,,ii  #aac? ,,congress  #b;d ,session   
,s4 #ahig  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,janu>y #h1 #bjad,mr4  
,leahy 7= himself1 ,mr4 ,s*um]1 ,mr4    
,frank51 & ,mr4 ,blum5?al7 introduc$ !  
foll[+ bill2 :i* 0 read twice & ref]r$  
to ! ,committee on ! ,judici>y  ,a      
,,bill  ,to prev5t & mitigate id5tity   
!ft1 to ensure privacy1 to provide      
notice ( security brea*es1 & to enhance 
crim9al p5alties1 law en=cem5t          
assi/ance1 & o!r protections aga9/      
security brea*es1 fraudul5t access1 &   
misuse ( p]sonally id5tifiable          
in=mation4  #a4 ,%ort title2 table (    
cont5ts  7a7 ,%ort title ,?is ,act may  
be cit$ z ! ,p]sonal ,data ,privacy &   
,security ,act ( #bjad4  7b7 ,table (   
,cont5ts ,! table ( cont5ts ( ?is ,act  
is z foll[s3 ,sec4 #a4 ,%ort title2     
table ( cont5ts4,sec4 #b4 ,f9d+s4,sec4  
#c4 ,def9itions4,,title ,i--,enhanc+    
puni%m5t = id5tity !ft & o!r violations 
( data privacy & security,sec4 #aja4    
,organiz$ crim9al activity 9 connection 

) unau?oriz$ access to p]sonally        
id5tifiable in=mation4,sec4 #ajb4       
,concealm5t ( security brea*es involv+  
s5sitive p]sonally id5tifiable          
in=mation4,sec4 #ajc4 ,p5alties = fraud 
& relat$ activity 9 connection )        
comput]s4,sec4 #ajd4 ,traffick+ 9       
passwords4,sec4 #aje4 ,conspiracy &     
attempt$ comput] fraud (f5ses4,sec4     
#ajf4 ,crim9al & civil =feiture = fraud 
& relat$ activity 9 connection )        
comput]s4,sec4 #ajg4 ,limitation on     
civil actions involv+ unau?oriz$        
use4,sec4 #ajh4 ,report+ ( c]ta9 crim9al
 cases4,sec4 #aji4 ,damage to critical  
infra/ructure comput]s4,sec4 #aaj4      
,limitation on actions involv+          
unau?oriz$ use4,,title ,,ii--,privacy & 
security ( p]sonally id5tifiable        
information,subtitle ,a--,a ,data       
,privacy & ,security ,program,sec4 #bja4
 ,purpose & applicability ( data privacy
 & security program4,sec4 #bjb4         
,requirem5ts = a p]sonal data privacy & 
security program4,sec4 #bjc4            

,en=cem5t4,sec4 #bjd4 ,relation to o!r  
laws4,subtitle ,b--,security ,brea*     
,notification,sec4 #baa4 ,notice to     
individuals4,sec4 #bab4                 
,exemptions4,sec4 #bac4 ,me?ods (       
notice4,sec4 #bad4 ,cont5t (            
notification4,sec4 #bae4 ,coord9ation ( 
notification ) cr$it report+            
ag5cies4,sec4 #baf4 ,notice to law      
en=cem5t4,sec4 #bag4 ,en=cem5t4,sec4    
#bah4 ,en=cem5t by ,/ate attorneys      
g5]al4,sec4 #bai4 ,effect on ,f$]al &   
,/ate law4,sec4 #bbj4 ,report+ on       
exemptions4,sec4 #bba4 ,effective       
date4,,title ,,iii--,compliance )       
/atutory ,pay-,z-,y-,g ,act,sec4 #cja4  
,budget compliance4  #b4 ,f9d+s         
,congress f9ds t-- 7#a7 databases (     
p]sonally id5tifiable in=mation are     
increas+ly prime t>gets ( hack]s1       
id5tity ?ieves1 rogue employees1 & o!r  
crim9als1 includ+ organiz$ & sophi/icat$
 crim9al op]ations2  7#b7 id5tity !ft is
 a s]i\s ?reat to ! ,nation's economic  
/ability1 national security1 homel&     

security1 cyb]security1 ! developm5t (  
e-comm]ce1 & ! privacy rights (         
,am]icans2  7#c7 security brea*es are a 
s]i\s ?reat to consum] confid5ce1 homel&
 security1 national security1 e-comm]ce1
 & economic /ability2  7#d7 x is        
important = bus9ess entities t own1 use1
 or lic5se p]sonally id5tifiable        
in=mation to adopt reasonable proc$ures 
to ensure ! security1 privacy1 &        
confid5tiality ( t p]sonally id5tifiable
 in=mation2  7#e7 individuals ^: p]sonal
 in=mation has be5 compromis$ or :o h   
be5 victims ( id5tity !ft %\ld receive !
 necess>y in=mation & assi/ance to      
mitigate _! damages & to re/ore !       
integrity ( _! p]sonal in=mation &      
id5tities2  7#f7 data misuse & use (    
inaccurate data h ! pot5tial to cause   
s]i\s or irrep>able h>m to an           
individual's livelihood1 privacy1 &     
lib]ty & und]m9e effici5t & effective   
bus9ess & gov]nm5t op]ations2  7#g7     
gov]nm5t access to comm]cial data c     
pot5tially improve safety1 law en=cem5t1

 & national security2 &  7#h7 because   
gov]nm5t use ( comm]cial data conta9+   
p]sonal in=mation pot5tially affects    
individual privacy1 & law en=cem5t &    
national security op]ations1 !re is a   
ne$ = ,congress to ex]cise ov]sight ov] 
gov]nm5t use ( comm]cial data4  #c4     
,def9itions ,9 ?is ,act1 ! foll[+       
def9itions %all apply3 7#a7 ,affiliate  
,! t]m affiliate means p]sons relat$ by 
common own]%ip or by corporate control4 
7#b7 ,ag5cy ,! t]m ag5cy has ! same     
mean+ giv5 su* t]m 9 section #eea (     
title #e1 ,unit$ ,/ates ,code4  7#c7    
,bus9ess entity ,! t]m bus9ess entity   
means any organization1 corporation1    
tru/1 p>tn]%ip1 sole proprietor%ip1     
un9corporat$ association1 or v5ture     
e/abli%$ to make a pr(it1 or nonpr(it4  
7#d7 ,data sy/em communication in=mation
 ,! t]m data sy/em communication        
in=mation means dial+1 r\t+1 address+1  
or signal+ in=mation t id5tifies !      
orig91 direction1 de/9ation1 process+1  
transmission1 or t]m9ation ( ea*        

communication initiat$1 attempt$1 or    
receiv$4  7#e7 ,designat$ entity ,! t]m 
designat$ entity means ! ,f$]al         
,gov]nm5t entity designat$ by !         
,secret>y ( ,homel& ,security "u section
 #baf7;a74  7#f7 ,encryption ,! t]m     
encryption-- 7,a7 means ! protection (  
data 9 electronic =m1 9 /orage or 9     
transit1 us+ an encryption te*nology t  
has be5 g5]ally accept$ by exp]ts 9 !   
field ( in=mation security t r5d]s su*  
data indeciph]able 9 ! abs5ce (         
associat$ cryptographic keys necess>y to
 enable decryption ( su* data2 &  7,b7  
includes appropriate managem5t &        
safegu>ds ( su* cryptographic keys s z  
to protect ! integrity ( ! encryption4  
7#g7 ,id5tity !ft ,! t]m id5tity !ft    
means a violation ( section             
#ajbh7;a77#g7 ( title #ah1 ,unit$ ,/ates
 ,code4  7#h7 ,p]sonally id5tifiable    
in=mation ,! t]m p]sonally id5tifiable  
in=mation means any in=mation1 or       
compilation ( in=mation1 9 electronic or
 digital =m t is a means (              

id5tification1 z def9$ by section       
#ajbh7;d77#g7 ( title #ah1 ,unit$ ,/ates
 ,code4  7#i7 ,public record s\rce ,!   
t]m public record s\rce means !         
,congress1 any ag5cy1 any ,/ate or local
 gov]nm5t ag5cy1 ! gov]nm5t ( ! ,di/rict
 ( ,columbia & gov]nm5ts ( ! t]ritories 
or possessions ( ! ,unit$ ,/ates1 &     
,f$]al1 ,/ate or local c\rts1 c\rts     
m>tial & milit>y commissions1 t ma9ta9  
p]sonally id5tifiable in=mation 9       
records available to ! public4  7#aj7   
,security brea*  7,a7 ,9 g5]al ,! t]m   
security brea* means compromise ( !     
security1 confid5tiality1 or integrity  
(1 or ! loss (1 comput]iz$ data t result
 91 or t !re is a reasonable basis to   
conclude has result$ 9-- 7i7 !          
unau?oriz$ acquisition ( s5sitive       
p]sonally id5tifiable in=mation2 &  7ii7
 access to s5sitive p]sonally           
id5tifiable in=mation t is = an         
unau?oriz$ purpose1 or 9 excess (       
au?orization4  7,b7 ,exclusion ,! t]m   
security brea* does n include-- 7i7 a   

good fai? acquisition ( s5sitive        
p]sonally id5tifiable in=mation by a    
bus9ess entity or ag5cy1 or an employee 
or ag5t ( a bus9ess entity or ag5cy1 if 
! s5sitive p]sonally id5tifiable        
in=mation is n subject to fur!r         
unau?oriz$ disclosure2  7ii7 ! release (
 a public record n o!rwise subject to   
confid5tiality or nondisclosure         
requirem5ts or ! release ( in=mation    
obta9$ f a public record1 includ+       
in=mation obta9$ f a news report or     
p]iodical2 or  7iii7 any lawfully       
au?oriz$ inve/igative1 protective1 or   
intellig5ce activity ( a law en=cem5t or
 intellig5ce ag5cy ( ! ,unit$ ,/ates1 a 
,/ate1 or a political subdivision ( a   
,/ate4  7#aa7 ,s5sitive p]sonally       
id5tifiable in=mation ,! t]m s5sitive   
p]sonally id5tifiable in=mation means   
any in=mation or compilation (          
in=mation1 9 electronic or digital =m t 
includes ! foll[+3 7,a7 ,an individual's
 fir/ & la/ "n or fir/ initial & la/ "n 
9 comb9ation ) any two ( ! foll[+ data  

elem5ts3 7i7 ,home address or telephone 
numb]4  7ii7 ,"m's maid5 "n4  7iii7     
,mon?1 day1 & ye> ( bir?4  7,b7 ,a      
non-truncat$ social security numb]1     
driv]'s lic5se numb]1 passport numb]1 or
 ali5 regi/ration numb] or o!r          
gov]nm5t-issu$ unique id5tification     
numb]4  7,c7 ,unique biometric data su* 
z a f+]pr9t1 voice pr9t1 a ret9a or iris
 image1 or any o!r unique physical      
repres5tation4  7,d7 ,a unique acc\nt   
id5tifi]1 includ+ a f9ancial acc\nt     
numb] or cr$it or debit c>d numb]1      
electronic id5tification numb]1 us] "n1 
or r\t+ code4  7,e7 ,any comb9ation ( ! 
foll[+ data elem5ts3 7i7 ,an            
individual's fir/ & la/ "n or fir/      
initial & la/ "n4  7ii7 ,a unique acc\nt
 id5tifi]1 includ+ a f9ancial acc\nt    
numb] or cr$it or debit c>d numb]1      
electronic id5tification numb]1 us] "n1 
or r\t+ code4  7iii7 ,any security code1
 access code1 or password1 or s\rce code
 t c\ld be us$ to g5]ate su* codes or   
passwords4  7#ab7 ,s]vice provid] ,! t]m

 s]vice provid] means a bus9ess entity t
 provides electronic data transmission1 
r\t+1 int]m$iate & transi5t /orage1 or  
connections to its sy/em or network1 :]e
 ! bus9ess entity provid+ su* s]vices   
does n select or modify ! cont5t ( !    
electronic data1 is n ! s5d] or ! int5d$
 recipi5t ( ! data1 & ! bus9ess entity  
transmits1 r\tes1 /ores1 or provides    
connections = p]sonal in=mation 9 a     
mann] t p]sonal in=mation is            
undiff]5tiat$ f o!r types ( data t su*  
bus9ess entity transmits1 r\tes1 /ores1 
or provides connections4 ,any su*       
bus9ess entity %all be treat$ z a s]vice
 provid] "u ?is ,act only to ! ext5t t x
 is engag$ 9 ! provision ( su*          
transmission1 r\t+1 int]m$iate &        
transi5t /orage or connections4  ,i     
,enhanc+ puni%m5t = id5tity !ft & o!r   
violations ( data privacy & security    
#aja4 ,organiz$ crim9al activity 9      
connection ) unau?oriz$ access to       
p]sonally id5tifiable in=mation ,section
 #aifa7a7 ( title #ah1 ,unit$ ,/ates    

,code1 is am5d$ by ins]t+ section #ajcj 
7relat+ to fraud & relat$ activity 9    
connection ) comput]s7 if ! act is a    
felony1 be=e section #ajhd4  #ajb4      
,concealm5t ( security brea*es involv+  
s5sitive p]sonally id5tifiable in=mation
  7a7 ,9 ,g5]al ,*apt] #dg ( title #ah1 
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+3  #ajda4 ,concealm5t (  
security brea*es involv+ s5sitive       
p]sonally id5tifiable in=mation  7a7 ,9 
g5]al ,:oev]1 hav+ k ( a security brea* 
& ( ! fact t notice ( su* security brea*
 is requir$ "u title ,,ii ( ! ,p]sonal  
,data ,privacy & ,security ,act ( #bjad1
 int5tionally & willfully conceals !    
fact ( su* security brea*1 %all1 9 !    
ev5t t su* security brea* results 9     
economic h>m to any individual 9 ! am\nt
 ( #a1jjj or m1 be f9$ "u ?is tile or   
imprison$ = n m ?an #e ye>s1 or bo?4    
7b7 ,p]son def9$ ,= purposes (          
subsection 7a71 ! t]m p]son has ! mean+ 
giv5 ! t]m 9 section #ajcj7;e77#ab74    
7c7 ,notice requirem5t ,any p]son seek+ 

an exemption "u section #bab7;b7 ( !    
,p]sonal ,data ,privacy & ,security ,act
 ( #bjad %all be immune f prosecution "u
 ?is section if ! ,f$]al ,trade         
,commission does n indicate1 9 writ+1 t 
su* notice be giv5 "u section           
#bab7;b77#c7 ( su* ,act4  4  7b7 ,con=m+
 & ,te*nical ,am5dm5ts ,! table (       
sections = *apt] #dg ( title #ah1 ,unit$
 ,/ates ,code1 is am5d$ by add+ at ! end
 ! foll[+3  #ajda4 ,concealm5t (        
security brea*es involv+ s5sitive       
p]sonally id5tifiable in=mation4  4  7c7
 ,en=cem5t au?ority  7#a7 ,9 g5]al ,!   
,unit$ ,/ates ,secret ,s]vice & ,f$]al  
,bureau ( ,inve/igation %all h !        
au?ority to inve/igate (f5ses "u section
 #ajda ( title #ah1 ,unit$ ,/ates ,code1
 z add$ by subsection 7a74  7#b7        
,nonexclusivity ,! au?ority grant$ 9    
p>agraph 7#a7 %all n be exclusive ( any 
exi/+ au?ority held by any o!r ,f$]al   
ag5cy4  #ajc4 ,p5alties = fraud & relat$
 activity 9 connection ) comput]s       
,section #ajcj7;c7 ( title #ah1 ,unit$  

,/ates ,code1 is am5d$ to read z foll[s3
  7c7 ,! puni%m5t = an (f5se "u         
subsection 7a7 or 7b7 ( ?is section is--
 7#a7 a f9e "u ?is title or imprisonm5t 
= n m ?an #bj ye>s1 or bo?1 9 ! case (  
an (f5se "u subsection 7a77#a7 ( ?is    
section2  7#b7 7,a7 except z provid$ 9  
subp>agraph 7,b71 a f9e "u ?is title or 
imprisonm5t = n m ?an #c ye>s1 or bo?1 9
 ! case ( an (f5se "u subsection        
7a77#b72 or  7,b7 a f9e "u ?is title or 
imprisonm5t = n m ?an t5 ye>s1 or bo?1 9
 ! case ( an (f5se "u p>agraph 7a77#b7 (
 ?is section1 if-- 7i7 ! (f5se 0        
committ$ = purposes ( comm]cial         
advantage or private f9ancial ga92  7ii7
 ! (f5se 0 committ$ 9 ! fur!rance ( any 
crim9al or torti\s act 9 violation ( !  
,con/itution or laws ( ! ,unit$ ,/ates1 
or ( any ,/ate2 or  7iii7 ! value ( !   
in=mation obta9$1 or t w\ld h be5 obta9$
 if ! (f5se 0 complet$1 exce$s #e1jjj2  
7#c7 a f9e "u ?is title or imprisonm5t =
 n m ?an #a ye>1 or bo?1 9 ! case ( an  
(f5se "u subsection 7a77#c7 ( ?is       

section2  7#d7 a f9e "u ?is title or    
imprisonm5t ( n m ?an #bj ye>s1 or bo?1 
9 ! case ( an (f5se "u subsection       
7a77#d7 ( ?is section2  7#e7 7,a7 except
 z provid$ 9 subp>agraph 7,d71 a f9e "u 
?is title1 imprisonm5t = n m ?an #bj    
ye>s1 or bo?1 9 ! case ( an (f5se "u    
subsection 7a77#e77;,a7 ( ?is section1  
if ! (f5se caus$-- 7i7 loss to #a or m  
p]sons dur+ any #a-ye> p]iod 7&1 =      
purposes ( an inve/igation1 prosecution1
 or o!r proce$+ br\ght by ! ,unit$      
,/ates only1 loss result+ f a relat$    
c\rse ( conduct affect+ #a or m o!r     
protect$ comput]s7 aggregat+ at lea/    
#e1jjj 9 value2  7ii7 ! modification or 
impairm5t1 or pot5tial modification or  
impairm5t1 ( ! m$ical exam9ation1       
diagnosis1 treatm5t1 or c>e ( #a or m   
individuals2  7iii7 physical injury to  
any p]son2  7iv7 a ?reat to public heal?
 or safety2  7v7 damage affect+ a       
comput] us$ by1 or on behalf (1 an      
entity ( ! ,unit$ ,/ates ,gov]nm5t 9    
fur!rance ( ! adm9i/ration ( ju/ice1    

national def5se1 or national security2  
or  7vi7 damage affect+ #aj or m        
protect$ comput]s dur+ any #a-ye> p]iod2
  7,b7 a f9e "u ?is title1 imprisonm5t =
 n m ?an #aj ye>s1 or bo?1 9 ! case ( an
 (f5se "u subsection 7a77#e77;,b71 if ! 
(f5se caus$ a h>m provid$ 9 clauses 7i7 
?r\gh 7vi7 ( subp>agraph 7,a7 ( ?is     
subsection2  7,c7 if ! (f5d] attempts to
 cause or kn[+ly or recklessly causes   
dea? f conduct 9 violation ( subsection 
7a77#e77;,a71 a f9e "u ?is title1       
imprisonm5t = any t]m ( ye>s or = life1 
or bo?2 or  7,d7 a f9e "u ?is title1    
imprisonm5t = n m ?an #a ye>1 or bo?1 = 
any o!r (f5se "u subsection 7a77#e72    
7#f7 a f9e "u ?is title or imprisonm5t =
 n m ?an #aj ye>s1 or bo?1 9 ! case ( an
 (f5se "u subsection 7a77#f7 ( ?is      
section2 or  7#g7 a f9e "u ?is title or 
imprisonm5t = n m ?an #aj ye>s1 or bo?1 
9 ! case ( an (f5se "u subsection       
7a77#g7 ( ?is section4  4  #ajd4        
,traffick+ 9 passwords ,section         
#ajcj7;a7 ( title #ah1 ,unit$ ,/ates    

,code1 is am5d$ by /rik+ p>agraph 7#f7 &
 ins]t+ ! foll[+3  7#f7 kn[+ly & ) int5t
 to defraud traffics 7z def9$ 9 section 
#ajbi7 9-- 7,a7 any password or simil>  
in=mation ?r\gh :i* a protect$ comput] z
 def9$ 9 subp>agraphs 7,a7 & 7,b7 (     
subsection 7e77#b7 may be access$ )\t   
au?orization2 or  7,b7 any means (      
access ?r\gh :i* a protect$ comput] z   
def9$ 9 subsection 7e77#b77;,a7 may be  
access$ )\t au?orization4  4  #aje4     
,conspiracy & attempt$ comput] fraud    
(f5ses ,section #ajcj7;b7 ( title #ah1  
,unit$ ,/ates ,code1 is am5d$ by ins]t+ 
= ! complet$ (f5se aft] puni%$ z        
provid$4  #ajf4 ,crim9al & civil        
=feiture = fraud & relat$ activity 9    
connection ) comput]s ,section #ajcj (  
title #ah1 ,unit$ ,/ates ,code1 is am5d$
 by /rik+ subsections 7i7 & 7j7 & ins]t+
 ! foll[+3  7i7 ,crim9al ,=feiture  7#a7
 ,! c\rt1 9 impos+ s5t5ce on any p]son  
convict$ ( a violation ( ?is section1 or
 convict$ ( conspiracy to violate ?is   
section1 %all ord]1 9 addition to any   

o!r s5t5ce impos$ & irrespective ( any  
provision ( ,/ate law1 t su* p]son =feit
 to ! ,unit$ ,/ates-- 7,a7 su* p]son's  
int]e/ 9 any prop]ty1 real or p]sonal1 t
 0 us$1 or int5d$ to be us$1 to commit  
or facilitate ! commission ( su*        
violation2 &  7,b7 any prop]ty1 real or 
p]sonal1 con/itut+ or d]iv$ f any gross 
proce$s1 or any prop]ty traceable to su*
 prop]ty1 t su* p]son obta9$1 directly  
or indirectly1 z a result ( su*         
violation4  7#b7 ,! crim9al =feiture (  
prop]ty "u ?is subsection1 includ+ any  
seizure & disposition ( ! prop]ty1 & any
 relat$ judicial or adm9i/rative        
proce$+1 %all be gov]n$ by ! provisions 
( section #dac ( ! ,compreh5sive ,drug  
,abuse ,prev5tion & ,control ,act (     
#aigj 7#ba ,u4,s4,c4 #hec71 except      
subsection 7d7 ( t section4  7j7 ,civil 
,=feiture  7#a7 ,! foll[+ %all be       
subject to =feiture to ! ,unit$ ,/ates &
 no prop]ty "r1 real or p]sonal1 %all   
exi/ 9 !m3 7,a7 ,any prop]ty1 real or   
p]sonal1 t 0 us$1 or int5d$ to be us$1  

to commit or facilitate ! commission (  
any violation ( ?is section1 or a       
conspiracy to violate ?is section4  7,b7
 ,any prop]ty1 real or p]sonal1         
con/itut+ or d]iv$ f any gross proce$s  
obta9$ directly or indirectly1 or any   
prop]ty traceable to su* prop]ty1 z a   
result ( ! commission ( any violation ( 
?is section1 or a conspiracy to violate 
?is section4  7#b7 ,seizures & =feitures
 "u ?is subsection %all be gov]n$ by !  
provisions 9 *apt] #df relat+ to civil  
=feitures1 except t su* duties z are    
impos$ on ! ,secret>y ( ! ,treasury "u !
 cu/oms laws describ$ 9 section #iha7;d7
 %all be p]=m$ by su* (fic]s1 ag5ts &   
o!r p]sons z may be designat$ = t       
purpose by ! ,secret>y ( ,homel&        
,security or ! ,attorney ,g5]al4  4     
#ajg4 ,limitation on civil actions      
involv+ unau?oriz$ use ,section         
#ajcj7;g7 ( title #ah1 ,unit$ ,/ates    
,code1 is am5d$-- 7#a7 by ins]t+ 7#a7   
be=e ,any p]son2 &  7#b7 by add+ at !   
end ! foll[+3  7#b7 ,no action may be   

br\ght "u ?is subsection if a violation 
( a contractual obligation or agreem5t1 
su* z an acceptable use policy or t]ms (
 s]vice agreem5t1 con/itutes ! sole     
basis = det]m9+ t access to ! protect$  
comput] is unau?oriz$1 or 9 excess (    
au?orization4  4  #ajh4 ,report+ ( c]ta9
 crim9al cases ,section #ajcj ( title   
#ah1 ,unit$ ,/ates ,code1 is am5d$ by   
add+ at ! end ! foll[+3  7k7 ,report+   
c]ta9 crim9al cases ,n lat] ?an #a ye>  
aft] ! date ( ! enactm5t ( ?is ,act1 &  
annually !reaft]1 ! ,attorney ,g5]al    
%all report to ! ,committee on !        
,judici>y ( ! ,s5ate & ! ,committee on !
 ,judici>y ( ! ,h\se ( ,repres5tatives !
 numb] ( crim9al cases br\ght "u        
subsection 7a7 t involve conduct 9 :i*--
 7#a7 ! def5dant-- 7,a7 exce$$ au?oriz$ 
access to a non-gov]nm5tal comput]2 or  
7,b7 access$ a non-gov]nm5tal comput]   
)\t au?orization2 &  7#b7 ! sole basis =
 ! ,gov]nm5t det]m9+ t access to !      
non-gov]nm5tal comput] 0 unau?oriz$1 or 
9 excess ( au?orization 0 t ! def5dant  

violat$ a contractual obligation or     
agreem5t ) a s]vice provid] or employ]1 
su* z an acceptable use policy or t]ms (
 s]vice agreem5t4  4  #aji4 ,damage to  
critical infra/ructure comput]s  7a7 ,9 
g5]al ,*apt] #dg ( title #ah1 ,unit$    
,/ates ,code1 is am5d$ by ins]t+ aft]   
section #ajcj ! foll[+3  #ajcj;,a4      
,aggravat$ damage to a critical         
infra/ructure comput]  7a7 ,def9itions  
,9 ?is section-- 7#a7 ! t]ms comput] &  
damage h ! mean+s giv5 su* t]ms 9       
section #ajcj2 &  7#b7 ! t]m critical   
infra/ructure comput] means a comput] t 
manages or controls sy/ems or assets    
vital to national def5se1 national      
security1 national economic security1   
public heal? or safety1 or any          
comb9ation ( ^? matt]s1 :e!r publicly or
 privately own$ or op]at$1 includ+--    
7,a7 gas & oil production1 /orage1 &    
deliv]y sy/ems2  7,b7 wat] supply       
sy/ems2  7,c7 telecommunication         
networks2  7,d7 electrical p[] deliv]y  
sy/ems2  7,e7 f9ance & bank+ sy/ems2    

7,f7 em]g5cy s]vices2  7,g7             
transportation sy/ems & s]vices2 &  7,h7
 gov]nm5t op]ations t provide ess5tial  
s]vices to ! public4  7b7 ,(f5se ,x %all
 be unlawful to1 dur+ & 9 relation to a 
felony violation ( section #ajcj1       
int5tionally cause or attempt to cause  
damage to a critical infra/ructure      
comput]1 & su* damage results 9 7or1 9 !
 case ( an attempt1 w\ld1 if complet$ h 
result$ 97 ! sub/antial impairm5t-- 7#a7
 ( ! op]ation ( ! critical infra/ructure
 comput]2 or  7#b7 ( ! critical         
infra/ructure associat$ ) ! comput]4    
7c7 ,p5alty ,any p]son :o violates      
subsection 7b7 %all be f9$ "u ?is title1
 imprison$ = n less ?an #c ye>s nor m   
?an #bj ye>s1 or bo?4  7d7 ,consecutive 
s5t5ce ,not)/&+ any o!r provision (     
law-- 7#a7 a c\rt %all n place on       
probation any p]son convict$ ( a        
violation ( ?is section2  7#b7 except z 
provid$ 9 p>agraph 7#d71 no t]m (       
imprisonm5t impos$ on a p]son "u ?is    
section %all run concurr5tly ) any o!r  

t]m ( imprisonm5t1 includ+ any t]m (    
imprisonm5t impos$ on ! p]son "u any o!r
 provision ( law1 includ+ any t]m (     
imprisonm5t impos$ = ! felony violation 
section #ajcj2  7#c7 9 det]m9+ any t]m (
 imprisonm5t to be impos$ = a felony    
violation ( section #ajcj1 a c\rt %all n
 9 any way r$uce ! t]m to be impos$ =   
su* crime s z to comp5sate =1 or o!rwise
 take into acc\nt1 any sep>ate t]m (    
imprisonm5t impos$ or to be impos$ = a  
violation ( ?is section2 &  7#d7 a t]m (
 imprisonm5t impos$ on a p]son = a      
violation ( ?is section may1 9 !        
discretion ( ! c\rt1 run concurr5tly1 9 
:ole or 9 "p1 only ) ano!r t]m (        
imprisonm5t t is impos$ by ! c\rt at !  
same "t on t p]son = an additional      
violation ( ?is section1 provid$ t su*  
discretion %all be ex]cis$ 9 accordance 
) any applicable guidel9es & policy     
/atem5ts issu$ by ! ,unit$ ,/ates       
,s5t5c+ ,commission pursuant to section 
#iid ( title #bh4  4  7b7 ,te*nical &   
con=m+ am5dm5t ,! table ( sections =    

*apt] #dg ( title #ah1 ,unit$ ,/ates    
,code1 is am5d$ by ins]t+ aft] ! item   
relat+ to section #ajcj ! foll[+3       
#ajcj;,a4 ,aggravat$ damage to a        
critical infra/ructure comput]4  4      
#aaj4 ,limitation on actions involv+    
unau?oriz$ use ,section #ajcj7;e77#f7 ( 
title #ah1 ,unit$ ,/ates ,code1 is am5d$
 by /rik+ alt]2 & ins]t+ alt]1 b does n 
include access 9 violation ( a          
contractual obligation or agreem5t1 su* 
z an acceptable use policy or t]ms (    
s]vice agreem5t1 ) an ,int]net s]vice   
provid]1 ,int]net website1 or           
non-gov]nm5t employ]1 if su* violation  
con/itutes ! sole basis = det]m9+ t     
access to a protect$ comput] is         
unau?oriz$24  ,,ii ,privacy & security (
 p]sonally id5tifiable in=mation  ,a ,a 
,data ,privacy & ,security ,program     
#bja4 ,purpose & applicability ( data   
privacy & security program  7a7 ,purpose
 ,! purpose ( ?is subtitle is to ensure 
/&>ds = develop+ & implem5t+            
adm9i/rative1 te*nical1 & physical      

safegu>ds to protect ! security (       
s5sitive p]sonally id5tifiable          
in=mation4  7b7 ,applicability ,a       
bus9ess entity engag+ 9 int]/ate comm]ce
 t involves collect+1 access+1          
transmitt+1 us+1 /or+1 or dispos+ (     
s5sitive p]sonally id5tifiable in=mation
 9 electronic or digital =m on #aj1jjj  
or m ,unit$ ,/ates p]sons is subject to 
! requirem5ts = a data privacy &        
security program "u section #bjb =      
protect+ s5sitive p]sonally id5tifiable 
in=mation4  7c7 ,limitations ,not)/&+   
any o!r obligation "u ?is subtitle1 ?is 
subtitle does n apply to ! foll[+3 7#a7 
,f9ancial in/itutions ,f9ancial         
in/itutions-- 7,a7 subject to ! data    
security requirem5ts & /&>ds "u section 
#eja7;b7 ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja7;b772 &  7,b7      
subject to ! jurisdiction ( an ag5cy or 
au?ority describ$ 9 section #eje7;a7 ( !
 ,gramm-,lea*-,bliley ,act 7#ae         
,u4,s4,c4 #fhje7;a774  7#b7 ,,hipaa     
regulat$ entities  7,a7 ,cov]$ entities 

,cov]$ entities subject to ! ,heal?     
,insurance ,portability & ,acc\ntability
 ,act ( #aiif 7#db ,u4,s4,c4 #acja et   
seq471 includ+ ! data security          
requirem5ts & implem5t+ regulations ( t 
,act4  7,b7 ,bus9ess entities ,a bus9ess
 entity %all be deem$ 9 compliance ) ?is
 ,act if ! bus9ess entity-- 7i7 is act+ 
z a bus9ess associate1 z t t]m is def9$ 
"u ! ,heal? ,insurance ,portability &   
,acc\ntability ,act ( #aiif 7#db        
,u4,s4,c4 #acja et seq47 & is 9         
compliance ) ! requirem5ts impos$ "u t  
,act & implem5t+ regulations promulgat$ 
"u t ,act2 &  7ii7 is subject to1 &     
curr5tly 9 compliance1 ) ! privacy &    
data security requirem5ts "u sections   
#acdja & #acdjd ( division ,a ( !       
,am]ican ,re9ve/m5t & ,recov]y ,act (   
#bjji 7#db ,u4,s4,c4 #agica & #agicd7 & 
implem5t+ regulations promulgat$ "u su* 
sections4  7#c7 ,s]vice provid]s ,a     
s]vice provid] = any electronic         
communication by a ?ird p>ty1 to ! ext5t
 t ! s]vice provid] is exclusively      

engag$ 9 ! transmission1 r\t+1 or       
tempor>y1 int]m$iate1 or transi5t /orage
 ( t communication4  7#d7 ,public       
records ,public records n o!rwise       
subject to a confid5tiality or          
nondisclosure requirem5t1 or in=mation  
obta9$ f a public record1 includ+       
in=mation obta9$ f a news report or     
p]iodical4  7d7 ,safe ,h>bors  7#a7 ,9  
g5]al ,a bus9ess entity %all be deem$ 9 
compliance ) ! privacy & security       
program requirem5ts "u section #bjb if !
 bus9ess entity complies ) or provides  
protection equal to indu/ry /&>ds or    
/&>ds widely accept$ z an effective     
indu/ry practice1 z id5tifi$ by ! ,f$]al
 ,trade ,commission1 t are applicable to
 ! type ( s5sitive p]sonally id5tifiable
 in=mation involv$ 9 ! ord9>y c\rse (   
bus9ess ( su* bus9ess entity4  7#b7     
,limitation ,no?+ 9 ?is subsection %all 
be con/ru$ to p]mit1 & no?+ does p]mit1 
! ,f$]al ,trade ,commission to issue    
regulations requir+1 or accord+ great]  
legal /atus to1 ! implem5tation ( or    

application ( a specific te*nology or   
te*nological specifications = meet+ !   
requirem5ts ( ?is title4  #bjb4         
,requirem5ts = a p]sonal data privacy & 
security program  7a7 ,p]sonal ,data    
,privacy & ,security ,program ,a bus9ess
 entity subject to ?is subtitle %all    
comply ) ! foll[+ safegu>ds & any o!r   
adm9i/rative1 te*nical1 or physical     
safegu>ds id5tifi$ by ! ,f$]al ,trade   
,commission 9 a rulemak+ process        
pursuant to section #eec ( title #e1    
,unit$ ,/ates ,code1 = ! protection (   
s5sitive p]sonally id5tifiable          
in=mation3 7#a7 ,scope ,a bus9ess entity
 %all implem5t a compreh5sive p]sonal   
data privacy & security program t       
includes adm9i/rative1 te*nical1 &      
physical safegu>ds appropriate to ! size
 & complexity ( ! bus9ess entity & !    
nature & scope ( its activities4  7#b7  
,design ,! p]sonal data privacy &       
security program %all be design$ to--   
7,a7 ensure ! privacy1 security1 &      
confid5tiality ( s5sitive p]sonally     

id5tify+ in=mation2  7,b7 protect aga9/ 
any anticipat$ vuln]abilities to !      
privacy1 security1 or integrity (       
s5sitive p]sonally id5tify+ in=mation2 &
  7,c7 protect aga9/ unau?oriz$ access  
to use ( s5sitive p]sonally id5tify+    
in=mation t c\ld create a significant   
risk ( h>m or fraud to any individual4  
7#c7 ,risk assessm5t ,a bus9ess entity  
%all-- 7,a7 id5tify reasonably =eseeable
 int]nal & ext]nal vuln]abilities t c\ld
 result 9 unau?oriz$ access1 disclosure1
 use1 or alt]ation ( s5sitive p]sonally 
id5tifiable in=mation or sy/ems conta9+ 
s5sitive p]sonally id5tifiable          
in=mation2  7,b7 assess ! likelihood ( &
 pot5tial damage f unau?oriz$ access1   
disclosure1 use1 or alt]ation ( s5sitive
 p]sonally id5tifiable in=mation2  7,c7 
assess ! suffici5cy ( its policies1     
te*nologies1 & safegu>ds 9 place to     
control & m9imize risks f unau?oriz$    
access1 disclosure1 use1 or alt]ation ( 
s5sitive p]sonally id5tifiable          
in=mation2 &  7,d7 assess ! vuln]ability

 ( s5sitive p]sonally id5tifiable       
in=mation dur+ de/ruction & disposal (  
su* in=mation1 includ+ ?r\gh ! disposal 
or retirem5t ( h>dw>e4  7#d7 ,risk      
managem5t & control ,ea* bus9ess entity 
%all-- 7,a7 design its p]sonal data     
privacy & security program to control ! 
risks id5tifi$ "u p>agraph 7#c72  7,b7  
adopt measures comm5surate ) !          
s5sitivity ( ! data z well z ! size1    
complexity1 & scope ( ! activities ( !  
bus9ess entity t-- 7i7 control access to
 sy/ems & facilities conta9+ s5sitive   
p]sonally id5tifiable in=mation1 includ+
 controls to au!nticate & p]mit access  
only to au?oriz$ individuals2  7ii7     
detect1 record1 & pres]ve in=mation     
relevant to actual & attempt$ fraudul5t1
 unlawful1 or unau?oriz$ access1        
disclosure1 use1 or alt]ation ( s5sitive
 p]sonally id5tifiable in=mation1       
includ+ by employees & o!r individuals  
o!rwise au?oriz$ to h access2  7iii7    
protect s5sitive p]sonally id5tifiable  
in=mation dur+ use1 transmission1       

/orage1 & disposal by encryption1       
r$action1 or access controls t are      
widely accept$ z an effective indu/ry   
practice or indu/ry /&>d1 or o!r        
reasonable means 7includ+ z direct$ =   
disposal ( records "u section #fbh ( !  
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afhaw7 & ! implem5t+         
regulations ( su* ,act z set =? 9       
section #fhb ( title #af1 ,code ( ,f$]al
 ,regulations72  7iv7 ensure t s5sitive 
p]sonally id5tifiable in=mation is      
prop]ly de/roy$ & dispos$ (1 includ+    
dur+ ! de/ruction ( comput]s1 diskettes1
 & o!r electronic m$ia t conta9 s5sitive
 p]sonally id5tifiable in=mation2  7v7  
trace access to records conta9+ s5sitive
 p]sonally id5tifiable in=mation s t !  
bus9ess entity c det]m9e :o access$ or  
acquir$ su* s5sitive p]sonally          
id5tifiable in=mation p]ta9+ to specific
 individuals2 &  7vi7 ensure t no ?ird  
p>ty or cu/om] ( ! bus9ess entity is    
au?oriz$ to access or acquire s5sitive  
p]sonally id5tifiable in=mation )\t !   

bus9ess entity fir/ p]=m+ suffici5t due 
dilig5ce to asc]ta91 ) reasonable       
c]ta9ty1 t su* in=mation is be+ s\ght = 
a valid legal purpose2 &  7,c7 e/abli% a
 plan & proc$ures = m9imiz+ ! am\nt (   
s5sitive p]sonally id5tifiable in=mation
 ma9ta9$ by su* bus9ess entity1 :i* %all
 provide = ! ret5tion ( s5sitive        
p]sonally id5tifiable in=mation only z  
reasonably ne$$ = ! bus9ess purposes (  
su* bus9ess entity or z necess>y to     
comply ) any legal obligation4  7b7     
,tra9+ ,ea* bus9ess entity subject to   
?is subtitle %all take /eps to ensure   
employee tra9+ & sup]vision =           
implem5tation ( ! data security program 
( ! bus9ess entity4  7c7 ,vuln]ability  
te/+  7#a7 ,9 g5]al ,ea* bus9ess entity 
subject to ?is subtitle %all take /eps  
to ensure regul> te/+ ( key controls1   
sy/ems1 & proc$ures ( ! p]sonal data    
privacy & security program to detect1   
prev5t1 & respond to attacks or         
intrusions1 or o!r sy/em failures4  7#b7
 ,frequ5cy ,! frequ5cy & nature ( ! te/s

 requir$ "u p>agraph 7#a7 %all be       
det]m9$ by ! risk assessm5t ( ! bus9ess 
entity "u subsection 7a77#c74  7d7      
,relation%ip to c]ta9 provid]s ( s]vices
 ,9 ! ev5t a bus9ess entity subject to  
?is subtitle engages a p]son or entity n
 subject to ?is subtitle 7o!r ?an a     
s]vice provid]7 to receive s5sitive     
p]sonally id5tifiable in=mation 9 p]=m+ 
s]vices or functions 7o!r ?an ! s]vices 
or functions provid$ by a s]vice        
provid]7 on behalf ( & "u ! in/ruction (
 su* bus9ess entity1 su* bus9ess entity 
%all-- 7#a7 ex]cise appropriate due     
dilig5ce 9 select+ ! p]son or entity =  
responsibilities relat$ to s5sitive     
p]sonally id5tifiable in=mation1 & take 
reasonable /eps to select & reta9 a     
p]son or entity t is capable ( ma9ta9+  
appropriate safegu>ds = ! security1     
privacy1 & integrity ( ! s5sitive       
p]sonally id5tifiable in=mation at      
issue2 &  7#b7 require ! p]son or entity
 by contract to implem5t & ma9ta9       
appropriate measures design$ to meet !  

objectives & requirem5ts gov]n+ entities
 subject to section #bja1 ?is section1 &
 subtitle ,b4  7e7 ,p]iodic ,assessm5t &
 ,p]sonal ,data ,privacy & ,security    
,mod]nization ,ea* bus9ess entity       
subject to ?is subtitle %all on a regul>
 basis monitor1 evaluate1 & adju/1 z    
appropriate its data privacy & security 
program 9 light ( any relevant *anges   
9-- 7#a7 te*nology2  7#b7 ! s5sitivity (
 p]sonally id5tifiable in=mation2  7#c7 
int]nal or ext]nal ?reats to p]sonally  
id5tifiable in=mation2 &  7#d7 ! *ang+  
bus9ess arrangem5ts ( ! bus9ess entity1 
su* z-- 7,a7 m]g]s & acquisitions2  7,b7
 alliances & jo9t v5tures2  7,c7        
outs\rc+ arrangem5ts2  7,d7 bankruptcy2 
&  7,e7 *anges to s5sitive p]sonally    
id5tifiable in=mation sy/ems4  7f7      
,implem5tation ,timel9e ,n lat] ?an #a  
ye> aft] ! date ( enactm5t ( ?is ,act1 a
 bus9ess entity subject to ! provisions 
( ?is subtitle %all implem5t a data     
privacy & security program pursuant to  
?is subtitle4  #bjc4 ,en=cem5t  7a7     

,civil ,p5alties  7#a7 ,9 g5]al ,any    
bus9ess entity t violates ! provisions (
 section #bja or #bjb %all be subject to
 civil p5alties ( n m ?an #e1jjj p]     
violation p] day :ile su* a violation   
exi/s1 ) a maximum ( #ejj1jjj p]        
violation4  7#b7 ,int5tional or willful 
violation ,a bus9ess entity t           
int5tionally or willfully violates !    
provisions ( section #bja or #bjb %all  
be subject to additional p5alties 9 !   
am\nt ( #e1jjj p] violation p] day :ile 
su* a violation exi/s1 ) a maximum ( an 
additional #ejj1jjj p] violation4  7#c7 
,p5alty limits  7,a7 ,9 g5]al ,not)/&+  
any o!r provision ( law1 ! total sum (  
civil p5alties assess$ aga9/ a bus9ess  
entity = all violations ( ! provisions (
 ?is subtitle result+ f ! same or relat$
 acts or omissions %all n exce$         
#ejj1jjj1 unless su* conduct is f\nd to 
be willful or int5tional4  7,b7         
,det]m9ations ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle  
has occurr$1 & if s1 ! am\nt ( ! p5alty 

to be impos$1 if any1 %all be made by ! 
c\rt sitt+ z ! f9d] ( fact4 ,!          
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle 0 willful or   
int5tional1 & if s1 ! am\nt ( !         
additional p5alty to be impos$1 if any1 
%all be made by ! c\rt sitt+ z ! f9d] ( 
fact4  7,c7 ,additional p5alty limit ,if
 a c\rt det]m9es "u subp>agraph 7,b7 t a
 violation ( a provision ( ?is subtitle 
0 willful or int5tional & imposes an    
additional p5alty1 ! c\rt may n impose  
an additional p5alty 9 an am\nt t exce$s
 #ejj1jjj4  7#d7 ,equitable relief ,a   
bus9ess entity engag$ 9 int]/ate comm]ce
 t violates ?is section may be enjo9$ f 
fur!r violations by a ,unit$ ,/ates     
di/rict c\rt4  7#e7 ,o!r rights &       
rem$ies ,! rights & rem$ies available "u
 ?is section are cumulative & %all n    
affect any o!r rights & rem$ies         
available "u law4  7b7 ,f$]al ,trade    
,commission ,au?ority ,any bus9ess      
entity %all h ! provisions ( ?is        
subtitle en=c$ aga9/ x by ! ,f$]al      

,trade ,commission4  7c7 ,/ate ,en=cem5t
  7#a7 ,civil actions ,9 any case 9 :i* 
! attorney g5]al ( a ,/ate or any ,/ate 
or local law en=cem5t ag5cy au?oriz$ by 
! ,/ate attorney g5]al or by ,/ate      
/atute to prosecute violations ( consum]
 protection law1 has reason to believe t
 an int]e/ ( ! resid5ts ( t ,/ate has   
be5 or is ?reat5$ or adv]sely affect$ by
 ! acts or practices ( a bus9ess entity 
t violate ?is subtitle1 ! ,/ate may br+ 
a civil action on behalf ( ! resid5ts ( 
t ,/ate 9 a di/rict c\rt ( ! ,unit$     
,/ates ( appropriate jurisdiction to--  
7,a7 enjo9 t act or practice2  7,b7     
en=ce compliance ) ?is subtitle2 or     
7,c7 obta9 civil p5alties ( n m ?an     
#e1jjj p] violation p] day :ile su*     
violations p]si/1 up to a maximum (     
#ejj1jjj p] violation4  7#b7 ,p5alty    
limits  7,a7 ,9 g5]al ,not)/&+ any o!r  
provision ( law1 ! total sum ( civil    
p5alties assess$ aga9/ a bus9ess entity 
= all violations ( ! provisions ( ?is   
subtitle result+ f ! same or relat$ acts

 or omissions %all n exce$ #ejj1jjj1    
unless su* conduct is f\nd to be willful
 or int5tional4  7,b7 ,det]m9ations ,!  
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle has occurr$1 & 
if s1 ! am\nt ( ! p5alty to be impos$1  
if any1 %all be made by ! c\rt sitt+ z !
 f9d] ( fact4 ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional1 & if s1 ! am\nt 
( ! additional p5alty to be impos$1 if  
any1 %all be made by ! c\rt sitt+ z !   
f9d] ( fact4  7,c7 ,additional p5alty   
limit ,if a c\rt det]m9es "u subp>agraph
 7,b7 t a violation ( a provision ( ?is 
subtitle 0 willful or int5tional &      
imposes an additional p5alty1 ! c\rt may
 n impose an additional p5alty 9 an     
am\nt t exce$s #ejj1jjj4  7#c7 ,notice  
7,a7 ,9 g5]al ,be=e fil+ an action "u   
?is subsection1 ! attorney g5]al ( !    
,/ate involv$ %all provide to ! ,f$]al  
,trade ,commission-- 7i7 a writt5 notice
 ( t action2 &  7ii7 a copy ( ! compla9t
 = t action4  7,b7 ,exception           

,subp>agraph 7,a7 %all n apply ) respect
 to ! fil+ ( an action by an attorney   
g5]al ( a ,/ate "u ?is subsection1 if ! 
attorney g5]al ( a ,/ate det]m9es t x is
 n feasible to provide ! notice describ$
 9 ?is subp>agraph be=e ! fil+ ( !      
action4  7,c7 ,notification :5          
practicable ,9 an action describ$ "u    
subp>agraph 7,b71 ! attorney g5]al ( a  
,/ate %all provide ! writt5 notice & !  
copy ( ! compla9t to ! ,f$]al ,trade    
,commission z soon aft] ! fil+ ( !      
compla9t z practicable4  7#d7 ,f$]al    
trade commission au?ority ,^u receiv+   
notice "u p>agraph 7#b71 ! ,f$]al ,trade
 ,commission %all h ! "r to-- 7,a7 move 
to /ay ! action1 p5d+ ! f9al disposition
 ( a p5d+ ,f$]al proce$+ or action z    
describ$ 9 p>agraph 7#d72  7,b7 int]v5e 
9 an action br\ght "u p>agraph 7#a72 &  
7,c7 file petitions = appeal4  7#e7     
,p5d+ proce$+s ,if ! ,f$]al ,trade      
,commission initiates a ,f$]al civil    
action = a violation ( ?is subtitle1 or 
any regulations !reund]1 no attorney    

g5]al ( a ,/ate may br+ an action = a   
violation ( ?is subtitle t result$ f !  
same or relat$ acts or omissions aga9/ a
 def5dant nam$ 9 ! ,f$]al civil action  
initiat$ by ! ,f$]al ,trade ,commission4
  7#f7 ,rule ( con/ruction ,= purposes (
 br++ any civil action "u p>agraph 7#a7 
no?+ 9 ?is subtitle %all be con/ru$ to  
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on ! attorney    
g5]al by ! laws ( t ,/ate to-- 7,a7     
conduct inve/igations2  7,b7 adm9i/]    
oa?s & affirmations2 or  7,c7 compel !  
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7#g7 ,v5ue2   
s]vice ( process  7,a7 ,v5ue ,any action
 br\ght "u ?is subsection may be br\ght 
9 ! di/rict c\rt ( ! ,unit$ ,/ates t    
meets applicable requirem5ts relat+ to  
v5ue "u section #acia ( title #bh1      
,unit$ ,/ates ,code4  7,b7 ,s]vice (    
process ,9 an action br\ght "u ?is      
subsection1 process may be s]v$ 9 any   
di/rict 9 :i* ! def5dant-- 7i7 is an    
inhabitant2 or  7ii7 may be f\nd4  7d7  

,no ,private ,cause ( ,action ,no?+ 9   
?is subtitle e/abli%es a private cause (
 action aga9/ a bus9ess entity =        
violation ( any provision ( ?is         
subtitle4  #bjd4 ,relation to o!r laws  
7a7 ,9 ,g5]al ,no ,/ate may require any 
bus9ess entity subject to ?is subtitle  
to comply ) any requirem5ts ) respect to
 adm9i/rative1 te*nical1 & physical     
safegu>ds = ! protection ( p]sonal      
in=mation4  7b7 ,limitations ,no?+ 9 ?is
 subtitle %all be con/ru$ to modify1    
limit1 or sup]s$e ! op]ation ( !        
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq47 or its implem5t+        
regulations1 includ+ ^? adopt$ or en=c$ 
by ,/ates4  ,b ,security ,brea*         
,notification  #baa4 ,notice to         
individuals  7a7 ,9 ,g5]al ,except z    
provid$ 9 section #bab1 any ag5cy1 or   
bus9ess entity engag$ 9 int]/ate        
comm]ce1 o!r ?an a s]vice provid]1 t    
uses1 accesses1 transmits1 /ores1       
disposes ( or collects s5sitive         
p]sonally id5tifiable in=mation %all1   

foll[+ ! discov]y ( a security brea* (  
su* in=mation1 notify any resid5t ( !   
,unit$ ,/ates ^: s5sitive p]sonally     
id5tifiable in=mation has be51 or is    
reasonably believ$ to h be51 access$1 or
 acquir$4  7b7 ,obligation ( ,own] or   
,lic5see  7#a7 ,notice to own] or       
lic5see ,any ag5cy1 or bus9ess entity   
engag$ 9 int]/ate comm]ce1 t uses1      
accesses1 transmits1 /ores1 disposes (1 
or collects s5sitive p]sonally          
id5tifiable in=mation t ! ag5cy or      
bus9ess entity does n own or lic5se %all
 notify ! own] or lic5see ( ! in=mation 
foll[+ ! discov]y ( a security brea*    
involv+ su* in=mation4  7#b7 ,notice by 
own]1 lic5see1 or o!r designat$ ?ird    
p>ty ,no?+ 9 ?is subtitle %all prev5t or
 abrogate an agreem5t betwe5 an ag5cy or
 bus9ess entity requir$ to give notice  
"u ?is section & a designat$ ?ird p>ty1 
includ+ an own] or lic5see ( ! s5sitive 
p]sonally id5tifiable in=mation subject 
to ! security brea*1 to provide !       
notifications requir$ "u subsection 7a74

  7#c7 ,bus9ess entity reliev$ f giv+   
notice ,a bus9ess entity obligat$ to    
give notice "u subsection 7a7 %all be   
reliev$ ( su* obligation if an own] or  
lic5see ( ! s5sitive p]sonally          
id5tifiable in=mation subject to !      
security brea*1 or o!r designat$ ?ird   
p>ty1 provides su* notification4  7#d7  
,s]vice provid]s ,if a s]vice provid]   
becomes aw>e ( a security brea* ( data 9
 electronic =m conta9+ s5sitive p]sonal 
in=mation t is own$ or possess$ by ano!r
 bus9ess entity t connects to or uses a 
sy/em or network provid$ by ! s]vice    
provid] = ! purpose ( transmitt+1 r\t+1 
or provid+ int]m$iate or transi5t /orage
 ( su* data1 ! s]vice provid] %all be   
requir$ to notify ! bus9ess entity :o   
initiat$ su* connection1 transmission1  
r\t+1 or /orage ( ! security brea* if ! 
bus9ess entity c be reasonably id5tifi$4
 ,^u receiv+ su* notification f a s]vice
 provid]1 ! bus9ess entity %all be      
requir$ to provide ! notification       
requir$ "u subsection 7a74  7c7         

,timel9ess ( ,notification  7#a7 ,9     
g5]al ,all notifications requir$ "u ?is 
section %all be made )\t unreasonable   
delay foll[+ ! discov]y by ! ag5cy or   
bus9ess entity ( a security brea*4  7#b7
 ,reasonable delay  7,a7 ,9 g5]al       
,reasonable delay "u ?is subsection may 
include any "t necess>y to det]m9e !    
scope ( ! security brea*1 prev5t fur!r  
disclosures1 conduct ! risk assessm5t   
describ$ 9 section #bjb7;a77#c71 &      
re/ore ! reasonable integrity ( ! data  
sy/em & provide notice to law en=cem5t  
:5 requir$4  7,b7 ,ext5sion  7i7 ,9     
g5]al ,except z provid$ 9 subsection    
7d71 delay ( notification %all n exce$  
#fj days foll[+ ! discov]y ( ! security 
brea*1 unless ! bus9ess entity or ag5cy 
reque/s an ext5sion ( "t & ! ,f$]al     
,trade ,commission det]m9es 9 writ+ t   
additional "t is reasonably necess>y to 
det]m9e ! scope ( ! security brea*1     
prev5t fur!r disclosures1 conduct ! risk
 assessm5t1 re/ore ! reasonable         
integrity ( ! data sy/em1 or to provide 

notice to ! designat$ entity4  7ii7     
,approval ( reque/ ,if ! ,f$]al ,trade  
,commission approves ! reque/ = delay1 !
 ag5cy or bus9ess entity may delay ! "t 
p]iod = notification = additional p]iods
 ( up to #cj days4  7#c7 ,burd5 (       
production ,! ag5cy1 bus9ess entity1    
own]1 or lic5see requir$ to provide     
notice "u ?is subtitle %all1 ^u ! reque/
 ( ! ,attorney ,g5]al or ! ,f$]al ,trade
 ,commission provide records or o!r     
evid5ce ( ! notifications requir$ "u ?is
 subtitle1 includ+ to ! ext5t           
applicable1 ! reasons = any delay (     
notification4  7d7 ,delay ( notification
 au?oriz$ = law en=cem5t or national    
security purposes  7#a7 ,9 g5]al ,if !  
,unit$ ,/ates ,secret ,s]vice or !      
,f$]al ,bureau ( ,inve/igation det]m9es 
t ! notification requir$ "u ?is section 
w\ld imp$e a crim9al inve/igation1 or   
national security activity1 su*         
notification %all be delay$ ^u writt5   
notice f ! ,unit$ ,/ates ,secret ,s]vice
 or ! ,f$]al ,bureau ( ,inve/igation to 

! ag5cy or bus9ess entity t exp]i5c$ !  
brea*4 ,! notification f ! ,unit$ ,/ates
 ,secret ,s]vice or ! ,f$]al ,bureau (  
,inve/igation %all specify 9 writ+ !    
p]iod ( delay reque/$ = law en=cem5t or 
national security purposes4  7#b7       
,ext5d$ delay ( notification ,if !      
notification requir$ "u subsection 7a7  
is delay$ pursuant to p>agraph 7#a71 an 
ag5cy or bus9ess entity %all give notice
 #cj days aft] ! day su* law en=cem5t or
 national security delay 0 invok$ unless
 a ,f$]al law en=cem5t or intellig5ce   
ag5cy provides writt5 notification t    
fur!r delay is necess>y4  7#c7 ,law     
en=cem5t immunity ,no non-con/itutional 
cause ( action %all lie 9 any c\rt aga9/
 any ag5cy = acts relat+ to ! delay (   
notification = law en=cem5t or national 
security purposes "u ?is subtitle4  7e7 
,limitations ,not)/&+ any o!r obligation
 "u ?is subtitle1 ?is subtitle does n   
apply to ! foll[+3 7#a7 ,f9ancial       
in/itutions ,f9ancial in/itutions-- 7,a7
 subject to ! data security requirem5ts 

& /&>ds "u section #eja7;b7 ( !         
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7;b772 &  7,b7 subject to !       
jurisdiction ( an ag5cy or au?ority     
describ$ 9 section #eje7;a7 ( !         
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhje7;a774  7#b7 ,,hipaa regulat$     
entities  7,a7 ,cov]$ entities ,cov]$   
entities subject to ! ,heal? ,insurance 
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acja et seq471    
includ+ ! data security requirem5ts &   
implem5t+ regulations ( t ,act4  7,b7   
,bus9ess entities ,a bus9ess entity %all
 be deem$ 9 compliance ) ?is ,act if !  
bus9ess entity-- 7i7 7,i7 is act+ z a   
cov]$ entity & z a bus9ess associate1 z 
^? t]ms are def9$ "u ! ,heal? ,insurance
 ,portability & ,acc\ntability ,act (   
#aiif 7#db ,u4,s4,c4 #acja et seq47 & is
 9 compliance ) ! requirem5ts impos$ "u 
t ,act & implem5t+ regulations          
promulgat$ "u t ,act2 &  7,,ii7 is      
subject to1 & curr5tly 9 compliance1 ) !
 data brea* notification1 privacy & data

 security requirem5ts "u ! ,heal?       
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? 7,,hite*7 ,act1 7#db    
,u4,s4,c4 #agicb7 & implem5t+           
regulations promulgat$ !reund]2 or  7ii7
 is act+ z a v5dor ( p]sonal heal?      
records & ?ird p>ty s]vice provid]1     
subject to ! ,heal? ,in=mation          
,te*nology = ,economic & ,cl9ical ,heal?
 7,,hite*7 ,act 7#db ,u4,s4,c4 #agicg71 
includ+ ! data brea* notification       
requirem5ts & implem5t+ regulations ( t 
,act4  #bab4 ,exemptions  7a7 ,exemption
 = ,national ,security & ,law ,en=cem5t 
7#a7 ,9 g5]al ,section #baa %all n apply
 to an ag5cy or bus9ess entity if-- 7,a7
 ! ,unit$ ,/ates ,secret ,s]vice or !   
,f$]al ,bureau ( ,inve/igation det]m9es 
t notification ( ! security brea* c\ld  
be expect$ to reveal s5sitive s\rces &  
me?ods or simil>ly imp$e ! ability ( !  
,gov]nm5t to conduct law en=cem5t       
inve/igations2 or  7,b7 ! ,f$]al ,bureau
 ( ,inve/igation det]m9es t notification
 ( ! security brea* c\ld be expect$ to  

cause damage to ! national security4    
7#b7 ,immunity ,no non-con/itutional    
cause ( action %all lie 9 any c\rt aga9/
 any ,f$]al ag5cy = acts relat+ to !    
exemption f notification = law en=cem5t 
or national security purposes "u ?is    
title4  7b7 ,safe ,h>bor  7#a7 ,9 g5]al 
,an ag5cy or bus9ess entity %all be     
exempt f ! notice requirem5ts "u section
 #baa1 if-- 7,a7 a risk assessm5t       
conduct$ by ! ag5cy or bus9ess entity   
concludes t1 bas$ ^u ! in=mation        
available1 !re is no significant risk t 
a security brea* has result$ 91 or w    
result 91 id5tity !ft1 economic loss or 
h>m1 or physical h>m to ! individuals ^:
 s5sitive p]sonally id5tifiable         
in=mation 0 subject to ! security brea*2
  7,b7 )\t unreasonable delay1 b n lat] 
?an #de days aft] ! discov]y ( a        
security brea*1 unless ext5d$ by !      
,f$]al ,trade ,commission1 ! ag5cy or   
bus9ess entity notifies ! ,f$]al ,trade 
,commission1 9 writ+1 (-- 7i7 ! results 
( ! risk assessm5t2 &  7ii7 its decision

 to invoke ! risk assessm5t exemption2 &
  7,c7 ! ,f$]al ,trade ,commission does 
n indicate1 9 writ+1 )9 #aj bus9ess days
 f receipt ( ! decision1 t notice %\ld  
be giv54  7#b7 ,rebuttable presumptions 
,= purposes ( p>agraph 7#a7-- 7,a7 !    
encryption ( s5sitive p]sonally         
id5tifiable in=mation describ$ 9        
p>agraph 7#a77;,a77i7 %all e/abli% a    
rebuttable presumption t no significant 
risk exi/s2 &  7,b7 ! r5d]+ ( s5sitive  
p]sonally id5tifiable in=mation describ$
 9 p>agraph 7#a77;,a77ii7 unusable1     
unreadable1 or indeciph]able ?r\gh data 
security te*nology or me?odology t is   
g5]ally accept$ by exp]ts 9 ! field (   
in=mation security1 su* z r$action or   
access controls %all e/abli% a          
rebuttable presumption t no significant 
risk exi/s4  7#c7 ,violation ,x %all be 
a violation ( ?is section to-- 7,a7 fail
 to conduct ! risk assessm5t 9 a        
reasonable mann]1 or accord+ to /&>ds   
g5]ally accept$ by exp]ts 9 ! field (   
in=mation security2 or  7,b7 submit !   

results ( a risk assessm5t t conta9s    
fraudul5t or delib]ately mislead+       
in=mation4  7c7 ,f9ancial fraud         
prev5tion exemption  7#a7 ,9 g5]al ,a   
bus9ess entity w be exempt f ! notice   
requirem5t "u section #baa if ! bus9ess 
entity utilizes or p>ticipates 9 a      
security program t-- 7,a7 effectively   
blocks ! use ( ! s5sitive p]sonally     
id5tifiable in=mation to initiate       
unau?oriz$ f9ancial transactions be=e !y
 are *>g$ to ! acc\nt ( ! individual2 & 
7,b7 provides = notice to affect$       
individuals aft] a security brea* t has 
result$ 9 fraud or unau?oriz$           
transactions4  7#b7 ,limitation ,!      
exemption 9 p>agraph 7#a7 does n apply  
if ! in=mation subject to ! security    
brea* includes an individual's fir/ &   
la/ "n1 or any o!r type ( s5sitive      
p]sonally id5tifiable in=mation z def9$ 
9 section #c1 unless t in=mation is only
 a cr$it c>d numb] or cr$it c>d security
 code4  #bac4 ,me?ods ( notice ,an ag5cy
 or bus9ess entity %all be 9 compliance 

) section #baa if x provides ! foll[+3  
7#a7 ,individual notice ,notice to      
individuals by "o ( ! foll[+ means3 7,a7
 ,writt5 notification to ! la/ kn[n home
 mail+ address ( ! individual 9 !       
records ( ! ag5cy or bus9ess entity4    
7,b7 ,telephone notice to ! individual  
p]sonally4  7,c7 ,e-mail notice1 if !   
individual has cons5t$ to receive su*   
notice & ! notice is consi/5t ) !       
provisions p]mitt+ electronic           
transmission ( notices "u section #aja (
 ! ,electronic ,signatures 9 ,global &  
,national ,comm]ce ,act 7#ae ,u4,s4,c4  
#gjja74  7#b7 ,m$ia notice ,notice to   
major m$ia outlets s]v+ a ,/ate or      
jurisdiction1 if ! numb] ( resid5ts (   
su* ,/ate ^: s5sitive p]sonally         
id5tifiable in=mation 01 or is          
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son exce$s   
#e1jjj4  #bad4 ,cont5t ( notification   
7a7 ,9 ,g5]al ,reg>dless ( ! me?od by   
:i* notice is provid$ to individuals "u 
section #bac1 su* notice %all include1  

to ! ext5t possible-- 7#a7 a description
 ( ! categories ( s5sitive p]sonally    
id5tifiable in=mation t 01 or is        
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son2  7#b7 a 
toll-free numb]-- 7,a7 t ! individual   
may use to contact ! ag5cy or bus9ess   
entity1 or ! ag5t ( ! ag5cy or bus9ess  
entity2 &  7,b7 f :i* ! individual may  
le>n :at types ( s5sitive p]sonally     
id5tifiable in=mation ! ag5cy or bus9ess
 entity ma9ta9$ ab\t t individual2 &    
7#c7 ! toll-free contact telephone      
numb]s & addresses = ! major cr$it      
report+ ag5cies4  7b7 ,additional cont5t
 ,not)/&+ section #bai1 a ,/ate may     
require t a notice "u subsection 7a7    
%all also include in=mation reg>d+      
victim protection assi/ance provid$ = by
 t ,/ate4  7c7 ,direct ,bus9ess         
,relation%ip ,reg>dless ( :e!r a bus9ess
 entity1 ag5cy1 or a designat$ ?ird p>ty
 provides ! notice requir$ pursuant to  
section #baa7;b71 su* notice %all       
include ! "n ( ! bus9ess entity or ag5cy

 t has a direct relation%ip ) !         
individual be+ notifi$4  #bae4          
,coord9ation ( notification ) cr$it     
report+ ag5cies ,if an ag5cy or bus9ess 
entity is requir$ to provide            
notification to m ?an #e1jjj individuals
 "u section #baa7;a71 ! ag5cy or bus9ess
 entity %all also notify all consum]    
report+ ag5cies t compile & ma9ta9 files
 on consum]s on a nationwide basis 7z   
def9$ 9 section #fjc7p7 ( ! ,fair ,cr$it
 ,report+ ,act 7#ae ,u4,s4,c4           
#afha;a7p777 ( ! tim+ & di/ribution ( ! 
notices4 ,su* notice %all be giv5 to !  
consum] cr$it report+ ag5cies )\t       
unreasonable delay &1 if x w n delay    
notice to ! affect$ individuals1 prior  
to ! di/ribution ( notices to ! affect$ 
individuals4  #baf4 ,notice to law      
en=cem5t  7a7 ,designation ( gov]nm5t   
entity ,to receive notice  7#a7 ,9 g5]al
 ,n lat] ?an #fj days aft] ! date (     
enactm5t ( ?is ,act1 ! ,secret>y (      
,homel& ,security %all designate a      
,f$]al ,gov]nm5t entity to receive !    

notices requir$ "u section #bab & ?is   
section1 & any o!r reports & in=mation  
ab\t in=mation security incid5ts1       
?reats1 & vuln]abilities4  7#b7         
,responsibilities ( ! designat$ entity  
,! designat$ entity %all-- 7,a7 be      
responsible = promptly provid+ !        
in=mation t x receives to ! ,unit$      
,/ates ,secret ,s]vice & ! ,f$]al       
,bureau ( ,inve/igation1 & to ! ,f$]al  
,trade ,commission = civil law en=cem5t 
purposes2 &  7,b7 provide ! in=mation   
describ$ 9 subp>agraph 7,a7 z           
appropriate to o!r ,f$]al ag5cies = law 
en=cem5t1 national security1 or data    
security purposes4  7b7 ,notice ,any    
bus9ess entity or ag5cy %all notify !   
designat$ entity ( ! fact t a security  
brea* has occurr$ if-- 7#a7 ! numb] (   
individuals ^: s5sitive p]sonally       
id5tify+ in=mation 01 or is reasonably  
believ$ to h be5 access$ or acquir$ by  
an unau?oriz$ p]son exce$s #e1jjj2  7#b7
 ! security brea* involves a database1  
network$ or integrat$ databases1 or o!r 

data sy/em conta9+ ! s5sitive p]sonally 
id5tifiable in=mation ( m ?an #ejj1jjj  
individuals nationwide2  7#c7 ! security
 brea* involves databases own$ by !     
,f$]al ,gov]nm5t2 or  7#d7 ! security   
brea* involves prim>ily s5sitive        
p]sonally id5tifiable in=mation (       
individuals kn[n to ! ag5cy or bus9ess  
entity to be employees & contractors ( !
 ,f$]al ,gov]nm5t involv$ 9 national    
security or law en=cem5t4  7c7 ,,ftc    
rulemak+ & review ( ?re%olds  7#a7      
,reports ,n lat] ?an #a ye> aft] ! date 
( ! enactm5t ( ?is ,act1 ! ,f$]al ,trade
 ,commission1 9 consultation ) !        
,attorney ,g5]al ( ! ,unit$ ,/ates & !  
,secret>y ( ,homel& ,security1 %all     
promulgate regulations "u section #eec (
 title #e1 ,unit$ ,/ates ,code1 reg>d+ !
 reports requir$ "u subsection 7a74     
7#b7 ,?re%olds = notice ,! ,f$]al ,trade
 ,commission1 9 consultation ) !        
,attorney ,g5]al & ! ,secret>y ( ,homel&
 ,security1 aft] notice & ! opportunity 
= public comm5t1 & 9 a mann] consi/5t ) 

?is section1 %all promulgate            
regulations1 z necess>y1 "u section #eec
 ( title #e1 ,unit$ ,/ates ,code1 to    
adju/ ! ?re%olds = notice to law        
en=cem5t & national security au?orities 
"u subsection 7a7 & to facilitate !     
purposes ( ?is section4  7d7 ,tim+ ,!   
notice requir$ "u subsection 7a7 %all be
 provid$ z promptly z possible1 b su*   
notice mu/ be provid$ ei!r #gb h\rs be=e
 notice is provid$ to an individual     
pursuant to section #baa1 or n lat] ?an 
#aj days aft] ! bus9ess entity or ag5cy 
discov]s ! security brea* or discov]s t 
! nature ( ! security brea* requires    
notice to law en=cem5t "u ?is section1  
:i*ev] occurs fir/4  #bag4 ,en=cem5t    
7a7 ,9 g5]al ,! ,attorney ,g5]al & !    
,f$]al ,trade ,commission may en=ce     
civil violations ( section #baa4  7b7   
,civil actions by ! ,attorney ,g5]al ( !
 ,unit$ ,/ates  7#a7 ,9 g5]al ,!        
,attorney ,g5]al may br+ a civil action 
9 ! appropriate ,unit$ ,/ates di/rict   
c\rt aga9/ any bus9ess entity t engages 

9 conduct con/itut+ a violation ( ?is   
subtitle &1 ^u pro( ( su* conduct by a  
prepond]ance ( ! evid5ce1 su* bus9ess   
entity %all be subject to a civil p5alty
 ( n m ?an #aa1jjj p] day p] security   
brea*4  7#b7 ,p5alty limitation ,not)/&+
 any o!r provision ( law1 ! total am\nt 
( ! civil p5alty assess$ aga9/ a bus9ess
 entity = conduct involv+ ! same or     
relat$ acts or omissions t results 9 a  
violation ( ?is subtitle may n exce$    
#a1jjj1jjj4  7#c7 ,det]m9ations ,!      
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle has occurr$1 & 
if s1 ! am\nt ( ! p5alty to be impos$1  
if any1 %all be made by ! c\rt sitt+ z !
 f9d] ( fact4 ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional1 & if s1 ! am\nt 
( ! additional p5alty to be impos$1 if  
any1 %all be made by ! c\rt sitt+ z !   
f9d] ( fact4  7#d7 ,additional p5alty   
limit ,if a c\rt det]m9es "u p>agraph   
7#c7 t a violation ( a provision ( ?is  
subtitle 0 willful or int5tional &      

imposes an additional p5alty1 ! c\rt may
 n impose an additional p5alty 9 an     
am\nt t exce$s #a1jjj1jjj4  7c7         
,injunctive actions by ! ,attorney      
,g5]al  7#a7 ,9 g5]al ,if x appe>s t a  
bus9ess entity has engag$1 or is engag$1
 9 any act or practice con/itut+ a      
violation ( ?is subtitle1 ! ,attorney   
,g5]al may petition an appropriate      
di/rict c\rt ( ! ,unit$ ,/ates = an     
ord]-- 7,a7 enjo9+ su* act or practice2 
or  7,b7 en=c+ compliance ) ?is         
subtitle4  7#b7 ,issuance ( ord] ,a c\rt
 may issue an ord] "u p>agraph 7#a71 if 
! c\rt f9ds t ! conduct 9 "q con/itutes 
a violation ( ?is subtitle4  7d7 ,civil 
actions by ! ,f$]al ,trade ,commission  
7#a7 ,9 g5]al ,compliance ) !           
requirem5ts impos$ "u ?is subtitle may  
be en=c$ "u ! ,f$]al ,trade ,commission 
,act 7#ae ,u4,s4,c4 #da et seq47 by !   
,f$]al ,trade ,commission ) respect to  
bus9ess entities subject to ?is ,act4   
,all ( ! functions & p[]s ( ! ,f$]al    
,trade ,commission "u ! ,f$]al ,trade   

,commission ,act are available to !     
,commission to en=ce compliance by any  
p]son ) ! requirem5ts impos$ "u ?is     
title4  7#b7 ,p5alty limitation  7,a7 ,9
 g5]al ,not)/&+ any o!r provision ( law1
 ! total sum ( civil p5alties assess$   
aga9/ a bus9ess entity = all violations 
( ! provisions ( ?is subtitle result+ f 
! same or relat$ acts or omissions may n
 exce$ #a1jjj1jjj1 unless su* conduct is
 f\nd to be willful or int5tional4  7,b7
 ,det]m9ations ,! det]m9ation ( :e!r a  
violation ( a provision ( ?is subtitle  
has occurr$1 & if s1 ! am\nt ( ! p5alty 
to be impos$1 if any1 %all be made by ! 
c\rt sitt+ z ! f9d] ( fact4 ,!          
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle 0 willful or   
int5tional1 & if s1 ! am\nt ( !         
additional p5alty to be impos$1 if any1 
%all be made by ! c\rt sitt+ z ! f9d] ( 
fact4  7,c7 ,additional p5alty limit ,if
 a c\rt det]m9es "u subp>agraph 7,b7 t a
 violation ( a provision ( ?is subtitle 
0 willful or int5tional & imposes an    

additional p5alty1 ! c\rt may n impose  
an additional p5alty 9 an am\nt t exce$s
 #a1jjj1jjj4  7#c7 ,unfair or deceptive 
acts or practices ,= ! purpose ( !      
ex]cise by ! ,f$]al ,trade ,commission (
 its functions & p[]s "u ! ,f$]al ,trade
 ,commission ,act1 a violation ( any    
requirem5t or prohibition impos$ "u ?is 
title %all con/itute an unfair or       
deceptive act or practice 9 comm]ce 9   
violation ( a regulation "u section     
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77,i77,b77 reg>d+ unfair or      
deceptive acts or practices & %all be   
subject to en=cem5t by ! ,f$]al ,trade  
,commission "u t ,act ) respect to any  
bus9ess entity1 irrespective ( :e!r t   
bus9ess entity is engag$ 9 comm]ce or   
meets any o!r jurisdictional te/s 9 !   
,f$]al ,trade ,commission ,act4  7e7    
,coord9ation ( en=cem5t  7#a7 ,9 g5]al  
,be=e op5+ an inve/igation1 ! ,f$]al    
,trade ,commission %all consult ) !     
,attorney ,g5]al4  7#b7 ,limitation ,!  

,f$]al ,trade ,commission may initiate  
inve/igations "u ?is subsection unless !
 ,attorney ,g5]al det]m9es t su* an     
inve/igation w\ld imp$e an ongo+ crim9al
 inve/igation or national security      
activity4  7#c7 ,coord9ation agreem5t   
7,a7 ,9 g5]al ,9 ord] to avoid conflicts
 & promote consi/5cy reg>d+ ! en=cem5t &
 litigation ( matt]s "u ?is ,act1 n lat]
 ?an #ahj days aft] ! enactm5t ( ?is    
,act1 ! ,attorney ,g5]al & ! ,f$]al     
,trade ,commission %all ent] into an    
agreem5t = coord9ation reg>d+ ! en=cem5t
 ( ?is ,act4  7,b7 ,requirem5t ,!       
coord9ation agreem5t ent]$ into "u      
subp>agraph 7,a7 %all include provisions
 to ensure t p>allel inve/igations &    
proce$+s "u ?is section are conduct$ 9 a
 matt] t avoids conflicts & does n imp$e
 ! ability ( ! ,attorney ,g5]al to      
prosecute violations ( ,f$]al crim9al   
laws4  7#d7 ,coord9ation ) ! ,,fcc ,if  
an en=cem5t action "u ?is ,act relates  
to cu/om] propriet>y network in=mation1 
! ,f$]al ,trade ,commission %all        

coord9ate ! en=cem5t action ) ! ,f$]al  
,communications ,commission4  7f7       
,rulemak+ ,! ,f$]al ,trade ,commission  
may1 9 consultation ) ! ,attorney       
,g5]al1 issue su* o!r regulations z x   
det]m9es to be necess>y to c>ry out ?is 
subtitle4 ,all regulations promulgat$ "u
 ?is ,act %all be issu$ 9 accordance )  
section #eec ( title #e1 ,unit$ ,/ates  
,code4 ,:]e regulations relate to cu/om]
 propriet>y network in=mation1 !        
promulgation ( su* regulations w be     
coord9at$ ) ! ,f$]al ,communications    
,commission4  7g7 ,o!r rights & rem$ies 
,! rights & rem$ies available "u ?is    
subtitle are cumulative & %all n affect 
any o!r rights & rem$ies available "u   
law4  7h7 ,fraud al]t ,section          
#fje;,a7b77#a7 ( ! ,fair ,cr$it ,report+
 ,act 7#ae ,u4,s4,c4 #afha;c-#a7;b77#a77
 is am5d$ by ins]t+ 1 or evid5ce t !    
consum] has receiv$ notice t ! consum]'s
 f9ancial in=mation has or may h be5    
compromis$1 aft] id5tity !ft report4    
#bah4 ,en=cem5t by ,/ate attorneys g5]al

  7a7 ,9 g5]al  7#a7 ,civil actions ,9  
any case 9 :i* ! attorney g5]al ( a     
,/ate or any ,/ate or local law en=cem5t
 ag5cy au?oriz$ by ! ,/ate attorney     
g5]al or by ,/ate /atute to prosecute   
violations ( consum] protection law1 has
 reason to believe t an int]e/ ( !      
resid5ts ( t ,/ate has be5 or is ?reat5$
 or adv]sely affect$ by ! engagem5t ( a 
bus9ess entity 9 a practice t is        
prohibit$ "u ?is subtitle1 ! ,/ate or ! 
,/ate or local law en=cem5t ag5cy on    
behalf ( ! resid5ts ( ! ag5cy's         
jurisdiction1 may br+ a civil action on 
behalf ( ! resid5ts ( ! ,/ate or        
jurisdiction 9 a di/rict c\rt ( ! ,unit$
 ,/ates ( appropriate jurisdiction to-- 
7,a7 enjo9 t practice2  7,b7 en=ce      
compliance ) ?is subtitle2 or  7,c7     
civil p5alties ( n m ?an #aa1jjj p] day 
p] security brea* up to a maximum (     
#a1jjj1jjj p] violation1 unless su*     
conduct is f\nd to be willful or        
int5tional4  7#b7 ,p5alty limitation    
7,a7 ,9 g5]al ,not)/&+ any o!r provision

 ( law1 ! total sum ( civil p5alties    
assess$ aga9/ a bus9ess entity = all    
violations ( ! provisions ( ?is subtitle
 result+ f ! same or relat$ acts or     
omissions may n exce$ #a1jjj1jjj1 unless
 su* conduct is f\nd to be willful or   
int5tional4  7,b7 ,det]m9ations ,!      
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle has occurr$1 & 
if s1 ! am\nt ( ! p5alty to be impos$1  
if any1 %all be made by ! c\rt sitt+ z !
 f9d] ( fact4 ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional1 & if s1 ! am\nt 
( ! additional p5alty to be impos$1 if  
any1 %all be made by ! c\rt sitt+ z !   
f9d] ( fact4  7,c7 ,additional p5alty   
limit ,if a c\rt det]m9es "u subp>agraph
 7,b7 t a violation ( a provision ( ?is 
subtitle 0 willful or int5tional &      
imposes an additional p5alty1 ! c\rt may
 n impose an additional p5alty 9 an     
am\nt t exce$s #a1jjj1jjj4  7#c7 ,notice
  7,a7 ,9 g5]al ,be=e fil+ an action "u 
p>agraph 7#a71 ! attorney g5]al ( !     

,/ate involv$ %all provide to !         
,attorney ,g5]al ( ! ,unit$ ,/ates-- 7i7
 writt5 notice ( ! action2 &  7ii7 a    
copy ( ! compla9t = ! action4  7,b7     
,exemption  7i7 ,9 g5]al ,subp>agraph   
7,a7 %all n apply ) respect to ! fil+ ( 
an action by an attorney g5]al ( a ,/ate
 "u ?is subtitle1 if ! ,/ate attorney   
g5]al det]m9es t x is n feasible to     
provide ! notice describ$ 9 su*         
subp>agraph be=e ! fil+ ( ! action4     
7ii7 ,notification ,9 an action describ$
 9 clause 7i71 ! attorney g5]al ( a     
,/ate %all provide notice & a copy ( !  
compla9t to ! ,attorney ,g5]al at ! "t !
 ,/ate attorney g5]al files ! action4   
7b7 ,f$]al proce$+s ,^u receiv+ notice  
"u subsection 7a77#b71 ! ,attorney      
,g5]al %all h ! "r to-- 7#a7 move to /ay
 ! action1 p5d+ ! f9al disposition ( a  
p5d+ ,f$]al proce$+ or action2  7#b7    
initiate an action 9 ! appropriate      
,unit$ ,/ates di/rict c\rt "u section   
#bag & move to consolidate all p5d+     
actions1 includ+ ,/ate actions1 9 su*   

c\rt2  7#c7 int]v5e 9 an action br\ght  
"u subsection 7a77#b72 &  7#d7 file     
petitions = appeal4  7c7 ,p5d+ proce$+s 
,if ! ,attorney ,g5]al or ! ,f$]al      
,trade ,commission initiate a crim9al   
proce$+ or civil action = a violation ( 
a provision ( ?is subtitle1 or any      
regulations !reund]1 no attorney g5]al (
 a ,/ate may br+ an action = a violation
 ( a provision ( ?is subtitle aga9/ a   
def5dant nam$ 9 ! ,f$]al crim9al proce$+
 or civil action4  7d7 ,con/ruction ,=  
purposes ( br++ any civil action "u     
subsection 7a71 no?+ 9 ?is subtitle     
reg>d+ notification %all be con/ru$ to  
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on su* attorney  
g5]al by ! laws ( t ,/ate to-- 7#a7     
conduct inve/igations2  7#b7 adm9i/]    
oa?s or affirmations2 or  7#c7 compel ! 
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7e7 ,v5ue2    
s]vice ( process  7#a7 ,v5ue ,any action
 br\ght "u subsection 7a7 may be br\ght 
9-- 7,a7 ! di/rict c\rt ( ! ,unit$      

,/ates t meets applicable requirem5ts   
relat+ to v5ue "u section #acia ( title 
#bh1 ,unit$ ,/ates ,code2 or  7,b7 ano!r
 c\rt ( compet5t jurisdiction4  7#b7    
,s]vice ( process ,9 an action br\ght "u
 subsection 7a71 process may be s]v$ 9  
any di/rict 9 :i* ! def5dant-- 7,a7 is  
an inhabitant2 or  7,b7 may be f\nd4    
7f7 ,no private cause ( action ,no?+ 9  
?is subtitle e/abli%es a private cause (
 action aga9/ a bus9ess entity =        
violation ( any provision ( ?is         
subtitle4  #bai4 ,effect on ,f$]al &    
,/ate law ,= any entity1 or ag5cy t is  
subject to ?is subtitle1 ! provisions ( 
?is subtitle %all sup]s$e any o!r       
provision ( ,f$]al law1 or any          
provisions ( ! law ( any ,/ate1 relat+  
to notification ( a security brea*1     
except z provid$ 9 section #bad7;b74    
,no?+ 9 ?is subtitle %all be con/ru$ to 
modify1 limit1 or sup]s$e ! op]ation ( !
 ,gramm-,lea*-,bliley ,act 7#ae         
,u4,s4,c4 #fhja et seq47 or its         
implem5t+ regulations1 includ+ ^?       

regulations adopt$ or en=c$ by ,/ates1 !
 ,heal? ,insurance ,portability &       
,acc\ntability ,act ( #aiif 7#db        
,u4,s4,c4 #acja et seq47 or its         
implem5t+ regulations1 or ! ,heal?      
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? ,act 7#db ,u4,s4,c4     
#agicg7 or its implem5t+ regulations4   
#bbj4 ,report+ on exemptions  7a7 ,,ftc 
report ,n lat] ?an #ah mon?s aft] ! date
 ( enactm5t ( ?is ,act1 & ^u reque/ by  
,congress !reaft]1 ! ,f$]al ,trade      
,commission %all submit a report to     
,congress on ! numb] & nature ( !       
security brea*es describ$ 9 ! notices   
fil$ by ^? bus9ess entities invok+ !    
risk assessm5t exemption "u section     
#bab7;b7 & _! response to su* notices4  
7b7 ,law en=cem5t report  7#a7 ,9 g5]al 
,n lat] ?an #ah mon?s aft] ! date (     
enactm5t ( ?is ,act1 & ^u ! reque/ by   
,congress !reaft]1 ! ,unit$ ,/ates      
,secret ,s]vice & ,f$]al ,bureau (      
,inve/igation %all submit a report to   
,congress on ! numb] & nature ( security

 brea*es subject to ! national security 
& law en=cem5t exemptions "u section    
#bab7;a74  7#b7 ,requirem5t ,! report   
requir$ "u p>agraph 7#a7 %all n include 
! cont5ts ( any risk assessm5t provid$  
to ! ,unit$ ,/ates ,secret ,s]vice & !  
,f$]al ,bureau ( ,inve/igation "u ?is   
subtitle4  #bba4 ,effective date ,?is   
subtitle %all take effect on !          
expiration ( ! date :i* is #ij days aft]
 ! date ( enactm5t ( ?is ,act4  ,,iii   
,compliance ) /atutory ,pay-,z-,y-,g    
,act  #cja4 ,budget compliance ,!       
budget>y effects ( ?is ,act1 = ! purpose
 ( comply+ ) ! ,/atutory ,pay-,z-,y-,g  
,act ( #bjaj1 %all be det]m9$ by ref]5ce
 to ! late/ /atem5t titl$ ,budget>y     
,effects ( ,,paygo ,legislation = ?is   
,act1 submitt$ = pr9t+ 9 !              
,congressional ,record by ! ,*airman ( !
 ,s5ate ,budget ,committee1 provid$ t   
su* /atem5t has be5 submitt$ prior to ! 
vote on passage4