,,ib  ,union ,cal5d> ,no4 #gai  #aad?   
,,congress  #b;d ,session  ,h4 ,r4 #aggj
  ,report ,no4 #aad-ijh  ,,9 ,,! ,,h\se 
,,( ,,repres5tatives  ,april #ad1 #bjae 
,mrs4 ,blackburn 7= h]self1 ,mr4 ,wel*1 
,mr4 ,burgess1 & ,mr4 ,upton7 introduc$ 
! foll[+ bill2 :i* 0 ref]r$ to !        
,committee on ,en]gy & ,comm]ce  ,janu>y
 #c1 #bjag ,report$ ) an am5dm5t1       
committ$ to ! ,committee ( ! ,:ole ,h\se
 on ! ,/ate ( ! ,union1 & ord]$ to be   
pr9t$ ,/rike out all aft] ! enact+      
clause & ins]t ! "p pr9t$ 9 italic ,=   
text ( introduc$ bill1 see copy ( bill z
 introduc$ on ,april #ad1 #bjae  ,a     
,,bill  ,to require c]ta9 entities :o   
collect & ma9ta9 p]sonal in=mation (    
individuals to secure su* in=mation & to
 provide notice to su* individuals 9 !  
case ( a brea* ( security involv+ su*   
in=mation1 & = o!r purposes4  #a4 ,%ort 
title2 purposes  7a7 ,%ort title ,?is   
,act may be cit$ z ! ,data ,security &  
,brea* ,notification ,act ( #bjae4  7b7 
,purposes ,! purposes ( ?is ,act are    

to--  7#a7 protect consum]s f id5tity   
!ft1 economic loss or economic h>m1 &   
f9ancial fraud by e/abli%+ /rong & uni=m
 national data security & brea*         
notification /&>ds = electronic data 9  
int]/ate comm]ce :ile m9imiz+ ,/ate law 
burd5s t may sub/antially affect        
int]/ate comm]ce2 &  7#b7 expressly     
preempt any relat$ ,/ate laws to ensure 
uni=mity ( ?is ,act's /&>ds & !         
consi/5cy ( _! application across       
jurisdictions4  #b4 ,requirem5ts =      
in=mation security ,a cov]$ entity %all 
implem5t & ma9ta9 reasonable security   
measures & practices to protect & secure
 p]sonal in=mation 9 electronic =m aga9/
 unau?oriz$ access & acquisition z      
appropriate = ! size & complexity ( su* 
cov]$ entity & ! nature & scope ( its   
activities4  #c4 ,notification (        
in=mation security brea*  7a7 ,9 g5]al  
7#a7 ,re/or+ security ,except z o!rwise 
provid$ by ?is section1 a cov]$ entity t
 uses1 accesses1 transmits1 /ores1      
disposes (1 or collects p]sonal         

in=mation %all1 foll[+ ! discov]y ( a   
brea* ( security re/ore ! reasonable    
integrity1 security1 & confid5tiality ( 
! data sy/em & id5tify ! impact ( !     
brea* pursuant to p>agraph 7#b74  7#b7  
,inve/igation ,a cov]$ entity %all      
conduct 9 good fai? a reasonable &      
prompt inve/igation ( ! brea* ( security
 to det]m9e :e!r !re is a reasonable    
risk t ! brea* ( security has result$ 91
 or w result 91 id5tity !ft1 economic   
loss or economic h>m1 or f9ancial fraud 
to ! individuals ^: p]sonal in=mation 0 
subject to ! brea* ( security4  7#c7    
,notification to individuals requir$    
7,a7 ,trigg] ,unless !re is no          
reasonable risk t ! brea* ( security has
 result$ 91 or w result 91 id5tity !ft1 
economic loss or economic h>m1 or       
f9ancial fraud to ! individuals ^:      
p]sonal in=mation 0 affect$ by ! brea* (
 security1 ! cov]$ entity %all notify   
any resid5t ( ! ,unit$ ,/ates t has be5 
affect$ by ! brea* ( security pursuant  
to ?is section4  7,b7 ,notification duty

 ,unless subject to a delay au?oriz$ "u 
subsection 7c7-- 7i7 a brea*$ cov]$     
entity %all notify any individual = :om 
an election 0 n made "u p>agraph        
7#d77;,c7 n lat] ?an #be days aft] !    
non-brea*$ cov]$ entity decl9es or fails
 to ex]cise ! election "u p>agraph      
7#d77;,c72  7ii7 a non-brea*$ cov]$     
entity %all notify any individual = :om 
! non-brea*$ cov]$ entity provid$       
p]sonal in=mation to ! brea*$ cov]$     
entity1 & su* p]sonal in=mation 0       
affect$ by ! brea* ( security1 n lat]   
?an #be days aft] ex]cis+ ! election "u 
p>agraph 7#d77;,c72 &  7iii7 any o!r    
cov]$ entity %all id5tify ! individuals 
affect$ by a brea* ( security & make !  
notification requir$ "u ?is subsection z
 exp$iti\sly z possible1 )\t            
unreasonable delay1 & n lat] ?an #cj    
days aft] complet+ ! requirem5ts (      
p>agraph 7#a74  7,c7 ,notification      
requir$ ^u discov]y ( additional        
individuals affect$ ,if a cov]$ entity1 
brea*$ cov]$ entity1 or non-brea*$ cov]$

 entity has provid$ ! notification to   
individuals requir$ "u ?is subsection & 
aft] su* notification discov]s          
additional individuals to :om           
notification is requir$ "u ?is          
subsection ) respect to ! same brea* (  
security1 ! cov]$ entity1 brea*$ cov]$  
entity1 or non-brea*$ cov]$ entity %all 
make su* notification to su* individuals
 z exp$iti\sly z possible & )\t         
unreasonable delay4  7#d7 ,non-brea*$   
cov]$ entity election notice  7,a7      
,notice to non-brea*$ cov]$ entity      
requir$ ,subject to ! requirem5ts ( ?is 
p>agraph1 unless !re is no reasonable   
risk t ! brea* ( security has result$ 91
 or w result 91 id5tity !ft1 economic   
loss or economic h>m1 or f9ancial fraud 
relat$ to ! p]sonal in=mation provid$ by
 ! non-brea*$ cov]$ entity to ! brea*$  
cov]$ entity1 ! brea*$ cov]$ entity     
%all1 z exp$iti\sly z possible & )\t    
unreasonable delay )9 #aj days aft]     
fulfill+ ! requirem5ts describ$ 9       
p>agraph 7#a71 notify 9 writ+ ea*       

non-brea*$ cov]$ entity ( ! brea* (     
security4  7,b7 ,cont5ts ( notice ,!    
brea*$ cov]$ entity %all include 9 !    
notice describ$ 9 subp>agraph 7,a7 !    
elem5ts ( p]sonal in=mation receiv$ f ! 
non-brea*$ cov]$ entity pursuant to !   
contract describ$ 9 subp>agraph 7,c7    
reasonably believ$ to be affect$ by !   
brea* ( security4  7,c7 ,election by    
non-brea*$ cov]$ entity aft] receiv+    
notice f a brea*$ cov]$ entity ,9 ! case
 ( a brea*$ cov]$ entity t is a p>ty to 
a writt5 contract ) a non-brea*$ cov]$  
entity 9 :i* ! brea*$ cov]$ entity      
ma9ta9s1 /ores1 transmits1 or processes 
data 9 electronic =m conta9+ p]sonal    
in=mation1 n lat] ?an #aj days aft]     
receipt ( ! notice describ$ 9           
subp>agraph 7,a71 ! non-brea*$ cov]$    
entity may elect1 9 writ+ to ! brea*$   
cov]$ entity1 to provide notification   
requir$ by p>agraph 7#c7 all individuals
 ^: p]sonal in=mation 0 provid$ by !    
non-brea*$ cov]$ entity to ! brea*$     
cov]$ entity & 0 affect$ by ! brea* (   

security4 ,su* election relieves !      
brea*$ cov]$ entity ( ! requirem5ts "u  
p>agraph 7#c7 ) respect to su*          
individuals4  7,d7 ,obligation aft]     
election  7i7 ,brea*$ cov]$ entity      
coop]ation ,if a non-brea*$ cov]$ entity
 elects "u subp>agraph 7,c7 to provide  
notice "u p>agraph 7#c71 ! brea*$ cov]$ 
entity %all coop]ate 9 all reasonable   
respects ) ! non-brea*$ cov]$ entity &  
provide any ( ! in=mation ! brea*$ cov]$
 entity possesses t is describ$ "u      
subsection 7d77#a77;,b7 & provide all   
p]sonal in=mation receiv$ f ! non-brea*$
 cov]$ entity t 0 affect$ by ! brea* (  
security s t ! notification to su*      
individuals is made z requir$ "u ?is    
section4 ,n lat] ?an #aj bus9ess days   
aft] ! non-brea*$ cov]$ entity submits a
 writt5 reque/ = in=mation reque/$ "u   
?is subsection to ! brea*$ cov]$ entity1
 ! brea*$ cov]$ entity %all provide su* 
in=mation4  7ii7 ,non-brea*$ cov]$      
entity coop]ation ,if a non-brea*$ cov]$
 entity does n elect to provide notice  

to individuals "u subp>agraph 7,c71 !   
non-brea*$ cov]$ entity %all provide any
 ( ! in=mation ! non-brea*$ cov]$ entity
 possesses t is describ$ "u subsection  
7d77#a77;,b7 = any individual ^: p]sonal
 in=mation 0 receiv$ f ! non-brea*$     
cov]$ entity t 0 affect$ by ! brea* (   
security1 & coop]ate 9 all reasonable   
respects )1 ! brea*$ cov]$ entity s t ! 
notification to su* individuals is made 
z requir$ "u ?is section4 ,n lat] ?an   
#aj bus9ess days aft] ! brea*$ cov]$    
entity submits a writt5 reque/ =        
in=mation reque/$ "u ?is subsection to !
 non-brea*$ cov]$ entity1 ! non-brea*$  
cov]$ entity %all provide su* in=mation4
  7#e7 ,law en=cem5t ,a cov]$ entity    
%all z exp$iti\sly z possible notify !  
,commission & ! ,secret ,s]vice or !    
,f$]al ,bureau ( ,inve/igation ( ! fact 
t a brea* ( security has occurr$ if !   
numb] ( individuals ^: p]sonal in=mation
 01 or !re is a reasonable basis to     
conclude 01 access$ & acquir$ by an     
unau?oriz$ p]son exce$s #aj1jjj4 ,any   

notification provid$ to ! ,secret       
,s]vice or ! ,f$]al ,bureau (           
,inve/igation pursuant to ?is p>agraph  
%all be provid$ n less ?an #aj days be=e
 notification is provid$ to individuals 
pursuant to p>agraph 7#c74  7b7 ,special
 notification requirem5ts  7#a7         
,non-pr(it organizations ,9 ! ev5t ( a  
brea* ( security involv+ p]sonal        
in=mation t w\ld trigg] notification "u 
subsection 7a71 a non-pr(it organization
 may complete su* notification accord+  
to ! proc$ures set =? 9 subsection      
7d77#b74  7#b7 ,coord9ation (           
notification ) consum] report+ ag5cies  
,if a cov]$ entity is requir$ to provide
 notification to m ?an #aj1jjj          
individuals "u subsection 7a71 su* cov]$
 entity %all also notify a consum]      
report+ ag5cy t compiles & ma9ta9s files
 on consum]s on a nationwide basis1 ( ! 
tim+ & di/ribution ( ! notices4 ,su*    
notice %all be giv5 to su* consum]      
report+ ag5cies )\t unreasonable delay  
&1 if x w n delay notice to ! affect$   

individuals1 prior to ! di/ribution (   
notices to ! affect$ individuals4  7c7  
,delay ( notification au?oriz$ = law    
en=cem5t or national security purposes  
,not)/&+ p>agraph 7#a71 if a ,f$]al1    
,/ate1 or local law en=cem5t ag5cy      
det]m9es t ! notification to individuals
 requir$ "u ?is section w\ld imp$e a    
civil or crim9al inve/igation or a      
,f$]al ag5cy det]m9es t su* notification
 w\ld ?reat5 national security1 su*     
notification %all be delay$ ^u writt5   
reque/ ( ! law en=cem5t ag5cy or ,f$]al 
ag5cy :i* ! law en=cem5t ag5cy or ,f$]al
 ag5cy det]m9es is reasonably necess>y &
 reque/s 9 writ+4 ,a law en=cem5t ag5cy 
or ,f$]al ag5cy may1 by a subsequ5t     
writt5 reque/1 revoke su* delay or ext5d
 ! p]iod ( "t set =? 9 ! orig9al reque/ 
made "u ?is p>agraph if fur!r delay is  
necess>y4 ,if a law en=cem5t ag5cy or   
,f$]al ag5cy reque/s a delay (          
notification to individuals "u ?is      
p>agraph1 ! ,commission %all1 ^u writt5 
reque/ ( ! law en=cem5t ag5cy or ,f$]al 

ag5cy1 delay any public disclosure ( a  
notification receiv$ by ! ,commission "u
 ?is section relat+ to ! same brea* (   
security until ! delay ( notification to
 individuals is no long] 9 effect4  7d7 
,me?od & cont5t ( notification  7#a7    
,direct notification  7,a7 ,me?od (     
notification ,a cov]$ entity requir$ to 
provide notification to an individual "u
 subsection 7a7 %all be 9 compliance )  
su* requirem5t if ! cov]$ entity        
provides su* notice by "o ( ! foll[+    
me?ods 7if ! select$ me?od c reasonably 
be expect$ to rea* ! int5d$ individual73
  7i7 ,writt5 notification by po/al     
mail4  7ii7 ,notification by email or   
o!r electronic means1 if ! cov]$        
entity's prim>y me?od ( communication ) 
! individual is by email or su* o!r     
electronic means or ! individual has    
cons5t$ to receive su* notification4    
7,b7 ,cont5t ( notification ,reg>dless (
 ! me?od by :i* notification is provid$ 
to an individual "u subp>agraph 7,a7 )  
respect to a brea* ( security1 su*      

notification %all include ea* ( !       
foll[+3  7i7 ,! id5tity ( ! cov]$ entity
 t suff]$ ! brea* &1 if su* cov]$ entity
 is also a brea*$ cov]$ entity provid+  
notice "u section #c7;b77#a71 ! id5tity 
( ea* non-brea*$ cov]$ entity t did n   
elect to notify affect$ individuals     
pursuant to section #c7;b77#a77;,b7     
suffici5t to %[ ! brea*$ cov]$ entity's 
comm]cial relation%ip to ! individual   
receiv+ notice4  7ii7 ,a description ( !
 p]sonal in=mation t 01 or !re is a     
reasonable basis to conclude 01 acquir$ 
& access$ by an unau?oriz$ p]son4  7iii7
 ,! date range ( ! brea* ( security1 or 
an approximate date range ( ! brea* (   
security if a specific date range is    
unkn[n bas$ on ! in=mation available at 
! "t ( ! notification4  7iv7 ,a         
telephone numb]1 or toll-free telephone 
numb] = any cov]$ entity t does n meet !
 def9ition ( a small bus9ess conc]n or  
non-pr(it organization1 t ! individual  
may use to contact ! cov]$ entity to    
inquire ab\t ! brea* ( security or !    

in=mation ! cov]$ entity ma9ta9$ ab\t t 
individual4  7v7 ,! toll-free contact   
telephone numb]s & addresses = a consum]
 report+ ag5cy t compiles & ma9ta9s     
files on consum]s on a nationwide basis4
  7vi7 ,! toll-free telephone numb] &   
,int]net website address = ! ,commission
 :]eby ! individual may obta9 in=mation 
reg>d+ id5tity !ft4  7#b7 ,sub/itute    
notification  7,a7 ,9 g5]al ,if1 aft]   
mak+ reasonable ef=ts to contact all    
individuals to :om notice is requir$ "u 
subsection 7a71 ! cov]$ entity f9ds t   
contact in=mation = #ejj or m           
individuals is insuffici5t or           
out-(-date1 ! cov]$ entity %all also    
provide sub/itute notice to ^?          
individuals1 :i* %all be reasonably     
calculat$ to rea* ! individuals affect$ 
by ! brea* ( security4  7,b7 ,=m (      
sub/itute notification ,a cov]$ entity  
may provide sub/itute notification by-- 
7i7 email or o!r electronic notification
 to ! ext5t t ! cov]$ entity has contact
 in=mation = individuals to :om x is    

requir$ to provide notification "u      
subsection 7a72 &  7ii7 a conspicu\s    
notice on ! cov]$ entity's ,int]net     
website 7if su* cov]$ entity ma9ta9s su*
 a website7 = at lea/ #ij days4  7,c7   
,cont5t ( sub/itute notice ,ea* =m (    
sub/itute notice "u clauses 7i7 & 7ii7 (
 subp>agraph 7,b7 %all include !        
in=mation requir$ "u p>agraph 7#a77;,b74
  7#c7 ,direct notification by a ?ird   
p>ty ,no?+ 9 ?is ,act %all be con/ru$ to
 prev5t a cov]$ entity f contract+ ) a  
?ird p>ty to provide ! notification     
requir$ "u ?is section1 provid$ su* ?ird
 p>ty issues su* notification )\t       
unreasonable delay1 9 accordance ) !    
requirem5ts ( ?is section1 & indicates  
to all individuals 9 su* notification t 
su* ?ird p>ty is s5d+ su* notification  
on behalf ( ! cov]$ entity4  7e7        
,requirem5ts ( s]vice provid]s  7#a7 ,9 
g5]al ,if a s]vice provid] becomes aw>e 
( a brea* ( security involv+ data 9     
electronic =m conta9+ p]sonal in=mation 
t is own$ or lic5s$ by a cov]$ entity t 

connects to or uses a sy/em or network  
provid$ by ! s]vice provid] = ! purpose 
( transmitt+1 r\t+1 or provid+          
int]m$iate or transi5t /orage ( su*     
data1 su* s]vice provid] %all notify !  
cov]$ entity :o initiat$ su* connection1
 transmission1 r\t+1 or /orage ( ! data 
conta9+ p]sonal in=mation brea*$1 if su*
 cov]$ entity c be reasonably id5tifi$4 
,if a s]vice provid] is act+ solely z a 
s]vice provid] = purposes ( ?is         
subsection1 ! s]vice provid] has no o!r 
notification obligations "u ?is section4
  7#b7 ,cov]$ entities :o receive notice
 f s]vice provid]s ,^u receiv+          
notification f a s]vice provid] "u      
p>agraph 7#a71 a cov]$ entity %all      
provide notification z requir$ "u ?is   
section4  #d4 ,en=cem5t  7a7 ,en=cem5t  
by ! ,f$]al ,trade ,commission  7#a7    
,unfair or deceptive acts or practices  
,a violation ( section #b or #c %all be 
treat$ z an unfair & deceptive act or   
practice 9 violation ( a regulation "u  
section #ah7;a77#a77;,b7 ( ! ,f$]al     

,trade ,commission ,act 7#ae ,u4,s4,c4  
#eg;a7a77#a77;,b77 reg>d+ unfair or     
deceptive acts or practices4  7#b7 ,p[]s
 ( commission ,! ,commission %all en=ce 
?is ,act 9 ! same mann]1 by ! same      
means1 & ) ! same jurisdiction1 p[]s1 & 
duties z ?\gh all applicable t]ms &     
provisions ( ! ,f$]al ,trade ,commission
 ,act 7#ae ,u4,s4,c4 #da et seq47 7     
incorporat$ into & made a "p ( ?is ,act1
 & any cov]$ entity :o violates ?is ,act
 %all be subject to ! p5alties & entitl$
 to ! privileges & immunities provid$ 9 
! ,f$]al ,trade ,commission ,act 7#ae   
,u4,s4,c4 #da et seq471 & z provid$ 9   
clauses 7ii7 & 7iii7 ( section          
#e7e77;,a74 ,not)/&+ section #e7m7 ( !  
,f$]al ,trade ,commission ,act1 !       
,commission may impose civil p5alties = 
violations ( section #c 9 an am\nt n    
great] ?an #a1jjj p] violation4 ,ea*    
failure to s5d notification z requir$ "u
 section #c to a resid5t ( ! ,unit$     
,/ates %all be treat$ z a sep>ate       
violation4  7#c7 ,maximum total         

liability = fir/-"t violation ( section 
#b ,! maximum total civil p5alty = :i*  
any cov]$ entity is liable "u ?is       
subsection = all violations ( section #b
 result+ f ! same relat$ act or omission
 may n exce$ #h1gfj1jjj1 if su* act or  
omission con/itutes ! cov]$ entity's    
fir/ violation ( section #b4  7#d7      
,maximum total liability = fir/-"t      
violation ( section #c ,! maximum total 
civil p5alty = :i* any cov]$ entity is  
liable "u ?is subsection = all          
violations ( section #c result+ f ! same
 relat$ act or omission may n exce$     
#ag1ebj1jjj1 if su* act or omission     
con/itutes ! cov]$ entity's fir/        
violation ( section #c4  7b7 ,en=cem5t  
by ,/ate attorneys g5]al  7#a7 ,civil   
action ,9 any case 9 :i* ! attorney     
g5]al ( a ,/ate has reason to believe t 
an int]e/ ( ! resid5ts ( t ,/ate has be5
 or is ?reat5$ or adv]sely affect$ by   
any cov]$ entity :o violates section #b 
or #c ( ?is ,act1 ! attorney g5]al ( !  
,/ate1 z p>5s patriae1 may br+ a civil  

action on behalf ( ! resid5ts ( ! ,/ate 
9 a di/rict c\rt ( ! ,unit$ ,/ates (    
appropriate jurisdiction to--  7,a7     
enjo9 fur!r violation ( su* section by !
 def5dant2  7,b7 compel compliance ) su*
 section2 or  7,c7 obta9 civil p5alties 
9 ! am\nt det]m9$ "u p>agraph 7#b74     
7#b7 ,civil p5alties  7,a7 ,calculation 
7i7 ,treatm5t ( violations ( section #b 
,= purposes ( p>agraph 7#a77;,c7 ) reg>d
 to all violations ( section #b result+ 
f ! same relat$ act or omission1 ! am\nt
 det]m9$ "u ?is p>agraph is ! am\nt     
calculat$ by multiply+ ! numb] ( days t 
a cov]$ entity is n 9 compliance ) su*  
section by an am\nt n great] ?an        
#aa1jjj4  7ii7 ,treatm5t ( violations ( 
section #c ,= purposes ( p>agraph       
7#a77;,c7 ) reg>d to a violation (      
section #c1 ! am\nt det]m9$ "u ?is      
p>agraph is ! am\nt calculat$ by        
multiply+ ! numb] ( violations ( su*    
section by an am\nt n great] ?an #a1jjj4
 ,ea* failure to s5d notification z     
requir$ "u section #c to a resid5t ( !  

,/ate %all be treat$ z a sep>ate        
violation4  7,b7 ,maximum total         
liability ,not)/&+ ! numb] ( actions :i*
 may be br\ght aga9/ a cov]$ entity "u  
?is subsection1 ! maximum civil p5alty =
 :i* any cov]$ entity may be liable "u  
?is subsection %all n exce$--  7i7      
#b1ejj1jjj = ea* violation ( section #b2
 &  7ii7 #b1ejj1jjj = all violations (  
section #c result+ f a s+le brea* (     
security4  7,c7 ,adju/m5t = inflation   
,beg9n+ on ! date t ! ,consum] ,price   
,index is fir/ publi%$ by ! ,bureau (   
,labor ,/ati/ics t is aft] "o ye> aft] !
 date ( enactm5t ( ?is ,act1 & ea* ye>  
!reaft]1 ! am\nts specifi$ 9 clauses 7i7
 & 7ii7 ( subp>agraph 7,a7 & clauses 7i7
 & 7ii7 ( subp>agraph 7,b7 %all be      
increas$ by ! p]c5tage increase 9 !     
,consum] ,price ,index publi%$ on t date
 f ! ,consum] ,price ,index publi%$ !   
previ\s ye>4  7,d7 ,p5alty factors ,9   
det]m9+ ! am\nt ( su* a civil p5alty1 ! 
degree ( culpability1 any hi/ory ( prior
 su* conduct1 ability to pay1 effect on 

ability to cont9ue to d bus9ess1 & su*  
o!r matt]s z ju/ice may require %all be 
tak5 into acc\nt4  7#c7 ,int]v5tion by !
 ,f$]al ,trade ,commission  7,a7 ,notice
 & int]v5tion ,9 all cases1 ! ,/ate %all
 provide prior writt5 notice ( any      
action "u p>agraph 7#a7 to ! ,commission
 & provide ! ,commission ) a copy ( its 
compla9t1 except 9 any case 9 :i* su*   
prior notice is n feasible1 9 :i* case !
 ,/ate %all s]ve su* notice imm$iately  
^u in/itut+ su* action4 ,! ,commission  
%all h ! "r--  7i7 to int]v5e 9 !       
action2  7ii7 ^u s int]v5+1 to be he>d  
on all matt]s aris+ !re92 &  7iii7 to   
file petitions = appeal4  7,b7 ,p5d+    
proce$+s ,if ! ,f$]al ,trade ,commission
 initiates a ,f$]al civil action = a    
violation ( ?is ,act1 no ,/ate attorney 
g5]al may br+ an action = a violation ( 
?is ,act t result$ f ! same or relat$   
acts or omissions aga9/ a def5dant nam$ 
9 ! civil action initiat$ by ! ,f$]al   
,trade ,commission4  7#d7 ,con/ruction  
,= purposes ( br++ any civil action "u  

p>agraph 7#a71 no?+ 9 ?is ,act %all be  
con/ru$ to prev5t an attorney g5]al ( a 
,/ate f ex]cis+ ! p[]s conf]r$ on !     
attorney g5]al by ! laws ( t ,/ate to-- 
7,a7 conduct inve/igations2  7,b7       
adm9i/] oa?s or affirmations2 or  7,c7  
compel ! att5dance ( witnesses or !     
production ( docum5t>y & o!r evid5ce4   
7c7 ,no private cause ( action ,no?+ 9  
?is ,act %all be con/ru$ to e/abli% a   
private cause ( action aga9/ a p]son = a
 violation ( ?is ,act4  #e4 ,def9itions 
,9 ?is ,act3 7#a7 ,brea* ( security ,!  
t]m brea* ( security--  7,a7 means a    
compromise ( ! security1 confid5tiality1
 or integrity (1 or loss (1 data 9      
electronic =m t results 91 or !re is a  
reasonable basis to conclude has result$
 91 unau?oriz$ access to & acquisition (
 p]sonal in=mation f a cov]$ entity2 &  
7,b7 does n include ! good fai?         
acquisition ( p]sonal in=mation by an   
employee or ag5t ( ! cov]$ entity = !   
purposes ( ! cov]$ entity1 if ! p]sonal 
in=mation is n us$ or subject to fur!r  

unau?oriz$ disclosure4  7#b7 ,brea*$    
cov]$ entity ,! t]m brea*$ cov]$ entity 
means a cov]$ entity t has incurr$ a    
brea* ( security affect+ data 9         
electronic =m conta9+ p]sonal in=mation 
( a non-brea*$ cov]$ entity t has       
directly contract$ ! brea*$ cov]$ entity
 to ma9ta91 /ore1 or process data 9     
electronic =m conta9+ p]sonal in=mation 
on behalf ( su* non-brea*$ cov]$ entity4
 ,= purposes ( ?is def9ition1 ! t]m     
brea*$ cov]$ entity %all n include a    
s]vice provid] t is subject to section  
#c7;e74  7#c7 ,commission ,! t]m        
,commission means ! ,f$]al ,trade       
,commission4  7#d7 ,consum] report+     
ag5cy t compiles & ma9ta9s files on     
consum]s on a nationwide basis ,! t]m   
consum] report+ ag5cy t compiles &      
ma9ta9s files on consum]s on a          
nationwide basis has ! mean+ giv5 t t]m 
9 section #fjc7p7 ( ! ,fair ,cr$it      
,report+ ,act 7#ae ,u4,s4,c4            
#afha;a7p774  7#e7 ,cov]$ entity  7,a7  
,9 g5]al ,! t]m cov]$ entity means-- 7i7

 a sole proprietor%ip1 p>tn]%ip1        
corporation1 tru/1 e/ate1 coop]ative1   
association1 or o!r entity 9 or affect+ 
comm]ce t acquires1 ma9ta9s1 /ores1     
sells1 or o!rwise uses data 9 electronic
 =m t includes p]sonal in=mation1 ov]   
:i* ! ,commission has au?ority pursuant 
to section #e7;a77#b7 ( ! ,f$]al ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b772  7ii7 not)/&+ section     
#e7;a77#b7 ( ! ,f$]al ,trade ,commission
 ,act 7#ae ,u4,s4,c4 #de7;a77#b771      
common c>ri]s subject to !              
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq472 &  7iii7       
not)/&+ any jurisdictional limitation ( 
! ,f$]al ,trade ,commission ,act 7#ae   
,u4,s4,c4 #da et seq471 any non-pr(it   
organization4  7,b7 ,exceptions ,! t]m  
cov]$ entity does n include-- 7i7 a     
cov]$ entity1 z def9$ 9 section #afj4ajc
 ( title #de1 ,code ( ,f$]al            
,regulations2  7ii7 a bus9ess associate1
 z def9$ 9 section #afj4ajc ( title #de1
 ,code ( ,f$]al ,regulations1 act+ 9 its

 capacity z a bus9ess associate2  7iii7 
if a cov]$ entity1 z def9$ 9 section    
#afj4ajc ( title #de1 ,code ( ,f$]al    
,regulations1 is a hybrid entity1 z     
def9$ 9 section #afd4aje ( title #de1   
,code ( ,f$]al ,regulations1 !n ! heal? 
c>e compon5t ( su* hybrid entity2  7iv7 
a brok]1 deal]1 inve/m5t advis]1 futures
 commission m]*ant1 special purpose     
vehicle1 f9ance company1 or p]son engag$
 9 provid+ insurance t is subject to    
title ,v ( ,public ,law #ajf-ajb 7#ae   
,u4,s4,c4 #fhja et seq472  7v7 a        
,/ate-*>t]$ cr$it union1 z def9$ 9      
section #aja7f7 ( ! ,f$]al ,cr$it ,union
 ,act 7#ab ,u4,s4,c4 #ageb7f771 t is n  
an insur$ cr$it union z def9$ 9 section 
#aja7g7 ( su* ,act 7#ab ,u4,s4,c4       
#ageb7g772 or  7vi7 a cr$it union s]vice
 organization z outl9$ 9 section        
#ajf7g77;,i7 ( ! ,f$]al ,cr$it ,union   
,act 7#ab ,u4,s4,c4 #ageg7g77;,i774     
7#f7 ,data 9 electronic =m ,! t]m data 9
 electronic =m means any data /or$      
electronically or digitally on any      

comput] sy/em or o!r database & includes
 recordable tapes & o!r mass /orage     
devices4  7#g7 ,encrypt$ ,! t]m         
encrypt$1 us$ ) respect to data 9       
electronic =m1 9 /orage or 9 transit--  
7,a7 means ! data is protect$ us+ an    
encryption te*nology t has be5 g5]ally  
accept$ by exp]ts 9 ! field ( in=mation 
security at ! "t ! brea* ( security     
occurr$ t r5d]s su* data indeciph]able 9
 ! abs5ce ( associat$ cryptographic keys
 necess>y to enable decryption ( su*    
data2 &  7,b7 includes appropriate      
managem5t & safegu>ds ( su*             
cryptographic keys 9 ord] to protect !  
integrity ( ! encryption4  7#h7         
,non-brea*$ cov]$ entity ,! t]m         
non-brea*$ cov]$ entity means a cov]$   
entity t has n incurr$ ! brea* (        
security involv+ data 9 electronic =m   
conta9+ p]sonal in=mation t x owns or   
lic5ses b ^: data has be5 affect$ by !  
brea* ( security incurr$ by a brea*$    
cov]$ entity x directly contracts to    
ma9ta91 /ore1 or process data 9         

electronic =m conta9+ p]sonal in=mation 
on behalf ( ! non-brea*$ cov]$ entity4  
7#i7 ,non-pr(it organization ,! t]m     
non-pr(it organization means an         
organization t is describ$ 9 section    
#eja7;c77#c7 ( ! ,int]nal ,rev5ue ,code 
( #aihf & exempt f tax "u section       
#eja7;a7 ( su* ,code4  7#aj7 ,p]sonal   
in=mation  7,a7 ,9 g5]al ,! t]m p]sonal 
in=mation means any in=mation or        
compilation ( in=mation 9 electronic =m 
t includes ! foll[+3  7i7 ,an           
individual's fir/ & la/ "n or fir/      
initial & la/ "n 9 comb9ation ) all ( ! 
foll[+3  7,i7 ,home address or telephone
 numb]4  7,,ii7 ,"m's maid5 "n1 if      
id5tifi$ z su*4  7,,iii7 ,mon?1 day1 &  
ye> ( bir?4  7ii7 ,a f9ancial acc\nt    
numb] or cr$it or debit c>d numb] or o!r
 id5tifi]1 9 comb9ation ) any security  
code1 access code1 or password t is     
requir$ = an individual to obta9 cr$it1 
)draw funds1 or engage 9 a f9ancial     
transaction4  7iii7 ,a unique acc\nt    
id5tifi] 7o!r ?an = an acc\nt describ$ 9

 clause 7ii771 electronic id5tification 
numb]1 biometric data unique to an      
individual1 us] "n1 or r\t+ code 9      
comb9ation ) any associat$ security     
code1 access code1 biometric data unique
 to an individual1 or password t is     
requir$ = an individual to obta9 money1 
or pur*ase goods1 s]vices1 or any o!r ?+
 ( value4  7iv7 ,a non-truncat$ social  
security numb]4  7v7 ,any in=mation t   
p]ta9s to ! transmission ( specific     
calls1 includ+1 = outb\nd calls1 ! numb]
 call$1 & ! "t1 location1 or duration ( 
any call &1 = inb\nd calls1 ! numb] f   
:i* ! call 0 plac$1 & ! "t1 location1 or
 duration ( any call4  7vi7 ,a us] "n or
 email address1 9 comb9ation ) a        
password or security "q & answ] t w\ld  
p]mit access to an onl9e acc\nt4  7vii7 
,a driv]'s lic5se numb]1 passport numb]1
 or ali5 regi/ration numb] or o!r       
gov]nm5t-issu$ unique id5tification     
numb]4  7,b7 ,exceptions ,! t]m p]sonal 
in=mation does n include-- 7i7 in=mation
 t is encrypt$ or r5d]$ unusable1       

unreadable1 or indeciph]able ?r\gh data 
security te*nology or me?odology t is   
g5]ally accept$ by exp]ts 9 ! field (   
in=mation security at ! "t ! brea* (    
security occurr$1 su* z r$action or     
access controls2 or  7ii7 in=mation     
available 9 a publicly available s\rce1 
includ+ in=mation obta9$ f a news       
report1 p]iodical1 or o!r widely        
di/ribut$ m$ia1 or f ,f$]al1 ,/ate1 or  
local gov]nm5t records4  7#aa7 ,s]vice  
provid] ,! t]m s]vice provid] means a   
cov]$ entity subject to !               
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq47 t provides      
electronic data transmission1 r\t+1     
int]m$iate & transi5t /orage1 or        
connection to its sy/em or network1 :]e 
su* entity provid+ su* s]vice does n    
select or modify ! cont5t ( ! electronic
 data1 is n ! s5d] or ! int5d$ recipi5t 
( ! data1 & does n diff]5tiate p]sonal  
in=mation f o!r in=mation t su* entity  
transmits1 r\tes1 /ores1 or = :i* su*   
entity provides connections4 ,any su*   

entity %all be treat$ z a s]vice provid]
 "u ?is ,act only to ! ext5t t x is     
engag$ 9 ! provision ( su* transmission1
 r\t+1 int]m$iate & transi5t /orage1 or 
connections4  7#ab7 ,small bus9ess      
conc]n ,! t]m small bus9ess conc]n has !
 mean+ giv5 su* t]m "u section #c ( !   
,small ,bus9ess ,act 7#ae ,u4,s4,c4     
#fcb74  7#ac7 ,/ate ,! t]m ,/ate means  
ea* ( ! sev]al ,/ates1 ! ,di/rict (     
,columbia1 ! ,commonweal? ( ,pu]to      
,rico1 ,guam1 ,am]ican ,samoa1 ! ,virg9 
,isl&s ( ! ,unit$ ,/ates1 ! ,commonweal?
 ( ! ,nor!rn ,m>iana ,isl&s1 any o!r    
t]ritory or possession ( ! ,unit$       
,/ates1 & ea* f$]ally recogniz$ ,indian 
tribe4  #f4 ,effect on o!r laws  7a7    
,preemption ( ,/ate in=mation security  
laws ,no ,/ate or political subdivision 
( a ,/ate %all1 ) respect to a cov]$    
entity subject to ?is ,act1 adopt1      
ma9ta91 en=ce1 or impose or cont9ue 9   
effect any law1 rule1 regulation1 duty1 
requirem5t1 /&>d1 or o!r provision hav+ 
! =ce & effect ( law relat+ to or )     

respect to ! security ( data 9          
electronic =m or notification foll[+ a  
security brea* ( su* data4  7b7 ,common 
law ,?is section %all n exempt a cov]$  
entity f liability "u common law4  7c7  
,c]ta9 ,,ftc en=cem5t limit$ to data    
security & brea* notification  7#a7     
,data security & brea* notification     
,ins(> z sections #bja1 #bjb1 #bbb1     
#cch1 & #fca ( ! ,communications ,act ( 
#aicd 7#dg ,u4,s4,c4 #bja1 #bjb1 #bbb1  
#cch1 & #eea71 & any regulations        
promulgat$ !reund]1 apply to cov]$      
entities ) respect to secur+ in=mation 9
 electronic =m f unau?oriz$ access &    
acquisition1 includ+ notification (     
unau?oriz$ access & acquisition to data 
9 electronic =m conta9+ p]sonal         
in=mation1 su* sections & regulations   
promulgat$ !reund] %all h no =ce or     
effect1 unless su* regulations p]ta9    
solely to #i-a-a calls4  7#b7 ,rule (   
con/ruction ,no?+ 9 ?is subsection      
o!rwise limits ! ,f$]al ,communications 
,commission's au?ority ) respect to     

sections #bja1 #bjb1 #bbb1 #cch1 & #fca 
( ! ,communications ,act ( #aicd 7#dg   
,u4,s4,c4 #bja1 #bjb1 #bbb1 #cch1 &     
#eea74  7d7 ,pres]vation ( commission   
au?ority ,no?+ 9 ?is ,act may be con/ru$
 9 any way to limit or affect !         
,commission's au?ority "u any o!r       
provision ( law4  #g4 ,education &      
outrea* = small bus9esses ,! ,commission
 %all conduct education & outrea* =     
small bus9ess conc]ns on data security  
practices & h[ to prev5t hack+ & o!r    
unau?oriz$ access to1 acquisition (1 or 
use ( data ma9ta9$ by su* small bus9ess 
conc]ns4  #h4 ,website on data security 
be/ practices ,! ,commission %all       
e/abli% & ma9ta9 an ,int]net website    
conta9+ non-b9d+ be/ practices =        
bus9esses reg>d+ data security & h[ to  
prev5t hack+ & o!r unau?oriz$ access to1
 acquisition (1 or use ( data ma9ta9$ by
 su* bus9esses4  #i4 ,effective date    
,?is ,act %all take effect #a ye> aft] !
 date ( enactm5t ( ?is ,act4  ,janu>y   
#c1 #bjag ,report$ ) an am5dm5t1        

committ$ to ! ,committee ( ! ,:ole ,h\se
 on ! ,/ate ( ! ,union1 & ord]$ to be   
pr9t$