I 
114TH CONGRESS 
1ST SESSION H. R. 2977 
To ensure the privacy and security of sensitive personal information, to 
prevent and mitigate identity theft, to provide notice of security breaches 
involving sensitive personal information, and to enhance law enforcement 
assistance and other protections against security breaches, fraudulent 
access, and misuse of personal information. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 8, 2015 
Mr. CICILLINE (for himself, Mr. NADLER, Mr. CONYERS, Mr. TAKANO, Ms. 
JUDY CHU of California, Ms. JACKSON LEE, Mr. CARSON of Indiana, Mr. 
CAPUANO, Mr. JOHNSON of Georgia, Mr. GARAMENDI, Mr. DESAULNIER, 
and Mr. GRAYSON) introduced the following bill; which was referred to 
the Committee on the Judiciary, and in addition to the Committees on 
Energy and Commerce, Financial Services, and the Budget, for a period 
to be subsequently determined by the Speaker, in each case for consider-
ation of such provisions as fall within the jurisdiction of the committee 
concerned 
A BILL 
To ensure the privacy and security of sensitive personal 
information, to prevent and mitigate identity theft, to 
provide notice of security breaches involving sensitive 
personal information, and to enhance law enforcement 
assistance 
and 
other 
protections 
against 
security 
breaches, fraudulent access, and misuse of personal infor-
mation. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Consumer Privacy Protection Act of 2015’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Findings. 
Sec. 3. Definitions. 
TITLE I—PUNISHMENT FOR CONCEALMENT OF SECURITY 
BREACHES AND TOOLS TO COMBAT CYBERCRIME 
Sec. 101. Concealment of security breaches involving sensitive personally identi-
fiable information. 
Sec. 102. Reporting of certain cybercrimes. 
Sec. 103. Authority to shut down botnets. 
Sec. 104. Deterring the development and sale of computer and cell phone spy-
ing devices. 
TITLE II—CONSUMER PRIVACY AND SECURITY OF SENSITIVE 
PERSONALLY IDENTIFIABLE INFORMATION 
Subtitle A—Consumer Privacy and Data Security Program 
Sec. 201. Purpose and applicability of consumer privacy and data security pro-
gram. 
Sec. 202. Requirements for consumer privacy and data security program. 
Sec. 203. Federal enforcement. 
Sec. 204. Enforcement by State attorneys general. 
Sec. 205. Relation to other laws. 
Subtitle B—Security Breach Notification 
Sec. 211. Notice to individuals. 
Sec. 212. Exemptions. 
Sec. 213. Methods of notice. 
Sec. 214. Content of notification. 
Sec. 215. Coordination of notification with credit reporting agencies. 
Sec. 216. Notice to the Federal Trade Commission. 
Sec. 217. Notice to law enforcement. 
Sec. 218. Federal enforcement. 
Sec. 219. Enforcement by State attorneys general. 
Sec. 220. Effect on Federal and State law. 
Sec. 221. Reporting on exemptions. 
Sec. 222. Effective date. 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
TITLE III—COMPLIANCE WITH STATUTORY PAY-AS-YOU-GO ACT 
Sec. 301. Budget compliance. 
SEC. 2. FINDINGS. 
Congress finds that— 
(1) databases of sensitive personally identifiable 
information are increasingly prime targets of hack-
ers, identity thieves, rogue employees, and other 
criminals, including organized and sophisticated 
criminal operations; 
(2) security breaches caused by such criminal 
acts are a serious threat to consumer privacy, con-
sumer confidence, homeland security, national secu-
rity, e-commerce, and economic stability; 
(3) misuse of sensitive personally identifiable 
information has the potential to cause serious or ir-
reparable harm to an individual’s livelihood, privacy, 
and liberty and undermine efficient and effective 
business and government operations; 
(4) identity theft is a serious threat to the Na-
tion’s economic stability, national security, homeland 
security, cybersecurity, the development of e-com-
merce, and the privacy rights of Americans; 
(5) it is important for business entities that 
own, use, store, or license sensitive personally identi-
fiable information to adopt reasonable policies and 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
procedures to help ensure the security and privacy of 
sensitive personally identifiable information; and 
(6) individuals whose personal information has 
been compromised or who have been victims of iden-
tity theft should receive the necessary information 
and assistance to mitigate any potential damage. 
SEC. 3. DEFINITIONS. 
In this Act, the following definitions shall apply: 
(1) AFFILIATE.—The term ‘‘affiliate’’ means 
persons related by common ownership or by cor-
porate control. 
(2) AGENCY.—The term ‘‘agency’’ has the same 
meaning given such term in section 551 of title 5, 
United States Code. 
(3) BUSINESS
ENTITY.—The term ‘‘business 
entity’’ means any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated as-
sociation, or venture established to make a profit, or 
a nonprofit organization. 
(4) CONSUMER PRIVACY AND DATA SECURITY 
PROGRAM.—The term ‘‘consumer privacy and data 
security program’’ means the program described in 
section 202(a). 
(5) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means any business entity, other than a service 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
provider, that collects, uses, accesses, transmits, 
stores, or disposes of sensitive personally identifiable 
information. 
(6) DESIGNATED
ENTITY.—The term ‘‘des-
ignated entity’’ means the Federal Government enti-
ty designated by the Secretary of Homeland Security 
under section 217(a). 
(7) ENCRYPTION.—The term ‘‘encryption’’— 
(A) means the protection of data in elec-
tronic form, in storage or in transit, using an 
encryption technology that has been generally 
accepted by experts in the field of information 
security that renders such data indecipherable 
in the absence of associated cryptographic keys 
necessary to enable decryption of such data; 
and 
(B) includes appropriate management and 
safeguards of such cryptographic keys so as to 
protect the integrity of the encryption. 
(8) IDENTITY
THEFT.—The term ‘‘identity 
theft’’ means a violation of section 1028(a)(7) of 
title 18, United States Code. 
(9) SECURITY BREACH.— 
(A) IN
GENERAL.—The term ‘‘security 
breach’’ means compromise of the privacy or se-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
curity of computerized data that results in, or 
that there is a reasonable basis to conclude has 
resulted in, unauthorized access to or acquisi-
tion of sensitive personally identifiable informa-
tion. 
(B) 
EXCLUSION.—The 
term 
‘‘security 
breach’’ does not include— 
(i) a good faith access or acquisition 
of sensitive personally identifiable informa-
tion by a business entity, or an employee 
or agent of a business entity, if the sen-
sitive personally identifiable information is 
not subject to further unauthorized disclo-
sure; 
(ii) the release of a public record not 
otherwise subject to confidentiality or non-
disclosure requirements; or 
(iii) any lawfully authorized investiga-
tive, protective, or intelligence activity of a 
law enforcement or intelligence agency of 
the United States, a State, or a political 
subdivision of a State. 
(10) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means any information or com-
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
pilation of information, in electronic or digital form 
that includes the following: 
(A) A non-truncated social security num-
ber, a driver’s license number, passport num-
ber, or alien registration number or other gov-
ernment-issued unique identification number. 
(B) A financial account number or credit 
or debit card number in combination with any 
security code, access code, or password if re-
quired for an individual to obtain credit, with-
draw funds, or engage in financial transactions. 
(C) A unique electronic account identifier, 
including an online user name or email address, 
in combination with any security code, access 
code, password, or security question and an-
swer, if required for an individual to obtain 
money, goods, services, access to digital photo-
graphs, digital videos or electronic communica-
tions, or any other thing of value. 
(D) Unique biometric data, such as 
faceprint, fingerprint, voice print, a retina or 
iris image, or any other unique physical rep-
resentation. 
(E) An individual’s first and last name or 
first initial and last name in combination with 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS
any information that relates to the individual’s 
past, present, or future physical or mental 
health or condition, or to the provision of health 
care to or diagnosis of the individual, including 
health insurance information such as a health 
insurance policy number or subscriber identi-
fication number, or any information in an indi-
vidual’s health insurance application and claims 
history. 
(F) Information about an individual’s geo-
graphic location generated by or derived from 
the operation or use of an electronic commu-
nications device that is sufficient to identify the 
street and name of the city or town in which 
the device is located, excluding telephone num-
bers or network or Internet protocol addresses. 
(G) 
Password-protected 
digital 
photo-
graphs and digital videos not otherwise avail-
able to the public. 
(11) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means a business entity that provides elec-
tronic data transmission, routing, intermediate and 
transient storage, or connections to its system or 
network, where the business entity providing such 
services does not select or modify the content of the 
VerDate Sep 11 2014 
01:21 Jul 10, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2977.IH
H2977
emcdonald on DSK67QTVN1PROD with BILLS