information concerning 
an individual that may reasonably be used 
by the party using, collecting, or storing 
that information to identify that individual. 
(6) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means— 
(A) personally identifiable information 
which, if lost, compromised, or disclosed with-
out authorization either alone or with other in-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
formation, carries a significant risk of economic 
or physical harm; or 
(B) information related to— 
(i) a particular medical condition or a 
health record; or 
(ii) the religious affiliation of an indi-
vidual. 
(7) THIRD PARTY.— 
(A) IN GENERAL.—The term ‘‘third party’’ 
means, with respect to a covered entity, a per-
son that— 
(i) is— 
(I) not related to the covered en-
tity by common ownership or cor-
porate control; or 
(II) related to the covered entity 
by common ownership or corporate 
control and an ordinary consumer 
would not understand that the covered 
entity and the person were related by 
common ownership or corporate con-
trol; 
(ii) is not a service provider used by 
the covered entity to receive personally 
identifiable information or sensitive person-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
ally identifiable information in performing 
services or functions on behalf of and 
under the instruction of the covered entity; 
and 
(iii) with respect to the collection of 
covered information of an individual, does 
not have an established business relation-
ship with the individual and does not iden-
tify itself to the individual at the time of 
such collection in a clear and conspicuous 
manner that is visible to the individual. 
(B) COMMON BRANDS.—The term ‘‘third 
party’’ may include, with respect to a covered 
entity, a person who operates under a common 
brand with the covered entity. 
(8) UNAUTHORIZED USE.— 
(A) IN GENERAL.—The term ‘‘unauthor-
ized use’’ means the use of covered information 
by a covered entity or its service provider for 
any purpose not authorized by the individual to 
whom such information relates. 
(B) EXCEPTIONS.—Except as provided in 
subparagraph (C), the term ‘‘unauthorized use’’ 
does not include use of covered information re-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
lating to an individual by a covered entity or its 
service provider as follows: 
(i) To process and enforce a trans-
action or deliver a service requested by 
that individual. 
(ii) To operate the covered entity that 
is providing a transaction or delivering a 
service requested by that individual, such 
as inventory management, financial report-
ing and accounting, planning, and product 
or service improvement or forecasting. 
(iii) To prevent or detect fraud or to 
provide for a physically or virtually secure 
environment. 
(iv) To investigate a possible crime. 
(v) That is required by a provision of 
law or legal process. 
(vi) To market or advertise to an indi-
vidual from a covered entity within the 
context of a covered entity’s own Internet 
website, services, or products if the covered 
information used for such marketing or ad-
vertising was— 
(I) collected directly by the cov-
ered entity; or 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(II) shared with the covered enti-
ty— 
(aa) at the affirmative re-
quest of the individual; or 
(bb) by an entity with which 
the individual has an established 
business relationship. 
(vii) Use that is necessary for the im-
provement of transaction or service deliv-
ery through research, testing, analysis, and 
development. 
(viii) Use that is necessary for inter-
nal operations, including the following: 
(I) Collecting customer satisfac-
tion surveys and conducting customer 
research to improve customer service 
information. 
(II) Information collected by an 
Internet website about the visits to 
such website and the click-through 
rates at such website— 
(aa) 
to 
improve 
website 
navigation and performance; or 
(bb) to understand and im-
prove the interaction of an indi-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
vidual with the advertising of a 
covered entity. 
(ix) Use— 
(I) by a covered entity with 
which an individual has an established 
business relationship; 
(II) which the individual could 
have reasonably expected, at the time 
such relationship was established, was 
related to a service provided pursuant 
to such relationship; and 
(III) which does not constitute a 
material change in use or practice 
from what could have reasonably been 
expected. 
(C) SAVINGS.—A use of covered informa-
tion regarding an individual by a covered entity 
or its service provider may only be excluded 
under subparagraph (B) from the definition of 
‘‘unauthorized use’’ under subparagraph (A) if 
the use is reasonable and consistent with the 
practices and purposes described in the notice 
given the individual in accordance with section 
121(a)(1). 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(9) UNIQUE
IDENTIFIER
INFORMATION.—The 
term ‘‘unique identifier information’’ means a 
unique persistent identifier associated with an indi-
vidual or a networked device, including a customer 
number held in a cookie, a user ID, a processor se-
rial number, or a device serial number. 
(b) MODIFIED DEFINITION BY RULEMAKING.—If the 
Commission determines that a term defined in any of 
paragraphs (3) through (8) is not reasonably sufficient to 
protect an individual from unfair or deceptive acts or prac-
tices, the Commission may by rule modify such definition 
as the Commission considers appropriate to protect such 
individual from an unfair or deceptive act or practice to 
the extent that the Commission determines will not unrea-
sonably impede interstate commerce. 
Subtitle A—Right to Security and 
Accountability 
SEC. 111. SECURITY. 
(a) RULEMAKING REQUIRED.—Not later than 180 
days after the date of the enactment of this Act, the Com-
mission shall initiate a rulemaking proceeding to require 
each covered entity to carry out security measures to pro-
tect the covered information it collects and maintains. 
(b) PROPORTION.—The requirements prescribed 
under subsection (a) shall provide for security measures 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
that are proportional to the size, type, nature, and sensi-
tivity of the covered information a covered entity collects. 
(c) CONSISTENCY.—The requirements prescribed 
under subsection (a) shall be consistent with guidance pro-
vided by the Commission and recognized industry prac-
tices for safety and security on the day before the date 
of the enactment of this Act. 
(d) TECHNOLOGICAL MEANS.—In a rule prescribed 
under subsection (a), the Commission may not require a 
specific technological means of meeting a requirement. 
SEC. 112. ACCOUNTABILITY. 
Each covered entity shall, in a manner proportional 
to the size, type, and nature of the covered information 
it collects— 
(1) have managerial accountability, proportional 
to the size and structure of the covered entity, for 
the adoption and implementation of policies con-
sistent with this title; 
(2) have a process to respond to non-frivolous 
inquiries from individuals regarding the collection, 
use, transfer, or storage of covered information re-
lating to such individuals; and 
(3) describe the means of compliance of the cov-
ered entity with the requirements of this Act upon 
request from— 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(A) the Commission; or 
(B) an appropriate safe harbor program 
established under section 151. 
SEC. 113. PRIVACY BY DESIGN. 
Each covered entity shall, in a manner proportional 
to the size, type, and nature of the covered information 
that it collects, implement a comprehensive information 
privacy program by— 
(1) incorporating necessary development proc-
esses and practices throughout the product life cycle 
that are designed to safeguard the personally identi-
fiable information that is covered information of in-
dividuals based on— 
(A) the reasonable expectations of such in-
dividuals regarding privacy; and 
(B) the relevant threats that need to be 
guarded against in meeting those expectations; 
and 
(2) maintaining appropriate management proc-
esses and practices throughout the data life cycle 
that are designed to ensure that information systems 
comply with— 
(A) the provisions of this title; 
(B) the privacy policies of a covered entity; 
and 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(C) the privacy preferences of individuals 
that are consistent with the consent choices and 
related mechanisms of individual participation 
as described in section 122. 
Subtitle B—Right to Notice and 
Individual Participation 
SEC. 121. TRANSPARENT NOTICE OF PRACTICES AND PUR-
POSES. 
(a) IN GENERAL.—Not later than 60 days after the 
date of the enactment of this Act, the Commission shall 
initiate a rulemaking proceeding to require each covered 
entity— 
(1) to provide accurate, clear, concise, and 
timely notice to individuals of— 
(A) the practices of the covered entity re-
garding the collection, use, transfer, and stor-
age of covered information; and 
(B) the specific purposes of those prac-
tices; 
(2) to provide accurate, clear, concise, and 
timely notice to individuals before implementing a 
material change in such practices; and 
(3) to maintain the notice required by para-
graph (1) in a form that individuals can readily ac-
cess. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(b) COMPLIANCE AND OTHER CONSIDERATIONS.—In 
the rulemaking required by subsection (a), the Commis-
sion— 
(1) shall consider the types of devices and 
methods individuals will use to access the required 
notice; 
(2) may provide that a covered entity unable to 
provide the required notice when information is col-
lected may comply with the requirement of sub-
section (a)(1) by providing an alternative time and 
means for an individual to receive the required no-
tice promptly; 
(3) may draft guidance for covered entities to 
use in designing their own notice and may include 
a draft model template for covered entities to use in 
designing their own notice; and 
(4) may provide guidance on how to construct 
computer-readable notices or how to use other tech-
nology to deliver the required notice. 
SEC. 122. INDIVIDUAL PARTICIPATION. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Commission shall 
initiate a rulemaking proceeding to require each covered 
entity— 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(1) to offer individuals a clear and conspicuous 
mechanism for opt-in consent for any use of their 
covered information that would otherwise be unau-
thorized use; 
(2) to offer individuals a robust, clear, and con-
spicuous mechanism for opt-in consent for the use 
by third parties of the individuals’ covered informa-
tion for behavioral advertising or marketing; 
(3) to provide any individual to whom the per-
sonally identifiable information that is covered infor-
mation pertains, and which the covered entity or its 
service provider stores, appropriate and reasonable— 
(A) access to such information; and 
(B) mechanisms to correct such informa-
tion to improve the accuracy of such informa-
tion; and 
(4) in the case that a covered entity enters 
bankruptcy or an individual requests the termination 
of a service provided by the covered entity to the in-
dividual or termination of some other relationship 
with the covered entity, to permit the individual to 
easily request that— 
(A) all of the personally identifiable infor-
mation that is covered information that the cov-
ered entity maintains relating to the individual, 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
except for information the individual authorized 
the sharing of or which the individual shared 
with the covered entity in a forum that is wide-
ly and publicly available, be rendered not per-
sonally identifiable; or 
(B) if rendering such information not per-
sonally identifiable is not possible, to cease the 
unauthorized use or transfer to a third party 
for an unauthorized use of such information or 
to cease use of such information for marketing, 
unless such unauthorized use or transfer is oth-
erwise required by a provision of law. 
(b) UNAUTHORIZED USE TRANSFERS.—In the rule-
making required by subsection (a), the Commission shall 
provide that with respect to transfers of covered informa-
tion to a third party for which an individual provides opt- 
in consent, the third party to which the information is 
transferred may not use such information for any unau-
thorized use other than a use— 
(1) specified pursuant to the purposes stated in 
the required notice under section 121(a); and 
(2) authorized by the individual when the indi-
vidual granted consent for the transfer of the infor-
mation to the third party. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(c) ALTERNATIVE MEANS TO TERMINATE USE OF 
COVERED INFORMATION.—In the rulemaking required by 
subsection (a), the Commission shall allow a covered entity 
to provide individuals an alternative means, in lieu of the 
access, consent, and correction requirements, of prohib-
iting a covered entity from use or transfer of that individ-
ual’s covered information. 
(d) SERVICE PROVIDERS.— 
(1) IN GENERAL.—The use of a service provider 
by a covered entity to receive covered information in 
performing services or functions on behalf of and 
under the instruction of the covered entity does not 
constitute an unauthorized use of such information 
by the covered entity if the covered entity and the 
service provider execute a contract that requires the 
service provider to collect, use, and store the infor-
mation on behalf of the covered entity in a manner 
consistent with— 
(A) the requirements of this title; and 
(B) the policies and practices related to 
such information of the covered entity. 
(2) TRANSFERS BETWEEN SERVICE PROVIDERS 
FOR A COVERED ENTITY.—The disclosure by a serv-
ice provider of covered information pursuant to a 
contract with a covered entity to another service pro-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
vider in order to perform the same service or func-
tions for that covered entity does not constitute an 
unauthorized use. 
(3) LIABILITY REMAINS WITH COVERED ENTI-
TY.—A covered entity remains responsible and liable 
for the protection of covered information that has 
been transferred to a service provider for processing, 
notwithstanding any agreement to the contrary be-
tween a covered entity and the service provider. 
Subtitle C—Rights Relating to Data 
Minimization, 
Constraints 
on 
Distribution, and Data Integrity 
SEC. 131. DATA MINIMIZATION. 
Each covered entity shall— 
(1) collect only as much covered information re-
lating to an individual as is reasonably necessary— 
(A) to process or enforce a transaction or 
deliver a service requested by such individual; 
(B) for the covered entity to provide a 
transaction or delivering a service requested by 
such individual, such as inventory management, 
financial reporting and accounting, planning, 
product or service improvement or forecasting, 
and customer support and service; 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(C) to prevent or detect fraud or to provide 
for a secure environment; 
(D) to investigate a possible crime; 
(E) to comply with a provision of law; 
(F) for the covered entity to market or ad-
vertise to such individual if the covered infor-
mation used for such marketing or advertising 
was collected directly by the covered entity; or 
(G) for internal operations, including— 
(i) collecting customer satisfaction 
surveys and conducting customer research 
to improve customer service; and 
(ii) collection from an Internet website 
of information about visits and click- 
through rates relating to such website to 
improve— 
(I) website navigation and per-
formance; and 
(II) the customer’s experience; 
(2) retain covered information for only such du-
ration as— 
(A) with respect to the provision of a 
transaction or delivery of a service to an indi-
vidual— 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(i) is necessary to provide such trans-
action or deliver such service to such indi-
vidual; or 
(ii) if such service is ongoing, is rea-
sonable for the ongoing nature of the serv-
ice; or 
(B) is required by a provision of law; 
(3) retain covered information only for the pur-
pose it was collected, or reasonably related purposes; 
and 
(4) exercise reasonable data retention proce-
dures with respect to both the initial collection and 
subsequent retention. 
SEC. 132. CONSTRAINTS ON DISTRIBUTION OF INFORMA-
TION. 
(a) IN GENERAL.—Each covered entity shall— 
(1) require by contract that any third party to 
which it transfers covered information use the infor-
mation only for purposes that are consistent with— 
(A) the provisions of this title; and 
(B) as specified in the contract; 
(2) require by contract that such third party 
may not combine information that the covered entity 
has transferred to it, that relates to an individual, 
and that is not personally identifiable information 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
with other information in order to identify such indi-
vidual, unless the covered entity has obtained the 
opt-in consent of such individual for such combina-
tion and identification; and 
(3) before executing a contract with a third 
party— 
(A) assure through due diligence that the 
third party is a legitimate organization; and 
(B) in the case of a material violation of 
the contract, at a minimum notify the Commis-
sion of such violation. 
(b) TRANSFERS TO UNRELIABLE THIRD PARTIES 
PROHIBITED.—A covered entity may not transfer covered 
information to a third party that the covered entity 
knows— 
(1) has intentionally or willfully violated a con-
tract required by subsection (a); and 
(2) is reasonably likely to violate such contract. 
(c) APPLICATION OF RULES TO THIRD PARTIES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a third party that receives covered infor-
mation from a covered entity shall be subject to the 
provisions of this Act as if it were a covered entity. 
(2) EXEMPTION.—The Commission may, as it 
determines appropriate, exempt classes of third par-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
ties from liability under any provision of subtitle B 
if the Commission finds that— 
(A) such class of third parties cannot rea-
sonably comply with such provision; or 
(B) with respect to covered information re-
lating to individuals that is transferred to such 
class, compliance by such class with such provi-
sion would not sufficiently benefit such individ-
uals. 
SEC. 133. DATA INTEGRITY. 
(a) IN GENERAL.—Each covered entity shall attempt 
to establish and maintain reasonable procedures to ensure 
that personally identifiable information that is covered in-
formation and maintained by the covered entity is accu-
rate in those instances where the covered information 
could be used to deny consumers benefits or cause signifi-
cant harm. 
(b) EXCEPTION.—Subsection (a) shall not apply to 
covered information of an individual maintained by a cov-
ered entity that is provided— 
(1) directly to the covered entity by the indi-
vidual; 
(2) to the covered entity by another entity at 
the request of the individual; 
(3) to prevent or detect fraud; or 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(4) to provide for a secure environment. 
Subtitle D—Right to Notice of 
Breaches of Security 
SEC. 141. DEFINITIONS. 
In this subtitle: 
(1) BREACH OF SECURITY.— 
(A) IN GENERAL.—The term ‘‘breach of 
security’’ means compromise of the security, 
confidentiality, or integrity of, or loss of, data 
in electronic form that results in, or there is a 
reasonable basis to conclude has resulted in, 
unauthorized access to or acquisition of person-
ally identifiable information from a covered en-
tity. 
(B) EXCLUSIONS.—The term ‘‘breach of 
security’’ does not include— 
(i) a good faith acquisition of person-
ally identifiable information by a covered 
entity, or an employee or agent of a cov-
ered entity, if the personally identifiable in-
formation is not subject to further use or 
unauthorized disclosure; 
(ii) any lawfully authorized investiga-
tive, protective, or intelligence activity of a 
law enforcement or an intelligence agency 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
of the United States, a State, or a political 
subdivision of a State; or 
(iii) the release of a public record not 
otherwise subject to confidentiality or non-
disclosure requirements. 
(2) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database, including recordable tapes and other 
mass storage devices. 
(3) DESIGNATED
ENTITY.—The term ‘‘des-
ignated entity’’ means the Federal Government enti-
ty designated by the Secretary of Homeland Security 
under section 143(a). 
(4) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means the unauthorized use of another per-
son’s personally identifiable information for the pur-
pose of engaging in commercial transactions under 
the identity of such other person, including any con-
tact that violates section 1028A of title 18, United 
States Code. 
(5) MAJOR CREDIT REPORTING AGENCY.—The 
term ‘‘major credit reporting agency’’ means a con-
sumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis within the 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
meaning of section 603(p) of the Fair Credit Re-
porting Act (15 U.S.C. 1681a(p)). 
(6) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means a person that provides electronic 
data transmission, routing, intermediate and tran-
sient storage, or connections to its system or net-
work, where the person providing such services does 
not select or modify the content of the electronic 
data, is not the sender or the intended recipient of 
the data, and does not differentiate personally iden-
tifiable information from other information that 
such person transmits, routes, or stores, or for 
which such person provides connections. Any such 
person shall be treated as a service provider under 
this subtitle only to the extent that it is engaged in 
the provision of such transmission, routing, inter-
mediate and transient storage, or connections. 
SEC. 142. NOTICE TO INDIVIDUALS. 
(a) IN GENERAL.—A covered entity that owns or pos-
sesses data in electronic form containing personally identi-
fiable information, following the discovery of a breach of 
security of the system maintained by the covered entity 
that contains such information, shall notify— 
(1) each individual who is a citizen or resident 
of the United States and whose personally identifi-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
able information has been, or is reasonably believed 
to have been, acquired or accessed from the covered 
entity as a result of the breach of security; and 
(2) the Commission, unless the covered entity 
has notified the designated entity under section 143. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD PARTIES.—In the event of a breach 
of security of a system maintained by a third party 
that has been contracted to maintain or process data 
in electronic form containing personally identifiable 
information on behalf of a covered entity who owns 
or possesses such data, the third party shall notify 
the covered entity of the breach of security. 
(2) SERVICE PROVIDERS.—If a service provider 
becomes aware of a breach of security of data in 
electronic form containing personally identifiable in-
formation that is owned or possessed by another cov-
ered entity that connects to or uses a system or net-
work provided by the service provider for the pur-
pose of transmitting, routing, or providing inter-
mediate or transient storage of such data, the serv-
ice provider shall notify of the breach of security 
only the covered entity who initiated such connec-
tion, transmission, routing, or storage if such cov-
ered entity can be reasonably identified. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(3) COORDINATION
OF
NOTIFICATION
WITH 
CREDIT REPORTING AGENCIES.— 
(A) IN GENERAL.—If a covered entity is 
required to provide notification to more than 
5,000 individuals under subsection (a)(1), the 
covered entity also shall notify each major cred-
it reporting agency of the timing and distribu-
tion of the notices, except when the only per-
sonally identifiable information that is the sub-
ject of the breach of security is the individual’s 
first name or initial and last name, or address, 
or phone number, in combination with a credit 
or debit card number, and any required security 
code. 
(B) NOTICE TO CREDIT REPORTING AGEN-
CIES BEFORE INDIVIDUALS.—Such notice shall 
be given to each credit reporting agency without 
unreasonable delay and, if it will not delay no-
tice to the affected individuals, prior to the dis-
tribution of notices to the affected individuals. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay following the discovery by the covered en-
tity of a security breach. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(2) REASONABLE DELAY.— 
(A) IN GENERAL.—Reasonable delay under 
this subsection may include any time necessary 
to determine the scope of the security breach, 
prevent further disclosures, restore the reason-
able integrity of the data system, and provide 
notice to law enforcement when required. 
(B) EXTENSION.— 
(i) IN GENERAL.—Except as provided 
in subsection (d), delay of notification shall 
not exceed 60 days following the discovery 
of the security breach, unless the covered 
entity requests an extension of time and 
the Commission determines in writing that 
additional time is reasonably necessary to 
determine the scope of the security breach, 
prevent further disclosures, restore the rea-
sonable integrity of the data system, or to 
provide notice to the designated entity. 
(ii) APPROVAL OF REQUEST.—If the 
Commission approves the request for delay, 
the covered entity may delay the period for 
notification for additional periods of up to 
30 days. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(3) BURDEN
OF
PRODUCTION.—The covered 
entity, third party, or service provider required to 
provide notice under this title shall, upon the request 
of the Commission provide records or other evidence 
of the notifications required under this subtitle, in-
cluding to the extent applicable, the reasons for any 
delay of notification. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF DIRECT NOTIFICATION.— 
Except as provided in paragraph (2), a covered 
entity shall be in compliance with the notifica-
tion requirement under subsection (a)(1) if— 
(i) the covered entity provides con-
spicuous and clearly identified notifica-
tion— 
(I) in writing; or 
(II) by e-mail or other electronic 
means if— 
(aa) the covered entity’s pri-
mary method of communication 
with the individual is by e-mail or 
such other electronic means; or 
(bb) the individual has con-
sented to receive notification by 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
e-mail or such other electronic 
means and such notification is 
provided in a manner that is con-
sistent with the provisions per-
mitting electronic transmission of 
notices under section 101 of the 
Electronic Signatures in Global 
and National Commerce Act (15 
U.S.C. 7001); and 
(ii) the method of notification selected 
under clause (i) can reasonably be expected 
to reach the intended individual. 
(B) CONTENT
OF
DIRECT
NOTIFICA-
TION.—Each method of notification under sub-
paragraph (A) shall include the following: 
(i) The date, estimated date, or esti-
mated date range of the breach of security. 
(ii) A description of the personally 
identifiable information that was or is rea-
sonably believed to have been acquired or 
accessed as a result of the breach of secu-
rity. 
(iii) A telephone number that an indi-
vidual can use at no cost to the individual 
to contact the covered entity to inquire 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
about the breach of security or the infor-
mation the covered entity maintained 
about that individual. 
(iv) Notice that the individual may be 
entitled to consumer credit reports under 
subsection (e)(1). 
(v) Instructions how an individual can 
request consumer credit reports under sub-
section (e)(1). 
(vi) A telephone number, that an indi-
vidual can use at no cost to the individual, 
and an address to contact each major cred-
it reporting agency. 
(vii) A telephone number, that an in-
dividual can use at no cost to the indi-
vidual, and an Internet website address to 
obtain information regarding identity theft 
from the Commission. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A covered entity re-
quired to provide notification to individuals 
under subsection (a)(1) may provide notifica-
tion under this paragraph instead of paragraph 
(1) of this subsection if— 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(i) notification under paragraph (1) is 
not feasible due to lack of sufficient con-
tact information for the individual required 
to be notified; or 
(ii) the covered entity owns or pos-
sesses data in electronic form containing 
personally identifiable information of fewer 
than 10,000 individuals and direct notifica-
tion is not feasible due to excessive cost to 
the covered entity required to provide such 
notification relative to the resources of 
such covered entity, as determined in ac-
cordance with the regulations issued by the 
Commission under paragraph (3)(A). 
(B) METHOD OF SUBSTITUTE NOTIFICA-
TION.—Notification under this paragraph shall 
include the following: 
(i) Conspicuous and clearly identified 
notification by e-mail to the extent the cov-
ered entity has an e-mail address for an in-
dividual who is entitled to notification 
under subsection (a)(1). 
(ii) Conspicuous and clearly identified 
notification on the Internet website of the 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
covered entity if the covered entity main-
tains an Internet website. 
(iii) Notification to print and to 
broadcast media, including major media in 
metropolitan and rural areas where the in-
dividuals whose personally identifiable in-
formation was acquired or accessed reside. 
(C) CONTENT OF SUBSTITUTE NOTIFICA-
TION.—Each method of notification under this 
paragraph shall include the following: 
(i) The date, estimated date, or esti-
mated date range of the breach of security. 
(ii) A description of the types of per-
sonally identifiable information that were 
or are reasonably believed to have been ac-
quired or accessed as a result of the breach 
of security. 
(iii) Notice that an individual may be 
entitled to consumer credit reports under 
subsection (e)(1). 
(iv) Instructions how an individual 
can request consumer credit reports under 
subsection (e)(1). 
(v) A telephone number that an indi-
vidual can use at no cost to the individual 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
to learn whether the individual’s personally 
identifiable information is included in the 
breach of security. 
(vi) A telephone number, that an indi-
vidual can use at no cost to the individual, 
and an address to contact each major cred-
it reporting agency. 
(vii) A telephone number, that an in-
dividual can use at no cost to the indi-
vidual, and an Internet website address to 
obtain information from the Commission 
regarding identity theft. 
(3) REGULATIONS AND GUIDANCE.— 
(A) 
REGULATIONS
CONCERNING
SUB-
STITUTE NOTIFICATION.— 
(i) IN GENERAL.—Not later than 1 
year after the date of the enactment of this 
Act, the Commission shall prescribe cri-
teria for determining circumstances under 
which notification may be provided under 
paragraph (2), including criteria for deter-
mining 
whether 
providing 
notification 
under paragraph (1) is not feasible due to 
excessive costs to the covered entity re-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
quired to provide such notification relative 
to the resources of such covered entity. 
(ii) 
OTHER
CIRCUMSTANCES.—The 
regulations required by clause (i) may also 
identify other circumstances in which noti-
fication under paragraph (2) would be ap-
propriate, including circumstances under 
which the cost of providing direct notifica-
tion exceeds the benefits to individuals. 
(B) GUIDANCE.— 
(i) IN GENERAL.—The Commission, in 
consultation with the Administrator of the 
Small Business Administration, shall pub-
lish and otherwise make available general 
guidance with respect to compliance with 
this subsection. 
(ii) CONTENTS.—The guidance re-
quired by clause (i) shall include the fol-
lowing: 
(I) A description of written or e- 
mail notification that complies with 
paragraph (1). 
(II) Guidance on the content of 
notification under paragraph (2), in-
cluding the extent of notification to 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
print and broadcast media that com-
plies with subparagraph (B)(iii) of 
such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—Subject to the provisions of 
this subsection, not later than 60 days after the date 
of a request by an individual who received notifica-
tion under subsection (a)(1) and quarterly thereafter 
for 2 years, a covered entity required to provide no-
tification under such subsection to such individual 
shall provide, or arrange for the provision of, to such 
individual at no cost to such individual, consumer 
credit reports from at least 1 major credit reporting 
agency. 
(2) LIMITATION.—Paragraph (1) shall not 
apply if the only personally identifiable information 
that is the subject of the breach of security is the 
individual’s first name or initial and last name, or 
address, or phone number, in combination with a 
credit or debit card number, and any required secu-
rity code. 
(3) RULEMAKING.—Not later than 1 year after 
the date of the enactment of this Act, the Commis-
sion shall prescribe the following: 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(A) Criteria for determining the cir-
cumstances under which a covered entity re-
quired to provide notification under subsection 
(a)(1) must provide or arrange for the provision 
of free consumer credit reports under this sub-
section. 
(B) A simple process under which a cov-
ered entity that is a small business concern or 
small nonprofit organization may request a full 
or a partial waiver or a modified or an alter-
native means of complying with this subsection 
if providing free consumer credit reports is not 
feasible due to excessive costs relative to the re-
sources of such covered entity and relative to 
the level of harm, to affected individuals, 
caused by the breach of security. 
(4) DEFINITIONS.—In this subsection: 
(A) SMALL
BUSINESS
CONCERN.—The 
term ‘‘small business concern’’ has the meaning 
given such term under section 3 of the Small 
Business Act (15 U.S.C. 632). 
(B) SMALL NONPROFIT ORGANIZATION.— 
The term ‘‘small nonprofit organization’’ has 
the meaning the Commission shall give such 
term for purposes of this subsection. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(f) DELAY OF NOTIFICATION AUTHORIZED FOR NA-
TIONAL
SECURITY
AND
LAW
ENFORCEMENT
PUR-
POSES.— 
(1) IN GENERAL.—If the United States Secret 
Service or the Federal Bureau of Investigation de-
termines that notification under this section would 
impede a criminal investigation or a national secu-
rity activity, such notification shall be delayed upon 
written notice from the United States Secret Service 
or the Federal Bureau of Investigation to the cov-
ered entity that experienced the breach of security. 
The notification from the United States Secret Serv-
ice or the Federal Bureau of Investigation shall 
specify the period of delay requested for national se-
curity or law enforcement purposes. 
(2) SUBSEQUENT DELAY OF NOTIFICATION.— 
(A) IN GENERAL.—If the notification re-
quired under subsection (a)(1) is delayed pursu-
ant to paragraph (1), a covered entity shall give 
notice not more than 30 days after the day 
such law enforcement or national security delay 
was invoked unless a Federal law enforcement 
or intelligence agency provides written notifica-
tion that further delay is necessary. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(B) WRITTEN
JUSTIFICATION
REQUIRE-
MENTS.— 
(i) UNITED
STATES
SECRET
SERV-
ICE.—If the United States Secret Service 
instructs a covered entity to delay notifica-
tion under this section beyond the 30-day 
period set forth in subparagraph (A) (re-
ferred to in this clause as ‘‘subsequent 
delay’’), the United States Secret Service 
shall submit written justification for the 
subsequent delay to the Secretary of 
Homeland Security before the subsequent 
delay begins. 
(ii) FEDERAL BUREAU OF INVESTIGA-
TION.—If the Federal Bureau of Investiga-
tion instructs a covered entity to delay no-
tification under this section beyond the 30- 
day period set forth in subparagraph (A) 
(referred to in this clause as ‘‘subsequent 
delay’’), the Federal Bureau of Investiga-
tion shall submit written justification for 
the subsequent delay to the Attorney Gen-
eral before the subsequent delay begins. 
(3) LAW ENFORCEMENT IMMUNITY.—No cause 
of action shall lie in any court against any Federal 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
agency for acts relating to the delay of notification 
for national security or law enforcement purposes 
under this subtitle. 
(g) GENERAL EXEMPTION.— 
(1) IN GENERAL.—A covered entity shall be ex-
empt from the requirements under this section if, 
following a breach of security, the covered entity 
reasonably concludes that there is no reasonable risk 
of identity theft, fraud, or other unlawful conduct. 
(2) FTC GUIDANCE.—Not later than 1 year 
after the date of the enactment of this Act, the 
Commission, after consultation with the Director of 
the National Institute of Standards and Technology, 
shall issue guidance regarding the application of the 
exemption under paragraph (1). 
(h) EXEMPTIONS
FOR NATIONAL SECURITY
AND 
LAW ENFORCEMENT PURPOSES.— 
(1) IN GENERAL.—A covered entity shall be ex-
empt from the notice requirements under this sec-
tion if— 
(A) a determination is made— 
(i) by the United States Secret Serv-
ice or the Federal Bureau of Investigation 
that notification of the breach of security 
could be reasonably expected to reveal sen-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
sitive sources and methods or similarly im-
pede the ability of the Government to con-
duct law enforcement or intelligence inves-
tigations; or 
(ii) by the Federal Bureau of Inves-
tigation that notification of the breach of 
security could be reasonably expected to 
cause damage to the national security; and 
(B) the United States Secret Service or the 
Federal Bureau of Investigation, as the case 
may be, provides written notice of its deter-
mination under subparagraph (A) to the cov-
ered entity. 
(2) UNITED STATES SECRET SERVICE.—If the 
United States Secret Service invokes an exemption 
under paragraph (1), the United States Secret Serv-
ice shall submit written justification for invoking the 
exemption to the Secretary of Homeland Security 
before the exemption is invoked. 
(3) FEDERAL BUREAU OF INVESTIGATION.—If 
the Federal Bureau of Investigation invokes an ex-
emption under paragraph (1), the Federal Bureau of 
Investigation shall submit written justification for 
invoking the exemption to the Attorney General be-
fore the exemption is invoked. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(4) IMMUNITY.—No cause of action shall lie in 
any court against any Federal agency for acts relat-
ing to the exemption from notification for national 
security or law enforcement purposes under this sub-
title. 
(5) REPORTS.—Not later than 540 days after 
the date of the enactment of this Act, and upon re-
quest by Congress thereafter, the United States Se-
cret Service and the Federal Bureau of Investigation 
shall submit to Congress a report on the number 
and nature of breaches of security subject to the ex-
emptions for national security and law enforcement 
purposes under this subsection. 
(i) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
(1) IN GENERAL.—A covered entity shall be ex-
empt from the notice requirements under this sec-
tion if the covered entity utilizes or participates in 
a security program that— 
(A) effectively blocks the use of the person-
ally identifiable information to initiate an unau-
thorized financial transaction before it is 
charged to the account of the individual; and 
(B) provides notice to each affected indi-
vidual after a breach of security that resulted in 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
attempted fraud or an attempted unauthorized 
transaction. 
(2) LIMITATIONS.—An exemption under para-
graph (1) shall not apply if— 
(A) the breach of security includes person-
ally identifiable information, other than a credit 
card number or credit card security code, of 
any type; or 
(B) the breach of security includes both 
the individual’s credit card number and the in-
dividual’s first and last name. 
(j) FINANCIAL INSTITUTIONS REGULATED BY FED-
ERAL FUNCTIONAL REGULATORS.— 
(1) IN GENERAL.—A covered financial institu-
tion shall be deemed in compliance with this section 
if— 
(A) the Federal functional regulator with 
jurisdiction over the covered financial institu-
tion has issued a standard by regulation or 
guideline under title V of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6801 et seq.) that— 
(i) requires financial institutions with-
in its jurisdiction to provide notification to 
individuals following a breach of security; 
and 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(ii) provides protections substantially 
similar to, or greater than, those required 
under this Act; and 
(B) the covered financial institution is in 
compliance with the standard under subpara-
graph (A). 
(2) DEFINITIONS.—In this subsection: 
(A) COVERED FINANCIAL INSTITUTION.— 
The term ‘‘covered financial institution’’ means 
a financial institution that is subject to— 
(i) the data security requirements of 
the Gramm-Leach-Bliley Act (15 U.S.C. 
6801 et seq.); 
(ii) any implementing standard issued 
by regulation or guideline issued under 
that Act; and 
(iii) the jurisdiction of a Federal func-
tional regulator under that Act. 
(B) FEDERAL FUNCTIONAL REGULATOR.— 
The term ‘‘Federal functional regulator’’ has 
the meaning given the term in section 509 of 
the Gramm-Leach-Bliley Act (15 U.S.C. 6809). 
(C) FINANCIAL
INSTITUTION.—The term 
‘‘financial institution’’ has the meaning given 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
the term in section 509 of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6809). 
(k) EXEMPTION; HEALTH PRIVACY.— 
(1) COVERED ENTITY OR BUSINESS ASSOCIATE 
UNDER HITECH ACT.—To the extent that a covered 
entity under this section acts as a covered entity or 
a business associate under section 13402 of the 
Health Information Technology for Economic and 
Clinical Health Act (42 U.S.C. 17932), has the obli-
gation to provide notification to individuals following 
a breach of security under that Act or its imple-
menting regulations, and is in compliance with that 
obligation, the covered entity shall be deemed in 
compliance with this section. 
(2) ENTITY SUBJECT TO HITECH ACT.—To the 
extent that a covered entity under this section acts 
as a vendor of personal health records, a third party 
service provider, or other entity subject to section 
13407 of the Health Information Technology for Ec-
onomical and Clinical Health Act (42 U.S.C. 
17937), has the obligation to provide notification to 
individuals following a breach of security under that 
Act or its implementing regulations, and is in com-
pliance with that obligation, the covered entity shall 
be deemed in compliance with this section. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(3) LIMITATION
OF
STATUTORY
CONSTRUC-
TION.—Nothing in this subtitle may be construed in 
any way to give effect to the sunset provision under 
section 13407(g)(2) of the Health Information Tech-
nology for Economic and Clinical Health Act (42 
U.S.C. 17937(g)(2)) or to otherwise limit or affect 
the applicability, under section 13407 of that Act, of 
the requirement to provide notification to individuals 
following a breach of security for vendors of personal 
health records and each entity described in clause 
(ii), (iii), or (iv) of section 13424(b)(1)(A) of that 
Act (42 U.S.C. 17953(b)(1)(A)). 
(l) INTERNET WEBSITE NOTICE OF FEDERAL TRADE 
COMMISSION.—If the Commission, upon receiving notifi-
cation of any breach of security that is reported to the 
Commission, finds that notification of the breach of secu-
rity via the Commission’s Internet website would be in the 
public interest or for the protection of consumers, the 
Commission shall place such a notice in a clear and con-
spicuous location on its Internet website. 
(m) FTC STUDY ON NOTIFICATION IN LANGUAGES 
IN ADDITION TO ENGLISH.—Not later than 1 year after 
the date of the enactment of this Act, the Commission 
shall conduct a study on the feasibility and advisability 
of requiring notification provided pursuant to subsection 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(d)(1) to be provided in a language in addition to English 
to individuals known to speak only such other language. 
SEC. 143. NOTICE TO LAW ENFORCEMENT. 
(a) DESIGNATION OF GOVERNMENT ENTITY TO RE-
CEIVE NOTICE.—Not later than 60 days after the date 
of the enactment of this Act, the Secretary of Homeland 
Security shall designate a Federal Government entity to 
receive notice under this section. 
(b) NOTICE TO DESIGNATED ENTITY.—A covered en-
tity shall notify the designated entity of a breach of secu-
rity if— 
(1) the number of individuals whose personally 
identifiable information was, or is reasonably be-
lieved to have been, acquired or accessed as a result 
of the breach of security exceeds 10,000; 
(2) the breach of security involves a database, 
networked or integrated databases, or other data 
system containing the personally identifiable infor-
mation of more than 1,000,000 individuals; 
(3) the breach of security involves databases 
owned by the Federal Government; or 
(4) the breach of security involves primarily 
personally identifiable information of individuals 
known to the covered entity to be employees or con-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
tractors of the Federal Government involved in na-
tional security or law enforcement. 
(c) CONTENT OF NOTICES.— 
(1) IN
GENERAL.—Each notice under sub-
section (b) shall contain the following: 
(A) The date, estimated date, or estimated 
date range of the breach of security. 
(B) A description of the nature of the 
breach of security. 
(C) A description of each type of person-
ally identifiable information that was or is rea-
sonably believed to have been acquired or 
accessed as a result of the breach of security. 
(D) A statement of each paragraph under 
subsection (b) that applies to the breach of se-
curity. 
(2) CONSTRUCTION.—Nothing in this section 
shall be construed to require a covered entity to re-
veal specific or identifying information about an in-
dividual as part of the notice under paragraph (1). 
(d) NOTICE
BY DESIGNATED ENTITY.—The des-
ignated entity shall promptly provide each notice it re-
ceives under subsection (b) to the following: 
(1) The United States Secret Service. 
(2) The Federal Bureau of Investigation. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(3) The Commission. 
(4) The United States Postal Inspection Serv-
ice, if the breach of security involves mail fraud. 
(5) The attorney general of each State affected 
by the breach of security. 
(6) Such other Federal agencies as the des-
ignated entity considers appropriate for law enforce-
ment, national security, or data security purposes. 
(e) TIMING OF NOTICES.—Notice under this section 
shall be delivered as follows: 
(1) Notice under subsection (b) shall be deliv-
ered as promptly as possible, but— 
(A) not less than 3 business days before 
notification to an individual section 142(a)(1); 
and 
(B) not later than 10 days after the date 
of discovery of the events requiring notice. 
(2) Notice under subsection (d) shall be deliv-
ered as promptly as possible, but not later than 1 
business day after the date that the designated enti-
ty receives notice of a breach of security from a cov-
ered entity. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
Subtitle E—Enforcement 
SEC. 151. GENERAL APPLICATION. 
The requirements of this title shall apply to any per-
son who— 
(1) collects, uses, transfers, or stores covered 
information concerning more than 5,000 individuals 
during any consecutive 12-month period; and 
(2) is— 
(A) a person over which the Commission 
has authority pursuant to section 5(a)(2) of the 
Federal Trade Commission Act (15 U.S.C. 
45(a)(2)); 
(B) a common carrier subject to the Com-
munications Act of 1934 (47 U.S.C. 151 et 
seq.), notwithstanding the definition of the term 
‘‘Acts to regulate commerce’’ in section 4 of the 
Federal Trade Commission Act (15 U.S.C. 44) 
and the exception provided by section 5(a)(2) of 
the Federal Trade Commission Act (15 U.S.C. 
45(a)(2)) for such carriers; or 
(C) a nonprofit organization, including any 
organization described in section 501(c) of the 
Internal Revenue Code of 1986 that is exempt 
from taxation under section 501(a) of such 
Code, notwithstanding the definition of the 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
term ‘‘Acts to regulate commerce’’ in section 4 
of the Federal Trade Commission Act (15 
U.S.C. 44) and the exception provided by sec-
tion 5(a)(2) of the Federal Trade Commission 
Act (15 U.S.C. 45(a)(2)) for such organiza-
tions. 
SEC. 152. ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A reckless or repetitive violation of a provision of this title, 
except section 143, shall be treated as an unfair or decep-
tive act or practice in violation of a regulation under sec-
tion 18(a)(1)(B) of the Federal Trade Commission Act 
(15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive 
acts or practices. 
(b) POWERS OF COMMISSION.— 
(1) IN GENERAL.—Except as provided in para-
graph (3), the Commission shall enforce this title, 
except section 143, in the same manner, by the same 
means, and with the same jurisdiction, powers, and 
duties as though all applicable terms and provisions 
of the Federal Trade Commission Act (15 U.S.C. 41 
et seq.) were incorporated into and made a part of 
this title. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(2) PRIVILEGES AND IMMUNITIES.—Except as 
provided in paragraph (3), any person who violates 
a provision of this title, except section 143, shall be 
subject to the penalties and entitled to the privileges 
and immunities provided in the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.). 
(3) COMMON CARRIERS AND NONPROFIT ORGA-
NIZATIONS.—The Commission shall enforce this 
title, except section 143, with respect to common 
carriers and nonprofit organizations described in 
section 151 to the extent necessary to effectuate the 
purposes of this title as if such carriers and non-
profit organizations were persons over which the 
Commission has authority pursuant to section 
5(a)(2) of the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)). 
(c) RULEMAKING AUTHORITY.— 
(1) LIMITATION.—In promulgating rules under 
this title, the Commission may not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
(2) ADMINISTRATIVE PROCEDURE.—The Com-
mission shall promulgate regulations under this title 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
in accordance with section 553 of title 5, United 
States Code. 
(d) RULE OF CONSTRUCTION.—Nothing in this title 
shall be construed to limit the authority of the Commission 
under any other provision of law. 
SEC. 153. ENFORCEMENT BY ATTORNEY GENERAL. 
(a) IN GENERAL.—The Attorney General may bring 
a civil action in the appropriate United States district 
court against any covered entity that engages in conduct 
constituting a violation of section 143. 
(b) PENALTIES.— 
(1) IN GENERAL.—Upon proof of such conduct 
by a preponderance of the evidence, a covered entity 
shall be subject to a civil penalty of not more than 
$1,000 per individual whose personally identifiable 
information was or is reasonably believed to have 
been accessed or acquired as a result of the breach 
of security that is the basis of the violation, up to 
a maximum of $100,000 per day while such violation 
persists. 
(2) LIMITATIONS.—The total amount of the 
civil penalty assessed under this subsection against 
a covered entity for acts or omissions relating to a 
single 
breach 
of 
security 
shall 
not 
exceed 
$3,000,000, unless the conduct constituting a viola-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
tion of subtitle D was reckless or repeated, in which 
case an additional civil penalty of up to $3,000,000 
may be imposed. 
(3) ADJUSTMENT FOR INFLATION.—Beginning 
on the date that the Consumer Price Index is first 
published by the Bureau of Labor Statistics that is 
after 1 year after the date of the enactment of this 
Act, and each year thereafter, the amounts specified 
in paragraphs (1) and (2) shall be increased by the 
percentage increase in the Consumer Price Index 
published on that date from the Consumer Price 
Index published the previous year. 
(c) INJUNCTIVE ACTIONS.—If it appears that a cov-
ered entity has engaged, or is engaged, in any act or prac-
tice that constitutes a violation of subtitle D, the Attorney 
General may petition an appropriate United States district 
court for an order enjoining such practice or enforcing 
compliance with such subtitle. 
(d) ISSUANCE OF ORDER.—A court may issue such 
an order under paragraph (c) if it finds that the conduct 
in question constitutes a violation of subtitle D. 
SEC. 154. ENFORCEMENT BY STATES. 
(a) CIVIL ACTION.—In any case in which the attor-
ney general of a State has reason to believe that an inter-
est of the residents of that State has been or is adversely 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
affected by a covered entity who violates any part of this 
title in a manner that results in economic or physical harm 
to an individual or engages in a pattern or practice that 
violates any part of this title other than section 143, the 
attorney general may, as parens patriae, bring a civil ac-
tion on behalf of the residents of the State in an appro-
priate district court of the United States— 
(1) to enjoin further violation of this title or a 
regulation promulgated under this title by the de-
fendant; 
(2) to compel compliance with this title or a 
regulation promulgated under this title; or 
(3) for violations of this title or a regulation 
promulgated under this title to obtain civil penalties 
in the amount determined under section title. 
(b) RIGHTS OF FEDERAL TRADE COMMISSION.— 
(1) NOTICE
TO
FEDERAL
TRADE
COMMIS-
SION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (C), the attorney general of a 
State shall notify the Commission in writing of 
any civil action under subsection (b), prior to 
initiating such civil action. 
(B) CONTENTS.—The notice required by 
subparagraph (A) shall include a copy of the 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
complaint to be filed to initiate such civil ac-
tion. 
(C) EXCEPTION.—If it is not feasible for 
the attorney general of a State to provide the 
notice required by subparagraph (A), the State 
shall provide notice immediately upon insti-
tuting a civil action under subsection (b). 
(2) INTERVENTION BY FEDERAL TRADE COM-
MISSION.—Upon receiving notice required by para-
graph (1) with respect to a civil action, the Commis-
sion may— 
(A) intervene in such action; and 
(B) upon intervening— 
(i) be heard on all matters arising in 
such civil action; and 
(ii) file petitions for appeal of a deci-
sion in such action. 
(c) PREEMPTIVE ACTION BY FEDERAL TRADE COM-
MISSION.—If the Commission institutes a civil action for 
violation of this title or a regulation promulgated under 
this title, no attorney general of a State may bring a civil 
action under subsection (a) against any defendant named 
in the complaint of the Commission for violation of this 
title or a regulation promulgated under this title that is 
alleged in such complaint. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
bile application directed to minors, or an operator having 
actual knowledge that personal information being collected 
is from a minor, to collect personal information from a 
minor unless such operator has adopted and complies with 
a Digital Marketing Bill of Rights for Teens that is con-
sistent with the Fair Information Practices Principles de-
scribed in subsection (b). 
(b) FAIR INFORMATION PRACTICES PRINCIPLES.— 
The Fair Information Practices Principles described in 
this subsection are the following: 
(1) COLLECTION LIMITATION PRINCIPLE.—Ex-
cept as provided in paragraph (3), personal informa-
tion should be collected from a minor only when col-
lection of the personal information is— 
(A) consistent with the context of a par-
ticular transaction or service or the relationship 
of the minor with the operator, including collec-
tion necessary to fulfill a transaction or provide 
a service requested by the minor; or 
(B) required or specifically authorized by 
law. 
(2) DATA QUALITY PRINCIPLE.—The personal 
information of a minor should be accurate, complete, 
and kept up-to-date to the extent necessary to fulfill 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS