,,ii  #aac? ,,congress  #b;d ,session   
,s4 #aibg  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,janu>y #ae1 #bjad,mr4 
,c>p] 7= himself & ,mr4 ,blunt7         
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,bank+1 ,h\s+1 & ,urban ,affairs  ,a    
,,bill  ,to protect in=mation relat+ to 
consum]s1 to require notice ( security  
brea*es1 & = o!r purposes4  #a4 ,%ort   
title ,?is ,act may be cit$ z ! ,data   
,security ,act ( #bjad4  #b4 ,def9itions
 ,= purposes ( ?is ,act1 ! foll[+       
def9itions %all apply3 7#a7 ,affiliate  
,! t]m affiliate means any company t    
controls1 is controll$ by1 or is "u     
common control ) ano!r company4  7#b7   
,ag5cy ,! t]m ag5cy has ! same mean+ z 9
 section #eea7a7 ( title #e1 ,unit$     
,/ates ,code4  7#c7 ,brea* ( data       
security  7,a7 ,9 g5]al ,! t]m brea* (  
data security means ! unau?oriz$        
acquisition ( s5sitive acc\nt in=mation 
or s5sitive p]sonal in=mation4  7,b7    
,exception = data t is n 9 usable =m    

7i7 ,9 g5]al ,! t]m brea* ( data        
security does n include ! unau?oriz$    
acquisition ( s5sitive acc\nt in=mation 
or s5sitive p]sonal in=mation t is      
ma9ta9$ or communicat$ 9 a mann] t is n 
usable-- 7,i7 to commit id5tity !ft2 or 
7,,ii7 to make fraudul5t transactions on
 f9ancial acc\nts4  7ii7 ,rule (        
,con/ruction ,= purposes ( ?is          
subp>agraph1 in=mation t is ma9ta9$ or  
communicat$ 9 a mann] t is n usable     
includes any in=mation t is ma9ta9$ or  
communicat$ 9 an encrypt$1 r$act$1      
alt]$1 edit$1 or cod$ =m4  7#d7         
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#e7        
,consum] ,! t]m consum] means an        
individual4  7#f7 ,consum] report+ ag5cy
 t compiles & ma9ta9s files on consum]s 
on a nationwide basis ,! t]m consum]    
report+ ag5cy t compiles & ma9ta9s files
 on consum]s on a nationwide basis has !
 same mean+ z 9 section #fjc7p7 ( !     
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha;a7p774  7#g7 ,cov]$     

entity  7,a7 ,9 g5]al ,! t]m cov]$      
entity means any-- 7i7 entity1 ! bus9ess
 ( :i* is engag+ 9 f9ancial activities1 
z describ$ 9 section #d7k7 ( ! ,bank    
,hold+ ,company ,act ( #aief 7#ab       
,u4,s4,c4 #ahdc7k772  7ii7 f9ancial     
in/itution1 includ+ any in/itution      
describ$ 9 section #cac4c7k7 ( title    
#af1 ,code ( ,f$]al ,regulations1 z 9   
effect on ! date ( enactm5t ( ?is ,act2 
7iii7 entity t ma9ta9s or o!rwise       
possesses in=mation t is subject to     
section #fbh ( ! ,fair ,cr$it ,report+  
,act 7#ae ,u4,s4,c4 #afhaw72 or  7iv7   
o!r individual1 p>tn]%ip1 corporation1  
tru/1 e/ate1 coop]ative1 association1 or
 entity t ma9ta9s or communicates       
s5sitive acc\nt in=mation or s5sitive   
p]sonal in=mation4  7,b7 ,exception ,!  
t]m cov]$ entity does n include any     
ag5cy or any o!r unit ( ,f$]al1 ,/ate1  
or local gov]nm5t or any subdivision ( !
 unit4  7#h7 ,f9ancial in/itution ,! t]m
 f9ancial in/itution has ! same mean+ z 
9 section #eji7c7 ( !                   

,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhji7c774  7#i7 ,s5sitive acc\nt      
in=mation ,! t]m s5sitive acc\nt        
in=mation means a f9ancial acc\nt numb] 
relat+ to a consum]1 includ+ a cr$it c>d
 numb] or debit c>d numb]1 9 comb9ation 
) any security code1 access code1       
password1 or o!r p]sonal id5tification  
in=mation requir$ to access ! f9ancial  
acc\nt4  7#aj7 ,s5sitive p]sonal        
in=mation  7,a7 ,9 g5]al ,! t]m s5sitive
 p]sonal in=mation means ! fir/ & la/   
"n1 address1 or telephone numb] ( a     
consum]1 9 comb9ation ) any ( ! foll[+  
relat+ to ! consum]3 7i7 ,social        
security acc\nt numb]4  7ii7 ,driv]'s   
lic5se numb] or equival5t ,/ate         
id5tification numb]4  7iii7 ,taxpay]    
id5tification numb]4  7,b7 ,exception ,!
 t]m s5sitive p]sonal in=mation does n  
include publicly available in=mation t  
is lawfully made available to ! g5]al   
public f-- 7i7 ,f$]al1 ,/ate1 or local  
gov]nm5t records2 or  7ii7 widely       
di/ribut$ m$ia4  7#aa7 ,sub/antial h>m  

or inconv5i5ce  7,a7 ,9 g5]al ,! t]m    
sub/antial h>m or inconv5i5ce means--   
7i7 mat]ial f9ancial loss to1 or civil  
or crim9al p5alties impos$ on1 a        
consum]1 due to ! unau?oriz$ use (      
s5sitive acc\nt in=mation or s5sitive   
p]sonal in=mation relat+ to ! consum]2  
or  7ii7 ! ne$ = a consum] to exp5d     
significant "t & ef=t to correct        
errone\s in=mation relat+ to ! consum]1 
includ+ in=mation ma9ta9$ by a consum]  
report+ ag5cy1 f9ancial in/itution1 or  
gov]nm5t entity1 9 ord] to avoid mat]ial
 f9ancial loss1 increas$ co/s1 or civil 
or crim9al p5alties1 due to ! unau?oriz$
 use ( s5sitive acc\nt in=mation or     
s5sitive p]sonal in=mation relat+ to !  
consum]4  7,b7 ,exception ,! t]m        
sub/antial h>m or inconv5i5ce does n    
include-- 7i7 *ang+ a f9ancial acc\nt   
numb] or clos+ a f9ancial acc\nt2 or    
7ii7 h>m or inconv5i5ce t does n result 
f id5tity !ft or acc\nt fraud4  #c4     
,protection ( in=mation & security brea*
 notification  7a7 ,security proc$ures  

requir$  7#a7 ,9 g5]al ,ea* cov]$ entity
 %all implem5t1 ma9ta91 & en=ce         
reasonable policies & proc$ures to      
protect ! confid5tiality & security (1  
s5sitive acc\nt in=mation & s5sitive    
p]sonal in=mation t is ma9ta9$ or is be+
 communicat$ by or on behalf ( a cov]$  
entity f ! unau?oriz$ use ( ! in=mation 
t is reasonably likely to result 9      
sub/antial h>m or inconv5i5ce to !      
consum] to :om ! in=mation relates4     
7#b7 ,limitation ,any policy or proc$ure
 implem5t$ or ma9ta9$ "u p>agraph 7#a7  
%all be appropriate to-- 7,a7 ! size &  
complexity ( ! cov]$ entity2  7,b7 !    
nature & scope ( ! activities ( ! cov]$ 
entity2 &  7,c7 ! s5sitivity ( ! consum]
 in=mation to be protect$4  7b7         
,inve/igation requir$  7#a7 ,9 g5]al ,if
 a cov]$ entity det]m9es t a brea* (    
data security has or may h occurr$ 9    
relation to s5sitive acc\nt in=mation or
 s5sitive p]sonal in=mation t is ma9ta9$
 or is be+ communicat$ by1 or on behalf 
(1 ! cov]$ entity1 ! cov]$ entity %all  

conduct an inve/igation to-- 7,a7 assess
 ! nature & scope ( ! brea*2  7,b7      
id5tify any s5sitive acc\nt in=mation or
 s5sitive p]sonal in=mation t may h be5 
involv$ 9 ! brea*2 &  7,c7 det]m9e if ! 
s5sitive acc\nt in=mation or s5sitive   
p]sonal in=mation is reasonably likely  
to be misus$ 9 a mann] caus+ sub/antial 
h>m or inconv5i5ce to ! consum]s to :om 
! in=mation relates4  7#b7 ,neural      
networks & in=mation security programs  
,9 det]m9+ ! likelihood ( misuse (      
s5sitive acc\nt in=mation "u p>agraph   
7#a77;,c71 a cov]$ entity %all consid]  
:e!r any neural network or security     
program has detect$1 or is likely to    
detect or prev5t1 fraudul5t transactions
 result+ f ! brea* ( security4  7c7     
,notice requir$ ,if a cov]$ entity      
det]m9es "u subsection 7b77#a77;,c7 t   
s5sitive acc\nt in=mation or s5sitive   
p]sonal in=mation involv$ 9 a brea* (   
data security is reasonably likely to be
 misus$ 9 a mann] caus+ sub/antial h>m  
or inconv5i5ce to ! consum]s to :om !   

in=mation relates1 ! cov]$ entity1 or a 
?ird p>ty act+ on behalf ( ! cov]$      
entity1 %all-- 7#a7 notify1 9 ! foll[+  
ord]-- 7,a7 ! appropriate ag5cy or      
au?ority id5tifi$ 9 section #e2  7,b7 an
 appropriate law en=cem5t ag5cy2  7,c7  
any entity t owns1 or is obligat$ on1 a 
f9ancial acc\nt to :i* ! s5sitive acc\nt
 in=mation relates1 if ! brea* involves 
a brea* ( s5sitive acc\nt in=mation2    
7,d7 ea* consum] report+ ag5cy t        
compiles & ma9ta9s files on consum]s on 
a nationwide basis1 if ! brea* involves 
s5sitive p]sonal in=mation relat+ to    
#e1jjj or m consum]s2 &  7,e7 all       
consum]s to :om ! s5sitive acc\nt       
in=mation or s5sitive p]sonal in=mation 
relates2 &  7#b7 take reasonable        
measures to re/ore ! security &         
confid5tiality ( ! s5sitive acc\nt      
in=mation or s5sitive p]sonal in=mation 
involv$ 9 ! brea*4  7d7 ,compliance     
7#a7 ,9 g5]al ,an entity %all be deem$  
to be 9 compliance )-- 7,a7 9 ! case ( a
 f9ancial in/itution-- 7i7 subsection   

7a71 & any regulations prescrib$ "u     
subsection 7a71 if ! f9ancial in/itution
 ma9ta9s policies & proc$ures to protect
 ! confid5tiality & security ( s5sitive 
acc\nt in=mation & s5sitive p]sonal     
in=mation t are consi/5t ) ! policies & 
proc$ures ( ! f9ancial in/itution t are 
design$ to comply ) ! requirem5ts (     
section #eja7;b7 ( !                    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7;b77 & any regulations or        
guidance prescrib$ "u t section t are   
applicable to ! f9ancial in/itution2 &  
7ii7 subsections 7b7 & 7c71 & any       
regulations prescrib$ "u subsections 7b7
 & 7c71 if ! f9ancial in/itution-- 7,i7 
7aa7 ma9ta9s policies & proc$ures to    
inve/igate & provide notice to consum]s 
( brea*es ( data security t are consi/5t
 ) ! policies & proc$ures ( ! f9ancial  
in/itution t are design$ to comply ) !  
inve/igation & notice requirem5ts       
e/abli%$ by regulations or guidance "u  
section #eja7;b7 ( !                    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4

 #fhja7;b77 t are applicable to !       
f9ancial in/itution2 or  7bb7 is an     
affiliate ( a bank hold+ company t      
ma9ta9s policies & proc$ures to         
inve/igate & provide notice to consum]s 
( brea*es ( data security t are consi/5t
 ) ! policies & proc$ures ( a bank t is 
an affiliate ( ! f9ancial in/itution1 & 
! policies & proc$ures ( ! bank are     
design$ to comply ) ! inve/igation &    
notice requirem5ts e/abli%$ by any      
regulations or guidance "u section      
#eja7;b7 ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja7;b77 t are         
applicable to ! bank2 &  7,,ii7 provides
 = notice to ! entities describ$ "u     
subp>agraphs 7,b71 7,c71 & 7,d7 (       
subsection 7c77#a71 if notice is provid$
 to consum]s pursuant to ! policies &   
proc$ures ( ! f9ancial in/itution       
describ$ 9 subclause 7,i72 &  7,b7      
subsections 7a71 7b71 & 7c71 if ! entity
 is a cov]$ entity = purposes ( !       
regulations promulgat$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          

,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note71  
to ! ext5t t ! entity is 9 compliance ) 
su* regulations4  7#b7 ,def9itions ,=   
purposes ( ?is subsection1 ! t]ms bank  
hold+ company & bank %all h ! same mean+
 giv5 ! t]ms "u section #b ( ! ,bank    
,hold+ ,company ,act ( #aief 7#ab       
,u4,s4,c4 #ahda74  #d4 ,implem5t+       
regulations  7a7 ,9 g5]al ,not)/&+ any  
o!r provision ( law1 & except z provid$ 
9 section #f1 ! ag5cies & au?orities    
id5tifi$ 9 section #e1 ) respect to !   
cov]$ entities t are subject to !       
respective en=cem5t au?ority ( ! ag5cies
 & au?orities1 %all prescribe           
regulations to implem5t ?is ,act4  7b7  
,coord9ation ,ea* ag5cy & au?ority      
requir$ to prescribe regulations "u     
subsection 7a7 %all consult & coord9ate 
) ea* o!r ag5cy & au?ority id5tifi$ 9   
section #e s t1 to ! ext5t possible1 !  
regulations prescrib$ by ea* ag5cy &    
au?ority are consi/5t & comp>able4  7c7 
,me?od ( provid+ notice to consum]s ,!  

regulations requir$ "u subsection 7a7   
%all-- 7#a7 prescribe ! me?ods by :i* a 
cov]$ entity %all notify a consum] ( a  
brea* ( data security "u section #c2 &  
7#b7 all[ a cov]$ entity to provide !   
notice by-- 7,a7 writt51 telephonic1 or 
e-mail notification2 or  7,b7 sub/itute 
notification1 if provid+ writt51        
telephonic1 or e-mail notification is n 
feasible due to-- 7i7 lack ( suffici5t  
contact in=mation = ! consum]s t mu/ be 
notifi$2 or  7ii7 excessive co/ to !    
cov]$ entity4  7d7 ,cont5t ( consum]    
notice ,! regulations requir$ "u        
subsection 7a7 %all-- 7#a7 prescribe !  
cont5t t %all be includ$ 9 a notice ( a 
brea* ( data security t is requir$ to be
 provid$ to consum]s "u section #c2 &   
7#b7 require ! notice to include-- 7,a7 
a description ( ! type ( s5sitive acc\nt
 in=mation or s5sitive p]sonal in=mation
 involv$ 9 ! brea* ( data security2     
7,b7 a g5]al description ( ! actions    
tak5 by ! cov]$ entity to re/ore !      
security & confid5tiality ( ! s5sitive  

acc\nt in=mation or s5sitive p]sonal    
in=mation involv$ 9 ! brea* ( data      
security2 &  7,c7 ! summ>y ( rights (   
victims ( id5tity !ft prep>$ by !       
,commission "u section #fji7;d7 ( !     
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha;g7d771 if ! brea* ( data
 security involves s5sitive p]sonal     
in=mation4  7e7 ,tim+ ( notice ,!       
regulations requir$ "u subsection 7a7   
%all e/abli% /&>ds = :5 a cov]$ entity  
%all provide any notice requir$ "u      
section #c4  7f7 ,law en=cem5t delay ,! 
regulations requir$ "u subsection 7a7   
%all all[ a cov]$ entity to delay       
provid+ notice ( a brea* ( data security
 to consum]s "u section #c if a law     
en=cem5t ag5cy reque/s su* a delay 9    
writ+4  7g7 ,s]vice provid]s ,!         
regulations requir$ "u subsection 7a7   
%all-- 7#a7 require any p>ty t ma9ta9s  
or communicates s5sitive acc\nt         
in=mation or s5sitive p]sonal in=mation 
on behalf ( a cov]$ entity to provide   
notice to t cov]$ entity if ! p>ty      

det]m9es t a brea* ( data security has1 
or may h1 occurr$ ) respect to !        
s5sitive acc\nt in=mation or s5sitive   
p]sonal in=mation2 &  7#b7 ensure t !re 
is only #a notification responsibility )
 respect to a brea* ( data security4    
7h7 ,tim+ ( regulations ,! regulations  
requir$ "u subsection 7a7 %all-- 7#a7 be
 issu$ 9 f9al =m n lat] ?an #f mon?s    
aft] ! date ( enactm5t ( ?is ,act2 &    
7#b7 take effect n lat] ?an #f mon?s    
aft] ! date on :i* !y are issu$ 9 f9al  
=m4  #e4 ,adm9i/rative en=cem5t  7a7 ,9 
g5]al ,not)/&+ any o!r provision ( law1 
section #c1 & ! regulations requir$ "u  
section #d1 %all be en=c$ exclusively   
"u-- 7#a7 section #h ( ! ,f$]al ,deposit
 ,insurance ,act 7#ab ,u4,s4,c4 #ahah71 
9 ! case (-- 7,a7 a national bank1 a    
,f$]al bran* or ,f$]al ag5cy ( a =eign  
bank1 or any subsidi>y !re( 7o!r ?an a  
brok]1 deal]1 p]son provid+ insurance1  
inve/m5t company1 or inve/m5t advis]71  
or a sav+s association1 ! deposits ( :i*
 are insur$ by ! ,f$]al ,deposit        

,insurance ,corporation1 or any         
subsidi>y !re( 7o!r ?an a brok]1 deal]1 
p]son provid+ insurance1 inve/m5t       
company1 or inve/m5t advis]71 by !      
,(fice ( ! ,comptroll] ( ! ,curr5cy2    
7,b7 a memb] bank ( ! ,f$]al ,res]ve    
,sy/em 7o!r ?an a national bank71 a     
bran* or ag5cy ( a =eign bank 7o!r ?an a
 ,f$]al bran*1 ,f$]al ag5cy1 or insur$  
,/ate bran* ( a =eign bank71 a comm]cial
 l5d+ company own$ or controll$ by a    
=eign bank1 an organization op]at+ "u   
section #be or #be;,a ( ! ,f$]al ,res]ve
 ,act 7#ab ,u4,s4,c4 #fja1 #faa71 or a  
bank hold+ company & its nonbank        
subsidi>y or affiliate 7o!r ?an a brok]1
 deal]1 p]son provid+ insurance1        
inve/m5t company1 or inve/m5t advis]71  
by ! ,bo>d ( ,gov]nors ( ! ,f$]al       
,res]ve ,sy/em2 &  7,c7 a bank1 !       
deposits ( :i* are insur$ by ! ,f$]al   
,deposit ,insurance ,corporation 7o!r   
?an a memb] ( ! ,f$]al ,res]ve ,sy/em71 
an insur$ ,/ate bran* ( a =eign bank1 or
 any subsidi>y !re( 7o!r ?an a brok]1   

deal]1 p]son provid+ insurance1 inve/m5t
 company1 or inve/m5t advis]71 by !     
,bo>d ( ,directors ( ! ,f$]al ,deposit  
,insurance ,corporation2  7#b7 ! ,f$]al 
,cr$it ,union ,act 7#ab ,u4,s4,c4 #agea 
et seq471 by ! ,national ,cr$it ,union  
,adm9i/ration ,bo>d ) respect to any    
f$]ally insur$ cr$it union2  7#c7 !     
,securities ,ex*ange ,act ( #aicd 7#ae  
,u4,s4,c4 #gh;a et seq471 by !          
,securities & ,ex*ange ,commission )    
respect to any brok] or deal]2  7#d7 !  
,inve/m5t ,company ,act ( #aidj 7#ae    
,u4,s4,c4 #hj;a-#a et seq471 by !       
,securities & ,ex*ange ,commission )    
respect to any inve/m5t company2  7#e7 !
 ,inve/m5t ,advis]s ,act ( #aidj 7#ae   
,u4,s4,c4 #hj;b-#a et seq471 by !       
,securities & ,ex*ange ,commission )    
respect to any inve/m5t advis] regi/]$ )
 ! ,securities & ,ex*ange ,commission "u
 t ,act2  7#f7 ! ,commodity ,ex*ange    
,act 7#g ,u4,s4,c4 #a et seq471 by !    
,commodity ,futures ,trad+ ,commission )
 respect to any futures commission      

m]*ant1 commodity trad+ advisor1        
commodity pool op]ator1 or introduc+    
brok]2  7#g7 ! provisions ( title ,,xiii
 ( ! ,h\s+ & ,community ,developm5t ,act
 ( #aiib 7#ab ,u4,s4,c4 #deja et seq471 
by ! ,director ( ,f$]al ,h\s+ ,ent]prise
 ,ov]sight 7& any successor to !        
functional regulatory ag5cy7 ) respect  
to ! ,f$]al ,national ,mortgage         
,association1 ! ,f$]al ,home ,loan      
,mortgage ,corporation1 & any o!r entity
 or ent]prise 7z def9$ 9 t title7       
subject to ! jurisdiction ( ! functional
 regulatory ag5cy "u t title1 includ+   
any affiliate ( any ! ent]prise2  7#h7  
,/ate insurance law1 9 ! case ( any     
p]son engag$ 9 provid+ insurance1 by !  
applicable ,/ate insurance au?ority ( ! 
,/ate 9 :i* ! p]son is domicil$2 &  7#i7
 ! ,f$]al ,trade ,commission ,act 7#ae  
,u4,s4,c4 #da et seq471 by ! ,commission
 = any o!r cov]$ entity t is n subject  
to ! jurisdiction ( any ag5cy or        
au?ority describ$ "u p>agraphs 7#a7     
?r\gh 7#h74  7b7 ,ext5sion ( ,f$]al     

,trade ,commission en=cem5t au?ority ,! 
au?ority ( ! ,commission to en=ce       
compliance ) section #c1 & ! regulations
 requir$ "u section #d1 "u subsection   
7a77#h7 %all-- 7#a7 not)/&+ ! ,f$]al    
,aviation ,act ( #aieh 7#di ,u4,s4,c4   
,app4 #acja et seq471 include ! au?ority
 to en=ce compliance by air c>ri]s &    
=eign air c>ri]s2 &  7#b7 not)/&+ !     
,pack]s & ,/ocky>ds ,act 7#g ,u4,s4,c4  
#aha et seq471 include ! au?ority to    
en=ce compliance by p]sons1 p>tn]%ips1 &
 corporations subject to ! provisions ( 
t ,act4  7c7 ,no private "r ( ,action   
7#a7 ,9 g5]al ,?is ,act1 & ! regulations
 prescrib$ "u ?is ,act1 may n be con/ru$
 to provide a private "r ( action1      
includ+ a class action ) respect to any 
act or practice regulat$ "u ?is ,act4   
7#b7 ,civil & crim9al ,actions ,no civil
 or crim9al action relat+ to any act or 
practice gov]n$ "u ?is ,act1 or !       
regulations prescrib$ "u ?is ,act1 %all 
be comm5c$ or ma9ta9$ 9 any ,/ate c\rt  
or "u ,/ate law1 includ+ a p5d5t ,/ate  

claim to an action "u ,f$]al law4  #f4  
,protection ( in=mation at ,f$]al       
ag5cies  7a7 ,data security /&>ds ,ea*  
ag5cy %all implem5t appropriate /&>ds   
relat+ to adm9i/rative1 te*nical1 &     
physical safegu>ds-- 7#a7 to insure !   
security & confid5tiality ( ! s5sitive  
acc\nt in=mation & s5sitive p]sonal     
in=mation t is ma9ta9$ or is be+        
communicat$ by1 or on behalf (1 t ag5cy2
  7#b7 to protect aga9/ any anticipat$  
?reats or haz>ds to ! security ( !      
s5sitive acc\nt in=mation & s5sitive    
p]sonal in=mation2 &  7#c7 to protect   
aga9/ misuse ( ! s5sitive acc\nt        
in=mation & s5sitive p]sonal in=mation t
 c\ld result 9 sub/antial h>m or        
inconv5i5ce to a consum]4  7b7 ,security
 brea* notification /&>ds ,ea* ag5cy    
%all implem5t appropriate /&>ds provid+ 
= notification ( consum]s :5 ! ag5cy    
det]m9es t s5sitive acc\nt in=mation or 
s5sitive p]sonal in=mation t is ma9ta9$ 
or is be+ communicat$ by1 or on behalf  
(1 ! ag5cy-- 7#a7 has be5 acquir$ )\t   

au?orization2 &  7#b7 is reasonably     
likely to be misus$ 9 a mann] caus+     
sub/antial h>m or inconv5i5ce to !      
consum]s to :om ! in=mation relates4    
#g4 ,relation to ,/ate law ,no          
requirem5t or prohibition may be impos$ 
"u ! laws ( any ,/ate ) respect to !    
responsibilities ( any p]son to-- 7#a7  
protect ! security ( in=mation relat+ to
 consum]s t is ma9ta9$ or communicat$   
by1 or on behalf (1 ! p]son2  7#b7      
safegu>d in=mation relat+ to consum]s f 
pot5tial misuse2  7#c7 inve/igate or    
provide notice ( ! unau?oriz$ access to 
in=mation relat+ to consum]s1 or !      
pot5tial misuse ( ! in=mation1 =        
fraudul5t1 illegal1 or o!r purposes2 or 
7#d7 mitigate any loss or h>m result+ f 
! unau?oriz$ access or misuse (         
in=mation relat+ to consum]s4  #h4      
,delay$ effective date = c]ta9          
provisions  7a7 ,cov]$ entities         
,sections #c & #g %all take effect on ! 
lat] (-- 7#a7 #a ye> aft] ! date (      
enactm5t ( ?is ,act2 or  7#b7 !         

effective date ( ! f9al regulations     
requir$ "u section #d4  7b7 ,ag5cies    
,section #f %all take effect #a ye> aft]
 ! date ( enactm5t ( ?is ,act4