,,ii #aacth ,,congress #b;d ,session ,s4 #aiie ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #d1 #bjad,mr4 ,blumenthal 7for himself and ,mr4 ,markey7 introduced the following bill2 which was read twice and referred to the ,committee on the ,judiciary ,a ,,bill ,to protect consumers by mitigating the vulnerability of personally identifiable information to theft through a security breach1 providing notice and remedies to consumers in the wake of such a breach1 holding companies accountable for preventable breaches1 facilitating the sharing of post-breach technical information between companies1 and enhancing criminal and civil penalties and other protections against the unauthorized collection or use of personally identifiable information4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,findings4,sec4 #c4 ,definitions4,,title ,i--,enhancing punishment for identity theft and other violations of data privacy and security,sec4 #aja4 ,concealment of security breaches involving sensitive personally identifiable information4,sec4 #ajb4 ,unauthorized manipulation of ,internet traffic on a user's computer4,,title ,,ii--,privacy and security of sensitive personally identifiable information ,subtitle ,a--,a data privacy and security program,sec4 #bja4 ,purpose and applicability of data privacy and security program4,sec4 #bjb4 ,requirements for a personal data privacy and security program4,sec4 #bjc4 ,federal enforcement4,sec4 #bjd4 ,enforcement by ,state ,attorneys ,general4,sec4 #bje4 ,supplemental enforcement by individuals4,subtitle ,b--,security breach notification,sec4 #baa4 ,notice to individuals4,sec4 #bab4 ,exemptions from notice to individuals4,sec4 #bac4 ,methods of notice to individuals4,sec4 #bad4 ,content of notice to individuals4,sec4 #bae4 ,remedies for security breach4,sec4 #baf4 ,notice to credit reporting agencies4,sec4 #bag4 ,notice to law enforcement4,sec4 #bah4 ,federal enforcement4,sec4 #bai4 ,enforcement by ,state attorneys general4,sec4 #bbj4 ,supplemental enforcement by individuals4,sec4 #bba4 ,relation to other laws4,sec4 #bbb4 ,authorization of appropriations4,sec4 #bbc4 ,reporting on risk assessment exemptions4,subtitle ,c--,post-,breach technical information clearinghouse,sec4 #bcj4 ,clearinghouse information collection1 maintenance1 and access4,sec4 #bca4 ,protections for clearinghouse participants4,sec4 #bcb4 ,effective date4,,title ,,iii--,access to and use of commercial data,sec4 #cja4 ,general services administration review of contracts4,sec4 #cjb4 ,requirement to audit information security practices of contractors and third-party business entities4,sec4 #cjc4 ,privacy impact assessment of government use of commercial information services containing sensitive personally identifiable information4,sec4 #cjd4 ,,fbi report on reported breaches and compliance4,sec4 #cje4 ,department of ,justice report on enforcement actions4,sec4 #cjf4 ,report on notification effectiveness4,,title ,,iv--,compliance with ,statutory ,pay-,as-,you-,go ,act,sec4 #dja4 ,budget compliance4 #b4 ,findings ,congress finds that-- 7#a7 databases of personally identifiable information are increasingly prime targets of hackers1 identity thieves1 rogue employees1 and other criminals1 including organized and sophisticated criminal operations2 7#b7 identity theft is a serious threat to the ,nation's economic stability1 homeland security1 the development of e-commerce1 and the privacy rights of people in the ,united ,states2 7#c7 over #i1cjj1jjj individuals were victims of identity theft in the ,united ,states in #bjaj2 7#d7 security breaches are a serious threat to consumer confidence1 homeland security1 e-commerce1 and economic stability2 7#e7 it is important for business entities that own1 use1 or license personally identifiable information to adopt reasonable procedures to ensure the security1 privacy1 and confidentiality of that personally identifiable information2 7#f7 individuals whose personal information has been compromised or who have been victims of identity theft should receive the necessary information and assistance to mitigate their damages and to restore the integrity of their personal information and identities2 7#g7 data misuse and use of inaccurate data have the potential to cause serious or irreparable harm to an individual's livelihood1 privacy1 and liberty and undermine efficient and effective business and government operations2 7#h7 there is a need to ensure that data brokers conduct their operations in a manner that prioritizes fairness1 transparency1 accuracy1 and respect for the privacy of consumers2 7#i7 government access to commercial data can potentially improve safety1 law enforcement1 and national security2 7#aj7 because government use of commercial data containing personal information potentially affects individual privacy1 and law enforcement and national security operations1 there is a need for ,congress to exercise oversight over government use of commercial data2 7#aa7 over #bb1ifj1jjj cases of data breaches involving personally identifiable information were reported through ,july of #bjaa1 and in #bjji through #bjaj1 over #bcj1ijj1jjj cases of personal data breaches were reported2 7#ab7 facilitating information sharing among business entities and across sectors in the event of a breach can assist in remediating the breach and preventing similar breaches in the future2 7#ac7 because the ,federal ,government has limited resources1 consumers themselves play a vital and complementary role in facilitating prompt notification and protecting against future breaches of security2 7#ad7 in addition to the immediate damages caused by security breaches1 the lack of basic remedial requirements often forces individuals whose sensitive personally identifiable information is compromised as a result of a security breach to incur the economic costs of litigation to seek remedies1 and the economic costs of fees required in many ,states to freeze compromised accounts2 and 7#ae7 victims of personal data breaches may suffer debilitating emotional and physical effects and become depressed or anxious1 especially in cases of repeated or unresolved instances of data breaches4 #c4 ,definitions 7a7 ,in general ,in this ,act1 the following definitions shall apply3 7#a7 ,affiliate ,the term affiliate means persons related by common ownership or by corporate control4 7#b7 ,agency ,the term agency has the meaning given the term in section #eea of title #e1 ,united ,states ,code4 7#c7 ,business entity ,the term business entity means any organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture established to make a profit1 or nonprofit4 7#d7 ,credit rating agency ,the term credit rating agency has the meaning given the term in section #c7;a77#fa7 of the ,securities ,exchange ,act of #aicd 7#ae ,u4,s4,c4 #gh;c7a77#fa774 7#e7 ,credit report ,the term credit report means a consumer report1 as that term is defined in section #fjc7;d7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7d774 7#f7 ,data broker ,the term data broker means a business entity which for monetary fees or dues regularly engages in the practice of collecting1 transmitting1 or providing access to sensitive personally identifiable information on more than #e1jjj individuals who are not the customers or employees of that business entity or affiliate primarily for the purposes of providing such information to nonaffiliated third parties on an interstate basis4 7#g7 ,designated entity ,the term designated entity means the ,federal ,government entity designated under section #bag7;a74 7#h7 ,encryption ,the term encryption-- 7,a7 means the protection of data in electronic form1 in storage or in transit1 using an encryption technology that has been generally accepted by experts in the field of information security that renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data2 and 7,b7 includes appropriate management and safeguards of such cryptographic keys so as to protect the integrity of the encryption4 7#i7 ,identity theft ,the term identity theft means a violation of section #ajbh7;a77#g7 of title #ah1 ,united ,states ,code4 7#aj7 ,intelligence community ,the term intelligence community includes the following3 7,a7 ,the ,office of the ,director of ,national ,intelligence4 7,b7 ,the ,central ,intelligence ,agency4 7,c7 ,the ,national ,security ,agency4 7,d7 ,the ,defense ,intelligence ,agency4 7,e7 ,the ,national ,geospatial-,intelligence ,agency4 7,f7 ,the ,national ,reconnaissance ,office4 7,g7 ,other offices within the ,department of ,defense for the collection of specialized national intelligence through reconnaissance programs4 7,h7 ,the intelligence elements of the ,army1 the ,navy1 the ,air ,force1 the ,marine ,corps1 the ,federal ,bureau of ,investigation1 and the ,department of ,energy4 7,i7 ,the ,bureau of ,intelligence and ,research of the ,department of ,state4 7,j7 ,the ,office of ,intelligence and ,analysis of the ,department of the ,treasury4 7,k7 ,the elements of the ,department of ,homeland ,security concerned with the analysis of intelligence information1 including the ,office of ,intelligence of the ,coast ,guard4 7,l7 ,such other elements of any other department or agency as may be designated by the ,president1 or designated jointly by the ,director of ,national ,intelligence and the head of the department or agency concerned1 as an element of the intelligence community4 7#aa7 ,predispute arbitration agreement ,the term predispute arbitration agreement means any agreement to arbitrate a dispute that had not yet arisen at the time of the making of the agreement4 7#ab7 ,public record source ,the term public record source means the ,congress1 any agency1 any ,state or local government agency1 the government of the ,district of ,columbia and governments of the territories or possessions of the ,united ,states1 and ,federal1 ,state or local courts1 courts martial and military commissions1 that maintain personally identifiable information in records available to the public4 7#ac7 ,security breach 7,a7 ,in general ,the term security breach means compromise of the security1 confidentiality1 or integrity of1 or the loss of1 computerized data through misrepresentation or actions that result in1 or that there is a reasonable basis to conclude has resulted in-- 7i7 the unauthorized acquisition of sensitive personally identifiable information2 or 7ii7 access to sensitive personally identifiable information that is for an unauthorized purpose1 or in excess of authorization4 7,b7 ,exclusion ,the term security breach does not include-- 7i7 a good faith acquisition of sensitive personally identifiable information by a business entity or agency1 or an employee or agent of a business entity or agency1 if the sensitive personally identifiable information is not subject to further unauthorized disclosure2 7ii7 the release of a public record not otherwise subject to confidentiality or nondisclosure requirements or the release of information obtained from a public record2 or 7iii7 any lawfully authorized criminal investigation or authorized investigative1 protective1 or intelligence activities that are carried out by or on behalf of any element of the intelligence community and conducted in accordance with the ,united ,states laws1 authorities1 and regulations governing such intelligence activities4 7#ad7 ,security freeze ,the term security freeze means a notice1 at the request of the consumer and subject to exceptions in section #bae7;b71 that prohibits the consumer reporting agency from releasing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer4 7#ae7 ,sensitive personally identifiable information ,the term sensitive personally identifiable information means any information or compilation of information1 in electronic or digital form that includes the following3 7,a7 ,an individual's first and last name or first initial and last name in combination with any #b of the following data elements3 7i7 ,home address4 7ii7 ,telephone number of the individual4 7iii7 ,mother's maiden name4 7iv7 ,month1 day1 and year of birth4 7,b7 ,a non-truncated social security number1 driver's license number1 passport number1 or alien registration number or other government-issued unique identification number4 7,c7 ,information about an individual's geographic location that is in whole or in part generated by or derived from that individual's use of a wireless communication device or other electronic device1 excluding telephone and instrument numbers and network or ,internet ,protocol addresses4 7,d7 ,unique biometric data such as a fingerprint1 voice print1 face print1 a retina or iris image1 or any other unique physical representation4 7,e7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 health insurance policy or subscriber identification number1 or routing code4 7,f7 ,not less than #b of the following data elements3 7i7 ,an individual's first and last name or first initial and last name4 7ii7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7iii7 ,any security code1 access code1 or password1 or source code that could be used to generate such codes and passwords4 7iv7 ,information regarding an individual's medical history1 mental or physical medical condition1 or medical treatment or diagnosis by a health care professional4 7,g7 ,any other combination of data elements that could allow unauthorized access to or acquisition of the information described in subparagraph 7,a71 7,b71 7,c71 7,d71 7,e71 or 7,f71 including-- 7i7 a unique account identifier2 7ii7 an electronic identification number2 7iii7 a user name2 7iv7 a routing code2 or 7v7 any associated security code1 access code1 or password or any associated security questions and answers that could allow unauthorized access to the account4 7#af7 ,service provider 7,a7 ,in general ,the term service provider means a business entity that-- 7i7 provides electronic data transmission1 routing1 intermediate and transient storage1 or connections to the system or network of the business entity2 7ii7 is not the sender or the intended recipient of the data2 7iii7 is not ordinarily expected to select or modify the content of the electronic data2 and 7iv7 transmits1 routes1 stores1 or provides connections for personal information in a manner that personal information is undifferentiated from other types of data that such business entity transmits1 routes1 stores1 or provides connections4 7,b7 ,savings clause ,any such business entity shall be treated as a service provider under this ,act only to the extent that the business entity is engaged in the provision of the transmission1 routing1 intermediate and transient storage or connections described in subparagraph 7,a74 7b7 ,modified definition by rulemaking ,the ,federal ,trade ,commission may1 by rule promulgated under section #eec of title #e1 ,united ,states ,code1 modify the definition of sensitive personally identifiable information in a manner consistent with the purposes of this ,act and to the extent that such modification will not unreasonably impede interstate commerce4 ,i ,enhancing punishment for identity theft and other violations of data privacy and security #aja4 ,concealment of security breaches involving sensitive personally identifiable information 7a7 ,in general ,chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of security breaches involving sensitive personally identifiable information 7a7 ,whoever1 having knowledge of a security breach and of the fact that notice of such security breach is required under title ,,ii of the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad1 intentionally or willfully conceals the fact of such security breach and which breach1 shall1 in the event that such security breach results in economic harm or substantial emotional distress to #a or more persons1 shall be fined under this title or imprisoned not more than #e years1 or both4 7b7 ,for purposes of subsection 7a71 the term person has the meaning given the term in section #ajcj7;e77#ab7 of title #ah1 ,united ,states ,code4 7c7 ,any person seeking an exemption under section #bab7;b7 of the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad shall be immune from prosecution under this section if the ,united ,states ,secret ,service does not indicate1 in writing1 that such notice be given under section #bab7;b77#a77;,b7 of the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad4 4 7b7 ,conforming and technical amendments ,the table of sections for chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of security breaches involving sensitive personally identifiable information4 4 7c7 ,enforcement authority 7#a7 ,in general ,the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation shall have the authority to investigate offenses under section #ajda of title #ah1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,nonexclusivity ,the authority granted in paragraph 7#a7 shall not be exclusive of any existing authority held by any other ,federal agency4 #ajb4 ,unauthorized manipulation of ,internet traffic on a user's computer 7a7 ,definition ,in this section1 the term protected computer has the meaning given the term in section #ajcj7;e77#b7 of title #ah1 ,united ,states ,code4 7b7 ,prohibition 7#a7 ,in general ,unless a service provider provides a clear and conspicuous disclosure of data collected in the process of intercepting a web search or query entered by an authorized user of a protected computer1 and obtains the consent of an authorized user of the protected computer prior to any such action1 it shall be unlawful for a service provider to knowingly or intentionally-- 7,a7 bypass the display of search engine results and redirect web searches or queries entered by an authorized user of a protected computer directly to a commercial website1 counterfeit web page1 or targeted advertisement and derive an economic benefit from such activity2 or 7,b7 monitor1 manipulate1 aggregate1 and market the data collected in the process of intercepting a web search or query entered by an authorized user of a protected computer and derive an economic benefit from such activity4 7#b7 ,consent ,a service provider may not require consent to perform the collection of data described in paragraph 7#a7 as a condition of providing service to an authorized user of the protected computer4 7c7 ,limitations on liability ,the restrictions imposed under this section do not apply to any monitoring of1 or interaction with1 a subscriber's ,internet or other network connection or service1 or a protected computer1 by or at the direction of a telecommunications carrier1 cable operator1 computer hardware or software provider1 financial institution or provider of information services or interactive computer service for-- 7#a7 network or computer security purposes2 7#b7 diagnostics2 7#c7 technical support2 7#d7 repair2 7#e7 network management2 7#f7 authorized updates of software or system firmware2 7#g7 authorized remote system management2 7#h7 authorized provision of protection for users of the computer from objectionable content2 7#i7 authorized scanning for computer software used in violation of this section for removal by an authorized user2 or 7#aj7 detection or prevention of fraud4 7d7 ,enforcement by the ,attorney ,general 7#a7 ,liability and penalty for violations ,any person who engages in an activity in violation of this section shall be fined not more than #ejj1jjj4 7#b7 ,enhanced liability and penalties for pattern or practice of violations 7,a7 ,in general ,any person who engages in a pattern or practice of activity that violates the provisions of this section shall be fined not more than #a1jjj1jjj4 7,b7 ,treatment of single action or conduct ,for purposes of subparagraph 7,a71 any single action or conduct that violates this section with respect to multiple protected computers shall be construed as a single violation4 7#c7 ,considerations ,in determining the amount of any penalty under paragraph 7#a7 or 7#b71 the court shall take into account-- 7,a7 the degree of culpability of the defendant2 7,b7 any history of prior such conduct2 7,c7 the ability of the defendant to pay any fine imposed2 7,d7 the effect on the ability of the defendant to continue to do business2 and 7,e7 such other matters as justice may require4 ,,ii ,privacy and security of sensitive personally identifiable information ,a ,a data privacy and security program #bja4 ,purpose and applicability of data privacy and security program 7a7 ,purpose ,the purpose of this subtitle is to ensure standards for developing and implementing administrative1 technical1 and physical safeguards to protect the security of sensitive personally identifiable information4 7b7 ,in general ,a business entity engaging in interstate commerce that involves collecting1 accessing1 transmitting1 using1 storing1 or disposing of sensitive personally identifiable information in electronic or digital form on #aj1jjj or more ,united ,states persons is subject to the requirements for a data privacy and security program under section #bjb for protecting sensitive personally identifiable information4 7c7 ,limitations ,notwithstanding any other obligation under this subtitle1 this subtitle does not apply to the following3 7#a7 ,financial institutions ,a financial institution subject to the data security requirements and standards under #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b77 and subject to the jurisdiction of an agency or authority described in section #eje7;a7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a771 if the ,federal functional regulator 7as defined in section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji77 with jurisdiction over that financial institution has issued a regulation under title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 that requires financial institutions within its jurisdiction to provide notification to individuals following a breach of security4 7#b7 ,,hipaa regulated entities 7,a7 ,covered entities ,a business entity subject to the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq471 including the data security requirements and implementing regulations of that ,act4 7,b7 ,compliance ,a business entity that-- 7i7 is acting as a business associate1 as that term is defined under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq47 and is in compliance with the requirements imposed under that ,act and implementing regulations promulgated under that ,act2 and 7ii7 is subject to1 and currently in compliance1 with the privacy and data security requirements under sections #acdja and #acdjd of division ,a of the ,american ,reinvestment and ,recovery ,act of #bjji 7#db ,u4,s4,c4 #agica and #agicd7 and implementing regulations promulgated under such sections4 7#c7 ,service providers ,a service provider for any electronic communication by a third party1 to the extent that the service provider is exclusively engaged in the transmission1 routing1 or temporary1 intermediate1 or transient storage of that communication4 7#d7 ,public records ,public records not otherwise subject to a confidentiality or nondisclosure requirement1 or information obtained from a public record1 including information obtained from a news report or periodical4 7d7 ,rule of construction ,nothing in this subtitle shall be construed to modify1 limit1 or supersede the operation of the provisions of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 or its implementing regulations1 including such regulations adopted or enforced by the ,states4 #bjb4 ,requirements for a personal data privacy and security program 7a7 ,personal data privacy and security program ,a business entity subject to this subtitle shall comply with the following safeguards and any other administrative1 technical1 or physical safeguards identified by the ,federal ,trade ,commission in a rulemaking process pursuant to section #eec of title #e1 ,united ,states ,code1 for the protection of sensitive personally identifiable information3 7#a7 ,scope ,a business entity shall implement a comprehensive personal data privacy and security program that includes administrative1 technical1 and physical safeguards appropriate to the size and complexity of the business entity and the nature and scope of its activities4 7#b7 ,design ,the personal data privacy and security program shall be designed to-- 7,a7 ensure the privacy1 security1 and confidentiality of sensitive personally identifiable information2 7,b7 protect against any anticipated vulnerabilities to the privacy1 security1 or integrity of sensitive personally identifiable information2 and 7,c7 protect against unauthorized access to or use of sensitive personally identifiable information that could create a significant risk of harm to any individual4 7#c7 ,risk assessment ,a business entity shall-- 7,a7 identify reasonably foreseeable internal and external vulnerabilities that could result in unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information or systems containing sensitive personally identifiable information2 7,b7 assess the likelihood of and potential damage from unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information2 7,c7 assess the sufficiency of its policies1 technologies1 and safeguards in place to control and minimize risks from unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information2 and 7,d7 assess the vulnerability of sensitive personally identifiable information during destruction and disposal of such information1 including through the disposal or retirement of hardware4 7#d7 ,risk management and control ,each business entity shall-- 7,a7 design its personal data privacy and security program to control the risks identified under paragraph 7#c72 and 7,b7 adopt measures commensurate with the sensitivity of the data as well as the size1 complexity1 and scope of the activities of the business entity that-- 7i7 control access to systems and facilities containing sensitive personally identifiable information1 including controls to authenticate and permit access only to authorized individuals2 7ii7 detect1 record1 and preserve information relevant to actual and attempted fraudulent1 unlawful1 or unauthorized access1 disclosure1 use1 or alteration of sensitive personally identifiable information1 including by employees and other individuals otherwise authorized to have access2 7iii7 protect sensitive personally identifiable information during use1 transmission1 storage1 and disposal by encryption1 redaction1 or access controls that are widely accepted as an effective industry practice or industry standard1 or other reasonable means 7including as directed for disposal of records under section #fbh of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afhaw7 and the implementing regulations of such ,act as set forth in section #fhb of title #af1 ,code of ,federal ,regulations72 7iv7 ensure that sensitive personally identifiable information is properly destroyed and disposed of1 including during the destruction of computers1 diskettes1 and other electronic media that contain sensitive personally identifiable information2 7v7 trace access to records containing sensitive personally identifiable information so that the business entity can determine who accessed or acquired such sensitive personally identifiable information pertaining to specific individuals2 7vi7 ensure that no third party or customer of the business entity is authorized to access or acquire sensitive personally identifiable information without the business entity first performing sufficient due diligence to ascertain1 with reasonable certainty1 that such information is being sought for a valid legal purpose2 and 7vii7 minimize the amount of personal information maintained by the business entity1 providing for the retention of such personal information only as reasonably needed for the business purposes of the business entity or as necessary to comply with any other provision of law4 7b7 ,training ,each business entity subject to this subtitle shall take steps to ensure employee training and supervision for implementation of the data security program of the business entity4 7c7 ,vulnerability testing 7#a7 ,in general ,each business entity subject to this subtitle shall take steps to ensure regular testing of key controls1 systems1 and procedures of the personal data privacy and security program to detect1 prevent1 and respond to attacks or intrusions1 or other system failures4 7#b7 ,frequency ,the frequency and nature of the tests required under paragraph 7#a7 shall be determined by the risk assessment of the business entity under subsection 7a77#c74 7d7 ,certain relationship to providers of services ,in the event a business entity subject to this subtitle engages a person or entity not subject to this subtitle 7other than a service provider7 to receive sensitive personally identifiable information in performing services or functions 7other than the services or functions provided by a service provider7 on behalf of and under the instruction of such business entity1 such business entity shall-- 7#a7 exercise appropriate due diligence in selecting the person or entity for responsibilities related to sensitive personally identifiable information1 and take reasonable steps to select and retain a person or entity that is capable of maintaining appropriate safeguards for the security1 privacy1 and integrity of the sensitive personally identifiable information at issue2 and 7#b7 require the person or entity by contract to implement and maintain appropriate measures designed to meet the objectives and requirements governing entities subject to section #bja1 this section1 and subtitle ,b4 7e7 ,periodic assessment and personal data privacy and security modernization ,each business entity subject to this subtitle shall on a regular basis monitor1 evaluate1 and adjust1 as appropriate its data privacy and security program in light of any relevant changes in-- 7#a7 technology2 7#b7 the sensitivity of sensitive personally identifiable information2 7#c7 internal or external threats to sensitive personally identifiable information2 and 7#d7 the changing business arrangements of the business entity1 such as-- 7,a7 mergers and acquisitions2 7,b7 alliances and joint ventures2 7,c7 outsourcing arrangements2 7,d7 bankruptcy2 and 7,e7 changes to sensitive personally identifiable information systems4 7f7 ,implementation timeline ,not later than #a year after the date of enactment of this ,act1 a business entity subject to the provisions of this subtitle shall implement a data privacy and security program pursuant to this subtitle4 #bjc4 ,federal enforcement 7a7 ,civil penalties 7#a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any business entity that engages in conduct constituting a violation of this subtitle and1 upon proof of such conduct by a preponderance of the evidence1 such business entity shall be subject to a civil penalty of not more than #e1jjj per violation per day while such a violation exists1 with a maximum of #bj1jjj1jjj per violation1 unless such conduct is found to be willful or intentional4 7#b7 ,intentional or willful violation ,a business entity that intentionally or willfully violates the provisions of this subtitle shall be subject to additional penalties in the amount of #e1jjj per violation per day while such a violation exists4 7#c7 ,considerations ,in determining the amount of a civil penalty under this subsection1 the court shall take into account-- 7,a7 the degree of culpability of the business entity2 7,b7 any prior violations of this subtitle by the business entity2 7,c7 the ability of the business entity to pay a civil penalty2 7,d7 the effect on the ability of the business entity to continue to do business2 7,e7 the number of individuals whose sensitive personally identifiable information was compromised by the breach2 7,f7 the relative cost of compliance with this subtitle2 and 7,g7 such other matters as justice may require4 7b7 ,injunctive actions by the ,attorney ,general 7#a7 ,in general ,if it appears that a business entity has engaged1 or is engaged1 in any act or practice constituting a violation of this subtitle1 the ,attorney ,general may petition an appropriate district court of the ,united ,states for an order-- 7,a7 enjoining such act or practice2 or 7,b7 enforcing compliance with this subtitle4 7#b7 ,issuance of order ,a court may issue an order under paragraph 7#a71 if the court finds that the conduct in question constitutes a violation of this subtitle4 7c7 ,other rights and remedies ,the rights and remedies available under this section are cumulative and shall not affect any other rights and remedies available under law4 #bjd4 ,enforcement by ,state ,attorneys ,general 7a7 ,civil actions 7#a7 ,in general ,in any case in which the attorney general of a ,state or any ,state or local law enforcement agency authorized by the ,state attorney general or by ,state statute to prosecute violations of consumer protection law1 has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the acts or practices of a business entity that violate this subtitle1 the ,state may bring a civil action on behalf of the residents of that ,state in a district court of the ,united ,states of appropriate jurisdiction1 or any other court of competent jurisdiction1 to-- 7,a7 enjoin that act or practice2 7,b7 enforce compliance with this subtitle2 or 7,c7 obtain civil penalties of not more than #e1jjj per violation per day while such violations persist1 up to a maximum of #bj1jjj1jjj per violation4 7#b7 ,considerations ,in determining the amount of a civil penalty under this subsection1 the court shall take into account-- 7,a7 the degree of culpability of the business entity2 7,b7 any prior violations of this subtitle by the business entity2 7,c7 the ability of the business entity to pay a civil penalty2 7,d7 the effect on the ability of the business entity to continue to do business2 7,e7 the number of individuals whose sensitive personally identifiable information was compromised by the breach2 7,f7 the relative cost of compliance with this subtitle2 and 7,g7 such other matters as justice may require4 7#c7 ,notice 7,a7 ,in general ,before filing an action under this subsection1 the attorney general of the ,state involved shall provide to the ,attorney ,general-- 7i7 a written notice of that action2 and 7ii7 a copy of the complaint for that action4 7,b7 ,exception ,subparagraph 7,a7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this subsection1 if the attorney general of a ,state determines that it is not feasible to provide the notice described in this subparagraph before the filing of the action4 7,c7 ,notification when practicable ,in an action described in subparagraph 7,b71 the attorney general of a ,state shall provide the written notice and a copy of the complaint to the ,attorney ,general as soon after the filing of the complaint as practicable4 7b7 ,federal proceedings ,upon receiving notice under subsection 7a77#c71 the ,attorney ,general shall have the right to-- 7#a7 move to stay the action1 pending the final disposition of a pending ,federal proceeding or action described in subsection 7c72 7#b7 initiate an action in the appropriate ,united ,states district court under section #bah and move to consolidate all pending actions1 including ,state actions1 in such court2 7#c7 intervene in an action brought under subsection 7a77#b72 and 7#d7 file petitions for appeal4 7c7 ,pending proceedings ,if the ,attorney ,general has instituted a proceeding or action for a violation of this subtitle or any regulations thereunder1 no attorney general of a ,state may1 during the pendency of such proceeding or action1 bring an action under this section against any defendant named in such criminal proceeding or civil action for any violation that is alleged in that proceeding or action4 7d7 ,construction ,for purposes of bringing any civil action under subsection 7a71 nothing in this section shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on such attorney general by the laws of that ,state to-- 7#a7 conduct investigations2 7#b7 administer oaths or affirmations2 or 7#c7 compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,venue2 service of process 7#a7 ,venue ,any action brought under subsection 7a7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 #bje4 ,supplemental enforcement by individuals 7a7 ,in general ,any person aggrieved by a violation of the provisions of this subtitle by a business entity may bring a civil action in a court of appropriate jurisdiction to recover for personal injuries sustained as a result of the violation4 7b7 ,authority ,to bring civil action2 jurisdiction ,as provided in subsection 7c71 any person may commence a civil action on his own behalf against any business entity who is alleged to have violated the provisions of this subtitle4 7c7 ,remedies in a citizen suit 7#a7 ,damages ,any individual harmed by a failure of a business entity to comply with the provisions of this subtitle1 shall be able to collect damages of not more than #aj1jjj per violation per day while such violations persist1 up to a maximum of #bj1jjj1jjj per violation4 7#b7 ,punitive damages ,a business entity may be liable for punitive damages if the business entity intentionally or willfully violates the provisions of this subtitle4 7#c7 ,equitable relief ,a business entity that violates the provisions of this subtitle may be enjoined to comply with the provisions of those sections4 7d7 ,other rights and remedies ,the rights and remedies available under this subsection are cumulative and shall not affect any other rights and remedies available under law4 7e7 ,nonenforceability of certain provisions waiving rights and remedies or requiring arbitration of disputes 7#a7 ,waiver of rights and remedies ,the rights and remedies provided for in this section may not be waived by any agreement1 policy form1 or condition of employment including by a predispute arbitration agreement4 7#b7 ,predispute arbitration agreements ,no predispute arbitration agreement shall be valid or enforceable1 if the agreement requires arbitration of a dispute arising under this section4 7f7 ,considerations ,in determining the amount of a civil penalty under this subsection1 the court shall take into account-- 7#a7 the degree of culpability of the business entity2 7#b7 any prior violations of this subtitle by the business entity2 7#c7 the ability of the business entity to pay a civil penalty2 7#d7 the effect on the ability of the business entity to continue to do business2 7#e7 the number of individuals whose sensitive personally identifiable information was compromised by the breach2 7#f7 the relative cost of compliance with this subtitle2 and 7#g7 such other matters as justice may require4 ,b ,security breach notification #baa4 ,notice to individuals 7a7 ,in general ,except as provided in section #bab1 any agency1 or business entity engaged in interstate commerce other than a service provider1 that uses1 accesses1 transmits1 stores1 disposes of or collects sensitive personally identifiable information that experiences a security breach of such information1 shall1 following the discovery of such security breach of such information1 notify any resident of the ,united ,states whose sensitive personally identifiable information has been1 or is reasonably believed to have been1 accessed1 or acquired4 7b7 ,obligation of owner or licensee 7#a7 ,notice to owner or licensee ,any agency1 or business entity engaged in interstate commerce1 that uses1 accesses1 transmits1 stores1 disposes of1 or collects sensitive personally identifiable information that the agency or business entity does not own or license shall notify the owner or licensee of the information following the discovery of a security breach involving such information4 7#b7 ,notice by owner1 licensee or other designated third party ,nothing in this subtitle shall prevent or abrogate an agreement between an agency or business entity required to give notice under this section and a designated third party1 including an owner or licensee of the sensitive personally identifiable information subject to the security breach1 to provide the notifications required under subsection 7a74 7#c7 ,business entity relieved from giving notice ,a business entity obligated to give notice under subsection 7a7 shall be relieved of such obligation if an owner or licensee of the sensitive personally identifiable information subject to the security breach1 or other designated third party1 provides such notification4 7#d7 ,service providers ,if a service provider becomes aware of a security breach containing sensitive personally identifiable information that is owned or possessed by another business entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 the service provider shall be required to notify the business entity who initiated such connection1 transmission1 routing1 or storage of the security breach if the business entity can be reasonably identified4 ,upon receiving such notification from a service provider1 the business entity shall be required to provide the notification required under subsection 7a74 7c7 ,timeliness of notification 7#a7 ,in general ,all notifications required under this section shall be made without unreasonable delay following the discovery by the agency or business entity of a security breach4 7#b7 ,reasonable delay ,reasonable delay under this subsection may include any time necessary to determine the scope of the security breach1 conduct the risk assessment described in section #bab7;b77#a71 and provide notice to law enforcement when required4 7#c7 ,burden of production ,the agency1 business entity1 owner1 or licensee required to provide notice under this subtitle shall1 upon the request of the ,attorney ,general1 the ,federal ,trade ,commission1 or the attorney general of a ,state or any ,state or local law enforcement agency authorized by the attorney general of the ,state or by ,state statute to prosecute violations of consumer protection law1 provide records or other evidence of the notifications required under this subtitle1 including to the extent applicable1 the reasons for any delay of notification4 7d7 ,delay of notification authorized for law enforcement or national security purposes 7#a7 ,in general ,if a ,federal law enforcement agency or member of the intelligence community determines that the notification required under this section would impede any lawfully authorized criminal investigation or authorized investigative1 protective1 or intelligence activities that are carried out by or on behalf of any element of the intelligence community and conducted in accordance with the ,united ,states laws1 authorities1 and regulations governing such intelligence activities1 such notification shall be delayed upon written notice from such ,federal law enforcement agency or member of the intelligence community to the agency or business entity that experienced the breach4 ,the notification shall specify in writing the period of delay required4 7#b7 ,extended delay of notification ,if the notification required under subsection 7a7 is delayed pursuant to paragraph 7#a71 an agency or business entity shall give notice #cj days after the day such law enforcement delay was invoked unless a ,federal law enforcement or member of the intelligence community provides written notification that further delay is necessary4 7#c7 ,law enforcement immunity ,no non-constitutional cause of action shall lie in any court against an agency for acts relating to the delay of notification for law enforcement or intelligence purposes under this subtitle4 #bab4 ,exemptions from notice to individuals 7a7 ,exemption for national security and law enforcement 7#a7 ,in general ,section #baa shall not apply to an agency or business entity if-- 7,a7 the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation determines that notification of the security breach could be expected to reveal sensitive sources and methods or similarly impede the ability of the ,government to conduct law enforcement investigations2 or 7,b7 the ,federal ,bureau of ,investigation determines that notification of the security breach could be expected to cause damage to national security4 7#b7 ,immunity ,no non-constitutional cause of action shall lie in any court against any ,federal agency for acts relating to the exemption from notification under this subtitle4 7b7 ,safe harbor 7#a7 ,in general ,an agency or business entity shall be exempt from the notice requirements under section #baa1 if-- 7,a7 a risk assessment conducted by the agency or business entity1 in consultation with the ,federal ,trade ,commission1 concludes that there is no significant risk that a security breach has resulted in1 or will result in harm to the individuals whose sensitive personally identifiable information was subject to the security breach2 and 7,b7 the ,federal ,trade ,commission or designated entity does not indicate within #g business days from the receipt of written notification from an agency or business entity pursuant to subsection #bab7;b77#b71 that the agency or business entity should not be exempt from the notice requirements of section #baa4 7#b7 ,risk assessment requirements 7,a7 ,conducting a risk assessment ,upon discovery of a security breach of an agency or business entity1 the agency or business entity shall conduct a risk assessment to determine if there is a significant risk that the security breach resulted in1 or will result in1 harm to the individuals whose sensitive personally identifiable information was subject to the security breach4 7i7 ,presumption of no significant risk ,it is presumed that there is no significant risk that the security breach has resulted in1 or will result in1 harm to the individuals whose sensitive personally identifiable data was subject to the security breach1 if the sensitive personally identifiable information has been rendered unusable1 unreadable1 or indecipherable through a security technology or methodology 7if the technology or methodology is generally accepted by experts in the information security field74 ,any such presumption may be rebutted by facts demonstrating that the security technologies or methodologies in a specific case1 have been or are reasonably likely to be compromised4 7ii7 ,presumption of significant risk ,it is presumed that there is a significant risk that the security breach has resulted in1 or will result in1 harm to individuals whose sensitive personally identifiable information was subject to the security breach if the agency or business entity failed to render such sensitive personally identifiable information indecipherable through a security technology or methodology 7if the technology or methodology is generally accepted by experts in the information security field74 7iii7 ,methodologies or technologies 7,i7 ,required rulemaking ,not later than #a year after the date of the enactment of this ,act1 and biannually thereafter1 the ,federal ,trade ,commission1 after consultation with the ,national ,institute of ,standards and ,technology1 shall issue rules 7pursuant to section #eec of title #e1 ,united ,states ,code7 or guidance to identify security methodologies or technologies1 such as encryption1 which render sensitive personally identifiable information unusable1 unreadable1 or indecipherable1 that shall1 if applied to such sensitive personally identifiable information1 establish a presumption that no significant risk of harm exists to individuals whose sensitive personally identifiable information was subject to a security breach4 ,any such presumption may be rebutted by facts demonstrating that any such methodology or technology in a specific case has been or is reasonably likely to be compromised4 7,,ii7 ,required consultation ,in issuing rules or guidance under subclause 7,,ii71 the ,commission shall also consult with relevant industries1 consumer organizations1 and data security and identity theft prevention experts and established standards setting bodies4 7iv7 ,,ftc guidance ,not later than #a year after the date of the enactment of this ,act1 the ,federal ,trade ,commission1 after consultation with the ,national ,institute of ,standards and ,technology1 shall issue guidance regarding the application of the exemption in clause 7i74 7,b7 ,written notification ,without unreasonable delay1 but not later than #g days after the discovery of a security breach1 unless extended by the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation1 the agency or business entity must notify the ,federal ,trade ,commission and designated entity1 in writing1 of-- 7i7 the results of the risk assessment2 and 7ii7 its decision to invoke the risk assessment exemption4 7,c7 ,violations ,it shall be a violation of this section to-- 7i7 fail to conduct a risk assessment in a reasonable manner1 or according to standards generally accepted by experts in the field of information security2 or 7ii7 submit results of a risk assessment that-- 7,i7 conceal violations of law1 inefficiency1 or administrative error2 7,,ii7 prevent embarrassment to a business entity1 organization1 or agency2 7,,iii7 restrain competition2 7,,iv7 contain fraudulent or deliberately misleading information2 or 7,v7 delay notification under section #baa for any other reason1 except where the agency or business entity reasonably believes that the risk assessment exception may apply4 7c7 ,financial fraud prevention exemption 7#a7 ,in general ,a business entity shall be exempt from the notice requirements of this subtitle if the business entity utilizes or participates in a security program that-- 7,a7 effectively blocks the use of the sensitive personally identifiable information to initiate unauthorized financial transactions before they are charged to the account of the individual2 and 7,b7 provides for notice to affected individuals after a security breach that has resulted in fraud or unauthorized transactions4 7#b7 ,limitation ,paragraph 7#a7 shall not apply to a business entity if the information subject to the security breach includes an individual's first and last name1 or any other type of sensitive personally identifiable information1 other than a credit card or credit card security code identified in section #c1 unless that information is only a credit card number or a credit card security code4 7d7 ,limitations ,notwithstanding any other obligation under this subtitle1 this subtitle does not apply to the following-- 7#a7 ,financial institutions ,a financial institution subject to the data security requirements and standards under #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 and subject to the jurisdiction of an agency or authority described in section #eje7;a7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a771 if the ,federal functional regulator 7as defined by section #eji of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji77 with jurisdiction over that financial institution has issued a regulation under title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq47 that requires financial institutions within its jurisdiction to provide notification to individuals following a breach of security4 7#b7 ,,hipaa regulated entities exemption 7,a7 ,in general ,a business entity shall be exempt from the notice requirement under section #baa if the business entity is one of the following3 7i7 ,covered entities ,a business entity subject to the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq471 including the data breach notification requirements and implementing regulations of that ,act4 7ii7 ,business entities ,a business entity that-- 7,i7 is acting as a business associate1 as that term is defined under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acja et seq47 and is in compliance with the requirements imposed under that ,act and implementing regulations promulgated under that ,act2 and 7,,ii7 is subject to1 and currently in compliance with1 the data breach notification requirements under section #acdjb or #acdjg of the ,american ,reinvestment and ,recovery ,act of #bjji 7#db ,u4,s4,c4 #agicb and #agicg7 and implementing regulations promulgated under such sections4 7,b7 ,limitation ,paragraph 7#a7 shall not apply to a business entity if the information subject to the security breach includes an individual's first and last name1 or any other type of sensitive personally identifiable information other than a health insurance policy or subscriber identification number or information regarding an individual's medical history1 mental or physical medical condition1 or medical treatment or diagnosis by a health care professional as identified in section #c unless that information is only a health insurance policy or subscriber identification number or information regarding an individual's medical history1 mental or physical medical condition1 or medical treatment or diagnosis by a health care professional4 #bac4 ,methods of notice to individuals ,to comply with section #baa1 an agency or business entity shall provide the following forms of notice3 7#a7 ,individual written notice ,written notice to individuals by #a of the following means3 7,a7 ,individual written notification to the last known home mailing address of the individual in the records of the agency or business entity4 7,b7 ,e-mail notice1 unless the individual has expressly opted not to receive such notices of security breaches or the notice is inconsistent with the provisions permitting electronic transmission of notices under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja74 7#b7 ,telephone notice ,telephone notice to the individual personally4 7#c7 ,public notice 7,a7 ,electronic notice ,prominent notice via all reasonable means of electronic contact between the individual and the agency or business entity1 including any website1 networked devices1 or other interface through which the agency or business entity regularly interacts with the consumer1 if the number of individuals whose sensitive personally identifiable information was or is reasonably believed to have been accessed or acquired by an unauthorized person exceeds #e1jjj4 7,b7 ,media notice ,notice to major media outlets serving a ,state or jurisdiction1 if the number of residents of such ,state whose sensitive personally identifiable information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person exceeds #e1jjj4 #bad4 ,content of notice to individuals 7a7 ,in general ,regardless of the method by which individual notice is provided to individuals under section #bac7a71 such notice shall include-- 7#a7 a description of the categories of sensitive personally identifiable information that was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person1 and how the agency or business entity came into possession of the sensitive personally identifiable information at issue2 7#b7 a toll-free number-- 7,a7 that the individual may use to contact the agency or business entity1 or the agent of the agency or business entity2 and 7,b7 from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual2 7#c7 the toll-free contact telephone numbers1 websites1 and addresses for the major credit reporting agencies2 7#d7 the telephone numbers and websites for the relevant ,federal agencies that provide information regarding identity theft prevention and protection2 7#e7 notice that the individual is entitled to receive1 at no cost to such individual1 consumer credit reports on a quarterly basis for a period of #b years1 credit monitoring or any other service that enables consumers to detect the misuse of sensitive personally identifiable information for a period of #b years1 and instructions to the individual on requesting such reports or service from the agency or business entity2 7#f7 notice that the individual is entitled to receive a security freeze and that the agency or business entity will be liable for any costs associated with the security freeze for #b years and the necessary instructions for requesting a security freeze2 and 7#g7 notice that any costs or damages incurred by an individual as a result of a security breach will be paid by the business entity or agency that experienced the security breach4 7b7 ,telephone notice ,telephone notice described in section #bac7b7 shall include1 to the extent possible-- 7#a7 notification that a security breach has occurred and that the individual's sensitive personally identifiable information may have been compromised2 7#b7 a description of the categories of sensitive personally identifiable information that were1 or are reasonably believed to have been1 accessed or acquired by an unauthorized person2 7#c7 a toll-free number and website-- 7,a7 that the individual may use to contact the agency or business entity1 or the authorized agent of the agency or business entity2 and 7,b7 from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual and remedies available to that individual2 and 7#d7 an alert to the individual that the agency or business entity is sending or has sent written notification containing additional information as required under section #bac7a77;,a74 7c7 ,public notice ,public notice described in section #bac7c7 shall include-- 7#a7 electronic notice1 which includes-- 7,a7 notification that a security breach has occurred and that the individual's sensitive personally identifiable information may have been compromised2 7,b7 a description of the categories of sensitive personally identifiable information that were1 or are reasonably believed to have been1 accessed or acquired by an unauthorized person2 and 7,c7 a toll-free number and website-- 7i7 that the individual may use to contact the agency or business entity1 or the authorized agent of the agency or business entity2 and 7ii7 from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual and remedies available to that individual2 and 7#b7 media notice1 which includes-- 7,a7 a description of the categories of sensitive personally identifiable information that was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person2 7,b7 a toll-free number-- 7i7 that the individual may use to contact the agency or business entity1 or the authorized agent of the agency or business entity2 and 7ii7 from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual and remedies available to that individual2 7,c7 the toll-free contact telephone numbers1 websites1 and addresses for the major credit reporting agencies2 7,d7 the telephone numbers and websites for the relevant ,federal agencies that provide information regarding identity theft prevention and protection2 7,e7 notice that the affected individuals are entitled to receive1 at no cost to such individuals1 consumer credit reports on a quarterly basis for a period of #b years1 credit monitoring1 or any other service that enables consumers to detect the misuse of sensitive personally identifiable information for a period of #b years2 7,f7 notice that the individual is entitled to receive a security freeze and that the agency or business entity will be liable for any costs associated with the security freeze for #b years2 and 7,g7 notice that the individual is entitled to receive compensation from the business entity or agency for any costs or damages incurred by the individual resulting from the security breach4 7d7 ,additional content ,notwithstanding section #bba1 a ,state may require that a notice under subsection 7a7 shall also include information regarding victim protection assistance provided for by that ,state4 7e7 ,direct business relationship ,regardless of whether a business entity1 agency1 or a designated third party provides the notice required pursuant to section #baa7;b71 such notice shall include the name of the business entity or agency that has a direct relationship with the individual being notified4 #bae4 ,remedies for security breach 7a7 ,credit reports and credit monitoring ,an agency or business entity required to provide notification under this subtitle shall1 upon request of an individual whose sensitive personally identifiable information was included in the security breach1 provide or arrange for the provision of1 to each such individual and at no cost to such individual-- 7#a7 consumer credit reports from not fewer than #a of the major credit reporting agencies beginning not later than #fj days following the request of the individual and continuing on a quarterly basis for a period of #b years thereafter2 and 7#b7 a credit monitoring or other service that enables consumers to detect the misuse of their personal information1 beginning not later than #fj days following the request of the individual and continuing for a period of #b years4 7b7 ,security freeze 7#a7 ,request ,any consumer may submit a written request1 by certified mail or such other secure method as authorized by a credit rating agency1 to a credit rating agency to place a security freeze on the credit report of the consumer4 7#b7 ,implementation of security freeze ,upon receipt of a written request under paragraph 7#a71 a credit rating agency shall-- 7,a7 not later than #e business days after receipt of the request1 place a security freeze on the credit report of the consumer2 and 7,b7 not later than #aj business days after placing a security freeze1 send a written confirmation of such security freeze to the consumer1 which shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of the credit report of the consumer to a third party or for a specified period of time4 7#c7 ,duration of security freeze ,except as provided in paragraph 7#d71 any security freeze authorized pursuant to the provisions of this section shall remain in effect until the consumer requests security freeze to be removed4 7#d7 ,disclosure of credit report to third party 7,a7 ,in general ,if a consumer that has requested a security freeze under this subsection wishes to authorize the disclosure of the credit report of the consumer to a third party1 or for a specified period of time1 while such security freeze is in effect1 the consumer shall contact the credit rating agency and provide-- 7i7 proper identification2 7ii7 the unique personal identification number or password described in paragraph 7#b77;,b72 and 7iii7 proper information regarding the third party who is to receive the credit report or the time period for which the credit report shall be available4 7,b7 ,requirement ,not later than #c business days after receipt of a request under subparagraph 7,a71 a credit rating agency shall lift the security freeze4 7#e7 ,procedures 7,a7 ,in general ,a credit rating agency shall develop procedures to receive and process requests from consumers under paragraph 7#b7 of this section4 7,b7 ,requirement ,procedures developed under subparagraph 7,a71 at a minimum1 shall include the ability of a consumer to send such temporary lift or removal request by electronic mail1 letter1 telephone1 or facsimile4 7#f7 ,requests by third party ,if a third party requests access to a credit report of a consumer that has been frozen under this subsection and the consumer has not authorized the disclosure of the credit report of the consumer to the third party1 the third party may deem such credit application as incomplete4 7#g7 ,determination by credit rating agency 7,a7 ,in general ,a credit rating agency may refuse to implement or may remove a security freeze under this subsection if the agency determines1 in good faith1 that-- 7i7 the request for a security freeze was made as part of a fraud that the consumer participated in1 had knowledge of1 or that can be demonstrated by circumstantial evidence2 or 7ii7 the consumer credit report was frozen due to a material misrepresentation of fact by the consumer4 7,b7 ,notice ,if a credit rating agency makes a determination under subparagraph 7,a7 to not implement1 or to remove1 a security freeze under this subsection1 the credit rating agency shall notify the consumer in writing of such determination-- 7i7 in the case of a determination not to implement a security freeze1 not later than #e business days after the determination is made2 and 7ii7 in the case of a removal of a security freeze1 prior to removing the freeze on the credit report of the consumer4 7#h7 ,rule of construction 7,a7 ,in general ,nothing in this section shall be construed to prohibit disclosure of a credit report of a consumer to-- 7i7 a person1 or the person's subsidiary1 affiliate1 agent or assignee with which the consumer has or1 prior to assignment1 had an account1 contract or debtor-creditor relationship for the purpose of reviewing the account or collecting the financial obligation owing for the account1 contract or debt2 7ii7 a subsidiary1 affiliate1 agent1 assignee or prospective assignee of a person to whom access has been granted under paragraph 7#d7 for the purpose of facilitating the extension of credit or other permissible use2 7iii7 any person acting pursuant to a court order1 warrant1 or subpoena2 7iv7 any person for the purpose of using such credit information to prescreen as provided by the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq472 7v7 any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed2 7vi7 a credit rating agency for the sole purpose of providing a consumer with a copy of the credit report of the consumer upon the request of the consumer2 or 7vii7 a ,federal1 ,state or local governmental entity1 including a law enforcement agency1 or court1 or their agents or assignees pursuant to their statutory or regulatory duties2 and 7viii7 any person for the sole purpose of providing a remedy requested by an individual under this section4 7,b7 ,reviewing the account ,for purposes of this subsection1 reviewing the account shall include activities relating to account maintenance1 monitoring1 credit line increases1 and account upgrades and enhancements4 7#i7 ,exceptions ,the following persons shall not be required to place a security freeze under this subsection1 but shall be subject to any security freeze placed on a credit report by another credit rating agency3 7,a7 ,a check services or fraud prevention services company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments1 electronic fund transfers or similar methods of payment4 7,b7 ,a deposit account information service company that issues reports regarding account closures due to fraud1 substantial overdrafts1 automated teller machine abuse1 or similar information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution4 7,c7 ,a credit rating agency that-- 7i7 acts only to resell credit information by assembling and merging information contained in a database of #a or more credit reporting agencies2 and 7ii7 does not maintain a permanent database of credit information from which new credit reports are produced4 7#aj7 ,fees 7,a7 ,in general ,a credit rating agency may charge reasonable fees for each security freeze1 removal of such freeze or temporary lift of such freeze for a period of time1 and a temporary lift of such freeze for a specific party4 7,b7 ,requirement ,any fees charged under subparagraph 7,a7 shall be borne by the agency or business entity providing notice under section #bad for #b years following the establishment of the security freeze under this subsection4 7c7 ,costs resulting from a security breach 7#a7 ,in general ,a business entity or agency that experiences a security breach and is required to provide notice under this subtitle shall pay1 upon request1 to any individual whose sensitive personally identifiable information has been1 or is reasonably believed to have been1 accessed or acquired as a result of such security breach1 any costs or damages incurred by the individual as a result of such security breach1 including costs associated with identity theft suffered as a result of such security breach4 7#b7 ,compliance ,a business entity or agency shall be deemed in compliance with this subsection if the business entity or agency-- 7,a7 provides insurance to any individual whose sensitive personally identifiable information has been1 or is reasonably believed to have been1 accessed or acquired as a result of a security breach and such insurance is sufficient to compensate the consumer for not less than #be1jjj of costs or damages2 or 7,b7 pays1 without unreasonable delay1 any actual costs or damages incurred by an individual as a result of the security breach4 #baf4 ,notice to credit reporting agencies ,if an agency or business entity is required to provide notification to more than #e1jjj individuals under section #baa7;a71 the agency or business entity shall also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis 7as defined in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p777 of the timing and distribution of the notices4 ,such notice shall be given to the consumer credit reporting agencies without unreasonable delay and1 if it will not delay notice to the affected individuals1 prior to the distribution of notices to the affected individuals4 #bag4 ,notice to law enforcement 7a7 ,designation of a government entity ,to receive notice 7#a7 ,in general ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security1 in consultation with the ,attorney ,general1 shall designate a ,federal ,government entity to receive the information required to be submitted under this subtitle1 and any other reports and information about information security incidents1 threats1 and vulnerabilities4 7#b7 ,responsibilities of the designated entity ,the designated entity shall-- 7,a7 be responsible for promptly providing the information it receives to the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation1 and to the ,federal ,trade ,commission for civil law enforcement purposes2 and 7,b7 provide the information described in subparagraph 7,a7 as appropriate to other ,federal agencies for law enforcement1 national security1 or data security purposes4 7b7 ,notice ,any business entity or agency shall notify the designated entity of the fact that a security breach has occurred if-- 7#a7 the number of individuals whose sensitive personally identifiable information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person exceeds #e1jjj2 7#b7 the security breach involves a database1 networked or integrated databases1 or other data system containing the sensitive personally identifiable information of more than #ejj1jjj individuals nationwide2 7#c7 the security breach involves databases owned by the ,federal ,government2 or 7#d7 the security breach involves primarily sensitive personally identifiable information of individuals known to the agency or business entity to be employees and contractors of the ,federal ,government involved in national security or law enforcement4 7c7 ,,ftc review of thresholds 7#a7 ,review ,not later than #a year after the date of enactment of this ,act1 the ,federal ,trade ,commission1 in consultation with the ,attorney ,general and the ,secretary of ,homeland ,security1 shall promulgate regulations regarding the reports required under subsection 7a74 7#b7 ,rulemaking ,the ,federal ,trade ,commission1 in consultation with the ,attorney ,general and the ,secretary of ,homeland ,security1 after notice and the opportunity for public comment1 and in a manner consistent with this section1 shall promulgate regulations1 as necessary1 under section #eec of title #e1 ,united ,states ,code1 to adjust the thresholds for notice to law enforcement and national security authorities under subsection 7a7 and to facilitate the purposes of this section4 7d7 ,timing of notices ,the notices required under this section shall be delivered as follows3 7#a7 ,notice under subsection 7a7 shall be delivered as promptly as possible1 but not later than #aj days after discovery of the security breach4 7#b7 ,notice under section #baa shall be delivered to individuals not later than #dh hours after the ,federal ,bureau of ,investigation or the ,secret ,service receives notice of a security breach from an agency or business entity4 #bah4 ,federal enforcement 7a7 ,civil actions by the ,attorney ,general 7#a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any business entity that engages in conduct constituting a violation of this subtitle and1 upon proof of such conduct by a preponderance of the evidence1 such business entity shall be subject to a civil penalty of not more than #ejj per day per individual whose sensitive personally identifiable information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person1 up to a maximum of #bj1jjj1jjj per violation1 unless such conduct is found to be willful or intentional4 7#b7 ,presumption ,a violation of section #bab7;b77#b77;,c7 shall be presumed to be willful or intentional conduct4 7b7 ,injunctive actions by the ,attorney ,general 7#a7 ,in general ,if it appears that a business entity has engaged1 or is engaged1 in any act or practice constituting a violation of this subtitle1 the ,attorney ,general may petition an appropriate district court of the ,united ,states for an order-- 7,a7 enjoining such act or practice2 or 7,b7 enforcing compliance with this subtitle4 7#b7 ,issuance of order ,a court may issue an order under paragraph 7#a71 if the court finds that the conduct in question constitutes a violation of this subtitle4 7c7 ,civil actions by the ,federal trade commission 7#a7 ,in general ,compliance with the requirements imposed under subtitle ,a and this subtitle may be enforced under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 by the ,federal ,trade ,commission with respect to business entities subject to this ,act4 ,all of the functions and powers of the ,federal ,trade ,commission under the ,federal ,trade ,commission ,act are available to the ,commission to enforce compliance by any person with the requirements imposed under this title4 7#b7 ,unfair or deceptive acts or practices ,for the purpose of the exercise by the ,federal ,trade ,commission of its functions and powers under the ,federal ,trade ,commission ,act1 a violation of any requirement or prohibition imposed under this title shall constitute an unfair or deceptive act or practice in commerce in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77,i77,b77 regarding unfair or deceptive acts or practices and shall be subject to enforcement by the ,federal ,trade ,commission under that ,act with respect to any business entity1 irrespective of whether that business entity is engaged in commerce or meets any other jurisdictional tests in the ,federal ,trade ,commission4 7d7 ,considerations ,in determining the amount of a civil penalty under this subsection1 the court shall take into account-- 7#a7 the degree of culpability of the business entity2 7#b7 any prior violations of this subtitle by the business entity2 7#c7 the ability of the business entity to pay a civil penalty2 7#d7 the effect on the ability of the business entity to continue to do business2 7#e7 the number of individuals whose sensitive personally identifiable information was compromised by the breach2 7#f7 the relative cost of compliance with this subtitle2 and 7#g7 such other matters as justice may require4 7e7 ,coordination of enforcement 7#a7 ,in general ,before opening an investigation1 the ,federal ,trade ,commission shall consult with the ,attorney ,general4 7#b7 ,limitation ,the ,federal ,trade ,commission may initiate investigations under this subsection unless the ,attorney ,general determines that such an investigation would impede an ongoing criminal investigation or national security activity4 7#c7 ,coordination agreement 7,a7 ,in general ,in order to avoid conflicts and promote consistency regarding the enforcement and litigation of matters under this ,act1 not later than #ahj days after the enactment of this ,act1 the ,attorney ,general and the ,commission shall enter into an agreement for coordination regarding the enforcement of this ,act4 7,b7 ,requirement ,the coordination agreement entered into under subparagraph 7,a7 shall include provisions to ensure that parallel investigations and proceedings under this section are conducted in a manner that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7#d7 ,coordination with the ,,fcc ,if an enforcement action under this ,act relates to customer proprietary network information1 the ,federal ,trade ,commission shall coordinate the enforcement action with the ,federal ,communications ,commission4 7f7 ,rulemaking ,the ,federal ,trade ,commission may1 in consultation with the ,attorney ,general1 issue such other regulations as it determines to be necessary to carry out this subtitle4 ,all regulations promulgated under this ,act shall be issued in accordance with section #eec of title #e1 ,united ,states ,code4 ,where regulations relate to customer proprietary network information1 the promulgation of such regulations will be coordinated with the ,federal ,communications ,commission4 7g7 ,other rights and remedies ,the rights and remedies available under this subtitle are cumulative and shall not affect any other rights and remedies available under law4 7h7 ,fraud alert ,section #fje;,a7b77#a7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;c-#a7;b77#a77 is amended in the matter preceding subparagraph 7,a7 by inserting 1 or evidence that the consumer has received notice that the consumer's financial information has or may have been compromised1 after identity theft report4 #bai4 ,enforcement by ,state attorneys general 7a7 ,in general 7#a7 ,civil actions 7,a7 ,in general ,in any case in which the attorney general of a ,state or any ,state or local law enforcement agency authorized by the ,state attorney general or by ,state statute to prosecute violations of consumer protection law1 has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of a business entity in a practice that is prohibited under this subtitle1 the ,state or the ,state or local law enforcement agency on behalf of the residents of the agency's jurisdiction1 may bring a civil action on behalf of the residents of the ,state or jurisdiction in a district court of the ,united ,states of appropriate jurisdiction or any other court of competent jurisdiction1 including a ,state court1 to-- 7i7 enjoin that practice2 7ii7 enforce compliance with this subtitle2 or 7iii7 obtain civil penalties of not more than #ejj per day per individual whose sensitive personally identifiable information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person1 up to a maximum of #bj1jjj1jjj per violation1 unless such conduct is found to be willful or intentional4 7,b7 ,presumption ,a violation of section #bab7;b77#b77;,c7 shall be presumed to be willful or intentional4 7#b7 ,considerations ,in determining the amount of a civil penalty under this subsection1 the court shall take into account-- 7,a7 the degree of culpability of the business entity2 7,b7 any prior violations of this subtitle by the business entity2 7,c7 the ability of the business entity to pay a civil penalty2 7,d7 the effect on the ability of the business entity to continue to do business2 7,e7 the number of individuals whose sensitive personally identifiable information was compromised by the breach2 7,f7 the relative cost of compliance with this subtitle2 and 7,g7 such other matters as justice may require4 7#c7 ,notice 7,a7 ,in general ,before filing an action under paragraph 7#a71 the attorney general of the ,state involved shall provide to the ,attorney ,general of the ,united ,states-- 7i7 written notice of the action2 and 7ii7 a copy of the complaint for the action4 7,b7 ,exemption 7i7 ,in general ,subparagraph 7,a7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this subtitle1 if the ,state attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action4 7ii7 ,notification ,in an action described in clause 7i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,attorney ,general at the time the ,state attorney general files the action4 7b7 ,federal proceedings ,upon receiving notice under subsection 7a77#b71 the ,attorney ,general shall have the right to-- 7#a7 move to stay the action1 pending the final disposition of a pending ,federal proceeding or action2 7#b7 initiate an action in the appropriate ,united ,states district court under section #bah and move to consolidate all pending actions1 including ,state actions1 in such court2 7#c7 intervene in an action brought under subsection 7a77#b72 and 7#d7 file petitions for appeal4 7c7 ,pending proceedings ,if the ,attorney ,general has instituted a proceeding or action for a violation of this subtitle or any regulations thereunder1 no attorney general of a ,state may1 during the pendency of such proceeding or action1 bring an action under this subtitle against any defendant named in such criminal proceeding or civil action for any violation that is alleged in that proceeding or action4 7d7 ,construction ,for purposes of bringing any civil action under subsection 7a71 nothing in this subtitle regarding notification shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on such attorney general by the laws of that ,state to-- 7#a7 conduct investigations2 7#b7 administer oaths or affirmations2 or 7#c7 compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,venue2 service of process 7#a7 ,venue ,any action brought under subsection 7a7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 #bbj4 ,supplemental enforcement by individuals 7a7 ,in general ,any person aggrieved by a violation of the provisions of section #baa1 #bac1 #bad1 #bae1 or #baf by a business entity may bring a civil action in a court of appropriate jurisdiction to recover for personal injuries sustained as a result of the violation4 7b7 ,authority ,to bring civil action2 jurisdiction ,as provided in subsection 7c71 an individual may commence a civil action on his own behalf against any business entity who is alleged to have violated the provisions of this subtitle4 7c7 ,remedies in a citizen suit 7#a7 ,damages ,any individual harmed by a failure of a business entity to comply with the provisions of section #baa1 #bac1 #bad1 #bae1 or #baf shall be able to collect damages of not more than #ejj per day per individual whose sensitive personally identifiable information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person1 up to a maximum of #bj1jjj1jjj per violation4 7#b7 ,punitive damages ,a business entity may be liable for punitive damages if the business entity-- 7,a7 intentionally or willfully violates the provisions of section #baa1 #bac1 #bad1 #bae1 or #baf2 or 7,b7 failed to comply with the requirements of subsections 7a7 through 7d7 of section #bjb4 7#c7 ,equitable relief ,a business entity that violates the provisions of section #baa1 #bac1 #bad1 #bae1 or #baf may be enjoined to provide required remedies under section #bae by a court of competent jurisdiction4 7d7 ,other rights and remedies ,the rights and remedies available under this subsection are cumulative and shall not affect any other rights and remedies available under law4 7e7 ,nonenforceability of ,certain ,provisions ,waiving ,rights and ,remedies or ,requiring ,arbitration of ,disputes 7#a7 ,waiver of rights and remedies ,the rights and remedies provided for in this section may not be waived by any agreement1 policy form1 or condition of employment including by a predispute arbitration agreement4 7#b7 ,predispute arbitration agreements ,no predispute arbitration agreement shall be valid or enforceable1 if the agreement requires arbitration of a dispute arising under this section4 7f7 ,considerations ,in determining the amount of a civil penalty under this subsection1 the court shall take into account-- 7#a7 the degree of culpability of the business entity2 7#b7 any prior violations of this subtitle by the business entity2 7#c7 the ability of the business entity to pay a civil penalty2 7#d7 the effect on the ability of the business entity to continue to do business2 7#e7 the number of individuals whose sensitive personally identifiable information was compromised by the breach2 7#f7 the relative cost of compliance with this subtitle2 and 7#g7 such other matters as justice may require4 #bba4 ,relation to other laws 7a7 ,in general ,the provisions of this subtitle shall supersede any other provision of ,federal law or any provision of law of any ,state relating to notification by a business entity engaged in interstate commerce or an agency of a security breach1 except as provided in this subsection4 7b7 ,limitations 7#a7 ,state common law ,nothing in this subtitle shall be construed to exempt any entity from liability under common law1 including through the operation of ordinary preemption principles1 and including liability through ,state trespass1 contract1 or tort law1 for damages caused by the failure to notify an individual following a security breach4 7#b7 ,gramm-leach-bliley ,act ,nothing in this ,act shall supersede the data security requirements of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq471 or implementing regulations based on that ,act4 7#c7 ,health ,privacy 7,a7 ,to the extent that a business entity acts as a covered entity or a business associate under the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicb71 and has the obligation to provide breach notification under that ,act or its implementing regulations1 the requirements of this ,act shall not apply4 7,b7 ,to the extent that a business entity acts as a vendor of personal health records1 a third-party service provider1 or other entity subject to the ,health ,information ,technology for ,economical and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg71 and has the obligation to provide breach notification under that ,act or its implementing regulations1 the requirements of this ,act shall not apply4 #bbb4 ,authorization of appropriations ,there are authorized to be appropriated such sums as may be necessary to cover the costs incurred by the ,united ,states ,secret ,service to carry out investigations and risk assessments of security breaches as required under this subtitle4 #bbc4 ,reporting on risk assessment exemptions ,the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation shall report to ,congress not later than #ah months after the date of enactment of this ,act1 and upon the request by ,congress thereafter1 on-- 7#a7 the number and nature of the security breaches described in the notices filed by those business entities invoking the risk assessment exemption under section #bab7;b7 and the response of the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation to such notices2 and 7#b7 the number and nature of security breaches subject to the national security and law enforcement exemptions under section #bab7;a71 provided that such report may not disclose the contents of any risk assessment provided to the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation pursuant to this subtitle4 ,c ,post-,breach technical information clearinghouse #bcj4 ,clearinghouse information collection1 maintenance1 and access 7a7 ,in general ,the designated entity shall maintain a clearinghouse of technical information concerning system vulnerabilities identified in the wake of security breaches1 which shall-- 7#a7 contain information disclosed by agencies or business entities under subsection 7b72 and 7#b7 be accessible to certified entities under subsection 7c74 7b7 ,post-,breach technical notification ,in any instance in which an agency or business entity is required to notify the designated entity under section #bag1 the agency or business entity shall also provide the designated entity with technical information concerning the nature of the security breach1 including-- 7#a7 technical information regarding any system vulnerabilities of the agency or business entity revealed by or identified as a consequence of the security breach2 7#b7 technical information regarding any system vulnerabilities of the agency or business entity actually exploited during the security breach2 and 7#c7 any other technical information concerning the nature of the security breach deemed appropriate for collection by the designated entity in furtherance of this subtitle4 7c7 ,access to clearinghouse ,any entity certified under subsection 7d7 may review information maintained by the technical information clearinghouse for the purpose of preventing security breaches that threaten the security of sensitive personally identifiable information4 7d7 ,certification for access ,the designated entity shall issue and revoke certifications to agencies and business entities wishing to review information maintained by the technical information clearinghouse and shall establish conditions for obtaining and maintaining such certifications1 including agreement that any information obtained directly or derived indirectly from the review of information maintained by the technical information clearinghouse-- 7#a7 shall only be used to improve the security and reduce the vulnerability of networks that collect1 access1 transmit1 use1 store1 or dispose of sensitive personally identifiable information2 7#b7 may not be used for any competitive commercial purpose2 and 7#c7 may not be shared with any third party1 including other parties certified for access to the information clearinghouse1 without the express written consent of the designated entity4 7e7 ,rulemaking ,in consultation with the private sector1 appropriate representatives of ,state and local governments1 and other appropriate ,federal agencies1 the designated entity may issue such regulations as it determines to be necessary to carry out this subtitle4 ,all regulations promulgated under this ,act shall be issued in accordance with section #eec of title #e1 ,united ,states ,code4 #bca4 ,protections for clearinghouse participants 7a7 ,protection of proprietary information ,to the extent feasible1 the designated entity shall ensure that any technical information disclosed to the designated entity under this subtitle shall be stored in a format designed to protect proprietary business information from inadvertent disclosure4 7b7 ,anonymous data release ,to the extent feasible1 the designated entity shall ensure that all information stored in the technical information clearinghouse and accessed by certified parties is presented in a form that minimizes the potential for such information to be traced to a particular network1 company1 or security breach incident4 7c7 ,protection from public disclosure ,except as otherwise provided in this subtitle-- 7#a7 security and vulnerability information collected under this section and provided to the ,federal ,government1 including aggregated analysis and data1 shall be exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code2 and 7#b7 under section #bcj7;e71 security and vulnerability-related information provided to the ,federal ,government under this section1 including aggregated analysis and data1 shall be protected from public disclosure1 except that this paragraph-- 7,a7 does not prohibit the sharing of such information1 as the designated entity determines to be appropriate1 in order to mitigate cybersecurity threats or further the official functions of a government agency2 and 7,b7 does not authorized such information to be withheld from a committee of ,congress authorized to request the information4 7d7 ,protection of classified information ,nothing in this subtitle permits the unauthorized disclosure of classified information4 #bcb4 ,effective date ,this subtitle shall take effect on the expiration of the date that is #ij days after the date of enactment of this ,act4 ,,iii ,access to and use of commercial data #cja4 ,general services administration review of contracts 7a7 ,in general ,in considering contract awards totaling more than #ejj1jjj and entered into after the date of enactment of this ,act with data brokers1 the ,administrator of the ,general ,services ,administration shall evaluate-- 7#a7 the data privacy and security program of a data broker to ensure the privacy and security of data containing sensitive personally identifiable information1 including whether such program adequately addresses privacy and security threats created by malicious software or code1 or the use of peer-to-peer file sharing software2 7#b7 the compliance of a data broker with such program2 7#c7 the extent to which the databases and systems containing sensitive personally identifiable information of a data broker have been compromised by security breaches2 and 7#d7 the response by a data broker to such breaches1 including the efforts by such data broker to mitigate the impact of such security breaches4 7b7 ,compliance safe harbor ,the data privacy and security program of a data broker shall be deemed sufficient for the purposes of subsection 7a71 if the data broker complies with or provides protection equal to industry standards1 as identified by the ,federal ,trade ,commission1 that are applicable to the type of sensitive personally identifiable information involved in the ordinary course of business of such data broker4 7c7 ,penalties ,in awarding contracts with data brokers for products or services related to access1 use1 compilation1 distribution1 processing1 analyzing1 or evaluating sensitive personally identifiable information1 the ,administrator of the ,general ,services ,administration shall-- 7#a7 include monetary or other penalties-- 7,a7 for failure to comply with subtitles ,a and ,b of title ,,ii2 or 7,b7 if a contractor knows or has reason to know that the sensitive personally identifiable information being provided is inaccurate1 and provides such inaccurate information2 and 7#b7 require a data broker that engages service providers not subject to subtitle ,a of title ,,ii for responsibilities related to sensitive personally identifiable information to-- 7,a7 exercise appropriate due diligence in selecting those service providers for responsibilities related to sensitive personally identifiable information2 7,b7 take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the security1 privacy1 and integrity of the sensitive personally identifiable information at issue2 and 7,c7 require such service providers1 by contract1 to implement and maintain appropriate measures designed to meet the objectives and requirements in title ,,ii4 7d7 ,limitation ,the penalties under subsection 7c7 shall not apply to a data broker providing information that is accurately and completely recorded from a public record source or licensor4 #cjb4 ,requirement to audit information security practices of contractors and third-party business entities ,section #cedd7;b7 of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#g77;,c77iii71 by striking and after the semicolon2 7#b7 in paragraph 7#h71 by striking the period and inserting 2 and2 and 7#c7 by adding at the end the following3 7#i7 procedures for evaluating and auditing the information security practices of contractors or third-party business entities supporting the information systems or operations of the agency involving sensitive personally identifiable information 7as that term is defined in section #c of the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad7 and ensuring remedial action to address any significant deficiencies4 4 #cjc4 ,privacy impact assessment of government use of commercial information services containing sensitive personally identifiable information 7a7 ,in general ,section #bjh7;b77#a7 of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note7 is amended in subparagraph 7,a7-- 7#a7 in clause 7i71 by striking or2 7#b7 in clause 7ii77,,ii71 by striking the period and inserting 2 or2 and 7#c7 by adding at the end the following3 7iii7 purchasing or subscribing for a fee to sensitive personally identifiable information from a data broker 7as such terms are defined in section #c of the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad74 4 7b7 ,limitation ,notwithstanding any other provision of law1 beginning #a year after the date of enactment of this ,act1 no ,federal agency may enter into a contract with a data broker to access for a fee any database consisting primarily of sensitive personally identifiable information concerning ,united ,states persons 7other than news reporting or telephone directories7 unless the head of the agency-- 7#a7 completes a privacy impact assessment under section #bjh of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note71 which shall subject to the provision in that ,act pertaining to sensitive information1 include a description of-- 7,a7 such database2 7,b7 the name of the data broker from whom it is obtained2 and 7,c7 the amount of the contract for use2 7#b7 adopts regulations that specify-- 7,a7 the personnel permitted to access1 analyze1 or otherwise use such databases2 7,b7 standards governing the access1 analysis1 or use of such databases2 7,c7 any standards used to ensure that the sensitive personally identifiable information accessed1 analyzed1 or used is the minimum necessary to accomplish the intended legitimate purpose of the ,federal agency2 7,d7 standards limiting the retention and redisclosure of sensitive personally identifiable information obtained from such databases2 7,e7 procedures ensuring that such data meet standards of accuracy1 relevance1 completeness1 and timeliness2 7,f7 the auditing and security measures to protect against unauthorized access1 analysis1 use1 or modification of data in such databases2 7,g7 applicable mechanisms by which individuals may secure timely redress for any adverse consequences wrongly incurred due to the access1 analysis1 or use of such databases2 7,h7 mechanisms1 if any1 for the enforcement and independent oversight of existing or planned procedures1 policies1 or guidelines2 and 7,i7 an outline of enforcement mechanisms for accountability to protect individuals and the public against unlawful or illegitimate access or use of databases2 and 7#c7 incorporates into the contract or other agreement totaling more than #ejj1jjj1 provisions-- 7,a7 providing for penalties-- 7i7 for failure to comply with title ,,ii of this ,act2 or 7ii7 if the entity knows or has reason to know that the sensitive personally identifiable information being provided to the ,federal department or agency is inaccurate1 and provides such inaccurate information2 and 7,b7 requiring a data broker that engages service providers not subject to subtitle ,a of title ,,ii of this ,act for responsibilities related to sensitive personally identifiable information to-- 7i7 exercise appropriate due diligence in selecting those service providers for responsibilities related to sensitive personally identifiable information2 7ii7 take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the security1 privacy1 and integrity of the sensitive personally identifiable information at issue2 and 7iii7 require such service providers1 by contract1 to implement and maintain appropriate measures designed to meet the objectives and requirements in title ,,ii of this ,act4 7c7 ,limitation on penalties ,the penalties under subsection 7b77#c77;,a7 shall not apply to a data broker providing information that is accurately and completely recorded from a public record source4 7d7 ,study of government use 7#a7 ,scope of study ,not later than #ahj days after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall conduct a study and audit and prepare a report on ,federal agency actions to address the recommendations in the ,government ,accountability ,office's ,april #bjjf report on agency adherence to key privacy principles in using data brokers or commercial databases containing sensitive personally identifiable information4 7#b7 ,report ,a copy of the report required under paragraph 7#a7 shall be submitted to ,congress4 #cjd4 ,,fbi report on reported breaches and compliance 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 and each year thereafter1 the ,federal ,bureau of ,investigation1 in coordination with the ,secret ,service1 shall submit to the ,committee on the ,judiciary of the ,senate and the ,committee on the ,judiciary of the ,house of ,representatives a report regarding any reported breaches at agencies or business entities during the preceding year4 7b7 ,report content ,such reporting shall include-- 7#a7 the total instances of breaches of security in the previous year2 7#b7 the percentage of breaches described in subsection 7a7 that occurred at an agency or business entity that did not comply with the personal data privacy and security program under section #bjb2 and 7#c7 recommendations1 if any1 for modifying or amending this ,act to increase its effectiveness4 #cje4 ,department of ,justice report on enforcement actions ,section #ebi of title #bh1 ,united ,states ,code1 is amended by adding at the end the following3 7c7 ,not later than #a year after the date of enactment of the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad1 and every fiscal year thereafter1 the ,attorney ,general shall submit to ,congress a report on ,federal enforcement actions1 ,state attorneys general enforcement actions1 and private enforcement actions1 undertaken pursuant to the ,personal ,data ,protection and ,breach ,accountability ,act of #bjad that shall include a description of the best practices for enforcement of such ,act as well as recommendations1 if any1 for modifying or amending this ,act to increase the effectiveness of such enforcement actions4 4 #cjf4 ,report on notification effectiveness 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 and each year thereafter1 the designated entity1 in coordination with the ,attorney ,general and the ,federal ,trade ,commission1 shall submit to the ,committee on the ,judiciary of the ,senate and the ,committee on the ,judiciary of the ,house of ,representatives a report regarding the effectiveness of post-breach notification practices by agencies and business entities4 7b7 ,report content ,the report required under subsection 7a7 shall include-- 7#a7 in each instance of a breach of security1 the amount of time between the instance of the breach and the discovery of the breach by the affected business entity2 7#b7 in each instance of a breach of security1 the amount of time between the discovery of the breach by the affected business entity and the notification to the ,federal ,bureau of ,investigation and the ,united ,states ,secret ,service2 and 7#c7 in each instance of a breach of security1 the amount of time between the discovery of the breach by the affected business entity and the notification to individuals whose sensitive personally identifiable information was compromised4 ,,iv ,compliance with ,statutory ,pay-,as-,you-,go ,act #dja4 ,budget compliance ,the budgetary effects of this ,act1 for the purpose of complying with the ,statutory ,pay-,as-,you-,go ,act of #bjaj1 shall be determined by reference to the latest statement titled ,budgetary ,effects of ,,paygo ,legislation for this ,act1 submitted for printing in the ,congressional ,record by the ,chairman of the ,senate ,budget ,committee1 provided that such statement has been submitted prior to the vote on passage4