,,ii #aacth ,,congress #b;d ,session ,s4 #ahig ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #h1 #bjad,mr4 ,leahy 7for himself1 ,mr4 ,schumer1 ,mr4 ,franken1 and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on the ,judiciary ,a ,,bill ,to prevent and mitigate identity theft1 to ensure privacy1 to provide notice of security breaches1 and to enhance criminal penalties1 law enforcement assistance1 and other protections against security breaches1 fraudulent access1 and misuse of personally identifiable information4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,personal ,data ,privacy and ,security ,act of #bjad4 7b7 ,table of ,contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,findings4,sec4 #c4 ,definitions4,,title ,i--,enhancing punishment for identity theft and other violations of data privacy and security,sec4 #aja4 ,organized criminal activity in connection with unauthorized access to personally identifiable information4,sec4 #ajb4 ,concealment of security breaches involving sensitive personally identifiable information4,sec4 #ajc4 ,penalties for fraud and related activity in connection with computers4,sec4 #ajd4 ,trafficking in passwords4,sec4 #aje4 ,conspiracy and attempted computer fraud offenses4,sec4 #ajf4 ,criminal and civil forfeiture for fraud and related activity in connection with computers4,sec4 #ajg4 ,limitation on civil actions involving unauthorized use4,sec4 #ajh4 ,reporting of certain criminal cases4,sec4 #aji4 ,damage to critical infrastructure computers4,sec4 #aaj4 ,limitation on actions involving unauthorized use4,,title ,,ii--,privacy and security of personally identifiable information,subtitle ,a--,a ,data ,privacy and ,security ,program,sec4 #bja4 ,purpose and applicability of data privacy and security program4,sec4 #bjb4 ,requirements for a personal data privacy and security program4,sec4 #bjc4 ,enforcement4,sec4 #bjd4 ,relation to other laws4,subtitle ,b--,security ,breach ,notification,sec4 #baa4 ,notice to individuals4,sec4 #bab4 ,exemptions4,sec4 #bac4 ,methods of notice4,sec4 #bad4 ,content of notification4,sec4 #bae4 ,coordination of notification with credit reporting agencies4,sec4 #baf4 ,notice to law enforcement4,sec4 #bag4 ,enforcement4,sec4 #bah4 ,enforcement by ,state attorneys general4,sec4 #bai4 ,effect on ,federal and ,state law4,sec4 #bbj4 ,reporting on exemptions4,sec4 #bba4 ,effective date4,,title ,,iii--,compliance with statutory ,pay-,as-,you-,go ,act,sec4 #cja4 ,budget compliance4 #b4 ,findings ,congress finds that-- 7#a7 databases of personally identifiable information are increasingly prime targets of hackers1 identity thieves1 rogue employees1 and other criminals1 including organized and sophisticated criminal operations2 7#b7 identity theft is a serious threat to the ,nation's economic stability1 national security1 homeland security1 cybersecurity1 the development of e-commerce1 and the privacy rights of ,americans2 7#c7 security breaches are a serious threat to consumer confidence1 homeland security1 national security1 e-commerce1 and economic stability2 7#d7 it is important for business entities that own1 use1 or license personally identifiable information to adopt reasonable procedures to ensure the security1 privacy1 and confidentiality of that personally identifiable information2 7#e7 individuals whose personal information has been compromised or who have been victims of identity theft should receive the necessary information and assistance to mitigate their damages and to restore the integrity of their personal information and identities2 7#f7 data misuse and use of inaccurate data have the potential to cause serious or irreparable harm to an individual's livelihood1 privacy1 and liberty and undermine efficient and effective business and government operations2 7#g7 government access to commercial data can potentially improve safety1 law enforcement1 and national security2 and 7#h7 because government use of commercial data containing personal information potentially affects individual privacy1 and law enforcement and national security operations1 there is a need for ,congress to exercise oversight over government use of commercial data4 #c4 ,definitions ,in this ,act1 the following definitions shall apply3 7#a7 ,affiliate ,the term affiliate means persons related by common ownership or by corporate control4 7#b7 ,agency ,the term agency has the same meaning given such term in section #eea of title #e1 ,united ,states ,code4 7#c7 ,business entity ,the term business entity means any organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture established to make a profit1 or nonprofit4 7#d7 ,data system communication information ,the term data system communication information means dialing1 routing1 addressing1 or signaling information that identifies the origin1 direction1 destination1 processing1 transmission1 or termination of each communication initiated1 attempted1 or received4 7#e7 ,designated entity ,the term designated entity means the ,federal ,government entity designated by the ,secretary of ,homeland ,security under section #baf7;a74 7#f7 ,encryption ,the term encryption-- 7,a7 means the protection of data in electronic form1 in storage or in transit1 using an encryption technology that has been generally accepted by experts in the field of information security that renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data2 and 7,b7 includes appropriate management and safeguards of such cryptographic keys so as to protect the integrity of the encryption4 7#g7 ,identity theft ,the term identity theft means a violation of section #ajbh7;a77#g7 of title #ah1 ,united ,states ,code4 7#h7 ,personally identifiable information ,the term personally identifiable information means any information1 or compilation of information1 in electronic or digital form that is a means of identification1 as defined by section #ajbh7;d77#g7 of title #ah1 ,united ,states ,code4 7#i7 ,public record source ,the term public record source means the ,congress1 any agency1 any ,state or local government agency1 the government of the ,district of ,columbia and governments of the territories or possessions of the ,united ,states1 and ,federal1 ,state or local courts1 courts martial and military commissions1 that maintain personally identifiable information in records available to the public4 7#aj7 ,security breach 7,a7 ,in general ,the term security breach means compromise of the security1 confidentiality1 or integrity of1 or the loss of1 computerized data that result in1 or that there is a reasonable basis to conclude has resulted in-- 7i7 the unauthorized acquisition of sensitive personally identifiable information2 and 7ii7 access to sensitive personally identifiable information that is for an unauthorized purpose1 or in excess of authorization4 7,b7 ,exclusion ,the term security breach does not include-- 7i7 a good faith acquisition of sensitive personally identifiable information by a business entity or agency1 or an employee or agent of a business entity or agency1 if the sensitive personally identifiable information is not subject to further unauthorized disclosure2 7ii7 the release of a public record not otherwise subject to confidentiality or nondisclosure requirements or the release of information obtained from a public record1 including information obtained from a news report or periodical2 or 7iii7 any lawfully authorized investigative1 protective1 or intelligence activity of a law enforcement or intelligence agency of the ,united ,states1 a ,state1 or a political subdivision of a ,state4 7#aa7 ,sensitive personally identifiable information ,the term sensitive personally identifiable information means any information or compilation of information1 in electronic or digital form that includes the following3 7,a7 ,an individual's first and last name or first initial and last name in combination with any two of the following data elements3 7i7 ,home address or telephone number4 7ii7 ,mother's maiden name4 7iii7 ,month1 day1 and year of birth4 7,b7 ,a non-truncated social security number1 driver's license number1 passport number1 or alien registration number or other government-issued unique identification number4 7,c7 ,unique biometric data such as a fingerprint1 voice print1 a retina or iris image1 or any other unique physical representation4 7,d7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7,e7 ,any combination of the following data elements3 7i7 ,an individual's first and last name or first initial and last name4 7ii7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7iii7 ,any security code1 access code1 or password1 or source code that could be used to generate such codes or passwords4 7#ab7 ,service provider ,the term service provider means a business entity that provides electronic data transmission1 routing1 intermediate and transient storage1 or connections to its system or network1 where the business entity providing such services does not select or modify the content of the electronic data1 is not the sender or the intended recipient of the data1 and the business entity transmits1 routes1 stores1 or provides connections for personal information in a manner that personal information is undifferentiated from other types of data that such business entity transmits1 routes1 stores1 or provides connections4 ,any such business entity shall be treated as a service provider under this ,act only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage or connections4 ,i ,enhancing punishment for identity theft and other violations of data privacy and security #aja4 ,organized criminal activity in connection with unauthorized access to personally identifiable information ,section #aifa7a7 of title #ah1 ,united ,states ,code1 is amended by inserting section #ajcj 7relating to fraud and related activity in connection with computers7 if the act is a felony1 before section #ajhd4 #ajb4 ,concealment of security breaches involving sensitive personally identifiable information 7a7 ,in ,general ,chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of security breaches involving sensitive personally identifiable information 7a7 ,in general ,whoever1 having knowledge of a security breach and of the fact that notice of such security breach is required under title ,,ii of the ,personal ,data ,privacy and ,security ,act of #bjad1 intentionally and willfully conceals the fact of such security breach1 shall1 in the event that such security breach results in economic harm to any individual in the amount of #a1jjj or more1 be fined under this tile or imprisoned for not more than #e years1 or both4 7b7 ,person defined ,for purposes of subsection 7a71 the term person has the meaning given the term in section #ajcj7;e77#ab74 7c7 ,notice requirement ,any person seeking an exemption under section #bab7;b7 of the ,personal ,data ,privacy and ,security ,act of #bjad shall be immune from prosecution under this section if the ,federal ,trade ,commission does not indicate1 in writing1 that such notice be given under section #bab7;b77#c7 of such ,act4 4 7b7 ,conforming and ,technical ,amendments ,the table of sections for chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of security breaches involving sensitive personally identifiable information4 4 7c7 ,enforcement authority 7#a7 ,in general ,the ,united ,states ,secret ,service and ,federal ,bureau of ,investigation shall have the authority to investigate offenses under section #ajda of title #ah1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,nonexclusivity ,the authority granted in paragraph 7#a7 shall not be exclusive of any existing authority held by any other ,federal agency4 #ajc4 ,penalties for fraud and related activity in connection with computers ,section #ajcj7;c7 of title #ah1 ,united ,states ,code1 is amended to read as follows3 7c7 ,the punishment for an offense under subsection 7a7 or 7b7 of this section is-- 7#a7 a fine under this title or imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#a7 of this section2 7#b7 7,a7 except as provided in subparagraph 7,b71 a fine under this title or imprisonment for not more than #c years1 or both1 in the case of an offense under subsection 7a77#b72 or 7,b7 a fine under this title or imprisonment for not more than ten years1 or both1 in the case of an offense under paragraph 7a77#b7 of this section1 if-- 7i7 the offense was committed for purposes of commercial advantage or private financial gain2 7ii7 the offense was committed in the furtherance of any criminal or tortious act in violation of the ,constitution or laws of the ,united ,states1 or of any ,state2 or 7iii7 the value of the information obtained1 or that would have been obtained if the offense was completed1 exceeds #e1jjj2 7#c7 a fine under this title or imprisonment for not more than #a year1 or both1 in the case of an offense under subsection 7a77#c7 of this section2 7#d7 a fine under this title or imprisonment of not more than #bj years1 or both1 in the case of an offense under subsection 7a77#d7 of this section2 7#e7 7,a7 except as provided in subparagraph 7,d71 a fine under this title1 imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#e77;,a7 of this section1 if the offense caused-- 7i7 loss to #a or more persons during any #a-year period 7and1 for purposes of an investigation1 prosecution1 or other proceeding brought by the ,united ,states only1 loss resulting from a related course of conduct affecting #a or more other protected computers7 aggregating at least #e1jjj in value2 7ii7 the modification or impairment1 or potential modification or impairment1 of the medical examination1 diagnosis1 treatment1 or care of #a or more individuals2 7iii7 physical injury to any person2 7iv7 a threat to public health or safety2 7v7 damage affecting a computer used by1 or on behalf of1 an entity of the ,united ,states ,government in furtherance of the administration of justice1 national defense1 or national security2 or 7vi7 damage affecting #aj or more protected computers during any #a-year period2 7,b7 a fine under this title1 imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#e77;,b71 if the offense caused a harm provided in clauses 7i7 through 7vi7 of subparagraph 7,a7 of this subsection2 7,c7 if the offender attempts to cause or knowingly or recklessly causes death from conduct in violation of subsection 7a77#e77;,a71 a fine under this title1 imprisonment for any term of years or for life1 or both2 or 7,d7 a fine under this title1 imprisonment for not more than #a year1 or both1 for any other offense under subsection 7a77#e72 7#f7 a fine under this title or imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#f7 of this section2 or 7#g7 a fine under this title or imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#g7 of this section4 4 #ajd4 ,trafficking in passwords ,section #ajcj7;a7 of title #ah1 ,united ,states ,code1 is amended by striking paragraph 7#f7 and inserting the following3 7#f7 knowingly and with intent to defraud traffics 7as defined in section #ajbi7 in-- 7,a7 any password or similar information through which a protected computer as defined in subparagraphs 7,a7 and 7,b7 of subsection 7e77#b7 may be accessed without authorization2 or 7,b7 any means of access through which a protected computer as defined in subsection 7e77#b77;,a7 may be accessed without authorization4 4 #aje4 ,conspiracy and attempted computer fraud offenses ,section #ajcj7;b7 of title #ah1 ,united ,states ,code1 is amended by inserting for the completed offense after punished as provided4 #ajf4 ,criminal and civil forfeiture for fraud and related activity in connection with computers ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by striking subsections 7i7 and 7j7 and inserting the following3 7i7 ,criminal ,forfeiture 7#a7 ,the court1 in imposing sentence on any person convicted of a violation of this section1 or convicted of conspiracy to violate this section1 shall order1 in addition to any other sentence imposed and irrespective of any provision of ,state law1 that such person forfeit to the ,united ,states-- 7,a7 such person's interest in any property1 real or personal1 that was used1 or intended to be used1 to commit or facilitate the commission of such violation2 and 7,b7 any property1 real or personal1 constituting or derived from any gross proceeds1 or any property traceable to such property1 that such person obtained1 directly or indirectly1 as a result of such violation4 7#b7 ,the criminal forfeiture of property under this subsection1 including any seizure and disposition of the property1 and any related judicial or administrative proceeding1 shall be governed by the provisions of section #dac of the ,comprehensive ,drug ,abuse ,prevention and ,control ,act of #aigj 7#ba ,u4,s4,c4 #hec71 except subsection 7d7 of that section4 7j7 ,civil ,forfeiture 7#a7 ,the following shall be subject to forfeiture to the ,united ,states and no property right1 real or personal1 shall exist in them3 7,a7 ,any property1 real or personal1 that was used1 or intended to be used1 to commit or facilitate the commission of any violation of this section1 or a conspiracy to violate this section4 7,b7 ,any property1 real or personal1 constituting or derived from any gross proceeds obtained directly or indirectly1 or any property traceable to such property1 as a result of the commission of any violation of this section1 or a conspiracy to violate this section4 7#b7 ,seizures and forfeitures under this subsection shall be governed by the provisions in chapter #df relating to civil forfeitures1 except that such duties as are imposed on the ,secretary of the ,treasury under the customs laws described in section #iha7;d7 shall be performed by such officers1 agents and other persons as may be designated for that purpose by the ,secretary of ,homeland ,security or the ,attorney ,general4 4 #ajg4 ,limitation on civil actions involving unauthorized use ,section #ajcj7;g7 of title #ah1 ,united ,states ,code1 is amended-- 7#a7 by inserting 7#a7 before ,any person2 and 7#b7 by adding at the end the following3 7#b7 ,no action may be brought under this subsection if a violation of a contractual obligation or agreement1 such as an acceptable use policy or terms of service agreement1 constitutes the sole basis for determining that access to the protected computer is unauthorized1 or in excess of authorization4 4 #ajh4 ,reporting of certain criminal cases ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 7k7 ,reporting certain criminal cases ,not later than #a year after the date of the enactment of this ,act1 and annually thereafter1 the ,attorney ,general shall report to the ,committee on the ,judiciary of the ,senate and the ,committee on the ,judiciary of the ,house of ,representatives the number of criminal cases brought under subsection 7a7 that involve conduct in which-- 7#a7 the defendant-- 7,a7 exceeded authorized access to a non-governmental computer2 or 7,b7 accessed a non-governmental computer without authorization2 and 7#b7 the sole basis for the ,government determining that access to the non-governmental computer was unauthorized1 or in excess of authorization was that the defendant violated a contractual obligation or agreement with a service provider or employer1 such as an acceptable use policy or terms of service agreement4 4 #aji4 ,damage to critical infrastructure computers 7a7 ,in general ,chapter #dg of title #ah1 ,united ,states ,code1 is amended by inserting after section #ajcj the following3 #ajcj;,a4 ,aggravated damage to a critical infrastructure computer 7a7 ,definitions ,in this section-- 7#a7 the terms computer and damage have the meanings given such terms in section #ajcj2 and 7#b7 the term critical infrastructure computer means a computer that manages or controls systems or assets vital to national defense1 national security1 national economic security1 public health or safety1 or any combination of those matters1 whether publicly or privately owned or operated1 including-- 7,a7 gas and oil production1 storage1 and delivery systems2 7,b7 water supply systems2 7,c7 telecommunication networks2 7,d7 electrical power delivery systems2 7,e7 finance and banking systems2 7,f7 emergency services2 7,g7 transportation systems and services2 and 7,h7 government operations that provide essential services to the public4 7b7 ,offense ,it shall be unlawful to1 during and in relation to a felony violation of section #ajcj1 intentionally cause or attempt to cause damage to a critical infrastructure computer1 and such damage results in 7or1 in the case of an attempt1 would1 if completed have resulted in7 the substantial impairment-- 7#a7 of the operation of the critical infrastructure computer2 or 7#b7 of the critical infrastructure associated with the computer4 7c7 ,penalty ,any person who violates subsection 7b7 shall be fined under this title1 imprisoned for not less than #c years nor more than #bj years1 or both4 7d7 ,consecutive sentence ,notwithstanding any other provision of law-- 7#a7 a court shall not place on probation any person convicted of a violation of this section2 7#b7 except as provided in paragraph 7#d71 no term of imprisonment imposed on a person under this section shall run concurrently with any other term of imprisonment1 including any term of imprisonment imposed on the person under any other provision of law1 including any term of imprisonment imposed for the felony violation section #ajcj2 7#c7 in determining any term of imprisonment to be imposed for a felony violation of section #ajcj1 a court shall not in any way reduce the term to be imposed for such crime so as to compensate for1 or otherwise take into account1 any separate term of imprisonment imposed or to be imposed for a violation of this section2 and 7#d7 a term of imprisonment imposed on a person for a violation of this section may1 in the discretion of the court1 run concurrently1 in whole or in part1 only with another term of imprisonment that is imposed by the court at the same time on that person for an additional violation of this section1 provided that such discretion shall be exercised in accordance with any applicable guidelines and policy statements issued by the ,united ,states ,sentencing ,commission pursuant to section #iid of title #bh4 4 7b7 ,technical and conforming amendment ,the table of sections for chapter #dg of title #ah1 ,united ,states ,code1 is amended by inserting after the item relating to section #ajcj the following3 #ajcj;,a4 ,aggravated damage to a critical infrastructure computer4 4 #aaj4 ,limitation on actions involving unauthorized use ,section #ajcj7;e77#f7 of title #ah1 ,united ,states ,code1 is amended by striking alter2 and inserting alter1 but does not include access in violation of a contractual obligation or agreement1 such as an acceptable use policy or terms of service agreement1 with an ,internet service provider1 ,internet website1 or non-government employer1 if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized24 ,,ii ,privacy and security of personally identifiable information ,a ,a ,data ,privacy and ,security ,program #bja4 ,purpose and applicability of data privacy and security program 7a7 ,purpose ,the purpose of this subtitle is to ensure standards for developing and implementing administrative1 technical1 and physical safeguards to protect the security of sensitive personally identifiable information4 7b7 ,applicability ,a business entity engaging in interstate commerce that involves collecting1 accessing1 transmitting1 using1 storing1 or disposing of sensitive personally identifiable information in electronic or digital form on #aj1jjj or more ,united ,states persons is subject to the requirements for a data privacy and security program under section #bjb for protecting sensitive personally identifiable information4 7c7 ,limitations ,notwithstanding any other obligation under this subtitle1 this subtitle does not apply to the following3 7#a7 ,financial institutions ,financial institutions-- 7,a7 subject to the data security requirements and standards under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b772 and 7,b7 subject to the jurisdiction of an agency or authority described in section #eje7;a7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a774 7#b7 ,,hipaa regulated entities 7,a7 ,covered entities ,covered entities subject to the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq471 including the data security requirements and implementing regulations of that ,act4 7,b7 ,business entities ,a business entity shall be deemed in compliance with this ,act if the business entity-- 7i7 is acting as a business associate1 as that term is defined under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq47 and is in compliance with the requirements imposed under that ,act and implementing regulations promulgated under that ,act2 and 7ii7 is subject to1 and currently in compliance1 with the privacy and data security requirements under sections #acdja and #acdjd of division ,a of the ,american ,reinvestment and ,recovery ,act of #bjji 7#db ,u4,s4,c4 #agica and #agicd7 and implementing regulations promulgated under such sections4 7#c7 ,service providers ,a service provider for any electronic communication by a third party1 to the extent that the service provider is exclusively engaged in the transmission1 routing1 or temporary1 intermediate1 or transient storage of that communication4 7#d7 ,public records ,public records not otherwise subject to a confidentiality or nondisclosure requirement1 or information obtained from a public record1 including information obtained from a news report or periodical4 7d7 ,safe ,harbors 7#a7 ,in general ,a business entity shall be deemed in compliance with the privacy and security program requirements under section #bjb if the business entity complies with or provides protection equal to industry standards or standards widely accepted as an effective industry practice1 as identified by the ,federal ,trade ,commission1 that are applicable to the type of sensitive personally identifiable information involved in the ordinary course of business of such business entity4 7#b7 ,limitation ,nothing in this subsection shall be construed to permit1 and nothing does permit1 the ,federal ,trade ,commission to issue regulations requiring1 or according greater legal status to1 the implementation of or application of a specific technology or technological specifications for meeting the requirements of this title4 #bjb4 ,requirements for a personal data privacy and security program 7a7 ,personal ,data ,privacy and ,security ,program ,a business entity subject to this subtitle shall comply with the following safeguards and any other administrative1 technical1 or physical safeguards identified by the ,federal ,trade ,commission in a rulemaking process pursuant to section #eec of title #e1 ,united ,states ,code1 for the protection of sensitive personally identifiable information3 7#a7 ,scope ,a business entity shall implement a comprehensive personal data privacy and security program that includes administrative1 technical1 and physical safeguards appropriate to the size and complexity of the business entity and the nature and scope of its activities4 7#b7 ,design ,the personal data privacy and security program shall be designed to-- 7,a7 ensure the privacy1 security1 and confidentiality of sensitive personally identifying information2 7,b7 protect against any anticipated vulnerabilities to the privacy1 security1 or integrity of sensitive personally identifying information2 and 7,c7 protect against unauthorized access to use of sensitive personally identifying information that could create a significant risk of harm or fraud to any individual4 7#c7 ,risk assessment ,a business entity shall-- 7,a7 identify reasonably foreseeable internal and external vulnerabilities that could result in unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information or systems containing sensitive personally identifiable information2 7,b7 assess the likelihood of and potential damage from unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information2 7,c7 assess the sufficiency of its policies1 technologies1 and safeguards in place to control and minimize risks from unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information2 and 7,d7 assess the vulnerability of sensitive personally identifiable information during destruction and disposal of such information1 including through the disposal or retirement of hardware4 7#d7 ,risk management and control ,each business entity shall-- 7,a7 design its personal data privacy and security program to control the risks identified under paragraph 7#c72 7,b7 adopt measures commensurate with the sensitivity of the data as well as the size1 complexity1 and scope of the activities of the business entity that-- 7i7 control access to systems and facilities containing sensitive personally identifiable information1 including controls to authenticate and permit access only to authorized individuals2 7ii7 detect1 record1 and preserve information relevant to actual and attempted fraudulent1 unlawful1 or unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information1 including by employees and other individuals otherwise authorized to have access2 7iii7 protect sensitive personally identifiable information during use1 transmission1 storage1 and disposal by encryption1 redaction1 or access controls that are widely accepted as an effective industry practice or industry standard1 or other reasonable means 7including as directed for disposal of records under section #fbh of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afhaw7 and the implementing regulations of such ,act as set forth in section #fhb of title #af1 ,code of ,federal ,regulations72 7iv7 ensure that sensitive personally identifiable information is properly destroyed and disposed of1 including during the destruction of computers1 diskettes1 and other electronic media that contain sensitive personally identifiable information2 7v7 trace access to records containing sensitive personally identifiable information so that the business entity can determine who accessed or acquired such sensitive personally identifiable information pertaining to specific individuals2 and 7vi7 ensure that no third party or customer of the business entity is authorized to access or acquire sensitive personally identifiable information without the business entity first performing sufficient due diligence to ascertain1 with reasonable certainty1 that such information is being sought for a valid legal purpose2 and 7,c7 establish a plan and procedures for minimizing the amount of sensitive personally identifiable information maintained by such business entity1 which shall provide for the retention of sensitive personally identifiable information only as reasonably needed for the business purposes of such business entity or as necessary to comply with any legal obligation4 7b7 ,training ,each business entity subject to this subtitle shall take steps to ensure employee training and supervision for implementation of the data security program of the business entity4 7c7 ,vulnerability testing 7#a7 ,in general ,each business entity subject to this subtitle shall take steps to ensure regular testing of key controls1 systems1 and procedures of the personal data privacy and security program to detect1 prevent1 and respond to attacks or intrusions1 or other system failures4 7#b7 ,frequency ,the frequency and nature of the tests required under paragraph 7#a7 shall be determined by the risk assessment of the business entity under subsection 7a77#c74 7d7 ,relationship to certain providers of services ,in the event a business entity subject to this subtitle engages a person or entity not subject to this subtitle 7other than a service provider7 to receive sensitive personally identifiable information in performing services or functions 7other than the services or functions provided by a service provider7 on behalf of and under the instruction of such business entity1 such business entity shall-- 7#a7 exercise appropriate due diligence in selecting the person or entity for responsibilities related to sensitive personally identifiable information1 and take reasonable steps to select and retain a person or entity that is capable of maintaining appropriate safeguards for the security1 privacy1 and integrity of the sensitive personally identifiable information at issue2 and 7#b7 require the person or entity by contract to implement and maintain appropriate measures designed to meet the objectives and requirements governing entities subject to section #bja1 this section1 and subtitle ,b4 7e7 ,periodic ,assessment and ,personal ,data ,privacy and ,security ,modernization ,each business entity subject to this subtitle shall on a regular basis monitor1 evaluate1 and adjust1 as appropriate its data privacy and security program in light of any relevant changes in-- 7#a7 technology2 7#b7 the sensitivity of personally identifiable information2 7#c7 internal or external threats to personally identifiable information2 and 7#d7 the changing business arrangements of the business entity1 such as-- 7,a7 mergers and acquisitions2 7,b7 alliances and joint ventures2 7,c7 outsourcing arrangements2 7,d7 bankruptcy2 and 7,e7 changes to sensitive personally identifiable information systems4 7f7 ,implementation ,timeline ,not later than #a year after the date of enactment of this ,act1 a business entity subject to the provisions of this subtitle shall implement a data privacy and security program pursuant to this subtitle4 #bjc4 ,enforcement 7a7 ,civil ,penalties 7#a7 ,in general ,any business entity that violates the provisions of section #bja or #bjb shall be subject to civil penalties of not more than #e1jjj per violation per day while such a violation exists1 with a maximum of #ejj1jjj per violation4 7#b7 ,intentional or willful violation ,a business entity that intentionally or willfully violates the provisions of section #bja or #bjb shall be subject to additional penalties in the amount of #e1jjj per violation per day while such a violation exists1 with a maximum of an additional #ejj1jjj per violation4 7#c7 ,penalty limits 7,a7 ,in general ,notwithstanding any other provision of law1 the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions shall not exceed #ejj1jjj1 unless such conduct is found to be willful or intentional4 7,b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,c7 ,additional penalty limit ,if a court determines under subparagraph 7,b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #ejj1jjj4 7#d7 ,equitable relief ,a business entity engaged in interstate commerce that violates this section may be enjoined from further violations by a ,united ,states district court4 7#e7 ,other rights and remedies ,the rights and remedies available under this section are cumulative and shall not affect any other rights and remedies available under law4 7b7 ,federal ,trade ,commission ,authority ,any business entity shall have the provisions of this subtitle enforced against it by the ,federal ,trade ,commission4 7c7 ,state ,enforcement 7#a7 ,civil actions ,in any case in which the attorney general of a ,state or any ,state or local law enforcement agency authorized by the ,state attorney general or by ,state statute to prosecute violations of consumer protection law1 has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the acts or practices of a business entity that violate this subtitle1 the ,state may bring a civil action on behalf of the residents of that ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7,a7 enjoin that act or practice2 7,b7 enforce compliance with this subtitle2 or 7,c7 obtain civil penalties of not more than #e1jjj per violation per day while such violations persist1 up to a maximum of #ejj1jjj per violation4 7#b7 ,penalty limits 7,a7 ,in general ,notwithstanding any other provision of law1 the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions shall not exceed #ejj1jjj1 unless such conduct is found to be willful or intentional4 7,b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,c7 ,additional penalty limit ,if a court determines under subparagraph 7,b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #ejj1jjj4 7#c7 ,notice 7,a7 ,in general ,before filing an action under this subsection1 the attorney general of the ,state involved shall provide to the ,federal ,trade ,commission-- 7i7 a written notice of that action2 and 7ii7 a copy of the complaint for that action4 7,b7 ,exception ,subparagraph 7,a7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this subsection1 if the attorney general of a ,state determines that it is not feasible to provide the notice described in this subparagraph before the filing of the action4 7,c7 ,notification when practicable ,in an action described under subparagraph 7,b71 the attorney general of a ,state shall provide the written notice and the copy of the complaint to the ,federal ,trade ,commission as soon after the filing of the complaint as practicable4 7#d7 ,federal trade commission authority ,upon receiving notice under paragraph 7#b71 the ,federal ,trade ,commission shall have the right to-- 7,a7 move to stay the action1 pending the final disposition of a pending ,federal proceeding or action as described in paragraph 7#d72 7,b7 intervene in an action brought under paragraph 7#a72 and 7,c7 file petitions for appeal4 7#e7 ,pending proceedings ,if the ,federal ,trade ,commission initiates a ,federal civil action for a violation of this subtitle1 or any regulations thereunder1 no attorney general of a ,state may bring an action for a violation of this subtitle that resulted from the same or related acts or omissions against a defendant named in the ,federal civil action initiated by the ,federal ,trade ,commission4 7#f7 ,rule of construction ,for purposes of bringing any civil action under paragraph 7#a7 nothing in this subtitle shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths and affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7#g7 ,venue2 service of process 7,a7 ,venue ,any action brought under this subsection may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under this subsection1 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7d7 ,no ,private ,cause of ,action ,nothing in this subtitle establishes a private cause of action against a business entity for violation of any provision of this subtitle4 #bjd4 ,relation to other laws 7a7 ,in ,general ,no ,state may require any business entity subject to this subtitle to comply with any requirements with respect to administrative1 technical1 and physical safeguards for the protection of personal information4 7b7 ,limitations ,nothing in this subtitle shall be construed to modify1 limit1 or supersede the operation of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 or its implementing regulations1 including those adopted or enforced by ,states4 ,b ,security ,breach ,notification #baa4 ,notice to individuals 7a7 ,in ,general ,except as provided in section #bab1 any agency1 or business entity engaged in interstate commerce1 other than a service provider1 that uses1 accesses1 transmits1 stores1 disposes of or collects sensitive personally identifiable information shall1 following the discovery of a security breach of such information1 notify any resident of the ,united ,states whose sensitive personally identifiable information has been1 or is reasonably believed to have been1 accessed1 or acquired4 7b7 ,obligation of ,owner or ,licensee 7#a7 ,notice to owner or licensee ,any agency1 or business entity engaged in interstate commerce1 that uses1 accesses1 transmits1 stores1 disposes of1 or collects sensitive personally identifiable information that the agency or business entity does not own or license shall notify the owner or licensee of the information following the discovery of a security breach involving such information4 7#b7 ,notice by owner1 licensee1 or other designated third party ,nothing in this subtitle shall prevent or abrogate an agreement between an agency or business entity required to give notice under this section and a designated third party1 including an owner or licensee of the sensitive personally identifiable information subject to the security breach1 to provide the notifications required under subsection 7a74 7#c7 ,business entity relieved from giving notice ,a business entity obligated to give notice under subsection 7a7 shall be relieved of such obligation if an owner or licensee of the sensitive personally identifiable information subject to the security breach1 or other designated third party1 provides such notification4 7#d7 ,service providers ,if a service provider becomes aware of a security breach of data in electronic form containing sensitive personal information that is owned or possessed by another business entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 the service provider shall be required to notify the business entity who initiated such connection1 transmission1 routing1 or storage of the security breach if the business entity can be reasonably identified4 ,upon receiving such notification from a service provider1 the business entity shall be required to provide the notification required under subsection 7a74 7c7 ,timeliness of ,notification 7#a7 ,in general ,all notifications required under this section shall be made without unreasonable delay following the discovery by the agency or business entity of a security breach4 7#b7 ,reasonable delay 7,a7 ,in general ,reasonable delay under this subsection may include any time necessary to determine the scope of the security breach1 prevent further disclosures1 conduct the risk assessment described in section #bjb7;a77#c71 and restore the reasonable integrity of the data system and provide notice to law enforcement when required4 7,b7 ,extension 7i7 ,in general ,except as provided in subsection 7d71 delay of notification shall not exceed #fj days following the discovery of the security breach1 unless the business entity or agency requests an extension of time and the ,federal ,trade ,commission determines in writing that additional time is reasonably necessary to determine the scope of the security breach1 prevent further disclosures1 conduct the risk assessment1 restore the reasonable integrity of the data system1 or to provide notice to the designated entity4 7ii7 ,approval of request ,if the ,federal ,trade ,commission approves the request for delay1 the agency or business entity may delay the time period for notification for additional periods of up to #cj days4 7#c7 ,burden of production ,the agency1 business entity1 owner1 or licensee required to provide notice under this subtitle shall1 upon the request of the ,attorney ,general or the ,federal ,trade ,commission provide records or other evidence of the notifications required under this subtitle1 including to the extent applicable1 the reasons for any delay of notification4 7d7 ,delay of notification authorized for law enforcement or national security purposes 7#a7 ,in general ,if the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation determines that the notification required under this section would impede a criminal investigation1 or national security activity1 such notification shall be delayed upon written notice from the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation to the agency or business entity that experienced the breach4 ,the notification from the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation shall specify in writing the period of delay requested for law enforcement or national security purposes4 7#b7 ,extended delay of notification ,if the notification required under subsection 7a7 is delayed pursuant to paragraph 7#a71 an agency or business entity shall give notice #cj days after the day such law enforcement or national security delay was invoked unless a ,federal law enforcement or intelligence agency provides written notification that further delay is necessary4 7#c7 ,law enforcement immunity ,no non-constitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification for law enforcement or national security purposes under this subtitle4 7e7 ,limitations ,notwithstanding any other obligation under this subtitle1 this subtitle does not apply to the following3 7#a7 ,financial institutions ,financial institutions-- 7,a7 subject to the data security requirements and standards under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b772 and 7,b7 subject to the jurisdiction of an agency or authority described in section #eje7;a7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a774 7#b7 ,,hipaa regulated entities 7,a7 ,covered entities ,covered entities subject to the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq471 including the data security requirements and implementing regulations of that ,act4 7,b7 ,business entities ,a business entity shall be deemed in compliance with this ,act if the business entity-- 7i7 7,i7 is acting as a covered entity and as a business associate1 as those terms are defined under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq47 and is in compliance with the requirements imposed under that ,act and implementing regulations promulgated under that ,act2 and 7,,ii7 is subject to1 and currently in compliance1 with the data breach notification1 privacy and data security requirements under the ,health ,information ,technology for ,economic and ,clinical ,health 7,,hitech7 ,act1 7#db ,u4,s4,c4 #agicb7 and implementing regulations promulgated thereunder2 or 7ii7 is acting as a vendor of personal health records and third party service provider1 subject to the ,health ,information ,technology for ,economic and ,clinical ,health 7,,hitech7 ,act 7#db ,u4,s4,c4 #agicg71 including the data breach notification requirements and implementing regulations of that ,act4 #bab4 ,exemptions 7a7 ,exemption for ,national ,security and ,law ,enforcement 7#a7 ,in general ,section #baa shall not apply to an agency or business entity if-- 7,a7 the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation determines that notification of the security breach could be expected to reveal sensitive sources and methods or similarly impede the ability of the ,government to conduct law enforcement investigations2 or 7,b7 the ,federal ,bureau of ,investigation determines that notification of the security breach could be expected to cause damage to the national security4 7#b7 ,immunity ,no non-constitutional cause of action shall lie in any court against any ,federal agency for acts relating to the exemption from notification for law enforcement or national security purposes under this title4 7b7 ,safe ,harbor 7#a7 ,in general ,an agency or business entity shall be exempt from the notice requirements under section #baa1 if-- 7,a7 a risk assessment conducted by the agency or business entity concludes that1 based upon the information available1 there is no significant risk that a security breach has resulted in1 or will result in1 identity theft1 economic loss or harm1 or physical harm to the individuals whose sensitive personally identifiable information was subject to the security breach2 7,b7 without unreasonable delay1 but not later than #de days after the discovery of a security breach1 unless extended by the ,federal ,trade ,commission1 the agency or business entity notifies the ,federal ,trade ,commission1 in writing1 of-- 7i7 the results of the risk assessment2 and 7ii7 its decision to invoke the risk assessment exemption2 and 7,c7 the ,federal ,trade ,commission does not indicate1 in writing1 within #aj business days from receipt of the decision1 that notice should be given4 7#b7 ,rebuttable presumptions ,for purposes of paragraph 7#a7-- 7,a7 the encryption of sensitive personally identifiable information described in paragraph 7#a77;,a77i7 shall establish a rebuttable presumption that no significant risk exists2 and 7,b7 the rendering of sensitive personally identifiable information described in paragraph 7#a77;,a77ii7 unusable1 unreadable1 or indecipherable through data security technology or methodology that is generally accepted by experts in the field of information security1 such as redaction or access controls shall establish a rebuttable presumption that no significant risk exists4 7#c7 ,violation ,it shall be a violation of this section to-- 7,a7 fail to conduct the risk assessment in a reasonable manner1 or according to standards generally accepted by experts in the field of information security2 or 7,b7 submit the results of a risk assessment that contains fraudulent or deliberately misleading information4 7c7 ,financial fraud prevention exemption 7#a7 ,in general ,a business entity will be exempt from the notice requirement under section #baa if the business entity utilizes or participates in a security program that-- 7,a7 effectively blocks the use of the sensitive personally identifiable information to initiate unauthorized financial transactions before they are charged to the account of the individual2 and 7,b7 provides for notice to affected individuals after a security breach that has resulted in fraud or unauthorized transactions4 7#b7 ,limitation ,the exemption in paragraph 7#a7 does not apply if the information subject to the security breach includes an individual's first and last name1 or any other type of sensitive personally identifiable information as defined in section #c1 unless that information is only a credit card number or credit card security code4 #bac4 ,methods of notice ,an agency or business entity shall be in compliance with section #baa if it provides the following3 7#a7 ,individual notice ,notice to individuals by one of the following means3 7,a7 ,written notification to the last known home mailing address of the individual in the records of the agency or business entity4 7,b7 ,telephone notice to the individual personally4 7,c7 ,e-mail notice1 if the individual has consented to receive such notice and the notice is consistent with the provisions permitting electronic transmission of notices under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja74 7#b7 ,media notice ,notice to major media outlets serving a ,state or jurisdiction1 if the number of residents of such ,state whose sensitive personally identifiable information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person exceeds #e1jjj4 #bad4 ,content of notification 7a7 ,in ,general ,regardless of the method by which notice is provided to individuals under section #bac1 such notice shall include1 to the extent possible-- 7#a7 a description of the categories of sensitive personally identifiable information that was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person2 7#b7 a toll-free number-- 7,a7 that the individual may use to contact the agency or business entity1 or the agent of the agency or business entity2 and 7,b7 from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual2 and 7#c7 the toll-free contact telephone numbers and addresses for the major credit reporting agencies4 7b7 ,additional content ,notwithstanding section #bai1 a ,state may require that a notice under subsection 7a7 shall also include information regarding victim protection assistance provided for by that ,state4 7c7 ,direct ,business ,relationship ,regardless of whether a business entity1 agency1 or a designated third party provides the notice required pursuant to section #baa7;b71 such notice shall include the name of the business entity or agency that has a direct relationship with the individual being notified4 #bae4 ,coordination of notification with credit reporting agencies ,if an agency or business entity is required to provide notification to more than #e1jjj individuals under section #baa7;a71 the agency or business entity shall also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis 7as defined in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p777 of the timing and distribution of the notices4 ,such notice shall be given to the consumer credit reporting agencies without unreasonable delay and1 if it will not delay notice to the affected individuals1 prior to the distribution of notices to the affected individuals4 #baf4 ,notice to law enforcement 7a7 ,designation of government entity ,to receive notice 7#a7 ,in general ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security shall designate a ,federal ,government entity to receive the notices required under section #bab and this section1 and any other reports and information about information security incidents1 threats1 and vulnerabilities4 7#b7 ,responsibilities of the designated entity ,the designated entity shall-- 7,a7 be responsible for promptly providing the information that it receives to the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation1 and to the ,federal ,trade ,commission for civil law enforcement purposes2 and 7,b7 provide the information described in subparagraph 7,a7 as appropriate to other ,federal agencies for law enforcement1 national security1 or data security purposes4 7b7 ,notice ,any business entity or agency shall notify the designated entity of the fact that a security breach has occurred if-- 7#a7 the number of individuals whose sensitive personally identifying information was1 or is reasonably believed to have been accessed or acquired by an unauthorized person exceeds #e1jjj2 7#b7 the security breach involves a database1 networked or integrated databases1 or other data system containing the sensitive personally identifiable information of more than #ejj1jjj individuals nationwide2 7#c7 the security breach involves databases owned by the ,federal ,government2 or 7#d7 the security breach involves primarily sensitive personally identifiable information of individuals known to the agency or business entity to be employees and contractors of the ,federal ,government involved in national security or law enforcement4 7c7 ,,ftc rulemaking and review of thresholds 7#a7 ,reports ,not later than #a year after the date of the enactment of this ,act1 the ,federal ,trade ,commission1 in consultation with the ,attorney ,general of the ,united ,states and the ,secretary of ,homeland ,security1 shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 regarding the reports required under subsection 7a74 7#b7 ,thresholds for notice ,the ,federal ,trade ,commission1 in consultation with the ,attorney ,general and the ,secretary of ,homeland ,security1 after notice and the opportunity for public comment1 and in a manner consistent with this section1 shall promulgate regulations1 as necessary1 under section #eec of title #e1 ,united ,states ,code1 to adjust the thresholds for notice to law enforcement and national security authorities under subsection 7a7 and to facilitate the purposes of this section4 7d7 ,timing ,the notice required under subsection 7a7 shall be provided as promptly as possible1 but such notice must be provided either #gb hours before notice is provided to an individual pursuant to section #baa1 or not later than #aj days after the business entity or agency discovers the security breach or discovers that the nature of the security breach requires notice to law enforcement under this section1 whichever occurs first4 #bag4 ,enforcement 7a7 ,in general ,the ,attorney ,general and the ,federal ,trade ,commission may enforce civil violations of section #baa4 7b7 ,civil actions by the ,attorney ,general of the ,united ,states 7#a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any business entity that engages in conduct constituting a violation of this subtitle and1 upon proof of such conduct by a preponderance of the evidence1 such business entity shall be subject to a civil penalty of not more than #aa1jjj per day per security breach4 7#b7 ,penalty limitation ,notwithstanding any other provision of law1 the total amount of the civil penalty assessed against a business entity for conduct involving the same or related acts or omissions that results in a violation of this subtitle may not exceed #a1jjj1jjj4 7#c7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7#d7 ,additional penalty limit ,if a court determines under paragraph 7#c7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #a1jjj1jjj4 7c7 ,injunctive actions by the ,attorney ,general 7#a7 ,in general ,if it appears that a business entity has engaged1 or is engaged1 in any act or practice constituting a violation of this subtitle1 the ,attorney ,general may petition an appropriate district court of the ,united ,states for an order-- 7,a7 enjoining such act or practice2 or 7,b7 enforcing compliance with this subtitle4 7#b7 ,issuance of order ,a court may issue an order under paragraph 7#a71 if the court finds that the conduct in question constitutes a violation of this subtitle4 7d7 ,civil actions by the ,federal ,trade ,commission 7#a7 ,in general ,compliance with the requirements imposed under this subtitle may be enforced under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 by the ,federal ,trade ,commission with respect to business entities subject to this ,act4 ,all of the functions and powers of the ,federal ,trade ,commission under the ,federal ,trade ,commission ,act are available to the ,commission to enforce compliance by any person with the requirements imposed under this title4 7#b7 ,penalty limitation 7,a7 ,in general ,notwithstanding any other provision of law1 the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions may not exceed #a1jjj1jjj1 unless such conduct is found to be willful or intentional4 7,b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,c7 ,additional penalty limit ,if a court determines under subparagraph 7,b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #a1jjj1jjj4 7#c7 ,unfair or deceptive acts or practices ,for the purpose of the exercise by the ,federal ,trade ,commission of its functions and powers under the ,federal ,trade ,commission ,act1 a violation of any requirement or prohibition imposed under this title shall constitute an unfair or deceptive act or practice in commerce in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77,i77,b77 regarding unfair or deceptive acts or practices and shall be subject to enforcement by the ,federal ,trade ,commission under that ,act with respect to any business entity1 irrespective of whether that business entity is engaged in commerce or meets any other jurisdictional tests in the ,federal ,trade ,commission ,act4 7e7 ,coordination of enforcement 7#a7 ,in general ,before opening an investigation1 the ,federal ,trade ,commission shall consult with the ,attorney ,general4 7#b7 ,limitation ,the ,federal ,trade ,commission may initiate investigations under this subsection unless the ,attorney ,general determines that such an investigation would impede an ongoing criminal investigation or national security activity4 7#c7 ,coordination agreement 7,a7 ,in general ,in order to avoid conflicts and promote consistency regarding the enforcement and litigation of matters under this ,act1 not later than #ahj days after the enactment of this ,act1 the ,attorney ,general and the ,federal ,trade ,commission shall enter into an agreement for coordination regarding the enforcement of this ,act4 7,b7 ,requirement ,the coordination agreement entered into under subparagraph 7,a7 shall include provisions to ensure that parallel investigations and proceedings under this section are conducted in a matter that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7#d7 ,coordination with the ,,fcc ,if an enforcement action under this ,act relates to customer proprietary network information1 the ,federal ,trade ,commission shall coordinate the enforcement action with the ,federal ,communications ,commission4 7f7 ,rulemaking ,the ,federal ,trade ,commission may1 in consultation with the ,attorney ,general1 issue such other regulations as it determines to be necessary to carry out this subtitle4 ,all regulations promulgated under this ,act shall be issued in accordance with section #eec of title #e1 ,united ,states ,code4 ,where regulations relate to customer proprietary network information1 the promulgation of such regulations will be coordinated with the ,federal ,communications ,commission4 7g7 ,other rights and remedies ,the rights and remedies available under this subtitle are cumulative and shall not affect any other rights and remedies available under law4 7h7 ,fraud alert ,section #fje;,a7b77#a7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;c-#a7;b77#a77 is amended by inserting 1 or evidence that the consumer has received notice that the consumer's financial information has or may have been compromised1 after identity theft report4 #bah4 ,enforcement by ,state attorneys general 7a7 ,in general 7#a7 ,civil actions ,in any case in which the attorney general of a ,state or any ,state or local law enforcement agency authorized by the ,state attorney general or by ,state statute to prosecute violations of consumer protection law1 has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of a business entity in a practice that is prohibited under this subtitle1 the ,state or the ,state or local law enforcement agency on behalf of the residents of the agency's jurisdiction1 may bring a civil action on behalf of the residents of the ,state or jurisdiction in a district court of the ,united ,states of appropriate jurisdiction to-- 7,a7 enjoin that practice2 7,b7 enforce compliance with this subtitle2 or 7,c7 civil penalties of not more than #aa1jjj per day per security breach up to a maximum of #a1jjj1jjj per violation1 unless such conduct is found to be willful or intentional4 7#b7 ,penalty limitation 7,a7 ,in general ,notwithstanding any other provision of law1 the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions may not exceed #a1jjj1jjj1 unless such conduct is found to be willful or intentional4 7,b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,c7 ,additional penalty limit ,if a court determines under subparagraph 7,b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #a1jjj1jjj4 7#c7 ,notice 7,a7 ,in general ,before filing an action under paragraph 7#a71 the attorney general of the ,state involved shall provide to the ,attorney ,general of the ,united ,states-- 7i7 written notice of the action2 and 7ii7 a copy of the complaint for the action4 7,b7 ,exemption 7i7 ,in general ,subparagraph 7,a7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this subtitle1 if the ,state attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action4 7ii7 ,notification ,in an action described in clause 7i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,attorney ,general at the time the ,state attorney general files the action4 7b7 ,federal proceedings ,upon receiving notice under subsection 7a77#b71 the ,attorney ,general shall have the right to-- 7#a7 move to stay the action1 pending the final disposition of a pending ,federal proceeding or action2 7#b7 initiate an action in the appropriate ,united ,states district court under section #bag and move to consolidate all pending actions1 including ,state actions1 in such court2 7#c7 intervene in an action brought under subsection 7a77#b72 and 7#d7 file petitions for appeal4 7c7 ,pending proceedings ,if the ,attorney ,general or the ,federal ,trade ,commission initiate a criminal proceeding or civil action for a violation of a provision of this subtitle1 or any regulations thereunder1 no attorney general of a ,state may bring an action for a violation of a provision of this subtitle against a defendant named in the ,federal criminal proceeding or civil action4 7d7 ,construction ,for purposes of bringing any civil action under subsection 7a71 nothing in this subtitle regarding notification shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on such attorney general by the laws of that ,state to-- 7#a7 conduct investigations2 7#b7 administer oaths or affirmations2 or 7#c7 compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,venue2 service of process 7#a7 ,venue ,any action brought under subsection 7a7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 7f7 ,no private cause of action ,nothing in this subtitle establishes a private cause of action against a business entity for violation of any provision of this subtitle4 #bai4 ,effect on ,federal and ,state law ,for any entity1 or agency that is subject to this subtitle1 the provisions of this subtitle shall supersede any other provision of ,federal law1 or any provisions of the law of any ,state1 relating to notification of a security breach1 except as provided in section #bad7;b74 ,nothing in this subtitle shall be construed to modify1 limit1 or supersede the operation of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 or its implementing regulations1 including those regulations adopted or enforced by ,states1 the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq47 or its implementing regulations1 or the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg7 or its implementing regulations4 #bbj4 ,reporting on exemptions 7a7 ,,ftc report ,not later than #ah months after the date of enactment of this ,act1 and upon request by ,congress thereafter1 the ,federal ,trade ,commission shall submit a report to ,congress on the number and nature of the security breaches described in the notices filed by those business entities invoking the risk assessment exemption under section #bab7;b7 and their response to such notices4 7b7 ,law enforcement report 7#a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 and upon the request by ,congress thereafter1 the ,united ,states ,secret ,service and ,federal ,bureau of ,investigation shall submit a report to ,congress on the number and nature of security breaches subject to the national security and law enforcement exemptions under section #bab7;a74 7#b7 ,requirement ,the report required under paragraph 7#a7 shall not include the contents of any risk assessment provided to the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation under this subtitle4 #bba4 ,effective date ,this subtitle shall take effect on the expiration of the date which is #ij days after the date of enactment of this ,act4 ,,iii ,compliance with statutory ,pay-,as-,you-,go ,act #cja4 ,budget compliance ,the budgetary effects of this ,act1 for the purpose of complying with the ,statutory ,pay-,as-,you-,go ,act of #bjaj1 shall be determined by reference to the latest statement titled ,budgetary ,effects of ,,paygo ,legislation for this ,act1 submitted for printing in the ,congressional ,record by the ,chairman of the ,senate ,budget ,committee1 provided that such statement has been submitted prior to the vote on passage4