,,ii #aadth ,,congress #ast ,session ,s4 #ajbg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #ba1 #bjae,mr4 ,kirk 7for himself and ,mrs4 ,gillibrand7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require notification of information security breaches and to enhance penalties for cyber criminals1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,breach ,notification and ,punishing ,cyber ,criminals ,act of #bjae4 #b4 ,requirements for information security ,each covered entity shall take reasonable measures to protect and secure data in electronic form containing personal information4 #c4 ,notification of information security breach 7a7 ,notification 7#a7 ,in general ,a covered entity that owns or licenses data in electronic form containing personal information shall give notice of any breach of the security of the system following discovery by the covered entity of the breach of the security of the system to each individual who is a citizen or resident of the ,united ,states-- 7,a7 whose personal information was1 or that the covered entity reasonably believes to have been1 accessed and acquired by an unauthorized person2 or 7,b7 who the covered entity reasonably believes may be at risk of identity theft1 fraud1 actual financial harm1 or other unlawful conduct4 7#b7 ,law enforcement 7,a7 ,designation of a government entity ,to receive notice 7i7 ,in general ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security1 in consultation with the ,attorney ,general1 shall designate a ,federal ,government entity to receive the information required to be submitted under this section1 and any other reports and information about information security incidents1 threats1 and vulnerabilities4 7ii7 ,responsibilities of the designated entity ,the designated entity shall-- 7,i7 be responsible for promptly providing the information it receives to the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation1 and to the ,federal ,trade ,commission for civil law enforcement purposes2 and 7,,ii7 provide the information described in subclause 7,i7 as appropriate to other ,federal agencies for law enforcement1 national security1 or data security purposes4 7,b7 ,notice ,not later than #cj days after the date on which a security breach is discovered1 a covered entity shall notify the designated entity of the fact that the breach of security has occurred if-- 7i7 the number of individuals whose personal information was1 or is reasonably believed to be to have been accessed and acquired by an unauthorized person is more than #a1jjj2 7ii7 the security breach involves a database1 networked or integrated databases1 or other data system containing the personal information of more than #bej1jjj individuals2 7iii7 the security breach involves databases owned by the ,federal ,government2 or 7iv7 the security breach involves personal information of primarily individuals known to the covered entity to be employees and contractors of the ,federal ,government involved in national security or law enforcement4 7,c7 ,,ftc review of thresholds 7i7 ,review ,not later than #a year after the date of enactment of this ,act1 the ,federal ,trade ,commission1 in consultation with the ,attorney ,general and the ,secretary of ,homeland ,security1 shall promulgate regulations regarding the reports required under subparagraph 7,a74 7ii7 ,rulemaking ,the ,federal ,trade ,commission1 in consultation with the ,attorney ,general and the ,secretary of ,homeland ,security1 after notice and the opportunity for public comment1 and in a manner consistent with this section1 shall promulgate regulations1 as necessary1 under section #eec of title #e1 ,united ,states ,code1 to adjust the thresholds for notice to law enforcement and national security authorities under subparagraph 7,a7 and to facilitate the purposes of this section4 7b7 ,special notification requirements 7#a7 ,third-party agents 7,a7 ,in general ,in the event of a breach of security of a system maintained by a third-party entity that has been contracted to maintain1 store1 or process data in electronic form containing personal information on behalf of a covered entity who owns or possesses such data1 the third-party entity shall notify the covered entity of the breach of security4 7,b7 ,covered entities who receive notice from third parties ,upon receiving notification from a third party under subparagraph 7,a71 a covered entity shall provide notification as required under subsection 7a74 7,c7 ,exception for service providers ,for purposes of this paragraph1 a service provider shall not be considered a third-party agent4 7#b7 ,service providers 7,a7 ,in general ,if a service provider becomes aware of a breach of security involving data in electronic form containing personal information that is owned or possessed by a covered entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 the service provider shall notify the covered entity who initiated such connection1 transmission1 routing1 or storage if the covered entity can be reasonably identified4 7,b7 ,covered entities who receive notice from service providers ,upon receiving notification from a service provider under subparagraph 7,a71 a covered entity shall provide notification as required under subsection 7a74 7c7 ,timeliness of notification 7#a7 ,notification to affected individuals 7,a7 ,in general ,unless subject to a delay authorized under subparagraph 7,b7 or paragraph 7#b71 a notification required under subsection 7a77#a7 with respect to a security breach shall be made not later than #cj days after the date on which the security breach was discovered1 consistent with any measures necessary to determine the scope of the security breach and restore the reasonable integrity of the data system that was breached4 7,b7 ,follow-up notification ,not later than #fj days after the date on which notice is provided under subsection 7a77#a71 if a covered entity has discovered additional information relating to how a breach of security occurred 7as required under subsection 7d77#a77;,b77iii7 to be included in a notification7 the covered entity may provide a follow-up notification to affected individuals that contains the additional information4 7#b7 ,delay of notification authorized for law enforcement or national security purposes 7,a7 ,law enforcement ,if a ,federal law enforcement agency determines that the notification required under subsection 7a7 would impede a civil or criminal investigation1 such notification shall be delayed upon the written request of the law enforcement agency for any period which the law enforcement agency determines is reasonably necessary4 ,a law enforcement agency may1 by a subsequent written request1 revoke such delay or extend the period set forth in the original request made under this subparagraph by a subsequent request if further delay is necessary4 7,b7 ,national security ,if a ,federal national security agency or homeland security agency determines that the notification required under this section would threaten national or homeland security1 such notification may be delayed upon the written request of the national security agency or homeland security agency for any period which the national security agency or homeland security agency determines is reasonably necessary4 ,a ,federal national security agency or homeland security agency may revoke such delay or extend the period set forth in the original request made under this subparagraph by a subsequent written request if further delay is necessary4 7d7 ,method and content of notification 7#a7 ,direct notification 7,a7 ,method of notification ,a covered entity required to provide notification to an individual under subsection 7a7 shall be in compliance with such requirement if the covered entity provides such notice by any one of the following methods3 7i7 ,written notification1 sent to the postal address of the individual in the records of the covered entity4 7ii7 ,telephone4 7iii7 ,email or other electronic means4 7,b7 ,content of notification ,regardless of the method by which notification is provided to an individual under subparagraph 7,a7 with respect to a security breach1 such notification1 to the extent practicable1 shall include-- 7i7 the date1 estimated date1 or estimated date range of the breach of security2 7ii7 a description of the personal information that was accessed and acquired1 or reasonably believed to have been accessed and acquired1 by an unauthorized person as a part of the security breach2 7iii7 a general description of how the breach of security occurred2 and 7iv7 information that the individual can use to contact the covered entity to inquire about-- 7,i7 the breach of security2 or 7,,ii7 the information the covered entity maintained about that individual4 7#b7 ,substitute notification 7,a7 ,circumstances giving rise to substitute notification ,a covered entity required to provide notification to an individual under subsection 7a7 may provide substitute notification in lieu of the direct notification required by paragraph 7#a7 if such direct notification is not feasible due to-- 7i7 excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity2 or 7ii7 lack of sufficient contact information for the individual required to be notified4 7,b7 ,form of substitute notification ,substitute notification described in subparagraph 7,a7 shall include-- 7i7 a conspicuous notice on the ,internet ,web site of the covered entity 7if such covered entity maintains such a ,web site72 and 7ii7 notification in print and to broadcast media1 including major media in metropolitan and rural areas where the individuals whose personal information was acquired reside4 7#c7 ,cost of notification ,a covered entity required to provide notification to an individual under subsection 7a7 shall provide such notification at no cost to the individual4 7e7 ,treatment of persons governed by other ,federal law ,except as provided in section #d7;b71 a covered entity who is in compliance with any other ,federal law that requires such covered entity to provide notification to individuals following a breach of security shall be deemed to be in compliance with this section4 #d4 ,application and enforcement 7a7 ,general application ,the requirements of sections #b and #c apply to-- 7#a7 any covered entity over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 and 7#b7 notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq474 7b7 ,application to cable operators1 satellite operators1 and telecommunications carriers ,sections #bbb1 #cch1 and #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb1 #cch1 and #eea71 and any regulations promulgated thereunder1 shall not apply with respect to the information security practices1 including practices relating to the notification of unauthorized access to data in electronic form1 of any covered entity otherwise subject to those sections4 7c7 ,enforcement by ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #b or #c shall be treated as an unfair or deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of commission 7,a7 ,in general ,except as provided in subsection 7a71 the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates section #c or #d shall be subject to the penalties and entitled to the privileges and immunities provided in such ,act4 7#c7 ,maximum total liability ,notwithstanding the number of actions which may be brought against a covered entity under this subsection1 the maximum civil penalty for which any covered entity may be liable under this subsection for all actions shall not exceed-- 7,a7 #a1jjj1jjj for all violations of section #b resulting from the same related act or omission2 and 7,b7 #a1jjj1jjj for all violations of section #c resulting from a single breach of security4 7d7 ,no private cause of action ,nothing in this ,act shall be construed to establish a private cause of action against a person for a violation of this ,act4 #e4 ,criminal penalties for cyber crimes ,part ,i of title #ah1 ,united ,states ,code1 is amended-- 7#a7 in chapter #dg-- 7,a7 in section #ajbh7;b7-- 7i7 in paragraph 7#a7-- 7,i7 in subparagraph 7,b71 by inserting or after the semicolon2 7,,ii7 in subparagraph 7,c71 by striking or after the semicolon2 and 7,,iii7 by striking subparagraph 7,d72 7ii7 by redesignating paragraphs 7#e7 and 7#f71 as paragraphs 7#f7 and 7#g71 respectively2 and 7iii7 by inserting after paragraph 7#d71 the following3 7#e7 for an offense under paragraph 7#g7 of such subsection1 a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #cj years1 or both2 2 7,b7 in section #ajbh;,a7a77#a71 by striking #b years and inserting #d years2 7,c7 in section #ajbi7;c77#a7-- 7i7 in subparagraph 7,a7-- 7,i7 in clause 7i71 by striking a fine under this title or imprisonment for not more than #aj years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #bj years2 and 7,,ii7 in clause 7ii71 by striking a fine under this title or imprisonment for not more than #ae years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #cj years2 and 7ii7 in subparagraph 7,b71 by striking a fine under this title or imprisonment for not more than #bj years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #dj years2 and 7,d7 in section #ajcj7;c7-- 7i7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by striking subsection 7a77#b71 7a77#c71 and inserting subsection 7a77#c72 7,,ii7 in subparagraph 7,b7-- 7aa7 in the matter preceding clause 7i71 by striking a fine under this title or imprisonment for not more than #e years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #aj years2 and 7bb7 in clause 7iii71 by striking and at the end2 7,,iii7 in subparagraph 7,c71 by striking 7a77#b712 and 7,,iv7 by adding at the end the following3 7,d7 a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #b years1 or both1 in the case of an offense under subsection 7a77#b7 which does not occur after a conviction for another offense under this section1 or an attempt to commit an offense punishable under this subparagraph2 and 7,e7 a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#b7 which occurs after a conviction for another offense under this section1 or an attempt to commit an offense punishable under this subparagraph2 2 7ii7 in paragraph 7#c7-- 7,i7 in subparagraph 7,a71 by striking 7a77#d7 or2 and 7,,ii7 in subparagraph 7,b71 by striking 7a77#d71 or2 7iii7 in paragraph 7#d7-- 7,i7 in subparagraph 7,a71 in the matter preceding clause 7i71 by striking a fine under this title1 imprisonment for not more than #e years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #aj years2 7,,ii7 in subparagraph 7,b71 in the matter preceding clause 7i71 by striking a fine under this title1 imprisonment for not more than #aj years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #bj years2 7,,iii7 in subparagraph 7,c71 in the matter preceding clause 7i71 by striking a fine under this title1 imprisonment for not more than #bj years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #dj years2 7,,iv7 in subparagraph 7,d71 in the matter preceding clause 7i71 by striking a fine under this title1 imprisonment for not more than #aj years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #bj years2 7,v7 in subparagraph 7,e71 by striking a fine under this title1 imprisonment for not more than #bj years and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #dj years2 7,,vi7 in subparagraph 7,f7-- 7aa7 by striking a fine under this title and inserting a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization72 and 7bb7 by striking or at the end2 and 7,,vii7 in subparagraph 7,g7-- 7aa7 in the matter preceding clause 7i71 by striking under this title1 imprisonment for not more than #a year and inserting of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #b years2 and 7bb7 in clause 7ii71 by striking the period at the end and inserting 2 and2 and 7iv7 by adding at the end the following3 7#e7 7,a7 a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#d7 which does not occur after a conviction for another offense under this section1 or an attempt to commit an offense punishable under this subparagraph2 and 7,b7 a fine of not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#d7 which occurs after a conviction for another offense under this section1 or an attempt to commit an offense punishable under this subparagraph4 2 7#b7 in chapter #fc-- 7,a7 in section #acdc-- 7i7 in the first sentence1 by striking fined under this title or imprisoned not more than #bj years and inserting fined not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisoned not more than #dj years2 and 7ii7 in the second sentence1 by striking #a1jjj1jjj or imprisoned not more than #cj years and inserting #b1jjj1jjj1 imprisoned for any term of years or for life2 and 7,b7 in section #acdd1 by striking #a1jjj1jjj or imprisoned not more than #cj years and inserting #b1jjj1jjj or imprisoned for any term of years or for life2 and 7#c7 in section #aeai1 by striking fined under this title1 imprisoned not more than #bj years and inserting fined not more than #ejj1jjj 7#a1jjj1jjj if the person is an organization71 imprisoned not more than #dj years4 #f4 ,apprehension and prosecution of international cyber criminals 7a7 ,international cyber criminal defined ,in this section1 the term international cyber criminal means an individual-- 7#a7 who is physically present within a country with which the ,united ,states does not have a mutual legal assistance treaty or an extradition treaty2 7#b7 who is believed to have committed a cybercrime or intellectual property crime against the interests of the ,united ,states or its citizens2 and 7#c7 for whom-- 7,a7 an arrest warrant has been issued by a judge in the ,united ,states2 or 7,b7 an international wanted notice 7commonly referred to as a ,red ,notice7 has been circulated by ,interpol4 7b7 ,bilateral consultations ,the ,secretary of ,state1 or designee1 shall consult with the appropriate government official of each country in which one or more international cyber criminals are physically present to determine what actions the government of such country has taken-- 7#a7 to apprehend and prosecute such criminals2 and 7#b7 to prevent such criminals from carrying out cybercrimes or intellectual property crimes against the interests of the ,united ,states or its citizens4 7c7 ,annual report 7#a7 ,in general ,the ,secretary of ,state shall submit to the appropriate congressional committees an annual report that identifies-- 7,a7 the number of international cyber criminals who are located in countries that do not have an extradition treaty or mutual legal assistance treaty with the ,united ,states1 broken down by country2 7,b7 the dates on which an official of the ,department of ,state1 as a result of this ,act1 discussed ways to thwart or prosecute international cyber criminals in a bilateral conversation with an official of another country1 including the name of each such country2 and 7,c7 for each international cyber criminal who was extradited into the ,united ,states during the most recently completed calendar year-- 7i7 his or her name2 7ii7 the crimes for which he or she was charged2 7iii7 his or her previous country of residence2 and 7iv7 the country from which he or she was extradited into the ,united ,states4 7#b7 ,appropriate congressional committees ,for purposes of this subsection1 the term appropriate congressional committees means-- 7,a7 the ,committee on ,foreign ,relations of the ,senate2 7,b7 the ,committee on ,appropriations of the ,senate2 7,c7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,d7 the ,committee on ,banking1 ,housing1 and ,urban ,affairs of the ,senate2 7,e7 the ,committee on ,foreign ,affairs of the ,house of ,representatives2 7,f7 the ,committee on ,appropriations of the ,house of ,representatives2 7,g7 the ,committee on ,homeland ,security of the ,house of ,representatives2 and 7,h7 the ,committee on ,financial ,services of the ,house of ,representatives4 #g4 ,definitions ,in this ,act3 7#a7 ,breach of security ,the term breach of security means unauthorized access and acquisition of data in electronic form containing personal information4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered entity 7,a7 ,in general ,the term covered entity means a sole proprietorship1 partnership1 corporation1 trust1 estate1 cooperative1 association1 or other commercial entity that acquires1 maintains1 stores1 or utilizes personal information4 7,b7 ,exemptions ,the term covered entity does not include the following3 7i7 ,financial institutions subject to title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7ii7 ,an entity covered by the regulations issued under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia7 to the extent that such entity is subject to the requirements of such regulations with respect to protected health information4 7#d7 ,data in electronic form ,the term data in electronic form means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices4 7#e7 ,designated entity ,the term designated entity means the ,federal ,government entity designated under section #c7;a77#b77;,a74 7#f7 ,personal information 7,a7 ,in general ,the term personal information means an individual's first name or first initial and last name in combination with any one or more of the following data elements for that individual3 7i7 ,social ,security number4 7ii7 ,driver's license number1 passport number1 military identification number1 or other similar number issued on a government document used to verify identity4 7iii7 ,financial account number1 or credit or debit card number1 and any required security code1 access code1 or password that is necessary to permit access to an individual's financial account4 7iv7 ,federal or ,state government issued identification card4 7v7 ,a username or email address1 in combination with a password or security question and answer that would allow access to an online account4 7vi7 ,medical information1 including the medical history1 mental or physical condition1 or medical treatment or diagnosis by a health care professional of the individual4 7vii7 ,health insurance information1 including a health insurance policy number or subscriber identification number1 any unique identifier used by a health insurer to identify an individual1 or any information in a health insurance application or claim history filed by the individual4 7viii7 ,an individual taxpayer identification number4 7,b7 ,exclusions 7i7 ,public record information ,personal information does not include information obtained about an individual which has been lawfully made publicly available by a ,federal1 ,state1 or local government entity or widely distributed by media4 7ii7 ,encrypted1 redacted1 or secured data ,personal information does not include information that is encrypted1 redacted1 or secured by any other method or technology that renders the data elements unusable4 7#g7 ,service provider ,the term service provider means an entity that provides electronic data transmission1 routing1 intermediate1 and transient storage1 or connections to its system or network1 where such entity providing such services does not select or modify the content of the electronic data1 is not the sender or the intended recipient of the data1 and does not differentiate personal information from other information that such entity transmits1 routes1 stores1 or for which such entity provides connections4 ,any such entity shall be treated as a service provider under this ,act only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage1 or connections4 #h4 ,effect on other laws ,this ,act preempts any law1 rule1 regulation1 requirement1 standard1 or other provision having the force and effect of law of any ,state1 or political subdivision of a ,state1 relating to the protection or security of data in electronic form containing personal information or the notification of a breach of security4 #i4 ,effective date ,this ,act shall take effect on the date that is #a year after the date of enactment of this ,act4