,,ii  #aad? ,,congress  #a/ ,session    
,s4 #ajbg  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,april #ba1 #bjae,mr4  
,kirk 7= himself & ,mrs4 ,gillibr&7     
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,comm]ce1 ,sci5ce1 & ,transportation  ,a
 ,,bill  ,to require notification (     
in=mation security brea*es & to enhance 
p5alties = cyb] crim9als1 & = o!r       
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,data ,brea* ,notification 
& ,puni%+ ,cyb] ,crim9als ,act ( #bjae4 
#b4 ,requirem5ts = in=mation security   
,ea* cov]$ entity %all take reasonable  
measures to protect & secure data 9     
electronic =m conta9+ p]sonal in=mation4
  #c4 ,notification ( in=mation security
 brea*  7a7 ,notification  7#a7 ,9 g5]al
 ,a cov]$ entity t owns or lic5ses data 
9 electronic =m conta9+ p]sonal         
in=mation %all give notice ( any brea* (
 ! security ( ! sy/em foll[+ discov]y by
 ! cov]$ entity ( ! brea* ( ! security (
 ! sy/em to ea* individual :o is a      

citiz5 or resid5t ( ! ,unit$ ,/ates--   
7,a7 ^: p]sonal in=mation 01 or t !     
cov]$ entity reasonably believes to h   
be51 access$ & acquir$ by an unau?oriz$ 
p]son2 or  7,b7 :o ! cov]$ entity       
reasonably believes may be at risk (    
id5tity !ft1 fraud1 actual f9ancial h>m1
 or o!r unlawful conduct4  7#b7 ,law    
en=cem5t  7,a7 ,designation ( a gov]nm5t
 entity ,to receive notice  7i7 ,9 g5]al
 ,n lat] ?an #fj days aft] ! date (     
enactm5t ( ?is ,act1 ! ,secret>y (      
,homel& ,security1 9 consultation ) !   
,attorney ,g5]al1 %all designate a      
,f$]al ,gov]nm5t entity to receive !    
in=mation requir$ to be submitt$ "u ?is 
section1 & any o!r reports & in=mation  
ab\t in=mation security incid5ts1       
?reats1 & vuln]abilities4  7ii7         
,responsibilities ( ! designat$ entity  
,! designat$ entity %all-- 7,i7 be      
responsible = promptly provid+ !        
in=mation x receives to ! ,unit$ ,/ates 
,secret ,s]vice & ! ,f$]al ,bureau (    
,inve/igation1 & to ! ,f$]al ,trade     

,commission = civil law en=cem5t        
purposes2 &  7,,ii7 provide ! in=mation 
describ$ 9 subclause 7,i7 z appropriate 
to o!r ,f$]al ag5cies = law en=cem5t1   
national security1 or data security     
purposes4  7,b7 ,notice ,n lat] ?an #cj 
days aft] ! date on :i* a security brea*
 is discov]$1 a cov]$ entity %all notify
 ! designat$ entity ( ! fact t ! brea* (
 security has occurr$ if--  7i7 ! numb] 
( individuals ^: p]sonal in=mation 01 or
 is reasonably believ$ to be to h be5   
access$ & acquir$ by an unau?oriz$ p]son
 is m ?an #a1jjj2  7ii7 ! security brea*
 involves a database1 network$ or       
integrat$ databases1 or o!r data sy/em  
conta9+ ! p]sonal in=mation ( m ?an     
#bej1jjj individuals2  7iii7 ! security 
brea* involves databases own$ by !      
,f$]al ,gov]nm5t2 or  7iv7 ! security   
brea* involves p]sonal in=mation (      
prim>ily individuals kn[n to ! cov]$    
entity to be employees & contractors ( !
 ,f$]al ,gov]nm5t involv$ 9 national    
security or law en=cem5t4  7,c7 ,,ftc   

review ( ?re%olds  7i7 ,review ,n lat]  
?an #a ye> aft] ! date ( enactm5t ( ?is 
,act1 ! ,f$]al ,trade ,commission1 9    
consultation ) ! ,attorney ,g5]al & !   
,secret>y ( ,homel& ,security1 %all     
promulgate regulations reg>d+ ! reports 
requir$ "u subp>agraph 7,a74  7ii7      
,rulemak+ ,! ,f$]al ,trade ,commission1 
9 consultation ) ! ,attorney ,g5]al & ! 
,secret>y ( ,homel& ,security1 aft]     
notice & ! opportunity = public comm5t1 
& 9 a mann] consi/5t ) ?is section1 %all
 promulgate regulations1 z necess>y1 "u 
section #eec ( title #e1 ,unit$ ,/ates  
,code1 to adju/ ! ?re%olds = notice to  
law en=cem5t & national security        
au?orities "u subp>agraph 7,a7 & to     
facilitate ! purposes ( ?is section4    
7b7 ,special notification requirem5ts   
7#a7 ,?ird-p>ty ag5ts  7,a7 ,9 g5]al ,9 
! ev5t ( a brea* ( security ( a sy/em   
ma9ta9$ by a ?ird-p>ty entity t has be5 
contract$ to ma9ta91 /ore1 or process   
data 9 electronic =m conta9+ p]sonal    
in=mation on behalf ( a cov]$ entity :o 

owns or possesses su* data1 ! ?ird-p>ty 
entity %all notify ! cov]$ entity ( !   
brea* ( security4  7,b7 ,cov]$ entities 
:o receive notice f ?ird p>ties ,^u     
receiv+ notification f a ?ird p>ty "u   
subp>agraph 7,a71 a cov]$ entity %all   
provide notification z requir$ "u       
subsection 7a74  7,c7 ,exception =      
s]vice provid]s ,= purposes ( ?is       
p>agraph1 a s]vice provid] %all n be    
consid]$ a ?ird-p>ty ag5t4  7#b7 ,s]vice
 provid]s  7,a7 ,9 g5]al ,if a s]vice   
provid] becomes aw>e ( a brea* (        
security involv+ data 9 electronic =m   
conta9+ p]sonal in=mation t is own$ or  
possess$ by a cov]$ entity t connects to
 or uses a sy/em or network provid$ by !
 s]vice provid] = ! purpose (           
transmitt+1 r\t+1 or provid+ int]m$iate 
or transi5t /orage ( su* data1 ! s]vice 
provid] %all notify ! cov]$ entity :o   
initiat$ su* connection1 transmission1  
r\t+1 or /orage if ! cov]$ entity c be  
reasonably id5tifi$4  7,b7 ,cov]$       
entities :o receive notice f s]vice     

provid]s ,^u receiv+ notification f a   
s]vice provid] "u subp>agraph 7,a71 a   
cov]$ entity %all provide notification z
 requir$ "u subsection 7a74  7c7        
,timel9ess ( notification  7#a7         
,notification to affect$ individuals    
7,a7 ,9 g5]al ,unless subject to a delay
 au?oriz$ "u subp>agraph 7,b7 or        
p>agraph 7#b71 a notification requir$ "u
 subsection 7a77#a7 ) respect to a      
security brea* %all be made n lat] ?an  
#cj days aft] ! date on :i* ! security  
brea* 0 discov]$1 consi/5t ) any        
measures necess>y to det]m9e ! scope ( !
 security brea* & re/ore ! reasonable   
integrity ( ! data sy/em t 0 brea*$4    
7,b7 ,foll[-up notification ,n lat] ?an 
#fj days aft] ! date on :i* notice is   
provid$ "u subsection 7a77#a71 if a     
cov]$ entity has discov]$ additional    
in=mation relat+ to h[ a brea* (        
security occurr$ 7z requir$ "u          
subsection 7d77#a77;,b77iii7 to be      
includ$ 9 a notification7 ! cov]$ entity
 may provide a foll[-up notification to 

affect$ individuals t conta9s !         
additional in=mation4  7#b7 ,delay (    
notification au?oriz$ = law en=cem5t or 
national security purposes  7,a7 ,law   
en=cem5t ,if a ,f$]al law en=cem5t ag5cy
 det]m9es t ! notification requir$ "u   
subsection 7a7 w\ld imp$e a civil or    
crim9al inve/igation1 su* notification  
%all be delay$ ^u ! writt5 reque/ ( !   
law en=cem5t ag5cy = any p]iod :i* ! law
 en=cem5t ag5cy det]m9es is reasonably  
necess>y4 ,a law en=cem5t ag5cy may1 by 
a subsequ5t writt5 reque/1 revoke su*   
delay or ext5d ! p]iod set =? 9 !       
orig9al reque/ made "u ?is subp>agraph  
by a subsequ5t reque/ if fur!r delay is 
necess>y4  7,b7 ,national security ,if a
 ,f$]al national security ag5cy or      
homel& security ag5cy det]m9es t !      
notification requir$ "u ?is section w\ld
 ?reat5 national or homel& security1 su*
 notification may be delay$ ^u ! writt5 
reque/ ( ! national security ag5cy or   
homel& security ag5cy = any p]iod :i* ! 
national security ag5cy or homel&       

security ag5cy det]m9es is reasonably   
necess>y4 ,a ,f$]al national security   
ag5cy or homel& security ag5cy may      
revoke su* delay or ext5d ! p]iod set =?
 9 ! orig9al reque/ made "u ?is         
subp>agraph by a subsequ5t writt5 reque/
 if fur!r delay is necess>y4  7d7 ,me?od
 & cont5t ( notification  7#a7 ,direct  
notification  7,a7 ,me?od ( notification
 ,a cov]$ entity requir$ to provide     
notification to an individual "u        
subsection 7a7 %all be 9 compliance )   
su* requirem5t if ! cov]$ entity        
provides su* notice by any "o ( ! foll[+
 me?ods3  7i7 ,writt5 notification1 s5t 
to ! po/al address ( ! individual 9 !   
records ( ! cov]$ entity4  7ii7         
,telephone4  7iii7 ,email or o!r        
electronic means4  7,b7 ,cont5t (       
notification ,reg>dless ( ! me?od by :i*
 notification is provid$ to an          
individual "u subp>agraph 7,a7 ) respect
 to a security brea*1 su* notification1 
to ! ext5t practicable1 %all include--  
7i7 ! date1 e/imat$ date1 or e/imat$    

date range ( ! brea* ( security2  7ii7 a
 description ( ! p]sonal in=mation t 0  
access$ & acquir$1 or reasonably believ$
 to h be5 access$ & acquir$1 by an      
unau?oriz$ p]son z a "p ( ! security    
brea*2  7iii7 a g5]al description ( h[ !
 brea* ( security occurr$2 &  7iv7      
in=mation t ! individual c use to       
contact ! cov]$ entity to inquire ab\t--
  7,i7 ! brea* ( security2 or  7,,ii7 ! 
in=mation ! cov]$ entity ma9ta9$ ab\t t 
individual4  7#b7 ,sub/itute            
notification  7,a7 ,circum/ances giv+   
rise to sub/itute notification ,a cov]$ 
entity requir$ to provide notification  
to an individual "u subsection 7a7 may  
provide sub/itute notification 9 lieu ( 
! direct notification requir$ by        
p>agraph 7#a7 if su* direct notification
 is n feasible due to--  7i7 excessive  
co/ to ! cov]$ entity requir$ to provide
 su* notification relative to ! res\rces
 ( su* cov]$ entity2 or  7ii7 lack (    
suffici5t contact in=mation = !         
individual requir$ to be notifi$4  7,b7 

,=m ( sub/itute notification ,sub/itute 
notification describ$ 9 subp>agraph 7,a7
 %all include--  7i7 a conspicu\s notice
 on ! ,int]net ,web site ( ! cov]$      
entity 7if su* cov]$ entity ma9ta9s su* 
a ,web site72 &  7ii7 notification 9    
pr9t & to broadca/ m$ia1 includ+ major  
m$ia 9 metropolitan & rural areas :]e ! 
individuals ^: p]sonal in=mation 0      
acquir$ reside4  7#c7 ,co/ (            
notification ,a cov]$ entity requir$ to 
provide notification to an individual "u
 subsection 7a7 %all provide su*        
notification at no co/ to ! individual4 
7e7 ,treatm5t ( p]sons gov]n$ by o!r    
,f$]al law ,except z provid$ 9 section  
#d7;b71 a cov]$ entity :o is 9          
compliance ) any o!r ,f$]al law t       
requires su* cov]$ entity to provide    
notification to individuals foll[+ a    
brea* ( security %all be deem$ to be 9  
compliance ) ?is section4  #d4          
,application & en=cem5t  7a7 ,g5]al     
application ,! requirem5ts ( sections #b
 & #c apply to-- 7#a7 any cov]$ entity  

ov] :i* ! ,commission has au?ority      
pursuant to section #e7;a77#b7 ( !      
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #de7;a77#b772 &  7#b7 not)/&+ 
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b771 common c>ri]s subject to !
 ,communications ,act ( #aicd 7#dg      
,u4,s4,c4 #aea et seq474  7b7           
,application to cable op]ators1         
satellite op]ators1 & telecommunications
 c>ri]s ,sections #bbb1 #cch1 & #fca ( !
 ,communications ,act ( #aicd 7#dg      
,u4,s4,c4 #bbb1 #cch1 & #eea71 & any    
regulations promulgat$ !reund]1 %all n  
apply ) respect to ! in=mation security 
practices1 includ+ practices relat+ to !
 notification ( unau?oriz$ access to    
data 9 electronic =m1 ( any cov]$ entity
 o!rwise subject to ^? sections4  7c7   
,en=cem5t by ,f$]al ,trade ,commission  
7#a7 ,unfair or deceptive acts or       
practices ,a violation ( section #b or  
#c %all be treat$ z an unfair or        
deceptive act or practice 9 violation ( 

a regulation "u section #ah7;a77#a77;,b7
 ( ! ,f$]al ,trade ,commission ,act 7#ae
 ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+    
unfair or deceptive acts or practices4  
7#b7 ,p[]s ( commission  7,a7 ,9 g5]al  
,except z provid$ 9 subsection 7a71 !   
,commission %all en=ce ?is ,act 9 ! same
 mann]1 by ! same means1 & ) ! same     
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4  7,b7 ,privileges &     
immunities ,any p]son :o violates       
section #c or #d %all be subject to !   
p5alties & entitl$ to ! privileges &    
immunities provid$ 9 su* ,act4  7#c7    
,maximum total liability ,not)/&+ !     
numb] ( actions :i* may be br\ght aga9/ 
a cov]$ entity "u ?is subsection1 !     
maximum civil p5alty = :i* any cov]$    
entity may be liable "u ?is subsection =
 all actions %all n exce$--  7,a7       
#a1jjj1jjj = all violations ( section #b
 result+ f ! same relat$ act or         

omission2 &  7,b7 #a1jjj1jjj = all      
violations ( section #c result+ f a s+le
 brea* ( security4  7d7 ,no private     
cause ( action ,no?+ 9 ?is ,act %all be 
con/ru$ to e/abli% a private cause (    
action aga9/ a p]son = a violation ( ?is
 ,act4  #e4 ,crim9al p5alties = cyb]    
crimes ,"p ,i ( title #ah1 ,unit$ ,/ates
 ,code1 is am5d$-- 7#a7 9 *apt] #dg--   
7,a7 9 section #ajbh7;b7-- 7i7 9        
p>agraph 7#a7--  7,i7 9 subp>agraph     
7,b71 by ins]t+ or aft] ! semicolon2    
7,,ii7 9 subp>agraph 7,c71 by /rik+ or  
aft] ! semicolon2 &  7,,iii7 by /rik+   
subp>agraph 7,d72  7ii7 by r$esignat+   
p>agraphs 7#e7 & 7#f71 z p>agraphs 7#f7 
& 7#g71 respectively2 &  7iii7 by ins]t+
 aft] p>agraph 7#d71 ! foll[+3  7#e7 =  
an (f5se "u p>agraph 7#g7 ( su*         
subsection1 a f9e ( n m ?an #ejj1jjj    
7#a1jjj1jjj if ! p]son is an            
organization71 imprisonm5t = n m ?an #cj
 ye>s1 or bo?2  2  7,b7 9 section       
#ajbh;,a7a77#a71 by /rik+ #b ye>s &     
ins]t+ #d ye>s2  7,c7 9 section         

#ajbi7;c77#a7--  7i7 9 subp>agraph      
7,a7-- 7,i7 9 clause 7i71 by /rik+ a f9e
 "u ?is title or imprisonm5t = n m ?an  
#aj ye>s & ins]t+ a f9e ( n m ?an       
#ejj1jjj 7#a1jjj1jjj if ! p]son is an   
organization71 imprisonm5t = n m ?an #bj
 ye>s2 &  7,,ii7 9 clause 7ii71 by /rik+
 a f9e "u ?is title or imprisonm5t = n m
 ?an #ae ye>s & ins]t+ a f9e ( n m ?an  
#ejj1jjj 7#a1jjj1jjj if ! p]son is an   
organization71 imprisonm5t = n m ?an #cj
 ye>s2 &  7ii7 9 subp>agraph 7,b71 by   
/rik+ a f9e "u ?is title or imprisonm5t 
= n m ?an #bj ye>s & ins]t+ a f9e ( n m 
?an #ejj1jjj 7#a1jjj1jjj if ! p]son is  
an organization71 imprisonm5t = n m ?an 
#dj ye>s2 &  7,d7 9 section #ajcj7;c7-- 
7i7 9 p>agraph 7#b7--  7,i7 9           
subp>agraph 7,a71 by /rik+ subsection   
7a77#b71 7a77#c71 & ins]t+ subsection   
7a77#c72  7,,ii7 9 subp>agraph 7,b7--   
7aa7 9 ! matt] prec$+ clause 7i71 by    
/rik+ a f9e "u ?is title or imprisonm5t 
= n m ?an #e ye>s & ins]t+ a f9e ( n m  
?an #ejj1jjj 7#a1jjj1jjj if ! p]son is  

an organization71 imprisonm5t = n m ?an 
#aj ye>s2 &  7bb7 9 clause 7iii71 by    
/rik+ & at ! end2  7,,iii7 9 subp>agraph
 7,c71 by /rik+ 7a77#b712 &  7,,iv7 by  
add+ at ! end ! foll[+3  7,d7 a f9e ( n 
m ?an #ejj1jjj 7#a1jjj1jjj if ! p]son is
 an organization71 imprisonm5t = n m ?an
 #b ye>s1 or bo?1 9 ! case ( an (f5se "u
 subsection 7a77#b7 :i* does n occur    
aft] a conviction = ano!r (f5se "u ?is  
section1 or an attempt to commit an     
(f5se puni%able "u ?is subp>agraph2 &   
7,e7 a f9e ( n m ?an #ejj1jjj           
7#a1jjj1jjj if ! p]son is an            
organization71 imprisonm5t = n m ?an #bj
 ye>s1 or bo?1 9 ! case ( an (f5se "u   
subsection 7a77#b7 :i* occurs aft] a    
conviction = ano!r (f5se "u ?is section1
 or an attempt to commit an (f5se       
puni%able "u ?is subp>agraph2  2  7ii7 9
 p>agraph 7#c7-- 7,i7 9 subp>agraph     
7,a71 by /rik+ 7a77#d7 or2 &  7,,ii7 9  
subp>agraph 7,b71 by /rik+ 7a77#d71 or2 
7iii7 9 p>agraph 7#d7--  7,i7 9         
subp>agraph 7,a71 9 ! matt] prec$+      

clause 7i71 by /rik+ a f9e "u ?is title1
 imprisonm5t = n m ?an #e ye>s & ins]t+ 
a f9e ( n m ?an #ejj1jjj 7#a1jjj1jjj if 
! p]son is an organization71 imprisonm5t
 = n m ?an #aj ye>s2  7,,ii7 9          
subp>agraph 7,b71 9 ! matt] prec$+      
clause 7i71 by /rik+ a f9e "u ?is title1
 imprisonm5t = n m ?an #aj ye>s & ins]t+
 a f9e ( n m ?an #ejj1jjj 7#a1jjj1jjj if
 ! p]son is an organization71           
imprisonm5t = n m ?an #bj ye>s2  7,,iii7
 9 subp>agraph 7,c71 9 ! matt] prec$+   
clause 7i71 by /rik+ a f9e "u ?is title1
 imprisonm5t = n m ?an #bj ye>s & ins]t+
 a f9e ( n m ?an #ejj1jjj 7#a1jjj1jjj if
 ! p]son is an organization71           
imprisonm5t = n m ?an #dj ye>s2  7,,iv7 
9 subp>agraph 7,d71 9 ! matt] prec$+    
clause 7i71 by /rik+ a f9e "u ?is title1
 imprisonm5t = n m ?an #aj ye>s & ins]t+
 a f9e ( n m ?an #ejj1jjj 7#a1jjj1jjj if
 ! p]son is an organization71           
imprisonm5t = n m ?an #bj ye>s2  7,v7 9 
subp>agraph 7,e71 by /rik+ a f9e "u ?is 
title1 imprisonm5t = n m ?an #bj ye>s & 

ins]t+ a f9e ( n m ?an #ejj1jjj         
7#a1jjj1jjj if ! p]son is an            
organization71 imprisonm5t = n m ?an #dj
 ye>s2  7,,vi7 9 subp>agraph 7,f7-- 7aa7
 by /rik+ a f9e "u ?is title & ins]t+ a 
f9e ( n m ?an #ejj1jjj 7#a1jjj1jjj if ! 
p]son is an organization72 &  7bb7 by   
/rik+ or at ! end2 &  7,,vii7 9         
subp>agraph 7,g7--  7aa7 9 ! matt]      
prec$+ clause 7i71 by /rik+ "u ?is      
title1 imprisonm5t = n m ?an #a ye> &   
ins]t+ ( n m ?an #ejj1jjj 7#a1jjj1jjj if
 ! p]son is an organization71           
imprisonm5t = n m ?an #b ye>s2 &  7bb7 9
 clause 7ii71 by /rik+ ! p]iod at ! end 
& ins]t+ 2 &2 &  7iv7 by add+ at ! end !
 foll[+3  7#e7 7,a7 a f9e ( n m ?an     
#ejj1jjj 7#a1jjj1jjj if ! p]son is an   
organization71 imprisonm5t = n m ?an #aj
 ye>s1 or bo?1 9 ! case ( an (f5se "u   
subsection 7a77#d7 :i* does n occur aft]
 a conviction = ano!r (f5se "u ?is      
section1 or an attempt to commit an     
(f5se puni%able "u ?is subp>agraph2 &   
7,b7 a f9e ( n m ?an #ejj1jjj           

7#a1jjj1jjj if ! p]son is an            
organization71 imprisonm5t = n m ?an #bj
 ye>s1 or bo?1 9 ! case ( an (f5se "u   
subsection 7a77#d7 :i* occurs aft] a    
conviction = ano!r (f5se "u ?is section1
 or an attempt to commit an (f5se       
puni%able "u ?is subp>agraph4  2  7#b7 9
 *apt] #fc-- 7,a7 9 section #acdc--  7i7
 9 ! fir/ s5t5ce1 by /rik+ f9$ "u ?is   
title or imprison$ n m ?an #bj ye>s &   
ins]t+ f9$ n m ?an #ejj1jjj 7#a1jjj1jjj 
if ! p]son is an organization71         
imprison$ n m ?an #dj ye>s2 &  7ii7 9 ! 
second s5t5ce1 by /rik+ #a1jjj1jjj or   
imprison$ n m ?an #cj ye>s & ins]t+     
#b1jjj1jjj1 imprison$ = any t]m ( ye>s  
or = life2 &  7,b7 9 section #acdd1 by  
/rik+ #a1jjj1jjj or imprison$ n m ?an   
#cj ye>s & ins]t+ #b1jjj1jjj or         
imprison$ = any t]m ( ye>s or = life2 & 
7#c7 9 section #aeai1 by /rik+ f9$ "u   
?is title1 imprison$ n m ?an #bj ye>s & 
ins]t+ f9$ n m ?an #ejj1jjj 7#a1jjj1jjj 
if ! p]son is an organization71         
imprison$ n m ?an #dj ye>s4  #f4        

,appreh5sion & prosecution (            
int]national cyb] crim9als  7a7         
,int]national cyb] crim9al def9$ ,9 ?is 
section1 ! t]m int]national cyb] crim9al
 means an individual-- 7#a7 :o is       
physically pres5t )9 a c\ntry ) :i* !   
,unit$ ,/ates does n h a mutual legal   
assi/ance treaty or an extradition      
treaty2  7#b7 :o is believ$ to h        
committ$ a cyb]crime or intellectual    
prop]ty crime aga9/ ! int]e/s ( ! ,unit$
 ,/ates or its citiz5s2 &  7#c7 = :om-- 
7,a7 an arre/ w>rant has be5 issu$ by a 
judge 9 ! ,unit$ ,/ates2 or  7,b7 an    
int]national want$ notice 7commonly     
ref]r$ to z a ,r$ ,notice7 has be5      
circulat$ by ,int]pol4  7b7 ,bilat]al   
consultations ,! ,secret>y ( ,/ate1 or  
designee1 %all consult ) ! appropriate  
gov]nm5t (ficial ( ea* c\ntry 9 :i* "o  
or m int]national cyb] crim9als are     
physically pres5t to det]m9e :at actions
 ! gov]nm5t ( su* c\ntry has tak5--     
7#a7 to appreh5d & prosecute su*        
crim9als2 &  7#b7 to prev5t su* crim9als

 f c>ry+ out cyb]crimes or intellectual 
prop]ty crimes aga9/ ! int]e/s ( !      
,unit$ ,/ates or its citiz5s4  7c7      
,annual report  7#a7 ,9 g5]al ,!        
,secret>y ( ,/ate %all submit to !      
appropriate congressional committees an 
annual report t id5tifies--  7,a7 !     
numb] ( int]national cyb] crim9als :o   
are locat$ 9 c\ntries t d n h an        
extradition treaty or mutual legal      
assi/ance treaty ) ! ,unit$ ,/ates1     
brok5 d[n by c\ntry2  7,b7 ! dates on   
:i* an (ficial ( ! ,dep>tm5t ( ,/ate1 z 
a result ( ?is ,act1 discuss$ ways to   
?w>t or prosecute int]national cyb]     
crim9als 9 a bilat]al conv]sation ) an  
(ficial ( ano!r c\ntry1 includ+ ! "n (  
ea* su* c\ntry2 &  7,c7 = ea*           
int]national cyb] crim9al :o 0 extradit$
 into ! ,unit$ ,/ates dur+ ! mo/ rec5tly
 complet$ cal5d> ye>--  7i7 8 or h] "n2 
7ii7 ! crimes = :i* he or %e 0 *>g$2    
7iii7 8 or h] previ\s c\ntry ( resid5ce2
 &  7iv7 ! c\ntry f :i* he or %e 0      
extradit$ into ! ,unit$ ,/ates4  7#b7   

,appropriate congressional committees ,=
 purposes ( ?is subsection1 ! t]m       
appropriate congressional committees    
means-- 7,a7 ! ,committee on ,=eign     
,relations ( ! ,s5ate2  7,b7 !          
,committee on ,appropriations ( !       
,s5ate2  7,c7 ! ,committee on ,homel&   
,security & ,gov]nm5tal ,affairs ( !    
,s5ate2  7,d7 ! ,committee on ,bank+1   
,h\s+1 & ,urban ,affairs ( ! ,s5ate2    
7,e7 ! ,committee on ,=eign ,affairs ( !
 ,h\se ( ,repres5tatives2  7,f7 !       
,committee on ,appropriations ( ! ,h\se 
( ,repres5tatives2  7,g7 ! ,committee on
 ,homel& ,security ( ! ,h\se (          
,repres5tatives2 &  7,h7 ! ,committee on
 ,f9ancial ,s]vices ( ! ,h\se (         
,repres5tatives4  #g4 ,def9itions ,9 ?is
 ,act3  7#a7 ,brea* ( security ,! t]m   
brea* ( security means unau?oriz$ access
 & acquisition ( data 9 electronic =m   
conta9+ p]sonal in=mation4  7#b7        
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#c7 ,cov]$ 
entity  7,a7 ,9 g5]al ,! t]m cov]$      

entity means a sole proprietor%ip1      
p>tn]%ip1 corporation1 tru/1 e/ate1     
coop]ative1 association1 or o!r         
comm]cial entity t acquires1 ma9ta9s1   
/ores1 or utilizes p]sonal in=mation4   
7,b7 ,exemptions ,! t]m cov]$ entity    
does n include ! foll[+3  7i7 ,f9ancial 
in/itutions subject to title ,v ( !     
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq474  7ii7 ,an entity cov]$ 
by ! regulations issu$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7,public ,law #ajd-aia7 to ! ext5t
 t su* entity is subject to !           
requirem5ts ( su* regulations ) respect 
to protect$ heal? in=mation4  7#d7 ,data
 9 electronic =m ,! t]m data 9          
electronic =m means any data /or$       
electronically or digitally on any      
comput] sy/em or o!r database & includes
 recordable tapes & o!r mass /orage     
devices4  7#e7 ,designat$ entity ,! t]m 
designat$ entity means ! ,f$]al         
,gov]nm5t entity designat$ "u section   

#c7;a77#b77;,a74  7#f7 ,p]sonal         
in=mation  7,a7 ,9 g5]al ,! t]m p]sonal 
in=mation means an individual's fir/ "n 
or fir/ initial & la/ "n 9 comb9ation ) 
any "o or m ( ! foll[+ data elem5ts = t 
individual3  7i7 ,social ,security      
numb]4  7ii7 ,driv]'s lic5se numb]1     
passport numb]1 milit>y id5tification   
numb]1 or o!r simil> numb] issu$ on a   
gov]nm5t docum5t us$ to v]ify id5tity4  
7iii7 ,f9ancial acc\nt numb]1 or cr$it  
or debit c>d numb]1 & any requir$       
security code1 access code1 or password 
t is necess>y to p]mit access to an     
individual's f9ancial acc\nt4  7iv7     
,f$]al or ,/ate gov]nm5t issu$          
id5tification c>d4  7v7 ,a us]name or   
email address1 9 comb9ation ) a password
 or security "q & answ] t w\ld all[     
access to an onl9e acc\nt4  7vi7 ,m$ical
 in=mation1 includ+ ! m$ical hi/ory1    
m5tal or physical condition1 or m$ical  
treatm5t or diagnosis by a heal? c>e    
pr(essional ( ! individual4  7vii7      
,heal? insurance in=mation1 includ+ a   

heal? insurance policy numb] or         
subscrib] id5tification numb]1 any      
unique id5tifi] us$ by a heal? insur] to
 id5tify an individual1 or any in=mation
 9 a heal? insurance application or     
claim hi/ory fil$ by ! individual4      
7viii7 ,an individual taxpay]           
id5tification numb]4  7,b7 ,exclusions  
7i7 ,public record in=mation ,p]sonal   
in=mation does n include in=mation      
obta9$ ab\t an individual :i* has be5   
lawfully made publicly available by a   
,f$]al1 ,/ate1 or local gov]nm5t entity 
or widely di/ribut$ by m$ia4  7ii7      
,encrypt$1 r$act$1 or secur$ data       
,p]sonal in=mation does n include       
in=mation t is encrypt$1 r$act$1 or     
secur$ by any o!r me?od or te*nology t  
r5d]s ! data elem5ts unusable4  7#g7    
,s]vice provid] ,! t]m s]vice provid]   
means an entity t provides electronic   
data transmission1 r\t+1 int]m$iate1 &  
transi5t /orage1 or connections to its  
sy/em or network1 :]e su* entity provid+
 su* s]vices does n select or modify !  

cont5t ( ! electronic data1 is n ! s5d] 
or ! int5d$ recipi5t ( ! data1 & does n 
diff]5tiate p]sonal in=mation f o!r     
in=mation t su* entity transmits1 r\tes1
 /ores1 or = :i* su* entity provides    
connections4 ,any su* entity %all be    
treat$ z a s]vice provid] "u ?is ,act   
only to ! ext5t t x is engag$ 9 !       
provision ( su* transmission1 r\t+1     
int]m$iate & transi5t /orage1 or        
connections4  #h4 ,effect on o!r laws   
,?is ,act preempts any law1 rule1       
regulation1 requirem5t1 /&>d1 or o!r    
provision hav+ ! =ce & effect ( law (   
any ,/ate1 or political subdivision ( a 
,/ate1 relat+ to ! protection or        
security ( data 9 electronic =m conta9+ 
p]sonal in=mation or ! notification ( a 
brea* ( security4  #i4 ,effective date  
,?is ,act %all take effect on ! date t  
is #a ye> aft] ! date ( enactm5t ( ?is  
,act4