,,ii  #aacth ,,congress  #ast ,session  
,s4 #aaic  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,june #bj1     
#bjac ,mr4 ,toomey 7for himself1 ,mr4   
,king1 ,mr4 ,thune1 ,mr4 ,heller1 ,mr4  
,blunt1 ,mr4 ,rubio1 ,mr4 ,coats1 and   
,mr4 ,roberts7 introduced the following 
bill2 which was read twice and referred 
to the ,committee on ,commerce1         
,science1 and ,transportation  ,a ,,bill
  ,to require certain entities that     
collect and maintain personal           
information of individuals to secure    
such information and to provide notice  
to such individuals in the case of a    
breach of security involving such       
information1 and for other purposes4    
#a4 ,short title ,this ,act may be cited
 as the ,data ,security and ,breach     
,notification ,act of #bjac4  #b4       
,requirements for information security  
,each covered entity shall take         
reasonable measures to protect and      
secure data in electronic form          
containing personal information4  #c4   

,notification of information security   
breach  7a7 ,notification  7#a7 ,in     
general ,a covered entity that owns or  
licenses data in electronic form        
containing personal information shall   
give notice of any breach of security   
following discovery by the covered      
entity of the breach of security to each
 individual who is a citizen or resident
 of the ,united ,states whose personal  
information was or that the covered     
entity reasonably believes to have been 
accessed and acquired by an unauthorized
 person and that the covered entity     
reasonably believes has caused or will  
cause identity theft or other actual    
financial harm4  7#b7 ,law enforcement  
,a covered entity shall notify the      
,secret ,service or the ,federal ,bureau
 of ,investigation of the fact that a   
breach of security has occurred if the  
number of individuals whose personal    
information the covered entity          
reasonably believes to have been        
accessed and acquired by an unauthorized

 person exceeds #aj1jjj4  7b7 ,special  
notification requirements  7#a7         
,third-party agents  7,a7 ,in general   
,in the event of a breach of security of
 a system maintained by a third-party   
entity that has been contracted to      
maintain1 store1 or process data in     
electronic form containing personal     
information on behalf of a covered      
entity who owns or possesses such data1 
such third-party entity shall notify    
such covered entity of the breach of    
security4  7,b7 ,covered entities who   
receive notice from third parties ,upon 
receiving notification from a third     
party under subparagraph 7,a71 a covered
 entity shall provide notification as   
required under subsection 7a74  7,c7    
,exception for service providers ,a     
service provider shall not be considered
 a third-party agent for purposes of    
this paragraph4  7#b7 ,service providers
  7,a7 ,in general ,if a service        
provider becomes aware of a breach of   
security involving data in electronic   

form containing personal information    
that is owned or possessed by a covered 
entity that connects to or uses a system
 or network provided by the service     
provider for the purpose of             
transmitting1 routing1 or providing     
intermediate or transient storage of    
such data1 such service provider shall  
notify the covered entity who initiated 
such connection1 transmission1 routing1 
or storage if such covered entity can be
 reasonably identified4  7,b7 ,covered  
entities who receive notice from service
 providers ,upon receiving notification 
from a service provider under           
subparagraph 7,a71 a covered entity     
shall provide notification as required  
under subsection 7a74  7c7 ,timeliness  
of notification  7#a7 ,in general       
,unless subject to a delay authorized   
under paragraph 7#c71 a notification    
required under subsection 7a7 with      
respect to a breach of security shall be
 made as expeditiously as practicable   
and without unreasonable delay4  7#b7   

,reasonable delay ,for purposes of      
paragraph 7#a71 a delay for the purpose 
of allowing the covered entity time to  
determine the scope of the breach of    
security1 to identify individuals       
affected by the breach of security1 and 
to restore the reasonable integrity of  
the data system that was breached1 shall
 be considered reasonable4  7#c7 ,delay 
of notification authorized for law      
enforcement or national security        
purposes  7,a7 ,law enforcement ,if a   
,federal law enforcement agency         
determines that the notification        
required under subsection 7a7 would     
interfere with a civil or criminal      
investigation1 such notification shall  
be delayed upon the written request of  
the law enforcement agency for any      
period which the law enforcement agency 
determines is reasonably necessary4 ,a  
law enforcement agency may1 by a        
subsequent written request1 revoke such 
delay or extend the period set forth in 
the original request made under this    

subparagraph by a subsequent request if 
further delay is necessary4  7,b7       
,national security ,if a ,federal       
national security agency or homeland    
security agency determines that the     
notification required under this section
 would threaten national or homeland    
security1 such notification may be      
delayed upon the written request of the 
national security agency or homeland    
security agency for any period which the
 national security agency or homeland   
security agency determines is reasonably
 necessary4 ,a ,federal national        
security agency or homeland security    
agency may revoke such delay or extend  
the period set forth in the original    
request made under this subparagraph by 
a subsequent written request if further 
delay is necessary4  7d7 ,method and    
content of notification  7#a7 ,direct   
notification  7,a7 ,method of           
notification ,a covered entity required 
to provide notification to an individual
 under subsection 7a7 shall be in       

compliance with such requirement if the 
covered entity provides such notice by  
one of the following methods3  7i7      
,written notification1 sent to the      
postal address of the individual in the 
records of the covered entity4  7ii7    
,telephone4  7iii7 ,email or other      
electronic means4  7,b7 ,content of     
notification ,regardless of the method  
by which notification is provided to an 
individual under subparagraph 7,a7 with 
respect to a breach of security1 such   
notification1 to the extent practicable1
 shall include--  7i7 the date1         
estimated date1 or estimated date range 
of the breach of security2  7ii7 a      
description of the personal information 
that was accessed and acquired1 or      
reasonably believed to have been        
accessed and acquired1 by an            
unauthorized person as a part of the    
breach of security2 and  7iii7          
information that the individual can use 
to contact the covered entity to inquire
 about--  7,i7 the breach of security2  

or  7,,ii7 the personal information the 
covered entity maintained about that    
individual4  7#b7 ,substitute           
notification  7,a7 ,circumstances giving
 rise to substitute notification ,a     
covered entity required to provide      
notification to an individual under     
subsection 7a7 may provide substitute   
notification in lieu of the direct      
notification required by paragraph 7#a7 
if such direct notification is not      
feasible due to--  7i7 excessive cost to
 the covered entity required to provide 
such notification relative to the       
resources of such covered entity2 or    
7ii7 lack of sufficient contact         
information for the individual required 
to be notified4  7,b7 ,form of          
substitute notification ,such substitute
 notification shall include at least one
 of the following3  7i7 ,a conspicuous  
notice on the ,internet website of the  
covered entity 7if such covered entity  
maintains such a website74  7ii7        
,notification in print and to broadcast 

media1 including major media in         
metropolitan and rural areas where the  
individuals whose personal information  
was acquired reside4  7e7 ,treatment of 
persons governed by other ,federal law  
,except as provided in section #d7;b71 a
 covered entity who is in compliance    
with any other ,federal law that        
requires such covered entity to provide 
notification to individuals following a 
breach of security shall be deemed to be
 in compliance with this section4  #d4  
,application and enforcement  7a7       
,general application ,the requirements  
of sections #b and #c apply to--  7#a7  
those persons1 partnerships1 or         
corporations over which the ,commission 
has authority pursuant to section       
#e7;a77#b7 of the ,federal ,trade       
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b772 and  7#b7 notwithstanding 
section #e7;a77#b7 of the ,federal      
,trade ,commission ,act 7#ae ,u4,s4,c4  
#de7;a77#b771 common carriers subject to
 the ,communications ,act of #aicd 7#dg 

,u4,s4,c4 #aea et seq474  7b7           
,application to cable operators1        
satellite operators1 and                
telecommunications carriers ,sections   
#bbb1 #cch1 and #fca of the             
,communications ,act of #aicd 7#dg      
,u4,s4,c4 #bbb1 #cch1 and #eea71 and any
 regulations promulgated thereunder1    
shall not apply with respect to the     
information security practices1         
including practices relating to the     
notification of unauthorized access to  
data in electronic form1 of any covered 
entity otherwise subject to those       
sections4  7c7 ,enforcement by ,federal 
,trade ,commission  7#a7 ,unfair or     
deceptive acts or practices ,a violation
 of section #b or #c shall be treated as
 an unfair or deceptive act or practice 
in violation of a regulation under      
section #ah7;a77#a77;,b7 of the ,federal
 ,trade ,commission ,act 7#ae ,u4,s4,c4 
#eg;a7a77#a77;,b77 regarding unfair or  
deceptive acts or practices4  7#b7      
,powers of commission  7,a7 ,in general 

,except as provided in subsection 7a71  
the ,commission shall enforce this ,act 
in the same manner1 by the same means1  
and with the same jurisdiction1 powers1 
and duties as though all applicable     
terms and provisions of the ,federal    
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 were incorporated into and 
made a part of this ,act4  7,b7         
,privileges and immunities ,any person  
who violates section #b or #c shall be  
subject to the penalties and entitled to
 the privileges and immunities provided 
in such ,act4  7#c7 ,maximum total      
liability ,notwithstanding the number of
 actions which may be brought against a 
covered entity under this subsection1   
the maximum civil penalty for which any 
covered entity may be liable under this 
subsection for all actions shall not    
exceed--  7,a7 #ejj1jjj for all         
violations of section #b resulting from 
the same related act or omission2 and   
7,b7 #ejj1jjj for all violations of     
section #c resulting from a single      

breach of security4  7d7 ,no private    
cause of action ,nothing in this ,act   
shall be construed to establish a       
private cause of action against a person
 for a violation of this ,act4  #e4     
,definitions ,in this ,act3  7#a7       
,breach of security ,the term breach of 
security means unauthorized access and  
acquisition of data in electronic form  
containing personal information4  7#b7  
,commission ,the term ,commission means 
the ,federal ,trade ,commission4  7#c7  
,covered entity  7,a7 ,in general ,the  
term covered entity means a sole        
proprietorship1 partnership1            
corporation1 trust1 estate1 cooperative1
 association1 or other commercial entity
 that acquires1 maintains1 stores1 or   
utilizes personal information4  7,b7    
,exemptions ,the term covered entity    
does not include the following3  7i7    
,financial institutions subject to title
 ,v of the ,gramm-,leach-,bliley ,act   
7#ae ,u4,s4,c4 #fhja et seq474  7ii7 ,an
 entity covered by the regulations      

issued under section #bfd7;c7 of the    
,health ,insurance ,portability and     
,accountability ,act of #aiif 7,public  
,law #ajd-aia7 to the extent that such  
entity is subject to the requirements of
 such regulations with respect to       
protected health information4  7#d7     
,data in electronic form ,the term data 
in electronic form means any data stored
 electronically or digitally on any     
computer system or other database and   
includes recordable tapes and other mass
 storage devices4  7#e7 ,personal       
information  7,a7 ,in general ,the term 
personal information means an           
individual's first name or first initial
 and last name in combination with any  
#a or more of the following data        
elements for that individual3  7i7      
,social ,security number4  7ii7         
,driver's license number1 passport      
number1 military identification number1 
or other similar number issued on a     
government document used to verify      
identity4  7iii7 ,financial account     

number or credit or debit card number1  
in combination with any required        
security code1 access code1 or password 
that is necessary to permit access to an
 individual's financial account4  7,b7  
,exclusions  7i7 public record          
information ,personal information does  
not include information obtained about  
an individual which has been lawfully   
made publicly available by a ,federal1  
,state1 or local government entity or   
widely distributed by media4  7ii7      
,encrypted1 redacted1 or secured data   
,personal information does not include  
information that is encrypted1 redacted1
 or secured by any other method or      
technology that removes elements that   
personally identify an individual or    
that otherwise renders the information  
unusable4  7#f7 ,service provider ,the  
term service provider means an entity   
that provides electronic data           
transmission1 routing1 intermediate1 and
 transient storage1 or connections to   
its system or network1 where such entity

 providing such services does not select
 or modify the content of the electronic
 data1 is not the sender or the intended
 recipient of the data1 and does not    
differentiate personal information from 
other information that such entity      
transmits1 routes1 stores1 or for which 
such entity provides connections4 ,any  
such entity shall be treated as a       
service provider under this ,act only to
 the extent that it is engaged in the   
provision of such transmission1 routing1
 intermediate and transient storage1 or 
connections4  #f4 ,effect on other laws 
,this ,act preempts any law1 rule1      
regulation1 requirement1 standard1 or   
other provision having the force and    
effect of law of any ,state1 or         
political subdivision of a ,state1      
relating to the protection or security  
of data in electronic form containing   
personal information or the notification
 of a breach of security4  #g4          
,effective date ,this ,act shall take   
effect on the date that is #a year after

 the date of enactment of this ,act4