,i #aacth ,,congress #b;d ,session ,h4 ,r4 #ddjj ,,in ,,the ,,house ,,of ,,representatives ,april #d1 #bjad ,mr4 ,rush 7for himself1 ,mr4 ,barton1 ,mr4 ,cicilline1 ,mr4 ,lipinski1 ,mr4 ,mc,nerney1 and ,ms4 ,schakowsky7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to protect consumers by requiring reasonable security policies and procedures to protect data containing personal information1 and to provide for nationwide notice in the event of a security breach4 #a4 ,short title ,this ,act may be cited as the ,data ,accountability and ,trust ,act4 #b4 ,requirements for information security 7a7 ,general security policies and procedures 7#a7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require each person engaged in interstate commerce that owns or possesses data containing personal information1 or contracts to have any third party entity maintain such data for such person1 to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information taking into consideration-- 7,a7 the size of1 and the nature1 scope1 and complexity of the activities engaged in by1 such person2 7,b7 the current state of the art in administrative1 technical1 and physical safeguards for protecting such information2 and 7,c7 the cost of implementing such safeguards4 7#b7 ,requirements ,such regulations shall require the policies and procedures to include the following3 7,a7 ,a security policy with respect to the collection1 use1 sale1 other dissemination1 and maintenance of such personal information4 7,b7 ,the identification of an officer or other individual as the point of contact with responsibility for the management of information security4 7,c7 ,a process for identifying and assessing any reasonably foreseeable vulnerabilities in the system or systems maintained by such person that contains such data1 which shall include regular monitoring for a breach of security of such system or systems4 7,d7 ,a process for taking preventive and corrective action to mitigate against any vulnerabilities identified in the process required by subparagraph 7,c71 which may include implementing any changes to security practices and the architecture1 installation1 or implementation of network or operating software4 7,e7 ,a process for disposing of data in electronic form containing personal information by shredding1 permanently erasing1 or otherwise modifying the personal information contained in such data to make such personal information permanently unreadable or undecipherable4 7,f7 ,a standard method or methods for the destruction of paper documents and other non-electronic data containing personal information4 7#c7 ,treatment of entities governed by other law ,any person who is in compliance with any other ,federal law that requires such person to maintain standards and safeguards for information security and protection of personal information that1 taken as a whole and as the ,commission shall determine in the rulemaking required under paragraph 7#a71 provide protections substantially similar to1 or greater than1 those required under this subsection1 shall be deemed to be in compliance with this subsection4 7b7 ,special requirements for information brokers 7#a7 ,submission of policies to the ,,ftc ,the regulations promulgated under subsection 7a7 shall require each information broker to submit its security policies to the ,commission in conjunction with a notification of a breach of security under section #c or upon request of the ,commission4 7#b7 ,post-breach audit ,for any information broker required to provide notification under section #c1 the ,commission may conduct audits of the information security practices of such information broker1 or require the information broker to conduct independent audits of such practices 7by an independent auditor who has not audited such information broker's security practices during the preceding #e years74 7#c7 ,accuracy of and individual access to personal information 7,a7 ,accuracy 7i7 ,in general ,each information broker shall establish reasonable procedures to assure the maximum possible accuracy of the personal information it collects1 assembles1 or maintains1 and any other information it collects1 assembles1 or maintains that specifically identifies an individual1 other than information which merely identifies an individual's name or address4 7ii7 ,limited exception for fraud databases ,the requirement in clause 7i7 shall not prevent the collection or maintenance of information that may be inaccurate with respect to a particular individual when that information is being collected or maintained solely-- 7,i7 for the purpose of indicating whether there may be a discrepancy or irregularity in the personal information that is associated with an individual2 and 7,,ii7 to help identify1 or authenticate the identity of1 an individual1 or to protect against or investigate fraud or other unlawful conduct4 7,b7 ,consumer access to information 7i7 ,access ,each information broker shall-- 7,i7 provide to each individual whose personal information it maintains1 at the individual's request at least #a time per year and at no cost to the individual1 and after verifying the identity of such individual1 a means for the individual to review any personal information regarding such individual maintained by the information broker and any other information maintained by the information broker that specifically identifies such individual1 other than information which merely identifies an individual's name or address2 and 7,,ii7 place a conspicuous notice on its ,internet website 7if the information broker maintains such a website7 instructing individuals how to request access to the information required to be provided under subclause 7,i71 and1 as applicable1 how to express a preference with respect to the use of personal information for marketing purposes under clause 7iii74 7ii7 ,disputed information ,whenever an individual whose information the information broker maintains makes a written request disputing the accuracy of any such information1 the information broker1 after verifying the identity of the individual making such request and unless there are reasonable grounds to believe such request is frivolous or irrelevant1 shall-- 7,i7 correct any inaccuracy2 or 7,,ii7 7aa7 in the case of information that is public record information1 inform the individual of the source of the information1 and1 if reasonably available1 where a request for correction may be directed and1 if the individual provides proof that the public record has been corrected or that the information broker was reporting the information incorrectly1 correct the inaccuracy in the information broker's records2 or 7bb7 in the case of information that is non-public information1 note the information that is disputed1 including the individual's statement disputing such information1 and take reasonable steps to independently verify such information under the procedures outlined in subparagraph 7,a7 if such information can be independently verified4 7iii7 ,alternative procedure for certain marketing information ,in accordance with regulations issued under clause 7v71 an information broker that maintains any information described in clause 7i7 which is used1 shared1 or sold by such information broker for marketing purposes1 may1 in lieu of complying with the access and dispute requirements set forth in clauses 7i7 and 7ii71 provide each individual whose information it maintains with a reasonable means of expressing a preference not to have his or her information used for such purposes4 ,if the individual expresses such a preference1 the information broker may not use1 share1 or sell the individual's information for marketing purposes4 7iv7 ,limitations ,an information broker may limit the access to information required under clause 7i77,i7 and is not required to provide notice to individuals as required under clause 7i77,,ii7 in the following circumstances3 7,i7 ,if access of the individual to the information is limited by law or legally recognized privilege4 7,,ii7 ,if the information is used for a legitimate governmental or fraud prevention purpose that would be compromised by such access4 7,,iii7 ,if the information consists of a published media record1 unless that record has been included in a report about an individual shared with a third party4 7v7 ,rulemaking ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to carry out this paragraph and to facilitate the purposes of this ,act4 ,in addition1 the ,commission shall issue regulations1 as necessary1 under section #eec of title #e1 ,united ,states ,code1 on the scope of the application of the limitations in clause 7iv71 including any additional circumstances in which an information broker may limit access to information under such clause that the ,commission determines to be appropriate4 7,c7 ,,fcra regulated persons ,any information broker who is engaged in activities subject to the ,fair ,credit ,reporting ,act and who is in compliance with sections #fji1 #faj1 and #faa of such ,act 7#ae ,u4,s4,c4 #afha;g2 #afha;h2 #afha;i7 with respect to information subject to such ,act1 shall be deemed to be in compliance with this paragraph with respect to such information4 7#d7 ,requirement of audit log of accessed and transmitted information ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require information brokers to establish measures which facilitate the auditing or retracing of any internal or external access to1 or transmissions of1 any data containing personal information collected1 assembled1 or maintained by such information broker4 7#e7 ,prohibition on pretexting by information brokers 7,a7 ,prohibition on obtaining personal information by false pretenses ,it shall be unlawful for an information broker to obtain or attempt to obtain1 or cause to be disclosed or attempt to cause to be disclosed to any person1 personal information or any other information relating to any person by-- 7i7 making a false1 fictitious1 or fraudulent statement or representation to any person2 or 7ii7 providing any document or other information to any person that the information broker knows or should know to be forged1 counterfeit1 lost1 stolen1 or fraudulently obtained1 or to contain a false1 fictitious1 or fraudulent statement or representation4 7,b7 ,prohibition on solicitation to obtain personal information under false pretenses ,it shall be unlawful for an information broker to request a person to obtain personal information or any other information relating to any other person1 if the information broker knew or should have known that the person to whom such a request is made will obtain or attempt to obtain such information in the manner described in subparagraph 7,a74 7c7 ,exemption for certain service providers ,nothing in this section shall apply to a service provider for any electronic communication by a third party that is transmitted1 routed1 or stored in intermediate or transient storage by such service provider4 #c4 ,notification of information security breach 7a7 ,nationwide ,notification ,any person engaged in interstate commerce that owns or possesses data in electronic form containing personal information shall1 following the discovery of a breach of security of the system maintained by such person that contains such data-- 7#a7 notify each individual who is a citizen or resident of the ,united ,states whose personal information was acquired or accessed as a result of such a breach of security2 and 7#b7 notify the ,commission4 7b7 ,special ,notification ,requirements 7#a7 ,third party agents ,in the event of a breach of security by any third party entity that has been contracted to maintain or process data in electronic form containing personal information on behalf of any other person who owns or possesses such data1 such third party entity shall be required to notify such person of the breach of security4 ,upon receiving such notification from such third party1 such person shall provide the notification required under subsection 7a74 7#b7 ,service providers ,if a service provider becomes aware of a breach of security of data in electronic form containing personal information that is owned or possessed by another person that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 such service provider shall be required to notify of such a breach of security only the person who initiated such connection1 transmission1 routing1 or storage if such person can be reasonably identified4 ,upon receiving such notification from a service provider1 such person shall provide the notification required under subsection 7a74 7#c7 ,coordination of notification with consumer reporting agencies ,if a person is required to provide notification to more than #e1jjj individuals under subsection 7a77#a71 the person shall also notify the major consumer reporting agencies of the timing and distribution of the notices4 ,such notice shall be given to the consumer reporting agencies without unreasonable delay and1 if it will not delay notice to the affected individuals1 prior to the distribution of notices to the affected individuals4 7c7 ,timeliness of ,notification 7#a7 ,in general ,unless subject to a delay authorized under paragraph 7#b71 a notification required under subsection 7a7 shall be made not later than #fj days following the discovery of a breach of security1 unless the person providing notice can show that providing notice within such a time frame is not feasible due to extraordinary circumstances necessary to prevent further breach or unauthorized disclosures1 and reasonably restore the integrity of the data system1 in which case such notification shall be made as promptly as possible4 7#b7 ,delay of ,notification ,authorized for ,law ,enforcement or ,national ,security ,purposes 7,a7 ,law enforcement ,if a ,federal1 ,state1 or local law enforcement agency determines that the notification required under this section would impede a civil or criminal investigation1 such notification shall be delayed upon the written request of the law enforcement agency for #cj days or such lesser period of time which the law enforcement agency determines is reasonably necessary and requests in writing4 ,a law enforcement agency may1 by a subsequent written request1 revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary4 7,b7 ,national security ,if a ,federal national security agency or homeland security agency determines that the notification required under this section would threaten national or homeland security1 such notification may be delayed for a period of time which the national security agency or homeland security agency determines is reasonably necessary and requests in writing4 ,a ,federal national security agency or homeland security agency may revoke such delay or extend the period of time set forth in the original request made under this paragraph by a subsequent written request if further delay is necessary4 7d7 ,method and ,content of ,notification 7#a7 ,direct notification 7,a7 ,method of notification ,a person required to provide notification to individuals under subsection 7a77#a7 shall be in compliance with such requirement if the person provides conspicuous and clearly identified notification by one of the following methods 7provided the selected method can reasonably be expected to reach the intended individual73 7i7 ,written notification4 7ii7 ,notification by email or other electronic means1 if-- 7,i7 the person's primary method of communication with the individual is by email or such other electronic means2 or 7,,ii7 the individual has consented to receive such notification and the notification is provided in a manner that is consistent with the provisions permitting electronic transmission of notices under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja74 7,b7 ,content of notification ,regardless of the method by which notification is provided to an individual under subparagraph 7,a71 such notification shall include-- 7i7 a description of the personal information that was acquired or accessed by an unauthorized person2 7ii7 a telephone number that the individual may use1 at no cost to such individual1 to contact the person to inquire about the breach of security or the information the person maintained about that individual2 7iii7 notice that the individual is entitled to receive1 at no cost to such individual1 consumer credit reports on a quarterly basis for a period of #b years1 or credit monitoring or other service that enables consumers to detect the misuse of their personal information for a period of #b years1 and instructions to the individual on requesting such reports or service from the person1 except when the only information which has been the subject of the security breach is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code2 7iv7 the toll-free contact telephone numbers and addresses for the major consumer reporting agencies2 and 7v7 a toll-free telephone number and ,internet website address for the ,commission whereby the individual may obtain information regarding identity theft4 7#b7 ,substitute notification 7,a7 ,circumstances giving rise to substitute notification ,a person required to provide notification to individuals under subsection 7a77#a7 may provide substitute notification in lieu of the direct notification required by paragraph 7#a7 if the person owns or possesses data in electronic form containing personal information of fewer than #a1jjj individuals and such direct notification is not feasible due to-- 7i7 excessive cost to the person required to provide such notification relative to the resources of such person1 as determined in accordance with the regulations issued by the ,commission under paragraph 7#c77;,a72 or 7ii7 lack of sufficient contact information for the individual required to be notified4 7,b7 ,form of substitute notification ,such substitute notification shall include-- 7i7 email notification to the extent that the person has email addresses of individuals to whom it is required to provide notification under subsection 7a77#a72 7ii7 a conspicuous notice on the ,internet website of the person 7if such person maintains such a website72 and 7iii7 notification in print and to broadcast media1 including major media in metropolitan and rural areas where the individuals whose personal information was acquired reside4 7,c7 ,content of substitute notice ,each form of substitute notice under this paragraph shall include-- 7i7 notice that individuals whose personal information is included in the breach of security are entitled to receive1 at no cost to the individuals1 consumer credit reports on a quarterly basis for a period of #b years1 or credit monitoring or other service that enables consumers to detect the misuse of their personal information for a period of #b years1 and instructions on requesting such reports or service from the person1 except when the only information which has been the subject of the security breach is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code2 and 7ii7 a telephone number by which an individual can1 at no cost to such individual1 learn whether that individual's personal information is included in the breach of security4 7#c7 ,regulations and guidance 7,a7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall1 by regulation under section #eec of title #e1 ,united ,states ,code1 establish criteria for determining circumstances under which substitute notification may be provided under paragraph 7#b71 including criteria for determining if notification under paragraph 7#a7 is not feasible due to excessive costs to the person required to provided such notification relative to the resources of such person4 ,such regulations may also identify other circumstances where substitute notification would be appropriate for any person1 including circumstances under which the cost of providing notification exceeds the benefits to consumers4 7,b7 ,guidance ,in addition1 the ,commission shall provide and publish general guidance with respect to compliance with this subsection4 ,such guidance shall include-- 7i7 a description of written or email notification that complies with the requirements of paragraph 7#a72 and 7ii7 guidance on the content of substitute notification under paragraph 7#b71 including the extent of notification to print and broadcast media that complies with the requirements of such paragraph4 7e7 ,other ,obligations ,following ,breach 7#a7 ,in general ,a person required to provide notification under subsection 7a7 shall1 upon request of an individual whose personal information was included in the breach of security1 provide or arrange for the provision of1 to each such individual and at no cost to such individual-- 7,a7 consumer credit reports from at least one of the major consumer reporting agencies beginning not later than #fj days following the individual's request and continuing on a quarterly basis for a period of #b years thereafter2 or 7,b7 a credit monitoring or other service that enables consumers to detect the misuse of their personal information1 beginning not later than #fj days following the individual's request and continuing for a period of #b years4 7#b7 ,limitation ,this subsection shall not apply if the only personal information which has been the subject of the security breach is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code4 7#c7 ,rulemaking ,as part of the ,commission's rulemaking described in subsection 7d77#c71 the ,commission shall determine the circumstances under which a person required to provide notification under subsection 7a77#a7 shall provide or arrange for the provision of free consumer credit reports or credit monitoring or other service to affected individuals4 7f7 ,exemption 7#a7 ,general exemption ,a person shall be exempt from the requirements under this section if1 following a breach of security1 such person determines that there is no reasonable risk of identity theft1 fraud1 or other unlawful conduct4 7#b7 ,presumption 7,a7 ,in general ,if the data in electronic form containing personal information is rendered unusable1 unreadable1 or indecipherable through encryption or other security technology or methodology 7if the method of encryption or such other technology or methodology is generally accepted by experts in the information security field71 there shall be a presumption that no reasonable risk of identity theft1 fraud1 or other unlawful conduct exists following a breach of security of such data4 ,any such presumption may be rebutted by facts demonstrating that the encryption or other security technologies or methodologies in a specific case1 have been or are reasonably likely to be compromised4 7,b7 methodologies or technologies ,not later than #a year after the date of the enactment of this ,act and biannually thereafter1 the ,commission shall issue rules 7pursuant to section #eec of title #e1 ,united ,states ,code7 or guidance to identify security methodologies or technologies which render data in electronic form unusable1 unreadable1 or indecipherable1 that shall1 if applied to such data1 establish a presumption that no reasonable risk of identity theft1 fraud1 or other unlawful conduct exists following a breach of security of such data4 ,any such presumption may be rebutted by facts demonstrating that any such methodology or technology in a specific case has been or is reasonably likely to be compromised4 ,in issuing such rules or guidance1 the ,commission shall consult with relevant industries1 consumer organizations1 and data security and identity theft prevention experts and established standards setting bodies4 7#c7 ,,ftc guidance ,not later than #a year after the date of the enactment of this ,act the ,commission shall issue guidance regarding the application of the exemption in paragraph 7#a74 7g7 ,website ,notice of ,federal ,trade ,commission ,if the ,commission1 upon receiving notification of any breach of security that is reported to the ,commission under subsection 7a77#b71 finds that notification of such a breach of security via the ,commission's ,internet website would be in the public interest or for the protection of consumers1 the ,commission shall place such a notice in a clear and conspicuous location on its ,internet website4 7h7 ,,ftc ,study on ,notification in ,languages in ,addition to ,english ,not later than #a year after the date of enactment of this ,act1 the ,commission shall conduct a study on the practicality and cost effectiveness of requiring the notification required by subsection 7d77#a7 to be provided in a language in addition to ,english to individuals known to speak only such other language4 7i7 ,general rulemaking authority ,the ,commission may promulgate regulations necessary under section #eec of title #e1 ,united ,states ,code1 to effectively enforce the requirements of this section4 7j7 ,treatment of persons governed by other law ,a person who is in compliance with any other ,federal law that requires such person to provide notification to individuals following a breach of security1 and that1 taken as a whole1 provides protections substantially similar to1 or greater than1 those required under this section1 as the ,commission shall determine by rule 7under section #eec of title #e1 ,united ,states ,code71 shall be deemed to be in compliance with this section4 #d4 ,application and ,enforcement 7a7 ,general application ,the requirements of sections #b and #c shall only apply to those persons1 partnerships1 or corporations over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b774 7b7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #b or #c shall be treated as an unfair and deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of commission ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates such regulations shall be subject to the penalties and entitled to the privileges and immunities provided in that ,act4 7#c7 ,limitation ,in promulgating rules under this ,act1 the ,commission shall not require the deployment or use of any specific products or technologies1 including any specific computer software or hardware4 7c7 ,enforcement by ,state ,attorneys ,general 7#a7 ,civil action ,in any case in which the attorney general of a ,state1 or an official or agency of a ,state1 has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by any person who violates section #b or #c of this ,act1 the attorney general1 official1 or agency of the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction-- 7,a7 to enjoin further violation of such section by the defendant2 7,b7 to compel compliance with such section2 or 7,c7 to obtain civil penalties in the amount determined under paragraph 7#b74 7#b7 ,civil penalties 7,a7 ,calculation 7i7 ,treatment of violations of section #b ,for purposes of paragraph 7#a77;,c7 with regard to a violation of section #b1 the amount determined under this paragraph is the amount calculated by multiplying the number of days that a person is not in compliance with such section by an amount not greater than #aa1jjj4 7ii7 ,treatment of violations of section #c ,for purposes of paragraph 7#a77;,c7 with regard to a violation of section #c1 the amount determined under this paragraph is the amount calculated by multiplying the number of violations of such section by an amount not greater than #aa1jjj4 ,each failure to send notification as required under section #c to a resident of the ,state shall be treated as a separate violation4 7,b7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of enactment of this ,act1 and each year thereafter1 the amounts specified in clauses 7i7 and 7ii7 of subparagraph 7,a7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7,c7 ,maximum total liability ,notwithstanding the number of actions which may be brought against a person under this subsection1 the maximum civil penalty for which any person may be liable under this subsection shall not exceed-- 7i7 #e1jjj1jjj for each violation of section #b2 and 7ii7 #e1jjj1jjj for all violations of section #c resulting from a single breach of security4 7#c7 ,intervention by the ,,ftc 7,a7 ,notice and intervention ,the ,state shall provide prior written notice of any action under paragraph 7#a7 to the ,commission and provide the ,commission with a copy of its complaint1 except in any case in which such prior notice is not feasible1 in which case the ,state shall serve such notice immediately upon instituting such action4 ,the ,commission shall have the right-- 7i7 to intervene in the action2 7ii7 upon so intervening1 to be heard on all matters arising therein2 and 7iii7 to file petitions for appeal4 7,b7 ,limitation on state action while federal action is pending ,if the ,commission has instituted a civil action for violation of this ,act1 no ,state attorney general1 or official or agency of a ,state1 may bring an action under this subsection during the pendency of that action against any defendant named in the complaint of the ,commission for any violation of this ,act alleged in the complaint4 7#d7 ,construction ,for purposes of bringing any civil action under paragraph 7#a71 nothing in this ,act shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths or affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7d7 ,affirmative ,defense for a ,violation of section #c 7#a7 ,in general ,it shall be an affirmative defense to an enforcement action brought under subsection 7b71 or a civil action brought under subsection 7c71 based on a violation of section #c1 that all of the personal information contained in the data in electronic form that was acquired or accessed as a result of a breach of security of the defendant is public record information that is lawfully made available to the general public from ,federal1 ,state1 or local government records and was acquired by the defendant from such records4 7#b7 ,no effect on other requirements ,nothing in this subsection shall be construed to exempt any person from the requirement to notify the ,commission of a breach of security as required under section #c7;a74 #e4 ,definitions ,in this ,act1 the following definitions apply3 7#a7 ,breach of security ,the term breach of security means the unauthorized acquisition of data in electronic form containing personal information4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,consumer reporting agency ,the term consumer reporting agency has the meaning given the term consumer reporting agency that compiles and maintains files on consumers on a nationwide basis in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#d7 ,data in electronic form ,the term data in electronic form means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices4 7#e7 ,encryption ,the term encryption means the protection of data in electronic form in storage or in transit using an encryption technology that has been adopted by an established standards setting body which renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data4 ,such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption4 7#f7 ,identity theft ,the term identity theft means the unauthorized use of another person's personal information for the purpose of engaging in commercial transactions under the name of such other person4 7#g7 ,information broker ,the term information broker-- 7,a7 means a commercial entity whose business is to collect1 assemble1 or maintain personal information concerning individuals who are not current or former customers of such entity in order to sell such information or provide access to such information to any nonaffiliated third party in exchange for consideration1 whether such collection1 assembly1 or maintenance of personal information is performed by the information broker directly1 or by contract or subcontract with any other entity2 and 7,b7 does not include a commercial entity to the extent that such entity processes information collected by and received from a nonaffiliated third party concerning individuals who are current or former customers or employees of such third party to enable such third party to 7#a7 provide benefits for its employees or 7#b7 directly transact business with its customers4 7#h7 ,personal information 7,a7 ,definition ,the term personal information means an individual's first name or initial and last name1 or address1 or phone number1 in combination with any #a or more of the following data elements for that individual3 7i7 ,social ,security number4 7ii7 ,driver's license number1 passport number1 military identification number1 or other similar number issued on a government document used to verify identity4 7iii7 ,financial account number1 or credit or debit card number1 and any required security code1 access code1 or password that is necessary to permit access to an individual's financial account4 7,b7 ,modified definition by rulemaking ,the ,commission may1 by rule promulgated under section #eec of title #e1 ,united ,states ,code1 modify the definition of personal information under subparagraph 7,a7-- 7i7 for the purpose of section #b to the extent that such modification will not unreasonably impede interstate commerce1 and will accomplish the purposes of this ,act2 or 7ii7 for the purpose of section #c1 to the extent that such modification is necessary to accommodate changes in technology or practices1 will not unreasonably impede interstate commerce1 and will accomplish the purposes of this ,act4 7#i7 ,public record information ,the term public record information means information about an individual which has been obtained originally from records of a ,federal1 ,state1 or local government entity that are available for public inspection4 7#aj7 ,non-public information ,the term non-public information means information about an individual that is of a private nature and neither available to the general public nor obtained from a public record4 7#aa7 ,service provider ,the term service provider means an entity that provides to a user transmission1 routing1 intermediate and transient storage1 or connections to its system or network1 for electronic communications1 between or among points specified by such user of material of the user's choosing1 without modification to the content of the material as sent or received4 ,any such entity shall be treated as a service provider under this ,act only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage or connections4 #f4 ,effect on other laws 7a7 ,preemption of ,state ,information ,security ,laws ,this ,act supersedes any provision of a statute1 regulation1 or rule of a ,state or political subdivision of a ,state1 with respect to those entities covered by the regulations issued pursuant to this ,act1 that expressly-- 7#a7 requires information security practices and treatment of data containing personal information similar to any of those required under section #b2 and 7#b7 requires notification to individuals of a breach of security resulting in unauthorized access to or acquisition of data in electronic form containing personal information4 7b7 ,additional ,preemption 7#a7 ,in general ,no person other than a person specified in section #d7;c7 may bring a civil action under the laws of any ,state if such action is premised in whole or in part upon the defendant violating any provision of this ,act4 7#b7 ,protection of consumer protection laws ,this subsection shall not be construed to limit the enforcement of any ,state consumer protection law by an attorney general of a ,state4 7c7 ,protection of ,certain ,state ,laws ,this ,act shall not be construed to preempt the applicability of-- 7#a7 ,state trespass1 contract1 or tort law2 or 7#b7 other ,state laws to the extent that those laws relate to acts of fraud4 7d7 ,preservation of ,,ftc ,authority ,nothing in this ,act may be construed in any way to limit or affect the ,commission's authority under any other provision of law4 #g4 ,effective date ,this ,act shall take effect #a year after the date of enactment of this ,act4 #h4 ,authorization of appropriations ,there is authorized to be appropriated to the ,commission #a1jjj1jjj for each of fiscal years #bjaa through #bjaf to carry out this ,act4