,i  #aac? ,,congress  #b;d ,session  ,h4
 ,r4 #ddjj  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,april #d1 #bjad ,mr4 
,ru% 7= himself1 ,mr4 ,b>ton1 ,mr4      
,cicill9e1 ,mr4 ,lip9ski1 ,mr4          
,mc,nerney1 & ,ms4 ,s*ak[sky7 introduc$ 
! foll[+ bill2 :i* 0 ref]r$ to !        
,committee on ,en]gy & ,comm]ce  ,a     
,,bill  ,to protect consum]s by requir+ 
reasonable security policies & proc$ures
 to protect data conta9+ p]sonal        
in=mation1 & to provide = nationwide    
notice 9 ! ev5t ( a security brea*4  #a4
 ,%ort title ,?is ,act may be cit$ z !  
,data ,acc\ntability & ,tru/ ,act4  #b4 
,requirem5ts = in=mation security  7a7  
,g5]al security policies & proc$ures    
7#a7 ,regulations ,n lat] ?an #a ye>    
aft] ! date ( enactm5t ( ?is ,act1 !    
,commission %all promulgate regulations 
"u section #eec ( title #e1 ,unit$      
,/ates ,code1 to require ea* p]son      
engag$ 9 int]/ate comm]ce t owns or     
possesses data conta9+ p]sonal          
in=mation1 or contracts to h any ?ird   

p>ty entity ma9ta9 su* data = su* p]son1
 to e/abli% & implem5t policies &       
proc$ures reg>d+ in=mation security     
practices = ! treatm5t & protection (   
p]sonal in=mation tak+ into             
consid]ation--  7,a7 ! size (1 & !      
nature1 scope1 & complexity ( !         
activities engag$ 9 by1 su* p]son2  7,b7
 ! curr5t /ate ( ! art 9 adm9i/rative1  
te*nical1 & physical safegu>ds =        
protect+ su* in=mation2 &  7,c7 ! co/ ( 
implem5t+ su* safegu>ds4  7#b7          
,requirem5ts ,su* regulations %all      
require ! policies & proc$ures to       
include ! foll[+3  7,a7 ,a security     
policy ) respect to ! collection1 use1  
sale1 o!r dissem9ation1 & ma9t5ance (   
su* p]sonal in=mation4  7,b7 ,!         
id5tification ( an (fic] or o!r         
individual z ! po9t ( contact )         
responsibility = ! managem5t ( in=mation
 security4  7,c7 ,a process = id5tify+ &
 assess+ any reasonably =eseeable       
vuln]abilities 9 ! sy/em or sy/ems      
ma9ta9$ by su* p]son t conta9s su* data1

 :i* %all include regul> monitor+ = a   
brea* ( security ( su* sy/em or sy/ems4 
7,d7 ,a process = tak+ prev5tive &      
corrective action to mitigate aga9/ any 
vuln]abilities id5tifi$ 9 ! process     
requir$ by subp>agraph 7,c71 :i* may    
include implem5t+ any *anges to security
 practices & ! ar*itecture1 in/allation1
 or implem5tation ( network or op]at+   
s(tw>e4  7,e7 ,a process = dispos+ (    
data 9 electronic =m conta9+ p]sonal    
in=mation by %r$d+1 p]man5tly eras+1 or 
o!rwise modify+ ! p]sonal in=mation     
conta9$ 9 su* data to make su* p]sonal  
in=mation p]man5tly unreadable or       
undeciph]able4  7,f7 ,a /&>d me?od or   
me?ods = ! de/ruction ( pap] docum5ts & 
o!r non-electronic data conta9+ p]sonal 
in=mation4  7#c7 ,treatm5t ( entities   
gov]n$ by o!r law ,any p]son :o is 9    
compliance ) any o!r ,f$]al law t       
requires su* p]son to ma9ta9 /&>ds &    
safegu>ds = in=mation security &        
protection ( p]sonal in=mation t1 tak5 z
 a :ole & z ! ,commission %all det]m9e 9

 ! rulemak+ requir$ "u p>agraph 7#a71   
provide protections sub/antially simil> 
to1 or great] ?an1 ^? requir$ "u ?is    
subsection1 %all be deem$ to be 9       
compliance ) ?is subsection4  7b7       
,special requirem5ts = in=mation brok]s 
7#a7 ,submission ( policies to ! ,,ftc  
,! regulations promulgat$ "u subsection 
7a7 %all require ea* in=mation brok] to 
submit its security policies to !       
,commission 9 conjunction ) a           
notification ( a brea* ( security "u    
section #c or ^u reque/ ( ! ,commission4
  7#b7 ,po/-brea* audit ,= any in=mation
 brok] requir$ to provide notification  
"u section #c1 ! ,commission may conduct
 audits ( ! in=mation security practices
 ( su* in=mation brok]1 or require !    
in=mation brok] to conduct indep5d5t    
audits ( su* practices 7by an indep5d5t 
auditor :o has n audit$ su* in=mation   
brok]'s security practices dur+ ! prec$+
 #e ye>s74  7#c7 ,accuracy ( &          
individual access to p]sonal in=mation  
7,a7 ,accuracy  7i7 ,9 g5]al ,ea*       

in=mation brok] %all e/abli% reasonable 
proc$ures to assure ! maximum possible  
accuracy ( ! p]sonal in=mation x        
collects1 assembles1 or ma9ta9s1 & any  
o!r in=mation x collects1 assembles1 or 
ma9ta9s t specifically id5tifies an     
individual1 o!r ?an in=mation :i* m]ely 
id5tifies an individual's "n or address4
  7ii7 ,limit$ exception = fraud        
databases ,! requirem5t 9 clause 7i7    
%all n prev5t ! collection or ma9t5ance 
( in=mation t may be inaccurate )       
respect to a p>ticul> individual :5 t   
in=mation is be+ collect$ or ma9ta9$    
solely--  7,i7 = ! purpose ( indicat+   
:e!r !re may be a discrepancy or        
irregul>ity 9 ! p]sonal in=mation t is  
associat$ ) an individual2 &  7,,ii7 to 
help id5tify1 or au!nticate ! id5tity (1
 an individual1 or to protect aga9/ or  
inve/igate fraud or o!r unlawful        
conduct4  7,b7 ,consum] access to       
in=mation  7i7 ,access ,ea* in=mation   
brok] %all--  7,i7 provide to ea*       
individual ^: p]sonal in=mation x       

ma9ta9s1 at ! individual's reque/ at    
lea/ #a "t p] ye> & at no co/ to !      
individual1 & aft] v]ify+ ! id5tity (   
su* individual1 a means = ! individual  
to review any p]sonal in=mation reg>d+  
su* individual ma9ta9$ by ! in=mation   
brok] & any o!r in=mation ma9ta9$ by !  
in=mation brok] t specifically id5tifies
 su* individual1 o!r ?an in=mation :i*  
m]ely id5tifies an individual's "n or   
address2 &  7,,ii7 place a conspicu\s   
notice on its ,int]net website 7if !    
in=mation brok] ma9ta9s su* a website7  
in/ruct+ individuals h[ to reque/ access
 to ! in=mation requir$ to be provid$ "u
 subclause 7,i71 &1 z applicable1 h[ to 
express a pref]5ce ) respect to ! use ( 
p]sonal in=mation = m>ket+ purposes "u  
clause 7iii74  7ii7 ,disput$ in=mation  
,:5ev] an individual ^: in=mation !     
in=mation brok] ma9ta9s makes a writt5  
reque/ disput+ ! accuracy ( any su*     
in=mation1 ! in=mation brok]1 aft]      
v]ify+ ! id5tity ( ! individual mak+ su*
 reque/ & unless !re are reasonable     

gr\nds to believe su* reque/ is frivol\s
 or irrelevant1 %all--  7,i7 correct any
 inaccuracy2 or  7,,ii7  7aa7 9 ! case (
 in=mation t is public record in=mation1
 in=m ! individual ( ! s\rce ( !        
in=mation1 &1 if reasonably available1  
:]e a reque/ = correction may be direct$
 &1 if ! individual provides pro( t !   
public record has be5 correct$ or t !   
in=mation brok] 0 report+ ! in=mation   
incorrectly1 correct ! inaccuracy 9 !   
in=mation brok]'s records2 or  7bb7 9 ! 
case ( in=mation t is non-public        
in=mation1 note ! in=mation t is        
disput$1 includ+ ! individual's /atem5t 
disput+ su* in=mation1 & take reasonable
 /eps to indep5d5tly v]ify su* in=mation
 "u ! proc$ures outl9$ 9 subp>agraph    
7,a7 if su* in=mation c be indep5d5tly  
v]ifi$4  7iii7 ,alt]native proc$ure =   
c]ta9 m>ket+ in=mation ,9 accordance )  
regulations issu$ "u clause 7v71 an     
in=mation brok] t ma9ta9s any in=mation 
describ$ 9 clause 7i7 :i* is us$1 %>$1  
or sold by su* in=mation brok] = m>ket+ 

purposes1 may1 9 lieu ( comply+ ) !     
access & dispute requirem5ts set =? 9   
clauses 7i7 & 7ii71 provide ea*         
individual ^: in=mation x ma9ta9s ) a   
reasonable means ( express+ a pref]5ce n
 to h 8 or h] in=mation us$ = su*       
purposes4 ,if ! individual expresses su*
 a pref]5ce1 ! in=mation brok] may n    
use1 %>e1 or sell ! individual's        
in=mation = m>ket+ purposes4  7iv7      
,limitations ,an in=mation brok] may    
limit ! access to in=mation requir$ "u  
clause 7i77,i7 & is n requir$ to provide
 notice to individuals z requir$ "u     
clause 7i77,,ii7 9 ! foll[+             
circum/ances3  7,i7 ,if access ( !      
individual to ! in=mation is limit$ by  
law or legally recogniz$ privilege4     
7,,ii7 ,if ! in=mation is us$ = a       
legitimate gov]nm5tal or fraud prev5tion
 purpose t w\ld be compromis$ by su*    
access4  7,,iii7 ,if ! in=mation consi/s
 ( a publi%$ m$ia record1 unless t      
record has be5 includ$ 9 a report ab\t  
an individual %>$ ) a ?ird p>ty4  7v7   

,rulemak+ ,n lat] ?an #a ye> aft] ! date
 ( ! enactm5t ( ?is ,act1 ! ,commission 
%all promulgate regulations "u section  
#eec ( title #e1 ,unit$ ,/ates ,code1 to
 c>ry out ?is p>agraph & to facilitate !
 purposes ( ?is ,act4 ,9 addition1 !    
,commission %all issue regulations1 z   
necess>y1 "u section #eec ( title #e1   
,unit$ ,/ates ,code1 on ! scope ( !     
application ( ! limitations 9 clause    
7iv71 includ+ any additional            
circum/ances 9 :i* an in=mation brok]   
may limit access to in=mation "u su*    
clause t ! ,commission det]m9es to be   
appropriate4  7,c7 ,,fcra regulat$      
p]sons ,any in=mation brok] :o is engag$
 9 activities subject to ! ,fair ,cr$it 
,report+ ,act & :o is 9 compliance )    
sections #fji1 #faj1 & #faa ( su* ,act  
7#ae ,u4,s4,c4 #afha;g2 #afha;h2        
#afha;i7 ) respect to in=mation subject 
to su* ,act1 %all be deem$ to be 9      
compliance ) ?is p>agraph ) respect to  
su* in=mation4  7#d7 ,requirem5t ( audit
 log ( access$ & transmitt$ in=mation ,n

 lat] ?an #a ye> aft] ! date ( !        
enactm5t ( ?is ,act1 ! ,commission %all 
promulgate regulations "u section #eec (
 title #e1 ,unit$ ,/ates ,code1 to      
require in=mation brok]s to e/abli%     
measures :i* facilitate ! audit+ or     
retrac+ ( any int]nal or ext]nal access 
to1 or transmissions (1 any data conta9+
 p]sonal in=mation collect$1 assembl$1  
or ma9ta9$ by su* in=mation brok]4  7#e7
 ,prohibition on pretext+ by in=mation  
brok]s  7,a7 ,prohibition on obta9+     
p]sonal in=mation by false pret5ses ,x  
%all be unlawful = an in=mation brok] to
 obta9 or attempt to obta91 or cause to 
be disclos$ or attempt to cause to be   
disclos$ to any p]son1 p]sonal in=mation
 or any o!r in=mation relat+ to any     
p]son by--  7i7 mak+ a false1 fictiti\s1
 or fraudul5t /atem5t or repres5tation  
to any p]son2 or  7ii7 provid+ any      
docum5t or o!r in=mation to any p]son t 
! in=mation brok] kn[s or %\ld "k to be 
=g$1 c\nt]feit1 lo/1 /ol51 or           
fraudul5tly obta9$1 or to conta9 a      

false1 fictiti\s1 or fraudul5t /atem5t  
or repres5tation4  7,b7 ,prohibition on 
solicitation to obta9 p]sonal in=mation 
"u false pret5ses ,x %all be unlawful = 
an in=mation brok] to reque/ a p]son to 
obta9 p]sonal in=mation or any o!r      
in=mation relat+ to any o!r p]son1 if ! 
in=mation brok] knew or %\ld h kn[n t ! 
p]son to :om su* a reque/ is made w     
obta9 or attempt to obta9 su* in=mation 
9 ! mann] describ$ 9 subp>agraph 7,a74  
7c7 ,exemption = c]ta9 s]vice provid]s  
,no?+ 9 ?is section %all apply to a     
s]vice provid] = any electronic         
communication by a ?ird p>ty t is       
transmitt$1 r\t$1 or /or$ 9 int]m$iate  
or transi5t /orage by su* s]vice        
provid]4  #c4 ,notification ( in=mation 
security brea*  7a7 ,nationwide         
,notification ,any p]son engag$ 9       
int]/ate comm]ce t owns or possesses    
data 9 electronic =m conta9+ p]sonal    
in=mation %all1 foll[+ ! discov]y ( a   
brea* ( security ( ! sy/em ma9ta9$ by   
su* p]son t conta9s su* data--  7#a7    

notify ea* individual :o is a citiz5 or 
resid5t ( ! ,unit$ ,/ates ^: p]sonal    
in=mation 0 acquir$ or access$ z a      
result ( su* a brea* ( security2 &  7#b7
 notify ! ,commission4  7b7 ,special    
,notification ,requirem5ts  7#a7 ,?ird  
p>ty ag5ts ,9 ! ev5t ( a brea* (        
security by any ?ird p>ty entity t has  
be5 contract$ to ma9ta9 or process data 
9 electronic =m conta9+ p]sonal         
in=mation on behalf ( any o!r p]son :o  
owns or possesses su* data1 su* ?ird    
p>ty entity %all be requir$ to notify   
su* p]son ( ! brea* ( security4 ,^u     
receiv+ su* notification f su* ?ird     
p>ty1 su* p]son %all provide !          
notification requir$ "u subsection 7a74 
7#b7 ,s]vice provid]s ,if a s]vice      
provid] becomes aw>e ( a brea* (        
security ( data 9 electronic =m conta9+ 
p]sonal in=mation t is own$ or possess$ 
by ano!r p]son t connects to or uses a  
sy/em or network provid$ by ! s]vice    
provid] = ! purpose ( transmitt+1 r\t+1 
or provid+ int]m$iate or transi5t /orage

 ( su* data1 su* s]vice provid] %all be 
requir$ to notify ( su* a brea* (       
security only ! p]son :o initiat$ su*   
connection1 transmission1 r\t+1 or      
/orage if su* p]son c be reasonably     
id5tifi$4 ,^u receiv+ su* notification f
 a s]vice provid]1 su* p]son %all       
provide ! notification requir$ "u       
subsection 7a74  7#c7 ,coord9ation (    
notification ) consum] report+ ag5cies  
,if a p]son is requir$ to provide       
notification to m ?an #e1jjj individuals
 "u subsection 7a77#a71 ! p]son %all    
also notify ! major consum] report+     
ag5cies ( ! tim+ & di/ribution ( !      
notices4 ,su* notice %all be giv5 to !  
consum] report+ ag5cies )\t unreasonable
 delay &1 if x w n delay notice to !    
affect$ individuals1 prior to !         
di/ribution ( notices to ! affect$      
individuals4  7c7 ,timel9ess (          
,notification  7#a7 ,9 g5]al ,unless    
subject to a delay au?oriz$ "u p>agraph 
7#b71 a notification requir$ "u         
subsection 7a7 %all be made n lat] ?an  

#fj days foll[+ ! discov]y ( a brea* (  
security1 unless ! p]son provid+ notice 
c %[ t provid+ notice )9 su* a "t frame 
is n feasible due to extraord9>y        
circum/ances necess>y to prev5t fur!r   
brea* or unau?oriz$ disclosures1 &      
reasonably re/ore ! integrity ( ! data  
sy/em1 9 :i* case su* notification %all 
be made z promptly z possible4  7#b7    
,delay ( ,notification ,au?oriz$ = ,law 
,en=cem5t or ,national ,security        
,purposes  7,a7 ,law en=cem5t ,if a     
,f$]al1 ,/ate1 or local law en=cem5t    
ag5cy det]m9es t ! notification requir$ 
"u ?is section w\ld imp$e a civil or    
crim9al inve/igation1 su* notification  
%all be delay$ ^u ! writt5 reque/ ( !   
law en=cem5t ag5cy = #cj days or su*    
less] p]iod ( "t :i* ! law en=cem5t     
ag5cy det]m9es is reasonably necess>y & 
reque/s 9 writ+4 ,a law en=cem5t ag5cy  
may1 by a subsequ5t writt5 reque/1      
revoke su* delay or ext5d ! p]iod ( "t  
set =? 9 ! orig9al reque/ made "u ?is   
p>agraph if fur!r delay is necess>y4    

7,b7 ,national security ,if a ,f$]al    
national security ag5cy or homel&       
security ag5cy det]m9es t ! notification
 requir$ "u ?is section w\ld ?reat5     
national or homel& security1 su*        
notification may be delay$ = a p]iod (  
"t :i* ! national security ag5cy or     
homel& security ag5cy det]m9es is       
reasonably necess>y & reque/s 9 writ+4  
,a ,f$]al national security ag5cy or    
homel& security ag5cy may revoke su*    
delay or ext5d ! p]iod ( "t set =? 9 !  
orig9al reque/ made "u ?is p>agraph by a
 subsequ5t writt5 reque/ if fur!r delay 
is necess>y4  7d7 ,me?od & ,cont5t (    
,notification  7#a7 ,direct notification
  7,a7 ,me?od ( notification ,a p]son   
requir$ to provide notification to      
individuals "u subsection 7a77#a7 %all  
be 9 compliance ) su* requirem5t if !   
p]son provides conspicu\s & cle>ly      
id5tifi$ notification by "o ( ! foll[+  
me?ods 7provid$ ! select$ me?od c       
reasonably be expect$ to rea* ! int5d$  
individual73  7i7 ,writt5 notification4 

7ii7 ,notification by email or o!r      
electronic means1 if--  7,i7 ! p]son's  
prim>y me?od ( communication ) !        
individual is by email or su* o!r       
electronic means2 or  7,,ii7 !          
individual has cons5t$ to receive su*   
notification & ! notification is provid$
 9 a mann] t is consi/5t ) ! provisions 
p]mitt+ electronic transmission (       
notices "u section #aja ( ! ,electronic 
,signatures 9 ,global & ,national       
,comm]ce ,act 7#ae ,u4,s4,c4 #gjja74    
7,b7 ,cont5t ( notification ,reg>dless (
 ! me?od by :i* notification is provid$ 
to an individual "u subp>agraph 7,a71   
su* notification %all include--  7i7 a  
description ( ! p]sonal in=mation t 0   
acquir$ or access$ by an unau?oriz$     
p]son2  7ii7 a telephone numb] t !      
individual may use1 at no co/ to su*    
individual1 to contact ! p]son to       
inquire ab\t ! brea* ( security or !    
in=mation ! p]son ma9ta9$ ab\t t        
individual2  7iii7 notice t ! individual
 is entitl$ to receive1 at no co/ to su*

 individual1 consum] cr$it reports on a 
qu>t]ly basis = a p]iod ( #b ye>s1 or   
cr$it monitor+ or o!r s]vice t enables  
consum]s to detect ! misuse ( _! p]sonal
 in=mation = a p]iod ( #b ye>s1 &       
in/ructions to ! individual on reque/+  
su* reports or s]vice f ! p]son1 except 
:5 ! only in=mation :i* has be5 !       
subject ( ! security brea* is !         
individual's fir/ "n or initial & la/   
"n1 or address1 or phone numb]1 9       
comb9ation ) a cr$it or debit c>d numb]1
 & any requir$ security code2  7iv7 !   
toll-free contact telephone numb]s &    
addresses = ! major consum] report+     
ag5cies2 &  7v7 a toll-free telephone   
numb] & ,int]net website address = !    
,commission :]eby ! individual may obta9
 in=mation reg>d+ id5tity !ft4  7#b7    
,sub/itute notification  7,a7           
,circum/ances giv+ rise to sub/itute    
notification ,a p]son requir$ to provide
 notification to individuals "u         
subsection 7a77#a7 may provide sub/itute
 notification 9 lieu ( ! direct         

notification requir$ by p>agraph 7#a7 if
 ! p]son owns or possesses data 9       
electronic =m conta9+ p]sonal in=mation 
( few] ?an #a1jjj individuals & su*     
direct notification is n feasible due   
to--  7i7 excessive co/ to ! p]son      
requir$ to provide su* notification     
relative to ! res\rces ( su* p]son1 z   
det]m9$ 9 accordance ) ! regulations    
issu$ by ! ,commission "u p>agraph      
7#c77;,a72 or  7ii7 lack ( suffici5t    
contact in=mation = ! individual requir$
 to be notifi$4  7,b7 ,=m ( sub/itute   
notification ,su* sub/itute notification
 %all include--  7i7 email notification 
to ! ext5t t ! p]son has email addresses
 ( individuals to :om x is requir$ to   
provide notification "u subsection      
7a77#a72  7ii7 a conspicu\s notice on ! 
,int]net website ( ! p]son 7if su* p]son
 ma9ta9s su* a website72 &  7iii7       
notification 9 pr9t & to broadca/ m$ia1 
includ+ major m$ia 9 metropolitan &     
rural areas :]e ! individuals ^: p]sonal
 in=mation 0 acquir$ reside4  7,c7      

,cont5t ( sub/itute notice ,ea* =m (    
sub/itute notice "u ?is p>agraph %all   
include--  7i7 notice t individuals ^:  
p]sonal in=mation is includ$ 9 ! brea* (
 security are entitl$ to receive1 at no 
co/ to ! individuals1 consum] cr$it     
reports on a qu>t]ly basis = a p]iod (  
#b ye>s1 or cr$it monitor+ or o!r s]vice
 t enables consum]s to detect ! misuse (
 _! p]sonal in=mation = a p]iod ( #b    
ye>s1 & in/ructions on reque/+ su*      
reports or s]vice f ! p]son1 except :5 !
 only in=mation :i* has be5 ! subject ( 
! security brea* is ! individual's fir/ 
"n or initial & la/ "n1 or address1 or  
phone numb]1 9 comb9ation ) a cr$it or  
debit c>d numb]1 & any requir$ security 
code2 &  7ii7 a telephone numb] by :i*  
an individual c1 at no co/ to su*       
individual1 le>n :e!r t individual's    
p]sonal in=mation is includ$ 9 ! brea* (
 security4  7#c7 ,regulations & guidance
  7,a7 ,regulations ,n lat] ?an #a ye>  
aft] ! date ( enactm5t ( ?is ,act1 !    
,commission %all1 by regulation "u      

section #eec ( title #e1 ,unit$ ,/ates  
,code1 e/abli% crit]ia = det]m9+        
circum/ances "u :i* sub/itute           
notification may be provid$ "u p>agraph 
7#b71 includ+ crit]ia = det]m9+ if      
notification "u p>agraph 7#a7 is n      
feasible due to excessive co/s to !     
p]son requir$ to provid$ su*            
notification relative to ! res\rces (   
su* p]son4 ,su* regulations may also    
id5tify o!r circum/ances :]e sub/itute  
notification w\ld be appropriate = any  
p]son1 includ+ circum/ances "u :i* ! co/
 ( provid+ notification exce$s ! b5efits
 to consum]s4  7,b7 ,guidance ,9        
addition1 ! ,commission %all provide &  
publi% g5]al guidance ) respect to      
compliance ) ?is subsection4 ,su*       
guidance %all include--  7i7 a          
description ( writt5 or email           
notification t complies ) ! requirem5ts 
( p>agraph 7#a72 &  7ii7 guidance on !  
cont5t ( sub/itute notification "u      
p>agraph 7#b71 includ+ ! ext5t (        
notification to pr9t & broadca/ m$ia t  

complies ) ! requirem5ts ( su* p>agraph4
  7e7 ,o!r ,obligations ,foll[+ ,brea*  
7#a7 ,9 g5]al ,a p]son requir$ to       
provide notification "u subsection 7a7  
%all1 ^u reque/ ( an individual ^:      
p]sonal in=mation 0 includ$ 9 ! brea* ( 
security1 provide or arrange = !        
provision (1 to ea* su* individual & at 
no co/ to su* individual--  7,a7 consum]
 cr$it reports f at lea/ "o ( ! major   
consum] report+ ag5cies beg9n+ n lat]   
?an #fj days foll[+ ! individual's      
reque/ & cont9u+ on a qu>t]ly basis = a 
p]iod ( #b ye>s !reaft]2 or  7,b7 a     
cr$it monitor+ or o!r s]vice t enables  
consum]s to detect ! misuse ( _! p]sonal
 in=mation1 beg9n+ n lat] ?an #fj days  
foll[+ ! individual's reque/ & cont9u+ =
 a p]iod ( #b ye>s4  7#b7 ,limitation   
,?is subsection %all n apply if ! only  
p]sonal in=mation :i* has be5 ! subject 
( ! security brea* is ! individual's    
fir/ "n or initial & la/ "n1 or address1
 or phone numb]1 9 comb9ation ) a cr$it 
or debit c>d numb]1 & any requir$       

security code4  7#c7 ,rulemak+ ,z "p ( !
 ,commission's rulemak+ describ$ 9      
subsection 7d77#c71 ! ,commission %all  
det]m9e ! circum/ances "u :i* a p]son   
requir$ to provide notification "u      
subsection 7a77#a7 %all provide or      
arrange = ! provision ( free consum]    
cr$it reports or cr$it monitor+ or o!r  
s]vice to affect$ individuals4  7f7     
,exemption  7#a7 ,g5]al exemption ,a    
p]son %all be exempt f ! requirem5ts "u 
?is section if1 foll[+ a brea* (        
security1 su* p]son det]m9es t !re is no
 reasonable risk ( id5tity !ft1 fraud1  
or o!r unlawful conduct4  7#b7          
,presumption  7,a7 ,9 g5]al ,if ! data 9
 electronic =m conta9+ p]sonal in=mation
 is r5d]$ unusable1 unreadable1 or      
indeciph]able ?r\gh encryption or o!r   
security te*nology or me?odology 7if !  
me?od ( encryption or su* o!r te*nology 
or me?odology is g5]ally accept$ by     
exp]ts 9 ! in=mation security field71   
!re %all be a presumption t no          
reasonable risk ( id5tity !ft1 fraud1 or

 o!r unlawful conduct exi/s foll[+ a    
brea* ( security ( su* data4 ,any su*   
presumption may be rebutt$ by facts     
demon/rat+ t ! encryption or o!r        
security te*nologies or me?odologies 9 a
 specific case1 h be5 or are reasonably 
likely to be compromis$4  7,b7          
me?odologies or te*nologies ,n lat] ?an 
#a ye> aft] ! date ( ! enactm5t ( ?is   
,act & biannually !reaft]1 ! ,commission
 %all issue rules 7pursuant to section  
#eec ( title #e1 ,unit$ ,/ates ,code7 or
 guidance to id5tify security           
me?odologies or te*nologies :i* r5d]    
data 9 electronic =m unusable1          
unreadable1 or indeciph]able1 t %all1 if
 appli$ to su* data1 e/abli% a          
presumption t no reasonable risk (      
id5tity !ft1 fraud1 or o!r unlawful     
conduct exi/s foll[+ a brea* ( security 
( su* data4 ,any su* presumption may be 
rebutt$ by facts demon/rat+ t any su*   
me?odology or te*nology 9 a specific    
case has be5 or is reasonably likely to 
be compromis$4 ,9 issu+ su* rules or    

guidance1 ! ,commission %all consult )  
relevant indu/ries1 consum]             
organizations1 & data security & id5tity
 !ft prev5tion exp]ts & e/abli%$ /&>ds  
sett+ bodies4  7#c7 ,,ftc guidance ,n   
lat] ?an #a ye> aft] ! date ( ! enactm5t
 ( ?is ,act ! ,commission %all issue    
guidance reg>d+ ! application ( !       
exemption 9 p>agraph 7#a74  7g7 ,website
 ,notice ( ,f$]al ,trade ,commission ,if
 ! ,commission1 ^u receiv+ notification 
( any brea* ( security t is report$ to !
 ,commission "u subsection 7a77#b71 f9ds
 t notification ( su* a brea* ( security
 via ! ,commission's ,int]net website   
w\ld be 9 ! public int]e/ or = !        
protection ( consum]s1 ! ,commission    
%all place su* a notice 9 a cle> &      
conspicu\s location on its ,int]net     
website4  7h7 ,,ftc ,/udy on            
,notification 9 ,languages 9 ,addition  
to ,engli% ,n lat] ?an #a ye> aft] !    
date ( enactm5t ( ?is ,act1 !           
,commission %all conduct a /udy on !    
practicality & co/ effectiv5ess (       

requir+ ! notification requir$ by       
subsection 7d77#a7 to be provid$ 9 a    
language 9 addition to ,engli% to       
individuals kn[n to speak only su* o!r  
language4  7i7 ,g5]al rulemak+ au?ority 
,! ,commission may promulgate           
regulations necess>y "u section #eec (  
title #e1 ,unit$ ,/ates ,code1 to       
effectively en=ce ! requirem5ts ( ?is   
section4  7j7 ,treatm5t ( p]sons gov]n$ 
by o!r law ,a p]son :o is 9 compliance )
 any o!r ,f$]al law t requires su* p]son
 to provide notification to individuals 
foll[+ a brea* ( security1 & t1 tak5 z a
 :ole1 provides protections sub/antially
 simil> to1 or great] ?an1 ^? requir$ "u
 ?is section1 z ! ,commission %all      
det]m9e by rule 7"u section #eec ( title
 #e1 ,unit$ ,/ates ,code71 %all be deem$
 to be 9 compliance ) ?is section4  #d4 
,application & ,en=cem5t  7a7 ,g5]al    
application ,! requirem5ts ( sections #b
 & #c %all only apply to ^? p]sons1     
p>tn]%ips1 or corporations ov] :i* !    
,commission has au?ority pursuant to    

section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b774  7b7 ,en=cem5t by ! ,f$]al
 ,trade ,commission  7#a7 ,unfair or    
deceptive acts or practices ,a violation
 ( section #b or #c %all be treat$ z an 
unfair & deceptive act or practice 9    
violation ( a regulation "u section     
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b77 reg>d+ unfair or     
deceptive acts or practices4  7#b7 ,p[]s
 ( commission ,! ,commission %all en=ce 
?is ,act 9 ! same mann]1 by ! same      
means1 & ) ! same jurisdiction1 p[]s1 & 
duties z ?\gh all applicable t]ms &     
provisions ( ! ,f$]al ,trade ,commission
 ,act 7#ae ,u4,s4,c4 #da et seq47 7     
incorporat$ into & made a "p ( ?is ,act4
 ,any p]son :o violates su* regulations 
%all be subject to ! p5alties & entitl$ 
to ! privileges & immunities provid$ 9 t
 ,act4  7#c7 ,limitation ,9 promulgat+  
rules "u ?is ,act1 ! ,commission %all n 
require ! deploym5t or use ( any        

specific products or te*nologies1       
includ+ any specific comput] s(tw>e or  
h>dw>e4  7c7 ,en=cem5t by ,/ate         
,attorneys ,g5]al  7#a7 ,civil action ,9
 any case 9 :i* ! attorney g5]al ( a    
,/ate1 or an (ficial or ag5cy ( a ,/ate1
 has reason to believe t an int]e/ ( !  
resid5ts ( t ,/ate has be5 or is ?reat5$
 or adv]sely affect$ by any p]son :o    
violates section #b or #c ( ?is ,act1 ! 
attorney g5]al1 (ficial1 or ag5cy ( !   
,/ate1 z p>5s patriae1 may br+ a civil  
action on behalf ( ! resid5ts ( ! ,/ate 
9 a di/rict c\rt ( ! ,unit$ ,/ates (    
appropriate jurisdiction--  7,a7 to     
enjo9 fur!r violation ( su* section by !
 def5dant2  7,b7 to compel compliance ) 
su* section2 or  7,c7 to obta9 civil    
p5alties 9 ! am\nt det]m9$ "u p>agraph  
7#b74  7#b7 ,civil p5alties  7,a7       
,calculation  7i7 ,treatm5t ( violations
 ( section #b ,= purposes ( p>agraph    
7#a77;,c7 ) reg>d to a violation (      
section #b1 ! am\nt det]m9$ "u ?is      
p>agraph is ! am\nt calculat$ by        

multiply+ ! numb] ( days t a p]son is n 
9 compliance ) su* section by an am\nt n
 great] ?an #aa1jjj4  7ii7 ,treatm5t (  
violations ( section #c ,= purposes (   
p>agraph 7#a77;,c7 ) reg>d to a         
violation ( section #c1 ! am\nt det]m9$ 
"u ?is p>agraph is ! am\nt calculat$ by 
multiply+ ! numb] ( violations ( su*    
section by an am\nt n great] ?an        
#aa1jjj4 ,ea* failure to s5d            
notification z requir$ "u section #c to 
a resid5t ( ! ,/ate %all be treat$ z a  
sep>ate violation4  7,b7 ,adju/m5t =    
inflation ,beg9n+ on ! date t ! ,consum]
 ,price ,index is fir/ publi%$ by !     
,bureau ( ,labor ,/ati/ics t is aft] #a 
ye> aft] ! date ( enactm5t ( ?is ,act1 &
 ea* ye> !reaft]1 ! am\nts specifi$ 9   
clauses 7i7 & 7ii7 ( subp>agraph 7,a7   
%all be increas$ by ! p]c5tage increase 
9 ! ,consum] ,price ,index publi%$ on t 
date f ! ,consum] ,price ,index publi%$ 
! previ\s ye>4  7,c7 ,maximum total     
liability ,not)/&+ ! numb] ( actions :i*
 may be br\ght aga9/ a p]son "u ?is     

subsection1 ! maximum civil p5alty = :i*
 any p]son may be liable "u ?is         
subsection %all n exce$--  7i7          
#e1jjj1jjj = ea* violation ( section #b2
 &  7ii7 #e1jjj1jjj = all violations (  
section #c result+ f a s+le brea* (     
security4  7#c7 ,int]v5tion by ! ,,ftc  
7,a7 ,notice & int]v5tion ,! ,/ate %all 
provide prior writt5 notice ( any action
 "u p>agraph 7#a7 to ! ,commission &    
provide ! ,commission ) a copy ( its    
compla9t1 except 9 any case 9 :i* su*   
prior notice is n feasible1 9 :i* case !
 ,/ate %all s]ve su* notice imm$iately  
^u in/itut+ su* action4 ,! ,commission  
%all h ! "r--  7i7 to int]v5e 9 !       
action2  7ii7 ^u s int]v5+1 to be he>d  
on all matt]s aris+ !re92 &  7iii7 to   
file petitions = appeal4  7,b7          
,limitation on /ate action :ile f$]al   
action is p5d+ ,if ! ,commission has    
in/itut$ a civil action = violation (   
?is ,act1 no ,/ate attorney g5]al1 or   
(ficial or ag5cy ( a ,/ate1 may br+ an  
action "u ?is subsection dur+ ! p5d5cy (

 t action aga9/ any def5dant nam$ 9 !   
compla9t ( ! ,commission = any violation
 ( ?is ,act alleg$ 9 ! compla9t4  7#d7  
,con/ruction ,= purposes ( br++ any     
civil action "u p>agraph 7#a71 no?+ 9   
?is ,act %all be con/ru$ to prev5t an   
attorney g5]al ( a ,/ate f ex]cis+ !    
p[]s conf]r$ on ! attorney g5]al by !   
laws ( t ,/ate to--  7,a7 conduct       
inve/igations2  7,b7 adm9i/] oa?s or    
affirmations2 or  7,c7 compel !         
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7d7           
,affirmative ,def5se = a ,violation (   
section #c  7#a7 ,9 g5]al ,x %all be an 
affirmative def5se to an en=cem5t action
 br\ght "u subsection 7b71 or a civil   
action br\ght "u subsection 7c71 bas$ on
 a violation ( section #c1 t all ( !    
p]sonal in=mation conta9$ 9 ! data 9    
electronic =m t 0 acquir$ or access$ z a
 result ( a brea* ( security ( !        
def5dant is public record in=mation t is
 lawfully made available to ! g5]al     
public f ,f$]al1 ,/ate1 or local        

gov]nm5t records & 0 acquir$ by !       
def5dant f su* records4  7#b7 ,no effect
 on o!r requirem5ts ,no?+ 9 ?is         
subsection %all be con/ru$ to exempt any
 p]son f ! requirem5t to notify !       
,commission ( a brea* ( security z      
requir$ "u section #c7;a74  #e4         
,def9itions ,9 ?is ,act1 ! foll[+       
def9itions apply3  7#a7 ,brea* (        
security ,! t]m brea* ( security means !
 unau?oriz$ acquisition ( data 9        
electronic =m conta9+ p]sonal in=mation4
  7#b7 ,commission ,! t]m ,commission   
means ! ,f$]al ,trade ,commission4  7#c7
 ,consum] report+ ag5cy ,! t]m consum]  
report+ ag5cy has ! mean+ giv5 ! t]m    
consum] report+ ag5cy t compiles &      
ma9ta9s files on consum]s on a          
nationwide basis 9 section #fjc7p7 ( !  
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha;a7p774  7#d7 ,data 9    
electronic =m ,! t]m data 9 electronic  
=m means any data /or$ electronically or
 digitally on any comput] sy/em or o!r  
database & includes recordable tapes &  

o!r mass /orage devices4  7#e7          
,encryption ,! t]m encryption means !   
protection ( data 9 electronic =m 9     
/orage or 9 transit us+ an encryption   
te*nology t has be5 adopt$ by an        
e/abli%$ /&>ds sett+ body :i* r5d]s su* 
data indeciph]able 9 ! abs5ce (         
associat$ cryptographic keys necess>y to
 enable decryption ( su* data4 ,su*     
encryption mu/ include appropriate      
managem5t & safegu>ds ( su* keys to     
protect ! integrity ( ! encryption4     
7#f7 ,id5tity !ft ,! t]m id5tity !ft    
means ! unau?oriz$ use ( ano!r p]son's  
p]sonal in=mation = ! purpose ( engag+ 9
 comm]cial transactions "u ! "n ( su*   
o!r p]son4  7#g7 ,in=mation brok] ,! t]m
 in=mation brok]--  7,a7 means a        
comm]cial entity ^: bus9ess is to       
collect1 assemble1 or ma9ta9 p]sonal    
in=mation conc]n+ individuals :o are n  
curr5t or =m] cu/om]s ( su* entity 9    
ord] to sell su* in=mation or provide   
access to su* in=mation to any          
nonaffiliat$ ?ird p>ty 9 ex*ange =      

consid]ation1 :e!r su* collection1      
assembly1 or ma9t5ance ( p]sonal        
in=mation is p]=m$ by ! in=mation brok] 
directly1 or by contract or subcontract 
) any o!r entity2 &  7,b7 does n include
 a comm]cial entity to ! ext5t t su*    
entity processes in=mation collect$ by &
 receiv$ f a nonaffiliat$ ?ird p>ty     
conc]n+ individuals :o are curr5t or =m]
 cu/om]s or employees ( su* ?ird p>ty to
 enable su* ?ird p>ty to 7#a7 provide   
b5efits = its employees or 7#b7 directly
 transact bus9ess ) its cu/om]s4  7#h7  
,p]sonal in=mation  7,a7 ,def9ition ,!  
t]m p]sonal in=mation means an          
individual's fir/ "n or initial & la/   
"n1 or address1 or phone numb]1 9       
comb9ation ) any #a or m ( ! foll[+ data
 elem5ts = t individual3  7i7 ,social   
,security numb]4  7ii7 ,driv]'s lic5se  
numb]1 passport numb]1 milit>y          
id5tification numb]1 or o!r simil> numb]
 issu$ on a gov]nm5t docum5t us$ to     
v]ify id5tity4  7iii7 ,f9ancial acc\nt  
numb]1 or cr$it or debit c>d numb]1 &   

any requir$ security code1 access code1 
or password t is necess>y to p]mit      
access to an individual's f9ancial      
acc\nt4  7,b7 ,modifi$ def9ition by     
rulemak+ ,! ,commission may1 by rule    
promulgat$ "u section #eec ( title #e1  
,unit$ ,/ates ,code1 modify ! def9ition 
( p]sonal in=mation "u subp>agraph      
7,a7--  7i7 = ! purpose ( section #b to 
! ext5t t su* modification w n          
unreasonably imp$e int]/ate comm]ce1 & w
 accompli% ! purposes ( ?is ,act2 or    
7ii7 = ! purpose ( section #c1 to !     
ext5t t su* modification is necess>y to 
accommodate *anges 9 te*nology or       
practices1 w n unreasonably imp$e       
int]/ate comm]ce1 & w accompli% !       
purposes ( ?is ,act4  7#i7 ,public      
record in=mation ,! t]m public record   
in=mation means in=mation ab\t an       
individual :i* has be5 obta9$ orig9ally 
f records ( a ,f$]al1 ,/ate1 or local   
gov]nm5t entity t are available = public
 inspection4  7#aj7 ,non-public         
in=mation ,! t]m non-public in=mation   

means in=mation ab\t an individual t is 
( a private nature & nei!r available to 
! g5]al public nor obta9$ f a public    
record4  7#aa7 ,s]vice provid] ,! t]m   
s]vice provid] means an entity t        
provides to a us] transmission1 r\t+1   
int]m$iate & transi5t /orage1 or        
connections to its sy/em or network1 =  
electronic communications1 betwe5 or    
among po9ts specifi$ by su* us] (       
mat]ial ( ! us]'s *oos+1 )\t            
modification to ! cont5t ( ! mat]ial z  
s5t or receiv$4 ,any su* entity %all be 
treat$ z a s]vice provid] "u ?is ,act   
only to ! ext5t t x is engag$ 9 !       
provision ( su* transmission1 r\t+1     
int]m$iate & transi5t /orage or         
connections4  #f4 ,effect on o!r laws   
7a7 ,preemption ( ,/ate ,in=mation      
,security ,laws ,?is ,act sup]s$es any  
provision ( a /atute1 regulation1 or    
rule ( a ,/ate or political subdivision 
( a ,/ate1 ) respect to ^? entities     
cov]$ by ! regulations issu$ pursuant to
 ?is ,act1 t expressly--  7#a7 requires 

in=mation security practices & treatm5t 
( data conta9+ p]sonal in=mation simil> 
to any ( ^? requir$ "u section #b2 &    
7#b7 requires notification to           
individuals ( a brea* ( security result+
 9 unau?oriz$ access to or acquisition (
 data 9 electronic =m conta9+ p]sonal   
in=mation4  7b7 ,additional ,preemption 
7#a7 ,9 g5]al ,no p]son o!r ?an a p]son 
specifi$ 9 section #d7;c7 may br+ a     
civil action "u ! laws ( any ,/ate if   
su* action is premis$ 9 :ole or 9 "p ^u 
! def5dant violat+ any provision ( ?is  
,act4  7#b7 ,protection ( consum]       
protection laws ,?is subsection %all n  
be con/ru$ to limit ! en=cem5t ( any    
,/ate consum] protection law by an      
attorney g5]al ( a ,/ate4  7c7          
,protection ( ,c]ta9 ,/ate ,laws ,?is   
,act %all n be con/ru$ to preempt !     
applicability (--  7#a7 ,/ate trespass1 
contract1 or tort law2 or  7#b7 o!r     
,/ate laws to ! ext5t t ^? laws relate  
to acts ( fraud4  7d7 ,pres]vation (    
,,ftc ,au?ority ,no?+ 9 ?is ,act may be 

con/ru$ 9 any way to limit or affect !  
,commission's au?ority "u any o!r       
provision ( law4  #g4 ,effective date   
,?is ,act %all take effect #a ye> aft] !
 date ( enactm5t ( ?is ,act4  #h4       
,au?orization ( appropriations ,!re is  
au?oriz$ to be appropriat$ to !         
,commission #a1jjj1jjj = ea* ( fiscal   
ye>s #bjaa ?r\gh #bjaf to c>ry out ?is  
,act4