,,ii  #aac? ,,congress  #b;d ,session   
,s4 #aiie  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,febru>y #d1 #bjad,mr4 
,blum5?al 7= himself & ,mr4 ,m>key7     
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on !     
,judici>y  ,a ,,bill  ,to protect       
consum]s by mitigat+ ! vuln]ability (   
p]sonally id5tifiable in=mation to !ft  
?r\gh a security brea*1 provid+ notice &
 rem$ies to consum]s 9 ! wake ( su* a   
brea*1 hold+ companies acc\ntable =     
prev5table brea*es1 facilitat+ ! %>+ (  
po/-brea* te*nical in=mation betwe5     
companies1 & enhanc+ crim9al & civil    
p5alties & o!r protections aga9/ !      
unau?oriz$ collection or use ( p]sonally
 id5tifiable in=mation4  #a4 ,%ort      
title2 table ( cont5ts  7a7 ,%ort title 
,?is ,act may be cit$ z ! ,p]sonal ,data
 ,protection & ,brea* ,acc\ntability    
,act ( #bjad4  7b7 ,table ( cont5ts ,!  
table ( cont5ts ( ?is ,act is z foll[s3 
,sec4 #a4 ,%ort title2 table (          
cont5ts4,sec4 #b4 ,f9d+s4,sec4 #c4      

,def9itions4,,title ,i--,enhanc+        
puni%m5t = id5tity !ft & o!r violations 
( data privacy & security,sec4 #aja4    
,concealm5t ( security brea*es involv+  
s5sitive p]sonally id5tifiable          
in=mation4,sec4 #ajb4 ,unau?oriz$       
manipulation ( ,int]net traffic on a    
us]'s comput]4,,title ,,ii--,privacy &  
security ( s5sitive p]sonally           
id5tifiable in=mation ,subtitle ,a--,a  
data privacy & security program,sec4    
#bja4 ,purpose & applicability ( data   
privacy & security program4,sec4 #bjb4  
,requirem5ts = a p]sonal data privacy & 
security program4,sec4 #bjc4 ,f$]al     
en=cem5t4,sec4 #bjd4 ,en=cem5t by ,/ate 
,attorneys ,g5]al4,sec4 #bje4           
,supplem5tal en=cem5t by                
individuals4,subtitle ,b--,security     
brea* notification,sec4 #baa4 ,notice to
 individuals4,sec4 #bab4 ,exemptions f  
notice to individuals4,sec4 #bac4       
,me?ods ( notice to individuals4,sec4   
#bad4 ,cont5t ( notice to               
individuals4,sec4 #bae4 ,rem$ies =      

security brea*4,sec4 #baf4 ,notice to   
cr$it report+ ag5cies4,sec4 #bag4       
,notice to law en=cem5t4,sec4 #bah4     
,f$]al en=cem5t4,sec4 #bai4 ,en=cem5t by
 ,/ate attorneys g5]al4,sec4 #bbj4      
,supplem5tal en=cem5t by                
individuals4,sec4 #bba4 ,relation to o!r
 laws4,sec4 #bbb4 ,au?orization (       
appropriations4,sec4 #bbc4 ,report+ on  
risk assessm5t exemptions4,subtitle     
,c--,po/-,brea* te*nical in=mation      
clearinghouse,sec4 #bcj4 ,cle>+h\se     
in=mation collection1 ma9t5ance1 &      
access4,sec4 #bca4 ,protections =       
cle>+h\se p>ticipants4,sec4 #bcb4       
,effective date4,,title ,,iii--,access  
to & use ( comm]cial data,sec4 #cja4    
,g5]al s]vices adm9i/ration review (    
contracts4,sec4 #cjb4 ,requirem5t to    
audit in=mation security practices (    
contractors & ?ird-p>ty bus9ess         
entities4,sec4 #cjc4 ,privacy impact    
assessm5t ( gov]nm5t use ( comm]cial    
in=mation s]vices conta9+ s5sitive      
p]sonally id5tifiable in=mation4,sec4   

#cjd4 ,,fbi report on report$ brea*es & 
compliance4,sec4 #cje4 ,dep>tm5t (      
,ju/ice report on en=cem5t actions4,sec4
 #cjf4 ,report on notification          
effectiv5ess4,,title ,,iv--,compliance )
 ,/atutory ,pay-,z-,y-,g ,act,sec4 #dja4
 ,budget compliance4  #b4 ,f9d+s        
,congress f9ds t-- 7#a7 databases (     
p]sonally id5tifiable in=mation are     
increas+ly prime t>gets ( hack]s1       
id5tity ?ieves1 rogue employees1 & o!r  
crim9als1 includ+ organiz$ & sophi/icat$
 crim9al op]ations2  7#b7 id5tity !ft is
 a s]i\s ?reat to ! ,nation's economic  
/ability1 homel& security1 ! developm5t 
( e-comm]ce1 & ! privacy rights ( p 9 ! 
,unit$ ,/ates2  7#c7 ov] #i1cjj1jjj     
individuals 7 victims ( id5tity !ft 9 ! 
,unit$ ,/ates 9 #bjaj2  7#d7 security   
brea*es are a s]i\s ?reat to consum]    
confid5ce1 homel& security1 e-comm]ce1 &
 economic /ability2  7#e7 x is important
 = bus9ess entities t own1 use1 or      
lic5se p]sonally id5tifiable in=mation  
to adopt reasonable proc$ures to ensure 

! security1 privacy1 & confid5tiality ( 
t p]sonally id5tifiable in=mation2  7#f7
 individuals ^: p]sonal in=mation has   
be5 compromis$ or :o h be5 victims (    
id5tity !ft %\ld receive ! necess>y     
in=mation & assi/ance to mitigate _!    
damages & to re/ore ! integrity ( _!    
p]sonal in=mation & id5tities2  7#g7    
data misuse & use ( inaccurate data h ! 
pot5tial to cause s]i\s or irrep>able   
h>m to an individual's livelihood1      
privacy1 & lib]ty & und]m9e effici5t &  
effective bus9ess & gov]nm5t op]ations2 
7#h7 !re is a ne$ to ensure t data      
brok]s conduct _! op]ations 9 a mann] t 
prioritizes fairness1 transp>5cy1       
accuracy1 & respect = ! privacy (       
consum]s2  7#i7 gov]nm5t access to      
comm]cial data c pot5tially improve     
safety1 law en=cem5t1 & national        
security2  7#aj7 because gov]nm5t use ( 
comm]cial data conta9+ p]sonal in=mation
 pot5tially affects individual privacy1 
& law en=cem5t & national security      
op]ations1 !re is a ne$ = ,congress to  

ex]cise ov]sight ov] gov]nm5t use (     
comm]cial data2  7#aa7 ov] #bb1ifj1jjj  
cases ( data brea*es involv+ p]sonally  
id5tifiable in=mation 7 report$ ?r\gh   
,july ( #bjaa1 & 9 #bjji ?r\gh #bjaj1   
ov] #bcj1ijj1jjj cases ( p]sonal data   
brea*es 7 report$2  7#ab7 facilitat+    
in=mation %>+ among bus9ess entities &  
across sectors 9 ! ev5t ( a brea* c     
assi/ 9 rem$iat+ ! brea* & prev5t+      
simil> brea*es 9 ! future2  7#ac7       
because ! ,f$]al ,gov]nm5t has limit$   
res\rces1 consum]s !mselves play a vital
 & complem5t>y role 9 facilitat+ prompt 
notification & protect+ aga9/ future    
brea*es ( security2  7#ad7 9 addition to
 ! imm$iate damages caus$ by security   
brea*es1 ! lack ( basic rem$ial         
requirem5ts (t5 =ces individuals ^:     
s5sitive p]sonally id5tifiable in=mation
 is compromis$ z a result ( a security  
brea* to incur ! economic co/s (        
litigation to seek rem$ies1 & ! economic
 co/s ( fees requir$ 9 _m ,/ates to     
freeze compromis$ acc\nts2 &  7#ae7     

victims ( p]sonal data brea*es may suff]
 debilitat+ emotional & physical effects
 & become depress$ or anxi\s1 especially
 9 cases ( repeat$ or unresolv$ in/ances
 ( data brea*es4  #c4 ,def9itions  7a7  
,9 g5]al ,9 ?is ,act1 ! foll[+          
def9itions %all apply3 7#a7 ,affiliate  
,! t]m affiliate means p]sons relat$ by 
common own]%ip or by corporate control4 
7#b7 ,ag5cy ,! t]m ag5cy has ! mean+    
giv5 ! t]m 9 section #eea ( title #e1   
,unit$ ,/ates ,code4  7#c7 ,bus9ess     
entity ,! t]m bus9ess entity means any  
organization1 corporation1 tru/1        
p>tn]%ip1 sole proprietor%ip1           
un9corporat$ association1 or v5ture     
e/abli%$ to make a pr(it1 or nonpr(it4  
7#d7 ,cr$it rat+ ag5cy ,! t]m cr$it rat+
 ag5cy has ! mean+ giv5 ! t]m 9 section 
#c7;a77#fa7 ( ! ,securities ,ex*ange    
,act ( #aicd 7#ae ,u4,s4,c4             
#gh;c7a77#fa774  7#e7 ,cr$it report ,!  
t]m cr$it report means a consum] report1
 z t t]m is def9$ 9 section #fjc7;d7 ( !
 ,fair ,cr$it ,report+ ,act 7#ae        

,u4,s4,c4 #afha;a7d774  7#f7 ,data brok]
 ,! t]m data brok] means a bus9ess      
entity :i* = monet>y fees or dues       
regul>ly engages 9 ! practice (         
collect+1 transmitt+1 or provid+ access 
to s5sitive p]sonally id5tifiable       
in=mation on m ?an #e1jjj individuals :o
 are n ! cu/om]s or employees ( t       
bus9ess entity or affiliate prim>ily = !
 purposes ( provid+ su* in=mation to    
nonaffiliat$ ?ird p>ties on an int]/ate 
basis4  7#g7 ,designat$ entity ,! t]m   
designat$ entity means ! ,f$]al         
,gov]nm5t entity designat$ "u section   
#bag7;a74  7#h7 ,encryption ,! t]m      
encryption-- 7,a7 means ! protection (  
data 9 electronic =m1 9 /orage or 9     
transit1 us+ an encryption te*nology t  
has be5 g5]ally accept$ by exp]ts 9 !   
field ( in=mation security t r5d]s su*  
data indeciph]able 9 ! abs5ce (         
associat$ cryptographic keys necess>y to
 enable decryption ( su* data2 &  7,b7  
includes appropriate managem5t &        
safegu>ds ( su* cryptographic keys s z  

to protect ! integrity ( ! encryption4  
7#i7 ,id5tity !ft ,! t]m id5tity !ft    
means a violation ( section             
#ajbh7;a77#g7 ( title #ah1 ,unit$ ,/ates
 ,code4  7#aj7 ,intellig5ce community ,!
 t]m intellig5ce community includes !   
foll[+3 7,a7 ,! ,(fice ( ! ,director (  
,national ,intellig5ce4  7,b7 ,! ,c5tral
 ,intellig5ce ,ag5cy4  7,c7 ,! ,national
 ,security ,ag5cy4  7,d7 ,! ,def5se     
,intellig5ce ,ag5cy4  7,e7 ,! ,national 
,geospatial-,intellig5ce ,ag5cy4  7,f7  
,! ,national ,reconnaissance ,(fice4    
7,g7 ,o!r (fices )9 ! ,dep>tm5t (       
,def5se = ! collection ( specializ$     
national intellig5ce ?r\gh              
reconnaissance programs4  7,h7 ,!       
intellig5ce elem5ts ( ! ,army1 ! ,navy1 
! ,air ,=ce1 ! ,m>9e ,corps1 ! ,f$]al   
,bureau ( ,inve/igation1 & ! ,dep>tm5t (
 ,en]gy4  7,i7 ,! ,bureau ( ,intellig5ce
 & ,rese>* ( ! ,dep>tm5t ( ,/ate4  7,j7 
,! ,(fice ( ,intellig5ce & ,analysis ( !
 ,dep>tm5t ( ! ,treasury4  7,k7 ,!      
elem5ts ( ! ,dep>tm5t ( ,homel&         

,security conc]n$ ) ! analysis (        
intellig5ce in=mation1 includ+ ! ,(fice 
( ,intellig5ce ( ! ,coa/ ,gu>d4  7,l7   
,su* o!r elem5ts ( any o!r dep>tm5t or  
ag5cy z may be designat$ by ! ,presid5t1
 or designat$ jo9tly by ! ,director (   
,national ,intellig5ce & ! head ( !     
dep>tm5t or ag5cy conc]n$1 z an elem5t (
 ! intellig5ce community4  7#aa7        
,pr$ispute arbitration agreem5t ,! t]m  
pr$ispute arbitration agreem5t means any
 agreem5t to arbitrate a dispute t _h n 
yet aris5 at ! "t ( ! mak+ ( ! agreem5t4
  7#ab7 ,public record s\rce ,! t]m     
public record s\rce means ! ,congress1  
any ag5cy1 any ,/ate or local gov]nm5t  
ag5cy1 ! gov]nm5t ( ! ,di/rict (        
,columbia & gov]nm5ts ( ! t]ritories or 
possessions ( ! ,unit$ ,/ates1 & ,f$]al1
 ,/ate or local c\rts1 c\rts m>tial &   
milit>y commissions1 t ma9ta9 p]sonally 
id5tifiable in=mation 9 records         
available to ! public4  7#ac7 ,security 
brea*  7,a7 ,9 g5]al ,! t]m security    
brea* means compromise ( ! security1    

confid5tiality1 or integrity (1 or !    
loss (1 comput]iz$ data ?r\gh           
misrepres5tation or actions t result 91 
or t !re is a reasonable basis to       
conclude has result$ 9-- 7i7 !          
unau?oriz$ acquisition ( s5sitive       
p]sonally id5tifiable in=mation2 or     
7ii7 access to s5sitive p]sonally       
id5tifiable in=mation t is = an         
unau?oriz$ purpose1 or 9 excess (       
au?orization4  7,b7 ,exclusion ,! t]m   
security brea* does n include-- 7i7 a   
good fai? acquisition ( s5sitive        
p]sonally id5tifiable in=mation by a    
bus9ess entity or ag5cy1 or an employee 
or ag5t ( a bus9ess entity or ag5cy1 if 
! s5sitive p]sonally id5tifiable        
in=mation is n subject to fur!r         
unau?oriz$ disclosure2  7ii7 ! release (
 a public record n o!rwise subject to   
confid5tiality or nondisclosure         
requirem5ts or ! release ( in=mation    
obta9$ f a public record2 or  7iii7 any 
lawfully au?oriz$ crim9al inve/igation  
or au?oriz$ inve/igative1 protective1 or

 intellig5ce activities t are c>ri$ out 
by or on behalf ( any elem5t ( !        
intellig5ce community & conduct$ 9      
accordance ) ! ,unit$ ,/ates laws1      
au?orities1 & regulations gov]n+ su*    
intellig5ce activities4  7#ad7 ,security
 freeze ,! t]m security freeze means a  
notice1 at ! reque/ ( ! consum] &       
subject to exceptions 9 section         
#bae7;b71 t prohibits ! consum] report+ 
ag5cy f releas+ all or any "p ( !       
consum]'s cr$it report or any in=mation 
d]iv$ f x )\t ! express au?orization ( !
 consum]4  7#ae7 ,s5sitive p]sonally    
id5tifiable in=mation ,! t]m s5sitive   
p]sonally id5tifiable in=mation means   
any in=mation or compilation (          
in=mation1 9 electronic or digital =m t 
includes ! foll[+3 7,a7 ,an individual's
 fir/ & la/ "n or fir/ initial & la/ "n 
9 comb9ation ) any #b ( ! foll[+ data   
elem5ts3 7i7 ,home address4  7ii7       
,telephone numb] ( ! individual4  7iii7 
,"m's maid5 "n4  7iv7 ,mon?1 day1 & ye> 
( bir?4  7,b7 ,a non-truncat$ social    

security numb]1 driv]'s lic5se numb]1   
passport numb]1 or ali5 regi/ration     
numb] or o!r gov]nm5t-issu$ unique      
id5tification numb]4  7,c7 ,in=mation   
ab\t an individual's geographic location
 t is 9 :ole or 9 "p g5]at$ by or d]iv$ 
f t individual's use ( a wireless       
communication device or o!r electronic  
device1 exclud+ telephone & in/rum5t    
numb]s & network or ,int]net ,protocol  
addresses4  7,d7 ,unique biometric data 
su* z a f+]pr9t1 voice pr9t1 face pr9t1 
a ret9a or iris image1 or any o!r unique
 physical repres5tation4  7,e7 ,a unique
 acc\nt id5tifi]1 includ+ a f9ancial    
acc\nt numb] or cr$it or debit c>d      
numb]1 electronic id5tification numb]1  
us] "n1 heal? insurance policy or       
subscrib] id5tification numb]1 or r\t+  
code4  7,f7 ,n less ?an #b ( ! foll[+   
data elem5ts3 7i7 ,an individual's fir/ 
& la/ "n or fir/ initial & la/ "n4  7ii7
 ,a unique acc\nt id5tifi]1 includ+ a   
f9ancial acc\nt numb] or cr$it or debit 
c>d numb]1 electronic id5tification     

numb]1 us] "n1 or r\t+ code4  7iii7 ,any
 security code1 access code1 or         
password1 or s\rce code t c\ld be us$ to
 g5]ate su* codes & passwords4  7iv7    
,in=mation reg>d+ an individual's m$ical
 hi/ory1 m5tal or physical m$ical       
condition1 or m$ical treatm5t or        
diagnosis by a heal? c>e pr(essional4   
7,g7 ,any o!r comb9ation ( data elem5ts 
t c\ld all[ unau?oriz$ access to or     
acquisition ( ! in=mation describ$ 9    
subp>agraph 7,a71 7,b71 7,c71 7,d71     
7,e71 or 7,f71 includ+-- 7i7 a unique   
acc\nt id5tifi]2  7ii7 an electronic    
id5tification numb]2  7iii7 a us] "n2   
7iv7 a r\t+ code2 or  7v7 any associat$ 
security code1 access code1 or password 
or any associat$ security que/ions &    
answ]s t c\ld all[ unau?oriz$ access to 
! acc\nt4  7#af7 ,s]vice provid]  7,a7  
,9 g5]al ,! t]m s]vice provid] means a  
bus9ess entity t-- 7i7 provides         
electronic data transmission1 r\t+1     
int]m$iate & transi5t /orage1 or        
connections to ! sy/em or network ( !   

bus9ess entity2  7ii7 is n ! s5d] or !  
int5d$ recipi5t ( ! data2  7iii7 is n   
ord9>ily expect$ to select or modify !  
cont5t ( ! electronic data2 &  7iv7     
transmits1 r\tes1 /ores1 or provides    
connections = p]sonal in=mation 9 a     
mann] t p]sonal in=mation is            
undiff]5tiat$ f o!r types ( data t su*  
bus9ess entity transmits1 r\tes1 /ores1 
or provides connections4  7,b7 ,sav+s   
clause ,any su* bus9ess entity %all be  
treat$ z a s]vice provid] "u ?is ,act   
only to ! ext5t t ! bus9ess entity is   
engag$ 9 ! provision ( ! transmission1  
r\t+1 int]m$iate & transi5t /orage or   
connections describ$ 9 subp>agraph 7,a74
  7b7 ,modifi$ def9ition by rulemak+ ,! 
,f$]al ,trade ,commission may1 by rule  
promulgat$ "u section #eec ( title #e1  
,unit$ ,/ates ,code1 modify ! def9ition 
( s5sitive p]sonally id5tifiable        
in=mation 9 a mann] consi/5t ) !        
purposes ( ?is ,act & to ! ext5t t su*  
modification w n unreasonably imp$e     
int]/ate comm]ce4  ,i ,enhanc+ puni%m5t 

= id5tity !ft & o!r violations ( data   
privacy & security  #aja4 ,concealm5t ( 
security brea*es involv+ s5sitive       
p]sonally id5tifiable in=mation  7a7 ,9 
g5]al ,*apt] #dg ( title #ah1 ,unit$    
,/ates ,code1 is am5d$ by add+ at ! end 
! foll[+3  #ajda4 ,concealm5t ( security
 brea*es involv+ s5sitive p]sonally     
id5tifiable in=mation  7a7 ,:oev]1 hav+ 
k ( a security brea* & ( ! fact t notice
 ( su* security brea* is requir$ "u     
title ,,ii ( ! ,p]sonal ,data           
,protection & ,brea* ,acc\ntability ,act
 ( #bjad1 int5tionally or willfully     
conceals ! fact ( su* security brea* &  
:i* brea*1 %all1 9 ! ev5t t su* security
 brea* results 9 economic h>m or        
sub/antial emotional di/ress to #a or m 
p]sons1 %all be f9$ "u ?is title or     
imprison$ n m ?an #e ye>s1 or bo?4  7b7 
,= purposes ( subsection 7a71 ! t]m     
p]son has ! mean+ giv5 ! t]m 9 section  
#ajcj7;e77#ab7 ( title #ah1 ,unit$      
,/ates ,code4  7c7 ,any p]son seek+ an  
exemption "u section #bab7;b7 ( !       

,p]sonal ,data ,protection & ,brea*     
,acc\ntability ,act ( #bjad %all be     
immune f prosecution "u ?is section if !
 ,unit$ ,/ates ,secret ,s]vice does n   
indicate1 9 writ+1 t su* notice be giv5 
"u section #bab7;b77#a77;,b7 ( !        
,p]sonal ,data ,protection & ,brea*     
,acc\ntability ,act ( #bjad4  4  7b7    
,con=m+ & te*nical am5dm5ts ,! table (  
sections = *apt] #dg ( title #ah1 ,unit$
 ,/ates ,code1 is am5d$ by add+ at ! end
 ! foll[+3  #ajda4 ,concealm5t (        
security brea*es involv+ s5sitive       
p]sonally id5tifiable in=mation4  4  7c7
 ,en=cem5t au?ority  7#a7 ,9 g5]al ,!   
,unit$ ,/ates ,secret ,s]vice & ! ,f$]al
 ,bureau ( ,inve/igation %all h !       
au?ority to inve/igate (f5ses "u section
 #ajda ( title #ah1 ,unit$ ,/ates ,code1
 z add$ by subsection 7a74  7#b7        
,nonexclusivity ,! au?ority grant$ 9    
p>agraph 7#a7 %all n be exclusive ( any 
exi/+ au?ority held by any o!r ,f$]al   
ag5cy4  #ajb4 ,unau?oriz$ manipulation (
 ,int]net traffic on a us]'s comput]    

7a7 ,def9ition ,9 ?is section1 ! t]m    
protect$ comput] has ! mean+ giv5 ! t]m 
9 section #ajcj7;e77#b7 ( title #ah1    
,unit$ ,/ates ,code4  7b7 ,prohibition  
7#a7 ,9 g5]al ,unless a s]vice provid]  
provides a cle> & conspicu\s disclosure 
( data collect$ 9 ! process ( int]cept+ 
a web se>* or qu]y ent]$ by an au?oriz$ 
us] ( a protect$ comput]1 & obta9s !    
cons5t ( an au?oriz$ us] ( ! protect$   
comput] prior to any su* action1 x %all 
be unlawful = a s]vice provid] to kn[+ly
 or int5tionally-- 7,a7 bypass ! display
 ( se>* eng9e results & r$irect web     
se>*es or qu]ies ent]$ by an au?oriz$   
us] ( a protect$ comput] directly to a  
comm]cial website1 c\nt]feit web page1  
or t>get$ adv]tisem5t & d]ive an        
economic b5efit f su* activity2 or  7,b7
 monitor1 manipulate1 aggregate1 & m>ket
 ! data collect$ 9 ! process ( int]cept+
 a web se>* or qu]y ent]$ by an au?oriz$
 us] ( a protect$ comput] & d]ive an    
economic b5efit f su* activity4  7#b7   
,cons5t ,a s]vice provid] may n require 

cons5t to p]=m ! collection ( data      
describ$ 9 p>agraph 7#a7 z a condition (
 provid+ s]vice to an au?oriz$ us] ( !  
protect$ comput]4  7c7 ,limitations on  
liability ,! re/rictions impos$ "u ?is  
section d n apply to any monitor+ (1 or 
int]action )1 a subscrib]'s ,int]net or 
o!r network connection or s]vice1 or a  
protect$ comput]1 by or at ! direction (
 a telecommunications c>ri]1 cable      
op]ator1 comput] h>dw>e or s(tw>e       
provid]1 f9ancial in/itution or provid] 
( in=mation s]vices or int]active       
comput] s]vice =-- 7#a7 network or      
comput] security purposes2  7#b7        
diagno/ics2  7#c7 te*nical support2     
7#d7 repair2  7#e7 network managem5t2   
7#f7 au?oriz$ updates ( s(tw>e or sy/em 
firmw>e2  7#g7 au?oriz$ remote sy/em    
managem5t2  7#h7 au?oriz$ provision (   
protection = us]s ( ! comput] f         
objectionable cont5t2  7#i7 au?oriz$    
scann+ = comput] s(tw>e us$ 9 violation 
( ?is section = removal by an au?oriz$  
us]2 or  7#aj7 detection or prev5tion ( 

fraud4  7d7 ,en=cem5t by ! ,attorney    
,g5]al  7#a7 ,liability & p5alty =      
violations ,any p]son :o engages 9 an   
activity 9 violation ( ?is section %all 
be f9$ n m ?an #ejj1jjj4  7#b7 ,enhanc$ 
liability & p5alties = patt]n or        
practice ( violations  7,a7 ,9 g5]al    
,any p]son :o engages 9 a patt]n or     
practice ( activity t violates !        
provisions ( ?is section %all be f9$ n m
 ?an #a1jjj1jjj4  7,b7 ,treatm5t ( s+le 
action or conduct ,= purposes (         
subp>agraph 7,a71 any s+le action or    
conduct t violates ?is section ) respect
 to multiple protect$ comput]s %all be  
con/ru$ z a s+le violation4  7#c7       
,consid]ations ,9 det]m9+ ! am\nt ( any 
p5alty "u p>agraph 7#a7 or 7#b71 ! c\rt 
%all take into acc\nt-- 7,a7 ! degree ( 
culpability ( ! def5dant2  7,b7 any     
hi/ory ( prior su* conduct2  7,c7 !     
ability ( ! def5dant to pay any f9e     
impos$2  7,d7 ! effect on ! ability ( ! 
def5dant to cont9ue to d bus9ess2 &     
7,e7 su* o!r matt]s z ju/ice may        

require4  ,,ii ,privacy & security (    
s5sitive p]sonally id5tifiable in=mation
  ,a ,a data privacy & security program 
#bja4 ,purpose & applicability ( data   
privacy & security program  7a7 ,purpose
 ,! purpose ( ?is subtitle is to ensure 
/&>ds = develop+ & implem5t+            
adm9i/rative1 te*nical1 & physical      
safegu>ds to protect ! security (       
s5sitive p]sonally id5tifiable          
in=mation4  7b7 ,9 g5]al ,a bus9ess     
entity engag+ 9 int]/ate comm]ce t      
involves collect+1 access+1 transmitt+1 
us+1 /or+1 or dispos+ ( s5sitive        
p]sonally id5tifiable in=mation 9       
electronic or digital =m on #aj1jjj or m
 ,unit$ ,/ates p]sons is subject to !   
requirem5ts = a data privacy & security 
program "u section #bjb = protect+      
s5sitive p]sonally id5tifiable          
in=mation4  7c7 ,limitations ,not)/&+   
any o!r obligation "u ?is subtitle1 ?is 
subtitle does n apply to ! foll[+3 7#a7 
,f9ancial in/itutions ,a f9ancial       
in/itution subject to ! data security   

requirem5ts & /&>ds "u #eja7;b7 ( !     
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7;b77 & subject to ! jurisdiction 
( an ag5cy or au?ority describ$ 9       
section #eje7;a7 ( !                    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhje7;a771 if ! ,f$]al functional     
regulator 7z def9$ 9 section #eji ( !   
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhji77 ) jurisdiction ov] t f9ancial  
in/itution has issu$ a regulation "u    
title ,v ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja et seq47 t requires
 f9ancial in/itutions )9 its            
jurisdiction to provide notification to 
individuals foll[+ a brea* ( security4  
7#b7 ,,hipaa regulat$ entities  7,a7    
,cov]$ entities ,a bus9ess entity       
subject to ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acja et seq471    
includ+ ! data security requirem5ts &   
implem5t+ regulations ( t ,act4  7,b7   
,compliance ,a bus9ess entity t-- 7i7 is
 act+ z a bus9ess associate1 z t t]m is 

def9$ "u ! ,heal? ,insurance            
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acja et seq47 & is
 9 compliance ) ! requirem5ts impos$ "u 
t ,act & implem5t+ regulations          
promulgat$ "u t ,act2 &  7ii7 is subject
 to1 & curr5tly 9 compliance1 ) !       
privacy & data security requirem5ts "u  
sections #acdja & #acdjd ( division ,a (
 ! ,am]ican ,re9ve/m5t & ,recov]y ,act (
 #bjji 7#db ,u4,s4,c4 #agica & #agicd7 &
 implem5t+ regulations promulgat$ "u su*
 sections4  7#c7 ,s]vice provid]s ,a    
s]vice provid] = any electronic         
communication by a ?ird p>ty1 to ! ext5t
 t ! s]vice provid] is exclusively      
engag$ 9 ! transmission1 r\t+1 or       
tempor>y1 int]m$iate1 or transi5t /orage
 ( t communication4  7#d7 ,public       
records ,public records n o!rwise       
subject to a confid5tiality or          
nondisclosure requirem5t1 or in=mation  
obta9$ f a public record1 includ+       
in=mation obta9$ f a news report or     
p]iodical4  7d7 ,rule ( con/ruction     

,no?+ 9 ?is subtitle %all be con/ru$ to 
modify1 limit1 or sup]s$e ! op]ation ( !
 provisions ( ! ,gramm-,lea*-,bliley    
,act 7#ae ,u4,s4,c4 #fhja et seq471 or  
its implem5t+ regulations1 includ+ su*  
regulations adopt$ or en=c$ by ! ,/ates4
  #bjb4 ,requirem5ts = a p]sonal data   
privacy & security program  7a7 ,p]sonal
 data privacy & security program ,a     
bus9ess entity subject to ?is subtitle  
%all comply ) ! foll[+ safegu>ds & any  
o!r adm9i/rative1 te*nical1 or physical 
safegu>ds id5tifi$ by ! ,f$]al ,trade   
,commission 9 a rulemak+ process        
pursuant to section #eec ( title #e1    
,unit$ ,/ates ,code1 = ! protection (   
s5sitive p]sonally id5tifiable          
in=mation3 7#a7 ,scope ,a bus9ess entity
 %all implem5t a compreh5sive p]sonal   
data privacy & security program t       
includes adm9i/rative1 te*nical1 &      
physical safegu>ds appropriate to ! size
 & complexity ( ! bus9ess entity & !    
nature & scope ( its activities4  7#b7  
,design ,! p]sonal data privacy &       

security program %all be design$ to--   
7,a7 ensure ! privacy1 security1 &      
confid5tiality ( s5sitive p]sonally     
id5tifiable in=mation2  7,b7 protect    
aga9/ any anticipat$ vuln]abilities to !
 privacy1 security1 or integrity (      
s5sitive p]sonally id5tifiable          
in=mation2 &  7,c7 protect aga9/        
unau?oriz$ access to or use ( s5sitive  
p]sonally id5tifiable in=mation t c\ld  
create a significant risk ( h>m to any  
individual4  7#c7 ,risk assessm5t ,a    
bus9ess entity %all-- 7,a7 id5tify      
reasonably =eseeable int]nal & ext]nal  
vuln]abilities t c\ld result 9          
unau?oriz$ access1 disclosure1 use1 or  
alt]ation ( s5sitive p]sonally          
id5tifiable in=mation or sy/ems conta9+ 
s5sitive p]sonally id5tifiable          
in=mation2  7,b7 assess ! likelihood ( &
 pot5tial damage f unau?oriz$ access1   
disclosure1 use1 or alt]ation ( s5sitive
 p]sonally id5tifiable in=mation2  7,c7 
assess ! suffici5cy ( its policies1     
te*nologies1 & safegu>ds 9 place to     

control & m9imize risks f unau?oriz$    
access1 disclosure1 use1 or alt]ation ( 
s5sitive p]sonally id5tifiable          
in=mation2 &  7,d7 assess ! vuln]ability
 ( s5sitive p]sonally id5tifiable       
in=mation dur+ de/ruction & disposal (  
su* in=mation1 includ+ ?r\gh ! disposal 
or retirem5t ( h>dw>e4  7#d7 ,risk      
managem5t & control ,ea* bus9ess entity 
%all-- 7,a7 design its p]sonal data     
privacy & security program to control ! 
risks id5tifi$ "u p>agraph 7#c72 &  7,b7
 adopt measures comm5surate ) !         
s5sitivity ( ! data z well z ! size1    
complexity1 & scope ( ! activities ( !  
bus9ess entity t-- 7i7 control access to
 sy/ems & facilities conta9+ s5sitive   
p]sonally id5tifiable in=mation1 includ+
 controls to au!nticate & p]mit access  
only to au?oriz$ individuals2  7ii7     
detect1 record1 & pres]ve in=mation     
relevant to actual & attempt$ fraudul5t1
 unlawful1 or unau?oriz$ access1        
disclosure1 use1 or alt]ation ( s5sitive
 p]sonally id5tifiable in=mation1       

includ+ by employees & o!r individuals  
o!rwise au?oriz$ to h access2  7iii7    
protect s5sitive p]sonally id5tifiable  
in=mation dur+ use1 transmission1       
/orage1 & disposal by encryption1       
r$action1 or access controls t are      
widely accept$ z an effective indu/ry   
practice or indu/ry /&>d1 or o!r        
reasonable means 7includ+ z direct$ =   
disposal ( records "u section #fbh ( !  
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afhaw7 & ! implem5t+         
regulations ( su* ,act z set =? 9       
section #fhb ( title #af1 ,code ( ,f$]al
 ,regulations72  7iv7 ensure t s5sitive 
p]sonally id5tifiable in=mation is      
prop]ly de/roy$ & dispos$ (1 includ+    
dur+ ! de/ruction ( comput]s1 diskettes1
 & o!r electronic m$ia t conta9 s5sitive
 p]sonally id5tifiable in=mation2  7v7  
trace access to records conta9+ s5sitive
 p]sonally id5tifiable in=mation s t !  
bus9ess entity c det]m9e :o access$ or  
acquir$ su* s5sitive p]sonally          
id5tifiable in=mation p]ta9+ to specific

 individuals2  7vi7 ensure t no ?ird    
p>ty or cu/om] ( ! bus9ess entity is    
au?oriz$ to access or acquire s5sitive  
p]sonally id5tifiable in=mation )\t !   
bus9ess entity fir/ p]=m+ suffici5t due 
dilig5ce to asc]ta91 ) reasonable       
c]ta9ty1 t su* in=mation is be+ s\ght = 
a valid legal purpose2 &  7vii7 m9imize 
! am\nt ( p]sonal in=mation ma9ta9$ by !
 bus9ess entity1 provid+ = ! ret5tion ( 
su* p]sonal in=mation only z reasonably 
ne$$ = ! bus9ess purposes ( ! bus9ess   
entity or z necess>y to comply ) any o!r
 provision ( law4  7b7 ,tra9+ ,ea*      
bus9ess entity subject to ?is subtitle  
%all take /eps to ensure employee tra9+ 
& sup]vision = implem5tation ( ! data   
security program ( ! bus9ess entity4    
7c7 ,vuln]ability te/+  7#a7 ,9 g5]al   
,ea* bus9ess entity subject to ?is      
subtitle %all take /eps to ensure regul>
 te/+ ( key controls1 sy/ems1 &         
proc$ures ( ! p]sonal data privacy &    
security program to detect1 prev5t1 &   
respond to attacks or intrusions1 or o!r

 sy/em failures4  7#b7 ,frequ5cy ,!     
frequ5cy & nature ( ! te/s requir$ "u   
p>agraph 7#a7 %all be det]m9$ by ! risk 
assessm5t ( ! bus9ess entity "u         
subsection 7a77#c74  7d7 ,c]ta9         
relation%ip to provid]s ( s]vices ,9 !  
ev5t a bus9ess entity subject to ?is    
subtitle engages a p]son or entity n    
subject to ?is subtitle 7o!r ?an a      
s]vice provid]7 to receive s5sitive     
p]sonally id5tifiable in=mation 9 p]=m+ 
s]vices or functions 7o!r ?an ! s]vices 
or functions provid$ by a s]vice        
provid]7 on behalf ( & "u ! in/ruction (
 su* bus9ess entity1 su* bus9ess entity 
%all-- 7#a7 ex]cise appropriate due     
dilig5ce 9 select+ ! p]son or entity =  
responsibilities relat$ to s5sitive     
p]sonally id5tifiable in=mation1 & take 
reasonable /eps to select & reta9 a     
p]son or entity t is capable ( ma9ta9+  
appropriate safegu>ds = ! security1     
privacy1 & integrity ( ! s5sitive       
p]sonally id5tifiable in=mation at      
issue2 &  7#b7 require ! p]son or entity

 by contract to implem5t & ma9ta9       
appropriate measures design$ to meet !  
objectives & requirem5ts gov]n+ entities
 subject to section #bja1 ?is section1 &
 subtitle ,b4  7e7 ,p]iodic assessm5t & 
p]sonal data privacy & security         
mod]nization ,ea* bus9ess entity subject
 to ?is subtitle %all on a regul> basis 
monitor1 evaluate1 & adju/1 z           
appropriate its data privacy & security 
program 9 light ( any relevant *anges   
9-- 7#a7 te*nology2  7#b7 ! s5sitivity (
 s5sitive p]sonally id5tifiable         
in=mation2  7#c7 int]nal or ext]nal     
?reats to s5sitive p]sonally id5tifiable
 in=mation2 &  7#d7 ! *ang+ bus9ess     
arrangem5ts ( ! bus9ess entity1 su* z-- 
7,a7 m]g]s & acquisitions2  7,b7        
alliances & jo9t v5tures2  7,c7 outs\rc+
 arrangem5ts2  7,d7 bankruptcy2 &  7,e7 
*anges to s5sitive p]sonally id5tifiable
 in=mation sy/ems4  7f7 ,implem5tation  
timel9e ,n lat] ?an #a ye> aft] ! date (
 enactm5t ( ?is ,act1 a bus9ess entity  
subject to ! provisions ( ?is subtitle  

%all implem5t a data privacy & security 
program pursuant to ?is subtitle4  #bjc4
 ,f$]al en=cem5t  7a7 ,civil p5alties   
7#a7 ,9 g5]al ,! ,attorney ,g5]al may   
br+ a civil action 9 ! appropriate      
,unit$ ,/ates di/rict c\rt aga9/ any    
bus9ess entity t engages 9 conduct      
con/itut+ a violation ( ?is subtitle &1 
^u pro( ( su* conduct by a prepond]ance 
( ! evid5ce1 su* bus9ess entity %all be 
subject to a civil p5alty ( n m ?an     
#e1jjj p] violation p] day :ile su* a   
violation exi/s1 ) a maximum (          
#bj1jjj1jjj p] violation1 unless su*    
conduct is f\nd to be willful or        
int5tional4  7#b7 ,int5tional or willful
 violation ,a bus9ess entity t          
int5tionally or willfully violates !    
provisions ( ?is subtitle %all be       
subject to additional p5alties 9 ! am\nt
 ( #e1jjj p] violation p] day :ile su* a
 violation exi/s4  7#c7 ,consid]ations  
,9 det]m9+ ! am\nt ( a civil p5alty "u  
?is subsection1 ! c\rt %all take into   
acc\nt-- 7,a7 ! degree ( culpability ( !

 bus9ess entity2  7,b7 any prior        
violations ( ?is subtitle by ! bus9ess  
entity2  7,c7 ! ability ( ! bus9ess     
entity to pay a civil p5alty2  7,d7 !   
effect on ! ability ( ! bus9ess entity  
to cont9ue to d bus9ess2  7,e7 ! numb] (
 individuals ^: s5sitive p]sonally      
id5tifiable in=mation 0 compromis$ by ! 
brea*2  7,f7 ! relative co/ ( compliance
 ) ?is subtitle2 &  7,g7 su* o!r matt]s 
z ju/ice may require4  7b7 ,injunctive  
actions by ! ,attorney ,g5]al  7#a7 ,9  
g5]al ,if x appe>s t a bus9ess entity   
has engag$1 or is engag$1 9 any act or  
practice con/itut+ a violation ( ?is    
subtitle1 ! ,attorney ,g5]al may        
petition an appropriate di/rict c\rt ( !
 ,unit$ ,/ates = an ord]-- 7,a7 enjo9+  
su* act or practice2 or  7,b7 en=c+     
compliance ) ?is subtitle4  7#b7        
,issuance ( ord] ,a c\rt may issue an   
ord] "u p>agraph 7#a71 if ! c\rt f9ds t 
! conduct 9 "q con/itutes a violation ( 
?is subtitle4  7c7 ,o!r rights & rem$ies
 ,! rights & rem$ies available "u ?is   

section are cumulative & %all n affect  
any o!r rights & rem$ies available "u   
law4  #bjd4 ,en=cem5t by ,/ate          
,attorneys ,g5]al  7a7 ,civil actions   
7#a7 ,9 g5]al ,9 any case 9 :i* !       
attorney g5]al ( a ,/ate or any ,/ate or
 local law en=cem5t ag5cy au?oriz$ by ! 
,/ate attorney g5]al or by ,/ate /atute 
to prosecute violations ( consum]       
protection law1 has reason to believe t 
an int]e/ ( ! resid5ts ( t ,/ate has be5
 or is ?reat5$ or adv]sely affect$ by ! 
acts or practices ( a bus9ess entity t  
violate ?is subtitle1 ! ,/ate may br+ a 
civil action on behalf ( ! resid5ts ( t 
,/ate 9 a di/rict c\rt ( ! ,unit$ ,/ates
 ( appropriate jurisdiction1 or any o!r 
c\rt ( compet5t jurisdiction1 to-- 7,a7 
enjo9 t act or practice2  7,b7 en=ce    
compliance ) ?is subtitle2 or  7,c7     
obta9 civil p5alties ( n m ?an #e1jjj p]
 violation p] day :ile su* violations   
p]si/1 up to a maximum ( #bj1jjj1jjj p] 
violation4  7#b7 ,consid]ations ,9      
det]m9+ ! am\nt ( a civil p5alty "u ?is 

subsection1 ! c\rt %all take into       
acc\nt-- 7,a7 ! degree ( culpability ( !
 bus9ess entity2  7,b7 any prior        
violations ( ?is subtitle by ! bus9ess  
entity2  7,c7 ! ability ( ! bus9ess     
entity to pay a civil p5alty2  7,d7 !   
effect on ! ability ( ! bus9ess entity  
to cont9ue to d bus9ess2  7,e7 ! numb] (
 individuals ^: s5sitive p]sonally      
id5tifiable in=mation 0 compromis$ by ! 
brea*2  7,f7 ! relative co/ ( compliance
 ) ?is subtitle2 &  7,g7 su* o!r matt]s 
z ju/ice may require4  7#c7 ,notice     
7,a7 ,9 g5]al ,be=e fil+ an action "u   
?is subsection1 ! attorney g5]al ( !    
,/ate involv$ %all provide to !         
,attorney ,g5]al-- 7i7 a writt5 notice (
 t action2 &  7ii7 a copy ( ! compla9t =
 t action4  7,b7 ,exception ,subp>agraph
 7,a7 %all n apply ) respect to ! fil+ (
 an action by an attorney g5]al ( a     
,/ate "u ?is subsection1 if ! attorney  
g5]al ( a ,/ate det]m9es t x is n       
feasible to provide ! notice describ$ 9 
?is subp>agraph be=e ! fil+ ( ! action4 

7,c7 ,notification :5 practicable ,9 an 
action describ$ 9 subp>agraph 7,b71 !   
attorney g5]al ( a ,/ate %all provide ! 
writt5 notice & a copy ( ! compla9t to !
 ,attorney ,g5]al z soon aft] ! fil+ ( !
 compla9t z practicable4  7b7 ,f$]al    
proce$+s ,^u receiv+ notice "u          
subsection 7a77#c71 ! ,attorney ,g5]al  
%all h ! "r to-- 7#a7 move to /ay !     
action1 p5d+ ! f9al disposition ( a p5d+
 ,f$]al proce$+ or action describ$ 9    
subsection 7c72  7#b7 initiate an action
 9 ! appropriate ,unit$ ,/ates di/rict  
c\rt "u section #bah & move to          
consolidate all p5d+ actions1 includ+   
,/ate actions1 9 su* c\rt2  7#c7 int]v5e
 9 an action br\ght "u subsection       
7a77#b72 &  7#d7 file petitions =       
appeal4  7c7 ,p5d+ proce$+s ,if !       
,attorney ,g5]al has in/itut$ a proce$+ 
or action = a violation ( ?is subtitle  
or any regulations !reund]1 no attorney 
g5]al ( a ,/ate may1 dur+ ! p5d5cy ( su*
 proce$+ or action1 br+ an action "u ?is
 section aga9/ any def5dant nam$ 9 su*  

crim9al proce$+ or civil action = any   
violation t is alleg$ 9 t proce$+ or    
action4  7d7 ,con/ruction ,= purposes ( 
br++ any civil action "u subsection 7a71
 no?+ 9 ?is section %all be con/ru$ to  
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on su* attorney  
g5]al by ! laws ( t ,/ate to-- 7#a7     
conduct inve/igations2  7#b7 adm9i/]    
oa?s or affirmations2 or  7#c7 compel ! 
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7e7 ,v5ue2    
s]vice ( process  7#a7 ,v5ue ,any action
 br\ght "u subsection 7a7 may be br\ght 
9-- 7,a7 ! di/rict c\rt ( ! ,unit$      
,/ates t meets applicable requirem5ts   
relat+ to v5ue "u section #acia ( title 
#bh1 ,unit$ ,/ates ,code2 or  7,b7 ano!r
 c\rt ( compet5t jurisdiction4  7#b7    
,s]vice ( process ,9 an action br\ght "u
 subsection 7a71 process may be s]v$ 9  
any di/rict 9 :i* ! def5dant-- 7,a7 is  
an inhabitant2 or  7,b7 may be f\nd4    
#bje4 ,supplem5tal en=cem5t by          
individuals  7a7 ,9 g5]al ,any p]son    

aggriev$ by a violation ( ! provisions (
 ?is subtitle by a bus9ess entity may   
br+ a civil action 9 a c\rt (           
appropriate jurisdiction to recov] =    
p]sonal injuries su/a9$ z a result ( !  
violation4  7b7 ,au?ority ,to br+ civil 
action2 jurisdiction ,z provid$ 9       
subsection 7c71 any p]son may comm5ce a 
civil action on 8 own behalf aga9/ any  
bus9ess entity :o is alleg$ to h violat$
 ! provisions ( ?is subtitle4  7c7      
,rem$ies 9 a citiz5 suit  7#a7 ,damages 
,any individual h>m$ by a failure ( a   
bus9ess entity to comply ) ! provisions 
( ?is subtitle1 %all be able to collect 
damages ( n m ?an #aj1jjj p] violation  
p] day :ile su* violations p]si/1 up to 
a maximum ( #bj1jjj1jjj p] violation4   
7#b7 ,punitive damages ,a bus9ess entity
 may be liable = punitive damages if !  
bus9ess entity int5tionally or willfully
 violates ! provisions ( ?is subtitle4  
7#c7 ,equitable relief ,a bus9ess entity
 t violates ! provisions ( ?is subtitle 
may be enjo9$ to comply ) ! provisions (

 ^? sections4  7d7 ,o!r rights & rem$ies
 ,! rights & rem$ies available "u ?is   
subsection are cumulative & %all n      
affect any o!r rights & rem$ies         
available "u law4  7e7 ,non5=ceability (
 c]ta9 provisions waiv+ rights & rem$ies
 or requir+ arbitration ( disputes  7#a7
 ,waiv] ( rights & rem$ies ,! rights &  
rem$ies provid$ = 9 ?is section may n be
 waiv$ by any agreem5t1 policy =m1 or   
condition ( employm5t includ+ by a      
pr$ispute arbitration agreem5t4  7#b7   
,pr$ispute arbitration agreem5ts ,no    
pr$ispute arbitration agreem5t %all be  
valid or en=ceable1 if ! agreem5t       
requires arbitration ( a dispute aris+  
"u ?is section4  7f7 ,consid]ations ,9  
det]m9+ ! am\nt ( a civil p5alty "u ?is 
subsection1 ! c\rt %all take into       
acc\nt-- 7#a7 ! degree ( culpability ( !
 bus9ess entity2  7#b7 any prior        
violations ( ?is subtitle by ! bus9ess  
entity2  7#c7 ! ability ( ! bus9ess     
entity to pay a civil p5alty2  7#d7 !   
effect on ! ability ( ! bus9ess entity  

to cont9ue to d bus9ess2  7#e7 ! numb] (
 individuals ^: s5sitive p]sonally      
id5tifiable in=mation 0 compromis$ by ! 
brea*2  7#f7 ! relative co/ ( compliance
 ) ?is subtitle2 &  7#g7 su* o!r matt]s 
z ju/ice may require4  ,b ,security     
brea* notification  #baa4 ,notice to    
individuals  7a7 ,9 g5]al ,except z     
provid$ 9 section #bab1 any ag5cy1 or   
bus9ess entity engag$ 9 int]/ate comm]ce
 o!r ?an a s]vice provid]1 t uses1      
accesses1 transmits1 /ores1 disposes (  
or collects s5sitive p]sonally          
id5tifiable in=mation t exp]i5ces a     
security brea* ( su* in=mation1 %all1   
foll[+ ! discov]y ( su* security brea* (
 su* in=mation1 notify any resid5t ( !  
,unit$ ,/ates ^: s5sitive p]sonally     
id5tifiable in=mation has be51 or is    
reasonably believ$ to h be51 access$1 or
 acquir$4  7b7 ,obligation ( own] or    
lic5see  7#a7 ,notice to own] or lic5see
 ,any ag5cy1 or bus9ess entity engag$ 9 
int]/ate comm]ce1 t uses1 accesses1     
transmits1 /ores1 disposes (1 or        

collects s5sitive p]sonally id5tifiable 
in=mation t ! ag5cy or bus9ess entity   
does n own or lic5se %all notify ! own] 
or lic5see ( ! in=mation foll[+ !       
discov]y ( a security brea* involv+ su* 
in=mation4  7#b7 ,notice by own]1       
lic5see or o!r designat$ ?ird p>ty ,no?+
 9 ?is subtitle %all prev5t or abrogate 
an agreem5t betwe5 an ag5cy or bus9ess  
entity requir$ to give notice "u ?is    
section & a designat$ ?ird p>ty1 includ+
 an own] or lic5see ( ! s5sitive        
p]sonally id5tifiable in=mation subject 
to ! security brea*1 to provide !       
notifications requir$ "u subsection 7a74
  7#c7 ,bus9ess entity reliev$ f giv+   
notice ,a bus9ess entity obligat$ to    
give notice "u subsection 7a7 %all be   
reliev$ ( su* obligation if an own] or  
lic5see ( ! s5sitive p]sonally          
id5tifiable in=mation subject to !      
security brea*1 or o!r designat$ ?ird   
p>ty1 provides su* notification4  7#d7  
,s]vice provid]s ,if a s]vice provid]   
becomes aw>e ( a security brea* conta9+ 

s5sitive p]sonally id5tifiable in=mation
 t is own$ or possess$ by ano!r bus9ess 
entity t connects to or uses a sy/em or 
network provid$ by ! s]vice provid] = ! 
purpose ( transmitt+1 r\t+1 or provid+  
int]m$iate or transi5t /orage ( su*     
data1 ! s]vice provid] %all be requir$  
to notify ! bus9ess entity :o initiat$  
su* connection1 transmission1 r\t+1 or  
/orage ( ! security brea* if ! bus9ess  
entity c be reasonably id5tifi$4 ,^u    
receiv+ su* notification f a s]vice     
provid]1 ! bus9ess entity %all be       
requir$ to provide ! notification       
requir$ "u subsection 7a74  7c7         
,timel9ess ( notification  7#a7 ,9 g5]al
 ,all notifications requir$ "u ?is      
section %all be made )\t unreasonable   
delay foll[+ ! discov]y by ! ag5cy or   
bus9ess entity ( a security brea*4  7#b7
 ,reasonable delay ,reasonable delay "u 
?is subsection may include any "t       
necess>y to det]m9e ! scope ( ! security
 brea*1 conduct ! risk assessm5t        
describ$ 9 section #bab7;b77#a71 &      

provide notice to law en=cem5t :5       
requir$4  7#c7 ,burd5 ( production ,!   
ag5cy1 bus9ess entity1 own]1 or lic5see 
requir$ to provide notice "u ?is        
subtitle %all1 ^u ! reque/ ( ! ,attorney
 ,g5]al1 ! ,f$]al ,trade ,commission1 or
 ! attorney g5]al ( a ,/ate or any ,/ate
 or local law en=cem5t ag5cy au?oriz$ by
 ! attorney g5]al ( ! ,/ate or by ,/ate 
/atute to prosecute violations ( consum]
 protection law1 provide records or o!r 
evid5ce ( ! notifications requir$ "u ?is
 subtitle1 includ+ to ! ext5t           
applicable1 ! reasons = any delay (     
notification4  7d7 ,delay ( notification
 au?oriz$ = law en=cem5t or national    
security purposes  7#a7 ,9 g5]al ,if a  
,f$]al law en=cem5t ag5cy or memb] ( !  
intellig5ce community det]m9es t !      
notification requir$ "u ?is section w\ld
 imp$e any lawfully au?oriz$ crim9al    
inve/igation or au?oriz$ inve/igative1  
protective1 or intellig5ce activities t 
are c>ri$ out by or on behalf ( any     
elem5t ( ! intellig5ce community &      

conduct$ 9 accordance ) ! ,unit$ ,/ates 
laws1 au?orities1 & regulations gov]n+  
su* intellig5ce activities1 su*         
notification %all be delay$ ^u writt5   
notice f su* ,f$]al law en=cem5t ag5cy  
or memb] ( ! intellig5ce community to ! 
ag5cy or bus9ess entity t exp]i5c$ !    
brea*4 ,! notification %all specify 9   
writ+ ! p]iod ( delay requir$4  7#b7    
,ext5d$ delay ( notification ,if !      
notification requir$ "u subsection 7a7  
is delay$ pursuant to p>agraph 7#a71 an 
ag5cy or bus9ess entity %all give notice
 #cj days aft] ! day su* law en=cem5t   
delay 0 invok$ unless a ,f$]al law      
en=cem5t or memb] ( ! intellig5ce       
community provides writt5 notification t
 fur!r delay is necess>y4  7#c7 ,law    
en=cem5t immunity ,no non-con/itutional 
cause ( action %all lie 9 any c\rt aga9/
 an ag5cy = acts relat+ to ! delay (    
notification = law en=cem5t or          
intellig5ce purposes "u ?is subtitle4   
#bab4 ,exemptions f notice to           
individuals  7a7 ,exemption = national  

security & law en=cem5t  7#a7 ,9 g5]al  
,section #baa %all n apply to an ag5cy  
or bus9ess entity if-- 7,a7 ! ,unit$    
,/ates ,secret ,s]vice or ! ,f$]al      
,bureau ( ,inve/igation det]m9es t      
notification ( ! security brea* c\ld be 
expect$ to reveal s5sitive s\rces &     
me?ods or simil>ly imp$e ! ability ( !  
,gov]nm5t to conduct law en=cem5t       
inve/igations2 or  7,b7 ! ,f$]al ,bureau
 ( ,inve/igation det]m9es t notification
 ( ! security brea* c\ld be expect$ to  
cause damage to national security4  7#b7
 ,immunity ,no non-con/itutional cause (
 action %all lie 9 any c\rt aga9/ any   
,f$]al ag5cy = acts relat+ to !         
exemption f notification "u ?is         
subtitle4  7b7 ,safe h>bor  7#a7 ,9     
g5]al ,an ag5cy or bus9ess entity %all  
be exempt f ! notice requirem5ts "u     
section #baa1 if-- 7,a7 a risk assessm5t
 conduct$ by ! ag5cy or bus9ess entity1 
9 consultation ) ! ,f$]al ,trade        
,commission1 concludes t !re is no      
significant risk t a security brea* has 

result$ 91 or w result 9 h>m to !       
individuals ^: s5sitive p]sonally       
id5tifiable in=mation 0 subject to !    
security brea*2 &  7,b7 ! ,f$]al ,trade 
,commission or designat$ entity does n  
indicate )9 #g bus9ess days f ! receipt 
( writt5 notification f an ag5cy or     
bus9ess entity pursuant to subsection   
#bab7;b77#b71 t ! ag5cy or bus9ess      
entity %\ld n be exempt f ! notice      
requirem5ts ( section #baa4  7#b7 ,risk 
assessm5t requirem5ts  7,a7 ,conduct+ a 
risk assessm5t ,^u discov]y ( a security
 brea* ( an ag5cy or bus9ess entity1 !  
ag5cy or bus9ess entity %all conduct a  
risk assessm5t to det]m9e if !re is a   
significant risk t ! security brea*     
result$ 91 or w result 91 h>m to !      
individuals ^: s5sitive p]sonally       
id5tifiable in=mation 0 subject to !    
security brea*4 7i7 ,presumption ( no   
significant risk ,x is presum$ t !re is 
no significant risk t ! security brea*  
has result$ 91 or w result 91 h>m to !  
individuals ^: s5sitive p]sonally       

id5tifiable data 0 subject to ! security
 brea*1 if ! s5sitive p]sonally         
id5tifiable in=mation has be5 r5d]$     
unusable1 unreadable1 or indeciph]able  
?r\gh a security te*nology or me?odology
 7if ! te*nology or me?odology is       
g5]ally accept$ by exp]ts 9 ! in=mation 
security field74 ,any su* presumption   
may be rebutt$ by facts demon/rat+ t !  
security te*nologies or me?odologies 9 a
 specific case1 h be5 or are reasonably 
likely to be compromis$4  7ii7          
,presumption ( significant risk ,x is   
presum$ t !re is a significant risk t ! 
security brea* has result$ 91 or w      
result 91 h>m to individuals ^: s5sitive
 p]sonally id5tifiable in=mation 0      
subject to ! security brea* if ! ag5cy  
or bus9ess entity fail$ to r5d] su*     
s5sitive p]sonally id5tifiable in=mation
 indeciph]able ?r\gh a security         
te*nology or me?odology 7if ! te*nology 
or me?odology is g5]ally accept$ by     
exp]ts 9 ! in=mation security field74   
7iii7 ,me?odologies or te*nologies  7,i7

 ,requir$ rulemak+ ,n lat] ?an #a ye>   
aft] ! date ( ! enactm5t ( ?is ,act1 &  
biannually !reaft]1 ! ,f$]al ,trade     
,commission1 aft] consultation ) !      
,national ,in/itute ( ,/&>ds &          
,te*nology1 %all issue rules 7pursuant  
to section #eec ( title #e1 ,unit$      
,/ates ,code7 or guidance to id5tify    
security me?odologies or te*nologies1   
su* z encryption1 :i* r5d] s5sitive     
p]sonally id5tifiable in=mation         
unusable1 unreadable1 or indeciph]able1 
t %all1 if appli$ to su* s5sitive       
p]sonally id5tifiable in=mation1 e/abli%
 a presumption t no significant risk (  
h>m exi/s to individuals ^: s5sitive    
p]sonally id5tifiable in=mation 0       
subject to a security brea*4 ,any su*   
presumption may be rebutt$ by facts     
demon/rat+ t any su* me?odology or      
te*nology 9 a specific case has be5 or  
is reasonably likely to be compromis$4  
7,,ii7 ,requir$ consultation ,9 issu+   
rules or guidance "u subclause 7,,ii71 !
 ,commission %all also consult )        

relevant indu/ries1 consum]             
organizations1 & data security & id5tity
 !ft prev5tion exp]ts & e/abli%$ /&>ds  
sett+ bodies4  7iv7 ,,ftc guidance ,n   
lat] ?an #a ye> aft] ! date ( ! enactm5t
 ( ?is ,act1 ! ,f$]al ,trade            
,commission1 aft] consultation ) !      
,national ,in/itute ( ,/&>ds &          
,te*nology1 %all issue guidance reg>d+ !
 application ( ! exemption 9 clause 7i74
  7,b7 ,writt5 notification ,)\t        
unreasonable delay1 b n lat] ?an #g days
 aft] ! discov]y ( a security brea*1    
unless ext5d$ by ! ,unit$ ,/ates ,secret
 ,s]vice or ! ,f$]al ,bureau (          
,inve/igation1 ! ag5cy or bus9ess entity
 mu/ notify ! ,f$]al ,trade ,commission 
& designat$ entity1 9 writ+1 (-- 7i7 !  
results ( ! risk assessm5t2 &  7ii7 its 
decision to invoke ! risk assessm5t     
exemption4  7,c7 ,violations ,x %all be 
a violation ( ?is section to-- 7i7 fail 
to conduct a risk assessm5t 9 a         
reasonable mann]1 or accord+ to /&>ds   
g5]ally accept$ by exp]ts 9 ! field (   

in=mation security2 or  7ii7 submit     
results ( a risk assessm5t t-- 7,i7     
conceal violations ( law1 ineffici5cy1  
or adm9i/rative error2  7,,ii7 prev5t   
emb>rassm5t to a bus9ess entity1        
organization1 or ag5cy2  7,,iii7 re/ra9 
competition2  7,,iv7 conta9 fraudul5t or
 delib]ately mislead+ in=mation2 or     
7,v7 delay notification "u section #baa 
= any o!r reason1 except :]e ! ag5cy or 
bus9ess entity reasonably believes t !  
risk assessm5t exception may apply4  7c7
 ,f9ancial fraud prev5tion exemption    
7#a7 ,9 g5]al ,a bus9ess entity %all be 
exempt f ! notice requirem5ts ( ?is     
subtitle if ! bus9ess entity utilizes or
 p>ticipates 9 a security program t--   
7,a7 effectively blocks ! use ( !       
s5sitive p]sonally id5tifiable in=mation
 to initiate unau?oriz$ f9ancial        
transactions be=e !y are *>g$ to !      
acc\nt ( ! individual2 &  7,b7 provides 
= notice to affect$ individuals aft] a  
security brea* t has result$ 9 fraud or 
unau?oriz$ transactions4  7#b7          

,limitation ,p>agraph 7#a7 %all n apply 
to a bus9ess entity if ! in=mation      
subject to ! security brea* includes an 
individual's fir/ & la/ "n1 or any o!r  
type ( s5sitive p]sonally id5tifiable   
in=mation1 o!r ?an a cr$it c>d or cr$it 
c>d security code id5tifi$ 9 section #c1
 unless t in=mation is only a cr$it c>d 
numb] or a cr$it c>d security code4  7d7
 ,limitations ,not)/&+ any o!r          
obligation "u ?is subtitle1 ?is subtitle
 does n apply to ! foll[+-- 7#a7        
,f9ancial in/itutions ,a f9ancial       
in/itution subject to ! data security   
requirem5ts & /&>ds "u #eja7;b7 ( !     
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq471 & subject to !         
jurisdiction ( an ag5cy or au?ority     
describ$ 9 section #eje7;a7 ( !         
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhje7;a771 if ! ,f$]al functional     
regulator 7z def9$ by section #eji ( !  
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhji77 ) jurisdiction ov] t f9ancial  
in/itution has issu$ a regulation "u    

title ,v ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja et seq47 t requires
 f9ancial in/itutions )9 its            
jurisdiction to provide notification to 
individuals foll[+ a brea* ( security4  
7#b7 ,,hipaa regulat$ entities exemption
  7,a7 ,9 g5]al ,a bus9ess entity %all  
be exempt f ! notice requirem5t "u      
section #baa if ! bus9ess entity is "o (
 ! foll[+3 7i7 ,cov]$ entities ,a       
bus9ess entity subject to ! ,heal?      
,insurance ,portability & ,acc\ntability
 ,act ( #aiif 7#db ,u4,s4,c4 #acja et   
seq471 includ+ ! data brea* notification
 requirem5ts & implem5t+ regulations ( t
 ,act4  7ii7 ,bus9ess entities ,a       
bus9ess entity t-- 7,i7 is act+ z a     
bus9ess associate1 z t t]m is def9$ "u !
 ,heal? ,insurance ,portability &       
,acc\ntability ,act ( #aiif 7#db        
,u4,s4,c4 #acja et seq47 & is 9         
compliance ) ! requirem5ts impos$ "u t  
,act & implem5t+ regulations promulgat$ 
"u t ,act2 &  7,,ii7 is subject to1 &   
curr5tly 9 compliance )1 ! data brea*   

notification requirem5ts "u section     
#acdjb or #acdjg ( ! ,am]ican ,re9ve/m5t
 & ,recov]y ,act ( #bjji 7#db ,u4,s4,c4 
#agicb & #agicg7 & implem5t+ regulations
 promulgat$ "u su* sections4  7,b7      
,limitation ,p>agraph 7#a7 %all n apply 
to a bus9ess entity if ! in=mation      
subject to ! security brea* includes an 
individual's fir/ & la/ "n1 or any o!r  
type ( s5sitive p]sonally id5tifiable   
in=mation o!r ?an a heal? insurance     
policy or subscrib] id5tification numb] 
or in=mation reg>d+ an individual's     
m$ical hi/ory1 m5tal or physical m$ical 
condition1 or m$ical treatm5t or        
diagnosis by a heal? c>e pr(essional z  
id5tifi$ 9 section #c unless t in=mation
 is only a heal? insurance policy or    
subscrib] id5tification numb] or        
in=mation reg>d+ an individual's m$ical 
hi/ory1 m5tal or physical m$ical        
condition1 or m$ical treatm5t or        
diagnosis by a heal? c>e pr(essional4   
#bac4 ,me?ods ( notice to individuals   
,to comply ) section #baa1 an ag5cy or  

bus9ess entity %all provide ! foll[+ =ms
 ( notice3 7#a7 ,individual writt5      
notice ,writt5 notice to individuals by 
#a ( ! foll[+ means3 7,a7 ,individual   
writt5 notification to ! la/ kn[n home  
mail+ address ( ! individual 9 ! records
 ( ! ag5cy or bus9ess entity4  7,b7     
,e-mail notice1 unless ! individual has 
expressly opt$ n to receive su* notices 
( security brea*es or ! notice is       
inconsi/5t ) ! provisions p]mitt+       
electronic transmission ( notices "u    
section #aja ( ! ,electronic ,signatures
 9 ,global & ,national ,comm]ce ,act    
7#ae ,u4,s4,c4 #gjja74  7#b7 ,telephone 
notice ,telephone notice to ! individual
 p]sonally4  7#c7 ,public notice  7,a7  
,electronic notice ,prom95t notice via  
all reasonable means ( electronic       
contact betwe5 ! individual & ! ag5cy or
 bus9ess entity1 includ+ any website1   
network$ devices1 or o!r int]face ?r\gh 
:i* ! ag5cy or bus9ess entity regul>ly  
int]acts ) ! consum]1 if ! numb] (      
individuals ^: s5sitive p]sonally       

id5tifiable in=mation 0 or is reasonably
 believ$ to h be5 access$ or acquir$ by 
an unau?oriz$ p]son exce$s #e1jjj4  7,b7
 ,m$ia notice ,notice to major m$ia     
outlets s]v+ a ,/ate or jurisdiction1 if
 ! numb] ( resid5ts ( su* ,/ate ^:      
s5sitive p]sonally id5tifiable in=mation
 01 or is reasonably believ$ to h be51  
access$ or acquir$ by an unau?oriz$     
p]son exce$s #e1jjj4  #bad4 ,cont5t (   
notice to individuals  7a7 ,9 g5]al     
,reg>dless ( ! me?od by :i* individual  
notice is provid$ to individuals "u     
section #bac7a71 su* notice %all        
include-- 7#a7 a description ( !        
categories ( s5sitive p]sonally         
id5tifiable in=mation t 01 or is        
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son1 & h[ !  
ag5cy or bus9ess entity came into       
possession ( ! s5sitive p]sonally       
id5tifiable in=mation at issue2  7#b7 a 
toll-free numb]-- 7,a7 t ! individual   
may use to contact ! ag5cy or bus9ess   
entity1 or ! ag5t ( ! ag5cy or bus9ess  

entity2 &  7,b7 f :i* ! individual may  
le>n :at types ( s5sitive p]sonally     
id5tifiable in=mation ! ag5cy or bus9ess
 entity ma9ta9$ ab\t t individual2  7#c7
 ! toll-free contact telephone numb]s1  
websites1 & addresses = ! major cr$it   
report+ ag5cies2  7#d7 ! telephone      
numb]s & websites = ! relevant ,f$]al   
ag5cies t provide in=mation reg>d+      
id5tity !ft prev5tion & protection2     
7#e7 notice t ! individual is entitl$ to
 receive1 at no co/ to su* individual1  
consum] cr$it reports on a qu>t]ly basis
 = a p]iod ( #b ye>s1 cr$it monitor+ or 
any o!r s]vice t enables consum]s to    
detect ! misuse ( s5sitive p]sonally    
id5tifiable in=mation = a p]iod ( #b    
ye>s1 & in/ructions to ! individual on  
reque/+ su* reports or s]vice f ! ag5cy 
or bus9ess entity2  7#f7 notice t !     
individual is entitl$ to receive a      
security freeze & t ! ag5cy or bus9ess  
entity w be liable = any co/s associat$ 
) ! security freeze = #b ye>s & !       
necess>y in/ructions = reque/+ a        

security freeze2 &  7#g7 notice t any   
co/s or damages incurr$ by an individual
 z a result ( a security brea* w be paid
 by ! bus9ess entity or ag5cy t exp]i5c$
 ! security brea*4  7b7 ,telephone      
notice ,telephone notice describ$ 9     
section #bac7b7 %all include1 to ! ext5t
 possible-- 7#a7 notification t a       
security brea* has occurr$ & t !        
individual's s5sitive p]sonally         
id5tifiable in=mation may h be5         
compromis$2  7#b7 a description ( !     
categories ( s5sitive p]sonally         
id5tifiable in=mation t 71 or are       
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son2  7#c7 a 
toll-free numb] & website-- 7,a7 t !    
individual may use to contact ! ag5cy or
 bus9ess entity1 or ! au?oriz$ ag5t ( ! 
ag5cy or bus9ess entity2 &  7,b7 f :i* !
 individual may le>n :at types (        
s5sitive p]sonally id5tifiable in=mation
 ! ag5cy or bus9ess entity ma9ta9$ ab\t 
t individual & rem$ies available to t   
individual2 &  7#d7 an al]t to !        

individual t ! ag5cy or bus9ess entity  
is s5d+ or has s5t writt5 notification  
conta9+ additional in=mation z requir$  
"u section #bac7a77;,a74  7c7 ,public   
notice ,public notice describ$ 9 section
 #bac7c7 %all include-- 7#a7 electronic 
notice1 :i* includes-- 7,a7 notification
 t a security brea* has occurr$ & t !   
individual's s5sitive p]sonally         
id5tifiable in=mation may h be5         
compromis$2  7,b7 a description ( !     
categories ( s5sitive p]sonally         
id5tifiable in=mation t 71 or are       
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son2 &  7,c7 
a toll-free numb] & website-- 7i7 t !   
individual may use to contact ! ag5cy or
 bus9ess entity1 or ! au?oriz$ ag5t ( ! 
ag5cy or bus9ess entity2 &  7ii7 f :i* !
 individual may le>n :at types (        
s5sitive p]sonally id5tifiable in=mation
 ! ag5cy or bus9ess entity ma9ta9$ ab\t 
t individual & rem$ies available to t   
individual2 &  7#b7 m$ia notice1 :i*    
includes-- 7,a7 a description ( !       

categories ( s5sitive p]sonally         
id5tifiable in=mation t 01 or is        
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son2  7,b7 a 
toll-free numb]-- 7i7 t ! individual may
 use to contact ! ag5cy or bus9ess      
entity1 or ! au?oriz$ ag5t ( ! ag5cy or 
bus9ess entity2 &  7ii7 f :i* !         
individual may le>n :at types ( s5sitive
 p]sonally id5tifiable in=mation ! ag5cy
 or bus9ess entity ma9ta9$ ab\t t       
individual & rem$ies available to t     
individual2  7,c7 ! toll-free contact   
telephone numb]s1 websites1 & addresses 
= ! major cr$it report+ ag5cies2  7,d7 !
 telephone numb]s & websites = !        
relevant ,f$]al ag5cies t provide       
in=mation reg>d+ id5tity !ft prev5tion &
 protection2  7,e7 notice t ! affect$   
individuals are entitl$ to receive1 at  
no co/ to su* individuals1 consum] cr$it
 reports on a qu>t]ly basis = a p]iod ( 
#b ye>s1 cr$it monitor+1 or any o!r     
s]vice t enables consum]s to detect !   
misuse ( s5sitive p]sonally id5tifiable 

in=mation = a p]iod ( #b ye>s2  7,f7    
notice t ! individual is entitl$ to     
receive a security freeze & t ! ag5cy or
 bus9ess entity w be liable = any co/s  
associat$ ) ! security freeze = #b ye>s2
 &  7,g7 notice t ! individual is       
entitl$ to receive comp5sation f !      
bus9ess entity or ag5cy = any co/s or   
damages incurr$ by ! individual result+ 
f ! security brea*4  7d7 ,additional    
cont5t ,not)/&+ section #bba1 a ,/ate   
may require t a notice "u subsection 7a7
 %all also include in=mation reg>d+     
victim protection assi/ance provid$ = by
 t ,/ate4  7e7 ,direct bus9ess          
relation%ip ,reg>dless ( :e!r a bus9ess 
entity1 ag5cy1 or a designat$ ?ird p>ty 
provides ! notice requir$ pursuant to   
section #baa7;b71 su* notice %all       
include ! "n ( ! bus9ess entity or ag5cy
 t has a direct relation%ip ) !         
individual be+ notifi$4  #bae4 ,rem$ies 
= security brea*  7a7 ,cr$it reports &  
cr$it monitor+ ,an ag5cy or bus9ess     
entity requir$ to provide notification  

"u ?is subtitle %all1 ^u reque/ ( an    
individual ^: s5sitive p]sonally        
id5tifiable in=mation 0 includ$ 9 !     
security brea*1 provide or arrange = !  
provision (1 to ea* su* individual & at 
no co/ to su* individual-- 7#a7 consum] 
cr$it reports f n few] ?an #a ( ! major 
cr$it report+ ag5cies beg9n+ n lat] ?an 
#fj days foll[+ ! reque/ ( ! individual 
& cont9u+ on a qu>t]ly basis = a p]iod (
 #b ye>s !reaft]2 &  7#b7 a cr$it       
monitor+ or o!r s]vice t enables        
consum]s to detect ! misuse ( _! p]sonal
 in=mation1 beg9n+ n lat] ?an #fj days  
foll[+ ! reque/ ( ! individual & cont9u+
 = a p]iod ( #b ye>s4  7b7 ,security    
freeze  7#a7 ,reque/ ,any consum] may   
submit a writt5 reque/1 by c]tifi$ mail 
or su* o!r secure me?od z au?oriz$ by a 
cr$it rat+ ag5cy1 to a cr$it rat+ ag5cy 
to place a security freeze on ! cr$it   
report ( ! consum]4  7#b7 ,implem5tation
 ( security freeze ,^u receipt ( a      
writt5 reque/ "u p>agraph 7#a71 a cr$it 
rat+ ag5cy %all-- 7,a7 n lat] ?an #e    

bus9ess days aft] receipt ( ! reque/1   
place a security freeze on ! cr$it      
report ( ! consum]2 &  7,b7 n lat] ?an  
#aj bus9ess days aft] plac+ a security  
freeze1 s5d a writt5 confirmation ( su* 
security freeze to ! consum]1 :i* %all  
provide ! consum] ) a unique p]sonal    
id5tification numb] or password to be   
us$ by ! consum] :5 provid+ au?orization
 = ! release ( ! cr$it report ( !       
consum] to a ?ird p>ty or = a specifi$  
p]iod ( "t4  7#c7 ,duration ( security  
freeze ,except z provid$ 9 p>agraph     
7#d71 any security freeze au?oriz$      
pursuant to ! provisions ( ?is section  
%all rema9 9 effect until ! consum]     
reque/s security freeze to be remov$4   
7#d7 ,disclosure ( cr$it report to ?ird 
p>ty  7,a7 ,9 g5]al ,if a consum] t has 
reque/$ a security freeze "u ?is        
subsection wi%es to au?orize !          
disclosure ( ! cr$it report ( ! consum] 
to a ?ird p>ty1 or = a specifi$ p]iod ( 
"t1 :ile su* security freeze is 9       
effect1 ! consum] %all contact ! cr$it  

rat+ ag5cy & provide-- 7i7 prop]        
id5tification2  7ii7 ! unique p]sonal   
id5tification numb] or password describ$
 9 p>agraph 7#b77;,b72 &  7iii7 prop]   
in=mation reg>d+ ! ?ird p>ty :o is to   
receive ! cr$it report or ! "t p]iod =  
:i* ! cr$it report %all be available4   
7,b7 ,requirem5t ,n lat] ?an #c bus9ess 
days aft] receipt ( a reque/ "u         
subp>agraph 7,a71 a cr$it rat+ ag5cy    
%all lift ! security freeze4  7#e7      
,proc$ures  7,a7 ,9 g5]al ,a cr$it rat+ 
ag5cy %all develop proc$ures to receive 
& process reque/s f consum]s "u p>agraph
 7#b7 ( ?is section4  7,b7 ,requirem5t  
,proc$ures develop$ "u subp>agraph 7,a71
 at a m9imum1 %all include ! ability ( a
 consum] to s5d su* tempor>y lift or    
removal reque/ by electronic mail1      
lett]1 telephone1 or facsimile4  7#f7   
,reque/s by ?ird p>ty ,if a ?ird p>ty   
reque/s access to a cr$it report ( a    
consum] t has be5 froz5 "u ?is          
subsection & ! consum] has n au?oriz$ ! 
disclosure ( ! cr$it report ( ! consum] 

to ! ?ird p>ty1 ! ?ird p>ty may deem su*
 cr$it application z incomplete4  7#g7  
,det]m9ation by cr$it rat+ ag5cy  7,a7  
,9 g5]al ,a cr$it rat+ ag5cy may refuse 
to implem5t or may remove a security    
freeze "u ?is subsection if ! ag5cy     
det]m9es1 9 good fai?1 t-- 7i7 ! reque/ 
= a security freeze 0 made z "p ( a     
fraud t ! consum] p>ticipat$ 91 _h k (1 
or t c be demon/rat$ by circum/antial   
evid5ce2 or  7ii7 ! consum] cr$it report
 0 froz5 due to a mat]ial               
misrepres5tation ( fact by ! consum]4   
7,b7 ,notice ,if a cr$it rat+ ag5cy     
makes a det]m9ation "u subp>agraph 7,a7 
to n implem5t1 or to remove1 a security 
freeze "u ?is subsection1 ! cr$it rat+  
ag5cy %all notify ! consum] 9 writ+ (   
su* det]m9ation-- 7i7 9 ! case ( a      
det]m9ation n to implem5t a security    
freeze1 n lat] ?an #e bus9ess days aft] 
! det]m9ation is made2 &  7ii7 9 ! case 
( a removal ( a security freeze1 prior  
to remov+ ! freeze on ! cr$it report ( !
 consum]4  7#h7 ,rule ( con/ruction     

7,a7 ,9 g5]al ,no?+ 9 ?is section %all  
be con/ru$ to prohibit disclosure ( a   
cr$it report ( a consum] to-- 7i7 a     
p]son1 or ! p]son's subsidi>y1          
affiliate1 ag5t or assignee ) :i* !     
consum] has or1 prior to assignm5t1 _h  
an acc\nt1 contract or debtor-cr$itor   
relation%ip = ! purpose ( review+ !     
acc\nt or collect+ ! f9ancial obligation
 ow+ = ! acc\nt1 contract or debt2  7ii7
 a subsidi>y1 affiliate1 ag5t1 assignee 
or prospective assignee ( a p]son to :om
 access has be5 grant$ "u p>agraph 7#d7 
= ! purpose ( facilitat+ ! ext5sion (   
cr$it or o!r p]missible use2  7iii7 any 
p]son act+ pursuant to a c\rt ord]1     
w>rant1 or subpo5a2  7iv7 any p]son = ! 
purpose ( us+ su* cr$it in=mation to    
prescre5 z provid$ by ! ,fair ,cr$it    
,report+ ,act 7#ae ,u4,s4,c4 #afha et   
seq472  7v7 any p]son = ! sole purpose (
 provid+ a cr$it file monitor+          
subscription s]vice to :i* ! consum] has
 subscrib$2  7vi7 a cr$it rat+ ag5cy = !
 sole purpose ( provid+ a consum] ) a   

copy ( ! cr$it report ( ! consum] ^u !  
reque/ ( ! consum]2 or  7vii7 a ,f$]al1 
,/ate or local gov]nm5tal entity1       
includ+ a law en=cem5t ag5cy1 or c\rt1  
or _! ag5ts or assignees pursuant to _! 
/atutory or regulatory duties2 &  7viii7
 any p]son = ! sole purpose ( provid+ a 
rem$y reque/$ by an individual "u ?is   
section4  7,b7 ,review+ ! acc\nt ,=     
purposes ( ?is subsection1 review+ !    
acc\nt %all include activities relat+ to
 acc\nt ma9t5ance1 monitor+1 cr$it l9e  
increases1 & acc\nt upgrades &          
enhancem5ts4  7#i7 ,exceptions ,! foll[+
 p]sons %all n be requir$ to place a    
security freeze "u ?is subsection1 b    
%all be subject to any security freeze  
plac$ on a cr$it report by ano!r cr$it  
rat+ ag5cy3 7,a7 ,a *eck s]vices or     
fraud prev5tion s]vices company t       
reports on incid5ts ( fraud or issues   
au?orizations = ! purpose ( approv+ or  
process+ negotiable in/rum5ts1          
electronic fund transf]s or simil>      
me?ods ( paym5t4  7,b7 ,a deposit acc\nt

 in=mation s]vice company t issues      
reports reg>d+ acc\nt closures due to   
fraud1 sub/antial ov]drafts1 automat$   
tell] ma*9e abuse1 or simil> in=mation  
reg>d+ a consum] to inquir+ banks or o!r
 f9ancial in/itutions = use only 9      
review+ a consum] reque/ = a deposit    
acc\nt at ! inquir+ bank or f9ancial    
in/itution4  7,c7 ,a cr$it rat+ ag5cy   
t-- 7i7 acts only to resell cr$it       
in=mation by assembl+ & m]g+ in=mation  
conta9$ 9 a database ( #a or m cr$it    
report+ ag5cies2 &  7ii7 does n ma9ta9 a
 p]man5t database ( cr$it in=mation f   
:i* new cr$it reports are produc$4      
7#aj7 ,fees  7,a7 ,9 g5]al ,a cr$it rat+
 ag5cy may *>ge reasonable fees = ea*   
security freeze1 removal ( su* freeze or
 tempor>y lift ( su* freeze = a p]iod ( 
"t1 & a tempor>y lift ( su* freeze = a  
specific p>ty4  7,b7 ,requirem5t ,any   
fees *>g$ "u subp>agraph 7,a7 %all be   
borne by ! ag5cy or bus9ess entity      
provid+ notice "u section #bad = #b ye>s
 foll[+ ! e/abli%m5t ( ! security freeze

 "u ?is subsection4  7c7 ,co/s result+ f
 a security brea*  7#a7 ,9 g5]al ,a     
bus9ess entity or ag5cy t exp]i5ces a   
security brea* & is requir$ to provide  
notice "u ?is subtitle %all pay1 ^u     
reque/1 to any individual ^: s5sitive   
p]sonally id5tifiable in=mation has be51
 or is reasonably believ$ to h be51     
access$ or acquir$ z a result ( su*     
security brea*1 any co/s or damages     
incurr$ by ! individual z a result ( su*
 security brea*1 includ+ co/s associat$ 
) id5tity !ft suff]$ z a result ( su*   
security brea*4  7#b7 ,compliance ,a    
bus9ess entity or ag5cy %all be deem$ 9 
compliance ) ?is subsection if ! bus9ess
 entity or ag5cy-- 7,a7 provides        
insurance to any individual ^: s5sitive 
p]sonally id5tifiable in=mation has be51
 or is reasonably believ$ to h be51     
access$ or acquir$ z a result ( a       
security brea* & su* insurance is       
suffici5t to comp5sate ! consum] = n    
less ?an #be1jjj ( co/s or damages2 or  
7,b7 pays1 )\t unreasonable delay1 any  

actual co/s or damages incurr$ by an    
individual z a result ( ! security      
brea*4  #baf4 ,notice to cr$it report+  
ag5cies ,if an ag5cy or bus9ess entity  
is requir$ to provide notification to m 
?an #e1jjj individuals "u section       
#baa7;a71 ! ag5cy or bus9ess entity %all
 also notify all consum] report+ ag5cies
 t compile & ma9ta9 files on consum]s on
 a nationwide basis 7z def9$ 9 section  
#fjc7p7 ( ! ,fair ,cr$it ,report+ ,act  
7#ae ,u4,s4,c4 #afha;a7p777 ( ! tim+ &  
di/ribution ( ! notices4 ,su* notice    
%all be giv5 to ! consum] cr$it report+ 
ag5cies )\t unreasonable delay &1 if x w
 n delay notice to ! affect$            
individuals1 prior to ! di/ribution (   
notices to ! affect$ individuals4  #bag4
 ,notice to law en=cem5t  7a7           
,designation ( a gov]nm5t entity ,to    
receive notice  7#a7 ,9 g5]al ,n lat]   
?an #fj days aft] ! date ( enactm5t (   
?is ,act1 ! ,secret>y ( ,homel&         
,security1 9 consultation ) ! ,attorney 
,g5]al1 %all designate a ,f$]al         

,gov]nm5t entity to receive ! in=mation 
requir$ to be submitt$ "u ?is subtitle1 
& any o!r reports & in=mation ab\t      
in=mation security incid5ts1 ?reats1 &  
vuln]abilities4  7#b7 ,responsibilities 
( ! designat$ entity ,! designat$ entity
 %all-- 7,a7 be responsible = promptly  
provid+ ! in=mation x receives to !     
,unit$ ,/ates ,secret ,s]vice & ! ,f$]al
 ,bureau ( ,inve/igation1 & to ! ,f$]al 
,trade ,commission = civil law en=cem5t 
purposes2 &  7,b7 provide ! in=mation   
describ$ 9 subp>agraph 7,a7 z           
appropriate to o!r ,f$]al ag5cies = law 
en=cem5t1 national security1 or data    
security purposes4  7b7 ,notice ,any    
bus9ess entity or ag5cy %all notify !   
designat$ entity ( ! fact t a security  
brea* has occurr$ if-- 7#a7 ! numb] (   
individuals ^: s5sitive p]sonally       
id5tifiable in=mation 01 or is          
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son exce$s   
#e1jjj2  7#b7 ! security brea* involves 
a database1 network$ or integrat$       

databases1 or o!r data sy/em conta9+ !  
s5sitive p]sonally id5tifiable in=mation
 ( m ?an #ejj1jjj individuals           
nationwide2  7#c7 ! security brea*      
involves databases own$ by ! ,f$]al     
,gov]nm5t2 or  7#d7 ! security brea*    
involves prim>ily s5sitive p]sonally    
id5tifiable in=mation ( individuals kn[n
 to ! ag5cy or bus9ess entity to be     
employees & contractors ( ! ,f$]al      
,gov]nm5t involv$ 9 national security or
 law en=cem5t4  7c7 ,,ftc review (      
?re%olds  7#a7 ,review ,n lat] ?an #a   
ye> aft] ! date ( enactm5t ( ?is ,act1 !
 ,f$]al ,trade ,commission1 9           
consultation ) ! ,attorney ,g5]al & !   
,secret>y ( ,homel& ,security1 %all     
promulgate regulations reg>d+ ! reports 
requir$ "u subsection 7a74  7#b7        
,rulemak+ ,! ,f$]al ,trade ,commission1 
9 consultation ) ! ,attorney ,g5]al & ! 
,secret>y ( ,homel& ,security1 aft]     
notice & ! opportunity = public comm5t1 
& 9 a mann] consi/5t ) ?is section1 %all
 promulgate regulations1 z necess>y1 "u 

section #eec ( title #e1 ,unit$ ,/ates  
,code1 to adju/ ! ?re%olds = notice to  
law en=cem5t & national security        
au?orities "u subsection 7a7 & to       
facilitate ! purposes ( ?is section4    
7d7 ,tim+ ( notices ,! notices requir$  
"u ?is section %all be deliv]$ z foll[s3
 7#a7 ,notice "u subsection 7a7 %all be 
deliv]$ z promptly z possible1 b n lat] 
?an #aj days aft] discov]y ( ! security 
brea*4  7#b7 ,notice "u section #baa    
%all be deliv]$ to individuals n lat]   
?an #dh h\rs aft] ! ,f$]al ,bureau (    
,inve/igation or ! ,secret ,s]vice      
receives notice ( a security brea* f an 
ag5cy or bus9ess entity4  #bah4 ,f$]al  
en=cem5t  7a7 ,civil actions by !       
,attorney ,g5]al  7#a7 ,9 g5]al ,!      
,attorney ,g5]al may br+ a civil action 
9 ! appropriate ,unit$ ,/ates di/rict   
c\rt aga9/ any bus9ess entity t engages 
9 conduct con/itut+ a violation ( ?is   
subtitle &1 ^u pro( ( su* conduct by a  
prepond]ance ( ! evid5ce1 su* bus9ess   
entity %all be subject to a civil p5alty

 ( n m ?an #ejj p] day p] individual ^: 
s5sitive p]sonally id5tifiable in=mation
 01 or is reasonably believ$ to h be51  
access$ or acquir$ by an unau?oriz$     
p]son1 up to a maximum ( #bj1jjj1jjj p] 
violation1 unless su* conduct is f\nd to
 be willful or int5tional4  7#b7        
,presumption ,a violation ( section     
#bab7;b77#b77;,c7 %all be presum$ to be 
willful or int5tional conduct4  7b7     
,injunctive actions by ! ,attorney      
,g5]al  7#a7 ,9 g5]al ,if x appe>s t a  
bus9ess entity has engag$1 or is engag$1
 9 any act or practice con/itut+ a      
violation ( ?is subtitle1 ! ,attorney   
,g5]al may petition an appropriate      
di/rict c\rt ( ! ,unit$ ,/ates = an     
ord]-- 7,a7 enjo9+ su* act or practice2 
or  7,b7 en=c+ compliance ) ?is         
subtitle4  7#b7 ,issuance ( ord] ,a c\rt
 may issue an ord] "u p>agraph 7#a71 if 
! c\rt f9ds t ! conduct 9 "q con/itutes 
a violation ( ?is subtitle4  7c7 ,civil 
actions by ! ,f$]al trade commission    
7#a7 ,9 g5]al ,compliance ) !           

requirem5ts impos$ "u subtitle ,a & ?is 
subtitle may be en=c$ "u ! ,f$]al ,trade
 ,commission ,act 7#ae ,u4,s4,c4 #da et 
seq47 by ! ,f$]al ,trade ,commission )  
respect to bus9ess entities subject to  
?is ,act4 ,all ( ! functions & p[]s ( ! 
,f$]al ,trade ,commission "u ! ,f$]al   
,trade ,commission ,act are available to
 ! ,commission to en=ce compliance by   
any p]son ) ! requirem5ts impos$ "u ?is 
title4  7#b7 ,unfair or deceptive acts  
or practices ,= ! purpose ( ! ex]cise by
 ! ,f$]al ,trade ,commission ( its      
functions & p[]s "u ! ,f$]al ,trade     
,commission ,act1 a violation ( any     
requirem5t or prohibition impos$ "u ?is 
title %all con/itute an unfair or       
deceptive act or practice 9 comm]ce 9   
violation ( a regulation "u section     
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77,i77,b77 reg>d+ unfair or      
deceptive acts or practices & %all be   
subject to en=cem5t by ! ,f$]al ,trade  
,commission "u t ,act ) respect to any  

bus9ess entity1 irrespective ( :e!r t   
bus9ess entity is engag$ 9 comm]ce or   
meets any o!r jurisdictional te/s 9 !   
,f$]al ,trade ,commission4  7d7         
,consid]ations ,9 det]m9+ ! am\nt ( a   
civil p5alty "u ?is subsection1 ! c\rt  
%all take into acc\nt-- 7#a7 ! degree ( 
culpability ( ! bus9ess entity2  7#b7   
any prior violations ( ?is subtitle by !
 bus9ess entity2  7#c7 ! ability ( !    
bus9ess entity to pay a civil p5alty2   
7#d7 ! effect on ! ability ( ! bus9ess  
entity to cont9ue to d bus9ess2  7#e7 ! 
numb] ( individuals ^: s5sitive         
p]sonally id5tifiable in=mation 0       
compromis$ by ! brea*2  7#f7 ! relative 
co/ ( compliance ) ?is subtitle2 &  7#g7
 su* o!r matt]s z ju/ice may require4   
7e7 ,coord9ation ( en=cem5t  7#a7 ,9    
g5]al ,be=e op5+ an inve/igation1 !     
,f$]al ,trade ,commission %all consult )
 ! ,attorney ,g5]al4  7#b7 ,limitation  
,! ,f$]al ,trade ,commission may        
initiate inve/igations "u ?is subsection
 unless ! ,attorney ,g5]al det]m9es t   

su* an inve/igation w\ld imp$e an ongo+ 
crim9al inve/igation or national        
security activity4  7#c7 ,coord9ation   
agreem5t  7,a7 ,9 g5]al ,9 ord] to avoid
 conflicts & promote consi/5cy reg>d+ ! 
en=cem5t & litigation ( matt]s "u ?is   
,act1 n lat] ?an #ahj days aft] !       
enactm5t ( ?is ,act1 ! ,attorney ,g5]al 
& ! ,commission %all ent] into an       
agreem5t = coord9ation reg>d+ ! en=cem5t
 ( ?is ,act4  7,b7 ,requirem5t ,!       
coord9ation agreem5t ent]$ into "u      
subp>agraph 7,a7 %all include provisions
 to ensure t p>allel inve/igations &    
proce$+s "u ?is section are conduct$ 9 a
 mann] t avoids conflicts & does n imp$e
 ! ability ( ! ,attorney ,g5]al to      
prosecute violations ( ,f$]al crim9al   
laws4  7#d7 ,coord9ation ) ! ,,fcc ,if  
an en=cem5t action "u ?is ,act relates  
to cu/om] propriet>y network in=mation1 
! ,f$]al ,trade ,commission %all        
coord9ate ! en=cem5t action ) ! ,f$]al  
,communications ,commission4  7f7       
,rulemak+ ,! ,f$]al ,trade ,commission  

may1 9 consultation ) ! ,attorney       
,g5]al1 issue su* o!r regulations z x   
det]m9es to be necess>y to c>ry out ?is 
subtitle4 ,all regulations promulgat$ "u
 ?is ,act %all be issu$ 9 accordance )  
section #eec ( title #e1 ,unit$ ,/ates  
,code4 ,:]e regulations relate to cu/om]
 propriet>y network in=mation1 !        
promulgation ( su* regulations w be     
coord9at$ ) ! ,f$]al ,communications    
,commission4  7g7 ,o!r rights & rem$ies 
,! rights & rem$ies available "u ?is    
subtitle are cumulative & %all n affect 
any o!r rights & rem$ies available "u   
law4  7h7 ,fraud al]t ,section          
#fje;,a7b77#a7 ( ! ,fair ,cr$it ,report+
 ,act 7#ae ,u4,s4,c4 #afha;c-#a7;b77#a77
 is am5d$ 9 ! matt] prec$+ subp>agraph  
7,a7 by ins]t+ 1 or evid5ce t ! consum] 
has receiv$ notice t ! consum]'s        
f9ancial in=mation has or may h be5     
compromis$1 aft] id5tity !ft report4    
#bai4 ,en=cem5t by ,/ate attorneys g5]al
  7a7 ,9 g5]al  7#a7 ,civil actions     
7,a7 ,9 g5]al ,9 any case 9 :i* !       

attorney g5]al ( a ,/ate or any ,/ate or
 local law en=cem5t ag5cy au?oriz$ by ! 
,/ate attorney g5]al or by ,/ate /atute 
to prosecute violations ( consum]       
protection law1 has reason to believe t 
an int]e/ ( ! resid5ts ( t ,/ate has be5
 or is ?reat5$ or adv]sely affect$ by ! 
engagem5t ( a bus9ess entity 9 a        
practice t is prohibit$ "u ?is subtitle1
 ! ,/ate or ! ,/ate or local law        
en=cem5t ag5cy on behalf ( ! resid5ts ( 
! ag5cy's jurisdiction1 may br+ a civil 
action on behalf ( ! resid5ts ( ! ,/ate 
or jurisdiction 9 a di/rict c\rt ( !    
,unit$ ,/ates ( appropriate jurisdiction
 or any o!r c\rt ( compet5t             
jurisdiction1 includ+ a ,/ate c\rt1 to--
 7i7 enjo9 t practice2  7ii7 en=ce      
compliance ) ?is subtitle2 or  7iii7    
obta9 civil p5alties ( n m ?an #ejj p]  
day p] individual ^: s5sitive p]sonally 
id5tifiable in=mation 01 or is          
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son1 up to a 
maximum ( #bj1jjj1jjj p] violation1     

unless su* conduct is f\nd to be willful
 or int5tional4  7,b7 ,presumption ,a   
violation ( section #bab7;b77#b77;,c7   
%all be presum$ to be willful or        
int5tional4  7#b7 ,consid]ations ,9     
det]m9+ ! am\nt ( a civil p5alty "u ?is 
subsection1 ! c\rt %all take into       
acc\nt-- 7,a7 ! degree ( culpability ( !
 bus9ess entity2  7,b7 any prior        
violations ( ?is subtitle by ! bus9ess  
entity2  7,c7 ! ability ( ! bus9ess     
entity to pay a civil p5alty2  7,d7 !   
effect on ! ability ( ! bus9ess entity  
to cont9ue to d bus9ess2  7,e7 ! numb] (
 individuals ^: s5sitive p]sonally      
id5tifiable in=mation 0 compromis$ by ! 
brea*2  7,f7 ! relative co/ ( compliance
 ) ?is subtitle2 &  7,g7 su* o!r matt]s 
z ju/ice may require4  7#c7 ,notice     
7,a7 ,9 g5]al ,be=e fil+ an action "u   
p>agraph 7#a71 ! attorney g5]al ( !     
,/ate involv$ %all provide to !         
,attorney ,g5]al ( ! ,unit$ ,/ates-- 7i7
 writt5 notice ( ! action2 &  7ii7 a    
copy ( ! compla9t = ! action4  7,b7     

,exemption  7i7 ,9 g5]al ,subp>agraph   
7,a7 %all n apply ) respect to ! fil+ ( 
an action by an attorney g5]al ( a ,/ate
 "u ?is subtitle1 if ! ,/ate attorney   
g5]al det]m9es t x is n feasible to     
provide ! notice describ$ 9 su*         
subp>agraph be=e ! fil+ ( ! action4     
7ii7 ,notification ,9 an action describ$
 9 clause 7i71 ! attorney g5]al ( a     
,/ate %all provide notice & a copy ( !  
compla9t to ! ,attorney ,g5]al at ! "t !
 ,/ate attorney g5]al files ! action4   
7b7 ,f$]al proce$+s ,^u receiv+ notice  
"u subsection 7a77#b71 ! ,attorney      
,g5]al %all h ! "r to-- 7#a7 move to /ay
 ! action1 p5d+ ! f9al disposition ( a  
p5d+ ,f$]al proce$+ or action2  7#b7    
initiate an action 9 ! appropriate      
,unit$ ,/ates di/rict c\rt "u section   
#bah & move to consolidate all p5d+     
actions1 includ+ ,/ate actions1 9 su*   
c\rt2  7#c7 int]v5e 9 an action br\ght  
"u subsection 7a77#b72 &  7#d7 file     
petitions = appeal4  7c7 ,p5d+ proce$+s 
,if ! ,attorney ,g5]al has in/itut$ a   

proce$+ or action = a violation ( ?is   
subtitle or any regulations !reund]1 no 
attorney g5]al ( a ,/ate may1 dur+ !    
p5d5cy ( su* proce$+ or action1 br+ an  
action "u ?is subtitle aga9/ any        
def5dant nam$ 9 su* crim9al proce$+ or  
civil action = any violation t is alleg$
 9 t proce$+ or action4  7d7            
,con/ruction ,= purposes ( br++ any     
civil action "u subsection 7a71 no?+ 9  
?is subtitle reg>d+ notification %all be
 con/ru$ to prev5t an attorney g5]al ( a
 ,/ate f ex]cis+ ! p[]s conf]r$ on su*  
attorney g5]al by ! laws ( t ,/ate to-- 
7#a7 conduct inve/igations2  7#b7       
adm9i/] oa?s or affirmations2 or  7#c7  
compel ! att5dance ( witnesses or !     
production ( docum5t>y & o!r evid5ce4   
7e7 ,v5ue2 s]vice ( process  7#a7 ,v5ue 
,any action br\ght "u subsection 7a7 may
 be br\ght 9-- 7,a7 ! di/rict c\rt ( !  
,unit$ ,/ates t meets applicable        
requirem5ts relat+ to v5ue "u section   
#acia ( title #bh1 ,unit$ ,/ates ,code2 
or  7,b7 ano!r c\rt ( compet5t          

jurisdiction4  7#b7 ,s]vice ( process ,9
 an action br\ght "u subsection 7a71    
process may be s]v$ 9 any di/rict 9 :i* 
! def5dant-- 7,a7 is an inhabitant2 or  
7,b7 may be f\nd4  #bbj4 ,supplem5tal   
en=cem5t by individuals  7a7 ,9 g5]al   
,any p]son aggriev$ by a violation ( !  
provisions ( section #baa1 #bac1 #bad1  
#bae1 or #baf by a bus9ess entity may   
br+ a civil action 9 a c\rt (           
appropriate jurisdiction to recov] =    
p]sonal injuries su/a9$ z a result ( !  
violation4  7b7 ,au?ority ,to br+ civil 
action2 jurisdiction ,z provid$ 9       
subsection 7c71 an individual may       
comm5ce a civil action on 8 own behalf  
aga9/ any bus9ess entity :o is alleg$ to
 h violat$ ! provisions ( ?is subtitle4 
7c7 ,rem$ies 9 a citiz5 suit  7#a7      
,damages ,any individual h>m$ by a      
failure ( a bus9ess entity to comply ) !
 provisions ( section #baa1 #bac1 #bad1 
#bae1 or #baf %all be able to collect   
damages ( n m ?an #ejj p] day p]        
individual ^: s5sitive p]sonally        

id5tifiable in=mation 01 or is          
reasonably believ$ to h be51 access$ or 
acquir$ by an unau?oriz$ p]son1 up to a 
maximum ( #bj1jjj1jjj p] violation4     
7#b7 ,punitive damages ,a bus9ess entity
 may be liable = punitive damages if !  
bus9ess entity-- 7,a7 int5tionally or   
willfully violates ! provisions (       
section #baa1 #bac1 #bad1 #bae1 or #baf2
 or  7,b7 fail$ to comply ) !           
requirem5ts ( subsections 7a7 ?r\gh 7d7 
( section #bjb4  7#c7 ,equitable relief 
,a bus9ess entity t violates !          
provisions ( section #baa1 #bac1 #bad1  
#bae1 or #baf may be enjo9$ to provide  
requir$ rem$ies "u section #bae by a    
c\rt ( compet5t jurisdiction4  7d7 ,o!r 
rights & rem$ies ,! rights & rem$ies    
available "u ?is subsection are         
cumulative & %all n affect any o!r      
rights & rem$ies available "u law4  7e7 
,non5=ceability ( ,c]ta9 ,provisions    
,waiv+ ,rights & ,rem$ies or ,requir+   
,arbitration ( ,disputes  7#a7 ,waiv] ( 
rights & rem$ies ,! rights & rem$ies    

provid$ = 9 ?is section may n be waiv$  
by any agreem5t1 policy =m1 or condition
 ( employm5t includ+ by a pr$ispute     
arbitration agreem5t4  7#b7 ,pr$ispute  
arbitration agreem5ts ,no pr$ispute     
arbitration agreem5t %all be valid or   
en=ceable1 if ! agreem5t requires       
arbitration ( a dispute aris+ "u ?is    
section4  7f7 ,consid]ations ,9 det]m9+ 
! am\nt ( a civil p5alty "u ?is         
subsection1 ! c\rt %all take into       
acc\nt-- 7#a7 ! degree ( culpability ( !
 bus9ess entity2  7#b7 any prior        
violations ( ?is subtitle by ! bus9ess  
entity2  7#c7 ! ability ( ! bus9ess     
entity to pay a civil p5alty2  7#d7 !   
effect on ! ability ( ! bus9ess entity  
to cont9ue to d bus9ess2  7#e7 ! numb] (
 individuals ^: s5sitive p]sonally      
id5tifiable in=mation 0 compromis$ by ! 
brea*2  7#f7 ! relative co/ ( compliance
 ) ?is subtitle2 &  7#g7 su* o!r matt]s 
z ju/ice may require4  #bba4 ,relation  
to o!r laws  7a7 ,9 g5]al ,! provisions 
( ?is subtitle %all sup]s$e any o!r     

provision ( ,f$]al law or any provision 
( law ( any ,/ate relat+ to notification
 by a bus9ess entity engag$ 9 int]/ate  
comm]ce or an ag5cy ( a security brea*1 
except z provid$ 9 ?is subsection4  7b7 
,limitations  7#a7 ,/ate common law     
,no?+ 9 ?is subtitle %all be con/ru$ to 
exempt any entity f liability "u common 
law1 includ+ ?r\gh ! op]ation ( ord9>y  
preemption pr9ciples1 & includ+         
liability ?r\gh ,/ate trespass1         
contract1 or tort law1 = damages caus$  
by ! failure to notify an individual    
foll[+ a security brea*4  7#b7          
,gramm-lea*-bliley ,act ,no?+ 9 ?is ,act
 %all sup]s$e ! data security           
requirem5ts ( ! ,gramm-,lea*-,bliley    
,act 7#ae ,u4,s4,c4 #fhja et seq471 or  
implem5t+ regulations bas$ on t ,act4   
7#c7 ,heal? ,privacy  7,a7 ,to ! ext5t t
 a bus9ess entity acts z a cov]$ entity 
or a bus9ess associate "u ! ,heal?      
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? ,act 7#db ,u4,s4,c4     
#agicb71 & has ! obligation to provide  

brea* notification "u t ,act or its     
implem5t+ regulations1 ! requirem5ts (  
?is ,act %all n apply4  7,b7 ,to ! ext5t
 t a bus9ess entity acts z a v5dor (    
p]sonal heal? records1 a ?ird-p>ty      
s]vice provid]1 or o!r entity subject to
 ! ,heal? ,in=mation ,te*nology =       
,economical & ,cl9ical ,heal? ,act 7#db 
,u4,s4,c4 #agicg71 & has ! obligation to
 provide brea* notification "u t ,act or
 its implem5t+ regulations1 !           
requirem5ts ( ?is ,act %all n apply4    
#bbb4 ,au?orization ( appropriations    
,!re are au?oriz$ to be appropriat$ su* 
sums z may be necess>y to cov] ! co/s   
incurr$ by ! ,unit$ ,/ates ,secret      
,s]vice to c>ry out inve/igations & risk
 assessm5ts ( security brea*es z requir$
 "u ?is subtitle4  #bbc4 ,report+ on    
risk assessm5t exemptions ,! ,unit$     
,/ates ,secret ,s]vice & ! ,f$]al       
,bureau ( ,inve/igation %all report to  
,congress n lat] ?an #ah mon?s aft] !   
date ( enactm5t ( ?is ,act1 & ^u !      
reque/ by ,congress !reaft]1 on-- 7#a7 !

 numb] & nature ( ! security brea*es    
describ$ 9 ! notices fil$ by ^? bus9ess 
entities invok+ ! risk assessm5t        
exemption "u section #bab7;b7 & !       
response ( ! ,unit$ ,/ates ,secret      
,s]vice & ! ,f$]al ,bureau (            
,inve/igation to su* notices2 &  7#b7 ! 
numb] & nature ( security brea*es       
subject to ! national security & law    
en=cem5t exemptions "u section #bab7;a71
 provid$ t su* report may n disclose !  
cont5ts ( any risk assessm5t provid$ to 
! ,unit$ ,/ates ,secret ,s]vice & !     
,f$]al ,bureau ( ,inve/igation pursuant 
to ?is subtitle4  ,c ,po/-,brea*        
te*nical in=mation cle>+h\se  #bcj4     
,cle>+h\se in=mation collection1        
ma9t5ance1 & access  7a7 ,9 g5]al ,!    
designat$ entity %all ma9ta9 a cle>+h\se
 ( te*nical in=mation conc]n+ sy/em     
vuln]abilities id5tifi$ 9 ! wake (      
security brea*es1 :i* %all-- 7#a7 conta9
 in=mation disclos$ by ag5cies or       
bus9ess entities "u subsection 7b72 &   
7#b7 be accessible to c]tifi$ entities  

"u subsection 7c74  7b7 ,po/-,brea*     
te*nical notification ,9 any in/ance 9  
:i* an ag5cy or bus9ess entity is       
requir$ to notify ! designat$ entity "u 
section #bag1 ! ag5cy or bus9ess entity 
%all also provide ! designat$ entity )  
te*nical in=mation conc]n+ ! nature ( ! 
security brea*1 includ+-- 7#a7 te*nical 
in=mation reg>d+ any sy/em              
vuln]abilities ( ! ag5cy or bus9ess     
entity reveal$ by or id5tifi$ z a       
consequ5ce ( ! security brea*2  7#b7    
te*nical in=mation reg>d+ any sy/em     
vuln]abilities ( ! ag5cy or bus9ess     
entity actually exploit$ dur+ ! security
 brea*2 &  7#c7 any o!r te*nical        
in=mation conc]n+ ! nature ( ! security 
brea* deem$ appropriate = collection by 
! designat$ entity 9 fur!rance ( ?is    
subtitle4  7c7 ,access to cle>+h\se ,any
 entity c]tifi$ "u subsection 7d7 may   
review in=mation ma9ta9$ by ! te*nical  
in=mation cle>+h\se = ! purpose (       
prev5t+ security brea*es t ?reat5 !     
security ( s5sitive p]sonally           

id5tifiable in=mation4  7d7             
,c]tification = access ,! designat$     
entity %all issue & revoke c]tifications
 to ag5cies & bus9ess entities wi%+ to  
review in=mation ma9ta9$ by ! te*nical  
in=mation cle>+h\se & %all e/abli%      
conditions = obta9+ & ma9ta9+ su*       
c]tifications1 includ+ agreem5t t any   
in=mation obta9$ directly or d]iv$      
indirectly f ! review ( in=mation       
ma9ta9$ by ! te*nical in=mation         
cle>+h\se-- 7#a7 %all only be us$ to    
improve ! security & r$uce !            
vuln]ability ( networks t collect1      
access1 transmit1 use1 /ore1 or dispose 
( s5sitive p]sonally id5tifiable        
in=mation2  7#b7 may n be us$ = any     
competitive comm]cial purpose2 &  7#c7  
may n be %>$ ) any ?ird p>ty1 includ+   
o!r p>ties c]tifi$ = access to !        
in=mation cle>+h\se1 )\t ! express      
writt5 cons5t ( ! designat$ entity4  7e7
 ,rulemak+ ,9 consultation ) ! private  
sector1 appropriate repres5tatives (    
,/ate & local gov]nm5ts1 & o!r          

appropriate ,f$]al ag5cies1 ! designat$ 
entity may issue su* regulations z x    
det]m9es to be necess>y to c>ry out ?is 
subtitle4 ,all regulations promulgat$ "u
 ?is ,act %all be issu$ 9 accordance )  
section #eec ( title #e1 ,unit$ ,/ates  
,code4  #bca4 ,protections = cle>+h\se  
p>ticipants  7a7 ,protection (          
propriet>y in=mation ,to ! ext5t        
feasible1 ! designat$ entity %all ensure
 t any te*nical in=mation disclos$ to ! 
designat$ entity "u ?is subtitle %all be
 /or$ 9 a =mat design$ to protect       
propriet>y bus9ess in=mation f inadv]t5t
 disclosure4  7b7 ,anonym\s data release
 ,to ! ext5t feasible1 ! designat$      
entity %all ensure t all in=mation /or$ 
9 ! te*nical in=mation cle>+h\se &      
access$ by c]tifi$ p>ties is pres5t$ 9 a
 =m t m9imizes ! pot5tial = su*         
in=mation to be trac$ to a p>ticul>     
network1 company1 or security brea*     
incid5t4  7c7 ,protection f public      
disclosure ,except z o!rwise provid$ 9  
?is subtitle-- 7#a7 security &          

vuln]ability in=mation collect$ "u ?is  
section & provid$ to ! ,f$]al ,gov]nm5t1
 includ+ aggregat$ analysis & data1 %all
 be exempt f disclosure "u section      
#eeb7;b77#c7 ( title #e1 ,unit$ ,/ates  
,code2 &  7#b7 "u section #bcj7;e71     
security & vuln]ability-relat$ in=mation
 provid$ to ! ,f$]al ,gov]nm5t "u ?is   
section1 includ+ aggregat$ analysis &   
data1 %all be protect$ f public         
disclosure1 except t ?is p>agraph-- 7,a7
 does n prohibit ! %>+ ( su* in=mation1 
z ! designat$ entity det]m9es to be     
appropriate1 9 ord] to mitigate         
cyb]security ?reats or fur!r ! (ficial  
functions ( a gov]nm5t ag5cy2 &  7,b7   
does n au?oriz$ su* in=mation to be     
)held f a committee ( ,congress au?oriz$
 to reque/ ! in=mation4  7d7 ,protection
 ( classifi$ in=mation ,no?+ 9 ?is      
subtitle p]mits ! unau?oriz$ disclosure 
( classifi$ in=mation4  #bcb4 ,effective
 date ,?is subtitle %all take effect on 
! expiration ( ! date t is #ij days aft]
 ! date ( enactm5t ( ?is ,act4  ,,iii   

,access to & use ( comm]cial data  #cja4
 ,g5]al s]vices adm9i/ration review (   
contracts  7a7 ,9 g5]al ,9 consid]+     
contract aw>ds total+ m ?an #ejj1jjj &  
ent]$ into aft] ! date ( enactm5t ( ?is 
,act ) data brok]s1 ! ,adm9i/rator ( !  
,g5]al ,s]vices ,adm9i/ration %all      
evaluate-- 7#a7 ! data privacy &        
security program ( a data brok] to      
ensure ! privacy & security ( data      
conta9+ s5sitive p]sonally id5tifiable  
in=mation1 includ+ :e!r su* program     
adequately addresses privacy & security 
?reats creat$ by malici\s s(tw>e or     
code1 or ! use ( pe]-to-pe] file %>+    
s(tw>e2  7#b7 ! compliance ( a data     
brok] ) su* program2  7#c7 ! ext5t to   
:i* ! databases & sy/ems conta9+        
s5sitive p]sonally id5tifiable in=mation
 ( a data brok] h be5 compromis$ by     
security brea*es2 &  7#d7 ! response by 
a data brok] to su* brea*es1 includ+ !  
ef=ts by su* data brok] to mitigate !   
impact ( su* security brea*es4  7b7     
,compliance safe h>bor ,! data privacy &

 security program ( a data brok] %all be
 deem$ suffici5t = ! purposes (         
subsection 7a71 if ! data brok] complies
 ) or provides protection equal to      
indu/ry /&>ds1 z id5tifi$ by ! ,f$]al   
,trade ,commission1 t are applicable to 
! type ( s5sitive p]sonally id5tifiable 
in=mation involv$ 9 ! ord9>y c\rse (    
bus9ess ( su* data brok]4  7c7 ,p5alties
 ,9 aw>d+ contracts ) data brok]s =     
products or s]vices relat$ to access1   
use1 compilation1 di/ribution1 process+1
 analyz+1 or evaluat+ s5sitive p]sonally
 id5tifiable in=mation1 ! ,adm9i/rator (
 ! ,g5]al ,s]vices ,adm9i/ration %all-- 
7#a7 include monet>y or o!r p5alties--  
7,a7 = failure to comply ) subtitles ,a 
& ,b ( title ,,ii2 or  7,b7 if a        
contractor kn[s or has reason to "k t ! 
s5sitive p]sonally id5tifiable in=mation
 be+ provid$ is inaccurate1 & provides  
su* inaccurate in=mation2 &  7#b7       
require a data brok] t engages s]vice   
provid]s n subject to subtitle ,a (     
title ,,ii = responsibilities relat$ to 

s5sitive p]sonally id5tifiable in=mation
 to-- 7,a7 ex]cise appropriate due      
dilig5ce 9 select+ ^? s]vice provid]s = 
responsibilities relat$ to s5sitive     
p]sonally id5tifiable in=mation2  7,b7  
take reasonable /eps to select & reta9  
s]vice provid]s t are capable ( ma9ta9+ 
appropriate safegu>ds = ! security1     
privacy1 & integrity ( ! s5sitive       
p]sonally id5tifiable in=mation at      
issue2 &  7,c7 require su* s]vice       
provid]s1 by contract1 to implem5t &    
ma9ta9 appropriate measures design$ to  
meet ! objectives & requirem5ts 9 title 
,,ii4  7d7 ,limitation ,! p5alties "u   
subsection 7c7 %all n apply to a data   
brok] provid+ in=mation t is accurately 
& completely record$ f a public record  
s\rce or lic5sor4  #cjb4 ,requirem5t to 
audit in=mation security practices (    
contractors & ?ird-p>ty bus9ess entities
 ,section #cedd7;b7 ( title #dd1 ,unit$ 
,/ates ,code1 is am5d$-- 7#a7 9 p>agraph
 7#g77;,c77iii71 by /rik+ & aft] !      
semicolon2  7#b7 9 p>agraph 7#h71 by    

/rik+ ! p]iod & ins]t+ 2 &2 &  7#c7 by  
add+ at ! end ! foll[+3  7#i7 proc$ures 
= evaluat+ & audit+ ! in=mation security
 practices ( contractors or ?ird-p>ty   
bus9ess entities support+ ! in=mation   
sy/ems or op]ations ( ! ag5cy involv+   
s5sitive p]sonally id5tifiable in=mation
 7z t t]m is def9$ 9 section #c ( !     
,p]sonal ,data ,protection & ,brea*     
,acc\ntability ,act ( #bjad7 & ensur+   
rem$ial action to address any           
significant defici5cies4  4  #cjc4      
,privacy impact assessm5t ( gov]nm5t use
 ( comm]cial in=mation s]vices conta9+  
s5sitive p]sonally id5tifiable in=mation
  7a7 ,9 g5]al ,section #bjh7;b77#a7 ( !
 ,e-,gov]nm5t ,act ( #bjjb 7#dd         
,u4,s4,c4 #ceja note7 is am5d$ 9        
subp>agraph 7,a7-- 7#a7 9 clause 7i71 by
 /rik+ or2  7#b7 9 clause 7ii77,,ii71 by
 /rik+ ! p]iod & ins]t+ 2 or2 &  7#c7 by
 add+ at ! end ! foll[+3  7iii7 pur*as+ 
or subscrib+ = a fee to s5sitive        
p]sonally id5tifiable in=mation f a data
 brok] 7z su* t]ms are def9$ 9 section  

#c ( ! ,p]sonal ,data ,protection &     
,brea* ,acc\ntability ,act ( #bjad74  4 
7b7 ,limitation ,not)/&+ any o!r        
provision ( law1 beg9n+ #a ye> aft] !   
date ( enactm5t ( ?is ,act1 no ,f$]al   
ag5cy may ent] into a contract ) a data 
brok] to access = a fee any database    
consi/+ prim>ily ( s5sitive p]sonally   
id5tifiable in=mation conc]n+ ,unit$    
,/ates p]sons 7o!r ?an news report+ or  
telephone directories7 unless ! head ( !
 ag5cy-- 7#a7 completes a privacy impact
 assessm5t "u section #bjh ( !          
,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4
 #ceja note71 :i* %all subject to !     
provision 9 t ,act p]ta9+ to s5sitive   
in=mation1 include a description (--    
7,a7 su* database2  7,b7 ! "n ( ! data  
brok] f :om x is obta9$2 &  7,c7 ! am\nt
 ( ! contract = use2  7#b7 adopts       
regulations t specify-- 7,a7 ! p]sonnel 
p]mitt$ to access1 analyze1 or o!rwise  
use su* databases2  7,b7 /&>ds gov]n+ ! 
access1 analysis1 or use ( su*          
databases2  7,c7 any /&>ds us$ to ensure

 t ! s5sitive p]sonally id5tifiable     
in=mation access$1 analyz$1 or us$ is ! 
m9imum necess>y to accompli% ! int5d$   
legitimate purpose ( ! ,f$]al ag5cy2    
7,d7 /&>ds limit+ ! ret5tion &          
r$isclosure ( s5sitive p]sonally        
id5tifiable in=mation obta9$ f su*      
databases2  7,e7 proc$ures ensur+ t su* 
data meet /&>ds ( accuracy1 relevance1  
complet5ess1 & timel9ess2  7,f7 ! audit+
 & security measures to protect aga9/   
unau?oriz$ access1 analysis1 use1 or    
modification ( data 9 su* databases2    
7,g7 applicable me*anisms by :i*        
individuals may secure timely r$ress =  
any adv]se consequ5ces wrongly incurr$  
due to ! access1 analysis1 or use ( su* 
databases2  7,h7 me*anisms1 if any1 = ! 
en=cem5t & indep5d5t ov]sight ( exi/+ or
 plann$ proc$ures1 policies1 or         
guidel9es2 &  7,i7 an outl9e ( en=cem5t 
me*anisms = acc\ntability to protect    
individuals & ! public aga9/ unlawful or
 illegitimate access or use ( databases2
 &  7#c7 incorporates into ! contract or

 o!r agreem5t total+ m ?an #ejj1jjj1    
provisions-- 7,a7 provid+ = p5alties--  
7i7 = failure to comply ) title ,,ii (  
?is ,act2 or  7ii7 if ! entity kn[s or  
has reason to "k t ! s5sitive p]sonally 
id5tifiable in=mation be+ provid$ to !  
,f$]al dep>tm5t or ag5cy is inaccurate1 
& provides su* inaccurate in=mation2 &  
7,b7 requir+ a data brok] t engages     
s]vice provid]s n subject to subtitle ,a
 ( title ,,ii ( ?is ,act =              
responsibilities relat$ to s5sitive     
p]sonally id5tifiable in=mation to-- 7i7
 ex]cise appropriate due dilig5ce 9     
select+ ^? s]vice provid]s =            
responsibilities relat$ to s5sitive     
p]sonally id5tifiable in=mation2  7ii7  
take reasonable /eps to select & reta9  
s]vice provid]s t are capable ( ma9ta9+ 
appropriate safegu>ds = ! security1     
privacy1 & integrity ( ! s5sitive       
p]sonally id5tifiable in=mation at      
issue2 &  7iii7 require su* s]vice      
provid]s1 by contract1 to implem5t &    
ma9ta9 appropriate measures design$ to  

meet ! objectives & requirem5ts 9 title 
,,ii ( ?is ,act4  7c7 ,limitation on    
p5alties ,! p5alties "u subsection      
7b77#c77;,a7 %all n apply to a data     
brok] provid+ in=mation t is accurately 
& completely record$ f a public record  
s\rce4  7d7 ,/udy ( gov]nm5t use  7#a7  
,scope ( /udy ,n lat] ?an #ahj days aft]
 ! date ( enactm5t ( ?is ,act1 !        
,comptroll] ,g5]al ( ! ,unit$ ,/ates    
%all conduct a /udy & audit & prep>e a  
report on ,f$]al ag5cy actions to       
address ! recomm5dations 9 ! ,gov]nm5t  
,acc\ntability ,(fice's ,april #bjjf    
report on ag5cy adh]5ce to key privacy  
pr9ciples 9 us+ data brok]s or comm]cial
 databases conta9+ s5sitive p]sonally   
id5tifiable in=mation4  7#b7 ,report ,a 
copy ( ! report requir$ "u p>agraph 7#a7
 %all be submitt$ to ,congress4  #cjd4  
,,fbi report on report$ brea*es &       
compliance  7a7 ,9 g5]al ,n lat] ?an #a 
ye> aft] ! date ( enactm5t ( ?is ,act1 &
 ea* ye> !reaft]1 ! ,f$]al ,bureau (    
,inve/igation1 9 coord9ation ) ! ,secret

 ,s]vice1 %all submit to ! ,committee on
 ! ,judici>y ( ! ,s5ate & ! ,committee  
on ! ,judici>y ( ! ,h\se (              
,repres5tatives a report reg>d+ any     
report$ brea*es at ag5cies or bus9ess   
entities dur+ ! prec$+ ye>4  7b7 ,report
 cont5t ,su* report+ %all include-- 7#a7
 ! total in/ances ( brea*es ( security 9
 ! previ\s ye>2  7#b7 ! p]c5tage (      
brea*es describ$ 9 subsection 7a7 t     
occurr$ at an ag5cy or bus9ess entity t 
did n comply ) ! p]sonal data privacy & 
security program "u section #bjb2 &     
7#c7 recomm5dations1 if any1 = modify+  
or am5d+ ?is ,act to increase its       
effectiv5ess4  #cje4 ,dep>tm5t ( ,ju/ice
 report on en=cem5t actions ,section    
#ebi ( title #bh1 ,unit$ ,/ates ,code1  
is am5d$ by add+ at ! end ! foll[+3  7c7
 ,n lat] ?an #a ye> aft] ! date (       
enactm5t ( ! ,p]sonal ,data ,protection 
& ,brea* ,acc\ntability ,act ( #bjad1 & 
e fiscal ye> !reaft]1 ! ,attorney ,g5]al
 %all submit to ,congress a report on   
,f$]al en=cem5t actions1 ,/ate attorneys

 g5]al en=cem5t actions1 & private      
en=cem5t actions1 und]tak5 pursuant to !
 ,p]sonal ,data ,protection & ,brea*    
,acc\ntability ,act ( #bjad t %all      
include a description ( ! be/ practices 
= en=cem5t ( su* ,act z well z          
recomm5dations1 if any1 = modify+ or    
am5d+ ?is ,act to increase !            
effectiv5ess ( su* en=cem5t actions4  4 
#cjf4 ,report on notification           
effectiv5ess  7a7 ,9 g5]al ,n lat] ?an  
#a ye> aft] ! date ( enactm5t ( ?is     
,act1 & ea* ye> !reaft]1 ! designat$    
entity1 9 coord9ation ) ! ,attorney     
,g5]al & ! ,f$]al ,trade ,commission1   
%all submit to ! ,committee on !        
,judici>y ( ! ,s5ate & ! ,committee on !
 ,judici>y ( ! ,h\se ( ,repres5tatives a
 report reg>d+ ! effectiv5ess (         
po/-brea* notification practices by     
ag5cies & bus9ess entities4  7b7 ,report
 cont5t ,! report requir$ "u subsection 
7a7 %all include-- 7#a7 9 ea* in/ance ( 
a brea* ( security1 ! am\nt ( "t betwe5 
! in/ance ( ! brea* & ! discov]y ( !    

brea* by ! affect$ bus9ess entity2  7#b7
 9 ea* in/ance ( a brea* ( security1 !  
am\nt ( "t betwe5 ! discov]y ( ! brea*  
by ! affect$ bus9ess entity & !         
notification to ! ,f$]al ,bureau (      
,inve/igation & ! ,unit$ ,/ates ,secret 
,s]vice2 &  7#c7 9 ea* in/ance ( a brea*
 ( security1 ! am\nt ( "t betwe5 !      
discov]y ( ! brea* by ! affect$ bus9ess 
entity & ! notification to individuals  
^: s5sitive p]sonally id5tifiable       
in=mation 0 compromis$4  ,,iv           
,compliance ) ,/atutory ,pay-,z-,y-,g   
,act  #dja4 ,budget compliance ,!       
budget>y effects ( ?is ,act1 = ! purpose
 ( comply+ ) ! ,/atutory ,pay-,z-,y-,g  
,act ( #bjaj1 %all be det]m9$ by ref]5ce
 to ! late/ /atem5t titl$ ,budget>y     
,effects ( ,,paygo ,legislation = ?is   
,act1 submitt$ = pr9t+ 9 !              
,congressional ,record by ! ,*airman ( !
 ,s5ate ,budget ,committee1 provid$ t   
su* /atem5t has be5 submitt$ prior to ! 
vote on passage4