,,ii #aac? ,,congress #a/ ,session ,s4 #aaic ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,june #bj1 #bjac ,mr4 ,toomey 7= himself1 ,mr4 ,k+1 ,mr4 ,?une1 ,mr4 ,hell]1 ,mr4 ,blunt1 ,mr4 ,rubio1 ,mr4 ,coats1 & ,mr4 ,rob]ts7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to require c]ta9 entities t collect & ma9ta9 p]sonal in=mation ( individuals to secure su* in=mation & to provide notice to su* individuals 9 ! case ( a brea* ( security involv+ su* in=mation1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,data ,security & ,brea* ,notification ,act ( #bjac4 #b4 ,requirem5ts = in=mation security ,ea* cov]$ entity %all take reasonable measures to protect & secure data 9 electronic =m conta9+ p]sonal in=mation4 #c4 ,notification ( in=mation security brea* 7a7 ,notification 7#a7 ,9 g5]al ,a cov]$ entity t owns or lic5ses data 9 electronic =m conta9+ p]sonal in=mation %all give notice ( any brea* ( security foll[+ discov]y by ! cov]$ entity ( ! brea* ( security to ea* individual :o is a citiz5 or resid5t ( ! ,unit$ ,/ates ^: p]sonal in=mation 0 or t ! cov]$ entity reasonably believes to h be5 access$ & acquir$ by an unau?oriz$ p]son & t ! cov]$ entity reasonably believes has caus$ or w cause id5tity !ft or o!r actual f9ancial h>m4 7#b7 ,law en=cem5t ,a cov]$ entity %all notify ! ,secret ,s]vice or ! ,f$]al ,bureau ( ,inve/igation ( ! fact t a brea* ( security has occurr$ if ! numb] ( individuals ^: p]sonal in=mation ! cov]$ entity reasonably believes to h be5 access$ & acquir$ by an unau?oriz$ p]son exce$s #aj1jjj4 7b7 ,special notification requirem5ts 7#a7 ,?ird-p>ty ag5ts 7,a7 ,9 g5]al ,9 ! ev5t ( a brea* ( security ( a sy/em ma9ta9$ by a ?ird-p>ty entity t has be5 contract$ to ma9ta91 /ore1 or process data 9 electronic =m conta9+ p]sonal in=mation on behalf ( a cov]$ entity :o owns or possesses su* data1 su* ?ird-p>ty entity %all notify su* cov]$ entity ( ! brea* ( security4 7,b7 ,cov]$ entities :o receive notice f ?ird p>ties ,^u receiv+ notification f a ?ird p>ty "u subp>agraph 7,a71 a cov]$ entity %all provide notification z requir$ "u subsection 7a74 7,c7 ,exception = s]vice provid]s ,a s]vice provid] %all n be consid]$ a ?ird-p>ty ag5t = purposes ( ?is p>agraph4 7#b7 ,s]vice provid]s 7,a7 ,9 g5]al ,if a s]vice provid] becomes aw>e ( a brea* ( security involv+ data 9 electronic =m conta9+ p]sonal in=mation t is own$ or possess$ by a cov]$ entity t connects to or uses a sy/em or network provid$ by ! s]vice provid] = ! purpose ( transmitt+1 r\t+1 or provid+ int]m$iate or transi5t /orage ( su* data1 su* s]vice provid] %all notify ! cov]$ entity :o initiat$ su* connection1 transmission1 r\t+1 or /orage if su* cov]$ entity c be reasonably id5tifi$4 7,b7 ,cov]$ entities :o receive notice f s]vice provid]s ,^u receiv+ notification f a s]vice provid] "u subp>agraph 7,a71 a cov]$ entity %all provide notification z requir$ "u subsection 7a74 7c7 ,timel9ess ( notification 7#a7 ,9 g5]al ,unless subject to a delay au?oriz$ "u p>agraph 7#c71 a notification requir$ "u subsection 7a7 ) respect to a brea* ( security %all be made z exp$iti\sly z practicable & )\t unreasonable delay4 7#b7 ,reasonable delay ,= purposes ( p>agraph 7#a71 a delay = ! purpose ( all[+ ! cov]$ entity "t to det]m9e ! scope ( ! brea* ( security1 to id5tify individuals affect$ by ! brea* ( security1 & to re/ore ! reasonable integrity ( ! data sy/em t 0 brea*$1 %all be consid]$ reasonable4 7#c7 ,delay ( notification au?oriz$ = law en=cem5t or national security purposes 7,a7 ,law en=cem5t ,if a ,f$]al law en=cem5t ag5cy det]m9es t ! notification requir$ "u subsection 7a7 w\ld int]f]e ) a civil or crim9al inve/igation1 su* notification %all be delay$ ^u ! writt5 reque/ ( ! law en=cem5t ag5cy = any p]iod :i* ! law en=cem5t ag5cy det]m9es is reasonably necess>y4 ,a law en=cem5t ag5cy may1 by a subsequ5t writt5 reque/1 revoke su* delay or ext5d ! p]iod set =? 9 ! orig9al reque/ made "u ?is subp>agraph by a subsequ5t reque/ if fur!r delay is necess>y4 7,b7 ,national security ,if a ,f$]al national security ag5cy or homel& security ag5cy det]m9es t ! notification requir$ "u ?is section w\ld ?reat5 national or homel& security1 su* notification may be delay$ ^u ! writt5 reque/ ( ! national security ag5cy or homel& security ag5cy = any p]iod :i* ! national security ag5cy or homel& security ag5cy det]m9es is reasonably necess>y4 ,a ,f$]al national security ag5cy or homel& security ag5cy may revoke su* delay or ext5d ! p]iod set =? 9 ! orig9al reque/ made "u ?is subp>agraph by a subsequ5t writt5 reque/ if fur!r delay is necess>y4 7d7 ,me?od & cont5t ( notification 7#a7 ,direct notification 7,a7 ,me?od ( notification ,a cov]$ entity requir$ to provide notification to an individual "u subsection 7a7 %all be 9 compliance ) su* requirem5t if ! cov]$ entity provides su* notice by "o ( ! foll[+ me?ods3 7i7 ,writt5 notification1 s5t to ! po/al address ( ! individual 9 ! records ( ! cov]$ entity4 7ii7 ,telephone4 7iii7 ,email or o!r electronic means4 7,b7 ,cont5t ( notification ,reg>dless ( ! me?od by :i* notification is provid$ to an individual "u subp>agraph 7,a7 ) respect to a brea* ( security1 su* notification1 to ! ext5t practicable1 %all include-- 7i7 ! date1 e/imat$ date1 or e/imat$ date range ( ! brea* ( security2 7ii7 a description ( ! p]sonal in=mation t 0 access$ & acquir$1 or reasonably believ$ to h be5 access$ & acquir$1 by an unau?oriz$ p]son z a "p ( ! brea* ( security2 & 7iii7 in=mation t ! individual c use to contact ! cov]$ entity to inquire ab\t-- 7,i7 ! brea* ( security2 or 7,,ii7 ! p]sonal in=mation ! cov]$ entity ma9ta9$ ab\t t individual4 7#b7 ,sub/itute notification 7,a7 ,circum/ances giv+ rise to sub/itute notification ,a cov]$ entity requir$ to provide notification to an individual "u subsection 7a7 may provide sub/itute notification 9 lieu ( ! direct notification requir$ by p>agraph 7#a7 if su* direct notification is n feasible due to-- 7i7 excessive co/ to ! cov]$ entity requir$ to provide su* notification relative to ! res\rces ( su* cov]$ entity2 or 7ii7 lack ( suffici5t contact in=mation = ! individual requir$ to be notifi$4 7,b7 ,=m ( sub/itute notification ,su* sub/itute notification %all include at lea/ "o ( ! foll[+3 7i7 ,a conspicu\s notice on ! ,int]net website ( ! cov]$ entity 7if su* cov]$ entity ma9ta9s su* a website74 7ii7 ,notification 9 pr9t & to broadca/ m$ia1 includ+ major m$ia 9 metropolitan & rural areas :]e ! individuals ^: p]sonal in=mation 0 acquir$ reside4 7e7 ,treatm5t ( p]sons gov]n$ by o!r ,f$]al law ,except z provid$ 9 section #d7;b71 a cov]$ entity :o is 9 compliance ) any o!r ,f$]al law t requires su* cov]$ entity to provide notification to individuals foll[+ a brea* ( security %all be deem$ to be 9 compliance ) ?is section4 #d4 ,application & en=cem5t 7a7 ,g5]al application ,! requirem5ts ( sections #b & #c apply to-- 7#a7 ^? p]sons1 p>tn]%ips1 or corporations ov] :i* ! ,commission has au?ority pursuant to section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 & 7#b7 not)/&+ section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq474 7b7 ,application to cable op]ators1 satellite op]ators1 & telecommunications c>ri]s ,sections #bbb1 #cch1 & #fca ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb1 #cch1 & #eea71 & any regulations promulgat$ !reund]1 %all n apply ) respect to ! in=mation security practices1 includ+ practices relat+ to ! notification ( unau?oriz$ access to data 9 electronic =m1 ( any cov]$ entity o!rwise subject to ^? sections4 7c7 ,en=cem5t by ,f$]al ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( section #b or #c %all be treat$ z an unfair or deceptive act or practice 9 violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7#b7 ,p[]s ( commission 7,a7 ,9 g5]al ,except z provid$ 9 subsection 7a71 ! ,commission %all en=ce ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 7,b7 ,privileges & immunities ,any p]son :o violates section #b or #c %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 su* ,act4 7#c7 ,maximum total liability ,not)/&+ ! numb] ( actions :i* may be br\ght aga9/ a cov]$ entity "u ?is subsection1 ! maximum civil p5alty = :i* any cov]$ entity may be liable "u ?is subsection = all actions %all n exce$-- 7,a7 #ejj1jjj = all violations ( section #b result+ f ! same relat$ act or omission2 & 7,b7 #ejj1jjj = all violations ( section #c result+ f a s+le brea* ( security4 7d7 ,no private cause ( action ,no?+ 9 ?is ,act %all be con/ru$ to e/abli% a private cause ( action aga9/ a p]son = a violation ( ?is ,act4 #e4 ,def9itions ,9 ?is ,act3 7#a7 ,brea* ( security ,! t]m brea* ( security means unau?oriz$ access & acquisition ( data 9 electronic =m conta9+ p]sonal in=mation4 7#b7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#c7 ,cov]$ entity 7,a7 ,9 g5]al ,! t]m cov]$ entity means a sole proprietor%ip1 p>tn]%ip1 corporation1 tru/1 e/ate1 coop]ative1 association1 or o!r comm]cial entity t acquires1 ma9ta9s1 /ores1 or utilizes p]sonal in=mation4 7,b7 ,exemptions ,! t]m cov]$ entity does n include ! foll[+3 7i7 ,f9ancial in/itutions subject to title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7ii7 ,an entity cov]$ by ! regulations issu$ "u section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7,public ,law #ajd-aia7 to ! ext5t t su* entity is subject to ! requirem5ts ( su* regulations ) respect to protect$ heal? in=mation4 7#d7 ,data 9 electronic =m ,! t]m data 9 electronic =m means any data /or$ electronically or digitally on any comput] sy/em or o!r database & includes recordable tapes & o!r mass /orage devices4 7#e7 ,p]sonal in=mation 7,a7 ,9 g5]al ,! t]m p]sonal in=mation means an individual's fir/ "n or fir/ initial & la/ "n 9 comb9ation ) any #a or m ( ! foll[+ data elem5ts = t individual3 7i7 ,social ,security numb]4 7ii7 ,driv]'s lic5se numb]1 passport numb]1 milit>y id5tification numb]1 or o!r simil> numb] issu$ on a gov]nm5t docum5t us$ to v]ify id5tity4 7iii7 ,f9ancial acc\nt numb] or cr$it or debit c>d numb]1 9 comb9ation ) any requir$ security code1 access code1 or password t is necess>y to p]mit access to an individual's f9ancial acc\nt4 7,b7 ,exclusions 7i7 public record in=mation ,p]sonal in=mation does n include in=mation obta9$ ab\t an individual :i* has be5 lawfully made publicly available by a ,f$]al1 ,/ate1 or local gov]nm5t entity or widely di/ribut$ by m$ia4 7ii7 ,encrypt$1 r$act$1 or secur$ data ,p]sonal in=mation does n include in=mation t is encrypt$1 r$act$1 or secur$ by any o!r me?od or te*nology t removes elem5ts t p]sonally id5tify an individual or t o!rwise r5d]s ! in=mation unusable4 7#f7 ,s]vice provid] ,! t]m s]vice provid] means an entity t provides electronic data transmission1 r\t+1 int]m$iate1 & transi5t /orage1 or connections to its sy/em or network1 :]e su* entity provid+ su* s]vices does n select or modify ! cont5t ( ! electronic data1 is n ! s5d] or ! int5d$ recipi5t ( ! data1 & does n diff]5tiate p]sonal in=mation f o!r in=mation t su* entity transmits1 r\tes1 /ores1 or = :i* su* entity provides connections4 ,any su* entity %all be treat$ z a s]vice provid] "u ?is ,act only to ! ext5t t x is engag$ 9 ! provision ( su* transmission1 r\t+1 int]m$iate & transi5t /orage1 or connections4 #f4 ,effect on o!r laws ,?is ,act preempts any law1 rule1 regulation1 requirem5t1 /&>d1 or o!r provision hav+ ! =ce & effect ( law ( any ,/ate1 or political subdivision ( a ,/ate1 relat+ to ! protection or security ( data 9 electronic =m conta9+ p]sonal in=mation or ! notification ( a brea* ( security4 #g4 ,effective date ,?is ,act %all take effect on ! date t is #a ye> aft] ! date ( enactm5t ( ?is ,act4