,i  #aacth ,,congress  #ast ,session    
,h4 ,r4 #aaba  ,,in ,,the ,,house ,,of  
,,representatives  ,march #ac1 #bjac    
,mr4 ,conyers 7for himself1 ,mr4 ,scott 
of ,virginia1 and ,mr4 ,johnson of      
,georgia7 introduced the following bill2
 which was referred to the ,committee on
 the ,judiciary  ,a ,,bill  ,to protect 
cyber privacy1 and for other purposes4  
#a4 ,short title ,this ,act may be cited
 as the ,cyber ,privacy ,fortification  
,act of #bjac4  ,i ,data ,breach        
,notification  #aja4 ,failure to provide
 notice of security breaches involving  
sensitive personally identifiable       
information  7a7 ,in general ,chapter   
#dg of title #ah1 ,united ,states ,code1
 is amended by adding at the end the    
following3  #ajdj4 ,failure to provide  
notice of security breaches involving   
sensitive personally identifiable       
information  7a7 ,whoever1 having a     
covered obligation to provide notice of 
a security breach involving sensitive   
personally identifiable information1    

knowingly fails to do so1 shall be fined
 under this title or imprisoned not more
 than #e years1 or both4  7b7 ,as used  
in this section--  7#a7 the term covered
 obligation1 with respect to providing  
notice of a security breach1 means an   
obligation under ,federal law or1 if the
 breach is in or affects interstate or  
foreign commerce1 under ,state law2     
7#b7 the term sensitive personally      
identifiable information means any      
electronic or digital information that  
includes--  7,a7 an individual's first  
and last name1 or first initial and last
 name1 or address or phone number in    
combination with any one of the         
following data elements where the data  
elements are not protected by a         
technology protection measure that      
renders the data element                
indecipherable--  7i7 a nontruncated    
social security number1 driver's license
 number1 state resident identification  
number1 passport number1 or alien       
registration number2  7ii7 both--  7,i7 

mother's maiden name1 if identified as  
such2 and  7,,ii7 month1 day1 and year  
of birth2 and  7iii7 unique biometric   
data such as a fingerprint1 voice print1
 a retina or iris image2 or  7,b7 a     
financial account number or credit or   
debit card number in combination with   
any security code1 access code or       
password that is required for an        
individual to obtain credit1 withdraw   
funds1 or engage in a financial         
transaction by means of such number2    
7#c7 the term security breach means a   
compromise of the security1             
confidentiality1 or integrity of        
computerized data that there is reason  
to believe has resulted in improper     
access to sensitive personally          
identifiable information2 and  7#d7 the 
term improper access means access       
without authorization or in excess of   
authorization4  4  7b7 ,clerical        
amendment ,the table of sections at the 
beginning of chapter #dg of title #ah1  
,united ,states ,code1 is amended by    

adding at the end the following3  #ajdj4
 ,concealment of security breaches      
involving personally identifiable       
information4  4  7c7 ,obligation ,to    
report  7#a7 ,in general ,a person who  
owns or possesses data in electronic    
form containing a means of              
identification and has knowledge of a   
major security breach of the system     
containing such data maintained by such 
person1 must provide prompt notice of   
such breach to the ,united ,states      
,secret ,service or ,federal ,bureau of 
,investigation4  7#b7 ,publication of   
list of notifications ,the ,secret      
,service and the ,federal ,bureau of    
,investigation shall annually publish in
 the ,federal ,register a list of all   
notifications submitted the previous    
calendar year and the identity of each  
entity with respect to which the major  
security breach occurred4  7#c7         
,definition ,in this subsection--  7,a7 
the term major security breach means any
 security breach involving--  7i7 means 

of identification pertaining to #aj1jjj 
or more individuals is1 or is reasonably
 believed to have been acquired2  7ii7  
databases owned by the ,federal         
,government2 or  7iii7 means of         
identification of ,federal ,government  
employees or contractors involved in    
national security matters or law        
enforcement2 and  7,b7 the term means of
 identification has the meaning given   
that term in section #ajbh of title #ah1
 ,united ,states ,code4  ,,ii           
,non-criminal privacy enforcement and   
privacy impact statements  #bja4        
,enforcement by ,attorney ,general and  
,state authorities  7a7 ,definition of  
authorized entity ,as used in this      
section1 the term authorized entity     
means the ,attorney ,general1 with      
respect to any conduct constituting a   
violation of a ,federal law enacted     
after the date of the enactment of this 
,act relating to data security and      
engaged in by a business entity1 and a  
,state ,attorney ,general with respect  

to that conduct to the extent the       
conduct adversely affects an interest of
 the residents of a ,state4  7b7 ,civil 
penalty  7#a7 ,generally ,an authorized 
entity may in a civil action obtain a   
civil penalty of not more than #ejj1jjj 
from any business entity that engages in
 conduct constituting a violation of a  
,federal law enacted after the date of  
the enactment of this ,act relating to  
data security4  7#b7 ,special rule for  
intentional violation ,if the violation 
described in subsection 7a7 is          
intentional1 the maximum civil penalty  
is #a1jjj1jjj4  7c7 ,injunctive relief  
,an authorized entity may1 in a civil   
action against a business entity that   
has engaged1 or is engaged1 in any      
conduct constituting a violation of a   
,federal law enacted after the date of  
the enactment of this ,act relating to  
data security1 obtain an order--  7#a7  
enjoining such act or practice2 or  7#b7
 enforcing compliance with that law4    
7d7 ,other rights and remedies ,the     

rights and remedies available under this
 section do not affect any other rights 
and remedies available under ,federal or
 ,state law4  #bjb4 ,coordination of    
,state and ,federal efforts  7a7 ,notice
  7#a7 ,in general ,a ,state consumer   
protection attorney may not bring an    
action under section #bja1 until the    
attorney general of the ,state involved 
provides to the ,attorney ,general of   
the ,united ,states--  7,a7 written     
notice of the action2 and  7,b7 a copy  
of the complaint for the action4  7#b7  
,exception ,paragraph 7#a7 does not     
apply with respect to the filing of an  
action by an attorney general of a      
,state under this section if the ,state 
attorney general determines that it is  
not feasible to provide the notice      
described in such subparagraph before   
the filing of the action1 in such a case
 the ,state attorney general shall      
provide notice and a copy of the        
complaint to the ,attorney ,general at  
the time the ,state attorney general    

files the action4  7b7 ,federal         
proceedings ,the ,attorney ,general     
may--  7#a7 move to stay any            
non-,federal action under section #bja1 
pending the final disposition of a      
pending ,federal action under that      
section2  7#b7 initiate an action in an 
appropriate ,united ,states district    
court and move to consolidate all       
pending actions under section #bja1     
including ,state actions1 in that court2
 and  7#c7 intervene in a ,state action 
under section #bja4  7c7 ,pending       
proceedings ,if the ,attorney ,general  
institutes a proceeding or action for a 
violation of a ,federal law enacted     
after the date of the enactment of this 
,act relating to data security1 no      
authority of a ,state may1 during the   
pendency of such proceeding or action1  
bring an action under this section      
against any defendant named in such     
criminal proceeding or a civil action   
against any defendant for any violation 
that is alleged in that proceeding or   

action4  7d7 ,definition ,as used in    
this section1 the term ,state consumer  
protection attorney means the attorney  
general of a ,state or any ,state or    
local law enforcement agency authorized 
by the ,state attorney general or by    
,state statute to prosecute violations  
of consumer protection law4  #bjc4      
,requirement that agency rulemaking take
 into consideration impacts on          
individual privacy  7a7 ,in general     
,title #e1 ,united ,states ,code1 is    
amended by adding after section #eec the
 following new section3  #eec;a4        
,privacy impact assessment in rulemaking
  7a7 ,initial privacy impact assessment
  7#a7 ,in general ,whenever an agency  
is required by section #eec of this     
title1 or any other law1 to publish a   
general notice of proposed rulemaking   
for a proposed rule1 or publishes a     
notice of proposed rulemaking for an    
interpretative rule involving the       
internal revenue laws of the ,united    
,states1 and such rule or proposed      

rulemaking pertains to the collection1  
maintenance1 use1 or disclosure of      
personally identifiable information from
 #aj or more individuals1 other than    
agencies1 instrumentalities1 or         
employees of the ,federal ,government1  
the agency shall prepare and make       
available for public comment an initial 
privacy impact assessment that describes
 the impact of the proposed rule on the 
privacy of individuals4 ,such assessment
 or a summary thereof shall be signed by
 the senior agency official with primary
 responsibility for privacy policy and  
be published in the ,federal ,register  
at the time of the publication of a     
general notice of proposed rulemaking   
for the rule4  7#b7 ,contents ,each     
initial privacy impact assessment       
required under this subsection shall    
contain the following3  7,a7 ,a         
description and analysis of the extent  
to which the proposed rule will impact  
the privacy interests of individuals1   
including the extent to which the       

proposed rule--  7i7 provides notice of 
the collection of personally            
identifiable information1 and specifies 
what personally identifiable information
 is to be collected and how it is to be 
collected1 maintained1 used1 and        
disclosed2  7ii7 allows access to such  
information by the person to whom the   
personally identifiable information     
pertains and provides an opportunity to 
correct inaccuracies2  7iii7 prevents   
such information1 which is collected for
 one purpose1 from being used for       
another purpose2 and  7iv7 provides     
security for such information1 including
 the provision of written notice to any 
individual1 within #ad days of the date 
of compromise1 whose privacy interests  
are compromised by the unauthorized     
release of personally identifiable      
information as a result of a breach of  
security at or by the agency4  7,b7 ,a  
description of any significant          
alternatives to the proposed rule which 
accomplish the stated objectives of     

applicable statutes and which minimize  
any significant privacy impact of the   
proposed rule on individuals4  7b7      
,final privacy impact assessment  7#a7  
,in general ,whenever an agency         
promulgates a final rule under section  
#eec of this title1 after being required
 by that section or any other law to    
publish a general notice of proposed    
rulemaking1 or promulgates a final      
interpretative rule involving the       
internal revenue laws of the ,united    
,states1 and such rule or proposed      
rulemaking pertains to the collection1  
maintenance1 use1 or disclosure of      
personally identifiable information from
 #aj or more individuals1 other than    
agencies1 instrumentalities1 or         
employees of the ,federal ,government1  
the agency shall prepare a final privacy
 impact assessment1 signed by the senior
 agency official with primary           
responsibility for privacy policy4  7#b7
 ,contents ,each final privacy impact   
assessment required under this          

subsection shall contain the following3 
7,a7 ,a description and analysis of the 
extent to which the final rule will     
impact the privacy interests of         
individuals1 including the extent to    
which such rule--  7i7 provides notice  
of the collection of personally         
identifiable information1 and specifies 
what personally identifiable information
 is to be collected and how it is to be 
collected1 maintained1 used1 and        
disclosed2  7ii7 allows access to such  
information by the person to whom the   
personally identifiable information     
pertains and provides an opportunity to 
correct inaccuracies2  7iii7 prevents   
such information1 which is collected for
 one purpose1 from being used for       
another purpose2 and  7iv7 provides     
security for such information1 including
 the provision of written notice to any 
individual1 within #ad days of the date 
of compromise1 whose privacy interests  
are compromised by the unauthorized     
release of personally identifiable      

information as a result of a breach of  
security at or by the agency4  7,b7 ,a  
summary of any significant issues raised
 by the public comments in response to  
the initial privacy impact assessment1 a
 summary of the analysis of the agency  
of such issues1 and a statement of any  
changes made in such rule as a result of
 such issues4  7,c7 ,a description of   
the steps the agency has taken to       
minimize the significant privacy impact 
on individuals consistent with the      
stated objectives of applicable         
statutes1 including a statement of the  
factual1 policy1 and legal reasons for  
selecting the alternative adopted in the
 final rule and why each one of the     
other significant alternatives to the   
rule considered by the agency which     
affect the privacy interests of         
individuals was rejected4  7#c7         
,availability to public ,the agency     
shall make copies of the final privacy  
impact assessment available to members  
of the public and shall publish in the  

,federal ,register such assessment or a 
summary thereof4  7c7 ,waivers  7#a7    
,emergencies ,an agency head may waive  
or delay the completion of some or all  
of the requirements of subsections 7a7  
and 7b7 to the same extent as the agency
 head may1 under section #fjh1 waive or 
delay the completion of some or all of  
the requirements of sections #fjc and   
#fjd1 respectively4  7#b7 ,national     
security ,an agency head may1 for       
national security reasons1 or to protect
 from disclosure classified information1
 confidential commercial information1 or
 information the disclosure of which may
 adversely affect a law enforcement     
effort1 waive or delay the completion of
 some or all of the following           
requirements3  7,a7 ,the requirement of 
subsection 7a77#a7 to make an assessment
 available for public comment1 provided 
that such assessment is made available1 
in classified form1 to the ,committees  
on the ,judiciary of the ,house of      
,representatives and the ,senate1 in    

lieu of making such assessment available
 to the public4  7,b7 ,the requirement  
of subsection 7a77#a7 to have an        
assessment or summary thereof published 
in the ,federal ,register1 provided that
 such assessment or summary is made     
available1 in classified form1 to the   
,committees on the ,judiciary of the    
,house of ,representatives and the      
,senate1 in lieu of publishing such     
assessment or summary in the ,federal   
,register4  7,c7 ,the requirements of   
subsection 7b77#c71 provided that the   
final privacy impact assessment is made 
available1 in classified form1 to the   
,committees on the ,judiciary of the    
,house of ,representatives and the      
,senate1 in lieu of making such         
assessment available to the public and  
publishing such assessment in the       
,federal ,register4  7d7 ,procedures for
 gathering comments ,when any rule is   
promulgated which may have a significant
 privacy impact on individuals1 or a    
privacy impact on a substantial number  

of individuals1 the head of the agency  
promulgating the rule or the official of
 the agency with statutory              
responsibility for the promulgation of  
the rule shall assure that individuals  
have been given an opportunity to       
participate in the rulemaking for the   
rule through techniques such as--  7#a7 
the inclusion in an advance notice of   
proposed rulemaking1 if issued1 of a    
statement that the proposed rule may    
have a significant privacy impact on    
individuals1 or a privacy impact on a   
substantial number of individuals2  7#b7
 the publication of a general notice of 
proposed rulemaking in publications of  
national circulation likely to be       
obtained by individuals2  7#c7 the      
direct notification of interested       
individuals2  7#d7 the conduct of open  
conferences or public hearings          
concerning the rule for individuals1    
including soliciting and receiving      
comments over computer networks2 and    
7#e7 the adoption or modification of    

agency procedural rules to reduce the   
cost or complexity of participation in  
the rulemaking by individuals4  7e7     
,periodic review of rules  7#a7 ,in     
general ,each agency shall carry out a  
periodic review of the rules promulgated
 by the agency that have a significant  
privacy impact on individuals1 or a     
privacy impact on a substantial number  
of individuals4 ,under such periodic    
review1 the agency shall determine1 for 
each such rule1 whether the rule can be 
amended or rescinded in a manner that   
minimizes any such impact while         
remaining in accordance with applicable 
statutes4 ,for each such determination1 
the agency shall consider the following 
factors3  7,a7 ,the continued need for  
the rule4  7,b7 ,the nature of          
complaints or comments received from the
 public concerning the rule4  7,c7 ,the 
complexity of the rule4  7,d7 ,the      
extent to which the rule overlaps1      
duplicates1 or conflicts with other     
,federal rules1 and1 to the extent      

feasible1 with ,state and local         
governmental rules4  7,e7 ,the length of
 time since the rule was last reviewed  
under this subsection4  7,f7 ,the degree
 to which technology1 economic          
conditions1 or other factors have       
changed in the area affected by the rule
 since the rule was last reviewed under 
this subsection4  7#b7 ,plan required   
,each agency shall carry out the        
periodic review required by paragraph   
7#a7 in accordance with a plan published
 by such agency in the ,federal         
,register4 ,each such plan shall provide
 for the review under this subsection of
 each rule promulgated by the agency not
 later than #aj years after the date on 
which such rule was published as the    
final rule and1 thereafter1 not later   
than #aj years after the date on which  
such rule was last reviewed under this  
subsection4 ,the agency may amend such  
plan at any time by publishing the      
revision in the ,federal ,register4     
7#c7 ,annual publication ,each year1    

each agency shall publish in the        
,federal ,register a list of the rules  
to be reviewed by such agency under this
 subsection during the following year4  
,the list shall include a brief         
description of each such rule and the   
need for and legal basis of such rule   
and shall invite public comment upon the
 determination to be made under this    
subsection with respect to such rule4   
7f7 ,judicial review  7#a7 ,in general  
,for any rule subject to this section1  
an individual who is adversely affected 
or aggrieved by final agency action is  
entitled to judicial review of agency   
compliance with the requirements of     
subsections 7b7 and 7c7 in accordance   
with chapter #g4 ,agency compliance with
 subsection 7d7 shall be judicially     
reviewable in connection with judicial  
review of subsection 7b74  7#b7         
,jurisdiction ,each court having        
jurisdiction to review such rule for    
compliance with section #eec1 or under  
any other provision of law1 shall have  

jurisdiction to review any claims of    
noncompliance with subsections 7b7 and  
7c7 in accordance with chapter #g4      
,agency compliance with subsection 7d7  
shall be judicially reviewable in       
connection with judicial review of      
subsection 7b74  7#c7 ,limitations  7,a7
 ,an individual may seek such review    
during the period beginning on the date 
of final agency action and ending #a    
year later1 except that where a         
provision of law requires that an action
 challenging a final agency action be   
commenced before the expiration of #a   
year1 such lesser period shall apply to 
an action for judicial review under this
 subsection4  7,b7 ,in the case where an
 agency delays the issuance of a final  
privacy impact assessment pursuant to   
subsection 7c71 an action for judicial  
review under this section shall be filed
 not later than--  7i7 #a year after the
 date the assessment is made available  
to the public2 or  7ii7 where a         
provision of law requires that an action

 challenging a final agency regulation  
be commenced before the expiration of   
the #a-year period1 the number of days  
specified in such provision of law that 
is after the date the assessment is made
 available to the public4  7#d7 ,relief 
,in granting any relief in an action    
under this subsection1 the court shall  
order the agency to take corrective     
action consistent with this section and 
chapter #g1 and may--  7,a7 remand the  
rule to the agency2 and  7,b7 defer the 
enforcement of the rule against         
individuals1 unless the court finds that
 continued enforcement of the rule is in
 the public interest4  7#e7 ,rule of    
construction ,nothing in this subsection
 limits the authority of any court to   
stay the effective date of any rule or  
provision thereof under any other       
provision of law or to grant any other  
relief in addition to the requirements  
of this subsection4  7#f7 ,record of    
agency action ,in an action for the     
judicial review of a rule1 the privacy  

impact assessment for such rule1        
including an assessment prepared or     
corrected pursuant to paragraph 7#d71   
shall constitute part of the entire     
record of agency action in connection   
with such review4  7#g7 ,exclusivity    
,compliance or noncompliance by an      
agency with the provisions of this      
section shall be subject to judicial    
review only in accordance with this     
subsection4  7#h7 ,savings clause       
,nothing in this subsection bars        
judicial review of any other impact     
statement or similar assessment required
 by any other law if judicial review of 
such statement or assessment is         
otherwise permitted by law4  7g7        
,definition ,for purposes of this       
section1 the term personally            
identifiable information means          
information that can be used to identify
 an individual1 including such          
individual's name1 address1 telephone   
number1 photograph1 social security     
number or other identifying information4

 ,it includes information about such    
individual's medical or financial       
condition4  4  7b7 ,periodic review     
transition provisions  7#a7 ,initial    
plan ,for each agency1 the plan required
 by subsection 7e7 of section #eec;a of 
title #e1 ,united ,states ,code 7as     
added by subsection 7a771 shall be      
published not later than #ahj days after
 the date of the enactment of this ,act4
  7#b7 ,review period ,in the case of a 
rule promulgated by an agency before the
 date of the enactment of this ,act1    
such plan shall provide for the periodic
 review of such rule before the         
expiration of the #aj-year period       
beginning on the date of the enactment  
of this ,act4 ,for any such rule1 the   
head of the agency may provide for a    
#a-year extension of such period if the 
head of the agency1 before the          
expiration of the period1 certifies in a
 statement published in the ,federal    
,register that reviewing such rule      
before the expiration of the period is  

not feasible4 ,the head of the agency   
may provide for additional #a-year      
extensions of the period pursuant to the
 preceding sentence1 but in no event may
 the period exceed #ae years4  7c7      
,congressional review ,section          
#hja7;a77#a77;,b7 of title #e1 ,united  
,states ,code1 is amended--  7#a7 by    
redesignating clauses 7iii7 and 7iv7 as 
clauses 7iv7 and 7v71 respectively2 and 
7#b7 by inserting after clause 7ii7 the 
following new clause3  7iii7 the        
agency's actions relevant to section    
#eec;a2  4  7d7 ,clerical amendment ,the
 table of sections at the beginning of  
chapter #e of title #e1 ,united ,states 
,code1 is amended by adding after the   
item relating to section #eec the       
following new item3  #eec;a4 ,privacy   
impact assessment in rulemaking4  4