I 114th CONGRESS 2d Session H. R. 6032 IN THE HOUSE OF REPRESENTATIVES September 14, 2016 Mr. Perlmutter introduced the following bill; which was referred to the Committee on Ways and Means A BILL To amend the Internal Revenue Code of 1986 to provide a tax credit for purchase of data breach insurance.

1. Short title This Act may be cited as the Data Breach Insurance Act . 2. Credits for purchase of data breach insurance (a) In general Subpart D of part IV of subchapter A of chapter 1 of the Internal Revenue Code of 1986 (relating to business related credits) is amended by adding at the end the following new section: 45S. Data breach insurance (a) In general For purposes of section 38, the data breach insurance credit determined under this section for the taxable year is an amount equal to 15 percent of the aggregate premiums paid or incurred by the taxpayer during such taxable year for qualified data breach insurance. (b) Qualified data breach insurance (1) In general For purposes of this section, the term qualified data breach insurance means coverage provided by an insurance company for expenses or losses in connection with the theft, loss, disclosure, inaccessibility, or manipulation, of data. (2) Cybersecurity framework requirement Such term shall not include coverage for any period unless the taxpayer has adopted, and is in compliance with, one of the following with respect to such period: (A) Version 1.0 of the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology as in effect on February 12, 2014, or subsequent versions or iterations. (B) Any similar standard specified by the Secretary (after consultation with the Secretary of Homeland Security and the Secretary of Commerce) for purposes of this paragraph. (3) Insurance company The term insurance company means any corporation subject to tax under subchapter L (or which would be so subject if such corporation were a domestic corporation). (4) Treatment of insurance covering more than data In the case of coverage under which amounts are payable for other than expenses or losses described in paragraph (1)— (A) no amount shall be treated as premiums for qualified data breach insurance unless the charge for such insurance is either separately stated in the contract, or furnished to the policyholder by the insurance company in a separate statement, (B) the amount taken into account as the premium paid or incurred for such insurance shall not exceed such charge, and (C) no amount shall be treated as paid or incurred for such insurance if the amount specified in the contract (or furnished to the policyholder by the insurance company in a separate statement) as the charge for such insurance is unreasonably large in relation to the total charges under the contract. (c) Premiums must be trade or business expense Premiums shall be taken into account under subsection (a) only if such premiums are paid or incurred in the ordinary course of the taxpayer’s trade or business. (d) Termination No credit shall be determined under this section for any taxable year beginning after the date which is 5 years after the date of the enactment of this section. . (b) Conforming amendments (1) Section 38(b) of such Code is amended by striking plus at the end of paragraph (35), by striking the period at the end of paragraph (36), and inserting , plus , and by adding at the end the following new paragraph: (37) the data breach insurance credit determined under section 45S. . (2) The table of sections for subpart D of part IV of subchapter A of chapter 1 of such Code is amended by adding at the end the following new item: Sec. 45S. Data breach insurance. . (c) Effective date The amendments made by this section shall apply to taxable years beginning after the date of the enactment of this Act.