,,ii #aacth ,,congress #b;d ,session ,s4 #aigf ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #cj1 #bjad,mr4 ,rockefeller 7for himself1 ,mrs4 ,feinstein1 ,mr4 ,pryor1 and ,mr4 ,nelson7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect consumers by requiring reasonable security policies and procedures to protect data containing personal information1 and to provide for nationwide notice in the event of a breach of security4 #a4 ,short title ,this ,act may be cited as the ,data ,security and ,breach ,notification ,act of #bjad4 #b4 ,requirements for information security 7a7 ,general security policies and procedures 7#a7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require each covered entity that owns or possesses data containing personal information1 or contracts to have any third-party entity maintain such data for such covered entity1 to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information taking into consideration-- 7,a7 the size of1 and the nature1 scope1 and complexity of the activities engaged in by such covered entity2 7,b7 the current state of the art in administrative1 technical1 and physical safeguards for protecting such information2 7,c7 the cost of implementing the safeguards under subparagraph 7,b72 and 7,d7 the impact on small businesses and nonprofits4 7#b7 ,requirements ,the regulations shall require the policies and procedures to include the following3 7,a7 ,a security policy with respect to the collection1 use1 sale1 other dissemination1 and maintenance of personal information4 7,b7 ,the identification of an officer or other individual as the point of contact with responsibility for the management of information security4 7,c7 ,a process for identifying and assessing any reasonably foreseeable vulnerabilities in each system maintained by the covered entity that contains such personal information1 which shall include regular monitoring for a breach of security of each such system4 7,d7 ,a process for taking preventive and corrective action to mitigate any vulnerabilities identified in the process required by subparagraph 7,c71 which may include implementing any changes to security practices and the architecture1 installation1 or implementation of network or operating software4 7,e7 ,a process for disposing of data in electronic form containing personal information by destroying1 permanently erasing1 or otherwise modifying the personal information contained in such data to make such personal information permanently unreadable or indecipherable4 7,f7 ,a standard method or methods for the destruction of paper documents and other non-electronic data containing personal information4 7b7 ,limitations 7#a7 ,covered entities subject to the ,gramm-,leach-,bliley ,act ,a financial institution that is subject to title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 and is in compliance with information security requirements under that ,act shall be deemed in compliance with this section4 7#b7 ,applicability of other information security requirements ,a person who is subject to1 and in compliance with1 the information security requirements of section #acdja of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica7 or of section #aagc7;d7 of title ,,xi1 part ,c of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#b7;d77 shall be deemed in compliance with this section with respect to any data governed by section #acdja of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica7 or by the ,health ,insurance ,portability and ,accountability ,act of #aiif ,security ,rule 7#de ,c4,f4,r4 #afj4ajc and ,part #afd74 7#c7 ,certain service providers ,nothing in this section shall apply to a service provider for any electronic communication by a third party to the extent that the service provider is engaged in the transmission1 routing1 or temporary1 intermediate1 or transient storage of that communication4 #c4 ,notification of breach of security 7a7 ,nationwide notification ,a covered entity that owns or possesses data in electronic form containing personal information1 following the discovery of a breach of security of the system maintained by the covered entity that contains such data1 shall notify-- 7#a7 each individual who is a citizen or resident of the ,united ,states and whose personal information was or is reasonably believed to have been acquired or accessed from the covered entity as a result of the breach of security2 and 7#b7 the ,commission1 unless the covered entity has notified the designated entity under section #d4 7b7 ,special notification requirements 7#a7 ,third-party entities ,in the event of a breach of security of a system maintained by a third-party entity that has been contracted to maintain or process data in electronic form containing personal information on behalf of any other covered entity who owns or possesses such data1 the third-party entity shall notify the covered entity of the breach of security4 ,upon receiving notification from the third party entity1 such covered entity shall provide the notification required under subsection 7a74 7#b7 ,service providers ,if a service provider becomes aware of a breach of security of data in electronic form containing personal information that is owned or possessed by another covered entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 the service provider shall notify of the breach of security only the covered entity who initiated such connection1 transmission1 routing1 or storage if such covered entity can be reasonably identified4 ,upon receiving the notification from the service provider1 the covered entity shall provide the notification required under subsection 7a74 7#c7 ,coordination of notification with credit reporting agencies ,if a covered entity is required to provide notification to more than #e1jjj individuals under subsection 7a77#a71 the covered entity also shall notify each major credit reporting agency of the timing and distribution of the notices1 except when the only personal information that is the subject of the breach of security is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code4 ,such notice shall be given to each credit reporting agency without unreasonable delay and1 if it will not delay notice to the affected individuals1 prior to the distribution of notices to the affected individuals4 7c7 ,timeliness of notification ,notification under subsection 7a7 shall be made-- 7#a7 not later than #cj days after the date of discovery of a breach of security2 or 7#b7 as promptly as possible if the covered entity providing notice can show that providing notice within the timeframe under paragraph 7#a7 is not feasible due to circumstances necessary-- 7,a7 to accurately identify affected consumers2 7,b7 to prevent further breach or unauthorized disclosures2 or 7,c7 to reasonably restore the integrity of the data system4 7d7 ,method and content of notification 7#a7 ,direct notification 7,a7 ,method of direct notification ,a covered entity shall be in compliance with the notification requirement under subsection 7a77#a7 if-- 7i7 the covered entity provides conspicuous and clearly identified notification-- 7,i7 in writing2 or 7,,ii7 by e-mail or other electronic means if-- 7aa7 the covered entity's primary method of communication with the individual is by e-mail or such other electronic means2 or 7bb7 the individual has consented to receive notification by e-mail or such other electronic means and such notification is provided in a manner that is consistent with the provisions permitting electronic transmission of notices under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja72 and 7ii7 the method of notification selected under clause 7i7 can reasonably be expected to reach the intended individual4 7,b7 ,content of direct notification ,each method of direct notification under subparagraph 7,a7 shall include-- 7i7 the date1 estimated date1 or estimated date range of the breach of security2 7ii7 a description of the personal information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security2 7iii7 a telephone number that an individual can use at no cost to the individual to contact the covered entity to inquire about the breach of security or the information the covered entity maintained about that individual2 7iv7 notice that the individual may be entitled to consumer credit reports under subsection 7e77#a72 7v7 instructions how an individual can request consumer credit reports under subsection 7e77#a72 7vi7 a telephone number1 that an individual can use at no cost to the individual1 and an address to contact each major credit reporting agency2 and 7vii7 a telephone number1 that an individual can use at no cost to the individual1 and an ,internet ,web site address to obtain information regarding identity theft from the ,commission4 7#b7 ,substitute notification 7,a7 ,circumstances giving rise to substitute notification ,a covered entity required to provide notification to individuals under subsection 7a77#a7 may provide substitute notification instead of direct notification under paragraph 7#a7-- 7i7 if direct notification is not feasible due to lack of sufficient contact information for the individual required to be notified2 or 7ii7 if the covered entity owns or possesses data in electronic form containing personal information of fewer than #aj1jjj individuals and direct notification is not feasible due to excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity1 as determined in accordance with the regulations issued by the ,commission under paragraph 7#c77;,a74 7,b7 ,method of substitute notification ,substitute notification under this paragraph shall include-- 7i7 conspicuous and clearly identified notification by e-mail to the extent the covered entity has an e-mail address for an individual who is entitled to notification under subsection 7a77#a72 7ii7 conspicuous and clearly identified notification on the ,internet ,web site of the covered entity if the covered entity maintains an ,internet ,web site2 and 7iii7 notification to print and to broadcast media1 including major media in metropolitan and rural areas where the individuals whose personal information was acquired reside4 7,c7 ,content of substitute notification ,each method of substitute notification under this paragraph shall include-- 7i7 the date1 estimated date1 or estimated date range of the breach of security2 7ii7 a description of the types of personal information that were or are reasonably believed to have been acquired or accessed as a result of the breach of security2 7iii7 notice that an individual may be entitled to consumer credit reports under subsection 7e77#a72 7iv7 instructions how an individual can request consumer credit reports under subsection 7e77#a72 7v7 a telephone number that an individual can use at no cost to the individual to learn whether the individual's personal information is included in the breach of security2 7vi7 a telephone number1 that an individual can use at no cost to the individual1 and an address to contact each major credit reporting agency2 and 7vii7 a telephone number1 that an individual can use at no cost to the individual1 and an ,internet ,web site address to obtain information regarding identity theft from the ,commission4 7#c7 ,regulations and guidance 7,a7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission1 by regulation under section #eec of title #e1 ,united ,states ,code1 shall establish criteria for determining circumstances under which substitute notification may be provided under section #c7;d77#b7 of this ,act1 including criteria for determining if direct notification under section #c7;d77#a7 of this ,act is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity4 ,the regulations may also identify other circumstances where substitute notification would be appropriate1 including circumstances under which the cost of providing direct notification exceeds the benefits to consumers4 7,b7 ,guidance ,in addition1 the ,commission1 in consultation with the ,small ,business ,administration1 shall provide and publish general guidance with respect to compliance with this subsection4 ,the guidance shall include-- 7i7 a description of written or e-mail notification that complies with paragraph 7#a72 and 7ii7 guidance on the content of substitute notification under paragraph 7#b71 including the extent of notification to print and broadcast media that complies with paragraph 7#b77;,b77iii74 7e7 ,other obligations following breach 7#a7 ,in general ,not later than #fj days after the date of request by an individual who received notification under subsection 7a77#a7 and quarterly thereafter for #b years1 a covered entity required to provide notification under subsection 7a77#a7 shall provide1 or arrange for the provision of1 to the individual at no cost1 consumer credit reports from at least #a major credit reporting agency4 7#b7 ,limitation ,this subsection shall not apply if the only personal information that is the subject of the breach of security is the individual's first name or initial and last name1 or address1 or phone number1 in combination with a credit or debit card number1 and any required security code4 7#c7 ,rulemaking ,the ,commission's rulemaking under subsection 7d77#c7 shall include-- 7,a7 determination of the circumstances under which a covered entity required to provide notification under subsection 7a77#a7 must provide or arrange for the provision of free consumer credit reports2 and 7,b7 establishment of a simple process under which a covered entity that is a small business or small non-profit organization may request a full or a partial waiver or a modified or an alternative means of complying with this subsection if providing free consumer credit reports is not feasible due to excessive costs relative to the resources of such covered entity and relative to the level of harm1 to affected individuals1 caused by the breach of security4 7f7 ,delay of ,notification ,authorized for ,national ,security and ,law ,enforcement ,purposes 7#a7 ,in general ,if the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation determines that notification under this section would impede a criminal investigation or a national security activity1 notification shall be delayed upon written notice from the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation to the covered entity that experienced the breach of security4 ,written notice from the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation shall specify the period of delay requested for national security or law enforcement purposes4 7#b7 ,subsequent delay of notification 7,a7 ,in general ,a covered entity shall provide notification under this section not later than #cj days after the day that the delay was invoked unless a ,federal law enforcement or intelligence agency provides subsequent written notice to the covered entity that further delay is necessary4 7,b7 ,written justification requirements 7i7 ,united ,states ,secret ,service ,if the ,united ,states ,secret ,service instructs a covered entity to delay notification under this section beyond the #cj-;day period under subparagraph 7,a7 7referred to in this clause as subsequent delay71 the ,united ,states ,secret ,service shall submit written justification for the subsequent delay to the ,secretary of ,homeland ,security before the subsequent delay begins4 7ii7 ,federal ,bureau of ,investigation ,if the ,federal ,bureau of ,investigation instructs a covered entity to delay notification under this section beyond the #cj-;day period under subparagraph 7,a7 7referred to in this clause as subsequent delay71 the ,federal ,bureau of ,investigation shall submit written justification for the subsequent delay to the ,attorney ,general before the subsequent delay begins4 7#c7 ,law enforcement immunity ,no cause of action shall lie in any court against any ,federal agency for acts relating to the delay of notification for national security or law enforcement purposes under this ,act4 7g7 ,general ,exemption 7#a7 ,in general ,a covered entity shall be exempt from the requirements under this section if1 following a breach of security1 the covered entity reasonably concludes that there is no reasonable risk of identity theft1 fraud1 or other unlawful conduct4 7#b7 ,presumption 7,a7 ,in general ,there shall be a presumption that no reasonable risk of identity theft1 fraud1 or other unlawful conduct exists following a breach of security if-- 7i7 the data is rendered unusable1 unreadable1 or indecipherable through a security technology or methodology2 and 7ii7 the security technology or methodology under clause 7i7 is generally accepted by experts in the information security field4 7,b7 ,rebuttal ,the presumption under subparagraph 7,a7 may be rebutted by facts demonstrating that the security technology or methodology in a specific case has been or is reasonably likely to be compromised4 7#c7 ,technologies or ,methodologies ,not later than #a year after the date of enactment of this ,act1 and biennially thereafter1 the ,commission1 after consultation with the ,national ,institute of ,standards and ,technology1 shall issue rules 7pursuant to section #eec of title #e1 ,united ,states ,code7 or guidance to identify each security technology and methodology under paragraph 7#b74 ,in identifying each such security technology and methodology1 the ,commission and the ,national ,institute of ,standards and ,technology shall-- 7,a7 consult with relevant industries1 consumer organizations1 data security and identity theft prevention experts1 and established standards setting bodies2 and 7,b7 consider whether and in what circumstances a security technology or methodology currently in use1 such as encryption1 complies with the standards under paragraph 7#b74 7#d7 ,,ftc guidance ,not later than #a year after the date of enactment of this ,act1 the ,commission1 after consultation with the ,national ,institute of ,standards and ,technology1 shall issue guidance regarding the application of the exemption under paragraph 7#a74 7h7 ,exemptions for national security and law enforcement purposes 7#a7 ,in general ,a covered entity shall be exempt from the requirements under this section if-- 7,a7 a determination is made-- 7i7 by the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation that notification of the breach of security could be reasonably expected to reveal sensitive sources and methods or similarly impede the ability of the ,government to conduct law enforcement or intelligence investigations2 or 7ii7 by the ,federal ,bureau of ,investigation that notification of the breach of security could be reasonably expected to cause damage to the national security2 and 7,b7 the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation1 as the case may be1 provides written notice of its determination under subparagraph 7,a7 to the covered entity4 7#b7 ,united ,states ,secret ,service ,if the ,united ,states ,secret ,service invokes an exemption under paragraph 7#a71 the ,united ,states ,secret ,service shall submit written justification for invoking the exemption to the ,secretary of ,homeland ,security before the exemption is invoked4 7#c7 ,federal ,bureau of ,investigation ,if the ,federal ,bureau of ,investigation invokes an exemption under paragraph 7#a71 the ,federal ,bureau of ,investigation shall submit written justification for invoking the exemption to the ,attorney ,general before the exemption is invoked4 7#d7 ,immunity ,no cause of action shall lie in any court against any ,federal agency for acts relating to the exemption from notification for national security or law enforcement purposes under this ,act4 7#e7 ,reports ,not later than #ah months after the date of enactment of this ,act1 and upon request by ,congress thereafter1 the ,united ,states ,secret ,service and ,federal ,bureau of ,investigation shall submit to ,congress a report on the number and nature of breaches of security subject to the exemptions for national security and law enforcement purposes under this subsection4 7i7 ,financial fraud prevention exemption 7#a7 ,in general ,a covered entity shall be exempt from the requirements under this section if the covered entity utilizes or participates in a security program that-- 7,a7 effectively blocks the use of the personal information to initiate an unauthorized financial transaction before it is charged to the account of the individual2 and 7,b7 provides notice to each affected individual after a breach of security that resulted in attempted fraud or an attempted unauthorized transaction4 7#b7 ,limitations ,an exemption under paragraph 7#a7 shall not apply if-- 7,a7 the breach of security includes personal information1 other than a credit card number or credit card security code1 of any type2 or 7,b7 the breach of security includes both the individual's credit card number and the individual's first and last name4 7j7 ,financial institutions regulated by ,federal functional regulators 7#a7 ,in general ,a covered financial institution shall be deemed in compliance with this section if-- 7,a7 the ,federal functional regulator with jurisdiction over the covered financial institution has issued a standard by regulation or guideline under title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 that-- 7i7 requires financial institutions within its jurisdiction to provide notification to individuals following a breach of security2 and 7ii7 provides protections substantially similar to1 or greater than1 those required under this ,act2 and 7,b7 the covered financial institution is in compliance with the standard under subparagraph 7,a74 7#b7 ,definitions ,in this subsection-- 7,a7 the term covered financial institution means a financial institution that is subject to-- 7i7 the data security requirements of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq472 7ii7 any implementing standard issued by regulation or guideline issued under that ,act2 and 7iii7 the jurisdiction of a ,federal functional regulator under that ,act2 7,b7 the term ,federal functional regulator has the meaning given the term in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji72 and 7,c7 the term financial institution has the meaning given the term in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji74 7k7 ,exemption2 health privacy 7#a7 ,covered entity or business associate under ,,hitech ,act ,to the extent that a covered entity under this ,act acts as a covered entity or a business associate under section #acdjb of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicb71 has the obligation to provide notification to individuals following a breach of security under that ,act or its implementing regulations1 and is in compliance with that obligation1 the covered entity shall be deemed in compliance with this section4 7#b7 ,entity subject to ,,hitech ,act ,to the extent that a covered entity under this ,act acts as a vendor of personal health records1 a third party service provider1 or other entity subject to section #acdjg of the ,health ,information ,technology for ,economical and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg71 has the obligation to provide notification to individuals following a breach of security under that ,act or its implementing regulations1 and is in compliance with that obligation1 the covered entity shall be deemed in compliance with this section4 7#c7 ,limitation of statutory construction ,nothing in this ,act may be construed in any way to give effect to the sunset provision under section #acdjg7;g77#b7 of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg7;g77#b77 or to otherwise limit or affect the applicability1 under section #acdjg of that ,act1 of the requirement to provide notification to individuals following a breach of security for vendors of personal health records and each entity described in clause 7ii71 7iii71 or 7iv7 of section #acdbd7;b77#a77;,a7 of that ,act 7#db ,u4,s4,c4 #agiec7;b77#a77;,a774 7l7 ,web site notice of ,federal ,trade ,commission ,if the ,commission1 upon receiving notification of any breach of security that is reported to the ,commission1 finds that notification of the breach of security via the ,commission's ,internet ,web site would be in the public interest or for the protection of consumers1 the ,commission shall place such a notice in a clear and conspicuous location on its ,internet ,web site4 7m7 ,,ftc study on notification in languages in addition to ,english ,not later than #a year after the date of enactment of this ,act1 the ,commission shall conduct a study on the practicality and cost effectiveness of requiring the direct notification required by subsection 7d77#a7 to be provided in a language in addition to ,english to individuals known to speak only such other language4 7n7 ,general rulemaking authority ,the ,commission may promulgate regulations necessary under section #eec of title #e1 ,united ,states ,code1 to effectively enforce the requirements of this section4 #d4 ,notice to law enforcement 7a7 ,designation of government entity ,to receive notice ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of the ,department of ,homeland ,security shall designate a ,federal ,government entity to receive notice under this section4 7b7 ,notice ,a covered entity shall notify the designated entity of a breach of security if-- 7#a7 the number of individuals whose personal information was1 or is reasonably believed to have been1 acquired or assessed as a result of the breach of security exceeds #aj1jjj2 7#b7 the breach of security involves a database1 networked or integrated databases1 or other data system containing the personal information of more than #a1jjj1jjj individuals2 7#c7 the breach of security involves databases owned by the ,federal ,government2 or 7#d7 the breach of security involves primarily personal information of individuals known to the covered entity to be employees or contractors of the ,federal ,government involved in national security or law enforcement4 7c7 ,content of notices 7#a7 ,in general ,each notice under subsection 7b7 shall contain-- 7,a7 the date1 estimated date1 or estimated date range of the breach of security2 7,b7 a description of the nature of the breach of security2 7,c7 a description of each type of personal information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security2 and 7,d7 a statement of each paragraph under subsection 7b7 that applies to the breach of security4 7#b7 ,construction ,nothing in this section shall be construed to require a covered entity to reveal specific or identifying information about an individual as part of the notice under paragraph 7#a74 7d7 ,responsibilities of the designated entity ,the designated entity shall promptly provide each notice it receives under subsection 7b7 to-- 7#a7 the ,united ,states ,secret ,service2 7#b7 the ,federal ,bureau of ,investigation2 7#c7 the ,federal ,trade ,commission2 7#d7 the ,united ,states ,postal ,inspection ,service1 if the breach of security involves mail fraud2 7#e7 the attorney general of each ,state affected by the breach of security2 and 7#f7 as appropriate1 other ,federal agencies for law enforcement1 national security1 or data security purposes4 7e7 ,timing of notices ,notice under this section shall be delivered as follows3 7#a7 ,notice under subsection 7b7 shall be delivered as promptly as possible1 but-- 7,a7 not less than #c business days before notification to an individual under section #c2 and 7,b7 not later than #aj days after the date of discovery of the events requiring notice4 7#b7 ,notice under subsection 7d7 shall be delivered as promptly as possible1 but not later than #a business day after the date that the designated entity receives notice of a breach of security from a covered entity4 #e4 ,application and enforcement 7a7 ,general application ,the requirements of sections #b and #c shall apply to-- 7#a7 those persons1 partnerships1 or corporations over which the ,commission has authority under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 and 7#b7 notwithstanding sections #d and #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd and #de7;a77#b771 any non-profit organization1 including any organization described in section #eja7;c7 of the ,internal ,revenue ,code of #aihf that is exempt from taxation under section #eja7;a7 of the ,internal ,revenue ,code of #aihf4 7b7 ,opt-,in for certain other entities 7#a7 ,in general ,notwithstanding sections #d and #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd and #de7;a77#b771 the requirements of section #c shall apply to any other covered entity not included under subsection 7a7 that enters into an agreement with the ,commission under which that covered entity would be subject to section #c with respect to any acts or omissions that occur while the agreement is in effect and that may constitute a violation of section #c1 if-- 7,a7 not less than #cj days prior to entering into the agreement with the person or entity1 the ,commission publishes notice in the ,federal ,register of the ,commission's intent to enter into the agreement2 and 7,b7 not later than #ad business days after entering into the agreement with the person or entity1 the ,commission publishes in the ,federal ,register-- 7i7 notice of the agreement2 7ii7 the identity of each person or entity covered by the agreement2 and 7iii7 the effective date of the agreement4 7#b7 ,construction 7,a7 ,other ,federal law ,an agreement under paragraph 7#a7 shall not effect a covered entity's obligation to provide notice of a breach of security or similar event under any other ,federal law4 7,b7 ,no preemption prior to valid agreement ,subsections 7a77#b7 and 7b7 of section #g shall not apply to a breach of security that occurs before a valid agreement under paragraph 7#a7 is in effect4 7c7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #b or #c of this ,act shall be treated as an unfair and deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of commission ,the ,commission shall enforce this ,act in the same manner1 by the same means1 with the same jurisdiction1 except as provided in subsections 7a77#b7 and 7b7 of this section1 and with the same powers and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any covered entity who violates such regulations shall be subject to the penalties and entitled to the privileges and immunities provided in that ,act4 7#c7 ,limitation ,in promulgating rules under this ,act1 the ,commission shall not require the deployment or use of any specific products or technologies1 including any specific computer software or hardware4 7d7 ,enforcement by ,state attorneys general 7#a7 ,civil action ,in any case in which the attorney general of a ,state1 or an official or agency of a ,state1 has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by any covered entity who violates section #b or section #c of this ,act1 the attorney general1 official1 or agency of the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction-- 7,a7 to enjoin further violation of such section by the defendant2 7,b7 to compel compliance with such section2 or 7,c7 to obtain civil penalties in the amount determined under paragraph 7#b74 7#b7 ,civil penalties 7,a7 ,calculation 7i7 ,treatment of violations of section #b ,for purposes of paragraph 7#a77;,c7 with regard to a violation of section #b1 the amount determined under this paragraph is the amount calculated by multiplying the number of days that a covered entity is not in compliance with such section by an amount not greater than #aa1jjj4 7ii7 ,treatment of violations of section #c ,for purposes of paragraph 7#a77;,c7 with regard to a violation of section #c1 the amount determined under this paragraph is the amount calculated by multiplying the number of violations of such section by an amount not greater than #aa1jjj4 ,each failure to send notification as required under section #c to a resident of the ,state shall be treated as a separate violation4 7,b7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of enactment of this ,act1 and each year thereafter1 the amounts specified in clauses 7i7 and 7ii7 of subparagraph 7,a7 and in clauses 7i7 and 7ii7 of subparagraph 7,c7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7,c7 ,maximum total liability ,notwithstanding the number of actions which may be brought against a covered entity under this subsection1 the maximum civil penalty for which any covered entity may be liable under this subsection shall not exceed-- 7i7 #e1jjj1jjj for each violation of section #b2 and 7ii7 #e1jjj1jjj for all violations of section #c resulting from a single breach of security4 7#c7 ,intervention by the ,,ftc 7,a7 ,notice and intervention ,the ,state shall provide prior written notice of any action under paragraph 7#a7 to the ,commission and provide the ,commission with a copy of its complaint1 except in any case in which such prior notice is not feasible1 in which case the ,state shall serve such notice immediately upon commencing such action4 ,the ,commission shall have the right-- 7i7 to intervene in the action2 7ii7 upon so intervening1 to be heard on all matters arising therein2 and 7iii7 to file petitions for appeal4 7,b7 ,limitation on ,state action while ,federal action is pending ,if the ,commission has instituted a civil action for violation of this ,act1 no ,state attorney general1 or official or agency of a ,state1 may bring an action under this subsection during the pendency of that action against any defendant named in the complaint of the ,commission for any violation of this ,act alleged in the complaint4 7#d7 ,construction ,for purposes of bringing any civil action under paragraph 7#a71 nothing in this ,act shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state-- 7,a7 to conduct investigations2 7,b7 to administer oaths or affirmations2 or 7,c7 to compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,notice to ,law ,enforcement2 ,civil ,enforcement by ,attorney ,general 7#a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any covered entity that engages in conduct constituting a violation of section #d4 7#b7 ,penalties 7,a7 ,in general ,upon proof of such conduct by a preponderance of the evidence1 a covered entity shall be subject to a civil penalty of not more than #a1jjj per individual whose personal information was or is reasonably believed to have been accessed or acquired as a result of the breach of security that is the basis of the violation1 up to a maximum of #ajj1jjj per day while such violation persists4 7,b7 ,limitations ,the total amount of the civil penalty assessed under this subsection against a covered entity for acts or omissions relating to a single breach of security shall not exceed #a1jjj1jjj1 unless the conduct constituting a violation of section #d was willful or intentional1 in which case an additional civil penalty of up to #a1jjj1jjj may be imposed4 7,c7 ,adjustment for inflation ,beginning on the date that the ,consumer ,price ,index is first published by the ,bureau of ,labor ,statistics that is after #a year after the date of enactment of this ,act1 and each year thereafter1 the amounts specified in subparagraphs 7,a7 and 7,b7 shall be increased by the percentage increase in the ,consumer ,price ,index published on that date from the ,consumer ,price ,index published the previous year4 7#c7 ,injunctive actions ,if it appears that a covered entity has engaged1 or is engaged1 in any act or practice that constitutes a violation of section #d1 the ,attorney ,general may petition an appropriate ,united ,states district court for an order enjoining such practice or enforcing compliance with section #d4 7#d7 ,issuance of order ,a court may issue such an order under paragraph 7#c7 if it finds that the conduct in question constitutes a violation of section #d4 7f7 ,concealment of breaches of security 7#a7 ,in general ,chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of breaches of security involving personal information 7a7 ,in general ,any person who1 having knowledge of a breach of security and of the fact that notification of the breach of security is required under the ,data ,security and ,breach ,notification ,act of #bjad1 intentionally and willfully conceals the fact of the breach of security1 shall1 in the event that the breach of security results in economic harm to any individual in the amount of #a1jjj or more1 be fined under this title1 imprisoned for not more than #e years1 or both4 7b7 ,person defined ,for purposes of subsection 7a71 the term person has the same meaning as in section #ajcj7;e77#ab7 of this title4 7c7 ,enforcement authority 7#a7 ,in general ,the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation shall have the authority to investigate offenses under this section4 7#b7 ,construction ,the authority granted in paragraph 7#a7 shall not be exclusive of any existing authority held by any other ,federal agency4 4 7#b7 ,conforming and technical amendments ,the table of sections for chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of breaches of security involving personal information4 4 #f4 ,definitions ,in this ,act3 7#a7 ,breach of security 7,a7 ,in general ,the term breach of security means compromise of the security1 confidentiality1 or integrity of1 or loss of1 data in electronic form that results in1 or there is a reasonable basis to conclude has resulted in1 unauthorized access to or acquisition of personal information from a covered entity4 7,b7 ,exclusions ,the term breach of security does not include-- 7i7 a good faith acquisition of personal information by a covered entity1 or an employee or agent of a covered entity1 if the personal information is not subject to further use or unauthorized disclosure2 7ii7 any lawfully authorized investigative1 protective1 or intelligence activity of a law enforcement or an intelligence agency of the ,united ,states1 a ,state1 or a political subdivision of a ,state2 or 7iii7 the release of a public record not otherwise subject to confidentiality or nondisclosure requirements4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered entity ,the term covered entity means a sole proprietorship1 partnership1 corporation1 trust1 estate1 cooperative1 association1 or other commercial entity1 and any charitable1 educational1 or nonprofit organization1 that acquires1 maintains1 or utilizes personal information4 7#d7 ,data in electronic form ,the term data in electronic form means any data stored electronically or digitally on any computer system or other database1 including recordable tapes and other mass storage devices4 7#e7 ,designated entity ,the term designated entity means the ,federal ,government entity designated by the ,secretary of ,homeland ,security under section #d4 7#f7 ,encryption ,the term encryption means the protection of data in electronic form in storage or in transit using an encryption technology that has been adopted by an established standards setting body which renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data4 ,such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption4 7#g7 ,identity theft ,the term identity theft means the unauthorized use of another person's personal information for the purpose of engaging in commercial transactions under the identity of such other person1 including any contact that violates section #ajbh;,a of title #ah1 ,united ,states ,code4 7#h7 ,major credit reporting agency ,the term major credit reporting agency means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis within the meaning of section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,personal information 7,a7 ,definition ,the term personal information means any information or compilation of information that includes-- 7i7 a non-truncated social security number2 7ii7 a financial account number or credit or debit card number in combination with any security code1 access code1 or password that is required for an individual to obtain credit1 withdraw funds1 or engage in a financial transaction2 or 7iii7 an individual's first and last name or first initial and last name in combination with-- 7,i7 a driver's license number1 a passport number1 or an alien registration number1 or other similar number issued on a government document used to verify identity2 7,,ii7 unique biometric data such as a finger print1 voice print1 retina or iris image1 or any other unique physical representation2 7,,iii7 a unique account identifier1 electronic identification number1 user name1 or routing code in combination with any associated security code1 access code1 or password that is required for an individual to obtain money1 goods1 services1 or any other thing of value2 or 7,,iv7 #b of the following3 7aa7 ,home address or telephone number4 7bb7 ,mother's maiden name1 if identified as such4 7cc7 ,month1 day1 and year of birth4 7,b7 ,modified definition by rulemaking ,if the ,commission determines that the definition under subparagraph 7,a7 is not reasonably sufficient to protect individuals from identity theft1 fraud1 or other unlawful conduct1 the ,commission by rule promulgated under section #eec of title #e1 ,united ,states ,code1 may modify the definition of personal information under subparagraph 7,a7 to the extent the modification will not unreasonably impede interstate commerce4 7#aj7 ,service provider ,the term service provider means a person that provides electronic data transmission1 routing1 intermediate and transient storage1 or connections to its system or network1 where the person providing such services does not select or modify the content of the electronic data1 is not the sender or the intended recipient of the data1 and does not differentiate personal information from other information that such person transmits1 routes1 or stores1 or for which such person provides connections4 ,any such person shall be treated as a service provider under this ,act only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage1 or connections4 #g4 ,effect on other laws 7a7 ,preemption of state information security laws 7#a7 ,covered entities under section #e7;a7 ,with respect to a covered entity subject to the ,act under section #e7;a71 this ,act supersedes any provision of a statute1 regulation1 or rule of a ,state or political subdivision of a ,state that expressly-- 7,a7 requires information security practices and treatment of data containing personal information similar to any of those required under section #b2 or 7,b7 requires notification to individuals of a breach of security as defined in section #f4 7#b7 ,covered entities under section #e7;b7 ,with respect to a covered entity subject to the ,act under section #e7;b71 this ,act supersedes any provision of a statute1 regulation1 or rule of a ,state or political subdivision of a ,state that expressly requires notification to individuals of a breach of security as defined in section #f4 7b7 ,additional preemption 7#a7 ,in general ,no person other than a person specified in section #e7;d7 may bring a civil action under the laws of any ,state if such action is premised in whole or in part upon the defendant violating any provision of this ,act4 7#b7 ,protection of consumer protection laws ,except as provided in subsection 7a7 of this section1 this subsection shall not be construed to limit the enforcement of any ,state consumer protection law by an attorney general of a ,state4 7c7 ,protection of certain ,state laws ,this ,act shall not be construed to preempt the applicability of-- 7#a7 ,state trespass1 contract1 or tort law2 or 7#b7 any other ,state laws to the extent that those laws relate to acts of fraud4 7d7 ,preservation of ,,ftc authority ,nothing in this ,act may be construed in any way to limit or affect the ,commission's authority under any other provision of law4 #h4 ,effective date ,this ,act and the amendments made by this ,act shall take effect #a year after the date of enactment of this ,act4