,,ii #aacth ,,congress #b;d ,session ,s4 #aibg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #ae1 #bjad,mr4 ,carper 7for himself and ,mr4 ,blunt7 introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to protect information relating to consumers1 to require notice of security breaches1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,security ,act of #bjad4 #b4 ,definitions ,for purposes of this ,act1 the following definitions shall apply3 7#a7 ,affiliate ,the term affiliate means any company that controls1 is controlled by1 or is under common control with another company4 7#b7 ,agency ,the term agency has the same meaning as in section #eea7a7 of title #e1 ,united ,states ,code4 7#c7 ,breach of data security 7,a7 ,in general ,the term breach of data security means the unauthorized acquisition of sensitive account information or sensitive personal information4 7,b7 ,exception for data that is not in usable form 7i7 ,in general ,the term breach of data security does not include the unauthorized acquisition of sensitive account information or sensitive personal information that is maintained or communicated in a manner that is not usable-- 7,i7 to commit identity theft2 or 7,,ii7 to make fraudulent transactions on financial accounts4 7ii7 ,rule of ,construction ,for purposes of this subparagraph1 information that is maintained or communicated in a manner that is not usable includes any information that is maintained or communicated in an encrypted1 redacted1 altered1 edited1 or coded form4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,consumer ,the term consumer means an individual4 7#f7 ,consumer reporting agency that compiles and maintains files on consumers on a nationwide basis ,the term consumer reporting agency that compiles and maintains files on consumers on a nationwide basis has the same meaning as in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#g7 ,covered entity 7,a7 ,in general ,the term covered entity means any-- 7i7 entity1 the business of which is engaging in financial activities1 as described in section #d7k7 of the ,bank ,holding ,company ,act of #aief 7#ab ,u4,s4,c4 #ahdc7k772 7ii7 financial institution1 including any institution described in section #cac4c7k7 of title #af1 ,code of ,federal ,regulations1 as in effect on the date of enactment of this ,act2 7iii7 entity that maintains or otherwise possesses information that is subject to section #fbh of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afhaw72 or 7iv7 other individual1 partnership1 corporation1 trust1 estate1 cooperative1 association1 or entity that maintains or communicates sensitive account information or sensitive personal information4 7,b7 ,exception ,the term covered entity does not include any agency or any other unit of ,federal1 ,state1 or local government or any subdivision of the unit4 7#h7 ,financial institution ,the term financial institution has the same meaning as in section #eji7c7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji7c774 7#i7 ,sensitive account information ,the term sensitive account information means a financial account number relating to a consumer1 including a credit card number or debit card number1 in combination with any security code1 access code1 password1 or other personal identification information required to access the financial account4 7#aj7 ,sensitive personal information 7,a7 ,in general ,the term sensitive personal information means the first and last name1 address1 or telephone number of a consumer1 in combination with any of the following relating to the consumer3 7i7 ,social security account number4 7ii7 ,driver's license number or equivalent ,state identification number4 7iii7 ,taxpayer identification number4 7,b7 ,exception ,the term sensitive personal information does not include publicly available information that is lawfully made available to the general public from-- 7i7 ,federal1 ,state1 or local government records2 or 7ii7 widely distributed media4 7#aa7 ,substantial harm or inconvenience 7,a7 ,in general ,the term substantial harm or inconvenience means-- 7i7 material financial loss to1 or civil or criminal penalties imposed on1 a consumer1 due to the unauthorized use of sensitive account information or sensitive personal information relating to the consumer2 or 7ii7 the need for a consumer to expend significant time and effort to correct erroneous information relating to the consumer1 including information maintained by a consumer reporting agency1 financial institution1 or government entity1 in order to avoid material financial loss1 increased costs1 or civil or criminal penalties1 due to the unauthorized use of sensitive account information or sensitive personal information relating to the consumer4 7,b7 ,exception ,the term substantial harm or inconvenience does not include-- 7i7 changing a financial account number or closing a financial account2 or 7ii7 harm or inconvenience that does not result from identity theft or account fraud4 #c4 ,protection of information and security breach notification 7a7 ,security procedures required 7#a7 ,in general ,each covered entity shall implement1 maintain1 and enforce reasonable policies and procedures to protect the confidentiality and security of1 sensitive account information and sensitive personal information that is maintained or is being communicated by or on behalf of a covered entity from the unauthorized use of the information that is reasonably likely to result in substantial harm or inconvenience to the consumer to whom the information relates4 7#b7 ,limitation ,any policy or procedure implemented or maintained under paragraph 7#a7 shall be appropriate to-- 7,a7 the size and complexity of the covered entity2 7,b7 the nature and scope of the activities of the covered entity2 and 7,c7 the sensitivity of the consumer information to be protected4 7b7 ,investigation required 7#a7 ,in general ,if a covered entity determines that a breach of data security has or may have occurred in relation to sensitive account information or sensitive personal information that is maintained or is being communicated by1 or on behalf of1 the covered entity1 the covered entity shall conduct an investigation to-- 7,a7 assess the nature and scope of the breach2 7,b7 identify any sensitive account information or sensitive personal information that may have been involved in the breach2 and 7,c7 determine if the sensitive account information or sensitive personal information is reasonably likely to be misused in a manner causing substantial harm or inconvenience to the consumers to whom the information relates4 7#b7 ,neural networks and information security programs ,in determining the likelihood of misuse of sensitive account information under paragraph 7#a77;,c71 a covered entity shall consider whether any neural network or security program has detected1 or is likely to detect or prevent1 fraudulent transactions resulting from the breach of security4 7c7 ,notice required ,if a covered entity determines under subsection 7b77#a77;,c7 that sensitive account information or sensitive personal information involved in a breach of data security is reasonably likely to be misused in a manner causing substantial harm or inconvenience to the consumers to whom the information relates1 the covered entity1 or a third party acting on behalf of the covered entity1 shall-- 7#a7 notify1 in the following order-- 7,a7 the appropriate agency or authority identified in section #e2 7,b7 an appropriate law enforcement agency2 7,c7 any entity that owns1 or is obligated on1 a financial account to which the sensitive account information relates1 if the breach involves a breach of sensitive account information2 7,d7 each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis1 if the breach involves sensitive personal information relating to #e1jjj or more consumers2 and 7,e7 all consumers to whom the sensitive account information or sensitive personal information relates2 and 7#b7 take reasonable measures to restore the security and confidentiality of the sensitive account information or sensitive personal information involved in the breach4 7d7 ,compliance 7#a7 ,in general ,an entity shall be deemed to be in compliance with-- 7,a7 in the case of a financial institution-- 7i7 subsection 7a71 and any regulations prescribed under subsection 7a71 if the financial institution maintains policies and procedures to protect the confidentiality and security of sensitive account information and sensitive personal information that are consistent with the policies and procedures of the financial institution that are designed to comply with the requirements of section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b77 and any regulations or guidance prescribed under that section that are applicable to the financial institution2 and 7ii7 subsections 7b7 and 7c71 and any regulations prescribed under subsections 7b7 and 7c71 if the financial institution-- 7,i7 7aa7 maintains policies and procedures to investigate and provide notice to consumers of breaches of data security that are consistent with the policies and procedures of the financial institution that are designed to comply with the investigation and notice requirements established by regulations or guidance under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b77 that are applicable to the financial institution2 or 7bb7 is an affiliate of a bank holding company that maintains policies and procedures to investigate and provide notice to consumers of breaches of data security that are consistent with the policies and procedures of a bank that is an affiliate of the financial institution1 and the policies and procedures of the bank are designed to comply with the investigation and notice requirements established by any regulations or guidance under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b77 that are applicable to the bank2 and 7,,ii7 provides for notice to the entities described under subparagraphs 7,b71 7,c71 and 7,d7 of subsection 7c77#a71 if notice is provided to consumers pursuant to the policies and procedures of the financial institution described in subclause 7,i72 and 7,b7 subsections 7a71 7b71 and 7c71 if the entity is a covered entity for purposes of the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 to the extent that the entity is in compliance with such regulations4 7#b7 ,definitions ,for purposes of this subsection1 the terms bank holding company and bank shall have the same meaning given the terms under section #b of the ,bank ,holding ,company ,act of #aief 7#ab ,u4,s4,c4 #ahda74 #d4 ,implementing regulations 7a7 ,in general ,notwithstanding any other provision of law1 and except as provided in section #f1 the agencies and authorities identified in section #e1 with respect to the covered entities that are subject to the respective enforcement authority of the agencies and authorities1 shall prescribe regulations to implement this ,act4 7b7 ,coordination ,each agency and authority required to prescribe regulations under subsection 7a7 shall consult and coordinate with each other agency and authority identified in section #e so that1 to the extent possible1 the regulations prescribed by each agency and authority are consistent and comparable4 7c7 ,method of providing notice to consumers ,the regulations required under subsection 7a7 shall-- 7#a7 prescribe the methods by which a covered entity shall notify a consumer of a breach of data security under section #c2 and 7#b7 allow a covered entity to provide the notice by-- 7,a7 written1 telephonic1 or e-mail notification2 or 7,b7 substitute notification1 if providing written1 telephonic1 or e-mail notification is not feasible due to-- 7i7 lack of sufficient contact information for the consumers that must be notified2 or 7ii7 excessive cost to the covered entity4 7d7 ,content of consumer notice ,the regulations required under subsection 7a7 shall-- 7#a7 prescribe the content that shall be included in a notice of a breach of data security that is required to be provided to consumers under section #c2 and 7#b7 require the notice to include-- 7,a7 a description of the type of sensitive account information or sensitive personal information involved in the breach of data security2 7,b7 a general description of the actions taken by the covered entity to restore the security and confidentiality of the sensitive account information or sensitive personal information involved in the breach of data security2 and 7,c7 the summary of rights of victims of identity theft prepared by the ,commission under section #fji7;d7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;g7d771 if the breach of data security involves sensitive personal information4 7e7 ,timing of notice ,the regulations required under subsection 7a7 shall establish standards for when a covered entity shall provide any notice required under section #c4 7f7 ,law enforcement delay ,the regulations required under subsection 7a7 shall allow a covered entity to delay providing notice of a breach of data security to consumers under section #c if a law enforcement agency requests such a delay in writing4 7g7 ,service providers ,the regulations required under subsection 7a7 shall-- 7#a7 require any party that maintains or communicates sensitive account information or sensitive personal information on behalf of a covered entity to provide notice to that covered entity if the party determines that a breach of data security has1 or may have1 occurred with respect to the sensitive account information or sensitive personal information2 and 7#b7 ensure that there is only #a notification responsibility with respect to a breach of data security4 7h7 ,timing of regulations ,the regulations required under subsection 7a7 shall-- 7#a7 be issued in final form not later than #f months after the date of enactment of this ,act2 and 7#b7 take effect not later than #f months after the date on which they are issued in final form4 #e4 ,administrative enforcement 7a7 ,in general ,notwithstanding any other provision of law1 section #c1 and the regulations required under section #d1 shall be enforced exclusively under-- 7#a7 section #h of the ,federal ,deposit ,insurance ,act 7#ab ,u4,s4,c4 #ahah71 in the case of-- 7,a7 a national bank1 a ,federal branch or ,federal agency of a foreign bank1 or any subsidiary thereof 7other than a broker1 dealer1 person providing insurance1 investment company1 or investment adviser71 or a savings association1 the deposits of which are insured by the ,federal ,deposit ,insurance ,corporation1 or any subsidiary thereof 7other than a broker1 dealer1 person providing insurance1 investment company1 or investment adviser71 by the ,office of the ,comptroller of the ,currency2 7,b7 a member bank of the ,federal ,reserve ,system 7other than a national bank71 a branch or agency of a foreign bank 7other than a ,federal branch1 ,federal agency1 or insured ,state branch of a foreign bank71 a commercial lending company owned or controlled by a foreign bank1 an organization operating under section #be or #be;,a of the ,federal ,reserve ,act 7#ab ,u4,s4,c4 #fja1 #faa71 or a bank holding company and its nonbank subsidiary or affiliate 7other than a broker1 dealer1 person providing insurance1 investment company1 or investment adviser71 by the ,board of ,governors of the ,federal ,reserve ,system2 and 7,c7 a bank1 the deposits of which are insured by the ,federal ,deposit ,insurance ,corporation 7other than a member of the ,federal ,reserve ,system71 an insured ,state branch of a foreign bank1 or any subsidiary thereof 7other than a broker1 dealer1 person providing insurance1 investment company1 or investment adviser71 by the ,board of ,directors of the ,federal ,deposit ,insurance ,corporation2 7#b7 the ,federal ,credit ,union ,act 7#ab ,u4,s4,c4 #agea et seq471 by the ,national ,credit ,union ,administration ,board with respect to any federally insured credit union2 7#c7 the ,securities ,exchange ,act of #aicd 7#ae ,u4,s4,c4 #gh;a et seq471 by the ,securities and ,exchange ,commission with respect to any broker or dealer2 7#d7 the ,investment ,company ,act of #aidj 7#ae ,u4,s4,c4 #hj;a-#a et seq471 by the ,securities and ,exchange ,commission with respect to any investment company2 7#e7 the ,investment ,advisers ,act of #aidj 7#ae ,u4,s4,c4 #hj;b-#a et seq471 by the ,securities and ,exchange ,commission with respect to any investment adviser registered with the ,securities and ,exchange ,commission under that ,act2 7#f7 the ,commodity ,exchange ,act 7#g ,u4,s4,c4 #a et seq471 by the ,commodity ,futures ,trading ,commission with respect to any futures commission merchant1 commodity trading advisor1 commodity pool operator1 or introducing broker2 7#g7 the provisions of title ,,xiii of the ,housing and ,community ,development ,act of #aiib 7#ab ,u4,s4,c4 #deja et seq471 by the ,director of ,federal ,housing ,enterprise ,oversight 7and any successor to the functional regulatory agency7 with respect to the ,federal ,national ,mortgage ,association1 the ,federal ,home ,loan ,mortgage ,corporation1 and any other entity or enterprise 7as defined in that title7 subject to the jurisdiction of the functional regulatory agency under that title1 including any affiliate of any the enterprise2 7#h7 ,state insurance law1 in the case of any person engaged in providing insurance1 by the applicable ,state insurance authority of the ,state in which the person is domiciled2 and 7#i7 the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq471 by the ,commission for any other covered entity that is not subject to the jurisdiction of any agency or authority described under paragraphs 7#a7 through 7#h74 7b7 ,extension of ,federal ,trade ,commission enforcement authority ,the authority of the ,commission to enforce compliance with section #c1 and the regulations required under section #d1 under subsection 7a77#h7 shall-- 7#a7 notwithstanding the ,federal ,aviation ,act of #aieh 7#di ,u4,s4,c4 ,app4 #acja et seq471 include the authority to enforce compliance by air carriers and foreign air carriers2 and 7#b7 notwithstanding the ,packers and ,stockyards ,act 7#g ,u4,s4,c4 #aha et seq471 include the authority to enforce compliance by persons1 partnerships1 and corporations subject to the provisions of that ,act4 7c7 ,no private right of ,action 7#a7 ,in general ,this ,act1 and the regulations prescribed under this ,act1 may not be construed to provide a private right of action1 including a class action with respect to any act or practice regulated under this ,act4 7#b7 ,civil and criminal ,actions ,no civil or criminal action relating to any act or practice governed under this ,act1 or the regulations prescribed under this ,act1 shall be commenced or maintained in any ,state court or under ,state law1 including a pendent ,state claim to an action under ,federal law4 #f4 ,protection of information at ,federal agencies 7a7 ,data security standards ,each agency shall implement appropriate standards relating to administrative1 technical1 and physical safeguards-- 7#a7 to insure the security and confidentiality of the sensitive account information and sensitive personal information that is maintained or is being communicated by1 or on behalf of1 that agency2 7#b7 to protect against any anticipated threats or hazards to the security of the sensitive account information and sensitive personal information2 and 7#c7 to protect against misuse of the sensitive account information and sensitive personal information that could result in substantial harm or inconvenience to a consumer4 7b7 ,security breach notification standards ,each agency shall implement appropriate standards providing for notification of consumers when the agency determines that sensitive account information or sensitive personal information that is maintained or is being communicated by1 or on behalf of1 the agency-- 7#a7 has been acquired without authorization2 and 7#b7 is reasonably likely to be misused in a manner causing substantial harm or inconvenience to the consumers to whom the information relates4 #g4 ,relation to ,state law ,no requirement or prohibition may be imposed under the laws of any ,state with respect to the responsibilities of any person to-- 7#a7 protect the security of information relating to consumers that is maintained or communicated by1 or on behalf of1 the person2 7#b7 safeguard information relating to consumers from potential misuse2 7#c7 investigate or provide notice of the unauthorized access to information relating to consumers1 or the potential misuse of the information1 for fraudulent1 illegal1 or other purposes2 or 7#d7 mitigate any loss or harm resulting from the unauthorized access or misuse of information relating to consumers4 #h4 ,delayed effective date for certain provisions 7a7 ,covered entities ,sections #c and #g shall take effect on the later of-- 7#a7 #a year after the date of enactment of this ,act2 or 7#b7 the effective date of the final regulations required under section #d4 7b7 ,agencies ,section #f shall take effect #a year after the date of enactment of this ,act4